- dovecot - dovecot.org

Error: Mailbox INBOX: Transaction commit failed: FTS transaction commit failed: transaction context
by Graham Leggett 22 Oct '20

22 Oct '20

Hi all, While trying to reindex a large mailbox to take advantage of Apache Tika, dovecot logs the following message: Error: Mailbox INBOX: Transaction commit failed: FTS transaction commit failed: transaction context The message is vague in that a transaction has failed, but nowhere does it say what the transaction boundaries are. Did the transaction affect the indexing of one message, or many messages? Did the indexing of the whole mailbox get aborted and rolled back, or just a single message? A wide question. How do I ensure that my shiny new dovecot index gets completely reindexed? How do I know if dovecot is indexing just the new messages, and ignoring the existing messages? Regards, Graham —

1 0

Best prometheus exporter for Dovecot 2.3 with the new metrics/stats module
by Sidsel Jensen 22 Oct '20

22 Oct '20

Hi ppl. I am trying to locate the best prometheus exporter for use with Dovecot 2.3 in connection with the new metrics/stats module. Any pointers in the right direction will be appreciated - seems like there is a bunch out there which all works with the old stats module. Anybody have something “in the works” for 2.3 ? Kind Regards, Sidsel Jensen

2 1

Testing with imaptest to non existing folder makes imap service crash
by Marc Roos 22 Oct '20

22 Oct '20

FWIIW I had this message still in drafts /usr/bin/imaptest - append=100,0 logout=0 host=xxx port=143 user=xxx pass=xxx seed=100 secs=1 clients=1 mbox=64kb.mbox box=inbox/test msgs=100000 And inbox/test does not exist, results in: Fatal: master: service(imap): child 20282 killed with signal 11 (core dumped)

2 1

Understanding matches in sieve
by ＠lbutlr 22 Oct '20

22 Oct '20

RFC 5229 gives the following example: if address :matches ["To", "Cc"] ["coyote(a)**.com", "wile(a)**.com"] { # ${0} is the matching address # ${1} is always the empty string # ${2} is part of the domain name ("ACME.Example") fileinto "INBOX.business.${2}"; stop; And I do not understand why ${1} is always the empty string. In this example, ${1} is the part before the < so using ${2} makes sense. if header :matches "List-ID" "*<*@*" { fileinto "INBOX.lists.${2}"; stop; } I am laso not sure why the first example used **.com instead of *.com (or is that the reason $1 doesn't contain anything because it is the first * of **?). If so, my familiarity with the bash syntax for ** may have been my undoing. If I had # Given to kremels(a)kreme.com if address :matches ["To", "Cc"] ["*(a)*.*"] # ${1} would contain "kremels" # ${2} would contain "kreme" # ${3} would contain "com" Yes? -- "Are you pondering what I'm pondering?" "Sure, Brain, but how are we going to find chaps our size?"

2 2

Users unable to login
by jesus san miguel 22 Oct '20

22 Oct '20

I have certain power users who can't login through POP3 or IMAP from their computer while being receiving mail on their cell phones (pop3), despite pop3_lock_session = no Am I hitting some other limit? I don't see any error in dovecot.log but a generic failed login: Oct 21 10:31:44 imap-login: Info: Disconnected (auth failed, 1 attempts in 2 secs): user=<someuser(a)somedomain.com>, method=DIGEST-MD5, rip=::1, lip=::1, secured, session=<XSVQLSqy2IYAAAAAAAAAAAAAAAAAAAAB> Running version is 2.3.11.3

4 8

Restrictions on default.sieve
by ＠lbutlr 21 Oct '20

21 Oct '20

Are there actions that default.sieve cannot take? I tried adding redirect :copy "backup+foo(a)local.example.com" and… nothing. No errors I can find, but also no mail being redirected. I also tried # there must be 'from' in the received headers if header :contains "received" "from" { redirect :copy "backup+foo(a)local.example.com" } And if header :index 1 :contains "received" "from" { redirect :copy "backup+foo(a)local.example.com" } But still, no mail in .foo for the backup user (yes, dovecot is setup to autofile +address into mailboxes, and that works). -- You couldn't say, 'I had orders.' You couldn't say, 'It's not fair.' No one was listening. There were no Words. You owned yourself. ... Not Thou Shalt Not. Say I Will Not. --Feet of Clay

