- dovecot - dovecot.org

Dovecot gzip u.files on sdboxes
by Jose Celestino 01 Feb '23

01 Feb '23

Hi, I was wondering if it's possible to lighten the process of converting sdbox mailboxes to zlib by, instead of using dsync (that brings much more io, copying from alt - and copying of unneeded data as we have many mails already compressed from activating zlib a couble of years ago) just compressing each of the u files. By compression of the u files I mean opening the uncompressed u file for reading, a u.temp file for writting and: 1. copy the dbox message header from u to u.tmp 2. compress the plain message and write it to u.tmp 3. fix the message_size_hex on the u.tmp dbox message header to the new, compressed size 4. copy the dbox metadata from u to u.tmp with Zphysical_size added 5. copy the u stat times to u.tmp 6. replace u with u.tmp Is the message_size_hex stored anywhere else (indexes) that may cause this to not work? Thank you.

2 1

Add Userdb extra field to existing configuration settings, not overriding them
by Stefano Cecconello 27 Jan '23

27 Jan '23

Hi, If i understood correctly the extra field feature ( https://doc.dovecot.org/configuration_manual/authentication/user_database_ex tra_fields/ ), any extra field that is passed from a SQL query will overwrite any existing settings on the dovecot.conf configuration file ( if present ) . For example, if i want to enable a plugin ( ex: acl ) on a per user basis, i would add a column\field ( ex: "acl_enabled" = 1 ) into my auth DB , then add into the dovecot password\user queries : . IF(acl_enabled = 0, NULL, 'acl imap_acl') AS mail_plugins . While having in the dovecot.conf this setting : . mail_plugins = quota notify protocol imap mail_plugins = $mail_plugins imap_quota . >From my test, this combination will lead to having the logging users with acl_enabled=1, a mail_plugins list of acl and imap_acl only, without the quota and notify plugins . If i change the acl_value to 0, the returned mail_plugins list is empty and it will not overrive\overwrite the dovecot.conf mail_plugins configuration . If it's correct, there is a way to merge both settings, like having in the dovecot.conf a minimal\base subset of settings and adding any additional values via SQL queries ? Thanks and best regards Stefano

2 1

sieve_extprograms plugin calling bash script
by Tom 27 Jan '23

27 Jan '23

I receive an email a few times a week containing a URL for a live stream which starts within a minute after receiving the email. I want to automate capturing the whole stream. I've been trying to write a sieve script which uses the sieve extprograms plugin to call a bash script that parses the URL from the email and passes it to a capture program. So far I've had no luck getting the bash script to call _any_ external programs. I can't even write a file to /tmp/, so it's not a filesystem permissions issue. The sieve script has no issues finding and executing the bash script, it just does nothing other than return an exit code. Does sieve put the extprogram script in some kind of sandbox where it has no access to the system? This may not be the best place to find answers to sieve plugin info. If so, can someone point me in the right direction?

3 2

How do you scale dovecot for good performance with Roundcube webmailer in front? (hitting limits without exhausting resources)
by Malte Schmidt 27 Jan '23

27 Jan '23

Good day, I am currently setting up/debugging a webmailer-only setup using Roundcube (latest version) with Dovecot (2.3.20, latest as of now). Generally speaking the setup performs OK, I wrote a JMeter Roundcube script to test the Roundcube. This includes actions like listing mails and fetching them. I am hitting a somehow dubious limit of 600 req/s though. (This includes all kinds of HTTP calls to Roundcube, not only the ones triggering IMAP). When the dovecot becomes unavailable, the performance without mails jumps to 7700 req/s. Testing is done with 4 JMeter-servers and one client. My setup is a Dovecot with MySQL (Percona XtraDB) backend. Mails are encrypted with mail_crypt and EC keys. Authentication is done in parallel (auth_cache_verify_with_workers=yes). Where possible min_available_processes have been set equal to the threads available on the Dovecot machine (64). Hardware is a 64 thread Xeon CPU at 2.10 GHz, 96 GB RAM, SSDs as backing storage IOPS read 40000/write 13000. What settings do you recommend and how was your experience with Roundcube and its performance in general (what should be possible with that kind of HW?)? Best regards and thanks in advance!

3 3

[REVISIONS] How to install SSL Certificate on Dovecot and Postfix
by Turritopsis Dohrnii Teo En Ming 27 Jan '23

27 Jan '23

Subject: [REVISIONS] How to install SSL Certificate on Dovecot and Postfix Good day from Singapore, Author: Mr. Turritopsis Dohrnii Teo En Ming (TARGETED INDIVIDUAL) Country: Singapore Date of Implementation: 6 Jan 2023 Friday SECTION ON DOVECOT =================== # cd /etc/dovecot/conf.d # nano 10-ssl.conf ssl = yes ssl_cert = </home/teo-en-ming-corp/2023.crt ssl_key = </home/teo-en-ming-corp/2023.key ssl_ca = </home/teo-en-ming-corp/inter2023.crt # nano /etc/dovecot/dovecot.conf protocols = imap pop3 !include conf.d/*.conf SECTION ON POSTFIX =================== # nano /etc/postfix/main.cf smtpd_use_tls = yes smtpd_tls_auth_only = yes smtpd_tls_key_file = /etc/postfix/2023.key smtpd_tls_cert_file = /etc/postfix/chain2023.crt smtpd_tls_CAfile = /etc/postfix/inter2023.crt Note: chain2023.crt is made by combining 2023.crt and inter2023.crt # nano /etc/postfix/master.cf submission inet n - n - - smtpd smtps inet n - n - - smtpd tlsmgr unix - - n 1000? 1 tlsmgr That's all. Regards, Mr. Turritopsis Dohrnii Teo En Ming Targeted Individual in Singapore Blogs: https://tdtemcerts.blogspot.com https://tdtemcerts.wordpress.com

1 0

LDAP scheme for Dovecot
by Daniel Betschart 24 Jan '23

24 Jan '23

I use an LDAP server for user administration, the users can manage themselves with the LDAP Account Manager (LAM). I would like to give the possibility to be able to define the quota per user. LAM provides support for certain schemes, but the qmail scheme is missing in the free variant. So I used the Courier scheme. Now, while LAM correctly stores the value in bytes, it appends the letter S. Unfortunately, the mail server Dovecot cannot do anything with this letter S. Is there a better scheme for Dovecot? I haven't found any until now. Or can I remove the letter S at the end in the Dovecot configuration file via regex?

1 0

Why does doveadm always run doveconf?
by Bert Van de Poel 21 Jan '23

21 Jan '23

Dear fellow Dovecot users, I've recently been aiding in the fixing up of the old dovecot_stats_ munin plugin. Currently, it still parses the output of doveadm oldstats, as it is quite an old script. Regardless of any feelings we may all have about oldstats, I was quite surprised to find that doveadm requires quite broad privileges (in my case root privileges) to function properly. It seems that any call to doveadm, even for "doveadm oldstats dump domain" runs doveconf and will attempt to fully parse my configuration including trying to read SSL/TLS certificates. Due to this choice, the fact the FIFO of oldstats can be given low privileges, doveadm still has to be invoked with high privileges or it will fail at the stage of verifying configuration. Now I'm wondering why it's the case that a command such as "doveadm oldstats dump domain" is invoking doveconf and therefore has these kinds of limitations. While for basically all non-stats functions of doveadm, running as root (or similar) makes a lot of sense, I'd argue it doesn't for oldstats (and maybe also the new stats?), which simply talk to a socket. Is there a certain reasoning behind this, or is this accidental behaviour because of the standard operations doveadm always performs? Any elaboration would be more than welcome! Kind regards, Bert

2 3

Different username for passdb and userdb
by support+dovecot＠shellworld.net 21 Jan '23

21 Jan '23

Hello I am attempting to use an external IMAP server for authentication, on Dovecot 2.3.16 (7e2e900c1a), running on Ubuntu 22.04. The external server requires usernames of the format: user@domain However, my local users, where the mail is actually drawn from, are of the format: user (passwd file driven). I was able to log in with just "user", and have it both authenticate remotely, and access local mail, using: passdb { driver = imap args = host=remotehost.com ssl=imaps port=993 user=%n@%d ssl_ca_dir=/etc/ssl/certs } userdb { driver = passwd args = blocking=no } However, the remote SMTP server, which I will not be proxying, requires the same user@domain format for usernames. I would rather not ask users to use "user@domain" for SMTP, and "user" for IMAP. They should only have to use "user@domain" for login everywhere. Is there a way to do this? The docs suggest so (AuthDatabase.PasswdFile.txt), but if so I must be botching it. Things I have tried: passdb { driver = imap args = host=remotehost.com ssl=imaps port=993 ssl_ca_dir=/etc/ssl/certs } userdb { driver = passwd args = blocking=no override_fields = username_format=%n } I also tried: override_fields = user=%n Or, alternatively to any override_fields: args = blocking=no username_format=%n Lastly, I even tried this whole different approach: userdb { driver = passwd-file args = blocking=no username_format=%n /etc/passwd } The following is logged no matter which of those I try: auth: imapc(remotehost.com:993): Connected to #.#.#.#:993 (local #.#.#.#:35088) auth: Error: passwd(user(a)domain,#.#.#.#,<...>): user not found from userdb imap(274049): Error: auth-master: login: request [...]: Login auth request failed: Authenticated user not found from userdb, auth lookup id=... (auth connected 10 msecs ago, request took 1 msecs, client-pid=274038 client-id=1) imap-login: Disconnected: Internal login failure (pid=274038 id=1): user=<user@domain>, method=PLAIN, rip=#.#.#.#, lip=#.#.#.#, mpid=274049, TLS, session=<...> (The last attempt got a slightly varied log message, but quite similar: auth: Error: passwd-file(user(a)domain#.#.#.#,<...>): user not found from userdb ) Any help with this would be much appreciated. Thanks! Luke

1 1

submission_host auth
by k v 18 Jan '23

18 Jan '23

When using dovecot container with sieve plugin there is no sendmail to use for sending email for sieve redirect action for example. We can use submission_host instead https://doc.dovecot.org/settings/core/#core_setting-submission_host but there is no way to specify credentials for auth in remote MTA. Submission_relay_* settings e.g. submission_relay_master_user relate to dovecot submission service. Using something like permit_mynetworks in remote MTA is not acceptable for security reasons. Is it possible to add authorization in the remote MTA using submission_host?

2 4

dovecot replication - new and cur folders on mx1 and mx2
by Tomaz Kavcic 18 Jan '23

18 Jan '23

Hello, I have a question in regards to specific dovecot replication behaviour and I'm just wondering if this is actually an expected/normal behaviour, or just a version issue. I'm using dovecot 2.3.16 which is packed by default with latest Ubuntu 22.04.1 LTS server release. I setup dovecot replication pair (mx1 - mx2) which is working ok. MX1 has priority 10, MX2 has priority 20. I use maildir (postfix + dovecot lmtp). The "strange" behaviour is this. When new mail arrives, it's by default delivered into "new" folder inside user directory. This email is then replicated to both servers (mx1 and mx2). When I login to mx1 via IMAP client (roundcube, outlook, etc.) that specific email is moved from "new" to "cur" folder on server mx1 and it's flagged also with "S", which probably means read flag. On server mx2, that email filename is also flagged with "S", but the email stays inside the "new" folder and it's not moved to "cur". If I want this email to be moved to "cur" on mx2 server, I have to login to that IMAP server as well, click on that email (which is already flagged as read), and after click, the email is also moved to "cur" on server mx2. Simply said, all new mails on mx1 server are moved to "cur" when accessed, but the stay in "new" folder on server mx2 until they're physically accessed there as well. Is this normal behaviour? I tried setup with TCP and SSH replication, and the situation is the same in all cases. Lastly, I tried TCPS (with SSL) as well, but that option has issues in 2.3.16, which is probably known already as I found multiple posts about these issues in this version. Thank you in advance for your answer and kind regards, Tomaz Kavcic. --- As suggested by mr. Timo Sarainen, this should be synced, so I'm posting doveconf -n as attachment for both servers as well.

3 3

Quota Clone Plugin
by MK 17 Jan '23

17 Jan '23

Hello Everybody, just a short question, maybe someone used this plugin and can give me a short answer. I have configured dovecot Quota Clone Plugin to copy quota information into a MySQL Database. Works finde, but dovecot writes the quota information only to the database if the quota is triggert by new email or something else like this. So I don't have all my user in the MySQL Database. Is there any command I can use that can trigger dovecot to write the quota information of all the users to the database one time, so that I have all my user quota information copied in the database? I have tried "doveadm quota recalc -A" but it took quite a long time and there is a very high I/O Load on the server, so I stopped it. I don't think this is what I want to do. Maybe there is another way. For all of you who don't know this plugin. https://doc.dovecot.org/configuration_manual/quota_clone_plugin/ Greetings, Oliver

3 3

hostname in director_mail_servers setting
by k v 16 Jan '23

16 Jan '23

director_mail_servers setting uses IP Adresses as values https://doc.dovecot.org/settings/core/#core_setting-director_mail_servers As described in the documentation, hostnames are converted to addresses when the configuration is read https://doc.dovecot.org/settings/types/#ip-addresses This is acceptable in host or virtual machine environment, but becomes a problem in a containerized environment. When any backend container is restarted, its address will change and users related to this backend can no longer connect, but backend (available with new IP address) can process request for example, director_mail_servers = dovecot-1 dovecot-2 dovecot-3 becomes in runtime (with one successfully connectetd user foo(a)example.com) doveadm director status mail server ip tag vhosts state state changed users 10.0.71.3 100 up - 0 10.0.71.4 100 up - 1 10.0.71.5 100 up - 0 where dovecot-1 10.0.71.3, dovecot-2 10.0.71.4, dovecot-3 10.0.71.5 When dovevecot-2 backend container restarts, and becomes new IP address, user can't connect to related backend: imap-login: Info: proxy(foo@example.com,10.0.71.4:143): Started proxying to <10.0.71.4> (<dovecot-2>) (0.009 secs) imap-login: Error: proxy(foo@example.com,10.0.71.4:143): connect(10.0.71.4, 143) failed: No route to host (after 28 secs, 3 reconnects, local=10.0.71.13:41066) My suggestion to developers: resolve backend hostnames to IP address on every request to director_mail_servers It's not about dovemon service with active health checks from dovecot pro, just dynamic hostname resolve

2 1

Error: Mailbox INBOX: file_dotlock_create in directory /var/mail failed: Permission denied
by manmatha 16 Jan '23

16 Jan '23

Hi All, We are running Round cube on top of dovecot and postfix as our email echo system. Main problem we are facing is that, roundcube loads really slow for big inboxes (~5000 emails). I found that, while it loads, imap process goes high in terms of CPU utilization(~90%). I asked it in some roundcube support group, They believe that it is related to dovecot not roundcube. Can you shed any light on this issue. Thanks in advance. Here is $dovecot -n$ output xyz@roundcube-internal-server-1:/etc/dovecot$ dovecot -n # 2.3.16 (7e2e900c1a): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.16 (09c29328) # OS: Linux 5.15.0-1024-kvm x86_64 Ubuntu 22.04.1 LTS # Hostname: roundcube-internal-server-1 auth_mechanisms = plain login disable_plaintext_auth = no listen = * lock_method = dotlock mail_always_cache_fields = date.received mail_cache_min_mail_count = 5000 mail_location = mbox:~/mail:INBOX=/var/mail/%u:INDEX=/var/indexes/isical.ac.in/%n mail_privileged_group = mail mail_sort_max_read_count = 100 mailbox_list_index_include_inbox = yes mailbox_list_index_very_dirty_syncs = yes maildir_very_dirty_syncs = yes mbox_dotlock_change_timeout = 1 mins mbox_lazy_writes = no mbox_write_locks = dotlock fcntl namespace inbox { inbox = yes location = prefix = } passdb { driver = pam } protocols = imap pop3 ssl_cert = </etc/dovecot/private/dovecot.pem ssl_client_ca_dir = /etc/ssl/certs ssl_dh = # hidden, use -P to show it ssl_key = # hidden, use -P to show it userdb { driver = passwd } protocol !indexer-worker { mail_vsize_bg_after_count = 100 } On a different note we are getting error occasionally of the following type. I dont know if they are related. Jan 16 15:36:13 roundcube-internal-server-1 dovecot: imap(xyz)<361270><aqauu17ycsvAqL8/>: Error: unlink(/var/mail/xyz.lock) failed: Permission denied (in file-dotlock.c:195) Jan 16 15:36:13 roundcube-internal-server-1 dovecot: imap(xyz)<361270><aqauu17ycsvAqL8/>: Error: unlink(xyz.lock) failed: Permission denied (in file-dotlock.c:195) Jan 16 15:36:13 roundcube-internal-server-1 dovecot: imap(xyz)<361270><aqauu17ycsvAqL8/>: Error: Mailbox INBOX: file_dotlock_create(xyz) in directory /var/mail failed: Permission denied (euid=10865(xyz) egid=8(mail) missing +w perm: /var/mail, UNIX perms appear ok (ACL/MAC wrong?), dir owned by 0:8 mode=0771)

2 1

Up to date dovecot packages on Ubuntu 22.4LTS
by Gerben Wierda 12 Jan '23

12 Jan '23

I just found out that Ubuntu Linux 22.04 LTS has a dovecot apt package that is 2.3.16. Debian 11 (stable) is at dovecot 2.3.13 with apt. if I looked correctly. Dovecot itself is at 2.3.20. That surprised me (I am new to the Linux distro and package management world) as Ubuntu 22.04 is a Long-Time Support version, and I was expecting packages to be updated as well (as many users will want updated packages. How does that work in the dovecot world? How come macOS MacPorts (2.3.19) has more recent packages than any of the large Debian-based Linuxes? Gerben Wierda (LinkedIn <https://www.linkedin.com/in/gerbenwierda>) R&A IT Strategy <https://ea.rna.nl/> (main site) Book: Chess and the Art of Enterprise Architecture <https://ea.rna.nl/the-book/> Book: Mastering ArchiMate <https://ea.rna.nl/the-book-edition-iii/>

3 2

director: pass different username to proxy than the one that is used for hashing
by alex 12 Jan '23

12 Jan '23

dovecot 2.3.13 Hi, I'm looking for a way to make director use a user@domain that is returned by the database for hashing but actually send the original user@domain in the proxied request. I cannot seem to find a way. I can change the name used for hashing by just returning a different user from the db. but that user is also the one that is send in the proxied request. this is what I have so far: director_username_hash = %L{user} # relevant sql: password_query = SELECT \ username as user, \ # -> this is used for hashing if destuser is not present. = OK NULL as password, \ 'y' as proxy, \ 'y' as nopassword, \ '%n@%d' as destuser \ # -> but as soon as I add this, this is used for hashing = !OK FROM dovecot_data('%n', '%d') Anyone know any clever tricks to accomplish this? Thanks! Alex (background: I've inherited a mail setup where mailboxes have multiple logins. (those all share the same 'home' for their maildirs). I need all of these to go to the same server. Most ideal would be hashing on home '%h' instead of %u :)).

