- dovecot - dovecot.org

Can passdb be bypassed for non-plaintext authentication mechanisms
by Mark Foley 05 Dec '17

05 Dec '17

I am using Active directory authentication via gssapi for most users. In dovecot.conf I have: auth_mechanisms = plain login gssapi auth_use_winbind = yes I also have passdb { driver = shadow } userdb { driver = passwd } for those few users who are NOT AD users. Even though the AD users do not exist in /etc/passwd or /etc/shadow, Dovecot ALWAYS first looks them up in shadow, which ALWAYS fails. The https://wiki2.dovecot.org/PasswordDatabase wiki says, "these databases can't be used with non-plaintext authentication mechanisms." Is there a way to bypass checking passdb (and userdb?) for these mechanism? --Mark

2 1

Re: Recommended tool for migrating IMAP servers
by Davide Marchi 05 Dec '17

05 Dec '17

[..] > Hi, > > I vouch for imapsync. Have used it in the past with quite a big amount > of > emails. > > cheers. > > x0p Ah, thanks x0! > Also if you have fs access on both servers, and you are using maildir, > plain rsync works just as well. > > Aki no, I've not fs access on both servers! :-/ > If you want to preserve IMAP UID:s and possibly also POP3 UIDL:s then > dovecot internal > dsync is the only tool that can do it. > > With every other tool you will face end users needing to invalidate > their local caches and > redownloading all headers if not also all mail bodies. > > Sami > Can I use this tool even if I do not know the other remote server typology? Many thanks to all!! Davide -- firma cosmogoniA <https://www.cosmogonia.org/> n o p r o v a r e n o f a r e o n o n f a r e n o n c e p r o v a r e

5 5

Re: Dovecot lmtp doesn't log
by Tomislav Perisic 04 Dec '17

04 Dec '17

Does anyone have any idea regarding this? On 17 Nov 2017 11:36, "Tomislav Perisic" <tomiperisic(a)gmail.com> wrote: Hi, We have 2 servers, server A and server B. Server A has: Postfix dovecot-2.2.33.2-1.el6.x86_64 Server B has: dovecot-2.2.33.2-1.el6.x86_64 dovecot-pigeonhole-2.2.33.2-1.el6.x86_64 Server A receives email on postfix, dovecot then takes that email from postfix and proxies it to Server B Dovecot. Dovecot on Server B takes the proxied email and delivers it with lmtp to the user inboxes. The problem is that the dovecot on server B Doesn't log anything regarding the emails that are being delivered to the mailbox via lmtp. Dovecot on server A logs everything perfectly regarding the proxy, so my assumption is that there is an issue with Dovecot lmtp logging. We changed the logging from syslog directly to a file and we noticed the same problem, missing log entries. We also tried turning on verbose logging and it didn't help. Server B: Red Hat 6.7 x86_64 rpm -qa | grep dove dovecot-2.2.33.2-1.el6.x86_64 dovecot-pigeonhole-2.2.33.2-1.el6.x86_64 doveconf -n # 2.2.33.2: /etc/dovecot/dovecot.conf # Pigeonhole version 0.4.21 auth_cache_negative_ttl = 0 auth_debug = yes auth_debug_passwords = yes auth_verbose = yes listen = * mail_debug = yes mail_gid = mail mail_location = maildir:~/Maildir mail_plugins = " quota zlib" mail_uid = vmail managesieve_notify_capability = mailto namespace inbox { inbox = yes location = mailbox Drafts { auto = subscribe special_use = \Drafts } mailbox Sent { auto = subscribe special_use = \Sent } mailbox Spam { auto = subscribe special_use = \Junk } mailbox Trash { auto = subscribe special_use = \Trash } mailbox Virus { auto = subscribe } plugin { quota = maildir:User quota sieve_extensions = +editheader sieve_max_actions = 32 sieve_max_redirects = 4 sieve_max_script_size = 1M sieve_quota_max_scripts = 0 sieve_trace_debug = yes sieve_trace_level = matching sieve_vacation_dont_check_recipient = yes sieve_vacation_send_from_recipient = yes sieve_vacation_use_original_recipient = yes zlib_save = gz zlib_save_level = 6 } protocols = imap pop3 lmtp sieve service auth { unix_listener auth-userdb { group = mail mode = 0666 user = vmail } } service lmtp { inet_listener lmtp { port = xx } } service managesieve-login { inet_listener sieve { port = xx } service_count = 1 } protocol lmtp { mail_plugins = " quota zlib sieve mail_log notify" } protocol imap { mail_plugins = " quota zlib imap_quota imap_zlib" } protocol sieve { managesieve_implementation_string = dovecot managesieve_logout_format = bytes ( in=%i : out=%o ) managesieve_max_line_length = 65536 managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date ihave }

3 6

Re: Howto authenticate smartPhone via Active Directory
by Mark Foley 03 Dec '17

03 Dec '17

Yes, you are right. This link: https://www.redips.net/linux/android-email-postfix-auth/#section2 shows: passdb pam { } used for authenticating Android. Problem #1 is that Slackware does not ship with PAM and the AD/DC Samba4 does not use it. It is used on Slackware for a domain member, but I'm not sure I should try configuring PAM on the AD/DC. Is there some otherway I can get authentication using domain credentials besides pam? the phone can send user and password. --Mark -----Original Message----- > Date: Sun, 03 Dec 2017 15:22:56 +0200 > Subject: Re: Howto authenticate smartPhone via Active Directory > From: Aki Tuomi <aki.tuomi(a)dovecot.fi> > To: Mark Foley <mfoley(a)ohprs.org>, dovecot(a)dovecot.org > > Actually you are authenticating gssapi clients from ad and everyone else from shadow. maybe you need to configure pam module? > ---Aki TuomiDovecot oy > > -------- Original message -------- > From: Mark Foley <mfoley(a)ohprs.org> > Date: 03/12/2017 06:03 (GMT+02:00) > To: dovecot(a)dovecot.org > Subject: Howto authenticate smartPhone via Active Directory > I have a Samba4 Active Directory server. Dovecot authenticates AD Users with domain credentials > using GSSAPI (Thunderbird client). I believe I have Dovecot set to attempt authentication via > shadow first and. failing that, it does authenticate via GSSAPI. > > Smartphones connect to Dovecot via port 143 and SSL. They are not domain members so if the > shadow authentication fails, no other methods are tried and no connection is made. > > What can I do with my dovecot config to fix this? > > > doveconf -n > # 2.2.15: /usr/local/etc/dovecot/dovecot.conf > # OS: Linux 4.4.88 x86_64 Slackware 14.2 > auth_debug = yes > auth_debug_passwords = yes > auth_gssapi_hostname = $ALL > auth_krb5_keytab = /etc/dovecot/dovecot.keytab > auth_mechanisms = plain login gssapi > auth_use_winbind = yes > auth_username_format = %n > auth_verbose = yes > auth_verbose_passwords = plain > disable_plaintext_auth = no > info_log_path = /var/log/dovecot_info > mail_location = maildir:~/Maildir > passdb { > driver = shadow > } > protocols = imap > ssl_cert = </etc/ssl/certs/OHPRS/GoDaddy/Apache/2016-08-10/54e789087d419b6e.crt > ssl_key = </etc/ssl/certs/OHPRS/GoDaddy/mail.ohprs.org.key > userdb { > driver = passwd > } > verbose_ssl = yes > > Thanks, Mark

1 0

Upgrade to 2.2.32 from 2.2.15 failed
by Mark Foley 03 Dec '17

03 Dec '17

I have a problem. I have been running Dovecot 2.2.15 and I'd like to upgrade. My distro (Slackware) has dovecot 2.2.32 available. I downloaded and installed that, but it didn't work. No one was able to get messages from the dovecot server on their workstations. The following is the entire dovecot log file from startup to the last message generated. No more messages went into the logfile after line 76, even with clients trying to connect. The 174.233.134.88 IP is from an external user connecting from his iPhone. The normal successful message from this user are shown at bottom. I'm suspecting something to do with line 18 where is says "Auth process broken." If anyone has any insight I'd deeply appreciate it as I'd love to upgrade. THX -- Mark 1 Nov 24 19:22:24 master: Info: Dovecot v2.2.32 (dfbe293d4) starting up for imap (core dumps disabled) 2 Nov 24 19:22:24 ssl-params: Info: Generating SSL parameters 3 Nov 24 19:22:26 ssl-params: Info: SSL parameters regeneration completed 4 Nov 24 19:23:02 imap-login: Debug: SSL: where=0x10, ret=1: before/accept initialization [174.233.134.88] 5 Nov 24 19:23:02 imap-login: Debug: SSL: where=0x2001, ret=1: before/accept initialization [174.233.134.88] 6 Nov 24 19:23:02 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 read client hello A [174.233.134.88] 7 Nov 24 19:23:02 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 write server hello A [174.233.134.88] 8 Nov 24 19:23:02 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 write certificate A [174.233.134.88] 9 Nov 24 19:23:02 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 write key exchange A [174.233.134.88] 10 Nov 24 19:23:02 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 write server done A [174.233.134.88] 11 Nov 24 19:23:02 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 flush data [174.233.134.88] 12 Nov 24 19:23:02 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 read client certificate A [174.233.134.88] 13 Nov 24 19:23:02 imap-login: Debug: SSL: where=0x2002, ret=-1: SSLv3 read client key exchange A [174.233.134.88] 14 Nov 24 19:23:02 imap-login: Debug: SSL: where=0x2002, ret=-1: SSLv3 read client key exchange A [174.233.134.88] 15 Nov 24 19:23:02 auth: Debug: Loading modules from directory: /usr/lib64/dovecot/auth 16 Nov 24 19:23:02 auth: Debug: Module loaded: /usr/lib64/dovecot/auth/lib20_auth_var_expand_crypt.so 17 Nov 24 19:23:02 auth: Debug: Loading modules from directory: /usr/lib64/dovecot/auth 18 Nov 24 19:23:02 imap-login: Info: Disconnected: Auth process broken (disconnected before auth was ready, waited 0 secs): user=<>, rip=174.233.134.88, lip=98.102.63.107, TLS handshaking, session=<idAcrMNe8xqu6YZY> 19 Nov 24 19:23:02 imap-login: Debug: SSL: where=0x10, ret=1: before/accept initialization [174.233.134.88] 20 Nov 24 19:23:02 imap-login: Debug: SSL: where=0x2001, ret=1: before/accept initialization [174.233.134.88] 21 Nov 24 19:23:02 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 read client hello A [174.233.134.88] 22 Nov 24 19:23:02 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 write server hello A [174.233.134.88] 23 Nov 24 19:23:02 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 write certificate A [174.233.134.88] 24 Nov 24 19:23:02 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 write key exchange A [174.233.134.88] 25 Nov 24 19:23:02 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 write server done A [174.233.134.88] 26 Nov 24 19:23:02 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 flush data [174.233.134.88] 27 Nov 24 19:23:02 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 read client certificate A [174.233.134.88] 28 Nov 24 19:23:02 imap-login: Debug: SSL: where=0x2002, ret=-1: SSLv3 read client key exchange A [174.233.134.88] 29 Nov 24 19:23:02 imap-login: Debug: SSL: where=0x2002, ret=-1: SSLv3 read client key exchange A [174.233.134.88] 30 Nov 24 19:23:02 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 read client key exchange A [174.233.134.88] 31 Nov 24 19:23:02 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 read certificate verify A [174.233.134.88] 32 Nov 24 19:23:02 imap-login: Debug: SSL: where=0x2002, ret=-1: SSLv3 read finished A [174.233.134.88] 33 Nov 24 19:23:03 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 read finished A [174.233.134.88] 34 Nov 24 19:23:03 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 write change cipher spec A [174.233.134.88] 35 Nov 24 19:23:03 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 write finished A [174.233.134.88] 36 Nov 24 19:23:03 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 flush data [174.233.134.88] 37 Nov 24 19:23:03 imap-login: Debug: SSL: where=0x20, ret=1: SSL negotiation finished successfully [174.233.134.88] 38 Nov 24 19:23:03 imap-login: Debug: SSL: where=0x2002, ret=1: SSL negotiation finished successfully [174.233.134.88] 39 Nov 24 19:23:04 auth: Debug: Loading modules from directory: /usr/lib64/dovecot/auth 40 Nov 24 19:23:04 auth: Debug: Module loaded: /usr/lib64/dovecot/auth/lib20_auth_var_expand_crypt.so 41 Nov 24 19:23:04 auth: Debug: Loading modules from directory: /usr/lib64/dovecot/auth 42 Nov 24 19:23:04 imap-login: Info: Disconnected: Auth process broken (disconnected before auth was ready, waited 2 secs): user=<>, rip=174.233.134.88, lip=98.102.63.107, TLS, session=<YGw7rMNe+Rqu6YZY> 43 Nov 24 19:23:04 imap-login: Debug: SSL alert: close notify [174.233.134.88] 44 Nov 24 19:23:05 imap-login: Debug: SSL: where=0x10, ret=1: before/accept initialization [174.233.134.88] 45 Nov 24 19:23:05 imap-login: Debug: SSL: where=0x2001, ret=1: before/accept initialization [174.233.134.88] 46 Nov 24 19:23:05 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 read client hello A [174.233.134.88] 47 Nov 24 19:23:05 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 write server hello A [174.233.134.88] 48 Nov 24 19:23:05 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 write certificate A [174.233.134.88] 49 Nov 24 19:23:05 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 write key exchange A [174.233.134.88] 50 Nov 24 19:23:05 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 write server done A [174.233.134.88] 51 Nov 24 19:23:05 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 flush data [174.233.134.88] 52 Nov 24 19:23:05 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 read client certificate A [174.233.134.88] 53 Nov 24 19:23:05 imap-login: Debug: SSL: where=0x2002, ret=-1: SSLv3 read client key exchange A [174.233.134.88] 54 Nov 24 19:23:05 imap-login: Debug: SSL: where=0x2002, ret=-1: SSLv3 read client key exchange A [174.233.134.88] 55 Nov 24 19:23:05 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 read client key exchange A [174.233.134.88] 56 Nov 24 19:23:05 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 read certificate verify A [174.233.134.88] 57 Nov 24 19:23:05 imap-login: Debug: SSL: where=0x2002, ret=-1: SSLv3 read finished A [174.233.134.88] 58 Nov 24 19:23:05 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 read finished A [174.233.134.88] 59 Nov 24 19:23:05 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 write change cipher spec A [174.233.134.88] 60 Nov 24 19:23:05 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 write finished A [174.233.134.88] 61 Nov 24 19:23:05 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 flush data [174.233.134.88] 62 Nov 24 19:23:05 imap-login: Debug: SSL: where=0x20, ret=1: SSL negotiation finished successfully [174.233.134.88] 63 Nov 24 19:23:05 imap-login: Debug: SSL: where=0x2002, ret=1: SSL negotiation finished successfully [174.233.134.88] 64 Nov 24 19:23:08 auth: Debug: Loading modules from directory: /usr/lib64/dovecot/auth 65 Nov 24 19:23:08 auth: Debug: Module loaded: /usr/lib64/dovecot/auth/lib20_auth_var_expand_crypt.so 66 Nov 24 19:23:08 auth: Debug: Loading modules from directory: /usr/lib64/dovecot/auth 67 Nov 24 19:23:08 imap-login: Info: Disconnected: Auth process broken (disconnected before auth was ready, waited 3 secs): user=<>, rip=174.233.134.88, lip=98.102.63.107, TLS, session=<7ZF4rMNe8hqu6YZY> 68 Nov 24 19:23:08 imap-login: Debug: SSL alert: close notify [174.233.134.88] 69 Nov 24 19:23:16 auth: Debug: Loading modules from directory: /usr/lib64/dovecot/auth 70 Nov 24 19:23:16 auth: Debug: Module loaded: /usr/lib64/dovecot/auth/lib20_auth_var_expand_crypt.so 71 Nov 24 19:23:16 auth: Debug: Loading modules from directory: /usr/lib64/dovecot/auth 72 Nov 24 19:23:16 imap-login: Info: Disconnected: Auth process broken (disconnected before auth was ready, waited 0 secs): user=<>, rip=192.168.0.54, lip=192.168.0.2, session=<6bbyrMNeGM/AqAA2> 73 Nov 24 19:24:13 auth: Debug: Loading modules from directory: /usr/lib64/dovecot/auth 74 Nov 24 19:24:13 auth: Debug: Module loaded: /usr/lib64/dovecot/auth/lib20_auth_var_expand_crypt.so 75 Nov 24 19:24:13 auth: Debug: Loading modules from directory: /usr/lib64/dovecot/auth 76 Nov 24 19:24:13 imap-login: Info: Disconnected: Auth process broken (disconnected before auth was ready, waited 0 secs): user=<>, rip=192.168.0.52, lip=192.168.0.2, session=<b75YsMNeb9nAqAA0> Normal OK messages from dovecot 2.2.15: Nov 24 23:50:49 imap-login: Debug: SSL: where=0x20, ret=1: SSL negotiation finished successfully [174.233.134.88] Nov 24 23:50:49 imap-login: Debug: SSL: where=0x2002, ret=1: SSL negotiation finished successfully [174.233.134.88] Nov 24 23:50:49 auth: Debug: client in: AUTH 1 PLAIN service=imap secured session=vQnEacde6QCu6YZY lip=98.102.63.107 rip=174.233.134.88 lport=993 rport=6889 resp=AG0udGhlbQAhbXRfMTAxOQ== (previous base64 data may contain sensitive data) Nov 24 23:50:49 auth-worker(17650): Debug: shadow(m.them,174.233.134.88): lookup Nov 24 23:50:49 auth: Debug: client passdb out: OK 1 user=m.them Finally, the 2.2.15 doveconf, which I used the same for 2.2.32: > doveconf -n # 2.2.15: /usr/local/etc/dovecot/dovecot.conf # OS: Linux 4.4.88 x86_64 Slackware 14.2 auth_debug = yes auth_debug_passwords = yes auth_gssapi_hostname = $ALL auth_krb5_keytab = /etc/dovecot/dovecot.keytab auth_mechanisms = plain login gssapi auth_use_winbind = yes auth_username_format = %n auth_verbose = yes auth_verbose_passwords = plain disable_plaintext_auth = no info_log_path = /var/log/dovecot_info mail_location = maildir:~/Maildir passdb { driver = shadow } protocols = imap ssl_cert = </etc/ssl/certs/OHPRS/GoDaddy/Apache/2016-08-10/54e789087d419b6e.crt ssl_key = </etc/ssl/certs/OHPRS/GoDaddy/mail.ohprs.org.key userdb { driver = passwd } verbose_ssl = yes

