- dovecot - dovecot.org

dict host param and fqdn
by Stéphane Cottin 15 Nov '17

15 Nov '17

Hi, I would like to use a fqdn instead of an IP address as redis host quota_clone_dict = redis:host=redis.host.name:port=6379 But only ip adresses are supported Error: quota_clone_dict: Failed to initialize 'redis:host=redis.host.name:port=6379': dict redis: Invalid IP: redis.host.name Why is name resolution not implemented here ? Is it for performance considerations ? Stéphane

1 0

Building dovecot 2.2.33.2 is broken with uclibc-ng
by Bernd Kuhls 14 Nov '17

14 Nov '17

Hi, this commit https://github.com/dovecot/core/commit/c9d76e2baf653fa5504d6849e5c1aae32eff… added code which can not be compiled with uclibc-ng 1.0.26 using buildroot: make[3]: Entering directory '/home/bernd/buildroot/br4/output/build/dovecot-2.2.33.2/src/lib-test' /bin/bash ../../libtool --tag=CC --mode=compile /home/bernd/buildroot/br4/output/host/bin/i586-buildroot-linux-uclibc-gcc -DHAVE_CONFIG_H -I. -I../.. -I../../src/lib -I../../src/lib-charset -D_LARGEFILE_SOURCE -D_LARGEFILE64_SOURCE -D_FILE_OFFSET_BITS=64 -std=gnu99 -D_LARGEFILE_SOURCE -D_LARGEFILE64_SOURCE -D_FILE_OFFSET_BITS=64 -Os -Wall -W -Wmissing-prototypes -Wmissing-declarations -Wpointer-arith -Wchar-subscripts -Wformat=2 -Wbad-function-cast -fno-builtin-strftime -Wstrict-aliasing=2 -I/home/bernd/buildroot/br4/output/host/i586-buildroot-linux-uclibc/sysroot/usr/include -c -o test-common.lo test-common.c libtool: compile: /home/bernd/buildroot/br4/output/host/bin/i586-buildroot-linux-uclibc-gcc -DHAVE_CONFIG_H -I. -I../.. -I../../src/lib -I../../src/lib-charset -D_LARGEFILE_SOURCE -D_LARGEFILE64_SOURCE -D_FILE_OFFSET_BITS=64 -std=gnu99 -D_LARGEFILE_SOURCE -D_LARGEFILE64_SOURCE -D_FILE_OFFSET_BITS=64 -Os -Wall -W -Wmissing-prototypes -Wmissing-declarations -Wpointer-arith -Wchar-subscripts -Wformat=2 -Wbad-function-cast -fno-builtin-strftime -Wstrict-aliasing=2 -I/home/bernd/buildroot/br4/output/host/i586-buildroot-linux-uclibc/sysroot/usr/include -c test-common.c -fPIC -DPIC -o .libs/test-common.o In file included from /home/bernd/buildroot/br4/output/host/i586-buildroot-linux-uclibc/sysroot/usr/include/bits/byteswap-common.h:34:0, from /home/bernd/buildroot/br4/output/host/i586-buildroot-linux-uclibc/sysroot/usr/include/bits/byteswap.h:55, from /home/bernd/buildroot/br4/output/host/i586-buildroot-linux-uclibc/sysroot/usr/include/byteswap.h:22, from /home/bernd/buildroot/br4/output/host/i586-buildroot-linux-uclibc/sysroot/usr/include/endian.h:59, from /home/bernd/buildroot/br4/output/host/i586-buildroot-linux-uclibc/sysroot/usr/include/bits/waitstatus.h:72, from /home/bernd/buildroot/br4/output/host/i586-buildroot-linux-uclibc/sysroot/usr/include/stdlib.h:41, from ../../src/lib/lib.h:11, from test-common.c:3: ../../src/lib/byteorder.h:32:24: error: expected identifier or '(' before '__extension__' static inline uint16_t bswap_16(uint16_t in); ^ In file included from /home/bernd/buildroot/br4/output/host/i586-buildroot-linux-uclibc/sysroot/usr/include/endian.h:59:0, from /home/bernd/buildroot/br4/output/host/i586-buildroot-linux-uclibc/sysroot/usr/include/bits/waitstatus.h:72, from /home/bernd/buildroot/br4/output/host/i586-buildroot-linux-uclibc/sysroot/usr/include/stdlib.h:41, from ../../src/lib/lib.h:11, from test-common.c:3: ../../src/lib/byteorder.h:92:24: error: redefinition of '__bswap_64' static inline uint64_t bswap_64(uint64_t in) ^ In file included from /home/bernd/buildroot/br4/output/host/i586-buildroot-linux-uclibc/sysroot/usr/include/bits/byteswap.h:55:0, from /home/bernd/buildroot/br4/output/host/i586-buildroot-linux-uclibc/sysroot/usr/include/byteswap.h:22, from /home/bernd/buildroot/br4/output/host/i586-buildroot-linux-uclibc/sysroot/usr/include/endian.h:59, from /home/bernd/buildroot/br4/output/host/i586-buildroot-linux-uclibc/sysroot/usr/include/bits/waitstatus.h:72, from /home/bernd/buildroot/br4/output/host/i586-buildroot-linux-uclibc/sysroot/usr/include/stdlib.h:41, from ../../src/lib/lib.h:11, from test-common.c:3: /home/bernd/buildroot/br4/output/host/i586-buildroot-linux-uclibc/sysroot/usr/include/bits/byteswap-common.h:75:1: note: previous definition of '__bswap_64' was here __bswap_64 (__uint64_t __bsx) ^~~~~~~~~~ In file included from /home/bernd/buildroot/br4/output/host/i586-buildroot-linux-uclibc/sysroot/usr/include/endian.h:59:0, from /home/bernd/buildroot/br4/output/host/i586-buildroot-linux-uclibc/sysroot/usr/include/bits/waitstatus.h:72, from /home/bernd/buildroot/br4/output/host/i586-buildroot-linux-uclibc/sysroot/usr/include/stdlib.h:41, from ../../src/lib/lib.h:11, from test-common.c:3: ../../src/lib/byteorder.h:104:24: error: redefinition of '__bswap_32' static inline uint32_t bswap_32(uint32_t in) ^ In file included from /home/bernd/buildroot/br4/output/host/i586-buildroot-linux-uclibc/sysroot/usr/include/bits/byteswap.h:55:0, from /home/bernd/buildroot/br4/output/host/i586-buildroot-linux-uclibc/sysroot/usr/include/byteswap.h:22, from /home/bernd/buildroot/br4/output/host/i586-buildroot-linux-uclibc/sysroot/usr/include/endian.h:59, from /home/bernd/buildroot/br4/output/host/i586-buildroot-linux-uclibc/sysroot/usr/include/bits/waitstatus.h:72, from /home/bernd/buildroot/br4/output/host/i586-buildroot-linux-uclibc/sysroot/usr/include/stdlib.h:41, from ../../src/lib/lib.h:11, from test-common.c:3: /home/bernd/buildroot/br4/output/host/i586-buildroot-linux-uclibc/sysroot/usr/include/bits/byteswap-common.h:44:1: note: previous definition of '__bswap_32' was here __bswap_32 (unsigned int __bsx) ^~~~~~~~~~ In file included from /home/bernd/buildroot/br4/output/host/i586-buildroot-linux-uclibc/sysroot/usr/include/bits/byteswap-common.h:34:0, from /home/bernd/buildroot/br4/output/host/i586-buildroot-linux-uclibc/sysroot/usr/include/bits/byteswap.h:55, from /home/bernd/buildroot/br4/output/host/i586-buildroot-linux-uclibc/sysroot/usr/include/byteswap.h:22, from /home/bernd/buildroot/br4/output/host/i586-buildroot-linux-uclibc/sysroot/usr/include/endian.h:59, from /home/bernd/buildroot/br4/output/host/i586-buildroot-linux-uclibc/sysroot/usr/include/bits/waitstatus.h:72, from /home/bernd/buildroot/br4/output/host/i586-buildroot-linux-uclibc/sysroot/usr/include/stdlib.h:41, from ../../src/lib/lib.h:11, from test-common.c:3: ../../src/lib/byteorder.h:112:24: error: expected identifier or '(' before '__extension__' static inline uint16_t bswap_16(uint16_t in) ^ Makefile:491: recipe for target 'test-common.lo' failed To reproduce try something like this: $ git clone git://git.buildroot.net/buildroot $ cd buildroot $ echo "BR2_PACKAGE_DOVECOT=y" > dovecot.defconfig $ make defconfig BR2_DEFCONFIG=dovecot.defconfig Patch buildroot: diff --git a/package/dovecot/dovecot.hash b/package/dovecot/dovecot.hash index 184745b394..3dbc50739c 100644 --- a/package/dovecot/dovecot.hash +++ b/package/dovecot/dovecot.hash @@ -1,2 +1,2 @@ # Locally computed after checking signature -sha256 034be40907748128d65088a4f59789b2f99ae7b33a88974eae0b6a68ece376a1 dovecot-2.2.31.tar.gz +sha256 fe1e3b78609a56ee22fc209077e4b75348fa1bbd54c46f52bde2472a4c4cee84 dovecot-2.2.33.2.tar.gz diff --git a/package/dovecot/dovecot.mk b/package/dovecot/dovecot.mk index 4cc6ae4de7..25a78b9f78 100644 --- a/package/dovecot/dovecot.mk +++ b/package/dovecot/dovecot.mk @@ -5,7 +5,7 @@ ################################################################################ DOVECOT_VERSION_MAJOR = 2.2 -DOVECOT_VERSION = $(DOVECOT_VERSION_MAJOR).31 +DOVECOT_VERSION = $(DOVECOT_VERSION_MAJOR).33.2 DOVECOT_SITE = http://www.dovecot.org/releases/$(DOVECOT_VERSION_MAJOR) DOVECOT_INSTALL_STAGING = YES DOVECOT_LICENSE = LGPL-2.1 Start the build using "make dovecot" and get some coffee/tee ;) Regards, Bernd

2 3

Doubt about replacing alt storage disks
by Amol Kulkarni 14 Nov '17

14 Nov '17

Hello, I have a working setup of dovecot 2.2.19 on centos 6. The mailbox format is mdbox. I've configured primary and alt storage. Now I want to replace the disk of the alt storage only. Broadly my plan to change it is as follows : 1. Mount the new disk on a temporary server. 2. Rsync data only from alt storage to the new disk - while the original server is live. This may take a few days. In between altmove will happen on the live disk. 3. Once the basic rsync is complete, stop all services on the live server 4. Mount the new disk on live server, in addition to live disk 5. Do final rsync - with the delete option 6. Unmount the live disk and mount new disk in its place 7. Start services I've 2 doubts abt this plan : 1. I've tried the first part until step 2. After the first rsync, I found unexpected differences between the m.* files on the live and new disk. The new disk has some additional files for some users, which are not present on the live disk. Since the rsync was run without delete option, these files were not deleted from the new disk. Does altmove delete some m.* files to reorganize mail ? Can end user mail deletion cause deletion of m.* files ? 2. I'm worried about commonly occuring problems with such movement : duplicate mail download in pop / resync in imap / index corruption. Is there any way to check integrity of data before switching to the new disk ? Thanks in advance, Amol.

1 0

Re: IMAP connections with ".eml" in the username - bot attack.
by Joseph Tam 14 Nov '17

14 Nov '17

James Brown writes: > We are seeing lots of IMAP login attempts like this: > > dovecot[363]: imap-login: Disconnected (auth failed, 1 attempts in 6 secs): user=<xcentrex5fxnewx5fxyorkx5fxquotex5fxisx5fxreadyx2dxx2dx426453.eml>, method=PLAIN, rip=197.255.60.118, > dovecot[363]: imap-login: Disconnected (auth failed, 1 attempts in 6 secs): user=<xmatchingx5fxyourx5fxrecentx5fxvisitx5fxonx5fxx2dxx2dx121584.eml(a)bordo.com.au>, method=PLAIN, rip=37.235.28.229, > > etc. > Is anyone else experiencing this? How is such an attack is supposed to > ever succeed? What are they trying to accomplish? Haven't seen it. I agree with another poster -- probably a spammer screwed up their spamware configuration. > Any ideas on how to mitigate it? Mitigate what? Even by your account, this won't get them anywhere, unless it's so fast and heavy, it's DoS'ing your system. Other than that, they're just bloating your logs, nothing more. If you want to pre-empt this via firewall, you'll need to get extremely lucky to characterise these IPs (a sample of 2 is not enough) in such a way as to able to formulate a firewall rule. Mostly likely, this is a rented botnet. If you somehow figure out an oracular rule to discern bot from some user road-warrior *before* they connect, give me a call. Sean Greenslade <sean(a)seangreenslade.com> writes: > Here's a fun laugh I found in one of my webserver logs: > >> 1446098745 218.249.219.2 "GET http://www.sciencedirect.com/science/book/9780123525512" 400 425 "" "Mozilla/4.0 (compatible; MSIE 4.01; Windows 95)" > > Not my website, nothing even close to that url is hosted on that server. Common proxy target. They're testing whether your web server will support anonymous web proxying. Almost exclusively from China. Joseph Tam <jtam.home(a)gmail.com>

1 0

SMTP and IMAP authentication critically fails out of the blue
by Felix Plapper 14 Nov '17

14 Nov '17

Hello Community and first things First: dovecot --version2.2.9dovecot -n# 2.2.9: /etc/dovecot/dovecot.conf# OS: Linux 3.13.0-042stab125.5 x86_64 Ubuntu 14.04.5 LTSauth_mechanisms = plain logindict { sqlquota = mysql:/etc/dovecot/dovecot-dict-sql.conf}listen = *,[::]log_timestamp = "%Y-%m-%d %H:%M:%S "login_log_format_elements = user=<%u> method=%m rip=%r lip=%l mpid=%e %c %kmail_fsync = alwaysmail_home = /var/vmail/%d/%nmail_location = maildir:~/mail_nfs_index = yesmail_nfs_storage = yesmail_plugins = quota aclmanagesieve_notify_capability = mailtomanagesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date ihavemmap_disable = yesnamespace { list = yes location = maildir:%%h/:INDEXPVT=~/Shared/%%u prefix = Shared/%%u/ separator = / subscriptions = yes type = shared}namespace inbox { inbox = yes location = mailbox Archiv { special_use = \Archive } mailbox Archive { auto = subscribe special_use = \Archive } mailbox Archives { special_use = \Archive } mailbox "Deleted Messages" { special_use = \Trash } mailbox Drafts { auto = subscribe special_use = \Drafts } mailbox Entwürfe { special_use = \Drafts } mailbox "Gelöschte Objekte" { special_use = \Trash } mailbox Gesendet { special_use = \Sent } mailbox Junk { auto = subscribe special_use = \Junk } mailbox Papierkorb { special_use = \Trash } mailbox Sent { auto = subscribe special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { auto = subscribe special_use = \Trash } prefix = separator = /}passdb { args = /etc/dovecot/dovecot-mysql.conf driver = sql}plugin { acl = vfile acl_anyone = allow acl_shared_dict = file:/var/vmail/shared-mailboxes.db quota = dict:User quota::proxy::sqlquota quota_rule2 = Trash:storage=+100%% sieve = /var/vmail/sieve/%u.sieve sieve_after = /var/vmail/sieve/global.sieve sieve_max_script_size = 1M sieve_quota_max_scripts = 0 sieve_quota_max_storage = 0}protocols = imap sieve lmtp pop3service auth { unix_listener /var/spool/postfix/private/auth_dovecot { group = postfix mode = 0660 user = postfix } unix_listener auth-master { mode = 0600 user = vmail } unix_listener auth-userdb { mode = 0600 user = vmail } user = root}service dict { unix_listener dict { group = vmail mode = 0660 user = vmail }}service lmtp { unix_listener /var/spool/postfix/private/dovecot-lmtp { group = postfix mode = 0600 user = postfix } user = vmail}service managesieve-login { inet_listener sieve { port = 4190 } process_min_avail = 2 service_count = 1 vsz_limit = 128 M}service managesieve { process_limit = 256}ssl_cert = </etc/ssl/mail/mail.crtssl_cipher_list = EDH+CAMELLIA:EDH+aRSA:EECDH+aRSA+AESGCM:EECDH+aRSA+SHA384:EECDH+aRSA+SHA256:EECDH:+CAMELLIA256:+AES256:+CAMELLIA128:+AES128:+SSLv3:!aNULL:!eNULL:!LOW:!3DES:!MD5:!EXP:!PSK:!DSS:!RC4:!SEED:!ECDSA:CAMELLIA256-SHA:AES256-SHA:CAMELLIA128-SHA:AES128-SHAssl_dh_parameters_length = 2048ssl_key = </etc/ssl/mail/mail.keyssl_protocols = !SSLv3 !SSLv2userdb { args = /etc/dovecot/dovecot-mysql.conf driver = sql}protocol imap { mail_plugins = quota imap_quota imap_acl acl}protocol lmtp { auth_socket_path = /var/run/dovecot/auth-master mail_plugins = quota sieve acl postmaster_address = postmaster(a)domain1.com}protocol sieve { managesieve_logout_format = bytes=%i/%o}remote 127.0.0.1 { disable_plaintext_auth = no}########################################### Mail.errNov 13 23:59:06 webdev dovecot: auth: Error: PLAIN(account(a)domain2.com, XXX.XXX.XXX.XXX,<y869CoDETEST4dHk>): Request 29154.1 timed out after 150 secs, state=1########################################### Mail.logNov 13 23:27:54 webdev dovecot: auth: Error: LOGIN(account(a)domain1.com,IP.IP.IP.IP,<oN4ly+TestDZ6dHk>): Request 28118.1 timed out after 150 secs, state=1Nov 13 23:27:57 webdev dovecot: auth: Error: PLAIN( account(a)domain2.com,XXX.XXX.XXX.XXX,<FAxKe+JaatES7tHk>): Request 28120.1 timed out after 150 secs, state=1Nov 13 23:28:24 webdev dovecot: imap-login: Disconnected: Inactivity during authentication (disconnected while authenticating, waited 180 secs): user=<>, method=LOGIN, rip=ClientIP, lip=ServerIP, TLS: Disconnected, TLSv1.2 with cipher DHE-RSA-AES128-GCM-SHA256 (128/128 bits) [...]Nov 13 23:47:15 webdev dovecot: imap-login: Aborted login (no auth attempts in 0 secs): user=<>, rip=84.119.151.17, lip=62.75.185.32########################################### I did not change anything on my client nor serverside setup and i suddenly could not reach the Mailserver anymore. Obviously I can reach the Server using SSH or HTTP. I hope I provided all infos you need to help me in this situation. And am grateful for every hint to solve this Note: Older mailinglist threads did not help because a link which solved a similar case is not available anymore.plus I tried to make the given pieces of information structured using styles. Maybe it gets delivered,displayed and enhances the ease of reading.