2 3

A user's last access time
by Victor Sudakov 21 Oct '20

21 Oct '20

Dear Colleagues, Is there a file or directory within a user's Maildir, whose date of modification or access indicates the last time the user accessed his/her E-mail via IMAP or POP3? I'd like to figure out the time a user last logged in into his/her mail account, not the last time a mail was delivered to the INBOX. This information is probably available in the log, but a file which is touched each time a user accesses his/her mail, is more convenient. -- Victor Sudakov, VAS4-RIPE, VAS47-RIPN 2:5005/49@fidonet http://vas.tomsk.ru/

7 13

Corrupted dbox file + assertion failure
by tim＠linux-daus.de 21 Oct '20

21 Oct '20

Hi all, a dsync failed due a corrupted mdbox file. Force-resync throws the same error. (Dovecot 2.3.9.2) Is there any change to fix/repair the file? dsync-local(LOCALPART(a)DOMAIN.TLD)<MBF5EUC8j1/FfQAAkqONGQ>: Warning: fscking index file /var/mail/12/DOMAIN.TLD/242/LOCALPART/mdbox/storage/dovecot.map.index dsync-local(LOCALPART(a)DOMAIN.TLD)<MBF5EUC8j1/FfQAAkqONGQ>: Warning: mdbox /var/mail/12/DOMAIN.TLD/242/LOCALPART/mdbox/storage: rebuilding indexes dsync-local(LOCALPART(a)DOMAIN.TLD)<MBF5EUC8j1/FfQAAkqONGQ>: Error: Corrupted dbox file /var/mail/12/DOMAIN.TLD/242/LOCALPART/mdbox/storage/m.6 (around offset=5191109): msg header has bad magic value dsync-local(LOCALPART(a)DOMAIN.TLD)<MBF5EUC8j1/FfQAAkqONGQ>: Panic: file dbox-file-fix.c: line 219 (dbox_file_find_next_magic): assertion failed: (ret == -1) dsync-local(LOCALPART(a)DOMAIN.TLD)<MBF5EUC8j1/FfQAAkqONGQ>: Error: Raw backtrace: #0 t_askpass[0x7fbf4218b5f0] -> #1 backtrace_append[0x7fbf4218b860] -> #2 backtrace_get[0x7fbf4218b9c0] -> #3 i_syslog_error_handler[0x7fbf42196840] -> #4 default_fatal_handler[0x7fbf42196910] -> #5 i_fatal[0x7fbf420ec3b7] -> #6 dbox_attachment_file_get_stream[0x7fbf424c1010] -> #7 dbox_file_fix[0x7fbf424c1540] -> #8 mdbox_get_setting_parser_info[0x7fbf424b9290] -> #9 mdbox_storage_rebuild_in_context[0x7fbf424b99a0] -> #10 mdbox_sync_begin[0x7fbf424bbd00] -> #11 mdbox_sync[0x7fbf424bc730] -> #12 mdbox_storage_sync_init[0x7fbf424bc7f0] -> #13 mailbox_sync_init[0x7fbf4249ee80] -> #14 mailbox_sync[0x7fbf4249ef70] -> #15 dsync_brain_master_send_mailbox[0x55d6521dcaa0] -> #16 dsync_brain_run[0x55d6521daae0] -> #17 dsync_brain_run[0x55d6521db360] -> #18 dsync_ibc_has_pending_data[0x55d6521f0840] -> #19 io_loop_call_io[0x7fbf421b0490] -> #20 io_loop_handler_run_internal[0x7fbf421b1e20] -> #21 io_loop_handler_run[0x7fbf421b05c0] -> #22 io_loop_run[0x7fbf421b0810] -> #23 who_line_filter_match[0x55d6521bfa00] -> #24 doveadm_dsync_main[0x55d6521c2280] -> #25 doveadm_mail_single_user[0x55d6521c3090] -> #26 doveadm_mail_try_run[0x55d6521c3900] -> #27 main[0x55d6521b2030] -> #28 __libc_start_main[0x7fbf417c61f0] -> #29 _start[0x55d6521b2670] -> #30 [no start/end information] Regards, Tim