3 4

Dovecot (doveadm, ssl, sync) - SSL error
by Arkadiusz Majewski 03 Dec '17

03 Dec '17

Hello! I've got a problem to run syncing between both dovecot services on the separate servers. The error indicates to the problem with SSL. Directly using openssl command to connect from one server to other and vice versa is passed without any errors. OS: FreeBSD 11.1-RELEASE-p4 Dovecot: 2.2.33.2_2 and the older one dovecot-2.2.32.1_1 (or similar) - build by ports. OpenSSL: 1.0.2k-freebsd 26 Jan 2017 dovecot: doveadm(10.18.1.15): Error: doveadm client disconnected before handshake: SSL_accept() failed: error:140760FC:SSL routines:SSL23_GET_CLIENT_HELLO:unknown protocol dovecot.conf (on both servers): mail_plugins = $mail_plugins notify replication service replicator { process_min_avail = 1 } service aggregator { fifo_listener replication-notify-fifo { user = dovecot } unix_listener replication-notify { user = dovecot } } service replicator { unix_listener replicator-doveadm { mode = 0600 } } replication_max_conns = 10 service doveadm { inet_listener { port = 12130 ssl = yes } } ssl = required ssl_protocols = SSLv3 TLSv1 TLSv1.1 TLSv1.2 ssl_cert = </usr/local/etc/dovecot/ssl/cert.crt ssl_key = </usr/local/etc/dovecot/ssl/cert.key ssl_client_ca_file = </usr/local/etc/dovecot/ssl/ca.pem ssl_client_ca_dir = /usr/local/etc/dovecot/ssl Thank you in advance for any help. Kind Regards, Arkadiusz Majewski

1 0

doveadm with 2-level user/domain quotas scheme
by Max Kostikov 03 Dec '17

03 Dec '17

Hi! I believe now it a right time to return to previous discussion about Dovecot's in 2-level user/domain quotas scheme wich was finished here https://dovecot.org/pipermail/dovecot/2015-October/102346.html Here is configuration. 1. Dictionary storage placed in MySQL table "quota2" root@localhost [(none)]> SHOW COLUMNS FROM quota2 FROM exim; +----------+--------------+------+-----+---------+-------+ | Field | Type | Null | Key | Default | Extra | +----------+--------------+------+-----+---------+-------+ | username | varchar(100) | NO | PRI | NULL | | | bytes | bigint(20) | NO | | 0 | | | messages | int(11) | NO | | 0 | | +----------+--------------+------+-----+---------+-------+ 3 rows in set (0,00 sec) 2. Two types of quota - for domains with index "2" and for users without index. ... plugin { quota = dict:user_quota::proxy::sqluserquota quota_rule2 = Trash:storage=+10%% quota_rule3 = Junk:storage=+10%% quota_warning = storage=100%% quota-exceeded 100 %u quota_warning2 = storage=95%% quota-warning 95 %u quota_warning3 = storage=90%% quota-warning 90 %u quota_warning4 = storage=75%% quota-warning 75 %u quota2 = dict:domain_quota:%d:proxy::sqldomainquota } dict { sqluserquota = mysql:/usr/local/etc/dovecot/dovecot-dict-sql-user.conf sqldomainquota = mysql:/usr/local/etc/dovecot/dovecot-dict-sql-domain.conf } service dict { unix_listener dict { user = mailnull mode = 0660 } } ... 3. Both stored in the same table and files "dovecot-dict-sql-user.conf" and "dovecot-dict-sql-domain.conf" are identical. connect = host=localhost dbname=exim user=user password=password map { pattern = priv/quota/storage table = quota2 username_field = username value_field = bytes } map { pattern = priv/quota/messages table = quota2 username_field = username value_field = messages } All quotas for users and domains are calculates correctly until "doveadm quota recalc" use. root@beta:~ # doveadm quota recalc -u foo(a)my.domain root@beta:~ # doveadm quota get -u foo(a)my.domain Quota name Type Value Limit % user_quota STORAGE 7850978 - 0 user_quota MESSAGE 32474 - 0 domain_quota STORAGE 7850978 - 0 domain_quota MESSAGE 32474 - , 0 If we look at MySQL table directly foo(a)my.domain quota was counted right but last users data was copied into domains values. ... root@localhost [exim]> SELECT * FROM quota2 WHERE username LIKE '%my.domain'; +-------------------+-------------+----------+ | username | bytes | messages | +-------------------+-------------+----------+ | foo(a)my.domain | 8039401321 | 32474 | | my.domain | 8039401321 | 32474 | | john(a)my.domain | 3455382803 | 11142 | | mary(a)my.domain | 544637146 | 1965 | +-------------------+-------------+----------+ 4 rows in set (0.00 sec) ... Also you may see that "doveadm quota get" above gave wrong values. For domain its produces empty output root@beta:~ # doveadm quota get -u my.domain doveadm(my.domain): Error: User doesn't exist Quota name Type Value Limit % Than if we are trying to calculate quota for domain or for all users (-A) it produces an error. root@beta:~ # doveadm quota recalc -u my.domain doveadm(my.domain): Error: User doesn't exist root@beta:~ # doveadm quota recalc -A Error: User listing returned failure doveadm: Error: Failed to iterate through some users So "doveadm quota" almost useless for such quotas scheme except single user. I wrote small shell-script "dovequota.sh" to resolve this issue but I believe that doveadm need to be fixed too. (script may be found here https://kostikov.co/problemy-uchyota-domennoj-kvoty-v-dovecot-2) -- With best regards, Max Kostikov BBM: 24CA5DF8 | W: https://kostikov.co

1 0

Re: Howto authenticate smartPhone via Active Directory
by Aki Tuomi 03 Dec '17

03 Dec '17

Actually you are authenticating gssapi clients from ad and everyone else from shadow. maybe you need to configure pam module? ---Aki TuomiDovecot oy -------- Original message --------From: Mark Foley <mfoley(a)ohprs.org> Date: 03/12/2017 06:03 (GMT+02:00) To: dovecot(a)dovecot.org Subject: Howto authenticate smartPhone via Active Directory I have a Samba4 Active Directory server. Dovecot authenticates AD Users with domain credentials using GSSAPI (Thunderbird client). I believe I have Dovecot set to attempt authentication via shadow first and. failing that, it does authenticate via GSSAPI. Smartphones connect to Dovecot via port 143 and SSL. They are not domain members so if the shadow authentication fails, no other methods are tried and no connection is made. What can I do with my dovecot config to fix this? > doveconf -n # 2.2.15: /usr/local/etc/dovecot/dovecot.conf # OS: Linux 4.4.88 x86_64 Slackware 14.2 auth_debug = yes auth_debug_passwords = yes auth_gssapi_hostname = $ALL auth_krb5_keytab = /etc/dovecot/dovecot.keytab auth_mechanisms = plain login gssapi auth_use_winbind = yes auth_username_format = %n auth_verbose = yes auth_verbose_passwords = plain disable_plaintext_auth = no info_log_path = /var/log/dovecot_info mail_location = maildir:~/Maildir passdb { driver = shadow } protocols = imap ssl_cert = </etc/ssl/certs/OHPRS/GoDaddy/Apache/2016-08-10/54e789087d419b6e.crt ssl_key = </etc/ssl/certs/OHPRS/GoDaddy/mail.ohprs.org.key userdb { driver = passwd } verbose_ssl = yes Thanks, Mark

1 0

mmap() Error, Invalid Argument - Double slash in path?
by GE Junk 02 Dec '17

02 Dec '17

I get a ton of these mmap() errors in the log. I noticed there's a double slash before Maildir. Is this normal? Config error? Dovecot bug? dovecot: imap(email(a)email.net): Error: mmap() failed with file /shares/email/vmail/vmail1/email.net/e/m/a/email-2017.02.25.08.09.39//Maildir/dovecot.index.cache: Invalid argument I'm running dovecot version 2.2.22 Thanks Eric

2 2

Re: Lua Auth
by Aki Tuomi 02 Dec '17

02 Dec '17

-------- Original message --------From: Mark Moseley <moseleymark(a)gmail.com> Date: 02/12/2017 02:34 (GMT+02:00) To: Cc: Dovecot Mailing List <dovecot(a)dovecot.org> Subject: Re: Lua Auth On Thu, Nov 30, 2017 at 5:26 AM, Stephan Bosch <s.bosch(a)ox.io> wrote: > > > Op 29-11-2017 om 6:17 schreef Aki Tuomi: > >> On November 29, 2017 at 4:37 AM Mark Moseley <moseleymark(a)gmail.com> >>> wrote: >>> >>> >>> Just happened to be surfing the docs and saw this. This is beyond >>> awesome: >>> >>> https://wiki2.dovecot.org/AuthDatabase/Lua >>> >>> Any words of wisdom on using it? I'd be putting a bunch of mysql logic in >>> it. Any horrible gotchas there? When it says 'blocking', should I assume >>> that means that a auth worker process will *not* accept any new auth >>> lookups until both auth_passdb_lookup() and auth_userdb_lookup() have >>> completed (in which I'd be doing several mysql calls)? If that's the >>> case, >>> I assume that the number of auth workers should be bumped up. >>> >>> And is a 2.3 release fairly imminent? >>> >> Hi! >> >> This feature was added very recently, and there is very little >> operational experience on it. As the docs should say, blocking=yes means >> that an auth worker is used, and yes, it will block each auth worker during >> authentication, but what we tried, it should perform rather nicely. >> >> The most important gotcha is to always test your lua code rigorously, >> because there is not much we can do to save you. >> >> It should be present in master branch, so if someone feels like trying it >> out, please let us know if you find any bugs or strangeness. It's not >> present in nightlies yet. >> >> We are planning on releasing 2.3.0 this year. >> > > The Xi package builder has this feature enabled since yesterday. It is > available in the dovecot-lua package; the first Xi package that doesn't > have an official Debian equivalent (yet anyway). > > > I've been playing with Lua auth and so far no issues. I was previously putting together a very ugly MySQL stored procedure. Using Lua would be a lot easier (esp when it comes to returning an arbitrary number of columns). I'd love to see any test Lua code that the dovecot team has been playing around with (and realize it's not remotely production-ready, so don't worry about caveats I did have a couple of questions though: 1) Is the data returned by Lua auth not cacheable? I've got the following settings (and I'm just using Lua in the userdb lookup, not passdb -- passdb is doing a lightweight SQL lookup for username/password): auth_cache_negative_ttl = 1 mins auth_cache_size = 10 M auth_cache_ttl = 10 mins but I notice that every time I auth, it'll redo all the queries in my Lua code. I'd have expected that data to be served out of cache till the 10min TTL is up 2) Is there an appropriate way to return data with spaces in it (or presumably other non-alphanum chars. My quota name had a space in it, which somehow got interpreted as 'yes' , i.e.: imap: Error: Failed to initialize quota: Invalid quota root quota: Unknown quota backend: yes I simply changed the space to an underscore as a workaround, but I'm curious if there's a better way. I tried various quoting without success. Didn't try escaping yet. 3) Can you elaborate on the "auth_request#response_from_template(template)" and "auth_request#var_expand(template)" functions? Specifically how to use them. I'm guessing that I could've used one of them to work around #2 (that it would have done the escaping for me) Thanks! ----- 1) I'll have to check this. 2) Instead of string, return a key value table. you can have spaces in values. 3) response_from_template expands a key=value string into table by var expanding values. var_expand can be used to interpolation for any purposes. it returns a string. see https://wiki.dovecot.org/Variables for details on how to use it. Individual variable access is more efficient to do directly. --- Aki Tuomi

