- dovecot - dovecot.org

Re: Sieve Symlink Creation
by dovecot＠ptld.com 13 Sep '22

13 Sep '22

> On 09-12-2022 12:16 pm, hi(a)zakaria.website wrote: > > It seems that dovecot doesn't understand the relative format and requires absolute format, per the documentation example. Perhaps find the code which parses the absolute path, and compile your own dovecot build, which can understand the path format you want? I did not find that. I want to learn more, can you link me the dovecot documentation you found explaining how absolute paths are required for sieve? > On 2022-08-25 13:32, dovecot(a)ptld.com wrote: >> The first time when the sieve files and folders get created, the active symlink is created as a full absolute path >> >> .active_sieve -> /mnt/email/domain/user/_sieve/filters.sieve >> >> After that, if you disable and enable the rule set the symlink gets recreated as relative >> >> .active_sieve -> filters.sieve >> >> How can i have the symlink always created as a relative path even on first time creation? >> Having a full absolute path over a mounted NSF is fragile. >> >> Dovecot 2.3.16 >> Pigeonhole 2.3.16 >> >> mail_home = /mnt/email/%d/%n/_dovecot >> mail_location = maildir:/mnt/email/%d/%n/_folders:INDEX=/mnt/email/%d/%n/_dovecot:CONTROL=/mnt/email/%d/%n/_dovecot >> plugin { >> sieve = file:~/../_sieve;active=~/../_sieve/.active_sieve >> sieve_max_script_size = 1M >> sieve_max_actions = 32 >> sieve_max_redirects = 4 >> sieve_quota_max_scripts = 20 >> sieve_quota_max_storage = 5M >> sieve_vacation_min_period = 1d >> sieve_vacation_use_original_recipient = no >> sieve_vacation_dont_check_recipient = no >> sieve_vacation_send_from_recipient = no >> sieve_redirect_envelope_from = sender >> sieve_user_email = %u >> }

2 1

real duplicates of some e-mails / dovecot-2.3.19
by Götz Reinicke 13 Sep '22

13 Sep '22

Hi, we have the issue, that some(!) e-mails we receive are duplicated when processed by dovecot and stored to the users inbox. The mails are binary identical, same message ID, same size etc. diff sees no difference …. For now we only see that it happens do small mails max. +- 5k in size. And in dose not happen for all mails, but some are spam, some are internal mails some are newsletter which are expected…. and it happens for different users. Dose anyone have/had a similar issue? Any suggestion or idea would be helpful. Thanks . Götz

2 1

Handling imap from outlook 365
by Todd Krein 12 Sep '22

12 Sep '22

I apologize if this has been answered before, but... Microsoft Outlook 365 doesn't allow a user to specify the account name for an imap acout, only the email address. Thus fred(a)smith.com<mailto:fred@smith.com> tries to log in as "fred(a)smith.com<mailto:fred@smith.com>" rather than "fred". Has anyone seen a way to fix this (Microsoft help boards are silent), perhaps by stripping the "@smith.com" during the logon procedure? Thanks, Todd Todd Krein | VP Hardware o:650.566.6657 m:408.857.0556 [Ooma_email_sig_11_ooma.jpg] ooma.com<http://ooma.com> _______________________________________ Ooma Confidential and Proprietary (including attachments if any)

3 2

Outlook 365 (RE: dovecot Digest, Vol 233, Issue 20)
by Todd Krein 12 Sep '22

12 Sep '22

Emilio, Thanks for the suggestions, but neither of these worked for me. Manual setup on Outlook 365 (I think as opposed to Outlook 202x), doesn't let you set the account name directly. It's being "helpful." Interestingly enough, if you set up as POP3, it realizes the account name is wrong and lets you enter it once you try to sync. Not so with IMAP. I was able to create the new account on the control panel, but outlook365 ignores all those accounts. Cheers, Todd -----Original Message----- ---------------------------------------------------------------------- Message: 1 Date: Sun, 11 Sep 2022 01:53:21 -0400 From: Emilio Augusto Lazo Zaia <emiliolazozaia(a)gmail.com> To: dovecot(a)dovecot.org Subject: Re: Solved (RE: Handling imap from outlook 365) Message-ID: <5eb6d25f-f9a9-88c5-db01-9306d0925a9c(a)gmail.com> Content-Type: text/plain; charset="utf-8"; Format="flowed" Manual setup or go to Windows Control Panel, Mail / Outlook section and the new account dialog should be like earlier versions of Office... hth Emilio Augusto Lazo Zaia On 9/9/22 16:18, Todd Krein wrote: > > (Sorry for the format, not sure how to reply to a single email in a > digest) > > ?[HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\setup] > > "DisableOffice365SimplifiedAccountCreation"=dword:00000001 > > and then chosen manual setup?? That lets us specify 'fred' as the username. > > Ken > > ? > > Ken, > > ????????????? OMG, you are a godsend. Yes, that fixed it completely! > > ????????????? Where do I send the beer? > > ????????????? Best regards, > > ????????????? Todd > > *Todd Krein *| VP Hardware > > o:650.566.6657 ? m:408.857.0556 > > Ooma_email_sig_11_ooma.jpg > > ooma.com <http://ooma.com> > > _______________________________________ > > Ooma Confidential and Proprietary (including attachments if any) >

1 0

Solved (RE: Handling imap from outlook 365)
by Todd Krein 11 Sep '22

11 Sep '22

(Sorry for the format, not sure how to reply to a single email in a digest) "[HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\setup] "DisableOffice365SimplifiedAccountCreation"=dword:00000001 and then chosen manual setup? That lets us specify 'fred' as the username. Ken " Ken, OMG, you are a godsend. Yes, that fixed it completely! Where do I send the beer? Best regards, Todd Todd Krein | VP Hardware o:650.566.6657 m:408.857.0556 [Ooma_email_sig_11_ooma.jpg] ooma.com<http://ooma.com> _______________________________________ Ooma Confidential and Proprietary (including attachments if any)

2 1

Unclear how to get both user and domain quotas to work
by Hans van Zijst 10 Sep '22

10 Sep '22

Hi, First of all: my apologies for this long message. I'm trying to post all the information anybody could need to help me on my way. What I'm trying to make is an installation where both users and domains can have quotas. Ideally I would configure a quota for a domain and set a quota of 0 for all users within that domain, so that mail will be accepted up to the point where the domain quota is reached. Setting up user quota was fairly easy, there's lots of documentation around and examples to take inspiration from. Not so much for domain quota however, or I'm really bad at searching the Net. I'm running Debian Bullseye here: MariaDB 10.5.12 Dovecot 2.3.13 Postfixadmin 3.3.10 I want to use dictionaries in MySQL, because eventually this will be a platform with several Dovecot and Postfix servers. At this time I'm only running one Dovecot installation and a few Postfix servers (two for communication with the outside world and one to do the virus and spam scanning). My current setup for user quota is how Postfixadmin wants it: MariaDB [postfixadmin]> desc quota2; +----------+--------------+------+-----+---------+-------+ | Field | Type | Null | Key | Default | Extra | +----------+--------------+------+-----+---------+-------+ | username | varchar(100) | NO | PRI | NULL | | | bytes | bigint(20) | NO | | 0 | | | messages | int(11) | NO | | 0 | | +----------+--------------+------+-----+---------+-------+ 3 rows in set (0.001 sec) In /etc/dovecot/conf.d/90-quota.conf I have this: plugin { quota = dict:User quota::proxy::sqlquota quota_rule = *:bytes=1024M quota_rule2 = Trash:bytes=+100M quota_vsizes = yes quota_status_success = DUNNO quota_status_nouser = DUNNO quota_status_overquota = "552 5.2.2 Mailbox is full" } dict { sqlquota = mysql:/etc/dovecot/dovecot-dict-sql.conf.ext } The SQL-configuration /etc/dovecot/dovecot-dict-sql.conf.ext is this: connect = host=... dbname=... user=... password=... map { pattern = priv/quota/storage table = quota2 username_field = username value_field = bytes } map { pattern = priv/quota/messages table = quota2 username_field = username value_field = messages } map { pattern = shared/expire/$user/$mailbox table = expires value_field = expire_stamp fields { username = $user mailbox = $mailbox } } I use LMTP to accept mail from Postfix; the quota-plugin is activated for LMTP, so every incoming mail should be counted. This works like a charm: if I don't configure a quota for a user, he gets the default 1GB, if I override it in Postfixadmin, then that's what he gets. I'm running quota-status on a TCP-port, so the gateway SMTP-servers can connect to Dovecot for a quotacheck to decide whether to accept or reject an incoming message. Again, this works flawlessly. I can't find any serious documentation about this mapping thing. In particular, what's with that "pattern"? All I can find in the documentation is: "The dict key must match exactly priv/quota/storage. The dict keys are hardcoded in the Dovecot code, so depending on what functionality you’re configuring you need to know the available dict keys used it." -- https://doc.dovecot.org/configuration_manual/dict/#dict-sql If anyone can point me at better documentation than the actual source code: please! I browsed through the quota-plugin source code, but I'm not a programmer and couldn't find what I thought I was looking for. That said, I'm not sure where I got the third "map" from, with the shared/expire pattern. I seem to have forgotten to document that bit of my journey. Now, domain quotas... I've tried all kinds of stuff, but at the moment I'm stuck with something that seems to almost work. I added a second quota root: plugin { quota2 = dict:Domain quota:%d:proxy::sqldomainquota quota2_rule = *:bytes=1024M quota2_status_success = DUNNO quota2_status_nouser = DUNNO quota2_status_overquota = "552 5.2.2 Domain quota exceeded" quota2_vsizes = yes } dict { sqldomainquota = mysql:/etc/dovecot/dovecot-dict-sql.conf.ext } This dict refers to the same mapping as the one for user quotas, and I think that's the way it should be. Please correct me if I'm wrong. This creates a new user in the quota2 table, by the name of just the domain. Unfortunately, it simply fills it with the numbers from the first user it can find in that domain, not all users in that domain combined. What I think I should do, is change something in the dict so that it sums up all users in that domain, something like this: SELECT SUM(bytes) FROM quota2 WHERE username LIKE '%@domain'; Problem is that I can't find anything useful online with regards to this, I'm not even sure if I'm thinking in the right direction here. Any hints, suggestions or corrections? Or pointers to articles or documentation I might have missed? Kind regards, Hans

2 1

Re: Dead links at https://wiki.dovecot.org/Migration/MailFormat
by Joseph Tam 10 Sep '22

10 Sep '22

> These links: > > http://dag.wieers.com/rpm/packages/pine/pine-4.64-3.el4.rf.i386.rpm > http://staff.washington.edu/chappa/pine/info/maildir.html > > on this page > > https://wiki.dovecot.org/Migration/MailFormat > > at the Dovecot wiki do not lead to useful results. I lost the context of this thread, but if you're looking for mailutil or the older pine stuff, the project has forked inti alpine and you can find the source tarball at https://alpineapp.email/ Joseph Tam <jtam.home(a)gmail.com>

1 0

Old-stats plugin and fifo_listener permissions
by Grant Keller 10 Sep '22

10 Sep '22

Hello, Currently working on using the old-stats plugin in dovecot version 2.3.10.1. What file permissions are recommended for the old-stats-mail and old-stats-user sockets? I was seeing a lack of data from the doveadm oldstats dump command until I adjusted the default config to the following: service old-stats { fifo_listener old-stats-mail { group = mode = 0666 user = root } fifo_listener old-stats-user { group = mode = 0666 user = } } Not totally clear on which processes need read or write on those so any advice is appreciated.

1 0

Managesieve not working
by Francis Augusto Medeiros-Logeay 09 Sep '22

09 Sep '22

Hi, I am running dovecot 2.3.7.2 on ubuntu, and have a replication setup. I noticed that managesieve doesn't seem to be working. On my backup MX, doing a telnet to 4190 gets me the proper greetings, but doing the same on my main server just gave me the normal telnet "Escape character is..." I get the following info on the server: root@d0ba5bb19b6b:/# doveadm service status managesieve name: managesieve process_count: 0 process_avail: 0 process_limit: 1024 client_limit: 1 throttle_secs: 0 exit_failure_last: 0 exit_failures_in_sec: 0 last_drop_warning: 0 listen_pending: n listening: y doveadm_stop: n But when attempting to connect, it doesn't work. Any advice? Best, Francis

5 11

Dead links at https://wiki.dovecot.org/Migration/MailFormat
by kjohnson＠eclypse.org 09 Sep '22

09 Sep '22

Hi, These links: http://dag.wieers.com/rpm/packages/pine/pine-4.64-3.el4.rf.i386.rpm http://staff.washington.edu/chappa/pine/info/maildir.html on this page https://wiki.dovecot.org/Migration/MailFormat at the Dovecot wiki do not lead to useful results. The dag.wieers.com link seems to redirect to a server at packages.sw.be that does not exist (or does not answer today). Not archived at Wayback Machine as far as I can tell. The washington.edu link returns a 404. This page does appear to be archived by the Wayback Machine, but many of the captures reported by the Wayback Machine actually return no results. I have not checked every capture. I did find a capture from 4 Oct 2008 that does have content. This is the link to that capture. https://web.archive.org/web/20081004145454/http://staff.washington.edu/chap… Perhaps someone who attends to the Dovecot Wiki will find this information helpful in updating that page in a useful way. Regards, Ken

1 0

Re: Re: Unable to set quota-fs plugin [fixed]
by Jorge Concha C. 08 Sep '22

08 Sep '22

Hello, This solution don't work for me (in Rocky Linux 8 and 9). Do you know other solutions? Or maybe an additional step is necessary? Thanks > The issue was in the systemd service file. The option PrivateDevices was > setted. It prevents the service to have access to physical devices. I > removed this option and from there, quota is reported without errors. > > Thanks for your support > > Regards, > > - > Eric Grammatico _/) > Jorge Concha C. Area de Sistemas CEC - U. de Chile

2 2

username changed gumby@example.com -> gumby
by Tom 08 Sep '22

08 Sep '22

As you can see in this snip of the maillog, the domain part of the username is being stripped away: Sep 6 23:12:40 vaj dovecot[114637]: auth-worker(114662): Debug: conn unix:auth-worker (pid=114660,uid=97): auth-worker<2>: passwd(gumby(a)example.com,10.0.0.70,<YlSArw3oaqoKAABG>): Performing userdb lookup Sep 6 23:12:40 vaj dovecot[114637]: auth-worker(114662): Debug: conn unix:auth-worker (pid=114660,uid=97): auth-worker<2>: passwd(gumby(a)example.com,10.0.0.70,<YlSArw3oaqoKAABG>): lookup Sep 6 23:12:40 vaj dovecot[114637]: auth-worker(114662): Debug: conn unix:auth-worker (pid=114660,uid=97): auth-worker<2>: passwd(gumby(a)example.com,10.0.0.70,<YlSArw3oaqoKAABG>): username changed gumby(a)example.com -> gumby Sep 6 23:12:40 vaj dovecot[114637]: auth-worker(114662): Debug: conn unix:auth-worker (pid=114660,uid=97): auth-worker<2>: passwd(gumby,10.0.0.70,<YlSArw3oaqoKAABG>): Finished userdb lookup This means that my mail_location will fail since it stores mail by user and domain. dovecot -n: # 2.3.19.1 (9b53102964): /etc/dovecot/dovecot.conf # OS: Linux 5.19.6-200.fc36.x86_64 x86_64 Fedora release 36 (Thirty Six) # Hostname: vaj.example.com auth_debug = yes auth_default_realm = EXAMPLE.COM auth_gssapi_hostname = $ALL auth_krb5_keytab = /etc/dovecot/dovecot-krb5.keytab auth_mechanisms = gssapi login plain auth_realms = example.com auth_username_format = %u auth_verbose = yes debug_log_path = /var/log/dovecot/debug info_log_path = /var/log/dovecot/info log_path = /var/log/dovecot/error log_timestamp = "%Y.%m.%d %H:%M:%S " mail_debug = yes mail_location = maildir:%h/Maildir/%d mbox_write_locks = fcntl namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } passdb { driver = pam } ssl = no ssl_cert = </etc/pki/dovecot/certs/dovecot.pem ssl_cipher_list = PROFILE=SYSTEM ssl_key = # hidden, use -P to show it userdb { driver = passwd } userdb { driver = passwd override_fields = mail=maildir:%h/Maildir/%d } verbose_ssl = yes How can I get around this issue? I need mailboxes stored by user/domain.

