- dovecot - dovecot.org

Re: Bug in renaming folder hierarchies - any reaction ?
by Klaus Steinberger 04 Mar '21

04 Mar '21

Hi, no comments on this? This is definitly with two different IMAP Clients reproducible. This led already to some message loss in user Mailboxes. > we discovered a major problem with renaming folders with subfolders > > testszenario: > > folders: > > test1 > test1/test1-1 > test1/test1-2 > > all 3 folders contain a test message > > after renaming the top level folder test1 to test2 following folders exist: > > test2 > test2/test1-1 > test2/test1-2 > > the subfolders test1-1 and test1-2 are empty, the top level folder contains the > correct message. > > > Now renmaing test2 back to test1: > > Alle folders again contain their messages. > > So this looks like during renaming the top level folder just the message > references for the subfolders got lost, and with renaming back they are there again. > > I can reproduce this behavior both with thunderbird and Horde Webmail as a > client, also it happens with a second different dovecot setup > Sincerly, Klaus Steinberger

2 7

Pigeonhole v0.5.14 released
by Aki Tuomi 04 Mar '21

04 Mar '21

Hi! We are pleased to release v0.5.14 of Pigeonhole. Please find source tarballs at https://pigeonhole.dovecot.org/releases/2.3/dovecot-2.3-pigeonhole-0.5.14.t… https://pigeonhole.dovecot.org/releases/2.3/dovecot-2.3-pigeonhole-0.5.14.t… Binary packages in https://repo.dovecot.org/ Docker images in https://hub.docker.com/r/dovecot/dovecot Aki Tuomi Open-Xchange oy --- * IMAP FILTER command: cmd-filter-sieve - Do not allow NIL as script name argument.

1 0

Why Last-login?
by ＠lbutlr 04 Mar '21

04 Mar '21

I've noticed several threads over the last year or so about last-login, and I was curious WHY people care about tracking this in the database. I can see wanting to know if a user has logged in recently, but this seems quite easy to tell by simply looking at the time stamp and/or contents of the mail spool for the user. For example, on my system I can look at the timestamps on the 'new' folders in the user's maildir to see if they are getting mail, and if the folders are empty, I have a time stamp of when they last checked that mailbox, giving me a pretty accurate time for when they last logged in. For example, looking at one user: # ls -lsdtr /path/to/user/maildir/{new,.**/new} I can see that the most recent "new" mailboxes were accessed on 02 Mar 14:25 and 03 Mar 01:45, and I can see that the latter mailbox has files in it and the former mailbox does not (just by the size, without doing an extra ls of those directories), so I know that the last time the user logged in was about 14:25 or later yesterday and that they definitely have not logged in in the last 3h05, which seems close enough to me. Am I missing some reason I would need/want to keep track of that specific login time separately? -- 'But you ain't part of it, are you?' said Granny conversationally. 'You try, but you always find yourself watchin' yourself watchin' people, eh? Never quite believin' anything? Thinkin' the wrong thoughts?'

7 12

Git / Compilation error
by Joan Moreau 04 Mar '21

04 Mar '21

Hello, With latest git, I get the following error : configure.ac:761: the top level configure.ac:22: error: possibly undefined macro: AC_DEFINE If this token and others are legitimate, please use m4_pattern_allow. See the Autoconf documentation. configure.ac:205: error: possibly undefined macro: AC_MSG_ERROR configure.ac:247: error: possibly undefined macro: AS_IF configure.ac:303: error: possibly undefined macro: AM_ICONV configure.ac:434: error: possibly undefined macro: AC_CHECK_HEADER configure:28073: error: possibly undefined macro: AC_CHECK_FUNC Something I am missing? Thank you