1 0

Re: iPhone/iPad IMAP connection bursts causes user+IP exceeded
by Joseph Tam 02 Dec '17

02 Dec '17

"David.M.Clark" <david(a)davrom.com> wrote: > I have modified mail_max_userip_connections to 400 which made no difference. > > The end user customer actually had Apple remote into their device and > they were impressed that the end user knew their IMAP settings. They > tested it and during this connection time, it worked as expected with > send and receive of e-mails. After Apple support disconnected from the > device, it not longer worked. I'm not sure your problem is the same as mine. Apart from getting a lot of these log messages ... Oct 24 21:32:54 server dovecot: imap-login: Maximum number of connections from user+IP exceeded (mail_max_userip_connections=12): user=<user> my users are not reporting any functional problems. I investigated this a little further. I bumped mail_max_userip_connections to 100, and looked at one of these connection bursts for one of my users. What I found was that it would steadily open new connections, hit the cap, then disconnect them all, and start the cycle over again. However, it would stop when the total number of connections made roughly equal to the number of mailboxes the user had. So a rough algorithm for these clients is for each mailbox[1..n] { if open mailbox[i] { ... do operation ... } else { // Hit cap close all open mailboxes } } close all open mailbox For example, if the user has 13 mailboxes and mail_max_userip_connections=5, you would see (c=connect, d=disconnect, m=max log lessage): ccccc m ddddd ccccc m ddddd ccc ddd I'm not sure whether the reader client displays partial results, or it collects all the results when the entire operation finishes. So the final effect I saw of bumping mail_max_userip_connections from the server perspective is that I get fewer "Maximum number of connections" log messages. Joseph Tam <jtam.home(a)gmail.com>

1 0

client unable to send mail, dovecot-imap errors
by GE Junk 02 Dec '17

02 Dec '17

Hi, I have an email client that is currently unable to send mail through imap. I am getting a ton of errors in dovecot-imap.log. All of these errors continue to show up, even after purging the dovecot*.* files from the offending folders. This happens to all email accounts on the server. Clearing the cache files doesn't fix, the error appears pretty much immediately after the new cache is generated. ============================== Error: mmap() failed with file path/Maildir/dovecot.index.cache: Invalid argument ============================== These errors are associated with an account unable to send right now. They seem to have only started since the send problem started. ============================== Error: Corrupted transaction log file path/Maildir/dovecot.index.log seq 5: indexid changed 1512100549 -> 1512183737 (sync_offset=0) Error: Index path/Maildir/dovecot.index: Lost log for seq=5 offset=12576: Failed to map file seq=178 offset=40..18446744073709551615 (ret=0) Warning: fscking index file path/Maildir/dovecot.index Error: Fixed index file path/Maildir/dovecot.index: log_file_seq 5 -> 179 IMAP session state is inconsistent, please relogin. in=26 out=1276 ============================== This error is also associated with the offending email client ============================== message repeated 9 times: [ imap(emailaddress): Error: Transaction log path/Maildir/dovecot.index.log: duplicate transaction log sequence (2)] ============================== Some additional info: dovecot: 2.2.22 (fe789d2) Ubuntu Server 16.04 Running on a qemu VM installed on an Unraid 6.3.5 Server 4GB RAM mail folder is located on virtio 9p2000 host passthru fs located on the same physical machine as the VM. Anyone have any ideas? Need additional information? Thanks, Eric

1 0

Lua Auth
by Mark Moseley 02 Dec '17

02 Dec '17

Just happened to be surfing the docs and saw this. This is beyond awesome: https://wiki2.dovecot.org/AuthDatabase/Lua Any words of wisdom on using it? I'd be putting a bunch of mysql logic in it. Any horrible gotchas there? When it says 'blocking', should I assume that means that a auth worker process will *not* accept any new auth lookups until both auth_passdb_lookup() and auth_userdb_lookup() have completed (in which I'd be doing several mysql calls)? If that's the case, I assume that the number of auth workers should be bumped up. And is a 2.3 release fairly imminent?

3 3

Autoreplies are not sent
by Sergio Belkin 01 Dec '17

01 Dec '17

Hi, Let's say I have 2 domains: - Virtual Mailbox Domain: example.local (internal domain) - Virtual Alias Domain: example.com (public domain) Every mail sent to @example.com is really sent to @example.local. I have a virtual alias that forward mails sent to support-abc(a)example.com is sent finally to: op1(a)example.local Now, I'd want to every mail was sent to support-abc(a)example.com it triggers an autoreply vacation style. So, I've wrote and compiled a sieve filter, something like that and put in op1(a)example.local sieve folder. But it fails complaining like that: nov 29 15:55:39 muteriver.example.local dovecot[12549]: lmtp(12675, op1(a)example.local) CqNdF6sCH1qDMQAAcSFsIQ: sieve: msgid=< ded22f3d-f1e3-157e-0667-ca73d851d1a8(a)example.com>: discarding vacation response for implicitly delivered message; no known (envelope) recipient address found in message headers (recipient=<op1(a)example.local>, and additional `:addresses' are specified) I've tried appending in dovecot configuration: lda_original_recipient_header = X-Original-To But it does not work either. Using: dovecot-pigeonhole-2.2.10-8.el7.centos.x86_64 and postfix-2.10.1-6.el7.x86_64 Please could you help me? Thanks in advance! -- -- Sergio Belkin LPIC-2 Certified - http://www.lpi.org

2 3

Re: iPhone/iPad IMAP connection bursts causes user+IP exceeded
by David.M.Clark 01 Dec '17

01 Dec '17

Thanks for the reply and suggestion Robert. I have now set mail_max_userip_connections to 400 in 20-imap.conf to see if it makes any difference. Late yesterday the customer tested from his office, an older IOS 9 tablet and he had IMAP working in a matter of minutes, so is certainly an newer software version by Apple issue. On 30/11/17 03:03, Robert Giles wrote: > David, > > I'd say that if you set the mail_max_userip_connections value to a > large-ish number (300-400), your users likely won't notice an issue on > their iOS 10.x and iOS 11.x devices. It's more of an annoyance in the > logs, and occasionally the iOS Mail app will show that it is stuck > checking mail for a few minutes (when the new max_userip_connections is > reached again, but with a large number, it happens much less frequently). > > Keep in mind max_userip applies to *authenticated* users, so a true, > malicious DoS situation is less likely. > > And yeah, I'm definitely tired of Apple going off and breaking their > software, because the blame always comes back on IT instead of Apple :( > > Robert > > > > On 2017-11-28 at 22:18, David.M.Clark wrote: >> Robert just got this one today. >> >> A customer has phoned who has replaced or updated their Apple 'stuff' >> (including iPhone 8 just purchased) and the identical settings that >> work on the older Apple based devices, as well as Outlook based PCs, >> work fine with IMAP (internal port 143 and external port 10143), but >> the newer IOS based devices just do not work. iPhone 8 does not let >> you downgrade to earlier OS either, which is something the customer >> was thinking of doing. >> >> Once again either Apple or Microsoft have 'moved the goal posts' >> expecting everyone else in the world to be forced to move with them. >> >> They are reporting issues on-line also with MS server and Office 365 >> so will be hoping we have some kind of good result quickly from Apple >> as this will only get worse as more people update and find their >> e-mail is 'dead in the water'. >> >> On 04/11/17 06:19, Robert Giles wrote: >>> Apologies for bumping Joseph Tam's rather old thread, but I'm >>> wondering if anyone has come up with a workaround/fix for this >>> problem that iOS Mail.app clients (10.3.3, 11.0.3, 11.1?) continue to >>> exhibit? >>> >>> Robert >>> >>> >>> >>> On 10/28/2016 at 03:49 PM, Joseph Tam wrote: >>>> I frequently see this from my iPhone/iPad IMAP users: >>>> >>>> Oct 24 21:30:55 server dovecot: imap-login: Login: user=<user>, >>>> ... >>>> [... repeated 10 times ...] >>>> Oct 24 21:32:54 server dovecot: imap-login: Maximum number of >>>> connections from user+IP exceeded (mail_max_userip_connections=12): >>>> user=<user> >>>> Oct 24 21:32:54 server dovecot: imap(user): Logged out ... >>>> [... repeated 11 times ...] >>>> >>>> These bursts of logins/max/logouts would cycling on for a few minutes. >>>> Googling this problem seems to turn up lots of similar complaints about >>>> iOS mail mail clients. e.g. >>>> >>>> https://discussions.apple.com/thread/2547839?tstart=0 >>>> >>>> iOS mail readers do not limit connections limit as other mailreaders >>>> can. I could increase mail_max_userip_connections, but that just moves >>>> the goal posts. >>>> >>>> Using the new rawlog feature in 2.2.26 (thanks Dovecot team!), I was >>>> able >>>> to see that these connection bursts are caused by clients doing global >>>> searches. The rawlogs show each mailbox being SELECT'd and searched >>>> (e.g. From header string): >>>> >>>> 1477369968.730450 2 ID ("name" "iPad Mail" "version" "13G36" >>>> "os" "iOS" "os-version" "9.3.5 (13G36)") >>>> 1477369968.781932 3 SELECT {mailbox} >>>> 1477369968.961636 4 UID SEARCH RETURN (COUNT) 1:* NOT DELETED >>>> 1477369969.006087 5 UID SEARCH RETURN (ALL) 1:* NOT DELETED >>>> 1477369969.052701 6 UID SEARCH RETURN (ALL) {search-term} NOT >>>> DELETED >>>> 1477369974.624153 7 LOGOUT >>>> >>>> Questions: >>>> >>>> 1) How does this affect the user? I heard from one user that it >>>> makes global searches unusable because his reader just spins its >>>> wheel. I'm not sure whether this is impatience or this results >>>> in failed searches. >>>> >>>> 2) Is there a client-side fix (e.g. connection limiting)? >>>> Apple appears to be intransigent on addressing this. >>>> >>>> 3) Will maintaining search indices (e.g. solr) help with this? >>>> Maybe the searches are taking too long and the connections pile >>>> up waiting for previous searches to finish. >>>> >>>> Thanks, >>>> Joseph Tam <jtam.home(a)gmail.com> >>> >> > -- As always, I remain at your service. Kindest Regards, David.M.Clark (Director - Senior Linux/UNIX Consultant) =--------------------------------------------------------------------------= Davrom Consulting Pty Ltd Mobile: 0418763124 PO Box 1644, Sunnybank Hills, 4109 E-mail (Work): david(a)davrom.com ABN: 81 096 990 804 E-mail (Priv): dmc1961(a)dmc1961.id.au Website: http://davrom.com Skype: dmc1961 Podcast: http://ldup.com.au Google: dmc1961(a)gmail.com =--------------------------------------------------------------------------= Specialising in: Linux (Fedora/RedHat/CentOS), UNIX, SCO, MikroTik, Networking/Internet, E-mail/Web Technologies =--------------------------------------------------------------------------= Please note: Any e-mail communication bearing this signature is for the exclusive purpose of the sender and is not for publication without the expressed permission of the sender or respective sender's organisation. =--------------------------------------------------------------------------=

