- dovecot - dovecot.org

Dovecot replication - notify not working
by Jonas Plitt 08 Jan '15

08 Jan '15

Dear Dovecot-Admins, I've set up a pair of Dovecot Servers, please find config of server one attached. They are configured to replicate changes over a tcp connection using port 12345, set up as described in http://wiki2.dovecot.org/Replication article page. Adding the user postboxes to replication using "doveadm replicator add '*' " syncs the mailboxes as expected. Unfortunately both of the servers does not propagate any changes, e.G. new mail in Sent folder. Removing and adding the mailboxes again syncs them again. Can anybody help me to get the notify working, please? many thanks in advance, Jonas

1 0

replication hangs
by Laszlo Toth 08 Jan '15

08 Jan '15

Hi, I have 2 Dovecot servers (2.2.10) which are replicating each other. Replication works fine except for one user. [root@dovecot2 ~]# doveadm -D sync -u username dovecot1 doveadm(root): Debug: Loading modules from directory: /usr/lib64/dovecot doveadm(root): Debug: Module loaded: /usr/lib64/dovecot/lib15_notify_plugin.so doveadm(root): Debug: Module loaded: /usr/lib64/dovecot/lib20_replication_plugin.so doveadm(root): Debug: Loading modules from directory: /usr/lib64/dovecot/doveadm doveadm(root): Debug: Skipping module doveadm_acl_plugin, because dlopen() failed: /usr/lib64/dovecot/doveadm/lib10_doveadm_acl_plugin.so: undefined symbol: acl_user_module (this is usually intentional, so just ignore this message) doveadm(root): Debug: Skipping module doveadm_expire_plugin, because dlopen() failed: /usr/lib64/dovecot/doveadm/lib10_doveadm_expire_plugin.so: undefined symbol: expire_set_lookup (this is usually intentional, so just ignore this message) doveadm(root): Debug: Skipping module doveadm_quota_plugin, because dlopen() failed: /usr/lib64/dovecot/doveadm/lib10_doveadm_quota_plugin.so: undefined symbol: quota_user_module (this is usually intentional, so just ignore this message) doveadm(root): Debug: Module loaded: /usr/lib64/dovecot/doveadm/lib10_doveadm_sieve_plugin.so doveadm(root): Debug: Skipping module doveadm_fts_plugin, because dlopen() failed: /usr/lib64/dovecot/doveadm/lib20_doveadm_fts_plugin.so: undefined symbol: fts_list_backend (this is usually intentional, so just ignore this message) doveadm(username): Debug: Effective uid=489, gid=489, home=/data/mail/username doveadm(username): Debug: fs: root=/data/mail/username, index=, indexpvt=, control=, inbox=, alt= doveadm(username): Debug: Namespace : Using permissions from /data/mail/username: mode=0700 gid=default dsync-local(username): Debug: brain M: in state=master_recv_handshake dsync-local(username): Debug: brain M: out state=send_mailbox_tree changed=1 dsync-local(username): Debug: brain M: in state=send_mailbox_tree dsync-local(username): Debug: brain M: out state=send_mailbox_tree_deletes changed=1 dsync-local(username): Debug: brain M: in state=send_mailbox_tree_deletes dsync-local(username): Debug: brain M: out state=recv_mailbox_tree changed=1 dsync-local(username): Debug: brain M: in state=recv_mailbox_tree dsync-local(username): Debug: brain M: out state=recv_mailbox_tree changed=0 dsync-local(username): Debug: brain M: in state=recv_mailbox_tree dsync-local(username): Debug: brain M: out state=recv_mailbox_tree changed=0 dsync-local(username): Debug: brain M: in state=recv_mailbox_tree dsync-local(username): Debug: brain M: out state=recv_mailbox_tree changed=0 dsync-local(username): Debug: brain M: in state=recv_mailbox_tree dsync-local(username): Debug: brain M: out state=recv_mailbox_tree changed=0 dsync-local(username): Debug: brain M: in state=recv_mailbox_tree dsync-local(username): Debug: brain M: out state=recv_mailbox_tree changed=0 dsync-local(username): Debug: brain M: in state=recv_mailbox_tree dsync-local(username): Debug: brain M: out state=recv_mailbox_tree changed=0 dsync-local(username): Debug: brain M: in state=recv_mailbox_tree dsync-local(username): Debug: brain M: out state=recv_mailbox_tree changed=0 dsync-local(username): Debug: brain M: in state=recv_mailbox_tree dsync-local(username): Debug: brain M: out state=recv_mailbox_tree changed=0 dsync-local(username): Debug: brain M: in state=recv_mailbox_tree dsync-local(username): Debug: brain M: out state=recv_mailbox_tree_deletes changed=1 dsync-local(username): Debug: brain M: in state=recv_mailbox_tree_deletes dsync-local(username): Debug: brain M: out state=recv_mailbox_tree_deletes changed=0 dsync-local(username): Debug: brain M: in state=recv_mailbox_tree_deletes dsync-local(username): Debug: brain M: out state=recv_mailbox_tree_deletes changed=0 dsync-local(username): Debug: brain M: in state=recv_mailbox_tree_deletes ...and it hangs. Both servers are CentOS 6.6 x64. Replication status for the problematic user: [root@deoveadm2 ~]# doveadm replicator status username username priority fast sync full sync failed username low 42:10:59 42:10:59 y I tried to reindex the problematic mailbox, tried to restart both mail servers but the issue still here. I found no error messages in /var/log/maillog. What should I try next? Thanks, Laszlo

1 0

imapc only backing up INBOX
by List 07 Jan '15

07 Jan '15

I am attempting to pull email from gmail IMAP to my local machine and with the configuration I have I only seem to get messages from the INBOX folder. Hoping I could get some assistance getting all the gmail folders to download. Here is the imapc config: imapc_host = 64.233.171.108 imapc_user = %u imapc_master_user = master imapc_password = somepass imapc_features = rfc822.size # If you have Dovecot v2.2.8+ you may get a significant performance improvement with fetch-headers: imapc_features = $imapc_features fetch-headers # Read multiple mails in parallel, improves performance mail_prefetch_count = 20 # If the old IMAP server uses INBOX. namespace prefix, set: imapc_list_prefix = Gmail # for SSL: imapc_port = 993 imapc_ssl = imaps #imapc_ssl_ca_dir = /etc/ssl imapc_ssl_verify = no And the doveadm command I am running: doveadm -D -o imapc_user=$username -o imapc_password=$escaped_password backup -R -x '\All' -x '\Flagged' -x '\Important' -u $username imapc:

1 0

Cached message size smaller than expected
by David Saez 07 Jan '15

07 Jan '15

Hi Since i upgraded to Dovecot 2.2.15 i start experiencing "Cached message size smaller than expected" errors that render a whole imap folder unusable as dovecot panics. I used Timo Sirainen maildir-size-fix.pl v1.1 script to try to fix the sizes but it does not seem to work trying to access the maildir produces this log in dovecot: Jan 07 19:34:13 imap(forumed(a)forumed.biz): Error: read(zlib(/var/spool/exim/mail/forumed.biz/forumed/.Sent/cur/1386527120.M104960P2012.mail,S=7725131:2,S)) failed: Cached message size smaller than expected (7725131 < 7729083, box=Sent, UID=2734) Jan 07 19:34:13 imap(forumed(a)forumed.biz): Error: Maildir filename has wrong S value, renamed the file from /var/spool/exim/mail/forumed.biz/forumed/.Sent/cur/1386527120.M104960P2012.mail,S=7725131:2,S to /var/spool/exim/mail/forumed.biz/forumed/.Sent/cur/1386527120.M104960P2012.mail,S=7729084:2,S Jan 07 19:34:13 imap(forumed(a)forumed.biz): Error: Corrupted index cache file /var/spool/exim/mail/forumed.biz/forumed/.Sent/dovecot.index.cache: Broken physical size for mail UID 2734 Jan 07 19:34:13 imap(forumed(a)forumed.biz): Panic: file istream.c: line 167 (i_stream_read): assertion failed: (old_size <= _stream->pos - _stream->skip) Jan 07 19:34:13 imap(forumed(a)forumed.biz): Error: Raw backtrace: /usr/local/lib/dovecot/libdovecot.so.0(+0x75e1a) [0x7feb14469e1a] -> /usr/local/lib/dovecot/libdovecot.so.0(+0x75e96) [0x7feb14469e96] -> /usr/local/lib/dovecot/libdovecot.so.0(i_error+0) [0x7feb1441b2bf] -> /usr/local/lib/dovecot/libdovecot.so.0(i_stream_read+0x214) [0x7feb144731f4] -> /usr/local/lib/dovecot/libdovecot.so.0(i_stream_read_data+0x52) [0x7feb144733b2] -> /usr/local/lib/dovecot/libdovecot.so.0(message_get_body_size+0xa9) [0x7feb1445da89] -> /usr/local/lib/dovecot/libdovecot-storage.so.0(index_mail_init_stream+0x16f) [0x7feb1473795f] -> /usr/local/lib/dovecot/libdovecot-storage.so.0(+0x2dacc) [0x7feb14701acc] -> /usr/local/lib/dovecot/libdovecot-storage.so.0(mail_get_stream+0x4d) [0x7feb1470f3ed] -> /usr/local/lib/dovecot/libdovecot-storage.so.0(+0x2e3e8) [0x7feb147023e8] -> /usr/local/lib/dovecot/libdovecot-storage.so.0(mail_get_virtual_size+0x2b) [0x7feb1470f07b] -> dovecot/imap() [0x41b2f5] -> dovecot/imap() [0x419d6c] -> dovecot/imap(imap_fetch_more+0x31) [0x419fa1] -> dovecot/imap() [0x40ebb0] -> dovecot/imap(command_exec+0x3d) [0x4183ad] -> dovecot/imap() [0x416a7e] -> dovecot/imap(client_output+0x10b) [0x417adb] -> /usr/local/lib/dovecot/libdovecot.so.0(+0x931d9) [0x7feb144871d9] -> /usr/local/lib/dovecot/libdovecot.so.0(io_loop_call_io+0x5b) [0x7feb1447b0db] -> /usr/local/lib/dovecot/libdovecot.so.0(io_loop_handler_run_internal+0xaf) [0x7feb1447c27f] -> /usr/local/lib/dovecot/libdovecot.so.0(io_loop_handler_run+0x9) [0x7feb1447b169] -> /usr/local/lib/dovecot/libdovecot.so.0(io_loop_run+0x38) [0x7feb1447b1f8] -> /usr/local/lib/dovecot/libdovecot.so.0(master_service_run+0x13) [0x7feb14420193] -> dovecot/imap(main+0x2b0) [0x4210d0] -> /lib/libc.so.6(__libc_start_main+0xfd) [0x7feb140b1c4d] -> dovecot/imap() [0x40bea9] Jan 07 19:34:13 imap(forumed(a)forumed.biz): Fatal: master: service(imap): child 9337 killed with signal 6 (core not dumped) 1386527120.M104960P2012.mail,S=7725131:2,S is actually a gzip compressed mail, it's compressed size (file system size) is 7725131 bytes after dovecot panic it's automatically renamed to 1386527120.M104960P2012.mail,S=7739837:2,S by dovecot dovecot -n # OS: Linux 2.6.32-5-amd64 x86_64 Debian 6.0.3 auth_cache_size = 10 M auth_cache_ttl = 1 days auth_mechanisms = plain login auth_username_chars = abcdefghijklmnopqrstuvwxyz01234567890.-_@ disable_plaintext_auth = no hostname = pop.olsns.net log_path = /usr/local/log/dovecot.log mail_fsync = never mail_gid = mail mail_plugins = " zlib" mail_uid = exim mailbox_list_index = yes maildir_very_dirty_syncs = yes namespace inbox { inbox = yes location = mailbox Drafts { auto = subscribe special_use = \Drafts } mailbox Junk { auto = subscribe special_use = \Junk } mailbox Sent { auto = subscribe special_use = \Sent } mailbox Trash { auto = subscribe special_use = \Trash } prefix = } passdb { args = /usr/local/etc/dovecot/dovecot-sql.conf driver = sql } plugin { zlib_save = gz zlib_save_level = 6 } pop3_fast_size_lookups = yes protocols = imap pop3 service auth { user = root } service imap-login { executable = /usr/local/libexec/dovecot/imap-login inet_listener imap { address = 82.98.162.142 127.0.0.1 } service_count = 100 user = dovecot } service imap { service_count = 100 } service pop3-login { executable = /usr/local/libexec/dovecot/pop3-login inet_listener pop3 { address = 82.98.162.142 } service_count = 100 user = dovecot } service pop3 { executable = /usr/local/libexec/dovecot/pop3 service_count = 100 } ssl_cert = </usr/local/etc/dovecot/dovecot.pem ssl_key = </usr/local/etc/dovecot/dovecot.key userdb { driver = prefetch } protocol pop3 { pop3_client_workarounds = outlook-no-nuls oe-ns-eoh pop3_uidl_format = %08Xu%08Xv } protocol imap { mail_plugins = " zlib imap_zlib" }

1 0

Kerberos problems with /dev/null as dovecot home
by Roland Hopferwieser 07 Jan '15

07 Jan '15

Hi, this is for documentation if someone else has the same problem. After migration from Dovecot 1 to 2.2. it was no longer able use Kerberos (Heimdal). I found out that dovecot tries to read ~/.krb5/config in the home of the dovecot user. This file doesn't need to exist, but if the home is set to /dev/null, it will not work. Maybe it would be nice to have an error message for this case. Regards, Roland