1 0

Living without fdpass / SCM_RIGHTS
by Dengler, Gabriel 10 Jan '23

10 Jan '23

Hello everyone, I wanted to run Dovecot inside Gramine [1]. Gramine is a tool to let normal Linux binaries run with the help of the Intel Software Guard Extensions (SGX) technology [2] in a secure enclave to which the operating system doesn't have an access to. Most parts of Dovecot now run fine, however, Dovecot uses the SCM_RIGHTS flag for the sendmsg system call to exchange file descriptors over Unix sockets [3]. Normally, this feature is available in every Unix, but in Gramine, this is currently not supported [4]. So, according to the logs, the authentication works, but after that, the imap-login process cannot exchange the file descriptor with the imap process. Therefore I wanted to ask if there is a possibility to make Dovecot work without this feature or if this would need fundamental changes in the code structure. Thanks for your help in advance! Best regards, Gabriel References: [1] https://gramineproject.io/ [2] https://de.wikipedia.org/wiki/Software_Guard_Extensions [3] https://github.com/dovecot/core/blob/main/src/lib/fdpass.c#L128 [4] https://github.com/gramineproject/gramine/discussions/1013#discussioncommen…

1 0

Dovecot - mail_crypt - lmtp-server - no password to decrypt the key
by Baljeet Bhinder 09 Jan '23

09 Jan '23

I have been using postfix+dovecot successfully for a while now until I tried mail crypt plugin lately. I tried what is describe here https://doc.dovecot.org/configuration_manual/mail_crypt_plugin/ and I went for global-keys as described here: https://doc.dovecot.org/configuration_manual/mail_crypt_plugin/#global-keys /"A good solution for environments where no user folder sharing is needed is to generate per-user EC key pair and encrypt that with something derived from user’s password."/ I am setting mail_crypt_global_private_key, mail_crypt_global_public_key, mail_crypt_save_version from user_query and userdb_mail_crypt_global_private_key_password from password_query. mail_crypt seems to work fine in imap (I saved a message as draft and it is stored encrypted on the disk), but lmtp complains about "mail_crypt_global_private_key_password unset, no password to decrypt the key" As you can see below in logs that it was able to set all other mail_crypt_ configurations successfully from user_query. However, the password is provided via password_query and I assume lmtp does not read password_query. How else can I provide a password in lmtp? Is my approach correct to begin with? -- Dovecot Configurations -- # using doveconf -n # 2.3.19.1 (9b53102964): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.19 (4eae2f79) # OS: Linux 5.15.0-57-generic x86_64 Ubuntu 20.04.5 LTS # Hostname: mailserver-dovecot-7c9ff7b94b-8ldrr auth_mechanisms = plain login auth_verbose = yes auth_verbose_passwords = yes debug_log_path = /dev/stdout haproxy_trusted_networks = 192.168.0.0/16 10.10.10.0/24 10.10.30.0/24 172.17.0.1/16 hostname = imap.mailserver.k8s.local pop.mailserver.k8s.local info_log_path = /dev/stdout listen = * log_path = /dev/stdout mail_debug = yes mail_gid = 1000 mail_home = /var/vmail/mailboxes/%d/%n mail_location = maildir:~/:LAYOUT=fs mail_plugins = quota mail_crypt mail_privileged_group = mail mail_uid = 1000 managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext imapsieve vnd.dovecot.imapsieve namespace inbox { inbox = yes location = mailbox Drafts { auto = subscribe special_use = \Drafts } mailbox Sent { auto = subscribe special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Spam { auto = subscribe autoexpunge = 30 days special_use = \Junk } mailbox Trash { auto = subscribe autoexpunge = 30 days special_use = \Trash } prefix = } passdb { args = /etc/dovecot/dovecot-sql.conf.ext driver = sql } plugin { imapsieve_mailbox1_before = file:/var/vmail/sieve/global/learn-spam.sieve imapsieve_mailbox1_causes = COPY APPEND FLAG imapsieve_mailbox1_name = Spam imapsieve_mailbox2_before = file:/var/vmail/sieve/global/learn-ham.sieve imapsieve_mailbox2_causes = COPY APPEND FLAG imapsieve_mailbox2_from = Spam imapsieve_mailbox2_name = * mail_crypt_save_version = 0 quota = maildir:User quota quota_exceeded_message = User %u has exhausted allowed storage space. quota_rule = Junk:ignore quota_rule2 = Trash:storage=+100M quota_warning = storage=90%% quota-warning 90 %u %d quota_warning2 = storage=80%% quota-warning 80 %u %d sieve = file:~/sieve;active=~/.dovecot.sieve sieve_before = /var/vmail/sieve/global/spam-global.sieve sieve_global = /var/vmail/sieve/global/ sieve_global_extensions = +vnd.dovecot.pipe +vnd.dovecot.debug sieve_pipe_bin_dir = /var/vmail/sieve/global sieve_plugins = sieve_imapsieve sieve_extprograms } protocols = " imap lmtp sieve pop3" service auth { inet_listener { port = 25252 } } service imap-login { inet_listener imap { haproxy = yes } inet_listener imaps { haproxy = yes ssl = yes } } service lmtp { executable = lmtp -L inet_listener lmtp { address = 0.0.0.0 port = 24 } } service managesieve-login { inet_listener sieve { port = 4190 } } service pop3-login { inet_listener pop3 { haproxy = yes } inet_listener pop3s { haproxy = yes } } ssl = required ssl_cert = </etc/dovecot/certs/tls.crt ssl_client_ca_dir = /etc/ssl/certs ssl_key = # hidden, use -P to show it ssl_prefer_server_ciphers = yes userdb { args = /etc/dovecot/dovecot-sql.conf.ext driver = sql } protocol lmtp { info_log_path = /dev/stdout log_path = /dev/stdout mail_plugins = quota mail_crypt sieve postmaster_address = <hidden> } protocol imap { mail_plugins = quota mail_crypt quota imap_quota imap_sieve } -- Dovecot Configurations Ends -- -- Password Query -- password_query = \ SELECT username, domain, password, \ '%{sha256:password}' AS userdb_mail_crypt_global_private_key_password \ FROM mailbox \ WHERE username='%u'; -- Password Query Ends-- -- User Query -- user_query = SELECT CONCAT('*:bytes=', 1024) as quota_rule, \ private_key AS mail_crypt_global_private_key, \ public_key AS mail_crypt_global_public_key, \ mail_crypt_save_version AS mail_crypt_save_version \ FROM mailbox \ WHERE username='%u'; -- User Query Ends -- -- Debug Logs -- --- Load Inbox --- imap-login: Info: Login: user=<someone(a)example.com>, method=PLAIN, rip=192.168.49.1, lip=192.168.49.2, mpid=241, TLS, session=<oaoI9sLxVKXAqDEB> imap(someone(a)example.com)<241><oaoI9sLxVKXAqDEB>: Debug: Loading modules from directory: /usr/lib/dovecot/modules imap(someone(a)example.com)<241><oaoI9sLxVKXAqDEB>: Debug: Module loaded: /usr/lib/dovecot/modules/lib10_mail_crypt_plugin.so imap(someone(a)example.com)<241><oaoI9sLxVKXAqDEB>: Debug: Module loaded: /usr/lib/dovecot/modules/lib10_quota_plugin.so imap(someone(a)example.com)<241><oaoI9sLxVKXAqDEB>: Debug: Module loaded: /usr/lib/dovecot/modules/lib11_imap_quota_plugin.so imap(someone(a)example.com)<241><oaoI9sLxVKXAqDEB>: Debug: Module loaded: /usr/lib/dovecot/modules/lib95_imap_sieve_plugin.so imap(someone(a)example.com)<241><oaoI9sLxVKXAqDEB>: Debug: Added userdb setting: plugin/mail_crypt_global_private_key=LS0tLS1CRUd.....LS0tLS0K imap(someone(a)example.com)<241><oaoI9sLxVKXAqDEB>: Debug: Added userdb setting: plugin/mail_crypt_global_private_key_password=<hidden> imap(someone(a)example.com)<241><oaoI9sLxVKXAqDEB>: Debug: Added userdb setting: plugin/mail_crypt_global_public_key=LS0tLS1CRUd.....LS0tCg== imap(someone(a)example.com)<241><oaoI9sLxVKXAqDEB>: Debug: Added userdb setting: plugin/mail_crypt_save_version=2 imap(someone(a)example.com)<241><oaoI9sLxVKXAqDEB>: Debug: Added userdb setting: plugin/quota_rule=*:bytes=1024000000 imap(someone(a)example.com)<241><oaoI9sLxVKXAqDEB>: Debug: Effective uid=1000, gid=1000, home=/var/vmail/mailboxes/example.com/someone imap(someone(a)example.com)<241><oaoI9sLxVKXAqDEB>: Debug: mail_crypt_plugin: mail_crypt_curve setting missing - generating EC keys disabled imap(someone(a)example.com)<241><oaoI9sLxVKXAqDEB>: Debug: Quota root: name=User quota backend=maildir args= imap(someone(a)example.com)<241><oaoI9sLxVKXAqDEB>: Debug: Quota rule: root=User quota mailbox=* bytes=1024000000 messages=0 imap(someone(a)example.com)<241><oaoI9sLxVKXAqDEB>: Debug: Quota rule: root=User quota mailbox=Trash bytes=+104857600 messages=0 imap(someone(a)example.com)<241><oaoI9sLxVKXAqDEB>: Debug: Quota warning: bytes=921600000 (90%) messages=0 reverse=no command=quota-warning 90 someone(a)example.com example.com imap(someone(a)example.com)<241><oaoI9sLxVKXAqDEB>: Debug: Quota warning: bytes=819200000 (80%) messages=0 reverse=no command=quota-warning 80 someone(a)example.com example.com imap(someone(a)example.com)<241><oaoI9sLxVKXAqDEB>: Debug: Quota grace: root=User quota bytes=102400000 (10%) imap(someone(a)example.com)<241><oaoI9sLxVKXAqDEB>: Debug: open(/proc/self/io) failed: Permission denied imap(someone(a)example.com)<241><oaoI9sLxVKXAqDEB>: Debug: Namespace inbox: type=private, prefix=, sep=, inbox=yes, hidden=no, list=yes, subscriptions=yes location=maildir:~/:LAYOUT=fs imap(someone(a)example.com)<241><oaoI9sLxVKXAqDEB>: Debug: fs: root=/var/vmail/mailboxes/example.com/someone, index=, indexpvt=, control=, inbox=/var/vmail/mailboxes/example.com/someone, alt= imap(someone(a)example.com)<241><oaoI9sLxVKXAqDEB>: Debug: quota: quota_over_flag check: quota_over_script unset - skipping imap(someone(a)example.com)<241><oaoI9sLxVKXAqDEB>: Debug: Mailbox INBOX: Mailbox opened --- Load Inbox Ends --- --- Lmtp --- lmtp(248): Info: Connect from 172.17.0.1 lmtp(someone(a)example.com)<248><e2dcD6TuumP4AAAALzF/Qw>: Debug: auth-master: userdb lookup(someone(a)example.com): Started userdb lookup lmtp(someone(a)example.com)<248><e2dcD6TuumP4AAAALzF/Qw>: Debug: auth-master: conn unix:/var/run/dovecot/auth-userdb: Connecting lmtp(someone(a)example.com)<248><e2dcD6TuumP4AAAALzF/Qw>: Debug: auth-master: conn unix:/var/run/dovecot/auth-userdb (pid=143,uid=0): Client connected (fd=18) imap(someone(a)example.com)<247><WlggG8PxEOvAqDEB>: Debug: Mailbox Sent: Purging (new file_seq=1673195172): creating cache imap(someone(a)example.com)<247><WlggG8PxEOvAqDEB>: Debug: Mailbox Sent: Purging finished, file_seq changed 0 -> 1673195172, size=0 -> 388, max_uid=0 lmtp(someone(a)example.com)<248><e2dcD6TuumP4AAAALzF/Qw>: Debug: auth-master: userdb lookup(someone(a)example.com): auth USER input: someone(a)example.com quota_rule=*:bytes=1024000000 mail_crypt_global_private_key=LS0tLS1CRUd.....LS0tLS0K mail_crypt_global_public_key=LS0tLS1CRUd.....LS0tCg== mail_crypt_save_version=2 lmtp(someone(a)example.com)<248><e2dcD6TuumP4AAAALzF/Qw>: Debug: auth-master: userdb lookup(someone(a)example.com): Finished userdb lookup (username=someone(a)example.com quota_rule=*:bytes=1024000000 mail_crypt_global_private_key=LS0tLS1CRUd.....LS0tLS0K mail_crypt_global_public_key=LS0tLS1CRUd.....LS0tCg== mail_crypt_save_version=2) lmtp(someone(a)example.com)<248><e2dcD6TuumP4AAAALzF/Qw>: Debug: lmtp-server: conn 172.17.0.1:6376 [1]: rcpt someone(a)example.com: Added userdb setting: plugin/mail_crypt_global_private_key=LS0tLS1CRUd.....LS0tLS0K imap(someone(a)example.com)<247><WlggG8PxEOvAqDEB>: Debug: duplicate db: Initialize lmtp(someone(a)example.com)<248><e2dcD6TuumP4AAAALzF/Qw>: Debug: lmtp-server: conn 172.17.0.1:6376 [1]: rcpt someone(a)example.com: Added userdb setting: plugin/mail_crypt_global_public_key=LS0tLS1CRUd.....LS0tCg== imap(someone(a)example.com)<247><WlggG8PxEOvAqDEB>: Debug: sieve: Pigeonhole version 0.5.19 (4eae2f79) initializing lmtp(someone(a)example.com)<248><e2dcD6TuumP4AAAALzF/Qw>: Debug: lmtp-server: conn 172.17.0.1:6376 [1]: rcpt someone(a)example.com: Added userdb setting: plugin/mail_crypt_save_version=2 lmtp(someone(a)example.com)<248><e2dcD6TuumP4AAAALzF/Qw>: Debug: lmtp-server: conn 172.17.0.1:6376 [1]: rcpt someone(a)example.com: Added userdb setting: plugin/quota_rule=*:bytes=1024000000 lmtp(someone(a)example.com)<248><e2dcD6TuumP4AAAALzF/Qw>: Debug: lmtp-server: conn 172.17.0.1:6376 [1]: rcpt someone(a)example.com: Effective uid=1000, gid=1000, home=/var/vmail/mailboxes/example.com/someone lmtp(someone(a)example.com)<248><e2dcD6TuumP4AAAALzF/Qw>: Debug: lmtp-server: conn 172.17.0.1:6376 [1]: rcpt someone(a)example.com: mail_crypt_plugin: mail_crypt_curve setting missing - generating EC keys disabled lmtp(someone(a)example.com)<248><e2dcD6TuumP4AAAALzF/Qw>: Debug: lmtp-server: conn 172.17.0.1:6376 [1]: rcpt someone(a)example.com: Quota root: name=User quota backend=maildir args= lmtp(someone(a)example.com)<248><e2dcD6TuumP4AAAALzF/Qw>: Debug: lmtp-server: conn 172.17.0.1:6376 [1]: rcpt someone(a)example.com: Quota rule: root=User quota mailbox=* bytes=1024000000 messages=0 lmtp(someone(a)example.com)<248><e2dcD6TuumP4AAAALzF/Qw>: Debug: lmtp-server: conn 172.17.0.1:6376 [1]: rcpt someone(a)example.com: Quota rule: root=User quota mailbox=Trash bytes=+104857600 messages=0 lmtp(someone(a)example.com)<248><e2dcD6TuumP4AAAALzF/Qw>: Debug: lmtp-server: conn 172.17.0.1:6376 [1]: rcpt someone(a)example.com: Quota warning: bytes=921600000 (90%) messages=0 reverse=no command=quota-warning 90 someone(a)example.com example.com lmtp(someone(a)example.com)<248><e2dcD6TuumP4AAAALzF/Qw>: Debug: lmtp-server: conn 172.17.0.1:6376 [1]: rcpt someone(a)example.com: Quota warning: bytes=819200000 (80%) messages=0 reverse=no command=quota-warning 80 someone(a)example.com example.com lmtp(someone(a)example.com)<248><e2dcD6TuumP4AAAALzF/Qw>: Debug: lmtp-server: conn 172.17.0.1:6376 [1]: rcpt someone(a)example.com: Quota grace: root=User quota bytes=102400000 (10%) lmtp(248): Error: lmtp-server: conn 172.17.0.1:6376 [1]: rcpt someone(a)example.com: Failed to initialize user: mail_crypt_plugin: mail_crypt_global_private_key: mail_crypt_global_private_key_password unset, no password to decrypt the key lmtp(248): Info: Disconnect from 172.17.0.1: Logged out (state=READY) --- Lmtp Ends --- -- Debug Logs Ends -- Thanks Baljeet Bhinder

3 3

Keycloak Authorization Code Flow
by Gary Horchem 08 Jan '23

08 Jan '23

Can dovecot use Keycloak Authorization Code Flow? I would like to use it instead of Password Resource Grant Flow for better security. Sent from my iPhone

1 0

How to set otp one time password
by weihao.chen＠artisantechnologies.cn 07 Jan '23

