- dovecot - dovecot.org

Re: Issue with one user only, exceeding connections
by Richard 08 Jun '22

08 Jun '22

> Date: Wednesday, June 08, 2022 14:14:23 -0500 > From: Jeremy Schaeffer <kb9mfd(a)phonesplus.biz> > > I keep having this issue with one user, and I have to restart > dovecot several times a day to clear it. What I have is a postfix / > dovecot mail server (Centos 7) and about a dozen users. All > mailboxes are imap ssl. I monitor about 4 mailboxes on my computer > and tablet. I use Thunderbird on the computer (cache connections at > 2) and K9 on the tablet, but one user of the four I keep getting > "Maximum number of connections from user+IP exceeded" and I have > the maximum at 50 "(mail_max_userip_connections=50)" so its hard > for me to believe I am actually exceeding it unless dovecot/client > is not dropping connections and keeps starting new ones until it > reaches the maximum, but again, only for one user, even though I am > monitoring 4 on the same devices. Any idea how to troubleshoot > this? I don't know if I should be looking at dovecot or the > clients, or what I need to look for. It's been going on since I put > this server in use over a year ago. I also have issues with Outlook > clients disconnecting, just outlook, is there any recommended > settings to make Outlook work smoother? > > Thanks! - Jeremy > > Config - > ># 2.2.36 (1f10bfa63): /etc/dovecot/dovecot.conf ># OS: Linux 3.10.0-1160.11.1.el7.x86_64 x86_64 CentOS Linux release ># 7.9.2009 (Core) Hostname: *** > } > protocol imap { > mail_max_userip_connections = 50 > } > On my centos-7 dovecot install (same versions you indicate you are using), that connection-limiting line is in: /etc/dovecot/conf.d/20-imap.conf while you appear to have it in the main dovecot.conf file. If you have that in both places I'm not certain which one takes precedence, but you might want to check. [In my setup almost all the configuration pieces are in include files, rather than the main .conf.] Starting with a "ps" (and grep &etc.) it's fairly easy to see how many connections any account has open. An open mailbox has one or two connections and then every folder (under a mailbox) that is open will have a connection associated with it too, which pushes up the count quickly if someone holds a lot of folders open.

1 0

Occasional service disruptions
by Nikolaos Milas 08 Jun '22

08 Jun '22

Hello, On a server with (Postfix and) Dovecot 2.3.18 (on a VM running CentOS 7 - 1 CPU, 5 GB RAM) with the config you will see below, we are facing occasional (infrequent) service disruptions: IMAP service seems unavailable to some users. Jun 6 12:01:25 vweb2 roundcube: <1eecb0d4> IMAP Error: Login failed for imaptester against vmail2.noa.gr from 195.251.202.xxx. Could not connect to ssl://vmail2.noa.gr:993: Connection rejected in /var/webs/webmail/rcube/program/lib/Roundcube/rcube_imap.php on line 211 (POST /?_task=login&_action=login) At that time there was no associated logged event in dovecot log. (Other users are logging in and out.) However, I see some warnings (I list the two of them closest to the above event): Jun 06 12:01:22 imap(user1)<29639><Vr0atcPg5M3BXBCl>: Warning: Inotify instance limit for user 500 (UID vmail) exceeded, disabling. Increase /proc/sys/fs/inotify/max_user_instances ... Jun 06 12:01:26 imap(user2)<29793><rZuSt8PgztoKyVSG>: Warning: Inotify instance limit for user 500 (UID vmail) exceeded, disabling. Increase /proc/sys/fs/inotify/max_user_instances (In above log excerpts I've only modified real usernames.) Restarting Dovecot returns things back to normal. I have tried to use "service_count = 100" in all configured services, to see how it goes. Most of the config is inherited from the past (older versions) and is not optimized. For example one can observe different "process_limit" values for different services, for no apparent reason I am aware of. Could anyone suggest changes and/or additions to the OS and/or Dovecot to resolve this issue? Any additional suggestions will also be welcome. Thanks in advance for your kind assistance. Here is the config (I've only changed postmaster address): ======================================================================= protocols = imap pop3 sieve lmtp login_greeting = Dovecot NOA ICXC-NIKA log_path = /var/log/dove.log mail_location = maildir:~/Maildir/ mail_gid = 500 mail_uid = 500 auth_mechanisms = plain login auth_username_format = %Ln auth_verbose = no auth_debug = no mail_debug = no disable_plaintext_auth = no mail_plugins = quota mail_log notify protocol imap { imap_client_workarounds = "delay-newmail" mail_plugins = quota imap_quota mail_log notify mail_max_userip_connections = 400 namespace inbox { mailbox Trash { autoexpunge = 15d } } } protocol pop3 { mail_max_userip_connections = 3 mail_plugins = quota notify pop3_client_workarounds = outlook-no-nuls oe-ns-eoh pop3_uidl_format = %08Xu%08Xv namespace inbox { mailbox Trash { autoexpunge = 15d } } } protocol lda { auth_socket_path = /var/run/dovecot/auth-master mail_plugins = quota notify sieve postmaster_address = xxxxxxxxx(a)noa.gr sendmail_path = /usr/lib/sendmail } protocol lmtp { auth_socket_path = /var/run/dovecot/auth-master postmaster_address = xxxxxxxxx(a)noa.gr mail_plugins = quota notify sieve sendmail_path = /usr/lib/sendmail } protocol sieve { managesieve_max_line_length = 65536 mail_max_userip_connections = 10 managesieve_logout_format = bytes=%i/%o managesieve_max_compile_errors = 10 } userdb { args = /etc/dovecot/dovecot-usrdb-ldap.conf driver = ldap } passdb { args = /etc/dovecot/dovecot-passdb-ldap.conf driver = ldap } plugin { mail_log_events = delete undelete expunge copy mailbox_delete mailbox_rename flag_change save mailbox_create mail_log_fields = uid box msgid size flags vsize from subject quota = maildir:User quota quota_rule = *:storage=15G quota_rule2 = Trash:storage=+3%% quota_warning = storage=75%% quota-warning 75 %u quota_warning2 = storage=90%% quota-warning 90 %u sieve = file:~/sieve;active=~/.dovecot.sieve sieve_max_script_size = 0 sieve_max_actions = 0 sieve_max_redirects = 2 } service quota-warning { executable = script /opt/mail1.sh user = vmail unix_listener quota-warning { user = vmail } } service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0660 user = postfix } unix_listener auth-master { group = vmail mode = 0660 user = vmail } user = root } service imap-login { service_count = 100 vsz_limit = 64 M process_limit = 500 } service pop3-login { service_count = 100 vsz_limit = 64 M } service managesieve-login { inet_listener sieve { port = 4190 } service_count = 100 process_min_avail = 0 vsz_limit = 64M } service managesieve { process_limit = 1024 } service imap { executable = imap postlogin process_limit = 2048 } service pop3 { executable = pop3 postlogin } service postlogin { executable = script-login -d rawlog unix_listener postlogin { } } service lmtp { unix_listener /var/spool/postfix/private/dovecot-lmtp { group = postfix mode = 0600 user = postfix } } ssl = yes ssl_cert = </etc/pki/tls/certs/star_noa_gr-cert-with_CA-rev-754868755.crt ssl_key = </etc/pki/tls/private/star_noa_gr-1243437.key namespace inbox { separator = . prefix = inbox = yes mailbox Drafts { special_use = \Drafts auto = subscribe } mailbox Junk { special_use = \Junk auto = subscribe } mailbox Trash { special_use = \Trash auto = subscribe } mailbox Sent { special_use = \Sent auto = subscribe } } ======================================================================= Nick

3 4

Distros based on OpenSSL 3 fail on lib-dcrypt/test-crypto
by Sloane Bernstein 08 Jun '22

08 Jun '22

Hello, I am getting our Dovecot packages preliminarily ready to support Linux distributions which rely on OpenSSL 3. I notice that even the main dev branch will build, but the test suite fails (among other places) at test_password_change in src/lib-dcrypt/test-crypto.c: -- [root@al9 lib-dcrypt]# ./test-crypto test_cipher_test_vectors ............................................. : ok test_cipher_aead_test_vectors ........................................ : ok test_hmac_test_vectors ............................................... : ok test_load_v1_keys .................................................... : ok test_load_v1_key ..................................................... : ok test_load_v1_public_key .............................................. : ok test_load_v2_key ..................................................... : ok test_load_v2_public_key .............................................. : ok test_get_info_v2_key ................................................. : ok test_gen_and_get_info_rsa_pem ........................................ : ok test_get_info_rsa_private_key ........................................ : ok test_get_info_invalid_keys ........................................... : ok test_get_info_key_encrypted .......................................... : ok test_get_info_pw_encrypted ........................................... : ok test-crypto.c:827: Assert failed: ret == TRUE Panic: file dcrypt-openssl.c: line 2636 (dcrypt_openssl_private_to_public_key): assertion failed: (priv_key != NULL && pub_key_r != NULL) Error: Raw backtrace: ./test-crypto(backtrace_append+0x42) [0x445332] -> ./test-crypto(backtrace_get+0x1e) [0x44544e] -> ./test-crypto() [0x42414b] -> ./test-crypto() [0x424181] -> ./test-crypto() [0x412b69] -> .libs/libdcrypt_openssl.so(+0x5f25) [0x7fb61954df25] -> ./test-crypto() [0x41cd9a] -> ./test-crypto() [0x4200af] -> ./test-crypto(test_run+0x4c) [0x420c5c] -> ./test-crypto(main+0x4b) [0x41717b] -> /lib64/libc.so.6(+0x44e50) [0x7fb6195a3e50] -> /lib64/libc.so.6(__libc_start_main+0x7c) [0x7fb6195a3efc] -> ./test-crypto(_start+0x25) [0x417295] Aborted (core dumped) -- Looking at how various distros handle this test failure when building packages, they all seem to apply the same patch developed by Red Hat to get this test to pass, attached to https://bugzilla.redhat.com/show_bug.cgi?id=1962035: -- diff -up dovecot-2.3.14/src/lib-dcrypt/dcrypt-openssl.c.opensslv3 dovecot-2.3.14/src/lib-dcrypt/dcrypt-openssl.c --- dovecot-2.3.14/src/lib-dcrypt/dcrypt-openssl.c.opensslv3 2021-06-03 18:56:52.573174433 +0200 +++ dovecot-2.3.14/src/lib-dcrypt/dcrypt-openssl.c 2021-06-03 18:56:52.585174274 +0200 @@ -73,10 +73,30 @@ 2<tab>key algo oid<tab>1<tab>symmetric algo name<tab>salt<tab>hash algo<tab>rounds<tab>E(RSA = i2d_PrivateKey, EC=Private Point)<tab>key id **/ +#if OPENSSL_VERSION_MAJOR == 3 +static EC_KEY *EVP_PKEY_get0_EC_KEYv3(EVP_PKEY *key) +{ + EC_KEY *eck = EVP_PKEY_get1_EC_KEY(key); + EVP_PKEY_set1_EC_KEY(key, eck); + EC_KEY_free(eck); + return eck; +} + +static EC_KEY *EVP_PKEY_get1_EC_KEYv3(EVP_PKEY *key) +{ + EC_KEY *eck = EVP_PKEY_get1_EC_KEY(key); + EVP_PKEY_set1_EC_KEY(key, eck); + return eck; +} + +#define EVP_PKEY_get0_EC_KEY EVP_PKEY_get0_EC_KEYv3 +#define EVP_PKEY_get1_EC_KEY EVP_PKEY_get1_EC_KEYv3 +#else #ifndef HAVE_EVP_PKEY_get0 #define EVP_PKEY_get0_EC_KEY(x) x->pkey.ec #define EVP_PKEY_get0_RSA(x) x->pkey.rsa #endif +#endif #ifndef HAVE_OBJ_LENGTH #define OBJ_length(o) ((o)->length) -- I presume that either this patch or an equivalent is planned for eventual inclusion into upstream? -- Sloane Bernstein Developer I cPanel, L.L.C.

2 1

The meaning of "tarpit" as used in the auth policy docs?
by Hippo Man 08 Jun '22

08 Jun '22

I'm trying to understand what is meant by "tarpit" in the ffollowing quote of the Dovecot auth policy docs for the "before" check ... First query is done *before* password and user databases are consulted. This means that any userdb/passdb attributes are left empty. The command used here is ‘allow’ and will appear on the URL as command=allow. status result values: - -1: Reject - 0: Accept - (Any other positive value): *Tarpit for this number of seconds.* What actually happens if a positive status value is returned here? Does it mean that the client will not receive any response for the given number of seconds, but that the given login attempt will still continue after that delay? Or does it mean that the client will not receive a response for the given number of seconds, and then the login will be rejected after that delay? What if the client has connected via pop3 and is sending multple "user" and "pass" combinations? If the "before" check returns, for example, the integer "5" as the status, does this mean there will be a 5-second delay between each login attempt that is being sent to this connection? Ideally, I'd like the following to occur, but I don't know if it is possible: * Client connects via pop3 and intends to send a large batch of "user"/"pass" commands via this connection. * The first "user"/"pass" command is made to wait for many seconds. * Then, the connection is dropped, so that the subsequent "user"/"pass" commands do not even hit the dovecot server. I'm thinking that this is *not* what is meant by "tarpit" in the auth policy docs, correct? Thank you for any clarification. -- hippoman(a)gmail.com Take a hippopotamus to lunch today.

2 1

Extremely long line
by Dmitriy Fitisov 07 Jun '22

07 Jun '22

Hello everyone, I’m using https://github.com/karastojko/mailio <https://github.com/karastojko/mailio> to get messages from dovecot-2.3.7.2 (3c910f64b) and 1 of the messages which is 2.5 mbytes in size and has an image attached, has a half megabyte of <80> (0x80) characters at the end. And that is with default encoding of 7 bit (meaning there is no part headers at the end), right after the message those characters. I got a feeling that max length was 998 characters. On other hand, looks like dovecot is replacing NULL chars with 0x80. Is that is correct behavior, should I expect that half meg of bytes in 1 line? Is it a known issue? Thank you. Dmitriy

2 1

Sieve configuration for roundcube
by Jeremy Hansen 07 Jun '22

07 Jun '22

Any pointers to get dovecot configured with sieve for Roundcube filters? Things I’ve found through search seem a bit all over the place. I’m using CentOS 8/Rocky Linux hosts. Thanks

4 6

Hiding imap account and still using it for outgoing email
by Hippo Man 07 Jun '22

07 Jun '22

I'm using dovecot 2.3.18 with a fairly recent version of postfix on my Debian-11 box. I have a question, and I'm not sure whether it pertains to dovecot, postfix, or both. I'm asking first here, but I'm glad to go to a postfix forum if it turns out that my question doesn't pertain to dovecot. On my server, account management in both dovecot and postfix is managed by the same mysql database, and postfix is configured to use dovecot's authentication mechanism. I have an email address which I do not want to be seen as one which can be accessed for imap nor pop3. However, I want to receive email to that address, and I, myself, still do want to be able to use imap or pop3 in order to access email that is sent to that address. I have something I want to try in order to accomplish this, but before I do, I want to make sure that no one can see any issues or "gotchas" with the following approach, or perhaps that there is an easier, more straightforward way to accomplish what I want to do: Assume the email address in question is "myemail(a)domain.com", and assume that I own and manage the "domain.com" domain. (1) Create another email address called "other(a)domain.com", and set it up with the same configuration as is currently set up for "myemail(a)domain.com" (2) In all my email clients, set the outgoing mail address and reply-to address for "other(a)domain.com" to be "myemail(a)domain.com". This way, all outgoing email from "other(a)domain.com" will look like it is being sent from "myemail(a)domain.com". (3) Change "myemail.com" (in the database used by dovecot and postfix) from being a bona-fide email address into becoming simply a forwarding email alias for "other(a)domain.com". (4) In all my email clients, change the inbox that I previously used for "myemail(a)domain.com" to now be associated with "other(a)domain.com". So ... if anyone sends email to "myemail(a)domain.com", it will automatically go to the "other(a)domain.com" inbox. And when I reply to those emails, the sender and reply-to addresses will still be "myemail(a)domain.com". And now, dovecot will no longer see "myemail(a)domain.com" as a mailbox from which email can be retrieved. And I will still be able to retrieve that email via imap or pop3 from the "other(a)domain.com" account. Do you folks think this will work? And again, is there perhaps a simpler way to accomplish this? Thank you in advance for any thoughts and suggestions. -- hippoman(a)gmail.com Take a hippopotamus to lunch today.

