- dovecot - dovecot.org

Subfolder in sieve not working as expected
by Kees van Vloten 16 Nov '21

16 Nov '21

On 15-11-2021 23:04, dovecot(a)ptld.com wrote: >> On 11-15-2021 3:46 pm, Kees van Vloten wrote: >> >> I am trying to move incoming mails into subfolders with this sieve >> script: >> >> require ["fileinto", "variables", "mailbox"]; >> if header :matches "Delivered-To" "*@*" >> { >> fileinto :create "INBOX/${2}"; >> } > > I am not using variables and my folders are pre-created. But just to > give you a starting point, this is what works using maildir++ format > with default directory layout. > https://doc.dovecot.org/configuration_manual/mail_location/Maildir/ > > require ["fileinto"]; > # rule:[Dovecot] > if header :contains "sender" "@dovecot.org" > { > fileinto "INBOX.Dovecot"; > } I have seen that working in the past :-) I switched to LAYOUT=fs recently because of the limitations of the dot as a folder separator (now I can have the domain-name as a folder-name). I found a nice description about folder and namespace issues here: https://forum.hestiacp.com/t/character-not-allowed-in-mailbox-name/566/4 But somehow the sieve implementation does not seem to work properly with LAYOUT=fs. What a good approach to further analyze this issue?

1 0

[Move mailboxes] 2.2.13 -> 2.3.13: Stuck on certificate verification
by phren＠ist-einmalig.de 15 Nov '21

15 Nov '21

Hi, I'm about to move all mailboxes from an old machine - running Dovecot 2.2.13 - to a new machine - running Dovecot 2.3.13 (89f716dc2). Cause the new machine is in a different location I must use SSL encryption. I followed the guide's I found, but I stuck on certificate verification: $ doveadm backup -Ru <user> tcps:<host>:12354 doveadm(<user>): Info: Received invalid SSL certificate: unable to get local issuer certificate: /CN=<host> (check ssl_client_ca_* settings?) doveadm(<user>): Error: doveadm server disconnected before handshake: Received invalid SSL certificate: unable to get local issuer certificate: /CN=<host> (check ssl_client_ca_* settings?) doveadm(<user>): Error: Disconnected from remote: Received invalid SSL certificate: unable to get local issuer certificate: /CN=<host> (check ssl_client_ca_* settings?) On port 12354 the server sends an incomplete certificate chain, whereas on port 993 everything is fine. I read that the settings - ssl_client_ca_dir - ssl_client_ca_file are not used on certificate verification for port 12354, one should use the setting ssl_ca Here are the non-default setting on the client side: $ dovecot -n # 2.3.13 (89f716dc2): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.13 (cdd19fe3) # OS: Linux 5.10.0-9-amd64 x86_64 Debian 11.1 ... ssl_ca = </etc/dovecot/dovecot_imap_chain.crt ssl_cert = </etc/ssl/letsencrypt.org/<host>.combine.crt ssl_cipher_list = EDH+aRSA:EECDH+aRSA+AESGCM:EECDH+aRSA+SHA384:EECDH+aRSA+SHA256:EECDH:+AES256:!aNULL:!eNULL:!LOW:!MEDIUM:!3DES:!MD5:!EXP:!PSK:!DSS:!RC4:!SEED:!ECDSA:!CAMELLIA ssl_client_ca_dir = /etc/ssl/certs ssl_client_ca_file = /etc/ssl/certs/ca-certificates.crt ... ssl_min_protocol = TLSv1.2 ssl_prefer_server_ciphers = yes ... verbose_ssl = yes ssl_verify_client_cert = yes According to https://doc.dovecot.org/configuration_manual/dovecot_ssl_configuration/ the setting ssl_ca should contain Issuing CA cert Issuing CA CRL Intermediate CA cert Intermediate CA CRL Root CA cert Root CA CRL But how do I build this file? I tried root certificate, root + intermediate certificate and root + intermediate + signed certificate. None of them made it work... I'm completely stuck on how to make certificate verification work. Can anyone give me a hint? Thanks in advance.

1 0

Strategies for protecting IMAP (e.g. MFA)
by Kees van Vloten 14 Nov '21

14 Nov '21

Apart from a really nice firewall firehol also supplies a good set of ip-blacklists. For public exposure of email ports, I am using the combination of firehol-firewall, firehol-blacklist, fail2ban and a whitelist based on geo-ip. The mail-client ports exposed are 993 and 465, because starttls is considered flawed nowadays: https://nostarttls.secvuln.info/) Full access from any IP (except firehol-blacklist and fail2ban) is possible over VPN (openvpn) with MFA (privacyidea). Privacyidea also supplies a mobile-app compatible with a.o. TOTP and HOTP but it provides a more secure way of enrollment (2-step). Thanks for pointing at crowdsec.net, will see if it can tighten security further in cooperation with the above. - Kees On 14-11-2021 11:33, infoomatic wrote: > I will throw in a few interesting projects which have kept my small > servers safe: > > *) firehol.org > > *) crowdsec.net > > *) www.fail2ban.org > > Have a look at those interesting projects! > > > On 13.11.21 22:16, Tyler Montney wrote: >> With the world of ransomware as it is today (aka attacks seem more >> vicious and commonplace), anything I expose to WAN must have >> additional protection. I've seen a few posts to this list on it. The >> only thing that helped was that Dovecot supports OAuth. Through OAuth >> I figure I could implement MFA. However, I'd have to host my own >> identity server. From there, Thunderbird supports OAuth so that should >> work. >> >> Since this is getting increasingly complicated, I wanted to ask before >> going further. What do you all do? Any recommendations?

4 4

Re: Strategies for protecting IMAP (e.g. MFA)
by Marc 14 Nov '21

14 Nov '21

Don't use email addresses as login ;) - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -. F1 Outsourcing Development Sp. z o.o. Poland t: +48 (0)12 4207 835 e: marc(a)f1-outsourcing.eu

3 3

IPv4/v6 based access checking and logging
by Lefteris Tsintjelis 13 Nov '21

13 Nov '21

Hi, I am currently using postfix/dovecot with postfix admin and I track the last login date already by using this: https://doc.dovecot.org/configuration_manual/lastlogin_plugin/ Besides last login date, I would like to also implement IPv4 and IPv6 last login tracking also and if possible, IP based login checking. Is post-login scripting the best most efficient way to go? Regards, Lefteris

3 6

2.3.17 update breaks dsync over tcps: Received invalid SSL certificate unable to get certificate CRL
by Salatiel Filho 12 Nov '21

12 Nov '21

Hi, I have updated dovecot from 2.3.16 (working flawless ) to 2.3.17 ( both Centos8 - community repo ) . Now dsync does not work anymore, logs shows: dovecot[30398]: doveadm(vmail): Error: Disconnected from remote: Received invalid SSL certificate: unable to get certificate CRL: /CN=imap.signed.with.my.own.ca(check ssl_client_ca_* settings?) I have a certificate signed by my "own CA". Both hosts trust my CA, and as I told previously, the configuration works just fine on 2.3.16. I really was not expecting that a minor update would break things, but 2.3.17 appears to have broken the setup for some people here in the maillists. Is there a workaround for this? I have tried to set ssl_require_crl = no , but nothing changed. I have: service doveadm { inet_listener { port = 26 ssl = yes } } ssl = required ssl_ca = </etc/ssl/certs/mail-cluster-communication_ca.pem ssl_cert = </etc/ssl/certs/mail-cluster-communication.crt ssl_key = # hidden, use -P to show it Thanks! Atenciosamente/Kind regards, Salatiel

1 0

after replication with compression quotas are wrong
by Arnaud Abélard 12 Nov '21

12 Nov '21

Hello, We are very long time happy dovecot users (since 2008 at least). We have around 90k mailboxes and since we had to move away from our NAS storage to a ceph storage I jumped on the opportunity to enable compression with the zlib plugin and dovecot's replication mecanism. We are using debian's dovecot 2.2.27 packages on production and our new server is running dovecot's own ce-2.3.17 packages. On the production server everything works fine but on the new server, replicated mailboxes' quota is all wrong: on production: # doveadm quota get -u dummy-c-1 Quota name Type Value Limit % Quota Utilisateur STORAGE 660026 976563 67 Quota Utilisateur MESSAGE 8651 - 0 on new server: doveadm quota get -u dummy-c-1 Quota name Type Value Limit % Quota Utilisateur STORAGE 1125251 976563 115 Quota Utilisateur MESSAGE 16646 - 0 If I add all the S flag from the filenames n both servers I get exactly the same usage, which is coherent with the quota on the production server: # find . -type f | grep 'S=' | awk -F'S=' '{print $2}' | awk -F',' '{print $1}' | awk -F':' '{print $1}' | paste -sd+ | bc -l 675865938 And I have exactly the same amountof mails on the two server, the replication works as expected, no unwanted duplication of mails occurs. Of course, I've tried to ask dovecot to recalculate quotas with doveadm quota recalc -u <username>, but it doesn't fix the problem. What am I missing? Thanks, Arnaud PS: Here is my doveconf -n output: # 2.3.17 (e2aa53df5b): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.17 (054dddfa) # OS: Linux 4.19.0-18-amd64 x86_64 Debian 10.11 # Hostname: gromel-test auth_cache_size = 10 k auth_verbose = yes disable_plaintext_auth = no doveadm_password = # hidden, use -P to show it hostname = gromel1.univ-nantes.prive lda_mailbox_autosubscribe = yes listen = * log_timestamp = "%Y-%m-%d %H:%M:%S " login_trusted_networks = (...) mail_gid = 5000 mail_location = maildir:%h mail_plugins = quota zlib notify replication mail_privileged_group = vmail mail_uid = 5000 maildir_stat_dirs = yes maildir_very_dirty_syncs = yes managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext namespace { inbox = yes location = prefix = INBOX. separator = . type = private } passdb { args = /etc/dovecot/dovecot-ldap.conf driver = ldap } plugin { quota = maildir:Quota Utilisateur quota_exceeded_message = Cet utilisateur a dépassé son quota, votre message n'a pu lui être livré. quota_full_tempfail = yes quota_rule = *:storage=1000M quota_rule2 = INBOX.Trash:storage=+100M sieve = ~/dovecot.sieve sieve_dir = ~/sieve sieve_extensions = -vacation sieve_global_dir = /var/lib/dovecot/sieve/global/ sieve_max_redirects = 1 zlib_save = gz zlib_save_level = 6 } postmaster_address = postmaster@<snip> protocols = imap pop3 sieve replication_max_conns = 50 service auth { client_limit = 49452 unix_listener auth-userdb { group = vmail mode = 0600 user = vmail } user = root } service dict { unix_listener dict { mode = 0600 user = vmail } } service doveadm { inet_listener { port = 12345 } } service imap-login { process_min_avail = 8 service_count = 0 user = mail } service imap { executable = imap process_limit = 16384 vsz_limit = 2 G } service managesieve-login { inet_listener sieve { port = 4190 } process_min_avail = 8 service_count = 0 user = mail vsz_limit = 2 G } service managesieve { drop_priv_before_exec = yes process_limit = 16384 } service pop3-login { process_min_avail = 8 service_count = 0 user = mail } service pop3 { drop_priv_before_exec = yes process_limit = 16384 } ssl = no userdb { args = /etc/dovecot/dovecot-ldap.conf driver = ldap } verbose_proctitle = yes protocol imap { mail_max_userip_connections = 50 mail_plugins = quota zlib notify replication imap_quota zlib } protocol pop3 { mail_plugins = quota zlib notify replication } protocol sieve { mail_max_userip_connections = 10 } protocol lda { mail_plugins = quota zlib notify replication sieve zlib } -- Arnaud Abélard Responsable pôle Système et Stockage Service Infrastructures DSIN Université de Nantes -

2 10

2.3.17: Panic on LMTP deliveries
by Michael Glaus 12 Nov '21

12 Nov '21

Hello Since the doevcot update to 2.3.17 i get a panic if a mail is delivered with lmtp. In the logs i get these messages: lmtp(rcpt(a)example.com)<21067><AtxaKh+hi2FLUgAAwujwpQ>: Error: lmtp-server: conn 10.0.0.105:52981 [1]: rcpt rcpt(a)example.com: duplicate db: User rcpt(a)example.com doesn't have home dir set, disabling duplicate database lmtp(rcpt(a)example.com)<21067><AtxaKh+hi2FLUgAAwujwpQ>: Panic: file imem.c: line 65 (i_strconcat): assertion failed: (str1 != NULL) lmtp(rcpt(a)example.com)<21067><AtxaKh+hi2FLUgAAwujwpQ>: Fatal: master: service(lmtp): child 21067 killed with signal 6 (core dumped) In the running config userdb does not return the field “home” and therefor a user does not have a “mail_home” only a “mail_location”. If i change the config to provide a “mail_home” it works, but due to the directory structure i can not change this yet. Best regards Michael Glaus Junior System Administrator -- Hostpoint AG Neue Jonastrasse 60 | 8640 Rapperswil-Jona | Schweiz michael.glaus(a)hostpoint.ch | www.hostpoint.ch

2 1

Userdb problem
by Erwan David 11 Nov '21

11 Nov '21

Hello I am trying to move authentication from ldap to passwdfile. Autentication works, but clients do not find the mails. With ldap I have : root@email:~ # doveadm auth login erwan xxxxx passdb: erwan auth succeeded extra fields: user=erwan userdb extra fields: erwan home=/var/db/mailboxes/erwan /var/db/mailboxes/erwan=/var/db/mailboxes/erwan uid=587 gid=587 auth_mech=PLAIN With passwdfile I get root@email:~ # doveadm auth login erwan xxxxx passdb: erwan auth succeeded extra fields: user=erwan userdb extra fields: erwan home=/var/db/mailboxes/erwan,uid=587,gid=587 uid=587 gid=587 auth_mech=PLAIN The only difference is this "/var/db/mailboxes/erwan=/var/db/mailboxes/erwan" (which is the place where email is stored). What is the problem with this ? auth configuration is : passdb { driver = passwd-file args = scheme=SHA512-CRYPT username_format=%n /usr/local/etc/dovecot/users } userdb { driver = passwd-file args = username_format=%n /usr/local/etc/dovecot/users # Default fields that can be overridden by passwd-file #default_fields = quota_rule=*:storage=1G default_fields = home=/var/db/mailboxes/%n,uid=587,gid=587 # Override fields from passwd-file #override_fields = home=/home/virtual/%u override_fields = home=/var/db/mailboxes/%n,uid=587,gid=587 }