2 1

doveadm http api hign performance?
by hfh＠cndns.com 21 Oct '20

21 Oct '20

Does doveadm http api have high execution efficiency? I have a program that directly calls doveadm http api. Will there be an efficiency problem if a large number of users call it? hfh(a)cndns.com

1 0

How to move/reorganise existing e-mails to yearly subfolders
by R. Diez 21 Oct '20

21 Oct '20

Hi all: I am new to e-mail servers and I am evaluating Dovecot. Not really the best combination. 8-) I am trying to find a balance between legal data retention requirements and online mailbox size. I do not want huge online mailboxes, as doing offline, rotating data backups could then take forever (among other reasons). I would rather avoid online (cloud) backups (data protection etc.). If I set a mailbox size limit, users will have to delete old mails by themselves. Or I could somehow script the deletion of attachments from old e-mails, as attachments are usually the main cause of huge mailboxes. Incidentally, can anyone point me to an easy way to achieve this? Preferably over with IMAP, otherwise with Dovecot tools. With regards to legal data retention (which I am no expert about either), I thought I could use some Postfix BCC feature I heard about in order to copy all incoming and outgoing e-mails to a single "data retention" mailbox. Or maybe several of them. I could then archive e-mails from that mailbox on a yearly basis. I would like to automatically organise e-mails inside that mailbox into subfolders like this: 2019/alice 2019/bob 2020/alice 2020/bob That is: [year]/[username] With such a folder structure, it is easier to see what is going on. Is there a tool that can reorganise existing e-mails into such a folder structure? I found some tools on the Internet to backup and export mails from IMAP to IMAP or maildir destinations. But I could not find a tool that just reorganises (moves) e-mails in such a manner inside an existing mailbox, maybe with a user-defined pattern for the destination folders. I guess moving e-mails around on the same mailbox would be much faster than exporting and reimporting them in some clever way. I could always write a Perl script, but that takes time. Such a tool may already exist. Or perhaps somebody could mention a similar, good-written script I can use as a starting point. I am sure there are many small gotchas to avoid. At the moment, I am only confident with Perl and Java. Maybe JavaScript. It would be best to reorganise the e-mails over IMAP. This way, I am independent of the e-mail server. But a Dovecot-specific solution would also be helpful. I could use such a reorganisation tool not just for archiving or data retention purposes, but to reorganise other mailboxes too, like my personal mailbox. I would rather have a script. Clicking around in Thunderbird does not scale. I have seen that you can use a "sieve" in Dovecot to achieve this. But I guess that would only apply to new e-mails. And that would probably apply just to incoming mails, and not to outgoing ones. If I migrate from the existing e-mail servers, the e-mails will probably be mass-imported without going through any "sieve", right? Besides, I already have a few huge mailboxes with many years of e-mails, stored in a different e-mail server, and it would be nice to be able to reorganise them as they are. That way, I could archive the existing older e-mails before migrating to Dovecot, which would reduce the disk size and the export/import time for the migration. Many thanks in advance, rdiez

4 5

modify dovecot user/pass_queries to deliver to local aliases via dovecot submission, with postfixadmin/sqlite3 tables?
by PGNet Dev 21 Oct '20

