- dovecot - dovecot.org

doveadm http api not responding under load
by Achim Stahlberger 23 Jan '24

23 Jan '24

Hello, we see this problem when doveadm-server is under load. We enabled doveadm http api with this config: service doveadm { inet_listener { port = 50000 } inet_listener http { port = 50001 ssl = no } } When doveadm server receives at lot of connects on port 50000 the http service on port 50001 is not responding until load on port 50000 drops to zero. It seems like doveadm-server is prefering port 50000 over 50001. Looking into Recv-Q when http hangs Netid State Recv-Q Send-Q Local Address:Port Peer Address:Port tcp LISTEN 129 128 0.0.0.0:50000 0.0.0.0:* tcp LISTEN 1 128 0.0.0.0:50001 0.0.0.0:* I used this script to produce load on port 50000 #!/bin/bash for i in {1..1000} do echo "124" | netcat localhost 50000 & done wait When this script is started it takes several seconds until a connect on port 50001 succeeds. We are using Dovecot version 2.3.20 (bdc808f24c). I think the problem is in src/lib/ioloop-epoll.c function io_loop_handler_run_internal. This might fix the problem (look for new variable rr): void io_loop_handler_run_internal(struct ioloop *ioloop) { struct ioloop_handler_context *ctx = ioloop->handler_context; struct epoll_event *events; const struct epoll_event *event; struct io_list *list; struct io_file *io; struct timeval tv; unsigned int events_count; int msecs, ret, i, j, k, rr; bool call; i_assert(ctx != NULL); /* get the time left for next timeout task */ msecs = io_loop_run_get_wait_time(ioloop, &tv); events = array_get_modifiable(&ctx->events, &events_count); if (ioloop->io_files != NULL && events_count > ctx->deleted_count) { ret = epoll_wait(ctx->epfd, events, events_count, msecs); if (ret < 0 && errno != EINTR) i_fatal("epoll_wait(): %m"); } else { /* no I/Os, but we should have some timeouts. just wait for them. */ i_assert(msecs >= 0); i_sleep_intr_msecs(msecs); ret = 0; } /* execute timeout handlers */ io_loop_handle_timeouts(ioloop); if (!ioloop->running) return; rr = ret>1 ? i_rand_limit(ret) : 0; for (k = 0; k < 2; k++) { for (i = (k==0 ? rr : 0); i < (k==0 ? ret : rr); i++) { /* io_loop_handle_add() may cause events array reallocation, so we have use array_idx() */ event = array_idx(&ctx->events, i); list = event->data.ptr; for (j = 0; j < IOLOOP_IOLIST_IOS_PER_FD; j++) { io = list->ios[j]; if (io == NULL) continue; call = FALSE; if ((event->events & (EPOLLHUP | EPOLLERR)) != 0) call = TRUE; else if ((io->io.condition & IO_READ) != 0) call = (event->events & EPOLLIN) != 0; else if ((io->io.condition & IO_WRITE) != 0) call = (event->events & EPOLLOUT) != 0; else if ((io->io.condition & IO_ERROR) != 0) call = (event->events & IO_EPOLL_ERROR) != 0; if (call) { io_loop_call_io(&io->io); if (!ioloop->running) return; } } } } } Thanks a lot. Achim https://www.tallence.com Folgt uns auf LinkedIn <https://www.linkedin.com/company/tallence-ag> // XING <https://www.xing.com/pages/tallenceag> // Twitter <https://twitter.com/tallence> // Instagram <https://www.instagram.com/tallence_ag/> // facebook <http://www.facebook.com/Tallence> Tallence AG // Sitz der Gesellschaft: Hamburg // Neue Gröningerstraße 13, 20457 Hamburg // Amtsgericht Hamburg HRB 142900 Vorstand: Frank Moll (Vorsitzender), Bernd Scherf // Aufsichtsrat: Wolf Ingomar Faecks (Vorsitzender) Die Speicherung und Verarbeitung personenbezogener Daten erfolgt entsprechend unserer Datenschutzhinweise. <https://www.tallence.com/datenschutzhinweise>

2 2

"Connection reset by peer" errors with Outlook
by Steve Dondley 23 Jan '24

23 Jan '24

I have a mail server using dovecot that has been running without issue for quite a couple of years now. It serves email for about 30 individuals. But since Jan 14th, users have been reporting spurious errors in MS Outlook: 316 Jan 21 00:38:12 ip-172-30-0-131 dovecot: pop3-login: Disconnected (no auth attempts in 1 secs): user=<>, rip=118.xxx.xxx.xxx, lip=172.30.0.131, TLS handshaking: read(size=783) failed: Connection reset by peer, session=<yVd4Hm4Pst12wSuN> 317 Jan 21 00:38:12 ip-172-30-0-131 dovecot: pop3-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=118.xxx.xxx.xxx, lip=172.30.0.131, TLS handshaking: read(size=598) failed: Connection reset by peer, session=<aKOAHm4PCOB2wSuN> 318 Jan 21 00:38:13 ip-172-30-0-131 dovecot: pop3-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=118.xxx.xxx.xxx, lip=172.30.0.131, TLS handshaking: read(size=598) failed: Connection reset by peer, session=<9rWIHm4PtuF2wSuN> 319 Jan 21 00:38:13 ip-172-30-0-131 dovecot: pop3-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=118.xxx.xxx.xxx, lip=172.30.0.131, TLS handshaking: read(size=677) failed: Connection reset by peer, session=<NsORHm4P9OJ2wSuN> 320 Jan 21 00:38:14 ip-172-30-0-131 dovecot: pop3-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=118.xxx.xxx.xxx, lip=172.30.0.131, TLS handshaking: read(size=691) failed: Connection reset by peer, session=<AACaHm4PdOR2wSuN> 321 Jan 21 00:38:15 ip-172-30-0-131 dovecot: pop3-login: Disconnected (no auth attempts in 1 secs): user=<>, rip=118.xxx.xxx.xxx, lip=172.30.0.131, TLS handshaking: read(size=610) failed: Connection reset by peer, session=<G8umHm4P2OV2wSuN> 322 Jan 21 00:38:16 ip-172-30-0-131 dovecot: pop3-login: Disconnected (no auth attempts in 1 secs): user=<>, rip=118.xxx.xxx.xxx, lip=172.30.0.131, TLS handshaking: read(size=609) failed: Connection reset by peer, session=<qSy0Hm4PuOd2wSuN> 323 Jan 21 00:38:16 ip-172-30-0-131 dovecot: pop3-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=118.xxx.xxx.xxx, lip=172.30.0.131, TLS handshaking: read(size=596) failed: Connection reset by peer, session=<W427Hm4PtOl2wSuN> 324 Jan 21 00:38:17 ip-172-30-0-131 dovecot: pop3-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=118.xxx.xxx.xxx, lip=172.30.0.131, TLS handshaking: read(size=596) failed: Connection reset by peer, session=<mu/JHm4Ptup2wSuN> Some characteristics of the problem that may offer a clue: * happening with multiple users, not just the same one * happens from different IP addresses. * happens about 3 to 5 times per day and the errors come in batches like above * MS Outlook error is: reported error (0x80042109): ‘Outlook cannot conect to your outgoing SMTP email server. If you continue to receive this message….blah blah blah I googled the error code but didn’t find anything particularly helpful. I’m running Debian bullseye, version 11.8.

4 7

Migrate Dovecot 2.0.16 (mbox) to Dovecot 2.3.16 (MaiDir) and preserve POP UIDs
by Barbara M. 21 Jan '24

21 Jan '24

Already done a first migration using imapsync Good result, but there is the POP3 UIDs problem. Searching online give a Tried to understand the instructions on: https://doc.dovecot.org/settings/plugin/pop3-migration-plugin/? with limited comprension results (the link in the page is to the old wiki). Searching online give more confusion ... I am obviouly interested to resync the INBOX with somethig that give to clients the old UIDs so they don't re-download all messages in the inbox as duplicates into their mailbox. I suppose I can do: doveadm -v expunge -u <username> mailbox INBOX all rm dovecot* in the Maildir folder doveadm force-resync -u <username> INBOX then use dsync to migrate the INBOX Here I need some hints to how setup it and wich syntax use. If useful I can copy or mount the /var/mail/ folder of the old server that contains the users INBOX to the new server. Thanks, B.

2 1

Re: Migrate Dovecot 2.0.16 (mbox) to Dovecot 2.3.16 (MaiDir) and preserve POP UIDs
by Joseph Tam 21 Jan '24

21 Jan '24

From: "Barbara M." <barbara(a)rfx.it> > I am obviouly interested to resync the INBOX with somethig that give to > clients the old UIDs so they don't re-download all messages in the inbox > as duplicates into their mailbox. When I mitigated away from qpopper, I configured protocol pop3 { ... pop3_reuse_xuidl = yes } Maybe that's of use to you? Joseph Tam <jtam.home(a)gmail.com>

1 0

Uncompress compressed messages in Maildir mailbox?
by achekalin＠lazurit.com 21 Jan '24

21 Jan '24

Some time ago I enabled compression on incoming messages, so LMTP delivered messages were compressed. Good idea in terms of disk space, but now I cannot uncompress any of these messages even when I need to! I was using this setting: plugins { zlib_save = lz4 } and now I can see this string at the beginning of each message file - "Dovecot-LZ4", so no other software can uncompress them for me. Please advise, how can I uncompress message file in Maildir mailbox when I need to access its contents directly?

4 5

master-users problem
by Barbara M. 20 Jan '24

20 Jan '24

I am trying to activate master-users as usual but seems in this case I am doing something wrong and I can't have it working. It is a Rocky Linux 9.x (in Proxmox CT), installed with virtualmin and using system users: # doveconf -n # 2.3.16 (7e2e900c1a): /etc/dovecot/dovecot.conf # OS: Linux 6.5.11-4-pve x86_64 Rocky Linux release 9.3 (Blue Onyx) auth_master_user_separator = * auth_mechanisms = plain login disable_plaintext_auth = no first_valid_uid = 1000 mail_location = maildir:~/Maildir mbox_write_locks = fcntl namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } passdb { args = /etc/dovecot/master-users driver = passwd-file master = yes result_success = continue } passdb { driver = pam } protocols = imap pop3 ssl = required ssl_cert = </etc/pki/dovecot/certs/dovecot.pem ssl_cipher_list = PROFILE=SYSTEM ssl_key = # hidden, use -P to show it userdb { driver = passwd } Any hints on what I am doing wrong and/or how to debug it? Thanks, B.

3 4

Forcing imap authentication failure for certain IP addresses
by Hippo Man 20 Jan '24

20 Jan '24

I'm running dovecot 2.3.18 under Debian 11. I want to do something that's a bit unusual: when IMAP connections are attempted from a few specific IP addresses, I want to force an IMAP authentication failure from those connections, no matter what user ID and password are specified. I know that I can use iptables to completely block imap access from those IP addresses to the IMAP ports. However, in these specific cases, I'd prefer that the connection goes through to dovecot, but for dovecot then to always generate authentication failures for those specific connections ... even if a valid user ID and password happen to be specified. Is there a way to do this in dovecot? Thank you very much in advance. -- hippoman(a)gmail.com Take a hippopotamus to lunch today. .---------, 0__0 / ( oo'---, / oo\ ,\ | | \ ,=__/ \ / / /------| /| |__|-' |__|'

2 1

Documentation flaw: man-page link.
by Ralph Corderoy 19 Jan '24

19 Jan '24

Hi, https://doc.dovecot.org/admin_manual/doveadm_mailbox_commands/ ends with The man-pages also contain good descriptions of doveadm commands. Man-pages can be accessed online at e.g. https://wiki.dovecot.org/Tools/Doveadm That wiki page says Our primary documentation is now at https://doc.dovecot.org, please update your links. But I was at https://doc.dovecot.org to start with and there is no obvious mention of man pages there. This needs tidying up to avoid the loop and ideally provide man pages. -- Cheers, Ralph.