1 1

Random behavior with sieve extprograms
by Thomas Sommer 04 Jun '22

04 Jun '22

Hi I have a random behavior with dovecot and sieve extprograms. Here is my sieve file: require ["fileinto", "vnd.dovecot.pipe", "copy", "imap4flags"]; # rule:[DABS] if header :contains "X-Original-To" "dabs(a)mydomain.ch" { pipe "sieve-dabs-execute.sh"; setflag "\\Seen"; fileinto "acme.DABS"; stop; } Emails matching the condition are processed by a laravel (php) artisan command. See service sieve-pipe-script below. The exit code of this php command is 0. I randomly get the following in my postfix logs: Sieve thinks that the command failed, but the email was always processed correctly. In that case I get a copy in my Inbox. I'm wondering what could be the cause for this random behavior. My guess is that approximately 70% are processed correctly, 30% is as below. May 31 13:50:38 star dovecot[99425]: lda(user)<99425><kma+MC4dlmJhhAEAzJBnyA>: sieve: msgid=<62961d1c.5y4hr0Vqi97JFnyb%DABS.zsmsvp02(a)example.com>: fileinto action: stored mail into mailbox 'acme.DABS' May 31 13:50:39 star dovecot[99425]: lda(user)<99425><kma+MC4dlmJhhAEAzJBnyA>: sieve: msgid=<62961d1c.5y4hr0Vqi97JFnyb%DABS.zsmsvp02(a)example.com>: stored mail into mailbox 'INBOX' May 31 13:50:39 star dovecot[99425]: lda(user)<99425><kma+MC4dlmJhhAEAzJBnyA>: sieve: Execution of script /home/user/sieve/.dovecot.sieve failed, but implicit keep was successful (user logfile /home/user/sieve/.dovecot.sieve.log may reveal additional details) .dovecot.sieve.log: sieve: info: started log at May 31 13:50:39. error: failed to pipe message to program `sieve-dabs-execute.sh': refer to server log for more information. [2022-05-31 13:50:39]. It's weird. "failed to pipe message to program" is simply not true. The command was processed correctly. Any ideas where to look for clues or how to debug this? Regards Thomas config: # 2.3.14 (cee3cbc0d): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.14 (1b5c82b2) # OS: Linux 5.17.5-x86_64-linode154 x86_64 Ubuntu 20.04.4 LTS auth_mechanisms = plain login auth_username_format = %n auth_verbose = yes mail_location = maildir:~/Maildir mail_plugins = " quota" managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext vnd.dovecot.pipe vnd.dovecot.execute namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } passdb { driver = pam } plugin { quota = fs:User quota quota_grace = 1%% quota_status_nouser = DUNNO quota_status_overquota = 552 5.2.2 Mailbox is full quota_status_success = DUNNO sieve = file:~/sieve;active=~/sieve/.dovecot.sieve sieve_execute_socket_dir = sieve_extensions = +vnd.dovecot.pipe +vnd.dovecot.execute sieve_pipe_exec_timeout = 30s sieve_pipe_socket_dir = sieve_plugins = sieve_extprograms sieve_redirect_envelope_from = recipient sieve_trace_debug = no sieve_trace_dir = ~/sieve/trace sieve_trace_level = matching } protocols = imap sieve service auth { unix_listener /var/spool/postfix/private/dovecot-auth { group = postfix mode = 0660 user = postfix } } service quota-status { client_limit = 1 executable = /usr/lib/dovecot/quota-status -p postfix inet_listener { address = 127.0.0.1 port = 8881 } } service sieve-pipe-script { executable = script /usr/bin/php /srv/www/mydomain/status/artisan dabs:processEmail unix_listener sieve-dabs-execute.sh { mode = 0660 user = user } user = www-data vsz_limit = 512 M } ssl = required ssl_cert = </etc/letsencrypt/live/star.mydomain.ch/fullchain.pem ssl_cipher_list = AES128+EECDH:AES128+EDH ssl_client_ca_dir = /etc/ssl/certs ssl_dh = # hidden, use -P to show it ssl_key = # hidden, use -P to show it ssl_min_protocol = TLSv1.2 ssl_prefer_server_ciphers = yes userdb { driver = passwd } protocol lda { deliver_log_format = msgid=%m: %$ mail_plugins = " quota sieve" postmaster_address = postmaster(a)mydomain.ch quota_full_tempfail = yes rejection_reason = Your message to <%t> was automatically rejected:%n%r } protocol imap { mail_max_userip_connections = 20 mail_plugins = " quota mail_log notify imap_quota" }

2 4

dovecot 2.3.19 source tarball build failed
by Dmitriy Fitisov 03 Jun '22

03 Jun '22

Hello all again, building from 2.3.19 src tarball on Darwin Kernel Version 21.5.0: Tue Apr 26 21:08:29 PDT 2022; root:xnu-8020.121.3~4/RELEASE_ARM64_T8101 arm64 got failure: ioloop-notify-kqueue.c:70:2: error: implicit declaration of function 'i_gettimeofday' is invalid in C99 [-Werror,-Wimplicit-function-declaration] i_gettimeofday(&ioloop_timeval); ^ ioloop-notify-kqueue.c:70:2: note: did you mean 'gettimeofday'? /Applications/Xcode.app/Contents/Developer/Platforms/MacOSX.platform/Developer/SDKs/MacOSX.sdk/usr/include/sys/time.h:197:9: note: 'gettimeofday' declared here int gettimeofday(struct timeval * __restrict, void * __restrict); ^ 1 error generated. Not sure what is a proper way to report patches. Seem source generated by bison? Anyway, just added one liner added to src/lib/ioloop-notify-kqueue.c: 13a14 > #include "time-util.h” Builds fine. Thank you. Dmitriy

2 2

Openmetrics label truncation
by Daniel Sabotta 03 Jun '22

03 Jun '22

Hello, I'm using dovecot 2.3.18 and want to collect metrics with prometheus via openmetrics. I need to label the metrics with the destination host name. The configuration works fine, but the label value is truncated after 32 chars (and a '...' is added). My config: service stats { inet_listener http { port = 9323 } } metric my_metric { filter = event=smtp_client_transaction_finished group_by = dest_host status_code } I wrote a simple patch, that fixes that for me: diff --git a/src/stats/stats-metrics.c b/src/stats/stats-metrics.c index 877c142546..30126563ff 100644 --- a/src/stats/stats-metrics.c +++ b/src/stats/stats-metrics.c @@ -357,7 +357,7 @@ stats_metric_sub_metric_alloc(struct metric *metric, const char *name, pool_t po array_append_zero(&fields); sub_metric = stats_metric_alloc(pool, metric->name, metric->set, array_idx(&fields, 0)); - sub_metric->sub_name = p_strdup(pool, str_sanitize_utf8(name, 32)); + sub_metric->sub_name = p_strdup(pool, str_sanitize_utf8(name, 63)); array_append(&metric->sub_metrics, &sub_metric, 1); return sub_metric; } Why are labels truncated after 32? Is there a reason I do not see? I found no reasons in the openmetrics specification [1]. Thanks in advance Daniel

2 2

Restrict IMAP login, but allow Postfix SASL
by lutz.niederer＠gmx.net 03 Jun '22

03 Jun '22

Hi, we have a very simple user-/passdb (like passwd) to authenticate virtual IMAP users. We also use this for Postfix authentication. Nothing special. But, we need to exclude some of the users from IMAP login. This means, some users should be allowed to send mail via Postfix (submission) and therefore authenticate via SASL against dovecot successfully, but they should not be allowed to login to their IMAP mail box. How could this be done? Thanks! -lutzn

9 9

Building dovecot-core
by Dmitriy Fitisov 03 Jun '22

03 Jun '22

Hi all, do we have any info on building dovecot-core? INSTALL.md suggests usual way: ./configure … Needless to say, there is no .configure in root dir. I think, instructions need to be updated to correct this. Thank you. Dmitriy

4 4

What is the state of SMTPUTF8 support?
by Sylvhem 02 Jun '22

02 Jun '22

Hi! It’s been some time since I last saw a mention of SMTPUTF8 here. Last time I heard about it, it was worked on. Does anybody have news about that? -- Sylvhem