1 0

Schema Patch to get Dovecot running with Solr 4.10.3
by Christian Felsing 07 Jan '15

07 Jan '15

Hello, AFAIK a known problem with newer Apache Solr versions. If you patch Dovecots solr-schema.xml Dovecot will work with Solr 4.10.3: --- solr-schema.xml 2015-01-05 09:12:51.080196122 +0100 +++ /home/solr/solr/example/solr/collection1/conf/schema.xml 2015-01-05 09:31:48.320206660 +0100 @@ -51,6 +51,7 @@ <field name="cc" type="text" indexed="true" stored="false" /> <field name="bcc" type="text" indexed="true" stored="false" /> <field name="subject" type="text" indexed="true" stored="false" /> + <field name="text" type="text" indexed="true" stored="false" />  <field name="_version_" type="long" indexed="true" stored="true"/> This patch was created regarding Dovecot 2.2.15, for Dovecot configuration please follow instructions at http://wiki2.dovecot.org/Plugins/FTS/Solr Christian

2 1

'ssl_cipher_list' setting
by Yoshito Takeuchi 06 Jan '15

06 Jan '15

Hi, I am Yoshi, Japanese. I used FreeBSD 10.1 Dovecot 2.2.15 I want pop3s, so I made /usr/local/etc/dovecot/local.conf ssl = yes ssl_cert = </usr/local/etc/dovecot/server.pem ssl_key = </usr/local/etc/dovecot/server.key ssl_ca = </usr/local/etc/dovecot/ca.pem ssl_protocols = !SSLv2 !SSLv3 ssl_cipher_list = ALL:!LOW:!SSLv2:!SSLV3:!EXP:!aNULL:!RC4 It's work fine. But, change ssl_cipher_list = ALL:!LOW:!SSLv2:!SSLv3:!EXP:!aNULL:!RC4 ( SSLV3 -> SSLv3 ) I did trouble. /var/log/maillog Jan 6 05:41:53 example dovecot: pop3-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=xxx.xxx.xxx.xxx, lip=xxx.xxx.xxx.xxx, TLS handshaking, session=<5e9 zuO0LVwB+PO8D> Is this bug ? or I did miss setting ? Thank you for reading. Yoshi

2 2

Crashes with tracebacks
by Timothe Litt 05 Jan '15

05 Jan '15

Crashes, redux. I hope I have provided all the information required for a solution. Many thanks in advance for having a look. I have 71 core files for a user, that all happened in the space of about 6 hours. It appears that mail delivered to 'Junk E-mail' is being accessed. I suspect they're all the same issue. I saw the same syslog entry a while back; did a resync & enabled process dumps. Naturally, it went away -- until this cluster of crashes. File system is ext3. It is NFS mounted by other machines, but only the local machine should be touching the mail directories. The user does not have an interactive login - it's an e-mail only account. This user's IMAP client is AppleMail. The delivery agent is procmail; Junk is detected by spamassassin; clamav is also present. pop3 is configured, but I don't think anyone uses it. Typical syslog (time matches core.20063): Dec 17 18:06:22 overkill dovecot: imap(<user>): Error: Next message unexpectedly corrupted in mbox file /home/<user>/mail/Junk E-mail at 1021601 Dec 17 18:06:22 overkill dovecot: imap(<user>): Panic: file mbox-sync.c: line 152 (mbox_sync_read_next_mail): assertion failed: (sync_ctx->input->v_offset != mail_ctx->mail.from_offset || sync_ctx->input->eof) Dec 17 18:06:22 overkill dovecot: imap(<user>): Error: Raw backtrace: /usr/local/lib/dovecot/libdovecot.so.0 [0x274ecf] -> /usr/local/lib/dovecot/libdovecot.so.0 [0x274f4d] -> /usr/local/lib/dovecot/libdovecot.so.0 [0x27446b] -> /usr/local/lib/dovecot/libdovecot-storage.so.0 [0x16633e] -> /usr/local/lib/dovecot/libdovecot-storage.so.0(mbox_sync+0x6b6) [0x168146] -> /usr/local/lib/dovecot/libdovecot-storage.so.0(mbox_storage_sync_init+0x81) [0x169391] -> /usr/local/lib/dovecot/libdovecot-storage.so.0(mailbox_sync_init+0x40) [0x186270] -> /usr/local/lib/dovecot/libdovecot-storage.so.0(mailbox_sync+0x3d) [0x18715d] -> /usr/local/lib/dovecot/libdovecot-storage.so.0(index_storage_get_status+0x74) [0x1b6c44] -> /usr/local/lib/dovecot/libdovecot-storage.so.0(mailbox_get_status+0x5f) [0x1895bf] -> dovecot/imap(imap_status_get+0x7a) [0x806396a] -> dovecot/imap(cmd_status+0x128) [0x80588a8] -> dovecot/imap(command_exec+0x33) [0x805c8e3] -> dovecot/imap [0x805b63f] -> dovecot/imap [0x805b6c3] -> dovecot/imap(client_handl Dec 17 18:06:22 overkill dovecot: imap(<user>): Fatal: master: service(imap): child 20063 killed with signal 6 (core dumped) Tracebacks in attached archive were generated with: > cd ~<user>; for C in core.*; do gdb /usr/local/libexec/dovecot/imap $C > -x gdb -q ; mv gdb.log gdb.$C.log; done where 'gdb' is: > set pagination off > set logging overwrite > set logging file gdb.log > set logging on > bt full > q Note that there are unprintable characters in the log files (binary arguments). I have saved, but not attached the mail file & it's .lock file before doing a doveadm force-resync -u <user> 'Junk E-mail'. Let me know if you require a copy to debug this. I have also saved the core files. Here is the dovecot config (I have replaced the domain with example.net) dovecot -n # 2.2.15: /usr/local/etc/dovecot/dovecot.conf # OS: Linux 2.6.22.14-72.fc6 i686 Fedora Core release 6 (Zod) first_valid_gid = 4000 first_valid_uid = 4000 hostname = smtp.example.net login_greeting = Dovecot ready. Unauthorized access is prohibited. mail_access_groups = mail mail_location = mbox:~/mail:INBOX=/var/mail/%n mail_privileged_group = mail namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox "Train As Forgotten" { auto = subscribe } mailbox "Train As Ham" { auto = subscribe } mailbox "Train As Spam" { auto = subscribe } mailbox Trash { auto = subscribe special_use = \Trash } prefix = separator = / } passdb { driver = pam } service imap-login { inet_listener imap { address = imap.v4.example.net imap.v6.example.net port = 143 } inet_listener imaps { address = imap.v4.example.net imap.v6.example.net port = 993 ssl = yes } } service pop3-login { inet_listener pop3 { address = pop.v4.example.net pop.v6.example.net port = 110 } inet_listener pop3s { address = pop.v4.example.net pop.v6.example.net port = 995 ssl = yes } } ssl_ca = </etc/pki/tls/certs/litts_net_ca-cert-crl.pem ssl_cert = </etc/pki/tls/certs/servers-litts-net.pem ssl_key = </etc/pki/tls/private/servers-litts-net.pmk userdb { driver = passwd } protocol imap { imap_client_workarounds = tb-extra-mailbox-sep tb-lsub-flags mail_plugins = } protocol pop3 { mail_plugins = pop3_client_workarounds = outlook-no-nuls oe-ns-eoh pop3_uidl_format = %08Xu%08Xv } Finally, here is a list of all the core files showing their creation times. Note they're all the same size. ls -l core* | cut -d ' ' -f5- | sort 536576 Dec 17 18:01 core.20067 536576 Dec 17 18:06 core.20063 536576 Dec 17 18:11 core.20464 536576 Dec 17 18:16 core.20665 536576 Dec 17 18:21 core.20913 536576 Dec 17 18:26 core.21098 536576 Dec 17 18:31 core.21359 536576 Dec 17 18:36 core.21589 536576 Dec 17 18:41 core.21805 536576 Dec 17 18:46 core.22077 536576 Dec 17 18:51 core.22262 536576 Dec 17 18:56 core.22518 536576 Dec 17 19:01 core.22771 536576 Dec 17 19:06 core.22955 536576 Dec 17 19:11 core.23227 536576 Dec 17 19:16 core.23438 536576 Dec 17 19:21 core.23679 536576 Dec 17 19:26 core.23856 536576 Dec 17 19:31 core.24089 536576 Dec 17 19:36 core.24328 536576 Dec 17 19:41 core.24569 536576 Dec 17 19:46 core.24806 536576 Dec 17 19:51 core.24994 536576 Dec 17 19:56 core.25233 536576 Dec 17 20:01 core.25447 536576 Dec 17 20:06 core.25612 536576 Dec 17 20:11 core.25825 536576 Dec 17 20:16 core.26091 536576 Dec 17 20:21 core.26309 536576 Dec 17 20:26 core.26453 536576 Dec 17 20:31 core.26773 536576 Dec 17 20:36 core.27020 536576 Dec 17 20:41 core.27278 536576 Dec 17 20:46 core.27505 536576 Dec 17 20:51 core.27681 536576 Dec 17 20:56 core.27913 536576 Dec 17 21:01 core.28214 536576 Dec 17 21:06 core.28445 536576 Dec 17 21:11 core.28739 536576 Dec 17 21:16 core.28975 536576 Dec 17 21:21 core.29205 536576 Dec 17 21:26 core.29407 536576 Dec 17 21:31 core.29635 536576 Dec 17 21:36 core.29892 536576 Dec 17 21:41 core.30132 536576 Dec 17 21:46 core.30407 536576 Dec 17 21:51 core.30542 536576 Dec 17 21:56 core.30834 536576 Dec 17 22:01 core.31099 536576 Dec 17 22:06 core.31264 536576 Dec 17 22:11 core.31529 536576 Dec 17 22:16 core.31761 536576 Dec 17 22:21 core.31981 536576 Dec 17 22:26 core.32191 536576 Dec 17 22:31 core.32436 536576 Dec 17 22:36 core.32665 536576 Dec 17 22:41 core.449 536576 Dec 17 22:46 core.676 536576 Dec 17 22:51 core.877 536576 Dec 17 22:56 core.1134 536576 Dec 17 23:01 core.1332 536576 Dec 17 23:06 core.1516 536576 Dec 17 23:11 core.1757 536576 Dec 17 23:16 core.1935 536576 Dec 17 23:21 core.2175 536576 Dec 17 23:26 core.2380 536576 Dec 17 23:31 core.2625 536576 Dec 17 23:36 core.2871 536576 Dec 17 23:41 core.3141 536576 Dec 17 23:46 core.3460 536576 Dec 17 23:51 core.3631 -- Timothe Litt ACM Distinguished Engineer -------------------------- This communication may not represent the ACM or my employer's views, if any, on the matters discussed.

2 1

mdbox GUID
by Nagy, Attila 04 Jan '15

04 Jan '15

Hi, The dbox page says: "Each message has a 128 bit globally unique identifier (GUID)" I guess this is what guid_128_generate() generates. Is this believed to be really globally unique? As far as I can tell, in the current architecture they are -given there are enough time precision-, because all dovecot daemons are single threaded, so they have concurrency but doesn't have parallelism (they are not multi threaded). I would like to list all of the messages, with this GUID as the unique identifier, so a collision would be fatal here...

1 0

ntlm_auth random failures with dovecot
by Jason Gunthorpe 04 Jan '15

04 Jan '15

I'm still a bit fuzzy on exactly what has blown up here since my 1.2 install (or maybe it was broken then and I never noticed), but it looks like the way dovecot is calling out to ntlm_auth is violating the --helper-protocol=squid-2.5-ntlmssp scheme. The issue is how it handles simultaneous clients connecting - for instance launching thunderbird with NTLM auth creates multiple imapds that all have to be auth'd. Since dovecot doesn't (and apparrently didn't in 1.2?) serialize this it ends up sending a jumble to ntlm_auth. Strace sayth, as example: read(0, "YR xxxxxxx=\n", 4096) = 48 read(0, "YR xxxxxxx=\n", 4096) = 48 read(0, "KK xxxxxxx=\n",4096) = 176 read(0, "KK xxxxxxx=\n",4096) = 176 That is two clients connecting at once, and the sequence has become jumbled. Fiddling around with ntlm_auth manually I can get it to give me this: YR xxx # 1 TT xxx # 1 YR xxx # 2 TT xxx # 2 KK xxx # 2 AF jgg # 2 KK xxx # 1 Called NTLMSSP after state machine was 'done' GENSEC login failed: NT_STATUS_INVALID_PARAMETER NA NT_STATUS_INVALID_PARAMETER Ie, reordering the sequence (# 1 and # 2) causes it to tell you that, no, the sequence cannot be reordered. To me this says the samba folks expect that the YY/TT/KK/AF sequence is *NOT* reordered. The implication is that the mech-winbind in dovecot must seralize everything, and it doesn't! So, this is fairly broken, I can hit these failure causes with a high probability when using thunderbird. Any thoughts on how to repair this? The simplest answer would be to pool and assign a ntlm_auth process to each incoming auth context, or to actually serialize auth. But it can't treat ntlm_auth as a stateless helper. Jason