1 1

Question about sieves
by João Silva 10 Nov '21

10 Nov '21

Hi I'm having a problem related to Dovecot (version 2.2.36) sieves and I'm not finding information. I'm calling a sieve with 90-sieve.conf: imapsieve_mailbox2_name = * 90-sieve.conf: imapsieve_mailbox2_from = SPAM 90-sieve.conf: imapsieve_mailbox2_causes = COPY 90-sieve.conf: imapsieve_mailbox2_before = file:/etc/dovecot/sieve/learn-ham.sieve The SPAM folder have a autoexpunge set. From the log analysis I have a very strong suspect that the sieve is being called when the mails from the Spam folder are expunged, is that possible? Is any other imapsieve_mailbox2_causes that could be used to prevent that? Thanks

3 3

dovecot: 2.3.16 -> 2.3.17_1
by Elise 10 Nov '21

10 Nov '21

Hi team, perhaps I do overlook something here, but after the update from 2.3.16 -> 2.3.17_1on startup Dovecot is generating error message: > doveconf: Fatal: execvp(/usr/local/sbin/dovecot) failed: Argument list too long > /usr/local/etc/rc.d/dovecot: WARNING: failed to start dovecot As a temporary solution I currently hashed out SSL in dovecot.conf and receive e-mail again. Can you tell how to fix? Thanks! /elise

5 9

Dovecot Proxy with OAuth2 Setting Question
by UMETSU HARUYASU(梅津　晴康) 08 Nov '21

08 Nov '21

Hi I'm setting up a Dovecot Proxy Server to access Gmail. But It doesn’t work. I tried to configure Dovecot without proxy authentication. passdb { driver = static args = nopasssword=y proxy=y proxy_mech=xoauth2 ... } It works fine. So far so good. But with proxy authentication It does not work. Many clients don't support Oauth2, so Dovecot needs to authenticate for them. Please tell me how to set up Dovecot Proxy with OAuth2. Reference https://doc.dovecot.org/configuration_manual/authentication/oauth2/ Dovecot 2.3.8 HAL Pyoco

1 0

How to enable LDAP authentication for schema SSHA384
by Ralph Seichter 08 Nov '21

08 Nov '21

While using LDAP-based authentication, I have come across the message auth: Error: [...] Unknown scheme SSHA384 Based on the docs at [1] I use the dovecot.org packages provided for Ubuntu 20.04 LTS which, as you can see, are not yet documented in the HTML page, put are available via [2]. Specifically, I used apt-get install dovecot-ldap dovecot-sqlite to install Dovecot. What else is needed beyond the two listed packages in order to enable support for SSHA384 password hashes in Dovecot? Am I perhaps missing some required configuration parameter? Your help is appreciated. -Ralph [1] https://doc.dovecot.org/installation_guide/dovecot_community_repositories/u… [2] http://repo.dovecot.org/ce-2.3-latest/ubuntu/focal/

3 4

auth-cache on disk?
by Przemysław Kwiatkowski 07 Nov '21

07 Nov '21

Hello, As far as I understand - auth cache it stored in memory, isn't it? Is there a way for it to survive Dovecot restart? -- Przemyslaw Kwiatkowski

4 6

Unable to find mail
by Rob Campbell 06 Nov '21

06 Nov '21

I just installed dovecot and it seems to be working well except I can't find where my new mail is being stored. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ In all things, Be Intentional.

2 1

Moving old emails to Gmail
by Rob Campbell 06 Nov '21

06 Nov '21

I have a backup of mail messages I have from back when i was in school using pine and I want to have them imported to my Gmail. So I set up dovecot and my Gmail can access it just fine but it can't find anything except my inbox (which I can't even find). I've moved my mail directory and I can view the emails using alpine but I cannot view my inbox using alpine. Also, although Gmail can get my new test messages, it can't find the messages in ~/mail where I am viewing them with alpine. How do I make it so Gmail can pull from ~/mail or ~/Maildir because I also converted the messages in ~/mail to ~/Maildir format but although I've tried mail_location = mbox:~/mail mail_location = mbox:~/Maildir mail_location = maildir:~/mail and mail_location = maildir:~/Maildir None of this worked but mail_location = maildir:~/Maildir is the only one that will at least allow me to get test messages in my inbox which Gmail can then pull. How do I resolve these issues? ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ In all things, Be Intentional.

2 1

stale (?) .dovecot.svbin causing segfault in dovecot-lda
by Matthieu Herrb 05 Nov '21