21 Oct '20

I run dovecot + postfix with postfixadmin/sqlite3 I'm set up for all/only virtual users. All outbound mail submits via dovecot submission port. My current dovecot pass/user db queries are password_query = \ SELECT \ username as user, \ password, \ '/data/vmail/%d/%n/Maildir' as userdb_home, \ 5000 as userdb_uid, \ 5000 as userdb_gid \ FROM mailbox WHERE username = '%u' AND active = '1' user_query = \ SELECT \ '/data/vmail/%d/%n/Maildir' as home, \ 5000 AS uid, \ 5000 AS gid, \ ('dirsize:storage=' || quota) AS quota \ FROM mailbox WHERE username = '%u' AND active = '1' It works perfectly for real addresses. I've setup an alias address, e.g. REAL: realuser(a)example.com ALIAS: aliasuser(a)example.com INBOUND email to the ALIAS address -- from the 'net, delivered from postfix via LMTP to dovecot backend -- works fine. BUT any/all mail from local users TO the ALIAS addr fail at userDB lookup 2020-10-20 12:26:54 lmtp(aliasuser(a)example.com)<rI49JP45j19D8QAA+IOfAw>: Debug: auth-master: userdb lookup(aliasuser(a)example.com): auth USER input: 2020-10-20 12:26:54 lmtp(aliasuser(a)example.com)<rI49JP45j19D8QAA+IOfAw>: Debug: auth-master: userdb lookup(aliasuser(a)example.com): Userdb lookup failed What mods are required to the password_query &/or user_query in order to FIX the local->aliasuser mail lookup and delivery ... and ideally not break the rest of delivery?

1 1

lib22_push_notification_lua_plugin.so: undefined symbol: dlua_dovecot_register
by Mrinal Sharma 20 Oct '20

20 Oct '20

I am trying to use Lua Notification plugin for Event push But saw this error. Can anyone help me on this issue. Error In the logs when I receive an Email is given below. ========================================== Oct 15 21:55:41 master: Info: Dovecot v2.3.11.3 (502c39af9) starting up for imap, lmtp Oct 15 21:56:51 lmtp(36): Fatal: Couldn't load required plugin /usr/lib/dovecot/modules/lib22_push_notification_lua_plugin.so: dlopen() failed: /usr/lib/dovecot/modules/lib22_push_notification_lua_plugin.so: undefined symbol: dlua_dovecot_register ====================================================================== # dovecot -n # 2.3.11.3 (502c39af9): /etc/dovecot/dovecot.conf # OS: Linux 4.19.128-microsoft-standard x86_64 Debian 10.6 9p # Hostname: 238afcc76ba9 auth_debug = yes auth_mechanisms = plain oauthbearer xoauth2 auth_verbose = yes disable_plaintext_auth = no doveadm_password = # hidden, use -P to show it log_path = /dev/stdout mail_debug = yes mail_location = maildir:/data/imap_store/%n mail_plugins = " quota" namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Greeting { auto = create } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { auto = no special_use = \Trash } prefix = } passdb { driver = pam } passdb { args = /etc/dovecot/dovecot-oauth2.plain.conf.ext driver = oauth2 mechanisms = plain login } plugin { push_lua_url = http://localhost:5678/mailnotify push_notification_driver = lua:file=/notify.lua quota = maildir:User quota quota_rule = *:storage=5MB quota_status_nouser = DUNNO quota_status_overquota = 552 5.2.2 Mailbox is full quota_status_success = DUNNO } protocols = imap lmtp service doveadm { inet_listener http { port = 80 } } service health-check { executable = script -p health-check.sh inet_listener health-check { port = 5001 } } service lmtp { inet_listener lmtp { address = * port = 24 } process_min_avail = 5 } ssl = no userdb { driver = passwd } userdb { args = /etc/dovecot/dovecot-sql.conf.ext driver = sql } protocol lmtp { mail_plugins = " quota quota notify push_notification push_notification_lua" postmaster_address = postmaster@domainname } protocol lda { mail_plugins = " quota notify push_notification" } protocol imap { imap_metadata = yes mail_plugins = " quota imap_quota quota" }

2 4

Problem with LDAP-query (Active Directory) on filter by memberOf
by Luca Bertoncello 20 Oct '20