2 3

Permission denied UNIX perms appear ok (ACL/MAC wrong?))
by Austin Witmer 07 Sep '22

07 Sep '22

Hello all! Recently I upgraded my mail server to Ubuntu 22.04 LTS and ever since then I am periodically getting some dovecot errors like the below in my mail log. As far as I can tell, my unix perms are just fine. What is ACL/MAC? Aug 20 14:41:58 mail dovecot: imap(user(a)domain.com)<56316><1NieGKPmuOdKwxVI>: Error: Mailbox INBOX: stat(/mnt/volume1/mailserver/plain/maildir/domain.com/user/dovecot.index.lo… failed: Permission denied (euid=1000(austin) egid=1000(austin) UNIX perms appear ok (ACL/MAC wrong?)) And here is the listing showing the permissions for that file. austin@mail:~$ ls -la /mnt/volume1/mailserver/plain/maildir/domain.com/user/dovecot.index.log -rwxrwxr-- 1 austin austin 15796 Aug 20 14:41 /mnt/volume1/mailserver/plain/maildir/domain.com/user/dovecot.index.log What in the world is causing these errors, and what can I do about them? Thanks in advance! Austin Witmer

7 20

Config file syntax: secrets from file in key=value
by Tobias Florek 06 Sep '22

06 Sep '22

Hi! I'd like to set up proxy authentication. This works fine, but I cannot get the passwords in to be read from file. Specifically I have this passdb block. passdb { driver = passwd-file mechanisms = plain scram-sha-256 default_fields = proxy=y host=dovecot-backend master=imapc-master-user proxy_mech=plain pass=</run/secrets/dovecot.imapc-master-user/password args = /run/secrets/dovecot.generated.app-passwd-file/passwd } This sets the password to the string /run/secrets/dovecot.imapc-master-user/password. I'd like the password to be set to the content of said file. Is it possible to get the password from a file or less desirable from the environment? Reading https://doc.dovecot.org/configuration_manual/config_file/ I assume it's not. Cheers, Tobias Florek

2 3

Replication
by Silvio Siefke 05 Sep '22

05 Sep '22

Hello, I try the replication of two Dovecot servers, but some errors always appear. Maybe someone here has an idea what's going wrong. As an MTA I use OpenSMTPD. Thank You Silvio dovecot -n on MX 1 # 2.3.13 (89f716dc2): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.13 (cdd19fe3) # OS: Linux 5.10.0-16-amd64 x86_64 Debian 11.4 # Hostname: asia.sisi-systems.ovh auth_mechanisms = plain login doveadm_password = # hidden, use -P to show it doveadm_port = 20000 mail_gid = vmail mail_location = maildir:~/Maildir mail_plugins = " notify replication" mail_privileged_group = vmail mail_uid = vmail managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext imapsieve vnd.dovecot.imapsieve namespace inbox { inbox = yes location = mailbox Drafts { auto = subscribe special_use = \Drafts } mailbox Sent { auto = subscribe special_use = \Sent } mailbox Spam { auto = subscribe special_use = \Junk } mailbox Trash { auto = subscribe special_use = \Trash } prefix = } passdb { args = scheme=SHA512-CRYPT username_format=%u /etc/dovecot/users driver = passwd-file } plugin { imapsieve_mailbox1_before = file:/var/vmail/sieve/global/learn-spam.sieve imapsieve_mailbox1_causes = COPY imapsieve_mailbox1_name = Spam imapsieve_mailbox2_before = file:/var/vmail/sieve/global/learn-ham.sieve imapsieve_mailbox2_causes = COPY imapsieve_mailbox2_from = Spam imapsieve_mailbox2_name = * mail_replica = tcp:192.168.1.112 quota = maildir:User quota quota_exceeded_message = Benutzer %u hat das Speichervolumen überschritten. / User %u has exhausted allowed storage space. replication_sync_timeout = 2 sieve = file:/var/vmail/sieve/%d/%n/scripts;active=/var/vmail/sieve/%d/%n/active-script.sieve sieve_before = /var/vmail/sieve/global/spam-global.sieve sieve_global_extensions = +vnd.dovecot.pipe +vnd.dovecot.environment sieve_pipe_bin_dir = /usr/lib/dovecot/sieve-pipe sieve_plugins = sieve_imapsieve sieve_extprograms } protocols = lmtp imap pop3 sieve service aggregator { fifo_listener replication-notify-fifo { user = vmail } unix_listener replication-notify { user = vmail } } service doveadm { inet_listener { port = 20000 } } service imap-login { inet_listener imap { port = 143 } } service lmtp { unix_listener lmtp { group = vmail user = vmail } } service managesieve-login { inet_listener sieve { port = 4190 } } service pop3-login { inet_listener pop3 { port = 110 } inet_listener pop3s { port = 995 ssl = yes } } service replicator { process_min_avail = 1 unix_listener replicator-doveadm { mode = 0600 user = vmail } } ssl = required ssl_cert = </etc/lego/certificates/imap.sisi-systems.ovh.crt ssl_cipher_list = ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384 ssl_client_ca_dir = /etc/ssl/certs ssl_dh = # hidden, use -P to show it ssl_key = # hidden, use -P to show it ssl_min_protocol = TLSv1.2 userdb { args = username_format=%u /etc/dovecot/users driver = passwd-file override_fields = uid=vmail gid=vmail home=/home/vmail/%d/%n } protocol imap { imap_idle_notify_interval = 29 mins mail_max_userip_connections = 20 mail_plugins = " notify replication quota imap_quota imap_sieve" } protocol lmtp { mail_plugins = " notify replication sieve notify push_notification" postmaster_address = network(a)sisi-systems.ovh } protocol pop3 { mail_max_userip_connections = 10 mail_plugins = " notify replication" } dovecot -n on MX 2 # 2.3.13 (89f716dc2): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.13 (cdd19fe3) # OS: Linux 5.10.0-15-amd64 x86_64 Debian 11.4 # Hostname: bulgaria.sisi-systems.ovh auth_mechanisms = plain login doveadm_password = # hidden, use -P to show it doveadm_port = 20000 mail_gid = vmail mail_location = maildir:~/Maildir mail_plugins = " notify replication" mail_privileged_group = vmail mail_uid = vmail managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext imapsieve vnd.dovecot.imapsieve namespace inbox { inbox = yes location = mailbox Drafts { auto = subscribe special_use = \Drafts } mailbox Sent { auto = subscribe special_use = \Sent } mailbox Spam { auto = subscribe special_use = \Junk } mailbox Trash { auto = subscribe special_use = \Trash } prefix = } passdb { args = scheme=SHA512-CRYPT username_format=%u /etc/dovecot/users driver = passwd-file } plugin { imapsieve_mailbox1_before = file:/var/vmail/sieve/global/learn-spam.sieve imapsieve_mailbox1_causes = COPY imapsieve_mailbox1_name = Spam imapsieve_mailbox2_before = file:/var/vmail/sieve/global/learn-ham.sieve imapsieve_mailbox2_causes = COPY imapsieve_mailbox2_from = Spam imapsieve_mailbox2_name = * mail_replica = tcp:192.168.1.102 quota = maildir:User quota quota_exceeded_message = Benutzer %u hat das Speichervolumen überschritten. / User %u has exhausted allowed storage space. replication_sync_timeout = 2 sieve = file:/var/vmail/sieve/%d/%n/scripts;active=/var/vmail/sieve/%d/%n/active-script.sieve sieve_before = /var/vmail/sieve/global/spam-global.sieve sieve_global_extensions = +vnd.dovecot.pipe +vnd.dovecot.environment sieve_pipe_bin_dir = /usr/lib/dovecot/sieve-pipe sieve_plugins = sieve_imapsieve sieve_extprograms } protocols = lmtp imap pop3 sieve service aggregator { fifo_listener replication-notify-fifo { user = vmail } unix_listener replication-notify { user = vmail } } service doveadm { inet_listener { port = 20000 } } service imap-login { inet_listener imap { port = 143 } } service lmtp { unix_listener lmtp { group = vmail user = vmail } } service managesieve-login { inet_listener sieve { port = 4190 } } service pop3-login { inet_listener pop3 { port = 110 } inet_listener pop3s { port = 995 ssl = yes } } service replicator { process_min_avail = 1 unix_listener replicator-doveadm { mode = 0600 user = vmail } } ssl = required ssl_cert = </etc/lego/certificates/imap.sisi-systems.ovh.crt ssl_cipher_list = ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384 ssl_client_ca_dir = /etc/ssl/certs ssl_dh = # hidden, use -P to show it ssl_key = # hidden, use -P to show it ssl_min_protocol = TLSv1.2 userdb { args = username_format=%u /etc/dovecot/users driver = passwd-file override_fields = uid=vmail gid=vmail home=/home/vmail/%d/%n } protocol imap { imap_idle_notify_interval = 29 mins mail_max_userip_connections = 20 mail_plugins = " notify replication quota imap_quota imap_sieve" } protocol lmtp { mail_plugins = " notify replication sieve notify push_notification" postmaster_address = network(a)sisi-systems.ovh } protocol pop3 { mail_max_userip_connections = 10 mail_plugins = " notify replication" } Log MX 1 (asia) Sep 5 18:02:12 asia dovecot: replicator: Fatal: master: service(replicator): child 706077 killed with signal 6 (core dumps disabled - https://dovecot.org/bugreport.html#coredumps) Sep 5 18:02:18 asia dovecot: replicator: Panic: data stack: Out of memory when allocating 268435496 bytes Sep 5 18:02:18 asia dovecot: replicator: Error: Raw backtrace: /usr/lib/dovecot/libdovecot.so.0(backtrace_append+0x42) [0x7f27434e84e2] -> /usr/lib/dovecot/libdovecot.so.0(backtrace_get+0x1e) [0x7f27434e85fe] -> /usr/lib/dovecot/libdovecot.so.0(+0xfc49b) [0x7f27434f449b] -> /usr/lib/dovecot/libdovecot.so.0(+0xfc531) [0x7f27434f4531] -> /usr/lib/dovecot/libdovecot.so.0(+0x53aee) [0x7f274344baee] -> /usr/lib/dovecot/libdovecot.so.0(+0x53435) [0x7f274344b435] -> /usr/lib/dovecot/libdovecot.so.0(+0xf5d88) [0x7f27434edd88] -> /usr/lib/dovecot/libdovecot.so.0(+0x11b818) [0x7f2743513818] -> /usr/lib/dovecot/libdovecot.so.0(+0xf25f2) [0x7f27434ea5f2] -> /usr/lib/dovecot/libdovecot.so.0(+0xf26a9) [0x7f27434ea6a9] -> /usr/lib/dovecot/libdovecot.so.0(buffer_write+0x1e) [0x7f27434ea8be] -> dovecot/replicator(replicator_queue_push+0x14a) [0x5633c8c4eb1a] -> dovecot/replicator(+0x5296) [0x5633c8c4e296] -> dovecot/replicator(+0x493e) [0x5633c8c4d93e] -> dovecot/replicator(+0x4b1c) [0x5633c8c4db1c] -> /usr/lib/dovecot/libdovecot.so.0(io_loop_call_io+0x69) [0x7f2743509f59] -> /usr/lib/dovecot/libdovecot.so.0(io_loop_handler_run_internal+0x132) [0x7f274350b592] -> /usr/lib/dovecot/libdovecot.so.0(io_loop_handler_run+0x50) [0x7f274350a000] -> /usr/lib/dovecot/libdovecot.so.0(io_loop_run+0x40) [0x7f274350a1c0] -> /usr/lib/dovecot/libdovecot.so.0(master_service_run+0x13) [0x7f27434804e3] -> dovecot/replicator(main+0x18d) [0x5633c8c4ccad] -> /lib/x86_64-linux-gnu/libc.so.6(__libc_start_main+0xea) [0x7f2743254d0a] -> dovecot/replicator(_start+0x2a) [0x5633c8c4cd6a] Sep 5 18:02:18 asia dovecot: replicator: Fatal: master: service(replicator): child 706082 killed with signal 6 (core dumps disabled - https://dovecot.org/bugreport.html#coredumps) Log MX 2 (bulgaria) Sep 5 13:02:05 bulgaria dovecot: replicator: Panic: data stack: Out of memory when allocating 268435496 bytes Sep 5 13:02:05 bulgaria dovecot: replicator: Error: Raw backtrace: /usr/lib/dovecot/libdovecot.so.0(backtrace_append+0x42) [0x7f813fa394e2] -> /usr/lib/dovecot/libdovecot.so.0(backtrace_get+0x1e) [0x7f813fa395fe] -> /usr/lib/dovecot/libdovecot.so.0(+0xfc49b) [0x7f813fa4549b] -> /usr/lib/dovecot/libdovecot.so.0(+0xfc531) [0x7f813fa45531] -> /usr/lib/dovecot/libdovecot.so.0(+0x53aee) [0x7f813f99caee] -> /usr/lib/dovecot/libdovecot.so.0(+0x53435) [0x7f813f99c435] -> /usr/lib/dovecot/libdovecot.so.0(+0xf5d88) [0x7f813fa3ed88] -> /usr/lib/dovecot/libdovecot.so.0(+0x11b818) [0x7f813fa64818] -> /usr/lib/dovecot/libdovecot.so.0(+0xf25f2) [0x7f813fa3b5f2] -> /usr/lib/dovecot/libdovecot.so.0(+0xf26a9) [0x7f813fa3b6a9] -> /usr/lib/dovecot/libdovecot.so.0(buffer_write+0x1e) [0x7f813fa3b8be] -> dovecot/replicator(replicator_queue_push+0x14a) [0x5646d37c5b1a] -> dovecot/replicator(+0x5296) [0x5646d37c5296] -> dovecot/replicator(+0x493e) [0x5646d37c493e] -> dovecot/replicator(+0x4b1c) [0x5646d37c4b1c] -> /usr/lib/dovecot/libdovecot.so.0(io_loop_call_io+0x69) [0x7f813fa5af59] -> /usr/lib/dovecot/libdovecot.so.0(io_loop_handler_run_internal+0x132) [0x7f813fa5c592] -> /usr/lib/dovecot/libdovecot.so.0(io_loop_handler_run+0x50) [0x7f813fa5b000] -> /usr/lib/dovecot/libdovecot.so.0(io_loop_run+0x40) [0x7f813fa5b1c0] -> /usr/lib/dovecot/libdovecot.so.0(master_service_run+0x13) [0x7f813f9d14e3] -> dovecot/replicator(main+0x18d) [0x5646d37c3cad] -> /lib/x86_64-linux-gnu/libc.so.6(__libc_start_main+0xea) [0x7f813f7a5d0a] -> dovecot/replicator(_start+0x2a) [0x5646d37c3d6a] Sep 5 13:02:05 bulgaria dovecot: replicator: Fatal: master: service(replicator): child 144867 killed with signal 6 (core dumps disabled - https://dovecot.org/bugreport.html#coredumps)