05 Nov '21

Hi, I've not touched the sieve filters I'm using for a long time (last modification 2 years ago), but I've upgraded the dovecot package and the system of my mail server. ~/.dovecot.svbin has not been updated, but I found out today that it would cause dovecot-lda to crash on some specifig messages (and fail to deliver them). Most of the mails (>99.9%) are delivered ok though. Here's the trace of the crash in the system logs : Nov 3 08:48:13 nowhere dovecot: lda(matthieu)<33178><DvDOErY+gmGagQAAB9SSGw>: Panic: Buffer write out of range (0 + 1) Nov 3 08:48:15 nowhere smtpd[37379]: ac2aaecba4099baa mda delivery evpid=b9346ef1d2a6c223 from=<REDACTED> to=<matthieu(a)herrb.eu> rcpt=<matthieu(a)herrb.eu> user=matthieu delay=12s result=PermFail stat=Error ("Abort trap (core dumped) ") After removing the old file, dovecot-lda is able to deliver the message that caused the crash whitout issues. Shouldn't ~/.dovecot.svbin be automatically be re-generated on dovecot version changes ? or is it dependant on other things (like system libs changing) ? Some details: I'm running OpenBSD (7.0 right now, was 6.9 before and probably 6.5 the last time .dovecot.svbin was generated). My logs show that the issue has also been happening with OpenBSD 6.9, but I never noticed until today). OpenSMTP is configured to deliver the message through dovecot-lda with: action "deliver" \ mda "/usr/local/libexec/dovecot/dovecot-lda" \ alias <aliases> in /etc/mail/smtpd.conf Below is the output of doveadm config : # 2.3.16 (7e2e900c1a): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.16 (09c29328) # OS: OpenBSD 7.0 amd64 ffs # Hostname: nowhere.herrb.eu # NOTE: Send doveconf -n output instead when asking for help. auth_anonymous_username = anonymous auth_cache_negative_ttl = 1 hours auth_cache_size = 0 auth_cache_ttl = 1 hours auth_cache_verify_password_with_worker = no auth_debug = no auth_debug_passwords = no auth_default_realm = auth_failure_delay = 2 secs auth_gssapi_hostname = auth_krb5_keytab = auth_master_user_separator = auth_mechanisms = plain auth_policy_check_after_auth = yes auth_policy_check_before_auth = yes auth_policy_hash_mech = sha256 auth_policy_hash_nonce = auth_policy_hash_truncate = 12 auth_policy_log_only = no auth_policy_reject_on_fail = no auth_policy_report_after_auth = yes auth_policy_request_attributes = login=%{requested_username} pwhash=%{hashed_password} remote=%{rip} device_id=%{client_id} protocol=%s session_id=%{session} auth_policy_server_api_header = auth_policy_server_timeout_msecs = 2000 auth_policy_server_url = auth_proxy_self = auth_realms = auth_socket_path = auth-userdb auth_ssl_require_client_cert = no auth_ssl_username_from_cert = no auth_stats = no auth_use_winbind = no auth_username_chars = abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ01234567890.-_@ auth_username_format = %Lu auth_username_translation = auth_verbose = yes auth_verbose_passwords = no auth_winbind_helper_path = /usr/bin/ntlm_auth auth_worker_max_count = 30 base_dir = /var/dovecot config_cache_size = 1 M debug_log_path = default_client_limit = 500 default_idle_kill = 1 mins default_internal_group = _dovecot default_internal_user = _dovecot default_login_user = _dovenull default_process_limit = 100 default_vsz_limit = 256 M deliver_log_format = msgid=%m: %$ dict_db_config = director_flush_socket = director_mail_servers = director_max_parallel_kicks = 100 director_max_parallel_moves = 100 director_output_buffer_size = 10 M director_ping_idle_timeout = 30 secs director_ping_max_timeout = 1 mins director_servers = director_user_expire = 15 mins director_user_kick_delay = 2 secs director_username_hash = %u disable_plaintext_auth = yes dotlock_use_excl = yes doveadm_allowed_commands = doveadm_api_key = doveadm_http_rawlog_dir = doveadm_password = doveadm_port = 0 doveadm_socket_path = doveadm-server doveadm_ssl = no doveadm_username = doveadm doveadm_worker_count = 0 dsync_alt_char = _ dsync_commit_msgs_interval = 100 dsync_features = dsync_hashed_headers = Date Message-ID dsync_remote_cmd = ssh -l%{login} %{host} doveadm dsync-server -u%u -U first_valid_gid = 1 first_valid_uid = 1000 haproxy_timeout = 3 secs haproxy_trusted_networks = hostname = imap_capability = imap_client_workarounds = imap_fetch_failure = disconnect-immediately imap_hibernate_timeout = 0 imap_id_log = imap_id_retain = no imap_id_send = name * imap_idle_notify_interval = 2 mins imap_literal_minus = no imap_logout_format = in=%i out=%o deleted=%{deleted} expunged=%{expunged} trashed=%{trashed} hdr_count=%{fetch_hdr_count} hdr_bytes=%{fetch_hdr_bytes} body_count=%{fetch_body_count} body_bytes=%{fetch_body_bytes} imap_max_line_length = 64 k imap_metadata = no imap_urlauth_host = imap_urlauth_logout_format = in=%i out=%o imap_urlauth_port = 143 imapc_cmd_timeout = 5 mins imapc_connection_retry_count = 1 imapc_connection_retry_interval = 1 secs imapc_features = imapc_host = imapc_list_prefix = imapc_master_user = imapc_max_idle_time = 29 mins imapc_max_line_length = 0 imapc_password = imapc_port = 143 imapc_rawlog_dir = imapc_sasl_mechanisms = imapc_ssl = no imapc_ssl_verify = yes imapc_user = import_environment = TZ CORE_OUTOFMEM CORE_ERROR info_log_path = instance_name = dovecot last_valid_gid = 0 last_valid_uid = 0 lda_mailbox_autocreate = yes lda_mailbox_autosubscribe = yes lda_original_recipient_header = libexec_dir = /usr/local/libexec/dovecot listen = *, :: lmtp_add_received_header = yes lmtp_client_workarounds = lmtp_hdr_delivery_address = final lmtp_proxy = no lmtp_proxy_rawlog_dir = lmtp_rawlog_dir = lmtp_rcpt_check_quota = no lmtp_save_to_detail_mailbox = no lmtp_user_concurrency_limit = 0 lock_method = fcntl log_core_filter = log_debug = log_path = syslog log_timestamp = "%b %d %H:%M:%S " login_access_sockets = login_greeting = Dovecot ready. login_log_format = %$: %s login_log_format_elements = user=<%u> method=%m rip=%r lip=%l mpid=%e %c session=<%{session}> login_plugin_dir = /usr/local/lib/dovecot/login login_plugins = login_proxy_max_disconnect_delay = 0 login_proxy_max_reconnects = 3 login_proxy_notify_path = proxy-notify login_proxy_timeout = 30 secs login_source_ips = login_trusted_networks = mail_access_groups = mail_always_cache_fields = mail_attachment_detection_options = mail_attachment_dir = mail_attachment_fs = sis posix mail_attachment_hash = %{sha1} mail_attachment_min_size = 128 k mail_attribute_dict = mail_cache_fields = flags mail_cache_min_mail_count = 0 mail_chroot = mail_debug = no mail_fsync = optimized mail_full_filesystem_access = no mail_gid = mail_home = mail_location = maildir:/var/mail/Maildir/%u:INDEX=/var/mail/indexes/%u mail_log_prefix = "%s(%u)<%{pid}><%{session}>: " mail_max_keyword_length = 50 mail_max_lock_timeout = 0 mail_max_userip_connections = 10 mail_never_cache_fields = imap.envelope mail_nfs_index = no mail_nfs_storage = no mail_plugin_dir = /usr/local/lib/dovecot mail_plugins = mail_prefetch_count = 0 mail_privileged_group = mail_save_crlf = no mail_server_admin = mail_server_comment = mail_shared_explicit_inbox = no mail_sort_max_read_count = 0 mail_temp_dir = /tmp mail_temp_scan_interval = 1 weeks mail_uid = mail_vsize_bg_after_count = 0 mailbox_idle_check_interval = 30 secs mailbox_list_index = yes mailbox_list_index_include_inbox = no mailbox_list_index_very_dirty_syncs = no maildir_broken_filename_sizes = no maildir_copy_with_hardlinks = yes maildir_empty_new = no maildir_stat_dirs = no maildir_very_dirty_syncs = no managesieve_client_workarounds = managesieve_implementation_string = Dovecot Pigeonhole managesieve_logout_format = bytes=%i/%o managesieve_max_compile_errors = 5 managesieve_max_line_length = 64 k managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext master_user_separator = mbox_dirty_syncs = yes mbox_dotlock_change_timeout = 2 mins mbox_lazy_writes = yes mbox_lock_timeout = 5 mins mbox_md5 = apop3d mbox_min_index_size = 0 mbox_read_locks = fcntl mbox_very_dirty_syncs = no mbox_write_locks = fcntl mdbox_preallocate_space = no mdbox_rotate_interval = 0 mdbox_rotate_size = 10 M mmap_disable = yes namespace inbox { disabled = no hidden = no ignore_on_failure = no inbox = yes list = yes location = mailbox Drafts { auto = no autoexpunge = 0 autoexpunge_max_mails = 0 comment = driver = special_use = \Drafts } mailbox Junk { auto = no autoexpunge = 0 autoexpunge_max_mails = 0 comment = driver = special_use = \Junk } mailbox Sent { auto = no autoexpunge = 0 autoexpunge_max_mails = 0 comment = driver = special_use = \Sent } mailbox "Sent Messages" { auto = no autoexpunge = 0 autoexpunge_max_mails = 0 comment = driver = special_use = \Sent } mailbox Trash { auto = no autoexpunge = 0 autoexpunge_max_mails = 0 comment = driver = special_use = \Trash } order = 0 prefix = separator = / subscriptions = yes type = private } old_stats_carbon_interval = 30 secs old_stats_carbon_name = old_stats_carbon_server = old_stats_command_min_time = 1 mins old_stats_domain_min_time = 12 hours old_stats_ip_min_time = 12 hours old_stats_memory_limit = 16 M old_stats_session_min_time = 15 mins old_stats_user_min_time = 1 hours passdb { args = auth_verbose = default default_fields = deny = no driver = bsdauth master = no mechanisms = name = override_fields = pass = no result_failure = continue result_internalfail = continue result_success = return-ok skip = never username_filter = } plugin { sieve = file:~/sieve;active=~/.dovecot.sieve } pop3_client_workarounds = pop3_delete_type = default pop3_deleted_flag = pop3_enable_last = no pop3_fast_size_lookups = no pop3_lock_session = no pop3_logout_format = top=%t/%p, retr=%r/%b, del=%d/%m, size=%s pop3_no_flag_updates = no pop3_reuse_xuidl = no pop3_save_uidl = no pop3_uidl_duplicates = allow pop3_uidl_format = %08Xu%08Xv pop3c_features = pop3c_host = pop3c_master_user = pop3c_password = pop3c_port = 110 pop3c_quick_received_date = no pop3c_rawlog_dir = pop3c_ssl = no pop3c_ssl_verify = yes pop3c_user = %u postmaster_address = postmaster@%{if;%d;ne;;%d;%{hostname}} protocols = imap lmtp sieve quota_full_tempfail = no rawlog_dir = recipient_delimiter = + rejection_reason = Your message to <%t> was automatically rejected:%n%r rejection_subject = Rejected: %s replication_dsync_parameters = -d -N -l 30 -U replication_full_sync_interval = 1 days replication_max_conns = 10 replicator_host = replicator replicator_port = 0 sendmail_path = /usr/sbin/sendmail service aggregator { chroot = . client_limit = 0 drop_priv_before_exec = no executable = aggregator extra_groups = fifo_listener replication-notify-fifo { group = mode = 0600 user = } group = idle_kill = 0 privileged_group = process_limit = 0 process_min_avail = 0 protocol = service_count = 0 type = unix_listener replication-notify { group = mode = 0600 user = } user = $default_internal_user vsz_limit = 18446744073709551615 B } service anvil { chroot = empty client_limit = 0 drop_priv_before_exec = no executable = anvil extra_groups = group = idle_kill = 4294967295 secs privileged_group = process_limit = 1 process_min_avail = 1 protocol = service_count = 0 type = anvil unix_listener anvil-auth-penalty { group = mode = 0600 user = } unix_listener anvil { group = mode = 0600 user = } user = $default_internal_user vsz_limit = 18446744073709551615 B } service auth-worker { chroot = client_limit = 1 drop_priv_before_exec = no executable = auth -w extra_groups = group = idle_kill = 0 privileged_group = process_limit = 0 process_min_avail = 0 protocol = service_count = 0 type = worker unix_listener auth-worker { group = mode = 0600 user = $default_internal_user } user = vsz_limit = 18446744073709551615 B } service auth { chroot = client_limit = 0 drop_priv_before_exec = no executable = auth extra_groups = group = idle_kill = 0 privileged_group = process_limit = 1 process_min_avail = 0 protocol = service_count = 0 type = unix_listener auth-client { group = mode = 0600 user = $default_internal_user } unix_listener auth-login { group = mode = 0600 user = $default_internal_user } unix_listener auth-master { group = mode = 0600 user = } unix_listener auth-userdb { group = mode = 0666 user = $default_internal_user } unix_listener login/login { group = mode = 0666 user = } unix_listener token-login/tokenlogin { group = mode = 0666 user = } user = $default_internal_user vsz_limit = 18446744073709551615 B } service config { chroot = client_limit = 0 drop_priv_before_exec = no executable = config extra_groups = group = idle_kill = 4294967295 secs privileged_group = process_limit = 0 process_min_avail = 0 protocol = service_count = 0 type = config unix_listener config { group = mode = 0600 user = } user = vsz_limit = 18446744073709551615 B } service dict-async { chroot = client_limit = 0 drop_priv_before_exec = no executable = dict extra_groups = group = idle_kill = 0 privileged_group = process_limit = 0 process_min_avail = 0 protocol = service_count = 0 type = unix_listener dict-async { group = $default_internal_group mode = 0660 user = } user = $default_internal_user vsz_limit = 18446744073709551615 B } service dict { chroot = client_limit = 1 drop_priv_before_exec = no executable = dict extra_groups = group = idle_kill = 0 privileged_group = process_limit = 0 process_min_avail = 0 protocol = service_count = 0 type = unix_listener dict { group = $default_internal_group mode = 0660 user = } user = $default_internal_user vsz_limit = 18446744073709551615 B } service director { chroot = . client_limit = 0 drop_priv_before_exec = no executable = director extra_groups = fifo_listener login/proxy-notify { group = mode = 00 user = } group = idle_kill = 4294967295 secs inet_listener { address = haproxy = no port = 0 reuse_port = no ssl = no } privileged_group = process_limit = 1 process_min_avail = 0 protocol = service_count = 0 type = unix_listener director-admin { group = mode = 0600 user = } unix_listener director-userdb { group = mode = 0600 user = } unix_listener login/director { group = mode = 00 user = } user = $default_internal_user vsz_limit = 18446744073709551615 B } service dns-client { chroot = client_limit = 1 drop_priv_before_exec = no executable = dns-client extra_groups = group = idle_kill = 0 privileged_group = process_limit = 0 process_min_avail = 0 protocol = service_count = 0 type = unix_listener dns-client { group = mode = 0666 user = } unix_listener login/dns-client { group = mode = 0666 user = } user = $default_internal_user vsz_limit = 18446744073709551615 B } service doveadm { chroot = client_limit = 1 drop_priv_before_exec = no executable = doveadm-server extra_groups = $default_internal_group group = idle_kill = 0 privileged_group = process_limit = 0 process_min_avail = 0 protocol = service_count = 1 type = unix_listener doveadm-server { group = mode = 0600 user = } user = vsz_limit = 18446744073709551615 B } service health-check { chroot = client_limit = 1 drop_priv_before_exec = yes executable = script -p health-check.sh extra_groups = group = idle_kill = 0 privileged_group = process_limit = 0 process_min_avail = 0 protocol = service_count = 0 type = user = $default_internal_user vsz_limit = 18446744073709551615 B } service imap-hibernate { chroot = client_limit = 0 drop_priv_before_exec = no executable = imap-hibernate extra_groups = group = idle_kill = 0 privileged_group = process_limit = 0 process_min_avail = 0 protocol = imap service_count = 0 type = unix_listener imap-hibernate { group = $default_internal_group mode = 0660 user = } user = $default_internal_user vsz_limit = 18446744073709551615 B } service imap-login { chroot = login client_limit = 0 drop_priv_before_exec = no executable = imap-login extra_groups = group = idle_kill = 0 inet_listener imap { address = haproxy = no port = 0 reuse_port = no ssl = no } inet_listener imaps { address = haproxy = no port = 993 reuse_port = no ssl = yes } privileged_group = process_limit = 0 process_min_avail = 0 protocol = imap service_count = 1 type = login user = $default_login_user vsz_limit = 18446744073709551615 B } service imap-urlauth-login { chroot = token-login client_limit = 0 drop_priv_before_exec = no executable = imap-urlauth-login extra_groups = group = idle_kill = 0 privileged_group = process_limit = 0 process_min_avail = 0 protocol = imap service_count = 1 type = login unix_listener imap-urlauth { group = mode = 0666 user = } user = $default_login_user vsz_limit = 18446744073709551615 B } service imap-urlauth-worker { chroot = client_limit = 1 drop_priv_before_exec = no executable = imap-urlauth-worker extra_groups = $default_internal_group group = idle_kill = 0 privileged_group = process_limit = 1024 process_min_avail = 0 protocol = imap service_count = 1 type = unix_listener imap-urlauth-worker { group = mode = 0600 user = $default_internal_user } user = vsz_limit = 18446744073709551615 B } service imap-urlauth { chroot = client_limit = 1 drop_priv_before_exec = no executable = imap-urlauth extra_groups = group = idle_kill = 0 privileged_group = process_limit = 1024 process_min_avail = 0 protocol = imap service_count = 1 type = unix_listener token-login/imap-urlauth { group = mode = 0666 user = } user = $default_internal_user vsz_limit = 18446744073709551615 B } service imap { chroot = client_limit = 1 drop_priv_before_exec = no executable = imap extra_groups = $default_internal_group group = idle_kill = 0 privileged_group = process_limit = 1024 process_min_avail = 0 protocol = imap service_count = 1 type = unix_listener imap-master { group = mode = 0600 user = } unix_listener login/imap { group = mode = 0666 user = } user = vsz_limit = 18446744073709551615 B } service indexer-worker { chroot = client_limit = 1 drop_priv_before_exec = no executable = indexer-worker extra_groups = $default_internal_group group = idle_kill = 0 privileged_group = process_limit = 10 process_min_avail = 0 protocol = service_count = 0 type = worker unix_listener indexer-worker { group = mode = 0600 user = $default_internal_user } user = vsz_limit = 18446744073709551615 B } service indexer { chroot = client_limit = 0 drop_priv_before_exec = no executable = indexer extra_groups = group = idle_kill = 0 privileged_group = process_limit = 1 process_min_avail = 0 protocol = service_count = 0 type = unix_listener indexer { group = mode = 0666 user = } user = $default_internal_user vsz_limit = 18446744073709551615 B } service ipc { chroot = empty client_limit = 0 drop_priv_before_exec = no executable = ipc extra_groups = group = idle_kill = 0 privileged_group = process_limit = 1 process_min_avail = 0 protocol = service_count = 0 type = unix_listener ipc { group = mode = 0600 user = $default_internal_user } unix_listener login/ipc-proxy { group = mode = 0600 user = $default_login_user } user = $default_internal_user vsz_limit = 18446744073709551615 B } service lmtp { chroot = client_limit = 1 drop_priv_before_exec = no executable = lmtp extra_groups = $default_internal_group group = idle_kill = 0 privileged_group = process_limit = 0 process_min_avail = 0 protocol = lmtp service_count = 0 type = unix_listener lmtp { group = mode = 0666 user = } user = vsz_limit = 18446744073709551615 B } service log { chroot = client_limit = 0 drop_priv_before_exec = no executable = log extra_groups = group = idle_kill = 4294967295 secs privileged_group = process_limit = 1 process_min_avail = 0 protocol = service_count = 0 type = log unix_listener log-errors { group = mode = 0600 user = } user = vsz_limit = 18446744073709551615 B } service managesieve-login { chroot = login client_limit = 0 drop_priv_before_exec = no executable = managesieve-login extra_groups = group = idle_kill = 0 inet_listener sieve { address = haproxy = no port = 4190 reuse_port = no ssl = no } privileged_group = process_limit = 0 process_min_avail = 0 protocol = sieve service_count = 1 type = login user = $default_login_user vsz_limit = 18446744073709551615 B } service managesieve { chroot = client_limit = 1 drop_priv_before_exec = no executable = managesieve extra_groups = group = idle_kill = 0 privileged_group = process_limit = 0 process_min_avail = 0 protocol = sieve service_count = 1 type = unix_listener login/sieve { group = mode = 0666 user = } user = vsz_limit = 18446744073709551615 B } service old-stats { chroot = empty client_limit = 0 drop_priv_before_exec = no executable = old-stats extra_groups = fifo_listener old-stats-mail { group = mode = 0600 user = } fifo_listener old-stats-user { group = mode = 0600 user = } group = idle_kill = 4294967295 secs privileged_group = process_limit = 1 process_min_avail = 0 protocol = service_count = 0 type = unix_listener old-stats { group = mode = 0600 user = } user = $default_internal_user vsz_limit = 18446744073709551615 B } service pop3-login { chroot = login client_limit = 0 drop_priv_before_exec = no executable = pop3-login extra_groups = group = idle_kill = 0 inet_listener pop { address = haproxy = no port = 0 reuse_port = no ssl = no } inet_listener pop3 { address = haproxy = no port = 110 reuse_port = no ssl = no } inet_listener pop3s { address = haproxy = no port = 995 reuse_port = no ssl = yes } privileged_group = process_limit = 0 process_min_avail = 0 protocol = pop3 service_count = 1 type = login user = $default_login_user vsz_limit = 18446744073709551615 B } service pop3 { chroot = client_limit = 1 drop_priv_before_exec = no executable = pop3 extra_groups = $default_internal_group group = idle_kill = 0 privileged_group = process_limit = 1024 process_min_avail = 0 protocol = pop3 service_count = 1 type = unix_listener login/pop3 { group = mode = 0666 user = } user = vsz_limit = 18446744073709551615 B } service replicator { chroot = client_limit = 0 drop_priv_before_exec = no executable = replicator extra_groups = group = idle_kill = 4294967295 secs privileged_group = process_limit = 1 process_min_avail = 0 protocol = service_count = 0 type = unix_listener replicator-doveadm { group = mode = 00 user = $default_internal_user } unix_listener replicator { group = mode = 0600 user = $default_internal_user } user = vsz_limit = 18446744073709551615 B } service stats { chroot = client_limit = 0 drop_priv_before_exec = no executable = stats extra_groups = group = idle_kill = 4294967295 secs privileged_group = process_limit = 1 process_min_avail = 0 protocol = service_count = 0 type = unix_listener stats-reader { group = mode = 0600 user = } unix_listener stats-writer { group = $default_internal_group mode = 0666 user = } user = $default_internal_user vsz_limit = 18446744073709551615 B } service submission-login { chroot = login client_limit = 0 drop_priv_before_exec = no executable = submission-login extra_groups = group = idle_kill = 0 inet_listener submission { address = haproxy = no port = 587 reuse_port = no ssl = no } privileged_group = process_limit = 0 process_min_avail = 0 protocol = submission service_count = 1 type = login user = $default_login_user vsz_limit = 18446744073709551615 B } service submission { chroot = client_limit = 1 drop_priv_before_exec = no executable = submission extra_groups = $default_internal_group group = idle_kill = 0 privileged_group = process_limit = 1024 process_min_avail = 0 protocol = submission service_count = 1 type = unix_listener login/submission { group = mode = 0666 user = } user = vsz_limit = 18446744073709551615 B } shutdown_clients = yes ssl = yes ssl_alt_cert = ssl_alt_key = ssl_ca = ssl_cert = </etc/ssl/herrb.eu.fullchain.pem ssl_cert_username_field = commonName ssl_cipher_list = ALL:!kRSA:!SRP:!kDHd:!DSS:!aNULL:!eNULL:!EXPORT:!DES:!3DES:!MD5:!PSK:!RC4:!ADH:!LOW@STRENGTH ssl_cipher_suites = ssl_client_ca_dir = ssl_client_ca_file = ssl_client_cert = ssl_client_key = ssl_client_require_valid_cert = yes ssl_crypto_device = ssl_curve_list = ssl_dh = # hidden, use -P to show it ssl_key = # hidden, use -P to show it ssl_key_password = ssl_min_protocol = TLSv1.2 ssl_options = ssl_prefer_server_ciphers = no ssl_require_crl = yes ssl_verify_client_cert = no state_dir = /var/dovecot stats_http_rawlog_dir = stats_writer_socket_path = stats-writer submission_client_workarounds = submission_host = submission_logout_format = in=%i out=%o submission_max_mail_size = 0 submission_max_recipients = 0 submission_relay_command_timeout = 5 mins submission_relay_connect_timeout = 30 secs submission_relay_host = submission_relay_master_user = submission_relay_max_idle_time = 29 mins submission_relay_password = submission_relay_port = 25 submission_relay_rawlog_dir = submission_relay_ssl = no submission_relay_ssl_verify = yes submission_relay_trusted = no submission_relay_user = submission_ssl = no submission_timeout = 30 secs syslog_facility = mail userdb { args = auth_verbose = default default_fields = driver = passwd name = override_fields = result_failure = continue result_internalfail = continue result_success = return-ok skip = never } valid_chroot_dirs = verbose_proctitle = no verbose_ssl = yes version_ignore = no protocol lmtp { mail_plugins = " sieve" } protocol lda { mail_plugins = " sieve" } -- Matthieu Herrb

