- dovecot - dovecot.org

seeking advice Error: Failed to lookup user
by noemi 28 Feb '24

28 Feb '24

Hi, I'm having some problems after activating the quota plugin: I followed the guide from the doc[0] but I'm having problems with some virtual user. I understand that,with my conf,the quota plugin check the limit of a user and then tell postfix to accept/discard the mail. i have some users under my main domain [conf in /etc/passwd] and some virtual user/domains [conf in virtusertable/virtdomains as files in postfix]. the virtual users use their local user for the login, so dovecot doesn't know they are virtual. I think the problem is here, because it is clear that the quota-status check is made by dovecot using the virtual user and not the local user[1]. understanding the problem doesn't help me in the resolution [other than burn everything and rebuild with a single management for local/virtual users using a db] but i will prefer a more soft approach. any help? my complete conf below[2] thanks, noemi [0] https://blog.sys4.de/postfix-dovecot-mailbox-quota-en.html [1] where the virtual user is mail(a)virtdomain.com and the local user is mail_virtdomain the check is done to user 'mail', thus returning a error: Nov 16 06:36:09 quota-status(other-user)<129776><OOwwMv+3VWXw+gEAKobZ8Q>: Error: Failed to lookup user mail(a)virtdomain.com: Mail access for users with UID 8 not permitted (see first_valid_uid in config file, uid from userdb lookup). [2] # 2.3.4.1 (f79e8e7e4): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.4 () # OS: Linux 6.1.0-10-amd64 x86_64 Debian 11.7 zfs # Hostname: mail-ng.pangea.org auth_mechanisms = plain login auth_username_format = %Ln default_client_limit = 3000 disable_plaintext_auth = no first_valid_uid = 8 log_path = /var/log/mail.log mail_location = maildir:/home/%n/Maildir mail_plugins = " quota" mail_privileged_group = mail managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } passdb { driver = pam } plugin { quota = maildir:User quota quota_exceeded_message = Quota exceeded, please go to https://laweb.pangea.org/contacte/ for instructions on how to fix this. quota_grace = 10%% quota_max_mail_size = 100M quota_status_nouser = DUNNO quota_status_overquota = 552 5.2.2 Mailbox is full and cannot receive any more emails quota_warning = storage=95%% quota-warning 95 %u quota_warning2 = storage=80%% quota-warning 80 %u sieve = file:~/sieve/;active=~/.dovecot.sieve sieve_user_log = /var/log/sieve.log sieve_vacation_send_from_recipient = yes } protocols = " imap lmtp sieve pop3" service auth { unix_listener /var/spool/postfix/private/dovecot-auth { group = postfix mode = 0660 user = postfix } } service imap-login { process_limit = 1024 service_count = 100 } service imap { process_limit = 1024 } service lmtp { unix_listener /var/spool/postfix/private/dovecot-lmtp { group = postfix mode = 0600 user = postfix } } service pop3-login { process_limit = 1024 service_count = 0 } service pop3 { process_limit = 1024 } service quota-status { client_limit = 1 executable = quota-status -p postfix inet_listener { address = 127.0.0.1 port = 7777 } } service quota-warning { executable = script /usr/local/bin/quota-warning.sh unix_listener quota-warning { mode = 0666 user = vmail } user = dovecot } ssl_cert = </etc/letsencrypt/live/mail-ng.pangea.org/fullchain.pem ssl_client_ca_dir = /etc/ssl/certs ssl_dh = # hidden, use -P to show it ssl_key = # hidden, use -P to show it userdb { driver = passwd } protocol imap { mail_max_userip_connections = 40 mail_plugins = " quota imap_quota" } protocol lmtp { mail_plugins = " quota sieve" }

1 0

Packages for Debian bookworm
by dovecot.org＠schildbach.de 25 Feb '24

25 Feb '24

Is there a reason there are no packages for recent Debian and Ubuntu versions? https://repo.dovecot.org/

2 1

Dovecot Authentication Protocol via SSL?
by dovecot.org＠schildbach.de 24 Feb '24

24 Feb '24

I'm trying to run the Dovecot Authentication Protocol (port 12345) [1] via SSL. Here is my non-SSL config: service auth { inet_listener { port = 12345 haproxy = yes } } Adding ssl=yes to the inner block doesn't seem to change anything, I can't connect via "openssl s_client -connect", for example. I do use SSL for IMAPS, so I know my general SSL configuration is fine and I've got a valid LetsEncrypt cert. Also, Postfix doesn't appear to offer any configuration in terms of running this protocol via SSL. Question: Does it even matter? I'm about to run this protocol over untrusted networks. Is it perhaps designed to handle this situation? I'm using SASL plain authentication. I'm obviously concerned about leaking passwords, but also about leaking usernames and activity logs in general. [1] https://doc.dovecot.org/3.0/developer_manual/design/auth_protocol/

1 0

Add tag support to 'Lua Director'
by William Edwards 24 Feb '24

24 Feb '24

Hi, There's a thread on this mailing list from 2022 called "The end of Dovecot Director?". I lost that email, hence the new conversation. Sorry about that. TL;DR: Is anyone else needing to migrate from Director interested in adding support for 2.x-style tags to the Lua script on https://doc.dovecot.org/3.0/configuration_manual/howto/director_with_lua/? Others on this list know Lua better than I. Background: Director is being removed from 2.4 (CE) / 3.x (Pro). After some notes from the community, the following manual entry popped up: https://doc.dovecot.org/3.0/configuration_manual/howto/director_with_lua/. It provides a Lua script that serves as a kind-of replacement for Director. It expects a list of backends, and maps users to a backend at connection time. The gotcha is in the last sentence: "There are no built-in tools in Dovecot to manage the database (such as adding backends, kicking users, monitoring backends, etc.). You need to build your own tooling." So, I built a CLI tool that provides the following functionality: - CRUD backends. - CRUD user-to-backend mappings. - Health-checking backends (replacing `poolmon`). - Swapping backends (move all users on backend X to backend Y). There's one to-do, though. Director had the concept of 'tags'. This is useful when one has multiple mail clusters, and users should be routed to a specific mail cluster. The Lua script does not know this concept. If a user does not have a mapping, it simply maps the user to any backend. Which could cause users to end up on the wrong backend. Therefore, it would be useful to add tag support to the Lua script: add `user_to_tags` and `tags` tables. Add a `tag_id` column to the `backends` table. Let the Lua script create a mapping to a backend with the same `tag_id` as the user entry in `user_to_tags`. Same logic as the `director_tag` passdb field (Director on 2.x). Alternatively, drop the 'tags' term: create a `user_to_backends` table with a JSON column taking multiple backend IDs (no foreign key relations = bad consistency). Alternatively, one could ensure that the Lua script never creates a mapping itself by manually creating it before the user connects. Pretty fragile in the real world, obviously. After this final to-do, I'd be happy to open-source my CLI. With kind regards, William Edwards

1 0

Help running dovecot with sieve
by pereirar2z＠gmail.com 23 Feb '24

23 Feb '24

Hi all, I'm running dovecot-pigeonhole-2.3.21-1.x86_64 & dovecot-2.3.21-1.x86_64 + roundcube 1.6.6 on my redhat server. Mailserver is working as expected with the exception fo the Filters. I've installed and configure everything that i'm aware of but unfortunatelly its not working. I think my installation is not loading this module: /usr/lib/dovecot/modules/lib90_sieve_plugin.so. But i have no idea what can I do more. Can you please help me? ###### # 2.3.21 (47349e2482): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.21 (f6cd4b8e) # OS: Linux 4.18.0-513.11.1.el8_9.x86_64 x86_64 Red Hat Enterprise Linux release 8.9 (Ootpa) xfs # Hostname: xxxxxx.xxxxx auth_debug = yes auth_verbose = yes disable_plaintext_auth = no first_valid_uid = 1000 listen = * log_path = /var/log/dovecot.log mail_debug = yes mail_location = maildir:/home/vmail/%d/%n/Maildir mail_plugins = acl mail_log notify mail_privileged_group = mail managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext mbox_write_locks = fcntl namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } passdb { args = /etc/dovecot/dovecot-sql.conf.ext driver = sql } plugin { sieve = ~/.dovecot.sieve sieve_default = /var/lib/dovecot/sieve/default.sieve sieve_dir = ~/sieve sieve_global = /var/lib/dovecot/sieve/global/ } protocols = imap pop3 sieve lmtp service auth-worker { user = vmail } service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0666 user = postfix } unix_listener auth-userdb { mode = 0600 user = vmail } user = dovecot } service lmtp { unix_listener /var/spool/postfix/private/dovecot-lmtp { group = postfix mode = 0600 user = postfix } } service managesieve-login { inet_listener sieve { port = 4190 } process_min_avail = 4 service_count = 1 vsz_limit = 64 M } service stats { unix_listener stats-reader { group = wheel mode = 0666 user = dovecot } unix_listener stats-writer { group = wheel mode = 0666 user = dovecot } } ssl_cert = </etc/pki/dovecot/certs/dovecot.pem ssl_key = # hidden, use -P to show it userdb { args = uid=vmail gid=vmail home=/home/vmail/%d/%n/Maildir driver = static } verbose_ssl = yes protocol lmtp { mail_plugins = acl mail_log notify quota sieve } protocol sieve { info_log_path = /var/log/dovecot-sieve.log log_debug = category=sieve managesieve_implementation_string = Dovecot Pigeonhole managesieve_logout_format = bytes=%i/%o managesieve_max_compile_errors = 5 managesieve_max_line_length = 64 k } (END ##### Can you guys see anything wrong here? Any help is highly appreciated! Thank-you

1 0

User-configurable time-based mail deletion in specific folders
by Peter Reinhold 22 Feb '24

22 Feb '24

Hi I have been wondering about if Dovecot has a feature that would allow users to setup a rule for a given folder, that mails older than X days should be deleted? Or is this something that would need to be done by an external script? I have looked a bit at autoexpunge, and while the basic feature looks to be what I need, it doesn't seem to be configurable down to a specific folder on a single user. -- Peter Reinhold Hi I have been wondering about if Dovecot has a feature that would allow users to setup a rule for a given folder, that mails older than X days should be deleted? Or is this something that would need to be done by an external script? I have looked a bit at autoexpunge, and while the basic feature looks to be what I need, it doesn't seem to be configurable down to a specific folder on a single user. -- Peter Reinhold

2 1

Valid Docs for Dovecot with postgresql
by burkhardt＠konsultaner.de 19 Feb '24

19 Feb '24

Hi! The docs for dovecot with postgres are outdated and I somehow cannot connect from my dovecot instance to my postgresql database. I tried a lot but the debug output dosn't help me. What user is actually trying to connect to the postgresql? the dovecot user or root or the actual user from the connection config? I want to connect locally. Do I use password or md5 or peer with a map to connect? (tried all) simple console with pgsql command works fine. I found a couple of "How tos" but nothing helped. Are there any potential version conflict? I'm on 2.3.16 with postgresql 16. Thanks! Richi Hi! The docs for dovecot with postgres are outdated and I somehow cannot connect from my dovecot instance to my postgresql database. I tried a lot but the debug output dosn't help me. What user is actually trying to connect to the postgresql? the dovecot user or root or the actual user from the connection config? I want to connect locally. Do I use password or md5 or peer with a map to connect? (tried all) simple console with pgsql command works fine. I found a couple of "How tos" but nothing helped. Are there any potential version conflict? I'm on 2.3.16 with postgresql 16. Thanks! Richi