5 8

doveadm-deduplicate deletes non-duplicates
by Ryan Kavanagh 31 May '22

31 May '22

Hi, I've been trying to use `doveadm deduplicate` to deduplicate mailboxes. According to doveadm-deduplicate(1), "deduplication will be done by message GUIDs". However, deduplication deletes messages with distinct message GUIDs, i.e., it deletes messages that are not duplicates. Is this a case of user error, do I have some form of corruption going on, or am I running into a bug? In case it helps, I'm including: 1) the list of GUIDs for messages in my INBOX before a deduplication run (as documented in doveadm-deduplicate(1)), 2) the output of `doveadm -D deduplicate -u rak mailbox INBOX`, 3) the list of GUIDs after deduplication, 4) a diff of (1) and (3), 5) the output of doveconf -n. Thanks, Ryan $ doveadm -f table fetch -u rak 'guid uid' mailbox INBOX | sort 0b3bee1414118f6282db0000226807b0 7100 0b4b681c18168f6220940000226807b0 7104 0b83ac1d79cf2962eb3a0100226807b0 6153 0b97791e83108f6282db0000226807b0 7095 1614451513.M180742P77875.hades.rak.ac,S=3516,W=3600 22 1614451513.M180779P77875.hades.rak.ac,S=5252,W=5370 52 1614452870.M315137P88362.hades.rak.ac,S=5516,W=5623 68 1614452870.M315152P88362.hades.rak.ac,S=5977,W=6085 69 23a5a0179e108f6282db0000226807b0 7097 33318e0686108f6282db0000226807b0 7096 3351581c9c0e8f624cd50000226807b0 7091 3359032360108f6282db0000226807b0 7093 3b3927352be48c62b65b0000226807b0 7072 3ba2252814118f62a2540100226807b0 7101 4154be0c2fc77761c2550000226807b0 4050 5b3a7327d73b866299cd0000226807b0 7013 638e073255235d62a5280100226807b0 6660 63b6422e14118f6282db0000226807b0 7102 8b9b942909118f6282db0000226807b0 7099 8bc95639a6168f62ad4e0000226807b0 7105 a316ee28980d8f627c460000226807b0 7090 ab802c1e37ac3d6214680100226807b0 6343 b3d12f21cd108f6282db0000226807b0 7098 bb89431b6e728d6230920000226807b0 7076 c386310f062adb61d1980000226807b0 5306 cb56992484478d62f3090100226807b0 7074 cb79bf3503128f6275220100226807b0 7103 eb2818367d108f62484b0100a558518d 7094 eb709020e70f8f62292e0000226807b0 7092 f19a8c06409a7d61271c0000226807b0 4128 f338ad1ff65e8562ff390100226807b0 7007 f9cd03363c457c613a0e0000226807b0 4107 guid uid $ doveadm -D deduplicate -u rak mailbox INBOX Debug: Loading modules from directory: /usr/local/lib/dovecot/doveadm Debug: Skipping module doveadm_acl_plugin, because dlopen() failed: Cannot load specified object (this is usually intentional, so just ignore this message) Debug: Skipping module doveadm_quota_plugin, because dlopen() failed: Cannot load specified object (this is usually intentional, so just ignore this message) Debug: Module loaded: /usr/local/lib/dovecot/doveadm/lib10_doveadm_sieve_plugin.so Debug: Skipping module doveadm_fts_plugin, because dlopen() failed: Cannot load specified object (this is usually intentional, so just ignore this message) Debug: Skipping module doveadm_fts_flatcurve_plugin, because dlopen() failed: Cannot load specified object (this is usually intentional, so just ignore this message) Debug: Skipping module doveadm_mail_crypt_plugin, because dlopen() failed: Cannot load specified object (this is usually intentional, so just ignore this message) May 31 12:50:35 Debug: Loading modules from directory: /usr/local/lib/dovecot May 31 12:50:35 Debug: Module loaded: /usr/local/lib/dovecot/lib15_notify_plugin.so May 31 12:50:35 Debug: Module loaded: /usr/local/lib/dovecot/lib20_replication_plugin.so May 31 12:50:35 Debug: Module loaded: /usr/local/lib/dovecot/lib20_virtual_plugin.so May 31 12:50:35 Debug: Loading modules from directory: /usr/local/lib/dovecot/doveadm May 31 12:50:35 Debug: Skipping module doveadm_acl_plugin, because dlopen() failed: Cannot load specified object (this is usually intentional, so just ignore this message) May 31 12:50:35 Debug: Skipping module doveadm_quota_plugin, because dlopen() failed: Cannot load specified object (this is usually intentional, so just ignore this message) May 31 12:50:35 Debug: Skipping module doveadm_fts_plugin, because dlopen() failed: Cannot load specified object (this is usually intentional, so just ignore this message) May 31 12:50:35 Debug: Skipping module doveadm_fts_flatcurve_plugin, because dlopen() failed: Cannot load specified object (this is usually intentional, so just ignore this message) May 31 12:50:35 Debug: Skipping module doveadm_mail_crypt_plugin, because dlopen() failed: Cannot load specified object (this is usually intentional, so just ignore this message) May 31 12:50:35 doveadm(rak)<74469><>: Debug: auth-master: userdb lookup(rak): Started userdb lookup May 31 12:50:35 doveadm(rak)<74469><>: Debug: auth-master: conn unix:/var/dovecot/auth-userdb: Connecting May 31 12:50:35 doveadm(rak)<74469><>: Debug: auth-master: conn unix:/var/dovecot/auth-userdb (pid=6157,uid=0): Client connected (fd=9) May 31 12:50:35 doveadm(rak)<74469><>: Debug: auth-master: userdb lookup(rak): auth USER input: rak uid=1002 gid=1002 home=/home/vmail/rak /etc/mail/auth May 31 12:50:35 doveadm(rak)<74469><>: Debug: auth-master: userdb lookup(rak): Finished userdb lookup (username=rak uid=1002 gid=1002 home=/home/vmail/rak /etc/mail/auth) May 31 12:50:35 doveadm(rak)<74469><>: Debug: Unknown userdb setting: plugin//etc/mail/auth=yes May 31 12:50:35 doveadm(rak)<74469><PLteAltHlmLlIgEAImgHsA>: Debug: Effective uid=1002, gid=1002, home=/home/vmail/rak May 31 12:50:35 doveadm(rak)<74469><PLteAltHlmLlIgEAImgHsA>: Debug: open(/proc/self/stat) failed: No such file or directory May 31 12:50:35 doveadm(rak)<74469><PLteAltHlmLlIgEAImgHsA>: Debug: open(/proc/self/io) failed: No such file or directory May 31 12:50:35 doveadm(rak)<74469><PLteAltHlmLlIgEAImgHsA>: Debug: Namespace inbox: type=private, prefix=, sep=/, inbox=yes, hidden=no, list=yes, subscriptions=yes location=maildir:~/mail:LAYOUT=fs:INDEX=~/indexes May 31 12:50:35 doveadm(rak)<74469><PLteAltHlmLlIgEAImgHsA>: Debug: fs: root=/home/vmail/rak/mail, index=/home/vmail/rak/indexes, indexpvt=, control=, inbox=/home/vmail/rak/mail, alt= May 31 12:50:35 doveadm(rak)<74469><PLteAltHlmLlIgEAImgHsA>: Debug: Namespace virtual: type=private, prefix=Virtual/, sep=/, inbox=no, hidden=no, list=yes, subscriptions=yes location=virtual:/etc/dovecot/virtual:LAYOUT=fs:INDEX=~/virtual May 31 12:50:35 doveadm(rak)<74469><PLteAltHlmLlIgEAImgHsA>: Debug: fs: root=/etc/dovecot/virtual, index=/home/vmail/rak/virtual, indexpvt=, control=, inbox=, alt= May 31 12:50:35 doveadm(rak): Debug: Mailbox INBOX: Mailbox opened May 31 12:50:35 doveadm(rak): Debug: Mailbox INBOX: UID 7007: Expunge requested May 31 12:50:35 doveadm(rak): Debug: Mailbox INBOX: UID 7013: Expunge requested May 31 12:50:35 doveadm(rak): Debug: Mailbox INBOX: UID 7090: Expunge requested May 31 12:50:35 doveadm(rak): Debug: Mailbox INBOX: UID 7091: Expunge requested May 31 12:50:35 doveadm(rak): Debug: Mailbox INBOX: UID 7094: Expunge requested May 31 12:50:35 doveadm(rak): Debug: Mailbox INBOX: UID 7096: Expunge requested May 31 12:50:35 doveadm(rak): Debug: Mailbox INBOX: UID 7099: Expunge requested May 31 12:50:35 doveadm(rak): Debug: Mailbox INBOX: UID 7101: Expunge requested May 31 12:50:35 doveadm(rak): Debug: Mailbox INBOX: UID 7103: Expunge requested May 31 12:50:35 doveadm(rak): Debug: Mailbox INBOX: UID 7007: Mail expunged May 31 12:50:35 doveadm(rak): Debug: Mailbox INBOX: UID 7013: Mail expunged May 31 12:50:35 doveadm(rak): Debug: Mailbox INBOX: UID 7090: Mail expunged May 31 12:50:35 doveadm(rak): Debug: Mailbox INBOX: UID 7091: Mail expunged May 31 12:50:35 doveadm(rak): Debug: Mailbox INBOX: UID 7094: Mail expunged May 31 12:50:35 doveadm(rak): Debug: Mailbox INBOX: UID 7096: Mail expunged May 31 12:50:35 doveadm(rak): Debug: Mailbox INBOX: UID 7099: Mail expunged May 31 12:50:35 doveadm(rak): Debug: Mailbox INBOX: UID 7101: Mail expunged May 31 12:50:35 doveadm(rak): Debug: Mailbox INBOX: UID 7103: Mail expunged May 31 12:50:35 doveadm(rak): Debug: Mailbox INBOX: Purging (new file_seq=1654009655): Too many deleted records (9/23) May 31 12:50:35 doveadm(rak): Debug: Mailbox INBOX: Purging finished, file_seq changed 1654009654 -> 1654009655, size=75108 -> 53936, max_uid=7105 May 31 12:50:35 doveadm(rak): Debug: User session is finished May 31 12:50:35 doveadm(74469): Debug: auth-master: conn unix:/var/dovecot/auth-userdb (pid=6157,uid=0): Disconnected: Connection closed (fd=9) $ doveadm -f table fetch -u rak 'guid uid' mailbox INBOX | sort 0b3bee1414118f6282db0000226807b0 7100 0b4b681c18168f6220940000226807b0 7104 0b83ac1d79cf2962eb3a0100226807b0 6153 0b97791e83108f6282db0000226807b0 7095 1614451513.M180742P77875.hades.rak.ac,S=3516,W=3600 22 1614451513.M180779P77875.hades.rak.ac,S=5252,W=5370 52 1614452870.M315137P88362.hades.rak.ac,S=5516,W=5623 68 1614452870.M315152P88362.hades.rak.ac,S=5977,W=6085 69 23a5a0179e108f6282db0000226807b0 7097 3359032360108f6282db0000226807b0 7093 3b3927352be48c62b65b0000226807b0 7072 4154be0c2fc77761c2550000226807b0 4050 638e073255235d62a5280100226807b0 6660 63b6422e14118f6282db0000226807b0 7102 8bc95639a6168f62ad4e0000226807b0 7105 ab802c1e37ac3d6214680100226807b0 6343 b3d12f21cd108f6282db0000226807b0 7098 bb89431b6e728d6230920000226807b0 7076 c386310f062adb61d1980000226807b0 5306 cb56992484478d62f3090100226807b0 7074 eb709020e70f8f62292e0000226807b0 7092 f19a8c06409a7d61271c0000226807b0 4128 f9cd03363c457c613a0e0000226807b0 4107 guid uid $ diff -u /tmp/guid-prededuplicate.txt /tmp/guid-postdeduplicate.txt --- /tmp/guid-prededuplicate.txt Tue May 31 12:50:24 2022 +++ /tmp/guid-postdeduplicate.txt Tue May 31 12:51:00 2022 @@ -7,27 +7,18 @@ 1614452870.M315137P88362.hades.rak.ac,S=5516,W=5623 68 1614452870.M315152P88362.hades.rak.ac,S=5977,W=6085 69 23a5a0179e108f6282db0000226807b0 7097 -33318e0686108f6282db0000226807b0 7096 -3351581c9c0e8f624cd50000226807b0 7091 3359032360108f6282db0000226807b0 7093 3b3927352be48c62b65b0000226807b0 7072 -3ba2252814118f62a2540100226807b0 7101 4154be0c2fc77761c2550000226807b0 4050 -5b3a7327d73b866299cd0000226807b0 7013 638e073255235d62a5280100226807b0 6660 63b6422e14118f6282db0000226807b0 7102 -8b9b942909118f6282db0000226807b0 7099 8bc95639a6168f62ad4e0000226807b0 7105 -a316ee28980d8f627c460000226807b0 7090 ab802c1e37ac3d6214680100226807b0 6343 b3d12f21cd108f6282db0000226807b0 7098 bb89431b6e728d6230920000226807b0 7076 c386310f062adb61d1980000226807b0 5306 cb56992484478d62f3090100226807b0 7074 -cb79bf3503128f6275220100226807b0 7103 -eb2818367d108f62484b0100a558518d 7094 eb709020e70f8f62292e0000226807b0 7092 f19a8c06409a7d61271c0000226807b0 4128 -f338ad1ff65e8562ff390100226807b0 7007 f9cd03363c457c613a0e0000226807b0 4107 guid uid $ doveconf -n # 2.3.19 (b3ad6004dc): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.19 (4eae2f79) # OS: OpenBSD 7.1 amd64 # Hostname: hades.rak.ac default_vsz_limit = 128 M doveadm_password = # hidden, use -P to show it first_valid_uid = 1000 mail_attribute_dict = file:%h/dovecot-attributes mail_location = maildir:~/mail:LAYOUT=fs:INDEX=~/indexes mail_plugins = " notify replication virtual" managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext imapsieve vnd.dovecot.imapsieve mbox_write_locks = fcntl mmap_disable = yes namespace inbox { inbox = yes location = mailbox Archive { auto = subscribe special_use = \Archive } mailbox Bin { auto = subscribe special_use = \Trash } mailbox Drafts { auto = subscribe special_use = \Drafts } mailbox Sent { auto = subscribe special_use = \Sent } mailbox Spam { auto = subscribe special_use = \Junk } prefix = separator = / } namespace virtual { location = virtual:/etc/dovecot/virtual:LAYOUT=fs:INDEX=~/virtual mailbox All { auto = subscribe comment = All my messages special_use = \All } mailbox Flagged { auto = subscribe special_use = \Flagged } prefix = Virtual/ separator = / } passdb { args = /etc/mail/auth driver = passwd-file } plugin { fts = flatcurve fts_autoindex = yes fts_autoindex_exclude = \Trash \Junk fts_enforced = yes fts_languages = en fts_tokenizers = generic email-address imapsieve_mailbox1_before = file:/usr/local/dovecot/sieve/report-spam.sieve imapsieve_mailbox1_causes = COPY,APPEND imapsieve_mailbox1_name = Spam imapsieve_mailbox2_before = file:/usr/local/dovecot/sieve/report-ham.sieve imapsieve_mailbox2_causes = COPY imapsieve_mailbox2_from = Spam imapsieve_mailbox2_name = * imapsieve_mailbox3_before = file:/usr/local/dovecot/sieve/report-ham.sieve imapsieve_mailbox3_causes = COPY,APPEND imapsieve_mailbox3_name = RAK imapsieve_url = sieve://localhost/ mail_replica = tcps:eos.rak.ac:12507 plugin = fts fts_flatcurve replication_dsync_parameters = -d -l 30 -U -n "" sieve = file:~/sieve;active=~/.dovecot.sieve sieve_before = /usr/local/dovecot/sieve-before.d/ sieve_global_extensions = +vnd.dovecot.pipe +vnd.dovecot.environment sieve_pipe_bin_dir = /usr/local/dovecot/sieve-pipe sieve_pipe_socket_dir = sieve-pipe sieve_plugins = sieve_imapsieve sieve_extprograms } protocols = imap lmtp sieve replication_dsync_parameters = -d -l 30 -U -n "" service aggregator { fifo_listener replication-notify-fifo { mode = 0666 user = _dovecot } unix_listener replication-notify { user = _dovecot } } service auth { unix_listener auth-userdb { user = vmail } } service doveadm { inet_listener { port = 12507 ssl = yes } vsz_limit = 512 M } service imap-login { inet_listener imap { port = 0 } inet_listener imaps { port = 993 ssl = yes } } service imap { vsz_limit = 512 M } service indexer-worker { vsz_limit = 512 M } service lmtp { drop_priv_before_exec = yes process_min_avail = 5 } service managesieve-login { inet_listener sieve { port = 4190 } inet_listener sieve_deprecated { port = 2000 } } service replicator { process_min_avail = 1 unix_listener replicator-doveadm { mode = 0666 } } service stats { unix_listener stats-reader { user = vmail } unix_listener stats-writer { user = vmail } } ssl_client_ca_file = /etc/ssl/cert.pem ssl_dh = # hidden, use -P to show it userdb { args = uid=vmail gid=vmail home=/home/vmail/%u /etc/mail/auth driver = static } userdb { args = /etc/mail/auth driver = passwd-file } protocol lmtp { mail_plugins = " notify replication virtual sieve" } protocol lda { mail_plugins = " notify replication virtual sieve" } protocol imap { imap_metadata = yes mail_plugins = " notify replication virtual imap_sieve" } -- |)|/ Ryan Kavanagh | 4E46 9519 ED67 7734 268F |\|\ https://rak.ac | BD95 8F7B F8FC 4A11 C97A

1 0

iPhone does not show 'read marks'.
by Heinz Bruederlin 31 May '22

31 May '22

The iPhone mail app does not show the read marks.The OS/X mail sets and shows the read marks correctly.Is there a way to fix or at least debug this behaviour ?

1 0

Disconnected: Auth process broken (disconnected before auth was ready ... ???
by Hippo Man 30 May '22

30 May '22

I've been running dovecot 2.2.36.4 (baf9232c1) on my Debian-8 host for a long time with no problems. I am trying to move my email server to a Debian-11 host, and I have Dovecot configured exactly the same way that I have it configured under Debian-8. However, when I try to connect to that server via imap, I always get the following error: 2022.05.30-18:17:21 imap-login: Info: Disconnected: Auth process broken (disconnected before auth was ready, waited 0 secs): user=<>, rip=::1, lip=::1, secured, session=<2+nKqj7g4t4AAAAAAAAAAAAAAAAAAAAB> The output of "dovecot -n" appears at the bottom of this message. I'm using mysql on the Debian-8 server for my authentication database, and I'm using mariadb on the Debian-11 server. The contents of the database on the new, Debian-11-based server are exactly the same as those on the Debian-8 server. These are the contents of /opt/local/etc/dovecot/dovecot-sql.ext with the comments removed. I can manually run the following queries against the database with a valid login ID, and these queries succeed ... driver = mysql connect = host=127.0.0.1 user=postfix password=XXXXXXXX dbname=postfix default_pass_scheme = CRYPT password_query = SELECT username AS user, domain, password FROM mailbox WHERE (username = '%u' OR find_in_set('%u', loginid) > 0) AND active = 1 user_query = SELECT concat('/var/vmail/', maildir) AS home, 1003 AS uid, 1003 AS gid FROM mailbox WHERE (username = '%u' OR find_in_set('%u', loginid) > 0) AND active = 1 Also ... % ls -Flas /var/run/dovecot/auth-userdb 0 srw-rw-rw- 1 dovecot root 0 May 30 18:30 /var/run/dovecot/auth-userdb= % ls -Flas /opt/local/etc/dovecot/dovecot-master-users-passwords 4 -rw-rw-r-- 1 root dovecot 36 Dec 16 2018 /opt/local/etc/dovecot/dovecot-master-users-passwords % ls -Flas /opt/local/etc/dovecot/ad-hoc-userdb 4 -rw-rw-r-- 1 root root 416 May 7 14:53 /opt/local/etc/dovecot/ad-hoc-userdb % ls -Flas /opt/local/etc/dovecot/dovecot-master-users-passwords 4 -rw-rw-r-- 1 root dovecot 36 Dec 16 2018 /opt/local/etc/dovecot/dovecot-master-users-passwords When I start up dovecot, the following line appears at the bottom of /var/log/mailclient.log ... 2022.05.30-18:31:37 master: Info: Dovecot v2.2.36.4 (baf9232c1) starting up for imap, pop3, lmtp, imap, pop3 (core dumps disabled) However, if I then run "telnet localhost 143", the following lines appear at the end of /var/log/mailclient.log ... 2022.05.30-18:32:44 master: Error: service(auth): command startup failed, throttling for 2 secs 2022.05.30-18:32:44 auth: Fatal: master: service(auth): child 235327 killed with signal 11 (core dumps disabled) 2022.05.30-18:32:44 imap-login: Info: Disconnected: Auth process broken (disconnected before auth was ready, waited 0 secs): user=<>, rip=::1, lip=::1, secured, session=<8ezN4T7gJOAAAAAAAAAAAAAAAAAAAAAB> The exact, same actions on my Debian-8 host do not fail. And here is the output from "dovecot -n". As you can see, all "verbose" and debug-related options are set to "yes". Thank you for any suggestions you might be able to offer: # 2.2.36.4 (baf9232c1): /opt/local/etc/dovecot/dovecot.conf # OS: Linux 5.10.0-14-amd64 x86_64 Debian 11.3 ext4 # Hostname: my.hostname.com auth_debug = yes auth_debug_passwords = yes auth_master_user_separator = : auth_mechanisms = plain login auth_socket_path = /var/run/dovecot/auth-userdb auth_verbose = yes auth_verbose_passwords = plain base_dir = /var/run/dovecot/ disable_plaintext_auth = no log_path = /var/log/mailclient.log log_timestamp = "%Y.%m.%d-%H:%M:%S " mail_debug = yes mail_location = maildir:/var/vmail/%d/%n/ namespace inbox { inbox = yes list = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = INBOX. separator = . } passdb { args = /opt/local/etc/dovecot/dovecot-master-users-passwords driver = passwd-file master = yes pass = yes } passdb { args = /opt/local/etc/dovecot/dovecot-sql.conf.ext driver = sql } passdb { args = scheme=plain username_format=%u /opt/local/etc/dovecot/ad-hoc-userdb driver = passwd-file } plugin { sieve = ~/.dovecot.sieve sieve_dir = ~/sieve } postmaster_address = postmaster(a)my.hostname.com protocols = imap pop3 lmtp imap pop3 service imap-login { inet_listener imap { port = 143 } inet_listener imaps { port = 993 ssl = yes } } service imap { executable = imap postlogin } service pop3 { executable = pop3 postlogin } service postlogin { executable = script-login -d rawlog } ssl_cert = </etc/letsencrypt/live/my.hostname.com/fullchain.pem ssl_cipher_list = HIGH:!SSLv2:!aNULL@STRENGTH ssl_client_ca_dir = /etc/ssl/certs ssl_client_ca_file = ca-certificates.crt ssl_key = # hidden, use -P to show it ssl_prefer_server_ciphers = yes userdb { args = /opt/local/etc/dovecot/dovecot-sql.conf.ext driver = sql } userdb { args = scheme=plain username_format=%u /opt/local/etc/dovecot/ad-hoc-userdb driver = passwd-file } protocol imap { mail_max_userip_connections = 128 } -- hippoman(a)gmail.com Take a hippopotamus to lunch today.

1 1

Force TCP socket disconnect on imap login failure?
by Lloyd Zusman 27 May '22

27 May '22

I'm running dovecot 2.2.13 under Debian 8. I'd like to force an immediate TCP socket disconnect after any imap login attempt that fails. Right now, if invalid credentials are supplied during an imap login, the client can keep retrying logins with different credentials. However, I want to prevent that from occurring by causing the socket connection to be closed as soon as there is any failed login attempt. I haven't been able to find any dovecot configuration setting which could control this behavior, but I'm hoping that I just missed something. Thank you very much for any suggestions. -- hippoman(a)gmail.com Take a hippopotamus to lunch today.

