- dovecot - dovecot.org

Re: Dovecot 2.2.27 proxy - enforcing per client IP connection limits
by Joseph Tam 20 Mar '17

20 Mar '17

Adi Pircalabu writes: > For us it is, we're periodically getting hammered by iOS devices that > try to open 300+ simultaneous IMAP connections for a single user from > the same IP, while the average hovers usually below 50 for the busier > mailboxes with many folders. Oh yeah, I've seen this. I think this happens when someone does a global pattern search, which causes the client to launch IMAP SEARCH commands on each and every mailbox. I've wondered whether installing Solr would alleviate this: it wouldn't directly address the connection limit problem, but perhaps it can return results fast enough to keep the concurrent connections count down. Can anyone with Solr installed confirm/refute this: does installing Solr keep iOS clients from roofing the connection count? Joseph Tam <jtam.home(a)gmail.com>

2 1

Mail restore and single storage attachement
by Jean-Luc Oms 20 Mar '17

20 Mar '17

Bonjour, I'm finishing the upgrade of an old installation of Dovecot/postfix mail system for my lab. In the configuration i plan ( dovecot 2.2.27 ), i choose to use: - mdbox format - single storage for attachements - 2 zfs file systems, one for mdboxes, the other for attachments The last tests before production concern my hability to restore a lost mail (or mailbox) ... (lot of changes when you are used to mbox format). 1) I uses doveadm import to restore part of mail from one of the zfs snapshot with a cde like: doveadm -Dv import -U bof2 -s -u bof2 mdbox:/mailpool/lirmm/.zfs/snapshot/zfs-auto-snap_frequent-2017-03-15-1645/vmail/bof2/mdbox Recup-AAAA mailbox AAAA I get this error: doveadm(bof2): Error: open() failed with file /mailpool/lirmm/.zfs/snapshot/zfs-auto-snap_frequent-2017-03-15-1645/vmail/bof2/mdbox/mailboxes/AAAA/dbox-Mails/dovecot.index.log: Read-only file system Thats right, my snapshot is ro, but why the import has to write to the source ? I'm missing something ? 2) I don't find any way to specify a source for attachements with the import command, then I first restore all the atachements from one snapshot, then make import, then purge. Is there a way to use a source for attachement file tree, or a command to find the mssing files for the import command ? Thanks -- __________________________________________ Jean-Luc Oms STI-RéseauX - LIRMM - CNRS/UM2 161 rue Ada - BAT 4 - CC 477 34095 Montpellier cedex 5 Tel +33 4 67 41 85 93 Urg +33 6 32 01 04 17 __________________________________________

1 1

Deploying Diffie-Hellman for TLS
by Jerry 20 Mar '17

20 Mar '17

I have been reading up on TLS and Dovecot and came across this URL: https://www.weakdh.org/sysadmin.html which recommended these settings for Dovecot. I would like to know if they are correct? Some much documentation on the web is pure garbage. Dovecot These changes should be made in /etc/dovecot.conf Cipher Suites ssl_cipher_list=ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA ssl_prefer_server_ciphers = yes (Dovecot 2.2.6 or greater) DH parameters #regenerates every week ssl_dh_parameters_length = 2048 Contrary to what the site recommends, I would have thought that changes should be made in the "10-ssl.conf" file. I am running "Dovecot 2.2.28" on a FreeBSD-11 machine with OpenSSL 1.0.2k, if that makes any difference. Thanks -- Jerry

2 1

Server migration
by Gandalf Corvotempesta 20 Mar '17

20 Mar '17

Hi to all. It's time to migrate an old server to a newer platform Some questions: 1) what happens by changing the pop3/IMAP server on the client? Is the client (Outlook, Thunderbird,...) smart enough to not download every message again? I'm asking this because the easier way to migrate would be move all mailboxes to the new server and then change the hostname on the client 2) what if I add a dovecot proxy on the new server, proxing back all requests to the older one, if the mailbox is still not migrated? Would the whole pop3/IMAP transaction happen through the proxy or there is something an http redirect (or anything similiar to the SIP protocol) ? 3) I think the response to this is no: is dovecot able to log the hostname used for the connection? I have multiple domains pointing to the same IP. Something like the Host header in Http.

2 1

[Bug] Mailbox aliases still broken
by azurit＠pobox.sk 20 Mar '17

20 Mar '17

Hi, about an year ago i was reporting a bug in mailbox aliases, which remains unfixed and unasnwered (probably totally ignored, don't understand why). I thought it was because the bug is old and already fixed but yesterday i upgraded to Dovecot 2.2.24 and problem persists. Here is the original report, everything, except the Dovecot version, is still correct: http://dovecot.org/list/dovecot/2015-June/101176.html Will this be fixed? Thanks for info. azur

4 7

dovecot problem with ssl
by Nilton Jose Rizzo 19 Mar '17

19 Mar '17

Hi all, I already searched for this error on google and nothing I never install dovecot, this is a first time. This error, I know, is too newbie and stupid, but I checked more than twice. root@server:/usr/local/etc/dovecot # sievec /home3/virtual/default.sieve doveconf: Fatal: Error in configuration file /usr/local/etc/dovecot/conf.d/10-ssl.conf line 7: Unknown setting: ssl root@server:/usr/local/etc/dovecot # I'm running a FreeBSD 12-current and compile all from ports (mysql, dovecot2, portfix3.1, and all needs ports, but this error don't leave. I'm fowling this tutorial to install all, but when I'll run a sievec this stop with this error. I'm not new in FreeBSD, I'm have good experience in FreeBSD. --- /************************************************* **Nilton José Rizzo UFRRJ **http://www.rizzo.eng.br http://www.ufrrj.br **http://lattes.cnpq.br/0079460703536198 **************************************************/