07 Jan '23

Dear Everybody: May I ask how to configure dovecot otp one-time verification login, that is, after the user logs in to the mailbox with the password + otp, he can send and receive emails without entering the password + otp again? # This is my settings: # /etc/dovecot/conf.d/10-auth.conf disable_plaintext_auth = yes auth_cache_size = 10M auth_failure_delay = 5 secs auth_ssl_username_from_cert = yes auth_mechanisms = otp !include auth-ldap.conf.ext error logs: ------------------------------- 6952-Jan 06 18:03:01 master: Info: Dovecot v2.3.19.1 (9b53102964) starting up for imap, lmtp (core dumps disabled) 6953-Jan 06 18:03:02 auth: Debug: Loading modules from directory: /usr/lib/dovecot/auth 6954-Jan 06 18:03:02 auth: Debug: Module loaded: /usr/lib/dovecot/auth/lib20_auth_var_expand_crypt.so 6955:Jan 06 18:03:02 auth: Fatal: OTP mechanism can't be supported with given passdbs 6956-Jan 06 18:03:02 master: Error: service(auth): command startup failed, throttling for 2.000 secs 6957-Jan 06 18:03:02 imap-login: Info: Disconnected: Auth process broken (disconnected before auth was ready, waited 0 secs): user=<>, rip=172.30.20.51, lip=172.16.5.111, TLS handshaking, session=<OiDkhZXx7fasHhQz> 6958-Jan 06 18:03:07 auth: Debug: Loading modules from directory: /usr/lib/dovecot/auth 6959-Jan 06 18:03:07 auth: Debug: Module loaded: /usr/lib/dovecot/auth/lib20_auth_var_expand_crypt.so 6960:Jan 06 18:03:07 auth: Fatal: OTP mechanism can't be supported with given passdbs 6961-Jan 06 18:03:07 master: Error: service(auth): command startup failed, throttling for 4.000 secs 6962-Jan 06 18:03:07 imap-login: Info: Disconnected: Auth process broken (disconnected before auth was ready, waited 0 secs): user=<>, rip=172.30.20.51, lip=172.16.5.111, TLS handshaking, session=<qgIyhpXx8PasHhQz> 6963-Jan 06 18:03:11 auth: Debug: Loading modules from directory: /usr/lib/dovecot/auth 6964-Jan 06 18:03:11 auth: Debug: Module loaded: /usr/lib/dovecot/auth/lib20_auth_var_expand_crypt.so 6965:Jan 06 18:03:11 auth: Fatal: OTP mechanism can't be supported with given passdbs 6966-Jan 06 18:03:11 master: Error: service(auth): command startup failed, throttling for 8.000 secs 6967-Jan 06 18:03:11 imap-login: Info: Disconnected: Auth process broken (disconnected before auth was ready, waited 3 secs): user=<>, rip=172.30.20.51, lip=172.16.5.111, TLS, session=<gDdvhpXx8/asHhQz> 6968-Jan 06 18:03:19 auth: Debug: Loading modules from directory: /usr/lib/dovecot/auth 6969-Jan 06 18:03:19 auth: Debug: Module loaded: /usr/lib/dovecot/auth/lib20_auth_var_expand_crypt.so 6970:Jan 06 18:03:19 auth: Fatal: OTP mechanism can't be supported with given passdbs 6971-Jan 06 18:03:19 master: Error: service(auth): command startup failed, throttling for 16.000 secs 6972-Jan 06 18:03:19 imap-login: Info: Disconnected: Auth process broken (disconnected before auth was ready, waited 8 secs): user=<>, rip=172.30.20.51, lip=172.16.5.111, TLS, session=<qp7phpXx9PasHhQz> 6973-Jan 06 18:03:29 imap-login: Info: Disconnected: Connection closed (disconnected before auth was ready, waited 5 secs): user=<>, rip=172.30.20.51, lip=172.16.5.111, TLS, session=<N1qAh5Xx/PasHhQz> 6974-Jan 06 18:03:35 auth: Debug: Loading modules from directory: /usr/lib/dovecot/auth 6975-Jan 06 18:03:35 auth: Debug: Module loaded: /usr/lib/dovecot/auth/lib20_auth_var_expand_crypt.so 6976:Jan 06 18:03:35 auth: Fatal: OTP mechanism can't be supported with given passdbs 6977-Jan 06 18:03:35 master: Error: service(auth): command startup failed, throttling for 32.000 secs 6978-Jan 06 18:04:01 master: Warning: Killed with signal 15 (by pid=2692494 uid=0 code=kill) 6979-Jan 06 18:04:02 master: Info: Dovecot v2.3.19.1 (9b53102964) starting up for imap, lmtp (core dumps disabled) 6980-Jan 06 18:04:09 auth: Debug: Loading modules from directory: /usr/lib/dovecot/auth 6981-Jan 06 18:04:09 auth: Debug: Module loaded: /usr/lib/dovecot/auth/lib20_auth_var_expand_crypt.so 6982:Jan 06 18:04:09 auth: Fatal: OTP mechanism can't be supported with given passdbs 6983-Jan 06 18:04:09 master: Error: service(auth): command startup failed, throttling for 2.000 secs 6984-Jan 06 18:04:09 imap-login: Info: Disconnected: Auth process broken (disconnected before auth was ready, waited 0 secs): user=<>, rip=172.30.20.51, lip=172.16.5.111, TLS handshaking, session=<8VrsiZXxFfesHhQz> 6985-Jan 06 18:04:56 auth: Debug: Loading modules from directory: /usr/lib/dovecot/auth 6986-Jan 06 18:04:56 auth: Debug: Module loaded: /usr/lib/dovecot/auth/lib20_auth_var_expand_crypt.so 6987:Jan 06 18:04:56 auth: Fatal: OTP mechanism can't be supported with given passdbs 6988-Jan 06 18:04:56 master: Error: service(auth): command startup failed, throttling for 4.000 secs 6989-Jan 06 18:05:57 auth: Debug: Loading modules from directory: /usr/lib/dovecot/auth 6990-Jan 06 18:05:57 auth: Debug: Module loaded: /usr/lib/dovecot/auth/lib20_auth_var_expand_crypt.so 6991:Jan 06 18:05:57 auth: Fatal: OTP mechanism can't be supported with given passdbs 6992-Jan 06 18:05:57 master: Error: service(auth): command startup failed, throttling for 8.000 secs 6993-Jan 06 18:06:26 master: Warning: Killed with signal 15 (by pid=2692680 uid=0 code=kill) 6994-Jan 06 18:06:27 log(2692602): Warning: Killed with signal 15 (by pid=1 uid=0 code=kill) 6995-Jan 06 18:06:27 master: Info: Dovecot v2.3.19.1 (9b53102964) starting up for imap, lmtp (core dumps disabled) 6996-Jan 06 18:06:47 auth: Debug: Loading modules from directory: /usr/lib/dovecot/auth 6997-Jan 06 18:06:47 auth: Debug: Module loaded: /usr/lib/dovecot/auth/lib20_auth_var_expand_crypt.so 6998-Jan 06 18:06:47 auth: Debug: Read auth token secret from /var/run/dovecot//auth-token-secret.dat 6999-Jan 06 18:06:47 auth: Error: ldap_bind 7000-Jan 06 18:06:47 auth: Error: ldap_simple_bind 7001-Jan 06 18:06:47 auth: Error: ldap_sasl_bind ------------------------------- if option: auth_mechanisms = plain login Can send and receive emails successfully, but when the otp time expires, you need to re-enter the password + otp, which is unacceptable to the user Looking forward to your reply, Tanks -- nick(Weihao) weihao.chen(a)artisantechnologies.cn

2 1

postfix connects to dovecot lmtp socket, but nothing is delivered
by Gerben Wierda 05 Jan '23

05 Jan '23

I am setting up a new server combination (postfix + dovecot). dovecot's auth service works for postfix. Just lmtp does not and I need to find out why. I don't see anything in the dovecot logging, but I see this on the postfix side (debug) Jan 05 16:11:59 snape postfix/lmtp[127]: connection established Jan 05 16:11:59 snape postfix/lmtp[127]: master_notify: status 0 Jan 05 16:11:59 snape postfix/lmtp[127]: deliver_request_initial: send initial response Jan 05 16:11:59 snape postfix/lmtp[127]: send attr protocol = delivery_request_protocol Jan 05 16:16:59 snape postfix/lmtp[126]: smtp_get: timeout Jan 05 16:16:59 snape postfix/lmtp[126]: connect to subsystem private/defer Jan 05 16:16:59 snape postfix/lmtp[126]: private/defer socket: wanted attribute: protocol Jan 05 16:16:59 snape postfix/lmtp[126]: input attribute name: protocol Jan 05 16:16:59 snape postfix/lmtp[126]: input attribute value: delivery_status_protocol Jan 05 16:16:59 snape postfix/lmtp[126]: private/defer socket: wanted attribute: (list terminator) Jan 05 16:16:59 snape postfix/lmtp[126]: input attribute name: (end) Jan 05 16:16:59 snape postfix/lmtp[126]: send attr nrequest = 0 Jan 05 16:16:59 snape postfix/lmtp[126]: send attr flags = 0 Jan 05 16:16:59 snape postfix/lmtp[126]: send attr queue_id = C71B3D1262 Jan 05 16:16:59 snape postfix/lmtp[126]: send attr original_recipient = sysbh(a)rna.nl Jan 05 16:16:59 snape postfix/lmtp[126]: send attr recipient = sysbh(a)rna.nl Jan 05 16:16:59 snape postfix/lmtp[126]: send attr offset = 18446744073709551615 Jan 05 16:16:59 snape postfix/lmtp[126]: send attr dsn_orig_rcpt = rfc822;sysbh(a)rna.nl Jan 05 16:16:59 snape postfix/lmtp[126]: send attr notify_flags = 0 Jan 05 16:16:59 snape postfix/lmtp[126]: send attr status = 4.4.2 Jan 05 16:16:59 snape postfix/lmtp[126]: send attr diag_type = Jan 05 16:16:59 snape postfix/lmtp[126]: send attr diag_text = Jan 05 16:16:59 snape postfix/lmtp[126]: send attr mta_type = Jan 05 16:16:59 snape postfix/lmtp[126]: send attr mta_mname = Jan 05 16:16:59 snape postfix/lmtp[126]: send attr action = delayed Jan 05 16:16:59 snape postfix/lmtp[126]: send attr reason = conversation with snape.rna.nl[private/lmtp] timed out while receiving the initial server greeting Jan 05 16:16:59 snape postfix/lmtp[126]: private/defer socket: wanted attribute: status Jan 05 16:16:59 snape postfix/lmtp[126]: input attribute name: status Jan 05 16:16:59 snape postfix/lmtp[126]: input attribute value: 0 Jan 05 16:16:59 snape postfix/lmtp[126]: private/defer socket: wanted attribute: (list terminator) Jan 05 16:16:59 snape postfix/lmtp[126]: input attribute name: (end) Jan 05 16:16:59 snape postfix/lmtp[126]: C71B3D1262: to=<sysbh(a)rna.nl>, relay=snape.rna.nl[private/lmtp], delay=300, delays=0.02/0/300/0, dsn=4.4.2, status=deferred (conversation with snape.rna.nl[private/lmtp] timed out while receiving the initial server greeting) Jan 05 16:16:59 snape postfix/lmtp[126]: flush_add: site rna.nl id C71B3D1262 Jan 05 16:16:59 snape postfix/lmtp[126]: match_list_match: rna.nl: no match Jan 05 16:16:59 snape postfix/lmtp[126]: flush_add: site rna.nl id C71B3D1262 status 4 Jan 05 16:16:59 snape postfix/lmtp[126]: deliver_request_final: send: "conversation with snape.rna.nl[private/lmtp] timed out while receiving the initial server greeting" -1 Jan 05 16:16:59 snape postfix/lmtp[126]: send attr status = 4.4.2 Jan 05 16:16:59 snape postfix/lmtp[126]: send attr diag_type = Jan 05 16:16:59 snape postfix/lmtp[126]: send attr diag_text = Jan 05 16:16:59 snape postfix/lmtp[126]: send attr mta_type = Jan 05 16:16:59 snape postfix/lmtp[127]: master_notify: status 1 Jan 05 16:16:59 snape postfix/lmtp[126]: send attr mta_mname = Jan 05 16:16:59 snape postfix/lmtp[127]: connection closed Jan 05 16:16:59 snape postfix/lmtp[126]: send attr action = Jan 05 16:16:59 snape postfix/lmtp[126]: send attr reason = conversation with snape.rna.nl[private/lmtp] timed out while receiving the initial server greeting Jan 05 16:16:59 snape postfix/lmtp[126]: send attr status = 4294967295 Jan 05 16:16:59 snape postfix/lmtp[126]: master_notify: status 1 Jan 05 16:16:59 snape postfix/lmtp[126]: connection closed It seems dovecot doesn't react to whatever postfix is doing on the socket. Another possibility is that the socket doesn't really work and dovecot never gets a connection request. How can I debug this? Might I test if the socket is the problem by running lmtp on the dovecot side on TCP on 127.0.0.1 and have postfix use that? Just to see if it works? If so, how do I tell postfix to do that? In dovecot I have added the tcp: service lmtp { inet_listener lmtp { address = 127.0.0.1 port = 24 } unix_listener /var/spool/postfix/private/lmtp { mode = 0660 user = postfix group = postfix } } service lmtp { executable = lmtp -L } protocol lmtp { info_log_path = /var/log/mail/dovecot-lmtp.log } Any other tips? Gerben Wierda (LinkedIn <https://www.linkedin.com/in/gerbenwierda>) R&A IT Strategy <https://ea.rna.nl/> (main site) Book: Chess and the Art of Enterprise Architecture <https://ea.rna.nl/the-book/> Book: Mastering ArchiMate <https://ea.rna.nl/the-book-edition-iii/>

4 8

Migrating, syncing, maybe load-balancing/failover two dovecot servers?
by Gerben Wierda 05 Jan '23

05 Jan '23

I am in the process of migrating from dovecot on one OS (macOS/darwin) to a new server running dovecot with another OS (Ubuntu Linux 22.4). I have mostly copied/adapted the setup of the old server to the new. I am in the process of finishing that and adding some stuff that still needs to be added/migrated, like rspamd. And the data of course before the new one takes over from the old. I have done a migration before (MacOS X Server dovecot to MacPorts dovecot on macOS), many years ago, I recall that I used dovecot syncing but also rsync and I don't really recall (and anyway, the software has changed since) I have been thinking about keeping them both alive, with one as a failover for the other. They will not share their storage (e.g. NFS), So, I was wondering if I can do something with syncing between instances and dovecot director. I have been looking at the documentation, but a quick scan reveals I cannot locate some sort of tutorial and I am uncertain what will work and what not. If keeping both alive in parallel is too problematic, it is OK to have regular syncing in one direction (old to new) at first and then switch over and have syncing in the other direction (new to old) Can someone enlighten me? Gerben Wierda (LinkedIn <https://www.linkedin.com/in/gerbenwierda>) R&A IT Strategy <https://ea.rna.nl/> (main site) Book: Chess and the Art of Enterprise Architecture <https://ea.rna.nl/the-book/> Book: Mastering ArchiMate <https://ea.rna.nl/the-book-edition-iii/>