16 28

solr-jetty package in Debian 11 bullseye
by John Gateley 25 May '22

25 May '22

Hello, I am in the process of upgrading the OS on my mailserver, currently Debian 9, to Debian 11. The solr-jetty package does not appear to exist in Debian 11. Does anyone know where it is? Thanks John

2 1

Re: Duplicate messages if message is moved when using dsync
by Thom Pol 25 May '22

25 May '22

Hi, Thanks for your reply! The dsync is triggered on IMAP/POP3/LDA/LMTP activity. See my config dump from the first email. I'm wondering if my config is not OK so it causes dsync to sync twice? > you need / preferably use a database for your user auth I already do this. > run the command doveadm user '*' - it needs to return a list of users > that will trigger replication (after doing config above) This part works fine. Thanks, Thom Pol On 18/05/2022 16:51, Paul Kudla (SCOM.CA Internet Services Inc.) wrote: > ok - question > > when you say dsync are you running that manually or as a cronjob ?? > > or using replication via dsync > > there is a difference > > replication is designed to handle mailbox changes by quing the changes > on the fly and then update in the background. > > replication tracks all changes in a mailbox and then sends them one at a > time to the target server. > > i run replication with tcp (not tcps or dsync) > > I find (other then the 300+folder issues) that it runs pretty good in > real time. > > if you are running dsync manually then yes timing on its own will be a > hit and miss and it will never sync properly if something appears during > the dsync process. > > if you have the sive running as discussed that is the first step > > you should setup replication so things are handled in real time. > > pls advise if you have already done replication or just manually dsyncing. > > Below is basic replication setup but you need to make sure various > pre-requirements are in place a head of time. > > 1. you need / preferably use a database for your user auth > > you need to setup an iterate sql statement that returns the user > list of users to be replicated > > Example (i use pgsql) : > > # cat dovecot-pgsql.conf > driver = pgsql > connect = host=localhost port=5433 dbname=scom_billing user=pgsql password= > default_pass_scheme = PLAIN > > password_query = SELECT username as user, password FROM email_users > WHERE username = '%u' and password <> 'alias' and status = True and > destination = '%u' > > user_query = SELECT home, uid, gid FROM email_users WHERE username = > '%u' and password <> 'alias' and status = True and destination = '%u' > > iterate_query = SELECT "username" as user, domain FROM email_users WHERE > status = True and alias_flag = False > > #iterate_query above is what returns the user lists > > 2. run the command doveadm user '*' - it needs to return a list of users > that will trigger replication (after doing config above) > > 3. in general here is my relative parts for tcp replication > > In dovecot.conf > > --------------------------------------------------------------------------- > > mail_plugins = " virtual notify replication fts fts_lucene " > > replication_dsync_parameters = -d -N -l 300 -U > > dsync_remote_cmd = ssh -l%{login} %{host} doveadm dsync-server -u%u > > plugin { > > ..... > mail_replica = tcp:10.221.0.19:12345 > > #(note this is the ip address of the other server) > #it is the only config change ie server one above > #server2 would be the other server for communicating. > > > > ..... > > } > > protocol imap { > mail_max_userip_connections = 50 > mail_plugins = $mail_plugins notify replication > } > > protocol pop3 { > mail_max_userip_connections = 50 > mail_plugins = $mail_plugins notify replication > } > > protocol imaps { > mail_max_userip_connections = 25 > mail_plugins = $mail_plugins notify replication > } > > protocol pop3s { > mail_max_userip_connections = 25 > mail_plugins = $mail_plugins notify replication > } > > replication_max_conns = 100 (optional) > > replication_full_sync_interval = 1d > > service replicator { > client_limit = 0 > drop_priv_before_exec = no > idle_kill = 4294967295s > process_limit = 1 > process_min_avail = 0 > service_count = 0 > vsz_limit = 8g > unix_listener replicator-doveadm { > mode = 0600 > user = vmail > } > vsz_limit = 8192M > } > > service aggregator { > process_limit = 1000 > #vsz_limit = 1g > fifo_listener replication-notify-fifo { > user = vmail > group = vmail > mode = 0666 > } > > } > > > > ---------------------------------------------------------------------------- > > that should do it? > > > > > > > > > > > > > Happy Wednesday !!! > Thanks - paul > > Paul Kudla > > > Scom.ca Internet Services<http://www.scom.ca> > 004-1009 Byron Street South > Whitby, Ontario - Canada > L1N 4S3 > > Toronto 416.642.7266 > Main?1.866.411.7266 > Fax?1.888.892.7266

1 0

Panic: file userdb-blocking with Dovecot 2.3.19
by Niklas Meyer 25 May '22

25 May '22

Hello all, since we´ve tested around with the new dovecot release in the mailcow project we´ve came across a curious and new error with Dovecot: /auth: Panic: file userdb-blocking.c: line 124 (userdb_blocking_iter_next): assertion failed: (ctx->conn != NULL)/ *System Information:* *Dovecot Version: 2.3.19 (b3ad6004dc)** * *OS: Debian 11 (dovecot is running in a docker container)* *CPU: x86* *Filesystem: ext4* The error occurs only with the newest Dovecot release (2.3.19), the config hasn´t been changed. In the Attachment you can find all (hopefully) helpful informations. Maybe it is a simple fix. Kind regards and thanks for your help. -- The mailcow Team - Niklas --- The Infrastructure Company GmbH Parkstr. 42 47877 Willich Handelsregister: Amtsgericht Krefeld, HRB 15904 USt-IdNr.: DE308854956 Geschäftsführer: Martin Vogt /*Hinweis: *Der Inhalt dieser E-Mail ist vertraulich und nur für den in der Nachricht angegebenen Empfänger bestimmt. Es ist strengstens untersagt, irgendeinen Teil dieser Nachricht ohne schriftliche Zustimmung des Absenders an Dritte weiterzugeben. Wenn Sie diese Nachricht irrtümlich erhalten haben, antworten Sie bitte auf diese Nachricht und folgen Sie mit ihrer Löschung, so dass wir sicherstellen können, dass ein solcher Fehler in Zukunft nicht mehr vorkommt./

3 2

Message attachments, relocated with Tbird in Dovecot maildir store, not openable; reversible by moving BACK to inbox?
by PGNet Dev 25 May '22

25 May '22

I run dovecot --version 2.3.17.1 (476cd46418) on lsb_release -rd Description: Fedora release 35 (Thirty Five) Release: 35 mail store is maildir mail_location = maildir:/data/vmail/%d/%n/Maildir:CONTROL=/data/vmail/%d/%n/_control:INDEX=/var/vmail-index/%d/%n:LAYOUT=fs:UTF-8 front-end client is thunderbird --version Thunderbird 91.7.0 also on lsb_release -rd Description: Fedora release 35 (Thirty Five) Release: 35 mail is delivered to the store via lmtp transport from a Postfix agent mail, with attachments (e.g., .PDF) is received OK it's readable, attachments can be opened and/or saved to disk\ if, in TBird client, i move the message to any other folder in the IMAP hierarchy, the message relocates, as expected. the message itself is still readable, and _appears_ to have the attachment. but, attempting to OPEN the *attachment*, with e.g. Okular, from within the relocated message pops up a dialog, "Could not open file:///tmp/pid-28435/manual_13542AE.pdf" and saving it to Desktop, ls -al manual_13542AE.pdf -rw-r--r-- 1 pgnd pgnd 27 Apr 1 06:01 manual_13542AE.pdf file manual_13542AE.pdf manual_13542AE.pdf: data then opening it similarly returns "Could not open file:///home/pgnd/Desktop/manual_13542AE.pdf." Moving the message, via TBird, **BACK** to the Inbox, cures the problem -- -- I can immediately, again, open & save the attachments. This 'feels' like cache management misconfiguration to me. Not sure whether in Tbird &/or Dovecot, or what to look for specificially. Hints as to cause/fix of this attachment issue? Or event what/where, specifically, to log?

4 12

doveadm mailbox status -u paul@scom.ca -t all (syntax)
by Paul Kudla (SCOM.CA Internet Services Inc.) 24 May '22

24 May '22

Ok I know this is a general question and at my level I should be able to figure this out all i want is the complete status of an inbox ? # doveadm mailbox status -u paul(a)scom.ca -t all keeps returning .... doveadm mailbox status [-u <user>|-A] [-S <socket_path>] <fields> <mailbox> [...] ie no specific error. and no status answer just looking for default info ? -- Happy Monday !!! Thanks - paul Paul Kudla Scom.ca Internet Services <http://www.scom.ca> 004-1009 Byron Street South Whitby, Ontario - Canada L1N 4S3 Toronto 416.642.7266 Main 1.866.411.7266 Fax 1.888.892.7266 Email paul(a)scom.ca

3 5

enable/control fts-tika debug logging in Dovecot 2.3.18 + Tika Server 2.4.0?
by PGNet Dev 24 May '22

24 May '22

i run dovecot-2.3.18-1.fc36.x86_64 i've installed Apache Tika, v 2.4.0 ls -al tika-server-standard-2.4.0.jar -rw-r--r-- 1 root root 59M May 2 09:53 tika-server-standard-2.4.0.jar tika's listening telnet 127.0.0.1 9998 Trying 127.0.0.1... Connected to 127.0.0.1. Escape character is '^]'. telnet> and responds to a test curl \ -T /tmp/test.pdf \ http://127.0.0.1:9998/meta pdf:unmappedUnicodeCharsPerPage,0,0,0,0,0,0,0,0,0,0,0,0,0,0 pdf:PDFVersion,1.4 xmp:CreatorTool,Adobe InDesign 15.1 (Macintosh) pdf:hasXFA,false access_permission:modify_annotations,true access_permission:can_print_degraded,true X-TIKA:Parsed-By-Full-Set,org.apache.tika.parser.DefaultParser,org.apache.tika.parser.pdf.PDFParser dcterms:created,2020-08-13T14:55:46Z language,en dcterms:modified,2020-09-24T23:38:28Z dc:format,application/pdf; version=1.4 xmpMM:DocumentID,xmp.id:8a612346-9d03-4caf-8ebf-da6f3716ed0a pdf:docinfo:creator_tool,Adobe InDesign 15.1 (Macintosh) access_permission:fill_in_form,true pdf:docinfo:modified,2020-09-24T23:38:28Z pdf:hasCollection,false pdf:encrypted,false pdf:hasMarkedContent,true Content-Type,application/pdf dc:language,en-US pdf:producer,Adobe PDF Library 15.0 access_permission:extract_for_accessibility,true access_permission:assemble_document,true xmpTPg:NPages,14 pdf:hasXMP,true pdf:charsPerPage,84,676,1653,1914,814,1022,645,1221,1087,732,887,1295,1263,149 access_permission:extract_content,true xmpMM:DerivedFrom:DocumentID,xmp.did:b98726d4-04c4-48f5-88be-0a48a0074356 access_permission:can_print,true pdf:docinfo:trapped,false X-TIKA:Parsed-By,org.apache.tika.parser.DefaultParser,org.apache.tika.parser.pdf.PDFParser xmpMM:DerivedFrom:InstanceID,xmp.iid:3dd6a91f-a114-4d63-804e-e2b749c15075 pdf:annotationTypes,null access_permission:can_modify,true pdf:docinfo:producer,Adobe PDF Library 15.0 pdf:docinfo:created,2020-08-13T14:55:46Z pdf:annotationSubtypes,Link in dovecot config, i've added plugin { fts_tika = http://127.0.0.1:9998/tika/ } and log_debug = (category=fts-flatcurve OR category=fts-tika) on message receipt, I see verbose logs for fts-flatcurve, as expected, but not a trace of output from fts-tika, in dovecot logs how to correctly turn on debug/verbose logging for fts-tika use in/by dovecot?

2 2

Many Thanks to the Programmers
by Paul Kudla (SCOM.CA Internet Services Inc.) 23 May '22

23 May '22

I am still in testing mode with 2.3.19 but the replication with the folders over 300+ seems to be fixed everything synced ok on its own within 30 minutes Again MUSH APPRECIATED ! Moving to 2.3.19 was woth it! -- Happy Monday !!! Thanks - paul Paul Kudla Scom.ca Internet Services <http://www.scom.ca> 004-1009 Byron Street South Whitby, Ontario - Canada L1N 4S3 Toronto 416.642.7266 Main 1.866.411.7266 Fax 1.888.892.7266 Email paul(a)scom.ca

1 0

mail_replica in userdb?
by Coy Hile 23 May '22

23 May '22

I seem to have got replication working from an older instance to a newer one (insofar as the data are present on the new box) that I’m looking to stand up to replace a newer box. In this case, nothing is configured to talk to the new machine yet, so the replication is unidirectional (old -> new). However, I’m seeing an error like like this repeatedly in syslog: 2022-05-21T23:23:15.295252+00:00 basement-imap01 dovecot: doveadm(hile(a)coyhile.com): Error: sync: User has no mail_replica in userdb What setting did I miss? kdoveconf -n # 2.3.7.2 (3c910f64b): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.7.2 () # OS: Linux 5.4.0-110-generic x86_64 Ubuntu 20.04.4 LTS # Hostname: basement-imap01.coyhile.com doveadm_password = # hidden, use -P to show it mail_location = maildir:~/Maildir mail_privileged_group = mail namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } passdb { args = /etc/dovecot/dovecot-ldap.conf.ext driver = ldap } protocols = " imap lmtp" service aggregator { fifo_listener replication-notify-fifo { mode = 0666 user = vmail } unix_listener replication-notify { mode = 0666 user = vmail } } service doveadm { inet_listener { port = 12345 } user = vmail } service replicator { unix_listener replicator-doveadm { mode = 0666 } } ssl_cert = </etc/dovecot/private/dovecot.pem ssl_client_ca_dir = /etc/ssl/certs ssl_dh = # hidden, use -P to show it ssl_key = # hidden, use -P to show it userdb { args = /etc/dovecot/dovecot-ldap.conf.ext driver = ldap override_fields = uid=vmail gid=vmail home=/data/mail/vmail/%d/%n } Is that error something that I can (for the moment) ignore since I’m explicitly NOT trying to have this host replicate data anywhere, or do I need to tweak something? -- Coy Hile coy.hile(a)coyhile.com

3 7

SQL user_query quota_rule for *:messages=
by James 23 May '22

23 May '22

Hello, dovecot.conf sets the system default quota for storage and message count: plugin { ... quota_rule = *:storage=1G quota_rule2 = *:messages=10000 ... } This quota_rule for the storage is overridden by an SQL user_query in dovecot-sql.conf: user_query = "SELECT ... '*:storage=' || maxstorage || 'M' AS userdb_quota_rule, ...;" Is it possible to override the message count limit with an SQL user_query (and password_query)? I tried returning userdb_quota_rule2 in the SQL but it did not work. "SELECT ... '*:messages=' || maxcount AS userdb_quota_rule2 ...;" Ref: https://doc.dovecot.org/configuration_manual/authentication/user_database_e…

