- dovecot - dovecot.org

Share
by liecj3＠bfh.ch 01 Jun '23

01 Jun '23

Hello dear Dovecot users I have a somewhat special request: I have a single file in mbox format which I want to make accessible via IMAP to anonymous logins. The mbox file is being updated outside of Dovecot and should not be changeable by Dovecot. So far I created a Docker container based on the official image (https://hub.docker.com/r/dovecot/dovecot) and configured the Dovecot according to https://doc.dovecot.org/configuration_manual/shared_mailboxes/public_shared/. The volume with the mbox file is mounted in the running container under /var/mail. Each time a client tries to access this public mailbox the following error is logged and no content is returned: May 26 21:57:06 imap(mutt)<16><Rkpg0Z/8pLfAqDAB>: Error: Mailbox Public/archive: open() failed with mbox: Read-only file system. Note that I don't need the file to be a shared mailbox. Instead I would also be happy to have all (anonymous) users mapped to the read-only mbox somewhere in the filesystem. Dockerfile: FROM dovecot/dovecot RUN mkdir -p /var/indexes/public RUN chown 1000:1000 /var/indexes/public ADD dovecot.conf /etc/dovecot/dovecot.conf /etc/dovecot/dovecot.conf: ## You should mount /etc/dovecot if you want to ## manage this file mail_home=/srv/mail/%Lu mail_location=sdbox:~/Mail mail_uid=1000 mail_gid=1000 #protocols = imap pop3 submission sieve lmtp protocols = imap first_valid_uid = 1000 last_valid_uid = 1000 passdb { driver = static args = password=pass } ssl=yes ssl_cert=<cert.pem ssl_key=<key.pem namespace { type = private inbox = yes separator = / } namespace { type = public prefix = Public/ location = mbox:/var/mail/:INDEX=/var/indexes/public subscriptions = no } listen = * log_path=/dev/stdout info_log_path=/dev/stdout debug_log_path=/dev/stdout

2 1

Using "forward_" variables in last_login_key
by Eirik Rye 01 Jun '23

01 Jun '23

Hello, In my setup, I am running dovecot with the following last_login config: plugin { last_login_dict = file:~/.last_login last_login_key = %s } I would like to distinguish between logins through webmail (Roundcube) and logins through regular IMAP clients. Roundcube sends "x-forward-service=webmail" in ID, and I have working logging for this by putting the following in login_log_format_elements: service=%{if;%{passdb:forward_service};eq;webmail;webmail;%s} (Is there may be a more elegant way to do this conditional?) This will print `service=webmail` for webmail logins, and `service=imap` for regular IMAP client logins. However, the same conditional does not work in last_login_key: last_login_key = %{if;%{passdb:forward_service};eq;webmail;webmail;%s} Using this, the login fails and the error log outputs the following error: Error: Failed to expand plugin setting last_login_key = '%{if;%{passdb:forward_service};eq;webmail;webmail;%s}': Unknown variable '%passdb' How can I tell which variables are available to use in this plugin? Are the forwarded variables not available? If not, any other suggestions on how to differentiate these logins in last_login? Looking at the remote_ip is not feasible for my setup. Best regards, Eirik

2 1

GSSAPI auth Line too long
by Thomas Lemarchand 31 May '23

31 May '23

Hello, On version 2.3.20 (80a5ac675d), I have a problem with submission-login when using GSSAPI auth : it's not working, probably due to AUTH line being too long. It appeared after I activated PAC on my Kerberos infrastructure. Now the Kerberos tickets contains MS-PAC data and are bigger. It's part of the RFC and is a valid use case : https://datatracker.ietf.org/doc/html/rfc4120#section-5.2.6 Logs : May 30 17:13:00 auth: Debug: auth client connected (pid=378) May 30 17:13:00 submission-login: Debug: smtp-server: conn 10.200.114.128:13587 [1]: Sent: 220 mail.int.k8s.lemarchand.io Dovecot ready. May 30 17:13:00 submission-login: Debug: smtp-server: conn 10.200.114.128:13587 [1]: Received new command: EHLO [192.168.202.16] May 30 17:13:00 submission-login: Debug: smtp-server: conn 10.200.114.128:13587 [1]: command EHLO: New command May 30 17:13:00 submission-login: Debug: smtp-server: conn 10.200.114.128:13587 [1]: command EHLO: Execute command May 30 17:13:00 submission-login: Debug: smtp-server: conn 10.200.114.128:13587 [1]: command EHLO: Pipeline blocked May 30 17:13:00 submission-login: Debug: smtp-server: conn 10.200.114.128:13587 [1]: command EHLO: 250 reply: Submitted May 30 17:13:00 submission-login: Debug: smtp-server: conn 10.200.114.128:13587 [1]: command EHLO: Replied May 30 17:13:00 submission-login: Debug: smtp-server: conn 10.200.114.128:13587 [1]: command EHLO: Ready to reply May 30 17:13:00 submission-login: Debug: smtp-server: conn 10.200.114.128:13587 [1]: Trigger output May 30 17:13:00 submission-login: Debug: smtp-server: conn 10.200.114.128:13587 [1]: command EHLO: Next to reply May 30 17:13:00 submission-login: Debug: smtp-server: conn 10.200.114.128:13587 [1]: Sending replies May 30 17:13:00 submission-login: Debug: smtp-server: conn 10.200.114.128:13587 [1]: command EHLO: Next to reply May 30 17:13:00 submission-login: Debug: smtp-server: conn 10.200.114.128:13587 [1]: command EHLO: Completed May 30 17:13:00 submission-login: Debug: smtp-server: conn 10.200.114.128:13587 [1]: command EHLO: Pipeline unblocked May 30 17:13:00 submission-login: Debug: smtp-server: conn 10.200.114.128:13587 [1]: Connection state reset May 30 17:13:00 submission-login: Debug: smtp-server: conn 10.200.114.128:13587 [1]: command EHLO: 250 reply: Sent: 250-mail.int.k8s.lemarchand.io 8BITMIME AUTH GSSAPI PLAIN LOGIN BURL imap CHUNKING ENHANCEDSTATUSCODES SIZE P IPELINING May 30 17:13:00 submission-login: Debug: smtp-server: conn 10.200.114.128:13587 [1]: command EHLO: Finished May 30 17:13:00 submission-login: Debug: smtp-server: conn 10.200.114.128:13587 [1]: command EHLO: Destroy May 30 17:13:00 submission-login: Debug: smtp-server: conn 10.200.114.128:13587 [1]: command EHLO: 250 reply: Destroy May 30 17:13:00 submission-login: Debug: smtp-server: conn 10.200.114.128:13587 [1]: Trigger output May 30 17:13:00 submission-login: Debug: smtp-server: conn 10.200.114.128:13587 [1]: No more commands pending May 30 17:13:00 submission-login: Debug: smtp-server: conn 10.200.114.128:13587 [1]: Sending replies May 30 17:13:00 submission-login: Debug: smtp-server: conn 10.200.114.128:13587 [1]: No more commands pending May 30 17:13:00 submission-login: Debug: smtp-server: conn 10.200.114.128:13587 [1]: Client sent invalid command: Command line is too long May 30 17:13:00 submission-login: Debug: smtp-server: conn 10.200.114.128:13587 [1]: command [unknown]: Invalid command May 30 17:13:00 submission-login: Debug: smtp-server: conn 10.200.114.128:13587 [1]: command [unknown]: 500 reply: Submitted May 30 17:13:00 submission-login: Debug: smtp-server: conn 10.200.114.128:13587 [1]: command [unknown]: Replied May 30 17:13:00 submission-login: Debug: smtp-server: conn 10.200.114.128:13587 [1]: command [unknown]: Ready to reply May 30 17:13:00 submission-login: Debug: smtp-server: conn 10.200.114.128:13587 [1]: Trigger output May 30 17:13:00 submission-login: Debug: smtp-server: conn 10.200.114.128:13587 [1]: Sending replies May 30 17:13:00 submission-login: Debug: smtp-server: conn 10.200.114.128:13587 [1]: command [unknown]: Next to reply May 30 17:13:00 submission-login: Debug: smtp-server: conn 10.200.114.128:13587 [1]: command [unknown]: Completed May 30 17:13:00 submission-login: Debug: smtp-server: conn 10.200.114.128:13587 [1]: command [unknown]: 500 reply: Sent: 500 5.5.2 Line too long May 30 17:13:00 submission-login: Debug: smtp-server: conn 10.200.114.128:13587 [1]: command [unknown]: Finished May 30 17:13:00 submission-login: Debug: smtp-server: conn 10.200.114.128:13587 [1]: command [unknown]: Destroy May 30 17:13:00 submission-login: Debug: smtp-server: conn 10.200.114.128:13587 [1]: command [unknown]: 500 reply: Destroy May 30 17:13:00 submission-login: Debug: smtp-server: conn 10.200.114.128:13587 [1]: Trigger output May 30 17:13:00 submission-login: Debug: smtp-server: conn 10.200.114.128:13587 [1]: No more commands pending May 30 17:13:00 submission-login: Debug: smtp-server: conn 10.200.114.128:13587 [1]: Sending replies May 30 17:13:00 submission-login: Debug: smtp-server: conn 10.200.114.128:13587 [1]: No more commands pending May 30 17:13:00 submission-login: Debug: smtp-server: conn 10.200.114.128:13587 [1]: Remote closed connection: Connection closed May 30 17:13:00 submission-login: Debug: smtp-server: conn 10.200.114.128:13587 [1]: Disconnected: Connection closed May 30 17:13:00 submission-login: Debug: smtp-server: conn 10.200.114.128:13587 [1]: Connection state reset My guess is that it's due to https://github.com/dovecot/core/blob/main/src/lib-smtp/smtp-common.h#L10 being too low (is it configurable ?), but I didn't read the code thoroughly. Red Hat IDM now activates MS-PAC by default, so any installation based on IDM (or FreeIPA) may have the same problem. What's your opinion ? Bug ? Mail sent using password auth :'( -- Thomas Lemarchand

4 7

Inconsistent listing of shared subfolders
by mschering＠intermesh.nl 30 May '23

30 May '23

Hi all, I have a problem with listing shared folders. In my web application I don't get the whole folder tree at once but get them level by level with: LIST "" "subfolder/%" RETURN (CHILDREN) Now I have an issue with shared folders. If I share folder test/sub with another user it returns it's (not shared) parent folder with this command: LIST "" "shared/someuser/%" RETURN (CHILDREN) But if I do the same with INBOX/sub it will not return the "INBOX" folder with the above command. Is that a bug or does anybody know why it behaves differently? Also, If I do: LIST "" "shared/someuser/*" RETURN (CHILDREN) it will return both the subfolder of test and inbox. My shared namespace is setup like this: namespace { type = shared separator = / prefix = shared/%%u/ # a) Per-user seen flags. Maildir indexes are shared. (INDEXPVT requires v2.2+) location = maildir:%%h/Maildir:INDEXPVT=~/Maildir/shared/%%u # b) Per-user seen flags. Maildir indexes are not shared. If users have direct filesystem level access to their mails, this is a safer option: #location = maildir:%%h/Maildir:INDEX=~/Maildir/shared/%%u:INDEXPVT=~/Maildir/shared/%%u subscriptions = no list = children } Thanks for any help! Best regards, Merijn

