- dovecot - dovecot.org

Imaptest sigfault error
by DeJa Wu 31 Jul '23

31 Jul '23

I Tried to run the test with imaptest and got a segfault error. Debug: Reading symbols from imaptest...done. (gdb) run user="puser%d(a)am.local" users=0-100000 pass=Us123456 host=ha-rr.am.local ssl=any-cert clients=100000 port=993 - secs=300 no_pipelining Starting program: /usr/bin/imaptest user="puser%d(a)am.local" users=0-100000 pass=Us123456 host=ha-rr.am.local ssl=any-cert clients=100000 port=993 - secs=300 no_pipelining [Thread debugging using libthread_db enabled] Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1". Logi Sele Logo 100% 100% 100% 179 163 154 551/637 [0%] 245 247 250 1153/1372 [1%] 238 240 238 1725/2086 [2%] 213 215 219 2250/2725 [2%] 213 209 203 2760/3364 (263 stalled >3s) [3%] 220 226 228 3308/4024 (854 stalled >3s) [4%] 247 245 247 3870/4765 (1338 stalled >3s) [4%] 239 237 239 4414/5482 (1800 stalled >3s) [5%] 259 257 259 4998/6259 (2299 stalled >3s) [6%] 270 274 271 5599/7069 (2809 stalled >3s) [7%] 3843 46 26 ms/cmd avg Logi Sele Logo 100% 100% 100% 243 242 237 6122/7798 (3369 stalled >3s) [7%] 242 239 237 6697/8524 (3937 stalled >3s) [8%] 241 241 248 7251/9247 (4542 stalled >3s) [9%] 229 231 234 7776/9934 (5143 stalled >3s) [9%] 230 228 225 8332/10624 (5800 stalled >3s) [10%] Program received signal SIGSEGV, Segmentation fault. 0x00007ffff7f1745f in io_loop_handler_run_internal () from /usr/lib/dovecot/libdovecot.so.0 How can I fix this?

2 1

Notification "API" for external replication
by Heiko Schlittermann 31 Jul '23

31 Jul '23

Hi Aki and all the Dovecot team, thank you for your work on Dovecot. As the "built-in" replication is going to cease (I do not want to discuss the reasoning or any judgement here): Can you (the Dovecot developers) ensure that a kind of "notification socket"¹ will be there, even if you do not provide a the replicator feature? And - but that's already a feature request - could you use this (or an other socket) for notifications on sieve script changes? I can imagine using this socket as an "official" interface to external software. Actually that would implicate that the notification messages are documented and stable, but I'm sure, this would be possible (if not done already). ¹) That is how I understand the current mechanism of the replication: the replicator gets a notification via the socket and starts replicating the mailbox. Best regards from Dresden/Germany Viele Grüße aus Dresden Heiko Schlittermann -- SCHLITTERMANN.de ---------------------------- internet & unix support - Heiko Schlittermann, Dipl.-Ing. (TU) - {fon,fax}: +49.351.802998{1,3} - gnupg encrypted messages are welcome --------------- key ID: F69376CE -

2 1

Accessing SSL parameters via dovecot variables
by Graham Leggett 26 Jul '23

26 Jul '23

Hi all, Dovecot supports variables, which can be used in filters. Does the SSL code expose variables linked to the client certificate? The answer today appears to be no, and if that’s true I plan to patch it, but just need to confirm I am not missing something. Regards, Graham —

2 2

Filtering by SASL auth mechanism
by Graham Leggett 26 Jul '23

26 Jul '23

Hi all, I want dovecot to behave differently depending on what SASL mechanism was used. Most specifically, if EXTERNAL, I want auth_ssl_username_from_cert to be yes, but no otherwise. There is a filtering mechanism that supports protocol, remote, etc. https://doc.dovecot.org/configuration_manual/config_file/ Would it make sense to add a SASL mechanism filter like this: mechanism external { # … } Regards, Graha —

1 0

SASL External and LDAP - Login attempt with empty password
by Graham Leggett 26 Jul '23

26 Jul '23

Hi all, I am trying to configure dovecot to accept SASL EXTERNAL authentication with a client certificate and no password. I have tried the following configuration: passdb { driver = ldap # Path for LDAP configuration file, see example-config/dovecot-ldap.conf.ext args = /etc/dovecot/dovecot-ldap-external.conf.ext mechanisms = external default_fields = noauthenticate=y } In the logs I see dovecot correctly negotiate SASL EXTERNAL, but eventually we reach this line and we fail: https://github.com/dovecot/core/blob/34a18f5a79bf7eca58e55aff3e1fe69468292d… Which is in turn reached by following this code: https://github.com/dovecot/core/blob/34a18f5a79bf7eca58e55aff3e1fe69468292d… In theory, if I understand this correctly, what is missing is a field to say “don’t try check any password”, which field is this supposed to be? “nopassword”? “noauthenticate”? I am happy to patch this, but need some guidance as what the correct approach is. Regards, Graham —

1 0

Quota possibly overcomplicating, need sanity check?
by David Mehler 25 Jul '23

25 Jul '23

Hello, New setup and trying to get quotas going. It's a Dovecot/Postfix/Mariadb virtual user setup. In my db I have a varchar field called quota with a default value of 128. Here's what I have in dovecot configs for quota: # Plugins mail_plugins = acl mail_crypt quota service stats { fifo_listener stats-mail { user = vmail mode = 0644 } inet_listener { address = 127.0.0.1 port = 24242 } } # quota status service quota-status { executable = quota-status -p postfix unix_listener /var/spool/postfix/private/dovecot-quota { user = postfix group = postfix mode = 0660 } client_limit = 1 } # Quota warnings service quota-warning { executable = script /usr/local/bin/quota-warning.sh user = vmail unix_listener quota-warning { group = vmail mode = 0660 user = vmail } } plugin { quota = count:User quota quota2 = maildir:Shared quota:ns=public/ quota_max_mail_size = 100M # Required for 'count' quota driver quota_vsizes = yes quota_rule2 = Trash:storage=+10%% quota_rule = *:storage=1G quota_rule2 = Trash:storage=100M quota_rule3 = SPAM:ignore quota_warning = storage=100%% quota-warning +100 %u quota_warning2 = storage=95%% quota-warning +95 %u quota_warning3 = storage=80%% quota-warning +80 %u quota_warning4 = -storage=100%% quota-warning -100 %u # user is no longer over quota quota_exceeded_message = User %u has exhausted allowed storage space. quota_grace = 10%% # 10% is the default quota_status_success = DUNNO quota_status_nouser = DUNNO quota_status_overquota = "552 5.2.2 Mailbox is full" ## Stats ### how often to session statistics (must be set) stats_refresh = 30 secs ### track per-IMAP command statistics (optional) stats_track_cmds = yes } The protocol imap has the imap_quota plugin and protocol lmtp has the quota plugin. I've also got lmtp_rcpt_check_quota = yes mailbox_list_index = yes In my dovecot-sql.conf file my user query looks like this: user_query = SELECT concat('*:storage=', quota, 'M') AS quota_rule FROM accounts WHERE username = '%Ln' AND domain = '%Ld' AND sendonly = false; Postfix checks: check_policy_service unix:private/dovecot-quota Am I overcomplicating? Thanks. Dave.