4 5

imap and lmtp create different index/control folders
by George Asenov 05 Jan '23

05 Jan '23

Hello, We have migrated our mail server from procmail lda to dovecot lmtp/sieve . dovecot imap create the dir with the email account test(a)s32.teststring.ml for name but lmtp create it as test-s32.someteststring.ml(a)serverhostname.tld I can't figure out how to manipulate nor what username postfix send to dovecot/lmtp or how dovecot/lmtp interpret it. As you will see in the config below there is a separate userdb set for lmtp because it receive the username/envelope from postfix as test-s32.someteststring.ml(a)serverhostname.tld which prevent it to use the pam authentication to verify and use the mail user to deliver email. So I use driver = passwd-file which have the option to configure the format of the username. But this is kind of dirty hack which i do not like. Anyone now how to configure dovecot/lmtp by default to remove the @myserverhostname.tld from the username or configure postfix not to add it? Here is the postfix config: ############################# postconf 2bounce_notice_recipient = postmaster access_map_defer_code = 450 access_map_reject_code = 554 address_verify_cache_cleanup_interval = 12h address_verify_default_transport = $default_transport address_verify_local_transport = $local_transport address_verify_map = btree:$data_directory/verify_cache address_verify_negative_cache = yes address_verify_negative_expire_time = 3d address_verify_negative_refresh_time = 3h address_verify_pending_request_limit = 5000 address_verify_poll_count = ${stress?{1}:{3}} address_verify_poll_delay = 3s address_verify_positive_expire_time = 31d address_verify_positive_refresh_time = 7d address_verify_relay_transport = $relay_transport address_verify_relayhost = $relayhost address_verify_sender = $double_bounce_sender address_verify_sender_dependent_default_transport_maps = $sender_dependent_default_transport_maps address_verify_sender_dependent_relayhost_maps = $sender_dependent_relayhost_maps address_verify_sender_ttl = 0s address_verify_service_name = verify address_verify_transport_maps = $transport_maps address_verify_virtual_transport = $virtual_transport alias_database = hash:/etc/aliases alias_maps = hash:/etc/aliases allow_mail_to_commands = alias, forward allow_mail_to_files = alias, forward allow_min_user = no allow_percent_hack = no allow_untrusted_routing = no alternate_config_directories = always_add_missing_headers = no always_bcc = anvil_rate_time_unit = 60s anvil_status_update_time = 600s append_at_myorigin = yes append_dot_mydomain = ${{$compatibility_level} < {1} ? {yes} : {no}} application_event_drain_time = 100s authorized_flush_users = static:anyone authorized_mailq_users = static:anyone authorized_submit_users = static:anyone backwards_bounce_logfile_compatibility = yes berkeley_db_create_buffer_size = 16777216 berkeley_db_read_buffer_size = 131072 best_mx_transport = biff = yes body_checks = body_checks_size_limit = 51200 bounce_notice_recipient = postmaster bounce_queue_lifetime = 5d bounce_service_name = bounce bounce_size_limit = 50000 bounce_template_file = broken_sasl_auth_clients = yes canonical_classes = envelope_sender, envelope_recipient, header_sender, header_recipient canonical_maps = cleanup_service_name = cleanup command_directory = /usr/sbin command_execution_directory = command_expansion_filter = 1234567890!@%-_=+:,./abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ command_time_limit = 1000s compatibility_level = 2 config_directory = /etc/postfix confirm_delay_cleared = no connection_cache_protocol_timeout = 5s connection_cache_service_name = scache connection_cache_status_update_time = 600s connection_cache_ttl_limit = 2s content_filter = cyrus_sasl_config_path = daemon_directory = /usr/libexec/postfix daemon_table_open_error_is_fatal = no daemon_timeout = 18000s data_directory = /var/lib/postfix debug_peer_level = 2 debug_peer_list = debugger_command = PATH=/bin:/usr/bin:/usr/local/bin:/usr/X11R6/bin ddd $daemon_directory/$process_name $process_id & sleep 5 default_database_type = hash default_delivery_slot_cost = 5 default_delivery_slot_discount = 50 default_delivery_slot_loan = 3 default_delivery_status_filter = default_destination_concurrency_failed_cohort_limit = 1 default_destination_concurrency_limit = 20 default_destination_concurrency_negative_feedback = 1 default_destination_concurrency_positive_feedback = 1 default_destination_rate_delay = 0s default_destination_recipient_limit = 50 default_extra_recipient_limit = 1000 default_filter_nexthop = default_minimum_delivery_slots = 3 default_privs = nobody default_process_limit = 100 default_rbl_reply = $rbl_code Service unavailable; $rbl_class [$rbl_what] blocked using $rbl_domain${rbl_reason?; $rbl_reason} default_recipient_limit = 20000 default_recipient_refill_delay = 5s default_recipient_refill_limit = 100 default_transport = smtp default_transport_rate_delay = 0s default_verp_delimiters = += defer_code = 450 defer_service_name = defer defer_transports = delay_logging_resolution_limit = 2 delay_notice_recipient = postmaster delay_warning_time = 0h deliver_lock_attempts = 20 deliver_lock_delay = 1s destination_concurrency_feedback_debug = no detect_8bit_encoding_header = yes disable_dns_lookups = no disable_mime_input_processing = no disable_mime_output_conversion = no disable_verp_bounces = no disable_vrfy_command = yes dns_ncache_ttl_fix_enable = no dnsblog_reply_delay = 0s dnsblog_service_name = dnsblog dont_remove = 0 double_bounce_sender = double-bounce duplicate_filter_limit = 1000 empty_address_default_transport_maps_lookup_key = <> empty_address_recipient = MAILER-DAEMON empty_address_relayhost_maps_lookup_key = <> enable_idna2003_compatibility = no enable_long_queue_ids = no enable_original_recipient = yes error_delivery_slot_cost = $default_delivery_slot_cost error_delivery_slot_discount = $default_delivery_slot_discount error_delivery_slot_loan = $default_delivery_slot_loan error_destination_concurrency_failed_cohort_limit = $default_destination_concurrency_failed_cohort_limit error_destination_concurrency_limit = $default_destination_concurrency_limit error_destination_concurrency_negative_feedback = $default_destination_concurrency_negative_feedback error_destination_concurrency_positive_feedback = $default_destination_concurrency_positive_feedback error_destination_rate_delay = $default_destination_rate_delay error_destination_recipient_limit = $default_destination_recipient_limit error_extra_recipient_limit = $default_extra_recipient_limit error_initial_destination_concurrency = $initial_destination_concurrency error_minimum_delivery_slots = $default_minimum_delivery_slots error_notice_recipient = postmaster error_recipient_limit = $default_recipient_limit error_recipient_refill_delay = $default_recipient_refill_delay error_recipient_refill_limit = $default_recipient_refill_limit error_service_name = error error_transport_rate_delay = $default_transport_rate_delay execution_directory_expansion_filter = 1234567890!@%-_=+:,./abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ expand_owner_alias = no export_environment = TZ MAIL_CONFIG LANG fallback_transport = fallback_transport_maps = fast_flush_domains = $relay_domains fast_flush_purge_time = 7d fast_flush_refresh_time = 12h fault_injection_code = 0 flush_service_name = flush fork_attempts = 5 fork_delay = 1s forward_expansion_filter = 1234567890!@%-_=+:,./abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ forward_path = $home/.forward${recipient_delimiter}${extension}, $home/.forward frozen_delivered_to = yes hash_queue_depth = 1 hash_queue_names = deferred, defer header_address_token_limit = 10240 header_checks = header_from_format = standard header_size_limit = 102400 helpful_warnings = yes home_mailbox = Maildir/ hopcount_limit = 50 html_directory = no ignore_mx_lookup_error = no import_environment = MAIL_CONFIG MAIL_DEBUG MAIL_LOGTAG TZ XAUTHORITY DISPLAY LANG=C POSTLOG_SERVICE POSTLOG_HOSTNAME in_flow_delay = 1s inet_interfaces = all inet_protocols = ipv4 info_log_address_format = internal initial_destination_concurrency = 5 internal_mail_filter_classes = invalid_hostname_reject_code = 501 ipc_idle = 5s ipc_timeout = 3600s ipc_ttl = 1000s line_length_limit = 2048 lmdb_map_size = 16777216 lmtp_address_preference = any lmtp_address_verify_target = rcpt lmtp_assume_final = no lmtp_balance_inet_protocols = yes lmtp_bind_address = lmtp_bind_address6 = lmtp_body_checks = lmtp_cname_overrides_servername = no lmtp_connect_timeout = 0s lmtp_connection_cache_destinations = lmtp_connection_cache_on_demand = yes lmtp_connection_cache_time_limit = 2s lmtp_connection_reuse_count_limit = 0 lmtp_connection_reuse_time_limit = 300s lmtp_data_done_timeout = 600s lmtp_data_init_timeout = 120s lmtp_data_xfer_timeout = 180s lmtp_defer_if_no_mx_address_found = no lmtp_delivery_slot_cost = $default_delivery_slot_cost lmtp_delivery_slot_discount = $default_delivery_slot_discount lmtp_delivery_slot_loan = $default_delivery_slot_loan lmtp_delivery_status_filter = $default_delivery_status_filter lmtp_destination_concurrency_failed_cohort_limit = $default_destination_concurrency_failed_cohort_limit lmtp_destination_concurrency_limit = $default_destination_concurrency_limit lmtp_destination_concurrency_negative_feedback = $default_destination_concurrency_negative_feedback lmtp_destination_concurrency_positive_feedback = $default_destination_concurrency_positive_feedback lmtp_destination_rate_delay = $default_destination_rate_delay lmtp_destination_recipient_limit = $default_destination_recipient_limit lmtp_discard_lhlo_keyword_address_maps = lmtp_discard_lhlo_keywords = lmtp_dns_reply_filter = lmtp_dns_resolver_options = lmtp_dns_support_level = lmtp_enforce_tls = no lmtp_extra_recipient_limit = $default_extra_recipient_limit lmtp_fallback_relay = lmtp_generic_maps = lmtp_header_checks = lmtp_host_lookup = dns lmtp_initial_destination_concurrency = $initial_destination_concurrency lmtp_lhlo_name = $myhostname lmtp_lhlo_timeout = 300s lmtp_line_length_limit = 998 lmtp_mail_timeout = 300s lmtp_mime_header_checks = lmtp_minimum_delivery_slots = $default_minimum_delivery_slots lmtp_mx_address_limit = 5 lmtp_mx_session_limit = 2 lmtp_nested_header_checks = lmtp_per_record_deadline = no lmtp_pix_workaround_delay_time = 10s lmtp_pix_workaround_maps = lmtp_pix_workaround_threshold_time = 500s lmtp_pix_workarounds = disable_esmtp,delay_dotcrlf lmtp_quit_timeout = 300s lmtp_quote_rfc821_envelope = yes lmtp_randomize_addresses = yes lmtp_rcpt_timeout = 300s lmtp_recipient_limit = $default_recipient_limit lmtp_recipient_refill_delay = $default_recipient_refill_delay lmtp_recipient_refill_limit = $default_recipient_refill_limit lmtp_reply_filter = lmtp_rset_timeout = 20s lmtp_sasl_auth_cache_name = lmtp_sasl_auth_cache_time = 90d lmtp_sasl_auth_enable = no lmtp_sasl_auth_soft_bounce = yes lmtp_sasl_mechanism_filter = lmtp_sasl_password_maps = lmtp_sasl_path = lmtp_sasl_security_options = noplaintext, noanonymous lmtp_sasl_tls_security_options = $lmtp_sasl_security_options lmtp_sasl_tls_verified_security_options = $lmtp_sasl_tls_security_options lmtp_sasl_type = cyrus lmtp_send_dummy_mail_auth = no lmtp_send_xforward_command = no lmtp_sender_dependent_authentication = no lmtp_skip_5xx_greeting = yes lmtp_skip_quit_response = no lmtp_starttls_timeout = 300s lmtp_tcp_port = 24 lmtp_tls_CAfile = lmtp_tls_CApath = lmtp_tls_block_early_mail_reply = no lmtp_tls_cert_file = lmtp_tls_chain_files = lmtp_tls_ciphers = medium lmtp_tls_connection_reuse = no lmtp_tls_dcert_file = lmtp_tls_dkey_file = $lmtp_tls_dcert_file lmtp_tls_eccert_file = lmtp_tls_eckey_file = $lmtp_tls_eccert_file lmtp_tls_enforce_peername = yes lmtp_tls_exclude_ciphers = lmtp_tls_fingerprint_cert_match = lmtp_tls_fingerprint_digest = md5 lmtp_tls_force_insecure_host_tlsa_lookup = no lmtp_tls_key_file = $lmtp_tls_cert_file lmtp_tls_loglevel = 0 lmtp_tls_mandatory_ciphers = medium lmtp_tls_mandatory_exclude_ciphers = lmtp_tls_mandatory_protocols = !SSLv2, !SSLv3 lmtp_tls_note_starttls_offer = no lmtp_tls_per_site = lmtp_tls_policy_maps = lmtp_tls_protocols = !SSLv2, !SSLv3 lmtp_tls_scert_verifydepth = 9 lmtp_tls_secure_cert_match = nexthop lmtp_tls_security_level = lmtp_tls_servername = lmtp_tls_session_cache_database = lmtp_tls_session_cache_timeout = 3600s lmtp_tls_trust_anchor_file = lmtp_tls_verify_cert_match = hostname lmtp_tls_wrappermode = no lmtp_transport_rate_delay = $default_transport_rate_delay lmtp_use_tls = no lmtp_xforward_timeout = 300s local_command_shell = local_delivery_slot_cost = $default_delivery_slot_cost local_delivery_slot_discount = $default_delivery_slot_discount local_delivery_slot_loan = $default_delivery_slot_loan local_delivery_status_filter = $default_delivery_status_filter local_destination_concurrency_failed_cohort_limit = $default_destination_concurrency_failed_cohort_limit local_destination_concurrency_limit = 2 local_destination_concurrency_negative_feedback = $default_destination_concurrency_negative_feedback local_destination_concurrency_positive_feedback = $default_destination_concurrency_positive_feedback local_destination_rate_delay = $default_destination_rate_delay local_destination_recipient_limit = 1 local_extra_recipient_limit = $default_extra_recipient_limit local_header_rewrite_clients = "" local_initial_destination_concurrency = $initial_destination_concurrency local_minimum_delivery_slots = $default_minimum_delivery_slots local_recipient_limit = $default_recipient_limit local_recipient_maps = proxy:unix:passwd.byname $alias_maps local_recipient_refill_delay = $default_recipient_refill_delay local_recipient_refill_limit = $default_recipient_refill_limit local_transport = local:$myhostname local_transport_rate_delay = $default_transport_rate_delay luser_relay = mail_name = Postfix mail_owner = postfix mail_release_date = 20201107 mail_spool_directory = /var/mail mail_version = 3.5.8 mailbox_command = mailbox_command_maps = mailbox_delivery_lock = fcntl, dotlock mailbox_size_limit = 0 mailbox_transport = lmtp:unix:private/dovecot-lmtp mailbox_transport_maps = maillog_file = maillog_file_compressor = gzip maillog_file_prefixes = /var, /dev/stdout maillog_file_rotate_suffix = %Y%m%d-%H%M%S mailq_path = /usr/bin/mailq.postfix manpage_directory = /usr/share/man maps_rbl_domains = maps_rbl_reject_code = 554 masquerade_classes = envelope_sender, header_sender, header_recipient masquerade_domains = masquerade_exceptions = master_service_disable = max_idle = 100s max_use = 100 maximal_backoff_time = 4000s maximal_queue_lifetime = 1d message_drop_headers = bcc, content-length, resent-bcc, return-path message_reject_characters = message_size_limit = 32000000 message_strip_characters = meta_directory = /etc/postfix milter_command_timeout = 30s milter_connect_macros = j {daemon_name} {daemon_addr} v _ milter_connect_timeout = 30s milter_content_timeout = 300s milter_data_macros = i milter_default_action = accept milter_end_of_data_macros = i milter_end_of_header_macros = i milter_header_checks = milter_helo_macros = {tls_version} {cipher} {cipher_bits} {cert_subject} {cert_issuer} milter_macro_daemon_name = $myhostname milter_macro_defaults = milter_macro_v = $mail_name $mail_version milter_mail_macros = i {auth_type} {auth_authen} {auth_author} {mail_addr} {mail_host} {mail_mailer} milter_protocol = 6 milter_rcpt_macros = i {rcpt_addr} {rcpt_host} {rcpt_mailer} milter_unknown_command_macros = mime_boundary_length_limit = 2048 mime_header_checks = $header_checks mime_nesting_limit = 100 minimal_backoff_time = 300s multi_instance_directories = multi_instance_enable = no multi_instance_group = multi_instance_name = multi_instance_wrapper = multi_recipient_bounce_reject_code = 550 mydestination = $myhostname, localhost.$mydomain, localhost, localhost.localdomain mydomain = mydomain.tld myhostname = sub.mydomain.tld mynetworks = 127.0.0.1/32 mynetworks_style = ${{$compatibility_level} < {2} ? {subnet} : {host}} myorigin = $myhostname nested_header_checks = $header_checks newaliases_path = /usr/bin/newaliases.postfix non_fqdn_reject_code = 504 non_smtpd_milters = inet:rspamd.domain.tld:11332 notify_classes = resource, software openssl_path = openssl owner_request_special = yes parent_domain_matches_subdomains = debug_peer_list,fast_flush_domains,mynetworks,permit_mx_backup_networks,qmqpd_authorized_clients,relay_domains,smtpd_access_maps permit_mx_backup_networks = pickup_service_name = pickup pipe_delivery_status_filter = $default_delivery_status_filter plaintext_reject_code = 450 postlog_service_name = postlog postlogd_watchdog_timeout = 10s postmulti_control_commands = reload flush postmulti_start_commands = start postmulti_stop_commands = stop abort drain quick-stop postscreen_access_list = permit_mynetworks postscreen_bare_newline_action = ignore postscreen_bare_newline_enable = no postscreen_bare_newline_ttl = 30d postscreen_blacklist_action = ignore postscreen_cache_cleanup_interval = 12h postscreen_cache_map = btree:$data_directory/postscreen_cache postscreen_cache_retention_time = 7d postscreen_client_connection_count_limit = $smtpd_client_connection_count_limit postscreen_command_count_limit = 20 postscreen_command_filter = postscreen_command_time_limit = ${stress?{10}:{300}}s postscreen_disable_vrfy_command = $disable_vrfy_command postscreen_discard_ehlo_keyword_address_maps = $smtpd_discard_ehlo_keyword_address_maps postscreen_discard_ehlo_keywords = $smtpd_discard_ehlo_keywords postscreen_dnsbl_action = ignore postscreen_dnsbl_max_ttl = ${postscreen_dnsbl_ttl?{$postscreen_dnsbl_ttl}:{1}}h postscreen_dnsbl_min_ttl = 60s postscreen_dnsbl_reply_map = postscreen_dnsbl_sites = postscreen_dnsbl_threshold = 1 postscreen_dnsbl_timeout = 10s postscreen_dnsbl_whitelist_threshold = 0 postscreen_enforce_tls = $smtpd_enforce_tls postscreen_expansion_filter = $smtpd_expansion_filter postscreen_forbidden_commands = $smtpd_forbidden_commands postscreen_greet_action = ignore postscreen_greet_banner = $smtpd_banner postscreen_greet_ttl = 1d postscreen_greet_wait = ${stress?{2}:{6}}s postscreen_helo_required = $smtpd_helo_required postscreen_non_smtp_command_action = drop postscreen_non_smtp_command_enable = no postscreen_non_smtp_command_ttl = 30d postscreen_pipelining_action = enforce postscreen_pipelining_enable = no postscreen_pipelining_ttl = 30d postscreen_post_queue_limit = $default_process_limit postscreen_pre_queue_limit = $default_process_limit postscreen_reject_footer = $smtpd_reject_footer postscreen_reject_footer_maps = $smtpd_reject_footer_maps postscreen_tls_security_level = $smtpd_tls_security_level postscreen_upstream_proxy_protocol = postscreen_upstream_proxy_timeout = 5s postscreen_use_tls = $smtpd_use_tls postscreen_watchdog_timeout = 10s postscreen_whitelist_interfaces = static:all prepend_delivered_header = command, file, forward process_id = 2311500 process_id_directory = pid process_name = postconf propagate_unmatched_extensions = canonical, virtual proxy_interfaces = proxy_read_maps = $local_recipient_maps $mydestination $virtual_alias_maps $virtual_alias_domains $virtual_mailbox_maps $virtual_mailbox_domains $relay_recipient_maps $relay_domains $canonical_maps $sender_canonical_maps $recipient_canonical_maps $relocated_maps $transport_maps $mynetworks $smtpd_sender_login_maps $sender_bcc_maps $recipient_bcc_maps $smtp_generic_maps $lmtp_generic_maps $alias_maps $smtpd_client_restrictions $smtpd_helo_restrictions $smtpd_sender_restrictions $smtpd_relay_restrictions $smtpd_recipient_restrictions $address_verify_sender_dependent_default_transport_maps $address_verify_sender_dependent_relayhost_maps $address_verify_transport_maps $fallback_transport_maps $lmtp_discard_lhlo_keyword_address_maps $lmtp_pix_workaround_maps $lmtp_sasl_password_maps $lmtp_tls_policy_maps $mailbox_command_maps $mailbox_transport_maps $postscreen_discard_ehlo_keyword_address_maps $rbl_reply_maps $sender_dependent_default_transport_maps $sender_dependent_relayhost_maps $smtp_discard_ehlo_keyword_address_maps $smtp_pix_workaround_maps $smtp_sasl_password_maps $smtp_tls_policy_maps $smtpd_discard_ehlo_keyword_address_maps $smtpd_milter_maps $virtual_gid_maps $virtual_uid_maps proxy_write_maps = $smtp_sasl_auth_cache_name $lmtp_sasl_auth_cache_name $address_verify_map $postscreen_cache_map proxymap_service_name = proxymap proxywrite_service_name = proxywrite qmgr_clog_warn_time = 300s qmgr_daemon_timeout = 1000s qmgr_fudge_factor = 100 qmgr_ipc_timeout = 60s qmgr_message_active_limit = 20000 qmgr_message_recipient_limit = 20000 qmgr_message_recipient_minimum = 10 qmqpd_authorized_clients = qmqpd_client_port_logging = no qmqpd_error_delay = 1s qmqpd_timeout = 300s queue_directory = /var/spool/postfix queue_file_attribute_count_limit = 100 queue_minfree = 0 queue_run_delay = 300s queue_service_name = qmgr rbl_reply_maps = readme_directory = /usr/share/doc/postfix/README_FILES receive_override_options = recipient_bcc_maps = recipient_canonical_classes = envelope_recipient, header_recipient recipient_canonical_maps = recipient_delimiter = reject_code = 554 reject_tempfail_action = defer_if_permit relay_clientcerts = relay_delivery_slot_cost = $default_delivery_slot_cost relay_delivery_slot_discount = $default_delivery_slot_discount relay_delivery_slot_loan = $default_delivery_slot_loan relay_destination_concurrency_failed_cohort_limit = $default_destination_concurrency_failed_cohort_limit relay_destination_concurrency_limit = $default_destination_concurrency_limit relay_destination_concurrency_negative_feedback = $default_destination_concurrency_negative_feedback relay_destination_concurrency_positive_feedback = $default_destination_concurrency_positive_feedback relay_destination_rate_delay = $default_destination_rate_delay relay_destination_recipient_limit = $default_destination_recipient_limit relay_domains = ${{$compatibility_level} < {2} ? {$mydestination} : {}} relay_domains_reject_code = 554 relay_extra_recipient_limit = $default_extra_recipient_limit relay_initial_destination_concurrency = $initial_destination_concurrency relay_minimum_delivery_slots = $default_minimum_delivery_slots relay_recipient_limit = $default_recipient_limit relay_recipient_maps = relay_recipient_refill_delay = $default_recipient_refill_delay relay_recipient_refill_limit = $default_recipient_refill_limit relay_transport = relay relay_transport_rate_delay = $default_transport_rate_delay relayhost = relocated_maps = remote_header_rewrite_domain = require_home_directory = no reset_owner_alias = no resolve_dequoted_address = yes resolve_null_domain = no resolve_numeric_domain = no retry_delivery_slot_cost = $default_delivery_slot_cost retry_delivery_slot_discount = $default_delivery_slot_discount retry_delivery_slot_loan = $default_delivery_slot_loan retry_destination_concurrency_failed_cohort_limit = $default_destination_concurrency_failed_cohort_limit retry_destination_concurrency_limit = $default_destination_concurrency_limit retry_destination_concurrency_negative_feedback = $default_destination_concurrency_negative_feedback retry_destination_concurrency_positive_feedback = $default_destination_concurrency_positive_feedback retry_destination_rate_delay = $default_destination_rate_delay retry_destination_recipient_limit = $default_destination_recipient_limit retry_extra_recipient_limit = $default_extra_recipient_limit retry_initial_destination_concurrency = $initial_destination_concurrency retry_minimum_delivery_slots = $default_minimum_delivery_slots retry_recipient_limit = $default_recipient_limit retry_recipient_refill_delay = $default_recipient_refill_delay retry_recipient_refill_limit = $default_recipient_refill_limit retry_transport_rate_delay = $default_transport_rate_delay rewrite_service_name = rewrite rhel_ipv6_normalize = no sample_directory = /usr/share/doc/postfix/samples send_cyrus_sasl_authzid = no sender_bcc_maps = hash:/etc/postfix/bcc sender_canonical_classes = envelope_sender, header_sender sender_canonical_maps = sender_dependent_default_transport_maps = hash:/etc/postfix/dependent sender_dependent_relayhost_maps = sendmail_fix_line_endings = always sendmail_path = /usr/sbin/sendmail.postfix service_name = service_throttle_time = 60s setgid_group = postdrop shlib_directory = /usr/lib64/postfix show_user_unknown_table_name = yes showq_service_name = showq smtp_address_preference = any smtp_address_verify_target = rcpt smtp_always_send_ehlo = yes smtp_balance_inet_protocols = yes smtp_bind_address = smtp_bind_address6 = smtp_body_checks = smtp_cname_overrides_servername = no smtp_connect_timeout = 30s smtp_connection_cache_destinations = smtp_connection_cache_on_demand = yes smtp_connection_cache_time_limit = 2s smtp_connection_reuse_count_limit = 0 smtp_connection_reuse_time_limit = 300s smtp_data_done_timeout = 600s smtp_data_init_timeout = 120s smtp_data_xfer_timeout = 180s smtp_defer_if_no_mx_address_found = no smtp_delivery_slot_cost = $default_delivery_slot_cost smtp_delivery_slot_discount = $default_delivery_slot_discount smtp_delivery_slot_loan = $default_delivery_slot_loan smtp_delivery_status_filter = $default_delivery_status_filter smtp_destination_concurrency_failed_cohort_limit = $default_destination_concurrency_failed_cohort_limit smtp_destination_concurrency_limit = $default_destination_concurrency_limit smtp_destination_concurrency_negative_feedback = $default_destination_concurrency_negative_feedback smtp_destination_concurrency_positive_feedback = $default_destination_concurrency_positive_feedback smtp_destination_rate_delay = $default_destination_rate_delay smtp_destination_recipient_limit = $default_destination_recipient_limit smtp_discard_ehlo_keyword_address_maps = smtp_discard_ehlo_keywords = smtp_dns_reply_filter = smtp_dns_resolver_options = smtp_dns_support_level = smtp_enforce_tls = no smtp_extra_recipient_limit = $default_extra_recipient_limit smtp_fallback_relay = $fallback_relay smtp_generic_maps = smtp_header_checks = smtp_helo_name = $myhostname smtp_helo_timeout = 300s smtp_host_lookup = dns smtp_initial_destination_concurrency = $initial_destination_concurrency smtp_line_length_limit = 998 smtp_mail_timeout = 300s smtp_mime_header_checks = smtp_minimum_delivery_slots = $default_minimum_delivery_slots smtp_mx_address_limit = 5 smtp_mx_session_limit = 2 smtp_nested_header_checks = smtp_never_send_ehlo = no smtp_per_record_deadline = no smtp_pix_workaround_delay_time = 10s smtp_pix_workaround_maps = smtp_pix_workaround_threshold_time = 500s smtp_pix_workarounds = disable_esmtp,delay_dotcrlf smtp_quit_timeout = 300s smtp_quote_rfc821_envelope = yes smtp_randomize_addresses = yes smtp_rcpt_timeout = 300s smtp_recipient_limit = $default_recipient_limit smtp_recipient_refill_delay = $default_recipient_refill_delay smtp_recipient_refill_limit = $default_recipient_refill_limit smtp_reply_filter = smtp_rset_timeout = 20s smtp_sasl_auth_cache_name = smtp_sasl_auth_cache_time = 90d smtp_sasl_auth_enable = no smtp_sasl_auth_soft_bounce = yes smtp_sasl_mechanism_filter = smtp_sasl_password_maps = smtp_sasl_path = smtp_sasl_security_options = noplaintext, noanonymous smtp_sasl_tls_security_options = $smtp_sasl_security_options smtp_sasl_tls_verified_security_options = $smtp_sasl_tls_security_options smtp_sasl_type = cyrus smtp_send_dummy_mail_auth = no smtp_send_xforward_command = no smtp_sender_dependent_authentication = no smtp_skip_5xx_greeting = yes smtp_skip_quit_response = yes smtp_starttls_timeout = 300s smtp_tcp_port = smtp smtp_tls_CAfile = /etc/pki/tls/certs/ca-bundle.crt smtp_tls_CApath = /etc/pki/tls/certs smtp_tls_block_early_mail_reply = no smtp_tls_cert_file = smtp_tls_chain_files = smtp_tls_ciphers = medium smtp_tls_connection_reuse = no smtp_tls_dane_insecure_mx_policy = dane smtp_tls_dcert_file = smtp_tls_dkey_file = $smtp_tls_dcert_file smtp_tls_eccert_file = smtp_tls_eckey_file = $smtp_tls_eccert_file smtp_tls_enforce_peername = yes smtp_tls_exclude_ciphers = RC4, aNULL, EXPORT, LOW, MEDIUM smtp_tls_fingerprint_cert_match = smtp_tls_fingerprint_digest = md5 smtp_tls_force_insecure_host_tlsa_lookup = no smtp_tls_key_file = $smtp_tls_cert_file smtp_tls_loglevel = 0 smtp_tls_mandatory_ciphers = medium smtp_tls_mandatory_exclude_ciphers = smtp_tls_mandatory_protocols = !SSLv2,!SSLv3 smtp_tls_note_starttls_offer = no smtp_tls_per_site = smtp_tls_policy_maps = smtp_tls_protocols = !SSLv2,!SSLv3 smtp_tls_scert_verifydepth = 9 smtp_tls_secure_cert_match = nexthop, dot-nexthop smtp_tls_security_level = may smtp_tls_servername = smtp_tls_session_cache_database = smtp_tls_session_cache_timeout = 3600s smtp_tls_trust_anchor_file = smtp_tls_verify_cert_match = hostname smtp_tls_wrappermode = no smtp_transport_rate_delay = $default_transport_rate_delay smtp_use_tls = no smtp_xforward_timeout = 300s smtpd_authorized_verp_clients = $authorized_verp_clients smtpd_authorized_xclient_hosts = smtpd_authorized_xforward_hosts = smtpd_banner = $myhostname ESMTP $mail_name smtpd_client_auth_rate_limit = 0 smtpd_client_connection_count_limit = 10 smtpd_client_connection_rate_limit = 60 smtpd_client_event_limit_exceptions = ${smtpd_client_connection_limit_exceptions:$mynetworks} smtpd_client_message_rate_limit = 0 smtpd_client_new_tls_session_rate_limit = 0 smtpd_client_port_logging = no smtpd_client_recipient_rate_limit = 0 smtpd_client_restrictions = smtpd_command_filter = smtpd_data_restrictions = smtpd_delay_open_until_valid_rcpt = yes smtpd_delay_reject = yes smtpd_discard_ehlo_keyword_address_maps = smtpd_discard_ehlo_keywords = chunking smtpd_dns_reply_filter = smtpd_end_of_data_restrictions = smtpd_enforce_tls = no smtpd_error_sleep_time = 1s smtpd_etrn_restrictions = smtpd_expansion_filter = \t\40!"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~ smtpd_forbidden_commands = CONNECT GET POST smtpd_hard_error_limit = ${stress?{1}:{20}} smtpd_helo_required = no smtpd_helo_restrictions = smtpd_history_flush_threshold = 100 smtpd_junk_command_limit = ${stress?{1}:{100}} smtpd_log_access_permit_actions = smtpd_milter_maps = smtpd_milters = inet:rspamd.domain.tld:11332 smtpd_noop_commands = smtpd_null_access_lookup_key = <> smtpd_peername_lookup = yes smtpd_per_record_deadline = ${stress?{yes}:{no}} smtpd_policy_service_default_action = 451 4.3.5 Server configuration problem smtpd_policy_service_max_idle = 300s smtpd_policy_service_max_ttl = 1000s smtpd_policy_service_policy_context = smtpd_policy_service_request_limit = 0 smtpd_policy_service_retry_delay = 1s smtpd_policy_service_timeout = 100s smtpd_policy_service_try_limit = 2 smtpd_proxy_ehlo = $myhostname smtpd_proxy_filter = smtpd_proxy_options = smtpd_proxy_timeout = 100s smtpd_recipient_limit = 1000 smtpd_recipient_overshoot_limit = 1000 smtpd_recipient_restrictions = permit_sasl_authenticated, reject_unauth_destination, reject_invalid_hostname, reject_unauth_pipelining, reject_non_fqdn_sender, reject_unknown_sender_domain, reject_non_fqdn_recipient, reject_unknown_recipient_domain, reject_rbl_client zen.spamhaus.org, reject_rhsbl_client dbl.spamhaus.org smtpd_reject_footer = smtpd_reject_footer_maps = smtpd_reject_unlisted_recipient = yes smtpd_reject_unlisted_sender = yes smtpd_relay_restrictions = ${{$compatibility_level} < {1} ? {} : {permit_mynetworks, permit_sasl_authenticated, defer_unauth_destination}} smtpd_restriction_classes = smtpd_sasl_auth_enable = yes smtpd_sasl_authenticated_header = no smtpd_sasl_exceptions_networks = smtpd_sasl_local_domain = smtpd_sasl_path = smtpd smtpd_sasl_response_limit = 12288 smtpd_sasl_security_options = noanonymous smtpd_sasl_service = smtp smtpd_sasl_tls_security_options = $smtpd_sasl_security_options smtpd_sasl_type = cyrus smtpd_sender_login_maps = unionmap:{regexp:/etc/postfix/login_maps.pcre hash:/etc/postfix/virtual} smtpd_sender_restrictions = smtpd_service_name = smtpd smtpd_soft_error_limit = 10 smtpd_starttls_timeout = ${stress?{10}:{300}}s smtpd_timeout = ${stress?{10}:{300}}s smtpd_tls_CAfile = /etc/postfix/postfix.ca.pem smtpd_tls_CApath = smtpd_tls_always_issue_session_ids = yes smtpd_tls_ask_ccert = no smtpd_tls_auth_only = no smtpd_tls_ccert_verifydepth = 9 smtpd_tls_cert_file = smtpd_tls_chain_files = /etc/pki/tls/private/postfix.key,/etc/pki/tls/certs/postfix.pem smtpd_tls_ciphers = medium smtpd_tls_dcert_file = smtpd_tls_dh1024_param_file = smtpd_tls_dh512_param_file = smtpd_tls_dkey_file = $smtpd_tls_dcert_file smtpd_tls_eccert_file = smtpd_tls_eckey_file = $smtpd_tls_eccert_file smtpd_tls_eecdh_grade = auto smtpd_tls_exclude_ciphers = RC4, aNULL, EXPORT, LOW, MEDIUM smtpd_tls_fingerprint_digest = md5 smtpd_tls_key_file = $smtpd_tls_cert_file smtpd_tls_loglevel = 0 smtpd_tls_mandatory_ciphers = high smtpd_tls_mandatory_exclude_ciphers = smtpd_tls_mandatory_protocols = !SSLv2, !SSLv3 smtpd_tls_protocols = !SSLv2,!SSLv3 smtpd_tls_received_header = no smtpd_tls_req_ccert = no smtpd_tls_security_level = may smtpd_tls_session_cache_database = smtpd_tls_session_cache_timeout = 3600s smtpd_tls_wrappermode = no smtpd_upstream_proxy_protocol = smtpd_upstream_proxy_timeout = 5s smtpd_use_tls = yes smtputf8_autodetect_classes = sendmail, verify smtputf8_enable = ${{$compatibility_level} < {1} ? {no} : {yes}} soft_bounce = no stale_lock_time = 500s stress = strict_7bit_headers = no strict_8bitmime = no strict_8bitmime_body = no strict_mailbox_ownership = yes strict_mime_encoding_domain = no strict_rfc821_envelopes = no strict_smtputf8 = no sun_mailtool_compatibility = no swap_bangpath = yes syslog_facility = mail syslog_name = ${multi_instance_name?{$multi_instance_name}:{postfix}} tcp_windowsize = 0 tls_append_default_CA = no tls_daemon_random_bytes = 32 tls_dane_digests = sha512 sha256 tls_disable_workarounds = tls_eecdh_auto_curves = X25519 X448 prime256v1 secp521r1 secp384r1 tls_eecdh_strong_curve = prime256v1 tls_eecdh_ultra_curve = secp384r1 tls_export_cipherlist = aNULL:-aNULL:HIGH:MEDIUM:LOW:EXPORT:+RC4:@STRENGTH tls_fast_shutdown_enable = yes tls_high_cipherlist = aNULL:-aNULL:HIGH:@STRENGTH tls_legacy_public_key_fingerprints = no tls_low_cipherlist = aNULL:-aNULL:HIGH:MEDIUM:LOW:+RC4:@STRENGTH tls_medium_cipherlist = aNULL:-aNULL:HIGH:MEDIUM:+RC4:@STRENGTH tls_null_cipherlist = eNULL:!aNULL tls_preempt_cipherlist = no tls_random_bytes = 32 tls_random_exchange_name = ${data_directory}/prng_exch tls_random_prng_update_period = 3600s tls_random_reseed_period = 3600s tls_random_source = dev:/dev/urandom tls_server_sni_maps = hash:/etc/postfix/vmail_ssl tls_session_ticket_cipher = aes-256-cbc tls_ssl_options = tls_wildcard_matches_multiple_labels = yes tlsmgr_service_name = tlsmgr tlsproxy_client_CAfile = $smtp_tls_CAfile tlsproxy_client_CApath = $smtp_tls_CApath tlsproxy_client_cert_file = $smtp_tls_cert_file tlsproxy_client_chain_files = $smtp_tls_chain_files tlsproxy_client_dcert_file = $smtp_tls_dcert_file tlsproxy_client_dkey_file = $smtp_tls_dkey_file tlsproxy_client_eccert_file = $smtp_tls_eccert_file tlsproxy_client_eckey_file = $smtp_tls_eckey_file tlsproxy_client_enforce_tls = $smtp_enforce_tls tlsproxy_client_fingerprint_digest = $smtp_tls_fingerprint_digest tlsproxy_client_key_file = $smtp_tls_key_file tlsproxy_client_level = $smtp_tls_security_level tlsproxy_client_loglevel = $smtp_tls_loglevel tlsproxy_client_loglevel_parameter = smtp_tls_loglevel tlsproxy_client_per_site = $smtp_tls_per_site tlsproxy_client_policy = $smtp_tls_policy_maps tlsproxy_client_scert_verifydepth = $smtp_tls_scert_verifydepth tlsproxy_client_use_tls = $smtp_use_tls tlsproxy_enforce_tls = $smtpd_enforce_tls tlsproxy_service_name = tlsproxy tlsproxy_tls_CAfile = $smtpd_tls_CAfile tlsproxy_tls_CApath = $smtpd_tls_CApath tlsproxy_tls_always_issue_session_ids = $smtpd_tls_always_issue_session_ids tlsproxy_tls_ask_ccert = $smtpd_tls_ask_ccert tlsproxy_tls_ccert_verifydepth = $smtpd_tls_ccert_verifydepth tlsproxy_tls_cert_file = $smtpd_tls_cert_file tlsproxy_tls_chain_files = $smtpd_tls_chain_files tlsproxy_tls_ciphers = $smtpd_tls_ciphers tlsproxy_tls_dcert_file = $smtpd_tls_dcert_file tlsproxy_tls_dh1024_param_file = $smtpd_tls_dh1024_param_file tlsproxy_tls_dh512_param_file = $smtpd_tls_dh512_param_file tlsproxy_tls_dkey_file = $smtpd_tls_dkey_file tlsproxy_tls_eccert_file = $smtpd_tls_eccert_file tlsproxy_tls_eckey_file = $smtpd_tls_eckey_file tlsproxy_tls_eecdh_grade = $smtpd_tls_eecdh_grade tlsproxy_tls_exclude_ciphers = $smtpd_tls_exclude_ciphers tlsproxy_tls_fingerprint_digest = $smtpd_tls_fingerprint_digest tlsproxy_tls_key_file = $smtpd_tls_key_file tlsproxy_tls_loglevel = $smtpd_tls_loglevel tlsproxy_tls_mandatory_ciphers = $smtpd_tls_mandatory_ciphers tlsproxy_tls_mandatory_exclude_ciphers = $smtpd_tls_mandatory_exclude_ciphers tlsproxy_tls_mandatory_protocols = $smtpd_tls_mandatory_protocols tlsproxy_tls_protocols = $smtpd_tls_protocols tlsproxy_tls_req_ccert = $smtpd_tls_req_ccert tlsproxy_tls_security_level = $smtpd_tls_security_level tlsproxy_use_tls = $smtpd_use_tls tlsproxy_watchdog_timeout = 10s trace_service_name = trace transport_maps = transport_retry_time = 60s trigger_timeout = 10s undisclosed_recipients_header = unknown_address_reject_code = 450 unknown_address_tempfail_action = $reject_tempfail_action unknown_client_reject_code = 450 unknown_helo_hostname_tempfail_action = $reject_tempfail_action unknown_hostname_reject_code = 450 unknown_local_recipient_reject_code = 550 unknown_relay_recipient_reject_code = 550 unknown_virtual_alias_reject_code = 550 unknown_virtual_mailbox_reject_code = 550 unverified_recipient_defer_code = 450 unverified_recipient_reject_code = 450 unverified_recipient_reject_reason = unverified_recipient_tempfail_action = $reject_tempfail_action unverified_sender_defer_code = 450 unverified_sender_reject_code = 450 unverified_sender_reject_reason = unverified_sender_tempfail_action = $reject_tempfail_action verp_delimiter_filter = -=+ virtual_alias_address_length_limit = 1000 virtual_alias_domains = $virtual_alias_maps virtual_alias_expansion_limit = 1000 virtual_alias_maps = hash:/etc/postfix/virtual virtual_alias_recursion_limit = 1000 virtual_delivery_slot_cost = $default_delivery_slot_cost virtual_delivery_slot_discount = $default_delivery_slot_discount virtual_delivery_slot_loan = $default_delivery_slot_loan virtual_delivery_status_filter = $default_delivery_status_filter virtual_destination_concurrency_failed_cohort_limit = $default_destination_concurrency_failed_cohort_limit virtual_destination_concurrency_limit = $default_destination_concurrency_limit virtual_destination_concurrency_negative_feedback = $default_destination_concurrency_negative_feedback virtual_destination_concurrency_positive_feedback = $default_destination_concurrency_positive_feedback virtual_destination_rate_delay = $default_destination_rate_delay virtual_destination_recipient_limit = $default_destination_recipient_limit virtual_extra_recipient_limit = $default_extra_recipient_limit virtual_gid_maps = virtual_initial_destination_concurrency = $initial_destination_concurrency virtual_mailbox_base = virtual_mailbox_domains = $virtual_mailbox_maps virtual_mailbox_limit = 51200000 virtual_mailbox_lock = fcntl, dotlock virtual_mailbox_maps = virtual_minimum_delivery_slots = $default_minimum_delivery_slots virtual_minimum_uid = 100 virtual_recipient_limit = $default_recipient_limit virtual_recipient_refill_delay = $default_recipient_refill_delay virtual_recipient_refill_limit = $default_recipient_refill_limit virtual_transport = virtual virtual_transport_rate_delay = $default_transport_rate_delay virtual_uid_maps = ############################# dovecot config: ############################# doveconf # 2.3.16 (7e2e900c1a): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.16 (09c29328) # OS: Linux 4.18.0-425.3.1.el8.x86_64 x86_64 Rocky Linux release 8.7 (Green Obsidian) # Hostname: m13.domain.tld # NOTE: Send doveconf -n output instead when asking for help. auth_anonymous_username = anonymous auth_cache_negative_ttl = 1 hours auth_cache_size = 0 auth_cache_ttl = 1 hours auth_cache_verify_password_with_worker = no auth_debug = no auth_debug_passwords = no auth_default_realm = auth_failure_delay = 2 secs auth_gssapi_hostname = auth_krb5_keytab = auth_master_user_separator = auth_mechanisms = plain login auth_policy_check_after_auth = yes auth_policy_check_before_auth = yes auth_policy_hash_mech = sha256 auth_policy_hash_nonce = auth_policy_hash_truncate = 12 auth_policy_log_only = no auth_policy_reject_on_fail = no auth_policy_report_after_auth = yes auth_policy_request_attributes = login=%{requested_username} pwhash=%{hashed_password} remote=%{rip} device_id=%{client_id} protocol=%s session_id=%{session} auth_policy_server_api_header = auth_policy_server_timeout_msecs = 2000 auth_policy_server_url = auth_proxy_self = auth_realms = auth_socket_path = auth-userdb auth_ssl_require_client_cert = no auth_ssl_username_from_cert = no auth_stats = no auth_use_winbind = no auth_username_chars = abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ01234567890.