2 1

dsync-trouble
by Hanns Mattes 05 Nov '21

05 Nov '21

Hi, dsync and replication are failing. They used to work, so I guess, it might be related to the update to 2.3.17. This is a fresh install of Freebsd 13. Please let me know, if further Information is needed (I haven't follow Odhiambos advice from another thread yet, but will follow, if requested) With replication-plugin disabled: # doveadm sync -u xxx(a)zzz.de tcps:mail.bruecko.de doveadm(xxx(a)zzz.de): Panic: file array.c: line 10 (array_idx_modifiable_i): assertion failed: (idx < array->buffer->used / array->element_size) Abort enabled plugin (btw: what makes dovecot trying to sync accounts on a fresh install, though the other server isn't configured to replicate with freebsd.bruecko.de): Nov 3 19:08:28 freebsd dovecot[68537]: doveadm(x.zzzz(a)yyy.de)<91733><IT8dBxzQgmFVZgEAA4a8sQ>: Fatal: master: service(doveadm): child 91733 killed with signal 6 (core not dumped - https://dovecot.org/bugreport.html#coredumps) I didn't follow Odhiambos advice from another thread yet, but do, if requested. Any help appreciated doveconf -n: # 2.3.17 (e2aa53df5b): /usr/local/etc/dovecot/dovecot.conf # Pigeonhole version 0.5.17 (054dddfa) # OS: FreeBSD 13.0-RELEASE-p4 amd64 # Hostname: freebsd.bruecko.de auth_master_user_separator = * auth_mechanisms = plain login digest-md5 cram-md5 apop auth_username_chars = abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ01234567890+.-_@ auth_verbose = yes doveadm_password = # hidden, use -P to show it doveadm_port = 54321 lda_mailbox_autocreate = yes lda_mailbox_autosubscribe = yes lda_original_recipient_header = X-Original-To lmtp_save_to_detail_mailbox = yes mail_location = mdbox:~/mdbox mail_plugins = " quota fts fts_xapian zlib notify acl" managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext namespace { hidden = no ignore_on_failure = no inbox = no list = children location = mdbox:%%h/mdbox prefix = shared/%%u/ separator = / subscriptions = yes type = shared } namespace { location = mdbox:/virtualmail/public:INDEXPVT=%h/mdbox/Public prefix = Public/ separator = / subscriptions = yes type = public } namespace inbox { inbox = yes location = mailbox Drafts { auto = subscribe special_use = \Drafts } mailbox Sent { auto = subscribe special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { auto = subscribe special_use = \Trash } prefix = INBOX/ separator = / } passdb { args = /usr/local/etc/dovecot/master-users driver = passwd-file master = yes pass = yes } passdb { args = /usr/local/etc/dovecot/dovecot-ldap.conf.ext driver = ldap } plugin { acl = vfile acl_anyone = allow acl_shared_dict = file:/virtualmail/shared-mailboxes.db fts = xapian fts_autoindex = yes fts_autoindex_exclude = \Trash fts_enforced = yes fts_xapian = partial=3 full=20 verbose=0 mail_replica = tcps:mail.bruecko.de quota = dict:User quota::file:%h/dovecot-quota quota_exceeded_message = Storage quota for this account has been exceeded, please try again later. quota_grace = 250M quota_rule = *:storage=2500M quota_rule2 = INBOX/Trash:storage=+10%% quota_status_nouser = DUNNO quota_status_overquota = 552 5.2.2 Mailbox is full / Mailbox ist voll quota_status_success = DUNNO quota_warning = storage=95%% quota-warning 95 %u quota_warning2 = storage=80%% quota-warning 80 %u quota_warning3 = storage=75%% quota-warning 75 %u sieve = ~/dovecot.sieve sieve_dir = ~/sieve sieve_global_dir = /virtualmail sieve_max_actions = 0 sieve_max_redirects = 64 sieve_max_script_size = 0 sieve_quota_max_scripts = 0 trash = /usr/local/etc/dovecot/dovecot-trash.conf.ext } postmaster_address = postmaster(a)bruecko.de protocols = imap pop3 lmtp sieve replication_dsync_parameters = -d -N -l 30 -U -x Public service aggregator { fifo_listener replication-notify-fifo { user = vmail } unix_listener replication-notify { user = vmail } } service auth { unix_listener /var/spool/postfix/private/auth { mode = 0666 } unix_listener auth-userdb { group = vmail user = vmail } } service decode2text { executable = script /usr/local/libexec/dovecot/decode2text.sh unix_listener decode2text { mode = 0666 } user = dovecot } service doveadm { drop_priv_before_exec = yes inet_listener { port = 54321 ssl = yes } vsz_limit = 0 } service imap-login { inet_listener imap { port = 143 } inet_listener imaps { port = 993 ssl = yes } } service indexer-worker { vsz_limit = 2 G } service lmtp { inet_listener lmtp { address = 127.0.0.1 port = 24 } user = vmail } service managesieve-login { inet_listener sieve { port = 4190 } inet_listener sieve_deprecated { port = 2000 } } service pop3-login { inet_listener pop3 { port = 110 } inet_listener pop3s { port = 995 ssl = yes } } service quota-status { client_limit = 1 executable = quota-status -p postfix inet_listener { port = 12340 } } service quota-warning { executable = script /usr/local/bin/quota-warning.sh unix_listener quota-warning { user = vmail } user = vmail } service replicator { process_min_avail = 1 unix_listener replicator-doveadm { mode = 0666 } } ssl_cert = </test/letsencrypt/live/bruecko.de/fullchain.pem ssl_cipher_list = ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA ssl_client_ca_dir = /etc/ssl/certs ssl_key = # hidden, use -P to show it ssl_prefer_server_ciphers = yes userdb { driver = prefetch } userdb { args = /usr/local/etc/dovecot/dovecot-ldap.conf.ext driver = ldap } verbose_proctitle = yes protocol lmtp { mail_plugins = " quota fts fts_xapian zlib notify acl sieve" } protocol lda { mail_plugins = " quota fts fts_xapian zlib notify acl sieve" } protocol imap { mail_plugins = " quota fts fts_xapian zlib notify acl imap_quota imap_zlib imap_acl" }

3 12

Recovering deleted messages?
by Sean McBride 05 Nov '21

05 Nov '21

Hi all, I've run postfix and dovecot for years, but they have been so trouble-free that I've never really learned in-depth how they work. :) But now I have a user who accidentally used a POP client, and it deleted all his email. He told me this only days later, and it's now been days later still, and so of course he has sent and received email since. I have backups of course, but it is a feasible thing to 'merge' the deleted emails from the backup into his current mailboxes? I couldn't find any FAQ for such a scenario, so thought I'd ask here... Thanks, Sean

5 5

mail_location for doveadm?
by Grant Keller 05 Nov '21

05 Nov '21

Hello, I am working on getting doveadm commands working from a director to a backend server and I am hitting a bit of a roadblock. We use a homebrew hashing algorithm for mail_location, which we set for users in postlogin scripts. Works fine except I get the following when I run doveadm on a user: # doveadm -D expunge -u gvk mailbox INBOX.Trash SENTBEFORE 1-Jan-2021Debug: Loading modules from directory: /usr/lib64/dovecot/doveadm Debug: Skipping module doveadm_acl_plugin, because dlopen() failed: /usr/lib64/dovecot/doveadm/lib10_doveadm_acl_plugin.so: undefined symbol: acl_user_module (this is usually intentional, so just ignore this message) Debug: Skipping module doveadm_expire_plugin, because dlopen() failed: /usr/lib64/dovecot/doveadm/lib10_doveadm_expire_plugin.so: undefined symbol: expire_set_deinit (this is usually intentional, so just ignore this message) Debug: Skipping module doveadm_quota_plugin, because dlopen() failed: /usr/lib64/dovecot/doveadm/lib10_doveadm_quota_plugin.so: undefined symbol: quota_user_module (this is usually intentional, so just ignore this message) Debug: Skipping module doveadm_fts_lucene_plugin, because dlopen() failed: /usr/lib64/dovecot/doveadm/lib20_doveadm_fts_lucene_plugin.so: undefined symbol: lucene_index_iter_deinit (this is usually intentional, so just ignore this message) Debug: Skipping module doveadm_fts_plugin, because dlopen() failed: /usr/lib64/dovecot/doveadm/lib20_doveadm_fts_plugin.so: undefined symbol: fts_user_get_language_list (this is usually intentional, so just ignore this message) Debug: Skipping module doveadm_mail_crypt_plugin, because dlopen() failed: /usr/lib64/dovecot/doveadm/libdoveadm_mail_crypt_plugin.so: undefined symbol: mail_crypt_box_get_pvt_digests (this is usually intentional, so just ignore this message) doveadm(gvk): Debug: auth-master: passdb lookup(gvk): Started passdb lookup doveadm(gvk): Debug: auth-master: conn unix:/var/run/dovecot/director-userdb: Connecting doveadm(gvk): Debug: auth-master: conn unix:/var/run/dovecot/director-userdb (pid=21984,uid=0): Client connected (fd=11) doveadm(gvk): Debug: auth-master: passdb lookup(gvk): auth PASS input: user=gvk proxy=y proxy_refresh=450 host=c.lab.imapd.sonic.net hostip=184.23.168.77 doveadm(gvk): Debug: auth-master: passdb lookup(gvk): Finished passdb lookup (user=gvk proxy=y proxy_refresh=450 host=c.lab.imapd.sonic.net hostip=184.23.168.77) doveadm(gvk): Error: remote(c.lab.imapd.sonic.net:1842): mail_location not set and autodetection failed: Mail storage autodetection failed with home=/home2/22/25/gvk doveadm(gvk): Debug: auth-master: conn unix:/var/run/dovecot/director-userdb (pid=21984,uid=0): Disconnected: Connection closed (fd=11) I don't see anything like a doveadm-postlogin service in the documentation, so how would I go about making this work. Grant Keller System Operations grant.keller(a)sonic.com

2 1

Memory leaks in dovecot
by Joan Moreau 04 Nov '21

04 Nov '21

Hi Anyone can help on those memory leaks since 2.3.17 ? These came after adding the fts_mail_user_init(user, FALSE, &error) and fts_mail_user_deinit(user) function calls to avoid breaking due to change in the API Thank you for help doveadm: Warning: Event 0x5563f3f2b740 leaked (parent=0x5563f3f2b330): mail-user.c:78 doveadm: Warning: Event 0x5563f3f2b330 leaked (parent=(nil)): mail-storage-service.c:1359 doveadm: Warning: Event 0x5563f4009ef0 leaked (parent=0x5563f3f4cf80): mail-index.c:67 doveadm: Warning: Event 0x5563f40096c0 leaked (parent=0x5563f3f4cf80): fs-api.c:32 doveadm: Warning: Event 0x5563f40092b0 leaked (parent=0x5563f3f4cf80): mail-storage.c:430 doveadm: Warning: Event 0x5563f3f4cf80 leaked (parent=0x5563f3f21f00): mail-user.c:78 doveadm: Warning: Event 0x5563f3f21f00 leaked (parent=(nil)): mail-storage-service.c:1359 doveadm: Warning: Event 0x5563f3f2d080 leaked (parent=0x5563f3f234f0): mail-index.c:67 doveadm: Warning: Event 0x5563f3f2c820 leaked (parent=0x5563f3f234f0): fs-api.c:32 doveadm: Warning: Event 0x5563f3f2c300 leaked (parent=0x5563f3f234f0): mail-storage.c:430 doveadm: Warning: Event 0x5563f3f234f0 leaked (parent=0x5563f3f4e1d0): mail-user.c:78 doveadm: Warning: Event 0x5563f3f4e1d0 leaked (parent=(nil)): mail-storage-service.c:1359 doveadm: Warning: Event 0x5563f3f24d20 leaked (parent=0x5563f3fd58b0): mail-index.c:67 doveadm: Warning: Event 0x5563f3f24620 leaked (parent=0x5563f3fd58b0): fs-api.c:32 doveadm: Warning: Event 0x5563f3f23e30 leaked (parent=0x5563f3fd58b0): mail-storage.c:430 doveadm: Warning: Event 0x5563f3fd58b0 leaked (parent=0x5563f3fd54a0): mail-user.c:78 doveadm: Warning: Event 0x5563f3fd54a0 leaked (parent=(nil)): mail-storage-service.c:1359 doveadm: Warning: Event 0x5563f3fd6df0 leaked (parent=0x5563f3fcc8a0): mail-index.c:67 doveadm: Warning: Event 0x5563f3fd65c0 leaked (parent=0x5563f3fcc8a0): fs-api.c:32 doveadm: Warning: Event 0x5563f3fd5dd0 leaked (parent=0x5563f3fcc8a0): mail-storage.c:430 doveadm: Warning: Event 0x5563f3fcc8a0 leaked (parent=0x5563f3f1c990): mail-user.c:78 doveadm: Warning: Event 0x5563f3f1c990 leaked (parent=(nil)): mail-storage-service.c:1359 doveadm: Warning: Event 0x5563f3f16a20 leaked (parent=0x5563f3fbb710): mail-index.c:67