2 7

t/s expired cert error
by Voytek Eymont 04 Mar '21

04 Mar '21

since a couple of days one of users reported getting expired certificate error in TB, looking at the log, I can see like: Mar 02 21:46:24 pop3-login: Info: Disconnected (no auth attempts in 0 secs): user=<>, rip=111.222.333.444, lip=103.106.168.105, TLS: SSL_read failed: error:14094415:SSL routines:SSL3_READ_BYTES:sslv3 alert certificate expired: SSL alert number 45, session=<...> but, looking at server with https://ssl-tools.net/mailservers/emu.sbt.net.au it says 'valid' as does certbot tool what am I missing ? Expiry Date: 2021-04-27 12:11:32+00:00 (VALID: 55 days) Certificate Path: /etc/letsencrypt/live/emu.sbt.net.au/fullchain.pem Private Key Path: /etc/letsencrypt/live/emu.sbt.net.au/privkey.pem # grep ssl_ dovecot.conf ssl_cert = </etc/letsencrypt/live/emu.sbt.net.au/fullchain.pem ssl_key = </etc/letsencrypt/live/emu.sbt.net.au/privkey.pem ssl_dh=</etc/dovecot/dh.pem

7 9

LDA File Permissions
by David Morsberger 03 Mar '21

03 Mar '21

All, I am looking for an easy way to setup LDA so that it creates files with group read permission. Currently LDA/Sieve create the '.dovecot.lda-dupes’ file with ‘0600’. My backup process needs to be able to read the file because it runs as a user that is in the same group as the LDA process. I looked into the source code and the file is opened with mode ‘0666’ as " fd = open(lock_info->lock_path, O_RDWR | O_EXCL | O_CREAT, 0666); This implies it is a umask issue. What is the best way to view and set the umask value for the LDA process on Ubuntu 20.04? Thanks, David

1 0

Can Dovecot honor Outlook's "leave mail on server for X days" setting?
by Steve Dondley 03 Mar '21

03 Mar '21

I googled around for a quite bit but surprisingly came up empty for an answer to this question which I'm sure has been broached before. I've got a linux box running dovecot/postfix using maildir format. I was surprised to learn that a client that had many GBs of email was running POP3, not IMAP. It turns out they had a setting to delete POP3 mail after X days turned on but it just went ignored. I know this is not how POP3 is supposed to work, but is there a way to get dovecot to honor the user's settings in Outlook? Or should I just tell the client to turn this off and use a proper IMAP account?

3 2

Skipped because not active
by 刘莹莹 03 Mar '21

03 Mar '21

config: mail_attribute_dict = file:%h/dovecot-attributes mailbox_list_index=yes plugin { push_notification_driver = dlog push_notification_driver = ox:url=http://127.0.0.1:80/notify-example.php } protocol imap { mail_plugins = autocreate notify push_notification imap_metadata = yes } protocol lda { mail_plugins = autocreate notify push_notification log_path = /var/log/lda.log } Error: Debug: push-notification-ox: Skipped because not active (/private/vendor/vendor.dovecot/pvt/server/vendor/vendor.dovecot/http-notify METADATA not set)

2 1

Can master users retain private \Seen flags ?
by tuuialou 02 Mar '21

02 Mar '21

Hello, I am trying to setup a shared mailbox for a small team. Let's say Alice and Bob both need to read and answer sales(a)example.com. I would like Alice and Bob to retain private \Seen flags on sales(a)example.com. I know I can achieve that with INDEXPVT on shared or public mailboxes but I am not 100% happy with this solution because: - Thunderbird displays sales(a)example.com/Inbox and sales(a)example.com/Sent as "subscribed folders" within alice(a)example.com and bob(a)example.com. So Alice and Bob can't use the unified view of Thunderbird. - I need create a special identity in Alice and Bob Thunderbird's configuration so the sender is sales(a)example.com when Alice or Bob sends an email from sales(a)example.com (and not alice(a)example.com or bob(a)example.com) But I am not sure another email client is able to do that (on a mobile phone for example). - I need to add ACL rights if a new folder is created under sales(a)example.com. So I am now looking at the "master users" feature of Dovecot to replicate this MS Exchange setup https://www.en.its.aau.dk/instructions/Mail/shared-mailbox-thunderbird/ (alice(a)example.com and bob(a)example.com log is as sales(a)example.com) I achieved that but I don't know how to retain private \Seen flags so that Bob doesn't see an email as read even if Alice has marked it as read before. Is it possible to retain private \Seen flags with master users? If yes, how can I achieve that? Thank you for any help! PS: I posted the same question on https://forum.iredmail.org/post77816.html and https://forum.iredmail.org/topic13549-proposal-for-a-exchange-like-shared-m… but I couldn't get help and was advised to ask here.