5 6

Bypass quota check
by Gabriele Nencioni 05 Sep '22

05 Sep '22

Hi all, I have the following quota configuration: lmtp_rcpt_check_quota = no mail_plugins = notify mail_log quota quota = dict:User quota::file:%h/dovecot-quota quota_exceeded_message = Quota exceeded quota_rule2 = Trash:storage=+100M quota_warning = storage=100%% quota-warning -q 100 -n %n -d %d -e OverQuota quota_warning2 = storage=80%% quota-warning -q 80 -n %n -d %d -e FillQuota quota_warning3 = -storage=99%% quota-warning -q 99 -n %n -d %d -e InQuota quota_full_tempfail = yes service quota-warning { executable = script /usr/local/dovecot/quotamanager.sh unix_listener quota-warning { mail_plugins = notify mail_log quota imap_quota imap_sieve mail_plugins = notify mail_log quota sieve and the quota_rule (per-user) is retrieved by a specific SQL query in my userdb. I'm wondering if there is a way to send an email to an account even if it's in overquota? In other words: is there a way to bypass (or skip) the quota check, maybe setting a sort of ACL, for example if an email comes from a specific ip address? Thanks in advance Regards, -- Gabriele Nencioni

2 1

Thousands of SSL certificates stalls new logins during reload - problem with Dovecot config process
by Bartosz Kwitniewski 05 Sep '22

05 Sep '22

Hello, I'm running a dovecot 2.3.19.1 server that has around 6000 SSL certificates in separate config files, each containing: local_name "domain" { ssl_cert = ... ssl_key = ... } When new certificate is added, dovecot is reloaded (around 20 times a day). When dovecot is being reloaded, users are unable to log in for around 30 seconds. The main problem here seems to be that during reload, new config process is immediately designated as the one serving config requests and then it starts parsing config files, which takes around 20-30 seconds. If it would parse config files first, and only then would become a new process for serving config requests, then it would probably solve the problem. Or perhaps there is a better way to load new certificates or a way to optimize? There is another problem with config process and shutdown_clients=no. We do not want to disconnect users during reload, because e.g. Thunderbird displays a popup that server is shutting down. When there are long lasting IMAP connections from Google and other services that aggregate e-mail, old config process is not being killed. Because config process with ~6000 certificates is using ~1 GB of RAM, it can quickly rise to 20 GB of memory used. This is not a big issue however, because we have created a task that kills old processes, but there could be a built-in mechanism to solve that problem. I have created minimal configuration and scripts to recreate problem. Reproduction steps below. Configuration (doveadm config -n): ========== # 2.3.19.1 (9b53102964): /etc/dovecot/dovecot.conf # OS: Linux 4.18.0-372.9.1.1.lve.el8.x86_64 x86_64 CloudLinux release 8.6 (Leonid Kadenyuk) # Hostname: - auth_mechanisms = plain login default_client_limit = 12288 default_process_limit = 2048 default_vsz_limit = 1 G first_valid_uid = 1000 mail_location = maildir:~/mail mbox_write_locks = fcntl namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } passdb { args = scheme=CRYPT username_format=%u /etc/dovecot/users driver = passwd-file } service auth-worker { user = $default_internal_user } service auth { user = $default_internal_user } service config { vsz_limit = 4 G } service imap-login { process_min_avail = 20 service_count = 1 } service imap { process_limit = 4096 } service pop3-login { process_min_avail = 20 service_count = 1 } service pop3 { process_limit = 512 } shutdown_clients = no ssl_cert = </etc/dovecot/certs/example.org.crt ssl_cipher_list = ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES128-SHA256:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA:DHE-DSS-AES128-GCM-SHA256:DHE-DSS-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-DSS-AES128-SHA256:DHE-DSS-AES256-SHA256:DHE-DSS-AES128-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-RSA-AES128-SHA:ECDH-ECDSA-AES128-GCM-SHA256:ECDH-ECDSA-AES256-GCM-SHA384:ECDH-RSA-AES128-GCM-SHA256:ECDH-RSA-AES256-GCM-SHA384:ECDH-ECDSA-AES128-SHA256:ECDH-ECDSA-AES256-SHA384:ECDH-ECDSA-AES128-SHA:ECDH-RSA-AES128-SHA256:ECDH-RSA-AES256-SHA384:ECDH-RSA-AES128-SHA:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-CHACHA20-POLY1305 ssl_dh = </etc/dovecot/dh.pem ssl_key = </etc/dovecot/certs/example.org.key ssl_options = no_compression ssl_prefer_server_ciphers = yes userdb { args = username_format=%u /etc/dovecot/users driver = passwd-file } verbose_proctitle = yes protocol imap { mail_max_userip_connections = 2048 } protocol pop3 { mail_max_userip_connections = 2048 } local_name domain4587.example.org mail.domain4587.example.org { ssl_cert = </etc/dovecot/certs/domain4587.example.org.crt ssl_key = </etc/dovecot/certs/domain4587.example.org.key } local_name domain4588.example.org mail.domain4588.example.org { ssl_cert = </etc/dovecot/certs/domain4588.example.org.crt ssl_key = </etc/dovecot/certs/domain4588.example.org.key } (...) 5000 certificates goes here ========== /etc/dovecot/users: ========== user@domain1.example.org:{SHA512-CRYPT}$6$...:1000:1000::/home/test/mail/domain1.example.org/user:: user@domain2.example.org:{SHA512-CRYPT}$6$...:1000:1000::/home/test/mail/domain2.example.org/user:: (...) 5000 users goes here, but one should be enough for testing. ========== Log file from dovecot reload: ========== Sep 02 12:37:24 dovecot[264040]: imap-login: Login: user=<user(a)domain1.example.org>, method=PLAIN, rip=127.0.0.1, lip=127.0.0.1, mpid=264964, TLS, session=<eQXGUK/ngJJ/AAAB> Sep 02 12:37:24 dovecot[264040]: imap(user(a)domain1.example.org)<264964><eQXGUK/ngJJ/AAAB>: Disconnected: Logged out in=25 out=782 deleted=0 expunged=0 trashed=0 hdr_count=0 hdr_bytes=0 body_count=0 body_bytes=0 Sep 02 12:37:25 systemd[1]: Reloading Dovecot IMAP/POP3 email server. Sep 02 12:37:26 dovecot[263234]: master: Warning: SIGHUP received - reloading configuration Sep 02 12:37:36 dovecot[263234]: master: Error: Error reading configuration: read(/usr/local/var/run/dovecot/config) failed: read(size=8192) failed: Interrupted system call - Also failed to read config by executing doveconf: /usr/local/var/run/dovecot/config is a UNIX socket Sep 02 12:37:36 systemd[1]: Reloaded Dovecot IMAP/POP3 email server. Sep 02 12:37:36 dovecot[264040]: imap-login: Fatal: Error reading configuration: read(/usr/local/var/run/dovecot/config) failed: read(size=8192) failed: Interrupted system call - Also failed to read config by executing doveconf: stat(/usr/local/var/run/dovecot/config) failed: No such file or directory (path is from CONFIG_FILE environment) Sep 02 12:37:36 dovecot[264040]: imap-login: Fatal: Error reading configuration: read(/usr/local/var/run/dovecot/config) failed: read(size=8192) failed: Interrupted system call - Also failed to read config by executing doveconf: stat(/usr/local/var/run/dovecot/config) failed: No such file or directory (path is from CONFIG_FILE environment) Sep 02 12:37:42 dovecot[264040]: imap-login: Fatal: Error reading configuration: read(/usr/local/var/run/dovecot/config) failed: read(size=8192) failed: Interrupted system call - Also failed to read config by executing doveconf: stat(/usr/local/var/run/dovecot/config) failed: No such file or directory (path is from CONFIG_FILE environment) Sep 02 12:37:46 dovecot[264040]: imap-login: Fatal: Error reading configuration: read(/usr/local/var/run/dovecot/config) failed: read(size=8192) failed: Interrupted system call - Also failed to read config by executing doveconf: /usr/local/var/run/dovecot/config is a UNIX socket (path is from CONFIG_FILE environment) Sep 02 12:37:46 dovecot[264040]: imap-login: Fatal: Error reading configuration: read(/usr/local/var/run/dovecot/config) failed: read(size=8192) failed: Interrupted system call - Also failed to read config by executing doveconf: /usr/local/var/run/dovecot/config is a UNIX socket (path is from CONFIG_FILE environment) Sep 02 12:37:46 dovecot[263234]: master: Error: service(imap-login): command startup failed, throttling for 2.000 secs Sep 02 12:37:46 dovecot[264040]: imap-login: Fatal: Error reading configuration: read(/usr/local/var/run/dovecot/config) failed: read(size=8192) failed: Interrupted system call - Also failed to read config by executing doveconf: /usr/local/var/run/dovecot/config is a UNIX socket (path is from CONFIG_FILE environment) Sep 02 12:37:47 dovecot[264040]: imap-login: Fatal: Error reading configuration: read(/usr/local/var/run/dovecot/config) failed: read(size=8192) failed: Interrupted system call - Also failed to read config by executing doveconf: stat(/usr/local/var/run/dovecot/config) failed: No such file or directory (path is from CONFIG_FILE environment) Sep 02 12:37:47 dovecot[264040]: imap-login: Fatal: Error reading configuration: read(/usr/local/var/run/dovecot/config) failed: read(size=8192) failed: Interrupted system call - Also failed to read config by executing doveconf: /usr/local/var/run/dovecot/config is a UNIX socket (path is from CONFIG_FILE environment) Sep 02 12:37:48 dovecot[264040]: imap-login: Fatal: Error reading configuration: read(/usr/local/var/run/dovecot/config) failed: read(size=8192) failed: Interrupted system call - Also failed to read config by executing doveconf: stat(/usr/local/var/run/dovecot/config) failed: No such file or directory (path is from CONFIG_FILE environment) Sep 02 12:37:48 dovecot[264040]: imap-login: Fatal: Error reading configuration: read(/usr/local/var/run/dovecot/config) failed: read(size=8192) failed: Interrupted system call - Also failed to read config by executing doveconf: /usr/local/var/run/dovecot/config is a UNIX socket (path is from CONFIG_FILE environment) Sep 02 12:37:48 dovecot[263234]: master: Error: service(imap-login): command startup failed, throttling for 4.000 secs Sep 02 12:37:49 dovecot[264040]: imap-login: Disconnected: Connection closed: read(size=737) failed: Connection reset by peer (no auth attempts in 5 secs): user=<>, rip=127.0.0.1, lip=127.0.0.1, TLS handshaking: read(size=737) failed: Connection reset by peer, session=<eNlHUq/njJJ/AAAB> Sep 02 12:37:49 dovecot[264040]: imap-login: Login: user=<user(a)domain1.example.org>, method=PLAIN, rip=127.0.0.1, lip=127.0.0.1, mpid=265059, TLS, session=<duBHUq/njpJ/AAAB> Sep 02 12:37:49 dovecot[264040]: imap(user(a)domain1.example.org)<265059><duBHUq/njpJ/AAAB>: Disconnected: Logged out in=25 out=790 deleted=0 expunged=0 trashed=0 hdr_count=0 hdr_bytes=0 body_count=0 body_bytes=0 ========== Script for testing login: ========== test-imap.expect ========== #!/usr/bin/expect -f set timeout 5 expect_before { timeout { puts "Error: Timeout"; exit 1 } eof { puts "Error: EOF"; exit 1 } } log_user 0 spawn openssl s_client -connect 127.0.0.1:993 expect "* OK" send -- "C1 LOGIN user(a)domain1.example.org PASSWORD\n" expect "C1 OK" send -- "C2 SELECT Inbox\n" expect "C2 OK" send -- "C3 LOGOUT\n" expect "C3 OK" expect eof ========== Script for testing long lasting login: ========== test-imap-long.expect ========== #!/usr/bin/expect -f set timeout -1 expect_before { timeout { puts "Error: Timeout"; exit 1 } eof { puts "Error: EOF"; exit 1 } } log_user 0 spawn openssl s_client -connect 127.0.0.1:993 expect "* OK" send -- "C1 LOGIN user(a)domain1.example.org PASSWORD\n" expect "C1 OK" send -- "C2 SELECT Inbox\n" expect "C2 OK" ========== Reproduction steps (I can attach full package for testing with 5000 self-signed certificates): 1. Start dovecot 2.3.19.1 with 5000 certificates in configuration files using config above. 2. Start test-imap.expect on another console, like that: while true; do date_now=$(date "+%Y-%m-%d %H:%M:%S"); echo -n "[$date_now] Test: "; ./imap-test.expect && echo "OK"; sleep 1; done 3. Reload dovecot. 4. Check logs and test-imap.expect output. Reproduction steps for config process not being terminated: 1. Start dovecot 2.3.19.1 using config above. 2. Start test-imap-long.expect (the second script) on another console. 3. Reload dovecot. 4. Start another test-imap-long.expect on another console. 5. Reload dovecot. 6. Check process list for dovecot config. Best regards, -- Bartosz Kwitniewski

6 9

Call procmail after sieve
by George Asenov 01 Sep '22

01 Sep '22

Hello, I'm trying to achieve the following scenario with dovecot + sieve + procmail. Dovecot is set as LDA in postfix (if this makes any difference) I need to set sieve that after it has executed all it's scripts (including before, ~/.sieve etc) and if keep is in still in effect to call procmail to also execute the custom user filters and then return (if it is not forwarded elsewhere or some) to dovecot for normal delivery. If you ask this I need this for backward compatibility. I now use procmail for local delivery,spam/virus filtering, and users have set a lot of custom filters/redirects. mailbox_command = /usr/bin/procmail-wrapper -o -a $DOMAIN -d $LOGNAME I want to migrate to dovecot as lda and sieve for filtering but to keep procmail working for a while. I have tried to follow (partially) this guide https://www.enricozini.org/blog/2022/debian/migrating-from-procmail-to-siev… but procmail fails to execute ########################## Aug 30 15:22:26 uk7 dovecot[112151]: lda(test-uk7.teststring567.tk)<112151><BlNhECIdDmMXtgEAsVjU+A>: Debug: program exec:/var/lib/dovecot/sieve-pipe/procmail: Establishing connection Aug 30 15:22:26 uk7 dovecot[112151]: lda(test-uk7.teststring567.tk)<112151><BlNhECIdDmMXtgEAsVjU+A>: Debug: program exec:/var/lib/dovecot/sieve-pipe/procmail: Forked child process Aug 30 15:22:26 uk7 dovecot[112151]: lda(test-uk7.teststring567.tk)<112151><BlNhECIdDmMXtgEAsVjU+A>: Debug: program exec:/var/lib/dovecot/sieve-pipe/procmail (112153): Connected to program Aug 30 15:22:26 uk7 dovecot[112151]: lda(test-uk7.teststring567.tk)<112151><BlNhECIdDmMXtgEAsVjU+A>: Debug: program exec:/var/lib/dovecot/sieve-pipe/procmail (112153): Finished streaming payload to program Aug 30 15:22:26 uk7 dovecot[112151]: lda(test-uk7.teststring567.tk)<112151><BlNhECIdDmMXtgEAsVjU+A>: Debug: program exec:/var/lib/dovecot/sieve-pipe/procmail (112153): Finished input to program Aug 30 15:22:26 uk7 dovecot[112151]: lda(test-uk7.teststring567.tk)<112151><BlNhECIdDmMXtgEAsVjU+A>: Debug: program exec:/var/lib/dovecot/sieve-pipe/procmail (112153): Disconnected Aug 30 15:22:26 uk7 dovecot[112151]: lda(test-uk7.teststring567.tk)<112151><BlNhECIdDmMXtgEAsVjU+A>: Debug: program exec:/var/lib/dovecot/sieve-pipe/procmail (112153): Waiting for program to finish after 0 msecs (timeout = 10000 msecs) Aug 30 15:22:26 uk7 dovecot[112153]: lda(test-uk7.teststring567.tk)<112151><BlNhECIdDmMXtgEAsVjU+A>: Fatal: execvp(/var/lib/dovecot/sieve-pipe/procmail) failed: Permission denied Aug 30 15:22:26 uk7 dovecot[112151]: lda(test-uk7.teststring567.tk)<112151><BlNhECIdDmMXtgEAsVjU+A>: Debug: program exec:/var/lib/dovecot/sieve-pipe/procmail (112153): Child process ended Aug 30 15:22:26 uk7 dovecot[112151]: lda(test-uk7.teststring567.tk)<112151><BlNhECIdDmMXtgEAsVjU+A>: program exec:/var/lib/dovecot/sieve-pipe/procmail (112153): Terminated with non-zero exit code 75 Aug 30 15:22:26 uk7 dovecot[112151]: lda(test-uk7.teststring567.tk)<112151><BlNhECIdDmMXtgEAsVjU+A>: Debug: program exec:/var/lib/dovecot/sieve-pipe/procmail (112153): Destroy Aug 30 15:22:26 uk7 dovecot[112151]: lda(test-uk7.teststring567.tk)<112151><BlNhECIdDmMXtgEAsVjU+A>: Error: sieve: failed to execute to program `procmail': refer to server log for more information. [2022-08-30 15:22:26] ############################### i couldn't find the logs referred here some relative (on my opinion) configs: ################################ #/etc/dovecot/conf.d/90-sieve.conf plugin { sieve = file:~/sieve;active=~/.dovecot.sieve sieve_plugins = sieve_extprograms sieve_extensions = +vnd.dovecot.pipe sieve_pipe_bin_dir = /var/lib/dovecot/sieve-pipe sieve_after = /var/lib/dovecot/sieve_after sieve_trace_dir = ~/.sieve-trace sieve_trace_level = matching sieve_trace_debug = yes } #################################### #/var/lib/dovecot/sieve-pipe/procmail #!/bin/sh exec /usr/bin/procmail ##################################### #/var/lib/dovecot/sieve_after/procmail.sieve require "vnd.dovecot.pipe"; pipe "procmail"; ##################################### #cat /etc/procmailrc SHELL="/bin/bash" SENDMAIL="/usr/sbin/sendmail" SENDMAILFLAGS="-oi -t"" LOGFILE="/var/log/procmail.log" # fully define here so user .procmailrc can use it too DELIVER="/usr/libexec/dovecot/deliver -d $LOGNAME" # fallback: DEFAULT="$HOME/Maildir/" MAILDIR="$HOME/Maildir/" # deliver spam to spam folder :0 w * ^X-Spam-Status: Yes | $DELIVER -m spam # uncomment next line to support user .procmailrc files INCLUDERC=$HOME/.procmailrc # deliver to INBOX and stop :0 w | $DELIVER ######################################### Thank you in advance