1 0

Outlook Duplicate emails
by Nick Lekkas 29 May '23

29 May '23

Hello there to all ! I have 2 postfix/dovecot mailservers. Those mailservers are synced using replicator enabled. The dovecot versions I use is 2.3.16 on Rocky Linux 9 .The configuration issued from CentOS 7 mailservers with replicator enabled using 2.2.36. The config is the same in both 2 couple servers. I have issue with pop3 and outlook that receives duplicate email in many cases and in some accounts. Have anyone faced any similar issue.? Any help appreciated... Best Regards Nick __________ ESET Endpoint Antivirus __________ This email was scanned, no threats were found. email from: to: with subject Outlook Duplicate emails dated 29/05/2023 - is OK Detection engine version: 27314 (20230529) https://www.eset.com

2 1

RE: LDAP olcAccess for auth_bind
by Marc 29 May '23

29 May '23

> >> > >> I really got your point, but how you will implement aliases > > has nothing to do with dovecot, sendmail can get those from ldap. > > > >> or domain > > sendmail gets these from ldap (but requires a restart) > > > >> query or maybe quota? You still need to access ldap directly for > other > >> info's. > > quotas can be/are distributed to the os by ldap. But it depends a bit > on your setup, and if you have multiple file systems. > > > >> I mean, dovecot can probably use linux login but i'm not sure about > the > >> MTA. Unless you have a fixed list of domains added manually. > >> > > I have on different servers cron jobs running, getting every 5?min > modified/created records and then do a restart or something else. All > these processes have own entity in ldap with own acls. > > sendmail can get anything you want from ldap. For outgoing mail auth, > I have sendmail use os users (which come from ldap) > > > So in the end you still access ldap from another program but not from > dovecot :) I don't get your point. The goal for using ldap is having a centralized database that distributes information. How you choose to implement this, is depending on your requirements. > You avoid to authenticate users directly only to send the credentials of > some privilleged user from postfix/sendmail/whatever script... > Not to avoid. Other applications have different needs and thus different acl's. Dovecot does not need to know a users email address or alias. Only the MTA needs to know. The relaying MTA does not need to know the user etc.

1 0

LDAP olcAccess for auth_bind
by Andrzej Milewski 28 May '23

28 May '23

Hi, I'm trying to set up a production mail server. I have installed Dovecot on Debian from the package. For authentication, I have another machine running OpenLDAP, also installed on Debian. I would like the end mail client to authenticate with Dovecot using the login and password set in LDAP. In the LDAP-related configuration, I have: auth_bind=yes base = ou=Users,dc=example,dc=com user_attrs = mail=couriermaildir:~/Maildir,homeDirectory=/home/%d/%uid/,uidNumber=uid,gidNumber=gid user_filter = (&(objectClass=posixAccount)(uid=%u)) pass_attrs = uid=user,userPassword=password,\ pass_filter = (&(objectClass=posixAccount)(uid=%u)) The LDAP user is entered as uid=user(a)example.com. With the default olcAccess permissions, it works and logs in correctly. Here are my default olcAccess settings after installation: # {1}mdb, config dn: olcDatabase={1}mdb,cn=config objectClass: olcDatabaseConfig objectClass: olcMdbConfig olcDatabase: {1}mdb olcDbDirectory: /var/lib/ldap olcSuffix: dc=example,dc=com olcAccess: {0}to dn.children="ou=Idmaps,dc=example,dc=com" attrs=userPassword, shadowLastChange,SambaLMPassword,SambaNTPassword by self write by anonymous a uth by dn="cn=samba,dc=example,dc=com" write by dn="cn=admin,dc=laktopol,dc=p l" write by * none olcAccess: {1}to dn.subtree="ou=Idmaps,dc=example,dc=com" by self write by dn= "cn=samba,dc=example,dc=com" write by dn="cn=admin,dc=example,dc=com" write b y * read olcAccess: {2}to dn.children="ou=Hosts,dc=example,dc=com" attrs=userPassword,s hadowLastChange,SambaLMPassword,SambaNTPassword by self write by anonymous au th by dn="cn=samba,dc=example,dc=com" write by dn="cn=admin,dc=example,dc=com " write by * none olcAccess: {3}to dn.subtree="ou=Hosts,dc=example,dc=com" by self write by dn=" cn=samba,dc=example,dc=com" write by dn="cn=admin,dc=example,dc=com" write by * read olcAccess: {4}to dn.children="ou=Users,dc=example,dc=com" attrs=userPassword,s hadowLastChange,SambaLMPassword,SambaNTPassword by self write by anonymous au th by dn="cn=samba,dc=example,dc=com" write by dn="cn=nsspam,dc=laktopol,dc=p l" write by dn="cn=admin,dc=example,dc=com" write by * none olcAccess: {5}to dn.children="ou=Users,dc=example,dc=com" by self write by dn= "cn=samba,dc=example,dc=com" write by dn="cn=nsspam,dc=example,dc=com" write by dn="cn=admin,dc=example,dc=com" write by * read olcAccess: {6}to filter=(objectClass=sambaDomain) by dn="cn=samba,dc=laktopol, dc=pl" write by dn="cn=admin,dc=example,dc=com" write by * read olcAccess: {7}to dn.base="dc=example,dc=com" attrs=children by dn="cn=samba,dc =laktopol,dc=pl" write by dn="cn=admin,dc=example,dc=com" write by * read olcAccess: {8}to attrs=userPassword,shadowLastChange,SambaLMPassword,SambaNTPa ssword by self write by anonymous auth by dn="cn=nsspam,dc=example,dc=com" wr ite by dn="cn=admin,dc=example,dc=com" write by * none olcAccess: {9}to attrs=shadowLastChange by self write by * read olcAccess: {10} to * by * read However, I am not satisfied with these settings because using the anonymous user, anyone can browse the entire LDAP tree. While passwords are not visible with anonymous login, user data in the LDAP domain is exposed. If I change the last olcAccess entry from "olcAccess: {10} to * by * read" to "olcAccess: {10} to * by anonymous auth," the anonymous user cannot browse LDAP, but the mail client user also cannot log in. What should be the correct configuration? -- Andrzej

4 12

Outlook fails to connect to Dovecot submission server
by Ralf Becker 28 May '23

28 May '23

Dovecot 2.3.20 including it's submission server works well with all sorts of clients, but Outlook. Outlook works / can connect to Dovecot IMAP service with same certificate TLS config, but it fails to connect using SMTPs on port 465. Other clients connect and send mails without problem, also openssl s_client can connect and reports no problems. I tried with Outlook Version 365 on Windows 11 (no cloud) and "Microsoft® Outlook® 2021 MSO (Version 2304 Build 16.0.16327.20200) 64-bit". I already enabled all submission_client_workarounds and lowered min_ssl_version from TLSv1.2 to TLSv1, but that changed nothing. I can see nothing failing in the logs, thought the OL connection wizard always check IMAP and SMTP together, so it's hard to say what the problem is. The same two Outlook version connect without a problem to Postfix authenticating via SASL to Dovecot also requiring a minimum TLS version of 1.2. They just wont connect with Dovecot submission server. Any ideas what's wrong, or how to debug that further? Ralf -- Ralf Becker EGroupware GmbH [www.egroupware.org] Handelsregister HRB Kaiserslautern 3587 Geschäftsführer Birgit und Ralf Becker Leibnizstr. 17, 67663 Kaiserslautern, Germany Telefon +49 631 31657-0

5 8

Inaccurate results while searching for a phrase in subject (fts-flatcurve)
by ss17＠fea.st 26 May '23

26 May '23

Hi, I had been using the lucene FTS plugin since a decade now and it has done me well. Thought of upgrading to the new & current stuff and came across the flatcurve plugin which seems very promising (xapian on the other hand was creating indexes larger than my mailboxes themselves). I am using following configuration in dovecot.conf: fts = flatcurve fts_filters_en = lowercase english-possessive stopwords fts_languages = en fts_tokenizers = generic email-address fts_autoindex = no fts_enforced = yes A search command like this: doveadm -D search -u john(a)doe.com mailbox INBOX SUBJECT "/home/johndoe/render.php" should show the messages with subject: "CRON: /home/johndoe/render.php OK" but produces a lot of extra undesired results and I think the second line in this debug output indicates the reason: May 23 07:44:13 doveadm(john(a)doe.com): Debug: fts-flatcurve(INBOX): Query (hdr_subject:/home/johndoe/render.php*) matches=0 uids= May 23 07:44:13 doveadm(john(a)doe.com): Debug: fts-flatcurve(INBOX): Query (hdr_subject:php* AND hdr_subject:render* AND hdr_subject:johndoe* AND hdr_subject:home*) matches=272 uids=67041,67085,67188,67223,67257,67290,67323,67355,67395,67564,67770,67817,67863,67985,68819,69512,69572,69635,69737,70017,70058,70086,70125,70147,70191,70296,70304,70331,70340,70350,70354,70375,70407,70417,70427,70449,70499,70521:70522,70535:70550,70555,70561:70563,70591,70597:70599,70662,70685,70702,70708,70718:70719,70724,70727:70728,70730:70733,70735,70746:70747,70754,70775,70777,70794,70811:70812,70822,70866,70942,70948,70971,71017,71021,71040,71042,71075,71079,71084,71113,71128:71129,71131,71152,71160,71184,71188,71208,71214,71225,71255,71269,71297,71300,71331,71375,71422,71449,71457,71467,71469,71495,71515,71605,71626,71632,71649,71672,71681:71682,71689,71692,71699,71716,71757,71770,71777,71782:71785,71790,71795,71797,71814,71818:71819,71828,71838:71842,71845,71859:71860,71937,71947,71954,71960,71963:71964,71977,71990,72014,72021:72022,72030,72034:72042,72045:72046,72049,72056,72061,72063,72073:72074,72083,72088,72090,72092,72101,72108,72129,72131:72132,72134,72136:72140,72159,72163,72172:72173,72186,72212,72218:72223,72237,72239,72246,72267,72288,72387,72410,72446,72469,72476:72477,72514,72541,72543,72568:72569,72572:72574,72598,72604,72606,72609,72644,72674,72687,72691,72694,72734,72772,72791,72797,72799,72803,72832:72833,72835:72841,72856:72857,72866:72867,72873:72874,72901,72930,72938,72948,72960,72965,72976,73018,73037,73071,73081,73116,73158,73249,73307,73352,73392,73466,73533,73601,73670,73733,73775,73784:73786,73804,73807,73811,73815,73819,73823,73825,73831,73842,73846,74005,74199,74390,74540,74684,74854,75017,75192,75354,75525,75710,75839:75843,75845,75903,75984:75985,76091,76263,76447,76624,76816,76989,77091:77092,77097,77119,77155,77293,77460,77608,77761,77908,78066,78218,78393,78400:78401,78522:78523,78560,78728,78921,79104,79298,79504,79555,79898,80027,80031:80032,80034:80035,80037,80056,80071,80073,80077:80079,80082:80084,80086,80089 I tried rebuilding the indexes with "fts_flatcurve_substring_search = yes" too but that didn't change anything. It works as expected with lucene plugin because in that case header search is performed via dovecot indexes instead of FTS. May be I am not doing something right in configuring this new FTS? Will really appreciate some pointers here. Thanks, Sam