4 11

replication issues between to nodes
by Remko Lodder 18 Mar '17

18 Mar '17

Hi, Some time ago I posted the below but never got a reponse that I could work with. So i am retrying now in the hope that there might be a better idea/suggestion on how to approach this. Situation; I have two nodes, which should replicate to eachother. My main machine receives most mail and the other one receives mostly system messages and should get replicated. (This used to be delivered on both machines, but given the issues below I had to make sure that the customer email at least arrives on machine A, as detailed below). When a mail arrives on main machine (A) everything is fine and things are synchronised asap. Customers can see the email directly via webmail/imap. When a mail arrives on the secondary machine (B) the replication is not issued until machine A starts a sync session. Customers do not see the email on machine A via webmail/imap. When a mail arrives on A, the synchronisation occurs, and all messages on B, not yet on A, are synchronised as well. Customers can now see the email on machine A as well via webmail/imap. Sadly this can mean that emails that became visible are hours late (read: were delivered hours before, but not visible for the customer). Both machines are configured through puppet, only individual settings like IP addresses and certificates are different because well, they have to. I included the difference below, and both ‘doveconf -n’s. If someone has a suggestion on seeing why machine B is not issueing (or does not seem to issue) replication, let me know. I verified that I can connect to the remote machines via IPv4 and IPv6 (for doveadm / replication purposes). Difference between configurations; --- tmp1.txt 2017-03-18 15:18:41.000000000 +0100 +++ tmp2.txt 2017-03-18 15:18:56.000000000 +0100 @@ -55,7 +55,7 @@ imapsieve_mailbox2_name = * mail_log_events = delete undelete expunge copy mailbox_delete mailbox_rename mail_log_fields = uid box msgid size - mail_replica = tcps:mail.jr-hosting.nl:12346 + mail_replica = tcps:mail2.jr-hosting.nl:12346 sieve = ~/.dovecot.sieve sieve_dir = ~/sieve sieve_execute_bin_dir = /usr/local/lib/dovecot/sieve @@ -105,7 +105,7 @@ } service lmtp { inet_listener lmtp { - address = XXX/X 127.0.0.1 ::1 + address = YYYY/Y 127.0.0.1 ::1 port = 24 } unix_listener /var/spool/postfix/private/dovecot-lmtp { @@ -123,8 +123,8 @@ mode = 0666 } } -ssl_ca = </usr/local/etc/letsencrypt/live/mail2.jr-hosting.nl/fullchain.pem -ssl_cert = </usr/local/etc/letsencrypt/live/mail2.jr-hosting.nl/cert.pem +ssl_ca = </usr/local/etc/letsencrypt/live/mail.jr-hosting.nl/fullchain.pem +ssl_cert = </usr/local/etc/letsencrypt/live/mail.jr-hosting.nl/cert.pem ssl_client_ca_file = /usr/local/certificates/letsencrypt-ca.pem ssl_key = # hidden, use -P to show it ssl_protocols = !SSLv2 !SSLv3 Machine A (the best working machine) # 2.2.28 (bed8434): /usr/local/etc/dovecot/dovecot.conf # Pigeonhole version 0.4.17 (e179378) # OS: FreeBSD 11.0-RELEASE-p8 amd64 auth_mechanisms = plain login disable_plaintext_auth = no doveadm_password = # hidden, use -P to show it haproxy_trusted_networks = XXXX/X lda_mailbox_autocreate = yes lda_mailbox_autosubscribe = yes lmtp_save_to_detail_mailbox = yes mail_debug = yes mail_fsync = always mail_location = mdbox:~/mdbox mail_plugins = " quota notify replication" managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext imapsieve namespace { inbox = yes location = mailbox Drafts { auto = subscribe special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { auto = subscribe special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Spam { auto = subscribe special_use = \Junk } mailbox Trash { auto = subscribe special_use = \Trash } prefix = separator = . } passdb { driver = pam } plugin { imapsieve_mailbox1_before = file:/usr/local/lib/dovecot/sieve/report-spam.sieve imapsieve_mailbox1_causes = COPY imapsieve_mailbox1_name = Spam imapsieve_mailbox2_before = file:/usr/local/lib/dovecot/sieve/report-ham.sieve imapsieve_mailbox2_causes = COPY imapsieve_mailbox2_from = Spam imapsieve_mailbox2_name = * mail_log_events = delete undelete expunge copy mailbox_delete mailbox_rename mail_log_fields = uid box msgid size mail_replica = tcps:mail2.jr-hosting.nl:12346 sieve = ~/.dovecot.sieve sieve_dir = ~/sieve sieve_execute_bin_dir = /usr/local/lib/dovecot/sieve sieve_global_dir = /usr/local/etc/dovecot/sieve/global/ sieve_global_extensions = +vnd.dovecot.pipe +vnd.dovecot.execute sieve_global_path = /usr/local/etc/dovecot/sieve/default.sieve sieve_pipe_bin_dir = /usr/local/lib/dovecot/sieve sieve_plugins = sieve_imapsieve sieve_extprograms } postmaster_address = postmaster(a)jr-hosting.nl protocols = imap pop3 lmtp sieve replication_dsync_parameters = -d -N -l 60 -U replication_max_conns = 100 service aggregator { fifo_listener replication-notify-fifo { mode = 0666 } unix_listener replication-notify { mode = 0666 } } service auth { unix_listener /var/spool/postfix/private/auth { mode = 0666 } } service doveadm { inet_listener { port = 12346 ssl = yes } } service imap-login { inet_listener imap_haproxy { haproxy = yes port = 10143 } inet_listener imaps_haproxy { haproxy = yes port = 10144 ssl = yes } service_count = 1 } service imap { process_limit = 1024 } service lmtp { inet_listener lmtp { address = XXXX/X 127.0.0.1 ::1 port = 24 } unix_listener /var/spool/postfix/private/dovecot-lmtp { group = postfix mode = 0600 user = postfix } } service pop3 { process_limit = 1024 } service replicator { process_min_avail = 1 unix_listener replicator-doveadm { mode = 0666 } } ssl_ca = </usr/local/etc/letsencrypt/live/mail.jr-hosting.nl/fullchain.pem ssl_cert = </usr/local/etc/letsencrypt/live/mail.jr-hosting.nl/cert.pem ssl_client_ca_file = /usr/local/certificates/letsencrypt-ca.pem ssl_key = # hidden, use -P to show it ssl_protocols = !SSLv2 !SSLv3 userdb { driver = passwd } verbose_proctitle = yes protocol lmtp { auth_username_format = %n mail_plugins = quota sieve postmaster_address = postmaster(a)jr-hosting.nl } protocol lda { mail_plugins = " quota notify replication sieve" } protocol imap { mail_max_userip_connections = 50 mail_plugins = " quota notify replication imap_quota imap_sieve” } Machine B: # 2.2.28 (bed8434): /usr/local/etc/dovecot/dovecot.conf # Pigeonhole version 0.4.17 (e179378) # OS: FreeBSD 11.0-RELEASE-p8 amd64 auth_mechanisms = plain login disable_plaintext_auth = no doveadm_password = # hidden, use -P to show it haproxy_trusted_networks = XXX/X lda_mailbox_autocreate = yes lda_mailbox_autosubscribe = yes lmtp_save_to_detail_mailbox = yes mail_debug = yes mail_fsync = always mail_location = mdbox:~/mdbox mail_plugins = " quota notify replication" managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext imapsieve namespace { inbox = yes location = mailbox Drafts { auto = subscribe special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { auto = subscribe special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Spam { auto = subscribe special_use = \Junk } mailbox Trash { auto = subscribe special_use = \Trash } prefix = separator = . } passdb { driver = pam } plugin { imapsieve_mailbox1_before = file:/usr/local/lib/dovecot/sieve/report-spam.sieve imapsieve_mailbox1_causes = COPY imapsieve_mailbox1_name = Spam imapsieve_mailbox2_before = file:/usr/local/lib/dovecot/sieve/report-ham.sieve imapsieve_mailbox2_causes = COPY imapsieve_mailbox2_from = Spam imapsieve_mailbox2_name = * mail_log_events = delete undelete expunge copy mailbox_delete mailbox_rename mail_log_fields = uid box msgid size mail_replica = tcps:mail.jr-hosting.nl:12346 sieve = ~/.dovecot.sieve sieve_dir = ~/sieve sieve_execute_bin_dir = /usr/local/lib/dovecot/sieve sieve_global_dir = /usr/local/etc/dovecot/sieve/global/ sieve_global_extensions = +vnd.dovecot.pipe +vnd.dovecot.execute sieve_global_path = /usr/local/etc/dovecot/sieve/default.sieve sieve_pipe_bin_dir = /usr/local/lib/dovecot/sieve sieve_plugins = sieve_imapsieve sieve_extprograms } postmaster_address = postmaster(a)jr-hosting.nl protocols = imap pop3 lmtp sieve replication_dsync_parameters = -d -N -l 60 -U replication_max_conns = 100 service aggregator { fifo_listener replication-notify-fifo { mode = 0666 } unix_listener replication-notify { mode = 0666 } } service auth { unix_listener /var/spool/postfix/private/auth { mode = 0666 } } service doveadm { inet_listener { port = 12346 ssl = yes } } service imap-login { inet_listener imap_haproxy { haproxy = yes port = 10143 } inet_listener imaps_haproxy { haproxy = yes port = 10144 ssl = yes } service_count = 1 } service imap { process_limit = 1024 } service lmtp { inet_listener lmtp { address = XXXX/X 127.0.0.1 ::1 port = 24 } unix_listener /var/spool/postfix/private/dovecot-lmtp { group = postfix mode = 0600 user = postfix } } service pop3 { process_limit = 1024 } service replicator { process_min_avail = 1 unix_listener replicator-doveadm { mode = 0666 } } ssl_ca = </usr/local/etc/letsencrypt/live/mail2.jr-hosting.nl/fullchain.pem ssl_cert = </usr/local/etc/letsencrypt/live/mail2.jr-hosting.nl/cert.pem ssl_client_ca_file = /usr/local/certificates/letsencrypt-ca.pem ssl_key = # hidden, use -P to show it ssl_protocols = !SSLv2 !SSLv3 userdb { driver = passwd } verbose_proctitle = yes protocol lmtp { auth_username_format = %n mail_plugins = quota sieve postmaster_address = postmaster(a)jr-hosting.nl } protocol lda { mail_plugins = " quota notify replication sieve" } protocol imap { mail_max_userip_connections = 50 mail_plugins = " quota notify replication imap_quota imap_sieve” }

1 0

sievec
by Robert Moskowitz 17 Mar '17

17 Mar '17

I am building a new mailserver on Centos7. My sieve is created with: mkdir /home/sieve cat <<EOF>/home/sieve/globalfilter.sieve || exit 1 require "fileinto"; if exists "X-Spam-Flag" { if header :contains "X-Spam-Flag" "NO" { } else { fileinto "Spam"; stop; } } if header :contains "subject" ["***SPAM***"] { fileinto "Spam"; stop; } EOF chown -R vmail:mail /home/sieve But in 90-sieve.conf there is the comment: # A path to a global sieve script file, which gets executed ONLY # if user's private Sieve script doesn't exist. Be sure to # pre-compile this script manually using the sievec command line # tool. #sieve_global_path = /var/lib/dovecot/sieve/default.sieve Do I run sievec on this script? And I found the following comment on a blog, about 3 years old: 2: Having a user-defined sieve script will cancel out the global script for redirecting spam. In the dovecot.conf, get rid of the sieve_global_path and sieve_global_dir, and instead use: sieve_before = /path/to/global.sieve -- what this will do is make sure that the global script runs before any user scripts, which allows the spam redirecting to actually work. What is current situation on this? thank you

4 8

Do I need to configure director?
by Angel L. Mateo 17 Mar '17

17 Mar '17

Hi, I'm configuring a farm of dovecot proxies redirecting users to backend servers. The decision of which backend server is used for a user is based in its ldap account information. In my previous configuration I was using an inherited director configuration in these proxy servers, but now I was wondering that because the decision is made according to user information, I don't need to run director. Do it? Is there any advantage of running director in this scenario? -- Angel L. Mateo Martínez Sección de Telemática Área de Tecnologías de la Información y las Comunicaciones Aplicadas (ATICA) http://www.um.es/atica Tfo: 868889150 Fax: 868888337