5 8

Lazy Expunge - why oh why deprecating namespace storage for this
by Matt Bryant 01 Sep '22

01 Sep '22

Hi Dovecot, Noticed on your web site that you have marked lazy_expunge storage location to namespace as deprecated since v2.3.0 and suggest a single mailbox with acl is the way to go. This seems to be a backward step for those that make use of the alt storage facility. Is there anyway we can persuade you NOT to deprecate this - it still works atm Why ? Well scenario time .... Installations make use of alt-storage feature so that new messages can be stored along with indexes etc on faster storage, whilst offloading older less viewed mail to a different storage tier. With storage to namespace - that namespace can have a location set that separates it from the mailbox (maybe even on a 3rd tier of storage) BUT with the mailbox solution then any deleted mail will in fact return from the alternate storage to the primary storage, and then will need to have a job run to alt-move it back off the faster storage to sit with the older messages and also can no longer be a potential 3rd tier of storage. This seems crazy and in fact some of reason mdbox is avoided since purging an mdbox means that any messages on alt-storage gets pulled back to primary storage. Alternately are there plans to allow a mailbox to have a 'location' in which case the location of the expunge mailbox could be set differently ? rgds Matt

1 0

where to setup virtual_mailbox_maps
by frakass 31 Aug '22

31 Aug '22

Hello, I have a domain in virtual_mailbox_domains: aaa.com I have also the virtual_alias_domains which include: bbb.com I know how to forward x(a)bbb.com to y(a)aaa.com by setting up the file "virtual_alias_maps": x(a)bbb.com y(a)aaa.com (and run postmap after the changes.) But, how can I setup virtual_mailbox_maps (if I name this correctly)? for example, 111(a)aaa.com forwards to 222(a)aaa.com. Thank you.

2 1

multiple / backup sql servers for sql server access
by Jack Snodgrass 31 Aug '22

31 Aug '22

I am using this file: dovecot-sql.conf.ext and in there I have a connect = "host=<dbserver> dbname=<dbname> user=<dbuser> password=<dbpass>" My <dbserver> was down and I lost mail access for a few days before I realized that there was an issue. How can I specify a backup server so that if my primary sql server goes down, a backup sql server will be queried? -- jack

3 4

Redhat 9 Repository for Dovecot
by Istiak Ferdous 29 Aug '22

29 Aug '22

Hello, Redhat 9 is publicly released for some time. Is there any plan to provide repository for it? http://repo.dovecot.org/ce-2.3-latest/rhel/ https://developers.redhat.com/articles/2022/05/18/whats-new-red-hat-enterpr… Thanks, Istiak Ferdous

2 4

Understanding Auth-Worker Logging
by dovecot＠ptld.com 29 Aug '22

29 Aug '22

Sometimes when auth-worker gets logged there is an extra 'field' combined with the username and IP inside the sql() section. dovecot[911]: auth-worker(8131): conn unix:auth-worker (pid=3870,uid=97): auth-worker<2>: sql(user(a)example.com,xxx.xxx.xxx.xxx,<8Q4ycCznAPdoiAwp>): Password mismatch (SHA1 of given password: 6ef33886cc5e17a60590cb4badac98d2960b6914) What is the "<8Q4ycCznAPdoiAwp>" and why is it logged only sometimes? Is there any documentation explaining what's inside of logs for dovecot?

2 1

Replication not working - GUIDs conflict - will be merged later
by Patrick Westenberg 28 Aug '22

28 Aug '22

Hi everyone, I have a weird problem with replication that I'm unable to solve. A new account is sychronized from an external provider via imapsync. The mails end up on my backend1. I see that the folder structure is immediately replicated to backend2. However, a lot of mails are missing and "doveadm replicator status" also states that something failed: priority fast sync full sync success sync failed mail(a)example.com none 00:02:36 00:39:47 - y There are no error log entries regarding this user at all. After some research I tried to start the replication manually with "doveadm -D backup -u mail(a)example.com -d tcp:x.y.z.11" and finally I got an error message: Jul 31 13:55:37 doveadm(mail(a)example.com)<11341><rm1YCblt5mJNLAAAJFg/Tg>: Debug: brain M: Mailbox INBOX: local=e74590221b6ce6620d29000024583f4e/0/1, remote=20a9ce2b1c6ce662244e0000baba0ddd/0/1: GUIDs conflict - will be merged later As a matter of fact, the mails in the inbox are the ones that are missing on backend2. I always end up with this error, no matter what I do: - I completely removed the folder structure on backend2. - I removed all database entries. - I removed this user from the replication, ran imapsync again followed by "doveadm -D backup ..." I also removed fts-flatcurve to rule this out as a cause of error. I have no idea what to do. This configuration worked for months. I got this error with 2.3.17.1 and 2.3.19.1 Any hints would be highly appreciated. Regards Patrick # 2.3.19.1 (9b53102964): /usr/local/etc/dovecot/dovecot.conf # Pigeonhole version 0.5.19 (4eae2f79) auth_master_user_separator = * auth_mechanisms = plain login doveadm_password = # hidden, use -P to show it doveadm_port = 12345 listen = x.y.z.12 lmtp_save_to_detail_mailbox = yes log_debug = category=fts-flatcurve log_path = /var/log/dovecot.log mail_debug = yes mail_home = /srv/mail/%Ld/%Ln mail_location = maildir:~/Maildir mail_plugins = quota notify replication managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext editheader metric imapc_traffic { fields = bytes_in bytes_out filter = event=imap_command_finished group_by = user } namespace inbox { inbox = yes location = mailbox Drafts { auto = subscribe special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { auto = subscribe special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Spamverdacht { auto = subscribe special_use = \Junk } mailbox Trash { auto = subscribe special_use = \Trash } prefix = INBOX/ separator = / type = private } passdb { args = /usr/local/etc/dovecot/master-user driver = passwd-file master = yes pass = yes } passdb { args = /usr/local/etc/dovecot/dovecot-sql.conf.ext driver = sql } plugin { mail_replica = tcp:x.y.z.11 quota = count:User quota quota_grace = 25M quota_rule2 = INBOX/Trash:storage=+100M quota_status_nouser = DUNNO quota_status_success = DUNNO quota_vsizes = yes quota_warning = storage=100%% quota-full %u quota_warning2 = storage=95%% quota-warning 95 %u quota_warning3 = storage=80%% quota-warning 80 %u quota_warning4 = -storage=100%% quota-ok %u sieve = ~/.dovecot.sieve sieve_after = /usr/local/etc/dovecot/sieve/sieve_after.sieve sieve_default = /usr/local/etc/dovecot/sieve/default.sieve sieve_dir = ~/sieve sieve_extensions = +editheader } protocols = imap pop3 lmtp sieve service aggregator { fifo_listener replication-notify-fifo { user = vmail } unix_listener replication-notify { user = vmail } } service auth { unix_listener auth-userdb { group = vmail mode = 0666 user = vmail } } service config { unix_listener config { mode = 0600 user = vmail } } service doveadm { inet_listener { port = 12345 } } service imap-login { process_min_avail = 2 service_count = 0 } service lmtp { executable = lmtp -L inet_listener lmtp { address = x.y.z.12 port = 24 } process_min_avail = 20 } service managesieve-login { inet_listener sieve { port = 4190 } } service quota-full { executable = script /usr/local/etc/dovecot/quota_full.sh unix_listener quota-full { user = vmail } user = root } service quota-ok { executable = script /usr/local/etc/dovecot/quota_ok.sh unix_listener quota-ok { user = vmail } user = root } service quota-status { client_limit = 1 executable = quota-status -p postfix inet_listener { port = 12340 } } service quota-warning { executable = script /usr/local/etc/dovecot/quota_warning.sh unix_listener quota-warning { user = vmail } user = root } service replicator { process_min_avail = 1 unix_listener replicator-doveadm { mode = 0600 user = vmail } } ssl = required ssl_cert = </etc/ssl/certs/bundle.pem ssl_client_ca_dir = /etc/ssl/certs ssl_dh = # hidden, use -P to show it ssl_key = # hidden, use -P to show it userdb { driver = prefetch } userdb { args = /usr/local/etc/dovecot/dovecot-sql.conf.ext driver = sql } verbose_proctitle = yes protocol lmtp { info_log_path = /var/log/dovecot-lmtp.log mail_plugins = quota notify replication sieve } protocol imap { mail_max_userip_connections = 40 mail_plugins = quota notify replication imap_quota }

5 9

Sieve Symlink Creation
by dovecot＠ptld.com 26 Aug '22

26 Aug '22

The first time when the sieve files and folders get created, the active symlink is created as a full absolute path .active_sieve -> /mnt/email/domain/user/_sieve/filters.sieve After that, if you disable and enable the rule set the symlink gets recreated as relative .active_sieve -> filters.sieve How can i have the symlink always created as a relative path even on first time creation? Having a full absolute path over a mounted NSF is fragile. Dovecot 2.3.16 Pigeonhole 2.3.16 mail_home = /mnt/email/%d/%n/_dovecot mail_location = maildir:/mnt/email/%d/%n/_folders:INDEX=/mnt/email/%d/%n/_dovecot:CONTROL=/mnt/email/%d/%n/_dovecot plugin { sieve = file:~/../_sieve;active=~/../_sieve/.active_sieve sieve_max_script_size = 1M sieve_max_actions = 32 sieve_max_redirects = 4 sieve_quota_max_scripts = 20 sieve_quota_max_storage = 5M sieve_vacation_min_period = 1d sieve_vacation_use_original_recipient = no sieve_vacation_dont_check_recipient = no sieve_vacation_send_from_recipient = no sieve_redirect_envelope_from = sender sieve_user_email = %u }

2 8

Is this safe?
by Jaroslaw Rafa 25 Aug '22

25 Aug '22

Hello, I asked about this a few days ago, but since nobody answered in that thread, I'd like to bring it up again as a separate thread. Maybe somebody answers... I have written a policy service for Postfix that checks whether the connecting IP address has currently an IMAP session open. For this, it needs to access the socket /var/run/dovecot/anvil. But by default, this socket is accessible only for root, and I obviously DON'T want my service to run as root: srw------- 1 root root 0 May 22 2020 /var/run/dovecot/anvil By modifying Dovecot configuration I was able to chnge the permissions on that socket to: srw-rw---- 1 root dovecot 0 Aug 21 20:47 /var/run/dovecot/anvil Then my service can run under the user "dovecot" and access the socket. Here's my question: did I create any security risk by changing the socket permissions like above and running my service under "dovecot" user? Or will it be better that I create a special user dedicated only for this service and run the service under that user? -- Regards, Jaroslaw Rafa raj(a)rafa.eu.org -- "In a million years, when kids go to school, they're gonna know: once there was a Hushpuppy, and she lived with her daddy in the Bathtub."