-_@ auth_username_format = %Lu auth_username_translation = auth_verbose = no auth_verbose_passwords = no auth_winbind_helper_path = /usr/bin/ntlm_auth auth_worker_max_count = 30 base_dir = /run/dovecot config_cache_size = 1 M debug_log_path = default_client_limit = 1000 default_idle_kill = 1 mins default_internal_group = dovecot default_internal_user = dovecot default_login_user = dovenull default_process_limit = 100 default_vsz_limit = 256 M deliver_log_format = msgid=%m: %$ dict_db_config = director_flush_socket = director_mail_servers = director_max_parallel_kicks = 100 director_max_parallel_moves = 100 director_output_buffer_size = 10 M director_ping_idle_timeout = 30 secs director_ping_max_timeout = 1 mins director_servers = director_user_expire = 15 mins director_user_kick_delay = 2 secs director_username_hash = %u disable_plaintext_auth = no dotlock_use_excl = yes doveadm_allowed_commands = doveadm_api_key = doveadm_http_rawlog_dir = doveadm_password = doveadm_port = 0 doveadm_socket_path = doveadm-server doveadm_ssl = no doveadm_username = doveadm doveadm_worker_count = 0 dsync_alt_char = _ dsync_commit_msgs_interval = 100 dsync_features = dsync_hashed_headers = Date Message-ID dsync_remote_cmd = ssh -l%{login} %{host} doveadm dsync-server -u%u -U first_valid_gid = 1 first_valid_uid = 1000 haproxy_timeout = 3 secs haproxy_trusted_networks = hostname = imap_capability = imap_client_workarounds = imap_fetch_failure = disconnect-immediately imap_hibernate_timeout = 0 imap_id_log = imap_id_retain = no imap_id_send = name * imap_idle_notify_interval = 2 mins imap_literal_minus = no imap_logout_format = in=%i out=%o deleted=%{deleted} expunged=%{expunged} trashed=%{trashed} hdr_count=%{fetch_hdr_count} hdr_bytes=%{fetch_hdr_bytes} body_count=%{fetch_body_count} body_bytes=%{fetch_body_bytes} imap_max_line_length = 64 k imap_metadata = no imap_urlauth_host = imap_urlauth_logout_format = in=%i out=%o imap_urlauth_port = 143 imapc_cmd_timeout = 5 mins imapc_connection_retry_count = 1 imapc_connection_retry_interval = 1 secs imapc_features = imapc_host = imapc_list_prefix = imapc_master_user = imapc_max_idle_time = 29 mins imapc_max_line_length = 0 imapc_password = imapc_port = 143 imapc_rawlog_dir = imapc_sasl_mechanisms = imapc_ssl = no imapc_ssl_verify = yes imapc_user = import_environment = TZ CORE_OUTOFMEM CORE_ERROR info_log_path = instance_name = dovecot last_valid_gid = 0 last_valid_uid = 0 lda_mailbox_autocreate = no lda_mailbox_autosubscribe = no lda_original_recipient_header = libexec_dir = /usr/libexec/dovecot listen = *, :: lmtp_add_received_header = yes lmtp_client_workarounds = lmtp_hdr_delivery_address = final lmtp_proxy = no lmtp_proxy_rawlog_dir = lmtp_rawlog_dir = lmtp_rcpt_check_quota = no lmtp_save_to_detail_mailbox = no lmtp_user_concurrency_limit = 0 lock_method = fcntl log_core_filter = log_debug = log_path = syslog log_timestamp = "%b %d %H:%M:%S " login_access_sockets = login_greeting = Dovecot ready. login_log_format = %$: %s login_log_format_elements = user=<%u> method=%m rip=%r lip=%l mpid=%e %c session=<%{session}> login_plugin_dir = /usr/lib64/dovecot/login login_plugins = login_proxy_max_disconnect_delay = 0 login_proxy_max_reconnects = 3 login_proxy_notify_path = proxy-notify login_proxy_timeout = 30 secs login_source_ips = login_trusted_networks = mail_access_groups = mail_always_cache_fields = mail_attachment_detection_options = mail_attachment_dir = mail_attachment_fs = sis posix mail_attachment_hash = %{sha1} mail_attachment_min_size = 128 k mail_attribute_dict = mail_cache_fields = flags mail_cache_min_mail_count = 0 mail_chroot = mail_debug = no mail_fsync = optimized mail_full_filesystem_access = no mail_gid = mail_home = mail_location = maildir:~/Maildir:INDEX=/var/lib/dovecot-virtualmin/index/%u:CONTROL=/var/lib/dovecot-virtualmin/control/%u mail_log_prefix = "%s(%u)<%{pid}><%{session}>: " mail_max_keyword_length = 50 mail_max_lock_timeout = 0 mail_max_userip_connections = 10 mail_never_cache_fields = imap.envelope mail_nfs_index = no mail_nfs_storage = no mail_plugin_dir = /usr/lib64/dovecot mail_plugins = mail_prefetch_count = 0 mail_privileged_group = mail_save_crlf = no mail_server_admin = mail_server_comment = mail_shared_explicit_inbox = no mail_sort_max_read_count = 0 mail_temp_dir = /tmp mail_temp_scan_interval = 1 weeks mail_uid = mail_vsize_bg_after_count = 0 mailbox_idle_check_interval = 30 secs mailbox_list_index = yes mailbox_list_index_include_inbox = no mailbox_list_index_very_dirty_syncs = no maildir_broken_filename_sizes = no maildir_copy_with_hardlinks = yes maildir_empty_new = no maildir_stat_dirs = no maildir_very_dirty_syncs = no managesieve_client_workarounds = managesieve_implementation_string = Dovecot Pigeonhole managesieve_logout_format = bytes=%i/%o managesieve_max_compile_errors = 5 managesieve_max_line_length = 64 k managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext vacation-seconds imapsieve vnd.dovecot.imapsieve master_user_separator = mbox_dirty_syncs = yes mbox_dotlock_change_timeout = 2 mins mbox_lazy_writes = yes mbox_lock_timeout = 5 mins mbox_md5 = apop3d mbox_min_index_size = 0 mbox_read_locks = fcntl mbox_very_dirty_syncs = no mbox_write_locks = fcntl mdbox_preallocate_space = no mdbox_rotate_interval = 0 mdbox_rotate_size = 10 M mmap_disable = no namespace inbox { disabled = no hidden = no ignore_on_failure = no inbox = yes list = yes location = mailbox Drafts { auto = subscribe autoexpunge = 0 autoexpunge_max_mails = 0 comment = driver = special_use = \Drafts } mailbox Junk { auto = subscribe autoexpunge = 0 autoexpunge_max_mails = 0 comment = driver = special_use = \Junk } mailbox Sent { auto = subscribe autoexpunge = 0 autoexpunge_max_mails = 0 comment = driver = special_use = \Sent } mailbox "Sent Messages" { auto = no autoexpunge = 0 autoexpunge_max_mails = 0 comment = driver = special_use = \Sent } mailbox Trash { auto = subscribe autoexpunge = 0 autoexpunge_max_mails = 0 comment = driver = special_use = \Trash } mailbox spam { auto = subscribe autoexpunge = 0 autoexpunge_max_mails = 0 comment = driver = special_use = \Junk } order = 0 prefix = separator = subscriptions = yes type = private } old_stats_carbon_interval = 30 secs old_stats_carbon_name = old_stats_carbon_server = old_stats_command_min_time = 1 mins old_stats_domain_min_time = 12 hours old_stats_ip_min_time = 12 hours old_stats_memory_limit = 16 M old_stats_session_min_time = 15 mins old_stats_user_min_time = 1 hours passdb { args = auth_verbose = default default_fields = deny = no driver = pam master = no mechanisms = name = override_fields = pass = no result_failure = continue result_internalfail = continue result_success = return-ok skip = never username_filter = } plugin { imapsieve_mailbox1_before = file:/var/lib/dovecot/sieve/learn-spam.sieve imapsieve_mailbox1_causes = COPY APPEND FLAG imapsieve_mailbox1_name = spam imapsieve_mailbox2_before = file:/var/lib/dovecot/sieve/learn-ham.sieve imapsieve_mailbox2_causes = COPY imapsieve_mailbox2_from = spam imapsieve_mailbox2_name = * imapsieve_mailbox3_before = file:/var/lib/dovecot/sieve/learn-spam.sieve imapsieve_mailbox3_causes = COPY APPEND FLAG imapsieve_mailbox3_name = Junk imapsieve_mailbox4_before = file:/var/lib/dovecot/sieve/learn-ham.sieve imapsieve_mailbox4_causes = COPY imapsieve_mailbox4_from = Junk imapsieve_mailbox4_name = * quota = fs:user userquota quota_grace = 100M quota_warning = storage=95%% quota-warning 95 %n %d quota_warning2 = storage=90%% quota-warning 90 %n %d quota_warning3 = storage=80%% quota-warning 80 %n %d sieve = file:~/sieve;active=~/.dovecot.sieve sieve_before = /var/lib/dovecot/sieve/before-global.sieve sieve_extensions = +vacation-seconds sieve_global_extensions = +vnd.dovecot.pipe +vnd.dovecot.environment +vnd.dovecot.debug sieve_pipe_bin_dir = /var/lib/dovecot/sieve sieve_plugins = sieve_extprograms sieve_imapsieve sieve_vacation_default_period = 10d sieve_vacation_max_period = 30d sieve_vacation_min_period = 1h } pop3_client_workarounds = pop3_delete_type = default pop3_deleted_flag = pop3_enable_last = no pop3_fast_size_lookups = no pop3_lock_session = no pop3_logout_format = top=%t/%p, retr=%r/%b, del=%d/%m, size=%s pop3_no_flag_updates = no pop3_reuse_xuidl = no pop3_save_uidl = no pop3_uidl_duplicates = allow pop3_uidl_format = %08Xu%08Xv pop3c_features = pop3c_host = pop3c_master_user = pop3c_password = pop3c_port = 110 pop3c_quick_received_date = no pop3c_rawlog_dir = pop3c_ssl = no pop3c_ssl_verify = yes pop3c_user = %u postmaster_address = postmaster@%{if;%d;ne;;%d;%{hostname}} protocols = imap pop3 lmtp sieve quota_full_tempfail = no rawlog_dir = recipient_delimiter = + rejection_reason = Your message to <%t> was automatically rejected:%n%r rejection_subject = Rejected: %s replication_dsync_parameters = -d -N -l 30 -U replication_full_sync_interval = 1 days replication_max_conns = 10 replicator_host = replicator replicator_port = 0 sendmail_path = /usr/sbin/sendmail service aggregator { chroot = . client_limit = 0 drop_priv_before_exec = no executable = aggregator extra_groups = fifo_listener replication-notify-fifo { group = mode = 0600 user = } group = idle_kill = 0 privileged_group = process_limit = 0 process_min_avail = 0 protocol = service_count = 0 type = unix_listener replication-notify { group = mode = 0600 user = } user = $default_internal_user vsz_limit = 18446744073709551615 B } service anvil { chroot = empty client_limit = 0 drop_priv_before_exec = no executable = anvil extra_groups = group = idle_kill = 4294967295 secs privileged_group = process_limit = 1 process_min_avail = 1 protocol = service_count = 0 type = anvil unix_listener anvil-auth-penalty { group = mode = 0600 user = } unix_listener anvil { group = mode = 0600 user = } user = $default_internal_user vsz_limit = 18446744073709551615 B } service auth-worker { chroot = client_limit = 1 drop_priv_before_exec = no executable = auth -w extra_groups = group = idle_kill = 0 privileged_group = process_limit = 0 process_min_avail = 0 protocol = service_count = 0 type = worker unix_listener auth-worker { group = mode = 0600 user = $default_internal_user } user = vsz_limit = 18446744073709551615 B } service auth { chroot = client_limit = 0 drop_priv_before_exec = no executable = auth extra_groups = group = idle_kill = 0 privileged_group = process_limit = 1 process_min_avail = 0 protocol = service_count = 0 type = unix_listener auth-client { group = mode = 0600 user = $default_internal_user } unix_listener auth-login { group = mode = 0600 user = $default_internal_user } unix_listener auth-master { group = mode = 0600 user = } unix_listener auth-userdb { group = mode = 0666 user = $default_internal_user } unix_listener login/login { group = mode = 0666 user = } unix_listener token-login/tokenlogin { group = mode = 0666 user = } user = $default_internal_user vsz_limit = 18446744073709551615 B } service config { chroot = client_limit = 0 drop_priv_before_exec = no executable = config extra_groups = group = idle_kill = 4294967295 secs privileged_group = process_limit = 0 process_min_avail = 0 protocol = service_count = 0 type = config unix_listener config { group = mode = 0600 user = } user = vsz_limit = 18446744073709551615 B } service dict-async { chroot = client_limit = 0 drop_priv_before_exec = no executable = dict extra_groups = group = idle_kill = 0 privileged_group = process_limit = 0 process_min_avail = 0 protocol = service_count = 0 type = unix_listener dict-async { group = $default_internal_group mode = 0660 user = } user = $default_internal_user vsz_limit = 18446744073709551615 B } service dict { chroot = client_limit = 1 drop_priv_before_exec = no executable = dict extra_groups = group = idle_kill = 0 privileged_group = process_limit = 0 process_min_avail = 0 protocol = service_count = 0 type = unix_listener dict { group = $default_internal_group mode = 0660 user = } user = $default_internal_user vsz_limit = 18446744073709551615 B } service director { chroot = . client_limit = 0 drop_priv_before_exec = no executable = director extra_groups = fifo_listener login/proxy-notify { group = mode = 00 user = } group = idle_kill = 4294967295 secs inet_listener { address = haproxy = no port = 0 reuse_port = no ssl = no } privileged_group = process_limit = 1 process_min_avail = 0 protocol = service_count = 0 type = unix_listener director-admin { group = mode = 0600 user = } unix_listener director-userdb { group = mode = 0600 user = } unix_listener login/director { group = mode = 00 user = } user = $default_internal_user vsz_limit = 18446744073709551615 B } service dns-client { chroot = client_limit = 1 drop_priv_before_exec = no executable = dns-client extra_groups = group = idle_kill = 0 privileged_group = process_limit = 0 process_min_avail = 0 protocol = service_count = 0 type = unix_listener dns-client { group = mode = 0666 user = } unix_listener login/dns-client { group = mode = 0666 user = } user = $default_internal_user vsz_limit = 18446744073709551615 B } service doveadm { chroot = client_limit = 1 drop_priv_before_exec = no executable = doveadm-server extra_groups = $default_internal_group group = idle_kill = 0 privileged_group = process_limit = 0 process_min_avail = 0 protocol = service_count = 1 type = unix_listener doveadm-server { group = mode = 0600 user = } user = vsz_limit = 18446744073709551615 B } service health-check { chroot = client_limit = 1 drop_priv_before_exec = yes executable = script -p health-check.sh extra_groups = group = idle_kill = 0 privileged_group = process_limit = 0 process_min_avail = 0 protocol = service_count = 0 type = user = $default_internal_user vsz_limit = 18446744073709551615 B } service imap-hibernate { chroot = client_limit = 0 drop_priv_before_exec = no executable = imap-hibernate extra_groups = group = idle_kill = 0 privileged_group = process_limit = 0 process_min_avail = 0 protocol = imap service_count = 0 type = unix_listener imap-hibernate { group = $default_internal_group mode = 0660 user = } user = $default_internal_user vsz_limit = 18446744073709551615 B } service imap-login { chroot = login client_limit = 0 drop_priv_before_exec = no executable = imap-login extra_groups = group = idle_kill = 0 inet_listener imap { address = haproxy = no port = 143 reuse_port = no ssl = no } inet_listener imaps { address = haproxy = no port = 993 reuse_port = no ssl = yes } privileged_group = process_limit = 0 process_min_avail = 5 protocol = imap service_count = 0 type = login user = $default_login_user vsz_limit = 18446744073709551615 B } service imap-urlauth-login { chroot = token-login client_limit = 0 drop_priv_before_exec = no executable = imap-urlauth-login extra_groups = group = idle_kill = 0 privileged_group = process_limit = 0 process_min_avail = 0 protocol = imap service_count = 1 type = login unix_listener imap-urlauth { group = mode = 0666 user = } user = $default_login_user vsz_limit = 18446744073709551615 B } service imap-urlauth-worker { chroot = client_limit = 1 drop_priv_before_exec = no executable = imap-urlauth-worker extra_groups = $default_internal_group group = idle_kill = 0 privileged_group = process_limit = 1024 process_min_avail = 0 protocol = imap service_count = 1 type = unix_listener imap-urlauth-worker { group = mode = 0600 user = $default_internal_user } user = vsz_limit = 18446744073709551615 B } service imap-urlauth { chroot = client_limit = 1 drop_priv_before_exec = no executable = imap-urlauth extra_groups = group = idle_kill = 0 privileged_group = process_limit = 1024 process_min_avail = 0 protocol = imap service_count = 1 type = unix_listener token-login/imap-urlauth { group = mode = 0666 user = } user = $default_internal_user vsz_limit = 18446744073709551615 B } service imap { chroot = client_limit = 1 drop_priv_before_exec = no executable = imap extra_groups = $default_internal_group group = idle_kill = 0 privileged_group = process_limit = 400 process_min_avail = 0 protocol = imap service_count = 1 type = unix_listener imap-master { group = mode = 0600 user = } unix_listener login/imap { group = mode = 0666 user = } user = vsz_limit = 18446744073709551615 B } service indexer-worker { chroot = client_limit = 1 drop_priv_before_exec = no executable = indexer-worker extra_groups = $default_internal_group group = idle_kill = 0 privileged_group = process_limit = 10 process_min_avail = 0 protocol = service_count = 0 type = worker unix_listener indexer-worker { group = mode = 0600 user = $default_internal_user } user = vsz_limit = 18446744073709551615 B } service indexer { chroot = client_limit = 0 drop_priv_before_exec = no executable = indexer extra_groups = group = idle_kill = 0 privileged_group = process_limit = 1 process_min_avail = 0 protocol = service_count = 0 type = unix_listener indexer { group = mode = 0666 user = } user = $default_internal_user vsz_limit = 18446744073709551615 B } service ipc { chroot = empty client_limit = 0 drop_priv_before_exec = no executable = ipc extra_groups = group = idle_kill = 0 privileged_group = process_limit = 1 process_min_avail = 0 protocol = service_count = 0 type = unix_listener ipc { group = mode = 0600 user = $default_internal_user } unix_listener login/ipc-proxy { group = mode = 0600 user = $default_login_user } user = $default_internal_user vsz_limit = 18446744073709551615 B } service lmtp { chroot = client_limit = 1 drop_priv_before_exec = no executable = lmtp extra_groups = $default_internal_group group = idle_kill = 0 privileged_group = process_limit = 0 process_min_avail = 0 protocol = lmtp service_count = 0 type = unix_listener /var/spool/postfix/private/dovecot-lmtp { group = postfix mode = 01224 user = postfix } unix_listener lmtp { group = mode = 0666 user = } user = vsz_limit = 18446744073709551615 B } service log { chroot = client_limit = 0 drop_priv_before_exec = no executable = log extra_groups = group = idle_kill = 4294967295 secs privileged_group = process_limit = 1 process_min_avail = 0 protocol = service_count = 0 type = log unix_listener log-errors { group = mode = 0600 user = } user = vsz_limit = 18446744073709551615 B } service managesieve-login { chroot = login client_limit = 0 drop_priv_before_exec = no executable = managesieve-login extra_groups = group = idle_kill = 0 inet_listener sieve { address = haproxy = no port = 4190 reuse_port = no ssl = no } privileged_group = process_limit = 0 process_min_avail = 0 protocol = sieve service_count = 1 type = login user = $default_login_user vsz_limit = 18446744073709551615 B } service managesieve { chroot = client_limit = 1 drop_priv_before_exec = no executable = managesieve extra_groups = group = idle_kill = 0 privileged_group = process_limit = 0 process_min_avail = 0 protocol = sieve service_count = 1 type = unix_listener login/sieve { group = mode = 0666 user = } user = vsz_limit = 18446744073709551615 B } service old-stats { chroot = empty client_limit = 0 drop_priv_before_exec = no executable = old-stats extra_groups = fifo_listener old-stats-mail { group = mode = 0600 user = } fifo_listener old-stats-user { group = mode = 0600 user = } group = idle_kill = 4294967295 secs privileged_group = process_limit = 1 process_min_avail = 0 protocol = service_count = 0 type = unix_listener old-stats { group = mode = 0600 user = } user = $default_internal_user vsz_limit = 18446744073709551615 B } service pop3-login { chroot = login client_limit = 0 drop_priv_before_exec = no executable = pop3-login extra_groups = group = idle_kill = 0 inet_listener pop3 { address = haproxy = no port = 110 reuse_port = no ssl = no } inet_listener pop3s { address = haproxy = no port = 995 reuse_port = no ssl = yes } privileged_group = process_limit = 0 process_min_avail = 0 protocol = pop3 service_count = 1 type = login user = $default_login_user vsz_limit = 18446744073709551615 B } service pop3 { chroot = client_limit = 1 drop_priv_before_exec = no executable = pop3 extra_groups = $default_internal_group group = idle_kill = 0 privileged_group = process_limit = 200 process_min_avail = 0 protocol = pop3 service_count = 1 type = unix_listener login/pop3 { group = mode = 0666 user = } user = vsz_limit = 18446744073709551615 B } service quota-warning { chroot = client_limit = 0 drop_priv_before_exec = no executable = script /var/lib/dovecot/quota-warning.sh extra_groups = group = idle_kill = 0 privileged_group = process_limit = 0 process_min_avail = 0 protocol = service_count = 1 type = unix_listener quota-warning { group = dovecot mode = 0666 user = dovecot } user = vsz_limit = 18446744073709551615 B } service replicator { chroot = client_limit = 0 drop_priv_before_exec = no executable = replicator extra_groups = group = idle_kill = 4294967295 secs privileged_group = process_limit = 1 process_min_avail = 0 protocol = service_count = 0 type = unix_listener replicator-doveadm { group = mode = 00 user = $default_internal_user } unix_listener replicator { group = mode = 0600 user = $default_internal_user } user = vsz_limit = 18446744073709551615 B } service stats { chroot = client_limit = 0 drop_priv_before_exec = no executable = stats extra_groups = group = idle_kill = 4294967295 secs privileged_group = process_limit = 1 process_min_avail = 0 protocol = service_count = 0 type = unix_listener stats-reader { group = mode = 0600 user = } unix_listener stats-writer { group = $default_internal_group mode = 0660 user = } user = $default_internal_user vsz_limit = 18446744073709551615 B } service submission-login { chroot = login client_limit = 0 drop_priv_before_exec = no executable = submission-login extra_groups = group = idle_kill = 0 inet_listener submission { address = haproxy = no port = 587 reuse_port = no ssl = no } privileged_group = process_limit = 0 process_min_avail = 0 protocol = submission service_count = 1 type = login user = $default_login_user vsz_limit = 18446744073709551615 B } service submission { chroot = client_limit = 1 drop_priv_before_exec = no executable = submission extra_groups = $default_internal_group group = idle_kill = 0 privileged_group = process_limit = 1024 process_min_avail = 0 protocol = submission service_count = 1 type = unix_listener login/submission { group = mode = 0666 user = } user = vsz_limit = 18446744073709551615 B } shutdown_clients = yes ssl = yes ssl_alt_cert = ssl_alt_key = ssl_ca = ssl_cert = </etc/pki/dovecot/certs/dovecot.pem ssl_cert_username_field = commonName ssl_cipher_list = PROFILE=SYSTEM ssl_cipher_suites = ssl_client_ca_dir = ssl_client_ca_file = ssl_client_cert = ssl_client_key = ssl_client_require_valid_cert = yes ssl_crypto_device = ssl_curve_list = ssl_dh = ssl_key = # hidden, use -P to show it ssl_key_password = ssl_min_protocol = TLSv1.2 ssl_options = ssl_prefer_server_ciphers = no ssl_require_crl = yes ssl_verify_client_cert = no state_dir = /var/lib/dovecot stats_http_rawlog_dir = stats_writer_socket_path = stats-writer submission_client_workarounds = submission_host = submission_logout_format = in=%i out=%o submission_max_mail_size = 0 submission_max_recipients = 0 submission_relay_command_timeout = 5 mins submission_relay_connect_timeout = 30 secs submission_relay_host = submission_relay_master_user = submission_relay_max_idle_time = 29 mins submission_relay_password = submission_relay_port = 25 submission_relay_rawlog_dir = submission_relay_ssl = no submission_relay_ssl_verify = yes submission_relay_trusted = no submission_relay_user = submission_ssl = no submission_timeout = 30 secs syslog_facility = mail userdb { args = auth_verbose = default default_fields = driver = passwd name = override_fields = result_failure = continue result_internalfail = continue result_success = return-ok skip = never } valid_chroot_dirs = verbose_proctitle = no verbose_ssl = no version_ignore = no protocol lmtp { mail_plugins = " sieve" userdb { args = username_format=%n /etc/passwd driver = passwd-file name = } } protocol imap { mail_plugins = " imap_quota imap_sieve quota" } local_name sub.domain.tld { ssl_cert = </etc/pki/dovecot/certs/sub.domain.tld.pem ssl_key = # hidden, use -P to show it } local_name othersub.domain.tld { ssl_cert = </etc/dovecot/cert.othersub.domain.tld.pem ssl_key = # hidden, use -P to show it } ############################# /etc/passwd ############################# test@s32.someteststring.ml:x:14127:3625:fsadf:/home/s32/homes/test:/dev/null test-s32.someteststring.ml:x:14127:3625:fsadf:/home/s32/homes/test:/dev/null ############################# /etc/postfix/virtual ############################# test(a)s32.someteststring.ml test-s32.someteststring.ml #############################