2 2

Dovecot 2.3.18 and OpenMetrics-Prometheus problem
by Christian Rößner 23 May '22

23 May '22

Hi, I have defined several metrics in Dovecot and activated the metrics service. After the I tried to include this in Prometheues, but I get strange errors. I gave up now after several hours in the hope that this might be a bug. So I ask for help here: Distribution: Rocky 8 Official Dovecot Repo Version: 2.3.18 Config for metrics, service and events: ----------------------------------------------------------------- metric auth_success { exporter = log filter = event=auth_request_finished AND success=yes } metric auth_failures { exporter = log filter = event=auth_request_finished AND NOT success=yes } metric auth_client_userdb { filter = event=auth_client_userdb_lookup_finished } metric auth_master { exporter = log filter = event=auth_master_client_login_finished } metric client_connected { filter = event=client_connection_connected } metric client_disconnected { filter = event=client_connection_disconnected group_by = reason } metric imap_command { filter = event=imap_command_finished group_by = cmd_name tagged_reply_state } metric lmtp_command { filter = event=smtp_server_command_finished AND protocol=lmtp group_by = cmd_name status_code duration:exponential:1:5:10 } metric imap_hibernate { filter = event=imap_client_hibernated group_by = error } metric imap_unhibernate { filter = event=imap_client_hibernated group_by = reason error } metric mail_delivery { filter = event=mail_delivery_finished group_by = duration:exponential:1:5:10 } metric sql_query { filter = event=sql_query_finished group_by = error_code } metric sieve_actions { filter = event=sieve_action_finished group_by = action_name error } metric managesieve { filter = event=managesieve_command_finished group_by = script_name } metric dict_lookups { filter = event=dict_lookup_finished group_by = driver error } service stats { inet_listener http { port = 9900 } } event_exporter log { format = json format_args = time-rfc3339 transport = log } ----------------------------------------------------------------- Shortened curl output: ----------------------------------------------------------------- # HELP process_start_time_seconds Timestamp of service start # TYPE process_start_time_seconds gauge process_start_time_seconds 1645743604 # HELP dovecot_build Dovecot build information # TYPE dovecot_build info dovecot_build_info{version="2.3.18",revision="9dd8408c18"} 1 # HELP dovecot_auth_success Total number of all events of this kind # TYPE dovecot_auth_success counter dovecot_auth_success_total 1669 # HELP dovecot_auth_success_duration_seconds Total duration of all events of this kind # TYPE dovecot_auth_success_duration_seconds counter dovecot_auth_success_duration_seconds_total 1.317570 # HELP dovecot_auth_failures Total number of all events of this kind # TYPE dovecot_auth_failures counter dovecot_auth_failures_total 1 # HELP dovecot_auth_failures_duration_seconds Total duration of all events of this kind # TYPE dovecot_auth_failures_duration_seconds counter ... # EOF ----------------------------------------------------------------- Prometheus yml config snippet: ----------------------------------------------------------------- global: scrape_interval: 15s evaluation_interval: 15s scrape_configs: - job_name: dovecot_exporter static_configs: - targets: - 172.30.10.1:9900 ----------------------------------------------------------------- Prometheus (Docker stable latest) with debug level show these lines: ----------------------------------------------------------------- prometheus_1 | ts=2022-02-25T10:22:00.840Z caller=scrape.go:1307 level=debug component="scrape manager" scrape_pool=dovecot_exporter target=http://172.30.10.1:9900/metrics msg="Append failed" err="expected label name or left brace, got \"INVALID\"" ----------------------------------------------------------------- Therefor the service is considered as being down. I really have no ide, what I can do here. Thanks for any help in advance Christian Rößner -- Rößner-Network-Solutions Zertifizierter ITSiBe / CISO Karl-Bröger-Str. 10, 36304 Alsfeld Fax: +49 6631 78823409, Mobil: +49 171 9905345 USt-IdNr.: DE225643613, https://roessner.website PGP fingerprint: 658D 1342 B762 F484 2DDF 1E88 38A5 4346 D727 94E5

4 9

Fix lmtp_save_to_detail_mailbox to be case insensitive?
by dovecot＠ptld.com 22 May '22

22 May '22

To bring this up again because i have not found a work around solution. Can dovecot make lmtp_save_to_detail_mailbox case-insensitive? If you create a folder "foobar" then an email with recipient user+foobar(a)example.com will be placed in the folder. However with the folder as "foobar" an email with recipient user+FOOBAR(a)example.com will report folder "FOOBAR" not found and the email will be placed in the inbox folder.

4 10

LDAP virtual user username being rewritten:
by Coy Hile 21 May '22

21 May '22

Hi all, I’m working on migrating a dovecot instance that formerly had its only user (me) stored in a SQL database to a new instance that uses LDAP so I don’t have to maintain a handful of different passwords. However, I’m ending up getting sent to an incorrect mailbox because the %d part of the username I enter is getting stripped somewhere along the lines. Dovecot debug logs show this happening here: May 21 18:36:53 auth: Debug: client in: AUTH 1 PLAIN service=imap secured session=itEO5InfPJusEgKD lip=172.18.2.131 rip=172.18.2.131 lport=143 rport=39740 resp=<hidden> May 21 18:36:53 auth: Debug: ldap(hile(a)coyhile.com,172.18.2.131,<itEO5InfPJusEgKD>): Performing passdb lookup May 21 18:36:53 auth: Debug: ldap(hile(a)coyhile.com,172.18.2.131,<itEO5InfPJusEgKD>): pass search: base=ou=People,dc=coyhile,dc=com scope=subtree filter=(&(objectClass=posixAccount)(uid=hile)) fields=uid,userPassword May 21 18:36:53 auth: Debug: ldap(hile(a)coyhile.com,172.18.2.131,<itEO5InfPJusEgKD>): result: uid=hile userPassword=<hidden>; uid,userPassword unused May 21 18:36:53 auth: Debug: ldap(hile(a)coyhile.com,172.18.2.131,<itEO5InfPJusEgKD>): username changed hile(a)coyhile.com -> hile May 21 18:36:53 auth: Debug: ldap(hile,172.18.2.131,<itEO5InfPJusEgKD>): Finished passdb lookup May 21 18:36:53 auth: Debug: auth(hile,172.18.2.131,<itEO5InfPJusEgKD>): Auth request finished May 21 18:36:53 auth: Debug: client passdb out: OK 1 user=hile original_user=hile(a)coyhile.com May 21 18:36:53 auth: Debug: master in: REQUEST 473956353 9409 1 2c1f94ded4de2c343425c90eeee8d094 session_pid=9412 request_auth_token May 21 18:36:53 auth: Debug: ldap(hile,172.18.2.131,<itEO5InfPJusEgKD>): Performing userdb lookup May 21 18:36:53 auth: Debug: ldap(hile,172.18.2.131,<itEO5InfPJusEgKD>): user search: base=ou=People,dc=coyhile,dc=com scope=subtree filter=(&(objectClass=posixAccount)(uid=hile)) fields=homeDirectory,uidNumber,gidNumber May 21 18:36:53 auth: Debug: ldap(hile,172.18.2.131,<itEO5InfPJusEgKD>): result: homeDirectory=/home/hile uidNumber=10000 gidNumber=10000; homeDirectory,uidNumber,gidNumber unused May 21 18:36:53 auth: Debug: ldap(hile,172.18.2.131,<itEO5InfPJusEgKD>): Finished userdb lookup May 21 18:36:53 auth: Debug: master userdb out: USER 473956353 hile home=/data/mail/vmail//hile uid=998 gid=998 auth_token=3a262da408d33ce2c51ecb1ddd943203fdbb17a3 auth_user=hile(a)coyhile.com Note the “username changed” line above. Clearly I’ve misconfigured something, butI am unsure what. My configuration is as follows: root@basement-imap01:/var/log# doveconf -n # 2.3.7.2 (3c910f64b): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.7.2 () # OS: Linux 5.4.0-110-generic x86_64 Ubuntu 20.04.4 LTS # Hostname: basement-imap01.coyhile.com auth_debug = yes debug_log_path = /var/log/dovecot-debug.log doveadm_password = # hidden, use -P to show it mail_location = maildir:~/Maildir mail_privileged_group = mail namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } passdb { args = /etc/dovecot/dovecot-ldap.conf.ext driver = ldap } protocols = " imap lmtp" service aggregator { fifo_listener replication-notify-fifo { mode = 0666 user = vmail } unix_listener replication-notify { mode = 0666 user = vmail } } service doveadm { inet_listener { port = 12345 } user = vmail } service replicator { unix_listener replicator-doveadm { mode = 0666 } } ssl_cert = </etc/dovecot/private/dovecot.pem ssl_client_ca_dir = /etc/ssl/certs ssl_dh = # hidden, use -P to show it ssl_key = # hidden, use -P to show it userdb { args = /etc/dovecot/dovecot-ldap.conf.ext driver = ldap override_fields = uid=vmail gid=vmail home=/data/mail/vmail/%d/%n } root@basement-imap01:/var/log# with the dovecot-ldap.conf.ext as follows: root@basement-imap01:/etc/dovecot# cat dovecot-ldap.conf.ext # This file is commonly accessed via passdb {} or userdb {} section in # conf.d/auth-ldap.conf.ext # This file is opened as root, so it should be owned by root and mode 0600. # # http://wiki2.dovecot.org/AuthDatabase/LDAP # # NOTE: If you're not using authentication binds, you'll need to give # dovecot-auth read access to userPassword field in the LDAP server. # With OpenLDAP this is done by modifying /etc/ldap/slapd.conf. There should # already be something like this: # access to attribute=userPassword # by dn="<dovecot's dn>" read # add this # by anonymous auth # by self write # by * none # Space separated list of LDAP hosts to use. host:port is allowed too. #hosts = hosts = ldap.coyhile.com # LDAP URIs to use. You can use this instead of hosts list. Note that this # setting isn't supported by all LDAP libraries. #uris = # Distinguished Name - the username used to login to the LDAP server. # Leave it commented out to bind anonymously (useful with auth_bind=yes). #dn = dn = uid=dovecotquery,ou=people,dc=coyhile,dc=com # Password for LDAP server, if dn is specified. #dnpass = dnpass = [REDACTED] # Use SASL binding instead of the simple binding. Note that this changes # ldap_version automatically to be 3 if it's lower. #sasl_bind = no # SASL mechanism name to use. #sasl_mech = # SASL realm to use. #sasl_realm = # SASL authorization ID, ie. the dnpass is for this "master user", but the # dn is still the logged in user. Normally you want to keep this empty. #sasl_authz_id = # Use TLS to connect to the LDAP server. #tls = no # TLS options, currently supported only with OpenLDAP: #tls_ca_cert_file = #tls_ca_cert_dir = #tls_cipher_suite = # TLS cert/key is used only if LDAP server requires a client certificate. #tls_cert_file = #tls_key_file = # Valid values: never, hard, demand, allow, try #tls_require_cert = # Use the given ldaprc path. #ldaprc_path = # LDAP library debug level as specified by LDAP_DEBUG_* in ldap_log.h. # -1 = everything. You may need to recompile OpenLDAP with debugging enabled # to get enough output. #debug_level = 0 # Use authentication binding for verifying password's validity. This works by # logging into LDAP server using the username and password given by client. # The pass_filter is used to find the DN for the user. Note that the pass_attrs # is still used, only the password field is ignored in it. Before doing any # search, the binding is switched back to the default DN. #auth_bind = no # If authentication binding is used, you can save one LDAP request per login # if users' DN can be specified with a common template. The template can use # the standard %variables (see user_filter). Note that you can't # use any pass_attrs if you use this setting. # # If you use this setting, it's a good idea to use a different # dovecot-ldap.conf.ext for userdb (it can even be a symlink, just as long as # the filename is different in userdb's args). That way one connection is used # only for LDAP binds and another connection is used for user lookups. # Otherwise the binding is changed to the default DN before each user lookup. # # For example: # auth_bind_userdn = cn=%u,ou=people,o=org # #auth_bind_userdn = # LDAP protocol version to use. Likely 2 or 3. #ldap_version = 3 # LDAP base. %variables can be used here. # For example: dc=mail, dc=example, dc=org base = ou=People,dc=coyhile,dc=com # Dereference: never, searching, finding, always #deref = never # Search scope: base, onelevel, subtree #scope = subtree scope = subtree # User attributes are given in LDAP-name=dovecot-internal-name list. The # internal names are: # uid - System UID # gid - System GID # home - Home directory # mail - Mail location # # There are also other special fields which can be returned, see # http://wiki2.dovecot.org/UserDatabase/ExtraFields #user_attrs = homeDirectory=home,uidNumber=uid,gidNumber=gid # Filter for user lookup. Some variables can be used (see # http://wiki2.dovecot.org/Variables for full list): # %u - username # %n - user part in user@domain, same as %u if there's no domain # %d - domain part in user@domain, empty if user there's no domain #user_filter = (&(objectClass=posixAccount)(uid=%u)) user_filter = (&(objectClass=posixAccount)(uid=%u)) # Password checking attributes: # user: Virtual user name (user@domain), if you wish to change the # user-given username to something else # password: Password, may optionally start with {type}, eg. {crypt} # There are also other special fields which can be returned, see # http://wiki2.dovecot.org/PasswordDatabase/ExtraFields #pass_attrs = uid=user,userPassword=password # If you wish to avoid two LDAP lookups (passdb + userdb), you can use # userdb prefetch instead of userdb ldap in dovecot.conf. In that case you'll # also have to include user_attrs in pass_attrs field prefixed with "userdb_" # string. For example: #pass_attrs = uid=user,userPassword=password,\ # homeDirectory=userdb_home,uidNumber=userdb_uid,gidNumber=userdb_gid # Filter for password lookups #pass_filter = (&(objectClass=posixAccount)(uid=%u)) pass_filter = (&(objectClass=posixAccount)(uid=%n)) # Attributes and filter to get a list of all users #iterate_attrs = uid=user iterate_attrs = maildrop=user iterate_filter = (objectClass=posixAccount) # Default password scheme. "{scheme}" before password overrides this. # List of supported schemes is in: http://wiki2.dovecot.org/Authentication #default_pass_scheme = CRYPT # By default all LDAP lookups are performed by the auth master process. # If blocking=yes, auth worker processes are used to perform the lookups. # Each auth worker process creates its own LDAP connection so this can # increase parallelism. With blocking=no the auth master process can # keep 8 requests pipelined for the LDAP connection, while with blocking=yes # each connection has a maximum of 1 request running. For small systems the # blocking=no is sufficient and uses less resources. #blocking = no root@basement-imap01:/etc/dovecot# -- Coy Hile coy.hile(a)coyhile.com

1 1

Possible to increase connection limit for one user only?
by Kurt Fitzner 20 May '22

20 May '22

I run a medium-sized virtual domain email server for about 15 domains. I also use it myself and have 3 or 4 devices using imap. I am often using a VPN to connect to my home network, which makes all my connections appear to come from one IP. I want to increase mail_max_userip_connections just for myself only so I'm not opening up my server to abuse. Is this possible?

3 3

doveadm search error
by Christoph Fürstaller 20 May '22

20 May '22

Hello, I've upgraded dovecote to 2.3.19 (b3ad6004dc) a week ago. Since then I get an error when searching for messages from all users in a particular folder: doveadm search -A mailbox 'INBOX.learn' Error: auth-master: userdb list: Disconnected unexpectedly doveadm: Error: Failed to iterate through some users This is in the logs: dovecot: auth: Panic: file userdb-blocking.c: line 124 (userdb_blocking_iter_next): assertion failed: (ctx->conn != NULL) dovecot: auth: Error: Raw backtrace: /usr/lib/dovecot/libdovecot.so.0(backtrace_append+0x41) [0x7f1c12675c91] -> /usr/lib/dovecot/libdovecot.so.0(backtrace_get+0x22) [0x7f1c12675db2] -> /usr/lib/dovecot/libdovecot.so.0(+0x10b0bb) [0x7f1c126830bb] -> /usr/lib/dovecot/libdovecot.so.0(+0x10b157) [0x7f1c12683157] -> /usr/lib/dovecot/libdovecot.so.0(+0x5d375) [0x7f1c125d5375] -> dovecot/auth [0 wait, 0 passdb, 0 userdb](+0x157a7) [0x55e0278287a7] -> dovecot/auth [0 wait, 0 passdb, 0 userdb](+0x1954b) [0x55e02782c54b] -> dovecot/auth [0 wait, 0 passdb, 0 userdb](+0x36ca7) [0x55e027849ca7] -> dovecot/auth [0 wait, 0 passdb, 0 userdb](+0x2ab86) [0x55e02783db86] -> /usr/lib/dovecot/libdovecot.so.0(io_loop_handle_timeouts+0x15f) [0x7f1c1269976f] -> /usr/lib/dovecot/libdovecot.so.0(io_loop_handler_run_internal+0xcf) [0x7f1c1269b02f] -> /usr/lib/dovecot/libdovecot.so.0(io_loop_handler_run+0x54) [0x7f1c12699a54] -> /usr/lib/dovecot/libdovecot.so.0(io_loop_run+0x40) [0x7f1c12699bc0] -> /usr/lib/dovecot/libdovecot.so.0(master_service_run+0x17) [0x7f1c1260b207] -> dovecot/auth [0 wait, 0 passdb, 0 userdb](main+0x3c8) [0x55e027829588] -> /lib/x86_64-linux-gnu/libc.so.6(+0x29fd0) [0x7f1c122cbfd0] -> /lib/x86_64-linux-gnu/libc.so.6(__libc_start_main+0x7d) [0x7f1c122cc07d] -> dovecot/auth [0 wait, 0 passdb, 0 userdb](_start+0x2e) [0x55e02782976e] dovecot: auth: Fatal: master: service(auth): child 19452 killed with signal 6 (core dumped) I've system users from passwd and users from a passwd-file: userdb { driver = passwd } userdb { args = username_format=%u /etc/dovecot/users driver = passwd-file } If I disable the passwd-file, a search works fine, but not with both user backends. This worked fine with version 2.3.18. Someone discovered this behavior too? This is my config: # 2.3.19 (b3ad6004dc): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.19 (4eae2f79) # OS: Linux 5.13.0-41-generic x86_64 Ubuntu 21.10 auth_mechanisms = plain login auth_username_format = %n default_vsz_limit = 2 G mail_location = maildir:~/Maildir mail_privileged_group = mail managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = INBOX. separator = . } passdb { driver = pam } passdb { args = scheme=ARGON2I username_format=%u /etc/dovecot/users driver = passwd-file } plugin { sieve = file:~/sieve;active=~/.dovecot.sieve sieve_before = /var/mail/moveSpam.sieve } protocols = imap lmtp sieve service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0660 user = postfix } } service imap-login { inet_listener imap { port = 0 } } service lmtp { unix_listener /var/spool/postfix/private/dovecot-lmtp { group = postfix mode = 0600 user = postfix } } service managesieve-login { inet_listener sieve { port = 4190 } } ssl = required ssl_cert = </etc/letsencrypt/live/mailserver/fullchain.pem ssl_client_ca_dir = /etc/ssl/certs ssl_dh = # hidden, use -P to show it ssl_key = # hidden, use -P to show it ssl_prefer_server_ciphers = yes userdb { driver = passwd } userdb { args = username_format=%u /etc/dovecot/users driver = passwd-file } verbose_proctitle = yes protocol lmtp { mail_plugins = " sieve" } protocol lda { mail_plugins = " sieve" } protocol imap { mail_max_userip_connections = 30 } Best regards, Christoph