3 4

[Dovecot] doveadm delete folders ?
by Robert Schetterer 19 Feb '24

19 Feb '24

Hi , is there a feature like doveadm expunge savedbefore ... for imap folder delete ? -- Best Regards MfG Robert Schetterer Germany/Munich/Bavaria

5 10

"Invalid uid in reply"
by J. B. Crawford 18 Feb '24

18 Feb '24

Hello, I am in the process of moving a previously working dovecot setup to a new authentication system. The identity management system, kanidm, uses a Pam module and NSS backend to provide user info. Authentication works normally on the machine, but Dovecot is having a lot of trouble, logging: Error: Invalid uid in reply Error: Invalid gid in reply I ran doveadm -D user jesse(a)waffle.tech as a test, and I see: Feb 17 21:58:33 doveadm(jesse(a)waffle.tech)<17666><>: Debug: auth-master: userdb lookup(jesse(a)waffle.tech): Started userdb lookup Feb 17 21:58:33 doveadm(jesse(a)waffle.tech)<17666><>: Debug: auth-master: conn unix:/run/dovecot/auth-userdb: Connecting Feb 17 21:58:33 doveadm(jesse(a)waffle.tech)<17666><>: Debug: auth-master: conn unix:/run/dovecot/auth-userdb (pid=17635,uid=0): Client connected (fd=9) Feb 17 21:58:33 doveadm(jesse(a)waffle.tech)<17666><>: Debug: auth-master: userdb lookup(jesse(a)waffle.tech): auth USER input: jesse system_groups_user=jesse uid=4123057063 gid=4123057063 home=/var/mail/jesse mail=maildir:/var/mail/jesse/Maildir Feb 17 21:58:33 doveadm(jesse(a)waffle.tech)<17666><>: Debug: auth-master: userdb lookup(jesse(a)waffle.tech): Finished userdb lookup (username=jesse system_groups_user=jesse uid=4123057063 gid=4123057063 home=/var/mail/jesse mail=maildir:/var/mail/jesse/Maildir) Feb 17 21:58:33 doveadm(jesse(a)waffle.tech)<17666><>: Error: Invalid uid in reply Feb 17 21:58:33 doveadm(jesse(a)waffle.tech)<17666><>: Error: Invalid gid in reply We can see the UID and GID in the debug output, but it comes out blank in the final info. I'm having a hard time finding what the cause could be, is it possible that these UID/GID values are too large? that's about the only thing I can think of right now. This is Dovecot 2.3.21 (47349e2482) on Fedora 39. Thanks, jc -- J. B. Crawford jesse(a)jbcrawford.us (575) 303-9001

2 2

long mail_location value formatting
by k v 17 Feb '24

17 Feb '24

Hello! The mail_location value with all the necessary keys can be quite long, for example: mail_location = mdbox:~/mdbox:VOLATILEDIR=/dev/shm/dovecot/volatile/%d/%n:LISTINDEX=/dev/shm/dovecot/listindex/%d/%n/dovecot.list.index:ALT=/var/dovecot-alt/%d/%n/mdbox When trying to split a value into multiple lines like: mail_location = \ mdbox:~/mdbox: \ VOLATILEDIR=/dev/shm/dovecot/volatile/%d/%n: \ LISTINDEX=/dev/shm/dovecot/listindex/%d/%n/dovecot.list.index: \ ALT=/var/dovecot-alt/%d/%n/mdbox according to the documentation https://doc.dovecot.org/configuration_manual/config_file/index.html#long-li…, each new line adds a whitespace, which breaks the value: doveadm config mail_location mail_location = mdbox:~/mdbox: VOLATILEDIR=/dev/shm/dovecot/volatile/%d/%n: LISTINDEX=/dev/shm/dovecot/listindex/%d/%n/dovecot.list.index: ALT=/var/dovecot-alt/%d/%n/mdbox doveadm mailbox list -u mail(a)example.com doveadm(mail(a)example.com): Error: Namespace '': Unknown setting: VOLATILEDIR Is it possible to split the value into multiple lines for better readability? Maybe add functionality to trim extra spaces when reading the mail_location value?

1 1

Doveadm on virtual users. Auth works but user don't
by jenawork＠iol.it 17 Feb '24

17 Feb '24

Hello All. I stumbled in a strange problem. I have some users stored in LDAP directory. They have uid in name.surname form and multiple mail attributes in the form of arbitraty(a)domain-n.it The Auth process works with virtual users on passdb (I can log with arbitraty(a)domain-1.it and arbitraty(a)domain-2.it) The usedb lookup works perfectly, and dovecot correctly creates the mailboxes in the form /home/domain/name.surname/arbitraty(a)domain-1.it/Maildir and /home/domain/name.surname/arbitraty(a)domain-2.it/Maildir The doveadm auth login arbitraty(a)domain-1.it command perfectly works, allowing the login to name.surname and the userdb lookup with the correct parameters. The doveadm user and the doveadm backup commands return "arbitraty(a)domain-1.it" not found I need it to migrate from an old cyrus imap to the new server Do someone have any idea? Thank you very much. (dovecot 2.3.19.1) Example: case 1: doveadm auth login "carlo.mor(a)sybill.it" Password: passdb: carlo.mor(a)sybill.it auth succeeded extra fields: user=carlo.mor original_user=carlo.mor(a)sybill.it userdb extra fields: carlo.mor uid=1001 gid=3001 home=/home/domain/carlo.mor/carlo.mor(a)sybill.it auth_mech=PLAIN auth_user=carlo.mor(a)sybill.it doveadm user "carlo.mor(a)sybill.it" userdb lookup: user carlo.mor(a)sybill.it doesn't exist field value

1 0

shared storage with local indexes?
by Andy Balholm 14 Feb '24

14 Feb '24

I'm trying to figure out how to have multiple Dovecot servers for high availability after replication goes away. The obvious solution would be some kind of shared storage, but the docs have all kinds of warnings about possible data corruption. It seems like Maildir is the safest mailbox format for shared storage, but even with Maildir there are warnings about the possibility of corrupting the index files. Would it make sense to use shared storage for the maildirs themselves, but use the INDEX option in mail_location to store index files locally, and have separate index files for each Dovecot server? That would take care of the potential for index corruption, but what other strange problems would it cause? Andy

2 1

Additional Kerberos (Samba) / GSSAPI auth for intranet users
by r.barclay＠habmalnefrage.de 14 Feb '24

14 Feb '24

Hi, I have a Dovecot (IMAP only) and Postfix (SMTP) based mail server. User names, mailbox settings and password hashes are loaded from a PostgreSQL database. The users use Thunderbird on the desktop and K9mail or Apple Mail on mobile phones. This works fine since a few years. Now I'd like to introduce Single Sign On with Thunderbird to ease up the deployment of clients systems. (No more manual mail password entry.) Users log in on a Samba AD domain, e.g.: johndoe(a)ad.example.internal. The mail addresses (and equally auth user names for Dovecot) are in the format: johndoe(a)example.org Up to now users have different passwords for AD and mail. These systems are not integrated. I have two related questions concerning that: First question: How can I map between these on the Dovecot side? There are no mailboxes or auth users like "johndoe(a)ad.example.internal". Instead, the public domain (e.g. example.org) is used for the mail system. Up to now the mail server doesn't know anything about the Samba domain and has nothing to do with that. Second question: Can I allow GSSAPI auth for intranet users only (e.g. 192.168.42.0/24)? My Internet router forwards the IMAP and SMTP ports to the mail server to allow the mobiles phones to connect to it. But it doesn't make sense to offer GSSAPI auth for Internet users from all over the world. Isn't that somewhat risky? All the M$ish AD stuff feels somewhat Mystery Meat like for me... Thank you very much for all input and help you can provide! Yours, Reg

2 1

Inconsistency in map index with dovecot v2.3.21
by John Alex. 14 Feb '24

14 Feb '24

Hi, since I upgraded dovecot to version 2.3.21 on a FreeBSD 13.2 system, I've been seeing a few occurences of the following warnings daily: Jan 11 13:13:25 dimokritos dovecot[33170]: lmtp(user1)<8209><SId/BlXNn2URIAAA+iYuTQ:T2>: Warning: mdbox /var/vmail/users/user1/mdbox/storage: Inconsistency in map index (5,40 != 5,56) Jan 11 13:13:25 dimokritos dovecot[33170]: lmtp(user1)<8209><SId/BlXNn2URIAAA+iYuTQ:T2>: Warning: fscking index file /var/vmail/users/user1/mdbox/storage/dovecot.map.index Jan 11 13:13:25 dimokritos dovecot[33170]: lmtp(user1)<8209><SId/BlXNn2URIAAA+iYuTQ:T2>: Warning: mdbox /var/vmail/users/user1/mdbox/storage: rebuilding indexes Jan 11 13:13:26 dimokritos dovecot[33170]: lmtp(user1)<8209><SId/BlXNn2URIAAA+iYuTQ:T2>: Warning: fscking index file /var/vmail/users/user1/mdbox/storage/dovecot.map.index The numbers in parentheses seem to always be of the format (x,40 != x,56) or (x,40 != x,72). I also get such errors on some users when purging (doveadm-purge fails with error 75): doveadm(user2): Warning: mdbox /var/vmail/users/user2/mdbox/storage: Inconsistency in map index (5,40 != 5,72) doveadm(user2): Warning: fscking index file /var/vmail/users/user2/mdbox/storage/dovecot.map.index doveadm(user2): Warning: mdbox /var/vmail/users/user2/mdbox/storage: rebuilding indexes doveadm(user2): Error: Purging namespace '' failed: BUG: Unknown internal error If I rerun doveadm purge for this user it completes successfully. Can anyone shed some light on what might be causing these messages? I didn't have these with 2.3.20. Should I be worried about data loss due to these index inconsistencies?