1 0

[PATCH] LAYOUT=imapdir is broken in v2.2
by Jason Gunthorpe 04 Jan '15

04 Jan '15

The next thing I noticed in my v1.2 -> 2.2 upgrade is that mail_location = maildir:[..]:LAYOUT=imapdir is broken, the symptom is dovecot returning this to the client when requesting any mailbox beyond INBOX: Character not allowed in mailbox name: ' Which is actually trying to say "Character not allowed in mailbox name: '\0'", but since the %c is not escaped it ends up with the truncated string. This patch fixes it: diff --git a/src/lib-storage/list/mailbox-list-maildir.c b/src/lib-storage/list/mailbox-list-maildir.c index c99a2900a6d6..ae5f35d955ac 100644 --- a/src/lib-storage/list/mailbox-list-maildir.c +++ b/src/lib-storage/list/mailbox-list-maildir.c @@ -46,6 +46,7 @@ static struct mailbox_list *imapdir_list_alloc(void) list = p_new(pool, struct maildir_mailbox_list, 1); list->list = imapdir_mailbox_list; list->list.pool = pool; + list->sep = '.'; list->global_temp_prefix = IMAPDIR_GLOBAL_TEMP_PREFIX; list->temp_prefix = p_strconcat(pool, list->global_temp_prefix, Analysis: I noticed this while upgrading a dovecot install from 1.2.15 (squeeze) to 2.2.13 (jessie). This upstream commit author Timo Sirainen <tss(a)iki.fi> Thu Jan 20 20:59:07 2011 +0200 (2011-01-20) changeset 12586 a2780b694b2d parent 12585 b748c622e896 child 12587 c3a258ee96c4 lib-storage: mailbox_alloc() now takes a virtual mailbox name and other related API changes. All storage_name <-> vname conversions now go through the same two mailbox_list methods. This has many benefits, such as: * listescape plugin is now much simpler and bugfree * allows changing lib-storage API to use UTF-8 mailbox names in future * allows creation of "mailbox aliases" plugin Restructed the _alloc functions to move the hierarchy_sep from the initializer into the _alloc call itself: @@ -29,6 +30,7 @@ static struct mailbox_list *maildir_list_alloc(void) list = p_new(pool, struct maildir_mailbox_list, 1); list->list = maildir_mailbox_list; list->list.pool = pool; + list->sep = '.'; list->global_temp_prefix = MAILDIR_GLOBAL_TEMP_PREFIX; list->temp_prefix = p_strconcat(pool, list->global_temp_prefix, [..] struct mailbox_list maildir_mailbox_list = { .name = MAILBOX_LIST_NAME_MAILDIRPLUSPLUS, - .hierarchy_sep = '.', .props = MAILBOX_LIST_PROP_NO_MAILDIR_NAME | MAILBOX_LIST_PROP_NO_ALT_DIR | MAILBOX_LIST_PROP_NO_NOSELECT, [..] struct mailbox_list imapdir_mailbox_list = { .name = MAILBOX_LIST_NAME_IMAPDIR, - .hierarchy_sep = '.', .props = MAILBOX_LIST_PROP_NO_MAILDIR_NAME | MAILBOX_LIST_PROP_NO_ALT_DIR | MAILBOX_LIST_PROP_NO_NOSELECT, Noting that heierarchy_sep was removed from maildir_mailbox_list and imapdir_mailbox_list but only added to maildir_list_alloc(), and not imapdir_list_alloc(). This ultimately results in mailbox_list_get_hierarchy_sep() returning '\0' and mailbox_verify_name() failing everything (all strings contain '\0' according to strchr). This ended up as debian bug #774533 Regards, Jason

1 0

dovecot and ntlm_auth through winbind
by Jason Gunthorpe 04 Jan '15

04 Jan '15

Hi all, I am upgrading a dovecot 1.2 installation to a 2.2 installation and have found and fixed a number of problems.. I've seen several postings in the archive about ntlm_auth not working, and it is true, there are several regressions in dovecot here. The first and simplest is that the enablement instructions in the wikki are wrong. ntlm_auth must be called as root, which is what 1.2 did. 2.2 defaults to calling it as the auth user which subtly doesn't work: Dec 30 20:30:21 quartz dovecot[8439]: auth: Error: Login for user []\[jgg]@[wakko] failed due to [Reading winbind reply failed!] Dec 30 20:30:21 quartz dovecot[8439]: auth: Error: ../auth/ntlmssp/ntlmssp_server.c:454: Checking NTLMSSP password for \jgg failed: NT_STATUS_UNSUCCESSFUL Dec 30 20:30:21 quartz dovecot[8439]: auth: Error: GENSEC login failed: NT_STATUS_UNSUCCESSFUL Dec 30 20:30:21 quartz dovecot[8439]: auth: Error: winbind: ntlm_auth exited with exit code 0 The fix is simple, run auth as root: service auth { user = root } This ended up as debian bug #774263 which has a few more details. Regards, Jason

1 0

dovecot-lda segfaults with replication
by Stefan Le Breton 04 Jan '15

04 Jan '15

Hi, I have set up replication, but dovecot-lda now fails with a segmentation fault. Problem seems to be in replication/replication-plugin.c line 253: struct replication_user *ruser = REPLICATION_USER_CONTEXT(ctx->ns->user); resulting in ruser = 0x0 # 2.2.15: /usr/local/etc/dovecot/dovecot.conf # Pigeonhole version 0.4.6 (3e924b1b6c5c+) # OS: FreeBSD 10.0-RELEASE amd64 gdb Backtrace + doveconf -n below. Regards Stefan gdb backtrace: #0 0x0000000802001bc4 in replication_mail_transaction_commit (txn=0x801c811b0, changes=0x7fffffffd3d0) at replication-plugin.c:258 ctx = (struct replication_mail_txn_context *) 0x801c811b0 ruser = (struct replication_user *) 0x0 priority = REPLICATION_PRIORITY_NONE #1 0x0000000801490749 in notify_contexts_mail_transaction_commit (t=0x801c24600, changes=0x7fffffffd3d0) at notify-plugin.c:132 ctx = (struct notify_context *) 0x801c8d020 mail_txn = (struct notify_mail_txn *) 0x801c282b0 #2 0x0000000801491a53 in notify_transaction_commit (t=0x801c24600, changes_r=0x7fffffffd3d0) at notify-storage.c:182 lt = (struct notify_transaction_context *) 0x0 lbox = (union mailbox_module_context *) 0x801cade50 #3 0x0000000800ae1ff9 in mailbox_transaction_commit_get_changes (_t=0x801ce01b0, changes_r=0x7fffffffd3d0) at mail-storage.c:1916 _data_stack_cur_id = 3 t = (struct mailbox_transaction_context *) 0x801c24600 box = (struct mailbox *) 0x801cad840 save_count = 1 ret = -128 #4 0x0000000800ae1f49 in mailbox_transaction_commit (t=0x801ce01b0) at mail-storage.c:1897 changes = {pool = 0x801cd5420, uid_validity = 1234722882, saved_uids = { arr = {buffer = 0x801cd5440, element_size = 8}, v = 0x801cd5440, v_modifiable = 0x801cd5440}, ignored_modseq_changes = 0, changed = true, no_read_perm = false} ret = 8 #5 0x000000080244bfb2 in sieve_action_opr_optional_read () from /usr/local/lib/dovecot-2.2-pigeonhole/libdovecot-sieve.so.0 No symbol table info available. #6 0x0000000802443924 in sieve_result_implicit_keep () from /usr/local/lib/dovecot-2.2-pigeonhole/libdovecot-sieve.so.0 No symbol table info available. #7 0x0000000802443dcd in sieve_result_execute () from /usr/local/lib/dovecot-2.2-pigeonhole/libdovecot-sieve.so.0 No symbol table info available. #8 0x0000000802452f1c in sieve_execute () from /usr/local/lib/dovecot-2.2-pigeonhole/libdovecot-sieve.so.0 No symbol table info available. #9 0x0000000802205912 in sieve_plugin_init () from /usr/local/lib/dovecot/lib90_sieve_plugin.so No symbol table info available. #10 0x0000000800829104 in mail_deliver (ctx=0x7fffffffda08, storage_r=0x7fffffffd960) at mail-deliver.c:400 ret = 8 #11 0x0000000000402f2e in main (argc=7, argv=0x7fffffffdb08) at main.c:437 set_roots = {0x604970, 0x0} ctx = {pool = 0x801c29420, set = 0x801c67988, session = 0x801c29440, dup_ctx = 0x801c237c0, session_id = 0x0, src_mail = 0x801c48840, src_envelope_sender = 0x0, dest_user = 0x801c87040, dest_addr = 0x7fffffffddaf "mail(a)maserver.de", final_dest_addr = 0x7fffffffddaf "mail(a)maserver.de", dest_mailbox_name = 0x403d68 "INBOX", dest_mail = 0x0, var_expand_table = 0x0, tempfail_error = 0x0, tried_default_save = false, saved_mail = false, save_dest_mail = false, mailbox_full = false, dsn = false} service_flags = 1027 user = 0x7fffffffdd9e "mail(a)maserver.de" errstr = 0x37f <Error reading address 0x37f: Bad address> path = 0x7fffffffddc0 "/tmp/mail" lda_set = (struct lda_settings *) 0x801c67988 storage_service = (struct mail_storage_service_ctx *) 0x801c46840 service_user = (struct mail_storage_service_user *) 0x801c67190 service_input = {module = 0x403d55 "lda", service = 0x403d55 "lda", username = 0x7fffffffdd9e "mail(a)maserver.de", session_id = 0x0, local_ip = { family = 0, u = {ip6 = {__u6_addr = {__u6_addr8 = '\0' <repeats 15 times>, __u6_addr16 = {0, 0, 0, 0, 0, 0, 0, 0}, __u6_addr32 = {0, 0, 0, 0}}}, ip4 = {s_addr = 0}}}, remote_ip = {family = 0, u = {ip6 = {__u6_addr = { __u6_addr8 = '\0' <repeats 15 times>, __u6_addr16 = {0, 0, 0, 0, 0, 0, 0, 0}, __u6_addr32 = {0, 0, 0, 0}}}, ip4 = {s_addr = 0}}}, local_port = 0, remote_port = 0, userdb_fields = 0x0, flags_override_add = 0, flags_override_remove = 0, no_userdb_lookup = 0} storage = (struct mail_storage *) 0x0 user_source = 0x404090 "" destaddr_source = 0x403d73 "-a parameter" process_euid = 0 stderr_rejection = false ret = 1 c = -1 error = MAIL_ERROR_NONE # 2.2.15: /usr/local/etc/dovecot/dovecot.conf # Pigeonhole version 0.4.6 (3e924b1b6c5c+) # OS: FreeBSD 10.0-RELEASE amd64 auth_mechanisms = plain login digest-md5 doveadm_password = welcomemyguest first_valid_gid = 0 first_valid_uid = 125 listen = * login_greeting = McImap mail_location = maildir:~/.maildir mail_log_prefix = "%Us(%u): " mail_plugins = " notify replication" managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date ihave duplicate passdb { args = dovecot driver = pam } passdb { args = /usr/local/etc/dovecot/dovecot-mysql.conf driver = sql } plugin { antispam_backend = mailtrain antispam_mail_notspam = some@where antispam_mail_sendmail = /usr/sbin/sendmail antispam_mail_spam = some@elsewhere antispam_spam_pattern = INBOX.spam* plugin_debug = yes } protocols = imap sieve service aggregator { fifo_listener replication-notify-fifo { user = vmail } unix_listener replication-notify { user = vmail } } service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0660 user = postfix } unix_listener auth-master { group = vmail mode = 0666 user = vmail } unix_listener auth-userdb { group = vmail mode = 0660 user = vmail } user = root } service doveadm { inet_listener { port = 31337 ssl = yes } } service managesieve-login { inet_listener sieve { port = 4190 } } service replicator { unix_listener replicator-doveadm { group = vmail mode = 0600 user = vmail } } ssl_cert = </a/cert.pem ssl_key = </a/key.pem userdb { driver = passwd } userdb { args = /usr/local/etc/dovecot/dovecot-mysql.conf driver = sql } verbose_proctitle = yes protocol imap { imap_client_workarounds = delay-newmail tb-extra-mailbox-sep mail_plugins = " notify replication antispam" } protocol lda { mail_plugins = " notify replication sieve" } protocol lmtp { mail_plugins = " notify replication sieve" }