3 3

post-login scripting
by Alex 19 Jan '24

19 Jan '24

Hi, I'm trying to determine the last login time for my IMAP users. Some systems use mbox while others are Maildir, but not sure that matters. I'd just like to touch a file similar to how it's done in this article, but it doesn't work for me. https://doc.dovecot.org/admin_manual/post_login_scripting/ I've followed the instructions explicitly - made the required changes to 10-master.conf and created a shell script in /usr/local/bin that touches a file in the user's home directory. However, the file doesn't get created/touched. I've enabled debugging and don't see any errors that might lead to what I'm doing wrong. It doesn't say explicitly in the article that the last-login script referenced in the article is actually the contents of the postlogin.sh script, but I'm assuming it is? When I put the following in my dovecot.conf instead of conf.d/10-auth.conf, it core dumps. I thought local changes should be made in dovecot.conf? service imap-login { executable = imap imap-postlogin inet_listener imap { port = 0 } inet_listener imaps { port = 993 } process_min_avail = 6 service_count = 0 vsz_limit = 512 M } service imap-postlogin { executable = script-login /usr/local/bin/postlogin.sh user = $default_internal_user } service pop3-login { inet_listener pop3 { port = 0 } inet_listener pop3s { port = 995 } } Hi, I'm trying to determine the last login time for my IMAP users. Some systems use mbox while others are Maildir, but not sure that matters. I'd just like to touch a file similar to how it's done in this article, but it doesn't work for me. https://doc.dovecot.org/admin_manual/post_login_scripting/ I've followed the instructions explicitly - made the required changes to 10- master.conf and created a shell script in /usr/local/bin that touches a file in the user's home directory. However, the file doesn't get created/touched. I've enabled debugging and don't see any errors that might lead to what I'm doing wrong. It doesn't say explicitly in the article that the last-login script referenced in the article is actually the contents of the postlogin.sh script, but I'm assuming it is? When I put the following in my dovecot.conf instead of conf.d/10-auth.conf, it core dumps. I thought local changes should be made in dovecot.conf? service imap-login { executable = imap imap-postlogin inet_listener imap { port = 0 } inet_listener imaps { port = 993 } process_min_avail = 6 service_count = 0 vsz_limit = 512 M } service imap-postlogin { executable = script-login /usr/local/bin/postlogin.sh user = $default_internal_user } service pop3-login { inet_listener pop3 { port = 0 } inet_listener pop3s { port = 995 } }

4 7

Re: What is the difference between BEFORE, SENTBEFORE, and SAVEDBEFORE?
by Joseph Tam 19 Jan '24

19 Jan '24

From: Paul Pace <paul(a)mostlybsd.com> > BEFORE date specification > Matches messages with an internal date before date > specification. > > SENTBEFORE date specification > Matches messages with a Date: header before date specification. > > SAVEDBEFORE date specification > Matches messages, which were saved before date specification. > > I am creating a cron job to purge old messages in Trash or Spam folders, > but I discovered using doveadm search queries using savedbefore that > somehow no message in any of the folders shows up with queries starting > at 5d, even though there are much older messages. I don't know exactly the answer to your query, but the semantics of each term may not be the problem. I had this exact problem a decade ago with my own trash purging script. If you dump the above values e.g. doveadm fetch -ftab -A 'mailbox date.received' mailbox Trash BEFORE 90d you may find that many of them have the same value, and what's more, the time coincides with the first time you queried for that value (i.e. when you ran the above doveadm fetch). I think these fields may not have cached values before you ask for it, then it gets instantiated the current timestamp when you do. If you do a fetch every day, you'll eventually reach 90d, and it will work forever more (+/- 1 day). Perhaps adding those fields into these settings is a more direct and better solution: https://doc.dovecot.org/configuration_manual/mail_cache_settings/ Joseph Tam <jtam.home(a)gmail.com>

1 1

What is the difference between BEFORE, SENTBEFORE, and SAVEDBEFORE?
by Paul Pace 19 Jan '24

19 Jan '24

In doveadm-search-query(7), it states: BEFORE date specification Matches messages with an internal date before date specification. SENTBEFORE date specification Matches messages with a Date: header before date specification. SAVEDBEFORE date specification Matches messages, which were saved before date specification. I am creating a cron job to purge old messages in Trash or Spam folders, but I discovered using doveadm search queries using savedbefore that somehow no message in any of the folders shows up with queries starting at 5d, even though there are much older messages. doveadm search mailbox Trash before 90d -A | wc -l 277 doveadm search mailbox Trash sentbefore 90d -A | wc -l 277 doveadm search mailbox Trash savedbefore 90d -A | wc -l 0 For my purpose, I'm not clear on the differences between the different queries and am wondering what will be the better option. Thank you, Paul

1 0

testing sieve/pigeonhole, auth errors
by Joe Acquisto 18 Jan '24

18 Jan '24

A small SOHO system, of installed perhaps a year. Seems to be working and wished to add pigeonhole/sieve. Per Pigeonhole/sieve troubleshooting in the docs, set on mail_debug = yes and this is what I see, upon launching Thunderbird as the client. Thought that "unknown user" and "permission denied" deserved attention before any other steps. Just the dialog for one user is pasted below. pid 475 is dovecot,vmail for dovecot imapd This is what I see for /proc/self/io blah #ll /proc/self/io -r-------- 1 root root 0 Jan 15 15:10 /proc/self/io Jan 15 14:53:35 auth-worker(22903): Info: conn unix:auth-worker (pid=22897,uid=475): auth-worker<1>: pam(me(a)here.com,192.168.11.166,<RbZgXgEPUKbAqAum>): unknown user Jan 15 14:53:35 auth-worker(22901): Info: conn unix:auth-worker (pid=22897,uid=475): auth-worker<4>: passwd(me(a)here.com,192.168.11.166,<RbZgXgEPUKbAqAum>): unknown user Jan 15 14:53:35 imap-login: Info: Login: user=<me(a)here.com>, method=PLAIN, rip=192.168.11.166, lip=192.168.0.225, mpid=22907, session=<RbZgXgEPUKbAqAum> Jan 15 14:53:35 imap(me(a)here.com)<22907><RbZgXgEPUKbAqAum>: Debug: Effective uid=100, gid=1000, home=/home/vmail/me(a)here.com Jan 15 14:53:35 imap(me(a)here.com)<22907><RbZgXgEPUKbAqAum>: Debug: open(/proc/self/io) failed: Permission denied Jan 15 14:53:35 imap(me(a)here.com)<22907><RbZgXgEPUKbAqAum>: Debug: Namespace inbox: type=private, prefix=, sep=, inbox=yes, hidden=no, list=yes, subscriptions=yes location=maildir:~/ Maildir Jan 15 14:53:35 imap(me(a)here.com)<22907><RbZgXgEPUKbAqAum>: Debug: maildir++: root=/home/vmail/me(a)here.com/Maildir, index=, indexpvt=, control=, inbox=/home/vmail/joea@j4com puters.com/Maildir, alt= Jan 15 14:53:35 auth-worker(22904): Info: conn unix:auth-worker (pid=22897,uid=475): auth-worker<1>: pam(me(a)here.com,192.168.11.166,<d7VgXgEPTqbAqAum>): unknown user Jan 15 14:53:35 auth-worker(22901): Info: conn unix:auth-worker (pid=22897,uid=475): auth-worker<5>: passwd(me(a)here.com,192.168.11.166,<d7VgXgEPTqbAqAum>): unknown user Jan 15 14:53:35 imap-login: Info: Login: user=<me(a)here.com>, method=PLAIN, rip=192.168.11.166, lip=192.168.0.225, mpid=22908, session=<d7VgXgEPTqbAqAum> Jan 15 14:53:35 imap(me(a)here.com)<22908><d7VgXgEPTqbAqAum>: Debug: Effective uid=100, gid=1000, home=/home/vmail/me(a)here.com Jan 15 14:53:35 imap(me(a)here.com)<22908><d7VgXgEPTqbAqAum>: Debug: open(/proc/self/io) failed: Permission denied Jan 15 14:53:35 imap(me(a)here.com)<22908><d7VgXgEPTqbAqAum>: Debug: Namespace inbox: type=private, prefix=, sep=, inbox=yes, hidden=no, list=yes, subscriptions=yes location=maildir:~/ Maildir Jan 15 14:53:35 imap(me(a)here.com)<22908><d7VgXgEPTqbAqAum>: Debug: maildir++: root=/home/vmail/me(a)here.com/Maildir, index=, indexpvt=, control=, inbox=/home/vmail/joea@j4com puters.com/Maildir, alt= Jan 15 14:53:36 imap(joea(a)acquisto-us.com)<22906><fwJdXgEPQKbAqAum>: Debug: Mailbox INBOX: Mailbox opened Jan 15 14:53:36 imap(me(a)here.com)<22907><RbZgXgEPUKbAqAum>: Debug: Mailbox INBOX: Mailbox opened Jan 15 14:53:37 imap(joea(a)acquisto-us.com)<22906><fwJdXgEPQKbAqAum>: Debug: Mailbox INBOX: UID 13710: Opened mail because: prefetch A small SOHO system, of installed perhaps a year. Seems to be working and wished to add pigeonhole/sieve. Per Pigeonhole/sieve troubleshooting in the docs, set on mail_debug = yes and this is what I see, upon launching Thunderbird as the client. Thought that "unknown user" and "permission denied" deserved attention before any other steps. Just the dialog for one user is pasted below. pid 475 is dovecot,vmail for dovecot imapd This is what I see for /proc/self/io blah # ll /proc/self/io -r-------- 1 root root 0 Jan 15 15:10 /proc/self/io Jan 15 14:53:35 auth-worker(22903): Info: conn unix:auth-worker (pid=22897,uid=475): auth-worker<1>: pam (me(a)here.com,192.168.11.166,<RbZgXgEPUKbAqAum>): unknown user Jan 15 14:53:35 auth-worker(22901): Info: conn unix:auth-worker (pid=22897,uid=475): auth-worker<4>: passwd (me(a)here.com,192.168.11.166,<RbZgXgEPUKbAqAum>): unknown user Jan 15 14:53:35 imap-login: Info: Login: user=<me(a)here.com>, method=PLAIN, rip=192.168.11.166, lip=192.168.0.225, mpid=22907, session=<RbZgXgEPUKbAqAum> Jan 15 14:53:35 imap(me(a)here.com)<22907><RbZgXgEPUKbAqAum>: Debug: Effective uid=100, gid=1000, home=/home/vmail/me(a)here.com Jan 15 14:53:35 imap(me(a)here.com)<22907><RbZgXgEPUKbAqAum>: Debug: open(/proc/ self/io) failed: Permission denied Jan 15 14:53:35 imap(me(a)here.com)<22907><RbZgXgEPUKbAqAum>: Debug: Namespace inbox: type=private, prefix=, sep=, inbox=yes, hidden=no, list=yes, subscriptions=yes location=maildir:~/ Maildir Jan 15 14:53:35 imap(me(a)here.com)<22907><RbZgXgEPUKbAqAum>: Debug: maildir++: root=/home/vmail/me(a)here.com/Maildir, index=, indexpvt=, control=, inbox=/home/ vmail/joea@j4com puters.com/Maildir, alt= Jan 15 14:53:35 auth-worker(22904): Info: conn unix:auth-worker (pid=22897,uid=475): auth-worker<1>: pam (me(a)here.com,192.168.11.166,<d7VgXgEPTqbAqAum>): unknown user Jan 15 14:53:35 auth-worker(22901): Info: conn unix:auth-worker (pid=22897,uid=475): auth-worker<5>: passwd (me(a)here.com,192.168.11.166,<d7VgXgEPTqbAqAum>): unknown user Jan 15 14:53:35 imap-login: Info: Login: user=<me(a)here.com>, method=PLAIN, rip=192.168.11.166, lip=192.168.0.225, mpid=22908, session=<d7VgXgEPTqbAqAum> Jan 15 14:53:35 imap(me(a)here.com)<22908><d7VgXgEPTqbAqAum>: Debug: Effective uid=100, gid=1000, home=/home/vmail/me(a)here.com Jan 15 14:53:35 imap(me(a)here.com)<22908><d7VgXgEPTqbAqAum>: Debug: open(/proc/ self/io) failed: Permission denied Jan 15 14:53:35 imap(me(a)here.com)<22908><d7VgXgEPTqbAqAum>: Debug: Namespace inbox: type=private, prefix=, sep=, inbox=yes, hidden=no, list=yes, subscriptions=yes location=maildir:~/ Maildir Jan 15 14:53:35 imap(me(a)here.com)<22908><d7VgXgEPTqbAqAum>: Debug: maildir++: root=/home/vmail/me(a)here.com/Maildir, index=, indexpvt=, control=, inbox=/home/ vmail/joea@j4com puters.com/Maildir, alt= Jan 15 14:53:36 imap(joea(a)acquisto-us.com)<22906><fwJdXgEPQKbAqAum>: Debug: Mailbox INBOX: Mailbox opened Jan 15 14:53:36 imap(me(a)here.com)<22907><RbZgXgEPUKbAqAum>: Debug: Mailbox INBOX: Mailbox opened Jan 15 14:53:37 imap(joea(a)acquisto-us.com)<22906><fwJdXgEPQKbAqAum>: Debug: Mailbox INBOX: UID 13710: Opened mail because: prefetch