2 1

Carbon_name path hardcoded
by Giordano Fechio (Giu) 13 Nov '17

13 Nov '17

Hello, I am setting up the imap_stats for dovecot and stumb up on a problem with carbon_name setup. const char *prefix = t_strdup_printf("dovecot.%s.global”, But I need to setup the path myself so my index cam be compliant to the index I already have. Wonder if changing it to something like the following so other users have a way to configure their own path or use the default in case they don’t want to worry about that. string_t *str = t_str_new(256); - const char *prefix = t_strdup_printf("dovecot.%s.global", + if ( strstr(carbon_name , "." != NULL) { + const char *prefix = t_strdup_printf("", stats_settings->carbon_name); + } else { + const char *prefix = t_strdup_printf("dovecot.%s.global", + stats_settings->carbon_name); + } If that is not the goal or if I am not using it right , let me know. Bests, G Fechio

1 0

ACL on shared folder
by T.Robers＠smtp.tutech.de 13 Nov '17

13 Nov '17

Hello everybody, we're using shared mailboxes as an archive to which everyone has full rights, set with doveadm. The rights look like this: doveadm acl get -u bob(a)example.com shared/archive(a)example.com ID Global Rights user=bob(a)example.com admin create delete expunge insert lookup \ post read write write-deleted write-seen Looking at this i would this i would think i should be able to move an existing folder to shared/archive(a)example.com. But i get a "permission denied". A rawlog session from trying to copy looks like this: 1 OK [CAPABILITY IMAP4rev1 LITERAL+ SASL-IR LOGIN-REFERRALS ID ENABLE IDLE SORT SORT=DISPLAY THREAD=REFERENCES THREAD=REFS THREAD=ORDEREDSUBJECT MULTIAPPEND URL-PARTIAL CATENATE UNSELECT CHILDREN NAMESPACE UIDPLUS LIST-EXTENDED I18NLEVEL=1 CONDSTORE QRESYNC ESEARCH ESORT SEARCHRES WITHIN CONTEXT=SEARCH LIST-STATUS BINARY MOVE NOTIFY ACL RIGHTS=texk] Logged in * ID ("name" "Dovecot") 2 OK ID completed (0.001 + 0.000 secs). * FLAGS (\Answered \Flagged \Deleted \Seen \Draft) * OK [PERMANENTFLAGS (\Answered \Flagged \Deleted \Seen \Draft \*)] Flags permitted. * 0 EXISTS * 0 RECENT * OK [UIDVALIDITY 1510573115] UIDs valid * OK [UIDNEXT 1] Predicted next UID 3 OK [READ-WRITE] Select completed (0.005 + 0.000 + 0.004 secs). * MYRIGHTS shared/archive(a)example.com/IT-Sachen/blablub lrwstipekxacd 4 OK Myrights completed (0.001 + 0.000 secs). + idling * OK Still here 5 OK Idle completed (4.007 + 4.006 + 4.006 secs). 6 OK NOOP completed (0.001 + 0.000 secs). + idling 7 OK Idle completed (42.014 + 42.013 + 42.013 secs). 8 OK List completed (0.015 + 0.000 + 0.014 secs). 9 OK Close completed (0.001 + 0.000 secs). 10 NO [NOPERM] Permission denied (0.005 + 0.000 + 0.004 secs). I don't understand why there's a permission denied because doveadm tells something else. The shared mailbox folder ist the inbox of the account archive(a)example.com What has to be changed that it's possible to save messages or to create folders in resp. under a shared inbox, or is this not possible? Any suggestion is welcome. Tia Thomas My configuration: # 2.2.33.2 (d6601f4ec): /etc/dovecot/dovecot.conf # Pigeonhole version 0.4.21 (92477967) # OS: Linux 2.6.32-696.13.2.el6.x86_64 x86_64 CentOS release 6.9 (Final) ext4 auth_debug = yes auth_debug_passwords = yes auth_master_user_separator = * auth_mechanisms = plain login auth_verbose = yes disable_plaintext_auth = no doveadm_password = # hidden, use -P to show it doveadm_port = 12345 imap_max_line_length = 2 M mail_debug = yes mail_location = maildir:/export/home/imap/%Lu/Maildir mail_plugins = acl mail_log notify mailbox_idle_check_interval = 10 secs mailbox_list_index = yes managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext namespace { hidden = no ignore_on_failure = no inbox = no list = children location = maildir:%%h/Maildir:INDEXPVT=%h/shared/%%u prefix = shared/%%u/ separator = / subscriptions = yes type = shared } namespace inbox { hidden = no inbox = yes list = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = INBOX/ separator = / type = private } passdb { args = /etc/dovecot/master-users driver = passwd-file master = yes } passdb { args = /etc/dovecot/dovecot-ldap.conf.ext driver = ldap } plugin { acl = vfile:/etc/dovecot/global-acls:cache_secs=300 acl_shared_dict = file:/export/home/shared-db/shared-mailboxes mail_log_events = append delete undelete expunge copy mailbox_delete mailbox_rename flag_change mail_log_fields = uid box msgid size from flags mail_replica = tcp:mail2.example.com sieve = ~/.dovecot.sieve sieve_dir = ~/sieve sieve_global = /var/lib/dovecot/sieve/global/ sieve_user_log = ~/.dovecot.sieve.log } protocols = imap pop3 lmtp sieve service aggregator { fifo_listener replication-notify-fifo { mode = 0666 user = vmail } unix_listener replication-notify { mode = 0666 user = vmail } } service auth { unix_listener /var/spool/postfix/private/auth { mode = 0666 } unix_listener auth-userdb { group = vmail mode = 0660 user = vmail } } service config { unix_listener config { user = vmail } } service doveadm { inet_listener { port = 12345 } user = vmail } service imap-login { inet_listener imaps { port = 993 ssl = yes } process_limit = 500 process_min_avail = 20 } service imap { executable = imap postlogin } service lmtp { inet_listener lmtp { address = 127.0.0.1 port = 24 } } service managesieve-login { inet_listener sieve { port = 4190 } inet_listener sieve_deprecated { port = 2000 } } } service pop3-login { inet_listener pop3s { port = 995 ssl = yes } } service pop3 { executable = pop3 postlogin } service postlogin { executable = script-login -d rawlog } service replicator { unix_listener replicator-doveadm { mode = 0666 } } ssl = required ssl_cert = </etc/pki/dovecot/certs/mail2.example.com.crt_chain ssl_cipher_list = ALL:!LOW:!SSLv2:!EXP:!aNULL:!EXPORT ssl_key = # hidden, use -P to show it ssl_protocols = !SSLv3 !SSLv2 syslog_facility = local6 userdb { args = /etc/dovecot/dovecot-ldap-userdb.conf.ext driver = ldap } protocol lmtp { mail_plugins = acl mail_log notify sieve } protocol imap { mail_max_userip_connections = 100 mail_plugins = acl mail_log notify imap_acl rawlog_dir = /tmp/rawlog/%u }

1 0

rawlog segfaults (error 4 in libdovecot.so.0.0.0)
by T. Robers 13 Nov '17

13 Nov '17

Hello everybody, i tried to debug imap sessions with the rawlog feature and rawlog creates files but when i try to dump them doveadm tells me [...] Error: zlib.read((file)): unexpected EOF at [...]. I looked at syslog files and i see, that rawlog gets terminated with a segfault, e.g.: segfault at 10 ip 00007ff6da362596 sp 00007fffe725a080 error 4 in libdovecot.so.0.0.0[7ff6da2a4000+122000] Is there a way to debug why rawlog ist terminated? I haven't found anything.I would be very thankful, if somebody could give a hint. My system is: # 2.2.33.2 (d6601f4ec): /etc/dovecot/dovecot.conf # Pigeonhole version 0.4.21 (92477967) # OS: Linux 2.6.32-696.3.1.el6.x86_64 x86_64 CentOS release 6.9 (Final) ext4 auth_debug = yes auth_debug_passwords = yes auth_master_user_separator = * auth_mechanisms = plain login auth_verbose = yes disable_plaintext_auth = no imap_max_line_length = 2 M mail_debug = yes mail_location = maildir:/export/home/imap/%Lu/Maildir mail_plugins = acl zlib mail_log notify mailbox_idle_check_interval = 10 secs mailbox_list_index = yes managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext namespace { hidden = no ignore_on_failure = no inbox = no list = children location = maildir:%%h/Maildir:INDEXPVT=%h/shared/%%u prefix = shared/%%u/ separator = / subscriptions = yes type = shared } namespace inbox { hidden = no inbox = yes list = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = INBOX/ separator = / type = private } passdb { args = /etc/dovecot/dovecot-ldap.conf.ext driver = ldap } plugin { acl = vfile:/etc/dovecot/global-acls:cache_secs=300 acl_shared_dict = file:/export/home/shared-db/shared-mailboxes mail_log_events = append delete undelete expunge copy mailbox_delete mailbox_rename flag_change mail_log_fields = uid box msgid size from flags sieve = ~/.dovecot.sieve sieve_dir = ~/sieve sieve_global = /var/lib/dovecot/sieve/global/ sieve_user_log = ~/.dovecot.sieve.log zlib_save = gz zlib_save_level = 6 } protocols = imap pop3 lmtp sieve service auth { unix_listener /var/spool/postfix/private/auth { mode = 0666 } unix_listener auth-userdb { group = vmail mode = 0660 user = vmail } } service imap-login { inet_listener imap { port = 143 } inet_listener imaps { port = 993 ssl = yes } process_limit = 500 process_min_avail = 20 } service imap { executable = imap postlogin } service lmtp { inet_listener lmtp { address = 127.0.0.1 port = 24 } } service managesieve-login { inet_listener sieve { port = 4190 } inet_listener sieve_deprecated { port = 2000 } } service pop3-login { inet_listener pop3s { port = 995 ssl = yes } } service pop3 { executable = pop3 postlogin } service postlogin { executable = script-login -d rawlog -f in } ssl = required ssl_cert = </etc/pki/dovecot/certs/mail.tutech.de.crt_chain ssl_cipher_list = ALL:!LOW:!SSLv2:!EXP:!aNULL:!EXPORT ssl_key = # hidden, use -P to show it ssl_protocols = !SSLv3 !SSLv2 syslog_facility = local6 userdb { args = /etc/dovecot/dovecot-ldap-userdb.conf.ext driver = ldap } protocol lmtp { mail_plugins = acl zlib mail_log notify sieve } protocol imap { mail_max_userip_connections = 100 mail_plugins = acl zlib mail_log notify imap_zlib imap_acl rawlog_dir = /tmp/rawlog/%u } Tia Thomas

4 3

imap coredump after doveadm altmove
by Frank Koch 13 Nov '17

13 Nov '17

Hello, i tried to move mails to an alt storage with the following command: doveadm altmove -u user(a)domain.de mailbox Inbox After that, the imap process produces a core dump (files has not been moved): Maillog: dovecot: imap-login: Login: user=<user(a)domain.de>, method=PLAIN, rip=X.X.X.X, lip=X.X.X.X, mpid=5393, TLS, session=<83JiHqNdTwCsEAIf> dovecot: imap(user(a)domain.de): Fatal: master: service(imap): child 5393 killed with signal 11 (core dumped) Version: Dovecot 2.2.18.2 OS: CenotOS6 2.6.32-696.10.2.el6.x86_64 local storage (ext4) #gdb --args /usr/libexec/dovecot/imap -u user(a)domain.de A1 STATUS INBOX (MESSAGES) Program received signal SIGSEGV, Segmentation fault. 0x00007ffff74b3c9a in __strrchr_sse2 () from /lib64/libc.so.6 (gdb) bt full #0 0x00007ffff74b3c9a in __strrchr_sse2 () from /lib64/libc.so.6 No symbol table info available. #1 0x00007ffff7b148cd in sdbox_file_move () from /usr/lib64/dovecot/libdovecot-storage.so.0 No symbol table info available. #2 0x00007ffff7b18284 in sdbox_sync_begin () from /usr/lib64/dovecot/libdovecot-storage.so.0 No symbol table info available. #3 0x00007ffff7b18382 in sdbox_sync () from /usr/lib64/dovecot/libdovecot-storage.so.0 No symbol table info available. #4 0x00007ffff7b18437 in sdbox_storage_sync_init () from /usr/lib64/dovecot/libdovecot-storage.so.0 No symbol table info available. #5 0x00007ffff7af64b3 in mailbox_sync_init () from /usr/lib64/dovecot/libdovecot-storage.so.0 No symbol table info available. #6 0x00007ffff7af7d27 in mailbox_sync () from /usr/lib64/dovecot/libdovecot-storage.so.0 No symbol table info available. #7 0x00007ffff7b62af2 in index_storage_get_status () from /usr/lib64/dovecot/libdovecot-storage.so.0 No symbol table info available. #8 0x00007ffff67eb32c in ?? () from /usr/lib64/dovecot/lib10_quota_plugin.so No symbol table info available. #9 0x00007ffff6c021e4 in ?? () from /usr/lib64/dovecot/lib01_acl_plugin.so No symbol table info available. #10 0x00007ffff7af8931 in mailbox_get_status () from /usr/lib64/dovecot/libdovecot-storage.so.0 No symbol table info available. #11 0x000000000041e07a in imap_status_get () No symbol table info available. #12 0x0000000000413629 in cmd_status () No symbol table info available. #13 0x00000000004178ed in command_exec () No symbol table info available. #14 0x00000000004168d0 in ?? () No symbol table info available. #15 0x0000000000416966 in ?? () No symbol table info available. #16 0x0000000000416c5d in client_handle_input () No symbol table info available. #17 0x0000000000416fdf in client_input () No symbol table info available. #18 0x00007ffff7852fbb in io_loop_call_io () from /usr/lib64/dovecot/libdovecot.so.0 No symbol table info available. #19 0x00007ffff785418f in io_loop_handler_run_internal () from /usr/lib64/dovecot/libdovecot.so.0 No symbol table info available. #20 0x00007ffff7853049 in io_loop_handler_run () from /usr/lib64/dovecot/libdovecot.so.0 No symbol table info available. #21 0x00007ffff78530c8 in io_loop_run () from /usr/lib64/dovecot/libdovecot.so.0 No symbol table info available. #22 0x00007ffff77f2043 in master_service_run () from /usr/lib64/dovecot/libdovecot.so.0 No symbol table info available. #23 0x00000000004206c1 in main () No symbol table info available. This is only on folders i have tried to move. best regards, Frank Koch --

1 0

IMAP connections with ".eml" in the username - bot attack.
by James Brown 13 Nov '17

13 Nov '17

We are seeing lots of IMAP login attempts like this: dovecot[363]: imap-login: Disconnected (auth failed, 1 attempts in 6 secs): user=<xcentrex5fxnewx5fxyorkx5fxquotex5fxisx5fxreadyx2dxx2dx426453.eml>, method=PLAIN, rip=197.255.60.118, or dovecot[363]: imap-login: Disconnected (auth failed, 1 attempts in 6 secs): user=<xmatchingx5fxyourx5fxrecentx5fxvisitx5fxonx5fxx2dxx2dx121584.eml(a)bordo.com.au>, method=PLAIN, rip=37.235.28.229, etc. We are running fail2ban, but as each login attempt is from a different IP it is not able to stop them. We are running Sophos UTM firewall but that has no IMAP Proxy and never will. Is anyone else experiencing this? How is such an attack is supposed to ever succeed? What are they trying to accomplish? Any ideas on how to mitigate it? Thanks, James.