1 0

Help with installing Apache Solr with Dovecot 2.2
by Kev Lau 03 Jan '15

03 Jan '15

Hi, I am relatively new to Apache Solr and I am trying to get it to integrate with Dovecot 2.2 running on Ubuntu 14.04 and needed a little help with configuration. The following steps I have already configured. Appreciate if someone could help, so please help me! 1. Apache Solr installed, up and running 6406 [main] INFO org.eclipse.jetty.server.AbstractConnector ? Started SocketConnector@0.0.0.0:8983 I can then ssh into it and see the running solr admin. ssh -t -L 8983:localhost:8983 user(a)mydomain.com 2. Schema file added startTime: 3 minutes ago instanceDir: /opt/solr/solr/collection1/ dataDir: /opt/solr/solr/collection1/data/ In my collection1 core selector I have the following files:- 1.solrconfig.xml 2.schema.xml The output of schema.xml is shown below:- <?xml version="1.0" encoding="UTF-8" ?>  <schema name="dovecot" version="1.5"> <field name="_version_" type="long" indexed="true" stored="true"/> <field name="_root_" type="string" indexed="true" stored="false"/> <types>  <fieldType name="string" class="solr.StrField" omitNorms="true"/> <fieldType name="long" class="solr.LongField" omitNorms="true"/> <fieldType name="slong" class="solr.SortableLongField" omitNorms="true"/> <fieldType name="float" class="solr.FloatField" omitNorms="true"/> <fieldType name="boolean" class="solr.BoolField" omitNorms="true"/> <fieldType name="text" class="solr.TextField" positionIncrementGap="100"> <analyzer type="index"> <tokenizer class="solr.WhitespaceTokenizerFactory"/> <filter class="solr.StopFilterFactory" ignoreCase="true" words="stopwords.txt"/> <filter class="solr.WordDelimiterFilterFactory" generateWordParts="1" generateNumberParts="1" catenateWords="1" catenateNumbers="1" catenateAll="0"/> <filter class="solr.LowerCaseFilterFactory"/>  <filter class="solr.SnowballPorterFilterFactory" protected="protwords.txt"/> <filter class="solr.NGramFilterFactory" minGramSize="3" maxGramSize="15"/> <filter class="solr.RemoveDuplicatesTokenFilterFactory"/> </analyzer> <analyzer type="query"> <tokenizer class="solr.WhitespaceTokenizerFactory"/> <filter class="solr.SynonymFilterFactory" synonyms="synonyms.txt" ignoreCase="true" expand="true"/> <filter class="solr.StopFilterFactory" ignoreCase="true" words="stopwords.txt"/> <filter class="solr.WordDelimiterFilterFactory" generateWordParts="1" generateNumberParts="1" catenateWords="0" catenateNumbers="0" catenateAll="0"/> <filter class="solr.LowerCaseFilterFactory"/>  <filter class="solr.SnowballPorterFilterFactory" protected="protwords.txt"/> <filter class="solr.RemoveDuplicatesTokenFilterFactory"/> </analyzer> </fieldType> </types> <fields> <field name="id" type="string" indexed="true" stored="true" required="true" /> <field name="uid" type="slong" indexed="true" stored="true" required="true" /> <field name="box" type="string" indexed="true" stored="true" required="true" /> <field name="user" type="string" indexed="true" stored="true" required="true" /> <field name="hdr" type="text" indexed="true" stored="false" /> <field name="body" type="text" indexed="true" stored="false" /> <field name="from" type="text" indexed="true" stored="false" /> <field name="to" type="text" indexed="true" stored="false" /> <field name="cc" type="text" indexed="true" stored="false" /> <field name="bcc" type="text" indexed="true" stored="false" /> <field name="subject" type="text" indexed="true" stored="false" /> </fields> <uniqueKey>id</uniqueKey> <defaultSearchField>body</defaultSearchField> <solrQueryParser defaultOperator="AND" /> </schema> 3. Dovecot package dovecot-solr installed 4. Dovecot configured with following files to run on solr-fts. In 10-mail.conf:- # Space separated list of plugins to load for all services. Plugins specific to # IMAP, LDA, etc. are added to this list in their own .conf files. #mail_plugins = mail_plugins = fts fts_solr In 90-plugin.conf:- plugin { fts = solr fts_solr = break-imap-search url=http://localhost:8983/solr/ } I would really appreciate if someone could please help me here. Request for someone to guide me here. Thanks a lot Kevin

2 4

Designing an Object Storage Plugin for a specific platform
by Listas＠Adminlinux 02 Jan '15

02 Jan '15

Hi! I'm planning to develop a OSP (Object Storage Plugin) to support a specific platform of my company. Is there any API documentation or sample code of a simple plugin that can be used as a basis for an implementation? Thanks! -- Thiago Henrique

1 1

Disabling compressed storage for one public namespace - is it possible?
by Marc Stürmer 02 Jan '15

02 Jan '15

Greetings, I've got Dovecot 2.2.X running with gzip compressed storage enabled by default. My question though is: is it possible to disable this compressed storage for one specific, public namespace only? I haven't found quite much information about it on the wiki. Thanks in advance.

2 1

dovecot 2 low TCP speed (fetching big mail)
by Wojciech Puchar 02 Jan '15

02 Jan '15

i use dovecot 2 under FreeBSD (dovecot2-2.2.15 compiled from ports). tried both with kqueue enabled or not. everything works very fast, EXCEPT fetching big mail. tried multiple clients (thunderbird on windows, alpine on the same server, alpine on other unix server connected by 1Gb/s LAN) and fetching peaks at 1MB/s. NO SSL! could you please point me where to search for a problem. hints: writing over IMAP (eg. writing to Sent folder) works at full speed. Doesn't seem like a problem with unix server, every other service goes at speed 70-100MB/s both directions (like samba, ftp). tried to turn off "kqueue" compile time option, no difference. Please give me a hint at least what to check. Does dovecot use other way to sent data over TCP socket than other programs? thank you.

2 2

Postfix and Dovecot SASL - wiki update
by Dan Langille 01 Jan '15

01 Jan '15

I wanted to mention I updated the Postfix and Dovecot SASL wiki entry yesterday. http://wiki2.dovecot.org/HowTo/PostfixAndDovecotSASL The entry: submission inet n - - - - smtpd was incorrect. It should be: submission inet n - n - - smtpd By specifying n for chroot, it ensures that DNS lookups can occur. Otherwise, if you are using reject_unknown_recipient_domain the following error will occur: Recipient address rejected: Domain not found Hope that helps. — Dan Langille http://langille.org/

2 2

dovecot: imap Error: fts_solr: Query didn't return uid
by Randall Gellens 01 Jan '15

01 Jan '15

Anyone know what this means and what the implications are? dovecot: imap(user) Error: fts_solr: Query didn't return uid -- Randall Gellens Opinions are personal; facts are suspect; I speak for myself only -------------- Randomly selected tag: --------------- Men fear thought as they fear nothing else on earth, more than ruin, more even than death --Bertrand Russell

1 0

dovecot 2 low TCP speed (fetching big mail)
by Wojciech Puchar 01 Jan '15

01 Jan '15

i use dovecot 2 under FreeBSD (dovecot2-2.2.15 compiled from ports). tried both with kqueue enabled or not. everything works very fast, EXCEPT fetching big mail. tried multiple clients (thunderbird on windows, alpine on the same server, alpine on other unix server connected by 1Gb/s LAN) and fetching peaks at 1MB/s. NO SSL! could you please point me where to search for a problem. hints: writing over IMAP (eg. writing to Sent folder) works at full speed. Doesn't seem like a problem with unix server, every other service goes at speed 70-100MB/s both directions (like samba, ftp). tried to turn off "kqueue" compile time option, no difference. Please give me a hint at least what to check. Does dovecot use other way to sent data over TCP socket than other programs? thank you.

2 1

dovecot-auth only configuration
by Dan Langille 31 Dec '14

31 Dec '14

I am configuring a dovecot-auth only installation. Postfix will use dovecot for sasl auth. Here is the configuration I’ve settled upon. I welcome suggestions for improving this setup. Thanks. # doveconf -n # 2.2.15: /usr/local/etc/dovecot/dovecot.conf # OS: FreeBSD 9.3-RELEASE-p5 amd64 auth_mechanisms = plain login mail_max_userip_connections = 80 mail_privileged_group = mail passdb { args = scheme=SHA512-CRYPT /var/db/dovecot.users driver = passwd-file } protocols = none service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0660 user = postfix } user = root } userdb { args = /var/db/dovecot.users driver = passwd-file } verbose_proctitle = yes — Dan Langille http://langille.org/

1 0

Authenticating Virtual Users without domain
by Leon Kyneur 31 Dec '14

31 Dec '14

Hi, I'm trying to migrate a large number of users to a new Dovecot cluster. The existing mail system allows a user to authenticate with a bare username if they have connected to the correct local IP on the server. e.g. imap.somedomain.com = 1.1.1.1 imap.anotheromain.com = 2.2.2.2 charlie@somedomain can authnenticate as 'charlie' or 'charlie(a)somedomain.com' as long as he is connected to imap.somedomain.com (1.1.1.1) likewise for bare usernames if they connect to imap.anotherdomain.com. A previous colleague actually achieved this by hacking with the Dovecot source code and writing in a lookup table feature. The code is very old and won't patch cleanly to the latest 2.2.15 source. Another platform we are using (commercial product) also has this feature but we also need to migrate these users to Dovecot. I already have a Dovecot proxy layer for mailbox lookup - so ideally I would like to do this on my Dovecot proxies. I know I can also do this kind of thing if I swapped my dovecot proxy for Perdition, however I don't really want to do that. I've looked into checkpassword scripts and could possibly make something work (albeit ugly) - is this the right direction to take here? Thanks, Leon

2 1

Segmentation fault in pigeonhole lib-sieve
by Orion Poplawski 31 Dec '14

31 Dec '14

The sieve plugin for Thundirbird likes to rapidly compile work in progress sieve scripts to continually give feedback on any errors in the script. This can trigger segmentation faults in lib-sieve with certain pathologically incomplete sieve scripts. One example: #0 tag_comparator_validate (valdtr=0x7f291aa713a0, arg=0x7fff5c3cfa58, cmd=0x7f291aa69360) at sieve-comparators.c:143 143 if ( (*arg)->type != SAAT_STRING ) { Missing separate debuginfos, use: debuginfo-install bzip2-libs-1.0.6-12.el7.x86_64 glibc-2.17-55.el7_0.3.x86_64 sssd-client-1.11.2-68.el7_0.6.x86_64 zlib-1.2.7-13.el7.x86_64 (gdb) list 138 *arg = sieve_ast_argument_next(*arg); 139 140 /* Check syntax: 141 * ":comparator" <comparator-name: string> 142 */ 143 if ( (*arg)->type != SAAT_STRING ) { 144 sieve_argument_validate_error(valdtr, *arg, 145 ":comparator tag requires one string argument, but %s was found", 146 sieve_ast_argument_name(*arg) ); 147 return FALSE; (gdb) print arg $1 = (struct sieve_ast_argument **) 0x7fff5c3cfa58 (gdb) print *arg $2 = (struct sieve_ast_argument *) 0x0 So sieve_ast_argument_next() is returning NULL and we're trying to dereference it without checking. Here's a completely naive attempt at a patch: --- dovecot-2.2.15/dovecot-2.2-pigeonhole-0.4.3/src/lib-sieve/sieve-comparators.c.null 2014-01-01 15:46:39.000000000 -0700 +++ dovecot-2.2.15/dovecot-2.2-pigeonhole-0.4.3/src/lib-sieve/sieve-comparators.c 2014-12-29 14:01:00.233436697 -0700 @@ -140,6 +140,11 @@ static bool tag_comparator_validate /* Check syntax: * ":comparator" <comparator-name: string> */ + if ( *arg == NULL ) { + sieve_argument_validate_error(valdtr, *arg, + ":comparator tag requires one string argument, but none was found"); + return FALSE; + } if ( (*arg)->type != SAAT_STRING ) { sieve_argument_validate_error(valdtr, *arg, ":comparator tag requires one string argument, but %s was found", -- Orion Poplawski Technical Manager 303-415-9701 x222 NWRA, Boulder/CoRA Office FAX: 303-415-9702 3380 Mitchell Lane orion(a)nwra.com Boulder, CO 80301 http://www.nwra.com

2 2

PAM issues on OS X Yosemite
by Markus Mayer 30 Dec '14

30 Dec '14

Hi, I have been running dovecot successfully on OS X Mavericks for several months. After upgrading to Yosemite, however, PAM authentication for dovecot is failing. Or rather, creating the PAM session is failing. Either way, I can't get to my e-mail. $ /usr/pkg/sbin/dovecot --version 2.2.15 $ /usr/pkg/sbin/dovecot -n # 2.2.15: /usr/pkg/etc/dovecot/dovecot.conf # OS: Darwin 14.0.0 x86_64 hfs auth_debug = yes auth_verbose = yes mail_location = maildir:/Volumes/Secure/%u/Maildir mail_privileged_group = mail namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } passdb { args = session=yes dovecot driver = pam } ssl_cert = </usr/pkg/etc/openssl/certs/dovecot.pem ssl_key = </usr/pkg/etc/openssl/private/dovecot.pem userdb { driver = passwd } $ defaults read "/System/Library/CoreServices/SystemVersion" ProductVersion 10.10.1 Dec 30 13:21:47 my.host.name dovecot[49247]: auth: Debug: auth client connected (pid=49289) Dec 30 13:21:51 my.host.name dovecot[49247]: auth: Debug: client in: AUTH 1 PLAIN service=imap secured session=3bBdlHULNgAAAAAAAAAAAAAAAAAAAAAB lip=::1 rip=::1 lport=143 rport=52278 resp=<hidden> Dec 30 13:21:51 my.host.name dovecot[49247]: auth-worker(49286): Debug: pam(markus,::1): lookup service=dovecot Dec 30 13:21:51 my.host.name dovecot[49247]: auth-worker(49286): Debug: pam(markus,::1): #1/1 style=1 msg=Password: Dec 30 13:21:51 my.host.name dovecot[49247]: auth-worker(49286): Error: pam(markus,::1): pam_open_session() failed: session failure Dec 30 13:21:53 my.host.name dovecot[49247]: auth: Debug: client passdb out: FAIL 1 user=markus It does successfully verify my password. If I purposefully enter a wrong password the error becomes "pam_authenticate() failed: authentication error (password mismatch?)". So that portion is okay. Do you have any suggestions how I might find out why pam_open_session() is failing? The auth process *is* running as root. I have tried these two PAM configurations. The first one based on Maverick's /etc/pam.d/login and used to work fine on Mavericks. # dovecot: auth account password session auth optional pam_krb5.so use_kcminit auth optional pam_ntlm.so try_first_pass auth optional pam_mount.so try_first_pass auth required pam_opendirectory.so try_first_pass account required pam_nologin.so account required pam_opendirectory.so password required pam_opendirectory.so session required pam_launchd.so session required pam_uwtmp.so session optional pam_mount.so I tried to simplify it by using the one suggested on dovecot's PAM wiki. # dovecot: auth account password session auth required pam_opendirectory.so try_first_pass account required pam_nologin.so account required pam_opendirectory.so password required pam_opendirectory.so On Yosemite, neither works. Or, quite possibly, both configurations are fine and the problem lies elsewhere. Any pointers would be greatly appreciated. In the mean time I'll be using auth-passwdfile, since that works. Thanks, -Markus