2 2

Replication Troubles
by Wolfgang Hennerbichler 16 Mar '17

16 Mar '17

Hi Dovecot Users, I’ve configured dovecot dsync replication and I see troubles in the logs and get user complaints which I can’t explain. I found similar threads on this mailinglist, but I couldn’t find a solution anywhere. Does anybody have dsync running without problems on a high volume mailserver? I see the following logs, examples given: Feb 17 18:16:49 dovecot dovecot: imap(zoechi): Warning: /var/mail/zoechi/dovecot-uidlist: Duplicate file entry at line 10395: 1487350019.M138380P28563.dovecot.wogri.at,S=18930,W=19377 (uid 41092 -> 41093) - retrying by re-reading from beginning with this one I’m not sure - it might be that this is completely OK because due to replication UIDs clash. Maybe that’s OK, but I couldn’t find a confirmation. Feb 17 18:16:49 dovecot dovecot: imap(zoechi): Warning: Maildir /var/mail/zoechi: Expunged message reappeared, giving a new UID (old uid=41092, file=1487350019.M138380P28563.dovecot.wogri.at,S=18930,W=19377) This one is definitely a problem, deleted messages re-appear in the mailbox. I made sure that the 2 hosts doing replication have different hostnames. I run 2.2.27 (from debian-jessie backports). Config below. Thanks for hints (or pointers to other example configs where dsync works without problems) # dovecot -n # 2.2.27 (c0f36b0): /etc/dovecot/dovecot.conf # Pigeonhole version 0.4.16 (fed8554) # OS: Linux 4.8.14 x86_64 Debian 8.7 ext4 auth_verbose = yes debug_log_path = /var/log/dovecot.debug doveadm_password = # hidden, use -P to show it first_valid_gid = 106 first_valid_uid = 104 hostname = localhost last_valid_gid = 106 last_valid_uid = 104 mail_gid = dovecot mail_location = maildir:/var/mail/%n mail_plugins = quota fts fts_lucene virtual notify replication mail_temp_dir = /var/lib/dovecot/tmp mail_uid = dovecot managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext editheader namespace { list = children location = virtual:/var/mail/%n/virtual prefix = virtual. separator = . } namespace inbox { inbox = yes list = yes location = mailbox "Deleted Messages" { auto = subscribe special_use = \Trash } mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { auto = no special_use = \Sent } mailbox Spam { auto = subscribe special_use = \Junk } mailbox Trash { special_use = \Trash } prefix = separator = . subscriptions = yes type = private } passdb { args = /etc/dovecot/dovecot-ldap.conf.ext driver = ldap } plugin { default_language = de fts = lucene fts_lucene = whitespace_chars=@. mail_replica = tcp:172.16.1.1:12345 quota = maildir:User quota quota_rule = *:storage=5G quota_rule2 = Trash:storage=+200M quota_rule3 = Spam:ignore quota_warning = storage=95%% quota-warning 95 %u quota_warning2 = storage=80%% quota-warning 80 %u sieve = /etc/sieve/%n.sieve sieve_default = /etc/sieve/default.sieve sieve_dir = ~/sieve sieve_extensions = +editheader } pop3_deleted_flag = $POP3Deleted postmaster_address = postmaster(a)wogri.at protocols = " imap lmtp sieve pop3" service aggregator { fifo_listener replication-notify-fifo { user = dovecot } unix_listener replication-notify { user = dovecot } } service doveadm { inet_listener { port = 12345 } } service imap { process_limit = 1024 } service lmtp { inet_listener lmtp { port = 2003 } unix_listener lmtp { user = dovecot } user = dovecot } service managesieve-login { inet_listener sieve { port = 4190 } service_count = 1 } service pop3 { process_limit = 1024 } service quota-warning { executable = script /usr/local/sbin/quota-warning.sh unix_listener quota-warning { user = dovecot } user = dovecot } service replicator { process_min_avail = 1 unix_listener replicator-doveadm { mode = 0600 } } ssl = required ssl_cert = </etc/dovecot/server.cert.pem ssl_key = # hidden, use -P to show it userdb { args = /etc/dovecot/dovecot-ldap.conf.ext driver = ldap } protocol lmtp { mail_plugins = quota sieve virtual notify replication } protocol lda { mail_plugins = quota fts fts_lucene virtual notify replication sieve } protocol imap { mail_max_userip_connections = 50 mail_plugins = quota fts fts_lucene virtual notify replication imap_quota } protocol pop3 { mail_plugins = quota fts fts_lucene virtual notify replication } local 2a00:XXX::/64 { doveadm_password = # hidden, use -P to show it }

3 4

Timeout Leak
by Luciano Mannucci 16 Mar '17

16 Mar '17

Hello all, I've got 3 occurences of this message in my log file: auth: Warning: Timeout leak: 0x805e480 (auth-request-handler.c:550) Can I ignore it, or is it a syhmptom of something wrong? I'm running dovecot 2.2.28 (bed8434). I'll post my doveconf -n if it is worth investigating further... Cheers, Luciano. -- /"\ /Via A. Salaino, 7 - 20144 Milano (Italy) \ / ASCII RIBBON CAMPAIGN / PHONE : +39 2 485781 FAX: +39 2 48578250 X AGAINST HTML MAIL / E-MAIL: posthamster(a)sublink.sublink.ORG / \ AND POSTINGS / WWW: http://www.lesassaie.IT/

2 2

'doveadm who' behind nginx mail proxy
by Edgaras Lukoševičius 16 Mar '17

16 Mar '17

Hello, we have configured nginx to work as mail proxy for backend dovecot servers. Dovecot servers behind nginx proxy are showing internal nginx ip address for every client when running 'doveadm who' instead of showing real client IP addresses. Is is possible to configure this setup to show real client IP addresses when running 'doveadm who' on internal dovecot servers or to configure nginx to show which user-ip pairs are proxied to which servers?

1 0

LDAP locking problems - home related
by Ganael Laplanche 16 Mar '17

16 Mar '17

Hi list, # dovecot --version 2.2.13 We use Dovecot LDA and I've discovered lots of messages stating that lock files cannot be written: Mar 16 12:02:03 mailhost dovecot: lda(someuser): Error: file_dotlock_open(/home/sg/someuser/.dovecot.lda-dupes) failed: No such file or directory That user's home directory is fetched from LDAP and does not exist locally on our 'mailhost' machine, so those error messages do make sense; I would like to fix that situation. In our current Dovecot configuration, only mail_location is set: mail_location = maildir:/var/mail/%u I would like to ignore the erroneous 'home' attribute fetched from LDAP and specify a common mail_home, i.e. set: mail_home = /var/mail/%u/home but if I understand correctly, that global mail_home configuration directive would still be overridden by the LDAP 'home' attribute fetched from passdb: [...] pass_attrs = supannAliasLogin=user,userPassword=password,\ homeDirectory=userdb_home,uidNumber=userdb_uid,gidNumber=userdb_gid [...] Can I just remove homeDirectory from pass_attrs to skip fetching 'home' from LDAP and then set the global mail_home ? Also, if that works: We would switch from a situation where a home is set (but wrong) to one where it becomes valid. Can there be any side-effect in that case (apart from fixing locking problems) ? Finally, will mail_home (leaf) directory be created if it does not exist yet (parent directory exists) ? Best regards, -- Ganael Laplanche <ganael.laplanche(a)centralesupelec.fr> Unix Systems Engineer @CentraleSupelec Rennes

1 1

Dovecot 2.2.27 proxy - enforcing per client IP connection limits
by Adi Pircalabu 16 Mar '17

16 Mar '17

Hi, Trying to keep abusive/buggy IMAP clients at bay on a number of Dovecot proxy servers, I've reconfigured them to use "mail_max_userip_connections = 50" in the "protocol imap" section, followed by restarting Dovecot. Yet, I'm still seeing 160+ established connections from a single IP address for the same email account. Am I missing anything? # 2.2.27 (c0f36b0): /etc/dovecot/dovecot.conf # Pigeonhole version 0.4.16 (fed8554) # OS: Linux 2.6.32-642.4.2.el6.x86_64 x86_64 CentOS release 6.8 (Final) auth_cache_negative_ttl = 5 mins auth_cache_size = 16 M auth_cache_ttl = 18 hours default_client_limit = 6120 default_process_limit = 500 managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext imapflags notify mbox_write_locks = fcntl namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } passdb { args = /etc/dovecot/dovecot-sql.conf.ext driver = sql } plugin { sieve = file:~/sieve;active=~/.dovecot.sieve sieve_extensions = +notify +imapflags } protocols = imap pop3 lmtp sieve service auth { client_limit = 6120 } service imap-login { process_limit = 2048 process_min_avail = 20 service_count = 0 vsz_limit = 256 M } service imap { process_limit = 2048 } service managesieve-login { inet_listener sieve { port = 4190 } service_count = 0 vsz_limit = 128 M } service managesieve { process_limit = 1024 } service pop3 { process_limit = 1024 } [...] protocol imap { imap_capability = IMAP4rev1 SASL-IR LOGIN-REFERRALS ID ENABLE IDLE mail_max_userip_connections = 50 } -- Adi Pircalabu

3 6

Postfix Ignoring lmtp, delivering straight to maildir
by Doug Barton 16 Mar '17

16 Mar '17

First I'd like to thank all the developers and contributors to dovecot. I've been using it for many years, and deeply appreciate your fine work. :) dovecot --version 2.2.22 (fe789d2) I have a working installation with postfix and dovecot, and I want to add sieve to it, so I am trying to configure postfix to use lmtp instead of 'virtual' for its delivery service. However it is ignoring that request, and for every message I get "status=sent (delivered to maildir)" and it shows up in my Inbox. On my mail host I have 1 normal user, let's say the username is 'myuser'. I have postfix configured to accept mail for several different domains, and each domain has a lot of different mail usernames (I use this for mailing lists and such). I use the virtual_maps feature of postfix, and have a map file that looks like this: abuse(a)dougbarton.us myuser hostmaster(a)dougbarton.us myuser dougb(a)dougbarton.us myuser ... All of this works great, and mail for all the different usernames and domains gets delivered into my one real user's Maildir, and I can see the mail with my IMAP clients. I've configured sieve in dovecot, and I can see the socket for lmtp in /var/spool/postfix/private/. I can also see the managesieve port in netstat, and I can use a sieve client to connect to it and edit scripts, etc. So according to all the tutorials I've read my next step is this in postfix' main.cf: virtual_transport = lmtp:unix:private/dovecot-lmtp which I did, and postfix restarts with no errors. But, it seems to avoid lmtp altogether, and as I mentioned above it delivers straight to my Maildir Inbox every time. I do have a sieve file, and the ~/dovecot.sieve symlink exists. I created a very simple filter: require ["fileinto", "imap4flags"]; if header :contains "Subject" "test" { fileinto "Junk"; } which my sieve client says is correct syntax. Still no joy. :-/ Any thoughts or suggestions are welcome. (And sorry this is so long, but based on my extensive searches it seems my configuration is a bit unique, so I explained it in some length.) Doug