1 0

mail_crypt on existing mailstore
by David Mehler 25 Jul '23

25 Jul '23

Hello, I've got a pre-existing mailstore, it's a Postfix/Dovecot/Mariadb virtual-user setup, with users and mailboxes. I'd now like to get mail_crypt going. Can I do this with this existing store or if not how would I set this up? Thanks. Dave.

1 0

subscription, dots and subscribe to shared folder.
by Julien Nadal 24 Jul '23

24 Jul '23

Hello; We were able to set up shared folders in a cluster (using dovecot as proxy on dedicated front-end servers, without using director) by following https://doc.dovecot.org/configuration_manual/shared_mailboxes/cluster_setup/. Here is our related conf on imap farms (dovecot v2.3.16 on Almalinux): namespaces: mail_location = maildir:~/Maildir namespace default { inbox = yes location = prefix = separator = / } namespace shared { list = children location = imapc:~/shared/%%u:INDEXPVT=~/shared-pvt/%%u prefix = shared/%%u/ separator = / subscriptions = no type = shared } imapc settings: imapc_features = fetch-bodystructure fetch-headers rfc822.size search modseq acl delay-login imapc_host = XXXXXX imapc_master_user = %{user} imapc_password = XXXXXX imapc_port = XXXXXX passdb { args = password=#hidden_use-P_to_show# userdb_namespace/shared/disabled=yes userdb_acl_user=%{auth_user} allow_nets=XXXXX/XX driver = static master = yes } dict { acl-mysql = mysql:/etc/dovecot/conf.d/dovecot-dict-sql.conf.ext } This way, a folder is created under ~/ : shared & shared-pvt : When user A shares a folder with B, B will find ~/shared/userA/sharedfolder I should mention that the user authentication (backend: mysql) uses the full email address as we are in a multi-tenant context. So the folder looks like ~/shared/usera(a)domain.tld/folder Since then, everything works perfectly, we can share and see the shared folders in the webmail (SOGo). Unfortunately, accessing these folders through an imap client (tested on Thunderbird and MSOutlook) is impossible because the subscription fails (the folder is listed, but the subscription doesn't seem to do anything). I could not find any relevant logs but I was able to confirm on the command line: I am able to view folder with LIST, subscribe with an "OK" output, but the folder is not listed with LSUB. So I could see that the subscribtion file in maildir shows incorrect entries: V 2 Sent Trash Drafts Junk shared/testuser1@sub domain tld/INBOX/folder The dots in the folder names are replaced by tabs. I was able to recover things by editing the file as follows: Sent Trash Drafts Junk shared/testuser1(a)sub.domain.tld/INBOX/folder This means that Maildir++ and V2 subscription can't handle dots in folders. I found a previous discussion: https://dovecot.org/pipermail/dovecot/2021-January/121233.html But the final advice can't be applied on our side: - changing LAYOUT to FS is not possible for us - we have already migrated the dot separator to slash - changing the layout only for shared namespaces does not solve the problem and totally breaks the access to shared folders. Thanks a lot for your advice Best regards Julien

3 4

Outlook and IMAP Flags
by Laura Smith 22 Jul '23

22 Jul '23

Hi I've tried searching the internet, but the only thing I can find is a post on a MIcrosoft forum where a Microsoft reps claims flags are not supported on IMAP (I thought it was an RFC3501 feature ?). Anyway, I have a user who has Outlook/Windows on desktop and iOS (iPhone/iPad) for remote. On the iOS devices, the user can happily set flags against messages with zero issues. And indeed, when they set these flags, they are shown in Outlook. However if they attempt to set the flag in Outlook, nothing happens. Outlook continues showing the message as if it was unflagged. Any ideas ? Laura

2 1

Exclude folders from fts xapian on a per-user basis
by Adam Kessel 21 Jul '23

21 Jul '23

Is there any way for a user to specify folders they want excluded from fts xapian indexing? Or can this only be done globally in /etc?

1 0

Dovecot pigeon/sieve and SELinux
by Graham Leggett 21 Jul '23

21 Jul '23

Hi all, I am in the process of migrating a dovecot installation from RHEL8 to RHEL9, this time round I am trying to get everything to work in selinux enforcing mode. First error I am stuck on is as follows: Error: sieve: file storage: Failed to stat sieve storage path: stat(/var/lib/dovecot/sieve/vacation.sieve) failed: Permission denied (euid=377(vmail) egid=376(vmail) missing +x perm: /var/lib/dovecot, we're not in group 97(dovecot), dir owned by 97:97 mode=0750) It appears that the vmail user cannot access /var/lib/dovecot, because under RHEL9 the permissions are hidden to the world. [root@seawitch dovecot]# ls -al /var/lib/dovecot total 12 drwxr-x---. 3 dovecot dovecot 36 Jul 21 17:51 . Am I correct in interpreting the error message as meaning that /var/lib/dovecot/sieve is not a correct directory for global sieve scripts, and they need to go somewhere else? If they do need to go somewhere else, in the world of enforcing selinux, where do they go? While dovecot-selinux is documented, sieve is not mentioned: https://linux.die.net/man/8/dovecot_selinux So, let’s work around the above error by adding the vmail user to the dovvecot group. Is this even a good idea? /usr/sbin/usermod -a -G dovecot vmail Now we hit the next error: Error: sieve: file storage: Failed to stat sieve storage path: stat(/var/lib/dovecot/sieve/vacation.sieve) failed: Permission denied (euid=380(vmail) egid=378(vmail) missing +w perm: /var/lib/dovecot/sieve/vacation.sieve stat(/var/lib/dovecot/sieve/vacation.sieve) failed: Permission denied, dir owned by 0:0 mode=0755) This error is weird. Dovecot is trying to open the original vacation.sieve source file for write - why? We have pre-compiled all the global sieve scripts: [root@marcopolo ~]# ls -al /var/lib/dovecot/sieve/ total 36 drwxr-xr-x. 5 root root 4096 Jul 21 17:29 . drwxr-x---. 3 dovecot dovecot 36 Jul 21 17:29 .. -rwxr-xr-x. 1 root root 284 Jul 21 08:47 junk.sieve -rw-r--r--. 1 root root 277 Jul 21 17:29 junk.svbin -rwxr-xr-x. 1 root root 316 Jul 21 08:47 report-ham.sieve -rw-r--r--. 1 root root 476 Jul 21 17:29 report-ham.svbin -rwxr-xr-x. 1 root root 201 Jul 21 08:47 report-spam.sieve -rw-r--r--. 1 root root 382 Jul 21 17:29 report-spam.svbin drwxr-xr-x. 2 root root 6 Jul 21 08:47 sieve-execute drwxr-xr-x. 2 root root 6 Jul 21 08:47 sieve-filter drwxr-xr-x. 2 root root 6 Jul 21 08:47 sieve-pipe -rwxr-xr-x. 1 root root 309 Jul 21 08:47 vacation.sieve -rw-r--r--. 1 root root 558 Jul 21 17:29 vacation.svbin Is the error perhaps inaccurate, and it’s trying to open a temp file for write, failing (correctly, it has no business opening a temp file for write at this point), and then claiming the failure on the temp file is a failure on the source file? So to sum up: - In an SELinux world of Redhat, what directory do global sieve scripts go? - What permissions and selinux context are required on the global sieve scripts directory? Regards, Graham —