1 0

SPECIAL-USE again
by Peter Mogensen 30 Dec '14

30 Dec '14

Hi, Great to see Thunderbird support SPECIAL-USE now. I would like to hear the list about the intended use of SPECIAL-USE. I get the impression from several earlier mails here that the intention is for the server to globally decide what the folder-name of a specific SPECIAL-USE folder is for all users. That's the way the documentation exemplifies it and what I get from posts like this: http://www.dovecot.org/list/dovecot/2013-February/088129.html I get the point that if *all* clients ignored the real folder-name and only obeyed SPECIAL-USE, the clients could locally in the GUI decide language and name of the \Sent, \Drafts, \Trash folders. And the real folder name would become just an opaque identifier. However that's not how the world is like. There are plenty of clients ignoring SPECIAL-USE and placing meaning in the actual folder name in a language of their own choice. It seems natural for me to let the user configure their own individual SPECIAL-USE tagging according to their language and/or mix of IMAP clients. - either by setting IMAP METADATA (RFC5464) or by having the userdb return entries like: "namespace/inbox/Papperskorg/specialuse=\Trash" (for a swede) /Peter PS: Also... Isn't there a need for a Sieve extension to allow "fileinto" to target a folder based on special-use ?

3 4

Re: doveadm pw generates different hash each time it is invoked
by Joseph Tam 29 Dec '14

29 Dec '14

reik red writes: > (I'm re-submittting after setting up a subscription, so I don't have to wait for the moderator) > , > What happened next surprised me greatly: if I specify "-s ssha", the > resulting hashed password changes each time I invoke "doveadm pw", but > if I do not specify the hashing method, I get the same password each time (as I > expect). What on earth is going on here? There must be something > fundamental that I am missing. "doveadm pw" is working correctly. CRAM-MD5 and SSHA use hashing in 2 different ways to authenticate a user. CRAM-MD5 is a challenge-response system where the server sends the client a random string each and every session. The client hashes the password and the random string and sends it to the server as proof of authenticity. The server performs the same calculation to verify. However, the server needs to know the password (or password equivalent) in order to duplicate the hash calculation. SSHA precomputes the random strings (salt) and hashes the password with it, and stores both salt and hash in the password database. During authentication, the password is (or ought to be) transmitted plain within a SSL connection from the client to the server, then the server hashes the password with the stored salt and compares with the hash in the database. Every time you run "doveadm pw -s sha" a new random salt is generated, hence a new hash is produced even though you use the same password. You would use challenge-response in situations where the communication channel is insecure (i.e. non-SSL). However, the drawback is the password database contains enough information for someone to authenticate if it should fall into the wrong hands. Joseph Tam <jtam.home(a)gmail.com>

1 0

Re: Awfully slow dovecot
by Joseph Tam 29 Dec '14

29 Dec '14

Robin Helgelin writes: > We?re using dovecot 1.0.7, which seems to be the latest version > available on CentOS 5. It wouldn't be a bad idea to update this if you can, even if you have to compile it yourself. You'll benefit from many bug fixes, one of which may solve your problem. > Downloading emails are dead slow. Really small emails goes quickly, > but normal emails and emails with attachments are so slow to download > it?s almost ridiculous. I?ve googled some and found that it could be > related to quota, but I disabled the quota plugins on imap with no > difference. The problem with "slowness" is that it can result from just about anything. I've seen reports of slowness caused by LDAP handups, filesystem and I/O polling, client issues, network issues, firewall issues, anti-virus stuff, resource starvation. That's just the stuff I remember. You'll need to dig further to reduce the scope of where it can be going wrong. I would suggest getting hints from - process tracing - network snooping - logs Test if it's a mail client issue by sampling more than one mail client (or better yet, talk IMAP directly to the server via telnet or netcat and download a large piece of Email). If that provokes a problem, work your way back to the server and do the same thing on the server itself (bypassing the network stack) and see if the problem still persists. Depending on what you find out, at least you'll know which side of the fence you should be looking at. (Also, asks yourself the obvious question: did you change anything before dovecot performance went down the tubes? New hardware? Patches?) Joseph Tam <jtam.home(a)gmail.com>

1 0

Deleting files in sdbox
by Jeff Mitchell 28 Dec '14

28 Dec '14

Hello, I'm curious as to what happens if I were to manually delete files in an sdbox on the server. A long time ago -- I'm not sure how, as it was several years ago -- something happened and a number of users got a large number of mail messages duplicated. Literally duplicated -- all headers, all body content. I have a script that can find these duplicated messages (by ignoring the first few and last few lines of each message, and using SHAs to compare and find the duplicates). However, I don't see a doveadm style command to manually delete messages, except for doveadm-expunge. In the past I've used that with search queries but my experience is that trying to do many individual operations on individual files with doveadm-expunge can be quite slow. So, if Dovecot is going to just say "huh, my indexes/metadata are wrong, lemme rebuild them", I'd rather just rm the messages and let Dovecot do its thing. Again, this is with sdbox storage. Dovecot version is 2.2.9. Thanks! --Jeff

3 3

Thunderbird supports SPECIAL-USE (Merry x-mas!)
by Patrick Ben Koetter 27 Dec '14

27 Dec '14

I've waited about two years to write this mail... :) As of Dezember, 24th Mozilla Thunderbird can handle SPECIAL-USE. The patch, which adds the required functionality, has passed review and TBs nightly build was successful. The next official Thunderbird release (version 38, release date 2015-05-19) will very likely ship SPECIAL-USE included. \o/ SPECIAL USE is an IMAP extension. It means less mailbox chaos for admins. But more than that it means less configuration work and easier orientation for end users. If IMAP server and client are capable of SPECIAL-USE [1] the server may tell the client some of the folders (Inbox, Drafts, Sent, Trash etc.) are reserved for SPECIAL-USE. Any client, capable of SPECIAL-USE, may adapts its local folders to the servers view. It may map e.g. "Sent Items" to "Sent", "Deleted Items" to "Trassh" etc. pp. All this takes place automatically. No more user interaction. No more locale problems. When all components - server, desktop-, webmail-, and mobile client - can handle SPECIAL-USE live becomes easier. Clients don't create their own 'special folders'. They understand special folders already exist and adapt. No more superfluous ambiguous folders. Users will know where their messages have been stored. Note: Combined with automx [2] users will only have to enter their realname, mail address and (optional) password and their client will setup all the rest automatically. SPECIAL-USE started as a suggestion to friends at IETF. We sponsored its implementation in Dovecot [3], when it had become a RFC standard. Then we took out to bring it to Thunderbird. This took use longer than expected. The moment we had begun to work on it, Mozilla withdrew most people from the Thunderbird team and reassigned them to Firefox OS. Things slowed down significantly and Microsoft Outlook became the first mail client to adopt SPECIAL-USE. Two years later - together with Ben Bucksch (Thunderbird developer) - we finally succeeded and it is about time to close the RFE [4]. Nobody should have to spend more time than required to configure their client. Everyone should be able to focus on their primary goal - communication via mail. We - sys4 and our business partner Becon - sponsored SPECIAL-USE. I hope SPECIAL-USE will make your and your customers life easier. The patch just became ready for x-mas. :) p@rick P.S. Unpacking the gift will have to wait until 2015-05-19. ;) [1] IMAP LIST Extension for Special-Use Mailboxes <http://tools.ietf.org/rfc/rfc6154.txt> [2] automx - mail setup made easy! <https://automx.org/> [3] Mailbox settings http://wiki2.dovecot.org/MailboxSettings [4] Bug 558659 - (RFC6154) Support IMAP LIST SPECIAL-USE (RFC 6154) to autoconfigure Sent, Trash, Draft folders on IMAP servers <https://bugzilla.mozilla.org/show_bug.cgi?id=558659> -- [*] sys4 AG https://sys4.de, +49 (89) 30 90 46 64 Franziskanerstraße 15, 81669 München Sitz der Gesellschaft: München, Amtsgericht München: HRB 199263 Vorstand: Patrick Ben Koetter, Marc Schiffbauer Aufsichtsratsvorsitzender: Florian Kirstein

5 4

Awfully slow dovecot
by Robin Helgelin 26 Dec '14

26 Dec '14

Hi, We’re using dovecot 1.0.7, which seems to be the latest version available on CentOS 5. Downloading emails are dead slow. Really small emails goes quickly, but normal emails and emails with attachments are so slow to download it’s almost ridiculous. I’ve googled some and found that it could be related to quota, but I disabled the quota plugins on imap with no difference. dovecot -n: # 1.0.7: /etc/dovecot.conf ssl_cert_file: /etc/dovecot/cert.pem ssl_key_file: /etc/dovecot/key.pem disable_plaintext_auth: yes verbose_ssl: yes login_dir: /var/run/dovecot/login login_executable(default): /usr/libexec/dovecot/imap-login login_executable(imap): /usr/libexec/dovecot/imap-login login_executable(pop3): /usr/libexec/dovecot/pop3-login valid_chroot_dirs: /var/mail/domains verbose_proctitle: yes last_valid_uid: 500 mail_location: maildir:/var/mail/domains/%d/%n/mail mail_executable(default): /usr/libexec/dovecot/imap mail_executable(imap): /usr/libexec/dovecot/imap mail_executable(pop3): /usr/libexec/dovecot/pop3 mail_plugins(default): mail_plugins(imap): mail_plugins(pop3): quota mail_plugin_dir(default): /usr/lib/dovecot/imap mail_plugin_dir(imap): /usr/lib/dovecot/imap mail_plugin_dir(pop3): /usr/lib/dovecot/pop3 auth default: mechanisms: plain login passdb: driver: ldap args: /etc/dovecot/dovecot-ldap.conf userdb: driver: ldap args: /etc/dovecot/dovecot-ldap.conf socket: type: listen client: path: /var/spool/postfix/private/auth mode: 384 user: postfix group: postfix master: path: /var/run/dovecot/auth-master mode: 384 user: vmail group: mail plugin: convert_mail: maildir:/var/mail/domains/%d/%u/mail dovecot-ldap.conf: auth_bind = yes hosts = example.com ldap_version = 3 base = o=hosting,dc=example,dc=com dn = cn=phamm,o=hosting,dc=example,dc=com dnpass = password pass_attrs = mail pass_filter = (&(objectClass=VirtualMailAccount)(accountActive=TRUE)(mail=%u)) user_attrs = mail,,,mail,,,quota=quota=maildir:storage user_filter = (&(objectClass=VirtualMailAccount)(accountActive=TRUE)(mail=%u)) deref = never scope = subtree default_pass_scheme = MD5 user_global_uid = 500 user_global_gid = 12

9 15

Curious dovecot behavior with service_count = 0
by anon_user＠openmailbox.org 26 Dec '14

26 Dec '14

Hello, I'm not experiencing this problem at all with service_count = 1 With service_count = 0, this is what I got randomly in my logs: TLS: SSL_read() syscall failed: Connection reset by peer To be successfully logged, the user have to initiate a new connection. I primary thought about vsz_limit but I've put this value to 10GB (yes this is very overkill, that was just for the test) and that don't change anything. I use the lastest version of dovecot. Any ideas ? Thanks.