3 3

Doveadm: Skipping module doveadm_mail_crypt_plugin loading
by vkosharskiy＠gmail.com 10 Nov '17

10 Nov '17

# dovecot --version Doveadm unable to load plugin bacause plugin doveadm_mail_crypt_plugin.so not compiled with function mail_crypt_box_get_pvt_digests, who defned in mail-crypt-key.c Fix for these problem: dovecot_doveadm_mail_crypt_fix.diff: --- src/plugins/mail-crypt/Makefile.am.old 2017-11-10 19:51:18.155088706 +0200 +++ src/plugins/mail-crypt/Makefile.am 2017-11-10 20:06:30.557814167 +0200 @@ -70,7 +70,8 @@ libfs_mail_crypt_la_LDFLAGS = -module -avoid-version libdoveadm_mail_crypt_plugin_la_SOURCES = \ - doveadm-mail-crypt.c + doveadm-mail-crypt.c \ + mail-crypt-key.c libdoveadm_mail_crypt_plugin_la_LIBADD = $(LIBDOVECOT) libdoveadm_mail_crypt_plugin_la_DEPENDENCIES = $(LIBDOVECOT_DEPS) libdoveadm_mail_crypt_plugin_la_LDFLAGS = -module -avoid-version # doveadm -D sis _*Debug: Skipping module doveadm_mail_crypt_plugin, because dlopen() failed: /usr/lib64/dovecot/doveadm/libdoveadm_mail_crypt_plugin.so: undefined symbol: mail_crypt_box_get_pvt_digests (this is usually intentional, so just ignore this message) *_ After compile: # doveadm -D sis

1 0

Replication oddities - different sizes between replicated nodes
by Remko Lodder 10 Nov '17

10 Nov '17

Dear Dovecot community, As discussing on IRC with Aki, I have the following thing happening: I got an alert from my mailservice last night that I was running over quota. My quota reached almost 91% (coming from 30%) in one day. I do not recall receiving so much email (we talk about multiple gb’s additional space usage), so something was acting up. When I logged into my mailservers (I’ll describe my setup later on), it mentioned that my FreeBSD mailbox was reaching 12gb of space usage. While the seeming replicated machine (named A) only had 100mb of space in use (which, with the amount of messages in the various mailboxes is consistent with what I would expect). I found out that the “Junk” mailbox was the ‘major' issue. I vaporized the replicated (12GB) mailbox and issued a ‘doveadm sync -u $user -N -U tcps:hostB` so that I would expect the hostB to reach around 100mb-ish of email. I let it go for a little and saw that the mail was done. When I issued a simple ‘df -h’ on the directory, it was already multiple 100mb’s large and growing. It grew back to multiple GB in little time. Again the Junk mailbox was the culprit. In the mean time I noticed my mailclient downloading 44k mails in that mailbox (where there were only a few in the Junk mailbox normally). I again vaporized the entire mailbox on hostB and cleaned out Junk and issued a manual synchronisation. It again grew quickly. Aki did an investigation with me and noticed that my rspamc script was not very well written. I rewrote it as suggested (As written on the site). This morning I continued with the investigation and it was again large on hostB where it was still 100mb-ish on hostA. I vaporized host B again and issued the manual sync with -Dv included per request of Aki. After letting it run for a little hostA grew to 300mb and hostB restarted to reach 1.2GB and remained static there. After half an hour or so the mailbox on hostA grew to 900mb and stayed there. I investigated the mailboxes and saw 8 times the same email. Cleaning them up with doveadm deduplicate -u $user mailbox ‘*’ made sure a lot of email was cut from both hosts. I am now in the state where: hostA: 268MB hostB: 579MB Both are for the same mailbox (I suspect that other mailboxes have similiar issues). When I look at the amount of messages counted by Apple Mail in the particular mailbox I see 1399 emails. The amount of ‘u’ files is 14722 on hostA and 23590 on hostB. I do not understand the difference from my mail client and the amount of u files. from mutt: Mutt: =mailbox [Msgs:1415 New:1 Flag:1 24M]-, which is roughly the same as Apple mail reports. I am a bit lost on where to look next, I would suspect that the synchronised mailboxes would be similar in size, but not the one 2 as large, or before that it grew and grew and grew. My personal feeling is that the sync takes place, but somehow it is not registering that a message had been synchronised and does that again, and again, and again till the message gets synchronised right and the acknowledge is received and it stays the same. That would at least support the 8times the same email that I saw at first and might also support the roughly double as big size of the other host (one sync goes wrong, the next sync went right and got acked). At the bottom I also referenced two previous emails of mine which report similar oddities. Messages that were removed on hostA got back within seconds as “new message” . My feeling there is that the hostB has the ‘failed sync copy with a different uid/guid’ and tells hostA that there is a new message and sends it over. My doveconf -n for hostA (hostB follows), I did sanitize a bit wrt. IP addresses and hostnames: 2.2.33.2 (d6601f4ec): /usr/local/etc/dovecot/dovecot.conf # Pigeonhole version 0.4.21 (92477967) # OS: FreeBSD 11.1-RELEASE amd64 auth_mechanisms = plain login disable_plaintext_auth = no doveadm_password = # hidden, use -P to show it lda_mailbox_autocreate = yes lda_mailbox_autosubscribe = yes lmtp_save_to_detail_mailbox = yes login_log_format_elements = user=<%u> method=%m rip=%r lip=%l mpid=%e %c %k mail_debug = yes mail_fsync = always mail_location = sdbox:~/sdbox mail_plugins = " quota notify replication" managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext imapsieve vnd.dovecot.imapsieve namespace { inbox = yes location = mailbox Drafts { auto = subscribe special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { auto = subscribe special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Spam { auto = subscribe special_use = \Junk } mailbox Trash { auto = subscribe special_use = \Trash } prefix = separator = . } passdb { driver = pam } plugin { imapsieve_mailbox1_before = file:/usr/local/lib/dovecot/sieve/report-spam.sieve imapsieve_mailbox1_causes = COPY imapsieve_mailbox1_name = Spam imapsieve_mailbox2_before = file:/usr/local/lib/dovecot/sieve/report-ham.sieve imapsieve_mailbox2_causes = COPY imapsieve_mailbox2_from = Spam imapsieve_mailbox2_name = * mail_log_events = delete undelete expunge copy mailbox_delete mailbox_rename mail_log_fields = uid box msgid size mail_replica = tcps:hostB:12346 sieve = ~/.dovecot.sieve sieve_after = /usr/local/etc/dovecot/sieve/after/ sieve_before = /usr/local/etc/dovecot/sieve/global/ sieve_dir = ~/sieve sieve_execute_bin_dir = /usr/local/lib/dovecot/sieve sieve_global = /usr/local/etc/dovecot/sieve/global/ sieve_global_extensions = +vnd.dovecot.pipe +vnd.dovecot.execute sieve_global_path = /usr/local/etc/dovecot/sieve/global/dovecot.sieve sieve_pipe_bin_dir = /usr/local/lib/dovecot/sieve sieve_plugins = sieve_imapsieve sieve_extprograms sieve_vacation_dont_check_recipient = yes } postmaster_address = postmaster@isp protocols = imap pop3 lmtp sieve service aggregator { fifo_listener replication-notify-fifo { mode = 0666 } unix_listener replication-notify { mode = 0666 } } service auth { unix_listener /var/spool/postfix/private/auth { mode = 0666 } } service doveadm { inet_listener { port = 12346 ssl = yes } } service imap-login { service_count = 1 } service imap { process_limit = 1024 } service lmtp { inet_listener lmtp { address = external ipv4 and ipv6 127.0.0.1 ::1 port = 24 } unix_listener /var/spool/postfix/private/dovecot-lmtp { group = postfix mode = 0600 user = postfix } } service pop3 { process_limit = 1024 } service replicator { process_min_avail = 1 unix_listener replicator-doveadm { mode = 0666 } } ssl_ca = </usr/local/etc/dehydrated/certs/hostA/fullchain.pem ssl_cert = </usr/local/etc/dehydrated/certs/hostA/cert.pem ssl_client_ca_file = /usr/local/certificates/letsencrypt-ca.pem ssl_dh_parameters_length = 2048 ssl_key = # hidden, use -P to show it ssl_protocols = !SSLv2 !SSLv3 TLSv1 TLSv1.1 TLSv1.2 userdb { driver = passwd } verbose_proctitle = yes protocol lmtp { auth_username_format = %n mail_fsync = optimized mail_plugins = " quota notify replication sieve" postmaster_address = postmaster@isp } protocol lda { mail_plugins = " quota notify replication sieve" } protocol imap { imap_client_workarounds = delay-newmail mail_max_userip_connections = 50 mail_plugins = " quota notify replication imap_quota imap_sieve" } for hostB: # 2.2.33.2 (d6601f4ec): /usr/local/etc/dovecot/dovecot.conf # Pigeonhole version 0.4.21 (92477967) # OS: FreeBSD 11.1-RELEASE-p1 amd64 auth_mechanisms = plain login disable_plaintext_auth = no doveadm_password = # hidden, use -P to show it lda_mailbox_autocreate = yes lda_mailbox_autosubscribe = yes lmtp_save_to_detail_mailbox = yes login_log_format_elements = user=<%u> method=%m rip=%r lip=%l mpid=%e %c %k mail_debug = yes mail_fsync = always mail_location = sdbox:~/sdbox mail_plugins = " quota notify replication" managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext imapsieve vnd.dovecot.imapsieve namespace { inbox = yes location = mailbox Drafts { auto = subscribe special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { auto = subscribe special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Spam { auto = subscribe special_use = \Junk } mailbox Trash { auto = subscribe special_use = \Trash } prefix = separator = . } passdb { driver = pam } plugin { imapsieve_mailbox1_before = file:/usr/local/lib/dovecot/sieve/report-spam.sieve imapsieve_mailbox1_causes = COPY imapsieve_mailbox1_name = Spam imapsieve_mailbox2_before = file:/usr/local/lib/dovecot/sieve/report-ham.sieve imapsieve_mailbox2_causes = COPY imapsieve_mailbox2_from = Spam imapsieve_mailbox2_name = * mail_log_events = delete undelete expunge copy mailbox_delete mailbox_rename mail_log_fields = uid box msgid size mail_replica = tcps:hostA:12346 sieve = ~/.dovecot.sieve sieve_after = /usr/local/etc/dovecot/sieve/after/ sieve_before = /usr/local/etc/dovecot/sieve/global/ sieve_dir = ~/sieve sieve_execute_bin_dir = /usr/local/lib/dovecot/sieve sieve_global = /usr/local/etc/dovecot/sieve/global/ sieve_global_extensions = +vnd.dovecot.pipe +vnd.dovecot.execute sieve_global_path = /usr/local/etc/dovecot/sieve/global/dovecot.sieve sieve_pipe_bin_dir = /usr/local/lib/dovecot/sieve sieve_plugins = sieve_imapsieve sieve_extprograms sieve_vacation_dont_check_recipient = yes } postmaster_address = postmaster@isp protocols = imap pop3 lmtp sieve service aggregator { fifo_listener replication-notify-fifo { mode = 0666 } unix_listener replication-notify { mode = 0666 } } service auth { unix_listener /var/spool/postfix/private/auth { mode = 0666 } } service doveadm { inet_listener { port = 12346 ssl = yes } } service imap-login { service_count = 1 } service imap { process_limit = 1024 } service lmtp { inet_listener lmtp { address = ipv4 and ipv6 address 127.0.0.1 ::1 port = 24 } unix_listener /var/spool/postfix/private/dovecot-lmtp { group = postfix mode = 0600 user = postfix } } service pop3 { process_limit = 1024 } service replicator { process_min_avail = 1 unix_listener replicator-doveadm { mode = 0666 } } ssl_ca = </usr/local/etc/dehydrated/certs/hostA/fullchain.pem ssl_cert = </usr/local/etc/dehydrated/certs/hostA/cert.pem ssl_client_ca_file = /usr/local/certificates/letsencrypt-ca.pem ssl_dh_parameters_length = 2048 ssl_key = # hidden, use -P to show it ssl_protocols = !SSLv2 !SSLv3 TLSv1 TLSv1.1 TLSv1.2 userdb { driver = passwd } verbose_proctitle = yes protocol lmtp { auth_username_format = %n mail_fsync = optimized mail_plugins = " quota notify replication sieve" postmaster_address = postmaster@isp } protocol lda { mail_plugins = " quota notify replication sieve" } protocol imap { imap_client_workarounds = delay-newmail mail_max_userip_connections = 50 mail_plugins = " quota notify replication imap_quota imap_sieve” } Both machines run FreeBSD, with a ZFS backend. HostB has quota’s on the zfs shares but none of them are full or almost full and have plenty of space left on their directories (so there is no quota or disk full issue there) Mail is arriving on both hosts by upstream MX’es. Most of my users use hostB as their main host. I use hostA as my primary host. Both machines are located at Hetzner in Germany. HostA is in DC6 and HostB is in DC12. Not situated next to eachother but low latency links between them. Both machines are connected to gbit uplinks and are not very highly loaded. The machines consist of 2x2TB disk (mirrored with ZFS) and 8cores, 32GB RAM. There were warnings when manually doing the sync that the mailbox changed in between and should be reissued, after which the mailboxes kept growing. Previously I reported two messages here which might be the foundation of the same issue: https://dovecot.org/list/dovecot/2016-July/104873.html and https://www.dovecot.org/list/dovecot/2017-March/107459.html

1 0

Sieve global path?
by Gao 10 Nov '17

10 Nov '17

Hello, I am building a new server on CentOS 7 and the global sieve filter can not be loaded. The debug shows: Nov 9 15:23:09 mail dovecot: lmtp(11182, gao(a)mydomain.com) Debug: sieve: Pigeonhole version 0.4.2 initializing Nov 9 15:23:09 mail dovecot: lmtp(11182, gao(a)mydomain.com) Debug: sieve: include: sieve_global_dir is not set; it is currently not possible to include `:global' scripts. The pigeonhole version: # yum list dovecot-pigeonhole dovecot-pigeonhole.x86_64 1:2.2.10-8.el7 I googled and got confused on how to make sieve point to the correct global filter (which I want auto deliver spams to Junk folder). So what is the correct setting? Thanks in advance. Gao Here is my doveconf -n output: ----------------------------------------------------------- [root@mail ~]# doveconf -n # 2.2.10: /etc/dovecot/dovecot.conf # OS: Linux 3.10.0-693.5.2.el7.x86_64 x86_64 CentOS Linux release 7.4.1708 (Core) xfs auth_mechanisms = plain login cram-md5 first_valid_gid = 5000 first_valid_uid = 5000 last_valid_gid = 5000 last_valid_uid = 5000 listen = * mail_debug = yes mail_gid = 5000 mail_location = maildir:/home/vmail/%d/%n/:INDEX=/home/vmail/%d/%n/indexes mail_plugins = " quota" mail_uid = 5000 managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date ihave mbox_write_locks = fcntl namespace inbox { inbox = yes location = mailbox Drafts { auto = subscribe special_use = \Drafts } mailbox Junk { auto = subscribe special_use = \Junk } mailbox Sent { auto = subscribe special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { auto = subscribe special_use = \Trash } prefix = } passdb { args = /etc/dovecot/conf.d/dovecot-mysql.conf.ext driver = sql } plugin { quota = maildir:User quota quota_exceeded_message = ERROR:422 - Mailbox full, sorry. quota_rule = Junk:ignore quota_rule2 = Trash:storage=+100M quota_warning = storage=90%% quota-warning 90 %u %d quota_warning2 = storage=80%% quota-warning 80 %u %d sieve = ~/sieve/.dovecot.sieve sieve_dir = ~/sieve sieve_global_path = /home/vmail/sieve/globalfilter.sieve sieve_max_script_size = 1M sievedir = ~/sieve } protocols = imap pop3 lmtp sieve service auth { unix_listener /var/spool/postfix/private/auth { group = vmail mode = 0666 user = vmail } } service imap-login { inet_listener imap { port = 143 } inet_listener imaps { port = 993 ssl = yes } } service lmtp { unix_listener /var/spool/postfix/private/dovecot-lmtp { group = postfix mode = 0600 user = postfix } } service managesieve-login { inet_listener sieve { port = 4190 } process_min_avail = 0 service_count = 1 vsz_limit = 64 M } service pop3-login { inet_listener pop3 { port = 110 } inet_listener pop3s { port = 995 ssl = yes } } service quota-warning { executable = script /usr/local/bin/overquota.sh group = vmail unix_listener quota-warning { group = vmail user = vmail } user = vmail } ssl = required ssl_cert = </etc/letsencrypt/live/mydomain.com/fullchain.pem ssl_cipher_list = EECDH+ECDSA+AESGCM:EECDH+aRSA+AESGCM:EECDH+ECDSA+SHA384:EECDH+ECDSA+SHA256:EECDH+aRSA+SHA384:EECDH+aRSA+SHA256:EECDH+aRSA+RC4:EECDH:EDH+aRSA:!aNULL:!eNULL:!LOW:!3DES:!MD5:!EXP:!PSK:!SRP:!DSS:!RC4 ssl_key = </etc/letsencrypt/live/mydomain.com/privkey.pem ssl_prefer_server_ciphers = yes ssl_protocols = !SSLv2 !SSLv3 userdb { args = /etc/dovecot/conf.d/dovecot-mysql.conf.ext driver = sql } protocol lmtp { mail_plugins = " quota sieve" postmaster_address = postmaster(a)mydomain.com } protocol imap { mail_plugins = " quota imap_quota" } protocol sieve { managesieve_implementation_string = Dovecot Pigeonhole managesieve_max_compile_errors = 5 managesieve_max_line_length = 65536 }

5 8

Postlogin script
by j.emerlik 10 Nov '17

10 Nov '17

Hi, I would like to prepare postlogin a script that allow imap connection to roundcube for all but restrict imap access for selected users. My question is that: Is possible in condition IF use IP addresses as range or with mask (because I've more than one web servers) ? My script: #!/bin/sh if [ "$IP" = "172.11.0.28" ] ; then printf "* [ALERT] Access allowed from that IP\r\n" exec "$@" fi CHECK_USER=`PGPASSWORD="somepass" /usr/local/pg950/bin/psql -q -t -U someuser -d maildb -c "select imap_allowed from __users where name = '$USER' LIMIT 1"` if [ $CHECK_USER == "f" ] ; then exit 0 fi if [ $CHECK_USER == "t" ] ; then exec "$@" fi Regards, Jack

3 3

doveadm -A backup
by DurgaPrasad - DatasoftComnet 10 Nov '17

10 Nov '17

Hello, I am trying to backup all users mails using doveadm -Dv backup -A mdbox:/nasdrive/mailbackupfolder However the script is not doing the backup into individual folders but is trying to overwrite the data in /nasdrive/mailbackupfolder for every user. Logically it should write into /nasdrive/mailbackupfolder/user1 , /nasdrive/mailbackupfolder/user2 etc. I know we can run a shell script by listing all users into a file but I feel that will be far slower and it will spawn multiple doveadm commands in parallel and is prone to delays. Can someone suggest something on how to backup using -A in a single command? Regards DP --- This email has been checked for viruses by Avast antivirus software. https://www.avast.com/antivirus

2 1

Migrating from Dovecot 1 to Dovecot 2
by Dovecot list 10 Nov '17

10 Nov '17

Hello. I try to migrate about 200G of mails from one server to another. On the old i have Dovecot1 with Maildirs (without master pass etc.), on the new one i setup dovecot2 with mdbox. I need now to migrate (partialy, not all at once) mails from one to another. I can't find any solution that i can use? I dont have master password, and i want to mikgrate all mailaccont each other. Can anyone use me a working config for this ? Best will be that migratet dont want to be downloaded by mail client one more time. Thanks for any help. Best regards.