3 4

Re: [EXT] Re: Dovecot imap-hibernate errors in 2.3.21
by Aki Tuomi 18 Jan '24

18 Jan '24

Can you send `doveconf -n`? I think it might be related to the separete user accounts somehow. Aki > On 18/01/2024 09:45 EET Lucas Rolff <lucas(a)lucasrolff.com> wrote: > > > SELinux runs in permissive mode on the system (so doesn't take action, and no violations are logged either), the OS specifically is Oracle Linux 8.9, the only main thing that differs from RHEL or eg rocky/almalinux is I use the newer oracle kernel they release, but shouldn't have any effect > > > The only "special" thing being that mail users are isolated on their own Linux user (a domain will result in a local Linux user being created), but that's about it. > There's nothing with eg virtualized file systems or anything like that, that would result in per user mount points as well > > > Sent from Outlook for iOS (https://aka.ms/o0ukef) > ------------------------------ > From: Aki Tuomi <aki.tuomi(a)open-xchange.com> > Sent: Thursday, January 18, 2024 8:37:07 AM > To: Lucas Rolff <lucas(a)lucasrolff.com>; dovecot(a)dovecot.org <dovecot(a)dovecot.org> > Subject: Re: Dovecot imap-hibernate errors in 2.3.21 > Did you check if maybe selinux is interfering here? I tested the 2.3.21-CE in a RHEL7 VM and hibernation seems to work there. > > Aki > > > On 17/01/2024 22:51 EET lucas(a)lucasrolff.com wrote: > > > > > > Thanks for your reply Aki! > > > > It doesn't seem to contain much more information sadly that points towards anything related to hibernate itself. > > "Debug: open(/proc/self/io) failed: Permission denied" being the main "thing" that seems a bit odd, but that also happens under 2.3.20 as well by the looks of it: > > > > ``` > > Jan 17 20:42:16 de-mail01 dovecot[3631433]: imap-login: Login: user=<customer(a)example.com>, method=PLAIN, rip=193.36.xx.xx, lip=176.9.151.xxx, mpid=3631534, TLS, session=<JVYMV8gOq5vBJIOe> > > Jan 17 20:42:16 de-mail01 dovecot[3631433]: imap(customer(a)example.com)<3631534><JVYMV8gOq5vBJIOe>: Debug: Loading modules from directory: /usr/lib64/dovecot > > Jan 17 20:42:16 de-mail01 dovecot[3631433]: imap(customer(a)example.com)<3631534><JVYMV8gOq5vBJIOe>: Debug: Module loaded: /usr/lib64/dovecot/lib10_quota_plugin.so > > Jan 17 20:42:16 de-mail01 dovecot[3631433]: imap(customer(a)example.com)<3631534><JVYMV8gOq5vBJIOe>: Debug: Module loaded: /usr/lib64/dovecot/lib11_imap_quota_plugin.so > > Jan 17 20:42:16 de-mail01 dovecot[3631433]: imap(customer(a)example.com)<3631534><JVYMV8gOq5vBJIOe>: Debug: Module loaded: /usr/lib64/dovecot/lib20_fts_plugin.so > > Jan 17 20:42:16 de-mail01 dovecot[3631433]: imap(customer(a)example.com)<3631534><JVYMV8gOq5vBJIOe>: Debug: Module loaded: /usr/lib64/dovecot/lib20_quota_clone_plugin.so > > Jan 17 20:42:16 de-mail01 dovecot[3631433]: imap(customer(a)example.com)<3631534><JVYMV8gOq5vBJIOe>: Debug: Module loaded: /usr/lib64/dovecot/lib20_zlib_plugin.so > > Jan 17 20:42:16 de-mail01 dovecot[3631433]: imap(customer(a)example.com)<3631534><JVYMV8gOq5vBJIOe>: Debug: Module loaded: /usr/lib64/dovecot/lib21_fts_solr_plugin.so > > Jan 17 20:42:16 de-mail01 dovecot[3631433]: imap(customer(a)example.com)<3631534><JVYMV8gOq5vBJIOe>: Debug: Added userdb setting: mail=mdbox:~/mail/example.com/customer/ > > Jan 17 20:42:16 de-mail01 dovecot[3631433]: imap(customer(a)example.com)<3631534><JVYMV8gOq5vBJIOe>: Debug: Added userdb setting: plugin/quota_rule=*:bytes=10240M > > Jan 17 20:42:16 de-mail01 dovecot[3631433]: imap(customer(a)example.com)<3631534><JVYMV8gOq5vBJIOe>: Debug: Effective uid=1098, gid=1098, home=/home/username/ > > Jan 17 20:42:16 de-mail01 dovecot[3631433]: imap(customer(a)example.com)<3631534><JVYMV8gOq5vBJIOe>: Debug: Quota root: name=User quota backend=count args= > > Jan 17 20:42:16 de-mail01 dovecot[3631433]: imap(customer(a)example.com)<3631534><JVYMV8gOq5vBJIOe>: Debug: Quota rule: root=User quota mailbox=* bytes=10737418240 messages=0 > > Jan 17 20:42:16 de-mail01 dovecot[3631433]: imap(customer(a)example.com)<3631534><JVYMV8gOq5vBJIOe>: Debug: Quota grace: root=User quota bytes=1073741824 (10%) > > Jan 17 20:42:16 de-mail01 dovecot[3631433]: imap(customer(a)example.com)<3631534><JVYMV8gOq5vBJIOe>: Debug: dict(proxy): dict created (uri=proxy::sqlquota, base_dir=/run/dovecot) > > Jan 17 20:42:16 de-mail01 dovecot[3631433]: imap(customer(a)example.com)<3631534><JVYMV8gOq5vBJIOe>: Debug: open(/proc/self/io) failed: Permission denied > > Jan 17 20:42:16 de-mail01 dovecot[3631433]: imap(customer(a)example.com)<3631534><JVYMV8gOq5vBJIOe>: Debug: Namespace inbox: type=private, prefix=, sep=, inbox=yes, hidden=no, list=yes, subscriptions=yes location=mdbox:~/mail/example.com/customer/ > > Jan 17 20:42:16 de-mail01 dovecot[3631433]: imap(customer(a)example.com)<3631534><JVYMV8gOq5vBJIOe>: Debug: fs: root=/home/username//mail/example.com/customer, index=, indexpvt=, control=, inbox=, alt= > > Jan 17 20:42:16 de-mail01 dovecot[3631433]: imap(customer(a)example.com)<3631534><JVYMV8gOq5vBJIOe>: Debug: quota: quota_over_flag check: quota_over_script unset - skipping > > Jan 17 20:42:17 de-mail01 dovecot[3631433]: imap(customer(a)example.com)<3631534><JVYMV8gOq5vBJIOe>: Debug: Mailbox INBOX: Mailbox opened > > Jan 17 20:42:17 de-mail01 dovecot[3631433]: imap(customer(a)example.com)<3631534><JVYMV8gOq5vBJIOe>: Debug: Mailbox INBOX: Mailbox opened > > Jan 17 20:42:49 de-mail01 dovecot[3631433]: imap-hibernate: Error: conn unix:imap-hibernate (pid=3631534,uid=1098): IMAP client fd not received > > Jan 17 20:42:49 de-mail01 dovecot[3631433]: imap(customer(a)example.com)<3631534><JVYMV8gOq5vBJIOe>: Error: Couldn't hibernate imap client: /run/dovecot/imap-hibernate disconnected > > Jan 17 20:43:16 de-mail01 dovecot[3631433]: imap(customer(a)example.com)<3631534><JVYMV8gOq5vBJIOe>: Debug: Mailbox INBOX: Mailbox opened > > Jan 17 20:43:49 de-mail01 dovecot[3631433]: imap-hibernate: Error: conn unix:imap-hibernate (pid=3631534,uid=1098): IMAP client fd not received > > Jan 17 20:43:49 de-mail01 dovecot[3631433]: imap(customer(a)example.com)<3631534><JVYMV8gOq5vBJIOe>: Error: Couldn't hibernate imap client: /run/dovecot/imap-hibernate disconnected > > Jan 17 20:44:16 de-mail01 dovecot[3631433]: imap(customer(a)example.com)<3631534><JVYMV8gOq5vBJIOe>: Debug: Mailbox INBOX: Mailbox opened > > Jan 17 20:44:49 de-mail01 dovecot[3631433]: imap-hibernate: Error: conn unix:imap-hibernate (pid=3631534,uid=1098): IMAP client fd not received > > Jan 17 20:44:49 de-mail01 dovecot[3631433]: imap(customer(a)example.com)<3631534><JVYMV8gOq5vBJIOe>: Error: Couldn't hibernate imap client: /run/dovecot/imap-hibernate disconnected > > Jan 17 20:45:16 de-mail01 dovecot[3631433]: imap(customer(a)example.com)<3631534><JVYMV8gOq5vBJIOe>: Debug: Mailbox INBOX: Mailbox opened > > Jan 17 20:45:49 de-mail01 dovecot[3631433]: imap-hibernate: Error: conn unix:imap-hibernate (pid=3631534,uid=1098): IMAP client fd not received > > Jan 17 20:45:49 de-mail01 dovecot[3631433]: imap(customer(a)example.com)<3631534><JVYMV8gOq5vBJIOe>: Error: Couldn't hibernate imap client: /run/dovecot/imap-hibernate disconnected > > Jan 17 20:46:16 de-mail01 dovecot[3631433]: imap(customer(a)example.com)<3631534><JVYMV8gOq5vBJIOe>: Debug: Mailbox INBOX: Mailbox opened > > Jan 17 20:46:49 de-mail01 dovecot[3631433]: imap-hibernate: Error: conn unix:imap-hibernate (pid=3631534,uid=1098): IMAP client fd not received > > Jan 17 20:46:49 de-mail01 dovecot[3631433]: imap(customer(a)example.com)<3631534><JVYMV8gOq5vBJIOe>: Error: Couldn't hibernate imap client: /run/dovecot/imap-hibernate disconnected > > ``` > > > > Best Regards, > > Lucas Rolff > > _______________________________________________ > > dovecot mailing list -- dovecot(a)dovecot.org > > To unsubscribe send an email to dovecot-leave(a)dovecot.org >