2 1

Dovecot v2.3.17 released
by Aki Tuomi 04 Nov '21

04 Nov '21

We are pleased to release v2.3.17 of Dovecot. Please note that 2.3.17 release will be the last one to support Debian/Stretch since Bullseye is now supported. https://dovecot.org/releases/2.3/dovecot-2.3.17.tar.gz https://dovecot.org/releases/2.3/dovecot-2.3.17.tar.gz.sig Binary packages in https://repo.dovecot.org/ Docker images in https://hub.docker.com/r/dovecot/dovecot Regards Aki Tuomi Open-Xchange oy --- * Dovecot now logs a warning if time seems to jump forward at least 100 milliseconds. * dict: Lines logged by the dict process now contain the dict name as the prefix. * lib-index: mail_cache_fields, mail_always_cache_fields and mail_never_cache_fields now verifies that the listed header names are valid. Especially the UTF8 "–" character has sometimes been wrongly used instead of the ASCII "-". + *-login: Added login_proxy_rawlog_dir setting to capture rawlogs between proxy and backend. + dict: The server process now keeps the last 10 idle dict backends cached for maximum of 30 seconds. Practically this acts as a connection pool for dict-redis and dict-ldap. Note that this doesn't affect dict-sql, because it already had its own internal cache. + doveadm: New stats add/remove commands added to support changing the metrics configuration on runtime. + lazy_expunge: Added lazy_expunge_exclude settings to disable lazy_expunge for specific folders. \Special-use flags can be used as folder names. + lib-lua: Added a new helper function dovecot.restrict_global_variables() to disable or enable defining new global variables. - LAYOUT=index List index rebuild was missing. - LAYOUT=index: Duplicate GUIDs were not detected. - acl: When using acl_ignore_namespace Dovecot attempted to access or create dovecot-acl-list even when the namespace should have been ignored. For virtual namespaces this could have yielded errors about "Read-only file system" or "Permission denied". - auth: Setting the "master" passdb field to empty value would cause proxying to fail with an authentication error. Now an empty "master" field is ignored. - doveadm-server: Duplicate error lines were sent for failed commands. This didn't normally cause visible problems, except when using wildcards in usernames or -A parameter to go through multiple users. - doveadm-server: Logs written by doveadm-server were often missing log prefixes, especially mail_log_prefix for mail commands. Logs sent to doveadm TCP client were also missing log prefixes. - doveadm: v2.3 regression: batch command always crashes. - doveadm: v2.3.11 regression: Commands failed if ssl_cert or ssl_key files weren't readable by the user running doveadm, even though doveadm didn't actually use these settings - imap-hibernate: Process may crash at deinit: Panic: file ioloop.c: line 928 (io_loop_destroy): assertion failed: (ioloop->cur_ctx == NULL). - imap: Using imap_fetch_failure=no-after can cause assert-crash with some IMAP commands if reading the mail fails (e.g. wrong cached mail size). Fixes: Panic: file index-mail-headers.c: line 198 (index_mail_parse_header_init): assertion failed: (!mail->data.header_parser_initialized) - imap: v2.3.10 regression: When using INDEXPVT to enable private \Seen flags (for shared or public namespaces) the STORE command did not send untagged replies for the \Seen flag changes. - imap: v2.3.15 regression: If PREVIEW/SNIPPET is not the final FETCH option in the command, the IMAP FETCH response is broken. - imap: v2.3.15 regression: MOVE command leaks mailbox if it can't be opened and crashes at deinit: Panic: file mail-user.c: line 229 (mail_user_deinit): assertion failed: ((*user)->refcount == 1). - imapc: Copying nonexistent mail via imapc could have crashed. Fixes: Panic: file mail-storage.c: line 2385 (mailbox_transaction_commit_get_changes): assertion failed: (ret < 0 || seq_range_count(&changes_r->saved_uids) == save_count || array_count(&changes_r->saved_uids) == 0). - indexer: v2.3.15 regression: Process crashes if indexer-client disconnects while it's waiting for command reply. This happened for example if IMAP SEARCH triggered long fts indexing and the IMAP client disconnected while waiting for the reply. - indexer: v2.3.15 regression: Process may have crashed in some situations. - indexer: v2.3.15 regression: indexer-worker processes may not have reached the process_limit in some situations, possibly even using just one indexer-worker process even though there were many indexing requests queued. - lib-compression: Reading lz4 compressed mdbox mails may crash. Fixes: Panic: file istream.c: line 345 (i_stream_read_memarea): assertion failed: (!stream->blocking). - lib-compression: bench-compress crashes due to xz being read-only. - lib-lua: Fix linking libdict_lua for non-GNU linkers when Lua support is disabled. - lib-mail: There was no limit on how large an email header name could be. Processable header names are now limited to 1000 bytes. - lib-oauth2: Dovecot disallowed JWT tokens if their validity time was older than token creation time (nbf < iat). - lib-storage: Reduce memory footprint of certain storage operations. - lib-storage: When listing mailboxes with storage name escape characters (^ or .) as part of the mailbox name, the listing could show corrupted mailbox names. Due to an issue in handling escaped parent folders, the listing of other mailbox names would become corrupted by prepending parts of the previously listed mailboxes parent folder as prefix to the actual mailbox names. The corruption can occur when using LAYOUT=INDEX and maildir or obox, or when using the listescape plugin. - mail-crypt: Fix "-O" argument for "doveadm mailbox cryptokey password" command to be a boolean, and not expect a string. - submission-login: Add support for not authenticating to next hop in submission proxying. - submission-login: EHLO was not sent again after XCLIENT when doing submission proxying. - virtual: Mailboxes do not correctly detect underlying mailboxes getting re-created even though they have a different UIDVALIDITY or GUID.

9 13

2.3.17 broken on CentOS8 / bug
by TG Servers 04 Nov '21

04 Nov '21

7 14

disable sieve replication with dsync
by David Mandelberg 04 Nov '21

04 Nov '21

Hi, I think I got dsync working for mail, but I'm getting these errors: Error: sieve: file storage: mkdir_parents_chgrp(/usr/local/etc/mail/mandelberg.org/david/sieve/tmp) failed: Read-only file system I'm managing sieve files externally, and I don't want any part of dovecot writing to them. Is there any way to configure dsync to not replicate them? I looked at doveadm-sync(1) to see about adding a flag to replication_dsync_parameters, but the closest thing I see is -x for excluding mailboxes. Or maybe -o? Is there a way to specify a nested setting to -o, so I could do something like `plugin { sieve = }` for dsync?

1 0

Re: full-text index and search
by Marc 03 Nov '21

03 Nov '21

Is there some info on what to expect how big these indexes can get (% mailbox)? Is there any differences between solr / xapian storage use? https://github.com/slusarz/dovecot-fts-flatcurve/

2 1

Re: limiting cpu time of dovecot/imap
by Marc 03 Nov '21

03 Nov '21

> > What would be the best way to 'throttle' dovecot/imap processes of specific users? > > > > Can you please elaborate a bit how you would like to ‘throttle’ the processes? Give it less CPU time? > > That you can probably achieve by returning service/imap/executable="/usr/bin/nice -n 10 /usr/libexec/dovecot/imap" > from users for the throttled users. > Thanks Sami, I was experimenting with some external script that applied cpulimit and ionice to processes. But this suggestion is of course much nicer.

1 0

RE: health check passthrough not 100% in combination with haproxy
by Marc 03 Nov '21

03 Nov '21

I was not having the exit trap and the sleep+kill, I don't really get why it is necessary to have these. Looks a bit inefficient to me having a sleep and to kill your own process. But I am not really a bash expert. > > which of course does not make sense... can you try if this works? I'm guessing your script probably looks pretty much like this already... > > #!/bin/bash > timeout=10 > trap "exit 0" QUIT > { > sleep $timeout > kill -3 $$ 2>/dev/null > } & > read -r input > exit_code=$? > if [ ${exit_code} -eq 0 ]; then > echo -n -e "HTTP/1.1 200 OK\r\n" > echo -n -e "Content-Length: 0\r\n" > echo -n -e "\r\n" > fi > exit 0

1 0

dsync error: Received unexpected input d != N
by David Mandelberg 03 Nov '21

03 Nov '21

Hi, I'm trying to set up replication with dsync, and I'm getting errors like this: dsync-local(david(a)mandelberg.org)<...>: Error: dsync(...): Received unexpected input d != N I tried the `doveadm -D sync` command from https://doc.dovecot.org/configuration_manual/replication/#administration and its output looked like: ... dsync-local(david(a)mandelberg.org)<...>: Debug: brain M: Locking done by remote (local hostname=..., remote hostname=...) dsync-local(david(a)mandelberg.org)<...>: Debug: brain M: Local mailbox tree: ... [line above repeated many times for different mailboxes] dsync-local(david(a)mandelberg.org)<...>: Error: dsync(...): Received unexpected input d != N dsync-local(david(a)mandelberg.org)<...>: Error: dsync(...): Received unexpected input d != N dsync-local(david(a)mandelberg.org)<...>: Debug: auth-master: conn unix:/run/dovecot/auth-userdb (pid=47097,uid=0): Disconnected: Connection closed (fd=8) I'm a bit stuck. Does anybody have any ideas what's going on? The output of `doveconf -n` is attached.

1 1

Auth-Trouble
by Hanns Mattes 03 Nov '21

03 Nov '21

Hi, I've installed Dovecot on a freshly installed machine running Freebsd 13.4. Configuration was copied from an earlier installation, which worked perfectly, until I screwed an update. AFAICS things are working, except replication. I see tons of Errors on the remote and the local machine Oct 31 16:15:30 freebsd dovecot[3248]: doveadm(xxx(a)xx.de): Fatal: connect(213.239.197.36:54321) failed: Interrupted system call and some Oct 31 16:47:33 freebsd dovecot[5509]: auth: cram-md5(xxx(a)xx.de,176.199.241.57,<xSyR+afPn9ywx/E5>): Password mismatch Oct 31 16:47:28 freebsd dovecot[5509]: doveadm(xxx(a)yy.de): Fatal: connect(213.239.197.36:54321) failed: Connection refused and we also get Oct 31 18:17:17 freebsd dovecot[934]: imap(xxx(a)wxxx.de)<1649><lWFvO6nPDeewx/E5>: Panic: file array.c: line 10 (array_idx_modifiable_i): assertion failed: (idx < array->buffer->used / array->element_size) Oct 31 18:17:17 freebsd dovecot[934]: imap(xxx(a)wxxx.de)<1649><lWFvO6nPDeewx/E5>: Fatal: master: service(imap): child 1649 killed with signal 6 (core not dumped - https://dovecot.org/bugreport.html#coredumps - set service imap { drop_priv_before_exec=yes }) not to forget Oct 31 18:18:33 freebsd dovecot[934]: doveadm(xxx@xxx): Fatal: connect(213.239.197.36:54321) failed: Connection refused Users are authenticating with ldap. I'm clueless, and I don't have any clue, if it is a misconfiguration of dovecot or my freebsd-install. Any ideas appreciated Here is the output of doveconf -n # 2.3.17 (e2aa53df5b): /usr/local/etc/dovecot/dovecot.conf # Pigeonhole version 0.5.17 (054dddfa) # OS: FreeBSD 13.0-RELEASE-p4 amd64 # Hostname: freebsd.bruecko.de auth_mechanisms = plain login digest-md5 cram-md5 apop auth_username_chars = abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ01234567890+.-_@ auth_verbose = yes doveadm_password = # hidden, use -P to show it doveadm_port = 54321 lda_mailbox_autocreate = yes lda_mailbox_autosubscribe = yes lda_original_recipient_header = X-Original-To lmtp_save_to_detail_mailbox = yes mail_location = mdbox:~/mdbox mail_plugins = " quota fts fts_xapian trash zlib notify replication acl" managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext namespace { hidden = no ignore_on_failure = no inbox = no list = children location = mdbox:%%h/mdbox prefix = shared/%%u/ separator = / subscriptions = yes type = shared } namespace { location = mdbox:/virtualmail/public:INDEXPVT=%h/mdbox/Public prefix = Public/ separator = / subscriptions = yes type = public } namespace inbox { inbox = yes location = mailbox Drafts { auto = subscribe special_use = \Drafts } mailbox Sent { auto = subscribe special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { auto = subscribe special_use = \Trash } prefix = INBOX/ separator = / } passdb { args = /usr/local/etc/dovecot/master-users driver = passwd-file master = yes pass = yes } passdb { args = /usr/local/etc/dovecot/dovecot-ldap.conf.ext driver = ldap } plugin { acl = vfile acl_anyone = allow acl_shared_dict = file:/virtualmail/shared-mailboxes.db fts = xapian fts_autoindex = yes fts_autoindex_exclude = \Trash fts_enforced = yes fts_xapian = partial=3 full=20 verbose=0 mail_replica = tcps:mail.bruecko.de quota = dict:User quota::file:%h/dovecot-quota quota_exceeded_message = Storage quota for this account has been exceeded, please try again later. quota_grace = 250M quota_rule = *:storage=2500M quota_rule2 = INBOX/Trash:storage=+10%% quota_status_nouser = DUNNO quota_status_overquota = 552 5.2.2 Mailbox is full / Mailbox ist voll quota_status_success = DUNNO quota_warning = storage=95%% quota-warning 95 %u quota_warning2 = storage=80%% quota-warning 80 %u quota_warning3 = storage=75%% quota-warning 75 %u sieve = ~/dovecot.sieve sieve_dir = ~/sieve sieve_global_dir = /virtualmail sieve_max_actions = 0 sieve_max_redirects = 128 sieve_max_script_size = 0 sieve_quota_max_scripts = 0 trash = /usr/local/etc/dovecot/dovecot-trash.conf.ext } postmaster_address = admin(a)bruecko.de protocols = imap pop3 lmtp sieve replication_dsync_parameters = -d -N -l 30 -U -x Public service aggregator { fifo_listener replication-notify-fifo { user = vmail } unix_listener replication-notify { user = vmail } } service auth { unix_listener /var/spool/postfix/private/auth { mode = 0666 } unix_listener auth-userdb { group = vmail user = vmail } } service decode2text { executable = script /usr/local/libexec/dovecot/decode2text.sh unix_listener decode2text { mode = 0666 } user = dovecot } service doveadm { inet_listener { port = 54321 ssl = yes } vsz_limit = 0 } service imap-login { inet_listener imap { port = 143 } inet_listener imaps { port = 993 ssl = yes } } service indexer-worker { vsz_limit = 2 G } service lmtp { inet_listener lmtp { address = 127.0.0.1 port = 24 } user = vmail } service managesieve-login { inet_listener sieve { port = 4190 } inet_listener sieve_deprecated { port = 2000 } } service pop3-login { inet_listener pop3 { port = 110 } inet_listener pop3s { port = 995 ssl = yes } } service quota-status { client_limit = 1 executable = quota-status -p postfix inet_listener { port = 12340 } } service quota-warning { executable = script /usr/local/bin/quota-warning.sh unix_listener quota-warning { user = vmail } user = vmail } service replicator { process_min_avail = 1 unix_listener replicator-doveadm { mode = 0666 } } ssl_cert = </usr/local/etc/dovecot/fullchain17.pem ssl_cipher_list = ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA ssl_client_ca_dir = /etc/ssl/certs ssl_key = # hidden, use -P to show it ssl_prefer_server_ciphers = yes userdb { driver = prefetch } userdb { args = /usr/local/etc/dovecot/dovecot-ldap.conf.ext driver = ldap } verbose_proctitle = yes protocol lmtp { mail_plugins = " quota fts fts_xapian trash zlib notify replication acl sieve" } protocol lda { mail_plugins = " quota fts fts_xapian trash zlib notify replication acl sieve" } protocol imap { mail_max_userip_connections = 100 mail_plugins = " quota fts fts_xapian trash zlib notify replication acl imap_quota imap_zlib imap_acl" } Regards Hanns