2 2

dovecot indexer-workers
by Nikolay Zlatkov 26 May '23

26 May '23

Hi, I have a problem with dovecot indexer-workers starting at the same time everyday and using too much disk io and cpu. I have limited indexer-workers to 2, but i am not sure this is the solution. Can you help me to configure this automatic reindex to be in the night for example. Best Regards! -- Николай Златков / Nikolay Zlatkov Системен администратор / System Administrator CALLFLOW mobilePhone +359 87 986 85 32 <tel:+359 87 986 85 32> emailAddress nzlatkov(a)callflowlab.com <mailto:nzlatkov@callflowlab.com> website www.callflowlab.com <//www.callflowlab.com> address Magnaurska shkola 11 Str., Office 310, Sofia 1784 All channels. One place. | OMNILINX | Check out our new product. <https://omnilinx.com/?utm_source=email&utm_medium=signature>

1 0

The (doveadm search HEADER "Header" "") command does not return email which have the header "Header"
by Léo El Amri 26 May '23

26 May '23

Hello there, When using the doveadm command (search HEADER "X-Discourse-Post-Id" "") or the IMAP command (SEARCH HEADER X-Discourse-Post-Id ""), emails containing a X-Discourse-Post-Id header are not listed. I've also tried with non X- headers, such as List-Unsubscribe and Auto-Submitted. RFC 3501 [1] and Dovecot's documentation [2] both says that this command should return emails containing the header searched. I couldn't find a mention of this bug in the git history, hence why I'm posting here, maybe there is something wrong with my installation ? I'm running Dovecot 2.3.20 on Debian on amd64 with an ext4 filesystem. I attached the output of dovecot -n. [1]: https://www.rfc-editor.org/rfc/rfc3501.html#section-6.4.4 [2]: https://wiki.dovecot.org/Tools/Doveadm/SearchQuery -- Cordially, Léo

1 1

dovecot replication crashing
by Heiko Schlittermann 25 May '23

25 May '23

Hi, I'm a but clueless, having issues with replication. `doveadm dsync -u hans` works. But using the following replication setup, I see coredumps. Where to go next? Interestingly not for all users. (For testing purposes I've only 2 users. One having about 20 messages: here even the replication works, but the 2nd user (having about 14k messages) fails. The failure seems to happen immediatly after starting the replication attempt). I saw the replication crashing using Dovecot packages from the current Debian distro. In order to debug this, I'm now using 2.3.20, built from Git. The replicator config boils down to this (complete config is attached) replication_full_sync_interval = 90d replication_max_conns = 16 mail_plugins = $mail_plugins notify replication plugin { mail_replica = tcps:smtp-mz.example.com:9090 } service replicator { process_min_avail = 1 unix_listener replicator-doveadm { mode = 0666 } } service aggregator { fifo_listener replication-notify-fifo { user = dovecot mode = 0666 } unix_listener replication-notify { user = dovecot mode = 0666 } } The stacktrace I get looks like this: Stack trace of thread 729589: #0 0x00007f9e4f2c8ce1 __GI_raise (libc.so.6 + 0x38ce1) #1 0x00007f9e4f2b2537 __GI_abort (libc.so.6 + 0x22537) #2 0x00007f9e4f5fe8c6 default_fatal_finish (libdovecot.so.0 + 0x558c6) #3 0x00007f9e4f6ab601 i_internal_fatal_handler (libdovecot.so.0 + 0x102601) #4 0x00007f9e4f5fe589 i_panic (libdovecot.so.0 + 0x55589) #5 0x00007f9e4f5fe99e fd_set_nonblock (libdovecot.so.0 + 0x5599e) #6 0x00005564cbe6a08d cmd_dsync_ibc_stream_init (doveadm-server + 0x3008d) #7 0x00005564cbe6b772 cmd_dsync_run (doveadm-server + 0x31772) #8 0x00005564cbe6d284 doveadm_mail_next_user (doveadm-server + 0x33284) #9 0x00005564cbe6e4ba doveadm_mail_cmd_exec (doveadm-server + 0x344ba) #10 0x00005564cbe7eb71 doveadm_cmd_run_ver2 (doveadm-server + 0x44b71) #11 0x00005564cbe8300a doveadm_cmd_server_run_ver2 (doveadm-server + 0x4900a) #12 0x00007f9e4f6c1799 io_loop_call_io (libdovecot.so.0 + 0x118799) #13 0x00007f9e4f6c2e82 io_loop_handler_run_internal (libdovecot.so.0 + 0x119e82) #14 0x00007f9e4f6c1840 io_loop_handler_run (libdovecot.so.0 + 0x118840) #15 0x00007f9e4f6c1a00 io_loop_run (libdovecot.so.0 + 0x118a00) #16 0x00007f9e4f6343a3 master_service_run (libdovecot.so.0 + 0x8b3a3) #17 0x00005564cbe5d9a2 main (doveadm-server + 0x239a2) #18 0x00007f9e4f2b3d0a __libc_start_main (libc.so.6 + 0x23d0a) #19 0x00005564cbe5da2a _start (doveadm-server + 0x23a2a) 2023 Mar 28 00:09:28 clone doveadm(hans)<729589><TdSzNhcUImT1IQsAKQCViw>: Fatal: master: service(doveadm): child 729589 killed with signal 6 (core dumped) I'm a bit clueless now, even using the coredump and gdb. -- Heiko

3 7

subscriptions via master user
by Przemysław Kwiatkowski 25 May '23

25 May '23

Hello, When I impersonate an regular user using master user (log in to Roundcube as "user*masteruser") - there are user's subscriptions missing. I can see all folders, but have to manually enable visibility in settings. Is this normal? Can I fix it? passdb { driver = passwd-file master = yes args = /filepath pass = yes } passdb { driver = passwd-file args = /filepath } userdb { driver = passwd-file args = /filepath default_fields = uid=vmail gid=vmail system_groups_user=vmail home=/srv/vmail/%d/%n master_user=%u } -- Przemyslaw Kwiatkowski

1 0

fts crash
by Przemysław Kwiatkowski 21 May '23

21 May '23

Hello, I started full reindex of whole emails base (doveadm index -A '*') and solr crashed due to out of memory. I had plenty of such messages: doveadm(gzt): Error: fts_solr: Indexing failed: Connection lost: read((conn:127.0.0.1:8983,id=621)) failed: EOF (Request queued 40.832 secs ago, 1 send attempts in 39.359 secs, 0.002 in http ioloop, 0.000 in other ioloops, connected 704.138 secs ago) doveadm(gzt): Error: Mailbox Sent: Precache for UID=4036 failed: Internal error occurred. Refer to server log for more information. [2023-05-20 06:01:40] doveadm(gzt): Error: Mailbox Sent: Transaction commit failed: FTS transaction commit failed: backend deinit I increased solr memory and restarted it. Do I have to restart dovedam index? The "request queued" message suggest that Dovecot is smart and I don't need to do anything. Am I right? (Any way to confirm that indeed everything was indexed?) -- Przemyslaw Kwiatkowski

2 1

Re: LMTP server client certificate validation
by Jochen Bern 19 May '23

19 May '23

On 16.05.23 14:27, Sean Gallagher wrote: > I have a created a CA for the sole purpose of signing the certificate of > the LMTPS client. I regard this as a horrible horrible kludge. ... how do you figure that? *Someone*, and that means you, has to specify which clients are allowed to connect. Which leaves three possibilities: a) You run the CA and thus, the CA can do the selection for you. Which means that in order to deal with a single-permissible-client situation, you need the CA to issue client certs to just that one entity. b) The CA does *not* and issues (client) certs to entities you do *not* want to grant access. Then the selection job remains yours and, assuming that requiring a client cert from that CA makes any sense in the first place, auth_ssl_username_from_cert is there to help you (by making sure that the username will be "the ID" from the cert so that you can base some additional filtering on that). c) The CA is willing to enrich the certs it issues with DN parts, X509v3 extensions or the like signalling access rights as granted beforehand by a *fourth* party, as in, you. Which is a terrible can of worms as soon as things, especially the number of such fourth parties to support by the same CA, start to scale up IMHO. Which promptly brings us back to you running the CA yourself ... Kind regards, -- Jochen Bern Systemingenieur Binect GmbH

3 5

Possible hack via doveadm
by Daniel L. Miller 18 May '23

18 May '23

I currently have two servers running with synchronization that I've been very happy with. However, I'm seeing the following in my logs recently: May 12 15:45:58 cloud1 dovecot: doveadm(194.165.16.78): Error: doveadm client not compatible with this server (mixed old and new binaries?) May 13 03:44:31 cloud1 dovecot: doveadm(45.227.254.48): Error: doveadm client not compatible with this server (mixed old and new binaries?) Since I don't recognize those IPs, the first is out of Panama and the other is Belize, I assume these are hostile attackers trying to exploit something. How can I defend against this? -- Daniel

5 6

pigeonhole: sieve: float score failed for comparator-i ascii-numeric
by Randy Li 18 May '23

18 May '23

Hello Following the sieve_spamtest_status_header from the document, I think I could extract the score from the spamassassin (which is from spampd lmtp). But sieve script can't never work properly with comparator "i;ascii-numeric". I have used sieve-test several times, once I remove the dot from the mail sample, the sieve script works well. I noticed that document says i;ascii-numeric is for unsigned integer only which certainly does work for this case. The score here would be signed float(all right all the float is signed) and it is a float variable from tst-spamvirustest.c. I think that is the place the bug happened. Unfortunately, I didn't found any RFC that supports a float comparator and I am not familiar with the sieve interrupter. If someone could give me a possible method to fix this, I could submit a patch. Sincerely Randy Li

2 2

Re: Incorrect saved dates in mailboxes
by Joseph Tam 18 May '23

18 May '23

> OK, that does make sense so far. Today I have checked, and the correct > dates seem to be showing up now after the initial date (ever since that > initial run of the "dovecot expunge" command was run on all mailboxes). > So in our case I have the expunge set to delete older than 30 days. I > assume if I wait 30 days from now, it will start working? Yup. If you run your script every day (and thus, run "doveadm fetch ... date.saved" as well), that will make sure any new mail put into your Trash folder will have date.saved within 24h of the "real" value. Joseph Tam <jtam.home(a)gmail.com>