1 0

Dovecot imap-hibernate errors in 2.3.21
by lucas＠lucasrolff.com 18 Jan '24

18 Jan '24

Hello, I recently upgraded a Dovecot install from 2.3.20 to 2.3.21 from the 2.3-latest repository ( http://repo.dovecot.org/ce-2.3-latest/rhel/$releasever/RPMS/$basearch ) However since then, I seem to be getting: Jan 13 01:08:32 mail01 dovecot[3646235]: imap-login: Login: user=<user(a)example.com>, method=PLAIN, rip=35.243.xxx.xxx, lip=176.9.xxx.xxx, mpid=3646265, TLS, session=<o9jJlMgOFzMj86dT> Jan 13 01:09:03 mail01 dovecot[3646235]: imap-hibernate: Error: conn unix:imap-hibernate (pid=3646265,uid=1010): IMAP client fd not received Jan 13 01:09:03 mail01 dovecot[3646235]: imap(user(a)example.com)<3646265><o9jJlMgOFzMj86dT>: Error: Couldn't hibernate imap client: /run/dovecot/imap-hibernate disconnected This seems to be the case for every email-account on the system. Related configs: 20-imap.conf: protocol imap { imap_hibernate_timeout = 30s imap_idle_notify_interval = 24 mins mail_plugins = $mail_plugins imap_quota quota_clone zlib fts fts_solr mail_max_userip_connections = 20 } 10-master.conf: service imap { # Most of the memory goes to mmap()ing files. You may need to increase this # limit if you have huge mailboxes. #vsz_limit = $default_vsz_limit unix_listener imap-master { user = $default_internal_user } extra_groups = $default_internal_group } service imap-hibernate { unix_listener imap-hibernate { mode = 0660 group = $default_internal_group } } 10-metrics.conf event_exporter log { format = json format_args = time-rfc3339 transport = log } metric hibernation_logging { exporter = log filter = event=imap_client_hibernated OR event=imap_client_unhibernated } socket: $ stat /run/dovecot/imap-hibernate File: /run/dovecot/imap-hibernate Size: 0 Blocks: 0 IO Block: 4096 socket Device: 19h/25d Inode: 48551407 Links: 1 Access: (0660/srw-rw----) Uid: ( 0/ root) Gid: ( 97/ dovecot) Context: system_u:object_r:dovecot_var_run_t:s0 Access: 2024-01-13 01:03:07.432084831 +0100 Modify: 2024-01-13 00:50:56.394662577 +0100 Change: 2024-01-13 00:50:56.394662577 +0100 Birth: - From the change log, I see the following: - imap-hibernate: If an IMAP client unhibernation timed out with "(version received)", the unhibernation could still have successfully finished later on and continued working normally. This was rather confusing, because imap-hibernate already logged that the client got disconnected. Avoid this by forcing the connection to shutdown on unhibernation timeout. By the looks of it, it seems hibernation never actually happens anymore as of the new version. Downgrading to version 2.3.20 again seems to make hibernation function again based on the event logs. In 2.3.21 I only see events being logged for `imap_client_hibernated` which matches the /run/dovecot/imap-hibernate disconnected: "error":"/run/dovecot/imap-hibernate disconnected" In 2.3.20 I get both imap_client_hibernated and imap_client_unhibernated events (that it happens and when idle_done is triggered). Thank you in advance!

2 3

Re: Multiple user attributes in LDAP userdb query strings
by Oucheou Hassan 17 Jan '24

17 Jan '24

Merci Merci

1 0

recipient delimiter option in dovecot
by André Rodier 17 Jan '24

17 Jan '24

Hello, all. Postfix allows me to configure multiple characters to be used as recipient delimiter. However, I don't see that in dovecot, it seems I can only use one character in recipient_delimiter ? Am I right ? Does dovecot would only let me use email+box(a)domain.com, or can I use other forms, for instance email~box(a)domain.com and email&box(a)domain.com ? Thanks. André -- 𝓐𝓡 - 𝐴𝑛𝑑𝑟𝑒 𝑅𝑜𝑑𝑖𝑒𝑟

2 1

Virtual folder with custom flags
by Kirill Korinsky 15 Jan '24

15 Jan '24

Greetings, I can't figure out how doesn it possible to create a virtual folder which contains mails which has falgs: \Flagged or any customers flag. For example I do have a test mail: mx2$ doas doveadm fetch -u kirill(a)korins.ky "mailbox flags" mailbox-guid fb9e821c7b778b658896000079e31c01 uid 67096 mailbox: Archive flags: \Flagged \Seen $NotJunk NotJunk $MailFlagBit0 $MailFlagBit2 Invoice mx2$ and virtual folder: mx2$ cat /etc/dovecot/virtual/Flagged/dovecot-virtual * -INBOX/Trash -INBOX/Trash/* -INBOX/Junk -INBOX/Junk/* flagged mx2$ If I unset flag \Flagged from that mail, it dissapear from the folder. So, how should I change definition to keep it here if it has user's specified flags like Invoice or ASAP or whatsoever? -- wbr, Kirill

2 1

Quota clone plugin - initial population of data
by John Fawcett 15 Jan '24

15 Jan '24

Hi while responding on a previous thread, I noticed in the documentation: https://doc.dovecot.org/configuration_manual/quota_clone_plugin/ "For example you might want to access everybody’s quota via Redis ... but you don’t store the Redis database permanently so it could become empty once in a while. " It aslo seems that the quota clone plugin propagates only quota changes. Putting both of these points together, you'll going to have missing quotas in redis if it is restarted. It will gradually get populated but only on basis of mailbox changes. Maybe there should be an initial load of all the quotas when dovecot starts, or could that be a performance issue? Maybe even doveadm quota recalc should propagate or contain an option to propage quotas so that even if it can't be done on dovecot startup, at least it can be done on demand by the administrator. John

1 0

ARM support
by Brad Koehn 15 Jan '24

15 Jan '24

Hey there, I was wondering if you’re planning to support ARM in your packages and/or Docker images. Right now I’m stuck on whatever ships with Debian for ARM64 architectures. Otherwise, suggestions how would I go about building them myself? In a modern build world, it’s fairly straightforward, especially with Docker to handle all the emulation. Thanks for such a great product! I’ve used Dovecot on my little server for over twenty years. — Brad Koehn Hey there, I was wondering if you’re planning to support ARM in your packages and/or Docker images. Right now I’m stuck on whatever ships with Debian for ARM64 architectures. Otherwise, suggestions how would I go about building them myself? In a modern build world, it’s fairly straightforward, especially with Docker to handle all the emulation. Thanks for such a great product! I’ve used Dovecot on my little server for over twenty years. — Brad Koehn

8 15

Custom map for quota
by Matt 15 Jan '24

15 Jan '24

Hi, I'm trying to setup quota with the following layout CREATE TABLE "domain" ( "id" INTEGER, "name" TEXT, "active" INTEGER DEFAULT 0, PRIMARY KEY("id"), UNIQUE("name") ) CREATE TABLE "address" ( "id" INTEGER, "localpart" TEXT NOT NULL, "domain_id" INTEGER NOT NULL, PRIMARY KEY("id"), UNIQUE("localpart","domain_id") ) CREATE TABLE "mailbox" ( "id" INTEGER, "address_id" INTEGER, "active" INTEGER DEFAULT 0, "password" TEXT, "quota_bytes" INTEGER DEFAULT 0, PRIMARY KEY("id") ) As I like to update the quota and I like to use a dict/map I'm not sure if I can update this following: map { pattern = priv/quota/storage table = maibox value_field = dummy fields { value_field = quota_bytes id = mailbox_id } mailbox_id will be queried using password_query using: "mailbox.id as mailbox_id" Using such map I hope to be able to use: SELECT quota_bytes FROM mailbox WHERE id = '$mailbox_id' INSERT INTO mailbox (quota_bytes) VALUES ('$value') ON DUPLICATE KEY UPDATE quota_bytes='$value' Can someone help me with this ? Hi, I'm trying to setup quota with the following layout CREATE TABLE "domain" ( "id" INTEGER, "name" TEXT, "active" INTEGER DEFAULT 0, PRIMARY KEY("id"), UNIQUE("name") ) CREATE TABLE "address" ( "id" INTEGER, "localpart" TEXT NOT NULL, "domain_id" INTEGER NOT NULL, PRIMARY KEY("id"), UNIQUE("localpart","domain_id") ) CREATE TABLE "mailbox" ( "id" INTEGER, "address_id" INTEGER, "active" INTEGER DEFAULT 0, "password" TEXT, "quota_bytes" INTEGER DEFAULT 0, PRIMARY KEY("id") ) As I like to update the quota and I like to use a dict/map I'm not sure if I can update this following: map { pattern = priv/quota/storage table = maibox value_field = dummy fields { value_field = quota_bytes id = mailbox_id } mailbox_id will be queried using password_query using: "mailbox.id as mailbox_id" Using such map I hope to be able to use: SELECT quota_bytes FROM mailbox WHERE id = '$mailbox_id' INSERT INTO mailbox (quota_bytes) VALUES ('$value') ON DUPLICATE KEY UPDATE quota_bytes='$value' Can someone help me with this ?