4 4

Enforcing quotas on shared mailboxes
by dovecot＠netrelay.it 12 Feb '24

12 Feb '24

I have configured a shared private namespace in dovecot so that, via ACLs, users can access other users' mailboxes. I set up a quota for each user and this also works well. The quota is monitored and new messages are denied if the quota is exceeded. There is one problem though: apparently dovecot treats shared mailboxes in relation to the current user's quota, it does not consider (as would be appropriate) the shared mailbox owner's quota. I will try to explain better with a couple of examples. ============== Consider the following case: user1 has a quota of 1MB, totally available user2 has a quota of 10MB, totally available user1 shares the "Sales" mailbox with user2 user2 copies a 500KB message to the shared "Sales" mailbox user1's quota will be correctly deducted by 500KB, thus resulting in 0.5MB available At this point, however, let's try another operation: user2 copies an 800KB message to the shared "Sales" mailbox. The server should return error because this way user1 exceeds the allocated quota of 1MB (500KB + 800KB), but instead the copy operation succeeds. This happens because at the time of the copy operation, dovecot considers the quota limit of user2 instead of considering the quota limit of user1. ============== Let us consider another case, performing the same operations but where the user quota limits are reversed (user1 has a larger quota than user2): user1 has a quota of 10MB, totally available user2 has a quota of 1MB, totally available user1 shares the "Sales" mailbox with user2 user2 copies a 500KB message to the shared mailbox "Sales" The operation fails by overquota, because again dovecot considers user2's quota limit instead of considering user1's quota limit. Therefore, it is as if user2, with a 1MB limit, tries to write to a "larger" area (10MB). As a counterevidence, setting user1 and user2 with the same quota limit, the operation succeeds perfectly. ============== Can anyone help me solve the problem? Is this a problem that is related to my configuration? Below I attach the output of dovecot -n =============== # 2.3.19.1 (9b53102964): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.19 (4eae2f79) # OS: Linux 6.1.0-16-cloud-arm64 aarch64 Debian 12.4 auth_master_user_separator = * auth_mechanisms = PLAIN LOGIN default_client_limit = 7168 default_process_limit = 1024 deliver_log_format = from=%{from}, envelope_sender=%{from_envelope}, subject=%{subject}, msgid=%m, size=%{size}, delivery_time=%{delivery_time}ms, %$ dict { acl = mysql:/etc/dovecot/dovecot-dict-acl-sql.conf.ext } first_valid_uid = 2000 last_valid_uid = 2000 listen = * [::] login_log_format_elements = user=<%u> method=%m rip=%r lip=%l mpid=%e %c %k session=<%{session}> mail_gid = 2000 mail_location = maildir:%Lh:INDEX=%Lh mail_plugins = quota mailbox_alias acl mail_log notify mail_uid = 2000 managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext editheader metric { filter = event=imap_command_finished metric_name = imap_command } namespace { inbox = yes location = mailbox { auto = no special_use = \Archive name = Archive } mailbox { auto = no special_use = \Archive name = Archives } mailbox { auto = no special_use = \Trash name = Deleted Messages } mailbox { auto = subscribe special_use = \Drafts name = Drafts } mailbox { auto = subscribe special_use = \Junk name = Junk } mailbox { auto = no special_use = \Junk name = Junk E-mail } mailbox { auto = subscribe special_use = \Sent name = Sent } mailbox { auto = no special_use = \Sent name = Sent Items } mailbox { auto = no special_use = \Sent name = Sent Messages } mailbox { auto = no special_use = \Junk name = Spam } mailbox { auto = subscribe special_use = \Trash name = Trash } prefix = separator = / type = private name = } namespace { list = children location = maildir:%%Lh:INDEXPVT=%%Lh/Shared/%{auth_user} prefix = Shared/%%u/ separator = / subscriptions = yes type = shared name = } passdb { args = /etc/dovecot/dovecot-sql.conf.ext driver = sql } passdb { args = /etc/dovecot/master-users driver = passwd-file master = yes result_success = continue } plugin { acl = vfile:/etc/dovecot/dovecot-acl acl_shared_dict = proxy::acl mail_log_events = delete undelete expunge copy mailbox_create mailbox_delete mailbox_rename mail_log_fields = uid box msgid size from subject flags quota = maildir:User quota quota_rule = *:storage=1G quota_rule2 = Trash:storage=+100M quota_status_nouser = DUNNO quota_status_overquota = 552 5.2.2 Mailbox is full quota_status_success = DUNNO quota_warning = storage=95%% quota-warning 95 %u quota_warning2 = storage=80%% quota-warning 80 %u sieve = file:/home/vmail/%d/sieve/%n/;active=/home/vmail/%d/sieve/%n/.dovecot.sieve sieve_before = /home/vmail/sieve/sievebefore1 sieve_editheader_forbid_add = X-Verified sieve_editheader_forbid_delete = X-Verified X-Seen sieve_editheader_max_header_size = 1k sieve_extensions = +editheader sieve_global_dir = /home/vmail/sieve sieve_max_redirects = 30 sieve_vacation_default_period = 1d sieve_vacation_min_period = 0 sieve_vacation_send_from_recipient = yes } protocols = pop3 imap sieve lmtp service replication-notify-fifo { name = aggregator } service anvil-auth-penalty { name = anvil } service auth-worker { name = auth-worker } service { unix_listener { group = postfix mode = 0666 user = postfix path = /var/spool/postfix/private/auth } unix_listener { group = vmail mode = 0660 user = vmail path = auth-userdb } name = auth } service config { name = config } service dict-async { name = dict-async } service { unix_listener { group = vmail mode = 0660 user = vmail path = dict } name = dict } service login/proxy-notify { name = director } service dns-client { name = dns-client } service doveadm-server { name = doveadm } service imap-hibernate { name = imap-hibernate } service imap { process_min_avail = 8 service_count = 0 vsz_limit = 1 G name = imap-login } service imap-urlauth { name = imap-urlauth-login } service imap-urlauth-worker { name = imap-urlauth-worker } service token-login/imap-urlauth { name = imap-urlauth } service { process_limit = 2048 name = imap } service indexer-worker { name = indexer-worker } service indexer { name = indexer } service ipc { name = ipc } service { unix_listener { group = postfix mode = 0666 user = postfix path = /var/spool/postfix/private/dovecot-lmtp } name = lmtp } service log-errors { name = log } service { inet_listener { port = 4190 name = sieve } name = managesieve-login } service login/sieve { name = managesieve } service old-stats-mail { name = old-stats } service pop3 { service_count = 0 name = pop3-login } service login/pop3 { name = pop3 } service { executable = script /opt/scripts/dovecot/quota-warning.sh unix_listener { group = vmail mode = 0660 user = vmail path = quota-warning } name = quota-warning } service replicator-doveadm { name = replicator } service login/stats-writer { unix_listener { group = vmail mode = 0660 user = vmail path = stats-reader } unix_listener { group = vmail mode = 0660 user = vmail path = stats-writer } name = stats } service submission { name = submission-login } service login/submission { name = submission } ssl = required ssl_cert = </etc/letsencrypt/live/mydomain.com/fullchain.pem ssl_cipher_list = EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH ssl_dh = # hidden, use -P to show it ssl_key = # hidden, use -P to show it ssl_prefer_server_ciphers = yes userdb { args = /etc/dovecot/dovecot-sql.conf.ext driver = sql } protocol lda { lda_mailbox_autocreate = yes lda_mailbox_autosubscribe = yes mail_plugins = quota mailbox_alias acl mail_log notify sieve service replication-notify-fifo { name = aggregator } service anvil-auth-penalty { name = anvil } service auth-worker { name = auth-worker } service auth-client { name = auth } service config { name = config } service dict-async { name = dict-async } service dict { name = dict } service login/proxy-notify { name = director } service dns-client { name = dns-client } service doveadm-server { name = doveadm } service imap-hibernate { name = imap-hibernate } service imap { name = imap-login } service imap-urlauth { name = imap-urlauth-login } service imap-urlauth-worker { name = imap-urlauth-worker } service token-login/imap-urlauth { name = imap-urlauth } service imap-master { name = imap } service indexer-worker { name = indexer-worker } service indexer { name = indexer } service ipc { name = ipc } service lmtp { name = lmtp } service log-errors { name = log } service sieve { name = managesieve-login } service login/sieve { name = managesieve } service old-stats-mail { name = old-stats } service pop3 { name = pop3-login } service login/pop3 { name = pop3 } service replicator-doveadm { name = replicator } service login/stats-writer { name = stats } service submission { name = submission-login } service login/submission { name = submission } } protocol lmtp { mail_plugins = quota mailbox_alias acl mail_log notify sieve postmaster_address = postmaster(a)mydomain.com recipient_delimiter = + service replication-notify-fifo { name = aggregator } service anvil-auth-penalty { name = anvil } service auth-worker { name = auth-worker } service auth-client { name = auth } service config { name = config } service dict-async { name = dict-async } service dict { name = dict } service login/proxy-notify { name = director } service dns-client { name = dns-client } service doveadm-server { name = doveadm } service imap-hibernate { name = imap-hibernate } service imap { name = imap-login } service imap-urlauth { name = imap-urlauth-login } service imap-urlauth-worker { name = imap-urlauth-worker } service token-login/imap-urlauth { name = imap-urlauth } service imap-master { name = imap } service indexer-worker { name = indexer-worker } service indexer { name = indexer } service ipc { name = ipc } service lmtp { name = lmtp } service log-errors { name = log } service sieve { name = managesieve-login } service login/sieve { name = managesieve } service old-stats-mail { name = old-stats } service pop3 { name = pop3-login } service login/pop3 { name = pop3 } service replicator-doveadm { name = replicator } service login/stats-writer { name = stats } service submission { name = submission-login } service login/submission { name = submission } } protocol imap { imap_client_workarounds = tb-extra-mailbox-sep mail_max_userip_connections = 256 mail_plugins = quota mailbox_alias acl mail_log notify imap_quota imap_acl service replication-notify-fifo { name = aggregator } service anvil-auth-penalty { name = anvil } service auth-worker { name = auth-worker } service auth-client { name = auth } service config { name = config } service dict-async { name = dict-async } service dict { name = dict } service login/proxy-notify { name = director } service dns-client { name = dns-client } service doveadm-server { name = doveadm } service imap-hibernate { name = imap-hibernate } service imap { name = imap-login } service imap-urlauth { name = imap-urlauth-login } service imap-urlauth-worker { name = imap-urlauth-worker } service token-login/imap-urlauth { name = imap-urlauth } service imap-master { name = imap } service indexer-worker { name = indexer-worker } service indexer { name = indexer } service ipc { name = ipc } service lmtp { name = lmtp } service log-errors { name = log } service sieve { name = managesieve-login } service login/sieve { name = managesieve } service old-stats-mail { name = old-stats } service pop3 { name = pop3-login } service login/pop3 { name = pop3 } service replicator-doveadm { name = replicator } service login/stats-writer { name = stats } service submission { name = submission-login } service login/submission { name = submission } } protocol pop3 { mail_max_userip_connections = 30 mail_plugins = quota mailbox_alias acl mail_log notify pop3_client_workarounds = outlook-no-nuls oe-ns-eoh pop3_uidl_format = %08Xu%08Xv service replication-notify-fifo { name = aggregator } service anvil-auth-penalty { name = anvil } service auth-worker { name = auth-worker } service auth-client { name = auth } service config { name = config } service dict-async { name = dict-async } service dict { name = dict } service login/proxy-notify { name = director } service dns-client { name = dns-client } service doveadm-server { name = doveadm } service imap-hibernate { name = imap-hibernate } service imap { name = imap-login } service imap-urlauth { name = imap-urlauth-login } service imap-urlauth-worker { name = imap-urlauth-worker } service token-login/imap-urlauth { name = imap-urlauth } service imap-master { name = imap } service indexer-worker { name = indexer-worker } service indexer { name = indexer } service ipc { name = ipc } service lmtp { name = lmtp } service log-errors { name = log } service sieve { name = managesieve-login } service login/sieve { name = managesieve } service old-stats-mail { name = old-stats } service pop3 { name = pop3-login } service login/pop3 { name = pop3 } service replicator-doveadm { name = replicator } service login/stats-writer { name = stats } service submission { name = submission-login } service login/submission { name = submission } }