1 0

IMAP account can't save any email with attachment
by Chris Thomas 20 Jul '23

20 Jul '23

Hi, I'm getting a curious problem where if I write a draft without an attachment and click save. It'll work without any issue at all. But if I do the same, then attach a file to the email, it'll sit there for a couple of minutes before timing out (I'm using thunderbird), it'll eventually give you a message saying "Your draft message was not copied to your drafts folder (Drafts) due to network or file access errors." I've got all of dovecots verbose logging turned on. I'm using dovecot as a submission server through to the postfix server to do the actual sending. All the logging is turned on there too. But I can't figure out what the problem is. Is there anything I can look for in the logs that will help me out? chris

2 3

Re: Tons of imap-login processes despite client_limit very high
by Joseph Tam 20 Jul '23

20 Jul '23

https://www.mail-archive.com/dovecot%40dovecot.org/msg85850.html From: D D <pierre.alletru(a)gmail.com> > We're seeing a ton of imap-login processes running even when using high performance mode (https://doc.dovecot.org/admin_manual/login_processes/#high-performance-mode) According to the docs: > > "process_min_avail should be set to be at least the number of CPU cores in the system, so that all of them will be used. Otherwise new processes are created only once an existing one’s connection count reaches client_limit" > > We have process_min_avail=4, client_limit=0 and default_client_limit=200000. So we'd expect seeing only 4 imap-login processes serving a ton of connections each. Yet, we see thousands of imap-login processes (more than half of all the imap processes): > ... > > Is having so many imap-login processes normal with our config? Did we misunderstand the docs or is there something wrong here? > > > default_client_limit = 1048576 > default_process_limit = 200000 > > service imap-login { > # client_limit = 0 # default is 0 > # process_limit = 0 # default is 0 > service_count = 100 This service limit might be your culprit. I wrote about the strange interaction between service_count and process_limit here: https://www.mail-archive.com/dovecot%40dovecot.org/msg85850.html This gotcha should really be documented. Joseph Tam <jtam.home(a)gmail.com>

3 4

Fatal error in http-client.c when passdb is oauth2 and userdb is sql
by Евгений Бахтин 19 Jul '23

19 Jul '23

5 5

-d ${user}@${nexthop} or -d ${recipient}?
by rixati6186＠iturchia.com 18 Jul '23

18 Jul '23

What's the differency between these two lines; 1- flags=DORhu user=vmail:vmail argv=/usr/local/libexec/dovecot/dovecot-lda -f ${sender} -r ${recipient} -d ${user}@${nexthop} 2- flags=DRhu user=vmail:vmail argv=/usr/local/libexec/dovecot/dovecot-lda -f ${sender} -d ${recipient} and which one should I use, based on a setup like; Dovecot, Postfix, Postfixadmin, ManageSieve and virtual users hosted in SQL? Thanks in advance.

1 0

dovecot: lda(info@mydomain) - vacation action: discarding vacation response to mailinglist recipient?
by rixati6186＠iturchia.com 18 Jul '23

18 Jul '23

Hello, I'm trying to set auto reply for my email account, through Roundcube and ManageSieve plugin (the plugin itself and its regular filtering works fine), however the auto-reply doesn't arrive to the sender's inbox, when I tested it with sending an email to myself/my server, from my Gmail account, my maillog has a line, stating; Jul 18 15:28:06 mailsrv dovecot: lda(info(a)mywebsite.com)<44812><uikMAlaFtmQMrwAAI6rZ/g>: sieve: msgid=<CA+GnASfyKJDPB-K2uCvxaOL-XQQ7Uv=yJt7sgJSYm-YJzYJSfQ(a)mail.gmail.com>: vacation action: discarding vacation response to mailinglist recipient <mysendermail(a)gmail.com> Any idea would be much appreciated, thank you!

1 1

Re: Fatal error in http-client.c when passdb is oauth2 and userdb is sql
by Евгений Бахтин 18 Jul '23

18 Jul '23

2 1

Re: Fatal error in http-client.c when passdb is oauth2 and userdb is sql
by Евгений Бахтин 18 Jul '23

18 Jul '23

2 1

Tons of imap-login processes despite client_limit very high
by D D 18 Jul '23

18 Jul '23

Hi Dovecot community. We're seeing a ton of imap-login processes running even when using high performance mode (https://doc.dovecot.org/admin_manual/login_processes/#high-performance-mode) According to the docs: "process_min_avail should be set to be at least the number of CPU cores in the system, so that all of them will be used. Otherwise new processes are created only once an existing one’s connection count reaches client_limit" We have process_min_avail=4, client_limit=0 and default_client_limit=200000. So we'd expect seeing only 4 imap-login processes serving a ton of connections each. Yet, we see thousands of imap-login processes (more than half of all the imap processes): $ ps aux | grep imap-login | wc -l 1278 $ ps aux | grep imap | wc -l 2154 We use verbose_proctitle=yes and a there seem to be 2 types of these processes, about half for a single IP and about half we suspect for multiple IPs: $ ps aux | grep imap-log _apt 1941081 0.0 0.0 10420 8700 ? S 14:57 0:00 dovecot/imap-login [84.115.232.178 TLS proxy] _apt 1941589 0.0 0.0 10532 8648 ? S 14:57 0:00 dovecot/imap-login [119.202.86.160 TLS proxy] _apt 1941789 0.0 0.0 10188 8620 ? S 14:57 0:00 dovecot/imap-login [0 pre-login + 2 TLS proxies] _apt 1942144 0.0 0.0 10716 8748 ? S 14:57 0:00 dovecot/imap-login [0 pre-login + 3 TLS proxies] _apt 1942428 0.0 0.0 10800 8712 ? S 14:57 0:00 dovecot/imap-login [5.41.100.37 TLS proxy] ... $ ps aux | grep imap-log | grep pre-login | wc -l 624 $ ps aux | grep imap-log | grep -v pre-login | wc -l 654 Is having so many imap-login processes normal with our config? Did we misunderstand the docs or is there something wrong here? default_client_limit = 1048576 default_process_limit = 200000 service imap-login { # client_limit = 0 # default is 0 # process_limit = 0 # default is 0 service_count = 100 process_min_avail = 4 vsz_limit = 2G inet_listener imap { } inet_listener imaps { haproxy = yes port = 994 } }

2 3

cram-md5, sasl and lua (inheriting technical debt)
by tknb8＠tunenet.dk 18 Jul '23

18 Jul '23

Hello, I am exploring the posibility of migrating an exsisting setup to postfix+dovecot. The issue being that many clients are currently configured for cram-md5 authentication. I am fully aware that this is a really, really, really bad idea, but re configuring all clients at once is not feasible with limited end user support resources. I have a setup running with LUA for the passdb, and everything works with PLAIN login. To keep compatibility with the PLAIN login mechanism i have tried to store {PLAIN} passwords in the DB, since proper secure password storage is incompatible with CRAM-MD5. My issue is that the LUA function auth_password_verify(req, pass) not even seems to be called for cram-md5 logins. Reading through the documentation also seems to indicate that the callenge is not passed to the LUA function making it impossible to compute the hash in LUA or the function req.password_verify(req, row.password, pass). Is my assumption correct that cram-md5 can not work with a LUA script ? Kind regards, Peter K.