1 0

Re: Incorrect saved dates in mailboxes
by Joseph Tam 18 May '23

18 May '23

Chris Szilagyi <chris(a)apex-internet.com> writes: > Recently, I noticed that our expunge script is not working, and I don't > think it ever has on this server. On further inspection, it looks like > the saved date for emails in the folders we want to expunge is set to a > recent date (yesterday) for almost all messages. For example, when I > run the command "doveadm -f tab fetch -u username date.saved mailbox > Trash", the date for almost all of the messages is yesterday at the > exact same time. I tried this on other users and they have this exact > same timestamp shown for most of their messages, too. > > I tried checking for "date.received" and that shows correct, it is > "date.saved" that is not working. > > Any idea of how or why this would not be showing the correct date? I've > used this setup in the past on other servers with dovecot and it has > worked great, no idea why we would be seeing this issue now. I recall having the same problem. I think the "date.saved" is not instantiated in the cache until you query for it. So the value you were shown is when you last dumped its value if it wasn't previously set -- your run of same values coincided when you ran "doveadm fetch". My expunge script just uses date.received instead -- it seems to work. Joseph Tam <jtam.home(a)gmail.com>

2 1

[PATCH] [WIP]: thunderbird mboxrd to mbox
by Randy Li 16 May '23

16 May '23

I was trying to restore email from local thunderbird download data. None of the script I found could work. This script is modified from superuser.com/questions/105653/how-to-convert-mboxo-mboxrd-to-mboxcl-mboxcl2 Which works for me, using this script I could use doveadm import to restore my INBOX(I don't know how to restore the Sent mailbox). If this script is useful, I would rewrite one for python3 and following the mboxrd spec. Signed-off-by: Randy Li <ayaka(a)soulik.info> --- mailman2mbox.py | 111 ++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 111 insertions(+) create mode 100755 mailman2mbox.py diff --git a/mailman2mbox.py b/mailman2mbox.py new file mode 100755 index 0000000..1a154b7 --- /dev/null +++ b/mailman2mbox.py @@ -0,0 +1,111 @@ +#!/usr/bin/env python2 +""" +Usage: ./mailman2mbox.py infile outfile default-to-address +""" +import sys +from time import strftime,strptime,mktime,asctime +from email.utils import parseaddr,formatdate + +if len(sys.argv) not in (3,4): + print __doc__ + sys.exit() + +out = open(sys.argv[2],"w") +listid = None +if len(sys.argv)==4: + listid = sys.argv[3] + +date_patterns = ("%b %d %H:%M:%S %Y", "%d %b %H:%M:%S %Y", "%d %b %Y %H:%M:%S", "%d %b %H:%M:%S", "%d %b %y %H:%M:%S", "%d %b %Y %H.%M.%S",'%m/%d/%y %H:%M:%S %p') + +class HeaderError(TypeError): + pass + + +def finish(headers, body): + body.append("\n") + for n,ln in enumerate(headers): + if ln.startswith("Date:"): + break + else: + raise HeaderError("No 'Date:' header:\n" + "".join(headers)+"\n") + if listid is not None: + for ln2 in headers: + if ln2.lower().startswith("list-id:"): + break + else: + headers.append("List-Id: <%s>\n" % (listid,)) + date_line = ln[5:].strip() + if date_line.endswith(')'): + date_line = date_line[:date_line.rfind('(')].rstrip() + if date_line[-5] in "+-": + date_line, tz = date_line[:-5].rstrip(), int(date_line[-5:])//100 + else: + tz = -5 + if date_line[:3] in ("Mon","Tue","Wed","Thu","Fri","Sat","Sun"): + if date_line[3:5] == ', ': + prefix = "%a, " + elif date_line[3] == ',': + prefix = "%a," + else: + prefix = "%a " + else: + prefix = "" + while True: + for p in date_patterns: + try: + date_struct = strptime(date_line, prefix+p) + except ValueError: + pass + else: + break + else: + if not date_line: + raise ValueError(headers[n]) + date_line = date_line[:date_line.rfind(' ')] + continue + break + + date_struct = list(date_struct) + try: + headers[n] = 'Date: %s\n' % (formatdate(mktime(date_struct),True)) + headers[0] = "From %s %s\n" % (headers[0][:-25].rstrip(), asctime(date_struct), ) + except ValueError: + raise ValueError(headers[n]) + + for w in headers, body: + for s in w: + out.write(s) + + +message = 0 +headers, body = None, None +for line in open(sys.argv[1]): + if line.startswith("From "): + message+=1 + header = True + if headers is not None: + try: + finish(headers, body) + except HeaderError: + message -= 1 + out.write('>') + for w in headers, body: + for s in w: + out.write(s) + headers, body = [], [] + line = line.replace(" at ", "@") + elif line == '\n': + header = False + elif header and line.startswith('From:'): + line = line.replace(" at ","@") + (headers if header else body).append(line) + +try: + finish(headers, body) +except HeaderError: + out.write('>') + for w in headers, body: + for s in w: + out.write(s) + +out.close() -- 2.40.1

2 1

Incorrect saved dates in mailboxes
by Chris Szilagyi 16 May '23

16 May '23

Hello: We have a server (Debian 11) using Dovecot 2.3 which has been in place for about a year. We are using mbox format for our mailboxes, and do not use MySQL, just plain user directories under /home. Recently, I noticed that our expunge script is not working, and I don't think it ever has on this server. On further inspection, it looks like the saved date for emails in the folders we want to expunge is set to a recent date (yesterday) for almost all messages. For example, when I run the command "doveadm -f tab fetch -u username date.saved mailbox Trash", the date for almost all of the messages is yesterday at the exact same time. I tried this on other users and they have this exact same timestamp shown for most of their messages, too. I tried checking for "date.received" and that shows correct, it is "date.saved" that is not working. Any idea of how or why this would not be showing the correct date? I've used this setup in the past on other servers with dovecot and it has worked great, no idea why we would be seeing this issue now. Thanks in advance. Chris

2 1

[feature request] SSL handshake rejection for non-SNI clients
by Serg 16 May '23

16 May '23

I would like to offer to implement a feature to reject SSL handshakes for a default certificate-key pair for efficiently discarding bot requests (i.e. such requests that provide invalid/not configured hostname or do not specify at all, like when doing request to the IP address directly). Nginx has such feature already implemented as seen here[1], and it would be beneficial if dovecot would support this too. Currently I am using the following SSL configuration snippet to mimic such behavior: > ssl_cert = </etc/ssl/dovecot/server.crt > ssl_key = </etc/ssl/dovecot/server.key > > local_name flopster.at.encryp.ch { > ssl_cert = </etc/ssl/domains/flopster.at.encryp.ch/fullchain > ssl_key = </etc/ssl/domains/flopster.at.encryp.ch/key > } But in this case the problem is that the invalid requests (for this example it is requests that don't have Server Name Indication at all or mention anything else but not flopster.at.encryp.ch) are still being replied by Dovecot with a TLS certificate rather than being simply rejected with a TLSV1_UNRECOGNIZED_NAME error code. [1]: <https://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_reject_handshake>

3 3

Re: [External] Re: Help - Permissions issue with new mail
by Mihai Badici 16 May '23

16 May '23

Sorry, I sent the reply directly to you not to the list. I try to find which is the uid expected by dovecot. Usually since in postfix the uid is set as 5000 you need to have the same "virtual" uid set in dovecot. I didn't see this in the fail you sent. Maybe you made some change in the past without restarting dovecot. Anyway i think a line like mail_uid=5000 somewhere in dovecot configuration ( location may differ )should fix your issue. Try to find if this is already set and if not add this in dovecot and restart it. On 2023-05-04 15:16, Michele Clark wrote: > Attached is a copy of my main.cf from postfix and my 10-mail from > dovecot > > Let me know if you see anything that I might try - Thanks in advance > > Michele Clark > Title | Engineering Business Unit > KBR | Government Solutions – US > Office: +1 937-713-8669 > > ------------------------- > > From: Mihai Badici <mihai(a)badici.ro> > Sent: Wednesday, May 3, 2023 3:44 PM > To: Michele Clark <Michele.Clark(a)us.kbr.com> > Subject: Re: [External] Re: Help - Permissions issue with new mail > > You don't often get email from mihai(a)badici.ro. Learn why this is > important [1] > > CAUTION: This email originated from outside of the organization. Do > Re: [External] Re: Help - Permissions issue with new mail Contact photo From Michele Clark on 2023-05-04 15:16 Details Headers Plain text Download all attachmentsSave all to cloud... 10-mail.conf.jpg.docx(~761 KB) MAIN.CF.JPG(~161 KB) Attached is a copy of my main.cf from postfix and my 10-mail from dovecot Let me know if you see anything that I might try - Thanks in advance Michele Clark Title | Engineering Business Unit KBR | Government Solutions – US Office: +1 937-713-8669 From: Mihai Badici <mihai(a)badici.ro> Sent: Wednesday, May 3, 2023 3:44 PM To: Michele Clark <Michele.Clark(a)us.kbr.com> Subject: Re: [External] Re: Help - Permissions issue with new mail You don't often get email from mihai(a)badici.ro. Learn why this is important CAUTION: This email originated from outside of the organization. Do not click links or open attachments unless you recognize the sender and know the content is safe. I think the problem isn't the rights of the files but dovecot need to use the same user for read them. I have something like: mail_uid = 5000 in 10-mail.conf, this uid need to be the same as in postfix On 5/3/23 21:42, Michele Clark via dovecot wrote: > 1: This was previously working but has been down since there was an > unexpected power outage. This install has been in place for several > years > 2: When I chmod -r the CUR folder I can get mail to drop to our > roundcube inbox or if I chmod the actual email file in the cur folder > (have tried > not click links or open attachments unless you recognize the sender > and know the content is safe. > > I think the problem isn't the rights of the files but dovecot need to > use the same user for read them. > > I have something like: mail_uid = 5000 in 10-mail.conf, this uid need > to be the same as in postfix > > On 5/3/23 21:42, Michele Clark via dovecot wrote: > >> 1: This was previously working but has been down since there was an >> unexpected power outage. This install has been in place for several >> years >> 2: When I chmod -r the CUR folder I can get mail to drop to our >> roundcube inbox or if I chmod the actual email file in the cur >> folder (have tried both) however new messages still come thru with >> -rw------- >> 3. Attached is a copy of the return from comm -23 <(postconf -n) >> <(postconf -d) with the exception of a few redactions for our >> personal data >> 4. What info would you like to see from dovecot? >> >> Any help is much app >> >> Michele Clark >> Title | Engineering Business Unit >> KBR | Government Solutions – US >> Office: +1 937-713-8669 >> >> ------------------------- >> >> From: John Stoffel <john(a)stoffel.org> >> Sent: Wednesday, May 3, 2023 2:14 PM >> To: Michele Clark <michele.clark(a)us.kbr.com> >> Cc: dovecot(a)dovecot.org <dovecot(a)dovecot.org> >> Subject: [External] Re: Help - Permissions issue with new mail >> >> [You don't often get email from john(a)stoffel.org. Learn why this is >> important at https://aka.ms/LearnAboutSenderIdentification [1] ] >> >> CAUTION: This email originated from outside of the organization. Do >> not click links or open attachments unless you recognize the sender >> and know the content is safe. >> >>>>>>> "michele" == michele clark--- via dovecot >> <dovecot(a)dovecot.org> writes: >> >>> We have an install of Dovecot running with Postfix and Roundcube >>> using virtual mail to allow us to connect to our AD domain which >> got >>> messed up after a power issue. >> >> Was this working before the AD problems, or is this a new install? >> >>> I can log into our Roundcube and see all my old emails, however >> new >>> emails keep getting stuck in the CUR files with permissions of >>> -rw------- >> >>> If I chmod the email it will deliver to the inbox in Roundcube. >> >> Where are you changing the permissions? The destination directory? >> >>> Can anyone advise on how I can adjust this so all new emails will >>> come thru with the correct permissions? - Thanks in advance >> >> It all depends on how your email are delivered, and you need to post >> some of your configuration details, such as the postfix config and >> the >> dovecot config. >> >> For postfix, just post the changed from defaults info, which you can >> get with the following bash sheel command: >> >> comm -23 <(postconf -n) <(postconf -d) >> >> See the postconf man page for details. >> >> Also post your dovecot info as well. >> >> This e-mail, including any attached files, may contain confidential >> information, privileged information and/or trade secrets for the >> sole use of the intended recipient. Any review, use, distribution, >> or disclosure by others is strictly prohibited. If you are not the >> intended recipient (or authorized to receive information for the >> intended recipient), please contact the sender by reply e-mail and >> delete all copies of this message. >> >> _______________________________________________ >> dovecot mailing list -- dovecot(a)dovecot.org >> To unsubscribe send an email to dovecot-leave(a)dovecot.org > This e-mail, including any attached files, may contain confidential > information, privileged information and/or trade secrets for the sole > use of the intended recipient. Any review, use, distribution, or > disclosure by others is strictly prohibited. If you are not the > intended recipient (or authorized to receive information for the > intended recipient), please contact the sender by reply e-mail and > delete all copies of this message. > > Links: > ------ > [1] https://aka.ms/LearnAboutSenderIdentification