3 2

SQL Authentication when the password contains spaces
by Yassine Chaouche 12 Feb '24

12 Feb '24

Dear list, I created a dovecot mysql user with a password containing spaces. When I try to run doveadm fetch (to test the sql authentication), I get the following error message in the logs: Feb 11 17:37:32 auth: Fatal: sqlpool: Missing value in connect string: xxx the connect line was: connect = "host=localhost dbname=mail user=dovecot password=xxx xxx xxx" The following code source taken from dovecot's github repo[1], suggests that the parsing relies on spaces as field separators. static int driver_mysql_parse_connect_string(struct mysql_db *db, const char *connect_string, const char **error_r) { const char *const *args, *name, *value; const char **field; db->ssl_cipher = "HIGH"; db->ssl_verify_server_cert = 1; db->connect_timeout = SQL_CONNECT_TIMEOUT_SECS; db->read_timeout = MYSQL_DEFAULT_READ_TIMEOUT_SECS; db->write_timeout = MYSQL_DEFAULT_WRITE_TIMEOUT_SECS; args = t_strsplit_spaces(connect_string, " "); for (; *args != NULL; args++) { value = strchr(*args, '='); if (value == NULL) { *error_r = t_strdup_printf("Missing value in connect string: %s", *args); return -1; } [...] How do I supply the connection string in a suitable way? References: [1] dovecot source code on github https://github.com/dovecot/core/blob/main/src/lib-sql/driver-mysql.c#L194 Troubleshooting info: Dovecot v2.3.19.1 (9b53102964) starting up for imap, lmtp, pop3 (core dumps disabled) on Debian 12 -- yassine -- sysadm +213-779 06 06 23 http://about.me/ychaouche Looking for side gigs.

2 2

doveadm fetch complains as Message was expunged
by Kirill A. Korinsky 11 Feb '24

11 Feb '24

Greeetings, I do have a cron script which runs doveadm NOT mailbox Junk SEEN SINCE 30d Everything works well with one exception, if user removes email when it's running, it may lead to an email from cron like: doveadm(...): Error: fetch(hdr) failed for box=virtual.All uid=145266: Message was expunged (for backend mailbox INBOX) I feel that it is a bug, isn't it? -- wbr, Kirill

2 1

IRC/Matrix
by Duje 10 Feb '24

10 Feb '24

Hi there! Do you have an IRC or Matrix channel, would you consider opening one for more direct response or questions one has using dovecot? - Duje Hi there! Do you have an IRC or Matrix channel, would you consider opening one for more direct response or questions one has using dovecot? - Duje

3 2

Dovecot trusted CAs
by Felix Auringer 09 Feb '24

09 Feb '24

Hello, for our testing environment, I would like to configure a CA that is trusted by Dovecot when making TLS connections. As you can see below in the config snippets, this is for example used when proxying to itself during a login with credentials for the OIDC provider. The Dovecot documentation (https://doc.dovecot.org/configuration_manual/authentication/proxies/) states: "ssl_client_ca_dir or ssl_client_ca_file aren’t currently used for verifying the remote certificate, although ideally they will be in a future Dovecot version. For now you need to add the trusted remote certificates to ssl_ca." Configuring a trusted CA via the `ssl_ca` config option works but is a little bit weird as this option originally is for TLS client authentication. I added the CA certificate to the system trust store and removed `ssl_ca` and `ssl_client_ca_file`, but it seems that Dovecot does not use the system store. Or is there any config option I am missing? Otherwise, are there any plans when `ssl_client_ca_file` will be used for remote connections (the documentation mentions that this would ideally be fixed in a later version)? And could I then use the aggregated Debian system trust store (/etc/ssl/certs/ca-certificates.crt) there? Best regards, Felix `dovecot -n` (shortened): # 2.3.19 (b3ad6004dc): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.19 (4eae2f79) # OS: Linux 6.7.3-arch1-1 x86_64 Debian 11.8 passdb { args = /etc/dovecot/oauth2-token.conf.ext driver = oauth2 mechanisms = xoauth2 oauthbearer } passdb { args = /etc/dovecot/oauth2-password.conf.ext driver = oauth2 mechanisms = plain login } protocols = imap lmtp service imap-login { inet_listener imap { port = 0 } inet_listener imaps { port = 993 ssl = yes } } service lmtp { inet_listener { port = 24 ssl = no } } ssl = required ssl_min_protocol = TLSv1.3 ssl_prefer_server_ciphers = yes protocol lmtp { ssl_cert = </etc/dovecot/tls/lmtp-certificate-chain.pem ssl_key = # hidden, use -P to show it } protocol imap { ssl_cert = </etc/dovecot/tls/imap-certificate-chain.pem ssl_key = # hidden, use -P to show it } `oauth2-password.conf.ext`: client_id = ${DOVECOT_OIDC_CLIENT_ID} client_secret = ${DOVECOT_OIDC_CLIENT_SECRET} introspection_mode = local force_introspection = yes username_attribute = preferred_username username_format = %Lu use_grant_password = yes grant_url = ${OIDC_TOKEN_URL} scope = ${DOVECOT_OIDC_SCOPE} issuers = ${OIDC_ISSUER_URL} pass_attrs = host=dovecot port=993 ssl=yes proxy=y proxy_mech=xoauth2 pass=%{oauth2:access_token} user=%{oauth2:sub} local_validation_key_dict = fs:posix:prefix=/etc/dovecot/keys/ tls_ca_cert_file = /etc/ssl/certs/ca-certificates.crt debug = no --- Gesellschaft für interkulturelles Zusammenleben gGmbH (GIZ) Felix Auringer IT Reformationsplatz 2 13597 Berlin Tel: 030/513 0100 00; Fax: 030/513 0100 09 www.giz.berlin; felix.auringer(a)giz.berlin Amtsgericht Charlottenburg HRB 200872 B Geschäftsführerin: Dr. Britta Marschke

1 0

doveadm-backup and quota question
by Thomas Plant 09 Feb '24

09 Feb '24

Hello, I executed a backup on my dovecot installation and saw that after the first backup, the used space in quota doubled. After executing a recalc all went to normal. For this small size mailbox it is not a problem, but I did a backup on a bigger mailbox, and it started to reject messages because of 'over quota'. Here is an example: # doveadm quota get -u info(a)domain.abc Quota name Type Value Limit % User quota STORAGE 16798 16777216 0 User quota MESSAGE 628 - 0 Domain quota STORAGE 32282 67108864 0 Domain quota MESSAGE 645 - 0 [root@vmi792826 ~]# doveadm backup -u info(a)domain.abc mdbox:/tmp/backup/info@plant-systems [root@vmi792826 ~]# doveadm quota get -u info(a)domain.abc Quota name Type Value Limit % User quota STORAGE 33596 16777216 0 User quota MESSAGE 1256 - 0 Domain quota STORAGE 64563 67108864 0 Domain quota MESSAGE 1290 - 0 [root@vmi792826 ~]# doveadm quota recalc -u info(a)domain.abc [root@vmi792826 ~]# doveadm quota get -u info(a)domain.abc Quota name Type Value Limit % User quota STORAGE 16798 16777216 0 User quota MESSAGE 628 - 0 Domain quota STORAGE 32282 67108864 0 Domain quota MESSAGE 645 - 0 Is it normal to have to issue a recalc after backup, or can it be some misconfiguration on my side? Hello, I executed a backup on my dovecot installation and saw that after the first backup, the used space in quota doubled. After executing a recalc all went to normal. For this small size mailbox it is not a problem, but I did a backup on a bigger mailbox, and it started to reject messages because of 'over quota'. Here is an example: # doveadm quota get -u info(a)domain.abc Quota name Type Value Limit % User quota STORAGE 16798 16777216 0 User quota MESSAGE 628 - 0 Domain quota STORAGE 32282 67108864 0 Domain quota MESSAGE 645 - 0 [root@vmi792826 ~]# doveadm backup -u info(a)domain.abc mdbox:/tmp/backup/ info@plant-systems [root@vmi792826 ~]# doveadm quota get -u info(a)domain.abc Quota name Type Value Limit % User quota STORAGE 33596 16777216 0 User quota MESSAGE 1256 - 0 Domain quota STORAGE 64563 67108864 0 Domain quota MESSAGE 1290 - 0 [root@vmi792826 ~]# doveadm quota recalc -u info(a)domain.abc [root@vmi792826 ~]# doveadm quota get -u info(a)domain.abc Quota name Type Value Limit % User quota STORAGE 16798 16777216 0 User quota MESSAGE 628 - 0 Domain quota STORAGE 32282 67108864 0 Domain quota MESSAGE 645 - 0 Is it normal to have to issue a recalc after backup, or can it be some misconfiguration on my side?

1 0

Re: Auth USER lookup failed
by Michael Slusarz 08 Feb '24

08 Feb '24

> On 02/05/2024 10:17 PM MST thecoudge(a)gmail.com wrote: > > I have dovecot working with PAM and Samba DC authentication for IMAP. However when I'm attempting to pass emails from postfix via LMTP > I don't actually need to authenticate LMTP I'm happy to check for valid users upstream. > > I'm getting the error: > Feb 06 15:11:39 Debian-server postfix/local[178200]: ADF0E78713C: passing <dom.username(a)Debian-server.sr.local> to transport=lmtp > Feb 06 15:11:39 Debian-server dovecot[178075]: auth: Error: static(dom.username): passdb doesn't support lookups, can't verify user's existence > Feb 06 15:11:39 Debian-server dovecot[178075]: lmtp(dom.username(a)Debian-server.sr.local)<178233><GJ/9Nou/wWU5uAIAiShiCA:T2>: Error: auth-master: userdb lookup(dom.username(a)Debian-server.sr.local): Auth USER lookup failed You need to define a userdb to return user information. Since LMTP doesn't require auth, it can't use the passdb so that's what the error message is saying. michael