2 3

Maybe a bit offtopic, Sieve beaviour
by João Silva 25 Aug '22

25 Aug '22

Hi If a sieve filter contains a rule if header :regex ["From"] ["@xxx.com","@yyy.pt"] { fileinto :create "ac"; } The mail should be copied to the folder ac and then proceed to other rules that a user might have or I understood the fileinto wrong? Using dovecot-pigeonhole-2.2.36-8.el7.x86_64

4 6

namespace directives from userdb not being applied
by Brendan Braybrook 24 Aug '22

24 Aug '22

hi all, i'm having a strange issue. i have a few dovecot instances running: 1- debian 10 with debian's dovecot-core 1:2.3.4.1-5+deb10u5 2- debian 10 with debian's dovecot-core 1:2.3.4.1-5+deb10u6 3- debian 11 with dovecot's dovecot-core 2:2.3.19.1-2+debian11 for all these, i've just been testing with a static userdb (ignore if the login user was different; they all had the same userdb data.. various different passdb configs were tried (none do any userdb prefetching): userdb { driver = static args = mail=maildir:/mail/mailstore03/492/177/b@b.com/:INDEX=/mail/index03/492/177/b@b.com/ home=/mail/mailstore03/492/177/b(a)b.com/ namespace=inbox,share namespace/inbox/separator=/ namespace/share/separator=/ namespace/share/prefix=boop/ } instance #2 and #3 don't seem to pass all the namespace directives i'm passing through to the imap process. (i originally found it happening with a lua userdb script then noticed it with a dict userdb, but the simpler static userdb still shows it happening so i don't think it's related to the different userdb mechanisms themselves) debug looks like: auth: Debug: master userdb out: USER 3466461185 b(a)b.com mail=maildir:/mail/mailstore03/492/177/b@b.com/:INDEX=/mail/index03/492/177/b@b.com/ home=/mail/mailstore03/492/177/b(a)b.com/ namespace=inbox,share namespace/inbox/separator=/ namespace/share/separator=/ namespace/share/prefix=boop/ auth_mech=PLAIN auth_token=bcdb366d56f4fceee83775a1b28ca89ccdf881fd script-login(b(a)b.com)<56895><>: Debug: Added userdb setting: mail=maildir:/mail/mailstore03/492/177/b@b.com/:INDEX=/mail/index03/492/177/b@b.com/ script-login(b(a)b.com)<56895><>: Debug: Added userdb setting: namespace=inbox,share script-login(b(a)b.com)<56895><>: Debug: Added userdb setting: namespace/inbox/separator=/ script-login(b(a)b.com)<56895><>: Debug: Added userdb setting: namespace/share/prefix=boop/ script-login(b(a)b.com)<56895><>: Debug: Added userdb setting: namespace/share/separator=/ imap(b(a)b.com)<56894><9mFyornjaMcKyAUI>: Debug: Added userdb setting: mail=maildir:/mail/mailstore03/492/177/b@b.com/:INDEX=/mail/index03/492/177/b@b.com/ imap(b(a)b.com)<56894><9mFyornjaMcKyAUI>: Debug: Added userdb setting: namespace=inbox,share imap(b(a)b.com)<56894><9mFyornjaMcKyAUI>: Debug: Namespace inbox: type=private, prefix=, sep=, inbox=yes, hidden=no, list=yes, subscriptions=yes location=maildir:/mail/mailstore03/492/177/b@b.com/:INDEX=/mail/index03/492/177/b@b.com/ imap(b(a)b.com)<56894><9mFyornjaMcKyAUI>: Debug: Namespace : type=private, prefix=, sep=, inbox=no, hidden=no, list=yes, subscriptions=yes location=maildir:/mail/mailstore03/492/177/b@b.com/:INDEX=/mail/index03/492/177/b@b.com/ the script-login task notes that these userdb settings are being added: namespace=inbox,share namespace/inbox/separator=/ namespace/share/prefix=boop/ namespace/share/separator=/ but the imap task only notes one: namespace=inbox,share both of these two instances end up getting an error because the imap task didn't pick up the prefix: Error: namespace configuration error: Duplicate namespace prefix: "" instance #1 behaves differently. it's script-login task debug is the same, but the imap debug notes: imap(bigip-imap(a)nagios.tucows.com)<2146><s3ctO7njd6cKBS39>: Debug: Added userdb setting: mail=maildir:/mail/mailstore03/492/177/b@b.com/:INDEX=/mail/index03/492/177/b@b.com/ imap(bigip-imap(a)nagios.tucows.com)<2146><s3ctO7njd6cKBS39>: Debug: Added userdb setting: namespace=inbox,share imap(bigip-imap(a)nagios.tucows.com)<2146><s3ctO7njd6cKBS39>: Debug: Added userdb setting: namespace/inbox/separator=/ imap(bigip-imap(a)nagios.tucows.com)<2146><s3ctO7njd6cKBS39>: Debug: tc_empty_notify_plugin init imap(bigip-imap(a)nagios.tucows.com)<2146><s3ctO7njd6cKBS39>: Debug: Namespace inbox: type=private, prefix=, sep=/, inbox=yes, hidden=no, list=yes, subscriptions=yes location=maildir:/mail/mailstore03/492/177/b@b.com/:INDEX=/mail/index03/492/177/b@b.com/ imap(bigip-imap(a)nagios.tucows.com)<2146><s3ctO7njd6cKBS39>: Debug: Namespace : type=private, prefix=, sep=, inbox=no, hidden=no, list=yes, subscriptions=yes location=maildir:/mail/mailstore03/492/177/b@b.com/:INDEX=/mail/index03/492/177/b@b.com/ on this one, the imap task notes that it added ALL the namespace directives, and consequently doesn't have any namespace prefix collisions. the difference between 1:2.3.4.1-5+deb10u5 and 1:2.3.4.1-5+deb10u6 doesn't seem that great, and the bug tracker for it doesn't indicate anything around userdb would be patched (https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=970386) but the problem still seems to exist in 2.3.19 - can anyone else see the same thing happening with the current builds? thanks! -brendan

3 4

Dovecot ACLs and XOAUTH2
by Felix Auringer 23 Aug '22

23 Aug '22

Hi, we're trying to set up an IMAP server using Dovecot as part of a new email system in a middle-sized company (around 150 employees). We have a keycloak identity server that is used for all logins and we would also like to use it for the new email system so that the non-technical employees (the majority) will have no issues using it. It's very nice that XOAUTH2 is already included in Dovecot, it works very well with our Roundcube web client. However, it seems that other clients like Thunderbird or Android Apps like FairEmail are not easy to set up as they have their XOAUTH providers hardcoded somewhere (https://bugzilla.mozilla.org/show_bug.cgi?id=1602166) Are you aware of any solution to integrate a dovecot server using XOAUTH2 into local clients (like Thunderbird)? We are currently trying to do it with passwords that can be set in Keycloak only for the purpose of email that can then be used to receive a valid token via a direct access grant but it's not a really nice solution as it introduces an additional password. Additionally, we would like to have all permission-related information saved in our identity server. For email, this includes shared mailboxes that a user is allowed to access. The ACL plugin that is used for shared mailboxes currently reads the permissions from disk which is not really feasible if the user base is large and setting these permissions should happen automatically. We are thinking the best way to do this is to encode the user's permissions in the token that dovecot receives in the login process. But as the token is only available in the authentication process and it does not seem to be intended to return such information from the password database (https://doc.dovecot.org/configuration_manual/authentication/password_databa…) we are unsure on how to process these information from the token. We did not find any plugin hooks in the authentication processes and the normal plugin hooks do not have access to information from the token anymore. What do you think is the best way to do this? We would be okay modifying some dovecot source code and contributing it back if desired. Best regards, Felix Auringer --- Gesellschaft für interkulturelles Zusammenleben gGmbH (GIZ) Felix Auringer IT Reformationsplatz 2 13597 Berlin Tel: 030/513 0100 00; Fax: 030/513 0100 09 www.giz.berlin; felix.auringer(a)giz.berlin Amtsgericht Charlottenburg HRB 200872 B Geschäftsführerin: Dr. Britta Marschke

2 6

Dict Redis error: Unsupported operation (dict does not support this feature)
by Tomas Dolezal 23 Aug '22