20 Oct '20

Hi list! We have a Dovecot 2.3.4 (from Debian 10 repository) that should connect to our AD to authenticate the users. It works, but now we would like to restrict using IMAP to all users in the Group "Funktion - E-Mail-Konto". So I changed the query from: (&(sAMAccountName=%n)(objectClass=user)(homeMDB=*)) to (&(sAMAccountName=%n)(objectClass=user)(homeMDB=*)(memberOf=CN=Funktion - E-Mail-Konto,OU=Funktionen,OU=People,DC=ad,DC=company,DC=org)) The baseDN is DC=ad,DC=company,DC=org With ldapsearch I can get all users and their attributes, but Dovecot fail with this error: Oct 20 15:57:10 mailgw02 dovecot: auth: Error: ldap(testuser,80.187.107.28,<eLf0mhqyLwlQu2sc>): ldap_search(base=dc=ad,dc=company,dc=org filter=(&(samAccountName=testuser)(objectClass=user)(homeMDB=*)(memberOf=CN=Funktion - E-Mail-Konto,OU=Funktionen,OU=People,DC=ad,DC=company,DC=org))) failed: Operations error I didn't found any explanation for this error... Can someone help me? The user used for the connection is the same in Dovecot and ldapsearch. Thanks a lot Luca Bertoncello (lucabert(a)lucabert.de)

1 0

Dovecot docker auto-responder - delegate to external SMTP
by Thomas Pronold 19 Oct '20

19 Oct '20

Hi all, I have dockerized my dovecot setup. Everything works fine besides auto-responder using sieve. Issue is that the my dovecot docker image does NOT come with a SMTP which could be used for outgoing mail. My SMTP setup (postfix) is in another image/container. I want to keep it that way, so that dovecot and postfix have separate images. So basically I have 2 containers running in the same internal network: a) dovecot IP 192.168.10.11 b) postfix IP 192.168.10.22 How do I have to configure dovecot so that it delegates all outgoing (autoresponder) mails to the SMTP on IP 192.168.10.22. The postfix image is configured in a way that certain IPs are allowed to send mails without authentication. So on postfix side I am set. Currently I did a quickfix: I added postfix to dovecot image and configured postfix to use the relayhost 192.168.10.22 for mailing. This works, still I would prefer having the dovecot image not containing an postfix SMTP. Thanks Tom

4 3

Unable to access mail via Outlook
by Odhiambo Washington 19 Oct '20

19 Oct '20

Hola, Dovecot- 2.3.11.3 with mdbox. I have a situation where I can access (view) the e-mails when I use a web-based IMAP client, but NOT M$ Outlook (configured for IMAP). Is there an easy way to solve this? When I send an e-mail to the mailbox address, I can see it on the webmail, but not on Outlook. -- Best regards, Odhiambo WASHINGTON, Nairobi,KE +254 7 3200 0004/+254 7 2274 3223 "Oh, the cruft.", grep ^[^#] :-)

4 13

Using NFS to extend local email storage
by Maciej Kokociński 19 Oct '20

19 Oct '20

We are running our IMAP mail server on a VPS in the cloud (dovecot+exim+horde webmail), and we are using our on-premises NAS for daily backups through custom rsync scripts (which work well with maildir). There is a lot of storage available on the NAS, while not so much on the VPS. Since, we often get downtime on-premises due to power outages we cannot move the mail server on-premises (though the outages do not interfere too much with the backups). Additional storage in the cloud is at a premium as we would like to avoid further increasing costs. Now, my idea is to set up an NFS volume on the NAS, and configure the cloud-based server as the client. I would like to store only the most recent emails on the main server, and keep the whole data set on the NAS. Naturally I have read the dovecot wiki concerning NFS, and I have browsed this mailing list's archive for answers, but I still have many concerns. Ideally, I would like to use as much storage as possible from the main server, so that only really old emails need to be fetched over the network if requested over IMAP. Also I would like the search function to work regardless whether the NAS is available or not. I wonder if anybody tried a similar configuration before. My concerns are: - should I use NFS volume directly and configure FS-Cache, or should I configure a cache volume separately using e.g. bcache or some other tool? - how to configure the cache to keep as many files and metadata locally? - is it possible to fine tune the cache so it always keeps all the newly created/modified files locally? - is it possible to tune the cache so it keeps at least n files for each user (each maildir)? - will it work fine if I put NFS traffic into an ssh tunnel for security? - will dovecot freeze/crash when the NFS volume disconnects or is temporarily unavailable, what will actually happen in such circumstances? - will the search function work when the NFS volume is unavailable? (I also plan to use solr in the future) - what happens when the main server crashes and then recovers from the NFS share? is the share guaranteed to be consistent? I hope that I have not asked too many questions for a single message... ;) I would really appreciate any help, because I am rather a newbie in dovecot administration, and it overwhelms me. Perhaps, what I am trying to achieve is not the way to go. I am open to suggestions. Best regards, Maciej