2 1

Many IDLE imap processes but very few connections moved to imap-hibernate
by pierre.alletru＠gmail.com 17 Jul '23

17 Jul '23

Hi Dovecot community! I have a strange issue with imap-hibernate. Or more likely it behaves as it's supposed to and it's just that I don't really understand it. I have enabled it, and it works, but for some reason hibernation happens only to a tiny amount of connections, whereas I have a lot of IDLE imap processes. And I can't find any relevant errors in the logs. ## config ## mail_debug = yes verbose_proctitle = yes $ doveconf imap_hibernate_timeout imap_hibernate_timeout = 5 secs $ doveconf -a | grep -A 21 'service imap-hibernate' service imap-hibernate { chroot = client_limit = 0 drop_priv_before_exec = no executable = imap-hibernate extra_groups = group = idle_kill = 0 privileged_group = process_limit = 0 process_min_avail = 0 protocol = imap service_count = 0 type = unix_listener imap-hibernate { group = $default_internal_group mode = 0660 user = } user = $default_internal_user vsz_limit = 18446744073709551615 B } ## imap processes ## $ ps aux | grep "dovecot/imap" | wc -l 2214 ps aux | grep "dovecot/imap" | grep IDLE | wc -l 1258 $ ps aux | grep "imap-hibernate" syslog 1571453 0.0 0.0 4748 3156 ? S 15:44 0:00 dovecot/imap-hibernate [18 connections] As you can see here I have 1258 IDLE imap processes (out of 2214 in total), and only 18 connections in imap-hibernate. I'd like to have all IDLE processes to be moved to imap-hibernate in order to save up memory. Any idea why these 1k+ IDLE imap processes are not moved into imap-hibernate? Thank you!

2 1

Problem connecting with desktop client
by Wolfgang Paul Rauchholz 17 Jul '23

17 Jul '23

I run my home server under Rocky Linux 9. The server is modem / router and as such has two firewall interfaces; internal and external. Dovecot version is dovecot-2.3.16-8.el9.x86_64 kernel is: 5.14.0-284.18.1.el9_2.x86_64 My domain is wo-lar.com Postfix and Dovecot are up and running, and I can send and receive emails from CLI. But I cannot connect from desktop clients. I get the following error message: Server message: Can't connect to host "tcp://wo-lar.com:143" I tried to telnet from my desktop and server. Results are the same: - I always get a connection refused: telnet wo-lar.com 143 telnet / telnet <Server LAN IP> 143. On server only: telnet 127.0.0.1 143 - telnet wo-lar 143 (without .com!) establishes a connection [root@home wp.rauchholz]# telnet wo-lar 143 Trying 79.152.236.25... Connected to wo-lar. Escape character is '^]'. OK [CAPABILITY IMAP4rev1 SASL-IR LOGIN-REFERRALS ID ENABLE IDLE LITERAL+ STARTTLS AUTH=PLAIN AUTH=LOGIN] Dovecot ready. I went through all kinds for conf files and search for wo-lar string, but can't find it anywhere Where is the mistake hiding? Thanks for helping. Wolfgang

2 4

Re: Replication going away?
by William Edwards 16 Jul '23

16 Jul '23

> Op 16 jul. 2023 om 17:57 heeft Aki Tuomi <aki.tuomi(a)open-xchange.com> het volgende geschreven: > > Hi! > > Yes, director and replicator are removed, and won't be available for pro users either. > > For NFS setups (or similar shared setups), we have documented a way to use Lua to run a director-like setup, see > > https://doc.dovecot.org/3.0/configuration_manual/howto/director_with_lua/ It would probably be good to share this link in the aforementioned Director removal thread. > > Regards to replication, doveadm sync is not being removed. So you can still run doveadm sync on your system to have a primary / backup setup. > > Aki > >> On 16/07/2023 18:34 EEST William Edwards via dovecot <dovecot(a)dovecot.org> wrote: >> >> >> Top posting because nothing specific to reply to, sorry. Not exactly sure, but there’s another thread about the removal of Director in favour of Dovecot Pro on 3.x. Perhaps this change is related. >> >> William Edwards >> >>>> Op 16 jul. 2023 om 16:33 heeft Daniele <danix(a)kernel-panic.it> het volgende geschreven: >>> >>> Hello, >>> >>> Just like Vladimir, I'm a bit concerned about this change, and I'd really appreciate if someone could let us know if the replication feature (that works so well!) will be replaced or removed; and, in case of removal, what would be recommended replacement? >>> Thanks in advance and best regards, >>> Daniele >>> >>>> On 09-Jul-23 9:36 PM, Vladimir Mishonov via dovecot wrote: >>>> Hello everyone. >>>> >>>> Just saw this commit in the official Github repo: >>>> >>>> https://github.com/dovecot/core/commit/4c04e4c30fd4817a8b0e11d04d9681173f69… >>>> >>>> Looking at the commit details, it appears that it completely removes the replication feature. I'm a bit perplexed by this change and am not sure what might be the justification for it. Personally, I find replication to be very useful, as it allows me to maintain a synchronized mirror of all of my mailboxes on my home server, for use as backup in case the primary server goes down for some reason. >>>> >>>> Perhaps there's some sort of replacement being planned for this feature? Or maybe the relevant code is simply going to be refactored to a plugin or external program, and there's nothing to worry about at all? >>>> >>>> In any case, I'd greatly appreciate if one of the developers could comment on this change. >>>> >>> >>> _______________________________________________ >>> dovecot mailing list -- dovecot(a)dovecot.org >>> To unsubscribe send an email to dovecot-leave(a)dovecot.org >>> >> >> _______________________________________________ >> dovecot mailing list -- dovecot(a)dovecot.org >> To unsubscribe send an email to dovecot-leave(a)dovecot.org >