3 2

Permission problem when using sieve script
by tacodewolff＠gmail.com 07 Feb '24

07 Feb '24

Hi, I've been banging my head on this problem for a while now and need some help on this issue. I've set up Dovecot with Sieve scripts, which use bash scripts to either learn ham or learn spam. This is sent to the Rspamd controller (using a Unix socket at /var/run/rspamd/rspamd-controller.sock). The socket has permissions 660 and is owned by _rspamd:_rspamd. It's directory and parent directory have 755. The sieve script looks like: exec /usr/bin/rspamc -h /var/run/rspamd/rspamd-controller.sock -P 'password' learn_ham I've added the dovecot user to the _rspamd group, but I consistently get "Permission denied" when marking emails as ham/spam. Only when I make the socket permission 666 it works correctly. Also when the permission is 660 but ownership is _rspamd:dovecot it works as well. I don't want the former as anyone could connect, and the latter can't be set automatically in Rspamd. I'm pulling my hairs out. I've tried to figure out the user and group that dovecot uses to run the sieve script (creatively by 'exit'ing the bash script with the uid or gid as error code), and they are both 97 (i.e. dovecot uid and gid). I've tried personally logging in as dovecot using 'sudo -u dovecot bash' and then using 'socat' to connect to the socket. This works fine. But through the dovecot sieve script for some reason it's not working. I've tried disabling SELinux and fapolicyd, but no luck. Is Dovecot using some restricted permissions when running sieve scripts? # dovecot --version 2.3.16 (7e2e900c1a) Thank you, Taco

1 1

Auth USER lookup failed
by thecoudge＠gmail.com 06 Feb '24

06 Feb '24

I have dovecot working with PAM and Samba DC authentication for IMAP. However when I'm attempting to pass emails from postfix via LMTP I don't actually need to authenticate LMTP I'm happy to check for valid users upstream. I'm getting the error: Feb 06 15:11:39 Debian-server postfix/local[178200]: ADF0E78713C: passing <dom.username(a)Debian-server.sr.local> to transport=lmtp Feb 06 15:11:39 Debian-server dovecot[178075]: auth: Error: static(dom.username): passdb doesn't support lookups, can't verify user's existence Feb 06 15:11:39 Debian-server dovecot[178075]: lmtp(dom.username(a)Debian-server.sr.local)<178233><GJ/9Nou/wWU5uAIAiShiCA:T2>: Error: auth-master: userdb lookup(dom.username(a)Debian-server.sr.local): Auth USER lookup failed Feb 06 15:11:39 Debian-server dovecot[178075]: lmtp(178233): Error: lmtp-server: conn unix:pid=178201,uid=111 [4]: rcpt dom.username(a)Debian-server.sr.local: Failed to lookup user dom.usernamey(a)Debian-server.sr.local: Internal error occurred. Refer to server log for more information. Doveconf -n: auth_username_format = %Ln disable_plaintext_auth = no mail_gid = vmail mail_location = maildir:/var/mail/virtual/%d/%n mail_privileged_group = mail mail_uid = vmail namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } passdb { args = mail driver = pam } plugin { sieve = file:~/sieve;active=~/.dovecot.sieve } protocols = " imap lmtp lmtp" service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0666 user = postfix } } service lmtp { unix_listener /var/spool/postfix/private/dovecot-lmtp { group = postfix mode = 0600 user = postfix } } ssl_cert = </etc/dovecot/private/dovecot.pem ssl_client_ca_dir = /etc/ssl/certs ssl_dh = # hidden, use -P to show it ssl_key = # hidden, use -P to show it protocol lmtp { passdb { args = allow_all_users=yes driver = pam name = } }

2 1

possible wrong sql syntax ?
by Maurizio Caloro 06 Feb '24

06 Feb '24

hi i dont know exactly what succeeded but me alias don't run any more :-/ i know i used to be able to send mail via aliases from mae to markus(a)domain.com The names have of course been changed, simply for reasons of data protection. frendly asking i need little help, i think i have syntax mistake on mysql syntax call please why auth-worker don't find the alias mae, and send back "unknown user" ? emails send to markus(a)domain.com and also other mail adresses will run without problems. only the function alias no longer wants to. Feb 05 Time Dovecot/lmtp(279699): Info: Connect from local Feb 05 Time Dovecot/auth-worker(279700): Info: conn unix:auth-worker (pid=279685,uid=113): auth-worker<5>: sql(mae(a)domain.com): unknown user Feb 05 Time Dovecot/lmtp(279699): Info: Disconnect from local: Client has quit the connection (state=READY) dovecot.conf [snip] passdb { args = /etc/dovecot/dovecot-sql.conf driver = sql } userdb { args = /etc/dovecot/dovecot-sql.conf driver = sql } cat auth-sql.conf.ext [snip] passdb { driver = mysql args = /etc/dovecot/dovecot-sql.conf } userdb { driver = mysql args = /etc/dovecot/dovecot-sql.conf } # cat dovecot-sql.conf driver = mysql connect = host=localhost dbname=mailserver user=username password= default_pass_scheme = CRYPT user_query = SELECT '/srv/vmail/%d/%n' AS home, '10000' AS uid, '10000' AS gid, CONCAT('*:storage=', (quota*1024)) as quota_rule FROM mailbox WHERE username='%u' AND active = 1 password_query = SELECT username AS user, password, '/srv/vmail/%d/%n' AS userdb_home, '10000' AS userdb_uid, '10000' AS userdb_gid, CONCAT('maildir:storage=', (quota*1024)) as userdb_quota FROM mailbox WHERE username='%u' AND active = 1 yes this exist as mailbox # dovecot user markus(a)domain.com field value uid 10000 gid 10000 home /srv/vmail/domain.com/markus mail maildir:~/Maildir quota_rule *:storage=0 yes the mae are only a alias, so i think this are right!? # dovecot user mae(a)domain.com userdb lookup: user mae(a)domain.com doesn't exist field value MariaDB [mailserver]> SELECT * FROM mailbox; +------------------ +----------+--------+---------------------+------------+------------+---------+ | username | password | name | maildir | local_part | domain | active | +-------------------+----------+--------+---------------------+------------+------------+---------+ | markus(a)domain.com | ******** | markus | domain.com/markus/ | Markus M | domain.com | 1 | MariaDB [mailserver]> SELECT * FROM alias; +-----------------+--------------------+------------+--------+ | address | goto | domain | active | +-----------------+---------------------------------+--------+ | mae(a)domain.com | markus(a)domain.com | domain.com | 1 | +-----------------+---------------------------------+--------+ 34 rows in set (0.001 sec) dovecot --version 2.3.13 (89f716dc2) postconf mail_version 3.5.23 mysql Ver 15.1 Distrib 10.5.21-MariaDB debian 11 bullseye

1 0

Sieve question: Rewriting from using variables (ccsend issues)
by Ian Evans 06 Feb '24

06 Feb '24

As a journalist, I deal with a lot of PR companies that use constant contact. For years, I've built up a nice sieve filter that sports these people into my PR folder. I guess to help with dkim/SPF issues, Constant Contact has started rewriting the from header to the sender's address rewritten to end with a ccsend domain. The sender's actual email address is now in the reply-to header. This has resulted in all my PR emails ending up in the main inbox. Rather than rewrite hundreds of rules, I asked (foolishly?) ChatGPT if there was a way to check for ccsend in the from and then use the reply-to as the from. This is what it came up with and this would be the first rule in the sieve file: #Many PR companies use ccsend for lists. Check if headers contain "ccsend" and #then use reply-to for rules if allof (header :contains "from" "ccsend") { # Set "Reply-To" as "From" address set "from" "${reply-to}"; } Before I put this into production, will this work? Do the rest of the rules go inside the last curly bracket or after it? Thanks for any advice. As a journalist, I deal with a lot of PR companies that use constant contact. For years, I've built up a nice sieve filter that sports these people into my PR folder. I guess to help with dkim/SPF issues, Constant Contact has started rewriting the from header to the sender's address rewritten to end with a ccsend domain. The sender's actual email address is now in the reply-to header. This has resulted in all my PR emails ending up in the main inbox. Rather than rewrite hundreds of rules, I asked (foolishly?) ChatGPT if there was a way to check for ccsend in the from and then use the reply-to as the from. This is what it came up with and this would be the first rule in the sieve file: #Many PR companies use ccsend for lists. Check if headers contain "ccsend" and #then use reply-to for rules if allof (header :contains "from" "ccsend") { # Set "Reply-To" as "From" address set "from" "${reply-to}"; } Before I put this into production, will this work? Do the rest of the rules go inside the last curly bracket or after it? Thanks for any advice.

1 0

submission_add_received_header option?
by Ellie McNeill 05 Feb '24

05 Feb '24

Hi, I've recently upgraded my mail server from Debian 11 to Debian 12. It now runs dovecot 2.3.19.1 (verified with dovecot --version). According to the "Dovecot Core Settings" page, a new setting 'submission_add_received_header' was added in dovecot 2.3.19 to give admins the option of hiding the IP of the sending client when using dovecot's submissiond: https://doc.dovecot.org/3.0/settings/core/ However, when I place this option in my config, dovecot refuses to start and says that the option is not recognised: doveconf: Fatal: Error in configuration file /etc/dovecot/conf.d/20-submission.conf line 92: Unknown setting: submission_add_received_header Can anyone help me with this? Ellie

5 5

Recommended changes for delivery from Exim
by jgh＠exim.org 05 Feb '24

05 Feb '24

Hi, Security changes to Exim have invalidated certain suggested configurations in the Dovecot wiki. As I do not have a Dovecot installation to test, I am not going to write any updates there. It would be good if someone would test these suggestions and then make updates as needed. 1) The use of $local_part and $domain in commands run by the "pipe" transport will be disallowed in the upcoming Exim release. These are currently noted as optional, with the "-m" flag to dovecot-lda. They should be replaced with validated (untainted) versions, commonly $local_part_data and $domain_data, developed via one of the several de-taint methods documented for Exim. The same applies to $original_local_part and $original_domain. 2) The use of $sender_address will likewise be disallowed. This and the "-f" flag can be dropped from the dovecot-lda command line, and the specification of a null "message_prefix" option removed. The defaults for a pipe transport will then prefix the message with a suitable Mbox "From " header line, which dovecot-lda is documented to extract the sender from. Both of these suggestions are back-compatible to the current 4.95 release of Exim, and will be required with the 4.96 release. -- Cheers, Jeremy Refs: - https://wiki.dovecot.org/LDA/Exim - https://doc.dovecot.org/configuration_manual/protocols/lda/