4 3

Strange permissions error - Failed to stat sieve storage path
by Graham Leggett 18 Oct '20

18 Oct '20

Hi all I have dovecot-lda set up to run as vmail:vmail, with some sieve scripts in /var/lib/dovecot/sieve. The sieve scripts fail to be found with the following (detailed and very helpful) error message: Oct 14 16:13:33 gatekeeper dovecot[8109]: lda(minfrin(a)example.com)<8109><ZJ9nMo0Hh1+tHwAAKdTwig>: Error: sieve: file storage: Failed to stat sieve storage path: stat(/var/lib/dovecot/sieve/vacation.sieve) failed: Permission denied (euid=387(vmail) egid=387(vmail) missing +x perm: /var/lib/dovecot, we're not in group 97(dovecot), dir owned by 97:97 mode=0750) In this case, the user vmail is a member of the dovecot group: [root@gatekeeper dovecot]# cat /etc/group | grep vmail mail:x:12:postfix,vmail,opendmarc,opendkim,openarc dovecot:x:97:vmail vmail:x:387: [root@gatekeeper dovecot]# sudo su - vmail Last login: Wed Oct 14 16:15:48 SAST 2020 on pts/0 [vmail@gatekeeper ~]$ wc -c /var/lib/dovecot/sieve/vacation.svbin 530 /var/lib/dovecot/sieve/vacation.svbin Does dovecot-lda do anything odd with respect to group memberships? Regards, Graham —

2 1

Problem reading SSL key
by Tech Support 18 Oct '20

18 Oct '20

All; I'm trying to setup dovecot to use SSL, but I'm getting an error message in the logs. I'm getting the error imap-login: Fatal: Couldn't parse private ssl_key. I'm using a commercial cert so I know that the .crt and .key files themselves are not the problem. I have them configured like so: ssl_cert = </etc/pki/tls/certs/mail_acmewidgets_net.crt ssl_key = </etc/pki/tls/private/mail_acmewidgets_net.key The crt is mode 444 and the key is mode 400. Since the log is not giving any other information, I don't know what the problem is. Any insight at all would be greatly appreciated. Thanks; Frank

2 1

backup of namespace, is still looking at (touching?) other namespace?
by Marc Roos 17 Oct '20

17 Oct '20

When I am doing this: doveadm backup -f -n inbox -F /root/backup-accounts.txt tcp:mailxx.local:542 I am getting an error on the distributed storage, which I exactly did not wanted to be touched. doveadm(testaccount): Error: remote(mailxx.local:542): User initialization failed: Namespace 'Archive/': stat(/home/mail-archive/testaccount/Archive/mailboxes) failed: Permission denied (euid=xxx(testaccount) egid=xx(xxxxx) missing +x perm: /home/mail-archive, dir owned by 0:0 mode=0700) doveadm(testaccount): Error: remote(mailxx.local:542): dsync-server: User init failed doveadm(testaccount): Error: Failed to start remote dsync-server command: Remote exit_code=75

1 0

how to set smtp-client -> submission_relay_host for IPv4 only?
by PGNet Dev 16 Oct '20