3 3

Panic: file index-search-result.c: line 132 (index_search_result_update_flags): assertion failed: (result->search_args->args == &search_arg)
by Markus Doits 14 Jan '24

14 Jan '24

Hello dovecot community, I hope you can help me with the following panic: --- Panic: file index-search-result.c: line 132 (index_search_result_update_flags): assertion failed: (result->search_args->args == &search_arg) Error: Raw backtrace: /usr/lib/dovecot/libdovecot.so.0(backtrace_append+0x46) [0x7f839a045846] -> /usr/lib/dovecot/libdovecot.so.0(backtrace_get+0x22) [0x7f839a045962] -> /usr/lib/dovecot/libdovecot.so.0(+0x10d81b) [0x7f839a05281b] -> /usr/lib/dovecot/libdovecot.so.0(+0x10d8b7) [0x7f839a0528b7] -> /usr/lib/dovecot/libdovecot.so.0(+0x5e2e2) [0x7f8399fa32e2] -> /usr/lib/dovecot/libdovecot-storage.so.0(+0x518a4) [0x7f839a1768a4] -> /usr/lib/dovecot/modules/lib20_virtual_plugin.so(virtual_storage_sync_init+0x274e) [0x7f8399ea4a9e] -> /usr/lib/dovecot/libdovecot-storage.so.0(mailbox_sync_init+0x5c) [0x7f839a192f9c] -> /usr/lib/dovecot/libdovecot-storage.so.0(mailbox_sync+0x39) [0x7f839a193039] -> /usr/lib/dovecot/libdovecot-storage.so.0(index_storage_get_status+0x37) [0x7f839a210467] -> /usr/lib/dovecot/modules/lib20_virtual_plugin.so(+0xc6c5) [0x7f8399e9f6c5] -> /usr/lib/dovecot/modules/lib20_fts_plugin.so(+0x145e2) [0x7f8399ee65e2] -> /usr/lib/dovecot/modules/lib01_acl_plugin.so(+0x10cb9) [0x7f8399f31cb9] -> /usr/lib/dovecot/libdovecot-storage.so.0(mailbox_get_status+0x64) [0x7f839a1935a4] -> dovecot/imap(imap_status_get+0x98) [0x55c63c180748] -> dovecot/imap(cmd_status+0x19e) [0x55c63c170a7e] -> dovecot/imap(command_exec+0xa4) [0x55c63c177444] -> dovecot/imap(+0x22392) [0x55c63c175392] -> dovecot/imap(+0x22444) [0x55c63c175444] -> dovecot/imap(client_handle_input+0x1bd) [0x55c63c17589d] -> dovecot/imap(client_input+0x74) [0x55c63c175e64] -> /usr/lib/dovecot/libdovecot.so.0(io_loop_call_io+0x6d) [0x7f839a06903d] -> /usr/lib/dovecot/libdovecot.so.0(io_loop_handler_run_internal+0x13a) [0x7f839a06a7aa] -> /usr/lib/dovecot/libdovecot.so.0(io_loop_handler_run+0x54) [0x7f839a0690e4] -> /usr/lib/dovecot/libdovecot.so.0(io_loop_run+0x40) [0x7f839a0692a0] -> /usr/lib/dovecot/libdovecot.so.0(master_service_run+0x17) [0x7f8399fd9ad7] -> dovecot/imap(main+0x570) [0x55c63c166d20] -> /lib/x86_64-linux-gnu/libc.so.6(+0x29d90) [0x7f8399c29d90] -> /lib/x86_64-linux-gnu/libc.so.6(__libc_start_main+0x80) [0x7f8399c29e40] -> dovecot/imap(_start+0x25) [0x55c63c166de5] Fatal: master: service(imap): child 793983 killed with signal 6 (core dumped) --- Happening on ubuntu 22.04, dovecot 2.3.21 from [this ubuntu ppa](https://launchpad.net/~patrickdk/+archive/ubuntu/production/+packages?… dovecot-core:amd64 1:2.3.21-0a~jammy dovecot-dev:amd64 1:2.3.21-0a~jammy dovecot-imapd:amd64 1:2.3.21-0a~jammy dovecot-ldap:amd64 1:2.3.21-0a~jammy dovecot-lmtpd:amd64 1:2.3.21-0a~jammy dovecot-sieve:amd64 1:2.3.21-0a~jammy dovecot-solr:amd64 1:2.3.21-0a~jammy --- I have this virtual mailbox configured: namespace { prefix = _/ separator = / location = virtual:~/Maildir/virtual:LAYOUT=maildir++:INDEX=~/Maildir/virtual } When I remove this mailbox, the error goes away - so it seems to be something with the virtual mailbox. As the fts provider I use [fts_flatcurve](https://slusarz.github.io/dovecot-fts-flatcurve), maybe this has something to do with it? Any help appreciated how to debug this further and maybe fix it. Thanks!

3 3

execute: /user/bin/checkpassword /user/libexec/dovecot/checkpassword-reply
by Steve Button 14 Jan '24

14 Jan '24

Hi, I have recently moved a dovecot installation from 2.2.36 on RHEL7.9 onto 2.3.20 on Amazon Linux 2023 and I'm now seeing the error message in the title relating to /usr/bin/checkpassword (which doesn't exist on either). This is a project that I've inherited, and I've never used dovecot previously. I've been searching around for a couple of days trying to figure this out. Running out of ideas. Here's a slightly redacted snippet from dovecot.log Jan 04 17:23:22 auth: Debug: checkpassword(redacted(a)redacted.redacted.local,127.0.0.1,<6uwL/SEOzpt/AAAB>): Performing passdb lookup Jan 04 17:23:22 auth: Debug: checkpassword(redacted(a)redacted.redacted.local,127.0.0.1,<6uwL/SEOzpt/AAAB>): execute: /usr/bin/checkpassword /usr/libexec/dovecot/checkpassword-reply Jan 04 17:23:22 auth: Fatal: execv(/usr/bin/checkpassword) failed: No such file or directory Jan 04 17:23:22 auth: Debug: checkpassword(redacted(a)redacted.redacted.local,127.0.0.1,<6uwL/SEOzpt/AAAB>): Received input: Jan 04 17:23:22 auth: Debug: checkpassword(redacted(a)redacted.redacted.local,127.0.0.1,<6uwL/SEOzpt/AAAB>): exit_status=84 Jan 04 17:23:22 auth: Error: checkpassword(redacted(a)redacted.redacted.local,127.0.0.1,<6uwL/SEOzpt/AAAB>): Child 106455 exited with status 84 Jan 04 17:23:22 auth: Debug: checkpassword(redacted(a)redacted.redacted.local,127.0.0.1,<6uwL/SEOzpt/AAAB>): Finished passdb lookup Jan 04 17:23:22 auth: Debug: auth(redacted(a)redacted.redacted.local,127.0.0.1,<6uwL/SEOzpt/AAAB>): Auth request finished Jan 04 17:23:24 auth: Debug: client passdb out: FAIL 1 user=redacted(a)redacted.redacted.local code=temp_fail Jan 04 17:23:24 imap-login: Info: Disconnected: Connection closed (auth service reported temporary failure): user=redacted(a)redacted.redacted.local, method=PLAIN, rip=127.0.0.1, lip=127.0.0.1, secured, session=<6uwL/SEOzpt/AAAB> Jan 04 17:23:24 auth: Debug: auth client connected (pid=106456) Jan 04 17:23:24 auth: Debug: client in: AUTH 1 PLAIN service=imap secured session=R5kq/SEO0Jt/AAAB lip=127.0.0.1 rip=127.0.0.1 lport=143 rport=39888 As part of the build process we overwrite the config files with ones which are presumably from a previous version. In particular there's an auth.conf file which contains :- !include auth-checkpassword.conf.ext and in turn that file contains the stanza :- passdb { driver = checkpassword args = /usr/bin/checkpassword } which is where I guess the problem lies. The thing is the config files are almost identical on both systems. Here's the dovecot -n output... [root@server dovecot]# dovecot -n # 2.3.20 (xyz675d): /etc/dovecot/dovecot.conf # OS: Linux 6.1.61-85.141.amzn2023.x86_64 x86_64 ext4 # Hostname: server...1a97d auth_debug = yes auth_verbose = yes disable_plaintext_auth = no first_valid_gid = 0 first_valid_uid = 0 listen = * log_path = /var/project/log/dovecot/dovecot.log mail_location = maildir:/var/mail/vhosts/%d/%n mail_privileged_group = mail mbox_write_locks = fcntl passdb { args = username_format=%u /etc/dovecot/users driver = passwd-file } passdb { args = /usr/bin/checkpassword driver = checkpassword } protocols = imap service auth { unix_listener auth-userdb \{ group = postfix mode = 0600 user = postfix } } ssl_cert = </etc/pki/dovecot/certs/dovecot.pem ssl_key = # hidden, use -P to show it userdb { args = uid=vmail gid=vmail home=/var/mail/vhosts/%d/%n driver = static } userdb { driver = prefetch } Hi, I have recently moved a dovecot installation from 2.2.36 on RHEL7.9 onto 2.3.20 on Amazon Linux 2023 and I'm now seeing the error message in the title relating to /usr/bin/checkpassword (which doesn't exist on either). This is a project that I've inherited, and I've never used dovecot previously. I've been searching around for a couple of days trying to figure this out. Running out of ideas. Here's a slightly redacted snippet from dovecot.log Jan 04 17:23:22 auth: Debug: checkpassword (redacted(a)redacted.redacted.local,127.0.0.1,<6uwL/SEOzpt/AAAB>): Performing passdb lookup Jan 04 17:23:22 auth: Debug: checkpassword (redacted(a)redacted.redacted.local,127.0.0.1,<6uwL/SEOzpt/AAAB>): execute: /usr/ bin/checkpassword /usr/libexec/dovecot/checkpassword-reply Jan 04 17:23:22 auth: Fatal: execv(/usr/bin/checkpassword) failed: No such file or directory Jan 04 17:23:22 auth: Debug: checkpassword (redacted(a)redacted.redacted.local,127.0.0.1,<6uwL/SEOzpt/AAAB>): Received input: Jan 04 17:23:22 auth: Debug: checkpassword (redacted(a)redacted.redacted.local,127.0.0.1,<6uwL/SEOzpt/AAAB>): exit_status=84 Jan 04 17:23:22 auth: Error: checkpassword (redacted(a)redacted.redacted.local,127.0.0.1,<6uwL/SEOzpt/AAAB>): Child 106455 exited with status 84 Jan 04 17:23:22 auth: Debug: checkpassword (redacted(a)redacted.redacted.local,127.0.0.1,<6uwL/SEOzpt/AAAB>): Finished passdb lookup Jan 04 17:23:22 auth: Debug: auth (redacted(a)redacted.redacted.local,127.0.0.1,<6uwL/SEOzpt/AAAB>): Auth request finished Jan 04 17:23:24 auth: Debug: client passdb out: FAIL 1 user=redacted(a)redacted.redacted.local code=temp_fail Jan 04 17:23:24 imap-login: Info: Disconnected: Connection closed (auth service reported temporary failure): user=redacted(a)redacted.redacted.local, method=PLAIN, rip=127.0.0.1, lip=127.0.0.1, secured, session=<6uwL/SEOzpt/AAAB> Jan 04 17:23:24 auth: Debug: auth client connected (pid=106456) Jan 04 17:23:24 auth: Debug: client in: AUTH 1 PLAIN service=imap secured session=R5kq/SEO0Jt/AAAB lip=127.0.0.1 rip=127.0.0.1 lport=143 rport=39888 As part of the build process we overwrite the config files with ones which are presumably from a previous version. In particular there's an auth.conf file which contains :- !include auth-checkpassword.conf.ext and in turn that file contains the stanza :- passdb { driver = checkpassword args = /usr/bin/checkpassword } which is where I guess the problem lies. The thing is the config files are almost identical on both systems. Here's the dovecot -n output... [root@server dovecot]# dovecot -n # 2.3.20 (xyz675d): /etc/dovecot/dovecot.conf # OS: Linux 6.1.61-85.141.amzn2023.x86_64 x86_64 ext4 # Hostname: server...1a97d auth_debug = yes auth_verbose = yes disable_plaintext_auth = no first_valid_gid = 0 first_valid_uid = 0 listen = * log_path = /var/project/log/dovecot/dovecot.log mail_location = maildir:/var/mail/vhosts/%d/%n mail_privileged_group = mail mbox_write_locks = fcntl passdb { args = username_format=%u /etc/dovecot/users driver = passwd-file } passdb { args = /usr/bin/checkpassword driver = checkpassword } protocols = imap service auth { unix_listener auth-userdb \{ group = postfix mode = 0600 user = postfix } } ssl_cert = </etc/pki/dovecot/certs/dovecot.pem ssl_key = # hidden, use -P to show it userdb { args = uid=vmail gid=vmail home=/var/mail/vhosts/%d/%n driver = static } userdb { driver = prefetch }