2 2

Dovecot auth error
by Mathieu R. 08 Nov '17

08 Nov '17

I just tried to configure a new dovecot/postfix server, and i end up with a dovecot auth error at startup. I can't find a solution by myself. Below are details, thanks in advance for your precious help, and excuse my poor english : dovecot --version 2.2.27 (c0f36b0) (Debian) Dovecot -n : https://400iso.net/public/dov.txt grep -v '^ *$#.*$\?$' /etc/dovecot/dovecot-sql.conf driver = mysql connect = host=127.0.0.1 dbname=postfix user=postfix password=password default_pass_scheme = MD5-CRYPT user_query = SELECT '/srv/vmail/%d/%n' AS home, 3000 AS uid, 3000 AS gid, CONCAT('*:bytes=', CAST(quota AS CHAR)) AS quota_rule FROM mailbox WHERE username = '%u' AND active='1' password_query = SELECT password FROM mailbox WHERE username = '%u' Here is part of the server's log : Nov 4 20:57:49 vps81550 postfix/postscreen[21578]: CONNECT from [209.85.215.51]:47485 to [149.56.x.x]:25 Nov 4 20:57:49 vps81550 postfix/dnsblog[21583]: addr 209.85.215.51 listed by domain dnsbl.sorbs.net as 127.0.0.6 Nov 4 20:57:55 vps81550 postfix/postscreen[21578]: PASS OLD [209.85.215.51]:47485 Nov 4 20:57:55 vps81550 postfix/smtpd[21585]: connect from mail-lf0-f51.google.com[209.85.215.51] Nov 4 20:57:55 vps81550 postfix/smtpd[21585]: Untrusted TLS connection established from mail-lf0-f51.google.com[209.85.215.51] TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits) Nov 4 20:57:55 vps81550 dovecot: auth: Fatal: sql: driver not set in configuration file /etc/dovecot/dovecot-sql.conf.ext Nov 4 20:57:55 vps81550 dovecot: master: Error: service(auth): command startup failed, throttling for 2 secs Nov 4 20:57:55 vps81550 postfix/smtpd[21585]: fatal: no SASL authentication mechanisms Nov 4 20:57:56 vps81550 postfix/master[21528]: warning: process /usr/lib/postfix/sbin/smtpd pid 21585 exit status 1 Nov 4 20:57:56 vps81550 postfix/master[21528]: warning: /usr/lib/postfix/sbin/smtpd: bad command startup -- throttling -- Mathieu R.

3 4

'doveadm replicator remove' only temporary?
by Robert Giles 07 Nov '17

07 Nov '17

Hi folks, Wondering if this is expected behavior; we'd like to be able to pause replication for a particular account on our 2.2.32 active-active cluster, but delivering a message (LMTP) to the account seems to turn replication back on again: (replication on) server1:~# doveadm replicator status rgiles username priority fast sync full sync success sync failed rgiles none 00:00:30 23:45:01 00:00:30 - (remove manually) server:~# doveadm replicator remove rgiles (confirm replication is off) server:~# doveadm replicator remove rgiles Error: Replicator failed: User not found (confirm again that replication is still off) server1:~# doveadm replicator status rgiles username priority fast sync full sync success sync failed (and one more time, still off) server1:~# doveadm replicator status rgiles username priority fast sync full sync success sync failed (send an e-mail, and voila, replication is running again) server1:~# doveadm replicator status rgiles username priority fast sync full sync success sync failed rgiles none 00:00:01 00:00:03 00:00:01 - I've tried quickly disabling replication on both systems, and they inevitably override the 'doveadm replicator remove' command and begin dsync'ing again with each other. Thanks for any ideas out there - Robert

1 1

Re: Dovecot auth error
by Aki Tuomi 07 Nov '17

07 Nov '17

apparently my reply got lost.. have you installed dovecot-mysql package? ---Aki TuomiDovecot oy -------- Original message --------From: "Mathieu R." <mathieu(a)400iso.net> Date: 07/11/2017 16:18 (GMT+02:00) To: dovecot(a)dovecot.org Subject: Re: Dovecot auth error Maybe i got no answer because there is an error which seem obvious in my logs : Nov 4 20:57:55 vps81550 dovecot: auth: Fatal: sql: driver not set in configuration file /etc/dovecot/dovecot-sql.conf.ext I've obviously seen that, and tried to configure driver in that file, but it had no positive outcome, sous i reversed my config to the previous state. Considering what i've read, dovecot's MySQL configuration should be OK, but i still have that fatal error Le sam. 4 nov. 2017 à 21:02, Mathieu R. <mathieu(a)400iso.net> a écrit : > I just tried to configure a new dovecot/postfix server, and i end up with > a dovecot auth error at startup. > I can't find a solution by myself. > Below are details, thanks in advance for your precious help, and excuse my > poor english : > > dovecot --version > 2.2.27 (c0f36b0) (Debian) > > Dovecot -n : > https://400iso.net/public/dov.txt > > > grep -v '^ *$#.*$\?$' /etc/dovecot/dovecot-sql.conf > driver = mysql > connect = host=127.0.0.1 dbname=postfix user=postfix password=password > default_pass_scheme = MD5-CRYPT > user_query = SELECT '/srv/vmail/%d/%n' AS home, 3000 AS uid, 3000 AS gid, > CONCAT('*:bytes=', CAST(quota AS CHAR)) AS quota_rule FROM mailbox WHERE > username = '%u' AND active='1' > password_query = SELECT password FROM mailbox WHERE username = '%u' > > > Here is part of the server's log : > > Nov 4 20:57:49 vps81550 postfix/postscreen[21578]: CONNECT from > [209.85.215.51]:47485 to [149.56.x.x]:25 > Nov 4 20:57:49 vps81550 postfix/dnsblog[21583]: addr 209.85.215.51 listed > by domain dnsbl.sorbs.net as 127.0.0.6 > Nov 4 20:57:55 vps81550 postfix/postscreen[21578]: PASS OLD > [209.85.215.51]:47485 > Nov 4 20:57:55 vps81550 postfix/smtpd[21585]: connect from > mail-lf0-f51.google.com[209.85.215.51] > Nov 4 20:57:55 vps81550 postfix/smtpd[21585]: Untrusted TLS connection > established from mail-lf0-f51.google.com[209.85.215.51] TLSv1.2 with > cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits) > Nov 4 20:57:55 vps81550 dovecot: auth: Fatal: sql: driver not set in > configuration file /etc/dovecot/dovecot-sql.conf.ext > Nov 4 20:57:55 vps81550 dovecot: master: Error: service(auth): command > startup failed, throttling for 2 secs > Nov 4 20:57:55 vps81550 postfix/smtpd[21585]: fatal: no SASL > authentication mechanisms > Nov 4 20:57:56 vps81550 postfix/master[21528]: warning: process > /usr/lib/postfix/sbin/smtpd pid 21585 exit status 1 > Nov 4 20:57:56 vps81550 postfix/master[21528]: warning: > /usr/lib/postfix/sbin/smtpd: bad command startup -- throttling > -- > > Mathieu R. > -- Mathieu R.

1 0

Log reopen broken in 2.2.33?
by David Zambonini 07 Nov '17

07 Nov '17

Has re-opening the logfiles broken between 2.2.32 and 2.2.33 releases? Using the same config that I've had for the past 10 or so point releases, /usr/bin/doveadm log reopen works perfectly up until 2.2.32, but with 2.2.33 (and .1 and .2) no new logfiles are created, file descriptors still have the original files open and keep writings to those logs. On an idling test instance, I get: master: Warning: Sent SIGKILL to 1 log processes I can see both SIGUSR1 and SIGKILL generated by the master process, but the current log process doesn't terminate - it receives SIGUSR1, but not SIGKILL. Anyone able to verify this on their own setup? Am I missing a required config change? Using epoll, which hasn't changed. -- David Zambonini

2 3

dovecot-lda without starting dovecot?
by Stephan von Krawczynski 07 Nov '17

07 Nov '17

Hello, we have a setup where SMTP/LDA and POP3/IMAP are on different physical hosts. They share the mail data via an external storage. Now we would like to use dovecot-lda on the smtp host, so we wonder if the lda binary works without starting dovecot from init. As there will be no POP3/IMAP usage on this host it seems unnecessary. Nevertheless we cannot judge if it is still needed for lda&sieve to work. Your opinion? -- Regards, Stephan

4 5

mail_crypt plugin, few questions
by Zbyszek Żółkiewski 06 Nov '17

06 Nov '17

Hi, I have few questions regarding mail_crypt: 1) Is mail_crypt_global_private_key file read upon dovecot start/restart only or it is/can be read in any other time? I have made few tests by starting dovecot and removing master key for decryption - therefore it is not available on the platform - it only reside in memory, removing one of attack vectors 2) Is there planned any “rollout” for key rotation in the feature ? 3) is there any better way to encrypt mails that were sent before enabling mail_crypt ? I have made some simple script to automate and in-place encryption: https://gist.github.com/kolargol/d551d132949068ce6efce7bc85a317cb but maybe there is better way? If someone want to use it, please read code before as it require updating magic(5) local database thanks! _ Zbyszek Żółkiewski

2 5

stats module
by Jeff Abrahamson 06 Nov '17

06 Nov '17

I'd like to monitor my dovecot instance (running on ubuntu 16.04) using telegraf. [T] jeff@nantes-1:log $ dovecot --version 2.2.22 (fe789d2) [T] jeff@nantes-1:log $ To do that, I think I need to use the stats module and get it to talk on port 24242. I've not found enough documentation on this module to feel really comfortable with it, so it doesn't surprise me that I don't have it working. But I'd much appreciate if someone could point me in the right direction. In particular, nothing listens on 24242. # This file is based on https://wiki2.dovecot.org/Statistics # Dovecot v2.1+ supports gathering statistics (CPU, disk usage, etc.) # from mail processes (IMAP, POP3, LMTP, etc.) to the stats # process. The stats process can later be queried what's going on in # the system. With imap_stats plugin you can get per-command level # statistics for IMAP commands. # # There are different "zoom levels" you can look at the statistics: # # * command: Per-IMAP command # * session: Per IMAP/POP3 connection # * user: Per user (all of user's sessions summed up) # * domain: Per domain (all of domain's users summed up) # * ip: Per IP address (all sessions from the IP summed up) # * global: Everything summed up (2.2.16+) mail_plugins = $mail_plugins stats protocol imap { mail_plugins = $mail_plugins imap_stats } plugin { # how often to session statistics (must be set) stats_refresh = 30 secs # track per-IMAP command statistics (optional) stats_track_cmds = yes } # You'll also need to give enough permissions for mail processes to be # able to write to stats-mail fifo. For example if you use a single # "vmail" user for mail access: service stats { fifo_listener stats-mail { user = vmail mode = 0600 } } # Memory usage configuration # The stats process attempts to keep memory usage below a specified # amount. This value is only approximate because of extra overhead # caused by malloc() itself. stats_memory_limit = 16 M # Once the memory limit is reached, oldest statistics are freed from # memory. Different statistics levels have different timeout limits, # which are configured in: stats_command_min_time = 1 mins stats_domain_min_time = 12 hours stats_ip_min_time = 12 hours stats_session_min_time = 15 mins stats_user_min_time = 1 hours service stats { inet_listener { address = 127.0.0.1 port = 24242 } } Thanks in advance. -- Jeff Abrahamson +33 6 24 40 01 57 +44 7920 594 255 http://p27.eu/jeff/

6 11

migrating from maildir to mdbox, preserving pop3 UIDL
by Jan-Pieter Cornet 03 Nov '17

03 Nov '17

Hi, I'm trying to migrate from maildir to mdbox while preserving the pop3 UIDL (and the imap UID). The problem is, for maildir we use (for compatiblity with qpopper): pop3_uidl_format = %f Problem is, as soon as I convert that to mdbox, then whenever a client issues the UIDL command via a POP connection, the connection is closed and this error is displayed in the log: Error: UIDL: File name not found (pop3_uidl_format=%f not supported by storage?) As a workaround, I enabled "pop3_reuse_xuidl = yes", and before conversion I put an X-UIDL: header in the mails. However, since the UIDL is the filename and the filename also contains S=<size>,W=<sizeOnWire>, I need to change the header in such a way that the size and number of lines stay the same. That's... tedious and error-prone. Is there an easier solution, eg teaching 'doveadm sync' to preserve pop3 UIDL somehow? For the record, I currently convert maildir to mdbox using: doveadm -D backup -u user@domain 'doveadm -o mail=mdbox:/path/to/storage:INDEX=/path/to/fast/storage -o plugin/zlib_save=gz -o mail_uid=$UID -o mail_gid=$GID dsync-server' Thanks for any help! -- Jan-Pieter Cornet <johnpc(a)xs4all.net> Systeembeheer XS4ALL Internet bv www.xs4all.nl

1 0

Enabling notification for all users
by Delisle, John 03 Nov '17

03 Nov '17

Hello, I have a domain populated with ~60 users who infrequently receive email. As a result, they rarely check their email, and miss important messages. The users are virtual LDAP users, and each user has an attribute "backupMailAddress" that contains their primary high-traffic email address that they check daily. (i.e. they have an address like John(a)lowtrafficdomain.com<mailto:John@lowtrafficdomain.com>, and a backupMailAddress attribute like john(a)primaryemailaddress.com<mailto:john@primaryemailaddress.com> ) I'm looking to enable new-email notification for all users, and have the notifications go to their high-traffic email address (their backupMailAddress). I know I can do this through individual user managesieve.sieve configurations and have a script that populates this with a notify rule, but this solution doesn't scale well, and doesn't handle new users/ departing users well. Is the a way I could apply this globally, so that if a user has a populated backupMailAddress attribute, a notification is sent there? Thanks John Delisle | Solution Architecture | Ceridian HCM | m: 204.294.5529 (preferred) | w: 204.975.5909 John.Delisle(a)ceridian.com<mailto:John.Delisle@ceridian.com> | www.ceridian.com<http://www.ceridian.com/> Ceridian. Makes Work Life Better(tm) This communication is intended to be received only by the individual[s] or entity[s] to whom or to which it is addressed, and contains information which is confidential, privileged and subject to copyright. Any unauthorized use, copying, review or disclosure is prohibited. Please notify the sender immediately if you have received this communication in error [by calling collect, if necessary] so that we can arrange for its return at our expense. Thank you in advance for your anticipated assistance and cooperation. Cette communication est destinée uniquement à la personne ou à la personne morale à qui elle est adressée. Elle contient de l’information confidentielle, protégée par le secret professionnel et sujette à des droits d'auteurs. Toute utilisation, reproduction, consultation ou divulgation non autorisées sont interdites. Nous vous prions d’aviser immédiatement l’expéditeur si vous avez reçu cette communication par erreur (en appelant à frais virés, si nécessaire), afin que nous puissions prendre des dispositions pour en assurer le renvoi à nos frais. Nous vous remercions à l’avance de votre coopération.

1 0

LDAP Filters as defined for dovecot UserDB and passDB
by Will Merkens 03 Nov '17

03 Nov '17

I have pretty much everything working fine. I have run into one issue with the filters that I am unsure where this a filter is being set. Dovecot 2.2.32 (dfbe293d4) I have setup dovecot-ldap.conf.ext to control my LDAP query's My current layout used filters based on looking at the posixAccount attributes user_filter = (&(objectClass=posixAccount)(uid=%u)) If I connect to a a ldap account that has no posixAccount attributes set I was getting a failure in the logs Nov 02 14:15:48 mail2 dovecot[28715]: auth: Debug: ldap(sales,192.168.123.39,<fd5mpwVddrvAqHsn>): user search: base=ou=People,dc=userful,dc=ca scope=subtree filter=(&(objectClass=posixAccount)(uid=sales)) fields=mail,user_filter Nov 02 14:15:48 mail2 dovecot[28715]: auth: Debug: ldap(sales,192.168.123.39,<fd5mpwVddrvAqHsn>): no fields returned by the server Nov 02 14:15:48 mail2 dovecot[28715]: auth: ldap(sales,192.168.123.39,<fd5mpwVddrvAqHsn>): unknown user Nov 02 14:15:48 mail2 dovecot[28715]: auth: Error: ldap(sales,192.168.123.39,<fd5mpwVddrvAqHsn>): user not found from userdb I changed the filters thinking I needed to look at the attributes seen by one of these accounts, I used the apache studio to find out what was visible. >From that I saw inetOrgPerson could be used. So I changed the filters. user_filter = (&(objectClass=inetOrgPerson)(uid=%u)) pass_filter = (&(objectClass=inetOrgPerson)(uid=%n)) iterate_filter = (objectClass=inetOrgPerson) Nov 02 14:26:44 mail2 dovecot[29047]: auth: Debug: client in: AUTH 1 PLAIN service=imap secured session=Y0GBzgVdlorAqHsn lip=192.168.123.236 Nov 02 14:26:44 mail2 dovecot[29047]: auth-worker(29066): Debug: ldap(sales(a)userful.com,192.168.123.39,<Y0GBzgVdlorAqHsn>): bind search: base=ou=People,dc=userful,dc=ca filter=(&(objectClass=inetOrgPerson)(uid=sales)) Nov 02 14:26:44 mail2 dovecot[29047]: auth-worker(29066): Debug: ldap(sales(a)userful.com,192.168.123.39,<Y0GBzgVdlorAqHsn>): result: uid=sales; uid unused Nov 02 14:26:44 mail2 dovecot[29047]: auth-worker(29066): Debug: ldap(sales(a)userful.com,192.168.123.39,<Y0GBzgVdlorAqHsn>): username changed sales(a)userful.com -> sales Nov 02 14:26:44 mail2 dovecot[29047]: auth-worker(29066): Debug: ldap(sales,192.168.123.39,<Y0GBzgVdlorAqHsn>): result: uid=sales Nov 02 14:26:44 mail2 dovecot[29047]: auth: Debug: ldap(sales(a)userful.com,192.168.123.39,<Y0GBzgVdlorAqHsn>): username changed sales(a)userful.com -> sales Nov 02 14:26:44 mail2 dovecot[29047]: auth: Debug: client passdb out: OK 1 user=sales original_user=sales(a)userful.com so far so good but then I get Nov 02 14:26:44 mail2 dovecot[29047]: auth: Debug: master in: REQUEST 3851550721 29049 1 519189df600c24c010b57158ac01c867 session_pid=29073 request_auth_token Nov 02 14:26:44 mail2 dovecot[29047]: auth-worker(29066): Debug: ldap(sales,192.168.123.39,<Y0GBzgVdlorAqHsn>): user search: base=ou=People,dc=userful,dc=ca scope=subtree filter=(&(objectClass=posixAccount)(uid=sales)) fields=mail,user_filter Nov 02 14:26:44 mail2 dovecot[29047]: auth-worker(29066): Debug: ldap(sales,192.168.123.39,<Y0GBzgVdlorAqHsn>): no fields returned by the server Nov 02 14:26:44 mail2 dovecot[29047]: auth-worker(29066): ldap(sales,192.168.123.39,<Y0GBzgVdlorAqHsn>): unknown user Nov 02 14:26:44 mail2 dovecot[29047]: auth: Error: ldap(sales,192.168.123.39,<Y0GBzgVdlorAqHsn>): user not found from userdb The question then is where did it get filter=(&(objectClass=posixAccount) from since I changed the filters to inetOrgPerson I grep the dovecot settings directory and all My filters are in the one file. The file that hold the ldap settings -- William Merkens IT Support Analyst Userful Corporation +1 403.289.2177 ext.289 +1 866 USERFUL (1-866-873-7385) Suite 300, 736 8th Ave. SW Calgary AB T2P 1H4 Managed Desktops Done Right. http://www.userful.com