1 1

Re: Maildir permissions on creation?
by Von Random 26 Dec '14

26 Dec '14

The main reason is that I don't want to provide backup user with unnecessary write permissions within maildirs and mail user within backup logs dir. I was talking about mail_user:mail_group 0750 on dirs and 0640 on files. (Or, possibly, mail_user:backup_group 2750 and 2640.) 26.12.2014, 11:19, "Tobi" <tobster(a)brain-force.ch>: > Whats the reason you do not want to use default dovecot user. Your idea would assume that at least the group must have write access. For me a no-go on mailboxes. > > Am 24. Dezember 2014 13:21:15 MEZ, schrieb Von Random <von(a)vdrandom.org>: >> Hello. >> >> In my configuration dovecot reads home from mysql and uses no variables >> within it. It uses Maildir++ storage with virtual users. I also happen >> to use LMTP. >> >> I want to use a backup solution that does not involve running itself as >> root. Neither do I want to run it as dovecot's mail user. >> >> And there lies the problem: dovecot creates maildirs with 0700 and >> files within them inherit that set of permissions. And there seems to >> be no sane way to control it. I think I've figured out what to patch in >> order to change that default, but if possible, I'd like to avoid doing >> that. >> >> tl;dr: is it possible to change the default set of permissions for new >> maildirs created by dovecot? > > - -- > Diese Nachricht wurde von meinem Android-Mobiltelefon mit K-9 Mail gesendet. >> -----BEGIN PGP SIGNATURE----- >> Version: APG v1.1.1 >> >> iQI7BAEBCgAlBQJUnRoiHhxUb2JpIDx0b2JzdGVyQGJyYWluLWZvcmNlLmNoPgAK >> CRA1HOYlqGik5L9iD/9FIE2JzWfB7fWJEbI3vVg+ar4LRGwW1xNIf8ahlytPbsmH >> D9dFP3kWpJH6TO41AksNjz/FxHcUqSrlsKYTFUsDZCyb9Zyxd8Jv+dH04FwUzw+y >> kq+ayoylnTN7Q8mQnqkUpWEuYd5ohWbbUUSguwzN8Zd1T4jCFR9/Lvu0cweE6meu >> mBGwvXBbfBP4El+mAM2lKnoMXQpMycS6aX7FwQ/fBaoWSkzg/2az69UtqG6LLF67 >> ZhJkbn17cpT3y/l/2nV5urdcFVh8RoSXNuYyMN4r7IDKQ6BPsneD+839LS9X/gP/ >> QMuo5nO5xdx4q1bT9gtv1zz5eKAJ1f3R2oPZyxdpiV5PruSY3J3kvu0cF0aJvQF6 >> +s0iDsoDBcueB6JEUnYAarteWvBvxRnqb8ytju1xbIEkKLZtaS8Gf2cpZ8eA+Ha/ >> D0zkYfq7bt+Ra7BY6Qh7XMfiN5z9eWe5RqOmVLZRLf9N75U6wWa+fmXpvlqEtGNV >> pKsgif/ivCHiA24+JSJ1PBRjwO36Tu4MsSlT2WnkvyFBQzFzg9T00fl+uTXzgNEz >> SBta2wmXk9XVJ9mPzfNrAaAA3+T6H90Sj1CbRt7NZx30UdwYoIL5XXEtnG0p1XdS >> moe91H2UE+NT+jgj7emAOLxJf86vIwiHCqI0Zl/7wVNJEnKBXJP5WIHcdEDEHg== >> =Tl/z >> -----END PGP SIGNATURE-----

1 1

doveadm pw generates different hash each time it is invoked !?
by reik red 26 Dec '14

26 Dec '14

I am absolutely dumbfounded by "doveadm pw". My understanding is that the command should be used to create a hashed password that should in turn be placed into /etc/dovecot/passwd Here comes the "dumbfounded" part. I was creating a new virtual user, running doveadm pw to generate the hashed password. But when I tried to login via imap, the password was rejected. So I started checking that I had populated /etc/dovecot/passwd with the correct values, and in the process I ran "doveadm pw" again to make certain I had not accidentally pasted the wrong value along with a username. (I'm re-submittting after setting up a subscription, so I don't have to wait for the moderator) , What happened next surprised me greatly: if I specify "-s ssha", the resulting hashed password changes each time I invoke "doveadm pw", but if I do not specify the hashing method, I get the same password each time (as I expect). What on earth is going on here? There must be something fundamental that I am missing. ============================================== Illustrative example: machine(user) 6136 > doveadm pw -u joebob Enter new password: Retype new password: {CRAM-MD5}00747cf2ffaf11c5ea4a64979c3901fc1d20dee13f480bb598f7d8575b23e61b machine(user) 6137 > doveadm pw -u joebob Enter new password: Retype new password: {CRAM-MD5}00747cf2ffaf11c5ea4a64979c3901fc1d20dee13f480bb598f7d8575b23e61b #SAME, as expected machine(user) > doveadm pw -u glorg Enter new password: Retype new password: {CRAM-MD5}00747cf2ffaf11c5ea4a64979c3901fc1d20dee13f480bb598f7d8575b23e61b #another surprising behavior: The (virtual) username specified does not affect the hash!!! machine(user) 6138 > doveadm pw -u joebob -s ssha Enter new password: Retype new password: {SSHA}AtjINkQra967qIhU6khRED4U1x3aKwDi machine(user) 6139 > doveadm pw -u joebob -s ssha Enter new password: Retype new password: {SSHA}fZiFlHPKDn6ESM/gnUIcjJ14hRlH10DV # DIFFERENT, very unexpected ============================================== I'm on fedora 19, using dovecot.x86_64 version 1:2.2.15-1.fc19 per yum.

2 1

Dovecot-ee
by Davide 25 Dec '14

25 Dec '14

Hi to all, i found that dovecot-ee repository access is free 0,00 $ cost; i'm running dovecot community 2.2.13 can i migrate my system to dovecot-ee? What are difference between Dovecot-ee and Dovecot-community? -- *Davide Marchi* *T*eorema *F*errara *Srl* Via Spronello, 7 - Ferrara - 44121 Tel. *0532783161* Fax. *0532783368* E-m@il: *davide.marchi(a)mail.cgilfe.it* Skype: *davide.marchi73* Web: *http://www.cgilfe.it* *CONFIDENZIALITA'* *Ai sensi del D.Lgs. 196/2003 si precisa che le informazioni contenute in questo messaggio sono riservate ed a uso esclusivo del destinatario/dei destinatari. Qualora il messaggio in parola Le fosse pervenuto per errore, La invitiamo ad eliminarlo senza copiarlo e a non inoltrarlo a terzi, dandocene gentilmente comunicazione.* *Per favore, pensa all'ambiente. Stampa questa email solo se necessario.*

3 3

director + lmtp + ldap user
by Lazy 25 Dec '14

25 Dec '14

Hi, recently I have migrated our prevoius dovecot-lda to 2.2 with director + lmtp. And we are having some issues. When lmtp delivers to ldap uid names everything works except sieve vacation (login is not found in headers so reply is not sent). When using full email addresses in rcpt to vacation works but usernames are inconsistent (one user can login using his email address, or aliases, or uid). To fix that in ldap settings a have added uid=user which should be setting the username to approperate values. Most of the times it works but some deliveries are using email addresses not ldap uid's which seems to break dict quota's. It's must be related to auth cache (flushing the cache fixes the issue temporarly for given account). I think that the cache can be "polluted" by some other dovecot service. Does anyone have an idea where this can be comming from ? doveadm auth lookup -f user mon(a)test.com returns expected ldap uid no email address Thanks in advance for any help. Michal Grzedzicki from dovecot-ldap.conf.ext from backends user_attrs = uid=user, mailMessageStore=home, mailQuotaSize=quota_rule=*:bytes=%$ user_filter = (&(&(!(accountStatus=deleted))(objectClass=qMailUser))(|(mail=%u)(uid=%u)(mailAlternateAddress=%u))) pass_attrs = uid=user,userPassword=password pass_filter = (&(objectClass=qMailUser)(|(mail=%u)(uid=%u)(mailAlternateAddress=%u))) iterate_attrs = uid=user iterate_filter = (&(&(objectClass=qmailUser)(!(accountStatus=deleted)))) director is doing the authorization and passing it to the backend using a master user protocol lmtp { passdb { args = proxy=y nopassword=y port=24 } } backend doveconf -n # 2.2.15: /etc/dovecot/dovecot.conf # OS: Linux 3.2.0-4-amd64 x86_64 Debian 7.7 auth_cache_negative_ttl = 5 mins auth_cache_size = 10 M auth_cache_ttl = 5 mins auth_debug = yes auth_master_user_separator = * auth_mechanisms = plain login auth_username_format = %u auth_verbose = yes base_dir = /var/run/dovecot/ deliver_log_format = msgid=%m f:%f s:%s %$ disable_plaintext_auth = no first_valid_gid = 300 first_valid_uid = 300 import_environment = TZ last_valid_gid = 300 last_valid_uid = 300 lda_mailbox_autocreate = yes lda_mailbox_autosubscribe = yes lda_original_recipient_header = Delivered-To login_greeting = Imap ready. mail_debug = yes mail_gid = 300 mail_location = maildir:~/Maildir:INDEX=/var/dovecot_indexes%h mail_plugins = quota expire notify mail_log mail_uid = 300 maildir_very_dirty_syncs = yes managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date ihave duplicate namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox SPAM { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } passdb { args = /etc/dovecot/master-users driver = passwd-file master = yes pass = yes } passdb { args = /etc/dovecot/dovecot-ldap.conf.ext driver = ldap } plugin { expire = SPAM expire_dict = redis:host=127.0.0.1:prefix=expire/ mail_log_events = delete undelete expunge copy mailbox_delete mailbox_rename mail_log_fields = uid box msgid from subject size quota = dict:User quota::redis:host=127.0.0.1:prefix=user/ quota_warning = storage=95%% quota-warning 95 %u quota_warning2 = storage=80%% quota-warning 80 %u sieve_global_dir = /etc/sieve_global sieve_max_redirects = 20 } postmaster_address = postmaster(a)iq.pl protocols = imap pop3 lmtp sieve recipient_delimiter = service auth { unix_listener auth-userdb { mode = 0777 } } service dict { unix_listener dict { group = vmail user = vmail } } service doveadm { inet_listener { port = 2424 } } service imap-login { process_min_avail = 8 service_count = 0 } service imap { process_limit = 14000 } service lmtp { inet_listener lmtp { address = dovecot1 port = 24 } process_min_avail = 5 user = vmail } service managesieve-login { inet_listener sieve { address = 0.0.0.0 port = 4090 } protocol = sieve } service pop3-login { process_min_avail = 8 service_count = 0 } service pop3 { process_limit = 10000 } service quota-warning { executable = script /usr/local/bin/quota_warning.sh unix_listener quota-warning { user = vmail } user = vmail } ssl = no syslog_facility = local2 userdb { args = /etc/dovecot/dovecot-ldap.conf.ext driver = ldap } verbose_proctitle = yes protocol lmtp { auth_username_format = %u info_log_path = /var/log/dovecot-lmtp mail_plugins = quota expire notify mail_log sieve syslog_facility = local3 } protocol lda { mail_plugins = quota expire notify mail_log sieve syslog_facility = local3 } protocol imap { mail_max_userip_connections = 30 mail_plugins = quota expire notify mail_log imap_quota }

1 0

Maildir permissions on creation?
by Von Random 24 Dec '14

24 Dec '14

Hello. In my configuration dovecot reads home from mysql and uses no variables within it. It uses Maildir++ storage with virtual users. I also happen to use LMTP. I want to use a backup solution that does not involve running itself as root. Neither do I want to run it as dovecot's mail user. And there lies the problem: dovecot creates maildirs with 0700 and files within them inherit that set of permissions. And there seems to be no sane way to control it. I think I've figured out what to patch in order to change that default, but if possible, I'd like to avoid doing that. tl;dr: is it possible to change the default set of permissions for new maildirs created by dovecot?

1 0

Configuring LMTP/IMAP proxy
by Le Moing, Guenhaël 23 Dec '14

23 Dec '14

Hi, First, my version: [root@centos1 conf.d]# dovecot --version 2.2.15 [root@centos1 conf.d]# I have already configured dovecot that way (on one single VM, so everythinh is stored on the same machine) - A post fix server sending out to LMTP - LMTP is the dovecot LMTP server, configured with "lmtp-proxy= no", - LMTP checks the users receiving messages by using Linux passwd file "userdb" section in auth-passwdfile.conf.ext, - IMAP LOGINS are authenticated using DIGEST-MD5 also configured in auth-passwdfile.conf.ext : - # Authentication for passwd-file users. Included from 10-auth.conf. # # passwd-like file with specified location. # <doc/wiki/AuthDatabase.PasswdFile.txt> passdb { driver = passwd-file args = scheme=DIGEST-MD5 username_format=%n /etc/dovecot/users.DIGEST-MD5 #args = scheme=CRAM-MD5 username_format=%n /etc/dovecot/users.CRAM-MD5 } userdb { driver = passwd # Default fields that can be overridden by passwd-file #default_fields = quota_rule=*:storage=1G default_fields = uid=root gid=root home=/home/%n # Override fields from passwd-file #override_fields = home=/home/virtual/%u } This works fine, I can send messages through SMTP, and read them using IMAP access. But now, I woukd like to have amore structured architecture with : - A LMTP server configured as PROXY : has to identify the user, and proxy the request to the backen LMTP server (where its mailbox will stand) - On backend, I also have to start another LMTP serevr, but not configured in proxy mode of course, - Same for IMAP : IMAP proxy first checking LOGIN credentials, and then forwarding to IMAP server running on backend. As a first step, I would like to continue using my files to authenticate uses (so passwd file , and users.DIGEST-MD5), but final goal will be using a MySQL DB. So my main question are : 1) I just made a test and changed "lmtp_proxy" to "yes" in my 20_lmtp.cong file, but, strangely, this did not cah nge anything ! The LMTP process still receives mails and stores them on the local host , 2) Are there any documentation describing this process in details ? I only found some pieces on wiki pages, but not enough unfortunately ... 3) Are there some configuratiion files ready to use for my configuration. Thanks in advance. Cordialement. Guenhaël. This message contains information that may be privileged or confidential and is the property of the Capgemini Group. It is intended only for the person to whom it is addressed. If you are not the intended recipient, you are not authorized to read, print, retain, copy, disseminate, distribute, or use this message or any part thereof. If you receive this message in error, please notify the sender immediately and delete all copies of this message.