2 7

Shared folders - dovecot.index.pvt view is inconsistent
by Felix Ingram 03 Nov '21

03 Nov '21

Hello all, As part of the system I'm cobbling together, I have a need for sharing folders between users. I've followed the various pieces of documentation and seem to have something working but have encountered an odd issue. When user1 shares a folder with user2, then on first access user2 gets a "permission denied" error when trying to access the folder. If I immediately try to access the folder again, then everything is okay. The logs talk about the index.pvt files being inconsistent, which seems to result in the error the first time but allows access the second. I've searched the mailing lists and it seems that this was seen a few years ago and is due to the index files being empty but there didn't seem to be a resolution. At the moment, I am filing messages into folders under INBOX, which means that the INBOX itself is empty (though I've seen the same behaviour if I put some messages in there as well). Can anyone suggest a fix/workaround? I've included my config and some log entries below. In the logs, the "tester@..." user is trying to access the folder "INBOX/tester2" shared by "foo123@...". (Bonus question: can anyone suggest a mail client that allows easy access to shared folders? For the life of me I can't see how to do it in Thunderbird, so I'm using a python script at the moment.) Thanks in advance, Felix # 2.3.7.2 (3c910f64b): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.7.2 () # OS: Linux 5.10.16.3-microsoft-standard-WSL2 x86_64 Ubuntu 20.04.3 LTS overlay # Hostname: ptm-dovecot-5b466fb667-gk6f7 auth_debug = yes auth_debug_passwords = yes auth_master_user_separator = * auth_username_chars = auth_verbose = yes dict { acl = pgsql:/etc/dovecot/conf.d/dovecot-dict-sql.conf.ext } disable_plaintext_auth = no log_path = /dev/stderr mail_debug = yes mail_location = maildir:/home/vmail/%u mail_plugins = acl master_user_separator = * namespace { inbox = yes location = prefix = separator = / type = private } namespace { list = children location = maildir:/home/vmail/%%u:INDEXPVT=~/Maildir/shared/%%u prefix = shared/%%u/ separator = / subscriptions = no type = shared } passdb { args = /etc/dovecot/conf.d/dovecot-sql.conf.ext driver = sql } plugin { acl = vfile:/etc/dovecot/dovecot-acl:cache_secs=6 acl_defaults_from_inbox = yes acl_shared_dict = proxy::acl sieve_default = /etc/dovecot/conf.d/user-to-folder.sieve } protocols = imap lmtp service auth { unix_listener auth-userdb { group = vmail mode = 0600 user = vmail } user = root } service lmtp { inet_listener lmtp { address = 0.0.0.0 port = 24 } } userdb { args = /etc/dovecot/conf.d/dovecot-sql.conf.ext driver = sql } protocol lmtp { log_path = /home/vmail/dovecot-deliver.log mail_plugins = acl sieve postmaster_address = admin(a)mydomain.com } protocol imap { mail_plugins = acl imap_acl } Log output: Nov 03 14:38:27 : Debug: acl: initializing backend with data: vfile:/etc/dovecot/dovecot-acl:cache_secs=6 Nov 03 14:38:27 : Debug: acl: acl username = tester(a)dovecot.mydomain.com Nov 03 14:38:27 : Debug: acl: owner = 1 Nov 03 14:38:27 : Debug: acl vfile: Global ACL file: /etc/dovecot/dovecot-acl Nov 03 14:38:27 : Debug: Namespace : type=shared, prefix=shared/%u/, sep=/, inbox=no, hidden=no, list=children, subscriptions=no location=maildir:/home/vmail/%u:INDEXPVT=~/Maildir/shared/%u Nov 03 14:38:27 : Debug: shared: root=/var/run/dovecot, index=, indexpvt=, control=, inbox=, alt= Nov 03 14:38:27 : Debug: acl: initializing backend with data: vfile:/etc/dovecot/dovecot-acl:cache_secs=6 Nov 03 14:38:27 : Debug: acl: acl username = tester(a)dovecot.mydomain.com Nov 03 14:38:27 : Debug: acl: owner = 0 Nov 03 14:38:27 : Debug: acl vfile: Global ACL file: /etc/dovecot/dovecot-acl Nov 03 14:38:27 : Debug: Mailbox INBOX: Mailbox opened because: SELECT Nov 03 14:38:27 : Debug: acl vfile: file /home/vmail/ tester(a)dovecot.mydomain.com/dovecot-acl not found Nov 03 14:38:27 : Debug: Namespace : /home/vmail/tester(a)dovecot.mydomain.com doesn't exist yet, using default permissions Nov 03 14:38:27 : Debug: Namespace : Using permissions from /home/vmail/ tester(a)dovecot.mydomain.com: mode=0700 gid=default Nov 03 14:38:27 : Debug: acl vfile: file /home/vmail/ tester(a)dovecot.mydomain.com/dovecot-acl not found Nov 03 14:38:27 : Debug: auth-master: userdb lookup( foo123(a)dovecot.mydomain.com) Started userdb lookup Nov 03 14:38:27 : Debug: auth-master: conn unix:/var/run/dovecot/auth-userdb: Connecting Nov 03 14:38:27 : Debug: auth-master: conn unix:/var/run/dovecot/auth-userdb: Client connected (fd=18) Nov 03 14:38:27 auth: Debug: master in: USER 1 foo123(a)dovecot.mydomain.com service=imap Nov 03 14:38:27 auth: Debug: sql(foo123(a)dovecot.mydomain.com): Performing userdb lookup Nov 03 14:38:27 auth: Debug: sql(foo123(a)dovecot.mydomain.com): SELECT home, uid, gid FROM users WHERE userid = 'foo123' AND domain = ' dovecot.mydomain.com' Nov 03 14:38:27 auth: Debug: sql(foo123(a)dovecot.mydomain.com): Finished userdb lookup Nov 03 14:38:27 auth: Debug: userdb out: USER 1 foo123(a)dovecot.mydomain.com home=/tmp/foo123 uid=5000 gid=5001 Nov 03 14:38:27 : Debug: auth-master: userdb lookup( foo123(a)dovecot.mydomain.com) auth USER input: foo123(a)dovecot.mydomain.com home=/tmp/foo123 uid=5000 gid=5001 Nov 03 14:38:27 : Debug: auth-master: userdb lookup( foo123(a)dovecot.mydomain.com) Finished userdb lookup (username= foo123(a)dovecot.mydomain.com home=/tmp/foo123 uid=5000 gid=5001) Nov 03 14:38:27 : Debug: maildir++: root=/home/vmail/ foo123(a)dovecot.mydomain.com, index=, indexpvt=/tmp/foo123/Maildir/shared/ foo123(a)dovecot.mydomain.com, control=, inbox=/home/vmail/ foo123(a)dovecot.mydomain.com, alt= Nov 03 14:38:27 : Debug: acl: initializing backend with data: vfile:/etc/dovecot/dovecot-acl:cache_secs=6 Nov 03 14:38:27 : Debug: acl: acl username = foo123(a)dovecot.mydomain.com Nov 03 14:38:27 : Debug: acl: owner = 1 Nov 03 14:38:27 : Debug: acl vfile: Global ACL file: /etc/dovecot/dovecot-acl Nov 03 14:38:27 : Debug: maildir++: root=/home/vmail/ foo123(a)dovecot.mydomain.com, index=, indexpvt=/tmp/tester/Maildir/shared/ foo123(a)dovecot.mydomain.com, control=, inbox=/home/vmail/ foo123(a)dovecot.mydomain.com, alt= Nov 03 14:38:27 : Debug: acl: initializing backend with data: vfile:/etc/dovecot/dovecot-acl:cache_secs=6 Nov 03 14:38:27 : Debug: acl: acl username = tester(a)dovecot.mydomain.com Nov 03 14:38:27 : Debug: acl: owner = 0 Nov 03 14:38:27 : Debug: acl vfile: Global ACL file: /etc/dovecot/dovecot-acl Nov 03 14:38:27 : Debug: Mailbox shared/foo123(a)dovecot.mydomain.com/INBOX: Mailbox opened because: SELECT Nov 03 14:38:27 : Debug: acl vfile: reading file /home/vmail/ foo123(a)dovecot.mydomain.com/dovecot-acl Nov 03 14:38:27 : Error: /tmp/tester/Maildir/shared/ foo123(a)dovecot.mydomain.com/.INBOX/dovecot.index.pvt reset, view is now inconsistent Nov 03 14:38:27 : Debug: Namespace shared/: Using permissions from : mode=0700 gid=default Nov 03 14:38:27 : Debug: acl vfile: file /home/vmail/ foo123(a)dovecot.mydomain.com/.INBOX.tester2/dovecot-acl not found Nov 03 14:38:27 : Error: /tmp/tester/Maildir/shared/ foo123(a)dovecot.mydomain.com/.INBOX/dovecot.index.pvt view is inconsistent Nov 03 14:38:27 : Debug: Mailbox shared/ foo123(a)dovecot.mydomain.com/INBOX/tester2: Mailbox opened because: SELECT Nov 03 14:38:27 : Error: /tmp/tester/Maildir/shared/ foo123(a)dovecot.mydomain.com/.INBOX.tester2/dovecot.index.pvt reset, view is now inconsistent Nov 03 14:38:28 : Error: /tmp/tester/Maildir/shared/ foo123(a)dovecot.mydomain.com/.INBOX.tester2/dovecot.index.pvt view is inconsistent Nov 03 14:38:28 : Debug: Mailbox shared/ foo123(a)dovecot.mydomain.com/INBOX/tester2: UID 1: Opened mail because: prefetch Nov 03 14:38:28 : Debug: Mailbox shared/ foo123(a)dovecot.mydomain.com/INBOX/tester2: UID 1: Opened mail because: access Nov 03 14:38:28 : Debug: Mailbox shared/ foo123(a)dovecot.mydomain.com/INBOX/tester2: UID 1: Opened mail because: full mail Nov 03 14:38:28 : Info: FETCH failed: Permission denied in=360 out=2880 deleted=0 expunged=0 trashed=0 hdr_count=0 hdr_bytes=0 body_count=1 body_bytes=857

1 0

full-text index and search
by Yonghua Peng 03 Nov '21

03 Nov '21

dear community Does dovecot have the plugins to implement full-text indexing and searching? Thanks a lot.

2 1

Multiple messages with the same GUID
by Ron Garret 02 Nov '21

02 Nov '21

I somehow ended up with multiple messages in the same mailbox with the same GUID. All of the messages are identical (AFAICT) but getting multiple responses for doveadm fetch for a particular guid is screwing up one of my applications. When I searched for the offending guid in dovecot-uidlist I found this: 4927 :1632837493.M663171P23208.vm1.rngh.net,S=3942258,W=3993573 4928 G1632837493.M663171P23208.vm1.rngh.net,S=3942258,W=3993573 :1632880292.M915983P1968.vm1.rngh.net,S=3942258,W=3993573 4929 G1632837493.M663171P23208.vm1.rngh.net,S=3942258,W=3993573 :1632880303.M863130P547.vm1.rngh.net,S=3942258,W=3993573 4930 G1632837493.M663171P23208.vm1.rngh.net,S=3942258,W=3993573 :1632880303.M863131P547.vm1.rngh.net,S=3942258,W=3993573 I tried to figure this out by looking at: https://doc.dovecot.org/admin_manual/mailbox_formats/maildir/ but this case doesn’t seem to be covered there. Can someone please help me figure out what might have happened to produce this situation? Is there a way to recover from it? Thanks, rg

2 2

Transfer or Archival of Dovecot Accounts
by Stefan Malte 02 Nov '21

02 Nov '21

Hello, We have the following situation: We are using Dovecot on several Mailservers administered via ISPConfig. The servers all use old versions of Debian and ISPConfig and my job - I joined the company as a Linux system administrator 6 months ago - is to consolidate these old servers into one new server I already set up. I did a trial run with one user from one company by way of duplicating her account on the new server, creating a new mail account in her outlook and changing the MX record from the old to the new server. This works. This was rather time-intensive and I still have to face the problem of what to do with the existing mail data once we shut down the old servers one-by-one. Is there a way to move or even better integrate the data from the old mailbox on the old server to the new mailbox on the new server without any user intervention? https://pypi.org/project/dovecot-archive/ looks promising, but it assumes a situation we don't have: In our case the original user and the user in whose mailbox the data should be stored have the same email address. I am very open to suggestions on how to do this the smart way. Even manually entering the users' account data by hand on the new server is very time consuming. At the same time this is a much needed opportunity to weed out old mailboxes and forwardings which are not used any more. Even complete domains on the old servers have proven to be not in use anymore - the client company switched to Exchange online according to the MX record and failed to inform us. Anyway, this is a huge load of work and I'd rather spend more time preparing correctly and efficiently repeating simple tasks again and again. I am grateful for any advice. After all, this situation is certainly not unique. Yours faithfully Stefan Malte Schumacher

1 0

health check passthrough not 100% in combination with haproxy
by Marc 02 Nov '21

02 Nov '21

I have been trying to get a simple health check in haproxy to work. But somehome the haproxy request is differently handled then a curl request, which generates a socket error in haproxy. The health script echos these lines, with this config[2] echo -ne "HTTP/1.1 200 OK\r\n" echo -ne "Content-Length: 0\r\n" echo -ne "\r\n" exit 0 The curl request generates ok, haproxy generates socket error. The haproxy=yes, reuseport=yes do not seem to resolve anything. If stop dovecot and run "dovecot-health-check.sh | nc -l 192.168.10.46 5001" then the haproxy check is ok. So I guess the script is ok. But what is dovecot then doing with it's output when haproxy is requesting it? [1] https://discourse.haproxy.org/t/httpck-on-bash-script-results-in-socket-err… [2] service health-check { executable = script -p /usr/local/sbin/dovecot-health-check.sh inet_listener health-check { port = 5001 haproxy = no reuse_port = no } }

3 6

Ldap dict for shared mailboxes
by Kees van Vloten 02 Nov '21

02 Nov '21

Hi everybody, I am trying to construct a LDAP dict for shared mailboxes. There is a lot of documentation available but nothing specific to this usecase. I could not find anything useful on Google nor in the mailinglist archives :-( The best start point seems to be the doc on shared mailbox dictionaries (https://doc.dovecot.org/configuration_manual/shared_mailboxes/shared_mailbo…) in particular the example for SQL dict. But obviously LDAP is different than SQL. The dictionaries page (https://doc.dovecot.org/configuration_manual/dict/) has LDAP example but it looks like it does not contain all the bit and pieces I need. Following the structure of the SQL example, I come to something like this: map { pattern = shared/shared-boxes/user/$to/$from base_dn = ou=shared mailboxes,dc=example,dc=com filter = (&(objectClass=group)(mail=%{from}) fields { from_user=$from to_user=$to } } The "to_user" / "$to" should be filled with the 'uid' or 'email' of a nested group lookup of the 'member' fields of the group. What are the mechanics to get that done? Does anyone has an example or pointer to documentation or is a LDAP dict for shared-mailboxes not possible / supported? And in the latter case, suggestions about possible alternatives are welcome :-) FYI. the LDAP implementation I am using is a recent Samba4 ad-dc. - Kees.