2 1

%{listener} not working
by cesco 19 May '22

19 May '22

Hi I'm trying to use the variable %{listener} in the following password mysql query: password_query = SELECT accounts.mcf AS password FROM accounts, domains WHERE user = '%n' AND accounts.domain = '%d' AND accounts.domain = domains.domain AND domains.host = '%{hostname}' AND accounts.service IN ('master', '%{listener}') but it doesn't expand, giving: Failed to expand password_query=SELECT accounts.mcf AS password FROM accounts, domains WHERE user = '%n' AND accounts.domain = '%d' AND accounts.domain = domains.domain AND domains.host = '%{hostname}' AND accounts.service IN ('master', '%{listener} ') : Unknown variable '%listener' %{hostname} works correctly, as well as other variables I tried. many thanks Franz ------------------- below my doveconf -n: # 2.3.19 (b3ad6004dc): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.19 (4eae2f79) # OS: Linux 5.10.0-13-amd64 x86_64 Debian 11.3 # Hostname: example.org auth_debug = yes auth_mechanisms = plain login auth_verbose = yes disable_plaintext_auth = no doveadm_password = # hidden, use -P to show it doveadm_port = 12345 hostname = example.org login_log_format_elements = method=%m lip=%l %c %k mail_fsync = never mail_location = maildir:/var/vmail/%d/%n@%d/:INDEX=/var/vmail_indexes/%d/%n@%d/ mail_max_userip_connections = 200 mail_plugins = " notify replication fts fts_lucene" maildir_stat_dirs = yes maildir_very_dirty_syncs = yes managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext namespace inbox { inbox = yes location = mailbox Drafts { auto = subscribe special_use = \Drafts } mailbox Sent { auto = subscribe special_use = \Sent } mailbox Spam { auto = subscribe special_use = \Junk } mailbox Trash { auto = subscribe special_use = \Trash } prefix = } passdb { args = /etc/dovecot/sql.conf.ext driver = sql } plugin { fts = lucene fts_autoindex = yes fts_autoindex_max_recent_msgs = 80 fts_index_timeout = 90 fts_lucene = whitespace_chars=@. last_login_dict = proxy::lastlogin last_login_key = # hidden, use -P to show it sieve_extensions = +vnd.dovecot.filter sieve_global_extensions = +vnd.dovecot.filter sieve_plugins = sieve_extprograms } protocols = imap pop3 lmtp sieve submission service aggregator { fifo_listener replication-notify-fifo { user = dovemail } unix_listener replication-notify { user = dovemail } } service dict { unix_listener dict { group = dovemail mode = 0660 user = root } } service doveadm { inet_listener { port = 12345 } } service imap-login { service_count = 1 } service imap { executable = imap } service lmtp { inet_listener lmtp { port = 24 } process_min_avail = 5 } service managesieve-login { inet_listener sieve { port = 4190 } } service pop3-login { service_count = 1 } service pop3 { executable = pop3 } service replicator { process_min_avail = 1 unix_listener replicator-doveadm { group = dovemail mode = 0600 user = dovemail } } service submission-login { inet_listener submissions { port = 465 ssl = yes } } ssl_cipher_list = ALL:!LOW:!SSLv2:!EXP:!aNULL:!RC4::!eNULL:!LOW:!3DES:!MD5:!EXP:!PSK:!SRP:!DSS ssl_dh = # hidden, use -P to show it ssl_key = # hidden, use -P to show it ssl_prefer_server_ciphers = yes submission_max_mail_size = 100000000 B submission_max_recipients = 100 submission_relay_host = 127.0.0.1 submission_relay_port = 10025 userdb { args = uid=1000 gid=1000 home=/var/vmail/%d/%n@%d/ plain_pass=#hidden_use-P_to_show# user_part=%n domain_part=%d driver = static } userdb { driver = prefetch } userdb { args = /etc/dovecot/sql.conf.ext driver = sql } valid_chroot_dirs = /var/vmail:/var/vmail_indexes protocol imap { mail_plugins = " notify replication fts fts_lucene imap_zlib last_login" } protocol pop3 { mail_plugins = " notify replication fts fts_lucene last_login" } protocol lmtp { mail_fsync = optimized mail_plugins = " notify replication fts fts_lucene sieve" }

2 3

[Rocky Linux 8.6] expire plugin file disappeared
by Masakazu Hirose 19 May '22

19 May '22

Hi, Rocky Linux Dovecot no longer reads the expired plugin from the library directory. I use Rocky Linux packages. Rocky or Redhat may fail to package. "/usr/lib64/dovecot/lib20_expire_plugin.so" seems to have disappeared in the new package. This may not be relevant to the Dovecot project. # /var/log/messages May 18 08:21:22 xxxxxxx dovecot[3508407]: imap(yyyyyyy): Error: Plugin 'expire' not found from directory /usr/lib64/dovecot # cat /etc/redhat-release Rocky Linux release 8.6 (Green Obsidian) # rpm -qa | grep dovecot dovecot-2.3.16-2.el8.x86_64 dovecot-mysql-2.3.16-2.el8.x86_64 Thank you, Masakazu

2 2

Re: Duplicate messages if message is moved when using dsync
by Thom Pol 18 May '22

18 May '22

Never mind. It did not work, issue still exists. I guess my network was a little slower when I thought it worked, so the emails were moved by my local client only after the sync had already happened between the servers. So, back to the original message. Anyone any idea how this moving on local client while the remote servers are still running the dsync can work correctly without getting a duplicate? Kind regards, Thom Pol On 18/05/2022 16:24, Paul Kudla (SCOM.CA Internet Services Inc.) wrote: > Your Welcome > > > > Happy Wednesday !!! > Thanks - paul > > Paul Kudla > > > Scom.ca Internet Services<http://www.scom.ca> > 004-1009 Byron Street South > Whitby, Ontario - Canada > L1N 4S3 > > Toronto 416.642.7266 > Main?1.866.411.7266 > Fax?1.888.892.7266

2 1

FTS Solr -- no commit on message delete
by Shawn Heisey 18 May '22

18 May '22

I've been chasing down oddities in behavior related to FTS Solr for a while now. First the part that isn't a problem with dovecot: In cases where message deletes bypass the Trash folder (such as shift-delete and normal workflow with the Drafts and Sent folders), Thunderbird does not inform Dovecot about the change in a way that causes Dovecot to delete the entries from Solr. When you completely exit Thunderbird, it then sends something to dovecot that results in the messages being deleted from Solr. Today I discovered a related problem that I think IS in Dovecot. I did a shift-delete on some messages, and then exited Thunderbird. Dovecot did delete the messages from Solr, but it did not send a commit to make those changes affect subsequent searches. Is this something worth opening a bug? Where would I do that? Thanks, Shawn

1 1

Upgrading from 2.3.18 --> 2.3.19
by Paul Kudla (SCOM.CA Internet Services Inc.) 18 May '22

18 May '22

Ok currently running 2.3.18 Would like to upgrade to 2.3.19 (to keep current) Since these are production servers can i down grade back to 2.3.18 if nessesary? Issues at hand is there seems to be conflicting messages about the replication being fixed or not ? so would like to basically try 2.3.19 to see if it fixes some of my issues (large folder counts etc failing to replicate properly) If it does or stays the same then i am ok with that for now. if 2.3.19 causes issues can i go back to 2.3.18 as i already have scripts etc sorting out the sync issues? pls advise -- Happy Wednesday !!! Thanks - paul Paul Kudla Scom.ca Internet Services <http://www.scom.ca> 004-1009 Byron Street South Whitby, Ontario - Canada L1N 4S3 Toronto 416.642.7266 Main 1.866.411.7266 Fax 1.888.892.7266

1 0

Re: Can sync/migrate all mail from remote imap account except the main "INBOX"
by Darren Mobley 18 May '22

18 May '22

Your example pointed me to a solution, excellent ! In my case I only needed one pass, I had to supply both imapc_list_prefix AND imapc_prefix AND the "namespace/inbox/prefix=" options. In case anyone runs into this in the future, here's a decent place to start for debugging: /usr/bin/doveadm -Dv -o imapc_list_prefix=INBOX -o imapc_prefix=INBOX. -o "namespace/inbox/prefix=" -o mail_fsync=never -o dsync_commit_msgs_interval=100 -o imapc_features=rfc822.size,fetch-headers -o dsync_features=empty-header-workaround -o imapc_port=143 -o imapc_host=127.0.0.1 -o imapc_password=yayforpasswords -o imapc_user=mailto:wah@hellodemo.ppl -o imapc_rawlog_dir=/tmp/raww -o mail_prefetch_count=20 sync -1Ru mailto:saywhatnow@letest.tld imapc: Thanks again for digging through the old emails where the magic incantations were, I really appreciate it! Darren ---- On Wed, 18 May 2022 05:19:53 -0500 Sami Ketola <sami(a)ketola.io> wrote ---- So adding "-o imapc_list_prefix=INBOX" to the doveadm command line should fix that, I would think ? So is the remote INBOX really 'INBOX' or 'INBOX.INBOX'? Command line arguments depend on which one it is. I managed to find some old archived emails with some tips on how it was solved back then. It was done with something like this: normal doveadm command: 'LOG_STDERR_TIMESTAMP="%b %d %H:%M:%S.%{usecs} " ' + '/usr/bin/doveadm' + dsync_debug + \ " -o mail_prefetch_count=10 " + \ " -o imapc_features=fetch-headers " + \ " -o imapc_host=" + legacy_host + \ " -o imapc_port=" + legacy_port + \ " -o imapc_list_prefix=" + imapc_prefix + \ " -o imapc_prefix=" + imapc_prefix + \ " -o imapc_user=" + self.legacy_user + \ " -o imapc_master_user=" + self.legacy_user + \ " -o imapc_password=" + imapc_master_password + \ " -o mail_fsync=never " + \ " backup -u " + self.uid + \ " -R imapc: >> " + dsync_err_log_location + self.uid + ".dsync_err.log 2>&1" If I remember correctly imapc_prefix was 'INBOX/' since this customer had INBOX/INBOX setup with / as separator. and if user had INBOX/INBOX detected this command was run on top of that to migrate INBOX: 'LOG_STDERR_TIMESTAMP="%b %d %H:%M:%S.%{usecs} " ' + '/usr/bin/doveadm' + dsync_debug + \ " -o namespace/inbox/prefix= " + \ " -o mail_prefetch_count=10 " + \ " -o imapc_features=fetch-headers " + \ " -o imapc_host=" + legacy_host + \ " -o imapc_port=" + legacy_port + \ " -o imapc_user=" + self.legacy_user + \ " -o imapc_master_user=" + self.legacy_user + \ " -o imapc_password=" + imapc_master_password + \ " -o mail_fsync=never " + \ " backup -u " + self.uid + \ " -m INBOX/INBOX " + \ " -R imapc: >> " + dsync_err_log_location + self.uid + ".dsync_err.log 2>&1" HTH, Sami

1 0

Re: dovecot Digest, Vol 229, Issue 23
by Thom Pol 18 May '22

18 May '22

I must say I was a bit sceptical if this sieve script would resolve it, but it seems like it totally did! Thanks a lot for your reply, hope this helps someone else in the future as well. Kind regards, Thom Pol On 16/05/2022 08:12, Paul Kudla (SCOM.CA Internet Services Inc.) wrote: > ok duplicsate emails (even across dsync, replication etc) is typically > handled via a global sieve script > > > I use : > > # cat duplicates.sieve > require "duplicate"; # for dovecot >= 2.2.18 > > if duplicate { > discard; > stop; > } > > for the scripts > > and setup sieve to work via my dovecot.conf file > > relative parts below : > > -------------------------------------------------------------------- > > protocols = imap pop3 lmtp sieve > > protocol lmtp { > mail_plugins = $mail_plugins sieve > postmaster_address =monitor(a)scom.ca > } > > > protocol lda { > mail_plugins = $mail_plugins sieve > } > > > plugin { > ..... > > sieve =file:~/sieve;active=~/sieve/.dovecot.sieve > > sieve_duplicate_default_period = 1h > sieve_duplicate_max_period = 1d > sieve_extensions = +duplicate +notify +imapflags +vacation-seconds > sieve_global_dir = /usr/local/etc/dovecot/sieve > sieve_before = /usr/local/etc/dovecot/sieve/duplicates.sieve > > ..... > } > > service managesieve-login { > process_limit = 1000 > vsz_limit = 1g > inet_listener sieve { > port = 4190 > } > } > > protocol sieve { > managesieve_implementation_string = Dovecot Pigeonhole > managesieve_max_line_length = 65536 > } > > > > ------------------------------------------------------------------ > > > note the sieve_before which handles duplictes during delivery etc. > > > Happy Monday !!! > Thanks - paul > > Paul Kudla > > > Scom.ca Internet Services<http://www.scom.ca> > 004-1009 Byron Street South > Whitby, Ontario - Canada > L1N 4S3 > > Toronto 416.642.7266 > Main?1.866.411.7266 > Fax?1.888.892.7266

2 1

dovecot virtual users with sendmail, my solution
by Christopher McCrory 18 May '22

18 May '22

Hello... I wanted to use dovecot virtual users with sendmail. As you probably know, this doesn't work by default. The more scalable solution is probably to use LDAP, but I really don't like it. This is how I did it https://github.com/chrismcc-gmail/dovecot-virtual-sendmail Basically I abused glibc's db feature in /etc/nsswitch in /var/db/Makefile something like this: $(VAR_DB)/passwd.db: /etc/dovecot/usersfile @printf %s "$(patsubst %.db,%,$(@F))... " @$(AWK) 'BEGIN { FS=":"; OFS=":" } \ /^[ \t]*$$/ { next } \ /^[ \t]*#/ { next } \ /^root/ { next } \ /^[^#]/ { printf ".%s ", $$1; \ printf "%s:x:65534:65534:%s:/home/vmail/%s:/sbin/nologin\n", $$1, $$1, $$1; \ }' $^ | \ $(MAKEDB) -o $@ - @echo "done." make -C /var/db getent passwd ; shows ... virtualuser:x:65534:65534:virtualuser:/home/vmail/virtualuser:/sbin/nologin othervuser:x:65534:65534:othervuser:/home/vmail/othervuser:/sbin/nologin A longer explanation and more info is in the github repository It takes about 10 minutes to go from new clean server to working email server with this I've been running this in production for about a week now without any problems. Question: Has anyone else done this? I don't see any downsides, but I might be missing something. -- Christopher McCrory To the optimist, the glass is half full. To the pessimist, the glass is half empty. To the engineer, the glass is twice as big as it needs to be.