3 5

Backing Up and Restoring mailboxes
by Jerry 15 Mar '17

15 Mar '17

I am going to be wiping clean my system and doing a complete upgrade. I have dovecot installed. I want to back up the mail system, and then be able to restore it. I thought that I could do this. doveadm -Dv backup -u user(a)example.com maildir:~/DoveBU Then I was going to gunzip that directory and put it onto a USB Drive. Now, after updating the system, I thought that I could just unzip the file from the USB drive. My question is, what command do I run to return the files to the same place they were originally. Assuming the structure was: "/var/mail/vmail/", what would I do? Thanks -- Jerry

1 0

FW: Unable to create needed folders
by Ken Zachreson 15 Mar '17

15 Mar '17

Never mind, I am stupid and did not read all available information. Needed to change permissions on /var/mail/* Thank You, Ken Z -----Original Message----- From: Ken Zachreson Sent: Wednesday, March 15, 2017 10:28 AM To: 'dovecot(a)dovecot.org' <dovecot(a)dovecot.org> Subject: Unable to create needed folders Greetings, The log reports that a process cannot create the needed folders. Please review and tell me what I have done wrong. dovecot 2.0.9 # 2.0.9: /etc/dovecot/dovecot.conf doveconf: Warning: NOTE: You can get a new clean config file with: doveconf -n > dovecot-new.conf doveconf: Warning: Obsolete setting in /etc/dovecot/dovecot.conf:85: protocol { ssl_listen } has been replaced by service { inet_listener { address } } # OS: Linux 2.6.32-642.15.1.el6.x86_64 x86_64 CentOS release 6.8 (Final) auth_mechanisms = plain login last_valid_gid = 520 last_valid_uid = 520 mail_location = mbox:~/mail/:INBOX=/var/mail/%u mbox_write_locks = fcntl passdb { args = dovecot driver = pam } protocols = imap service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0660 user = postfix } } service imap-login { inet_listener imaps { address = * } } service pop3-login { inet_listener pop3s { address = * } } ssl_ca = /etc/pki/tls/certs/gd_bundle-g2-g1.crt ssl_cert = </etc/pki/tls/certs/c1e209e3ca2e1e5.crt ssl_key = </etc/pki/tls/private/gcrcnet.key userdb { driver = passwd } protocol pop3 { pop3_uidl_format = %08Xv%08Xu } ERROR Message from log Mar 15 10:14:03 MultiTronic6 dovecot: imap-login: Login: user=<wifi.adm>, method=LOGIN, rip=xx.xx.xx.xx, lip=yy.yy.yy.yy, mpid=5973, TLS Mar 15 10:14:03 MultiTronic6 dovecot: imap(wifi.adm): Error: chown(/home/wifi.adm/mail/.imap/INBOX, -1, 12(mail)) failed: Operation not permitted (egid=504(wifi.adm), group based on /var/mail/wifi.adm) Mar 15 10:14:03 MultiTronic6 dovecot: imap(wifi.adm): Error: mkdir(/home/wifi.adm/mail/.imap/INBOX) failed: Operation not permitted Mar 15 10:14:03 MultiTronic6 dovecot: imap(wifi.adm): Connection closed bytes=39/423 Thank You, Ken Zachreson IT Manager, Grand Canyon Resort Corp 928-769-2629 928-769-2638 Help Desk

1 0

Unable to create needed folders
by Ken Zachreson 15 Mar '17

15 Mar '17

Greetings, The log reports that a process cannot create the needed folders. Please review and tell me what I have done wrong. dovecot 2.0.9 # 2.0.9: /etc/dovecot/dovecot.conf doveconf: Warning: NOTE: You can get a new clean config file with: doveconf -n > dovecot-new.conf doveconf: Warning: Obsolete setting in /etc/dovecot/dovecot.conf:85: protocol { ssl_listen } has been replaced by service { inet_listener { address } } # OS: Linux 2.6.32-642.15.1.el6.x86_64 x86_64 CentOS release 6.8 (Final) auth_mechanisms = plain login last_valid_gid = 520 last_valid_uid = 520 mail_location = mbox:~/mail/:INBOX=/var/mail/%u mbox_write_locks = fcntl passdb { args = dovecot driver = pam } protocols = imap service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0660 user = postfix } } service imap-login { inet_listener imaps { address = * } } service pop3-login { inet_listener pop3s { address = * } } ssl_ca = /etc/pki/tls/certs/gd_bundle-g2-g1.crt ssl_cert = </etc/pki/tls/certs/c1e209e3ca2e1e5.crt ssl_key = </etc/pki/tls/private/gcrcnet.key userdb { driver = passwd } protocol pop3 { pop3_uidl_format = %08Xv%08Xu } ERROR Message from log Mar 15 10:14:03 MultiTronic6 dovecot: imap-login: Login: user=<wifi.adm>, method=LOGIN, rip=xx.xx.xx.xx, lip=yy.yy.yy.yy, mpid=5973, TLS Mar 15 10:14:03 MultiTronic6 dovecot: imap(wifi.adm): Error: chown(/home/wifi.adm/mail/.imap/INBOX, -1, 12(mail)) failed: Operation not permitted (egid=504(wifi.adm), group based on /var/mail/wifi.adm) Mar 15 10:14:03 MultiTronic6 dovecot: imap(wifi.adm): Error: mkdir(/home/wifi.adm/mail/.imap/INBOX) failed: Operation not permitted Mar 15 10:14:03 MultiTronic6 dovecot: imap(wifi.adm): Connection closed bytes=39/423 Thank You, Ken Zachreson IT Manager, Grand Canyon Resort Corp 928-769-2629 928-769-2638 Help Desk

1 0

autocreate ONLY for new Users
by plataleas 15 Mar '17

15 Mar '17

Hi All We are currently migrating accounts to Dovecot. The existing accounts do have special folders with different names. (i.e. sent, sent-mail) The autocreate-function of "special folders" is useful. However we need this feature ONLY for new users. The existing accounts have a mapping for their own "special folders". There are discussions about this topic on the mailing list: /http://www.dovecot.org/list/dovecot/2014-August/097313.html https://dovecot.org/list/dovecot/2016-May/104296.html/ Did someone manage to implement this ? Are there workarounds? Thanks and regards plataleas

3 6

Custom cache_key for passdb-sql
by Tom Sommer 15 Mar '17

15 Mar '17

The cache_key for the SQL-passdb should be created automatically, but for some reason the service (%s) is not part of the key, and I need it to be I've tried to set a manual cache_key, but that fails: Mar 15 11:54:02 auth: Fatal: sql /etc/dovecot/dovecot-sql.conf cache_key=%s%u%{real_ip}: Can't open configuration file /etc/dovecot/dovecot-sql.conf cache_key=%s%u%{real_ip}: No such file or directory passdb { args = /etc/dovecot/dovecot-sql.conf cache_key=%s%u%{real_ip} driver = sql } Is this not possible? -- Tom

1 0

welcome plugin
by David Mehler 14 Mar '17

14 Mar '17

Hello, If anyone is using the welcome plugin in dovecot 2.2.x to sent a one-time new welcome email to new users can I get a look at your configuration? I'm stuck, I create a user and the welcome action does not execute. If you've got a script to send the mail can I get a look at that as well? Thanks. Dave.

3 2

Users with extra mailbox: namespace/mailbox in userdb lookup?
by MRob 14 Mar '17

14 Mar '17

Hello, We have a need for some users to have an additional folder created and subscribed for them. Is is possible to return an override for the default "namespace inbox" containing the needed mailbox definitions in the userdb lookup for such users? If so, how would the userdb lookup result be formatted? Presumably as just one long string, but how would the setting be named given there can't be a space in it? Can I replace the space with an underscore, e.g. userdb_namespace_inbox = '{ mailbox Drafts { auto=subscribe special_use = \Drafts } mailbox Trash { auto=subscribe special_use = \Trash } }' Or is there some other way to do this?

4 11

strange behaviour of dovecot
by Masaharu Kawada 14 Mar '17

14 Mar '17

Dear dovecot-list, Dovecot gives the below error messages and those errors go away after running 'systemctl restart dovecot'(Restarting dovecot service)', however, the same happens after a while later(like after 300 mails delivered). --- master : Error : service(anvil) : Initial Status notification no received in 30 seconds, killing the process master : Error : service(log) : Initial Status notification no received in 30 seconds, killing the process master : Error : service(ssl-params) : Initial Status notification no received in 30 seconds, killing the process master : Error : service(log) : child 3703 killed with signal 9 --- then the log process is not there so that no mail log gets captured in maillog: --- root 28036 0.0 0.0 19864 1604 ? Ss 11:45 0:00 /usr/sbin/dovecot -F dovecot 28074 0.0 0.0 9312 1000 ? S 11:46 0:00 dovecot/anvil root 28075 0.0 0.0 12324 2084 ? S 11:46 0:00 dovecot/config --- Does this have something to do with any limitation in dovecot configuration? If anyone in the list ever has similar or same experience, please give me a clue that shows where to look at from here. Thanks, -- Masaharu Kawada

2 2

Solr 6.4.2
by Daniel Miller 14 Mar '17

14 Mar '17

For those trying Solr - version 6.4.2 fixed a number of bugs in the 6.4.x series. Speed is incredible. If you haven't tried it - I strongly recommend it! And, using the included installation script (with Solr) combined with my schema - installation was painless. I'm now running in single core mode without issues (running in cloud mode with a single core seemed silly anyway). -- Daniel