3 3

Problem with share mailbox
by Frédéric FONDRIEST 05 Feb '24

05 Feb '24

Hi all, we get some problems with sharing mailbox between users. when we share something the dovecot-acl file is updated, but the shared-mailboxes.db file is not created nor updated. Even if we create the file and set permission to 777... strangely the debug log gives : 2024-02-05 09:29:04 imap(xxxxxx)<13741><SA8qQZ4QBIsKDMcL>: Debug: dict(file): dict created (uri=file:/tmp/shared-mailboxes.db, base_dir=/var/run/dovecot) 2024-02-05 09:29:04 imap(xxxxxx)<13741><SA8qQZ4QBIsKDMcL>: Debug: open(/proc/self/io) failed: Permission denied we don't understand why we get this kind of message. we search on this mailing list without any clean explaination. we expect a bug somewhere.. any ideas ? system is : debian 12 dovecot 2.3.19.1 (9b53102964) # 2.3.19.1 (9b53102964): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.19 (4eae2f79) # OS: Linux 6.1.0-17-amd64 x86_64 Debian 12.4 auth_master_user_separator = * auth_mechanisms = plain login auth_username_format = %n base_dir = /var/run/dovecot log_path = /var/log/dovecot.log log_timestamp = "%Y-%m-%d %H:%M:%S " mail_debug = yes mail_gid = 5000 mail_home = /home/vmail/%u mail_location = /home/vmail/%u/Maildir mail_plugins = acl mail_log acl mail_log mail_privileged_group = mail mail_uid = 5000 namespace { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = separator = / type = private } namespace { list = children location = maildir:%%h/Maildir:INDEX=~/Maildir/shared/%%u:INDEXPVT=~/Maildir/shared/%%u prefix = shared/%%u/ separator = / subscriptions = no type = shared } passdb { args = /etc/dovecot/master-users driver = passwd-file master = yes } passdb { args = /etc/dovecot/dovecot-ldap-passdb.conf driver = ldap name = ldap } plugin { acl = vfile acl_shared_dict = file:/tmp/shared-mailboxes.db acl_user = %u master_user = %u } protocols = imap lmtp service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0660 user = postfix } } service lmtp { inet_listener lmtp { address = * port = 24 } user = vmail } ssl_cert = </etc/ssl/mail.crt ssl_key = # hidden, use -P to show it userdb { args = /etc/dovecot/dovecot-ldap-userdb.conf driver = ldap name = ldap } protocol imap { imap_client_workarounds = delay-newmail imap_max_line_length = 64 k mail_max_userip_connections = 20 mail_plugins = acl imap_acl } protocol lda { info_log_path = log_path = mail_plugins = mail_log postmaster_address = postmaster@xxx quota_full_tempfail = yes syslog_facility = mail } protocol lmtp { info_log_path = log_path = mail_plugins = mail_log postmaster_address = postmaster@xxx quota_full_tempfail = yes } Hi all, we get some problems with sharing mailbox between users. when we share something the dovecot-acl file is updated, but the shared- mailboxes.db file is not created nor updated. Even if we create the file and set permission to 777... strangely the debug log gives : 2024-02-05 09:29:04 imap(xxxxxx)<13741><SA8qQZ4QBIsKDMcL>: Debug: dict(file): dict created (uri=file:/tmp/shared-mailboxes.db, base_dir=/var/run/dovecot) 2024-02-05 09:29:04 imap(xxxxxx)<13741><SA8qQZ4QBIsKDMcL>: Debug: open(/proc/ self/io) failed: Permission denied we don't understand why we get this kind of message. we search on this mailing list without any clean explaination. we expect a bug somewhere.. any ideas ? system is : debian 12 dovecot 2.3.19.1 (9b53102964) # 2.3.19.1 (9b53102964): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.19 (4eae2f79) # OS: Linux 6.1.0-17-amd64 x86_64 Debian 12.4 auth_master_user_separator = * auth_mechanisms = plain login auth_username_format = %n base_dir = /var/run/dovecot log_path = /var/log/dovecot.log log_timestamp = "%Y-%m-%d %H:%M:%S " mail_debug = yes mail_gid = 5000 mail_home = /home/vmail/%u mail_location = /home/vmail/%u/Maildir mail_plugins = acl mail_log acl mail_log mail_privileged_group = mail mail_uid = 5000 namespace { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = separator = / type = private } namespace { list = children location = maildir:%%h/Maildir:INDEX=~/Maildir/shared/%%u:INDEXPVT=~/Maildir/ shared/%%u prefix = shared/%%u/ separator = / subscriptions = no type = shared } passdb { args = /etc/dovecot/master-users driver = passwd-file master = yes } passdb { args = /etc/dovecot/dovecot-ldap-passdb.conf driver = ldap name = ldap } plugin { acl = vfile acl_shared_dict = file:/tmp/shared-mailboxes.db acl_user = %u master_user = %u } protocols = imap lmtp service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0660 user = postfix } } service lmtp { inet_listener lmtp { address = * port = 24 } user = vmail } ssl_cert = </etc/ssl/mail.crt ssl_key = # hidden, use -P to show it userdb { args = /etc/dovecot/dovecot-ldap-userdb.conf driver = ldap name = ldap } protocol imap { imap_client_workarounds = delay-newmail imap_max_line_length = 64 k mail_max_userip_connections = 20 mail_plugins = acl imap_acl } protocol lda { info_log_path = log_path = mail_plugins = mail_log postmaster_address = postmaster@xxx quota_full_tempfail = yes syslog_facility = mail } protocol lmtp { info_log_path = log_path = mail_plugins = mail_log postmaster_address = postmaster@xxx quota_full_tempfail = yes }

4 7

Splitting up packages
by Larry Rosenman 01 Feb '24

01 Feb '24

I'm the maintainer of the dovecot and pigeonhole ports on FreeBSD and am looking to make separate installable packages like the project does for Linux. Can you help me know what needs to go where and what options (if any) change the base? Thanks for any help here. -- Larry Rosenman http://www.lerctr.org/~ler Phone: +1 214-642-9640 (c) E-Mail: larryrtx(a)gmail.com US Mail: 5708 Sabbia Dr, Round Rock, TX 78665-2106 I'm the maintainer of the dovecot and pigeonhole ports on FreeBSD and am looking to make separate installable packages like the project does for Linux. Can you help me know what needs to go where and what options (if any) change the base? Thanks for any help here. -- Larry Rosenman http://www.lerctr.org/~ler Phone: +1 214-642-9640 (c) E-Mail: larryrtx(a)gmail.com US Mail: 5708 Sabbia Dr, Round Rock, TX 78665-2106

3 2

We couldn't drop root group privileges
by forumforeign 01 Feb '24

01 Feb '24

Hello. I have - dovecot 2.3.21 (also tried 2.3.5) - postfix 3.8.5 (also tried 3.8.4) It's a new setup where I use postfix + dovecot-delivery for delivery to local mailbox. At logs I have an error and mail deffers in queue: dovecot: [ID 702911 mail.crit] lda(poli(a)domain.com)<7808>: Fatal: We couldn't drop root group privileges (wanted=6(mail), gid=0(root), egid=0(root)) Postfix and dovecot start from root UID, but user dovecot/postfix has corresponding groups to run as specific group: root@solaris:# id -a dovecot uid=110(dovecot) gid=110(dovecot) groups=110(dovecot),6(mail) root@solaris:# id -a postfix uid=26(postfix) gid=26(postfix) groups=26(postfix),6(mail) root@solaris:# id -a root uid=0(root) gid=0(root) groups=0(root),1(other),2(bin),3(sys),4(adm),6(mail),7(tty),8(lp),12(daemon) Also, when I run a dtrace (a system call trace mechanism) I see, that dovecot-lda runs as group "mail" (gid=6), so, there isn't any problem, but dovecot thinks another: UID GID PID PPID ARGS 0 26 7719 7638 pipe -n dovecot -t unix flags=DRhu user=nobody:mail argv=/usr/libexec/dovecot/d 60001 6 7720 7718 /usr/libexec/dovecot/dovecot-lda -f mega(a)domain.com -d poli(a)domain.com 60001 6 7720 7718 /usr/bin/amd64/doveconf -f service=lda -c /etc/dovecot/dovecot.conf -m lda -e / 60001 6 7720 7718 /usr/libexec/dovecot/dovecot-lda -f mega(a)domain.com -d poli(a)domain.com What exactly dovecot wants and how to solve this error? Here is part of "dovecot -n" output which is corresponding to user/group/lda: # 2.3.5.1 (7ec6d0ade): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.6 (92dc263a) # OS: SunOS 5.11 i86pc # Hostname: solaris auth_debug = yes auth_mechanisms = plain login auth_verbose = yes default_process_limit = 99 disable_plaintext_auth = no first_valid_gid = 6 first_valid_uid = 60001 last_valid_gid = 6 last_valid_uid = 60001 mail_access_groups = mail mail_debug = yes mail_gid = 6 mail_location = /var/mail/vmail/%u@%d mail_max_userip_connections = 99 mail_privileged_group = mail mail_uid = 60001 maildir_very_dirty_syncs = yes ... service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0666 user = postfix } } ... protocol lda { mail_plugins = " sieve" postmaster_address = postmaster } PS. Also, I have aother box with very old setup (dovecot 2.2.27) and it works with the same configuration without any errors. I thought that this is OS specific problem and tried on the same version OS run a dovecot 2.3.21, but still had an errors.

1 1

Emails automatically thread by subject, no matter how old or unrelated
by wakod67943＠flexvio.com 01 Feb '24

01 Feb '24

To preface, I’m using the Crossbox mail client hosted by MXroute. I was directed to Dovecot support when I made my inquiry to the former’s developers. Apparently, when you write an email subject that is verbatim to another, previously sent email, the two become linked in a conversation thread. I could have an email from 1996 titled “Groceries” and if I make one today titled “Groceries” my inbox would have them connected as one long thread. I’m getting email threads in the 100s because of this. Crossbox people have told me it’s not something they have control over. They mentioned it being a Dovecot problem. Has anyone encountered this? It would be tremendously inconvenient to ensure that every email I ever send from now on has a unique subject so to as not have them threaded together. Let me be clear, email threading and conversation views are extremely useful. I just want them to be…relevant to the chain of emails that are being looked at. Is there a way to group threads by unique header information? It is becoming borderline unusable to sift through invoices.

3 2

JMAP support?
by Mark Constable 31 Jan '24

31 Jan '24

On Fri Jan 25 2019 Aki wrote: > There is no JMAP support in any dovecot version yet. Two years on so what is the status of JMAP support in Dovecot now?