1 1

My Solr FTS problem
by Gao 01 Dec '17

01 Dec '17

I am testing the solr FTS following the guide here: http://things.m31.ch/?p=379 Now I am having problem when I try to test: # doveadm -v index -u fail2ban(a)mydomain.com Inbox doveadm(fail2ban(a)mydomain.com): Error: fts_solr: Invalid XML input at 1:0: not well-formed (invalid token) (near: { "responseHeader":{ "status":0, "QTime":0, "params":{ "q":"box:8864fa1d51ea1d5a7b12000096a1aaf8 AND user:fa) doveadm(fail2ban(a)mydomain.com): Error: Mailbox INBOX: Status lookup failed: Internal error occurred. Refer to server log for more information. [2017-11-30 13:05:24] My system is CentOS 7, Dovecot 3.2.4 (installed from source with solr support), Java OpenJDK-1.8.0, Solr v7.1.0. Could some one help me on this please? Here is detailed debug out put: [root@mail ~]# doveadm -vD index -u fail2ban(a)mydomain.com Inbox Debug: Loading modules from directory: /usr/lib64/dovecot Debug: Module loaded: /usr/lib64/dovecot/lib10_quota_plugin.so Debug: Module loaded: /usr/lib64/dovecot/lib20_fts_plugin.so Debug: Module loaded: /usr/lib64/dovecot/lib21_fts_solr_plugin.so Debug: Loading modules from directory: /usr/lib64/dovecot/doveadm Debug: Skipping module doveadm_acl_plugin, because dlopen() failed: /usr/lib64/dovecot/doveadm/lib10_doveadm_acl_plugin.so: undefined symbol: acl_user_module (this is usually intentional, so just ignore this message) Debug: Skipping module doveadm_expire_plugin, because dlopen() failed: /usr/lib64/dovecot/doveadm/lib10_doveadm_expire_plugin.so: undefined symbol: expire_set_deinit (this is usually intentional, so just ignore this message) Debug: Module loaded: /usr/lib64/dovecot/doveadm/lib10_doveadm_quota_plugin.so Debug: Module loaded: /usr/lib64/dovecot/doveadm/lib10_doveadm_sieve_plugin.so Debug: Module loaded: /usr/lib64/dovecot/doveadm/lib20_doveadm_fts_plugin.so Debug: Skipping module doveadm_mail_crypt_plugin, because dlopen() failed: /usr/lib64/dovecot/doveadm/libdoveadm_mail_crypt_plugin.so: undefined symbol: mail_crypt_box_get_pvt_digests (this is usually intentional, so just ignore this message) doveadm(fail2ban(a)mydomain.com): Debug: Added userdb setting: mail=maildir:/home/vmail/mydomain.com/fail2ban/ doveadm(fail2ban(a)mydomain.com): Debug: Added userdb setting: plugin/quota_rule=*:bytes=0 doveadm(fail2ban(a)mydomain.com): Debug: Effective uid=5000, gid=5000, home=/home/vmail/mydomain.com/fail2ban/ doveadm(fail2ban(a)mydomain.com): Debug: Quota root: name=User quota backend=maildir args= doveadm(fail2ban(a)mydomain.com): Debug: Quota rule: root=User quota mailbox=* bytes=0 messages=0 doveadm(fail2ban(a)mydomain.com): Debug: Quota rule: root=User quota mailbox=Trash bytes=+104857600 messages=0 doveadm(fail2ban(a)mydomain.com): Debug: Quota warning: bytes=0 (90%) messages=0 reverse=no command=quota-warning 90 fail2ban(a)mydomain.com mydomain.com doveadm(fail2ban(a)mydomain.com): Debug: Quota warning: bytes=0 (80%) messages=0 reverse=no command=quota-warning 80 fail2ban(a)mydomain.com mydomain.com doveadm(fail2ban(a)mydomain.com): Debug: Quota grace: root=User quota bytes=0 (10%) doveadm(fail2ban(a)mydomain.com): Debug: Namespace inbox: type=private, prefix=, sep=, inbox=yes, hidden=no, list=yes, subscriptions=yes location=maildir:/home/vmail/mydomain.com/fail2ban/ doveadm(fail2ban(a)mydomain.com): Debug: maildir++: root=/home/vmail/mydomain.com/fail2ban, index=, indexpvt=, control=, inbox=/home/vmail/mydomain.com/fail2ban, alt= doveadm(fail2ban(a)mydomain.com): Debug: quota: quota_over_flag check: quota_over_script unset - skipping doveadm(fail2ban(a)mydomain.com): Debug: INBOX: Mailbox opened because: index doveadm(fail2ban(a)mydomain.com): Debug: http-client: host 127.0.0.1: Host created doveadm(fail2ban(a)mydomain.com): Debug: http-client: peer 127.0.0.1:8983: Peer created doveadm(fail2ban(a)mydomain.com): Debug: http-client: queue http://127.0.0.1:8983: Setting up connection to 127.0.0.1:8983 (1 requests pending) doveadm(fail2ban(a)mydomain.com): Debug: http-client: peer 127.0.0.1:8983: Linked queue http://127.0.0.1:8983 (1 queues linked) doveadm(fail2ban(a)mydomain.com): Debug: http-client: queue http://127.0.0.1:8983: Started new connection to 127.0.0.1:8983 doveadm(fail2ban(a)mydomain.com): Debug: http-client: request [Req1: GET http://127.0.0.1:8983/solr/dovecot/select?fl=uid&rows=1&sort=uid+desc&q=box…] Submitted doveadm(fail2ban(a)mydomain.com): Debug: http-client: Waiting for 1 requests to finish doveadm(fail2ban(a)mydomain.com): Debug: http-client: peer 127.0.0.1:8983: Creating 1 new connections to handle requests (already 0 usable, connecting to 0, closing 0) doveadm(fail2ban(a)mydomain.com): Debug: http-client: peer 127.0.0.1:8983: Making new connection 1 of 1 doveadm(fail2ban(a)mydomain.com): Debug: http-client: conn 127.0.0.1:8983 [0]: HTTP connection created (1 parallel connections exist) doveadm(fail2ban(a)mydomain.com): Debug: http-client: conn 127.0.0.1:8983 [0]: Connected doveadm(fail2ban(a)mydomain.com): Debug: http-client: conn 127.0.0.1:8983 [0]: Ready for requests doveadm(fail2ban(a)mydomain.com): Debug: http-client: peer 127.0.0.1:8983: Successfully connected (connections=1) doveadm(fail2ban(a)mydomain.com): Debug: http-client: peer 127.0.0.1:8983: Using 1 idle connections to handle 1 requests (1 total connections ready) doveadm(fail2ban(a)mydomain.com): Debug: http-client: queue http://127.0.0.1:8983: Connection to peer 127.0.0.1:8983 claimed request [Req1: GET http://127.0.0.1:8983/solr/dovecot/select?fl=uid&rows=1&sort=uid+desc&q=box…] doveadm(fail2ban(a)mydomain.com): Debug: http-client: conn 127.0.0.1:8983 [0]: Claimed request [Req1: GET http://127.0.0.1:8983/solr/dovecot/select?fl=uid&rows=1&sort=uid+desc&q=box…] doveadm(fail2ban(a)mydomain.com): Debug: http-client: request [Req1: GET http://127.0.0.1:8983/solr/dovecot/select?fl=uid&rows=1&sort=uid+desc&q=box…] Sent header doveadm(fail2ban(a)mydomain.com): Debug: http-client: peer 127.0.0.1:8983: No more requests to service for this peer (1 connections exist) doveadm(fail2ban(a)mydomain.com): Debug: http-client: conn 127.0.0.1:8983 [0]: Got 200 response for request [Req1: GET http://127.0.0.1:8983/solr/dovecot/select?fl=uid&rows=1&sort=uid+desc&q=box…] (took 3 ms + 2 ms in queue) doveadm(fail2ban(a)mydomain.com): Error: fts_solr: Invalid XML input at 1:0: not well-formed (invalid token) (near: { "responseHeader":{ "status":0, "QTime":1, "params":{ "q":"box:8864fa1d51ea1d5a7b12000096a1aaf8 AND user:fa) doveadm(fail2ban(a)mydomain.com): Debug: http-client: conn 127.0.0.1:8983 [0]: Response payload stream destroyed (0 ms after initial response) doveadm(fail2ban(a)mydomain.com): Debug: http-client: request [Req1: GET http://127.0.0.1:8983/solr/dovecot/select?fl=uid&rows=1&sort=uid+desc&q=box…] Finished doveadm(fail2ban(a)mydomain.com): Debug: http-client: queue http://127.0.0.1:8983: Dropping request [Req1: GET http://127.0.0.1:8983/solr/dovecot/select?fl=uid&rows=1&sort=uid+desc&q=box…] doveadm(fail2ban(a)mydomain.com): Debug: http-client: host 127.0.0.1: Host is idle (timeout = 100 msecs) doveadm(fail2ban(a)mydomain.com): Debug: http-client: request [Req1: GET http://127.0.0.1:8983/solr/dovecot/select?fl=uid&rows=1&sort=uid+desc&q=box…] Free (requests left=1) doveadm(fail2ban(a)mydomain.com): Debug: http-client: All requests finished doveadm(fail2ban(a)mydomain.com): Error: Mailbox INBOX: Status lookup failed: Internal error occurred. Refer to server log for more information. [2017-11-30 13:13:57] doveadm(fail2ban(a)mydomain.com): Debug: http-client: peer 127.0.0.1:8983: Peer close doveadm(fail2ban(a)mydomain.com): Debug: http-client: peer 127.0.0.1:8983: Peer disconnect doveadm(fail2ban(a)mydomain.com): Debug: http-client: conn 127.0.0.1:8983 [0]: Peer closed doveadm(fail2ban(a)mydomain.com): Debug: http-client: conn 127.0.0.1:8983 [0]: Connection disconnect doveadm(fail2ban(a)mydomain.com): Debug: http-client: conn 127.0.0.1:8983 [0]: Connection destroy doveadm(fail2ban(a)mydomain.com): Debug: http-client: peer 127.0.0.1:8983: Peer destroy doveadm(fail2ban(a)mydomain.com): Debug: http-client: host 127.0.0.1: Host destroy doveadm(fail2ban(a)mydomain.com): Debug: http-client: queue http://127.0.0.1:8983: Destroy

2 2

Username character disallowed by auth_username_chars: 0x13
by Alex 30 Nov '17

30 Nov '17

Hi, I'm receiving the following messages in my mail logs that I haven't seen before: Nov 28 22:45:31 bwipropemail dovecot: auth: login(?,179.210.41.21): Username character disallowed by auth_username_chars: 0x13 (username: AB?) Nov 28 22:45:31 bwipropemail dovecot: auth: login(?,179.210.41.21): Username character disallowed by auth_username_chars: 0x13 (username: AB?) There's thousands of them, from hundreds of different IP addresses. I suspect it's an exploit attempt, but does anyone know which? I've added a fail2ban entry, but I'd also like to make sure my dovecot is not vulnerable. This is on a fc25 system with all updates.

2 2

Detect port number of SASL AUTH request?
by MRob 30 Nov '17

30 Nov '17

Hi, this is partly Postfix related, but I want to know if there could be way to distinguish port of the SASL AUTH request to segregate user services. Currently I use unix listener for dovecot sasl auth, but could change to inet_listener. Only way I can think is to have different SASL AUTH services for each master.cf entry where its needed. But is it possible for Dovecot to have more than one SASL AUTH services with different configuration setup? It would be nicer if there was a way for Postfix to tell Dovecot about the port the client connected on. Or maybe it can be done with a SASL realm? I'm not sure how? Any help please?

2 1

Plugin 'sieve_imapsieve' not found
by Christopher Satchell 30 Nov '17

30 Nov '17

Hello, when Dovecot launches (and pretty much at any action afterwards) it always throws following error: | managesieve: Fatal: Plugin 'sieve_imapsieve' not found from directory /usr/lib/dovecot/modules/sieve | config: Error: managesieve-login: dump-capability process returned 89 dovecot-sieve and dovecot-managesieved are both installed and the only plugin in the mentioned folder is `lib90_sieve_extprograms_plugin.so`. `doveconf -n` output: # 2.2.22 (fe789d2): /etc/dovecot/dovecot.conf # Pigeonhole version 0.4.13 (7b14904) managesieve(username): Fatal: Plugin 'sieve_imapsieve' not found from directory /usr/lib/dovecot/modules/sieve doveconf: Error: managesieve-login: dump-capability process returned 89 # OS: Linux 4.4.0-101-generic x86_64 Ubuntu 16.04.3 LTS auth_mechanisms = plain login mail_gid = vmail mail_home = /var/vmail/mailboxes/%d/%n mail_location = maildir:~/mail:LAYOUT=fs mail_privileged_group = vmail mail_uid = vmail namespace inbox { inbox = yes location = mailbox Drafts { auto = subscribe special_use = \Drafts } mailbox Sent { auto = subscribe special_use = \Sent } mailbox Spam { auto = subscribe special_use = \Junk } mailbox Trash { auto = subscribe special_use = \Trash } prefix = } passdb { args = /etc/dovecot/dovecot-sql.conf driver = sql } plugin { imapsieve_mailbox1_before = file:/var/vmail/sieve/global/learn-spam.sieve imapsieve_mailbox1_causes = COPY imapsieve_mailbox1_name = Spam imapsieve_mailbox2_before = file:/var/vmail/sieve/global/learn-ham.sieve imapsieve_mailbox2_causes = COPY imapsieve_mailbox2_from = Spam imapsieve_mailbox2_name = * quota = maildir:User quota quota_exceeded_message = Benutzer %u hat das Speichervolumen überschritten. / User %u has exhausted allowed storage space. sieve = file:/var/vmail/sieve/%d/%n/scripts;active=/var/vmail/sieve/%d/%n/active-script.sieve sieve_before = /var/vmail/sieve/global/spam-global.sieve sieve_global_extensions = +vnd.dovecot.pipe sieve_pipe_bin_dir = /usr/bin sieve_plugins = sieve_imapsieve sieve_extprograms } protocols = imap lmtp sieve service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0660 user = postfix } unix_listener auth-userdb { group = vmail mode = 0660 user = vmail } } service imap-login { inet_listener imap { port = 143 } } service lmtp { unix_listener /var/spool/postfix/private/dovecot-lmtp { group = postfix mode = 0660 user = postfix } user = vmail } service managesieve-login { inet_listener sieve { port = 4190 } } ssl = required ssl_cert = </etc/letsencrypt/live/mail.domain.tld/fullchain.pem ssl_cipher_list = EDH+CAMELLIA:EDH+aRSA:EECDH+aRSA+AESGCM:EECDH+aRSA+SHA256:EECDH:+CAMELLIA128:+AES128:+SSLv3:!aNULL:!eNULL:!LOW:!3DES:!MD5:!EXP:!PSK:!DSS:!RC4:!SEED:!IDEA:!ECDSA:kEDH:CAMELLIA128-SHA:AES128-SHA ssl_dh_parameters_length = 2048 ssl_key = </etc/letsencrypt/live/mail.domain.tld/privkey.pem ssl_prefer_server_ciphers = yes ssl_protocols = !SSLv3 userdb { args = /etc/dovecot/dovecot-sql.conf driver = sql } protocol imap { imap_idle_notify_interval = 29 mins mail_max_userip_connections = 20 mail_plugins = " quota imap_quota imap_sieve" } protocol lmtp { mail_plugins = " sieve" postmaster_address = postmaster(a)domain.tld } Thanks in advance. Chris

3 3

dovecot - 2 Faktor Auth
by Hajo Locke 30 Nov '17

30 Nov '17

Hallo Liste, hat sich schon mal jemand mit 2 Faktor Auth für dovecot beschäftigt? Es geht dabei nicht nur um die Absicherung einer Weboberfläche sondern direkt die Absicherung der Standard pop/imap Verbindungen des Clients. Wir machen das auth bisher über MySQL. Rein technisch würde das gehen, da man die Password-Query beliebig anpassen und auch mit allow_nets arbeiten kann. Es wäre eher die Herausforderung für den Client den 2. Faktor zu erfüllen und seine IP freizuschalten. Man müsste dann ja Clients wie Thunderbird veranlassen irgendwie die Challenge des 2. Faktors anzuzeigen und zu erfüllen. Vermutlich kann man das nur mit speziellen Clients z.B. einer eigenen App machen. Hat jemand in dem Bereich Erfahrung und kann diese teilen? Danke, Hajo

2 1

ManageSieve: authenticate "EXTERNAL" not behaving correctly
by Marc Weustink 30 Nov '17