23 Aug '22

Hi all, when we try to delete any folder from Trash folder, for exmaple Trash.Test, Thunderbird and RoundCube IMAP clients show this error: DELETE: Internal error occurred. Refer to server log for more information. [2022-08-22 23:03:00] (0.001 + 0.000 secs). And deleted folder is still in Trash. This error is in the maillog: Aug 22 22:36:12 mail1 dovecot[1012]: imap(test(a)test.tld)<3355><KhIoINrmh8tecCPV>: Error: Mailbox Trash.Test: dict_iterate(priv/70555f26b6e803632f0d0000c2736b7f/) failed: Unsupported operation (dict does not support this feature) We use Redis as Dovecot dict and the command "redis-cli monitor" shows queries MULTI and DISCARD. I have tried to find any simillar problem at Google but without success. The error message "Unsupported operation (dict does not support this feature)" has not found. And in the source dict-fail.c there are many situations with this error string. Anybody can help me? Thanks, Tom. $ cat /var/log/maillog Aug 22 22:16:40 mail1 dovecot[1012]: auth: Debug: client in: AUTH#0111#011PLAIN#011service=imap#011secured=tls#011session=KhIoINrmh8tecCPV#011lip=4.5.6.7#011rip=1.2.3.4#011lport=143#011rport=52103#011real_lip=1.2.3.4#011real_rip=4.5.6.7#011real_rport=58392#011local_name=mail1.default.cz#011resp=<hidden> Aug 22 22:16:40 mail1 dovecot[1012]: auth: Debug: passwd-file(test(a)test.tld,1.2.3.4,<KhIoINrmh8tecCPV>): Performing passdb lookup Aug 22 22:16:40 mail1 dovecot[1012]: auth: Debug: passwd-file(test(a)test.tld,1.2.3.4,<KhIoINrmh8tecCPV>): lookup: user=test(a)test.tld file=/etc/dovecot/mail-users Aug 22 22:16:40 mail1 dovecot[1012]: auth: Debug: passwd-file(test(a)test.tld,1.2.3.4,<KhIoINrmh8tecCPV>): allow_real_nets: Matching for network 1.2.3.4 Aug 22 22:16:40 mail1 dovecot[1012]: auth: Debug: passwd-file(test(a)test.tld,1.2.3.4,<KhIoINrmh8tecCPV>): allow_real_nets: Matching for network 4.5.6.7 Aug 22 22:16:40 mail1 dovecot[1012]: auth: Debug: passwd-file(test(a)test.tld,1.2.3.4,<KhIoINrmh8tecCPV>): Finished passdb lookup Aug 22 22:16:40 mail1 dovecot[1012]: auth: Debug: auth(test(a)test.tld,1.2.3.4,<KhIoINrmh8tecCPV>): Auth request finished Aug 22 22:16:40 mail1 dovecot[1012]: auth: Debug: passwd-file(test(a)test.tld,1.2.3.4,<KhIoINrmh8tecCPV>): Performing userdb lookup Aug 22 22:16:40 mail1 dovecot[1012]: auth: Debug: passwd-file(test(a)test.tld,1.2.3.4,<KhIoINrmh8tecCPV>): lookup: user=test(a)test.tld file=/etc/dovecot/mail-users Aug 22 22:16:40 mail1 dovecot[1012]: auth: Debug: passwd-file(test(a)test.tld,1.2.3.4,<KhIoINrmh8tecCPV>): Finished userdb lookup Aug 22 22:16:40 mail1 dovecot[1012]: imap-login: Login: user=<test(a)test.tld>, method=PLAIN, rip=1.2.3.4, lip=4.5.6.7, mpid=3355, TLS, session=<KhIoINrmh8tecCPV> Aug 22 22:16:40 mail1 dovecot[1012]: imap(test(a)test.tld)<3355><KhIoINrmh8tecCPV>: Debug: Loading modules from directory: /usr/lib64/dovecot Aug 22 22:16:40 mail1 dovecot[1012]: imap(test(a)test.tld)<3355><KhIoINrmh8tecCPV>: Debug: Module loaded: /usr/lib64/dovecot/lib10_last_login_plugin.so Aug 22 22:16:40 mail1 dovecot[1012]: imap(test(a)test.tld)<3355><KhIoINrmh8tecCPV>: Debug: Module loaded: /usr/lib64/dovecot/lib10_quota_plugin.so Aug 22 22:16:40 mail1 dovecot[1012]: imap(test(a)test.tld)<3355><KhIoINrmh8tecCPV>: Debug: Module loaded: /usr/lib64/dovecot/lib11_imap_quota_plugin.so Aug 22 22:16:40 mail1 dovecot[1012]: imap(test(a)test.tld)<3355><KhIoINrmh8tecCPV>: Debug: Module loaded: /usr/lib64/dovecot/lib20_quota_clone_plugin.so Aug 22 22:16:40 mail1 dovecot[1012]: imap(test(a)test.tld)<3355><KhIoINrmh8tecCPV>: Debug: Module loaded: /usr/lib64/dovecot/lib30_imap_zlib_plugin.so Aug 22 22:16:40 mail1 dovecot[1012]: imap(test(a)test.tld)<3355><KhIoINrmh8tecCPV>: Debug: Module loaded: /usr/lib64/dovecot/lib95_imap_sieve_plugin.so Aug 22 22:16:40 mail1 dovecot[1012]: imap(test(a)test.tld)<3355><KhIoINrmh8tecCPV>: Debug: Effective uid=8, gid=12, home=/var/maildir/test.tld/test Aug 22 22:16:40 mail1 dovecot[1012]: imap(test(a)test.tld)<3355><KhIoINrmh8tecCPV>: Debug: dict(redis)<test(a)test.tld>: redis: Connecting Aug 22 22:16:40 mail1 dovecot[1012]: imap(test(a)test.tld)<3355><KhIoINrmh8tecCPV>: Debug: dict(redis)<test(a)test.tld>: conn 127.0.0.1:6379: Waiting for connect (fd=17) to finish for max 0 msecs Aug 22 22:16:40 mail1 dovecot[1012]: imap(test(a)test.tld)<3355><KhIoINrmh8tecCPV>: Debug: dict(redis)<test(a)test.tld>: conn 127.0.0.1:6379: Client connected (fd=17) Aug 22 22:16:40 mail1 dovecot[1012]: imap(test(a)test.tld)<3355><KhIoINrmh8tecCPV>: Debug: dict(redis)<test(a)test.tld>: Starting transaction Aug 22 22:16:40 mail1 dovecot[1012]: imap(test(a)test.tld)<3355><KhIoINrmh8tecCPV>: Debug: dict(redis)<test(a)test.tld>: Setting 'shared/last-login/test(a)test.tld/imap/1.2.3.4' to '1661199400' Aug 22 22:16:40 mail1 dovecot[1012]: imap(test(a)test.tld)<3355><KhIoINrmh8tecCPV>: Debug: Quota root: name=User quota backend=count args= Aug 22 22:16:40 mail1 dovecot[1012]: imap(test(a)test.tld)<3355><KhIoINrmh8tecCPV>: Debug: Quota grace: root=User quota bytes=0 (10%) Aug 22 22:16:40 mail1 dovecot[1012]: imap(test(a)test.tld)<3355><KhIoINrmh8tecCPV>: Debug: Namespace inbox: type=private, prefix=, sep=, inbox=yes, hidden=no, list=yes, subscriptions=yes location=maildir:~/Maildir:UTF-8 Aug 22 22:16:40 mail1 dovecot[1012]: imap(test(a)test.tld)<3355><KhIoINrmh8tecCPV>: Debug: maildir++: root=/var/maildir/test.tld/test/Maildir, index=, indexpvt=, control=, inbox=/var/maildir/test.tld/test/Maildir, alt= Aug 22 22:16:40 mail1 dovecot[1012]: imap(test(a)test.tld)<3355><KhIoINrmh8tecCPV>: Debug: quota: quota_over_flag check: quota_over_script unset - skipping Aug 22 22:16:40 mail1 dovecot[1012]: imap(test(a)test.tld)<3355><KhIoINrmh8tecCPV>: Debug: dict(redis)<test(a)test.tld>: Dict transaction finished Aug 22 22:16:40 mail1 dovecot[1012]: imap(test(a)test.tld)<3355><KhIoINrmh8tecCPV>: Debug: dict(redis)<test(a)test.tld>: Waiting for dict to finish pending operations Aug 22 22:16:40 mail1 dovecot[1012]: imap(test(a)test.tld)<3355><KhIoINrmh8tecCPV>: Debug: dict(redis)<test(a)test.tld>: conn 127.0.0.1:6379: Disconnected: Connection closed (fd=17) Aug 22 22:36:12 mail1 dovecot[1012]: imap(test(a)test.tld)<3355><KhIoINrmh8tecCPV>: Debug: Mailbox Trash.Test: Mailbox opened because: DELETE Aug 22 22:36:12 mail1 dovecot[1012]: imap(test(a)test.tld)<3355><KhIoINrmh8tecCPV>: Debug: Namespace : Using permissions from /var/maildir/test.tld/test/Maildir: mode=0700 gid=default Aug 22 22:36:12 mail1 dovecot[1012]: imap(test(a)test.tld)<3355><KhIoINrmh8tecCPV>: Debug: dict(redis)<test(a)test.tld>: Iterating prefix priv/70555f26b6e803632f0d0000c2736b7f/ Aug 22 22:36:12 mail1 dovecot[1012]: imap(test(a)test.tld)<3355><KhIoINrmh8tecCPV>: Debug: dict(redis)<test(a)test.tld>: redis: Connecting Aug 22 22:36:12 mail1 dovecot[1012]: imap(test(a)test.tld)<3355><KhIoINrmh8tecCPV>: Debug: dict(redis)<test(a)test.tld>: conn 127.0.0.1:6379: Waiting for connect (fd=18) to finish for max 0 msecs Aug 22 22:36:12 mail1 dovecot[1012]: imap(test(a)test.tld)<3355><KhIoINrmh8tecCPV>: Debug: dict(redis)<test(a)test.tld>: conn 127.0.0.1:6379: Client connected (fd=18) Aug 22 22:36:12 mail1 dovecot[1012]: imap(test(a)test.tld)<3355><KhIoINrmh8tecCPV>: Debug: dict(redis)<test(a)test.tld>: Starting transaction Aug 22 22:36:12 mail1 dovecot[1012]: imap(test(a)test.tld)<3355><KhIoINrmh8tecCPV>: Debug: dict(redis)<test(a)test.tld>: Unsetting 'priv/70555f26b6e803632f0d0000c2736b7f/comment' Aug 22 22:36:12 mail1 dovecot[1012]: imap(test(a)test.tld)<3355><KhIoINrmh8tecCPV>: Debug: dict(redis)<test(a)test.tld>: Iteration finished: Unsupported operation (dict does not support this feature) Aug 22 22:36:12 mail1 dovecot[1012]: imap(test(a)test.tld)<3355><KhIoINrmh8tecCPV>: Error: Mailbox Trash.Test: dict_iterate(priv/70555f26b6e803632f0d0000c2736b7f/) failed: Unsupported operation (dict does not support this feature) Aug 22 22:36:12 mail1 dovecot[1012]: imap(test(a)test.tld)<3355><KhIoINrmh8tecCPV>: Debug: dict(redis)<test(a)test.tld>: Dict transaction finished Aug 22 22:36:22 mail1 dovecot[1012]: imap(test(a)test.tld)<3355><KhIoINrmh8tecCPV>: Debug: Mailbox Junk: Mailbox opened because: SELECT Aug 22 22:36:22 mail1 dovecot[1012]: imap(test(a)test.tld)<3355><KhIoINrmh8tecCPV>: Debug: Mailbox INBOX: Mailbox opened because: quota count Aug 22 22:36:22 mail1 dovecot[1012]: imap(test(a)test.tld)<3355><KhIoINrmh8tecCPV>: Debug: Mailbox Trash.Test: Mailbox opened because: quota count Aug 22 22:36:22 mail1 dovecot[1012]: imap(test(a)test.tld)<3355><KhIoINrmh8tecCPV>: Debug: Mailbox Junk: UID 51504: Looked up field flags from mail cache Aug 22 22:36:22 mail1 dovecot[1012]: imap(test(a)test.tld)<3355><KhIoINrmh8tecCPV>: Debug: Mailbox Junk: UID 51504: Looked up field mime.parts from mail cache Aug 22 22:36:22 mail1 dovecot[1012]: imap(test(a)test.tld)<3355><KhIoINrmh8tecCPV>: Debug: Mailbox Junk: UID 51504: Looked up field hdr.BCC from mail cache Aug 22 22:36:22 mail1 dovecot[1012]: imap(test(a)test.tld)<3355><KhIoINrmh8tecCPV>: Debug: Mailbox Junk: UID 51504: Looked up field hdr.CC from mail cache Aug 22 22:36:22 mail1 dovecot[1012]: imap(test(a)test.tld)<3355><KhIoINrmh8tecCPV>: Debug: Mailbox Junk: UID 51504: Looked up field hdr.CONTENT-TYPE from mail cache Aug 22 22:36:22 mail1 dovecot[1012]: imap(test(a)test.tld)<3355><KhIoINrmh8tecCPV>: Debug: Mailbox Junk: UID 51504: Looked up field hdr.DATE from mail cache Aug 22 22:36:22 mail1 dovecot[1012]: imap(test(a)test.tld)<3355><KhIoINrmh8tecCPV>: Debug: Mailbox Junk: UID 51504: Looked up field hdr.FROM from mail cache Aug 22 22:36:22 mail1 dovecot[1012]: imap(test(a)test.tld)<3355><KhIoINrmh8tecCPV>: Debug: Mailbox Junk: UID 51504: Looked up field hdr.IN-REPLY-TO from mail cache Aug 22 22:36:22 mail1 dovecot[1012]: imap(test(a)test.tld)<3355><KhIoINrmh8tecCPV>: Debug: Mailbox Junk: UID 51504: Looked up field hdr.MESSAGE-ID from mail cache Aug 22 22:36:22 mail1 dovecot[1012]: imap(test(a)test.tld)<3355><KhIoINrmh8tecCPV>: Debug: Mailbox Junk: UID 51504: Looked up field hdr.NEWSGROUPS from mail cache Aug 22 22:36:22 mail1 dovecot[1012]: imap(test(a)test.tld)<3355><KhIoINrmh8tecCPV>: Debug: Mailbox Junk: UID 51504: Looked up field hdr.PRIORITY from mail cache Aug 22 22:36:22 mail1 dovecot[1012]: imap(test(a)test.tld)<3355><KhIoINrmh8tecCPV>: Debug: Mailbox Junk: UID 51504: Looked up field hdr.REFERENCES from mail cache Aug 22 22:36:22 mail1 dovecot[1012]: imap(test(a)test.tld)<3355><KhIoINrmh8tecCPV>: Debug: Mailbox Junk: UID 51504: Looked up field hdr.REPLY-TO from mail cache Aug 22 22:36:22 mail1 dovecot[1012]: imap(test(a)test.tld)<3355><KhIoINrmh8tecCPV>: Debug: Mailbox Junk: UID 51504: Looked up field hdr.SUBJECT from mail cache Aug 22 22:36:22 mail1 dovecot[1012]: imap(test(a)test.tld)<3355><KhIoINrmh8tecCPV>: Debug: Mailbox Junk: UID 51504: Looked up field hdr.TO from mail cache Aug 22 22:36:22 mail1 dovecot[1012]: imap(test(a)test.tld)<3355><KhIoINrmh8tecCPV>: Debug: Mailbox Junk: UID 51504: Looked up field hdr.X-PRIORITY from mail cache Aug 22 22:36:22 mail1 dovecot[1012]: imap(test(a)test.tld)<3355><KhIoINrmh8tecCPV>: Debug: Mailbox Junk: UID 51504: Looked up field hdr.X-SPAM-FLAG from mail cache Aug 22 22:36:22 mail1 dovecot[1012]: imap(test(a)test.tld)<3355><KhIoINrmh8tecCPV>: Debug: Mailbox Junk: UID 51504: Looked up field hdr.X-SPAM-STATUS from mail cache Aug 22 22:36:26 mail1 dovecot[1012]: imap(test(a)test.tld)<3355><KhIoINrmh8tecCPV>: Debug: Mailbox INBOX: Mailbox opened because: quota count Aug 22 22:38:26 mail1 dovecot[1012]: imap(test(a)test.tld)<3355><KhIoINrmh8tecCPV>: Debug: Mailbox INBOX: Mailbox opened because: quota count Aug 22 22:40:26 mail1 dovecot[1012]: imap(test(a)test.tld)<3355><KhIoINrmh8tecCPV>: Debug: Mailbox INBOX: Mailbox opened because: quota count Aug 22 22:42:26 mail1 dovecot[1012]: imap(test(a)test.tld)<3355><KhIoINrmh8tecCPV>: Debug: Mailbox INBOX: Mailbox opened because: quota count Aug 22 22:44:26 mail1 dovecot[1012]: imap(test(a)test.tld)<3355><KhIoINrmh8tecCPV>: Debug: Mailbox INBOX: Mailbox opened because: quota count Aug 22 22:46:26 mail1 dovecot[1012]: imap(test(a)test.tld)<3355><KhIoINrmh8tecCPV>: Debug: Mailbox INBOX: Mailbox opened because: quota count Aug 22 22:48:26 mail1 dovecot[1012]: imap(test(a)test.tld)<3355><KhIoINrmh8tecCPV>: Debug: Mailbox INBOX: Mailbox opened because: quota count Aug 22 22:50:26 mail1 dovecot[1012]: imap(test(a)test.tld)<3355><KhIoINrmh8tecCPV>: Debug: Mailbox INBOX: Mailbox opened because: quota count Aug 22 22:52:26 mail1 dovecot[1012]: imap(test(a)test.tld)<3355><KhIoINrmh8tecCPV>: Debug: Mailbox INBOX: Mailbox opened because: quota count Aug 22 22:54:26 mail1 dovecot[1012]: imap(test(a)test.tld)<3355><KhIoINrmh8tecCPV>: Debug: Mailbox INBOX: Mailbox opened because: quota count Aug 22 22:56:26 mail1 dovecot[1012]: imap(test(a)test.tld)<3355><KhIoINrmh8tecCPV>: Debug: Mailbox INBOX: Mailbox opened because: quota count Aug 22 22:58:26 mail1 dovecot[1012]: imap(test(a)test.tld)<3355><KhIoINrmh8tecCPV>: Debug: Mailbox INBOX: Mailbox opened because: quota count Aug 22 23:00:26 mail1 dovecot[1012]: imap(test(a)test.tld)<3355><KhIoINrmh8tecCPV>: Debug: Mailbox INBOX: Mailbox opened because: quota count Aug 22 23:02:26 mail1 dovecot[1012]: imap(test(a)test.tld)<3355><KhIoINrmh8tecCPV>: Debug: Mailbox INBOX: Mailbox opened because: quota count $ uname -a Linux mail1.default.cz 4.18.0-408.el8.x86_64 #1 SMP Mon Jul 18 17:42:52 UTC 2022 x86_64 x86_64 x86_64 GNU/Linux $ cat /etc/centos-release CentOS Stream release 8 $ dnf list installed dovecot redis: Installed Packages dovecot.x86_64 1:2.3.16-3.el8 @appstream redis.x86_64 5.0.3-5.module_el8.4.0+955+7126e393 @appstream $ mount /dev/mapper/system-root on / type xfs (rw,noatime,nodiratime,attr2,inode64,logbufs=8,logbsize=32k,noquota) $ dovecot -n # 2.3.16 (7e2e900c1a): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.16 (09c29328) # OS: Linux 4.18.0-408.el8.x86_64 x86_64 CentOS Stream release 8 # Hostname: mail1.default.cz auth_debug = yes auth_mechanisms = plain login auth_verbose = yes disable_plaintext_auth = no first_valid_uid = 8 hostname = mail1.default.cz lmtp_rcpt_check_quota = yes lmtp_save_to_detail_mailbox = yes login_trusted_networks = 1.2.3.4 mail_attribute_dict = redis:host=127.0.0.1:port=6379:prefix=dovecot/ mail_debug = yes mail_gid = mail mail_location = maildir:~/Maildir:UTF-8 mail_server_admin = mailto:admin@test.tld mail_uid = mail managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext vnd.dovecot.debug imapsieve vnd.dovecot.imapsieve namespace inbox { inbox = yes location = mailbox Archive { auto = no special_use = \Archive } mailbox Archives { auto = no special_use = \Archive } mailbox Drafts { auto = subscribe special_use = \Drafts } mailbox Junk { auto = subscribe autoexpunge = 30 days special_use = \Junk } mailbox Sent { auto = subscribe special_use = \Sent } mailbox Trash { auto = subscribe autoexpunge = 30 days special_use = \Trash } prefix = } passdb { args = scheme=CRYPT username_format=%u /etc/dovecot/mail-users driver = passwd-file } plugin { imapsieve_url = sieve://mail.vizus.cz last_login_dict = redis:host=127.0.0.1:port=6379:prefix=dovecot/ last_login_key = # hidden, use -P to show it quota = count:User quota quota_clone_dict = redis:host=127.0.0.1:port=6379:prefix=dovecot/ quota_grace = 10%% quota_vsizes = yes sieve = file:~/sieve;active=~/user.sieve sieve_before = file:~/admin.sieve sieve_extensions = +vnd.dovecot.debug +copy sieve_plugins = sieve_imapsieve } postmaster_address = postmaster(a)test.tld protocols = imap pop3 lmtp sieve service anvil { client_limit = 2048 } service auth { client_limit = 2048 } service imap-login { process_limit = 1024 } service lmtp { unix_listener lmtp { group = postfix mode = 0600 user = postfix } } service pop3-login { process_limit = 256 } ssl_ca = </etc/pki/tls/cert.pem ssl_cert = </etc/pki/test.tld.pem ssl_client_cert = </etc/pki/test.tld.pem ssl_client_key = # hidden, use -P to show it ssl_dh = # hidden, use -P to show it ssl_key = # hidden, use -P to show it ssl_prefer_server_ciphers = yes ssl_require_crl = no userdb { args = username_format=%u /etc/dovecot/mail-users driver = passwd-file } protocol imap { imap_metadata = yes mail_plugins = quota quota_clone imap_quota last_login imap_zlib imap_sieve } protocol pop3 { mail_plugins = quota quota_clone last_login } protocol lmtp { mail_plugins = quota quota_clone last_login sieve } protocol !indexer-worker { mail_vsize_bg_after_count = 100 } dovecot-sysreport-mail1.default.cz-1661201665.tar.gz

1 0

Should one prevent reconnection before expunge?
by Jack Cecil 22 Aug '22

22 Aug '22

Hello. From my understanding the 'autoexpunge' feature activates on user disconnect. But could you help me understand the 'doveadm expunge' feature better? If a Maildir has 20 thousand messages and user is reading it over IMAP I have a suspicion it is not a good idea to be rewriting the dovecot cache at the same time. Should I temporarily prevent login (e.g. with passwd-file deny) and then kick them before the expunge? Thank you.

3 4

Get a list of currently active IMAP connections?
by Jaroslaw Rafa 22 Aug '22

22 Aug '22

Hello Dovecot community, I have a question: is it possible to programmatically get from Dovecot a list of currently active IMAP sessions (with IP addresses)? Via a plugin or something? Or just check if there is an IMAP session currently open from a particular IP address, with true/false type answer? I'm planning to implement a policy service for *Postfix* that will revive the old "POP before SMTP" authorization concept (only it will be "IMAP before SMTP" this time). This policy service will reject connections to mail submission ports (465, 587) - without even going to SMTP AUTH phase - unless the connecting IP address has currently an IMAP session open to Dovecot, to mitigate SMTP AUTH attacks. But for this I need some way to check from within this policy service if the particular IP address has a connection open or not. It could be of course obtained by scanning Dovecot logs, but this involves quite a large overhead. Therefore I'm looking for the way to get this information directly from Dovecot's current state. Can you advise me of any way to do this? Or maybe someone has already written such a piece of software and it is available somewhere on the Net? -- Regards, Jaroslaw Rafa raj(a)rafa.eu.org -- "In a million years, when kids go to school, they're gonna know: once there was a Hushpuppy, and she lived with her daddy in the Bathtub."