2 1

Preventing deletion of mails in some directories?
by Philip Rhoades 18 May '22

18 May '22

People, I can't get the system "chattr" to do what I want so I am wondering if there is some way to prevent deletion of mails in the INBOX and the Sent folders? Renaming and moving files needs to be possible for Maildir functions and also for me - so I only need deletion prevention . . Is this possible from Dovecot? Thanks, Phil. -- Philip Rhoades PO Box 896 Cowra NSW 2794 Australia E-mail: phil(a)pricom.com.au

3 2

Can sync/migrate all mail from remote imap account except the main "INBOX"
by Darren Mobley 18 May '22

18 May '22

Greetings! I've been trying to sync my email to a server, however it only syncs the mail in folders other than INBOX. For testing purposes, I've created a fake domain, "letest.tld" and a new empty user account "mailto:saywhatnow@letest.tld" to receive the copy of the mail being migrated. What I've been trying are iterations of: /usr/bin/doveadm -D -o mail_fsync=never -o dsync_features=empty-header-workaround -o imapc_ssl=imaps -o imapc_features=rfc822.size,fetch-headers -o dsync_commit_msgs_interval=100 -o imapc_port=993 -o imapc_host=imap.zoho.com -o imapc_password=NoNoTRe4LLyMyP4$$ -o imapc_user=mailto:decker@n3t.net -o mail_prefetch_count=20 sync -1Ru mailto:saywhatnow@letest.tld imapc: Regardless of running sync -1 or backup (I want to keep original mailbox as-is for now) I get errors related to INBOX. With sync -1 ; May 10 16:53:29 dsync(mailto:saywhatnow@letest.tld): Debug: brain S: Ignore nonexistent mailbox GUID c92f64f79f0d1ed01e6d5b314f04886c with -1 sync May 10 16:53:29 dsync(mailto:saywhatnow@letest.tld): Debug: brain S: We don't have mailbox c92f64f79f0d1ed01e6d5b314f04886c May 10 16:53:29 dsync(mailto:saywhatnow@letest.tld): Debug: brain M: Ignoring missing remote box GUID c92f64f79f0d1ed01e6d5b314f04886c May 10 16:53:29 dsync(mailto:saywhatnow@letest.tld): Debug: Mailbox INBOX.Archive: Mailbox opened May 10 16:53:29 dsync(mailto:saywhatnow@letest.tld): Debug: Mailbox INBOX.Archive: Mailbox opened May 10 16:53:29 dsync(mailto:saywhatnow@letest.tld): Debug: brain S: Skipping unchanged mailbox 51a58e1d1d5c491aac71488647b20224 May 10 16:53:29 dsync(mailto:saywhatnow@letest.tld): Debug: Mailbox INBOX.Commercial Spam: Mailbox opened May 10 16:53:29 dsync(mailto:saywhatnow@letest.tld): Debug: Mailbox INBOX.Commercial Spam: Mailbox opened With backup : May 10 16:54:55 doveadm(mailto:saywhatnow@letest.tld): Debug: brain M: Namespace INBOX. has location maildir:/home/letest/mail/letest.tld/saywhatnow:UTF-8 May 10 16:54:55 doveadm(mailto:saywhatnow@letest.tld): Debug: Mailbox INBOX: Mailbox opened May 10 16:54:55 doveadm(mailto:saywhatnow@letest.tld): Debug: Mailbox INBOX: Mailbox opened May 10 16:54:55 doveadm(mailto:saywhatnow@letest.tld): Debug: Namespace INBOX.: Using permissions from /home/letest/mail/letest.tld/saywhatnow: mode=0700 gid=default ... May 10 16:54:55 dsync(mailto:saywhatnow@letest.tld): Debug: brain S: Namespace INBOX. has location imapc: May 10 16:54:57 dsync(mailto:saywhatnow@letest.tld): Debug: brain M: Local mailbox tree: INBOX guid=c92f64f79f0d1ed01e6d5b314f04886c uid_validity=1 uid_next=1 subs=yes last_change=0 last_subs=1652217475 May 10 16:54:57 dsync(mailto:saywhatnow@letest.tld): Debug: brain S: Local mailbox tree: INBOX guid=c92f64f79f0d1ed01e6d5b314f04886c uid_validity=1 uid_next=8230 subs=yes last_change=0 last_subs=0 ... May 10 16:54:57 dsync(mailto:saywhatnow@letest.tld): Debug: brain M: Remote mailbox tree: INBOX guid=c92f64f79f0d1ed01e6d5b314f04886c uid_validity=1 uid_next=8230 subs=yes last_change=0 last_subs=0 ... May 10 16:54:57 dsync(mailto:saywhatnow@letest.tld): Debug: brain M: Mailbox INBOX: local=c92f64f79f0d1ed01e6d5b314f04886c/0/1, remote=c92f64f79f0d1ed01e6d5b314f04886c/0/1: Mailboxes are equal ... May 10 16:54:57 dsync(mailto:saywhatnow@letest.tld): Debug: Mailbox INBOX: Mailbox opened May 10 16:54:57 dsync(mailto:saywhatnow@letest.tld): Debug: brain S: Mailbox INBOX: local=c92f64f79f0d1ed01e6d5b314f04886c/0/1, remote=c92f64f79f0d1ed01e6d5b314f04886c/0/1: Mailboxes are equal ... May 10 16:54:57 dsync(mailto:saywhatnow@letest.tld): Debug: Mailbox INBOX: Mailbox opened May 10 16:54:57 dsync(mailto:saywhatnow@letest.tld): Debug: brain S: Change during sync: Mailbox GUID c92f64f79f0d1ed01e6d5b314f04886c was lost May 10 16:54:57 dsync(mailto:saywhatnow@letest.tld): Debug: brain S: We don't have mailbox c92f64f79f0d1ed01e6d5b314f04886c May 10 16:54:57 dsync(mailto:saywhatnow@letest.tld): Debug: brain M: Change during sync: Remote lost mailbox GUID c92f64f79f0d1ed01e6d5b314f04886c (maybe it was just deleted?) ... May 10 16:55:33 dsync(mailto:saywhatnow@letest.tld): Warning: Mailbox changes caused a desync. You may want to run dsync again: Remote lost mailbox GUID c92f64f79f0d1ed01e6d5b314f04886c (maybe it was just deleted?) This is odd, since that very GUID is in the uidlist file for the base folder: # grep -R Gc92f64f79f0d1ed01e6d5b314f04886c /home/letest/mail/letest.tld/saywhatnow /home/letest/mail/letest.tld/saywhatnow/dovecot-uidlist:3 V1 N1 Gc92f64f79f0d1ed01e6d5b314f04886c I've tried all sorts of things to get this to work, including removing the entire /home/letest/mail/letest.tld/saywhatnow/ directory so there could be no conflicts with existing mailbox, set mailbox_list_index=no , set lda_mailbox_autocreate=no , etc. The errors appear to originate from src/doveadm/dsync/dsync-brain-mailbox.c but it's not really telling me a lot. I'm using dovecot version 2.3.18 (9dd8408c18) on a cPanel server. `dovecot -n` output attached. Any help would be greatly appreciated! Thanks, Darren

3 5

Dovecot and RFC6856
by Tan Mientras 17 May '22

17 May '22

Hi. Just after upgrading *courier* from an old version, we are receiving warning messages instead of mails stating: "This E-mail message was determined to be Unicode-formatted but your E-mail reader does not support Unicode E-mail." warnings. It looks much like: *https://bugzilla.mozilla.org/show_bug.cgi?id=1571672 <https://bugzilla.mozilla.org/show_bug.cgi?id=1571672>* https://talk.plesk.com/threads/messages-with-unicode-unable-to-pick-up-via-… it seems, malformed mails (they showed errors before migration, but they were shown at least!) are handled incorrectly by thunderbird and the only option is to *revert backwards or migrate to dovecot*. *Does dovecot also implement RFC8656*? Will the same happen if we migrate to dovecot? Any plans for future adoption of that RFC?

2 1

Shared mailboxes, users with dots and a bug in subscriptions
by Tobias Stein 17 May '22

17 May '22

Hi, i'm running Dovecot 2.3.14.alpha0 with shared namespaces and stumbled across some errors messages logged, when the list of subscribed mailboxes is queried by a client. For every distinct account of in the list of subscriptions two corresponding lines are logged: Jan 28 11:42:34 mx1 dovecot: auth: missing passwd file: /etc/dovecot/private/example/users Jan 28 11:42:34 mx1 dovecot: auth: missing passwd file: /etc/dovecot/private/example/users Jan 28 11:42:34 mx1 dovecot: auth: missing passwd file: /etc/dovecot/private/example/users Jan 28 11:42:36 mx1 dovecot: imap(example_user(a)example.com)<3638><xl6li/O5VsVfWxyn>: Error: mkdir(/var/run/dovecot/user-not-found/noc@example) failed: Permission denied (euid=109(vmail) egid=118(vmail) missing +w perm: /var/run/dovecot, dir owned by 0:0 mode=0755) Jan 28 11:42:36 mx1 dovecot: imap(example_user(a)example.com)<3638><xl6li/O5VsVfWxyn>: Error: mkdir(/var/run/dovecot/user-not-found/info@example) failed: Permission denied (euid=109(vmail) egid=118(vmail) missing +w perm: /var/run/dovecot, dir owned by 0:0 mode=0755) Jan 28 11:42:36 mx1 dovecot: imap(example_user(a)example.com)<3638><xl6li/O5VsVfWxyn>: Error: mkdir(/var/run/dovecot/user-not-found/root@example) failed: Permission denied (euid=109(vmail) egid=118(vmail) missing +w perm: /var/run/dovecot, dir owned by 0:0 mode=0755) Similar messages are logged, when invalid entries are listed in '/var/lib/dovecot/db/shared-mailboxes', which i already pruned and haven't received them anymore since. I think these errors are caused by an unintended behaviour when writing "~/Maildir/subscriptions", which looks (shortened) like this. V 2 INBOX/INBOX shared/noc@example com/INBOX shared/info@example com/INBOX shared/root@example com/test shared/root@example com/test test_sub The subscription-file.c explodes the name on every hierarchy separator ('.','\0') and inserts a TAB character. Unfortunately it also explodes on the DNS label delimiter „.‟. This should probably be fixed by passing a structure containing the required information to the formatter to distinguish mailboxes from domain-names. Subscription in combination with multiple domains and shared mailboxes seems broken to me. Actually i can't even explain to me, why it is working in face of the errors. :-) Unfortunately in Maildir++ the separator dot is hard-coded. There is a very old thread on this mailing list, that suggests using „auth_username_translation‟ to replace dots with a different character, but this idea is getting worse the longer i think about it. I absolutely dislike the idea to set LAYOUT=fs, namespace/separator = § to change the separators to split on, because this would mean to restructure the physical layout of all mailboxes (hierarchically) and mess around with lots of files. I attached a dovecot-sysreport to reproduce the behaviour. /etc/dovecot/private/example.com/users looks like this: ### user:password:uid:gid:(gecos):home:(shell):extra_fields noc:{SSHA512}_hash_:::::: info:{SSHA512}_hash_:::::: root:{SSHA512}_hash_:::::: Please correct me if i'm wrong or point me to a workaround, but i think the layout code needs some love. :-) Best regards Tobias

2 4

Re: Permissions and ownership on /dev/shm/dovecot
by doug 16 May '22

16 May '22

1 0

Fatal Error after upgrade to 2:2.3.19-2+debian11
by Sebastian Kroczek 16 May '22

16 May '22

Hello all, I updated the server tonight and with it Dovecot from 2.2.27 to 2:2.3.19-2+debian11. However, there seems to be a problem with the ACLs, because since then fatal errors are logged (see core dump). I suspect that some outdated configuration is causing this behavior, but so far I couldn't figure out which one it could be. I also have no clue right now how to debug this further. Thank you very much for your help. If more information are needed, I will of course be happy to provide them. VG Sebastian ======== Error logs ========= May 16 13:33:43 Fatal: imap(user1(a)domain.com)<0r5YZR/fM4AfrHBI>: master: service(imap): child 238359 killed with signal 11 (core dumped) May 16 13:33:46 Fatal: imap(user2(a)domain.com)<Ul+kZR/fA4AfrHBI>: master: service(imap): child 238386 killed with signal 11 (core dumped) May 16 13:33:46 Fatal: imap(user3(a)domain.com)<VGOkZR/fG4AfrHBI>: master: service(imap): child 238387 killed with signal 11 (core dumped) May 16 13:34:54 Fatal: imap(user4(a)domain.com)<1WS6aR/fHoAfrHBI>: master: service(imap): child 238509 killed with signal 11 (core dumped) May 16 13:34:54 Fatal: imap(user2(a)domain.com)<mQu6aR/fBIAfrHBI>: master: service(imap): child 238508 killed with signal 11 (core dumped) May 16 13:35:27 Fatal: imap(user3(a)domain.com)<pWGYax/fE4AfrHBI>: master: service(imap): child 238589 killed with signal 11 (core dumped) May 16 13:35:27 Fatal: imap(user1(a)domain.com)<s/mgax/fG4AfrHBI>: master: service(imap): child 238590 killed with signal 11 (core dumped) ======== END Error logs ========= ======== dovecot.conf ========== # 2.3.19 (b3ad6004dc): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.19 (4eae2f79) # OS: Linux 5.10.0-14-amd64 x86_64 Debian 11.3 # Hostname: wv-imap1.wavecloud.de auth_mechanisms = plain login default_vsz_limit = 4 G dict { acl = mysql:/etc/dovecot/dovecot-dict-sql.conf } first_valid_gid = 5000 first_valid_uid = 5000 imap_capability = +XDOVECOT last_valid_gid = 5000 last_valid_uid = 5000 listen = 10.10.115.XX login_trusted_networks = 10.10.115.XX 10.10.115.XX mail_location = maildir:~/ mail_log_prefix = "%s(%u)<%{session}>: " mail_plugins = acl notify quota fts fts_solr virtual maildir_stat_dirs = yes managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date ihave namespace { inbox = yes location = mailbox Archive { auto = subscribe special_use = \Archive } mailbox Drafts { auto = subscribe special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { auto = subscribe special_use = \Sent } mailbox "Sent Items" { auto = no special_use = \Sent } mailbox "Sent Messages" { auto = no special_use = \Sent } mailbox Spam { auto = subscribe special_use = \Junk } mailbox Trash { auto = subscribe special_use = \Trash } prefix = separator = / type = private } namespace Virtual { hidden = yes list = no location = virtual:/etc/dovecot/virtual:INDEX=/srv/vmail/_virtual/%u prefix = Virtual/ separator = / subscriptions = no } namespace shared { list = yes location = maildir:%%h:INDEX=~/shared/%%u prefix = shared/%%u/ separator = / subscriptions = no type = shared } passdb { args = /etc/dovecot/dovecot-sql-password.conf driver = sql } passdb { args = /etc/dovecot/admin-sql.conf driver = sql master = yes pass = yes } plugin { acl = vfile acl_shared_dict = proxy::acl fts = solr fts_autoindex = yes fts_solr = url=http://wv-solr1.wavecloud.de:8983/solr/dovecot/ quota = maildir:User quota quota_rule = *:storage=20G quota_rule2 = Trash:storage=+100M quota_rule3 = SPAM:ignore quota_warning = storage=95%% quota-warning 95 %u quota_warning2 = storage=80%% quota-warning 80 %u quota_warning3 = -storage=100%% quota-warning below %u sieve = ~/.dovecot.sieve sieve_before = /var/vmail/globalsieverc sieve_max_script_size = 1M sieve_quota_max_scripts = 42 sieve_quota_max_storage = 10 } protocols = imap pop3 sieve lmtp service auth { unix_listener /var/spool/postfix/private/auth { group = vmail mode = 0666 user = vmail } unix_listener auth-master { mode = 0666 } } service dict { unix_listener dict { mode = 0600 user = vmail } } service imap-login { process_min_avail = 1 service_count = 0 vsz_limit = 500 M } service lmtp { inet_listener lmtp { address = 0.0.0.0 port = 24 } } service managesieve-login { executable = /usr/lib/dovecot/managesieve-login inet_listener sieve { address = 10.10.115.10 port = 4190 } process_min_avail = 1 service_count = 1 } service managesieve { executable = /usr/local/sbin/dovecot-managesieve.sh } service pop3-login { process_min_avail = 1 service_count = 1 } service quota-warning { executable = script /usr/local/sbin/quota-warning.sh user = vmail } service stats { unix_listener stats-reader { group = vmail mode = 0660 user = vmail } unix_listener stats-writer { group = vmail mode = 0660 user = vmail } } shutdown_clients = no ssl_cert = </etc/ssl/cert.pem ssl_dh = # hidden, use -P to show it ssl_key = # hidden, use -P to show it userdb { args = /etc/dovecot/dovecot-sql.conf driver = sql } verbose_proctitle = yes protocol imap { imap_client_workarounds = delay-newmail tb-extra-mailbox-sep mail_max_userip_connections = 2048 mail_plugins = acl notify quota fts fts_solr virtual imap_quota imap_acl } protocol pop3 { mail_plugins = acl notify quota fts fts_solr virtual pop3_client_workarounds = outlook-no-nuls oe-ns-eoh pop3_uidl_format = %08Xu%08Xv } protocol lda { hostname = wv-imap1.wavecloud.de mail_fsync = optimized mail_plugins = acl notify quota fts fts_solr virtual sieve postmaster_address = postmaster(a)example.com quota_full_tempfail = yes sendmail_path = /usr/lib/sendmail } protocol sieve { managesieve_implementation_string = Dovecot Pigeonhole } protocol lmtp { mail_fsync = optimized mail_plugins = acl notify quota fts fts_solr virtual sieve } ======== END dovecot.conf ========== ======== Core-Dump ================= PID: 240475 (imap) UID: 5000 (vmail) GID: 5000 (vmail) Signal: 11 (SEGV) Timestamp: Mon 2022-05-16 13:49:56 CEST (1min 17s ago) Command Line: dovecot/imap [user1(a)domain.com XX.XX.XX.XX MYRIGHTS] Executable: /usr/lib/dovecot/imap Control Group: /system.slice/dovecot.service Unit: dovecot.service Slice: system.slice Boot ID: acb78ce2252049778ff969755d277453 Machine ID: 1367ff1e75be457cacbf5e204a28711b Hostname: wv-imap1 Storage: /var/lib/systemd/coredump/core.imap.5000.acb78ce2252049778ff969755d277453.240475.1652701796000000.zst Message: Process 240475 (imap) of user 5000 dumped core. Stack trace of thread 240475: #0 0x00007f5db938c17c acl_mailbox_get_aclobj (lib01_acl_plugin.so + 0xf17c) #1 0x00007f5db93776ed n/a (lib02_imap_acl_plugin.so + 0x36ed) #2 0x000055f5568444d4 command_exec (imap + 0x224d4) #3 0x000055f55684244f n/a (imap + 0x2044f) #4 0x000055f5568424fa n/a (imap + 0x204fa) #5 0x000055f5568429d5 client_handle_input (imap + 0x209d5) #6 0x000055f556842f40 client_input (imap + 0x20f40) #7 0x00007f5db9682529 io_loop_call_io (libdovecot.so.0 + 0x118529) #8 0x00007f5db9683c12 io_loop_handler_run_internal (libdovecot.so.0 + 0x119c12) #9 0x00007f5db96825d0 io_loop_handler_run (libdovecot.so.0 + 0x1185d0) #10 0x00007f5db9682790 io_loop_run (libdovecot.so.0 + 0x118790) #11 0x00007f5db95f5353 master_service_run (libdovecot.so.0 + 0x8b353) #12 0x000055f556833f0a main (imap + 0x11f0a) #13 0x00007f5db93c5d0a __libc_start_main (libc.so.6 + 0x26d0a) #14 0x000055f556833fca _start (imap + 0x11fca) =========== END Core-Dump ============= -- Wavecon GmbH Anschrift: Gustavstraße 18, 90762 Fürth Website: www.wavecon.de Support: support(a)wavecon.de Telefon: +49 (0)911-1206581 (werktags von 9 - 17 Uhr) Hotline 24/7: 0800-WAVECON Fax: +49 (0)911-2129233 Registernummer: HRB Fürth 18164 GF: Cemil Degirmenci UstID: DE251398082 Pflichtinformationen nach Art. 13 DSGVO siehe wavecon.de/de/datenschutz