7 10

doveadm sync failed after adding "mechanisms = plain login" to passdb
by James 31 Jan '24

31 Jan '24

Hello, After adding `mechanisms = plain login` to passdb (passwd-file), `doveadm -D sync -u e(a)example.com -d -N -l 30 -U` failed with ``` Jan 26 06:49:22 doveadm(e(a)example.com): Error: remote(server2.example.com:61526): doveadm(1.1.1.1,e(a)example.com): auth-master: passdb lookup(e(a)example.com): Auth PASS lookup failed Jan 26 06:49:22 doveadm(e(a)example.com): Error: remote(server2.example.com:61526): doveadm(1.1.1.1,e(a)example.com): /run/dovecot/auth-userdb: passdb lookup failed (to see if user is proxied, because doveadm_port is set) ``` With `auth_debug=yes`, I found these lines. ``` Jan 26 04:55:37 server2 dovecot: auth: Debug: skipping passdb: mechanism filtered Jan 26 04:55:37 server2 dovecot: auth: Error: All password databases were skipped ``` What should I do to fix it without deleting `mechanisms = plain login`? More information could be found on [this link](https://github.com/orgs/docker-mailserver/discussions/3836#discussion…. Thanks

1 0

Re: JMAP support?
by Marcel Schmidt 30 Jan '24

30 Jan '24

Hi, is there any progress on this? Since the IETF draft is long completed, will you integrate JMAP in a coming dovecot version or is this topic completely abandoned? Marcel Hi, is there any progress on this? Since the IETF draft is long completed, will you integrate JMAP in a coming dovecot version or is this topic completely abandoned? Marcel

1 0

One Way sync is deleting emails
by Steve Moser 30 Jan '24

30 Jan '24

Hello, I am hoping that you can help me. I am running this command on my main email server, one way backup/sync to the backup server. sudo doveadm sync -1 -A remote:root@x.x.x.x x.x.x.x is my remote server. I will add a new email on the main, run the command and it shows up on the backup. - Great! Now I delete that email from the main, run the command and the email is removed from the backup. That should not delete anything from the backup, correct? I prefer Not to delete anything, only update/add. Do you see what I am doing wrong? Thank You!!!! Here my installed versions dovecot-core 1:2.3.16+dfsg1-3ubuntu2.2 dovecot-imapd 1:2.3.16+dfsg1-3ubuntu2.2 dovecot-lmtpd 1:2.3.16+dfsg1-3ubuntu2.2 dovecot-mysql 1:2.3.16+dfsg1-3ubuntu2.2 dovecot-pop3d 1:2.3.16+dfsg1-3ubuntu2.2 postfix 3.6.4-1ubuntu1.2 amd64 High-performance mail transport agentpostfix-mysql 3.6.4-1ubuntu1.2 amd64 MySQL map support for Postfixpostfix-policyd-spf-python 2.9.3-1 all Postfix policy server for SPF checking Hello, I am hoping that you can help me. I am running this command on my main email server, one way backup/sync to the backup server. sudo doveadm sync -1 -A remote:root@x.x.x.x x.x.x.x is my remote server. I will add a new email on the main, run the command and it shows up on the backup. - Great! Now I delete that email from the main, run the command and the email is removed from the backup. That should not delete anything from the backup, correct? I prefer Not to delete anything, only update/add. Do you see what I am doing wrong? Thank You!!!! Here my installed versions dovecot-core 1:2.3.16+dfsg1-3ubuntu2.2 dovecot-imapd 1:2.3.16+dfsg1-3ubuntu2.2 dovecot-lmtpd 1:2.3.16+dfsg1-3ubuntu2.2 dovecot-mysql 1:2.3.16+dfsg1-3ubuntu2.2 dovecot-pop3d 1:2.3.16+dfsg1-3ubuntu2.2 postfix 3.6.4-1ubuntu1.2 amd64 High-performance mail transport agent postfix-mysql 3.6.4-1ubuntu1.2 amd64 MySQL map support for Postfix postfix-policyd-spf-python 2.9.3-1 all Postfix policy server for SPF checking

2 1

sieve filter generated email- sent folder
by joe a 29 Jan '24

29 Jan '24

dovecot 2.3.21 pigeonhole 0.5.21. Filters created via roundcube. Attempting to have filters detect certain email, send a notification text message to mobile via email, and copy that notification email to "Sent" folder. Filter(s) detect condition, move the email to desired folder and appear, as note in logs outside of dovecot, to sent the notification email. The notification email is not recorded in "Sent" folder and is not received by mobile device. Is this a "do-able" thing in dovecot/pigeonhole? If so, how? Docs available?

3 4

fts indexer stuck on very large plaintext messages
by p h 29 Jan '24

29 Jan '24

Hi, I recently fts indexed a users mailbox with xapian which had 10-15 very large plaintext messages (>20Mb). The content of these messages was mostly a list of all files on a linux server (tripwire and backup reports). The indexer-worker process was completely stuck processing these messages, cpu pegged at 100% running continuously for multiple days. I was wondering if there is way to avoid this issue. It would be great if I could configure limits for the fts indexing process.

2 1

shared mailbox replication
by micha＠micha.waw.pl 28 Jan '24

28 Jan '24

We use a shared mailbox, where incoming mails from customers are stored. Every user can see it as "shared/contact(a)domain.name". When a new message comes, any user who is currently available just takes the message and does something with it. It's configured this way: namespace shared { type = shared separator = / prefix = shared/%%u/ location = maildir:%%h/.maildir:LAYOUT=fs:INDEX=~/.shared/%%u subscriptions = no list = children } It worked perfectly until I set up replication. Now we have a mess, because a message moved/deleted on one server are replicated beck form another. This is known issue. The documentation says it clear: "Warning Shared folder replication doesn’t work correctly. Mainly it can generate a lot of duplicate emails. This is because there’s currently a per-user lock that prevents multiple dsyncs from working simultaneously on the same user. But with shared folders multiple users can be syncing the same folder. So this would need additional locks (e.g. shared folders would likely need to lock the owner user, and public folders would likely need a per-folder lock or maybe a global public folder lock). There are no plans to fix this." I understand "There are no plans to fix this." But... maybe there is a workaround? I am sure someone before me had already this problem... :-)

1 0

Tests fail 2.3.21 in aarch64 build
by Peter 28 Jan '24

28 Jan '24

Building Dovecot 2.3.21 for aarch64 (building with qemu emulation) I get the following in the test stage: test-file-cache.c:266: Assert failed: file_cache_set_size(cache, 1024) == -1 Panic: file test-common.c: line 211 (test_expect_error_string_n_times): assertion failed: (expected_errors == 0) test-common.c:245: Assert failed: suppress == TRUE Error: Raw backtrace: ./test-lib(+0x693f0) [0x7f10b36943f0] -> ./test-lib(+0x6d8e4) [0x7f10b36988e4] -> ./test-lib(+0x75110) [0x7f10b36a0110] -> ./test-lib(+0x75168) [0x7f10b36a0168] -> ./test-lib(+0x15534) [0x7f10b3640534] -> ./test-lib(+0x152ec) [0x7f10b36402ec] -> ./test-lib(+0x3411c) [0x7f10b365f11c] -> ./test-lib(+0x15e64) [0x7f10b3640e64] -> /lib64/libc.so.6(+0x2c79c) [0x40000087579c] -> /lib64/libc.so.6(__libc_start_main+0x98) [0x40000087586c] -> ./test-lib(+0x163f0) [0x7f10b36413f0] qemu: uncaught target signal 6 (Aborted) - core dumped I'll provide more info on request. Is this just an issue with the tests or is it an issue with Dovecot itself? Peter

1 0

Azure AD / Entra Id OAuth2 issue, username not recognized
by meint＠meint.net 26 Jan '24

26 Jan '24

Dovecot version 2.3.16 Trying to use Azure AD / Entra Id with OAuth2 authentication, I have most of it working but somehow Dovecot fails to map / recognize the username, hopefully somebody can point out what I'm doing wrong? Excerpt from log: Jan 26 09:13:20 localhost dovecot: auth: Debug: http-client: conn [2603:1026:3000:108::4]:443 [1]: Got 200 response for request [Req1: POST https://login.microsoftonline.com/79b065d9-761f-4b79-a5cb-71a452f452af/oaut…] OK (took 220 ms + 82 ms in queue) Jan 26 09:13:20 localhost dovecot: auth: Debug: oauth2(test-external@secumailer.com,2a05:d018:ebe:d005:22b6:dc4b:41c6:7fec): Password grant succeeded Jan 26 09:13:20 localhost dovecot: auth: Debug: oauth2(test-external@secumailer.com,2a05:d018:ebe:d005:22b6:dc4b:41c6:7fec): Processing field token_type Jan 26 09:13:20 localhost dovecot: auth: Debug: oauth2(test-external@secumailer.com,2a05:d018:ebe:d005:22b6:dc4b:41c6:7fec): Processing field scope Jan 26 09:13:20 localhost dovecot: auth: Debug: oauth2(test-external@secumailer.com,2a05:d018:ebe:d005:22b6:dc4b:41c6:7fec): Processing field expires_in Jan 26 09:13:20 localhost dovecot: auth: Debug: oauth2(test-external@secumailer.com,2a05:d018:ebe:d005:22b6:dc4b:41c6:7fec): Processing field ext_expires_in Jan 26 09:13:20 localhost dovecot: auth: Debug: oauth2(test-external@secumailer.com,2a05:d018:ebe:d005:22b6:dc4b:41c6:7fec): Processing field access_token Jan 26 09:13:20 localhost dovecot: auth: Error: oauth2(test-external@secumailer.com,2a05:d018:ebe:d005:22b6:dc4b:41c6:7fec): oauth2 failed: Password grant failed: No username returned I'm using Resource Owner Password Grant flow. I have the following configured in conf.d/auth-oauth.conf.ext: passdb { driver = oauth2 mechanisms = plain args = /etc/dovecot/dovecot-oauth2.plain.conf.ext } I have the following configured in dovecot-oauth2.plain.conf.ext: grant_url = https://login.microsoftonline.com/<redacted>/oauth2/v2.0/token client_id = <redacted> client_secret = <redacted> username_attribute = email use_grant_password = yes scope = api://<redacted>/mail-relay debug = yes rawlog_dir = /tmp/oauth2 I have the following response from the oauth raw logs: out: 1706256800.309971 POST /<redacted>/oauth2/v2.0/token HTTP/1.1 1706256800.309971 Host: login.microsoftonline.com 1706256800.309971 Date: Fri, 26 Jan 2024 08:13:20 GMT 1706256800.309971 User-Agent: dovecot-oauth2-passdb/2.3.16 1706256800.309971 Content-Length: 255 1706256800.309971 Connection: Keep-Alive 1706256800.310013 Content-Type: application/x-www-form-urlencoded 1706256800.310018 1706256800.310056 grant_type=password&username=test-external(a)example.org&password=<redacted>&client_id=<redacted>&client_secret=<redacted>&scope=api:%2f%2f<redacted>%2fmail-relay in: 1706256800.530754 HTTP/1.1 200 OK 1706256800.530754 Cache-Control: no-store, no-cache 1706256800.530754 Pragma: no-cache 1706256800.530754 Content-Type: application/json; charset=utf-8 1706256800.530754 Expires: -1 1706256800.530754 Strict-Transport-Security: max-age=31536000; includeSubDomains 1706256800.530754 X-Content-Type-Options: nosniff 1706256800.530754 P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" 1706256800.530754 x-ms-request-id: 629ce7bf-a5e9-4655-9019-83690c8b4400 1706256800.530754 x-ms-ests-server: 2.1.17122.2 - SEC ProdSlices 1706256800.530754 X-XSS-Protection: 0 1706256800.530754 Set-Cookie: fpc=Am8EyNTmX2ZOkMLj2MB82W4gKLwwAQAAAJ9gRd0OAAAA; expires=Sun, 25-Feb-2024 08:13:20 GMT; path=/; secure; HttpOnly; SameSite=None 1706256800.530754 Set-Cookie: x-ms-gateway-slice=estsfd; path=/; secure; samesite=none; httponly 1706256800.530754 Set-Cookie: stsservicecookie=estsfd; path=/; secure; samesite=none; httponly 1706256800.530754 Date: Fri, 26 Jan 2024 08:13:20 GMT 1706256800.530754 Content-Length: 1979 1706256800.530754 1706256800.530754 {"token_type":"Bearer","scope":"api://<redacted>/mail-relay","expires_in":5296,"ext_expires_in":5296,"access_token":"eyJ0eX ...<redacted>"} If I inspect the access token I'm getting: { "aud": "<redacted>", "iss": "<redacted>", "iat": 1706256500, "nbf": 1706256500, "exp": 1706262097, "acr": "1", "aio": "ATQAy/8VAAAANgbkS6NmHL3yGyROhLM28ooLX57pCjHjp0TGtd7EjwgVZy/i2aEqfV6sxiHeGZ0N", "amr": [ "pwd" ], "appid": "<redacted>", "appidacr": "1", "email": "test-external(a)example.org", "ipaddr": "<redacted>", "login_hint": "<redacted>", "name": "test-external", "oid": "657401f0-c9f0-402c-af6f-9ef063e7a281", "preferred_username": "test-external(a)example.org", "rh": "0.ATEA2WWweR92eUuly3GkUvRSr08CZ45J3dRLnCQJZCVUYBcxAKo.", "scp": "mail-relay", "sub": "ST9owcQQN2e0tBsHiVjvR8SCdlfUR_114tJk4C2bRxg", "tid": "79b065d9-761f-4b79-a5cb-71a452f452af", "unique_name": "test-external(a)sexample.org", "upn": "test-external(a)example.org", "uti": "v-ecYumlVUaQGYNpDItEAA", "ver": "1.0" } The email attribute is present in the access token yet Dovecot doesnt appear to recognize it. What am I doing wrong?