4 9

replicator service
by Przemysław Kwiatkowski 15 May '23

15 May '23

I'm confused. Replicator service is bidirectional. Does it mean I should start it only on *one* end of a replication pair? Or on both, working simultaneously? -- MiCHA

2 1

acl replication
by micha＠micha.waw.pl 15 May '23

15 May '23

What is correct way to sync ACLs across two servers? Example: I want user1 to have access to user2 mailbox. I do this on server1: doveadm acl set shared/user2 user=user1 admin create delete expunge insert lookup read write write-deleted write-see Now user1 can see shared/user2 when logged to server1. (Looks good!) He still has no access when logged to server2. (Seems correct.) So I do synchronization: doveadm sync -u user2 remote:server2 ...and nothing changes. He still have access only when logged to server1. So I force full synchronization: doveadm sync -u -f user2 remote:server2 ...and success! User1 has access to shared/user2 on both servers now. But now I want to remove access. So I do this on server1: doveadm acl delete shared/user2 user=user1 Of course the above affects only server1, so user1 still have access when logged to server2. So now I do synchronization: doveadm sync -u user2 remote:server2 Nothing happens. :-( So I try do do full synchro: doveadm sync -u user2 -f remote:server2 ...disaster! The ACL is COPIED BACK from server2 to server1 and effectively restoring access to shared/user2 on on both servers again. (WTH?) So big question is: Who to do it properly? It would be enough for me if ACL's were copied only one way (server1->server2), but bidirectional replication would of course also be nice. :-) Configs: namespace { disabled = no hidden = no ignore_on_failure = no inbox = no list = children location = maildir:%%h/.maildir:LAYOUT=fs:INDEX=~/.shared/%%u order = 0 prefix = shared/%%u/ separator = / subscriptions = no type = shared } plugin { acl = vfile:/etc/dovecot/mailconfig/global-acls acl_defaults_from_inbox = yes acl_shared_dict = file:/etc/dovecot/mailconfig/shared/shared-mailboxes }

3 4

Conclusion about plus address setup
by Tom Reed 14 May '23

14 May '23

Hello Just FYI, After simple putting this line into postfix's main.cf: recipient_delimiter = + And reload postfix, the plus alias address should work. I am using dovecot LMTP as delivery agent. Nothing changes to dovecot configuration. Here are the versions: Postfix 3.6.4 Dovecot 2.3.16 OS Ubuntu 22.04 Thank you very much for all helps. regards Tom

1 0

dovecot for plus address
by Tom Reed 13 May '23

13 May '23

Hello How to setup dovecot to accept the plus address? such as user+foo(a)sample.com will be delivered into user(a)sample.com Thank you. Tom R.

3 4

Sieve with several redirects stops if one redirect fails
by Matteo Staglianò 12 May '23

12 May '23

Hello, I have this block on my sieve filter: |if not header :matches "X-Spam-Status" "Yes*" {|| || redirect "atest(a)non-existent.tld";|| || redirect "info(a)existent.tld";|| ||}|| ||keep;| when the first redirect fails: |sieve: info: started log at May 12 10:33:21.|| ||error: msgid=<20230512103320.070708@candy>: redirect action: failed to redirect message to <atest(a)non-existent.tld>: smtp(host.smtp.tld): RCPT TO failed: 550 5.1.1|| ||<atest(a)non-existent.tld> recipient rejected (permanent failure).| the second one is not even triggered. I would like to know if this is an expected behaviour or a misconfiguration on my side. |dovecot-core 2:2.3.8-4~buster|| ||dovecot-imapd 2:2.3.8-4~buster|| ||dovecot-lmtpd 2:2.3.8-4~buster|| ||dovecot-mysql 2:2.3.8-4~buster|| ||dovecot-pigeonhole-dbg 2:2.3.8-4~buster|| ||dovecot-pop3d 2:2.3.8-4~buster|| ||dovecot-sieve 2:2.3.8-4~buster|| |||| ||sieve = ~/.dovecot.sieve|| ||sieve_extensions = +editheader|| ||sieve_global_extensions = +vnd.dovecot.pipe|| ||sieve_max_redirects = 15|| ||sieve_pipe_bin_dir = /usr/lib/dovecot/|| ||sieve_plugins = sieve_imapsieve sieve_extprograms|| ||sieve_vacation_default_period = 1h|| ||mail_plugins = notify mail_log quota imap_quota imap_sieve|| ||mail_plugins = notify mail_log quota sieve|| || | Thank you

1 0

doveadm on remote socket SSL problem
by miro.igov＠pharmya.com 11 May '23

11 May '23

Hello, trying to exec doveadm commands on remote server: doveadm search -S domain.com:12333 -u user@domaincom mailbox Sent This produces error in remote server log: doveadm(192.168.10.19): Error: SSL handshake failed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number How to do it right?

1 0

dsync start/end date issue
by miro.igov＠pharmya.com 11 May '23

11 May '23

Hello, i am trying to do a backup with doveadm backup command. I need to set date filter with argument [-e end date]. Doing so with -e 2020-01-01 or -e 1577829600 shows error: dovecot: doveadm: Error: dsync(mail-archive.domain.com): handshake: Invalid sync_until_timestamp: 0 What is the correct way of time filter?

1 0

Best practice for Dovecot with LDAP and Postfix
by Moritz Pflanzer 09 May '23

09 May '23

Hi all, so far I had a setup where Dovecot was using a passwd file as userdb and passdb. Postfix was then authenticating with Dovecot via SASL to validate user accounts. Now I added an LDAP backend and would like to use that for Dovecot and Postfix. My first approach was to change the passdb to use the LDAP driver with the following settings: hosts = openldap:1389 base = ou=users,dc=example,dc=com auth_bind = yes auth_bind_userdn = uid=%n,ou=users,dc=example,dc=com And I changed the userdb driver to static since anyway there is just the vmail system account for all virtual user mailboxes. This is working as expected for the IMAP connections. But postfix authentication fails as it is apparently using a wrong user_filter. This is what I see in the logs from OpenLDAP: docker-openldap-1 | 645908ae.1d975b70 0x7fe379297700 conn=1347 fd=12 ACCEPT from IP=172.19.0.7:52144 (IP=0.0.0.0:1389) docker-openldap-1 | 645908ae.1d98571f 0x7fe379a98700 conn=1347 op=0 BIND dn="" method=128 docker-openldap-1 | 645908ae.1d993bd7 0x7fe379a98700 conn=1347 op=0 RESULT tag=97 err=0 qtime=0.000009 etime=0.000072 text= docker-postfix-1 | May 08 14:35:26 nest postfix/smtpd[12455]: 8A9FC1E03C5: client=mo4-p01-ob.smtp.rzone.de[85.215.255.51] docker-postfix-1 | May 08 14:35:26 nest postfix/cleanup[12461]: 8A9FC1E03C5: message-id=<713569303.508224.1683556526256(a)webmail.strato.de> docker-postfix-1 | May 08 14:35:26 nest postfix/qmgr[951]: 8A9FC1E03C5: from=<moritz(a)pflanzer.eu>, size=3340, nrcpt=1 (queue active) docker-postfix-1 | May 08 14:35:26 nest postfix/smtpd[12455]: disconnect from mo4-p01-ob.smtp.rzone.de[85.215.255.51] ehlo=2 starttls=1 mail=1 rcpt=1 data=1 quit=1 commands=7 docker-openldap-1 | 645908ae.2616b031 0x7fe379297700 conn=1347 op=1 SRCH base="ou=users,dc=example,dc=com" scope=2 deref=0 filter="(&(objectClass=posixAccount)(uid=moritz(a)example.com))" docker-openldap-1 | 645908ae.26179272 0x7fe379297700 conn=1347 op=1 SRCH attr=uid docker-openldap-1 | 645908ae.2619389b 0x7fe379297700 conn=1347 op=1 SEARCH RESULT tag=101 err=32 qtime=0.000017 etime=0.000221 nentries=0 text= I tried setting the user_filter manually to "user_filter = (mail=%u)" but that doesn't have any effect. Is this the expected behavior from Dovecot? I guess I can get it working by using the ldap driver for the userdb as well. But is that the best approach since I technically don't need it for dovecot itself. Or should I now change the postfix config as well to directly authenticate against the LDAP server instead of using SASL with Dovecot? Looking forward to recommendations, Moritz

7 16

Re: dmarc user can't receive email because of encrypted storage
by Aki Tuomi 09 May '23