1 0

Re: First time setting up Director Woes
by Jesse C. Smillie 13 Mar '17

13 Mar '17

Working again. Explains a lot actually. Inital box I was experimenting on PAM was already setup and had worked. That error I got caught up in was with SSSD and PAM wasn't working. Fixing the error shot myself in the foot in other ways. Thank you! -Jesse C. Smillie On 3/13/17 4:38 PM, Aki Tuomi wrote: >> On March 13, 2017 at 10:21 PM "Jesse C. Smillie" <jsmillie(a)gatewayk12.org> wrote: >> >> >> I'm trying to setup our first director server. Trying to keep the >> initial config simple really as just maybe a proof of concept and its >> got me pulling my hair out today. Initially I just tried to convert one >> of my already running IMAP servers to be a director just to see if I >> could do it. I modified the configs as it appeared they needed based on: >> >> https://wiki2.dovecot.org/Director >> http://wiki2.dovecot.org/PasswordDatabase/ExtraFields/Proxy >> >> But it didn't work. Kept serving files locally instead of proxing off >> to the servers listed. > Remove this: > >> passdb { >> driver = pam >> } > Aki

1 0

First time setting up Director Woes
by Jesse C. Smillie 13 Mar '17

13 Mar '17

I'm trying to setup our first director server. Trying to keep the initial config simple really as just maybe a proof of concept and its got me pulling my hair out today. Initially I just tried to convert one of my already running IMAP servers to be a director just to see if I could do it. I modified the configs as it appeared they needed based on: https://wiki2.dovecot.org/Director http://wiki2.dovecot.org/PasswordDatabase/ExtraFields/Proxy But it didn't work. Kept serving files locally instead of proxing off to the servers listed. -----------------------------------------------------------------------------------------------==== Mar 13 15:58:27 fugitoid dovecot: imap-login: Login: user=<makaveli>, method=PLAIN, rip=10.0.15.114, lip=10.1.12.221, mpid=3022, TLS, session=<YCCCIqJKmMIKAA9y> Mar 13 15:58:27 fugitoid dovecot: imap(makaveli): Error: User initialization failed: Namespace '': mkdir(/home/makaveli/Maildir) failed: Permission denied (euid=2605(makaveli) egid=1100(<unknown>) missing +w perm: /home, dir owned by 0:0 mode=0755) Mar 13 15:58:27 fugitoid dovecot: imap: Error: Invalid user settings. Refer to server log for more information. Thinking it was just something with that box (still running Dovecot 2.2.10 as well) I moved on to setup a new Centos7 server and go through the setup again and initially it was working for a few hours. -----------------------------------------------------------------------------------------------==== Mar 13 12:19:03 fugitoid dovecot: imap-login: proxy(makaveli): started proxying to 10.1.12.228:993: user=<makaveli>, method=PLAIN, rip=10.0.15.114, lip=10.1.12.221, TLS, session=<CzfaEZ9KXgAKAA9y> Then at some point I got side tracked by a pam error message and when I came back from working that out Dovecot was trying to authenticate users locally again. I really feel like I'm missing something here, but for the life of me I can't figure it out. Any ideas would be welcome. Thanks. # 2.2.28 (bed8434): /etc/dovecot/dovecot.conf # OS: Linux 3.10.0-514.10.2.el7.x86_64 x86_64 CentOS Linux release 7.3.1611 (Core) auth_mechanisms = plain login default_client_limit = 1024 director_mail_servers = 10.1.12.229 10.1.12.228 10.1.12.225 director_servers = 10.1.12.221:9090 mail_fsync = always mail_nfs_storage = yes mbox_write_locks = fcntl namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } passdb { driver = pam } passdb { args = proxy=y nopassword=y ssl=any-cert driver = static } protocols = imap service director { fifo_listener login/proxy-notify { mode = 0666 } inet_listener { port = 9090 } unix_listener director-userdb { mode = 0600 } unix_listener login/director { mode = 0666 } } service imap-login { executable = imap-login director inet_listener imaps { port = 993 ssl = yes } } ssl = required ssl_ca = </etc/GoDaddy_SSL/gd_bundle.crt ssl_cert = </etc/GoDaddy_SSL/gatewayk12.cert ssl_cipher_list = ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA ssl_dh_parameters_length = 2048 ssl_key = # hidden, use -P to show it ssl_protocols = TLSv1 TLSv1.1 TLSv1.2 userdb { driver = passwd }

2 1

change mdbox rotation size?
by Dave McGuire 13 Mar '17

13 Mar '17

Hey folks. Is it possible/advisable to change the mdbox rotation size on an operational mdbox spool? If so, is there any way to "repackage" (for the lack of a better term) an existing mdbox spool to a different rotation size? Thanks, -Dave -- Dave McGuire, AK4HZ New Kensington, PA

1 0

Dict protocol changes string
by Nagy, Attila 13 Mar '17

13 Mar '17

Hi, I use pass and userdb with dict protocol in a similar way: key passdb { key = passdb^MAuth-User: %u^MAuth-Pass: %w^MAuth-Protocol: %s^MClient-IP: %r format = json } (^M is an \r character, inserted with vi CTRL-v + enter) Until 2.2.24 this has worked, but 2.2.25 seems to convert that ASCII 13 into an ASCII 1 and an "r". Python printout from what I get with 2.2.25: 'Lshared/passdb\x01rAuth-User: user\x01rAuth-Pass: pass\x01rAuth-Protocol: pop3\x01rClient-IP: 1.2.3.4' Is this change intentional? Why?

2 4

dovecot: master: Dovecot v2.2.22 (fe789d2) starting up for imap, pop3 (core dumps disabled)
by Basdove 13 Mar '17

13 Mar '17

Hi. Always the below log appraring log under /var/log/mail.log Is this right or How to resolve it. Ubuntu 16.04.2 LTS server edition Mar 13 06:13:20 home dovecot: master: Dovecot v2.2.22 (fe789d2) starting up for imap, pop3 (core dumps disabled) Mar 13 06:13:30 home postfix/master[1495]: daemon started -- version 3.1.0, configuration /etc/postfix dovecot -n output -------------------------------------------------------------------- # 2.2.22 (fe789d2): /etc/dovecot/dovecot.conf # Pigeonhole version 0.4.13 (7b14904) # OS: Linux 4.4.0-64-generic x86_64 Ubuntu 16.04.2 LTS auth_mechanisms = plain login mail_location = mbox:~/mail:INBOX=/var/mail/%u mail_privileged_group = mail namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } passdb { driver = pam } protocols = " imap pop3" service auth-worker { user = root } service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0660 user = postfix } } ssl_ca = >/etc/ssl/certs/01.pem ssl_cert = </etc/ssl/certs/cacert.pem ssl_key = </etc/ssl/private/cakey.pem ssl_key_password = # hidden, use -P to show it ssl_protocols = TLSv1 ssl_verify_client_cert = yes userdb { driver = passwd } ---------------------------------------------------------- Thanhs & Regards Baskaranand

2 1

I’m slightly shocked
by dovecot 11 Mar '17

11 Mar '17

Hey! Just take a look at that crazy stuff, I'm slightly shocked! Here it is http://web.wacinema.com/6869 Yours, dovecot

1 0

virtual all mails folder in dovecot
by Rahul Singh Badyal 11 Mar '17

11 Mar '17

I have Centos 7 mail server installed with dovecot and postfix with MariaDB. I am trying to add a virtual All Mails folder for every user so that they can have all mails such as inbox, sent in a single folder, something like gmail. Please help me for this. *Regards,* *Rahul*

2 1

(no subject)
by Rahul Singh Badyal 11 Mar '17

11 Mar '17

I have Centos 7 mail server installed with dovecot and postfix with MariaDB. I am trying to add a virtual All Mails folder for every user so that they can have all mails such as inbox, sent in a single folder, something like gmail. Please help me for this. *Regards,* *Rahul*

1 0

new article
by dovecot 11 Mar '17

11 Mar '17

Hi, There is an article I've written recently and I wanted to hear your thoughts about it, please read it here http://example.wowcinema.com/6f6e Best regards, dovecot

1 0

v2.2.28 released
by Timo Sirainen 10 Mar '17

10 Mar '17

http://dovecot.org/releases/2.2/dovecot-2.2.28.tar.gz http://dovecot.org/releases/2.2/dovecot-2.2.28.tar.gz.sig * director: "doveadm director move" to same host now refreshes user's timeout. This allows keeping user constantly in the same backend by just periodically moving the user there. * When new mailbox is created, use initially INBOX's dovecot.index.cache caching decisions. * Expunging mails writes GUID to dovecot.index.log now only if the GUID is quickly available from index/cache. * pop3c: Increase timeout for PASS command to 5 minutes. * Mail access errors are no longer ignored when searching or sorting. With IMAP the untagged SEARCH/SORT reply is still sent the same as before, but NO reply is returned instead of OK. + Make dovecot.list.index's filename configurable. This is needed when there are multiple namespaces pointing to the same mail root (e.g. lazy_expunge namespace for mdbox). + Add size.virtual to dovecot.index when folder vsizes are accessed (e.g. quota=count). This is mainly a workaround to avoid slow quota recalculation performance when message sizes get lost from dovecot.index.cache due to corruption or some other reason. + auth: Support OAUTHBEARER and XOAUTH2 mechanisms. Also support them in lib-dsasl for client side. + auth: Support filtering by SASL mechanism: passdb { mechanisms } + Shrink the mail processes' memory usage by not storing settings duplicated unnecessarily many times. + imap: Add imap_fetch_failure setting to control what happens when FETCH fails for some mails (see example-config). + imap: Include info about last command in disconnection log line. + imap: Created new SEARCH=X-MIMEPART extension. It's currently not advertised by default, since it's not fully implemented. + fts-solr: Add support for basic authentication. + Cassandra: Support automatically retrying failed queries if execution_retry_interval and execution_retry_times are set. + doveadm: Added "mailbox path" command. + mail_log plugin: If plugin { mail_log_cached_only=yes }, log the wanted fields only if it doesn't require opening the email. + mail_vsize_bg_after_count setting added (see example-config). + mail_sort_max_read_count setting added (see example-config). + pop3c: Added pop3c_features=no-pipelining setting to prevent using PIPELINING extension even though it's advertised. - Index files: day_first_uid wasn't updated correctly since v2.2.26. This caused dovecot.index.cache to be non-optimal. - imap: SEARCH/SORT may have assert-crashed in client_check_command_hangs - imap: FETCH X-MAILBOX may have assert-crashed in virtual mailboxes. - imap: Running time in tagged command reply was often wrongly 0. - search: Using NOT n:* or NOT UID n:* wasn't handled correctly - director: doveadm director kick was broken - director: Fix crash when using director_flush_socket - director: Fix some bugs when moving users between backends - imapc: Various error handling fixes and improvements - master: doveadm process status output had a lot of duplicates. - autoexpunge: If mailbox's rename timestamp is newer than mail's save-timestamp, use it instead. This is useful when autoexpunging e.g. Trash/* and an entire mailbox is deleted by renaming it under Trash to prevent it from being autoexpunged too early. - autoexpunge: Multiple processes may have been trying to expunge the same mails simultaneously. This was problematic especially with lazy_expunge plugin. - auth: %{passdb:*} was empty in auth-worker processes - auth-policy: hashed_password was always sent empty. - dict-sql: Merge multiple UPDATEs to a single statement if possible. - fts-solr: Escape {} chars when sending queries - fts: fts_autoindex_exclude = \Special-use caused crashes - doveadm-server: Fix leaks and other problems when process is reused for multiple requests (service_count != 1) - sdbox: Fix assert-crash on mailbox create race - lda/lmtp: deliver_log_format values weren't entirely correct if Sieve was used. especially %{storage_id} was broken. - lmtp_user_concurrency_limit didn't work if userdb changed username