30 Nov '17

Hi, I've enabled client certificate authentication for imap and managesieve. When I use Thunderbird with the sieve plugin it tries to login, but times out. Initially I reported this to the sieve plugin, but we came to the conclusion that it managesieve is misbehaving. https://github.com/thsmi/sieve/issues/94 Thunderbird (win10-64) 52.4.0 (32bit) Sieve 0.2.3k Dovecot (Ubuntu 16.04.3 LTS) 2.2.33.1-1 (sid) What happens is the following (p=plugin sends m=managesieve sends) p:authenticate "EXTERNAL" "" m:"" The response is unexpected. According to RFC 5804 an empty challenge/response is sent as an empty string. So I would expect: p:authenticate "EXTERNAL" "" m:OK "Logged in." With the use of gnutls-cli I could reproduce (c=I send m=managesieve sends) gnutls-cli --starttls --x509keyfile marc_mail.key --x509certfile marc_mail.crt -p sieve 172.17.1.4 ... m:OK "TLS negotiation successful." c:authenticate "EXTERNAL" "" m:"" c:"" m:OK "Logged in." However if I try the "imap" syntax (rfc4959) I get logged in at once ... m:OK "TLS negotiation successful." c:authenticate "EXTERNAL" "=" m:OK "Logged in." Note that this is an imap only extention, "=" is an invalid base64 encoding. Marc

2 4

Re: iPhone/iPad IMAP connection bursts causes user+IP exceeded
by Joseph Tam 30 Nov '17

30 Nov '17

On 30/11/17 03:03, Robert Giles wrote: >> David, >> >> I'd say that if you set the mail_max_userip_connections value to a >> large-ish number (300-400), your users likely won't notice an issue on >> their iOS 10.x and iOS 11.x devices.? It's more of an annoyance in the >> logs, and occasionally the iOS Mail app will show that it is stuck >> checking mail for a few minutes (when the new max_userip_connections is >> reached again, but with a large number, it happens much less frequently). >> >> Keep in mind max_userip applies to *authenticated* users, so a true, >> malicious DoS situation is less likely. Maybe not malicious DoS, but if your running a shared platform, or supports hundreds of users using Apple products, you can do the arithmetic and see that you can run into problems with resource starvation. >> And yeah, I'm definitely tired of Apple going off and breaking their >> software, because the blame always comes back on IT instead of Apple :( Apple, are you listening? Would it kill you to design your software not to treat remote mail servers like personal servers that can serve up connections like candy? (I also see that some iOS clients keeps an open SMTP connection on standby, even though it's not sending mail.) Joseph Tam <jtam.home(a)gmail.com>

1 0

iPhone/iPad IMAP connection bursts causes user+IP exceeded
by Joseph Tam 30 Nov '17

30 Nov '17

I frequently see this from my iPhone/iPad IMAP users: Oct 24 21:30:55 server dovecot: imap-login: Login: user=<user>, ... [... repeated 10 times ...] Oct 24 21:32:54 server dovecot: imap-login: Maximum number of connections from user+IP exceeded (mail_max_userip_connections=12): user=<user> Oct 24 21:32:54 server dovecot: imap(user): Logged out ... [... repeated 11 times ...] These bursts of logins/max/logouts would cycling on for a few minutes. Googling this problem seems to turn up lots of similar complaints about iOS mail mail clients. e.g. https://discussions.apple.com/thread/2547839?tstart=0 iOS mail readers do not limit connections limit as other mailreaders can. I could increase mail_max_userip_connections, but that just moves the goal posts. Using the new rawlog feature in 2.2.26 (thanks Dovecot team!), I was able to see that these connection bursts are caused by clients doing global searches. The rawlogs show each mailbox being SELECT'd and searched (e.g. From header string): 1477369968.730450 2 ID ("name" "iPad Mail" "version" "13G36" "os" "iOS" "os-version" "9.3.5 (13G36)") 1477369968.781932 3 SELECT {mailbox} 1477369968.961636 4 UID SEARCH RETURN (COUNT) 1:* NOT DELETED 1477369969.006087 5 UID SEARCH RETURN (ALL) 1:* NOT DELETED 1477369969.052701 6 UID SEARCH RETURN (ALL) {search-term} NOT DELETED 1477369974.624153 7 LOGOUT Questions: 1) How does this affect the user? I heard from one user that it makes global searches unusable because his reader just spins its wheel. I'm not sure whether this is impatience or this results in failed searches. 2) Is there a client-side fix (e.g. connection limiting)? Apple appears to be intransigent on addressing this. 3) Will maintaining search indices (e.g. solr) help with this? Maybe the searches are taking too long and the connections pile up waiting for previous searches to finish. Thanks, Joseph Tam <jtam.home(a)gmail.com>

3 2

XDOVECOT capability?
by Hogne Vevle 28 Nov '17

28 Nov '17

Hi! Here and there, I'm seeing mentions of a "XDOVECOT" capability - e.g. on https://documentation.open-xchange.com/7.8.2/middleware/components/search/c… . However, I can't seem to find any documentation on what this actually does. We need to add this capability to our servers in order for certain functionality of Open Xchange App Suite to work properly (as seen in the link above), but we don't want to blindly update our entire Dovecot cluster just because their docs tell us to :) Can someone, please, shed some light on what other effects we can expect to see after enabling this capability, if any? Or is it simply a way of telling clients that "Hey, I'm a Dovecot server" - nothing else? Cheers, - Hogne

2 1

How to make dovecot access a MySQL database with a certain domain?
by Spike98 28 Nov '17

28 Nov '17

I am trying to make a mail server with Postfix using the Dovecot software. At the time of wanting to access my server from a mail client, it does not let me access and see the logs of my server with the command: $ service dovecot status with the following error: dovecot: auth-worker(2769): Error: mysql(127.0.0.1): Connect failed to database (postfix): Access denied for user 'postfix'@'localhost' (using password: YES) - waiting for 125 seconds before retry From what I understand of this error is that it is trying to enter 'postfix' @ 'localhost' instead of the domain that I specify when I made the database that is mydomain.com How can you make dovecot go to MySQL with postfix(a)mydomain.com instead of localhost This is my Dovecot configuration /etc/dovecot/dovecot-sql.conf.ext driver=mysql default_pass_scheme=PLAIN-MD5 connect=host=127.0.0.1 dbname=postfix user=postfix password=postfix password_query=SELECT username,domain,password FROM usuarios WHERE username='%n' AND domain='%d' user_query=SELECT 1007 as uid, 1007 as gid, concat("maildir:/var/vmail",domain,'/',username,'/') as mail FROM usuarios WHERE username='%n' AND domain='%d' iterate_query=SELECT username,domain FROM usuarios

3 2

Imapsieve plugin?
by Bruce 28 Nov '17

28 Nov '17

Debian stretch. Dovecot 2.2.27 I was working with a document that references the imapsieve plugin. It references the /etc/dovecot/conf.d/90-imapsieve.conf file. The only reference I've found for it is https://wiki2.dovecot.org/Pigeonhole/Sieve/Plugins/IMAPSieve#Configuration. I've got dovecot-managedsieve and dovecot-sieve already installed. Am I missing something obvious here? Bruce M.

2 2

Re: Server migration
by Joseph Tam 27 Nov '17

27 Nov '17

> I've asked this before, but now it's time to move one server to > another, I can't delay the operation anymore (the older server is > failing) > > Both server are pretty old: 1.2.15 > > Probably, faster way would be to rsync all mailboxes from the older > server to the newer one. I can start migrating everything while > running then, stop the older server and sync only what is changed, > keeping downtime at minimum. > > Any better solution ? It depends on your situation. If you only have a small userbase with modest amount of mail, you can probably take your whole system down, do a one time migration, then cut over to the new system without too much downtime. If you have medium sized operation, then what you propose above would work. If you have a large userbase (or large user mailboxes), or you want to minimize downtime, you can incrementally migrate per user so that any particular user experiences a small window of outage, but the system is online for everybody else. This, of course, requires a lot more setup and planning. Joseph Tam <jtam.home(a)gmail.com>

1 0

lmtp-Eroor
by Jakob Schürz 27 Nov '17

27 Nov '17

Hi There! I can not find anything about this message: dovecot[23202]: lmtp(jakob): Debug: Mailbox <lmtp DATA>: Opened mail UID=1 because: header Message-ID (Cache file is unusable) dovecot[23202]: lmtp(jakob): Debug: Mailbox <lmtp DATA>: Opened mail UID=1 because: virtual size (Cache file is unusable) And the next is: dovecot[23202]: lmtp(jakob): rphlK01SG1qiWgAAk1Mx3g: sieve: msgid=<E1eJ6cv-000624-Je(a)xxx.xxxxxxx.xxx>: stored mail into mailbox 'INBOX/TESTORDNER' It happens when a mail gets delivered through lmtp. My exim-Transport is this: dovecot_lmtp: driver = lmtp socket = /var/run/dovecot/lmtp #maximum number of deliveries per batch, default 1 batch_max = 200 And my dovecot-Conf is this: # dovecot -n # 2.2.27 (c0f36b0): /etc/dovecot/dovecot.conf # Pigeonhole version 0.4.16 (fed8554) # OS: Linux 4.13.0-trunk-amd64 x86_64 Debian 9.1 btrfs auth_debug = yes auth_mechanisms = plain login cram-md5 digest-md5 auth_socket_path = /var/run/dovecot/auth-userdb auth_verbose = yes first_valid_uid = 1000 imap_capability = +XDOVECOT imap_client_workarounds = tb-extra-mailbox-sep lda_mailbox_autocreate = yes lda_mailbox_autosubscribe = yes listen = *, ::1 login_trusted_networks = 127.0.0.1/8 192.168.0.0/24 192.168.1.0/24 172.17.0.0/24 172.18.0.0/24 mail_debug = yes mail_gid = vmail mail_home = /var/mail/%u mail_location = maildir:/var/mail/%u/Maildir:LAYOUT=fs:INDEX=/var/lib/dovecot/db/indexes/Maildir/%u:INDEXPVT=/var/lib/dovecot/db/indexes/Maildir/%u:CONTROL=/var/lib/dovecot/db/control/Maildir/%u mail_plugins = zlib quota acl listescape mail_log notify virtual mail_privileged_group = vmail mail_server_admin = mailto:jakob@xundeenergie.at mail_shared_explicit_inbox = yes mail_uid = vmail managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext mmap_disable = yes namespace { hidden = no inbox = no list = children location = maildir:/var/mail/mailarchiv/%u/:LAYOUT=fs:INDEX=/var/lib/dovecot/db/indexes/mailarchiv/%u:INDEXPVT=/var/lib/dovecot/db/indexes/mailarchiv/%u mailbox incoming { auto = create } mailbox outgoing { auto = create } prefix = Mailarchiv/ separator = / subscriptions = no type = private } namespace { list = children location = maildir:/var/mail/public/:LAYOUT=fs:INDEX=/var/lib/dovecot/db/indexes/public/%u:INDEXPVT=/var/lib/dovecot/db/indexes/public/%u prefix = Roseggergasse/ separator = / subscriptions = no type = public } namespace Geteilt { hidden = no inbox = no list = children location = maildir:/var/mail/%%u/Maildir:LAYOUT=fs:INDEXPVT=/var/lib/dovecot/db/indexes/shared/%u/%%u:INDEX=/var/lib/dovecot/db/indexes/shared/%u/%%u prefix = Geteilt/%%n/ separator = / subscriptions = no type = shared } namespace Real { hidden = yes list = no location = virtual:/var/mail/real:INDEX=/var/lib/dovecot/db/indexes/real/%u prefix = Real/ separator = / subscriptions = no } namespace Synoptic { hidden = no list = children location = virtual:/var/mail/virtual:INDEX=/var/lib/dovecot/db/indexes/virtual/%u mailbox INBOX/Archives { auto = no special_use = \Archive } mailbox INBOX/Drafts { auto = no special_use = \Drafts } mailbox INBOX/Entwürfe { auto = no special_use = \Drafts } mailbox INBOX/Junk { auto = no special_use = \Junk } mailbox INBOX/Spam { auto = no special_use = \Junk } mailbox Sent { auto = no special_use = \Sent } prefix = Synoptic/ separator = / subscriptions = no } namespace inbox { hidden = no inbox = yes location = mailbox Archiv { auto = no special_use = \Archive } mailbox Archive { auto = no special_use = \Archive } mailbox Archives { auto = no special_use = \Archive } mailbox "Deleted Messages" { auto = no special_use = \Trash } mailbox Drafts { auto = no special_use = \Drafts } mailbox Entwürfe { auto = no special_use = \Drafts } mailbox "Gelöschte Elemente" { auto = no special_use = \Trash } mailbox "Gelöschte Objekte" { auto = no special_use = \Trash } mailbox Gesendet { auto = no special_use = \Sent } mailbox "Gesendete Elemente" { auto = no special_use = \Sent } mailbox "Gesendete Objekte" { auto = no special_use = \Sent } mailbox Important { auto = no } mailbox Junk { auto = subscribe autoexpunge = 30 days special_use = \Junk } mailbox Mistkübel { auto = no special_use = \Trash } mailbox Papierkorb { auto = no special_use = \Trash } mailbox Sent { auto = subscribe special_use = \Sent } mailbox "Sent Messages" { auto = no special_use = \Sent } mailbox Spam { auto = no special_use = \Junk } mailbox Synoptic/Alle { auto = no comment = All my messages special_use = \All } mailbox Trash { auto = no special_use = \Trash } mailbox Wichtig { auto = create } prefix = INBOX/ separator = / subscriptions = no type = private } namespace subscriptions { hidden = yes list = no location = prefix = subscriptions = yes } passdb { args = scheme=CRYPT username_format=%u /etc/dovecot/users driver = passwd-file } plugin { acl = vfile:/etc/dovecot/dovecot-acl:cache_secs=300 acl_shared_dict = file:/var/lib/dovecot/db/shared-mailboxes.db fts = lucene fts_autoindex = yes fts_autoindex_max_recent_msgs = 80 fts_decoder = decode2text.sh fts_index_timeout = 90 fts_lucene = whitespace_chars=@. normalize no_snowball mail_home = /var/mail/%u setting_name = sieve, managedsieve sieve = file:/var/mail/%u/sieve/;active=/var/mail/%u/sieve/%u.sieve } postmaster_address = postmaster@localhost protocols = " imap lmtp sieve pop3 sieve" service anvil { unix_listener anvil-auth-penalty { mode = 00 } } service auth { unix_listener auth-client { group = vmail mode = 0666 user = vmail } unix_listener auth-userdb { group = vmail mode = 0666 user = vmail } } service imap-login { inet_listener imap { port = 143 } inet_listener imaps { port = 993 ssl = yes } process_min_avail = 1 service_count = 1 } service imap { executable = imap postlogin process_limit = 1024 vsz_limit = 400 M } service lmtp { user = vmail vsz_limit = 400 M } service postlogin { executable = script-login -d rawlog } ssl = required ssl_cert = </etc/dovecot/dovecot.crt ssl_cipher_list = ALL:!ADH:!LOW:!SSLv2:!SSLv3:!EXP:!aNULL:+HIGH:+MEDIUM ssl_key = # hidden, use -P to show it ssl_protocols = TLSv1.2 TLSv1.1 TLSv1 !SSLv3 userdb { args = username_format=%u /etc/dovecot/users default_fields = home=/var/mail/%u driver = passwd-file } verbose_proctitle = yes protocol lmtp { auth_username_format = %n mail_plugins = zlib quota acl listescape mail_log notify virtual quota sieve acl } protocol lda { mail_plugins = zlib quota acl listescape mail_log notify virtual quota sieve acl } protocol imap { mail_max_userip_connections = 10 mail_plugins = zlib quota acl listescape mail_log notify virtual imap_quota imap_acl }