1 0

user lookup fails username is SHA256 @domain
by Daniel Botting 16 Jul '23

16 Jul '23

Hi all, I'm currently building a replacement personal mailserver on Debian 11 (hopefully upgrade it to 12 and it will continue to work). My existing personal mailserver is serving a handful of mailboxes for three domains, virtual users, on an older version of Debian. When I attempt to deliver mail to the server (using swaks) it is accepted by Exim and passed to lda, as per the logs below the lda is somehow seeing the CRYPT entry as if it was the local part? Output from syslog: Jul 16 09:50:02 imap2 dovecot: lda({SHA256-CRYPT}generated-sha(a)example.domain)<700316><>: Debug: auth-master: userdb lookup({SHA256-CRYPT}generated-sha(a)example.domain): Started userdb lookup Jul 16 09:50:02 imap2 dovecot: lda({SHA256-CRYPT}generated-sha(a)example.domain)<700316><>: Debug: auth-master: conn unix:/run/dovecot/auth-userdb: Connecting Jul 16 09:50:02 imap2 dovecot: lda({SHA256-CRYPT}generated-sha(a)example.domain)<700316><>: Debug: auth-master: conn unix:/run/dovecot/auth-userdb (pid=700293,uid=0): Client connected (fd=9) Jul 16 09:50:02 imap2 dovecot: auth: Debug: master in: USER#0111#011{SHA256-CRYPT}generated-sha(a)example.domain#011service=lda Jul 16 09:50:02 imap2 dovecot: auth: Username character disallowed by auth_username_chars: 0x7b (username: {SHA256-CRYPT}generated-sha(a)example.domain) Jul 16 09:50:02 imap2 dovecot: auth: Debug: userdb out: NOTFOUND#0111 Jul 16 09:50:02 imap2 dovecot: lda({SHA256-CRYPT}generated-sha(a)example.domain)<700316><>: Debug: auth-master: userdb lookup({SHA256-CRYPT}generated-sha(a)example.domain): auth USER input: Jul 16 09:50:02 imap2 dovecot: lda({SHA256-CRYPT}generated-sha(a)example.domain)<700316><>: Debug: auth-master: userdb lookup({SHA256-CRYPT}generated-sha(a)example.domain): Userdb lookup failed Jul 16 09:50:02 imap2 dovecot: lda(700316): Debug: auth-master: conn unix:/run/dovecot/auth-userdb (pid=700293,uid=0): Disconnected: Connection closed (fd=9) From what I've read 0x7b is hex for { so disallowed by auth_username_chars line is because of this problem. Doveconf -n output: # 2.3.20 (80a5ac675d): /etc/dovecot/dovecot.conf # OS: Linux 5.10.0-21-amd64 x86_64 Debian 11.6 # Hostname: mailserver.fqdn auth_debug = yes auth_debug_passwords = yes auth_verbose = yes mail_debug = yes mail_location = maildir:~/Maildir namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } passdb { args = /etc/vmail/%d/passwd driver = passwd-file } protocols = " imap" service auth { unix_listener auth-client { group = Debian-exim mode = 0660 } } service stats { unix_listener stats-reader { group = vmail mode = 0660 user = vmail } unix_listener stats-writer { group = vmail mode = 0660 user = vmail } } ssl = required ssl_cert = </path/to/cert.pem ssl_client_ca_dir = /etc/ssl/certs ssl_key = # hidden, use -P to show it userdb { args = uid=vmail gid=vmail home=/var/local/vmail/%d/%u driver = static } Example of line in passwd file: username:{SHA256-CRYPT}generated-sha I followed https://doc.dovecot.org/configuration_manual/howto/simple_virtual_install/ before posting to ensure I hadn't missed something obvious. Any thoughts on this would be appreciated. Thanks Daniel

1 0

Windows 11 Outlook 365 and dovecot
by The Doctor 16 Jul '23

16 Jul '23

Are there any known Idssues? I help set up a client this morning using Win11 and Dovecot and the client cannot delete e-mail like he did previously. -- Member - Liberal International This is doctor(a)nk.ca Ici doctor(a)nk.ca Yahweh, King & country!Never Satan President Republic!Beware AntiChrist rising! Look at Psalms 14 and 53 on Atheism https://www.empire.kred/ROOTNK?t=94a1f39b We look outside to find assurance, and then we fail. -unknown Beware https://mindspring.com

3 2

Options to track performance?
by Christian 15 Jul '23

15 Jul '23

Hi there, after upgrading my dovecot on a bookworm container, I now have a weird delay when imap clients like Evolution connect the first time. Is there any performance logging configuration I could enable, to see what dovecot is doing in which timing? I suspect some timeout or delay somewhere, but unable to find it so far. Kind regards Chris

1 0

Options to track performance?
by Christian 15 Jul '23

15 Jul '23

Hi there, after upgrading my dovecot on a bookworm container, I now have a weird delay when imap clients like Evolution connect the first time. Is there any performance logging configuration I could enable, to see what dovecot is doing in which timing? I suspect some timeout or delay somewhere, but unable to find it so far. Kind regards Chris

1 0

dovecot and argonid
by Maciej Milaszewski 13 Jul '23

13 Jul '23

Hi For test I try use new auth (argonid) fot dovecot-2.3.20 I change only in sql: password: {ARGON2ID}........ in dovecot.conf i set default_vsz_limit = 2000 M and I can't auth Jul 12 15:07:43 dovecot8 dovecot: auth-worker(44928): conn unix:auth-worker (pid=23437,uid=114): auth-worker<4772376>: sql(user12,xxx.xxx.xxx.12,<VfN04EkA0LUK>): Password mismatch Jul 12 15:07:43 dovecot8 dovecot: imap-login: Disconnected: Connection closed (auth failed, 1 attempts in 105 secs): user=<user12>, method=PLAIN, rip=xxx.xxx.xxx.12, lip=xxx.xxx.xxx.12, secured, session=<VfN04EkA0LUK> I try telnet ip 144 a login username pass Any idea ?

2 3

Proper way to enable statistics on Dovecot 2.3.20?
by rixati6186＠iturchia.com 12 Jul '23

12 Jul '23

Hi. I'm using Dovecot on OpenBSD OS. "dovecot --version" reports: 2.3.20 (80a5ac675d) and this is my configuration file: https://termbin.com/m4to How to properly set the statistics for the version I use? I have both "service stats" and "service old-stats" and it seems I'm not really getting any statistics. Where's my mistake? Thanks in advance. ("doveadm oldstats top" command gives an empty page with columns.) Thanks.

2 6

argon2id best practices, generating and database storage
by David Mehler 12 Jul '23

12 Jul '23

Hello, To users of argon2id as a password hash, what are best practices/what do you use to generate the argon2id password hashes? I want to know if I should do more than: doveadm pw -s ARGON2ID Also, for storing an argon2id password hash in a database (mysql/mariadb in this example) what value(s) do you use for the field? Thanks. Dave.

1 0

Motion for OCSP Support in Dovecot
by novoMedia 12 Jul '23

12 Jul '23

Currently, Dovecot does not offer any support for OCSP, leaving system administrators with a dilemma: choosing between security or compatibility. - What is OCSP? OCSP (Online Certificate Status Protocol) is a network protocol used to check the validity and revocation status of digital certificates in real-time. - What is Must-Staple? "Must-Staple" is a certificate extension that enforces the inclusion of OCSP stapling information, requiring servers to present the certificate's revocation status during the TLS handshake. - What advantages does the use of Must-Staple offer? The inclusion of a 'must-staple' flag in a certificate mandates the presence of an OCSP response during a TLS handshake, ensuring that a revoked certificate remains (at worst) only usable until the expiration of the latest OCSP response, rather than the expiration of the certificate itself (subject to specific client/implementation). https://www.reddit.com/r/selfhosted/comments/aye79v/the_case_for_ocsp_musts… - What is the current issue with Dovecot? Presently, any system administrator who intends to issue must-staple certificates, faces the dilemma to either chose to a) Refrain from issuing must-staple certificates at all, resulting in the loss of a valuable security feature. b) Issue must-staple certificates without an OCSP response in Dovecot, thereby breaking the TLS RFC (and “hope for the best” on the client side…). A "stuck between a rock and a hard place" situation. - Any other reasons to implement OCSP? Regulatory frameworks such as HIPAA, PCI-DSS and more require the implementation of OCSP to enhance privacy and security. Personally, this requirement does not impact me since I am neither located in the United States nor have customers there. Nonetheless, it is worth noting this requirement for individuals or entities who are subject to these regulations. - Is there demand for OCSP in Dovecot? https://github.com/mjhas/dovecot/issues/44 (First GitHub Google hit for “dovecot ocsp”) https://serverfault.com/questions/830434/do-postfix-and-dovecot-support-ocs… https://dovecot.org/pipermail/dovecot/2018-October/113368.html https://www.dovecot.org/list/dovecot/2016-March/103395.html - Summary By implementing a simple OCSP solution, Dovecot could effectively solve this predicament without any drawbacks for its users. The focus here is on simplicity. It is unnecessary to employ a comprehensive OCSP resolver/responder like the one used in Nginx; rather, it would suffice to allow the definition of a simple file path containing the OCSP response alongside the certificate (honoring TLS SNI). Please kindly consider my motion.