6 7

Maildirsize not updated
by chaouche yacine 08 Mar '17

08 Mar '17

Hello dovecot Problem : maildirsize and dovecot quota get have different values dovecot version : 2.2.13 happens with : some mailboxes This issue happens only to some mailboxes and only for a specific period of time until maildirsize gets updated by something (not me). I can't reproduce this now because it happened this morning and now its 2 PM and the problem is gone (maildirsize was updated). Anybody experienced the same situation ? -- Yassine.

3 6

iOS Mail app and rapid authenticate / disconnect on Dovecot proxy
by Robert Giles 07 Mar '17

07 Mar '17

Hi folks, I have a handful of iOS 10.2.1 Mail app IMAP clients that intermittently break into this unexplained authenticate-then-immediately-disconnect behavior when connecting to a RHEL7 Dovecot (dovecot-2.2.10-7.el7) proxy, providing proxied connections to a backend Panda/UW-IMAP server. From talking to the users, the activity would appear to be spontaneous (ie: not caused by user interaction with the device). The behavior doesn't seem to have any observable implications for the end user, other than momentarily hitting the Dovecot process_limit (which, if not raised to a rather large number, disrupts new IMAP proxy connections momentarily). I reckon this is not an issue with Dovecot, but I'm curious to know if other folks have observed this behavior when dealing with iOS Mail app clients? The log entries look like this: iOS 10 device = 172.16.0.1 RHEL7 Dovecot proxy host = 192.168.0.1 ("proxyhost") Panda/UW-IMAP target = panda.imap.tld Mar 6 12:11:00 proxyhost dovecot: imap-login: proxy(jdoe): started proxying to panda.imap.tld:993: user=<jdoe>, method=PLAIN, rip=172.16.0.1, lip=192.168.0.1, TLS, session=<VvzqehVKhwBCol00> Mar 6 12:11:00 proxyhost dovecot: imap-login: proxy(jdoe): disconnecting 172.16.0.1 (Disconnected by client): user=<jdoe>, method=PLAIN, rip=172.16.0.1, lip=192.168.0.1, TLS: Disconnected, session=<VvzqehVKhwBCol00> Mar 6 12:11:01 proxyhost dovecot: imap-login: proxy(jdoe): started proxying to panda.imap.tld:993: user=<jdoe>, method=PLAIN, rip=172.16.0.1, lip=192.168.0.1, TLS, session=<jaXxehVKiABCol00> Mar 6 12:11:01 proxyhost dovecot: imap-login: proxy(jdoe): disconnecting 172.16.0.1 (Disconnected by server): user=<jdoe>, method=PLAIN, rip=172.16.0.1, lip=192.168.0.1, TLS, session=<jaXxehVKiABCol00> Mar 6 12:11:01 proxyhost dovecot: imap-login: proxy(jdoe): started proxying to panda.imap.tld:993: user=<jdoe>, method=PLAIN, rip=172.16.0.1, lip=192.168.0.1, TLS, session=<RmX4ehVKiQBCol00> Mar 6 12:11:01 proxyhost dovecot: imap-login: proxy(jdoe): disconnecting 172.16.0.1 (Disconnected by server): user=<jdoe>, method=PLAIN, rip=172.16.0.1, lip=192.168.0.1, TLS, session=<RmX4ehVKiQBCol00> Mar 6 12:11:02 proxyhost dovecot: imap-login: proxy(jdoe): started proxying to panda.imap.tld:993: user=<jdoe>, method=PLAIN, rip=172.16.0.1, lip=192.168.0.1, TLS, session=<inYBexVKigBCol00> Mar 6 12:11:02 proxyhost dovecot: imap-login: proxy(jdoe): disconnecting 172.16.0.1 (Disconnected by server): user=<jdoe>, method=PLAIN, rip=172.16.0.1, lip=192.168.0.1, TLS, session=<inYBexVKigBCol00> Mar 6 12:11:02 proxyhost dovecot: imap-login: proxy(jdoe): started proxying to panda.imap.tld:993: user=<jdoe>, method=PLAIN, rip=172.16.0.1, lip=192.168.0.1, TLS, session=<GwAJexVKiwBCol00> Mar 6 12:11:02 proxyhost dovecot: imap-login: proxy(jdoe): disconnecting 172.16.0.1 (Disconnected by server): user=<jdoe>, method=PLAIN, rip=172.16.0.1, lip=192.168.0.1, TLS, session=<GwAJexVKiwBCol00> Mar 6 12:11:03 proxyhost dovecot: imap-login: proxy(jdoe): started proxying to panda.imap.tld:993: user=<jdoe>, method=PLAIN, rip=172.16.0.1, lip=192.168.0.1, TLS, session=<asUPexVKswBCol00> Mar 6 12:11:03 proxyhost dovecot: imap-login: proxy(jdoe): disconnecting 172.16.0.1 (Disconnected by server): user=<jdoe>, method=PLAIN, rip=172.16.0.1, lip=192.168.0.1, TLS, session=<asUPexVKswBCol00> Mar 6 12:11:03 proxyhost dovecot: imap-login: proxy(jdoe): started proxying to panda.imap.tld:993: user=<jdoe>, method=PLAIN, rip=172.16.0.1, lip=192.168.0.1, TLS, session=<n9YYexVKjQBCol00> Mar 6 12:11:04 proxyhost dovecot: imap-login: proxy(jdoe): disconnecting 172.16.0.1 (Disconnected by server): user=<jdoe>, method=PLAIN, rip=172.16.0.1, lip=192.168.0.1, TLS, session=<n9YYexVKjQBCol00> ...and on and on, usually until the 'service imap-login' process_limit is reached. You could naturally apply some iptables rate-limiting to avoid hitting process_limit, but it'd be nice to have the iOS client simply behave properly instead. dovecot -n: --- # 2.2.10: /etc/dovecot/dovecot.conf # OS: Linux 3.10.0-514.6.2.el7.x86_64 x86_64 Red Hat Enterprise Linux Server release 7.3 (Maipo) auth_mechanisms = plain login auth_verbose = yes first_valid_uid = 1000 imap_capability = +I18NLEVEL=1 mbox_write_locks = fcntl passdb { args = nopassword=y default_fields = proxy=y ssl=any-cert host=panda.imap.tld driver = static } protocols = imap pop3 service imap-login { process_limit = 400-ish at the moment process_min_avail = 2 } service pop3-login { inet_listener pop3s { port = 995 ssl = yes } } ssl = required ssl_ca = </etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem ssl_cert = <proxyhost.crt ssl_dh_parameters_length = 2048 ssl_key = <proxyhost.key ssl_protocols = !SSLv3 !SSLv3 ssl_require_crl = no userdb { driver = static } --- Thanks for any insight out there. Robert Giles

1 0

SiS hashes file ?
by Sai Kiran Gummaraj 07 Mar '17

07 Mar '17

Hello, In mdbox SiS POSIX mail box setting - There are hard-links under - <mail_attachment_dir>/ha/sh/<hash>-<guid-1> <mail_attachment_dir>/ha/sh/<hash>-<guid-2> Why is a copy of the file kept under hashes/<hash> ? -- Regards, Sai Kiran