3 3

Bug: lmtp proxy does not quote local parts with spaces
by David Zambonini 03 Nov '17

03 Nov '17

There seems to be a bug with RFC822 processing in ltmp proxying that doesn't quote local parts that, for example, contain spaces. director config: director_username_hash = %Ln lmtp_proxy = yes recipient_delimiter = + protocol lmtp { auth_socket_path = director-userdb auth_username_chars = auth_username_format = %Ln passdb { driver = sql args = /etc/director/sql.d/lmtp.ext result_failure = return-fail result_internalfail = return-fail } } lmtp.ext: password_query = SELECT 'y' AS proxy, NULL AS password, 'y' AS nopassword FROM users WHERE userName='%Ln' from exim -> director LMTP network dump: MAIL FROM:<test(a)testdomain.com>\r\n RCPT TO:<"deemzed.uk+Junk E-mail"@mailbox.localhost>\r\n DATA\r\n (etc) .\r\n 501 5.5.4 Invalid parameters\r\n QUIT\r\n from director -> dovecot LMTP network dump: MAIL FROM:<test(a)testdomain.com>\r\n RCPT TO:<deemzed.uk+Junk E-mail>\r\n 501 5.5.4 Invalid.parameters\r\n I'll try to pare down a full config for doveconf that displays this behaviour if required, as currently I have sensitive/extraneous information in there, but this seems fairly cut and dried as a bug to me. -- Dave

3 7

dovecot-2.3 (-git) Warning (Was Re: dovecot Digest, Vol 174, Issue 64)
by Reuben Farrelly 02 Nov '17

02 Nov '17

Hi, On 30/10/2017 7:22 PM, dovecot-request(a)dovecot.org wrote: > Message: 6 > Date: Mon, 30 Oct 2017 10:22:42 +0200 > From: Teemu Huovila <teemu.huovila(a)dovecot.fi> > To: dovecot(a)dovecot.org > Subject: Re: dovecot-2.3 (-git) Warning and Fatal Compile Error > Message-ID: <7d2c0b5b-019a-067c-c6be-f36571ed9a96(a)dovecot.fi> > Content-Type: text/plain; charset=utf-8 > > > > On 30.10.2017 09:10, Aki Tuomi wrote: >> >> >> On 30.10.2017 00:23, Reuben Farrelly wrote: >>> Hi Aki, >>> >>> On 30/10/2017 12:43 AM, Aki Tuomi wrote: >>>>> On October 29, 2017 at 1:55 PM Reuben Farrelly >>>>> <reuben-dovecot(a)reub.net> wrote: >>>>> >>>>> >>>>> Hi again, >>>>> >>>>> Chasing down one last problem which seems to have been missed from my >>>>> last email: >>>>> >>>>> On 20/10/2017 9:22 PM, Stephan Bosch wrote: >>>>>> >>>>>> Op 20-10-2017 om 4:23 schreef Reuben Farrelly: >>>>>>> On 18/10/2017 11:40 PM, Timo Sirainen wrote: >>>>>>>> On 18 Oct 2017, at 6.34, Reuben Farrelly <reuben-dovecot(a)reub.net> >>>>>>>> wrote: >>>>> This problem below is still present in 2.3 -git, as of version >>>>> 2.3.devel >>>>> (6fc40674e) >>>>> >>>>>>>> Secondly, this ssl_dh messages is always printed from doveconf: >>>>>>>> >>>>>>>> doveconf: Warning: please set ssl_dh=</etc/dovecot/dh.pem >>>>>>>> doveconf: Warning: You can generate it with: dd >>>>>>>> if=/var/lib/dovecot/ssl-parameters.dat bs=1 skip=88 | openssl dh >>>>>>>> -inform der > /etc/dovecot/dh.pem >>>>>>>> >>>>>>>> Yet the file is there: >>>>>>>> >>>>>>>> thunderstorm conf.d # ls -la /etc/dovecot/dh.pem >>>>>>>> -rw-r--r-- 1 root root 769 Oct 19 21:55 /etc/dovecot/dh.pem >>>>>>>> >>>>>>>> And the config is there as well: >>>>>>>> >>>>>>>> thunderstorm dovecot # doveconf -P | grep ssl_dh >>>>>>>> ssl_dh = </etc/dovecot/dh.pem >>>>>>>> doveconf: Warning: please set ssl_dh=</etc/dovecot/dh.pem >>>>>>>> doveconf: Warning: You can generate it with: dd >>>>>>>> if=/var/lib/dovecot/ssl-parameters.dat bs=1 skip=88 | openssl dh >>>>>>>> -inform der > /etc/dovecot/dh.pem >>>>>>>> ?? ssl_dh = -----BEGIN DH PARAMETERS----- >>>>>>>> ?? ssl_dh = -----BEGIN DH PARAMETERS----- >>>>>>>> ?? ssl_dh = -----BEGIN DH PARAMETERS----- >>>>>>>> ?? ssl_dh = -----BEGIN DH PARAMETERS----- >>>>>>>> ?? ssl_dh = -----BEGIN DH PARAMETERS----- >>>>>>>> ?? ssl_dh = -----BEGIN DH PARAMETERS----- >>>>>>>> ?? ssl_dh = -----BEGIN DH PARAMETERS----- >>>>>>>> ?? ssl_dh = -----BEGIN DH PARAMETERS----- >>>>>>>> thunderstorm dovecot # >>>>>>>> >>>>>>>> It appears that this warning is being triggered by the presence of >>>>>>>> the ssl-parameters.dat file because when I remove it the warning >>>>>>>> goes away. Perhaps the warning could be made a bit more specific >>>>>>>> about this file being removed if it is not required because at the >>>>>>>> moment the warning message is not related to the trigger. >>>>>>>> >>>>>>>> Thanks, >>>>>>>> Reuben >>>>> Thanks, >>>>> Reuben >>>> It is triggered when there is ssl-parameters.dat file *AND* there is >>>> no ssl_dh=< explicitly set in config file. >>>> >>>> Aki >>> >>> I have this already in my 10-ssl.conf file: >>> >>> lightning dovecot # /etc/init.d/dovecot reload >>> doveconf: Warning: please set ssl_dh=</etc/dovecot/dh.pem >>> doveconf: Warning: You can generate it with: dd >>> if=/var/lib/dovecot/ssl-parameters.dat bs=1 skip=88 | openssl dh >>> -inform der > /etc/dovecot/dh.pem >>> ?* Reloading dovecot configs and restarting auth/login processes >>> ...????? [ ok ] >>> lightning dovecot # >>> >>> However: >>> >>> lightning dovecot # grep ssl_dh conf.d/10-ssl.conf >>> # gives on startup when ssl_dh is unset. >>> ssl_dh=</etc/dovecot/dh.pem >>> lightning dovecot # >>> >>> and the file is there: >>> >>> lightning dovecot # ls -la /etc/dovecot/dh.pem >>> -rw-r--r-- 1 root root 769 Oct 19 19:06 /etc/dovecot/dh.pem >>> lightning dovecot # >>> >>> So it is actually configured and yet the warning still is present. >>> >>> Reuben >> >> Hi! >> >> I gave this a try, and I was not able to repeat this issue. Perhaps you >> are still missing ssl_dh somewhere? >> >> Aki >> > Hello > > Just a guess, but at this point I would recommend reviewing the output of "doveconf -n" to make sure the appropriate settings are present. > > br, > Teemu I still can't see anything amiss. Here's the output from doveconf -n: # 2.3.devel (65ef8330e): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.devel (f4659224) # OS: Linux 4.9.56-x86_64-linode87 x86_64 Gentoo Base System release 2.4.1 auth_mechanisms = plain login auth_socket_path = /var/run/dovecot/auth-userdb auth_username_format = %Ln doveadm_password = # hidden, use -P to show it first_valid_uid = 1000 imap_client_workarounds = tb-lsub-flags tb-extra-mailbox-sep last_valid_uid = 1100 login_log_format_elements = user=<%u> auth-method=%m remote=%r local=%l %k login_trusted_networks = 192.168.0.0/16 mail_location = maildir:~/Maildir mail_plugins = stats notify replication fts fts_lucene managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } passdb { args = failure_show_msg=yes %s driver = pam } plugin { fts = lucene fts_autoindex = yes fts_languages = en fts_lucene = whitespace_chars=@. mail_replica = tcps:inside-mail.reub.net:4813 replication_full_sync_interval = 4 hours sieve = file:~/sieve;active=~/.dovecot.sieve stats_refresh = 30 secs stats_track_cmds = yes } protocols = imap lmtp sieve recipient_delimiter = - service aggregator { fifo_listener replication-notify-fifo { mode = 0666 user = root } unix_listener replication-notify { mode = 0666 user = root } } service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0666 user = postfix } unix_listener auth-userdb { mode = 0777 } } service doveadm { inet_listener { address = 2400:8901:e001:3a::20 port = 4813 ssl = yes } user = root } service imap { executable = imap postlogin } service lmtp { inet_listener lmtp { address = ::1 port = 24 } unix_listener /var/spool/postfix/private/dovecot-lmtp { group = postfix mode = 0660 user = postfix } } service postlogin { executable = script-login -d rawlog } service replicator { process_min_avail = 1 unix_listener replicator-doveadm { mode = 0666 } } service stats { fifo_listener stats-mail { mode = 0666 } } ssl_ca = </etc/ssl/misc/alphassl_intermediate_ca.crt ssl_cert = </etc/ssl/dovecot/*.reub.net.crt ssl_cipher_list = DEFAULT:!EXPORT:!LOW:!MEDIUM:!MD5 ssl_client_ca_dir = /etc/ssl/certs ssl_client_ca_file = /etc/ssl/misc/alphassl_intermediate_ca.crt ssl_dh = # hidden, use -P to show it ssl_key = # hidden, use -P to show it ssl_protocols = !SSLv2 !SSLv3 !TLSv1 userdb { driver = passwd } protocol lmtp { mail_plugins = stats notify replication fts fts_lucene sieve ssl_dh = # hidden, use -P to show it } protocol !indexer-worker { ssl_dh = # hidden, use -P to show it } protocol lda { mail_plugins = stats notify replication fts fts_lucene sieve ssl_dh = # hidden, use -P to show it } protocol imap { mail_plugins = stats notify replication fts fts_lucene imap_stats ssl_dh = # hidden, use -P to show it } protocol sieve { ssl_dh = # hidden, use -P to show it } protocol pop3 { ssl_dh = # hidden, use -P to show it } And showing with -P as an example: protocol pop3 { ssl_dh = -----BEGIN DH PARAMETERS----- MIIBCAKCAQEAo4NpFI4fpUe65FVv1hotVS9pTUbCKs1ypGRZcFMXzpsXPqHU+M4s ... AAAAAAAAAAAAAAAAAAAAAAAAAAA= -----END DH PARAMETERS----- There is a single set of valid DH parameters for every protocol as listed above. It seems odd that ssl_dh is defined all of these protocols specifically too. This specific per-protocol definition of ssl_dh isn't specified in any config file. Reuben

3 4

Replication to wrong mailbox
by Ralf Becker 02 Nov '17

02 Nov '17

It happened now twice that replication created folders and mails in the wrong mailbox :( Here's the architecture we use: - 2 Dovecot (2.2.32) backends in two different datacenters replicating via a VPN connection - Dovecot directors in both datacenters talks to both backends with vhost_count of 100 vs 1 for local vs remote backend - backends use proxy dict via a unix domain socket and socat to talk via tcp to a dict on a different server (kubernetes cluster) - backends have a local sqlite userdb for iteration (also containing home directories, as just iteration is not possible) - serving around 7000 mailboxes in a roughly 200 different domains Everything works as expected, until dict is not reachable eg. due to a server failure or a planed reboot of a node of the kubernetes cluster. In that situation it can happen that some requests are not answered, even with Kubernetes running multiple instances of the dict. I can only speculate what happens then: it seems the connection failure to the remote dict is not correctly handled and leads to situation in which last mailbox/home directory is used for the replication :( When it happened the first time we attributed it to the fact that the Sqlite database at that time contained no home directory information, which we fixed after. This first time (server failure) took a couple of minutes and lead to many mailboxes containing mostly folders but also some new arrived mails belonging to other mailboxes/users. We could only resolve that situation by rolling back to a zfs snapshot before the downtime. The second time was last Friday night during a (much shorter) reboot of a Kubernetes node and lead only to a single mailbox containing folders and mails of other mailboxes. That was verified by looking at timestamps of directories below $home/mdbox/mailboxes and files in $home/mdbox/storage. I can not tell if adding the home directory to the Sqlite database or the shorter time of the failure limited the wrong replication to a single mailbox. Can someone with more knowledge of the Dovecot code please check/verify how replication deals with failures in proxy dict. I'm of cause happy to provide more information of our configuration if needed. Here is an exert of our configuration (full doveconf -n is attached): passdb { args = /etc/dovecot/dovecot-dict-master-auth.conf driver = dict master = yes } passdb { args = /etc/dovecot/dovecot-dict-auth.conf driver = dict } userdb { driver = prefetch } userdb { args = /etc/dovecot/dovecot-dict-auth.conf driver = dict } userdb { args = /etc/dovecot/dovecot-sql.conf driver = sql } dovecot-dict-auth.conf: uri = proxy:/var/run/dovecot_auth_proxy/socket:backend password_key = passdb/%u/%w user_key = userdb/%u iterate_disable = yes dovecot-dict-master-auth.conf: uri = proxy:/var/run/dovecot_auth_proxy/socket:backend password_key = master/%{login_user}/%u/%w iterate_disable = yes dovecot-sql.conf: driver = sqlite connect = /etc/dovecot/users.sqlite user_query = SELECT home,NULL AS uid,NULL AS gid FROM users WHERE userid = '%n' AND domain = '%d' iterate_query = SELECT userid AS username, domain FROM users -- Ralf Becker EGroupware GmbH [www.egroupware.org] Handelsregister HRB Kaiserslautern 3587 Geschäftsführer Birgit und Ralf Becker Leibnizstr. 17, 67663 Kaiserslautern, Germany Telefon +49 631 31657-0

3 5

How to limit Apple Mail (desktop)?
by Rupert Gallagher 02 Nov '17

02 Nov '17

By default, Apple Mail downloads all e-mails from server's account. Previous versions of this client allowed to opt-out. The latest two versions? however, only allow to opt-out from downloading the attachments. The stress on the server is unbearable. We cannot ask users to be considerate: this is the default behaviour of Apple Mail. We need a server-side solution to the problem. Please share your ideas.

6 13

LDAP authentication and shadowExpire
by Mantas Gegužis 02 Nov '17

02 Nov '17

Hi, I am trying to configure Dovecot (2.2.27) with LDAP passdb, specifically with authentication binds (https://wiki.dovecot.org/AuthDatabase/LDAP/AuthBinds) Atribute shadowExpire has a unix time stamp value. Is there a way to write pass_filter like shadowExpire<ToDay? Or maybe there is better way to implement password expiration in Dovecot? -- Pagarbiai Mantas Gegužis VU Informacinių technologijų taikymo centras

2 1

Re: How to limit Apple Mail (desktop)?
by Joseph Tam 01 Nov '17

01 Nov '17

"@lbutlr" <kremels(a)kreme.com> writes: (Are you the OP, or have I mistakenly atributed this to Rupert Gallagher?) >> So what the composition of all this traffic? Are you saying the mail >> client is ultra dumb and repeatedly downloading entire messages, read >> and unread, attachment and all (i.e. you're truly bandwidth limited?) > > It most certainly does not do that. If this is the case for the OP, it's back to square one to find log entries, and/or nfsstat/iostat/vmstat/etc output to see what is "killing" the server. File locking issues, mail_max_userip_connections and process limit values could also cause service flakiness. Apple mail readers seems to gobble up IMAP connections like candy. Joseph Tam <jtam.home(a)gmail.com>