2 3

Replication going away?
by Vladimir Mishonov 26 Jan '24

26 Jan '24

Hello everyone. Just saw this commit in the official Github repo: https://github.com/dovecot/core/commit/4c04e4c30fd4817a8b0e11d04d9681173f69… Looking at the commit details, it appears that it completely removes the replication feature. I'm a bit perplexed by this change and am not sure what might be the justification for it. Personally, I find replication to be very useful, as it allows me to maintain a synchronized mirror of all of my mailboxes on my home server, for use as backup in case the primary server goes down for some reason. Perhaps there's some sort of replacement being planned for this feature? Or maybe the relevant code is simply going to be refactored to a plugin or external program, and there's nothing to worry about at all? In any case, I'd greatly appreciate if one of the developers could comment on this change. -- Kind regards, a concerned user of Dovecot (Vladimir)

34 66

Error activating filter set
by joe a 25 Jan '24

25 Jan '24

Some success creating and using filters, created via roundcube, but, when testing activate and deactivating filter sets, received an error. However, I can edit and add filters without apparent error, even "importing" from an existing filter set. var/log/dovecot-info.log shows, in part: ([%user] refers to the active dovecot user, whose account seems to operate perfectly, aside from filters). Obfuscated out of habit. Form is user(a)domain.com. "Jan 24 15:44:49 managesieve([%user])<23204><Pk9VIrcPfKx/AAAB>: Info: Failed to activate script `dovecot.orig': Internal error occurred. Refer to server log for more information. [2024-01-24 15:44:49]" It is unclear, among other things, what and where this "server log" is. tail -f /var/log/messages shows nothing during the various traipsing about in filters Not just foggy outdoors lately.

1 1

IMAP Sieve fileinto :create intermediate folders
by dovecot-4tg＠freakin.rocks 25 Jan '24

25 Jan '24

I apologize if this isn't the appropriate place for this question. Consider a Sieve script with this instruction: fileinto :create "folder 1.folder 2.folder 3"; That faithfully creates in Maildir the folder named '.folder 1.folder 2.folder 3'/ An IMAP Client shows this in tree format as: - folder 1 - - folder 2 - - - folder 3 But there isn't really a "folder 2". That is, there is no Maildir '.folder 1.folder 2' so what happens in the MUA is really subject to its coding. In Thunderbird, for example, 'folder 2' is grayed out. You can't subscribe to it or drop a file into that folder because it is disabled. With no mail actually targeted to that folder, that's generally not a problem, but Thunderbird does raise errors as it attempts to scan folders, correctly claiming that it can't access the folder because it doesn't exist. That's irritating to the user. So to the questions: 1) Is there anything in Dovecot or Pidgeonhole Sieve that might allow us to auto-create the missing intermediate folders? Maybe using a vnd.dovecot.* extension or some sieve capability? 2) Aside from being inelegant, is there anything wrong with a cron script that creates missing Maildir folders? While I am developer, I haven't yet looked into the proper way to create and configure folders user folders. 3) Would it be more appropriate to create a new extension, implementation of some RFC, Lua script, or some other type of plugin that might get triggered on a fileinto operation? Again, I haven't looked deeply in this direction and could use a few RTM references. 4) Might there already exist an external script or custom extension that does this? 5) Might this be a worthy enhancement request for Dovecot or Pidgeonhole Sieve? Thanks! Dovecot 2.3.7.2 / Pidgeonhole 0.5.7.2 / Ubuntu v20

1 0

lda or lmtp for sieve?
by Joe Acquisto 25 Jan '24

25 Jan '24

I noticed that many places in the documentation and in examples gleaned from the wilderness, refer to the LDA protocol when discussing sieve. The documentation also mentions that lmtp is preferred over lda, and seems to say in places that sieve will operate without issue in either case. Does it matter to sieve implementation if one uses only lmtp?

7 13

Can Dovecot use an MH data store?
by Steve Litt 25 Jan '24

25 Jan '24

Hi all, I know Dovecot can use a Maildir mail store and a Mailbox mail store. Can it also use an MH mail store? If so, is there a way of getting procmail to dump messages into the correct MH folder? Thanks, SteveT Steve Litt Autumn 2023 featured book: Rapid Learning for the 21st Century http://www.troubleshooters.com/rl21

1 0

Re: "Connection reset by peer" errors with Outlook
by Joseph Tam 24 Jan '24

24 Jan '24

From: Steve Dondley <s(a)dondley.com> > I have no idea what is triggering it for so many different users from legit > email addresses. Still investigating. But this appears to be a fail2ban > problem, not a dovecot problem. My logs are filled with failed authentication from Outlook clients. The clients seem to be trying different usernames (with/without domains), and maybe SSL/TLS flavours. My guess is Outlook is doing some autodiscovery/autoconfiguration thing, and occasionally hits the right combo and successfully authenticates. I'm not sure I would characterise this as a fail2ban problem. Fail2ban is doing what it says on the side of the tin: looking for repeated authentication failures, and blocking those that fail too many times. The real problem is Outlook fumble around for the correct settings, and mimicking a brute force attack. I've had great difficulty getting some Outlook clients to configure exactly the settings it should have (like excluding domain names from usernames). Try running his command line using Windows-R (not from cmd.exe). outlook.exe /PIM NoEmail This will avoid the auto-setup process that railroads you into frustration. MacOSX Mail app tries the same stuff, but at least you can turn that behaviour off and stop it from second guessing your settings. Joseph Tam <jtam.home(a)gmail.com>

2 1

Managesieve "config" unable to complete?
by joe a 24 Jan '24

24 Jan '24

What say we try this again, on a "blank slate"? Dovecot installed on OpenSuse Leap 15.5, from their supplied "dovecot23" package. That package claims to be Dovecot 2.3.21 and Pigeonhole 0.5.21 Unable to get managesieve to bind to port 4190. Output of dovecot -n attached. Various tools, including lsof, sockets, do not show 4190 in use. While grasping for/at straws, noticed this: ~: # lsof | grep manage config 19097 root mem REG 0,47 6896 257261 /usr/lib64/dovecot/modules/settings/libmanagesieve_settings.so config 19097 root mem REG 0,47 14696 257260 /usr/lib64/dovecot/modules/settings/libmanagesieve_login_settings.so Does that suggest an attempt to configure managesieve is unable to do so? What does it infer? Bad configuration? File ownership? File rights? Bug? Thanks for patience and forbearance

3 6

Strangeness in defining "protocols"
by joe a 24 Jan '24

24 Jan '24

Well, a strangeness to my view. Since this is an opensuse package and not the "lastest and greatest", not sure if I should post this here or "over there". It is a given that I may have, through some noobiness have bungled something early on that is causing this. I am prepared to accept the semi-public ritual shaming that may follow. All references to results mean per "dovecot -n". One can be assured that dovecot.conf was edited followed by "dovecot -n", then 20-managesieve.conf edited followed by "dovecot -n", for each "set". What happens is, it appears, that if one specifies or alters the "default" protocols in /etc/dovecot/dovecot.conf, any protocols subsequently defined, at least in /etc/dovecot/conf.d/20-managesieve.conf, are not honored. It does not seem to matter if it is specified as "protocols = sieve" or "protocols = $protocols sieve". Further, in /etc/dovecot/dovecot.conf, if one comments out "protocols", one finds protocols is not listed at all, unless there is a protocol defined later such as "sieve" in 20-managesieve.conf. if one lists "protocols = " then "protocols = " is listed even if a protocol is defined later such as "sieve" in 20-managesieve.conf of one lists "protocols = $protocols", nothing is listed, unless if: "protocols = sieve" is defined in 20-managesieve.conf, "protocols = sieve" is listed "protocols = $protocols sieve" is defined in 20-managesieve.conf - then "protocols = imap pop3 lmtp sieve" is listed. Again, all as shown by "dovecot -n" after editing each file(s). I hope this is useful in determining if there is a problem, and helps lead to a solution if one is warranted. I'll send this also to the openSuse list as a distinct email.

1 0

managesieve server not answering?
by Joe Acquisto 23 Jan '24

23 Jan '24

Trying to connect to managesieve server configured to port 4190. No go. Roundcube is configured (thunderbird apparently having nothing current), but selecting "Add Filter" (new since re-configured for managesieve) produces "unable to connect to server". Port 4190 does not seem to answer or be "bound" to anything. Telnet to 4190 produces "connection refused". A "one box" solution. If I had to guess, I would guess, operator error. Otherwise, things are looking up. But, I remember a movie that said never to do that . . .

6 32

Replication between three or more servers
by tomas.simonaitis＠gmail.com 23 Jan '24

23 Jan '24

Hi list members, documentation says "Replication works only between server pairs. If you have a large cluster, you need multiple independently functioning Dovecot backend pairs". Do I understant correctly, that in order to have replication between 3 servers, one would need to run 2 instances of dovecot on each server with (a bit) different configuration. e.g. Serv1: -- dovecot-1.conf .. plugin { mail_replica = tcps:Serv2:1234 } .. -- dovecot-2.conf .. plugin { mail_replica = tcps:Serv3:1234 } .. Serv2: -- dovecot-1.conf .. plugin { mail_replica = tcps:Serv1:1234 } .. -- dovecot-2.conf .. plugin { mail_replica = tcps:Serv3:1234 } .. etc. Won't two processes of dovecot in one machine (assuming local storage) conflict accessing same Maildirs? Thanks for any insights

1 0