1 0

submissiond xoauth2 authentication: line too long
by Tobias Florek 04 Jan '23

04 Jan '23

Hi, I am running the latest container image which has dovecot-submissiond 2:2.3.20-3+debian11 I am running into the following problem. I have successfully set up xoauth2 for IMAP and ManageSieve. Now when roundcube tries to send email to submissiond it fails with 500 5.5.2 Line too long This happens right after roundcube sends AUTH XOAUTH2 dXNlcj10ZkBzY2hhZWZmZXItYWcu[...] (a line of length 2149 characters). Reading RFC 4954, section 4 I suppose that this does not look standard compliant. Am I correct? I will raise this issue with roundcube as well. Cheers, Tobi

1 1

CRAM MD5 passwd db permission issue
by Gerben Wierda 04 Jan '23

04 Jan '23

I am busy migrating. I am moving from macOS+MacPorts to Ubuntu+Docker On the old system, I have this in the dovecot config: mail_uid = _dovecot mail_gid = mail mail_privileged_group = mail mail_access_groups = mail This seems weird to me, I think the dovecot user should be in group dovecot only if I understand the docs. On the old system dovecot, postfix, dovenull and rspamd are all members of the mail group. On that system, the cram md5 passwd database (file) has these permissions: drwxr-xr-x 3 root wheel 96 Feb 2 2021 . drwxr-xr-x 22 root admin 704 Jan 4 15:17 .. -rw-r----- 1 root mail 1234 Feb 2 2021 cram-md5.pwd and that has worked like that for many years, basically starting with Mac OS X Server, surviving all kinds of macOS migrations. On my new Ubuntu system I've copied this setup over: drwxr-xr-x 2 root root 4096 Jan 4 09:49 . drwxr-xr-x 7 root root 4096 Jan 4 15:21 .. -rw-r----- 1 root mail 1234 Feb 2 2021 cram-md5.pwd mail_uid = dovecot mail_gid = mail mail_privileged_group = mail mail_access_groups = mail But: Jan 04 15:40:08 auth: Error: passwd-file /etc/dovecot/etc/cram-md5.pwd:open(/etc/dovecot/etc/cram-md5.pwd) failed: Permission denied (euid=91(dovecot) egid=91(dovecot) missing +r perm: /etc/dovecot/etc/cram-md5.pwd, we're not in group 8(mail), dir owned by 0:0 mode=0755) And really, dovecot is in group mail. From /etc/group: mail:x:8:postfix,dovecot dovenull:x:90: dovecot:x:91: And from /etc/passwd: dovenull:x:90:90::/home/dovenull:/usr/sbin/nologin dovecot:x:91:91::/home/dovecot:/usr/sbin/nologin So, that I get this error baffles me. Gerben Wierda (LinkedIn <https://www.linkedin.com/in/gerbenwierda>) R&A IT Strategy <https://ea.rna.nl/> (main site) Book: Chess and the Art of Enterprise Architecture <https://ea.rna.nl/the-book/> Book: Mastering ArchiMate <https://ea.rna.nl/the-book-edition-iii/>

2 1

doveadm proxy list has strange entries
by Tobias Florek 02 Jan '23

02 Jan '23

Hi! I am using dovecot from the latest docker image: Version 2:2.3.20-3+debian11 When getting the proxy list I get the following entries. # doveadm -f flow proxy list username=user(a)example.com proto=imap src ip=10.254.0.13 dest ip=172.23.6.194 port=143 username=username proto=service src ip=src-ip dest ip=dest-ip port=dest-port username=user2(a)example.com proto=imap src ip=10.254.0.13 dest ip=172.23.6.194 port=143 username=username proto=service src ip=src-ip dest ip=dest-ip port=dest-port username=user3(a)example.com proto=imap src ip=10.254.0.13 dest ip=172.23.6.194 port=143 username=username proto=service src ip=src-ip dest ip=dest-ip port=dest-port ... These correspond to the http API's response: # curl -H "Authorization: X-Dovecot-API $(echo -n MY_API_KEY|base64 -w0)" http://localhost:8080/doveadm/v1 -H "Content-Type: application/json" -d '[["proxyList",{},"tag1"]]' | jq [ [ "doveadmResponse", [ { "username": "user(a)example.com", "service": "imap", "src-ip": "10.254.0.13", "dest-ip": "172.23.6.194", "dest-port": "143" }, { "username": "username", "service": "service", "src-ip": "src-ip", "dest-ip": "dest-ip", "dest-port": "dest-port" }, ... ], "tag1" ] ] This does not look right. Cheers, Tobias Florek

3 2

Error: Failed to get quota resource STORAGE: quota-fs: quotactl(Q_GETQUOTA, NFS:/home) failed: No such file or directory
by Jorge Concha C. 01 Jan '23

01 Jan '23

Hello everyone, I'm migrating my dovecot (imap) server from CentOS-6 to RockyLinux-9, but I can't get the QUOTA-FS plugin to work. When trying the "doveadm quota get -u user" command, it returns an error "doveadm(user): Error: Failed to get quota resource STORAGE: quota-fs: quotactl(Q_GETQUOTA, nfs:/home) failed: No such file or directory" If the user has his "$home" on a local drive, everything works fine, but if the user has his $home on a nfs-filesystem, it throws that error. On CentOS-6, everything works fine, with the same users on the same nfs-filesystem. I don't know if it is the product of the OS change or the dovecot version change. CentOS6 -> Dovecot 2.2.10 RockyLinux-9 -> Dovecot 2.3.16 Does anyone have any ideas? Thanks -- Jorge Concha C. Área de Sistemas - CEC U. de Chile

3 12

Iteration failure on passwd-file when listing all users?
by EML 31 Dec '22

31 Dec '22

Dovecot 2.3.16, Ubuntu 22.04. I'm trying to get a list of all dovecot users, on a simple test setup on my local network (which "works", in that I can get IMAP mails from dovecot): passdb { driver = passwd-file args = /var/mail/vhosts/%d/shadow } userdb { driver = passwd-file args = /var/mail/vhosts/%d/passwd } The command 'doveadm user -u foo(a)example.com' correctly shows that user. However, any attempt to wildcard the user fails: # doveadm user -u *(a)example.com Error: auth-master: userdb list: User listing returned failure Fatal: user listing failed The log file shows Error: conn unix:auth-worker (pid=13471,uid=129): auth-worker<1>: passwd-file(*(a)example.com): passwd-file: User iteration isn't currently supported with %variable paths Any ideas? And, if I can get this to work, is this method any better than just reading /var/mail/vhosts/example.com/passwd and extracting the first field to get the user name? Or just finding all the maildir directories in /var/mail/vhosts/example.com? Thanks. If you're interested, I'm doing this so that I can automate postfix setup (by mapping new addresses to known dovecot users in the postfix virtual mailbox file). The vmailbox file might look like: # 'user1' is a known dovecot user foo(a)example.com example.com/user1

3 6

Permissions issue with doveadm mailbox command
by James Moe 31 Dec '22

31 Dec '22

I have been exploring dovecot and came across this: $ sudo doveadm mailbox list doveadm(root): Error: Mail access for users with UID 303 not permitted (see first_valid_uid in config file, uid from mail_uid setting). Hmm. After setting "first_valid_uid = 300": $ sudo doveadm mailbox list doveadm(root)<4380><4VP8EENer2McEQAAvbJltg>: Error: chdir(/root/) failed: Permission denied (euid=303(vmail) egid=303(vmail) missing +x perm: /root, dir owned by 0:0 mode=0700) INBOX I do not understand the error message. The current configuration. (Note I have changed first_valid_uid to its original value.) $ postconf -n # 2.3.15 (0503334ab1): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.15 (e6a84e31) # OS: Linux 5.14.21-150400.24.33-default x86_64 btrfs # Hostname: sma-server3.sma.com auth_mechanisms = plain login base_dir = /var/run/dovecot/ debug_log_path = /data01/var/log/dovecot/dovecot-debug.log disable_plaintext_auth = no first_valid_uid = 1001 info_log_path = /data01/var/log/dovecot/dovecot-info.log log_path = /data01/var/log/dovecot/dovecot.log log_timestamp = %Y-%m-%dT%H:%M:%S mail_gid = vmail mail_location = maildir:/var/mail/vmail/%u/ mail_uid = vmail managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } passdb { driver = pam } passdb { args = /etc/dovecot/dovecot-sql.conf.ext driver = sql } plugin { sieve = file:~/sieve;active=~/.dovecot.sieve } protocols = imap service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0660 user = postfix } } service log { group = users user = dovecot } ssl = no ssl_cipher_list = ALL:!aNULL:!eNULL:!EXPORT:!DES:!3DES:!MD5:!PSK:!RC4:!ADH:!LOW@STRENGTH ssl_options = no_compression ssl_prefer_server_ciphers = yes userdb { driver = passwd } userdb { args = /etc/dovecot/dovecot-sql.conf.ext driver = sql } -- James Moe moe dot james at sohnen-moe dot com 520.743.3936 Think.

2 1

Permissions for dovecot logging
by James Moe 31 Dec '22

31 Dec '22

dovecot 2.3.15 opensuse LEAP 15.4 I changed logging to use a path rather than syslog. Doing so makes it easier to work with fail2ban. Dovecot fails to start with the error: Can't open log file /data01/var/log/dovecot.log: Permission denied Permissions: drwxrwxr-x 1 root users 104 Feb 25 2018 /data01/ drwxrwxr-x 1 sma-user3x users 102 Dec 17 14:50 /data01/var/ drwxrwxr-x 1 sma-user3x users 146 Dec 27 15:37 /data01/var/log/ drwxrwxr-x 1 dovecot users 22 Dec 27 15:47 /data01/var/log/dovecot/ "dovecot" is a member of "users". What "permission" am I missing? Note: A long time ago I had a problem with programs consuming all available space on the system disk with log or backup files. I have since gotten in the habit of putting log files on a non-system disk. -- James Moe moe dot james at sohnen-moe dot com 520.743.3936 Think.

4 6

Self hosting solution for Christmas
by Andre Rodier 29 Dec '22

29 Dec '22

Hello everyone, Here my present for Christmas: a new version of HomeBox, the self hosted email solution. Feel free to drop comments, create issues, update the docs, etc. I released this quickly before going on vacation, so you may find some issues. However, this is mostly stable, and the code is easy to modify. Also, you can now add and remove components individually, with an Ansible playbook. https://github.com/progmaticltd/homebox System installation and features - Custom Debian installer generation with full disk encryption and fully automatic installation. - Unlock the system upon boot by entering the passphrase through SSH. - Install packages only from Debian stable (Bullseye). - Automatic letsencrypt certificates generation using Lego and DNS challenge. - Automatic security updates (optional). - Centralised authentication with an LDAP users database, SSL certificate, password policies, PAM integration. - AppArmor activated with a profile for all daemons. - XKCD Random passwords generated and saved into pass (or on file system). - Can be used at home, on a dedicated or virtual server hosted online. - Flexible IP address support: IPv4 only, IPv6 only, and IPv4+IPv4 or IPv4+IPv6. - Embedded DNS server, with CAA, DNSSEC and SSHFP (SSH fingerprint) support. - Grade A https sites, HSTS implemented by default. - Automatic configuration of OpenPGP Web Key Directory. - Automatic firewall rules for inbound, outbound and forwarding traffic, using nftables. - Restricted outbound web sites access to the minimum. - Automatic update of DNS keys, DNS servers and glue records on Gandi. Emails - Postfix configuration and installation, with LDAP lookups, internationalised email aliases, fully SSL compliant. - Generate DKIM keys, SPF and DMARC DNS records. The DKIM keys are generated every year. - Automatic copy of sent emails into the sent folder. - Automatic creation of the postmaster account and special email addresses using RFC 2142 specifications. - Dovecot configuration, IMAPS, POP3S, Quotas, ManageSieve. - Simple spam and ham learning by moving emails in and out the Junk folder - Sieve and vacation scripts. - Virtual folders for server search: unread messages, conversations view, all messages, flagged and messages labelled as "important". - Email addresses with recipient delimiter included, e.g. john.doe+lists(a)dbcooper.com. - Optional master user creation, e.g. for families with children or moderated communities. - Server side full text search inside emails, attached documents and files and compressed archives, with better results than GMail. - SOGo webmail with sieve filters management, password change form, Calendar and Address book management, GUI to import other account emails. - Powerful and light antispam system with rspamd and optional access to the web interface. - Antivirus for inbound and outbound emails with clamav (optional). - Automatic configuration for Thunderbird and Outlook using published XML and other clients with special DNS records (RFC 6186). Calendar and Address book - Install and configure a CalDAV / CardDAV server, with automatic discovery (RFC 6186). - Groupware functionality in a web interface, with SOGo. - Recurring events, email alerts, shared address books and calendars. - Mobile devices compatibility: Android, Apple iOS, BlackBerry 10 and Windows mobile through Microsoft ActiveSync. Other optional features - Incremental backups, encrypted, on multiple destination (SFTP, S3, Samba share or USB drive), with email and Jabber reporting. - Jabber server, using ejabberd, with LDAP authentication, direct or offline file transfer and optional server to server communication. - Static web site skeleton configuration, with https certificates and A+ security grade by default. Development - YAML files validation on each commit, using travis-ci. - End to end integration tests for the majority of components. - Playbooks to facilitate the installation or removal of development packages. - Global debug flag to activate the debug mode of all components. - Fully open source Ansible scripts licensed under GPLv3. Merry Christmas, André

4 7

Sieve duplicates
by Ferenc 28 Dec '22

28 Dec '22

Hi list, I’m trying this again from a different account because of lots of SPF warnings. I have Sieve scripts that duplicate e-mails. I don’t want that. My dovecot version is 2.3.4.1 (f79e8e7e4), Pigeonhole version 0.5.4 on Linux 5.4.189-2-pve x86_64 Debian 10.13. My scripts get called on an imap COPY action (imapsieve extension). The mail is fed to an external script (spam/ham training or retraining) via a pipe :copy action (vnd.dovecot.pipe extension). An header is added to keep track of what happened (editheader extension). I use "if header :contains” for my (simple) logic. If contains header X, do this, add header Y. If contains header Y, do that, add header X. I end each "if” part with “keep;" and “stop;” commands. Simple versions of the scripts, without the if-then construct, seem to work ok with imapsieve. As soon as I try to use if-then-else I find a duplicate of the processed e-mail; the original mail seems to be untouched, the duplicate appears to have been processed. With macos mail not all duplicates show up but with Roundcube webmail I can see them all. The scripts are like this: # without if-then require … pipe :copy … addheader … keep; # with if-then require … if header :contains pipe :copy … addheader … keep; stop; if not exists pipe :copy … addheader … keep; stop; keep; The scripts get called from “imapsieve_mailbox1_before” for example. Cheers, Ferenc

2 2

Dovecot v2.3.20 released
by Aki Tuomi 28 Dec '22

28 Dec '22

We are pleased to release v2.3.20 of Dovecot. https://dovecot.org/releases/2.3/dovecot-2.3.20.tar.gz https://dovecot.org/releases/2.3/dovecot-2.3.20.tar.gz.sig Binary packages in https://repo.dovecot.org/ Docker images in https://hub.docker.com/r/dovecot/dovecot Regards, Aki Tuomi Open-Xchange oy -- + Add dsync_features=no-header-hashes. When this setting is enabled and one dsync side doesn't support mail GUIDs (i.e. imapc), there is no fallback to using header hashes. Instead, dsync assumes that all mails with identical IMAP UIDs contains the same mail contents. This can significantly improve dsync performance with some IMAP servers that don't support caching Date/Message-ID headers. + lua: HTTP client has more settings now, see https://doc.dovecot.org/admin_manual/lua/#dovecot.http.client + replicator: "doveadm replicator status" command now outputs when the next sync is expected for the user. - LAYOUT=index: duplicate GUIDs were not cleaned out. Also the list recovery was not optimal. - auth: Assert crash would occur when iterating multiple userdb backends. - director: Logging into director using master user with auth_master_user_separator character redirected user to a wrong backend, unless master_user_separator setting was also set to the same value. Merged these into auth_master_user_separator. - dsync: Couldn't always fix folder GUID conflicts automatically with Maildir format. This resulted in replication repeatedly failing with "Remote lost mailbox GUID". - dsync: Failed to migrate INBOX when using namespace prefix=INBOX/, resulting in "Remote lost mailbox GUID" errors. - dsync: INBOX was created too early with namespace prefix=INBOX/, resulting a GUID conflict. This may have been resolved automatically, but not always. - dsync: v2.3.18 regression: Wrong imapc password with dsync caused Panic: file lib-event.c: line 506 (event_pop_global): assertion failed: (event == current_global_event) - imapc: Requesting STATUS for a mailbox with imapc and INDEXPVT configured did not return correct (private) unseen counts. - lib-dict: Process would crash when committing data to redis without dict proxy. - lib-mail: Corrupted cached BODYSTRUCTURE caused panic during FETCH. Fixes: Panic: file message-part-data.c: line 579 (message_part_is_attachment): assertion failed: (data != NULL). v2.3.13 regression. - lib-storage: mail_attribute_dict with dict-sql failed when it tried to lookup empty dict keys. - lib: ioloop-kqueue was missing include breaking some BSD builds. - lua-http: Dovecot Lua HTTP client could not resolve DNS names in mail processes, because it expected "dns-client" socket to exist in the current directory. - oauth2: Using %{oauth2:name} variables could cause useless introspections. - pop3: Sending POP3 command with ':' character caused an assert-crash. v2.3.18 regression. - replicator: Replication queue had various issues, potentially causing replication requests to become stuck. - stats: Invalid Prometheus label names were created with specific

5 7

Happy Holidays From SCOM.CA Internet Services Inc.
by Paul Kudla 23 Dec '22

23 Dec '22

1 0

Pigeonhole v0.5.20 released
by Aki Tuomi 22 Dec '22

22 Dec '22

We are pleased to release v0.5.20 of Pigeonhole. https://pigeonhole.dovecot.org/releases/2.3/dovecot-2.3-pigeonhole-0.5.20.t… https://pigeonhole.dovecot.org/releases/2.3/dovecot-2.3-pigeonhole-0.5.20.t… Binary packages in https://repo.dovecot.org/ Docker images in https://hub.docker.com/r/dovecot/dovecot Regards, Aki Tuomi Open-Xchange oy -- * No changes - release done to keep version numbers synced.