1 0

Transitioning away from mail_location = maildir:~
by Chris Stankevitz 06 Mar '17

06 Mar '17

Hi, I have been using this setup for years: mail_home = /var/mail/vhosts/%d/%n mail_location = maildir:~ I have since learned that mail_home and mail_location should be different. I plan to use this: mail_home = /var/mail/vhosts/%d/%n mail_location = maildir:~/mail I would like the transition to be transparent for my email clients. I don't want mail/directories/sieve_scripts to disappear. 1. Should I manually create the maildir:~/mail directories? 2. Should I move files from /var/mail/vhosts/%d/%n into maildir:~/mail? Which files? (In other words: which files are "home directory" files and which files are "mail files"?) Thank you, Chris Example home directory: drwx------ . drwxr-xr-x .. drwx------ .Archives drwx------ .Archives.2016 drwx------ .Archives.2017 drwx------ .Drafts drwx------ .Junk drwx------ .Notes drwx------ .Sent drwx------ .Sent drwx------ .Trash drwx------ .work drwx------ .home drwx------ .todo lrwx------ .dovecot.sieve -rw------- .dovecot.sieve.log -rw------- .dovecot.sieve.log.0 -rw------- .dovecot.svbin drwx------ cur -rw------- dovecot-keywords -rw------- dovecot-uidlist -rw------- dovecot-uidvalidity -r--r--r-- dovecot-uidvalidity.55411048 -rw------- dovecot.index -rw------- dovecot.index.cache -rw------- dovecot.index.log -rw------- dovecot.mailbox.log drwx------ new drwx------ sieve -rw------- subscriptions drwx------ tmp $ dovecot -n # 2.2.27 (c0f36b0): /usr/local/etc/dovecot/dovecot.conf # Pigeonhole version 0.4.16 (fed8554) # OS: FreeBSD 10.3-RELEASE-p11 amd64 lmtp_save_to_detail_mailbox = yes mail_gid = 1002 mail_home = /var/mail/vhosts/%d/%n mail_location = maildir:~ mail_privileged_group = vpostfix mail_uid = 1002 managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } passdb { args = scheme=CRYPT username_format=%u /usr/local/etc/dovecot/users driver = passwd-file } plugin { recipient_delimiter = - sieve = file:~/sieve;active=~/.dovecot.sieve } protocols = imap pop3 lmtp sieve recipient_delimiter = - service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0666 user = postfix } unix_listener auth-userdb { group = postfix mode = 0600 user = postfix } } service lmtp { unix_listener /var/spool/postfix/private/dovecot-lmtp { group = postfix mode = 0666 user = postfix } } service managesieve-login { inet_listener sieve { port = 4190 } } ssl_cert = xxx ssl_key = xxx userdb { args = username_format=%u /usr/local/etc/dovecot/users driver = passwd-file } protocol lmtp { mail_plugins = " sieve" postmaster_address = xxx } protocol lda { mail_plugins = " sieve" }

5 6

quota-warning: possible to have size also?
by dovecot＠avv.solutions 06 Mar '17

06 Mar '17

Hello Community, My dovecot setup works fine with quotas and quota-warning. I have a questions though: when running the warning script, the example foundis it possible to pass the *quota size *as argument also? This would be useful with per-user quota. e.g. /some/script xx% username *xxxbytes* (order is not relevant of course) Thank you for your help. Cheers

4 4

dovecot 2.2.x listening on multiple interfaces
by David Mehler 06 Mar '17

06 Mar '17

Hello, I'm wondering if it's possible to get dovecot to listen on multiple interfaces without designating * for everything? I've got a machine with three interfaces going to three different networks. I'm not wanting to let dovecot listen on all interfaces * just two of them, standard ports. Is this doable? Thanks. Dave.

2 1

Upgrade from 2.0. to 2.2
by Jakob Curdes 06 Mar '17

06 Mar '17

Hello, we have a centos 6 server running dovecot 2.0 provided with the OS, currently 2.0.9. We would like to upgrade to the 2.2.19 package provided by the mailserver.guru repo. I read the upgrading docs for 2.1 and 2.2 and found the following issues: 2.0 - 2.1: - define namespace inbox or delete 15-mailboxes.conf (we do not "care about special use mailboxes") - plugins and UTF-8: we do not use one of the listed plugins - to allow mixed usernames set auth_username_format to "nothing" - solr backend: not used in our setup - expire plugin: not used - dsync: not used 2.1 - 2.2 - fts-solr: not used (?) - autocreate: not used - other changes: trivial or not used Are there other things that we need to observe? Is a direct update from 2.0.9 to 2.2.19 feasible with the above precautions or do we need to put in a 2.1 version in between? Thank you for hints, Jakob

4 6

welcome plugin
by David Mehler 06 Mar '17

06 Mar '17

Hello, Is anyone using the welcome plugin? I'm trying to utilize it to send a message when a user first logs in to the system, containing important information for them to know. The plugin loads, I don't have a configuration problem, but the message never gets sent. What can I provide to more easily troubleshoot this? Thanks. Dave.

3 5

[enhancement] fts-solr low performance
by azurit＠pobox.sk 05 Mar '17

05 Mar '17

Hi, we have activated fts-solr about a week ago and immediately started to experience really *low* performance with MOVE and EXPUNGE commands. After several days of googling, tcpdumping and straceing i was able to find and resolve the problem. We are using Dovecot 2.2.27 from Debian Jessie (jessie-backports), which is doing a soft commit in solr after every MOVE or EXPUNGE command - this behavior cannot be, currently, changed. The problem is that this was causing every MOVE/EXPUNGE to take about 6 seconds to complete. The problem appears to be in very old version of Solr - 3.6.2 (!!). This is the only version which is shipped with current (Jessie) and also next (Stretch) version of Debian, don't ask my why, i don't understand it either. Solr versions below 4.0 are NOT supporting soft commits, so all commits are hard and this was the problem. Finally, i decided to patch our Dovecot to not send a commit at all and everything started to be super fast. I'm doing hard commits every minute via cron so the only consequence of this is that you cannot search for messages delivered before less then a minute (which you, usually, don't need to do anyway). While googling i also find out that Solr supports autoCommit function (and from version 4.0 also autoSoftCommit), so there's no reason for Dovecot to handle this on it's own (and potentially doing hundreds or thousands of soft commits every second) - you can just set Solr to, for example, do autoSoftCommit every second and autoCommit every minute: https://cwiki.apache.org/confluence/display/solr/UpdateHandlers+in+SolrConf… Also this wiki page should be updated with warning about old versoins of Solr not supporting soft commits (you could also mention the auto[Soft]Commit function): http://wiki2.dovecot.org/Plugins/FTS/Solr I suggest to allow completely disable Solr commits in Dovecot by configuration, so people like me can handle this easily. What do you think? azur

1 0

fts_solr and connection via https://
by Jan Vonde 04 Mar '17

04 Mar '17

Hi, I am trying to get fts_solr working and my index server is available via HTTPS only. Dovecot is running on a Debian Jessie system and the Solr server has a letsencrypt certificate. My dovecot version is: 2.2.devel (a9ed8ae) The current setup is: 10-mail.conf: mail_plugins = fts fts_solr 90-fts.conf: plugin { fts = solr fts_autoindex = yes fts_solr = url=https://foo.example.com/solr/dovecot/ } When I try to index the mailboxes I am getting error messages like this: doveadm(user@host): Error: fts_solr: Lookup failed: 9002 Couldn't initialize SSL context: Can't verify remote server certs without trusted CAs (ssl_client_ca_* settings) doveadm(user@host): Error: Mailbox INBOX: Status lookup failed: Internal error occurred. Refer to server log for more information. [2017-01-22 09:52:38] Segmentation fault Contacting the index server via curl on the command line on the same host works, it returns HTTP 200: user@host ~ $ curl -s -o /dev/null -w "%{http_code}" https://foo.example.com/solr/ 200 user@host ~ $ Currently I have the following ssl related settings: user@host ~ $ doveconf -n -P | grep -i ssl ssl_cert = </etc/ssl/certs/mail.example.org.crt ssl_cipher_list = ALL:!LOW:!SSLv2:ALL:!aNULL:!ADH:!eNULL:!EXP:RC4+RSA:+HIGH:+MEDIUM ssl_key = </etc/ssl/private/mail.example.org.key ssl_protocols = !SSLv2 !SSLv3 I tried adding the following settings but that didn't help: ssl_ca = < /etc/ssl/certs/ca-certificates.crt ssl_client_ca_dir = /etc/ssl/certs Can you give me a hint how I can get the ssl certificate accepted? Thanks in advance and have a nice day, Jan :-)