3 6

doveadm backup or sync Read status
by DurgaPrasad - DatasoftComnet 27 Nov '17

27 Nov '17

Hello All, Sorry for reposting. Earlier I was in digest mode hence could not update the previous post. I am trying to migrate mail from a dovecot-2.0.13-1_129.el5 maildir to dovecot-2.2.10-8.el7.x86_64 centos 7 mdbox. I am using this command doveadm -v -o mail_fsync=never backup -R -u user(a)domain.com imapc: also tried doveadm -v -o mail_fsync=never sync -1 -R -u user(a)domain.com imapc: Both work flawlessly - Timo is great !!! - My issue is the source folders are all marked as read. The target folders of-course have unread OK. POP3 UIDLs are also ok (tested for one user). (1) My question is how can I make the source remain same (unread status etc.) so that I do migrate the various domains in a transparent manner and then switch servers ?. I have multiple virtual domains. (2) One more question do I have to do both imapc_ & also pop3c_ migration since I need the POP UIDLs to work properly for my outlook POP3 users after migration ?. I want to know the possibilities. Thanks DP --- This email has been checked for viruses by Avast antivirus software. https://www.avast.com/antivirus

1 0

Server migration
by Gandalf Corvotempesta 27 Nov '17

27 Nov '17

I've asked this before, but now it's time to move one server to another, I can't delay the operation anymore (the older server is failing) Both server are pretty old: 1.2.15 Probably, faster way would be to rsync all mailboxes from the older server to the newer one. I can start migrating everything while running then, stop the older server and sync only what is changed, keeping downtime at minimum. Any better solution ? No, server upgrade is not possible. Not at this time. It's too time consuming and I have to move asap.

2 1

Dovecot LMTP Proxy + STARTTLS?
by Tobi 27 Nov '17

27 Nov '17

Hi I got dovecot 2.2.26 on a Centos7 with latest updates. Dovecot is configured to act as director and delivers to my two backend servers. I enabled lmtp proxy on director to listen on port 24. Now I see in msg headers that the connection to the lmtp proxy uses STARTTLS but the connection from proxy to backend seems to be unencrypted. Is it possible to enforce the use of STARTTLS in the connection from the director to the backend as well? Regards tobi

5 4

doveadm backup or sync Read status
by DurgaPrasad - DatasoftComnet 26 Nov '17

26 Nov '17

Hello all, I am trying to migrate mail from a dovecot-2.0.13-1_129.el5 maildir to dovecot-2.2.10-8.el7.x86_64 centos 7 mdbox. I am using this command doveadm -v -o mail_fsync=never backup -R -u user(a)domain.com imapc: also tried doveadm -v -o mail_fsync=never sync -1 -R -u user(a)domain.com imapc: Both work flawlessly - Timo is great !!! - My issue is the source folders are all marked as read. The target folders of-course have unread OK. POP3 UIDLs are also ok (tested for one user). (1) My question is how can I make the source remain same (unread status etc.) so that I do migrate the various domains in a transparent manner and then switch servers ?. I have multiple virtual domains. (2) One more question do I have to do both imapc_ & also pop3c_ migration since I need the POP UIDLs to work properly for my outlook POP3 users after migration ?. Thanks DP --- This email has been checked for viruses by Avast antivirus software. https://www.avast.com/antivirus

1 0

Mark message as read when moved to Trash
by Felix Rubio Dalmau 26 Nov '17

26 Nov '17

Hi all, When I send a message to trash, without previously reading it (just with the subject is enough to say I do not want to read it), it remains as "unread". Then, clients (I am using Kmail) report there are unread message, when all of them are in Trash. The question, then is: Is there any way to automatically mark a message as read, when that message is moved to Trash? Thank you! Felix

5 5

Re: Sieve coding question
by Stephan Bosch 25 Nov '17

25 Nov '17

Op 11/25/2017 om 5:33 PM schreef Roger Klorese: > On Sat, Nov 25, 2017 at 4:56 AM Stephan Bosch <stephan(a)rename-it.nl > <mailto:stephan@rename-it.nl>> wrote: > > Op 11/19/2017 om 8:54 AM schreef Roger B.A. Klorese: > > On 11/16/17 11:03 AM, Stephan Bosch wrote: > >> Op 11/16/2017 om 7:42 PM schreef lists.dovecot(a)rogerklorese.com > <mailto:lists.dovecot@rogerklorese.com>: > >>> Is there a more appropriate list on which to ask for assistance in > >>> coding Sieve rules, or may I ask here? > >> I know of no other suitable venue, so go ahead. > >> > >> Regards, > >> > >> Stephan. > > > And I > > > Here is the config. I don't think IMAPsieve is configured... > > Then I don't understand what you mean. Sieve is normally only involved > at initial delivery, not when messages are moved between mailboxes. > > Regards, > > Stephan. > > > Of cpurse, that was my understanding too. Hence the question. Are you sure your mail client doesn't have any rules of its own that may be doing this? Regards, Stephan.

1 0

Sieve coding question
by lists.dovecot＠rogerklorese.com 25 Nov '17

25 Nov '17

Is there a more appropriate list on which to ask for assistance in coding Sieve rules, or may I ask here?

3 5

Re: Upgrade to 2.2.32 from 2.2.15 failed
by Mark Foley 25 Nov '17

25 Nov '17

No, is that something that would make a difference between 2.2.15 and 2.2.32? --Mark On Fri, 24 Nov 2017 21:37:47 -0800 Gary <lists(a)lazygranch.com> wrote: > Out of curiosity, do you do a !SSLv3 in the conf file? > > > Original Message >> From: mfoley(a)ohprs.org >> Sent: November 24, 2017 9:04 PM >> To: dovecot(a)dovecot.org >> Subject: Upgrade to 2.2.32 from 2.2.15 failed >> >> I have a problem. I have been running Dovecot 2.2.15 and I'd like to upgrade. My distro >> (Slackware) has dovecot 2.2.32 available. I downloaded and installed that, but it didn't work. >> No one was able to get messages from the dovecot server on their workstations. The following is >> the entire dovecot log file from startup to the last message generated. No more messages went >> into the logfile after line 76, even with clients trying to connect. The 174.233.134.88 IP is >> from an external user connecting from his iPhone. The normal successful message from this user >> are shown at bottom. >> >> I'm suspecting something to do with line 18 where is says "Auth process broken." If anyone has >> any insight I'd deeply appreciate it as I'd love to upgrade. >> >> THX -- Mark >> >> 1 Nov 24 19:22:24 master: Info: Dovecot v2.2.32 (dfbe293d4) starting up for imap (core dumps disabled) >> 2 Nov 24 19:22:24 ssl-params: Info: Generating SSL parameters >> 3 Nov 24 19:22:26 ssl-params: Info: SSL parameters regeneration completed >> 4 Nov 24 19:23:02 imap-login: Debug: SSL: where=0x10, ret=1: before/accept initialization [174.233.134.88] >> 5 Nov 24 19:23:02 imap-login: Debug: SSL: where=0x2001, ret=1: before/accept initialization [174.233.134.88] >> 6 Nov 24 19:23:02 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 read client hello A [174.233.134.88] >> 7 Nov 24 19:23:02 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 write server hello A [174.233.134.88] >> 8 Nov 24 19:23:02 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 write certificate A [174.233.134.88] >> 9 Nov 24 19:23:02 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 write key exchange A [174.233.134.88] >> 10 Nov 24 19:23:02 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 write server done A [174.233.134.88] >> 11 Nov 24 19:23:02 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 flush data [174.233.134.88] >> 12 Nov 24 19:23:02 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 read client certificate A [174.233.134.88] >> 13 Nov 24 19:23:02 imap-login: Debug: SSL: where=0x2002, ret=-1: SSLv3 read client key exchange A [174.233.134.88] >> 14 Nov 24 19:23:02 imap-login: Debug: SSL: where=0x2002, ret=-1: SSLv3 read client key exchange A [174.233.134.88] >> 15 Nov 24 19:23:02 auth: Debug: Loading modules from directory: /usr/lib64/dovecot/auth >> 16 Nov 24 19:23:02 auth: Debug: Module loaded: /usr/lib64/dovecot/auth/lib20_auth_var_expand_crypt.so >> 17 Nov 24 19:23:02 auth: Debug: Loading modules from directory: /usr/lib64/dovecot/auth >> 18 Nov 24 19:23:02 imap-login: Info: Disconnected: Auth process broken (disconnected before auth was ready, waited 0 secs): user=<>, rip=174.233.134.88, lip=98.102.63.107, TLS handshaking, session=<idAcrMNe8xqu6YZY> >> 19 Nov 24 19:23:02 imap-login: Debug: SSL: where=0x10, ret=1: before/accept initialization [174.233.134.88] >> 20 Nov 24 19:23:02 imap-login: Debug: SSL: where=0x2001, ret=1: before/accept initialization [174.233.134.88] >> 21 Nov 24 19:23:02 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 read client hello A [174.233.134.88] >> 22 Nov 24 19:23:02 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 write server hello A [174.233.134.88] >> 23 Nov 24 19:23:02 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 write certificate A [174.233.134.88] >> 24 Nov 24 19:23:02 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 write key exchange A [174.233.134.88] >> 25 Nov 24 19:23:02 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 write server done A [174.233.134.88] >> 26 Nov 24 19:23:02 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 flush data [174.233.134.88] >> 27 Nov 24 19:23:02 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 read client certificate A [174.233.134.88] >> 28 Nov 24 19:23:02 imap-login: Debug: SSL: where=0x2002, ret=-1: SSLv3 read client key exchange A [174.233.134.88] >> 29 Nov 24 19:23:02 imap-login: Debug: SSL: where=0x2002, ret=-1: SSLv3 read client key exchange A [174.233.134.88] >> 30 Nov 24 19:23:02 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 read client key exchange A [174.233.134.88] >> 31 Nov 24 19:23:02 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 read certificate verify A [174.233.134.88] >> 32 Nov 24 19:23:02 imap-login: Debug: SSL: where=0x2002, ret=-1: SSLv3 read finished A [174.233.134.88] >> 33 Nov 24 19:23:03 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 read finished A [174.233.134.88] >> 34 Nov 24 19:23:03 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 write change cipher spec A [174.233.134.88] >> 35 Nov 24 19:23:03 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 write finished A [174.233.134.88] >> 36 Nov 24 19:23:03 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 flush data [174.233.134.88] >> 37 Nov 24 19:23:03 imap-login: Debug: SSL: where=0x20, ret=1: SSL negotiation finished successfully [174.233.134.88] >> 38 Nov 24 19:23:03 imap-login: Debug: SSL: where=0x2002, ret=1: SSL negotiation finished successfully [174.233.134.88] >> 39 Nov 24 19:23:04 auth: Debug: Loading modules from directory: /usr/lib64/dovecot/auth >> 40 Nov 24 19:23:04 auth: Debug: Module loaded: /usr/lib64/dovecot/auth/lib20_auth_var_expand_crypt.so >> 41 Nov 24 19:23:04 auth: Debug: Loading modules from directory: /usr/lib64/dovecot/auth >> 42 Nov 24 19:23:04 imap-login: Info: Disconnected: Auth process broken (disconnected before auth was ready, waited 2 secs): user=<>, rip=174.233.134.88, lip=98.102.63.107, TLS, session=<YGw7rMNe+Rqu6YZY> >> 43 Nov 24 19:23:04 imap-login: Debug: SSL alert: close notify [174.233.134.88] >> 44 Nov 24 19:23:05 imap-login: Debug: SSL: where=0x10, ret=1: before/accept initialization [174.233.134.88] >> 45 Nov 24 19:23:05 imap-login: Debug: SSL: where=0x2001, ret=1: before/accept initialization [174.233.134.88] >> 46 Nov 24 19:23:05 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 read client hello A [174.233.134.88] >> 47 Nov 24 19:23:05 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 write server hello A [174.233.134.88] >> 48 Nov 24 19:23:05 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 write certificate A [174.233.134.88] >> 49 Nov 24 19:23:05 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 write key exchange A [174.233.134.88] >> 50 Nov 24 19:23:05 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 write server done A [174.233.134.88] >> 51 Nov 24 19:23:05 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 flush data [174.233.134.88] >> 52 Nov 24 19:23:05 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 read client certificate A [174.233.134.88] >> 53 Nov 24 19:23:05 imap-login: Debug: SSL: where=0x2002, ret=-1: SSLv3 read client key exchange A [174.233.134.88] >> 54 Nov 24 19:23:05 imap-login: Debug: SSL: where=0x2002, ret=-1: SSLv3 read client key exchange A [174.233.134.88] >> 55 Nov 24 19:23:05 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 read client key exchange A [174.233.134.88] >> 56 Nov 24 19:23:05 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 read certificate verify A [174.233.134.88] >> 57 Nov 24 19:23:05 imap-login: Debug: SSL: where=0x2002, ret=-1: SSLv3 read finished A [174.233.134.88] >> 58 Nov 24 19:23:05 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 read finished A [174.233.134.88] >> 59 Nov 24 19:23:05 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 write change cipher spec A [174.233.134.88] >> 60 Nov 24 19:23:05 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 write finished A [174.233.134.88] >> 61 Nov 24 19:23:05 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 flush data [174.233.134.88] >> 62 Nov 24 19:23:05 imap-login: Debug: SSL: where=0x20, ret=1: SSL negotiation finished successfully [174.233.134.88] >> 63 Nov 24 19:23:05 imap-login: Debug: SSL: where=0x2002, ret=1: SSL negotiation finished successfully [174.233.134.88] >> 64 Nov 24 19:23:08 auth: Debug: Loading modules from directory: /usr/lib64/dovecot/auth >> 65 Nov 24 19:23:08 auth: Debug: Module loaded: /usr/lib64/dovecot/auth/lib20_auth_var_expand_crypt.so >> 66 Nov 24 19:23:08 auth: Debug: Loading modules from directory: /usr/lib64/dovecot/auth >> 67 Nov 24 19:23:08 imap-login: Info: Disconnected: Auth process broken (disconnected before auth was ready, waited 3 secs): user=<>, rip=174.233.134.88, lip=98.102.63.107, TLS, session=<7ZF4rMNe8hqu6YZY> >> 68 Nov 24 19:23:08 imap-login: Debug: SSL alert: close notify [174.233.134.88] >> 69 Nov 24 19:23:16 auth: Debug: Loading modules from directory: /usr/lib64/dovecot/auth >> 70 Nov 24 19:23:16 auth: Debug: Module loaded: /usr/lib64/dovecot/auth/lib20_auth_var_expand_crypt.so >> 71 Nov 24 19:23:16 auth: Debug: Loading modules from directory: /usr/lib64/dovecot/auth >> 72 Nov 24 19:23:16 imap-login: Info: Disconnected: Auth process broken (disconnected before auth was ready, waited 0 secs): user=<>, rip=192.168.0.54, lip=192.168.0.2, session=<6bbyrMNeGM/AqAA2> >> 73 Nov 24 19:24:13 auth: Debug: Loading modules from directory: /usr/lib64/dovecot/auth >> 74 Nov 24 19:24:13 auth: Debug: Module loaded: /usr/lib64/dovecot/auth/lib20_auth_var_expand_crypt.so >> 75 Nov 24 19:24:13 auth: Debug: Loading modules from directory: /usr/lib64/dovecot/auth >> 76 Nov 24 19:24:13 imap-login: Info: Disconnected: Auth process broken (disconnected before auth was ready, waited 0 secs): user=<>, rip=192.168.0.52, lip=192.168.0.2, session=<b75YsMNeb9nAqAA0> >> >> Normal OK messages from dovecot 2.2.15: >> >> Nov 24 23:50:49 imap-login: Debug: SSL: where=0x20, ret=1: SSL negotiation finished successfully [174.233.134.88] >> Nov 24 23:50:49 imap-login: Debug: SSL: where=0x2002, ret=1: SSL negotiation finished successfully [174.233.134.88] >> Nov 24 23:50:49 auth: Debug: client in: AUTH 1 PLAIN service=imap secured session=vQnEacde6QCu6YZY lip=98.102.63.107 rip=174.233.134.88 lport=993 rport=6889 resp=AG0udGhlbQAhbXRfMTAxOQ== (previous base64 data may contain sensitive data) >> Nov 24 23:50:49 auth-worker(17650): Debug: shadow(m.them,174.233.134.88): lookup >> Nov 24 23:50:49 auth: Debug: client passdb out: OK 1 user=m.them >> >> Finally, the 2.2.15 doveconf, which I used the same for 2.2.32: >> >> > doveconf -n >> # 2.2.15: /usr/local/etc/dovecot/dovecot.conf >> # OS: Linux 4.4.88 x86_64 Slackware 14.2 >> auth_debug = yes >> auth_debug_passwords = yes >> auth_gssapi_hostname = $ALL >> auth_krb5_keytab = /etc/dovecot/dovecot.keytab >> auth_mechanisms = plain login gssapi >> auth_use_winbind = yes >> auth_username_format = %n >> auth_verbose = yes >> auth_verbose_passwords = plain >> disable_plaintext_auth = no >> info_log_path = /var/log/dovecot_info >> mail_location = maildir:~/Maildir >> passdb { >> driver = shadow >> } >> protocols = imap >> ssl_cert = </etc/ssl/certs/OHPRS/GoDaddy/Apache/2016-08-10/54e789087d419b6e.crt >> ssl_key = </etc/ssl/certs/OHPRS/GoDaddy/mail.ohprs.org.key >> userdb { >> driver = passwd >> } >> verbose_ssl = yes