2 1

zlib, mdbox and spam filtering scripts
by Philon 23 Dec '14

23 Dec '14

Hi all, I am quite happily running a dovecot setup with maildirs. This was once running courier but since the migration I have never ever looked back. Now, with growing userbase I’m looking into using zlib compression and mdbox instead of maildir. This seems to go quite well using dsync on a testbed server. So let’s go production! Before final decision I came across this: - I’m using a spam learning address, where users forward their mails to train SpamAssassin. - there is a cron script on the server, mime-stripping the attachments and feeding them into SA - works quite well even for the still numerous POP users So well… compression ok, I could add a gunzip into the script and go from there. But mdbox seems only accessible via dovecot. I don’t think that accessing via IMAP makes sense for a local script. So I would block myself out when using mdbox. How are your spam/ham training routines? How do you feed SA? thank you! Philon

3 4

error: iostream-ssl.h: No such file or directory
by Tobi 22 Dec '14

22 Dec '14

Hi list I'm trying to build dovecot 2.2.15 from source on a debian wheezy (64bit). As I wanted to get starttls support for dovecot's lmtp I got the patched files from here: http://hg.dovecot.org/dovecot-2.2/rev/297192cfbd37 My ./configure ./configure --prefix=/usr/local/dovecot-test --with-solr --with-mysql --with-sql --without-shadow --without-pam configure seems to run fine but the following make ends up in client.c:17:26: fatal error: iostream-ssl.h: No such file or directory compilation terminated. make[3]: *** [client.o] Error 1 make[3]: Leaving directory `/usr/local/src/dovecot-2.2.15/src/lmtp' make[2]: *** [all-recursive] Error 1 make[2]: Leaving directory `/usr/local/src/dovecot-2.2.15/src' make[1]: *** [all-recursive] Error 1 make[1]: Leaving directory `/usr/local/src/dovecot-2.2.15' make: *** [all] Error 2 Any ideas what I'm missing? libssl-dev is installed via apt Thanks for any idea Cheers tobi

3 2

lmtp usernames with -
by Lazy 19 Dec '14

19 Dec '14

Hello I have a problem with lmtp delivery to usernames with '-' char. Everythong after - is ignored. when delivering to test-test2 the error message is. User doesn't exist: test I suspect this is a sideefect of auth_username_format = %Lu I have tried %Ln without success. Imap works without problems for those users. How can I disable this mapping for lmtp and use verbatim username for lookup. Thanks in advance for any answers.

2 3

Migrate maildir between servers dovecot
by Davide Gmail 18 Dec '14

18 Dec '14

Hi to all, i have two servers with dovecot 2.2.15 one is actualy on production (server A) and another that i put on production soon (server B) My goal is migrate maildir from server A and server B. How can i achieve that? I read http://wiki2.dovecot.org/Migration/Dsync but i haven't understand well where to put such configuration (in which server). Thanks in advance for any help.

3 2

best file system ?
by absolutely_free＠libero.it 18 Dec '14

18 Dec '14

Hi, I'm going to set up a new storage for our email users (about 10k). It's a network attached storage (Coraid). In your opinion, what is the best file system for mail server (pop3/imap/webmail) purpose? Thank you

12 14

Migrate dovecot maildirbetween servers
by Davide 18 Dec '14

18 Dec '14

Hi to all, i have two servers with dovecot 2.2.15 one is actualy on production (server A) and another that i put on production soon (server B) My goal is migrate maildir from server A and server B. How can i achieve that? I read http://wiki2.dovecot.org/Migration/Dsync but i haven't understand well where to put such configuration (in which server). Thanks in advance for any help. -- *Davide Marchi Teorema Ferrara Srl** **Via Spronello, 7 - Ferrara - 44121 05327831610532783368 davide.marchi(a)mail.cgilfe.it davide.marchi73 Web: http://www.cgilfe.it* * CONFIDENZIALITA'* *Ai sensi del D.Lgs. 196/2003 si precisa che le informazioni contenute in questo messaggio sono riservate ed a uso esclusivo del destinatario/dei destinatari. Qualora il messaggio in parola Le fosse pervenuto per errore, La invitiamo ad eliminarlo senza copiarlo e a non inoltrarlo a terzi, dandocene gentilmente comunicazione.* *Per favore, pensa all'ambiente. Stampa questa email solo se necessario.*

2 1

LDAP: Connection appears to be hanging, reconnecting
by Matthias Egger 17 Dec '14

17 Dec '14

Hello List I have a strange problem here which i try to analyse, but i'm stuck. Maybe someone has a hint? What happened: A few weeks ago one of the LDAPS Servers which is not maintained by us has crashed. From that moment on, users could still login to check their emails, but they were not able to send any email through postfix (which uses smtpd_sasl_type = dovecot) What i do not understand, is why did dovecot not switch to the second configured LDAPS Server? It looks like it retried for ever to reconnect to the crashed LDAP Server. From the moment of the crash we see a lot of Errors like these in our logfiles: Nov 30 16:51:53 servername dovecot: [ID 583609 mail.error] auth: Error: ldap(userone,USERS_IP1,<WKiTeBUJQQBUSAnE>): Connection appears to be hanging, reconnecting AND Nov 30 16:51:59 servername dovecot: [ID 583609 mail.error] auth: Error: plain(usertwo,USERS_IP2,<QgJvcBUJqABTTWrJ>): Request 1982.83548 timed out after 151 secs, state=1 The used dovecot version is 2.2.13, runs on a solaris 10 system and the configuration for passdb and userdb are: passdb { args = /etc/dovecot-ldap.conf default_fields = deny = no driver = ldap master = no name = override_fields = pass = no result_failure = continue result_internalfail = continue result_success = return-ok skip = never } userdb { args = /etc/dovecot-ldap.conf default_fields = driver = ldap name = override_fields = result_failure = continue result_internalfail = continue result_success = return-ok skip = never } And the dovecot-ldap.conf contains (obfuscated): uris = ldaps://server2.tld ldaps://server1.tld ldaps://server4.tld ldaps://server3.tld dn = ... dnpass = ... ldap_version = 3 auth_bind = yes base = ... scope = onelevel user_attrs = homeDirectory=home,uidNumber=uid,gidNumber=gid user_filter = ... pass_attrs = uid=user pass_filter = ... The strange thing is, that with the very same binaries and configuration (okay, some minimal modifications have been made to bind to the correct interfaces...) a test on our testsystem works as it should. When we shutdown slapd, dovecot recognizes it an connects to the alternate LDAPS. When we shutdown slapd and start a netcat (just to let something listening without responding)... you guess it. Dovecot does recognize it and switches over to the alternate testsystem. So on our testsystem, everything worked as it should. But the productive system did not. And since the LDAPS are not maintained by us it is somewhat hard to try to reproduce something. At least i got the logfiles from server2.tld and server1.tld. But they only show what i still knew. Our server connected to server2.tld until the crash happened. But server1.tld never got any connection. Has someone an idea what i could try to find out why dovecot did not switch to server1.tld? Best regards Matthias Egger -- Matthias Egger ETH Zurich Department of Information Technology maegger(a)ee.ethz.ch and Electrical Engineering IT Support Group (ISG.EE), ETL/F/24.1 Phone +41 (0)44 632 03 90 Physikstrasse 3, CH-8092 Zurich Fax +41 (0)44 632 11 95

2 2

dsync summary?
by Randall Gellens 17 Dec '14

17 Dec '14

Is there a way for dsync to report a summary of what it did? For example, when finished, it could report how many messages in how many folders were added (or deleted for a two-way sync) or had flags modified, and if any messages/folders were skipped due to errors or whatever. This could provide a sanity check that a sync looks like it worked. -- Randall Gellens Opinions are personal; facts are suspect; I speak for myself only -------------- Randomly selected tag: --------------- Hippogriff: An animal (now extinct) which was half horse and half griffin. The griffin was itself a compound creature, half lion and half eagle. The hippogriff was actually, therefore, only one quarter eagle, which is two dollars and fifty cents in gold. The study of zoology is full of surprises.

2 1

Re: [2.3 feature request]: multiple passwords for single user
by Rick Romero 17 Dec '14

17 Dec '14

Quoting Arkadiusz Miśkiewicz <arekm(a)maven.pl>: > Hi. > > I wonder if there any plans of finishing "multiple passwords for single > user" > feature? > <snip> > > Untill that happens (not that great) workaround exists: > http://wiki2.dovecot.org/Authentication/MultipleDatabases > > Whoops misfired Unless you want a single service to have multiple passwords, which doesn't seem like a good idea to me, use SQL if statements to separate by service/host. http://www.dovecot.org/list/dovecot/2014-July/097140.html

2 1

dsync "Error: imapc: Remote server didn't send BODY[] for UID"
by Randall Gellens 17 Dec '14

17 Dec '14

Anyone know what this means and what the implications are? Does this mean some messages are missing? $sudo dsync -D -v -f -R -o mail_fsync=never backup -u test imapc: ... dsync(test): Error: imapc: Remote server didn't send BODY[] for UID 266 in #somefolder -- Randall Gellens Opinions are personal; facts are suspect; I speak for myself only -------------- Randomly selected tag: --------------- Hippogriff: An animal (now extinct) which was half horse and half griffin. The griffin was itself a compound creature, half lion and half eagle. The hippogriff was actually, therefore, only one quarter eagle, which is two dollars and fifty cents in gold. The study of zoology is full of surprises.

1 0

replication - more than 2 servers?
by Ron Cleven 17 Dec '14

17 Dec '14

We tested dovecot for a fair amount of time and decided finally to put it into production under CentOS 7 (we are running 2.2.10). I just joined the list, so I apologize for what is probably a question that has been answered many times, but I was wondering if there are any plans to implement replication among 3 or more servers (all "masters", as with 2)? As best as I can tell, replication seems to be limited to 2 servers, and it is not obvious to me even how more than 2 would be supported syntactically in the configs. That is, what might be an example of the "mail_replica" clauses if such a thing was supported?

3 2

Replication sieve scripts.
by Jan Wideł 16 Dec '14

16 Dec '14

Hi, according to changelog 2.2.rc3, dsync should replicate sieve scripts. Do I need turn on or switch some option(s), for this to work? Replication of mailboxes works great, only sieve scripts not. root@mail-1-proidea ~ # dpkg -l dovecot* | grep ^ii ii dovecot-core 2:2.2.15-1~auto+0 amd64 secure POP3/IMAP server - core files ii dovecot-imapd 2:2.2.15-1~auto+0 amd64 secure POP3/IMAP server - IMAP daemon ii dovecot-ldap 2:2.2.15-1~auto+0 amd64 secure POP3/IMAP server - LDAP support ii dovecot-lmtpd 2:2.2.15-1~auto+0 amd64 secure POP3/IMAP server - LMTP server ii dovecot-managesieved 2:2.2.15-1~auto+0 amd64 secure POP3/IMAP server - ManageSieve server ii dovecot-pop3d 2:2.2.15-1~auto+0 amd64 secure POP3/IMAP server - POP3 daemon ii dovecot-sieve 2:2.2.15-1~auto+0 amd64 secure POP3/IMAP server - Sieve filters support My configuration (doveconf-n): # 2.2.15: /etc/dovecot/dovecot.conf # OS: Linux 3.2.0-4-grsec-amd64 x86_64 Debian 7.7 ext4 auth_mechanisms = plain login auth_verbose = yes default_client_limit = 5000 default_process_limit = 500 default_vsz_limit = 768 M doveadm_password = xxxxxxxxx doveadm_port = 10900 lda_mailbox_autocreate = yes lda_mailbox_autosubscribe = yes mail_gid = vmail mail_location = maildir:/srv/mail/virtual/%d/%u mail_plugins = " notify replication mail_log" mail_uid = vmail managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date ihave duplicate imapflags notify namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } passdb { args = /etc/dovecot/dovecot-ldap.conf.ext driver = ldap } plugin { mail_log_events = delete undelete expunge copy mailbox_delete mailbox_rename mail_log_fields = uid box msgid size mail_replica = tcps:mail2.xxxxxxx:10900 sieve = file:~/sieve;active=~/dovecot.sieve sieve_dir = ~/sieve sieve_extensions = +notify +imapflags sieve_global_dir = /etc/dovecot/sieve/global/ sieve_global_path = /etc/dovecot/sieve/default.sieve } postmaster_address = postmaster(a)networkers.pl protocols = " imap lmtp sieve pop3" replication_max_conns = 5 service aggregator { fifo_listener replication-notify-fifo { user = vmail } unix_listener replication-notify { user = vmail } } service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0660 user = postfix } unix_listener auth-client { group = postfix mode = 0660 user = postfix } unix_listener auth-master { group = vmail mode = 0660 user = vmail } unix_listener auth-userdb { group = vmail mode = 0660 user = vmail } } service doveadm { inet_listener { address = x.x.x.x port = 10900 ssl = yes } } service imap-login { inet_listener imap { port = 143 } inet_listener imaps { port = 993 ssl = yes } process_limit = 500 process_min_avail = 2 } service lmtp { unix_listener /var/spool/postfix/private/dovecot-lmtp { group = postfix mode = 0660 user = postfix } } service managesieve-login { inet_listener sieve { port = 4190 } } service managesieve { process_limit = 1024 } service pop3-login { inet_listener pop3 { port = 110 } inet_listener pop3s { port = 995 ssl = yes } } service replicator { process_min_avail = 1 unix_listener replicator-doveadm { group = vmail mode = 0660 user = dovecot } } ssl = required ssl_cert = </etc/dovecot/dovecot.pem ssl_client_ca_dir = /etc/ssl/certs ssl_key = </etc/dovecot/private/dovecot.pem userdb { args = /etc/dovecot/dovecot-ldap.conf.ext default_fields = home=/srv/mail/virtual/%d/%u driver = ldap } protocol lmtp { mail_plugins = " notify replication mail_log quota sieve" postmaster_address = postmaster(a)networkers.pl } protocol lda { auth_socket_path = /var/run/dovecot/auth-master mail_plugins = " notify replication mail_log sieve sieve autocreate" } protocol imap { mail_max_userip_connections = 20 } protocol sieve { managesieve_implementation_string = Dovecot Pigeonhole managesieve_max_line_length = 65536 } -- Jan Wideł Senior System Administrator e-mail: jan.widel(a)networkers.pl mobile: +48 797 004 946 www: http://www.networkers.pl GPG: http://networkers.pl/GPG/2E7359CD.asc