09 May '23

> On 04/05/2023 21:08 EEST efeizbudak(a)disroot.org wrote: > > > On 2023-05-04 20:53, Aki Tuomi via dovecot wrote: > >> On 04/05/2023 20:11 EEST efeizbudak--- via dovecot > >> <dovecot(a)dovecot.org> wrote: > >> > >> > >> Hi all, > >> > >> So recently google has been trying to send email to dmarc(a)domain.com > >> on > >> my server but I'm using encrypted storage and since the dmarc user has > >> no password the email is being rejected with the error: > >> > >> May 4 16:51:50 domain dovecot: > >> lda(dmarc)<3326><l0J9NabiU2T+DAAA1iAyAg>: Error: sieve: > >> msgid=<10341808348719730099(a)google.com>: failed to store into mailbox > >> 'INBOX': generate_keypair(INBOX) failed: > >> mail_crypt_require_encrypted_user_key set, cannot generate user > >> keypair > >> without password or key > >> > >> How can I fix this, or at least read what the mail says? Would it be > >> safe to just give dmarc user a strong password? > > > > You can run > > > > doveadm mailbox cryptokey generate -U dmarc -N > > > > so the user will have a keypair generated. Then it should work. > > > > Aki > > I'm getting > > generate: invalid option -- 'N' > > should I just run it without -N ? > > Thank you! Please keep responses on the list. Try -n password? I have a faint recall of a buggy version like this. Aki

2 11

Documentation issue: incorrect link
by Tom Hendrikx 06 May '23

06 May '23

Hello, In the second paragraph at https://doc.dovecot.org/configuration_manual/sieve/extensions/duplicate/, a link is included to RFC7353, but this RFC is not related to sieve at all. I think the correct RFC to link is RFC7352, like in the first paragraph. Kind regards, Tom

1 0

amount of users
by Thomas Schäfer 05 May '23

05 May '23

Hi, is somewhere a table/matrix/function based on experience how many users require which values for mail_max_userip_connections default_client_limit default_process_limit ...? I run into problems with a small group of users, since the defaults seem to be only for single man shows. The second assumption is: User are permanently online (connected to imap) and using two devices in average (one or two desktops, + one mobile device) Regards, Thomas -- There’s no place like ::1 Thomas Schäfer (Systemverwaltung) Ludwig-Maximilians-Universität Centrum für Informations- und Sprachverarbeitung Oettingenstraße 67 Raum C109 80538 München ☎ +49/89/2180-9706 ℻ +49/89/2180-9701

1 0

dmarc user can't receive email because of encrypted storage
by efeizbudak＠disroot.org 04 May '23

04 May '23

Hi all, So recently google has been trying to send email to dmarc(a)domain.com on my server but I'm using encrypted storage and since the dmarc user has no password the email is being rejected with the error: May 4 16:51:50 domain dovecot: lda(dmarc)<3326><l0J9NabiU2T+DAAA1iAyAg>: Error: sieve: msgid=<10341808348719730099(a)google.com>: failed to store into mailbox 'INBOX': generate_keypair(INBOX) failed: mail_crypt_require_encrypted_user_key set, cannot generate user keypair without password or key How can I fix this, or at least read what the mail says? Would it be safe to just give dmarc user a strong password?

2 1

Error: read() failed for file :: No buffer space available
by rudolf＠padaru.de 04 May '23

04 May '23

Hey there, ive got a situation with one of mine mailusers he cant access his mailbox and i cant resync the mailuser or access the mails with doveadm too: In maillog we got a lot of these errors, ist only m.73 that makes problems: Error: Syncing mailbox INBOX failed: read() /mdbox/storage/m.73: No buffer space available I dont really understand whats the problem here, the partition has ~500gb free space and all other mailboxes work fine on this server. Is there somebody who can give me a hint to solve this? First i thought the mdbox file is to obig, so i increased the mdbox_rotate_size limit without success. To restart the dovecot changes nothing too. In the dovecot journal i cant find other problems wo cause in this one, same in syslog, nothing special to see, like segfaults or so. My doveconf -n: # 2.3.19.1 (9b53102964): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.19 (4eae2f79) # OS: Linux 5.4.0-146-generic x86_64 Ubuntu 20.04.6 LTS auth_mechanisms = plain login auth_username_chars = abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ01234567890.-_@üÜöÖäÄ auth_worker_max_count = 60 default_vsz_limit = 1000 M disable_plaintext_auth = no imap_capability = +XLIST imap_logout_format = in=%i out=%o del=%{deleted} fetched_mails=%{fetch_hdr_count} lda_mailbox_autocreate = yes lda_mailbox_autosubscribe = yes lock_method = flock login_log_format_elements = user=<%u> method=%m rip=%r lip=%l %c mail_always_cache_fields = date.received date.sent imap.envelope hdr.x-spam hdr.x-virus-status hdr.return-path hdr.received flags mail_cache_min_mail_count = 30 mail_location = auto: mail_max_userip_connections = 30 mail_never_cache_fields = mail_plugins = " zlib" managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext editheader imapflags notify vnd.dovecot.pipe vnd.dovecot.filter vnd.dovecot.execute mbox_read_locks = dotlock mbox_very_dirty_syncs = yes mdbox_rotate_size = 250 M namespace inbox { inbox = yes location = mailbox Archiv { auto = no special_use = } mailbox Drafts { auto = no special_use = } mailbox Junk { auto = no special_use = } mailbox Sent { auto = no special_use = } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { auto = no special_use = } prefix = } passdb { args = /etc/dovecot/conf.d/zDovecot-sql.conf.ext driver = sql } plugin { sieve = ~/sieve/.dovecot.sieve sieve_after = ~/sieve_after/.dovecot_after.sieve sieve_before = ~/sieve_before/.dovecot_before.sieve sieve_dir = ~/sieve sieve_execute_bin_dir = /usr/local/bin/ sieve_execute_input_eol = lf sieve_extensions = +notify +imapflags +vnd.dovecot.pipe +vnd.dovecot.filter +vnd.dovecot.execute +editheader -reject sieve_filter_bin_dir = /usr/local/bin/ sieve_filter_input_eol = lf sieve_global_dir = /etc/dovecot/sieve/ sieve_max_redirects = 25 sieve_pipe_bin_dir = /usr/local/bin/ sieve_pipe_input_eol = lf sieve_plugins = sieve_extprograms sieve_redirect_envelope_from = recipient zlib_save = gz zlib_save_level = 6 } protocols = imap pop3 sieve service auth-worker { idle_kill = 1 mins } service auth { idle_kill = 1 mins unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0660 user = postfix } user = root } service imap-login { executable = /usr/lib/dovecot/imap-login process_min_avail = 4 service_count = 0 user = dovecot } service imap { process_limit = 1024 } service managesieve-login { inet_listener sieve { port = 4190 } service_count = 0 user = dovecot } service managesieve { process_limit = 1024 user = dovecot } service pop3-login { executable = /usr/lib/dovecot/pop3-login process_min_avail = 4 service_count = 0 user = dovecot } service pop3 { executable = /usr/lib/dovecot/pop3 process_limit = 1024 } service stats { unix_listener stats-reader { group = dovecot mode = 0666 } unix_listener stats-writer { group = dovecot mode = 0666 } } shutdown_clients = no ssl_cert = </etc/certs/ourCert.com.pem ssl_cipher_list = EECDH+ECDSA+AESGCM:EECDH+aRSA+AESGCM:EECDH+ECDSA+SHA384:EECDH+ECDSA+SHA256:E ECDH+aRSA+SHA384:EECDH+aRSA+SHA256:EECDH+aRSA+RC4:EECDH:EDH+aRSA:!aNULL:!eNU LL:!LOW:!3DES:!MD5:!EXP:!PSK:!SRP:!DSS:!RC4 ssl_dh = # hidden, use -P to show it ssl_key = # hidden, use -P to show it ssl_prefer_server_ciphers = yes userdb { args = /etc/dovecot/conf.d/zDovecot-sql.conf.ext driver = sql } verbose_proctitle = yes protocol lda { mail_plugins = " zlib sieve zlib" rejection_reason = Your message to <%t> was automatically discarded:%n%r } protocol imap { imap_client_workarounds = delay-newmail mail_plugins = " zlib mail_log notify zlib" ssl = yes } protocol pop3 { mail_plugins = zlib pop3_client_workarounds = oe-ns-eoh outlook-no-nuls pop3_no_flag_updates = no pop3_uidl_format = %08Xu%08Xv ssl = yes } Size oft he mdbox-file: du -b m.73 262143997 m.73 Mit freundlichen Grüßen Yours sincerely <https://padaru.de/> Pascal Rudolf | Geschäftsführer PADARU-IT | Bielebohstraße 10 | 02736 Beiersdorf @: rudolf(a)padaru.de | www: <http://padaru.de/> padaru.de mobil: +49 (0) 17 772 595 32

1 0

Help - Permissions issue with new mail
by michele.clark＠us.kbr.com 03 May '23

03 May '23

Hi all. We have an install of Dovecot running with Postfix and Roundcube using virtual mail to allow us to connect to our AD domain which got messed up after a power issue. I can log into our Roundcube and see all my old emails, however new emails keep getting stuck in the CUR files with permissions of -rw------- If I chmod the email it will deliver to the inbox in Roundcube. Can anyone advise on how I can adjust this so all new emails will come thru with the correct permissions? - Thanks in advance

5 4

managesieve problem
by Soeren Malchow 25 Apr '23

25 Apr '23

Hi, i am struggeling with a managesieve problem, we are using docker mailserver and managesieve login does not work, if i understand correctly, then dovecot should offer something like this "SASL" "PLAIN" on our server it is simply empty "SASL" "" i was trying to authenticate in a telnet connection AUTHENTICATE "PLAIN" "LOGINSTRING_HERE" And i get this NO "Error in MANAGESIEVE command received by server." first of all i would like to ask where the SASL capabilites come from, how can i get it to offer "PLAIN" or "AUTH" everything else (e.g. sieve itself) just works find Cheers Soeren

2 2

dovecot sasl with postfix, smtp auth not available
by Badli Al Rashid 24 Apr '23

24 Apr '23

Hi All, I have set up dovecot sasl with postfix. When I check the smtp with ehlo there is no auth advertise. Connected to www.zystro.xyz. Escape character is '^]'. 220 www.zystro.xyz ehlo x.zystro.xyz 250-www.zystro.xyz 250-PIPELINING 250-SIZE 10485760 250-ETRN 250-STARTTLS 250-ENHANCEDSTATUSCODES 250-8BITMIME 250-DSN 250-SMTPUTF8 250 CHUNKING I did a number of installations the auth was not shown. I have use debian distributed and also dovecot packages. Sasl. root@www:~# postconf -a cyrus dovecot root@www:~# postconf -A cyrus Dovecot version. root@www:~# dovecot --version 2.3.20 (80a5ac675d) Dovecot configuration. root@www:~# dovecot -n # 2.3.20 (80a5ac675d): /etc/dovecot/dovecot.conf # OS: Linux 5.10.0-21-amd64 x86_64 Debian 11.6 # Hostname: www.zystro.xyz auth_mechanisms = plain login debug_log_path = /var/log/dovecot-debug.log info_log_path = /var/log/dovecot-info.log log_path = /var/log/dovecot.log mail_location = mbox:~/Mailbox namespace { inbox = yes location = prefix = separator = / } passdb { driver = pam } postmaster_address = postmaster(a)zystro.xyz protocols = imap service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0660 user = postfix } } service imap-login { inet_listener imap { address = 127.0.0.1,::1 port = 143 } inet_listener imaps { address = * port = 993 ssl = yes } } ssl_cert = </etc/letsencrypt/live/www.zystro.xyz/fu llchain.pem ssl_key = # hidden, use -P to show it userdb { args = blocking=no driver = passwd } I have followed the guide at postfix and dovecot but still the auth did not appear. https://doc.dovecot.org/configuration_manual/howto/postfix_and_dovecot_sasl/ https://www.postfix.org/SASL_README.html Anybody got any ideas ? Regards, -badli