2 1

Unconfigurable 500 ms debounce on IMAP IDLE notifications
by Alex 14 Jan '24

14 Jan '24

Hello all, I have been investigating the reason for high end-to-end email delivery delay (>1 second to send a message to echo bot and receive a reply back) on a Postfix+Dovecot email server setup used to run the tests for Delta Chat core [1]. It appeared that most of the time was spent between the submission SMTP service accepting the mail for delivery and receiving an IDLE wakeup on the other side. Looking into the Dovecot source code, I found that all notifications from the storage to callbacks set up by IDLE are delayed by a debounce constant NOTIFY_DELAY_MSECS [2]. It appears to have been added in 2009 [3], but even before that Dovecot was only delivering notifications when a second-resolution timer is changed by at least 1, so IDLE notifications probably were delayed by half a second on average even before that. Commit message says "If the notification is done immediately, IDLE may not notice the change because it's not finished yet." This sounds like a workaround for some internal Dovecot bug. I have nevertheless tried to compile Dovecot with this constant reduced from 500 ms to 1 ms [4] and it resulted in exceptionally fast delivery without any problems caused to the Delta Chat core online test suite which is using this Postfix+Dovecot server accounts. We are running all the tests against this server and it appears to work fine. Round trip time for sending a message to an echo bot and receiving a reply back is reduced from 1.1 s to 0.2 s, which is easily visible in a chat app [5]. I wonder if this debounce delay was added as a workaround for an internal Dovecot bug or a client bug and is not necessary anymore. It does not seem to be useful for well-behaving clients because if necessary the client may debounce notifications on its side and postpone interrupting IDLE with "DONE". I would actually like to disable this delay completely on our server setup [6], as for chat it is common to receive multiple messages in a short period of time, e.g. when sending a message to a group and receiving multiple read receipts from currently active users. [1] https://github.com/deltachat/deltachat-core-rust/ [2] https://github.com/dovecot/core/blob/93a53a9d590f0220de28600f36a969cc38c314… [3] https://github.com/dovecot/core/commit/56fb5d09955b6097f77b341717fd9b70e9f1… [4] https://github.com/deltachat/chatmail/issues/72#issuecomment-1806645153 [5] https://delta.chat/assets/blog/nine-echo.mp4 [6] https://github.com/deltachat/chatmail Best regards, Alex

2 6

Lots of "dovecot: auth: Error: auth client 0 disconnected with 1 pending requests: EOF" errors in error.log
by Jay Sladojevic 14 Jan '24

14 Jan '24

I've recently upgraded to dovecot 2.3 and now my error.log is full of this message: dovecot: auth: Error: auth client 0 disconnected with 1 pending requests: EOF In earlier versions, this error was logged at a warning level. What is the rationale behind the elevation to error log level? May I suggest to revert this change? (fyi: the code in question is in /src/auth/auth-client-connection.c) static void auth_client_disconnected(struct auth_client_connection **_conn) { struct auth_client_connection *conn = *_conn; unsigned int request_count; int err; *_conn = NULL; if (conn->input->stream_errno != 0) err = conn->input->stream_errno; else if (conn->output->stream_errno != 0) err = conn->output->stream_errno; else err = 0; request_count = conn->request_handler == NULL ? 0 : auth_request_handler_get_request_count(conn->request_handler); if (request_count > 0) { e_error(conn->event, "auth client %u disconnected with %u " "pending requests: %s", conn->pid, request_count, err == 0 ? "EOF" : strerror(err)); } auth_client_connection_destroy(&conn); }

1 0

Redirects 550'd So why no SRS method
by Laura Steynes 05 Jan '24

05 Jan '24

Happy New Year! Now to Aki, Timo, Corr, why, when setting up mail forwarding, is sieve not automatically configuring rules for SRS, it has this ability for long time, yet dovecots sieve based forwarding just creates a plain old redirect "forward" resulting in,in 2024, 99% of forwarded emails getting rejected for failing SPF because it's not enabling the require or the rules needed for successful sender rewriting. Is this an oversight? and I suppose the bigger question is, when is it planned to be corrected to using SRS method? Happy New Year! Now to Aki, Timo, Corr, why, when setting up mail forwarding, is sieve not automatically configuring rules for SRS, it has this ability for long time, yet dovecots sieve based forwarding just creates a plain old redirect "forward" resulting in,in 2024, 99% of forwarded emails getting rejected for failing SPF because it's not enabling the require or the rules needed for successful sender rewriting. Is this an oversight? and I suppose the bigger question is, when is it planned to be corrected to using SRS method?

3 2

Piegonhole behaviour when redirect fails
by Aubry Jaquier 04 Jan '24

04 Jan '24

Hello, I noticed an unusual behavior of the implicit keep from pigeonhole when a redirect fails in a sieve script. For instance, with the sieve below, if the relay host is unavailable, dovecot will not accept the email and will respond with a tempfail. redirect "myaddress(a)domain.com"; stop; But if my sieve script has a fileinto inside (see the example below), dovecot will accept the message, copy the email in the INBOX and in the folder from the fileinto and write the following log "Execution of script filter.sieve failed, but implicit keep was successful" fileinto "Folder"; redirect "myaddress(a)domain.com"; stop; According to the RFC 5228, section 2.10.2 Implicit keep, the last example should not trigger an implicit keep but act like the first example. An implicit keep is performed if a message is not written to a mailbox, redirected to a new address, or explicitly thrown out. That is, if a fileinto, a keep, a redirect, or a discard is performed, an implicit keep is not. Does it look like a bug to you, or is this the intended behaviour ? Best regards, Aubry Hello, I noticed an unusual behavior of the implicit keep from pigeonhole when a redirect fails in a sieve script. For instance, with the sieve below, if the relay host is unavailable, dovecot will not accept the email and will respond with a tempfail. redirect "myaddress(a)domain.com"; stop; But if my sieve script has a fileinto inside (see the example below), dovecot will accept the message, copy the email in the INBOX and in the folder from the fileinto and write the following log "Execution of script filter.sieve failed, but implicit keep was successful" fileinto "Folder"; redirect "myaddress(a)domain.com"; stop; According to the RFC 5228, section 2.10.2 Implicit keep, the last example should not trigger an implicit keep but act like the first example. An implicit keep is performed if a message is not written to a mailbox, redirected to a new address, or explicitly thrown out. That is, if a fileinto, a keep, a redirect, or a discard is performed, an implicit keep is not. Does it look like a bug to you, or is this the intended behaviour ? Best regards, Aubry

2 1

Autocreate virtual users' home directory?
by John Fawcett 04 Jan '24

04 Jan '24

Hi I have recently rectified an old configuration error whereby I had virtual users' home and mail directories set to the same value. I used option 3 from "ways to set up home directory" https://doc.dovecot.org/configuration_manual/home_directories_for_virtual_u… so I have: home= |/var/vmail/domain/user/home/| mail= |/var/vmail/domain/user/| |where domain and user are substituted for the real domain and user.| For existing users where I created the home directory when migrating the settings, there is no issue. But I am seeing errors like this for new users: lmtp(test(a)example.com)<125035><EHDOAyS1lWVr6AEAjpgUYA>: Error: autoexpunge: Couldn't create dovecot.autoexpunge.lock lock: file_create_locked(/var/vmail/example.com/test@example.com/home//dovecot.au… failed: safe_mkstemp(/var/vmail/example.com/test@example.com/home//dovecot.autoexpu… failed: No such file or directory Seems that differently to mail directory which is automatically created, the home directory is not created. I couldn't see any config setting that would autocreate home directories (where home directories are subdirectories of mail directories). Would it be worthwhile introducing an autocreate option for home directories? John Hi I have recently rectified an old configuration error whereby I had virtual users' home and mail directories set to the same value. I used option 3 from "ways to set up home directory" https://doc.dovecot.org/configuration_manual/ home_directories_for_virtual_users/ so I have: home= /var/vmail/domain/user/home/ mail= /var/vmail/domain/user/ where domain and user are substituted for the real domain and user. For existing users where I created the home directory when migrating the settings, there is no issue. But I am seeing errors like this for new users: lmtp(test(a)example.com)<125035><EHDOAyS1lWVr6AEAjpgUYA>: Error: autoexpunge: Couldn't create dovecot.autoexpunge.lock lock: file_create_locked(/var/vmail/ example.com/test@example.com/home//dovecot.autoexpunge.lock) failed: safe_mkstemp(/var/vmail/example.com/test@example.com/home// dovecot.autoexpunge.lock) failed: No such file or directory Seems that differently to mail directory which is automatically created, the home directory is not created. I couldn't see any config setting that would autocreate home directories (where home directories are subdirectories of mail directories). Would it be worthwhile introducing an autocreate option for home directories? John

2 2

Solr/Tika patches for dovecot 2.3.21
by John Fawcett 03 Jan '24

03 Jan '24

Hi I've just made updated versions of 3 patches against the latest release 2.3.21 in case they are useful to someone or might get considered for official inclusion. John *dovecot-2.3.21-tika-http-auth.patch* Allows specification of username and password in the fts_tika setting for basic auth against tika server. For example fts_tika = https://user:password@tika_server:443/tika *dovecot-2.3.21-solr-max-size.patch * This is a simplified version of my previous patch. Sets a size limit (configuration fts_max_size) on message bodies that are to be indexed. Message bodies for messages larger than fts_max_size are not sent to solr. Defaults to zero which means no limit. For example fts_max_size = 10M *dovecot-2.3.21-solr-max-rows.patch * When dovecot sends a search to solr it uses the rows parameter. For multiple mailbox search the value used is SOLR_MAX_MULTI_ROWS , hardcoded to 100000. For single mailbox search the value is uidnext. This patch introduces an upper limit for single mailbox search using the same value as SOLR_MAX_MULTI_ROWS, while leaving the existing functionality of sending the uidnext value if it is smaller. This is just to place a more reasonable upper bound since uidnext can get much larger. Hi I've just made updated versions of 3 patches against the latest release 2.3.21 in case they are useful to someone or might get considered for official inclusion. John dovecot-2.3.21-tika-http-auth.patch Allows specification of username and password in the fts_tika setting for basic auth against tika server. For example fts_tika = https://user:password@tika_server:443/tika dovecot-2.3.21-solr-max-size.patch This is a simplified version of my previous patch. Sets a size limit (configuration fts_max_size) on message bodies that are to be indexed. Message bodies for messages larger than fts_max_size are not sent to solr. Defaults to zero which means no limit. For example fts_max_size = 10M dovecot-2.3.21-solr-max-rows.patch When dovecot sends a search to solr it uses the rows parameter. For multiple mailbox search the value used is SOLR_MAX_MULTI_ROWS , hardcoded to 100000. For single mailbox search the value is uidnext. This patch introduces an upper limit for single mailbox search using the same value as SOLR_MAX_MULTI_ROWS, while leaving the existing functionality of sending the uidnext value if it is smaller. This is just to place a more reasonable upper bound since uidnext can get much larger.