4 6

mail-crypt key sharing
by Robert Senger 12 Jul '23

12 Jul '23

Hi all, I am trying to setup mailbox sharing (not public mailboxes) together with mail-crypt plugin and encrypted folder keys. According to the source code of the mail-crypt plugin (there's code trying to retrieve private keys for shared mailboxes), and its documentation, this should be possible: ----- If you are using global keys, mails can be shared within the key scope. The global key can be provided with several different scopes: Global scope: key is configured in dovecot.conf file Per-user(group) scope: key is configured in userdb file With folder keys, key sharing can be done to single user, or multiple users. When key is shared to single user, and the user has public key available, the folder key is encrypted to recipient’s public key. If you have mail_crypt_acl_require_secure_key_sharing enabled, you can’t share the key to groups or someone with no public key. ----- The documentation mentions key sharing, but I have no idea how this could be implemented, and did not find anything else than this mail- crypt documentation in the whole web... I assume that I need to export the user key of the users's folder that should be shared, and import it into the receiving users keys, encrypted with the receiving user's key. Is that right? Any hints how to do that? Regards, Robert -- Robert Senger

1 2

Shared folders?
by joe a 11 Jul '23

11 Jul '23

Is it possible to setup shared folders between virtual users on the same server?

5 9

Public mailboxes and mailcrypt
by Robert Senger 11 Jul '23

11 Jul '23

Hi there, is there a possibility to combine public mailboxes (as described in the first link below) with mailcrypt plugin using per-user keys (as described in the second link below)? I assume, no. But if there's a solution like, for example, storing the decryption key multiple times with different password protection, or by using a global key for the public mailbox only, let me know... I know that I could simply turn off encryption for the public mailbox, and I know how to do that. That's the fllback solution... ;) Regards, Robert (1) https://doc.dovecot.org/configuration_manual/shared_mailboxes/public_shared… (2) https://doc.dovecot.org/configuration_manual/mail_crypt_plugin/ -- Robert Senger

3 3

How to disable BINARY extension
by Ralf Becker 10 Jul '23

10 Jul '23

Reason for disabling are many broken mails containing unescaped equal signs ("=") and our webmailer is using BINARY, when offered, and than does not display the mail and reports Dovecots error "Invalid quoted-printable input trailer: '=' not followed by two hex digits". I'm fully aware that the mails are broken, unfortunately all sorts of programs or senders generate them ... I can use imap_capability = <full-list-of-caps-without-binary> but this is for multiple reasons not ideal: - new caps would never show up - pre-login the are also displayed There seems to be no syntax like: imap_capability = -BINARY Is there any other way to disable just binary? Ralf -- Ralf Becker EGroupware GmbH [www.egroupware.org] Handelsregister HRB Kaiserslautern 3587 Geschäftsführer Birgit und Ralf Becker Leibnizstr. 17, 67663 Kaiserslautern, Germany Telefon +49 631 31657-0

1 0

meaning of LIST output
by joe a 10 Jul '23

10 Jul '23

having trouble using offlineimap to copy folders to a local store for spamassasin to use. Says "no folder to sync (folderfilter issue?)" Thinking I simply did not know the proper folder name, did telnet to dovecot server for list of folders, see this,(snippet): . . . * LIST (\HasNoChildren \UnMarked) "." Cabinet.Missed-SPAM * LIST (\HasNoChildren) "." Cabinet.Missed-HAM * LIST (\HasNoChildren \UnMarked) "." Cabinet.Marked-SPAM . . . What is the significance of not one being not "UnMarked"? joe a.

1 0

rename virtual user?
by joe a 09 Jul '23

09 Jul '23

Possible to change a virtual user account, in passwd file, to another name and or domain?

3 3

Public mailboxes and mailcrypt
by Robert Senger 09 Jul '23

09 Jul '23

Hi there, is there a possibility to combine public mailboxes (as described in the first link below) with mailcrypt plugin using per-user keys (as described in the second link below)? I assume, no. But if there's a solution like, for example, storing the decryption key multiple times with different password protection, or by using a global key for the public mailbox only, let me know... I know that I could simply turn off encryption for the public mailbox, and I know how to do that. That's the fllback solution... ;) Regards, Robert (1) https://doc.dovecot.org/configuration_manual/shared_mailboxes/public_shared… (2) https://doc.dovecot.org/configuration_manual/mail_crypt_plugin/ -- Robert Senger

1 0

Fwd: dovecot and postfix, authentication issue
by jeremy ardley 06 Jul '23

06 Jul '23

On 6/7/23 20:49, joe a wrote: > On 7/6/2023 8:12 AM, jeremy ardley via dovecot wrote: >> >> On 6/7/23 19:15, joe a wrote: >>> >>> If your example was meant to show the correct way, I cannot see any >>> difference between that and what my posted config shows other than >>> the sequential (contiguous?) in your example. >> >> Perhaps try the different configuration out? Or even better, stick to >> one auithentication method only. >> >> >> Jeremy >> > > Sorry, not to appear dense or argumentative, but I did not see any > difference in your example, vs what exists, other than that in your > example they are grouped together. > > Is that what you suggest I try, or are my aging eyes and brain missing > something there? > How about just using PAM? In dovecot.conf : auth_mechanisms = plain login passdb { driver = pam } userdb { driver = passwd } This will then call pam whose config is mainly determined by cat /etc/pam.d/dovecot #%PAM-1.0 #auth required pam_faillock.so preauth silent audit #auth [default=die] pam_faillock.so authfail audit @include common-auth @include common-account @include common-session Assuming the pam config is defaults then you will get pam authenticating local users against the local (unix) passwd file. In turn this will authenticate dovecot users and then postfix users This may sound complex but it's pretty standard to have postfix --> dovecot --> pam --> unix_local