6 12

dovecot-fts-solr Solr9 support
by PGNet Dev 24 Apr '23

24 Apr '23

I run dovecot-2.3.18 , & am deploying Solr search with 'dovecot-fts-solr' I run Solr standalone. When creating a dedicated 'dovecot' core, cp'ing from Dovecot's included solr schemas ls -al /usr/share/doc/dovecot/solr-* -rw-r--r-- 1 root root 12K Dec 3 06:48 /usr/share/doc/dovecot/solr-config-7.7.0.xml -rw-r--r-- 1 root root 2.7K Dec 3 06:48 /usr/share/doc/dovecot/solr-schema-7.7.0.xml -rw-r--r-- 1 root root 2.9K Dec 3 06:48 /usr/share/doc/dovecot/solr-schema.xml is tested only for Solr 7.7.0 https://doc.dovecot.org/configuration_manual/fts/solr/ "The steps described in this page are tested for Solr 7.7.0. For other versions, this these steps may need to be adjusted." which, per solr docs https://solr.apache.org/downloads.html About versions and support Version Description 9.x Current major version for feature releases (STABLE) 8.11.x Previous major version may sometimes receive critical bugfix releases 10 Next major version, yet to be released (UNSTABLE) <8.11 All older versions are End Of Life (EOL) is EOL'd and unsupported. In the dovecot 7.7.0 schema, FastLRUCache/LRUCache are used as the caching class(es), grep class=.*LRU /usr/share/doc/dovecot/solr-config-7.7.0.xml <filterCache class="solr.FastLRUCache" <queryResultCache class="solr.LRUCache" <documentCache class="solr.LRUCache" class="solr.search.LRUCache" For Solr 9, cat CHANGES.txt Upgrade Notes --------------------- ... * SOLR-13817: Deprecate legacy SolrCache implementations. Users are encouraged to transition their configurations to use org.apache.solr.search.CaffeineCache instead. (ab) running solr9 + dovecot-fts-solr search, based on the 7.7.0 schemas, results in errors, failed scan & search. Modifying the config to use CaffeineCache cp solr-config-7.7.0.xml solr-config-9.0.0.xml perl -pi -e '\ s|solr.FastLRUCache|solr.CaffeineCache|g; \ s|solr.LRUCache|solr.CaffeineCache|g; \ s|solr.search.LRUCache|solr.search.CaffeineCache|g;' \ solr-config-9.0.0.xml appears to do the trick. Atm, indexing & search -- both manually triggered, and on delivery receipt to Dovecot store -- is working with no errors (yet). I've not tested exhaustively yet, & don't know if this Cache class change in the schema is both necessary & sufficient for dovecot-fts-solr search use with solr 9.0.0 Given that for Solr "<8.11 All older versions are End Of Life (EOL)" it'd be useful for Dovecot to 'retest' for current, not-EOL'd Solr, and publish/package compatible schemas accordingly.

5 8

Indexer opening emails in write mode ?
by Andre Rodier 23 Apr '23

23 Apr '23

Hi, I have dovecot indexer working inside AppArmor, and I am confused by some error messages: > name="/home/users/andre/mails/maildir/.Sent/cur/1682251668.M110083P109814.pigment,S=1743,W=1776:2,S" pid=111784 > comm="indexer-worker" requested_mask="wd" denied_mask="wd" fsuid=1001 ouid=1001 Why the indexer would open email files in write mode, please ? Thanks for your advice

1 0

sieve traces not logged
by Christian Weiske 23 Apr '23

23 Apr '23

Hello, Some sieve filters do not work as expected and I want to debug why. For that I configured in /etc/dovecot/conf.d/90-sieve.conf sieve_trace_dir = /var/log/dovecot/ sieve_trace_level = matching and created /var/log/dovecot/ and gave it the user+group "Debian-exim". Unfortunately, no logs are written into that direcory. The normal log file in /var/log/dovecot.log contains no information - except that lmtp stored the mail in mailbox "test". The docs[1] only say that those two options need to be enabled. Sieve itself works, which I confirmed by creating a rule that moves mails with subject "test" into a separate folder. What am I doing wrong? ---- $ dovecot --version 2.3.20 (80a5ac675d) Running on Debian 11, packages from https://repo.dovecot.org/ce-2.3-latest/debian/bullseye Full sieve config from "dovecot -n": plugin { imapsieve_mailbox1_before = file:/var/lib/dovecot/sieve/learn-spam.sieve imapsieve_mailbox1_causes = COPY imapsieve_mailbox1_name = Spam imapsieve_mailbox2_before = file:/var/lib/dovecot/sieve/learn-ham.sieve imapsieve_mailbox2_causes = COPY imapsieve_mailbox2_from = Spam imapsieve_mailbox2_name = * sieve = file:~/sieve;active=~/.dovecot.sieve sieve_default = /var/lib/dovecot/sieve/default.sieve sieve_global_extensions = +vnd.dovecot.pipe +vnd.dovecot.environment sieve_pipe_bin_dir = /etc/dovecot/sieve-bin/ sieve_plugins = sieve_imapsieve sieve_extprograms sieve_trace_debug = no sieve_trace_dir = /var/log/dovecot-sieve sieve_trace_level = matching } [1] https://doc.dovecot.org/configuration_manual/sieve/configuration/#trace-deb… -- Regards/Mit freundlichen Grüßen Christian Weiske -=≡ Geeking around in the name of science since 1982 ≡=-

1 1

Blacklistd
by Doug Hardie 22 Apr '23

22 Apr '23

Are there any plans to interface to blacklistd? -- Doug

6 9

quotas and Trash
by David Koski 22 Apr '23

22 Apr '23

Hello, I am testing quotas with the following configuration: plugin { quota_rule = *:storage=1M quota_rule2 = INBOX.Trash:storage=+100M quota_grace = 10%% } The 1M limit works perfectly but I had to prefix Trash with "INBOX." to get it to stop complaining about an unknown namespace. But now the quota_rule2 is ignored. Once the mailbox reaches 1M, even if it is all in INBOX.Trash, it will fail to deliver due to quota limit. Dovecot: 2.3.13+dfsg1-2+deb11u1:amd64 Debian 11 auth_mechanisms = plain login disable_plaintext_auth = no mail_plugins = quota mail_privileged_group = mail namespace inbox { inbox = yes location = mailbox Drafts { auto = subscribe special_use = \Drafts } mailbox Junk { auto = subscribe special_use = \Junk } mailbox Sent { auto = subscribe special_use = \Sent } mailbox "Sent Messages" { auto = subscribe special_use = \Sent } mailbox Trash { auto = subscribe special_use = \Trash } prefix = INBOX. separator = . } passdb { args = /etc/dovecot/dovecot-sql.conf.ext driver = sql } plugin { mail_plugins = quota quota quota = maildir:User quota quota_grace = 10%% quota_rule = *:storage=1M quota_rule2 = INBOX.Trash:storage=+100M } protocols = " imap pop3" service anvil { unix_listener anvil-auth-penalty { group = vmail mode = 0660 user = vmail } } service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0666 user = postfix } unix_listener auth-client { mode = 0660 } } service imap-login { inet_listener imap { address = 172.16.0.1 } } service pop3-login { inet_listener pop3 { address = 172.16.0.1 } } service stats { unix_listener stats-reader { group = vmail mode = 0660 user = vmail } unix_listener stats-writer { group = vmail mode = 0660 user = vmail } } ssl = no ssl_client_ca_dir = /etc/ssl/certs ssl_dh = # hidden, use -P to show it userdb { args = /etc/dovecot/dovecot-sql.conf.ext driver = sql } protocol lmtp { mail_plugins = quota quota postmaster_address = dkoski(a)sutinen.com } protocol lda { mail_plugins = quota quota } protocol imap { mail_max_userip_connections = 14 mail_plugins = quota quota imap_quota } protocol pop3 { mail_plugins = quota quota } Regards, David Koski dkoski(a)sutinen.com

3 7

Message searching in Dovecot
by John Gateley 21 Apr '23

21 Apr '23

Hello, For mobile clients (gmail on Android), I need a server side searching solution. A few months ago, I tried getting Solr to work with Dovecot, but failed. The instructions here https://doc.dovecot.org/configuration_manual/fts/solr/ are quite out of date, they reference Debian 8 and 9 (current version 11), and Solr 7.7 (current version 9.2) My Solr experience is pretty much zero. Questions/Requests: * Is there a different tool than Solr I should be using for this? * Does anyone have a recent version of Solr and Debian working? * If you do, would you be willing to help me? * I cannot afford much, this is a home mailserver for my wife and I, but I could pay a small consulting fee. I use ansible to deploy the server, I'd be willing to contribute the playbooks somewhere for documentation, or help with the docs. Thanks! John

5 6

Re: Mailing list is being Spam Filtered by O-365
by White, Daniel E. (GSFC-770.0)[AEGIS] 20 Apr '23

20 Apr '23

From headers: Received: from BL0GCC02FT014.eop-gcc02.prod.protection.outlook.com (2a01:111:f400:7d05::209) by CYXPR09CA0010.outlook.office365.com (2603:10b6:930:d4::15) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.6319.25 via Frontend Transport; Thu, 20 Apr 2023 11:49:06 +0000 Authentication-Results: spf=softfail (sender IP is 63.88.93.251) smtp.mailfrom=open-xchange.com; dkim=fail (signature did not verify) header.d=open-xchange.com;dmarc=fail action=oreject header.from=open-xchange.com;compauth=none reason=452 Received-SPF: SoftFail (protection.outlook.com: domain of transitioning open-xchange.com discourages use of 63.88.93.251 as permitted sender) From: Aki Tuomi <aki.tuomi(a)open-xchange.com> Date: Thursday, April 20, 2023 at 07:49 Subject: [EXTERNAL] Re: Mailing list is being Spam Filtered by O-365 On 20/04/2023 14:18 EEST White, Daniel E. (GSFC-770.0)[AEGIS] via dovecot <dovecot(a)dovecot.org<mailto:dovecot@dovecot.org>> wrote: Is there any chance that SPF and DKIM records could be added to appear in the headers ? The gubba-mint folks are getting extremely medieval about email security. Um? Those already are added? Or what do you mean? Aki

3 2

Mailing list is being Spam Filtered by O-365
by White, Daniel E. (GSFC-770.0)[AEGIS] 20 Apr '23

20 Apr '23

Is there any chance that SPF and DKIM records could be added to appear in the headers ? The gubba-mint folks are getting extremely medieval about email security.