1 0

limiting cpu time of dovecot/imap
by Marc 01 Nov '21

01 Nov '21

What would be the best way to 'throttle' dovecot/imap processes of specific users?

2 1

Dovecot does not start on MacOS 12.01
by Don Feliciano 01 Nov '21

01 Nov '21

I've been happily running Dovecot on my Mac for many years (installed via Homebrew). After upgrading to Monterey (MacOS 12.01), it no longer starts: $ sw_vers ProductName: macOS ProductVersion: 12.0.1 BuildVersion: 21A559 $ uname -a Darwin dfelicia-mac 21.1.0 Darwin Kernel Version 21.1.0: Wed Oct 13 17:33:23 PDT 2021; root:xnu-8019.41.5~1/RELEASE_X86_64 x86_64 $ sudo dovecot -F Oct 27 10:11:18 service(log): Fatal: setrlimit(RLIMIT_DATA, 268435456): Invalid argument $ mount /dev/disk1s2s1 on / (apfs, sealed, local, read-only, journaled) devfs on /dev (devfs, local, nobrowse) /dev/disk1s5 on /System/Volumes/VM (apfs, local, noexec, journaled, noatime, nobrowse) /dev/disk1s3 on /System/Volumes/Preboot (apfs, local, journaled, nobrowse) /dev/disk1s6 on /System/Volumes/Update (apfs, local, journaled, nobrowse) /dev/disk1s1 on /System/Volumes/Data (apfs, local, journaled, nobrowse) $ sudo dovecot -n # 2.3.16 (7e2e900c1a): /usr/local/etc/dovecot/dovecot.conf # Pigeonhole version 0.5.16 (09c29328) # OS: Darwin 21.1.0 x86_64 apfs # Hostname: dfelicia-mac default_internal_group = mail default_internal_user = _dovecot default_login_user = _dovenull first_valid_uid = 100 listen = 127.0.0.1 log_path = /var/log/dovecot.log mail_location = maildir:/usr/local/var/mail/%u managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext namespace inbox { inbox = yes location mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix } passdb { args = login driver = pam } protocols = imap service imap-login { inet_listener imap { address = 127.0.0.1 port = 143 } inet_listener imaps { address = 127.0.0.1 ssl = no } } ssl = no userdb { driver = passwd } $ ulimit -Ha core file size (blocks, -c) unlimited data seg size (kbytes, -d) unlimited file size (blocks, -f) unlimited max locked memory (kbytes, -l) unlimited max memory size (kbytes, -m) unlimited open files (-n) unlimited pipe size (512 bytes, -p) 1 stack size (kbytes, -s) 65532 cpu time (seconds, -t) unlimited max user processes (-u) 2784 virtual memory (kbytes, -v) unlimited

3 10

2.3.17 - breaks with fts-xapian.
by Juan Felipe Arjona 01 Nov '21

01 Nov '21

Hello: I just upgraded my Debian server with dovecot 2.3.17, and it breaks when using the plugin fts-xapian. Apparently is a bug in Dovecot, please see: https://github.com/grosjo/fts-xapian/issues/99 Thanks, Juan

3 2

Errors after freebsd upgrade
by Hanns Mattes 01 Nov '21

01 Nov '21

Hi, after upgrading Freebsd from ports dovecot is throwing the following error Oct 30 18:04:15 freebsd dovecot[59232]: doveadm(xxx(a)example.com)<84061><S3CoJf9sfWFdSAEAUmejdw>: Fatal: master: service(doveadm): child 84061 killed with signal 6 (core not dumped - https://dovecot.org/bugreport.html#coredumps - set service doveadm { drop_priv_before_exec=yes }) I (surely) may have missed something while upgrading (I've learned a lot about backup/snapshot-strategies with zfs, but to late to apply). How can I debug the erro? Regards Hanns

2 1

Design Check
by Felix Ingram 31 Oct '21

31 Oct '21

Hello all, I'm building a mail system and would like to check whether my design is feasible. I'm fairly certain that it is but I think I don't have the right words and concepts lined up properly in my head. The end system will provide temporary/disposable email addresses that can be accessed by multiple people. People would be able to send email to addresses that match the following format: user1(a)foobar.mydomain.com user2(a)foobar.mydomain.com user1(a)barbaz.mydomain.com user2(a)barbaz.mydomain.com I would like all emails to the "foobar" subdomain to end up in their own mailbox and all emails to the "barbaz" subdomain to go to their own mailbox. (I think that means I need a foobar and barbaz user on Dovecot). Users of the system should be able to see all of the emails, including the original addresses they were sent to. e.g. user1(a)foobar.mydomain.com and user2(a)foobar.mydomain.com both get delivered to the "foobar" mailbox, and users can see all emails, including that they were sent to "user1" and "user2" The users of the system would be able to access any of the foobar, barbaz, etc mailboxes - I believe that means that they would need to be set as master users. I will be creating a web interface for users to get/set their credentials, so can add those users on an adhoc basis, but I will need to have the "foobar", "barbaz", etc users created whenever an email arrives (we won't know ahead of time). The plan is to have postfix accepting the emails before passing them to Dovecot. I don't believe postfix needs to do much processing but that this would be the place to transform the address into the correct user/mailbox name. So my questions are: 1. Does the above sound reasonable? 2. Can Dovecot auto-create users as needed? 3. Will I be able to preserve the original email? 4. Are master users the right approach? There is no strong requirement for privacy between mailboxes - there is no issue with one user being able to read all email. There is also no requirement to be able to send email but that is a feature request for the future - we would want people to be able to send as the original address when that's implemented. Any pointers gratefully received. Thanks in advance, Felix

4 9

v2.3.17 - dsync says invalid option -- E
by Daniel J. Luke 31 Oct '21

31 Oct '21

Hello, I've got some scripts that archive off mail that stopped working with 2.3.17. Specifically this worksin 2.3.16: sudo -n /usr/local/bin/dsync -u dluke -m Sent -o mail_location=mbox:~/tmp/ mirror maildir:~/Maildir/ but fails on 2.3.17 with the following error message: dsync: invalid option -- E -- Daniel J. Luke

3 5

Re: Dovecot 2.3.17 can not start - too many parameters
by Robert Nowotny 29 Oct '21

29 Oct '21

Michael, it seems the rumors are right. After shortening the file /etc/ssl/ca-certificates.crt to one entry, it works. Of course this is not a solution, so a fix will be needed. I use the "/etc/ssl/certs/ca-certificates.crt" which is included with Ubuntu impish yours sincerely Robert Am 29.10.2021 um 21:09 schrieb Michael Kliewe: Hi, I have heard rumors that this happens when you provide a CA bundle file which is big. If you just provide a single CA file it works. Something has changed there, maybe the developers have more details about this change. King regards Michael Am 29.10.2021 um 19:25 schrieb Robert Nowotny: Dovecot 2.3.17 can not start - too many parameters. but the same config is working on 2.3.16 (and for a long time already ...) started via systemd unit file : ================== [Unit] Description=Dovecot IMAP/POP3 email server Documentation=man:dovecot(1) Documentation=http://wiki2.dovecot.org/ After=local-fs.target network.target dnsmasq.service NetworkManager-wait-online.service network-online.target Requires=network.target network-online.target dnsmasq.service local-fs.target [Service] Type=forking ExecStart=/usr/local/sbin/dovecot -c /etc/dovecot/dovecot.conf PIDFile=/usr/local/var/run/dovecot/master.pid ExecReload=/usr/local/bin/doveadm reload ExecStop=/usr/local/bin/doveadm stop PrivateTmp=true NonBlocking=yes LimitNOFILE=8192 [Install] WantedBy=multi-user.target ================== log: Oct 29 18:48:58 lxc-imap dovecot[1781]: doveconf: Fatal: execvp(/usr/local/sbin/dovecot) failed: Argument list too long Oct 29 18:48:58 lxc-imap systemd[1]: dovecot.service: Control process exited, code=exited, status=89/n/a Oct 29 18:48:58 lxc-imap systemd[1]: dovecot.service: Failed with result 'exit-code'. but when I run doveconf -n, it is working under 2.3.17 I needed to revert to version 2.3.16 to send this email ;-) running on Ubuntu impish yours sincerely Robert Nowotny Rotek GmbH

1 0

Dovecot 2.3.17 can not start - too many parameters
by Robert Nowotny 29 Oct '21

29 Oct '21

Dovecot 2.3.17 can not start - too many parameters. but the same config is working on 2.3.16 (and for a long time already ...) started via systemd unit file : ================== [Unit] Description=Dovecot IMAP/POP3 email server Documentation=man:dovecot(1) Documentation=http://wiki2.dovecot.org/ After=local-fs.target network.target dnsmasq.service NetworkManager-wait-online.service network-online.target Requires=network.target network-online.target dnsmasq.service local-fs.target [Service] Type=forking ExecStart=/usr/local/sbin/dovecot -c /etc/dovecot/dovecot.conf PIDFile=/usr/local/var/run/dovecot/master.pid ExecReload=/usr/local/bin/doveadm reload ExecStop=/usr/local/bin/doveadm stop PrivateTmp=true NonBlocking=yes LimitNOFILE=8192 [Install] WantedBy=multi-user.target ================== log: Oct 29 18:48:58 lxc-imap dovecot[1781]: doveconf: Fatal: execvp(/usr/local/sbin/dovecot) failed: Argument list too long Oct 29 18:48:58 lxc-imap systemd[1]: dovecot.service: Control process exited, code=exited, status=89/n/a Oct 29 18:48:58 lxc-imap systemd[1]: dovecot.service: Failed with result 'exit-code'. but when I run doveconf -n, it is working under 2.3.17 I needed to revert to version 2.3.16 to send this email ;-) running on Ubuntu impish yours sincerely Robert Nowotny Rotek GmbH

2 1

Dovecot version 2.3.17 - dovadm user fail (LDAP)
by Günther J. Niederwimmer 29 Oct '21

29 Oct '21

Hello Oracle 8 (Centos) after Update I have Errors in the log ct 29 13:06:45 mx03.xxxxxxxxx.at dovecot[661311]: doveadm(gjn): Error: User doesn't exist Oct 29 13:06:45 mx03.xxxxxxxxxx.at dovecot[661311]: doveadm(baucons): Error: User doesn't exist Oct 29 13:06:45 mx03.xxxxxxxxxx.at dovecot[661311]: doveadm(ulrike): Error: User doesn't exist but with doveadm user '*' gjn ulrike baucons This is a Problem on all my 3 system? only one is working correct this is a centos 7 Server -- mit freundlichen Grüßen / best regards Günther J. Niederwimmer

2 2

Dovecot version 2.3.17 - mail replication stopped working
by Daniel Botting 29 Oct '21

29 Oct '21

Hi, We upgraded to Dovecot 2.3.17 today and mail replication has stopped working as expected, the error in mail.err is: Oct 28 10:27:44 hostname dovecot: imap-login: Error: net_connect_unix(/var/run/dovecot/stats-writer) failed: No such file or directory Oct 28 10:28:47 hostname dovecot: doveadm: Error: sync: invalid option -- 'T' This is constantly repeated afterwards All the files in /var/run/dovecot have last modified time of 10:27 The permissions on both hosts for this file are: srw-rw---- 1 root dovecot 0 Oct 28 10:27 stats-writer= OS: Debian 10.11 Doveconf -n output below: # 2.3.17 (e2aa53df5b): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.17 (054dddfa) # OS: Linux 4.19.0-18-amd64 x86_64 Debian 10.11 # Hostname: mailserver fqdn auth_verbose = yes default_vsz_limit = 0 doveadm_password = # hidden, use -P to show it first_valid_gid = 8 first_valid_uid = 8 last_valid_gid = 8 last_valid_uid = 8 lda_mailbox_autocreate = yes lda_mailbox_autosubscribe = yes mail_gid = 8 mail_location = maildir:~/Maildir mail_plugins = " notify replication" mail_uid = 8 managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext editheader imapflags namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } passdb { args = /etc/dovecot/dovecot-ldap.conf.ext driver = ldap } plugin { mail_replica = tcps:fqdn:port number sieve = ~/.dovecot.sieve sieve_dir = ~/sieve sieve_extensions = +editheader +imapflags } postmaster_address = postmaster@ourdomain protocols = " imap sieve pop3" replication_dsync_parameters = -d -N -l 15 -U -T 10 replication_max_conns = 24 service aggregator { fifo_listener replication-notify-fifo { user = mail } unix_listener replication-notify { user = mail } } service auth { unix_listener /var/run/dovecot-exim-bridge { mode = 0660 user = Debian-exim } } service doveadm { inet_listener { port = 12345 ssl = yes } } service imap-login { inet_listener imap { port = 143 } inet_listener imaps { port = 993 ssl = yes } process_limit = 512 process_min_avail = 4 service_count = 1 } service imap { process_limit = 1024 } service managesieve-login { inet_listener sieve { port = 4190 } process_min_avail = 1 service_count = 8 vsz_limit = 256 M } service managesieve { process_limit = 1024 } service replicator { process_min_avail = 1 unix_listener replicator-doveadm { mode = 0666 } } ssl = required ssl_cert = </ssl cert path ssl_cipher_list = ALL:!LOW:!SSLv2:!EXP:!aNULL ssl_client_ca_dir = /etc/ssl/certs ssl_key = # hidden, use -P to show it userdb { args = /etc/dovecot/dovecot-ldap.conf.ext driver = ldap override_fields = home=/var/mail/%u uid=mail gid=mail } protocol lda { mail_plugins = " notify replication sieve" } protocol imap { mail_max_userip_connections = 32 mail_plugins = " notify replication" } protocol sieve { mail_max_userip_connections = 10 managesieve_logout_format = bytes=%i/%o managesieve_max_line_length = 64 k } Best regards Daniel