2 2

how to take mdbox extract of time interval and restore that again?
by lutz.niederer＠gmx.net 03 Jan '24

03 Jan '24

Hi! Due to a fatal hardware error we have to extract data of all existing imap accounts and all their boxes/folders etc. from an mdbox store starting with the 5th of december until today. Then we have to restore the old system and import the data back into it. Mail before 5th will come from the system backup, newer mail from that export. After that it may be possible that some/few mails may exist twice in the boxes, but that's ok. 1. What would be the command line for doveadm to extract everything starting the 5th? I find that the command line for doveadm is pretty complicated. I tried but I am not sure if I really got all mails exported. So I would like to ask if someone with much more experience can give me a command line that surely does what we want. The command will be run from a remote machine. 2. And what would be the command line to restore all the mails that we have exported back into the system? (The folder and account structure is the same.) 3. After that some of the mails may exist twice. Is that a problem, maybe because of internal IDs? 4. Are there any other things we need to be aware of when doing that? I thank you very much for your help! Cheers! -lutzn

2 1

Broken Docs
by Peter 02 Jan '24

02 Jan '24

The page: https://doc.dovecot.org/configuration_manual/protocols/lmtp_server/ ... has links to the old dovecot wiki which are now broken, specifically the Postfix and Exim links at the bottom of the page. Can someone please port those pages over to the docs and fix the links? Peter

2 1

Certificate of the documentation site (https://doc.dovecot.org/)
by gileh13242＠vasteron.com 02 Jan '24

02 Jan '24

Hey ! Your certificate expired today, I can't access it because of my business proxy :). [No Error] (TLS code: X509_V_ERR_CERT_HAS_EXPIRED) SSL Certificate expired on: Jan 2 06:31:02 2024 GMT Have a nice day !

2 1

A bug and a misleading description
by David Van Edwards 01 Jan '24

01 Jan '24

!. I have just tried deleting Sent messages and when I put the search string 1:200 in only one message was deleted. And when I put in 1:500 again only one message was deleted. In both cases a green message box came up saying the operation was successful. 2. I successfully deleted 1000 messages from my Inbox using the search string 1:1000 but it was not clear to me that this would delete the 1000 most RECENT emails, not as I imagined the FIRST 1000 emails counting from the beginning. Is that the case? It certainly seems to have been the result and it’s rather upsetting. Should your documentation make it clear whether 1:1000 is counting forwards or backwards? Best wishes, David David Van Edwards The Smokehouse 6 Whitwell Road, Norwich NR1 4HB 01603 629899 david(a)vanedwards.co.uk https://www.vanedwards.co.uk

2 1

Authentication failure due to address space limit
by Max Nikulin 26 Dec '23

26 Dec '23

Hi, I faced an error that appeared rather obscure at first, so I am trying to figure out if something can be improved. I have managed to solve the issue. I am running a Dovecot IMAP server to keep my personal mail archive. This server does not receive or send mail, just IMAP access. There was no reason to tune its performance, so its configuration is close to what Debian package has out of the box (actually doc/example-config). At certain moment I started to get authentication failures: dovecot[72165]: auth-worker: Error: fatal error: failed to reserve page summary memory dovecot[72165]: auth-worker: Error: dovecot[72165]: auth-worker: Error: runtime stack: dovecot[72165]: auth-worker: Error: runtime.throw({0x7f552c418194?, 0x7f552c1feb10?}) dovecot[72165]: auth-worker: Error: runtime/panic.go:1047 +0x5f fp=0x7f552c1feac0 sp=0x7f552c1fea90 pc=0x7f552c28a53f dovecot[72165]: auth-worker: Error: runtime.(*pageAlloc).sysInit(0x7f552c5f6fd0) dovecot[72165]: auth-worker: Error: runtime/mpagealloc_64bit.go:82 +0x195 fp=0x7f552c1feb48 sp=0x7f552c1feac0 pc=0x7f552c280ef5 dovecot[72165]: auth-worker: Error: runtime.(*pageAlloc).init(0x7f552c5f6fd0, 0x7f552c5f6fc0, 0x0?) dovecot[72165]: auth-worker: Error: runtime/mpagealloc.go:324 +0x70 fp=0x7f552c1feb70 sp=0x7f552c1feb48 pc=0x7f552c27eb50 dovecot[72165]: auth-worker: Error: runtime.(*mheap).init(0x7f552c5f6fc0) dovecot[72165]: auth-worker: Error: runtime/mheap.go:729 +0x13f fp=0x7f552c1feba8 sp=0x7f552c1feb70 pc=0x7f552c27bf5f dovecot[72165]: auth-worker: Error: runtime.mallocinit() dovecot[72165]: auth-worker: Error: runtime/malloc.go:407 +0xb2 fp=0x7f552c1febd0 sp=0x7f552c1feba8 pc=0x7f552c260e72 dovecot[72165]: auth-worker: Error: runtime.schedinit() dovecot[72165]: auth-worker: Error: runtime/proc.go:693 +0xab fp=0x7f552c1fec30 sp=0x7f552c1febd0 pc=0x7f552c28df0b dovecot[72165]: auth-worker: Error: runtime.rt0_go() dovecot[72165]: auth-worker: Error: runtime/asm_amd64.s:345 +0x120 fp=0x7f552c1fec38 sp=0x7f552c1fec30 pc=0x7f552c2b7c20 dovecot[72165]: auth: Error: auth-worker: Aborted PASSV request for mailuser: Worker process died unexpectedly dovecot[72165]: auth-worker: Fatal: master: service(auth-worker): child 72211 returned error 2 Such errors happen even for invalid users curl -v 'imap://bad:bad@localhost/' I have realized that it may be related to the pam_fscrypt plugin I had installed before. It is intended for another system user, so I did not expect any negative consequence on Dovecot. Disabling the module confirmed my guess. This PAM module is written in Go and language runtime requires almost 1G of address space (RLIMIT_AS) even when actual memory allocation is several times lower (the user has no configured login protector). https://github.com/golang/go/issues/38010 "runtime: high startup address space usage (RLIMIT_AS) on Linux AMD64" The code of the fscrypt PAM module has Go panic handlers, but this case error happens early during runtime initialization, so error handlers have not set yet and can not provide a more instructive error. I do not like that Go has no knobs like compile or link flags to prevent early allocation of rather large address space. At the same time I admit that doing garbage collection efficiently is tricky and unreasonable efforts may be required to allow modest address space at startup. Default Dovecot configuration has vsz_limit = $default_vsz_limit = 256M The following configuration snippet solves the issue: service auth-worker { # still crash, but later # vsz_limit = 800M vsz_limit = 1024M } I am realizing that my use case is rather specific. Mail and encrypted home directories are hardly compatible. However some other PAM modules may cause similar issues. Cgroup Linux kernel feature should allow to limit real memory usage and it should be better than per-process limits imposed on address space size. However assigning proper control groups for Dovecot processes may be not so trivial. I am unsure if auth-worker vsz_limit or default_vsz_limit should be raised in the example configuration. Do you think it is reasonable to add warnings concerning PAM plugins and vsz_limit to docs? I mean - https://doc.dovecot.org/configuration_manual/authentication/pam/ - https://doc.dovecot.org/configuration_manual/service_configuration/#auth-wo… in a similar way as it is done for Argon2 in https://doc.dovecot.org/configuration_manual/authentication/password_scheme… P.S. Debian 12 bookworm, Dovecot 1:2.3.19.1+dfsg1-2.1

2 4

Elevate Your Storytelling Experience with Start Motion Media
by petersthomas383＠gmail.com 19 Dec '23

19 Dec '23

Startmotionmedia.com Media, we specialize in crafting captivating visual narratives through expert video production services. Our dedicated team focuses on delivering compelling storytelling that resonates across diverse industries, creating impactful videos that leave a lasting impression. At Start Motion Media, our mission is to bring creativity to life. From conceptualization to production, we ensure each project reflects our commitment to excellence. Our portfolio showcases the artistry and skill behind Start Motion Media's captivating visual storytelling. Experience storytelling prowess firsthand by exploring <a href="https://www.startmotionmedia.com/can-web-development-be-a-side-hustle-for-s…">startmotionmedia</a>. Immerse yourself in our gallery of projects, witnessing the transformative power of visual narratives. Start Motion Media invites you to witness how storytelling unfolds through our lens, shaping brands and captivating audiences worldwide. For businesses seeking to amplify their narratives and engage audiences effectively, Start Motion Media is the answer. Harness the storytelling expertise of Start Motion Media to elevate your brand's story and make a lasting impact in the digital sphere.

1 0

Re-Enabling TLS1.1 in dovecot 2.3.16
by Nils 14 Dec '23

14 Dec '23

Hi, I'd like to re-enable TLS1.1 (at least temporary) to see if it fixes a problem with one of my clients. When I add "ssl_min_protocol = TLSv1.1" to either dovecot.conf or conf.d/10-ssl.conf it doesn't seem to have an effect. Still the client is not working. I used testssl.sh to check the available ssl versions and it says that tls1.1 is not offered: $ ./testssl.sh --starttls imap SERVERNAME.TLD:143 ... Service set: STARTTLS via IMAP Testing protocols via sockets SSLv2 not offered (OK) SSLv3 not offered (OK) TLS 1 not offered TLS 1.1 not offered TLS 1.2 offered (OK) TLS 1.3 offered (OK): final Kind regards, Nils

2 2

dovecot submission max line length
by Kees van Vloten 13 Dec '23

13 Dec '23

Hi all, After upgrading Debian Bullseye (Dovecot 2.3.13) to Bookworm (Dovcecot 2.3.19), submission-login returns an error on Kerberos authentication: "Client sent invalid command: Command line is too long". When I initially set this up on Bullseye I have seen the same issue, but adding "imap_max_line_length = 2M" solved it. Now with 2.3.19 kerberos authentication still works (with this setting) for imap connections but it stopped working for submission. Is there a new config setting for submission-login that I missed? Or is this a bug in 2.3.19? - Kees.

3 3

Username used by dovecot to access database certificate and key files
by John Fawcett 08 Dec '23

08 Dec '23

Hi does anyone happen to know the username under which dovecot accesses the certificate and key files when connecting to a mariadb database with ssl? I can't seem to get dovecot to read the files without a "other" readable bit set. I have dovecot users in mysql with the following connect string in dovecot-sql.conf.ext connect = host=x.x.x host=y.y.y host=z.z.z dbname=maildb user=mailuser password=xxxxxx \ ssl_ca=/etc/ssl/mysql/ca-cert.pem \ ssl_cert=/etc/ssl/mysql/client-cert.pem \ ssl_key=/etc/ssl/mysql/client-key.pem \ ssl_verify_server_cert=yes The certificate and key files in /etc/ssl/mysql/ are owned by root with group users: ls -l /etc/ssl/mysql total 12 -r--r--r--. 1 root root 2041 Jun 22 15:32 ca-cert.pem -r--r--r--. 1 root users 1907 Jun 22 15:32 client-cert.pem -r--r--r--. 1 root users 3272 Jun 22 15:32 client-key.pem For my test dovecot, dovenull and vmail are all members of group users: grep users /etc/group users:x:100:postfix,dovecot,dovenull,vmail If I remove the "other" readable attribute on the certificate and key files, dovecot complains it can't connect to the db server: auth: Error: mysql(x.x.x): Connect failed to database (maildb): TLS/SSL error: Permission denied (13) - waiting for 1 seconds before retry I realize it only adds marginal security to not have these files world readable, but still it is puzzling why dovecot cannot read them in that case. Can anyone see what I am missing? Thanks John

3 5

Unlocking Entertainment Excellence: Explore jGuru's Latest Netflix Series Guide
by Angelique Medina 08 Dec '23

08 Dec '23

Discover a digital haven at jgurucom, where entertainment expertise meets insightful curation. JGuru, a premier online destination, stands as a beacon for enthusiasts seeking the latest trends and in-depth knowledge. As a dynamic platform, jGuru transcends conventional boundaries, offering a plethora of resources for tech aficionados, gamers, and pop culture enthusiasts alike. Navigate through jGuru's diverse content to unearth gems like their comprehensive guide to the most anticipated Netflix series of 2022. Delve into the intricacies of storytelling, cinematography, and exclusive insights that make each series a must-watch. JGuru's commitment to excellence shines through in its meticulous coverage, establishing it as a go-to hub for all things entertainment. For an unparalleled experience, visit http://www.jguru.com/the-most-anticipated-netflix-series-2022/ – where entertainment aficionados converge to elevate their viewing journey. JGuru: Your Gateway to Entertainment Brilliance.