1 0

OT: Two simultaneous POP3 connections from Outlook
by kjohnson＠eclypse.org 21 Dec '22

21 Dec '22

Hello, I recognize this may be somewhat off-topic, but my search-fu has failed to provide useful results, so I ask for pointers to further information. Today, while examining Dovecot logs, I found a case where the Outlook mail client (probably 2016 or later) on a user's computer opened two simultaneous, or at least overlapping, POP3 connections to Dovecot. This did not go well, naturally. Warning: Transaction log file .../mail/.imap/INBOX/dovecot.index.log was locked for 156 seconds (rotating while syncing) If anyone else has found useful information about this peculiar behavior for an email client, I would be pleased to receive a pointer in that direction. Thank you. Ken

2 1

How is URLAUTH broken, and for how long?
by Andy Balholm 21 Dec '22

21 Dec '22

The documentation for imap_urlauth_host says: > Warning > > URLAUTH in current versions of Dovecot is broken in several ways. > This will be fixed in the future, but activating URLAUTH support > on production systems is not recommended. In what ways is it broken? Is anyone actually working on fixing it? Andy

1 0

Re: SPF DNS Error / R_SPF_DNSFAIL
by Jochen Bern 20 Dec '22

20 Dec '22

On 19.12.22 13:20, Carlos Mogas da Silva wrote: > On Mon, 2022-12-19 at 12:38 +0100, Benny Pedersen wrote: >> Carlos Mogas da Silva skrev den 2022-12-19 11:57: >>> What can cause this error and/or how can I debug it? >> >> try avoid to many dns querys > > Even on a caching dns server? Any ideas on why it is failing? I don't remember it being in an actual RFC, but SPF records are supposed to not require more than 10 DNS queries to fully resolve. https://dmarcian.com/spf-survey/ gives cttexpresso.pt an all-green result, but notes that the "+a:email.reditus.pt" part is inoperational ("no A or AAAA RRs found", in fact, I'm getting an NXDOMAIN for the FQDN). Regards, -- Jochen Bern Systemingenieur Binect GmbH

1 0

SPF DNS Error / R_SPF_DNSFAIL
by Carlos Mogas da Silva 20 Dec '22

20 Dec '22

Hi list. My incoming messages are getting R_SPF_DNSFAIL and an error on the Authentication-Results header: spf=temperror (mail01.r3pek.org: error in processing during lookup of no-reply(a)cttexpresso.pt: DNS error) I see the DNS request on my DNS server and a "working" reply going out. What can cause this error and/or how can I debug it?

4 6

mail filters
by mick.crane 20 Dec '22

20 Dec '22

I'm using what ever is in Debian Bookworm, I'm pretty sure. These filters? I collect from different email addresses like gmail and that. If filter for the "Sent to" email address, move to this directory If "From" contains "blah", move to this other directory. If something is Sent to and also From contains "blah" then I get 2 copies of the message in both filter directories. How can I fix this? regards mick

5 6

feature request: add base64 variable modifier
by alex 19 Dec '22

19 Dec '22

Hi, It would be very convenient to have a base64 variable modifier. Main use-case is to base64-encode passwords when changing your hashing scheme. With a base64 encoding modifier (e.g. %B) something like this would safely work: userdb { driver = prefetch default_fields = plain_pass=%Bw } without things breaking when there are %-characters in the password, and without having to send the plaintext password to the database, as current solutions propose, which is never a good idea. alternative solution: adapt the generic hash-modifier to accept a none/plaintext hashing-scheme and use the base64 output functionality that is already available there. Thanks! Alex

1 0

What do I do with the ".ext?"
by James Moe 18 Dec '22

18 Dec '22

dovecot 2.3.15 opensuse LEAP 15.4 I am installing dovecot and have postfix as the SMTP agent. It also needs to use a MySQL database. In </etc/dovecot> there is the main dovecot.conf file, and a number of other files with the extension ".conf.ext." It is not clear how to use these. I could nothing in the documentation that discusses it. Do I copy one, say dovecot-sql.conf.ext, modify it: - rename the copy without the ".ext?" - or move the copy to the "conf.d" directory, with or without the "ext?" -- James Moe moe dot james at sohnen-moe dot com 520.743.3936 Think.

2 2

2.3.14: stale imap-login processes due to bogus user setup tying up process limit
by Volker Stolz 16 Dec '22

16 Dec '22

I just dealt with an interesting Dovecot issue on our small server, and thought I might share it. I also feel that although in the end it was a configuration error, Dovecot should somehow avoid leaving this processes around and hence filling up the process limit quickly. - set up Dovecot IMAP on Debian buster (either with the older 2.3.x Debian package, or 2.3.14 from the dovecot-repo) - config: ... namespace inbox { inbox = yes location = ... default settings ... ... passdb { args = scheme=HMAC-MD5 username_format=%u /etc/dovecot/users driver = passwd-file } protocols = " imap" ... userdb { args = blocking=no driver = passwd } ... - secret sauce: have a user in the passdb that doesn't have a physical account on the system yet (we were migrating to a new machine). The log-file shows successful authentication for that user (after we flipped DNS to point to this new machine), but over time (2-3 times/day) we were left with an increasing number of `imap-login` processes in state `pre-login`, eventually requiring a dovecot restart. Dialling up process_limits didn't seem to help, we'd just get more of these stale processes. After creating the user on the system, the behaviour reverted to normal, no more stale processes. I do not know what error message that user received on their end, but since we announced we were migrating, they probably just ignored it and thought it as part of the transition. Best, Volker (a happy & long Dovecot user)

3 4

Re: Can't figure out why managesieve (pigeonhole) can't connect
by colin＠colinlikesfood.com 15 Dec '22

15 Dec '22

thank you again. it seems you have seen my paste of config.inc.php. I do not have a config.php: my_user@some_host:/usr/local/www/roundcube/config # ls -l total 67 -rw-r--r-- 1 root wheel 164 Jul 23 15:17 .htaccess -rw-r--r-- 1 root wheel 1867 Nov 22 15:12 config.inc.php -rw-r--r-- 1 root wheel 2943 Jul 23 15:17 config.inc.php.sample -rw-r--r-- 1 root wheel 63790 Oct 29 20:24 defaults.inc.php -rw-r--r-- 1 root wheel 2806 Jul 23 15:17 mimetypes.php my_user@some_host:/usr/local/www/roundcube/config # I have tried changing tls:// to ssl:// and back again (in the line $config['managesieve_host'] = 'tls://obfuscated.domain';) but the error remains the same: roundcube: PHP Error: Connection refused (GET /index.php?_task=settings&_action=plugin.managesieve) roundcube: PHP Error: Unable to connect to managesieve on obfuscated.domain:4190 in /usr/local/www/roundcube/plugins/managesieve/lib/Roundcube/rcube_sieve_engine.php on line 221 (GET /index.php?_task=settings&_action=plugin.managesieve) roundcube: PHP Error: Not currently in AUTHORISATION state (GET /index.php?_task=settings&_action=plugin.managesieve) php: PHP Error: Not currently connected (GET /index.php?_task=settings&_action=plugin.managesieve) roundcube: PHP Error: Connection refused (GET /index.php?_task=settings&_action=plugin.managesieve-action&_framed=1&_nav=hide) roundcube: PHP Error: Unable to connect to managesieve on obfuscated.domain:4190 in /usr/local/www/roundcube/plugins/managesieve/lib/Roundcube/rcube_sieve_engine.php on line 221 (GET /index.php?_task=settings&_action=plugin.managesieve-action&_framed=1&_nav=hide) php: PHP Error: Not currently connected (GET /index.php?_task=settings&_action=plugin.managesieve-action&_framed=1&_nav=hide) roundcube: PHP Error: Connection refused (POST /?_task=settings&_action=plugin.managesieve-save) roundcube: PHP Error: Unable to connect to managesieve on obfuscated.domain:4190 in /usr/local/www/roundcube/plugins/managesieve/lib/Roundcube/rcube_sieve_engine.php on line 221 (POST /?_task=settings&_action=plugin.managesieve-save) i don't understand why it can't connect, this seems to work fine: # gnutls-cli --tofu --starttls -p 4190 10.0.0.91 Processed 142 CA certificate(s). Resolving '10.0.0.91:4190'... Connecting to '10.0.0.91:4190'... - Simple Client Mode: "IMPLEMENTATION" "dovecot" "SIEVE" "fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext" "NOTIFY" "mailto" "SASL" "CRAM-MD5" "STARTTLS" "VERSION" "1.0" OK "Dovecot ready." STARTTLS OK "Begin TLS negotiation now." *** Starting TLS handshake - Certificate type: X.509 - Got a certificate list of 3 certificates. - Certificate[0] info: - subject `CN=obfuscated.domain.com', issuer `CN=R3,O=Let's Encrypt,C=US', serial xxxxxxxxxxxxxxxxxxxxxx, RSA key 2048 bits, signed using RSA-SHA256, activated `yyyy-mm-dd 17:48:15 UTC', expires `yyyy-mm-dd 17:48:14 UTC', pin-sha256="xxxxxxxxxxxxxxxxxxxxxx" Public Key ID: sha1:xxxxxxxxxxxxxxxxxxxxxx sha256:xxxxxxxxxxxxxxxxxxxxxx Public Key PIN: pin-sha256:xxxxxxxxxxxxxxxxxxxxxx - Certificate[1] info: - subject `CN=R3,O=Let's Encrypt,C=US', issuer `CN=ISRG Root X1,O=Internet Security Research Group,C=US', serial xxxxxxxxxxxxxxxxxxxxxx, RSA key 2048 bits, signed using RSA-SHA256, activated `yyyy-mm-dd 00:00:00 UTC', expires `yyyy-mm-dd 16:00:00 UTC', pin-sha256="xxxxxxxxxxxxxxxxxxxxxx" - Certificate[2] info: - subject `CN=ISRG Root X1,O=Internet Security Research Group,C=US', issuer `CN=DST Root CA X3,O=Digital Signature Trust Co.', serial yyyy-mm-dd, RSA key 4096 bits, signed using RSA-SHA256, activated `yyyy-mm-dd 19:14:03 UTC', expires `yyyy-mm-dd 18:14:03 UTC', pin-sha256="xxxxxxxxxxxxxxxxxxxxxx" - Status: The certificate is NOT trusted. The name in the certificate does not match the expected. *** PKI verification of server certificate failed... Host 10.0.0.91 (sieve) has never been contacted before. Its certificate is valid for 10.0.0.91. Are you sure you want to trust it? (y/N): y - Description: (TLS1.3-X.509)-(ECDHE-SECP256R1)-(RSA-PSS-RSAE-SHA256)-(AES-256-GCM) - Session ID: xx:yy:xx:yy:xx:yy... - Options: "IMPLEMENTATION" "dovecot" "SIEVE" "fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext" "NOTIFY" "mailto" "SASL" "CRAM-MD5" "VERSION" "1.0" OK "TLS negotiation successful." On 2022-11-23 13:35, Yassine Chaouche wrote: > also make sure your are editing config.php and not config.inc.php > (which you pasted) > > Yassine. > > Le 23 novembre 2022 8:30:36 PM GMT+01:00, Yassine Chaouche > <a.chaouche(a)algerian-radio.dz> a écrit : > >> good. we have established that the problem shouldn't be on dovecot's >> side. i suspect roundcube is misconfigured or can't connect for some >> reason. I believe someone mentioned SSL and TLS support problem in RC >> for a specific version? can you try without? also can you paste RC >> config? >> >> Yassine.

5 6

Kerberos/GSSAPI auth weirdness?
by r3pek 14 Dec '22

14 Dec '22

Hi list! I'm migrating my server into a new REALM (INT.R3PEK.ORG) from an old one (R3PEK.ORG) This is a completely new install and configuration, so no leftovers exits. The machine is correctly register into the REALM and users are able to login without a problem. Now, when I try to login using a Kerberos ticket, for some reason that I can't understand, dovecot is looking for a ticket on the old REALM. Maybe because of the email domain (which stayed the same)? This is the error message I see on the clients: "Failed to authenticate: Server krbtgt/R3PEK.ORG(a)INT.R3PEK.ORG" The one it should be looking for is krbtgt/INT.R3PEK.ORG(a)INT.R3PEK.ORG, but I can't seem to figure out where the problem is. # doveconf | grep -i realm auth_default_realm = INT.R3PEK.ORG auth_realms = INT.R3PEK.ORG What do I need to change to make this work?

1 0

sasl service for other app
by Henry R 13 Dec '22

13 Dec '22

can dovecot run as a general sasl service for other apps? such as webdav. Thanks.

6 10

Backups
by Doug Hardie 11 Dec '22

11 Dec '22

I started to investigate using doveadm backup to backup my mail system. I have a small number of users and the mail store is not large. It uses maildir format. I setup a test system that is not connected to the internet and started up dovecot. I used the following command to backup one user: doveadm backup -u ben remote:test ben is the user is in the mail store. Test is the actual server name. That worked just fine. The maildir was copied completely (as best as I can tell with ls). Then I tried the second user: doveadm backup -u jean remote:test This gives 2 error messages: doveadm(jean)[]<McRYOFI0jGN1MwAAmC+70w>: Error: Mailbox INBOX: Failed to get attribute vendor/vendor.dovecot/pvt/server/sieve/files/.dovecot: Mailbox attributes not enabled doveadm(jean)[]<0IwxIlI0jGMgUwAAZU03Dg>: Error: Remote command returned error 65: ssh test doveadm dsync-server -ujean -U In addition, the maildir directories are created, but there are no emails in any of them (e.g., cur). What is the problem with the 2nd and why does it behave differently from the first? -- Doug

4 8

Sieve duplicates
by Ferenc 09 Dec '22

09 Dec '22

Hi list, I have Sieve scripts that unintentionally duplicate e-mails. My dovecot version is 2.3.4.1 (f79e8e7e4), Pigeonhole version 0.5.4 on Linux 5.4.189-2-pve x86_64 Debian 10.13. My scripts get called on an imap COPY action (imapsieve extension). The mail is fed to an external script (spam/ham training) via a pipe :copy action (vnd.dovecot.pipe extension). An header is added to keep track of what happened (editheader extension). I use "if header :contains” for my (simple) logic. If contains header X, do this, add header Y. If contains header Y, do that, add header X. I end each "if” part with keep; and stop; commands. Simple versions of this script, without the if-then construct, seem to work ok. As soon as I try to use if-then-else I find a duplicate of the processed e-mail; one that seems to be untouched, one that appears to have been processed. I hope I’m making myself clear… # without if-then require … pipe :copy … addheader … keep; # with if-then require … if header :contains pipe :copy … addheader … keep; stop; if not exists pipe :copy … addheader … keep; stop; keep; The scripts get called from for instance imapsieve_mailbox1_before. Cheers, Ferenc

1 0

Seen Flags per User
by Maurice Kunze 08 Dec '22

08 Dec '22

Hello, i want to configure seen flags per user for shared public mailboxes in dovecot. I have added the INDEVPVT Option to the location parameter in the namespace and restarted the services and the server. Unfortunately nothing changed and there are still global seen flags in the configuration. In a post i read that i have to manually add some files to the location but this isnt specified in the documentation. below is the version we use and the config. dovecot --version 2.3.13 (89f716dc2) dovecot -n # 2.3.13 (89f716dc2): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.13 (cdd19fe3) # OS: Linux 5.10.0-17-amd64 x86_64 Debian 11.4 ext4 # Hostname: <SERVERNAME> auth_debug = yes auth_debug_passwords = yes auth_verbose = yes auth_verbose_passwords = plain mail_debug = yes mail_gid = vmail mail_location = maildir:/var/mail/user mail_plugins = acl mail_privileged_group = vmail mail_uid = vmail namespace { list = yes location = maildir:/var/mail/public:INDEXPVT=/var/mail/public prefix = public/ separator = / subscriptions = no type = public } namespace { list = yes location = maildir:/var/mail/user/%u/Maildir:INDEX=/var/mail/user/%u/shared/%u:CONTROL=/var/mail/user/%u/shared/%u prefix = shared/%%u/ separator = / subscriptions = no type = shared } namespace inbox { hidden = no inbox = yes list = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = separator = / subscriptions = yes type = private } passdb { args = /etc/dovecot/dovecot-ldap.conf.ext driver = ldap } plugin { acl = vfile acl_anyone = allow acl_shared_dict = file:/var/mail/database/shared-mailboxes.db } protocols = " imap" service stats { unix_listener stats-reader { group = vmail mode = 0660 user = vmail } unix_listener stats-writer { group = vmail mode = 0660 user = vmail } } ssl_cert = </var/ssl/dove.crt ssl_client_ca_dir = /etc/ssl/certs ssl_dh = # hidden, use -P to show it ssl_key = # hidden, use -P to show it userdb { args = /etc/dovecot/dovecot-ldap.conf.ext driver = ldap } protocol imap { mail_plugins = acl imap_acl }

2 5

access dict in lua auth script
by Tobias Florek 08 Dec '22

08 Dec '22

Hi! I want to access a configured dictionary in a lua authentication script. Unfortunately the documentation <https://doc.dovecot.org/admin_manual/lua/> does mention a dict object but no way to get one. I also did not find any lua tests in dovecot's source code. Is using the built-in dict not supported? Cheers, Tobias Florek

2 2

moving messages between namespaces go into purge
by Marc 07 Dec '22

07 Dec '22

I think it would be nice to have an option where the moving of messages between namespaces (by automated server scripts) would not result in messages ending up in the 'purge' queue. Currently when you move these copied messages, they end up in the purge queue combined with messages that users deleted. I am more or less forced to purge the mailbox after moving GB's while I prefer not to do this, because I would like to keep the opportunity to recover from the purge queue. Maybe there is a way to 'deduplicate' this purge queue?

3 4