2 10

mdbox Inconsistency in map index
by bOnK 04 Mar '17

04 Mar '17

After a (power)crash two accounts have been corrupted. I tried to rescue things by running force-resync multiple times, but that didn't work out. Searching the archives, I found a recent suggestion (by Timo) to delete the index files, but I'm not sure which files to delete and what the consequences will be. When I deleted ``storage/dovecot.map.index'' in an unimportant account of my own, things only grew worse and I decided to delete the account and start fresh... Something I obviously don't want to do with the other account as it belongs to a client with about 2.5G mails (856 m.* files), which we don't want to lose. I have observed the following behavior in the logs: When a new mail arrives: (The second line below is always the same, however there's no mail with uid 12819 according to doveadm search uid 12819) Mar 04 11:43:28 lda(user): Warning: mdbox /var/mail/user/storage: Inconsistency in map index (117,1060 != 117,1883660) Mar 04 11:43:28 lda(user): Error: Log synchronization error at seq=117,offset=1546660 for /var/mail/user/storage/dovecot.map.index: Extension record inc drops number below zero (uid=12819, diff=-1, orig=0) Mar 04 11:43:28 lda(user): Warning: fscking index file /var/mail/user/storage/dovecot.map.index Mar 04 11:43:28 lda(user): Info: msgid=<d760229d563e99dc787acd0746b18b31(a)feedback.1dayfly.net>: saved mail to INBOX Mar 04 11:43:28 lda(user): Warning: mdbox /var/mail/user/storage: Inconsistency in map index (117,1060 != 117,1883784) Mar 04 11:43:28 lda(user): Warning: fscking index file /var/mail/user/storage/dovecot.map.index Mar 04 11:43:28 lda(user): Warning: mdbox /var/mail/user/storage: rebuilding indexes Mar 04 11:43:28 lda(user): Warning: fscking index file /var/mail/user/storage/dovecot.map.index Mar 04 11:43:28 imap(user): Error: /var/mail/user/mailboxes/INBOX/dbox-Mails/dovecot.index reset, view is now inconsistent Mar 04 11:43:28 imap(user): Info: IMAP session state is inconsistent, please relogin. in=2011 out=108358 deleted=0 expunged=0 trashed=0 When user logs in next (might be from another box/MUA) Mar 04 11:44:36 imap-login: Info: Login: user=<user>, method=PLAIN, rip=82.95.XX.XX, lip=37.97.XX.XX, mpid=14884, TLS, session=<VfvML+ZJuO9SX18R> Mar 04 11:44:37 imap(user): Warning: mdbox /var/mail/user/storage: Inconsistency in map index (117,1060 != 117,1884336) Mar 04 11:44:37 imap(user): Warning: fscking index file /var/mail/user/storage/dovecot.map.index Mar 04 11:44:37 imap(user): Warning: mdbox /var/mail/user/storage: rebuilding indexes Mar 04 11:44:37 imap(user): Error: /var/mail/user/mailboxes/INBOX/dbox-Mails/dovecot.index reset, view is now inconsistent Mar 04 11:44:37 imap(user): Info: IMAP session state is inconsistent, please relogin. in=331 out=178391 deleted=0 expunged=0 trashed=0 Mar 04 11:44:37 imap(user): Warning: mdbox /var/mail/user/storage: Inconsistency in map index (117,1060 != 117,1884396) Mar 04 11:44:37 imap(user): Warning: fscking index file /var/mail/user/storage/dovecot.map.index Mar 04 11:44:37 imap(user): Warning: fscking index file /var/mail/user/storage/dovecot.map.index Mar 04 11:44:37 imap-login: Info: Login: user=<user>, method=PLAIN, rip=82.95.XX.XX, lip=37.97.XX.XX, mpid=14886, TLS, session=<AUTbL+ZJuu9SX18R> Besides the nuisance of getting kicked of every time a new mail arrives, user cannot delete mails (as in: move to Trash). TL;DR: which files to delete and what will be the consequences? -- b.

1 0

letsencrypt
by David Mehler 04 Mar '17

04 Mar '17

Hello, I know some users here are using letsencrypt for their CA. If this is to off topic write me privately. I'm wanting letsencrypt to take over as my CA, replacing existing self signed certificates. I've got web working, a certificate for https sites and one for webmail as they have different names. What I'm now wanting to do is get letsencrypt going for my email setup, the smtp handled by postfix, but mail, and imap I believe are handled by dovecot. With the web it was easy just let apache serve the token that letsencrypt needed and I got certificates. How do I do this with regards email? I hope that's clear. Any help appreciated. Thanks. Dave.

8 9

Re: letsencrypt
by Joseph Tam 04 Mar '17

04 Mar '17

> Thanks. Is there another way of doing this? I've got a web server > running on 80 and 443. Are there any other options? I'm getting this list in digest mode, so it's possible by the time this gets to you, I will have repeated someone else' suggestion. In this situation, where your dovecot server lives on the same host as a web server (wembail?), and this web server is already going certificate renewal, then just change the certificate to use SNI extension and add all LS services that live on this host. (This does not count as a cert renewal, but a new cert). (E.g. if you are using a certbot to get a certifiticate for "webmail.mydomain", then add "pop3.mydomain", "imap.mydomain" and "smtp.mydomain" to the certificate.) Your web server will have to virtually host those domains for the purposes of mapping the token pickup folder. Then you can use the same certificate for all TLS services hosted on that server. Joseph Tam <jtam.home(a)gmail.com>

1 0

Re: letsencrypt
by Joseph Tam 03 Mar '17

03 Mar '17

David Mehler <dave.mehler(a)gmail.com> writes: > I'm wanting letsencrypt to take over as my CA, replacing existing self > signed certificates. I've got web working, a certificate for https > sites and one for webmail as they have different names. What I'm now > wanting to do is get letsencrypt going for my email setup, the smtp > handled by postfix, but mail, and imap I believe are handled by > dovecot. SMTP is handled by postfix, imap/pop is handled by dovecot. > With the web it was easy just let apache serve the token that > letsencrypt needed and I got certificates. How do I do this with > regards email? You can do the DNS challenge method if your server has the ability to update DNS entries, or you can use certbot clients in standalone-mode that will act as a simple web server just long enough to serve out the token to complete the authentication. Joseph Tam <jtam.home(a)gmail.com>

1 0

Director+NFS Experiences
by Mark Moseley 03 Mar '17

03 Mar '17

As someone who is about to begin the process of moving from maildir to mdbox on NFS (and therefore just about to start the 'director-ization' of everything) for ~6.5m mailboxes, I'm curious if anyone can share any experiences with it. The list is surprisingly quiet about this subject, and articles on google are mainly just about setting director up. I've yet to stumble across an article about someone's experiences with it. * How big of a director cluster do you use? I'm going to have millions of mailboxes behind 10 directors. I'm guessing that's plenty. It's actually split over two datacenters. In the larger, we've got about 200k connections currently, so in a perfectly-balanced world, each director would have 20k connections on it. I'm guessing that's child's play. Any good rule of thumb for ratio of 'backend servers::director servers'? In my larger DC, it's about 5::1. * Do you use the perl poolmon script or something else? The perl script was being weird for me, so I rewrote it in python but it basically does the exact same things. * Seen any issues with director? In testing, I managed to wedge things by having my poolmon script running on all the cluster boxes (I think). I've since rewritten it to run *only* on the lowest-numbered director. When it wedged, I had piles (read: hundreds per second) of log entries that said: Feb 12 06:25:03 director: Warning: director(10.1.20.5:9090/right): Host 10.1.17.3 is being updated before previous update had finished (down -> up) - setting to state=up vhosts=0 Feb 12 06:25:03 director: Warning: director(10.1.20.5:9090/right): Host 10.1.17.3 is being updated before previous update had finished (up -> down) - setting to state=down vhosts=0 Feb 12 06:25:03 director: Warning: director(10.1.20.3:9090/left): Host 10.1.17.3 is being updated before previous update had finished (down -> up) - setting to state=up vhosts=0 Feb 12 06:25:03 director: Warning: director(10.1.20.3:9090/left): Host 10.1.17.3 is being updated before previous update had finished (up -> down) - setting to state=down vhosts=0 Because it was in testing, I didn't notice it and it was like this for several days till dovecot was restarted on all the director nodes. I'm not 100% on what happened, but my *guess* is that two boxes tried to update the status of the same backend server in rapid succession. * Assuming you're using NFS, do you still see non-trivial amounts of indexes getting corrupted? * Again, assuming NFS and assuming at least some corrupted indexes, what's your guess for success rate % for dovecot recovering them automatically? And how about success rate % for ones that dovecot wasn't able to do automatically but you had to use doveadm to repair it? Really what I'm trying to figure out is 1) how often sysops will need to manually recover indexes; and 2) how often admins *can't* manually recover indexes? * if you have unrecoverable indexes (and assuming you have snapshots on your NFS server), does grabbing the most recent indexes from the snapshots always work for recovery (obviously, up till the point that the snapshot was taken)? * Any gotchas you've seen anywhere in a director-fied stack? I realize that's a broad question :) * Does one of your director nodes going down cause any issues? E.g. issues with the left and right nodes syncing with each other? Or when the director node comes back up? * Does a backend node going down cause a storm of reconnects? In the time between deploying director and getting mailboxes converted to mdbox, reconnects for us will mean cold local-disk dovecot caches. But hopefully consistent hashing helps with that? * Do you have consistent hashing turned on? I can't think of any reason not to have it turned on, but who knows * Any other configuration knobs (including sysctl) that you needed to futz with, vs the default? I appreciate any feedback!

8 14

Mailbox size in log file
by Sergio Bastian Rodríguez 03 Mar '17

03 Mar '17

Hello Dovecot list. I need that Dovecot log writes mailbox size in all POP / IMAP connections, but I do not know if Dovecot can do that. I have been searching about that with not successful. For example, this is the log of our last email platform, different than Dovecot: 06:48:14 025BEE83 POP3 LOGIN user 'xxx(a)xxx.com' MailboxSize = 61708 Capacity = 2% ...... 06:49:19 025BEE83 POP3 LOGOUT user 'xxx(a)xxx.com' MailboxSize = 14472 Capacity = 0% In this example we can know the mailbox size before and after the connection, and it shows that user has removed or downloaded all messages from server. Now in Dovecot we have no information about that, and I cannot find any plugin which gives this us functionality. Is it possible to have this feature in Dovecot? Thanks for your help. ________________________________ ------------------------------------------------------------------------ Le informamos, como destinatario de este mensaje, que el correo electrónico y las comunicaciones por medio de Internet no permiten asegurar ni garantizar la confidencialidad de los mensajes transmitidos, así como tampoco su integridad o su correcta recepción, por lo que TELECABLE DE ASTURIAS, S.A. no asume responsabilidad alguna por tales circunstancias. Si no consintiese en la utilización del correo electrónico o de las comunicaciones vía Internet le rogamos nos lo comunique y ponga en nuestro conocimiento de manera inmediata. Este mensaje va dirigido, de manera exclusiva, a su destinatario y contiene información confidencial y sujeta al secreto profesional, cuya divulgación no está permitida por la ley. En caso de haber recibido este mensaje por error, le rogamos que, de forma inmediata, nos lo comunique mediante correo electrónico remitido a nuestra atención o a través del teléfono (+ 34) 984191000 y proceda a su eliminación, así como a la de cualquier documento adjunto al mismo. Asimismo, le comunicamos que la distribución, copia o utilización de este mensaje, o de cualquier documento adjunto al mismo, cualquiera que fuera su finalidad, están prohibidas por la ley. ------------------------------------------------------------------------

3 4