2 2

dovecot and postfix, authentication issue
by joe a 06 Jul '23

06 Jul '23

Greetings from a new dovecot user. Have setup dovecot on openSuse 15.4 with postfix as the MTA. Both are the latest version in that distribution. Simple virtual user setup using /etc/dovecot/passwd Dovecot seems to be working and all the defined users are authenticating well enough for imapsync to migrate files to the mailboxes. However, when attempting to send test mail via postfix, only some users are authenticated and have mail delivered. Using swaks (smtp toolkit) the failures are: 550 5.1.1 <some.user(a)mydomain.com>: Recipient address rejected: User unknown in local recipient table I'm puzzled, probably some simple thing overlooked. To avoid clutter, I won't include postfix items unless asked. dovecot --version 2.3.20 (80a5ac675d) dovecot -n # 2.3.20 (80a5ac675d): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.20 (149edcf2) # OS: Linux 5.14.21-150400.24.66-default x86_64 # Hostname: flitch auth_verbose = ob-fuskate disable_plaintext_auth = no first_valid_uid = 100 info_log_path = /var/log/dovecot-info.log log_path = /var/log/dovecot.log mail_location = maildir:~/Maildir managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } passdb { driver = pam } passdb { args = /etc/dovecot/passwd driver = passwd-file } plugin { sieve = file:~/sieve;active=~/.dovecot.sieve } protocols = imap lmtp service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0660 user = postfix } } service lmtp { unix_listener /var/spool/postfix/private/dovecot-lmtp { group = postfix mode = 0600 user = postfix } } ssl = no ssl_cipher_list = ALL:!aNULL:!eNULL:!EXPORT:!DES:!3DES:!MD5:!PSK:!RC4:!ADH:!LOW@STRENGTH ssl_options = no_compression ssl_prefer_server_ciphers = yes userdb { driver = passwd } userdb { args = uid=vmail gid=vmail home=/home/vmail/%u driver = static }

3 6

director_username_hash usable variables
by Stefano Cecconello 06 Jul '23

06 Jul '23

Hi, From the documentation of the director_username_hash core setting ( https://doc.dovecot.org/settings/core/#core_setting-director_username_hash ), it seems that it is possible to use some variables for the hashing of the username from a proxy\director : . Variables that can be used for this setting: * Global variables * %{user}, %u \ Username (username@domain) * %{username}, %n \ Username * %{domain}, %d \ Domain . If i need to use in the hash calculation some variables that are not global, like domain_first \ orig_username authentication_variables ( https://doc.dovecot.org/configuration_manual/config_file/config_variables/#a uthentication-variables ), are those be parsed\read from the director_hash_username settings ? Or the only variables allowed to be used are : * %{user}, %u \ Username (username@domain) * %{username}, %n \ Username * %{domain}, %d \ Domain * Global: %% * Global: env:<name> * Global: uid * Global: gid * Global: pid * Global: hostname In order to see if these variables are read\parsed during the hashing, somebody know if there is a way to log their value in the dovecot log ? Thanks Stefano

1 0

Chrooting
by Alexey Vlasov 30 Jun '23

30 Jun '23

Hi, I have the following hier for chrooting local users: /var/mail/.u336084 /var/mail/.u336084/bin /var/mail/.u336084/dev [cut here] /var/mail/.u336084/proc /var/mail/.u336084/var/ [cut here] /var/mail/.u336084/var/mail/ /var/mail/.u336084/var/mail/u336084 /var/mail/.u336084/var/mail/u336084/Mail /var/mail/.u336084/Mail -> var/mail/u336084/Mail (symlink) passwd file: u336084:x:1340334:255::/var/mail/.u336084:/bin/bash Chroot works fine, for SSH, FTP and etc, for example: # chroot /var/mail/.u336084 /bin/bash Given the current hierarchy, is it possible to tell the dovecot to do the same chroot? I found strange behavior that users cannot delete IMAP-folders: [pid 25055] stat("/var/mail/.u336084/Mail/.www1", {st_mode=S_IFDIR|0700, st_size=167, ...}) = 0 [pid 25055] stat("/var/mail/.u336084/Mail/.Trash.www1", 0x7ffeddc3d5c0) = -1 ENOENT (No such file or directory) [pid 25055] stat("/var/mail/.u336084/Mail/.Trash", {st_mode=S_IFDIR|0777, st_size=198, ...}) = 0 [pid 25055] fcntl(16, F_SETLK, {l_type=F_UNLCK, l_whence=SEEK_SET, l_start=0, l_len=0}) = 0 [pid 25055] fcntl(16, F_SETLK, {l_type=F_WRLCK, l_whence=SEEK_SET, l_start=0, l_len=0}) = 0 [pid 25055] fstat(16, {st_mode=S_IFREG|0600, st_size=0, ...}) = 0 [pid 25055] stat("/var/mail/.u336084/Mail/mailboxes.lock", {st_mode=S_IFREG|0600, st_size=0, ...}) = 0 [pid 25055] unlink("/var/mail/.u336084/Mail/mailboxes.lock") = 0 [pid 25055] close(16) = 0 [pid 25055] write(7, "96 NO [CANNOT] Renaming not supported across conflicting directory permissions (0.002 + 0.000 + 0.001 secs).\r\n", 110) = 110 [pid 25055] epoll_wait(11, [{EPOLLIN, {u32=1794732256, u64=94916277006560}}], 7, 1800000) = 1 Btw I don't see any conflicting dirs: root@:/var/mail/u336084# ls -ld /var/mail/.u336084/Mail/.www1 drwx------ 5 u336084 virtmail 167 Jun 27 13:26 /var/mail/.u336084/Mail/.www1 root@:/var/mail/u336084# ls -ld /var/mail/.u336084/Mail lrwxrwxrwx 1 u336084 virtmail 26 Apr 28 21:43 /var/mail/.u336084/Mail -> var/mail/u336084/Mail root@:/var/mail/u336084# ls -ld Mail drwx------ 16 u336084 virtmail 4096 Jun 30 01:25 Mail All folders have right owner u336084. With this configuration Courier worked properly, I noteced the problem after migration to Dovecot. Thanks in advance.

1 0

Warning sqlpool(mysql): Query failed
by Alessio Cecchi 27 Jun '23

27 Jun '23

Hi, with the last dovecot version (2.3.13) I see many of this warnings via "doveadm log errors": Feb 17 03:26:28 Warning: dict(31513): conn unix:dict (pid=31330,uid=95): dict(mysql)<email1(a)company1.com>: sqlpool(mysql): Query failed, retrying: MySQL server has gone away (idled for 679 secs) Feb 17 03:48:53 Warning: dict(31013): conn unix:dict (pid=31805,uid=95): dict(mysql)<email2(a)company2.com>: sqlpool(mysql): Query failed, retrying: MySQL server has gone away (idled for 685 secs) Feb 17 03:54:12 Warning: dict(32529): conn unix:dict (pid=3147,uid=95): dict(mysql)<email3(a)company3.com>: sqlpool(mysql): Query failed, retrying: MySQL server has gone away (idled for 670 secs) What do they mean? I thinks are related to inactivity timeout on mysql server (where I have a wait_timeout=600), but these warnings could be problems or can be fixed with some setting in dovecot? My dovecot configuration about dict: dict { acl = mysql:/etc/dovecot/dovecot-dict-sql.conf.ext expire = mysql:/etc/dovecot/dovecot-dict-sql.conf.ext sieve = mysql:/etc/dovecot/dovecot-dict-sieve-sql.conf.ext sqlquota = mysql:/etc/dovecot/dovecot-dict-sql.conf.ext } plugin { [...] acl_shared_dict = proxy::acl expire_dict = proxy::expire quota2 = dict:Quota Usage::noenforcing:proxy::sqlquota sieve = file:~/sieve;active=~/.dovecot.sieve sieve_before = dict:proxy::sieve;name=activesql [...] } service dict { process_limit = 500 unix_listener dict { group = vmail mode = 0660 user = vmail } } Thanks -- Alessio Cecchi Postmaster @ http://www.qboxmail.it https://www.linkedin.com/in/alessice