16 Oct '20

In dovecot conf, for submission relay, I've config'd submission_relay_host = lan.example.com submission_relay_port = 465 hostname -- not IP -- must be used, to inform relay for cert verification match. Here, host lan.example.com lan.example.com has address 10.0.1.47 lan.example.com has IPv6 address fd80:25:01::47 The receiving smtp relay listens only on IPv4 -- no IPv6 service, telnet 10.0.1.47 465 Trying 10.0.1.47... Connected to 10.0.1.47. Escape character is '^]'. telnet -6 fd80:25:01::47 465 Trying fd80:25:01::47... telnet: connect to address fd80:25:01::47: Connection refused On the lan, all boxes are set, in "/etc/gai.conf", for IPv6 to take precedence over IPv4. On submission to dovecot submission port, after login/auth, dovecot smtp-client subsequently connects to the relay lan.example.com:465 IPv6 1st, & fails 2020-10-15 12:51:45 submission(mua(a)example.com)<8OJP+rqxuvho7Z95>: Error: smtp-client: conn lan.example.com:465 ([fd80:25:01::47]:465) [1]: connect(lan.example.com:465) failed: Connection refused then falls back to IPv4, and continues OK 2020-10-15 12:51:45 submission(mua(a)example.com)<8OJP+rqxuvho7Z95>: Info: Successfully relayed message: from=<test(a)remote.example.com>, size=84, id=LMe...Aw, nrcpt=1, reply=`247 2.0.0 Ok: queued as 4CC0KY1wXNzWf93' not fatal, but wasted effort, and noise in the logs. how/where do I configure (just) the dovecot smtp-client -> submission_relay_host to only connect IPv4?

3 4

Dovecot won't accept IMAP TLS 1 connections from older devices [SOLVED]
by Brian Martin 16 Oct '20

16 Oct '20

I've spent days scouring the Internet and trying various solutions on a problem with my Dovecot installation, so I thought I'd share what I learned in hopes of saving other people a lot of time. The dedicated Dovecot hands will know all of the following already. This is for those of us that have to cover a lot of bases. I upgraded my mail server from Ubuntu 18.04.1 to Ubuntu 20.04.1, and found that older Mac-books and iPads (and probably other devices) could no longer establish IMAP connections to Dovecot. Dovecot logged: SSL routines:tls_early_post_process_client_hello:unsupported protocol and TCP/IP traces showed that it dropped the connection after the client's initial HELLO. I tested what kinds of connections Dovecot would accept with (for example): openssl s_client -tls1_1 -connect localhost:993 # Test whether TLSv1.1 is accepted - received "unsupported protocol" message. Searching showed that Dovecot has a parameter "ssl_min_protocol", which is documented as defaulting to TLSv1. Nevertheless I explicitly set it to TLSv1 with no effect. This was a red herring. I spent a long time looking to see if Dovecot had a bug in handling this newish parameter, etc. Eventually I came across one posting regarding a web server, that told me the OpenSSL libraries that Dovecot and lots of other packages use has a single configuration file for the entire system. In Ubuntu 20.04 it defaults to requiring TLSv1.2 or above. Changing the configuration for OpenSSL affects everything on the system using the library. I changed the file, restarted Dovecot, and it immediately accepted TLSv1 connections. Obviously I'd prefer to maintain the improved security of TLSv1.2, but in my case it was better to continue providing mail service at a lower security level than to deny service to some users until they upgraded their personal devices. You'll need to make your on decision on that score. The file to change is (on Ubuntu, at least) /usr/lib/ssl/openssl.cnf. The change consists of adding a line of code in the initial section that invokes several new sections later: In the initial section I added: openssl_conf = default_conf Then at the bottom of the file I added: [default_conf] ssl_conf = ssl_sect [ssl_sect] system_default = system_default_sect [system_default_sect] MinProtocol = TLSv1 CipherString = DEFAULT@SECLEVEL=1 There is an alternative approach that I have read of but not tested. Basically you can create a new file elsewhere with the customized content, and then set an environmental variable (OPENSSL_CONF) just before launching Dovecot that points to your new file. This way, only Dovecot is using downgraded security. Since my mail server is a dedicated system and I didn't want to muck with the Dovecot start-up environment, I didn't feel the need to go that route. So all my digging into why Dovecot wouldn't accept TLSv1 connections and how to change it were completely on the wrong path. It would be nice if Dovecot could log a message when its ssl_min_protocol is set lower than what OpenSSL will accept, but Dovecot may not be able to tell what OpenSSL is doing. In any case, those are the symptoms, the real problem, and how to fix it. Good luck, and thanks to Matt Caswell for posting the answer that I eventually found. Ref: https://askubuntu.com/questions/1233186/ubuntu-20-04-how-to-set-lower-ssl-s…