1 0

Dovecot proxy
by Federico Bartolucci 24 Nov '17

24 Nov '17

Hello, has someone already tested the dovecot-proxy with more than 10 nodes? or someone knows anyway if is it officially supported up to a certain number? Thanks.

2 1

set parameter per user
by A. Schulze 24 Nov '17

24 Nov '17

Hello, My dovecot server (2.2.33.2) work with "lmtp_save_to_detail_mailbox = no" Now I would like to enable the feature for /some/ users. Is that an option that could be set from an LDAP entry? I tried the following: modify my ldap schema to allow an optional attribute "lmtp-save-to-detail-mailbox" in /etc/dovecot/ldap.conf user_attrs = ... =lmtp_save_to_detail_mailbox=%{ldap:lmtp-save-to-detail-mailbox:no}, =... Now I set an ldapattribute "lmtp-save-to-detail-mailbox" with value "yes" for some users. Unfortunately messages to user+extension@domain are still delivered to INBOX/ while they should be delivered to INBOX/extension. I also tried to make the attribute accessible vi pass_attr and userdb_foo = ... because I use prefetch driver as userdb. I also disabled prefetching at all but no luck :-/ any Ideas? Andreas

3 5

Exclude disabled accounts
by Evgeniy Korneechev 23 Nov '17

23 Nov '17

Hello! We have userdb=passwd. userdb { driver = passwd #server was entered domain Active Directory override_fields = home=/var/vmail/glu_vrem/%u } If I disable in AD user's account, he can not sign in. But he can and will receive letters, which of course is not correct. How can I exclude disabled accounts from 'userdb'? dovecot -n: # 2.2.27 (c0f36b0): /etc/dovecot/dovecot.conf # Pigeonhole version 0.4.16 (fed8554) # OS: Linux 4.4.39-std-def-alt0.M80P.1 x86_64 ALT 8.1 Server auth_debug = yes auth_debug_passwords = yes auth_mechanisms = plain login cram-md5 auth_socket_path = /var/run/dovecot/auth-userdb auth_username_chars = auth_verbose = yes auth_verbose_passwords = plain base_dir = /var/run/dovecot/ debug_log_path = /var/log/dovecot disable_plaintext_auth = no first_valid_gid = 502 first_valid_uid = 502 last_valid_gid = 268999999 last_valid_uid = 268999999 log_path = /var/log/dovecot login_log_format_elements = user=<%u> method=%m rip=%r lip=%l mpid=%e %c mail_access_groups = vmail mail_debug = yes mail_gid = 502 mail_location = maildir:/%Lh/Maildir/:INDEX=/%Lh/Maildir/ mail_plugins = " quota autocreate" mail_privileged_group = vmail mail_uid = 502 managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext imapflags notify mbox_write_locks = fcntl namespace { list = children location = maildir:%%h/Maildir:INDEX=~/Maildir/shared/%%u prefix = shared/%%u/ separator = / subscriptions = yes type = shared } namespace inbox { inbox = yes location = prefix = separator = / type = private } passdb { driver = pam } passdb { args = /etc/dovecot/dovecot-sql.conf.ext driver = sql } plugin { quota_rule = *:storage=5G recipient_delimiter = + sieve = /etc/dovecot/sieves/default.sieve sieve_default = /etc/dovecot/sieves/default.sieve sieve_dir = ~/sieve sieve_extensions = +notify +imapflags sieve_max_redirects = 8 } protocols = imap pop3 lmtp sieve service auth-worker { user = root } service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0666 user = postfix } unix_listener auth-userdb { group = vmail mode = 0666 user = vmail } } service dict { unix_listener dict { group = vmail mode = 0600 user = vmail } } service imap-login { inet_listener imap { port = 143 } } service imap { process_limit = 1024 vsz_limit = 256 M } service lmtp { unix_listener lmtp { mode = 0666 } } service managesieve-login { inet_listener sieve { port = 4190 } vsz_limit = 64 M } service pop3-login { inet_listener pop3 { port = 110 } } service pop3 { process_limit = 1024 } ssl_ca = </usr/share/ca-certificates/ca-bundle.crt ssl_cert = </etc/dovecot/server.crt ssl_key = # hidden, use -P to show it userdb { driver = passwd override_fields = home=/var/vmail/glu_vrem/%u } userdb { args = /etc/dovecot/dovecot-sql.conf.ext driver = sql } protocol lmtp { mail_plugins = " quota autocreate sieve" } protocol lda { mail_plugins = " quota autocreate sieve quota" plugin { quota = dict:user::file:/var/vmail/glu_vrem/%n/.quotausage } } protocol imap { mail_plugins = " quota autocreate autocreate imap_quota" plugin { autocreate = INBOX autocreate2 = Sent autocreate3 = Trash autocreate4 = Drafts autocreate5 = Junk autosubscribe = INBOX autosubscribe2 = Sent autosubscribe3 = Trash autosubscribe4 = Drafts autosubscribe5 = Junk quota = dict:user::file:/var/vmail/glu_vrem/%n/.quotausage } } protocol sieve { mail_max_userip_connections = 10 managesieve_implementation_string = Dovecot Pigeonhole managesieve_logout_format = bytes=%i/%o managesieve_max_compile_errors = 5 managesieve_max_line_length = 65536 } protocol pop3 { pop3_client_workarounds = outlook-no-nuls oe-ns-eoh pop3_uidl_format = %08Xu%08Xv } -- WBR, Korneechev Evgeniy BaseALT/ALTLinux Team

2 1

Passing information from passdb to userdb
by Qmail 23 Nov '17

23 Nov '17

I'm trying to hack together a new authentication back-end and I wanted to know if it's possible to pass values from passdb to userdb in the auth_request structure at authentication time. I modified struct auth_request in auth-request.h to contain a new variable and it gets set properly in my passdb, however the value is not there when checking for it userdb. I'm very novice when it comes to Dovecot programming so any help is appreciated. Thanks!

2 3

[Dovecot] Configure replication in backup mode
by japerez 22 Nov '17

22 Nov '17

Dovecot 2.2.27 (c0f36b0) I'm trying to configure dovecot to backup all my email to a secondary server using "dsync". I got it working in "sync" mode or two-way synchonization, that means whatever happens in one server gets replicated in the other. However, documentation also says that a one way synchronization is posible, yet, after spending a good amount of hours searching, I failed to find what do I have to modify in my "30-dsync.conf" to do so. My 30-dsync.conf reads as follows: #This sets globally the port needed to connect #to the doveadm service #doveadm_port = 12345 # Set the password globally to use for connecting to # and requiring for the doveadm service doveadm_password = +++++++++++++ # Set the directory for validating certificates # provided when running with SSL enabled # Should be the standard OpenSSL certificate directory by default ssl_client_ca_dir = /etc/ssl/certs # Configure the doveadm service to listen service doveadm { inet_listener { # port to listen on port = 12345 # enable SSL # ssl = yes } } # Configure the aggregator service for notifications service aggregator { fifo_listener replication-notify-fifo { # Your mail user that's managing files generally is used here user = +++++ mode = 0755 } unix_listener replication-notify { user = +++++ mode = 0755 } } # Configure the replicator service service replicator { user = root process_min_avail = 1 unix_listener replicator-doveadm { user = root mode = 0755 } } replication_dsync_parameters = -d -N -l 30 -U -x nobody # Configure target hosts for replication # tcps can be tcp if you don't want to connect with SSL # :port can be omitted if it's the default set globally for doveadm plugin { mail_replica = tcp:*.*.*.*:12345 } Thanks.

1 0

dovecot initscript
by dovecot＠schoepfer.info 22 Nov '17

22 Nov '17

Hi, about https://wiki.dovecot.org/DovecotInit, i wondered about stop) if test $running = yes; then echo "Stopping Dovecot" kill `cat $pidfile` echo "." else echo "Dovecot is already stopped." fi ;; Is "doveadm stop" technically the same, or better/worse/safer? Does "doveadm stop" wait until all child processes are finished, or would "sleep 1" in the restart-function still be necessary in this case? Is "kill -HUP `cat $pidfile`" technically the same as "doveadm reload"? If it'a all fine to use doveadm in an initscript, i there a reason to not add "doveadm start" to doveadm functionality? Surely this is not that important, but maybe a bit more consistent. Thanks, Johannes

1 0

Log rotation and combining...
by SH Development 22 Nov '17

22 Nov '17

I have recently noticed that my dovecot-deliver.log is huge and wanted to start rotating it. So a couple of questions: 1. Can the dovecot-deliver.log be combined with the maillog, that gets rotated weekly? If it can be done, is it advisable? Since the inception of this particular server, the log file has been located in the /home/vmail directory. Is there a reason it shouldn’t be located in the /var/log directory with the maillog? 2. Separate from above, if I create a new logrotate script example as follows: # dovecot SIGUSR1: Re-opens the log files. /home/vmail/dovecot-deliver.log { missingok notifempty delaycompress sharedscripts postrotate /bin/kill -USR1 `cat /var/run/dovecot/master.pid 2>/dev/null` 2> /dev/null || true endscript } I get the following error only when cron tries to run it: /etc/cron.daily/logrotate: error: stat of /home/vmail/dovecot-deliver.log failed: Permission denied Owner on the log are vmail:vmail. If I manually force logrotate on this particular log, it works fine. Ethon

3 6

Re: Errors installing on Ubuntu 17.04
by Someone 21 Nov '17

21 Nov '17

On Tue, 21/11/17, Jeff Kletsky <dovecot(a)allycomm.com> wrote: > On 11/20/17 1:58 PM, Someone wrote: > > > I've been struggling with this on and off for a while now. Upon > > attempting to install Dovecot on Ubuntu 17.04 I get the following errors [...] > "Hint: Some lines were ellipsized, use -l to show in full." I'm aware of that, yes. Unfortunately I don't know how to tell any of the myriad of package installers to "do the right thing" in such cases, and, as stated, this is happening during installation. > Without seeing the full messages, my guess is that you've got problems with your IPv6 configuration or connectivity. Entirely possible, since I don't have IPv6 and have completely disabled it as a result. Even were I to re-enable it, I don't see it would help if problems with IPv6 connectivity would also be a problem (because I don't have it).