8 17

Adding new server (POP3 only)
by Antonino Esposito 21 Aug '22

21 Aug '22

Good morning, we're facing a spike in users activation and we've decided to add another server for POP3 only. Since our dovecot is currently backed by NFS, i'm under the impression we just need to add a new instance listening for POP3, backed by the same NFS. However, i'm afraid the existing POP3 users will download the messages once again, due to the fact the responding server will be on a different IP address, even if the hostname will be exactly the same. Am i right in this assumption? Have you any advice for me? Thanks Antonino

2 1

Fields not showing in openmetrics statistics
by Rybkin Vladimir 17 Aug '22

17 Aug '22

Hello I'm trying to configure stats with openmetrics Dovecot version: 2.3.19 I make the settings as follows: ``` # cat /home/beget/dovecot/conf/conf.d/90-openmetrics.conf | grep -v -E "^#" service stats { inet_listener http { port = 9900 } } event_exporter log { format = json format_args = time-rfc3339 transport = log } metric imap_commands { exporter = log filter = event=* } metric imap_command { filter = event=imap_command_finished fields = bytes_in bytes_out group_by = cmd_name tagged_reply_state } ``` The problem is that no matter what configuration I do, the fields parameter is not displayed in openmetrics ``` # curl http://192.168.20.252:9900/metrics | grep -v -E "^#\ " | grep imap_command % Total % Received % Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed 100 4891 100 4891 0 0 285k 0 --:--:-- --:--:-- --:--:-- 341k dovecot_imap_commands_total 388 dovecot_imap_commands_duration_seconds_total 24.225760 dovecot_imap_command_total{cmd_name="NAMESPACE"} 1 dovecot_imap_command_total{cmd_name="NAMESPACE",tagged_reply_state="OK"} 1 dovecot_imap_command_total{cmd_name="ID"} 4 dovecot_imap_command_total{cmd_name="ID",tagged_reply_state="OK"} 4 dovecot_imap_command_total{cmd_name="ENABLE"} 4 dovecot_imap_command_total{cmd_name="ENABLE",tagged_reply_state="OK"} 4 dovecot_imap_command_total{cmd_name="SELECT"} 3 dovecot_imap_command_total{cmd_name="SELECT",tagged_reply_state="OK"} 3 dovecot_imap_command_total{cmd_name="GETQUOTAROOT"} 3 dovecot_imap_command_total{cmd_name="GETQUOTAROOT",tagged_reply_state="OK"} 3 dovecot_imap_command_total{cmd_name="UID FETCH"} 19 dovecot_imap_command_total{cmd_name="UID FETCH",tagged_reply_state="OK"} 19 dovecot_imap_command_total{cmd_name="LIST"} 2 dovecot_imap_command_total{cmd_name="LIST",tagged_reply_state="OK"} 2 dovecot_imap_command_total{cmd_name="IDLE"} 1 dovecot_imap_command_total{cmd_name="IDLE",tagged_reply_state="OK"} 1 dovecot_imap_command_total{cmd_name="STATUS"} 2 dovecot_imap_command_total{cmd_name="STATUS",tagged_reply_state="OK"} 2 dovecot_imap_command_count 39 dovecot_imap_command_duration_seconds_total{cmd_name="NAMESPACE"} 0.000218 dovecot_imap_command_duration_seconds_total{cmd_name="NAMESPACE",tagged_reply_state="OK"} 0.000218 dovecot_imap_command_duration_seconds_total{cmd_name="ID"} 0.000900 dovecot_imap_command_duration_seconds_total{cmd_name="ID",tagged_reply_state="OK"} 0.000900 dovecot_imap_command_duration_seconds_total{cmd_name="ENABLE"} 0.000332 dovecot_imap_command_duration_seconds_total{cmd_name="ENABLE",tagged_reply_state="OK"} 0.000332 dovecot_imap_command_duration_seconds_total{cmd_name="SELECT"} 0.028734 dovecot_imap_command_duration_seconds_total{cmd_name="SELECT",tagged_reply_state="OK"} 0.028734 dovecot_imap_command_duration_seconds_total{cmd_name="GETQUOTAROOT"} 0.127621 dovecot_imap_command_duration_seconds_total{cmd_name="GETQUOTAROOT",tagged_reply_state="OK"} 0.127621 dovecot_imap_command_duration_seconds_total{cmd_name="UID FETCH"} 0.097117 dovecot_imap_command_duration_seconds_total{cmd_name="UID FETCH",tagged_reply_state="OK"} 0.097117 dovecot_imap_command_duration_seconds_total{cmd_name="LIST"} 0.003738 dovecot_imap_command_duration_seconds_total{cmd_name="LIST",tagged_reply_state="OK"} 0.003738 dovecot_imap_command_duration_seconds_total{cmd_name="IDLE"} 7.397259 dovecot_imap_command_duration_seconds_total{cmd_name="IDLE",tagged_reply_state="OK"} 7.397259 dovecot_imap_command_duration_seconds_total{cmd_name="STATUS"} 0.041169 dovecot_imap_command_duration_seconds_total{cmd_name="STATUS",tagged_reply_state="OK"} 0.041169 dovecot_imap_command_duration_seconds_sum 7.697088 ``` It is displayed through doveadm ``` # altdocker exec $(altdocker ps -aq -f name=dove) doveadm stats dump metric_name field count sum min max avg median stddev %95 imap_commands duration 449 1043812019 20 116763630 2324748.37 2382 12137052.43 608328 imap_command duration 49 145807071 72 46020784 2975654.51 3381 11041798.07 46017747 imap_command bytes_in 49 1419 0 179 28.96 37 28.93 55 imap_command bytes_out 49 1867985 0 424616 38122.14 167 74553.96 158613 imap_command_NAMESPACE duration 1 218 218 218 218.00 218 0.00 218 imap_command_NAMESPACE bytes_in 1 0 0 0 0.00 0 0.00 0 imap_command_NAMESPACE bytes_out 1 86 86 86 86.00 86 0.00 86 imap_command_NAMESPACE_OK duration 1 218 218 218 218.00 218 0.00 218 imap_command_NAMESPACE_OK bytes_in 1 0 0 0 0.00 0 0.00 0 imap_command_NAMESPACE_OK bytes_out 1 86 86 86 86.00 86 0.00 86 imap_command_ID duration 4 900 145 288 225.00 233 59.07 288 imap_command_ID bytes_in 4 168 42 42 42.00 42 0.00 42 imap_command_ID bytes_out 4 275 66 75 68.75 67 3.63 75 imap_command_ID_OK duration 4 900 145 288 225.00 233 59.07 288 imap_command_ID_OK bytes_in 4 168 42 42 42.00 42 0.00 42 imap_command_ID_OK bytes_out 4 275 66 75 68.75 67 3.63 75 imap_command_ENABLE duration 4 332 72 110 83.00 75 15.65 110 imap_command_ENABLE bytes_in 4 44 11 11 11.00 11 0.00 11 imap_command_ENABLE bytes_out 4 147 36 37 36.75 37 0.44 37 imap_command_ENABLE_OK duration 4 332 72 110 83.00 75 15.65 110 imap_command_ENABLE_OK bytes_in 4 44 11 11 11.00 11 0.00 11 imap_command_ENABLE_OK bytes_out 4 147 36 37 36.75 37 0.44 37 imap_command_SELECT duration 3 28734 4662 16200 9578.00 7872 4862.39 16200 imap_command_SELECT bytes_in 3 33 7 14 11.00 12 2.94 14 imap_command_SELECT bytes_out 3 1034 309 416 344.67 309 50.44 416 imap_command_SELECT_OK duration 3 28734 4662 16200 9578.00 7872 4862.39 16200 imap_command_SELECT_OK bytes_in 3 33 7 14 11.00 12 2.94 14 imap_command_SELECT_OK bytes_out 3 1034 309 416 344.67 309 50.44 416 imap_command_GETQUOTAROOT duration 6 171676 12353 74871 28612.67 17219 22308.42 74871 imap_command_GETQUOTAROOT bytes_in 6 66 7 14 11.00 12 2.94 14 imap_command_GETQUOTAROOT bytes_out 6 983 159 167 163.83 165 3.18 167 imap_command_GETQUOTAROOT_OK duration 6 171676 12353 74871 28612.67 17219 22308.42 74871 imap_command_GETQUOTAROOT_OK bytes_in 6 66 7 14 11.00 12 2.94 14 imap_command_GETQUOTAROOT_OK bytes_out 6 983 159 167 163.83 165 3.18 167 imap_command_UID_FETCH duration 20 97998 881 16915 4899.90 3304 4306.81 13912 imap_command_UID_FETCH bytes_in 20 922 13 179 46.10 37 34.76 103 imap_command_UID_FETCH bytes_out 20 1864818 40 424616 93240.90 100838 92111.34 174020 imap_command_UID_FETCH_OK duration 20 97998 881 16915 4899.90 3304 4306.81 13912 imap_command_UID_FETCH_OK bytes_in 20 922 13 179 46.10 37 34.76 103 imap_command_UID_FETCH_OK bytes_out 20 1864818 40 424616 93240.90 100838 92111.34 174020 imap_command_LIST duration 2 3738 1715 2023 1869.00 1869 154.00 2023 imap_command_LIST bytes_in 2 56 10 46 28.00 28 18.00 46 imap_command_LIST bytes_out 2 315 85 230 157.50 157 72.50 230 imap_command_LIST_OK duration 2 3738 1715 2023 1869.00 1869 154.00 2023 imap_command_LIST_OK bytes_in 2 56 10 46 28.00 28 18.00 46 imap_command_LIST_OK bytes_out 2 315 85 230 157.50 157 72.50 230 imap_command_IDLE duration 4 145454703 7397259 46020784 36363675.75 46018330 16723768.54 46020784 imap_command_IDLE bytes_in 4 32 8 8 8.00 8 0.00 8 imap_command_IDLE bytes_out 4 91 10 27 22.75 27 7.36 27 imap_command_IDLE_OK duration 4 145454703 7397259 46020784 36363675.75 46018330 16723768.54 46020784 imap_command_IDLE_OK bytes_in 4 32 8 8 8.00 8 0.00 8 imap_command_IDLE_OK bytes_out 4 91 10 27 22.75 27 7.36 27 imap_command_STATUS duration 2 41169 16692 24477 20584.50 20584 3892.50 24477 imap_command_STATUS bytes_in 2 92 45 47 46.00 46 1.00 47 imap_command_STATUS bytes_out 2 236 117 119 118.00 118 1.00 119 imap_command_STATUS_OK duration 2 41169 16692 24477 20584.50 20584 3892.50 24477 imap_command_STATUS_OK bytes_in 2 92 45 47 46.00 46 1.00 47 imap_command_STATUS_OK bytes_out 2 236 117 119 118.00 118 1.00 119 imap_command_NOOP duration 3 7603 1654 3177 2534.33 2772 644.07 3177 imap_command_NOOP bytes_in 3 6 2 2 2.00 2 0.00 2 imap_command_NOOP bytes_out 3 0 0 0 0.00 0 0.00 0 imap_command_NOOP_OK duration 3 7603 1654 3177 2534.33 2772 644.07 3177 imap_command_NOOP_OK bytes_in 3 6 2 2 2.00 2 0.00 2 imap_command_NOOP_OK bytes_out 3 0 0 0 0.00 0 0.00 0 ``` I can’t understand what I’m doing wrong so that field data is displayed in openmetrics.

1 0

Re: dovecot/config processes open, and consuming all memory
by Joseph Tam 17 Aug '22

17 Aug '22

From: Aki Tuomi <aki.tuomi(a)open-xchange.com> > The *default* configuration for service config is usually just fine. > Is there some reason you decided to modify it in first place? Are you asking me, or the OP? I guess the blunt answer is ignorance on my part. However, I pointed out that the docs about this setting is somewhat misleading -- it's used to limit any potential memory leaks for long-lived processes by ensuring it terminates periodically. I read this and thought to myself "this is a good thing to do", without realizing that it would have the opposite effect as lingering clients could delay service termination indefinitely. The side effect is many new processes are spawned to handle new clients, and eventually the maximum process limit is reached, and chaos ensues. So for services like imap-login and others that can have lingering clients, the only sensible values for service_limit is {0,1}. If you set service_limit>1, the asymptotic behaviour is like service_limit=1, and process_limit would have to be adjusted accordingly. The docs can explain this rather wordy and subtle explanation of service_limit, or service_limit can be constrained to values {0,1} so that others don't blunder along the same path I did. Joseph Tam <jtam.home(a)gmail.com>

2 1

Re: dovecot/config processes open, and consuming all memory
by Joseph Tam 16 Aug '22

16 Aug '22

> I'm having strange behavior in dovecot 2.3.16. > It's opening dozens of dovecot/config process and consuming all server > memory. Normally each process consumes between 700Mb and 1Gb of ram. > > Would anyone have an idea about this? > > service config { > vsz_limit = 2048M > idle_kill = 60s > service_count = 1024 > } Not sure it's related, but if you have service_count not 0 or 1, there is a strange interaction with other limits that could cause processes to hang around. My description of problem https://www.mail-archive.com/dovecot%40dovecot.org/msg85850.html Your situation is slgihtly different (service not imap_login, and idle_kill timeout should reduce lingering processes that caused my problem), but try setting service_limit to either 0 or 1 and see if your problem goes away, or gets worse. You can also see how many file descriptors are being held by the config process, and see the behaviour over time (e.g. monitor /proc/{pid}/fd/*); maybe that will give you a clue as to what the config process is doing. Joseph Tam <jtam.home(a)gmail.com>

3 5

Slow IMAP SORT
by Ewald Dieterich 16 Aug '22

16 Aug '22

The following IMAP SORT with 2 sort criteria is very slow on an mdbox mailbox with lots of mails (more than 10,000) and an empty cache: . SORT (ARRIVAL DATE) UTF-8 ALL Each mail is opened when the SORT is executed, which is slow, given the number of mails in the mailbox. Debug: Mailbox INBOX: UID 1003: Opened mail because: header stream <repeated for each mail> Repeating the SORT opens all mails again and again: Debug: Mailbox INBOX: UID 1003: Opened mail because: header stream <repeated for each mail> If I just sort by ARRIVAL, the SORT is fast and I don't see any "Opened mail because" messages in the debug log. . SORT (ARRIVAL) UTF-8 ALL If I just sort by DATE, the first SORT is slow. . SORT (DATE) UTF-8 ALL The debug log looks like this: Debug: Mailbox INBOX: UID 1003: Opened mail because: header Date (Mail has other cached fields, reset_id=1633683216) <repeated for each mail> This fills the cache and if I sort by DATE again, the SORT is fast and I don't get any more "Opened mail because" messages in the debug log. If I now repeat "SORT (ARRIVAL DATE)", the SORT is fast, the mails are not opened. If I clear the cache, "SORT (ARRIVAL DATE)" goes back to being slow, not filling the cache. This doesn't seem right. "SORT (ARRIVAL DATE)" should also fill the cache to execute repeated SORTS faster, right?