3 2

Auro expunge
by ＠lbutlr 15 Oct '20

15 Oct '20

When using autoexpunge = 14 days in, for example. The trash of junk folders, does that physically remove the messages from disk or simply mark them to be removed and some other action needs to be taken? I ask because my mail server crapped out today and I discovered a Junk folder with 490,000 messages in it, and the sa-spamd and mariadb processes died a horrible death. Haven't had time to track down what was going on, but there were definitely messages in that junk folder from 2019 (though, of course, they may have been added within the last 14 days, I can't verify that as my solution was to remove the folder and recreate a new empty maildir). -- I don't believe there's a power in the 'verse can stop Kaylee from bein' cheerful. Sometimes you just wanna duct-tape her mouth and dump her in the hold for a month.

5 5

RE: dovecot Digest, Vol 210, Issue 27
by webadmin＠exalt.com.au 15 Oct '20

15 Oct '20

I am investigating whether dovecot(https://github.com/dovecot/core/) handles case insensitive Message-ID headers as per RFC. I can't raise a support issue with cPanel team (https://tickets.cpanel.net/review/login.cgi) as that needs an paid account with them. There may be an issue with the CPANEL/WHM DKIM module. Is the source code online? Rob

3 2

How do I enable sieve trace debugging?
by Graham Leggett 14 Oct '20

14 Oct '20

Hi all, I want to enable trace debugging for sieve. Most specifically, I want to know what sieve scripts are running, and whether they’re doing anything. I cannot get anything other than dead silence from dovecot with respect to sieve. I have tried the same as asked in this question: https://unix.stackexchange.com/questions/550618/dovecot-sieve-trace-does-no… In my case, the config looks like this: ## TRACE DEBUGGING # Trace debugging provides detailed insight in the operations performed by # the Sieve script. These settings apply to both the LDA Sieve plugin and the # IMAPSIEVE plugin. # # WARNING: On a busy server, this functionality can quickly fill up the trace # directory with a lot of trace files. Enable this only temporarily and as # selective as possible. # The directory where trace files are written. Trace debugging is disabled if # this setting is not configured or if the directory does not exist. If the # path is relative or it starts with "~/" it is interpreted relative to the # current user's home directory. sieve_trace_dir = /tmp/sieve-trace # The verbosity level of the trace messages. Trace debugging is disabled if # this setting is not configured. Possible values are: # # "actions" - Only print executed action commands, like keep, # fileinto, reject and redirect. # "commands" - Print any executed command, excluding test commands. # "tests" - Print all executed commands and performed tests. # "matching" - Print all executed commands, performed tests and the # values matched in those tests. sieve_trace_level = actions,command,tests,matching # Enables highly verbose debugging messages that are usually only useful for # developers. sieve_trace_debug = yes This looks sensible, syslog would be a great place to log, but nothing related to sieve appears. [root@gatekeeper dovecot]# doveadm log find Looking for log files from /var/log Debug: /var/log/maillog Info: /var/log/maillog Warning: /var/log/maillog Error: /var/log/maillog Fatal: /var/log/maillog Regards, Graham —

3 3

Changing IMAP separator - does it break things?
by Victor Sudakov 14 Oct '20

14 Oct '20

Dear Colleagues, I am using Dovecot 2.3.4.1 with maildirs. Just found out that MacOS Mail clients cannot work with nested folders, presumably because the MacOS Mail does not understand "." as the IMAP separator. Other clients (ThunderBird, Sylpheed, mutt) work fine. Do you think I can change the hierarchy separator in the "inbox" namespace without breaking other clients and the mail layout on disk, losing mail etc? I don't want to break mail for 50 people just to please one Mac Mail user. The users are advanced developers actively using mail sorting rules, nested folders etc. My `doveconf -n` is here: https://termbin.com/w1wd -- Victor Sudakov, VAS4-RIPE, VAS47-RIPN 2:5005/49@fidonet http://vas.tomsk.ru/

5 20