1 0

IMAP Benchmarking, active/active cluster with GFS2
by Hristo Pavlov 01 Nov '17

01 Nov '17

Hi All, We're on migration stage to a new 2-node active/active cluster with shared iSCSI storage, everything is ready, but we are in the process of I/O testing, before we going to in production. Cluster info: 2 nodes with CentOS 7.4 balancer ( keepalived + ldirectord ), 2 dovecot directors, 2 dovecot IMAP backends, 2 Postfix SMTP, gfs2 ( corosync + dlm ), LMTP between Postfix and Dovecot directors ( proxy ) and Dovecot backends. Everything seems normal, the users are mapped to dovecot backends, the balancers and the directors are working properly. The measurements were created under the following conditions : - operating system : CentOS Linux release 7.4.1708 (Core)- virtual server (KVM) - (2 cores per virtual socket) and 4 GB RAM - RAID 10 ( 6 x 2TB Seagate ST2000NX0273 SAS 7200 RPM ( iSCSI SAN Infrotrend Storage DS 4024 ), partition 5.45 TB formatted with gfs2. - Dovecot 2.2.10 - imaptest v.1.0.0 We run a test with ./imaptest userfile=users.txt mbox=dovecot-crlf secs=300 clients=50 append=100,0 logout=0 msgs=10000000, part of the output is that, but we can't understand what mean these values, anyone who has experience with imaptest can explain what they mean? 100% 50% 50% 100% 100% 100% 50% 100% 100% 100% 30% 0 223 216 0 442 657 219 218 443 438 50/ 50 0 229 212 0 418 596 194 224 428 424 50/ 50 0 217 226 0 436 632 227 223 429 428 50/ 50 0 214 226 0 432 644 207 193 429 435 50/ 50 0 213 204 0 414 587 209 213 414 417 50/ 50 0 195 206 0 427 611 213 203 426 420 50/ 50 0 225 200 0 435 642 215 226 439 445 50/ 50 0 229 194 0 441 637 223 213 441 436 50/ 50 0 213 219 0 434 616 212 232 431 428 50/ 50 0 210 213 0 427 622 203 219 434 440 50/ 50 0 112 113 0 35 30 30 56 87 111 ms/cmd avg Logi List Stat Sele Fetc Fet2 Stor Dele Expu Appe 100% 50% 50% 100% 100% 100% 50% 100% 100% 100% 30% 0 231 246 0 443 622 204 211 444 440 50/ 50 0 215 211 0 431 601 194 219 428 430 50/ 50 0 230 228 0 445 626 216 235 445 440 50/ 50 0 218 234 0 429 624 182 225 420 428 50/ 50 0 223 222 0 427 640 214 215 430 431 50/ 50 0 210 219 0 424 582 201 213 433 428 50/ 50 0 198 208 0 418 579 212 210 416 412 50/ 50 0 221 211 0 419 617 209 215 418 420 50/ 50 0 208 196 0 405 566 223 189 413 413 50/ 50 0 215 244 0 441 639 198 212 431 435 50/ 50 0 115 114 0 35 30 30 57 87 112 ms/cmd avg Logi List Stat Sele Fetc Fet2 Stor Dele Expu Appe 100% 50% 50% 100% 100% 100% 50% 100% 100% 100% 30% 0 199 219 0 422 608 206 205 424 420 50/ 50 0 214 206 0 429 616 209 208 432 435 50/ 50 0 227 204 0 413 583 200 213 412 410 50/ 50 0 192 214 0 416 609 212 219 411 415 50/ 50 0 212 215 0 426 625 204 225 434 428 50/ 50 0 202 209 0 423 585 224 197 415 421 50/ 50 0 216 221 0 422 599 190 197 427 426 50/ 50 0 208 207 0 414 579 209 211 414 410 50/ 50 0 205 211 0 432 616 212 213 423 427 50/ 50 0 225 207 0 432 642 208 215 436 434 50/ 50 0 115 115 0 36 31 32 59 89 113 ms/cmd avg Logi List Stat Sele Fetc Fet2 Stor Dele Expu Appe 100% 50% 50% 100% 100% 100% 50% 100% 100% 100% 30% 0 211 216 0 431 614 212 221 437 439 50/ 50 0 165 159 0 324 487 160 148 322 315 50/ 50 0 225 199 0 406 568 215 209 403 410 50/ 50 0 213 217 0 441 617 202 220 448 442 50/ 50 0 221 230 0 439 609 229 216 428 437 50/ 50 0 227 211 0 429 595 210 206 432 430 50/ 50 0 196 218 0 423 619 209 207 425 419 50/ 50 0 218 194 0 422 596 199 212 417 422 50/ 50 0 223 213 0 427 599 221 220 434 432 50/ 50 0 185 203 0 405 558 226 211 399 403 50/ 50 0 118 118 0 37 32 31 58 91 116 ms/cmd avg Totals: Logi List Stat Sele Fetc Fet2 Stor Dele Expu Appe 100% 50% 50% 100% 100% 100% 50% 100% 100% 100% 30% 50 61115 61109 50 122229 174619 59582 60969 122229 122229 Both nodеs pick up load average about 20-30 and io wait 14-20%. top - 16:34:50 up 7 days, 1:35, 1 user, load average: 22.22, 9.18, 3.47 Tasks: 244 total, 4 running, 240 sleeping, 0 stopped, 0 zombie %Cpu(s): 28.8 us, 29.8 sy, 0.0 ni, 16.4 id, 14.9 wa, 0.0 hi, 10.1 si, 0.0 st KiB Mem : 4013876 total, 134212 free, 1083648 used, 2796016 buff/cache KiB Swap: 6292476 total, 5974836 free, 317640 used. 2449504 avail Mem Do you think that's normal? Тhis test is only for 50 users, if run it for 100 have many stalled commands... We have about 500-700 mailboxes and we want to testing a load close to a real environment. Can anyone help with ideas? Thank you very much!

1 0

Re: How to limit Apple Mail (desktop)?
by Joseph Tam 01 Nov '17

01 Nov '17

Rupert Gallagher writes: > By default, Apple Mail downloads all e-mails from? server's account. > Previous versions of this client allowed to opt-out. The latest two > versions? however, only allow to opt-out from downloading the > attachments. > > The stress on the server is unbearable. We cannot ask users to be > considerate: this is the default behaviour of Apple Mail. (I'm coming into this thread late.) I'm having a hard time visualizing the cause of your problem. Most big messages have the bulk of their data as attachments (which you state the mail reader can defer downloading). Also, readers usually cache local copies, so they're downloaded once. So what the composition of all this traffic? Are you saying the mail client is ultra dumb and repeatedly downloading entire messages, read and unread, attachment and all (i.e. you're truly bandwidth limited?) Do your users typically have many concurrent readers for the same mailbox? What kind of session numbers are you supporting? 100s? 1000s? 10K+? Your data outflow has an incoming counterpart: if you're having a hard time serving it out, is your MTA also having a hard time with the incoming volume? Can it simply be the case you've underscaled your remote mail service? Joseph Tam <jtam.home(a)gmail.com>

2 1

All over sudden dovecot thinks FS is read only
by Tobi 31 Oct '17

31 Oct '17

Hi list I have to dovecot instances running which host my mailboxes on Centos7 dovecot.x86_64 1:2.2.26.0-2.el7.centos installed dovecot-debuginfo.x86_64 1:2.2.26.0-2.el7.centos installed dovecot-mysql.x86_64 1:2.2.26.0-2.el7.centos installed dovecot-pigeonhole.x86_64 1:2.2.26.0-2.el7.centos installed all over sudden both dovecot "think" that the mailbox filesystem is read only and fill the logs with Oct 28 11:39:50 mbox1 dovecot: lmtp(tobster(a)brain-force.ch): Error: ssY/MGZQ9FnoLgAAC4IaJw:2: sieve: failed to open logfile (LOGGING TO STDERR): open(/home/vmail/brain-force.ch/tobster/.dovecot.sieve.log) failed: Read-only file system But a test at cli shows that I can write to the location $ echo "test" >/home/vmail/brain-force.ch/tobster/.dovecot.test $ cat /home/vmail/brain-force.ch/tobster/.dovecot.test test $ echo "test1" >/home/vmail/brain-force.ch/tobster/.dovecot.test $ cat /home/vmail/brain-force.ch/tobster/.dovecot.test test1 Mounts show that the FS should be rw /dev/vda2 / ext4 rw,relatime,data=ordered 0 0 I restarted dovecot several time already. As well I restarted the physical host on which the dovecot vms reside. Filesystems are not full and are not running out of inodes. Does anyone have an idea why dovecot suddenly behaves like that? Thanks a lot for any hint Regards tobi

4 6

Pigeonhole vacation and envelope extension recipient addresses
by David Zambonini 31 Oct '17

31 Oct '17

I have a situation where my LMTP RCPT TO: goes to a mailbox user account that does not reflect either the final (through aliasing) or envelope email address. SMTP RCPT TO: (envelope-local-part@envelope-domain) Final Recipient: (final-local-part@final-domain) LMTP RCPT TO: (mailbox-local-part@mailbox-domain) I'd like to use the final recipient as the vacation address, but also have the envelope recipient address used in place of the LTMP RCPT TO for the envelope extension. At the moment it looks like I can set one or the other? Let's say I add an x-final-to and x-envelope-to header to the email headers before delivering via LMTP. Then, setting: sieve_vacation_use_original_recipient = yes lda_original_recipient_header = x-final-to will get the vacation replies coming from where I'd like, but the envelope extension will not reflect the original SMTP envelope to. Conversely, setting: lda_original_recipient_header = x-envelope-to might get the envelope extension working correctly, but will not give vacation replies from where I'd like. Is there some way anyone is aware of to configure both final and envelope senders based on email headers (that doesn't involve lda flags, these are on different systems), or am I currently out of luck? I've tried playing with DSN ORCPT but it seems like a non-starter trying to get it passed through (exim) -- David Zambonini

3 2

antispam plugin with IMAPSieve
by j.emerlik 31 Oct '17

31 Oct '17

Hi, my dovecot is configured with IMAP Sieve antispam plugin (sa-learn), everything seems to be working correctly but in debug mode in my log file I noticed "dovecot: imap: Error". Last 14 lines od my log file: Oct 31 15:05:25 mnode1 dovecot: imap: Error: Oct 31 15:05:25.040 [10743] dbg: bayes: tokenized header: 90 tokens Oct 31 15:05:25 mnode1 dovecot: imap: Error: Oct 31 15:05:25.067 [10743] dbg: bayes: seen (8e031cc9fec44b6607dc7f6b37903fc49e9c8526@sa_generated) put Oct 31 15:05:25 mnode1 dovecot: imap: Error: Oct 31 15:05:25.067 [10743] dbg: bayes: learned '8e031cc9fec44b6607dc7f6b37903fc49e9c8526@sa_generated', atime: 1509457623 Oct 31 15:05:25 mnode1 dovecot: imap: Error: Oct 31 15:05:25.068 [10743] dbg: plugin: Mail::SpamAssassin::Plugin::Bayes=HASH(0x2adc340) implements 'learner_close', priority 0 Oct 31 15:05:25 mnode1 dovecot: imap: Error: Oct 31 15:05:25.033 [10743] dbg: bayes: using userid: 7 Oct 31 15:05:25 mnode1 dovecot: imap: Error: Oct 31 15:05:25.037 [10743] dbg: bayes: tokenized body: 174 tokens Oct 31 15:05:25 mnode1 dovecot: imap: Error: Oct 31 15:05:25.037 [10743] dbg: bayes: tokenized uri: 0 tokens Oct 31 15:05:25 mnode1 dovecot: imap: Error: Oct 31 15:05:25.037 [10743] dbg: bayes: tokenized invisible: 0 tokens Oct 31 15:05:25 mnode1 dovecot: imap: Error: Oct 31 15:05:25.040 [10743] dbg: bayes: tokenized header: 90 tokens Oct 31 15:05:25 mnode1 dovecot: imap: Error: Oct 31 15:05:25.067 [10743] dbg: bayes: seen (8e031cc9fec44b6607dc7f6b37903fc49e9c8526@sa_generated) put Oct 31 15:05:25 mnode1 dovecot: imap: Error: Oct 31 15:05:25.067 [10743] dbg: bayes: learned '8e031cc9fec44b6607dc7f6b37903fc49e9c8526@sa_generated', atime: 1509457623 Logs looks good and I don't understand "Error:" from log, It looks like sa-learn is connected to database and learned bayes. Error in log it's normal or It's means that it not work ? Regards, Jack

2 1

Re: Bug#876364: dovecot-sieve: Just discovered imap_sieve/sieve_imapsieve is not set up to work with virtual mailboxes.
by Apollon Oikonomopoulos 31 Oct '17

31 Oct '17

Control: tags -1 + moreinfo upstream [Forwarding this to the Dovecot mailing list, just in case someone can help] Hi, Thanks for the report! See my comments inline. On 11:56 Thu 21 Sep , Thurgood Angelou wrote: > Package: dovecot-core > Version: 1:2.2.32-2 > > I've just discovered a bug where the sieve plugin (especially IMAP) > will not work with a virtual mailbox. I recently found this out when > testing a virtual mailbox setup and I use imap_sieve for SPAM > filtering so to lose that would be painful. > > This is what is reported in dovecot's debug log... > > Sep 21 10:53:01 imap(personal(a)othersider92.com): Panic: file mail-index-map.c: line 549 (mail_index_map_lookup_seq_range): assertion failed: (first_uid > 0) > Sep 21 10:53:01 imap(personal(a)othersider92.com): Error: Raw backtrace: /usr/lib/dovecot/libdovecot.so.0(+0x9f0a2) [0x7f4226fd50a2] -> /usr/lib/dovecot/libdovecot.so.0(+0x9f19a) [0x7f4226fd519a] -> /usr/lib/dovecot/libdovecot.so.0(i_fatal+0) [0x7f4226f65cf8] -> /usr/lib/dovecot/libdovecot-storage.so.0(mail_index_map_lookup_seq_range+0x120) [0x7f422733dae0] -> /usr/lib/dovecot/libdovecot-storage.so.0(+0xe8d1d) [0x7f422734cd1d] -> /usr/lib/dovecot/libdovecot-storage.so.0(mail_index_lookup_seq+0xf) [0x7f4227350e9f] -> /usr/lib/dovecot/modules/lib20_virtual_plugin.so(+0x82aa) [0x7f422678a2aa] -> /usr/lib/dovecot/modules/lib95_imap_sieve_plugin.so(+0x708c) [0x7f422657d08c] -> /usr/lib/dovecot/libdovecot-storage.so.0(mailbox_transaction_commit_get_changes+0x52) [0x7f42272adca2] -> dovecot/imap(+0x10084) [0x556502adb084] -> dovecot/imap(command_exec+0x5c) [0x556502ae7d9c] -> dovecot/imap(+0x1b322) [0x556502ae6322] -> dovecot/imap(+0x1b3bc) [0x556502ae63bc] -> dovecot/imap(client_handle_input > +0x18d) [0x556502ae677d] -> dovecot/imap(client_input+0xac) [0x556502ae6ccc] -> /usr/lib/dovecot/libdovecot.so.0(io_loop_call_io+0x52) [0x7f4226fea742] -> /usr/lib/dovecot/libdovecot.so.0(io_loop_handler_run_internal+0x12e) [0x7f4226febd8e] -> /usr/lib/dovecot/libdovecot.so.0(io_loop_handler_run+0x36) [0x7f4226fea7d6] -> /usr/lib/dovecot/libdovecot.so.0(io_loop_run+0x38) [0x7f4226fea988] -> /usr/lib/dovecot/libdovecot.so.0(master_service_run+0x13) [0x7f4226f70353] -> dovecot/imap(main+0x329) [0x556502ad9139] -> /lib/x86_64-linux-gnu/libc.so.6(__libc_start_main+0xf1) [0x7f4226bb92e1] -> dovecot/imap(_start+0x2a) [0x556502ad92ca] After mixing in the debug symbols, this backtrace becomes: /usr/lib/dovecot/libdovecot.so.0(+0x9f0a2) [0x7f4226fd50a2] default_fatal_finish at ./src/lib/failures.c:195 /usr/lib/dovecot/libdovecot.so.0(+0x9f19a) [0x7f4226fd519a] ?? at ./src/lib/failures.c:670 /usr/lib/dovecot/libdovecot.so.0(i_fatal+0) [0x7f4226f65cf8] i_fatal at ./src/lib/failures.c:280 /usr/lib/dovecot/libdovecot-storage.so.0(mail_index_map_lookup_seq_range+0x120) [0x7f422733dae0] mail_index_map_lookup_seq_range at ./src/lib-index/mail-index-map.c:550 /usr/lib/dovecot/libdovecot-storage.so.0(+0xe8d1d) [0x7f422734cd1d] tview_lookup_seq_range at ./src/lib-index/mail-index-transaction-view.c:178 /usr/lib/dovecot/libdovecot-storage.so.0(mail_index_lookup_seq+0xf) [0x7f4227350e9f] mail_index_lookup_seq at ./src/lib-index/mail-index-view.c:522 /usr/lib/dovecot/modules/lib20_virtual_plugin.so(+0x82aa) [0x7f422678a2aa] virtual_mail_set_uid at ./src/plugins/virtual/virtual-mail.c:213 /usr/lib/dovecot/modules/lib95_imap_sieve_plugin.so(+0x708c) [0x7f422657d08c] imap_sieve_mailbox_transaction_run at ./pigeonhole/src/plugins/imapsieve/imap-sieve-storage.c:752 (inlined by: imap_sieve_mailbox_transaction_commit at ./pigeonhole/src/plugins/imapsieve/imap-sieve-storage.c:807) /usr/lib/dovecot/libdovecot-storage.so.0(mailbox_transaction_commit_get_changes+0x52) [0x7f42272adca2] mailbox_transaction_commit_get_changes at ./src/lib-storage/mail-storage.c:2083 dovecot/imap(+0x10084) [0x556502adb084] cmd_copy_full at ./src/imap/cmd-copy.c:146 dovecot/imap(command_exec+0x5c) [0x556502ae7d9c] command_exec at ./src/imap/imap-commands.c:200 dovecot/imap(+0x1b322) [0x556502ae6322] client_command_input at ./src/imap/imap-client.c:1088 dovecot/imap(+0x1b3bc) [0x556502ae63bc] client_command_input at ./src/imap/imap-client.c:1150 dovecot/imap(client_handle_input+0x18d) [0x556502ae677d] client_handle_input at ./src/imap/imap-client.c:1203 dovecot/imap(client_input+0xac) [0x556502ae6ccc] client_input at ./src/imap/imap-client.c:1249 /usr/lib/dovecot/libdovecot.so.0(io_loop_call_io+0x52) [0x7f4226fea742] io_loop_call_io at ./src/lib/ioloop.c:600 /usr/lib/dovecot/libdovecot.so.0(io_loop_handler_run_internal+0x12e) [0x7f4226febd8e] io_loop_handler_run_internal at ./src/lib/ioloop-epoll.c:223 /usr/lib/dovecot/libdovecot.so.0(io_loop_handler_run+0x36) [0x7f4226fea7d6] io_loop_handler_run at ./src/lib/ioloop.c:648 /usr/lib/dovecot/libdovecot.so.0(io_loop_run+0x38) [0x7f4226fea988] io_loop_run at ./src/lib/ioloop.c:622 /usr/lib/dovecot/libdovecot.so.0(master_service_run+0x13) [0x7f4226f70353] master_service_run at ./src/lib-master/master-service.c:667 dovecot/imap(main+0x329) [0x556502ad9139] main at ./src/imap/main.c:491 /lib/x86_64-linux-gnu/libc.so.6(__libc_start_main+0xf1) [0x7f4226bb92e1] __libc_start_main at ../csu/libc-start.c:325 dovecot/imap(_start+0x2a) [0x556502ad92ca] start at ??:0 > -- System Information: > Debian Release: 8.2 > APT prefers oldstable-updates > APT policy: (500, 'oldstable-updates'), (500, 'unstable'), (500, 'testing'), (500, 'oldstable') > Architecture: amd64 (x86_64) > > Kernel: Linux 3.16.0-4-amd64 (SMP w/2 CPU cores) > Locale: LANG=en_GB.UTF-8, LC_CTYPE=en_GB.UTF-8 (charmap=UTF-8), LANGUAGE=en_GB:en (charmap=UTF-8) > Shell: /bin/sh linked to /bin/dash > Init: systemd (via /run/systemd/system) > > Versions of packages dovecot-sieve depends on: > ii dovecot-core 1:2.2.32-2 > ii libc6 2.24-17 > ii ucf 3.0030 > > dovecot-sieve recommends no packages. > > dovecot-sieve suggests no packages. > > Versions of packages dovecot-sieve is related to: > ii dovecot-core [dovecot-common] 1:2.2.32-2 > pn dovecot-dbg <none> > pn dovecot-dev <none> > ii dovecot-gssapi 1:2.2.32-2 > ii dovecot-imapd 1:2.2.32-2 > ii dovecot-ldap 1:2.2.32-2 > ii dovecot-lmtpd 1:2.2.32-2 > ii dovecot-managesieved 1:2.2.32-2 > ii dovecot-mysql 1:2.2.32-2 > pn dovecot-pgsql <none> > pn dovecot-pop3d <none> > ii dovecot-sieve 1:2.2.32-2 > pn dovecot-sqlite <none> Could you also include the output of doveconf -n? Regards, Apollon