2 4

Re: [EXT] Re: Dovecot v2.3.17 released
by Frank Elsner 28 Oct '21

28 Oct '21

On Thu, 28 Oct 2021 19:17:40 +0300 (EEST) Aki Tuomi wrote: > > > On 28/10/2021 19:10 Frank Elsner <frank.elsner(a)mailbox.org> wrote: > > > > > > On Thu, 28 Oct 2021 17:32:28 +0300 (EEST) Aki Tuomi wrote: > > > > [ ... ] > > > > > I guess you are using systemd-coredump, so try > > > > > > coredumpctl dump -o core /usr/libexec/dovecot/imap { ... ] > In the directory you ran that command, there will be now a file called 'core'. Can you now do: > > gdb /usr/libexec/dovecot/imap core > bt full Hi Aki, I hope to deliver the requested info with this output (gdb) bt full #0 fts_user_autoindex_exclude (box=<optimized out>, box@entry=0x559500fdd138) at fts-user.c:347 fuser = <optimized out> #1 0x00007f50d8f623b6 in fts_mailbox_allocated (box=0x559500fdd138) at fts-storage.c:806 flist = <optimized out> v = 0x559500fdd7b8 fbox = 0x559500fdd918 #2 0x00007f50d942bd1c in hook_mailbox_allocated (box=box@entry=0x559500fdd138) at mail-storage-hooks.c:256 _data_stack_cur_id = 5 _foreach_end = 0x559500fce758 _foreach_ptr = 0x559500fce740 hooks = 0x7f50d8f90b40 <fts_mail_storage_hooks> ctx = 0x559500fde558 #3 0x00007f50d9426f11 in mailbox_alloc (list=0x559500fd40c8, vname=vname@entry=0x559500f87620 "Administration", flags=flags@entry=0) at mail-storage.c:885 _data_stack_cur_id = 4 new_list = 0x559500fd40c8 storage = 0x559500fd48d8 box = 0x559500fdd138 open_error = MAIL_ERROR_NONE errstr = 0x0 __func__ = "mailbox_alloc" #4 0x00005594fffcaae2 in cmd_create (cmd=0x559500fd38b8) at cmd-create.c:40 ns = 0x559500fd3390 --Type <RET> for more, q to quit, c to continue without paging-- mailbox = 0x559500f87620 "Administration" orig_mailbox = <optimized out> box = 0x559500fdc5a0 directory = <optimized out> len = 14 #5 0x00005594fffd8494 in command_exec (cmd=cmd@entry=0x559500fd38b8) at imap-commands.c:201 hook = 0x559500f93580 finished = <optimized out> __func__ = "command_exec" #6 0x00005594fffd64c2 in client_command_input (cmd=<optimized out>) at imap-client.c:1230 client = 0x559500fd2788 command = <optimized out> tag = 0x7f50d9331f3a <p_strdup+74> "]A\\A]\303\061\300\303ff.\017\037\204" name = 0x5594fffea726 "CREATE" ret = <optimized out> __func__ = "client_command_input" #7 0x00005594fffd6574 in client_command_input (cmd=<optimized out>) at imap-client.c:1297 client = 0x559500fd2788 command = <optimized out> tag = 0x559500f9e0e8 "161" name = 0x559500f9e0f0 "CREATE" ret = <optimized out> __func__ = "client_command_input" --Type <RET> for more, q to quit, c to continue without paging-- #8 0x00005594fffd697d in client_handle_next_command (remove_io_r=<synthetic pointer>, client=0x559500fd2788) at imap-client.c:1339 No locals. #9 client_handle_input (client=0x559500fd2788) at imap-client.c:1353 _data_stack_cur_id = 3 ret = <optimized out> remove_io = false handled_commands = false __func__ = "client_handle_input" #10 0x00005594fffd6f30 in client_input (client=0x559500fd2788) at imap-client.c:1397 cmd = 0x559500f9b6a8 output = 0x559500fd31f0 bytes = 27 __func__ = "client_input" #11 0x00007f50d9314249 in io_loop_call_io (io=0x559500fd3330) at ioloop.c:737 ioloop = 0x559500f8fe70 t_id = 2 __func__ = "io_loop_call_io" #12 0x00007f50d93158f2 in io_loop_handler_run_internal (ioloop=ioloop@entry=0x559500f8fe70) at ioloop-epoll.c:222 ctx = 0x559500f925d0 events = <optimized out> event = 0x559500f92650 list = 0x559500f9b690 --Type <RET> for more, q to quit, c to continue without paging-- io = <optimized out> tv = {tv_sec = 1799, tv_usec = 999057} events_count = <optimized out> msecs = <optimized out> ret = 1 i = 0 j = 0 call = <optimized out> __func__ = "io_loop_handler_run_internal" #13 0x00007f50d93142f0 in io_loop_handler_run (ioloop=0x559500f8fe70) at ioloop.c:789 __func__ = "io_loop_handler_run" #14 0x00007f50d93144b0 in io_loop_run (ioloop=0x559500f8fe70) at ioloop.c:762 __func__ = "io_loop_run" #15 0x00007f50d92884f3 in master_service_run (service=0x559500f8fcd0, callback=callback@entry=0x5594fffe4c90 <client_connected>) at master-service.c:863 No locals. #16 0x00005594fffc7f85 in main (argc=<optimized out>, argv=<optimized out>) at main.c:564 set_roots = {0x5594ffff98e0 <smtp_submit_setting_parser_info>, 0x5594ffff9600 <imap_setting_parser_info>, 0x0} login_set = {auth_socket_path = 0x559500f877f8 "\003", postlogin_socket_path = 0x0, postlogin_timeout_secs = 60, callback = 0x5594fffe5640 <login_client_connected>, failure_callback = 0x5594fffe4d60 <login_client_failed>, request_auth_token = true} service_flags = <optimized out> storage_service_flags = (MAIL_STORAGE_SERVICE_FLAG_NO_NAMESPACES | MAIL_STORAGE_SERVICE_FLAG_NO_SSL_CA) --Type <RET> for more, q to quit, c to continue without paging-- username = <optimized out> auth_socket_path = <optimized out> c = <optimized out> error = 0x7fffe05085a8 "" (gdb) By for today, Frank

2 1

Pigeonhole v0.5.17 released
by Aki Tuomi 28 Oct '21

28 Oct '21

We are pleased to release first release candidate for v0.5.14. We have done changes to packaging so please give us any feedback on how it works. https://pigeonhole.dovecot.org/releases/2.3/dovecot-2.3-pigeonhole-0.5.17.t… https://pigeonhole.dovecot.org/releases/2.3/dovecot-2.3-pigeonhole-0.5.17.t… Binary packages in https://repo.dovecot.org/ Docker images in https://hub.docker.com/r/dovecot/dovecot Kind regards, Aki Tuomi Open-Xchange oy --- - duplicate: The Sieve duplicate test is prone to false negatives when the user receives many e-mails concurrently, meaning that duplicate deliveries can still occur. - fileinto: v2.3.16 regression: Sieve delivery crashes if mail is delivered to non-existing and existing folder. - imap-filter-sieve: v2.3.15 regression: The CPU limits on Sieve execution are too easily exceeded in IMAP context (the IMAPSieve and FILTER=SIEVE capabilities). Changed the default to unlimited CPU time for IMAP context, since similar excessive resource usage can be caused by other means as well. The CPU limits on Sieve scripts executed at LDA/LMTP delivery are still enforced by default. - redirect: The Sieve redirect action has protections against users triggering mail loops. Unfortunately, the detection of a redirect mail loop sometimes causes the message to get lost if no other Sieve action is applied that delivers the message somewhere else. - redirect: v2.3.16 regression: With certain Sieve scripts if redirect fails due to temporary failure, the lmtp process may crash after the delivery. Fixes: Panic: file mail-user.c: line 229 (mail_user_deinit): assertion failed: ((*user)->refcount == 1).

3 3

download from pigeonhole.dovecot.org not possible via IPv6 http
by Wolfgang Zenker 28 Oct '21

28 Oct '21

Hello, I tried to download the dovecot-2.3-pigeonhole-0.5.15.tar.gz source archive from http://pigeonhole.dovecot.org/releases/2.3/dovecot-2.3-pigeonhole-0.5.15.ta… on an IPv6-only server, but the download fails. The server pigeonhole.dovecot.org has an IPv6 address published in DNS that is actually pingable, but connection on the http-port is not possible. Connecting on https does work, as does http AND https on IPv4. This appears to be a simple configuration problem and should be easily fixed; the correct behaviour would be to redirect from http to https on IPv6 the same way it is done for IPv4 already. Greetings, Wolfgang

2 1

dovecot oauth
by la.jolie＠paquerette 27 Oct '21

27 Oct '21

Hello, I upgraded my servers from Debian Buster (v10) to Bullseye (v11). Before the upgrade, I had Roundcube / Dovecot working with LemonLdap (via OAuth). After the upgrade, i can't connect to Roundcube anymore. - roundcube (v1.5-rc) stayed the same - Dovecot upgraded from v1:2.3.4.1-5+deb10u6 to v1:2.3.13+dfsg1-2 I already discussed on the LemonLdap mailing list and the analysis was: "Seems like your app is not sending client_id and client_secret correctly then It can do that either as POST parameters or in the Authorization header" I downgraded Dovecot to Buster version (v1:2.3.4.1-5+deb10u6) and Roundcube / Dovecot are working again. What could have change between these 2 versions to have that error? My dovecot Oauth config: ---- debug = yes ## url for verifying token validity. Token is appended to the URL tokeninfo_url = https://auth.mydomain.name/oauth2/userinfo?access_token= ## introspection endpoint, used to gather extra fields and other information. introspection_url = https://auth.mydomain.name/oauth2/introspect ## How introspection is made, valid values are ## auth = GET request with Bearer authentication ## get = GET request with token appended to URL ## post = POST request with token=bearer_token as content introspection_mode = post ## TLS settings tls_ca_cert_file = /etc/ssl/certs/ca-certificates.crt ## username attribute in response (default: email) username_attribute = email ---- The error I found in the logs: ---- ==> nginx/portal.log <== 11.22.33.44 - - [25/Oct/2021:16:31:59 +0200] "POST /oauth2/introspect HTTP/1.1" 401 355 "-" "dovecot-oauth2-passdb/2.3.13" - ==> error <== Oct 25 16:31:59 XXX LLNG[413575]: [error] No authentication provided to get token, or authentication type not supported ==> mail.log <== Oct 25 16:31:59 XXX dovecot[1390]: auth: Debug: http-client: conn 11.22.33.44:443 [12]: Got 401 response for request [Req72: POST https://auth.mydomain.name/oauth2/introspect] Unauthorized (took 705 ms + 0 ms in queue) Oct 25 16:31:59 XXX dovecot[1390]: auth: Error: oauth2(yyyyy(a)mydomain.name,127.0.0.1,<bTQoOS7PRLV/AAAB>): oauth2 failed: Object doesn't begin with '{' ---- Thanks, Kenny

2 2

Doveadm fetch slow and 100%CPU with a specific message-id
by Alessio Cecchi 26 Oct '21

26 Oct '21

Hi, I'm using doveadm fetch in order to find the mailbox where a messagge is stored: doveadm fetch -u alessio(a)domain.com "mailbox" HEADER Message-ID '1234(a)domain.com' If the messagge-id is ... long more than? ... I don't know, the lookup is very very slow, here an example: with message-id 9c102380c557e7e146a33cb4b49ab802(a)cbweb.cecchi.net respons time: 3 secs with message-id kZ1ZoAa8QnsfZ64hTe9P3K0OOjL24xTq7vUMB3Qw3E(a)www.myxmail.com response time: 80 secs and java/solr use the 100% CPU Both messages are in the same folder (Trash) If I add -D to doveadm it stuck some seconds every time connect to Solr: Oct 25 18:30:08 doveadm(alessio(a)domain.com): Debug: http-client: queue http://127.0.0.1:8983: Connection to peer 127.0.0.1:8983 claimed request [Req1: GET http://127.0.0.1:8983/solr/dovecot/select?wt=xml&fl=uid,score&rows=26&sort=…] Oct 25 18:30:08 doveadm(alessio(a)domain.com): Debug: http-client: conn 127.0.0.1:8983 [1]: Claimed request [Req1: GET http://127.0.0.1:8983/solr/dovecot/select?wt=xml&fl=uid,score&rows=26&sort=…] Oct 25 18:30:08 doveadm(alessio(a)domain.com): Debug: http-client: request [Req1: GET http://127.0.0.1/solr/dovecot/select?wt=xml&fl=uid,score&rows=26&sort=uid+a…...: Sent header Oct 25 18:30:08 doveadm(alessio(a)domain.com): Debug: http-client: peer 127.0.0.1:8983: No more requests to service for this peer (1 connections exist, 0 pending) [...] Oct 25 18:30:08 doveadm(alessio(a)domain.com): Debug: http-client: queue http://127.0.0.1:8983 My dovecot version is 2.3.16 and Solr 7.7. Why? Thanks -- Alessio Cecchi Postmaster @ http://www.qboxmail.it https://www.linkedin.com/in/alessice

4 9