3 2

dovecot/config processes open, and consuming all memory
by filipe＠digirati.com.br 15 Aug '22

15 Aug '22

I'm having strange behavior in dovecot 2.3.16. It's opening dozens of dovecot/config process and consuming all server memory. Normally each process consumes between 700Mb and 1Gb of ram. Would anyone have an idea about this? service config { vsz_limit = 2048M idle_kill = 60s service_count = 1024 } pstree systemd─┬─ModemManager───2*[{ModemManager}] ├─agetty ├─cron ├─dbus-daemon ├─dovecot─┬─anvil │ ├─6*[auth] │ ├─46*[config] │ ├─1212*[imap] │ ├─155*[imap-login] │ ├─12*[lmtp] │ ├─38*[log] │ ├─10*[managesieve] │ ├─19*[pop3] │ ├─3*[pop3-login] │ └─18*[stats] root 45831 0.0 1.1 774688 752732 ? S 09:31 0:31 dovecot/config root 388792 0.0 1.1 775060 753276 ? S 14:00 0:15 dovecot/config root 510685 0.0 1.1 775384 753604 ? S 15:06 0:20 dovecot/config root 675638 0.0 1.1 775348 753620 ? S 16:56 0:15 dovecot/config root 795375 0.0 1.1 775460 753516 ? S 18:03 0:07 dovecot/config root 798754 0.2 1.1 775592 753712 ? S 18:05 0:30 dovecot/config root 1082696 0.2 1.1 774892 753216 ? S 21:10 0:07 dovecot/config root 1098433 0.4 1.1 774924 753244 ? S 21:33 0:07 dovecot/config root 1109255 0.9 1.1 774924 753344 ? S 21:50 0:07 dovecot/config root 1112976 2.0 1.1 774956 753528 ? S 21:57 0:07 dovecot/config root 1114137 3.0 1.1 775028 753308 ? S 21:59 0:07 dovecot/config root 1115382 5.4 1.1 774924 753496 ? S 22:01 0:06 dovecot/config root 1883627 0.0 1.1 759120 728832 ? S Aug11 0:07 dovecot/config root 1889705 0.0 1.8 1251460 1221872 ? S Aug11 0:11 dovecot/config root 1895022 0.0 1.8 1253280 1224284 ? S Aug11 0:11 dovecot/config root 1900690 0.0 1.8 1255684 1227528 ? S Aug11 0:12 dovecot/config root 1905648 0.0 1.8 1257880 1229912 ? S Aug11 0:12 dovecot/config root 1910857 0.0 1.8 1259156 1231552 ? S Aug11 0:12 dovecot/config root 1914332 0.0 1.1 764328 736552 ? S Aug11 0:20 dovecot/config root 2343896 0.0 1.8 1259472 1231516 ? S Aug11 0:12 dovecot/config root 2346351 0.0 1.8 1259472 1231836 ? S Aug11 0:13 dovecot/config root 2348559 0.0 1.1 764704 736440 ? S Aug11 0:14 dovecot/config root 2445701 0.0 1.1 764276 736540 ? S Aug11 0:19 dovecot/config root 2572525 0.0 1.1 764640 736880 ? S Aug11 0:18 dovecot/config root 2734251 0.0 1.1 764776 737696 ? S Aug11 0:08 dovecot/config root 2740980 0.0 1.1 764768 737244 ? S Aug11 0:17 dovecot/config root 2899925 0.0 1.1 764624 737760 ? S Aug11 0:43 dovecot/config root 3517063 0.0 1.1 764984 738004 ? S Aug11 0:09 dovecot/config root 3541465 0.0 1.1 765224 738756 ? S Aug11 0:07 dovecot/config root 3545589 0.0 1.1 766452 740408 ? S Aug11 0:06 dovecot/config root 3549259 0.0 1.1 766796 741048 ? S Aug11 0:07 dovecot/config root 3553902 0.0 1.1 767812 742284 ? S Aug11 0:07 dovecot/config root 3558080 0.0 1.1 768440 743524 ? S Aug11 0:08 dovecot/config root 3562091 0.0 1.1 769224 744424 ? S Aug11 0:07 dovecot/config root 3568721 0.0 1.1 769388 744888 ? S Aug11 0:07 dovecot/config root 3573024 0.0 1.1 770048 745904 ? S Aug11 0:08 dovecot/config root 3578416 0.0 1.1 770836 746736 ? S Aug11 0:06 dovecot/config root 3581765 0.0 1.1 771948 748492 ? S Aug11 0:06 dovecot/config root 3585837 0.0 1.1 772828 749860 ? S Aug11 0:07 dovecot/config root 3590276 0.0 1.1 773560 750520 ? S Aug11 0:07 dovecot/config root 3594640 0.0 1.1 774612 752552 ? S Aug11 0:08 dovecot/config root 3597417 0.0 1.1 774968 753076 ? S Aug11 0:35 dovecot/config root 4116314 0.0 1.9 1280496 1258580 ? S 05:31 0:13 dovecot/config root 4118115 0.0 1.1 774688 752556 ? S 05:33 0:16 dovecot/config

3 4

convert mdbox to maildir
by lutz.niederer＠gmx.net 14 Aug '22

14 Aug '22

Hi! We need to move all users from one (pretty old) installation of dovecot to a new one. The old one uses mdbox for users' mailboxes and maildir for shared/public mailboxes. The new one must be maildir only. I believe that I can just copy the shared/public maildir structure to the new installation without problems. Am I right? Do I have to expect any trouble? (Set owner, permissions etc...) The real problem is that we must not use the running, old dovecot installation. So we are not able to connect to the old server, pull all folders and mails and create a new maildir structure. Currently, we can't do anything against it. What we get are the users' mdbox files. Is there any way to convert mdbox files and structures to maildir directly from filesystem? Or do we have to build a copy of the old machine (dovecot only, or -maybe better- a vm) and then use doveadm backup? Or is it ok to just set up the completely new installation, set mail_location to where the new Maildirs will be, like maildir:~/Maildir and then run something like doveadm backup mdbox:/tmp/$user/mdbox -u $user? Will this transfer all mails and folders or do we have to keep an eye on some specific things? I thank you very much and cheers! -lutzn

9 14

Submission auth gssapi: line too long
by Carlos Mogas da Silva 14 Aug '22

14 Aug '22

Hey guys. Dovecot is complaining about a "Line too long" when the clients send the AUTH command with GSSAPI authentication. Known bug? # dovecot --version 2.3.19.1 (9b53102964) This is right after the EHLO command (which is after STARTTLS): [1]: No more commands pending [1]: Sending replies [1]: No more commands pending [1]: Client sent invalid command: Command line is too long [1]: command [unknown]: Invalid command [1]: command [unknown]: 500 reply: Submitted [1]: command [unknown]: Replied [1]: command [unknown]: Ready to reply [1]: Trigger output [1]: Sending replies [1]: command [unknown]: Next to reply [1]: command [unknown]: Completed [1]: command [unknown]: 500 reply: Sent: 500 5.5.2 Line too long [1]: command [unknown]: Finished [1]: command [unknown]: Destroy [1]: command [unknown]: 500 reply: Destroy [1]: Trigger output

1 0

Aw: Re: convert mdbox to maildir
by lutz.niederer＠gmx.net 14 Aug '22

14 Aug '22

1 0

mdbox: purge only if it's worthwhile
by Sven Strickroth 12 Aug '22

12 Aug '22

Hi, with the mdbox storage one needs to regularly run purge to really clean up deleted mails from the storage. Running purge can be an IO intensive task as the files are append-only and even if in a 10 MB mdbox file only a small mail is deleted all other mails need to be copied to a new file. Therefore, I wonder whether there is the option to apply a threshold before a mdbox file is cleaned up, e.g. only purge an old mail if this affects > 10% of the mdbox filesize or if at least X bytes will be freed in an mdbox file. Is this possible ATM? Otherwise this can be seen as a feature request. Best, Sven PS: From the docs it's unclear to me how the mdbox rotating algorithm works. Is only to the latest mdbox file appended or it is possible that a small mail might be appended to an older mdbox file?

1 0

pre-define or alter list of IMAP keywords
by spi 11 Aug '22

11 Aug '22

I am using Dovecot 2.3.4.1 with sdbox and mostly Thunderbird on Linux and FairEmail on Android as IMAP clients. I use a defined set of IMAP keywords to allow different users to mark and filter their mails based on keywords. That works pretty well but I stumble across an issue from time to time: In TB I can pre-define a list of keywords which the user can choose one from. FairEmail shows all those keywords Dovecot presents - there is nothing like the list in TB. Issue 1: If there are no mails flagged in a folder, Dovecot doesn't present any keywords and therefore FairEmail shows none - the user has to remember and type in the correct keyword. Issue 2: After some time FairEmail shows a huge list of keywords for the INBOX, even keywords not in use for quite some time. To get rid of these keywords I deleted the index files on Dovecot (which with sdbox are not meant to be deleted?). It seems, Dovecot caches the keywords in the index files. Question: 1) Is there a way on Dovecot to define a list of keywords Dovecot presents to the IMAP clients? 2) If not, is there a nicer way to clean the keyword lists from old entries not assigned to any mail in that folder? -- Cheers spi

3 11

Sieve rule for whitelisting domains after spam processing
by Nicolae Iuoras 10 Aug '22

10 Aug '22

Hello, My mail server has a global Sieve rule defined in sieve_before to file messages classified as spam by spamassassin into the Spam folder: require ["regex", "fileinto", "imap4flags"]; if allof (header :regex "X-Spam-Status" "^Yes") { fileinto "Spam"; } This works great, except I'd like the ability to whitelist certain senders or domains whose emails end up in Spam, usually due to a misconfigured SPF DNS TXT record or something like that. I use Roundcube as my Webmail client, so the easiest way to whitelist would be to create a rule for each domain directly in Roundcube using its built-in Sieve integration to move legitimate messages out of the Spam folder. I already have several rules set up to flag and sort non-spam messages, and they're working fine. I therefore tried adding a simple rule to move Spam into the Inbox: # rule:[Not Spam] if allof (header :contains "from" "user(a)good-domain.com") { fileinto "INBOX"; } However, the above rule does not work as I expected. When I receive an email from good-domain.com that's classified as Spam by spamassassin, the global rule sends it to the Spam folder and it is not re-filed into the Inbox. The second rule doesn't seem to do anything. I'm probably doing something simple wrong, but I can't figure out what (I'm a Sieve newb). Any suggestions please? Thanks, Nick

2 1

Submission Service Copy To Sent
by Asai 10 Aug '22

10 Aug '22

Greetings, We've had a longstanding problem with emails not being copied to the Sent folder that seems to be a bug with various email clients (Thunderbird, TypeApp.) I know that Dovecot has the option to use the Submission service to copy emails to Sent without using SMTP to do this. Would this solve the problem we've seen over the years of emails not being copied to the Sent folder on various clients under certain (unknown) conditions? Thanks for your insight here. Asai

3 3

Re: how to setup dovecot to accept client certificates signed with a private CA when the server certificate is signed by a public CA
by jean-christophe manciot 09 Aug '22

09 Aug '22

@Marc@f1-outsourcing.eu No, the private CA certificate was not present there as I thought that its presence in the bundle pointed to by <ssl_ca> was enough. Anyway, placing it in /etc/ssl/certs and restarting dovecot does not change anything for the client, as expected. On Tue, Aug 9, 2022 at 10:09 AM jean-christophe manciot <actionmystique(a)gmail.com> wrote: > > @Marc@f1-outsourcing.eu > No, the private CA certificate was not present there as I thought that > its presence in the bundle pointed to by <ssl_ca> was enough. > Anyway, placing it in /etc/ssl/certs and restarting dovecot does not > change anything for the client, as expected. > > On Mon, Aug 8, 2022 at 9:28 PM Marc <Marc(a)f1-outsourcing.eu> wrote: > > > > Have you added your root CA to where the rest of the ca certs are stored on your distribution? > > > > > > > > > > I forgot to say that this mail server has been working perfectly for > > > many years (but without client certificates). > > > > > > On Mon, Aug 8, 2022 at 6:42 PM jean-christophe manciot > > > <actionmystique(a)gmail.com> wrote: > > > > > > > > @build+dovecot@de-korte.org > > > > > > > > ssl_ca = </etc/ssl/CA_Certificate_CRL_bundle.pem > > > > <ssl_ca> contains actually the private CA certificate bundled with the > > > > private CA CRL. > > > > > > > > ssl_cert = </etc/ssl/fullchain.pem > > > > <ssl_cert> contains the public server certificate bundled with Let's > > > > encrypt CA X3 cross-signed certificate. > > > > > > > > Maybe the latter should rather contain the root and intermediate > > > certificates. > > > > > > > > On Mon, Aug 8, 2022 at 11:45 AM Arjen de Korte > > > > <build+dovecot(a)de-korte.org> wrote: > > > > > > > > > > Citeren jean-christophe manciot <actionmystique(a)gmail.com>: > > > > > > > > > > > Hi everyone, > > > > > > > > > > > > I'm trying to setup dovecot to accept only client certificates > > > created > > > > > > with a private CA: > > > > > > auth_ssl_require_client_cert = yes > > > > > > ssl_verify_client_cert = yes > > > > > > ssl_ca = </etc/ssl/CA_Certificate_CRL_bundle.pem > > > > > > > > > > This is wrong, you should enter your private CA here. If > > > > > 'ssl_verify_client_cert' is not set to 'yes', this field should > > > > > generally be empty / not configured. > > > > > > > > > > > At the same time, dovecot is setup with an SSL certificate created > > > by > > > > > > a public CA (let's encrypt): > > > > > > ssl = required > > > > > > ssl_cert = </etc/ssl/fullchain.pem > > > > > > ssl_key = </etc/ssl/key.pem > > > > > > > > > > > > When I try to connect to the server with a client (evolution), I > > > get a > > > > > > connection error: > > > > > > "Client did not present valid SSL certificate" except that it is > > > valid. > > > > > > > > > > > > As you probably already know, let's encrypt does not create client > > > > > > certificates. > > > > > > It seems that using a different CA for client certificates and for > > > the > > > > > > server certificate is unsupported. > > > > > > > > > > > > Am I missing something? > > > > -- > Jean-Christophe -- Jean-Christophe

1 0

how to setup dovecot to accept client certificates signed with a private CA when the server certificate is signed by a public CA
by jean-christophe manciot 08 Aug '22

08 Aug '22

Hi everyone, I'm trying to setup dovecot to accept only client certificates created with a private CA: auth_ssl_require_client_cert = yes ssl_verify_client_cert = yes ssl_ca = </etc/ssl/CA_Certificate_CRL_bundle.pem At the same time, dovecot is setup with an SSL certificate created by a public CA (let's encrypt): ssl = required ssl_cert = </etc/ssl/fullchain.pem ssl_key = </etc/ssl/key.pem When I try to connect to the server with a client (evolution), I get a connection error: "Client did not present valid SSL certificate" except that it is valid. As you probably already know, let's encrypt does not create client certificates. It seems that using a different CA for client certificates and for the server certificate is unsupported. Am I missing something? -- Jean-Christophe

3 4

rawlog data in a lua script
by michael.zork＠feierfighter.de 08 Aug '22

08 Aug '22

Hi, I'm searching for a possibility to have the rawlog feature in lua, which would be much easier for processing. Currently Dovecot, when activating rawlog for a user, writes everything to disk (which creates I/O), and I have to somehow read it from there. That's a bit complicated, because I have to get notified via inotify or similar when there are new files created, and then I have to start a "tail" or "epoll" mechanism on the files to get the contents in more or less real time (IMAP sessions can be multiple hours or days). It would be much easier to hook to the "raw request and response events" inside Dovecot and have the rawlog-data in a lua script, where I can prepare it and send it to another maschine for monitoring/collection/analysis/statistics or similar, for example via HTTP. Having the rawlog data available in lua would make things a lot easier. Is there any possibility at the moment to create a lua script and "hook" to those "request and response events"? If not, would it be possible to add that feature in the future? Kind regards Michael

5 8

RFC 9266: Channel Bindings for TLS 1.3 support
by * Neustradamus * 08 Aug '22

08 Aug '22

Hello all, I would like to know if it is possible to add RFC 9266: Channel Bindings for TLS 1.3? - https://datatracker.ietf.org/doc/html/rfc9266 Little details, to know easily: - tls-unique for TLS =< 1.2 - tls-exporter for TLS = 1.3 It is will be used by SCRAM-SHA-*-PLUS like SCRAM-SHA-1-PLUS/SCRAM-SHA-256-PLUS. SCRAM-SHA-1 and SCRAM-SHA-256 are already supported. Thanks in advance. Regards, Neustradamus

2 1

Re: RHEL9 Repository
by justina colmena ~biz 07 Aug '22

07 Aug '22

On August 5, 2022 3:30:57 PM AKDT, Peter <peter(a)pajamian.dhs.org> wrote: >The main site doesn't currently support https but the repositories do, also all packages are cryptographically signed and the signing keys are served off of a secure server. > >The info on the site is public information that doesn't really need to be secure. > In which case any actual content on the said site becomes injected with ultra-persistent linux-targeted adware, spyware, and pop-ups by any given third party in transit, which craps up my phone and slows down my desktop browser to a crawl, and then I have to update my adblocker, re-up all my security settings and fix all the other things that break due to spam malicious advertising on the internet. Plain old http is simply maddening these days. Leave the front door wide open for online hustlers and thieves, yeah, some people have bank accounts or manage actual money on their computers. I would highly encourage a use of basic https all around: certbot/letsencrypt is currently free and there are many other low-cost options for https in conjunction with any given hosting service or platform. -- Sent from my Android device with K-9 Mail. Please excuse my brevity. -- Sent from my Android device with K-9 Mail. Please excuse my brevity.

2 1