2 1

home folder for virtual users with autoexpunge setting
by felix＠kngnt.org 21 Nov '17

21 Nov '17

Hi all, I have enabled today the autoexpunge setting for Trash folders, and I am getting the following error when Dovecot starts: imap(<USER>): Error: autoexpunge: Couldn't create dovecot.autoexpunge.lock lock: User has no home directory I understand this is correct: as <USER> is a virtual user, it does not have home folder. Is there any way I can set the autoexpunge plugin to store the lock file in the virtual user email home folder? Thank you! Felix

4 4

macros in config support
by Arkadiusz Miśkiewicz 21 Nov '17

21 Nov '17

Hi. Is there any support for macros in dovecot configuration - user defined macros? For example: server-config.conf: %define my_db_name "aaa" %define my_db_host "db.example.com" %define my_db_pass "sdfdsfsdfsdf2313" %define server_id 10 %define something blabla ... dovecot-sql.conf: !include server-config.conf connect = host=%{my_db_host} dbname=%{my_db_name} .... iterate_query = SELECT ... WHERE os.id_pop3_server=%{server_id} ... Basically to be able to use own macros anywhere in config files. -- Arkadiusz Miśkiewicz, arekm / ( maven.pl | pld-linux.org )

1 0

LMTP "Relative home directory paths not supported"
by Jeff Kletsky 21 Nov '17

21 Nov '17

I'm in the process of moving from LDA to LMTP (Postfix upstream) prior to a transition off `nix accounts to virtual accounts and am stumped by LMTP reporting dovecot: lmtp(10019, jeff(a)example.com) Error: Relative home directory paths not supported: 0 LDA does /not /have any problems with PAM or passwd-file passdb/userdb and the ubiquitous definition of mail_location = maildir:~/Maildir:LAYOUT=fs I have yet to be able to get LMTP to deliver mail, nor have I found anything on the Dovecot wiki to describe how to represent that the mail_location is <whatever/userdb/returned/for/home>/Maildir I'd prefer to localize the user-to-file-space mapping localized to Dovecot (rather than split within Postfix and Dovecot) I'd definitely appreciate any pointers to web pages or specific suggestions as to how to resolve this. Excerpts of Dovecot local.conf follow, full doveconf -n output on request. The/users /file is in the same format as FreeBSD /etc/master.passwd with name, password, UID, gid, home_dir, and shell meaningfully populated. The configuration below works with LDA (end-to-end). With LMTP, it identifies <jeff(a)example.com> as a valid destination, but fails on delivery with the "relative home directory paths" error message. passdb { driver = passwd-file args = /path/to/users } userdb { driver = passwd-file args = username_format=%n /path/to/users } # See http://wiki2.dovecot.org/MailLocation/Maildir # https://wiki.dovecot.org/VirtualUsers/Home mail_location = maildir:~/Maildir:LAYOUT=fs # mail_location = maildir:%h/Maildir:LAYOUT=fs Thanks! Jeff

2 4

Errors installing on Ubuntu 17.04
by Someone 21 Nov '17

21 Nov '17

I've been struggling with this on and off for a while now. Upon attempting to install Dovecot on Ubuntu 17.04 I get the following errors Selecting previously unselected package dovecot-imapd. (Reading database ... 243684 files and directories currently installed.) Preparing to unpack .../dovecot-imapd_1%3a2.2.27-2ubuntu2_amd64.deb ... Unpacking dovecot-imapd (1:2.2.27-2ubuntu2) ... Processing triggers for dovecot-core (1:2.2.27-2ubuntu2) ... Processing triggers for ufw (0.35-4) ... Setting up dovecot-imapd (1:2.2.27-2ubuntu2) ... Creating config file /etc/dovecot/conf.d/20-imap.conf with new version Processing triggers for dovecot-core (1:2.2.27-2ubuntu2) ... Job for dovecot.service failed because the control process exited with error code. See "systemctl status dovecot.service" and "journalctl -xe" for details. invoke-rc.d: initscript dovecot, action "restart" failed. dovecot.service - Dovecot IMAP/POP3 email server Loaded: loaded (/lib/systemd/system/dovecot.service; enabled; vendor preset: enabled) Active: failed (Result: exit-code) since Thu 2017-10-05 14:08:56 BST; 17ms ago Docs: man:dovecot(1) http://wiki2.dovecot.org/ Process: 8880 ExecStop=/usr/bin/doveadm stop (code=exited, status=0/SUCCESS) Process: 8885 ExecStart=/usr/sbin/dovecot (code=exited, status=89) Main PID: 8729 (code=exited, status=0/SUCCESS) Oct 05 14:08:56 ash systemd[1]: Starting Dovecot IMAP/POP3 email server... Oct 05 14:08:56 ash dovecot[8885]: Error: socket() failed: Address family n…ocol Oct 05 14:08:56 ash dovecot[8885]: Error: service(imap-login): listen(::, 1…ocol Oct 05 14:08:56 ash dovecot[8885]: master: Error: socket() failed: Address …ocol Oct 05 14:08:56 ash dovecot[8885]: Fatal: Failed to start listeners Oct 05 14:08:56 ash systemd[1]: dovecot.service: Control process exited, co…s=89 Oct 05 14:08:56 ash systemd[1]: Failed to start Dovecot IMAP/POP3 email server. Oct 05 14:08:56 ash systemd[1]: dovecot.service: Unit entered failed state. Oct 05 14:08:56 ash systemd[1]: dovecot.service: Failed with result 'exit-code'. Hint: Some lines were ellipsized, use -l to show in full. dpkg: error processing package dovecot-core (--configure): subprocess installed post-installation script returned error exit status 1 (and more) Apologies for any wrapping due to long lines in the above output.

2 1

Re: dovecot-lda without starting dovecot?
by Aki Tuomi 20 Nov '17

20 Nov '17

you could try setting protocols = in config file to disable (most) listeners. ---Aki TuomiDovecot oy -------- Original message --------From: Stephan von Krawczynski <skraw.ml(a)ithnet.com> Date: 03/11/2017 19:39 (GMT+02:00) To: Dovecot Mailing List <dovecot(a)dovecot.org> Subject: Re: dovecot-lda without starting dovecot? On Fri, 3 Nov 2017 19:30:22 +0200 Sami Ketola <sami.ketola(a)dovecot.fi> wrote: > > On 3 Nov 2017, at 18.23, Stephan von Krawczynski <skraw.ml(a)ithnet.com> > > wrote: Hello Aki, > > > > let me explain this a bit more. We do not intend to use only some copied > > binary. Of course we would do a full installation of dovecot and > > pidgeonhole, only we question if it is necessary to start the dovecot > > init-file bringing up the dovecot imap/imap-login/pop/pop-login/auth and > > other processes. Indeed we have virtual users. > > > While it might be possible to disable all the other services except master I > must ask why? How would the users be accessing their mails then? > > Sami Hello Sami, you did not read my first post. We are talking about a multihost installation where one host does SMTP and LDA, and the other does POP and IMAP (with dovecot). Now we want to use dovecot-lda for the local delivery _on the SMTP host_. So there is no need for open POP or IMAP ports and the corresponding running services. -- Regards, Stephan

7 19

doveadm mailbox list -s Segmentation fault
by Kristjan Eentsalu 20 Nov '17

20 Nov '17

Hey, I'm getting Segmentation fault when doing "doveadm mailbox list -s -u kristjan.eentsalu". doveadm mailbox list -u kristjan.eentsalu works fine. OS: FreeBSD 11.1-RELEASE-p1 Dovecot 2.2.33.2 , pigenhole 0.4.21 Trace and dovecot -n below GNU gdb 6.1.1 [FreeBSD] Copyright 2004 Free Software Foundation, Inc. GDB is free software, covered by the GNU General Public License, and you are welcome to change it and/or distribute copies of it under certain conditions. Type "show copying" to see the conditions. There is absolutely no warranty for GDB. Type "show warranty" for details. This GDB was configured as "amd64-marcel-freebsd"... Core was generated by `doveadm mailbox list -s -u kristjan.eentsalu'. Program terminated with signal 11, Segmentation fault. Reading symbols from /lib/libz.so.6...done. Loaded symbols for /lib/libz.so.6 Reading symbols from /lib/libcrypt.so.5...done. Loaded symbols for /lib/libcrypt.so.5 Reading symbols from /usr/local/lib/dovecot/libdovecot-storage.so.0...done. Loaded symbols for /usr/local/lib/dovecot/libdovecot-storage.so.0 Reading symbols from /usr/local/lib/dovecot/libdovecot.so.0...done. Loaded symbols for /usr/local/lib/dovecot/libdovecot.so.0 Reading symbols from /lib/libc.so.7...done. Loaded symbols for /lib/libc.so.7 Reading symbols from /usr/local/lib/dovecot/lib01_acl_plugin.so...done. Loaded symbols for /usr/local/lib/dovecot/lib01_acl_plugin.so Reading symbols from /usr/local/lib/dovecot/lib10_quota_plugin.so...done. Loaded symbols for /usr/local/lib/dovecot/lib10_quota_plugin.so Reading symbols from /usr/local/lib/dovecot/lib15_notify_plugin.so...done. Loaded symbols for /usr/local/lib/dovecot/lib15_notify_plugin.so Reading symbols from /usr/local/lib/dovecot/lib20_mail_log_plugin.so...done. Loaded symbols for /usr/local/lib/dovecot/lib20_mail_log_plugin.so Reading symbols from /usr/local/lib/dovecot/doveadm/lib10_doveadm_acl_plugin.so...done. Loaded symbols for /usr/local/lib/dovecot/doveadm/lib10_doveadm_acl_plugin.so Reading symbols from /usr/local/lib/dovecot/doveadm/lib10_doveadm_quota_plugin.so...done. Loaded symbols for /usr/local/lib/dovecot/doveadm/lib10_doveadm_quota_plugin.so Reading symbols from /usr/local/lib/dovecot/doveadm/lib10_doveadm_sieve_plugin.so...done. Loaded symbols for /usr/local/lib/dovecot/doveadm/lib10_doveadm_sieve_plugin.so Reading symbols from /usr/local/lib/dovecot-2.2-pigeonhole/libdovecot-sieve.so.0...done. Loaded symbols for /usr/local/lib/dovecot-2.2-pigeonhole/libdovecot-sieve.so.0 Reading symbols from /usr/local/lib/libldap-2.4.so.2...done. Loaded symbols for /usr/local/lib/libldap-2.4.so.2 Reading symbols from /usr/local/lib/liblber-2.4.so.2...done. Loaded symbols for /usr/local/lib/liblber-2.4.so.2 Reading symbols from /usr/local/lib/dovecot/libdovecot-lda.so.0...done. Loaded symbols for /usr/local/lib/dovecot/libdovecot-lda.so.0 Reading symbols from /usr/lib/libssl.so.8...done. Loaded symbols for /usr/lib/libssl.so.8 Reading symbols from /lib/libcrypto.so.8...done. Loaded symbols for /lib/libcrypto.so.8 Reading symbols from /libexec/ld-elf.so.1...done. Loaded symbols for /libexec/ld-elf.so.1 #0 0x0000000800d77e04 in mailbox_tree_traverse (tree=0x0, path=0x801c1a540 "INBOX", create=false, created_r=0x7fffffffe4f7) at mailbox-tree.c:103 103 if (*path != tree->separator && *path != '\0') # 2.2.33.2 (d6601f4ec): /usr/local/etc/dovecot/dovecot.conf # Pigeonhole version 0.4.21 (92477967) # OS: FreeBSD 11.1-RELEASE-p1 amd64 auth_master_user_separator = * auth_verbose_passwords = plain disable_plaintext_auth = no lmtp_save_to_detail_mailbox = yes mail_access_groups = imapmail mail_gid = imapmail mail_plugins = acl quota mail_log notify mail_uid = imapmail mailbox_list_index = yes managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext editheader namespace { hidden = no inbox = no list = no location = prefix = separator = / subscriptions = yes type = private } namespace avalik { hidden = no list = children location = maildir:/mail/imap/ domain.ee/shared:INDEXPVT=%h/public:LAYOUT=fs:DIRNAME=dsfFSFS prefix = shared/ separator = / subscriptions = no type = public } namespace inbox { alias_for = hidden = no inbox = yes list = yes location = mailbox Drafts { special_use = \Drafts } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Spam { special_use = \Junk } mailbox Trash { special_use = \Trash } prefix = INBOX/ separator = / subscriptions = no type = private } namespace user { list = children location = maildir:%%h/Maildir:LAYOUT=fs:DIRNAME=dsfFSFS:INDEXPVT=%h/shared/%%n prefix = user/%%n/ separator = / subscriptions = no type = shared } passdb { args = /usr/local/etc/dovecot/master-users driver = passwd-file master = yes pass = yes } passdb { args = /usr/local/etc/dovecot/dovecot-ldap.conf.ext driver = ldap } passdb { args = username_format=%u /usr/local/etc/dovecot/users driver = passwd-file } plugin { acl = vfile:/mail/dovecot/db/global-acls:cache_secs=300 acl_shared_dict = file:/mail/dovecot/db/shared-mailboxes quota = maildir quota2 = maildir:Public quota:ns=shared/ quota2_rule = *:storage=100G quota_grace = 10%% quota_rule = *:storage=5G quota_rule2 = INBOX/Trash:storage=+100M quota_status_nouser = DUNNO quota_status_overquota = 552 5.2.2 Mailbox is full quota_status_success = DUNNO recipient_delimiter = + sieve = file:~/sieve;active=~/.dovecot.sieve sieve_extensions = +editheader } protocols = imap lmtp sieve service lmtp { unix_listener /var/spool/postfix/private/dovecot-lmtp { group = postfix mode = 0600 user = postfix } } service managesieve-login { inet_listener sieve { port = 4190 } inet_listener sieve_deprecated { port = 2000 } service_count = 0 vsz_limit = 64 M } ssl = no ssl_cert = </etc/ssl/servercerts/domain.crt ssl_key = # hidden, use -P to show it userdb { args = /usr/local/etc/dovecot/dovecot-ldap.conf.ext driver = ldap } userdb { args = username_format=%u /usr/local/etc/dovecot/users default_fields = uid=1000 gid=1000 home=/mail/imap/%d/user/%n mail=maildir:~/Maildir:LAYOUT=fs:DIRNAME=dsfFSFS driver = passwd-file } protocol lmtp { mail_plugins = acl quota mail_log notify sieve postmaster_address = postmaster(a)domain.ee } protocol imap { mail_plugins = acl quota mail_log notify imap_acl imap_quota } Kristjan

2 4