2 1

Re: Postfix: running a script on authentication failure
by Joseph Tam 27 Jun '23

27 Jun '23

On Thu, 22 Jun 2023, Michael Peddemors wrote: > * Use services like RATS-AUTH to block IPs that can safely be blocked as known hackers.. Cool. Are there other DNSRBLs (apart from bl.blocklist.de) that list BFD attack IPs? > * Use services like RATS-NULL (or SpamHaus DROP lists) right in the firewall level. There are SOME networks > that should simply be 'unplugged' Can't find it in https://spamrats.com/. Is it an DNSRBL or downloadable file? > * Turn off port 110 (well, all plain text authentication) 90% less email compromise reports when you do.. That will disable STARTTLS though. Even though it's not plaintext, maybe that is a good thing as it avoids MITM banner stripping attacks. Joseph Tam <jtam.home(a)gmail.com>

2 1

Server migration, password scheme/hashing, argon2i, argon2d, argon2id, sha512, sha512-crypt, tiger2, salt?
by David Mehler 24 Jun '23

24 Jun '23

Hello, I'm migrating to a new server. It's running Debian 11 currently though that's going 12 this weekend. Currently it uses Openssl v3.0.9, and dovecot 2.3.13 and MySQL (in this case Mariadb) for storing user account information v10.6.14. My question is in regards password storage and scheme/encryption/salts. Currently they are stored in Mariadb password field with a type of varchar and a 255 character length, and are stored as SHA512-CRYPT. I'm wondering if I should keep this as is or when I migrate go to another scheme? I'm thinking argon2i, argon2d, argon2id, sha512, sha512-crypt, tiger2, saltt? Discussion/opinions welcome. Thanks. Dave.

2 3

configuring Dovecot submission service
by Computerisms Corporation 24 Jun '23

24 Jun '23

Hi Dovecot Gurus, I have been playing around with the submission service. I have managed to get all the things working that I want working with two exceptions. I have not found (or possibly I have overlooked) solutions in the documentation or discussions on the 'net. First; I would like to be able to authenticate against my backend MTA using the user-supplied credentials. I have tried setting submission_relay_user as %u and submission_relay_password as %w, but these seem to be passed through as literal strings, and of course my backend MTA has no idea who %u is. I found a post from 2019 that indicates passing the submission_relay_user/password to the backend is not a supported function, but hoping that maybe that is outdated info. I also found: https://doc.dovecot.org/3.0/configuration_manual/authentication/proxies/ Which seems to indicate it could pass credentials to a non-Dovecot MTA backend, but I am not really clear from the docs on how to set that up, and I did not find any relevant examples to work from. Seems like it would be setting up a Director service, maybe? I have done that before and I do manage multiple email servers, but none of them is clustered or configured to be interoperable, so not sure if this is a viable approach. Second; I am wondering about the possibility of having multiple submission_relay_host entries. For example if I have dovecot submission services running on my standard port 587 and 465 connect to a relay on the same box through localhost, but could I have another submission service running on another port, say 5587, and relay all traffic received on that port through a completely different host? I am thinking I could set that up by running a separate instance of dovecot for just that service, but maybe there is a more suitable way? I don't have a solid use-case for this in mind at the moment, but given that I do manage multiple email servers, I am thinking that if this is possible it might provide some useful corner-case configurations down the road. Thank you for reading my post, any thoughts, information, or pointers to relevant documentation would be most appreciated. -- Bob Miller 867-334-7117 www.computerisms.ca

2 3

Postfix: running a script on authentication failure
by André Rodier 22 Jun '23

22 Jun '23

Hello, all. I just set-up a new server, running postfix, with submission(s) activated on standard ports (587, 465) Shortly after it has been setup, I see brute force attacks (not surprising) from a whole /24 network (more surprising). I carefully checked the logs, and see the modus operandi, which basically loop across the IP addresses in the network, to avoid being blacklisted by tools like fail2ban. And it is true, even with fail2ban activated, no IP is blacklisted. By activating verbose logging, I see multiple user names are tried, not only passwords. Is there any way, with postfix, to run a script on authentication failure, with information like the IP address and the username passed, for instance. I basically need features that fail2ban doesn't offer - I would like to not rely on reading logs, removing one step and acting more pro-actively. - If a script is called on authentication failure, it is fairly easy to use a Levenshtein distance to differentiate between a user having lost his password and a brute force attack. - If I log all the failure in a database, with the IP address, and the whois information, the script would take decision according to the whois information. What are you using on your side ? - Do you know any service, that I could use, to get the network to ban from an IP address reputation, something like crowdsec, for instance ? - Anyone has success with Suricata, Snort, or a tool like this ? Please, do not suggest third party hosted services, I want to be part of my self-hosting solution. Kind regards, André

4 4

Postfix: running a script on authentication failure
by André Rodier 22 Jun '23

22 Jun '23

Hello, all. I just set-up a new server, running postfix, with submission(s) activated on standard ports (587, 465) Shortly after it has been setup, I see brute force attacks (not surprising) from a whole /24 network (more surprising). I carefully checked the logs, and see the modus operandi, which basically loop across the IP addresses in the network, to avoid being blacklisted by tools like fail2ban. And it is true, even with fail2ban activated, no IP is blacklisted. By activating verbose logging, I see multiple user names are tried, not only passwords. Is there any way, with postfix, to run a script on authentication failure, with information like the IP address and the username passed, for instance. I basically need features that fail2ban doesn't offer - I would like to not rely on reading logs, removing one step and acting more pro-actively. - If a script is called on authentication failure, it is fairly easy to use a Levenshtein distance to differentiate between a user having lost his password and a brute force attack. - If I log all the failure in a database, with the IP address, and the whois information, the script would take decision according to the whois information. What are you using on your side ? - Do you know any service, that I could use, to get the network to ban from an IP address reputation, something like crowdsec, for instance ? - Anyone has success with Suricata, Snort, or a tool like this ? Please, do not suggest third party hosted services, I want to be part of my self-hosting solution. Kind regards, André

1 0

el9 rpms
by Marc 21 Jun '23

21 Jun '23

Is there a specific reason why there are (still) no el9 packages? https://repo.dovecot.org/ce-2.3.17/centos/ https://repo.dovecot.org/ce-2.3-latest/rhel/

4 7

Re: Submission behaviour
by Joseph Tam 21 Jun '23

21 Jun '23

From: "André Rodier" > chain input { > > # Limit new imap connections ala fail2ban > meta nfproto ipv4 tcp dport imaps ct state new,untracked \ > limit rate over 10/minute add @banned_imap_ipv4 { ip saddr } I'm don't know all the subttlties of this rule, but there are some mail clients (MacOSX Mail comes to mind) that will bombard your IMAP server with new connections when it does a global search. It will open a new connection for each mailbox, then do a search. When your connection limit is reached, it will then close all the open connections and do another round. This may be interpreted as a BFD attack, and you'll lock out a legitimate user. Joseph Tam <jtam.home(a)gmail.com>

1 0