2 1

Request - extra variable in passdb for logging
by Bogusław Juza 20 Apr '23

20 Apr '23

Hi Staff, I'm creating the dovecot configuration for multiple user passwords e-mail site. It's working well, but I've one problem - I can't log, which password was used. I'm using auth-sql, the query looks like: password_query = \ SELECT `users`.`email` AS `user`, \ `shadow`.`passwd` AS `password`, \ FROM `shadow` WHERE `shadow`.`email` = '%u' AND \ ( ('%r'='127.0.0.1' AND `shadow`.`webmail`<>0) OR \ ('%r'<>'127.0.0.1' AND `shadow`.`imap`<>0 AND \ `shadow`.`hash`='%{sha512;rounds=5000:password}') \ ) LIMIT 1 The hash from random generated application password works as the selector, which password should be checked. It works fine, but in the log I have got only the e-mail and both IP addresses. I need to log one more information - which password was used (`shadow`.`id` column). It would be a great feature to have one more extra variable, which I could set in this query and which goes directly to log and nowhere else. I have tried something like: password_query = \ SELECT CONCAT(`users`.`email`,'#',`shadow`.`id`) AS `user`, ... and then "repair it" in user_query: SELECT `email` AS `user` WHERE `email` = REGEXP_SUBSTR('%u','[^#]+') and it even works well, except postfix-auth, which received email with #number as the username and it was problematic. So I'm kindly asking for this extra variable in next versions of Dovecot ;) Bogusław Juza

2 1

mbox to maildir migration, same server?
by kjohnson＠eclypse.org 20 Apr '23

20 Apr '23

What is the recommended procedure to migrate from mbox to maildir on a server already running dovecot? Ideally, this procedure would convert messages in an existing mbox INBOX and in ~/mail mboxes (as defined in my dovecot configuration) to storage in a ~/Maildir. Some of the INBOXs are rather large -- 100's of MB (one of the reasons for migrating). What I have tried has not worked for me. Below, I describe what I tried, how I tested before I tried, what went wrong, and the current setup (pre-migration). What I tried: ============= stop exim4 service dovecot stop Make dovecot listen only locally, not to external connections. /etc/dovecot/local.conf protocol imap { listen = 127.0.0.1:143 ssl_listen = 127.0.0.1:993 } protocol pop3 { listen = 127.0.0.1:110 ssl_listen = 127.0.0.1:995 } Modify dovecot configuration for maildir: Watch capitalization! #in 10-mail.conf: mail_location = maildir:/home/%u/Maildir namespace inbox { separator = / } dovecot -n, to confirm results and perform limited syntax checking. service dovecot start for each user, in a bash script: dsync -v -u "$U" mirror "mbox:/home/$U/mail:INBOX=/var/mail/$U" (if the conversion worked for all users, then reconfigure exim to use maildir and restart it; reconfigure dovecot to listen to external interfaces and restart.) How I tested: ============= Before trying this on the real server, I set up a matching (same versions of Debian, Exim, and Dovecot) VM using mbox, with a couple of accounts. One using POP3, one using IMAP. The IMAP account was accessed from Claws and from Outlook. The test accounts had perhaps a dozen messages on the server. I tried the conversion procedure, and everything I tried worked flawlessly. (Yes, next time I will move some real inbox files from the live server). What went wrong: ================ I encountered two types of problems here. The first was several dsync warnings (username changed): dsync(example): Warning: Mailbox changes caused a desync. You may want to run dsync again: Remote lost mailbox GUID 21bfa11a81f11763ac150000d09efc50 (maybe it was just deleted?) As I understand it, this can result in some or all messages being downloaded again by clients. My understanding may be wrong. I also don't understand how the mailbox could have changed -- exim4 was stopped, dovecot is only listening on 127.0.0.1, and I am the only user who uses a local mail client on that system, and this was not my account. The second problem I encountered seems to match Debian Bug report logs - #1011238. In part of the discussion of that report, the reporter mentions adding -1 to the command, as shown: dsync -v -u "$U" mirror -1 "mbox:/home/$U/mail:INBOX=/var/mail/$U" While this seemed to eliminate the dsync panic of #1011238, as far as I can tell, no old messages were actually moved from the old mbox files to the new maildirs. At that point I restored the backup mbox files and undid the changes to dovecot and exim4. Current setup: ============== Debian 11.4 Exim 4.94.2-7 dovecot 1:2.3.13+dfsg1-2 The current setup with Dovecot was a successful migration from IMAP-UW in December 2020. Output from dovecot -n (the list of trusted networks has been removed) # 2.3.13 (89f716dc2): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.13 (cdd19fe3) # OS: Linux 5.10.0-16-686-pae i686 Debian 11.4 # Hostname: localhost auth_verbose = yes mail_location = mbox:~/mail:INBOX=/var/mail/%u mail_privileged_group = mail namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } passdb { driver = pam } pop3_uidl_format = %08Xv%08Xu protocols = " imap pop3" ssl_cert = </etc/dovecot/dovecot.pem ssl_client_ca_dir = /etc/ssl/certs ssl_dh = # hidden, use -P to show it ssl_key = # hidden, use -P to show it userdb { driver = passwd } Thank you to anyone who read this far. Ken

4 4

last_login plugin and $remote_ip
by Fabrizio Cuseo 19 Apr '23

19 Apr '23

Good morning. I am planning a dovecot system with: - 3 x glusterfs servers (with 2 volumes, 1 ssd for short term mail, and 1 with bigger hdd for long term archive mail) - 1 x mysql server (another server with active replica will be added) - 3 x mbox servers (with dovecot pop/imap/lmpt/sieve/postfix) - 3 x dovecot proxy/directors for pop3/imap/smtp - 4 x proxmox mail gateway for antispam/antivirus in front of smtp servers - 1 x centralized syslog server All have private ip addresses, and in front there is a firewall with HA_proxy to make high availability and load balancing. My only problem now is using last_login plugin; i have configured on the mailbox servers on pop3/imap, but the ip address that is written on mysql is the proxy/director address, not the real client ip address. No results using real_remote_ip. Apr 19 09:14:31 mailbox-01 dovecot: pop3-login: Login: user=<username(a)domain.it>, method=PLAIN, rip=172.16.27.31, lip=172.16.27.21, mpid=19723, session=<42nHLKv5JsqsEBsf> Apr 19 09:14:31 mailproxy-01 dovecot: pop3-login: proxy(username@domain.it,172.16.27.21:110): Started proxying to 172.16.27.21 (1.978 secs): user=<username(a)domain.it>, method=PLAIN, rip=212.66.96.188, lip=172.16.27.31, session=<u4+wLKv5ZUjUQmC8> Apr 19 09:14:34 mailbox-01 dovecot: pop3(username(a)domain.it)<19723><42nHLKv5JsqsEBsf>: Disconnected: Logged out top=0/0, retr=0/0, del=0/37, size=115779706 Apr 19 09:14:34 mailproxy-01 dovecot: pop3-login: proxy(username@domain.it,172.16.27.21:110): Disconnected by server (0s idle, in=45, out=82): user=<username(a)domain.it>, method=PLAIN, rip=212.66.96.188, lip=172.16.27.31, session=<u4+wLKv5ZUjUQmC8> in db I have last_ip: 172.16.27.31, not 212.66.96.188 ------------- dovecot -n # 2.3.16 (7e2e900c1a): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.16 (09c29328) # OS: Linux 5.15.0-69-generic x86_64 Ubuntu 22.04.2 LTS # Hostname: mailbox-01 auth_default_realm = XXXXXXXX.it default_client_limit = 2500 dict { mysql = mysql:/etc/dovecot/dovecot-dict-sql.conf.ext sieve = mysql:/etc/dovecot/dict-sieve-sql.conf sql = mysql:/etc/dovecot/dovecot-dict-sql.conf.ext } disable_plaintext_auth = no doveadm_api_key = # hidden, use -P to show it first_valid_gid = 89 first_valid_uid = 89 imap_client_workarounds = tb-extra-mailbox-sep delay-newmail login_greeting = Welcome to mail server mail_fsync = always mail_gid = 89 mail_location = mbox:~/mail:INBOX=/var/mail/%u mail_plugins = quota mail_privileged_group = mail mail_uid = 89 mailbox_list_index_very_dirty_syncs = yes mdbox_rotate_size = 128 M mmap_disable = yes namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = separator = . } passdb { driver = pam } passdb { args = /etc/dovecot/dovecot-sql.conf.ext driver = sql } plugin { last_login_dict = proxy::sql last_login_key = # hidden, use -P to show it last_login_precision = ms quota = count:User quota quota_clone_dict = proxy::mysql quota_grace = 50M quota_rule2 = Trash:storage=+100M quota_vsizes = yes quota_warning = storage=95%% quota-warning 95 %u quota_warning2 = storage=80%% quota-warning 80 %u sieve = dict:proxy::sieve;name=active sieve_extensions = +vacation-seconds sieve_vacation_default_period = 7d sieve_vacation_max_period = 30d sieve_vacation_min_period = 1h } pop3_client_workarounds = outlook-no-nuls oe-ns-eoh protocols = " imap lmtp pop3" service dict { unix_listener dict { group = mail2023 mode = 0660 user = mail2023 } } service doveadm { inet_listener { port = 2425 } inet_listener http { port = 8080 } unix_listener doveadm-server { user = mail2023 } } service imap { process_limit = 1024 } service lmtp { inet_listener lmtp { port = 24 } unix_listener /var/spool/postfix/private/dovecot-lmtp { group = mail2023 mode = 0666 user = mail2023 } } service pop3 { process_limit = 250 } service quota-warning { executable = script /usr/local/bin/quota-warning.sh unix_listener quota-warning { mode = 0666 user = mail2023 } user = mail2023 } service stats { unix_listener stats-reader { group = mail2023 mode = 0660 user = mail2023 } unix_listener stats-writer { group = mail2023 mode = 0660 user = mail2023 } } ssl_cert = </etc/dovecot/private/dovecot.pem ssl_client_ca_dir = /etc/ssl/certs ssl_dh = # hidden, use -P to show it ssl_key = # hidden, use -P to show it userdb { driver = passwd } userdb { args = /etc/dovecot/dovecot-sql.conf.ext driver = sql } protocol lmtp { mail_plugins = quota sieve quota quota_clone } protocol !indexer-worker { mail_vsize_bg_after_count = 100 } protocol lda { mail_plugins = quota sieve quota quota_clone } protocol imap { mail_max_userip_connections = 10 mail_plugins = quota quota imap_quota quota_clone last_login } protocol pop3 { mail_max_userip_connections = 2 mail_plugins = quota quota quota_clone last_login } in dovecot-dict-sql.conf.ext there is: map { pattern = shared/last-login/$service/$user/$remote_ip table = mail_last_login value_field = last_access value_type = uint fields { userid = $user service = $service last_ip = $remote_ip } } -- --- Fabrizio Cuseo - mailto:f.cuseo@panservice.it

2 2