3 2

Re: Disconnected: Inactivity (no auth attempts in 180 secs)
by Joseph Tam 31 Oct '17

31 Oct '17

Alexandre <byalefp(a)yahoo.com.br> wrote: > I can send and receive mails using: > IMAP 143 with TLS OK, IMAP STARTTLS is working in some sense. (Your MTA handles SMTP, not dovecot.) > The hangup occours inside of my LAN using Outlook 2016, and Outside > also trying access on 4G from my Android smartphone. > > My goal is enable also POP3s and IMAPs using TLS. [voluminous diagnostics] I can't really see from what you present what the problem is. Can you report the output of openssl s_client -starttls imap {imap-server}:143 openssl s_client -starttls pop3 {imap-server}:110 (from both inside and outside), as well as any matching log entries. Joseph Tam <jtam.home(a)gmail.com>

1 0

Re: Password encription
by Joseph Tam 30 Oct '17

30 Oct '17

> Aki, (Not speaking for Aki) > I understand that salted passwords saved in my database and stronger hash > algorithm course that it will require more processor time/power to crack my > passwords. > > But only when hackers have direct access to my database what means that > hackers have access to my passwords hashes (eg. hackers stolen my database). > > My Dovecot use passwords saved in database as SHA256 and hackers can use > only SMTP, IMAP or POP3 services to try crack it using dictionary attack (I > understand that they using plain text dictionaty passwords). > > Stronger hash algorithm and salt is useful when hackers have direct access > to my database but when they use services as SMTP, IMAP or POP3 > to crack passwords only longer and more complicated password can be more > secure. > > I do not understand this correctly ? Yes, your understanding is basically correct. However, history gives lots of examples of broken systems that explicitly or implicitly relied on one critical system not failing -- they lacked defense in depth or resilience. Examples are "this system has no bugs", "my system does not leak hashes", "this algorithm is unbreakable", "we'll never see a CAT5 hurricane", etc. If these critical assumption ever becomes untrue, the foundation of your defense crumbles. If you narrow your attack definition to only include in-protocol remote brute forcing, then any decent password will take far too long to break that way (esp. with throttling controls that are built-in). Your log files will overflow recording the attempts long before you can expect a password to be cracked. However, you're still susceptable to the qwerty passwords. If this is your *only* line of defense, it is brittle. A robustly secure system will overlap protection: strong hashes, password compliance systems, brute force countermeasures, file permissions/OS hardening, network origins vetting, anti-DoS measures, etc. Keep this picture in mind that I found on CLCERT https://www.clcert.cl/humor/img/weakest-link-road.jpg Joseph Tam <jtam.home(a)gmail.com>

1 0

Dovecot and the Maildir path
by Will Merkens 30 Oct '17

30 Oct '17

System basics Centos 7.3 Dovecot 2.2.32 (dfbe293d4) I am working on a replacement mail server for work and one of the features I wanted was ldap authentication After much fiddling I got it to work. But I encountered a issue where two different methods of testing a mail account resulted in the mail_location being different I set mail_location = maildir:/var/spool/maildir/%d/%n/Maildir in dovecot.conf when I test the authentication and to see if the folders are created correctly on first use I have two results depending on how I test. First test was from openssl openssl s_client -connect mail2:993 I have no problem connecting, I issue the following commands * OK [CAPABILITY IMAP4rev1 LITERAL+ SASL-IR LOGIN-REFERRALS ID ENABLE IDLE AUTH=PLAIN] Dovecot ready. a login testuser(a)userful.com ******** a OK [CAPABILITY IMAP4rev1 LITERAL+ SASL-IR LOGIN-REFERRALS ID ENABLE IDLE SORT SORT=DISPLAY THREAD=REFERENCES THREAD=REFS THREAD=ORDEREDSUBJECT MULTIAPPEND URL-PARTIAL CATENATE UNSELECT CHILDREN NAMESPACE UIDPLUS LIST-EXTENDED I18NLEVEL=1 CONDSTORE QRESYNC ESEARCH ESORT SEARCHRES WITHIN CONTEXT=SEARCH LIST-STATUS BINARY MOVE] Logged in a list "" * * LIST (\HasNoChildren) "." INBOX a OK List completed (0.001 + 0.000 secs). * BYE Disconnected for inactivity. closed But when I look in the mail server at /var/spool/maildir the testuser is not created inside of userful.com but at the same level as userful.com contrary to the %d in mail_location settings. Now second method doveadm -D mailbox list -u 'testuser(a)userful.com' This correctly creates the user under the domain as specified. for logs I have from journalctl for openssl Oct 30 07:37:12 mail2 dovecot[10722]: auth: Debug: client in: AUTH 2 PLAIN service=imap secured session=VgBmvMNcQoTAqHsn lip=192.168. 123.236 rip=192.168.123.39 lport=993 rport=33858 resp=AHRlc3R1c2VyQHVzZXJmdWwuY29tADk5dGVzdHVzZXI5OQ== (previous base64 data may contain sensitive data) Oct 30 07:37:12 mail2 dovecot[10722]: auth: Debug: ldap(testuser(a)userful.com,192.168.123.39,<VgBmvMNcQoTAqHsn>): bind search: base=ou=People,dc=userful,dc=ca filter=(&(objectClass=posixAccount)(uid=testuser)) Oct 30 07:37:12 mail2 dovecot[10722]: auth: Debug: ldap(testuser(a)userful.com,192.168.123.39,<VgBmvMNcQoTAqHsn>): result: uid=testuser; uid unused Oct 30 07:37:12 mail2 dovecot[10722]: auth: Debug: ldap(testuser(a)userful.com,192.168.123.39,<VgBmvMNcQoTAqHsn>): username changed testuser(a)userful.com -> testuser Oct 30 07:37:12 mail2 dovecot[10722]: auth: Debug: ldap(testuser,192.168.123.39,<VgBmvMNcQoTAqHsn>): result: uid=testuser Oct 30 07:37:12 mail2 dovecot[10722]: auth: Debug: client passdb out: OK 2 user=testuser original_user=testuser(a)userful.com Oct 30 07:37:12 mail2 dovecot[10722]: auth: Debug: master in: REQUEST 2784755713 10725 2 d4a357fe811a1da8bd725b82fc1da2ab session_pid=11051 request_auth_token Oct 30 07:37:12 mail2 dovecot[10722]: auth: Debug: ldap(testuser,192.168.123.39,<VgBmvMNcQoTAqHsn>): user search: base=ou=People,dc=userful,dc=ca scope=subtree filter=(&(objectClass=posixAccount)(uid=testuser)) fields=homeDirectory,uidNumber,gidNumber Oct 30 07:37:12 mail2 dovecot[10722]: auth: Debug: ldap(testuser,192.168.123.39,<VgBmvMNcQoTAqHsn>): result: homeDirectory=/nfs/home/test-user uidNumber=6000 gidNumber=1000; homeDirectory,uidNumber,gidNumber unused Oct 30 07:37:12 mail2 dovecot[10722]: auth: Debug: ldap(testuser,192.168.123.39,<VgBmvMNcQoTAqHsn>): result: homeDirectory=/nfs/home/test-user uidNumber=6000 gidNumber=1000 Oct 30 07:37:12 mail2 dovecot[10722]: auth: Debug: master userdb out: USER 2784755713 testuser home=/nfs/home/test-user uid=6000 gid=1000 auth_token=29e6ac32c85cf1b69eeabbe8e4f8e4810e9a3468 auth_user=testuser(a)userful.com Oct 30 07:37:12 mail2 dovecot[10722]: imap-login: Login: user=<testuser>, method=PLAIN, rip=192.168.123.39, lip=192.168.123.236, mpid=11051, TLS, session=<VgBmvMNcQoTAqHsn> for doveadm Oct 30 07:39:12 mail2 dovecot[10722]: auth: Debug: master in: USER 1 testuser(a)userful.com service=doveadm Oct 30 07:39:12 mail2 dovecot[10722]: auth: Debug: ldap(testuser(a)userful.com): user search: base=ou=People,dc=userful,dc=ca scope=subtree filter=(&(objectClass=posixAccount)(uid=testuser)) fields=homeDirectory,uidNumber,gidNumber Oct 30 07:39:12 mail2 dovecot[10722]: auth: Debug: ldap(testuser(a)userful.com): result: homeDirectory=/nfs/home/test-user uidNumber=6000 gidNumber=1000; homeDirectory,uidNumber,gidNumber unused Oct 30 07:39:12 mail2 dovecot[10722]: auth: Debug: ldap(testuser(a)userful.com): result: homeDirectory=/nfs/home/test-user uidNumber=6000 gidNumber=1000 Oct 30 07:39:12 mail2 dovecot[10722]: auth: Debug: userdb out: USER 1 testuser(a)userful.com home=/nfs/home/test-user uid=6000 gid=1000 Any ideas and any settings files that I need to post. -- William Merkens IT Support Analyst Userful Corporation +1 403.289.2177 ext.289 +1 866 USERFUL (1-866-873-7385) Suite 300, 736 8th Ave. SW Calgary AB T2P 1H4 Managed Desktops Done Right. http://www.userful.com

2 1

dovecot-2.3 (-git) Warning and Fatal Compile Error
by Reuben Farrelly 30 Oct '17

30 Oct '17

I haven't been tracking dovecot-2.3 until now, but I've just given it a quick run, and there are a few things that may need some attention. Linux x86-64, Gentoo, GCC-7.2.0 Dovecot 2.3 @ commit 32c2612514a404ebc226f32bb88f28d76ceb1db1 Compiled with: ./configure --prefix=/usr --build=x86_64-pc-linux-gnu --host=x86_64-pc-linux-gnu --mandir=/usr/share/man --infodir=/usr/share/info --datadir=/usr/share --sysconfdir=/etc --localstatedir=/var/lib --disable-dependency-tracking --disable-silent-rules --docdir=/usr/share/doc/dovecot-9999_p20171018 --htmldir=/usr/share/doc/dovecot-9999_p20171018/html --libdir=/usr/lib64 --localstatedir=/var --with-moduledir=/usr/lib64/dovecot --without-stemmer --disable-rpath --with-icu --with-systemdsystemunitdir=/usr/lib/systemd/system --enable-maintainer-mode --with-bzlib --without-libcap --without-gssapi --without-ldap --with-lucene --with-lz4 --with-lzma --without-mysql --with-pam --without-pgsql --without-sqlite --without-solr --with-ssl --with-libwrap --without-textcat --without-vpopmail --with-zlib --disable-static Warnings: (Lots of this one...) /bin/sh ../../../libtool --tag=CC --mode=compile x86_64-pc-linux-gnu-gcc -DHAVE_CONFIG_H -I. -I../../.. -I../../../src/lib -I../../../src/lib-settings -I../../../src/lib-fts -I../../../src/lib-ssl-iostream -I../../../src/lib-http -I../../../src/lib-mail -I../../../src/lib-imap -I../../../src/lib-index -I../../../src/lib-storage -I../../../src/lib-storage/index -I../../../src/doveadm -std=gnu99 -O0 -g -pipe -march=native -mtune=native -ggdb -fstack-protector-strong -D_FORTIFY_SOURCE=2 -Wall -W -Wmissing-prototypes -Wmissing-declarations -Wpointer-arith -Wchar-subscripts -Wformat=2 -Wbad-function-cast -fno-builtin-strftime -Wstrict-aliasing=2 -c -o fts-user.lo fts-user.c libtool: compile: x86_64-pc-linux-gnu-gcc -DHAVE_CONFIG_H -I. -I../../.. -I../../../src/lib -I../../../src/lib-settings -I../../../src/lib-fts -I../../../src/lib-ssl-iostream -I../../../src/lib-http -I../../../src/lib-mail -I../../../src/lib-imap -I../../../src/lib-index -I../../../src/lib-storage -I../../../src/lib-storage/index -I../../../src/doveadm -std=gnu99 -O0 -g -pipe -march=native -mtune=native -ggdb -fstack-protector-strong -D_FORTIFY_SOURCE=2 -Wall -W -Wmissing-prototypes -Wmissing-declarations -Wpointer-arith -Wchar-subscripts -Wformat=2 -Wbad-function-cast -fno-builtin-strftime -Wstrict-aliasing=2 -c fts-storage.c -fPIC -DPIC -o .libs/fts-storage.o <command-line>:0:0: warning: "_FORTIFY_SOURCE" redefined <built-in>: note: this is the location of the previous definition In file included from /usr/include/bits/libc-header-start.h:33:0, from /usr/include/stdlib.h:25, from ../../../src/lib/lib.h:11, from fts-storage.c:3: /usr/include/features.h:376:4: warning: #warning _FORTIFY_SOURCE requires compiling with optimization (-O) [-Wcpp] # warning _FORTIFY_SOURCE requires compiling with optimization (-O) ^~~~~~~ The build then fails entirely with this: /bin/sh ../../../libtool --tag=CC --mode=compile x86_64-pc-linux-gnu-gcc -DHAVE_CONFIG_H -I. -I../../.. -I/home/portage/portage/net-mail/dovecot-9999_p20171018/work/dovecot-9999_p20171018 -I/home/portage/portage/net-mail/dovecot-9999_p20171018/work/dovecot-9999_p20171018/src/lib -I/home/portage/portage/net-mail/dovecot-9999_p20171018/work/dovecot-9999_p20171018/src/lib-dict -I/home/portage/portage/net-mail/dovecot-9999_p20171018/work/dovecot-9999_p20171018/src/lib-dns -I/home/portage/portage/net-mail/dovecot-9999_p20171018/work/dovecot-9999_p20171018/src/lib-http -I/home/portage/portage/net-mail/dovecot-9999_p20171018/work/dovecot-9999_p20171018/src/lib-mail -I/home/portage/portage/net-mail/dovecot-9999_p20171018/work/dovecot-9999_p20171018/src/lib-smtp -I/home/portage/portage/net-mail/dovecot-9999_p20171018/work/dovecot-9999_p20171018/src/lib-imap -I/home/portage/portage/net-mail/dovecot-9999_p20171018/work/dovecot-9999_p20171018/src/lib-fs -I/home/portage/portage/net-mail/dovecot-9999_p20171018/work/dovecot-9999_p20171018/src/lib-charset -I/home/portage/portage/net-mail/dovecot-9999_p20171018/work/dovecot-9999_p20171018/src/lib-auth -I/home/portage/portage/net-mail/dovecot-9999_p20171018/work/dovecot-9999_p20171018/src/lib-master -I/home/portage/portage/net-mail/dovecot-9999_p20171018/work/dovecot-9999_p20171018/src/lib-ssl-iostream -I/home/portage/portage/net-mail/dovecot-9999_p20171018/work/dovecot-9999_p20171018/src/lib-compression -I/home/portage/portage/net-mail/dovecot-9999_p20171018/work/dovecot-9999_p20171018/src/lib-settings -I/home/portage/portage/net-mail/dovecot-9999_p20171018/work/dovecot-9999_p20171018/src/lib-test -I/home/portage/portage/net-mail/dovecot-9999_p20171018/work/dovecot-9999_p20171018/src/lib-sasl -I/home/portage/portage/net-mail/dovecot-9999_p20171018/work/dovecot-9999_p20171018/src/lib-stats -I/home/portage/portage/net-mail/dovecot-9999_p20171018/work/dovecot-9999_p20171018/src/lib-dcrypt -I/home/portage/portage/net-mail/dovecot-9999_p20171018/work/dovecot-9999_p20171018/src/lib-program-client -I/home/portage/portage/net-mail/dovecot-9999_p20171018/work/dovecot-9999_p20171018/src/lib-index -I/home/portage/portage/net-mail/dovecot-9999_p20171018/work/dovecot-9999_p20171018/src/lib-storage -I/home/portage/portage/net-mail/dovecot-9999_p20171018/work/dovecot-9999_p20171018/src/lib-storage/list -I/home/portage/portage/net-mail/dovecot-9999_p20171018/work/dovecot-9999_p20171018/src/lib-storage/index -I/home/portage/portage/net-mail/dovecot-9999_p20171018/work/dovecot-9999_p20171018/src/lib-storage/index/raw -I/home/portage/portage/net-mail/dovecot-9999_p20171018/work/dovecot-9999_p20171018/src/lib-imap-storage -I/home/portage/portage/net-mail/dovecot-9999_p20171018/work/dovecot-9999_p20171018/src/plugins/quota -DMODULEDIR=\""/usr/lib64/dovecot"\" -O0 -g -pipe -march=native -mtune=native -ggdb -c -o realpath.lo realpath.c edit-mail.c: In function ‘edit_mail_wrap’: edit-mail.c:235:14: error: too few arguments to function ‘mailbox_transaction_begin’ raw_trans = mailbox_transaction_begin(raw_box, 0); ^~~~~~~~~~~~~~~~~~~~~~~~~ In file included from /home/portage/portage/net-mail/dovecot-9999_p20171018/work/dovecot-9999_p20171018/src/lib-storage/mail-storage-private.h:7:0, from edit-mail.c:16: /home/portage/portage/net-mail/dovecot-9999_p20171018/work/dovecot-9999_p20171018/src/lib-storage/mail-storage.h:651:1: note: declared here mailbox_transaction_begin(struct mailbox *box, ^~~~~~~~~~~~~~~~~~~~~~~~~ edit-mail.c: In function ‘edit_mail_set_cache_corrupted’: edit-mail.c:1662:2: error: too few arguments to function ‘edmail->wrapped->v.set_cache_corrupted’ edmail->wrapped->v.set_cache_corrupted(&edmail->wrapped->mail, field); ^~~~~~ edit-mail.c: In function ‘edit_mail_set_cache_corrupted_reason’: edit-mail.c:1671:21: error: ‘struct mail_vfuncs’ has no member named ‘set_cache_corrupted_reason’; did you mean ‘set_cache_corrupted’? edmail->wrapped->v.set_cache_corrupted_reason ^~~~~~~~~~~~~~~~~~~~~~~~~~ set_cache_corrupted edit-mail.c: At top level: edit-mail.c:1701:2: warning: initialization from incompatible pointer type [-Wincompatible-pointer-types] edit_mail_get_real_mail, ^~~~~~~~~~~~~~~~~~~~~~~ edit-mail.c:1701:2: note: (near initialization for ‘edit_mail_vfuncs.get_backend_mail’) edit-mail.c:1708:2: warning: initialization from incompatible pointer type [-Wincompatible-pointer-types] edit_mail_set_cache_corrupted, ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~ edit-mail.c:1708:2: note: (near initialization for ‘edit_mail_vfuncs.set_cache_corrupted’) edit-mail.c:1710:2: warning: excess elements in struct initializer edit_mail_set_cache_corrupted_reason ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ edit-mail.c:1710:2: note: (near initialization for ‘edit_mail_vfuncs’) make[4]: *** [Makefile:481: edit-mail.lo] Error 1 make[4]: *** Waiting for unfinished jobs.... Reuben