5 11

Problem with TLS and Outlook 2010
by Wayne Andersen 16 Dec '14

16 Dec '14

Dovecot 2.0.9 So I am trying to get my Outlook 2010 client to use TLS with Dovecot. The Outlook error that I get is: Log onto incoming mail server (IMAP): A secure connection to the server cannot be established. I have set the port to 143,993,995 none of them work, and the security to TLS. I have all of the certificates in the full chain installed on my machine and when viewing them they all show This certificate is OK. I have turned on Outlook logging and am seeing this: C:\PROGRA~2\MICROS~2\Office14\OUTLMIME.DLLIMAP: 14:48:40 [db] Intializing connection [131383B0] IMAP: 14:48:40 [db] Setting internal codepage to 1200 IMAP: 14:48:40 [db] Connecting to 'mail.mydomain.com' on port 143. IMAP: 14:48:40 [db] OnNotify: asOld = 0, asNew = 2, ae = 0 IMAP: 14:48:40 [db] srv_name = "mail.mydomain.com" srv_addr = 174.46.198.101:143 IMAP: 14:48:40 [db] OnNotify: asOld = 2, asNew = 3, ae = 1 IMAP: 14:48:40 [db] OnNotify: asOld = 3, asNew = 4, ae = 0 IMAP: 14:48:40 [db] OnNotify: asOld = 4, asNew = 5, ae = 2 IMAP: 14:48:40 [db] OnNotify: asOld = 5, asNew = 5, ae = 4 IMAP: 14:48:40 [db] OnNotify: asOld = 5, asNew = 5, ae = 3 IMAP: 14:48:40 [rx] * OK [CAPABILITY IMAP4REV1 LOGIN-REFERRALS IDLE AUTH=PLAIN AUTH=LOGIN] Dovecot ready. ß----- not seeing the STARTTLS capability here. IMAP: 14:48:40 [tx] sx59 CAPABILITY IMAP: 14:48:40 [db] OnNotify: asOld = 5, asNew = 5, ae = 3 IMAP: 14:48:40 [rx] * CAPABILITY IMAP4REV1 LOGIN-REFERRALS IDLE AUTH=PLAIN AUTH=LOGIN IMAP: 14:48:40 [rx] sx59 OK Capability completed. IMAP: 14:48:40 [db] ERROR: "A secure connection to the server cannot be established.", hr=0x800CCCE1 IMAP: 14:48:40 [db] Connection to 'mail.mydomain.com' closed. IMAP: 14:48:40 [db] OnNotify: asOld = 5, asNew = 0, ae = 5 >From a windows 7 client if I do a telnet mail.mydomain.com 143 I get: * OK [CAPABILITY IMAP4REV1 LOGIN-REFERRALS IDLE AUTH=PLAIN AUTH=LOGIN] Dovecot ready. ß--- do not see STARTTLS in the capability list. Same windows client: C:\OpenSSL-Win64\bin>openssl.exe s_client -connect mail.mydomain.com:993 WARNING: can't open config file: /usr/local/ssl/openssl.cnf Loading 'screen' into random state - done CONNECTED(0000018C) depth=2 C = GB, ST = Greater Manchester, L = Salford, O = COMODO CA Limited, CN = COMODO RSA Certification Authority verify error:num=20:unable to get local issuer certificate ß--- Yes I see this and it may be an issue, but this certificate exist and is valid. verify return:0 --- Certificate chain 0 s:/OU=Domain Control Validated/OU=COMODO SSL Wildcard/CN=*.mydomain.com i:/C=GB/ST=Greater Manchester/L=Salford/O=COMODO CA Limited/CN=COMODO RSA Domain Validation Secure Server CA 1 s:/C=GB/ST=Greater Manchester/L=Salford/O=COMODO CA Limited/CN=COMODO RSA Domain Validation Secure Server CA i:/C=GB/ST=Greater Manchester/L=Salford/O=COMODO CA Limited/CN=COMODO RSA Certification Authority 2 s:/C=GB/ST=Greater Manchester/L=Salford/O=COMODO CA Limited/CN=COMODO RSA Certification Authority i:/C=SE/O=AddTrust AB/OU=AddTrust External TTP Network/CN=AddTrust External CA Root --- Server certificate -----BEGIN CERTIFICATE----- MIIFVjCCBD6gAwIBAgIQWCEHgEVoKToQkXoG3+g1cTANBgkqhkiG9w0BAQsFADCB kDELMAkGA1UEBhMCR0IxGzAZBgNVBAgTEkdyZWF0ZXIgTWFuY2hlc3RlcjEQMA4G fs2e2XCjkEVu/YR7exKkmTf9wkhZ+tD0+S8= -----END CERTIFICATE----- subject=/OU=Domain Control Validated/OU=COMODO SSL Wildcard/CN=*.mydomain.com issuer=/C=GB/ST=Greater Manchester/L=Salford/O=COMODO CA Limited/CN=COMODO RSA Domain Validation Secure Server CA --- No client certificate CA names sent --- SSL handshake has read 5169 bytes and written 497 bytes --- New, TLSv1/SSLv3, Cipher is DHE-RSA-AES256-GCM-SHA384 Server public key is 2048 bit Secure Renegotiation IS supported Compression: NONE Expansion: NONE SSL-Session: Protocol : TLSv1.2 Cipher : DHE-RSA-AES256-GCM-SHA384 Session-ID: 281D21C81FA6E7656B9CA2BD13590DDE0094CC8FA43FFD31DFEEDEC74F2511BF Session-ID-ctx: Master-Key: AF36CFDBBAA955270A48E2E9740F671299511DA1B3EEAFFAEC582E100DE519EC7CBC612ED686 DBBBFE06B9D6E535B837 Key-Arg : None PSK identity: None PSK identity hint: None SRP username: None TLS session ticket lifetime hint: 300 (seconds) TLS session ticket: 0000 - 1d 2a e7 fd 94 9d a2 84-90 52 32 2f e7 89 28 59 .*.......R2/..(Y 0010 - 12 d5 b3 56 0e a7 71 c4-84 53 01 ec 95 97 59 4e ...V..q..S....YN 0020 - ac 17 3f 3f dc b6 b0 db-0f 47 0c 88 5a c2 7b a7 ..??.....G..Z.{. 0030 - d0 73 ff 19 ec 6f cd 67-d5 58 3e cd 91 eb 79 90 .s...o.g.X>...y. 0040 - 76 a9 d9 f2 17 dc da c4-bd ba 69 b4 11 c7 65 f9 v.........i...e. 0050 - 71 42 01 3b bd 6f a5 3a-9f 34 48 36 9e 31 4e 1c qB.;.o.:.4H6.1N. 0060 - 93 24 75 7f 8a c6 7f 7a-4c cd 93 bd 92 4c 9d 7f .$u....zL....L.. 0070 - df 47 11 3e 93 11 73 8e-09 5c ef 85 e2 aa bc 77 .G.>..s..\.....w 0080 - eb 29 fa c6 30 5b 27 de-50 98 47 7b 55 f0 84 91 .)..0['.P.G{U... 0090 - 97 da 66 29 1c c9 7e 63-56 8b a7 80 57 4b 2f 2c ..f)..~cV...WK/, Start Time: 1418336961 Timeout : 300 (sec) Verify return code: 20 (unable to get local issuer certificate) --- * OK [CAPABILITY IMAP4rev1 LITERAL+ SASL-IR LOGIN-REFERRALS ID ENABLE IDLE AUTH=PLAIN AUTH=LOGIN] Dovecot ready. e logout closed >From a linux client I get : * OK [CAPABILITY IMAP4rev1 LITERAL+ SASL-IR LOGIN-REFERRALS ID ENABLE IDLE STARTTLS AUTH=PLAIN AUTH=LOGIN] Dovecot ready. I do see STARTTLS here. >From a linux client: openssl s_client -connect localhost:993 CONNECTED(00000003) depth=3 C = SE, O = AddTrust AB, OU = AddTrust External TTP Network, CN = AddTrust External CA Root verify return:1 depth=2 C = GB, ST = Greater Manchester, L = Salford, O = COMODO CA Limited, CN = COMODO RSA Certification Authority verify return:1 depth=1 C = GB, ST = Greater Manchester, L = Salford, O = COMODO CA Limited, CN = COMODO RSA Domain Validation Secure Server CA verify return:1 depth=0 OU = Domain Control Validated, OU = COMODO SSL Wildcard, CN = *.mydomain.com verify return:1 --- Certificate chain 0 s:/OU=Domain Control Validated/OU=COMODO SSL Wildcard/CN=*.mydomain.com i:/C=GB/ST=Greater Manchester/L=Salford/O=COMODO CA Limited/CN=COMODO RSA Domain Validation Secure Server CA 1 s:/C=GB/ST=Greater Manchester/L=Salford/O=COMODO CA Limited/CN=COMODO RSA Domain Validation Secure Server CA i:/C=GB/ST=Greater Manchester/L=Salford/O=COMODO CA Limited/CN=COMODO RSA Certification Authority 2 s:/C=GB/ST=Greater Manchester/L=Salford/O=COMODO CA Limited/CN=COMODO RSA Certification Authority i:/C=SE/O=AddTrust AB/OU=AddTrust External TTP Network/CN=AddTrust External CA Root --- Server certificate -----BEGIN CERTIFICATE----- MIIFVjCCBD6gAwIBAgIQWCEHgEVoKToQkXoG3+g1cTANBgkqhkiG9w0BAQsFADCB fs2e2XCjkEVu/YR7exKkmTf9wkhZ+tD0+S8= -----END CERTIFICATE----- subject=/OU=Domain Control Validated/OU=COMODO SSL Wildcard/CN=*.mydomain.com issuer=/C=GB/ST=Greater Manchester/L=Salford/O=COMODO CA Limited/CN=COMODO RSA Domain Validation Secure Server CA --- No client certificate CA names sent --- SSL handshake has read 5169 bytes and written 453 bytes --- New, TLSv1/SSLv3, Cipher is DHE-RSA-AES256-GCM-SHA384 Server public key is 2048 bit Secure Renegotiation IS supported Compression: NONE Expansion: NONE SSL-Session: Protocol : TLSv1.2 Cipher : DHE-RSA-AES256-GCM-SHA384 Session-ID: 8357FF1D37476EEF1BE64DE443EFFBBED9CE375EA8CA5F1C5ED628B52E723D8F Session-ID-ctx: Master-Key: D6906D40FF47E7ED278AF4D0B143407A53955DA97365A09881EA0C68AAF3B879CB3136A7783B 18A46FD0A0634CBDC17D Key-Arg : None Krb5 Principal: None PSK identity: None PSK identity hint: None TLS session ticket lifetime hint: 300 (seconds) TLS session ticket: 0000 - cb 06 13 9a c9 2a 67 b7-3d 5b 5b 33 3b fe 1e 2e .....*g.=[[3;... 0010 - 18 73 2d ae 9e 4d f3 69-aa 13 ca 9c 07 94 73 cb .s-..M.i......s. 0020 - 02 a2 74 c9 df 70 ed 1b-33 f8 fb cb 97 1d 12 f5 ..t..p..3....... 0030 - 88 21 4e fd 7e be 69 b8-88 30 c9 99 70 f4 ea f3 .!N.~.i..0..p... 0040 - b0 90 c8 ab a6 f4 e5 37-c8 3e 4e 33 24 f9 cd 37 .......7.>N3$..7 0050 - f8 b0 8a 9a f3 44 39 27-e3 3d 96 3b ba a2 4e 85 .....D9'.=.;..N. 0060 - 77 5f a7 f7 6e 12 76 59-51 94 da 63 dd 99 cc 74 w_..n.vYQ..c...t 0070 - 1b 1b 1f 33 02 5f 3d ed-9a 57 e8 63 87 d4 8f d5 ...3._=..W.c.... 0080 - d5 fc 8c bf 89 4d 4d 91-bc 4f c7 67 79 c4 ec e9 .....MM..O.gy... 0090 - 47 68 0f 21 47 58 8a c9-10 a0 3b 46 e9 3b 08 cb Gh.!GX....;F.;.. Start Time: 1418337012 Timeout : 300 (sec) Verify return code: 0 (ok) --- * OK [CAPABILITY IMAP4rev1 LITERAL+ SASL-IR LOGIN-REFERRALS ID ENABLE IDLE AUTH=PLAIN AUTH=LOGIN] Dovecot ready. e logout closed doveconf n | grep ssl # 2.0.9: /etc/dovecot/dovecot.conf ssl_cert = </etc/pki/dovecot/certs/dovecot.pem ssl_cipher_list = ALL:!LOW:!SSLv3:!SSLv2:!EXP:!aNULL ssl_key = </etc/pki/dovecot/private/dovecot.key

3 3