3 5

TLS renegotiation issue (CVE-2011-1473) in Dovecot
by Greg Earle 16 May '22

16 May '22

Hello, At work I'm running a Dovecot 2.3.15 server on a RHEL 7.9 system with OpenSSL 1.0.2k. Our IT Security people are threatening to shut it down because of this: > We were notified of a possible TLS renegotiation vulnerability on > [FQHN]. > > [Parent organization] ticket NNNNNNN is open to track efforts. > > We conducted a manual test on the site for TLS Renegotiation on IMAP > port 993. > > We found that this was set to enabled. > > In order to remediate we will need to either: > > 1. Disable Renegotiation (preferred) > 2. Set a max aggregated renegotiation > > Please remediate as soon as possible. > > References: > > https://support.f5.com/csp/article/K15278 > > https://nvd.nist.gov/vuln/detail/cve-2011-1473 > > https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-1473 I did some Googling and among the results, I found a few old posts from this mailing list among them, which to summarize basically seemed to say "Yeah, we could write some code ... " but that was about it. The IT Security rep sent me a reference to an ancient Red Hat article https://access.redhat.com/articles/23543 which is hysterical - ancient history, references NSS and Tomcat, suggests changes to an add-on product (Red Hat Certificate Server) that is EOL, etc. Is there any way to mitigate this issue? (The only thing I can think of is to upgrade the Dovecot server to RHEL 8 and restrict connections to only TLSv1.3, but that ain't gonna happen overnight.) Thanks, - Greg

3 2

Duplicate messages if message is moved when using dsync
by Thom Pol 16 May '22

16 May '22

Hi, Hope you are well. We have a cluster of 2 Dovecot servers, both on v2.3.13 (89f716dc2), using dsync to sync the messages between them. Previously, we used TCPS to sync the messages, but after some testing, we concluded that syncing over SSH resulted in a lot less failed syncs, so we started using SSH. The change has been a success, but I now notice a issue when a email client immediately moves a messages to a separate folder while Dovecot is syncing, where the message is seen twice in the folder (with the exact same headers/content). For example, I have set a filter in my email client, Thunderbird, to immediately move all emails coming from this list to a separate folder. When opening that folder, I do not see one, but two unread messages, both identical to each other. When checking the directories on the server, I see this: mx1: /var/vmail/example.com/joe/Maildir/.Subdir.Subdir/cur/1652615808.M190190P990486.mx2,S=19089,W=19384:2,S /var/vmail/example.com/joe/Maildir/.Subdir.Subdir/cur/1652615811.M180050P1376677.mx1,S=19089,W=19384:2,S mx2: /var/vmail/example.com/joe/Maildir/.Subdir.Subdir/cur/1652615811.M981426P990530.mx2,S=19089,W=19384:2,S /var/vmail/example.com/joe/Maildir/.Subdir.Subdir/cur/1652615808.M190190P990486.mx2,S=19089,W=19384:2,S Note the difference: on mx1, one indicates mx1, and one mx2, while on the other server, both indicate mx2/ Any idea (other then telling end-users not to use such filters) how we could prevent these duplicate messages? This is our config: # Pigeonhole version 0.5.13 (cdd19fe3) # OS: Linux 5.10.0-13-cloud-amd64 x86_64 Debian 11.3 # Hostname: mx1.example.com auth_mechanisms = plain login disable_plaintext_auth = no dsync_remote_cmd = ssh -p 222 -l%{login} %{host} doveadm dsync-server -u%u imap_capability = +SPECIAL-USE XLIST listen = *,[::] lmtp_rcpt_check_quota = yes log_timestamp = "%Y-%m-%d %H:%M:%S " mail_max_userip_connections = 100 mail_plugins = quota mail_privileged_group = vmail namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = separator = . } passdb { args = /etc/dovecot/dovecot-sql.conf driver = sql } plugin { mail_replica = remote:root@mx2.example.com quota = dict:user::file:/var/vmail/%d/%n/.quotausage quota_status_nouser = DUNNO quota_status_overquota = 552 5.2.2 Mailbox is full quota_status_success = DUNNO sieve = /var/vmail/%d/%n/.sieve sieve_after = /var/vmail/%d/%n/.ispconfig.sieve sieve_before = /var/vmail/%d/%n/.ispconfig-before.sieve sieve_max_actions = 100 sieve_max_redirects = 25 sieve_max_script_size = 2M } protocols = imap pop3 lmtp replication_max_conns = 50 service aggregator { fifo_listener replication-notify-fifo { mode = 0666 user = vmail } unix_listener replication-notify { mode = 0666 user = vmail } } service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0660 user = postfix } unix_listener auth-userdb { group = vmail mode = 0600 user = vmail } user = root } service imap-login { client_limit = 1000 process_limit = 512 } service lmtp { unix_listener /var/spool/postfix/private/dovecot-lmtp { group = postfix mode = 0600 user = postfix } } service quota-status { client_limit = 1 executable = quota-status -p postfix unix_listener /var/spool/postfix/private/quota-status { group = postfix mode = 0660 user = postfix } } service replicator { process_min_avail = 1 unix_listener replicator-doveadm { mode = 0666 user = vmail } } service stats { unix_listener stats-reader { group = vmail mode = 0660 user = vmail } unix_listener stats-writer { group = vmail mode = 0660 user = vmail } } ssl_cert = </etc/postfix/smtpd.cert ssl_cipher_list = kEECDH:+kEECDH+SHA:kEDH:+kEDH+SHA:+kEDH+CAMELLIA:kECDH:+kECDH+SHA:kRSA:+kRSA+SHA:+kRSA+CAMELLIA:!aNULL:!eNULL:!SSLv2:!RC4:!MD5:!DES:!EXP:!SEED:!IDEA:!3DES ssl_client_ca_dir = /etc/ssl/certs ssl_dh = # hidden, use -P to show it ssl_key = # hidden, use -P to show it ssl_min_protocol = TLSv1.2 ssl_prefer_server_ciphers = yes userdb { driver = prefetch } userdb { args = /etc/dovecot/dovecot-sql.conf driver = sql } protocol imap { auth_verbose = yes mail_plugins = quota quota imap_quota quota notify replication } protocol pop3 { auth_verbose = yes mail_plugins = quota quota quota notify replication pop3_uidl_format = %08Xu%08Xv } protocol lda { mail_plugins = quota sieve quota sieve quota notify replication postmaster_address = postmaster(a)mx1.example.com } protocol lmtp { mail_plugins = quota quota sieve sieve quota notify replication postmaster_address = postmaster(a)mx1.example.com } Thanks in advance for your thoughts. Kind regards, Thom Pol

2 1

Use different log files
by Cristiano Deana 16 May '22

16 May '22

Hi, I have a mailserver with dovecot logging to syslog (by default, to /var/log/maillog) and my MTA (postfix) is doing the same. I use dovecot's services imap/pop3, auth and lmtp and now logs files are hard to read because I havve all together MTA and these services. Is it possibile to have different log with different services? Example: auth logging: /var/log/mail.auth delivery: /var/log/mail.delivery and so on Thank you -- ############################### # Cristiano Deana # # # # Senior Network Engineer # # Digital Response Team # # CittaStudi S.p.a. # # off. +39 015 855 1172 # # cell +39 328 310 6392 # ###############################

3 2

Re: TLS renegotiation issue (CVE-2011-1473) in Dovecot
by Greg Earle 16 May '22

16 May '22

On 13 May 2022, at 19:38, Elisamuel Resto <sam(a)samresto.dev> wrote: > I believe this to be a configuration error, not a dovecot problem. > The > output of dovecot -n (as an attachment; look it over for any data you > do > not want publicized) would help to suggest changes to bring you back > into compliance. Elisamuel, I'm not really sure why you think it's a configuration error, but I'll attach the "dovecot -n" output. Thanks, - Greg

3 2

Dovecot v2.3.19 released
by Aki Tuomi 16 May '22

16 May '22

Hi all! We are pleased to release v2.3.19 of Dovecot. The docker images have been upgraded to use bullseye as base image. https://dovecot.org/releases/2.3/dovecot-2.3.19.tar.gz https://dovecot.org/releases/2.3/dovecot-2.3.19.tar.gz.sig Binary packages in https://repo.dovecot.org/ Docker images in https://hub.docker.com/r/dovecot/dovecot Regards, Aki Tuomi Open-Xchange oy -- + Added mail_user_session_finished event, which is emitted when the mail user session is finished (e.g. imap, pop3, lmtp). It also includes fields with some process statistics information. See https://doc.dovecot.org/admin_manual/list_of_events/ for more information. + Added process_shutdown_filter setting. When an event matches the filter, the process will be shutdown after the current connection(s) have finished. This is intended to reduce memory usage of long-running imap processes that keep a lot of memory allocated instead of freeing it to the OS. + auth: Add cache hit indicator to auth passdb/userdb finished events. See https://doc.dovecot.org/admin_manual/list_of_events/ for more information. + doveadm deduplicate: Performance is improved significantly. + imapc: COPY commands were sent one mail at a time to the remote IMAP server. Now the copying is buffered, so multiple mails can be copied with a single COPY command. + lib-lua: Add a Lua interface to Dovecot's HTTP client library. See https://doc.dovecot.org/admin_manual/lua/ for more information. - auth: Cache lookup would use incorrect cache key after username change. - auth: Improve handling unexpected LDAP connection errors/hangs. Try to fix up these cases by reconnecting to the LDAP server and aborting LDAP requests earlier. - auth: Process crashed if userdb iteration was attempted while auth-workers were already full handling auth requests. - auth: db-oauth2: Using %{oauth2:name} variables caused unnecessary introspection requests. - dict: Timeouts may have been leaked at deinit. - director: Ring may have become unstable if a backend's tag was changed. It could also have caused director process to crash. - doveadm kick: Numeric parameter was treated as IP address. - doveadm: Proxying can panic when flushing print output. Fixes Panic: file ioloop.c: line 865 (io_loop_destroy): assertion failed: (ioloop == current_ioloop). - doveadm sync: BROKENCHAR was wrongly changed to '_' character when migrating mailboxes. This was set by default to %, so any mailbox names containing % characters were modified to "_25". - imapc: Copying or moving mails with doveadm to an imapc mailbox could have produced "Error: Syncing mailbox '[...]' failed" Errors. The operation itself succeeded but attempting to sync the destination mailbox failed. - imapc: Prevent index log synchronization errors when two or more imapc sessions are adding messages to the same mailbox index files, i.e. INDEX=MEMORY is not used. - indexer: Process was slowly leaking memory for each indexing request. - lib-fts: fts header filters caused binary content to be sent to the indexer with non-default configuration. - doveadm-server: Process could hang in some situations when printing output to TCP client, e.g. when printing doveadm sync state. - lib-index: dovecot.index.log files were often read and parsed entirely, rather than only the parts that were actually necessary. This mainly increased CPU usage. - lmtp-proxy: Session ID forwarding would cause same session IDs being used when delivering same mail to multiple backends. - log: Log prefix update may have been lost if log process was busy. This could have caused log prefixes to be empty or in some cases reused between sessions, i.e. log lines could have been logged for the wrong user/session. - mail_crypt: Plugin crashes if it's loaded only for some users. Fixes Panic: Module context mail_crypt_user_module missing. - mail_crypt: When LMTP was delivering mails to both recipients with mail encryption enabled and not enabled, the non-encrypted recipients may have gotten mails encrypted anyway. This happened when the first recipient was encrypted (mail_crypt_save_version=2) and the 2nd recipient was not encrypted (mail_crypt_save_version=0). - pop3: Session would crash if empty line was sent. - stats: HTTP server leaked memory. - submission-login: Long credentials, such as OAUTH2 tokens, were refused during SASL interactive due to submission server applying line length limits. - submission-login: When proxying to remote host, authentication was not using interactive SASL when logging in using long credentials such as OAUTH2 tokens. This caused authentication to fail due to line length constraints in SMTP protocol. - submission: Terminating the client connection with QUIT command after mail transaction is started with MAIL command and before it is finished with DATA/BDAT can cause a segfault crash. - virtual: doveadm search queries with mailbox-guid as the only parameter crashes: Panic: file virtual-search.c: line 77 (virtual_search_get_records): assertion failed: (result != 0)

12 20