5 9

Re: Password encription
by Joseph Tam 29 Oct '17

29 Oct '17

Aki Tuomi wrote: > The use of salt, today, is to prevent the attacker from directly seeing > who has same passwords. Of course it also will make a rainbow table > attack less useful, Not just less useful, but almost infeasible. Given the use of random salts, you would have to generate (number of possible salts) rainbow tables. This drastically changes the CPU/storage tradeoffs. > but then again, no one uses rainbow tables anymore > since it takes about few minutes to brute force a password in the cloud > or on your home computer GPU. SHA512-CRYPT uses by default 4000 rounds > on dovecot, to make it more computationally expensive, but still it's > not very strong protection anymore. I know it is theoretically possible, but really, how feasible is it? The way people talk about it, they make it sound trivial. As a test, I just generated a hash using "doveadm pw". Any takers? {SHA512-CRYPT}$6$qyQANQFbQGqOSqHh$Z4YVIe.QakXtWs63lWUmzlseKpiFzfPCKhwM0NQk8jP6QeRmk6POkCdSrFBmVO2wh.dgPCPA7Gq3sNUeKOZLM/ > MD5 with or without salt can be ATTAcked at passwords per second speed, > so using CRAM-MD5 of DIGEST-MD5 is very very poor choice. Anything with > MD5 should not be used for passwords these days. > > With Dovecot 2.3 we are making BLF-CRYPT available on all platforms, and > also adding support for ARGON2 when you have libsodium available. Straight hashes, without question, are weak. I routinely break NTLM hashes with rainbow tables. I'm *not* arguing against the use of stronger hashes, I'm just skeptical of the FUD surrounding the user of older salted hashes. This is especially true if the hashes are guarded against leakage, as most are. Strong crypt-hashes are an extra layer of protection (defense in depth). This page (if you trust 3rd parties) will report whether a password was ever found in a breached databases. You can also download the SHA1 hashes of all their known cracked passwords. It's big -- 5.3Gb 7-zipped file. https://haveibeenpwned.com/Passwords "j.emerlik" further asks: > You mean that today they using encrypted passwords to seeing > who has same passwords using brute force, hashes dictionary attack ? They precompute hashes for large number of password candidates, then look up hashes in that table. Rainbow tables are a way of folding large tables into a smaller ones, trading off space for extra CPU time. However, for hashes that use non-trivial salts, you would need to precompute an astronomically large number of tables. An attacker might be better off with a straight CPU-bound brute force search. Joseph Tam <jtam.home(a)gmail.com>

3 3

Need help in understanding auth digest-md5 and realm
by Admin Beckspaced 28 Oct '17

28 Oct '17

Hello dovecot community, I've setup dovecot and need a bit help in understanding the auth mechanism digest-md5 and realm in 10-auth.conf I got auth_mechanisms = plain login digest-md5 cram-md5 apop #auth_realms = #auth_default_realm = So i got empty realms. Auth normally works fine and clients can auth with mechanism digest-md5 and I see the following log entries: dovecot: auth: Debug: sql(user(a)temizbau.de,46.85.229.153,<klUjO3FcTy8uVeWZ>): Generating DIGEST-MD5 from user 'user(a)temizbau.de', password 'xxxx' dovecot: auth: Debug: sql(user(a)gruene-wiesentheid.de,87.168.26.5,<ISVLQXFcT/xXqBoF>): Generating DIGEST-MD5 from user 'user@gruene-wiesentheid.de@', password 'xxxxxxxxxx' dovecot: auth: Debug: sql(user(a)vitaler-genuss.de,81.209.203.170,<tzxyT3FcT9RR0cuq>): Generating DIGEST-MD5 from user 'user(a)vitaler-genuss.de', password 'xxxxxxxxxxx' But sometimes clients get a password mismatch and I the see the following log entries: dovecot: auth: Debug: sql(user(a)temizbau.de,80.187.103.15,<adzhAnVclmxQu2cP>): Generating DIGEST-MD5 from user 'user@temizbau.de@mail.beckspaced.com', password 'xxxx' dovecot: auth: Debug: sql(user(a)thansadet.com,87.218.86.165,<LWItYHVc6r1X2lal>): Generating DIGEST-MD5 from user 'user@thansadet.com@mail.beckspaced.com', password 'xxxxxxxxxx' dovecot: auth: Debug: sql(user(a)plaa-thansadetresort.com,110.164.127.146,<aGhcvHBcStJupH+S>): Generating DIGEST-MD5 from user 'user@plaa-thansadetresort.com@imap.beckspaced.com', password 'xxxxxxxxxx' when there's a password mismatch I see a different user string for generating the digest-md5 hash. i suppose users use a different mail client and the mail client does things differently? How can I fix this password mismatch thing? Do i just need to set an auth_realms of some random string in the 10-auth.conifig Or does the auth_realms need to be a host name? Domain name of some sort? For the moment I just removed the digest-md5 mechanism ... Or could I just simply not offer that mechanism? If someone could shed some light on this I would be more than grateful ;) Thanks & greetings Becki

4 6

Quota warning executable can not log to /dev/stdout
by Michael Härtl 28 Oct '17

28 Oct '17

I'm running dovecot 2.2.27 in a alpine based docker container and want to log to /dev/stdout. I therefore added this setting: log_path = /dev/stdout Logging works fine so far. Now I've added a quota-warning script. With the log_path setting above the script creates warnings like: Oct 28 10:27:01 quota-warning: Error: Can't open log file /dev/stdout: No such device or address Oct 28 10:27:01 quota-warning: Fatal: master: service(quota-warning): child 460 returned error 75 When I change log_path to something like /tmp/dovecot.log everything works fine. Dovecot itself is started via s6 with a run script like this: #!/bin/sh exec /usr/sbin/dovecot -F -c /etc/dovecot/dovecot.conf What could cause this issue and how could I fix it? For the record here's my doveconf -n output: # 2.2.27 (c0f36b0): /etc/dovecot/dovecot.conf # OS: Linux 4.4.27-x86_64-jb1 x86_64 ext4 auth_mechanisms = plain login auth_verbose = yes first_valid_uid = 100 log_path = /dev/stdout mail_gid = dovecot mail_home = /var/mail/domains/%d/%n mail_location = maildir:/var/mail/domains/%d/%n mail_max_userip_connections = 160 mail_plugins = " quota" mail_privileged_group = dovecot mail_uid = vmail managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext namespace inbox { inbox = yes location = mailbox Drafts { auto = subscribe special_use = \Drafts } mailbox Junk { auto = subscribe special_use = \Junk } mailbox Sent { auto = subscribe special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { auto = subscribe special_use = \Trash } prefix = separator = . } passdb { args = /etc/dovecot/dovecot-mysql.conf.ext driver = sql } plugin { quota = maildir:User quota quota_exceeded_message = Storage quota for user %u exceeded (Benutzer %u hat sein Speichervolumen ueberschritten) quota_grace = 10%% quota_rule2 = Trash:storage=+100M quota_status_nouser = DUNNO quota_status_overquota = 552 5.2.2 Mailbox is full quota_status_success = DUNNO quota_warning = storage=85%% quota-warning 80 %u %d } protocols = imap lmtp sieve service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0666 user = postfix } unix_listener auth-userdb { mode = 0777 } } service lmtp { unix_listener /var/spool/postfix/private/dovecot-lmtp { group = postfix mode = 0600 user = postfix } } service quota-status { client_limit = 1 executable = quota-status -p postfix inet_listener { port = 10001 } } service quota-warning { executable = script /usr/local/bin/quota-warning.sh group = dovecot unix_listener quota-warning { mode = 0666 user = dovecot } user = vmail } ssl_cert = </certs/fullchain.pem ssl_key = # hidden, use -P to show it ssl_protocols = !SSLv2 !SSLv3 userdb { args = /etc/dovecot/dovecot-mysql.conf.ext driver = sql } protocol imap { mail_plugins = " quota imap_quota" } protocol lmtp { mail_plugins = " quota sieve" }

2 2

How to check which version of openssl is getting compiled in into dovecot?
by krzf83＠gmail.com 27 Oct '17

27 Oct '17

I got multiple versions of openssl in my system. I compile dovecot with PKG_CONFIG_PATH=/usr/openssl-1.0.2l-fpic/lib/pkgconfig ./configure How do I check which version of openssl got compiled in? configure script does not show version. There seem to be no way to check it in compiled binary (?) My dovecot is still seen vulnerable by tls testing tools so I'm guessing wrong version of openssl got compiled it but there seem to be no way to check it.

3 7

secure setup for imap hibernation
by Arkadiusz Miśkiewicz 27 Oct '17

27 Oct '17

Hi. What's the approach for securely enabling imap hibernation in case when each user uses different uid and gid? Looks like none and 0666 on hibernation and imap master sockets is the only way? Thanks, -- Arkadiusz Miśkiewicz, arekm / ( maven.pl | pld-linux.org )

2 3

Re: Password encription
by Aki Tuomi 27 Oct '17

27 Oct '17

SHA512-CRYPT and PLAIN/LOGIN with SSL. ---Aki TuomiDovecot oy -------- Original message --------From: "j.emerlik" <j.emerlik(a)gmail.com> Date: 25/10/2017 12:07 (GMT+02:00) To: Aki Tuomi <aki.tuomi(a)dovecot.fi> Cc: Dovecot Mailing List <dovecot(a)dovecot.org> Subject: Re: Password encription What scheme and mechanism do you recommend? 2017-10-25 11:01 GMT+02:00 Aki Tuomi <aki.tuomi(a)dovecot.fi>: > CRAM-MD5 should not be used. Its not terribly secure. > > > ---Aki TuomiDovecot oy > -------- Original message --------From: "j.emerlik" <j.emerlik(a)gmail.com> > Date: 25/10/2017 11:58 (GMT+02:00) To: Aki Tuomi <aki.tuomi(a)dovecot.fi> > Cc: Dovecot Mailing List <dovecot(a)dovecot.org> Subject: Re: Password > encription > Thx Aki, > with CRAP-MD5 as scheme and mechanism it's works corretlly. > > 2017-10-25 10:52 GMT+02:00 Aki Tuomi <aki.tuomi(a)dovecot.fi>: > > > PLAIN and LOGIN. > > > > > > > > --- > > Aki Tuomi > > Dovecot oy > > > > -------- Original message -------- > > From: "j.emerlik" <j.emerlik(a)gmail.com> > > Date: 25/10/2017 11:41 (GMT+02:00) > > To: Dovecot Mailing List <dovecot(a)dovecot.org> > > Subject: Password encription > > > > Hi, > > which authentication mechanism should I use for SHA-256 password schama ? > > Regards, > > Jack > > >

3 6

Looking for NTLM config example
by Mark Foley 26 Oct '17

26 Oct '17

Now that I am running Thunderbird on Linux and away from Windows/Outlook, I'd like to take another run at setting up NTLM authentication from Thunderbird to my Samba4 AC/DC. With the help of the samba maillist folks I was able to set up NTLM authentication for domain user login. I should be able to do the same for email! But, I need help. I went to http://wiki2.dovecot.org/Authentication/Mechanisms/NTLM and got lost immediately. Are "authenticaion submethods" synonymous with "password schemes"? The 7th line down says, "NTLM password scheme is required for NTLM, NTLM2 and NTLMv2.", but in the referenced link I found no reference to "NTLM password scheme". The links http://wiki2.dovecot.org/Authentication/Mechanisms/NTLM and http://wiki2.dovecot.org/Authentication/PasswordSchemes, tell you what the 4 NTLM authentication submethods are, tells you what password schemes are, tells you what the NTLM client/server handshake is, but doesn't actually tell you how to configure dovecot config files. I'm much more interested in the "how to" than in: "NTLMv2: server and client nonce, MITM can't force downgrade" ... whatever that means. Anyway, probably it's my lack of understanding terminology. I don't even know what a "nonce" is. But, I learn well from examples! Can somone please give me a sample 10-auth.conf for NTML and any other supporting settings or configs I need? My current/working dovecot settings, which have been running perfectly for well over a year now, are: $ dovecot -n # 2.2.15: /usr/local/etc/dovecot/dovecot.conf # OS: Linux 3.10.17 x86_64 Slackware 14.1 auth_debug_passwords = yes auth_mechanisms = plain login auth_verbose = yes auth_verbose_passwords = plain disable_plaintext_auth = no info_log_path = /var/log/dovecot_info mail_location = maildir:~/Maildir passdb { driver = shadow } protocols = imap ssl_cert = </etc/ssl/certs/OHPRS/GoDaddy/Apache/2015-08-14/57aa6ed6ae98b4c7.crt ssl_key = </etc/ssl/certs/OHPRS/GoDaddy/my.server.name.key userdb { driver = passwd } verbose_ssl = yes Here's what I've tried so far as 10-auth.conf: disable_plaintext_auth = no auth_use_winbind = yes info_log_path = /var/log/dovecot_info auth_verbose = yes auth_debug_passwords = yes auth_verbose_passwords= plain auth_winbind_helper_path = /usr/bin/ntlm_auth auth_mechanisms = ntlm plain login userdb { driver = passwd args = username_format=%n allow_all_users=yes } Which gives me a dovecot -n of: $ dovecot -n # 2.2.15: /usr/local/etc/dovecot/dovecot.conf # OS: Linux 3.10.17 x86_64 Slackware 14.1 auth_debug_passwords = yes auth_mechanisms = ntlm plain login auth_use_winbind = yes auth_verbose = yes auth_verbose_passwords = plain disable_plaintext_auth = no info_log_path = /var/log/dovecot_info mail_location = maildir:~/Maildir protocols = imap ssl_cert = </etc/ssl/certs/OHPRS/GoDaddy/Apache/2015-08-14/57aa6ed6ae98b4c7.crt ssl_key = </etc/ssl/certs/OHPRS/GoDaddy/my.server.name.key userdb { args = username_format=%n allow_all_users=yes driver = passwd } verbose_ssl = yes I configured Thunderbird for NTLM authentication, then tried sending a message, I got the following in /var/log/dovecot_info: Apr 22 01:37:57 imap-login: Debug: SSL: elliptic curve secp384r1 will be used for ECDH and ECDHE key exchanges Apr 22 01:37:57 imap-login: Debug: SSL: elliptic curve secp384r1 will be used for ECDH and ECDHE key exchanges Apr 22 01:37:57 auth: Debug: Loading modules from directory: /usr/local/lib/dovecot/auth Apr 22 01:37:57 imap-login: Info: Disconnected: Auth process broken (disconnected before auth was ready, waited 0 secs): user=<>, rip=192.168.0.58, lip=98.102.63.107, session=<xFuyOgwx9wDAqAA6> On Thunderbird I got the error, "Sending of the message failed. The Outlgoing server (SMTP) my.server.name does not support the selected authentication method. Please change the 'Autnentication method' in 'Account Settings | Outgoing Server (SMTP)'." Clearly, something is configured wrong, but I've no clue what. Can I get some advice? THX --Mark

8 19

Initialization failed: Namespace '': mkdir(/var/www/mail) failed: Permission denied
by trash＠skrilnetz.net 26 Oct '17

26 Oct '17

Hi, I'm running dovecot (v 2.2.9) on ubuntu 14.04 since a long time. I did not change any configuration lately and I'm getting the below error message. /dovecot: lda(www-data): Error: user www-data: Initialization failed: Namespace '': MKDIR(/VAR/WWW/MAIL) failed: Permission denied (euid=33(www-data) egid=33(www-data) missing +w perm: /var/www, dir owned by 1001:1001 mode=0755//) / I did some troubleshooting and I don't understand where the MKDIR(/VAR/WWW/MAIL) is coming from. Mailboxes are in /var/mail and sending/receiving emails is working as it always did. mail_location is still setup to be MAIL_LOCATION = MBOX:~/MAIL:INBOX=/VAR/MAIL/%U Why is it trying a mkdir in /var/www? Any help would be appreciated. Rgs,

3 11