1 0

Compiler error
by Goetz Schultz 06 Dec '23

06 Dec '23

Hi, I have upgraded my system to FreeBSD14 and tried to recompile dovecot. The following error is thrown now (It did compile on FBSD13): <quote> test-mail-index-transaction-update.c:650:36: error: incompatible pointer to integer conversion passing 'char *(*)(int, int)' to parameter of type 'time_t' (aka 'long') [-Wint-conversion] mail_index_update_day_headers(t, tests[i].now + timezone); ^~~~~~~~~~~~~~~~~~~~~~~ </quote> (t, tests[i].now + timezone); ^~~~~~~~~~~~~~~~~~~~~~~ Is there a patch or something like that to compensate? -- Thanks and regards Goetz R Schultz ---------------->8---------------- Quis custodiet ipsos custodes? /"\ \ / ASCII Ribbon Campaign X against HTML e-mail / \ ----------------8<---------------- ---------------------------->8------------------------------ /"\ \ / ASCII Ribbon Campaign X against HTML e-mail / \ This message is transmitted on 100% recycled electrons. ---------------------------->8------------------------------ Unsigned message - no responsibillity that content is not altered

4 9

replicator: Panic: data stack: Out of memory when allocating 268435496 bytes
by Gerben Wierda 06 Dec '23

06 Dec '23

One step further in my quest to create a replacement mail server. I now have my old mail server (2.3.19.1, macOS + MacPorts) and my new (2.3.20, Alpine Linux, Docker, apk package). When I turn on replication it works, but, after a while I see: Jan 06 00:50:31 replicator: Panic: data stack: Out of memory when allocating 268435496 bytes Jan 06 00:50:32 replicator: Fatal: master: service(replicator): child 133 killed with signal 6 (core dumped) Jan 06 00:50:32 lmtp(pid 195 user sysbh): Warning: replication(sysbh): Sync failure: Jan 06 00:50:32 lmtp(pid 195 user sysbh): Warning: replication(sysbh): Remote sent invalid input: - I've removed synchronous operation for now (found a message on the net suggesting that) but is this known and what does it mean? Gerben Wierda (LinkedIn <https://www.linkedin.com/in/gerbenwierda>) R&A IT Strategy <https://ea.rna.nl/> (main site) Book: Chess and the Art of Enterprise Architecture <https://ea.rna.nl/the-book/> Book: Mastering ArchiMate <https://ea.rna.nl/the-book-edition-iii/>

6 15

Enhance Your Website Content: Logicsofts' Expert Tips
by Angelique Medina 04 Dec '23

04 Dec '23

Logicsofts, a leading web development company, is dedicated to empowering businesses through cutting-edge solutions. With a proven track record of creating visually appealing and functionally robust websites, Logicsofts stands out in the digital landscape. Their commitment to excellence extends to providing valuable insights through their blog. In a recent post https://www.logicsofts.co.uk/blog/how-to-write-website-content-rules-to-fol… , Logicsofts unravels the art of crafting compelling website content. The blog delves into essential rules for creating impactful content that resonates with your audience. Logicsofts emphasizes the significance of engaging and user-centric content to boost online presence and drive conversions. For businesses seeking to elevate their online game, Logicsofts' blog is a goldmine of practical advice. Implement the strategies outlined in the post to transform your website content and leave a lasting impression on your visitors. Explore the full article for a deep dive into the nuances of content creation - an invaluable resource for businesses striving to stay ahead in the digital realm.

1 0

auth_mechanisms per listener or local_name?
by Kees van Vloten 01 Dec '23

01 Dec '23

Hi all, I would like to use kerberos authentication on the local network but not for connections from internet, which are forwarded by haproxy. So both types of login can be distinguished by a different inet_listener and also a different by local_name. Is there a way to set auth_mechanisms such the it will impossible to use kerberos via haproxy connections or by filtering on local_name? - Kees.

1 0

client port int auth-worker log
by Joao Reis 29 Nov '23

29 Nov '23

Hello, Can the client's port number be included in the log entries generated by auth-worker, without needing to recompile Dovecot? Currently, the log entries look like this: |auth-worker(3538137): sql(user(a)domain.tld,123.123.123.123): Password mismatch | I would like the log entries to appear as follows: |auth-worker(3538137): sql(user(a)domain.tld,123.123.123.123,45343): Password mismatch | In this format, the client's port number (e.g., 45343) is also logged. thanks in advance. Hello, Can the client's port number be included in the log entries generated by auth- worker, without needing to recompile Dovecot? Currently, the log entries look like this: auth-worker(3538137): sql(user(a)domain.tld,123.123.123.123): Password mismatch I would like the log entries to appear as follows: auth-worker(3538137): sql(user(a)domain.tld,123.123.123.123,45343): Password mismatch In this format, the client's port number (e.g., 45343) is also logged. thanks in advance.

1 0

Re: Replication going away?
by Peter Wienemann 28 Nov '23

28 Nov '23

Hi, On 2023-11-28 16:20:56 +0100, gerben.wierda(a)rna.nl wrote: >From what version on is replication gone? I am running 2.3.20 and it still there. it will be gone from version 2.4/3.0 onward (see [0]). Best regards, Peter [0] https://doc.dovecot.org/3.0/installation_guide/upgrading/from-2.3-to-3.0

1 0

I've sent a question to dovecot@dovecot.org via mail. Why is it not ending up here?
by gerben.wierda＠rna.nl 28 Nov '23

28 Nov '23

This is what my postfix server says: Nov 28 14:23:12 albus postfix/qmgr[654]: 823D71CDE2714: from=<gerben.wierda(a)rna.nl>, size=9144, nrcpt=1 (que ue active) Nov 28 14:23:12 albus postfix/smtp[2294]: Untrusted TLS connection established to talvi.dovecot.org[94.237.1 05.223]:25: TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange ECDHE (prime256v1) server -signature RSA-PSS (2048 bits) server-digest SHA256 Nov 28 14:23:13 albus postfix/smtp[2294]: 823D71CDE2714: to=<dovecot(a)dovecot.org>, relay=talvi.dovecot.org[9 4.237.105.223]:25, delay=2.1, delays=0.51/0.02/0.75/0.83, dsn=2.0.0, status=sent (250 2.0.0 Ok: queued as E5 C425DEEF) Nov 28 14:23:13 albus postfix/qmgr[654]: 823D71CDE2714: removed But I can't see it here nor do I get it sent back to me.

1 0

OT? Maybe so, maybe no.
by joe a 27 Nov '23

27 Nov '23

Dovecot installation on OpenSuse LEAP 15.5. Works fine via Thunderbird. Roundcube install works great. Astonishing given my rusting skills. But only until . . . I try to send email. Then RoundCube tells me smtp error(): connection to server failed. Well, yeah, 'you're trying port 587, when I told you to use port 25. Whatareya, dense?'. Nah, yer just a machine, must be me. Posted on Roundcube board, views but no replies. Perhaps someone here knows what else I need to change besides: ~etc/roundcubemail/config.inc.php //$config['smtp_port'] = 587; $config['smtp_port'] = 25; I don't find any other relevant referenced to SMTP port in RC configuration.

2 5

Couldn't get vsize Issue
by duluxoz 26 Nov '23

26 Nov '23

Hi All, Looking for a little help, please. We're getting the following showing up in our dovecot logs: `Debug: Mailbox Junk: Couldn't get vsize from mailbox list index: Record for vsize`. This is happening for all(?) the different mailboxes We're not sure what we're looking at or looking for to even begin the t/shoot. I dropped the above into google but couldn't *seem* to find anything relevant. Would someone(s) be able to point me in the right direction as to what the actual issue is (ie some more in-depth detail than just the log message - yes, it may be obvious to some but not to me) and, more importantly, what to look at to get it resolved, please. :-) Thanks in advance Dulux-Oz

3 4

Re: How to temporarily make all mailboxes read-only for backup purposes?
by Matthias Nagel 26 Nov '23

26 Nov '23

I would like to avoid making a local deep copy first. This essentially doubles the required storage on the local disk and it also wears down the disk much faster as I will write gigabytes of data onto the disk every 24 hours. I would prefer an option which allows the backup program (Borg backup in my case) to only read the local data and send it to the remote backup space directly.

3 3

2 users who are the same user
by Michael Grant 26 Nov '23

26 Nov '23

I have been using system users (/etc/passwd). I recently started using, in addition, passwd-file with a separate dovecot password database so that I could have user@domainname users with a different password as their shell login password. This means I have dovecot authenticating on users in both /etc/passwd and /etc/dovecot/users. If I have a user in /etc/passwd, for example 'joe' and a user in /etc/dovecot/users, joe(a)example.org, and both of these users are in fact the same user but different password. They use the same inbox and the same mail files. Dovecot does not seem to like this very much. I am seeing many errors like this: Error: Mailbox INBOX: Sync failed for mbox: UID inserted in the middle of mailbox (4315358 > 4312144, seq=1, idx_msgs=3212) I think I'm causing this by having 2 users that are in fact the same user and dovecot is stepping on itself. Is it possible to tell Dovecot that these 2 users are in fact the same, as in like an alias user? Or is it possible to tell dovecot not to process mail for say for 'joe' the system user? Michael Grant

3 5

RE: How to temporarily make all mailboxes read-only for backup purposes?
by Matthias Nagel 25 Nov '23

25 Nov '23

> Why would you want to do that? Afaik sdbox stores email per file. There is also an index file which stores meta attributes per mail/file and I want them to be consistent. > The mta just delivers the email later and your backup is already old. That's not really am argument. Just imagine the mail would have been sent some moment later after the backup has been started. In that case the mail wouldn't be in the backup either. A backup on a regular schedule for catastrophe recovery always has the "issue" that it will be old by half the time of the schedule on average in case one really needs it. Regarding snapshots on ZFS an similar file system: Not an option as I am using a shared hoster and the file system does not allow snapshots. Am 22. November 2023 21:46:19 schrieb Marc <Marc(a)f1-outsourcing.eu>: > Why would you want to do that? Afaik sdbox stores email per file. The mta > just delivers the email later and your backup is already old. Are you > making a snapshot and backup that, that is a very short time window. > >> >> I am using Dovecot sdbox format for mailboxes. Is there an option to >> temporarily make Dovecot read-only while the mailboxes are being backed-up >> such that a consistent state is backed-up? >> >> I am looking for some command which I can use as pre- and post-hook for >> Borgbackup. I am looking for a way such that Dovecot defers any mail coming >> in via LMTP from Postfix, denies modifying mails/mailboxes via IMAP while >> Dovecot still allows to browse mails read-only.

2 1