2 6

migrating users to new server, dsync ?
by Voytek Eymont 02 Mar '21

02 Mar '21

I have Dovecot 2.3.13 on new server, 2.3.11 on 'old' server, Centos 6, old server still has a couple domains and about a dozen users, what's a the best way to migrate user mailboxes to new server (Maildir), use 'dsync' , is that the way to do it ? TIA, V

2 1

Failed to map transaction log path - Stale file handle
by Gonzalo Palacios Goicolea 02 Mar '21

02 Mar '21

Hi All, We recently moved from RHEL6 to RHEL7 and updated dovecot from dovecot-2.2.10-1_14.el6.x86_64 to dovecot-2.2.36-8.el7.x86_64. We use NFS for storing the mail, and 5 servers running at the same time. Before updating dovecot we stopped the service and deleted all dovecot.index* files Now we're experiencing some problems. For example, when deleting an email it is note deleted and appears again duplicated. These are the logs: Feb 28 08:50:42 server5 dovecot: imap(user@domain): Error: Index path/Maildir/dovecot.index: Lost log for seq=5 offset=228: Missing middle file seq=5 (between 5..4294967295, we have seqs 4): Log is locked - newer log can't exist (initial_mapped=1, reason=Index mapped) Feb 28 08:50:42 server5 dovecot: imap(user@domain): Warning: fscking index file path/Maildir/dovecot.index Feb 28 08:50:42 server5 dovecot: imap(user@domain): Error: Failed to map transaction log path/Maildir/dovecot.index.log at sync_offset=10328 after locking: pread() failed: Stale file handle Feb 28 08:50:42 server5 dovecot: imap(user@domain): Error: Index path/Maildir/dovecot.index: Lost log for seq=5 offset=228: Missing middle file seq=5 (between 5..4294967295, we have seqs 4): Requested newer log than exists - still after NFS flush: Log inode is unchanged (initial_mapped=1, reason=Index mapped) Feb 28 08:50:45 server5 dovecot: imap(user@domain): Error: Failed to map transaction log path/Maildir/dovecot.index.log at sync_offset=10328 after locking: pread() failed: Stale file handle Feb 28 08:50:45 server5 dovecot: imap(user@domain): Error: Failed to map view for path/Maildir/dovecot.index: Missing middle file seq=5 (between 5..5, we have seqs 4): Requested newer log than exists - still after NFS flush: Log inode is unchanged Usually restarting the email client solves the problem for a while. We've tried deleting the indexes but it happens again some time later. This is dovecot config: dovecot -n # 2.2.36 (1f10bfa63): /etc/dovecot/dovecot.conf # Pigeonhole version 0.4.24 (124e06aa) # OS: Linux 3.10.0-1160.6.1.el7.x86_64 x86_64 Red Hat Enterprise Linux Server release 7.9 (Maipo) # Hostname: server auth_cache_negative_ttl = 5 mins auth_cache_size = 500 M auth_cache_ttl = 5 mins auth_failure_delay = 5 secs default_vsz_limit = 1 G disable_plaintext_auth = no hostname = server imap_logout_format = in(bytes read)=%i out(bytes sent)=%o listen = * lock_method = dotlock mail_fsync = always mail_location = maildir:%h/Maildir mail_nfs_index = yes mail_nfs_storage = yes mail_plugins = " quota mail_log notify" managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext imapflags notify mbox_write_locks = fcntl mmap_disable = yes namespace { location = maildir:%h/Maildir/_backup prefix = _backup. separator = . type = private } namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } passdb { args = /etc/dovecot/dovecot-ldap.conf.ext driver = ldap } plugin { mail_log_events = delete undelete expunge mailbox_delete mailbox_rename mailbox_create save mail_log_fields = uid box msgid from subject quota = maildir:_backup:ns= quota_exceeded_message = El espacio asignado para el almacenamiento del correo del destinatario ha superado su capacidad total. Por ello, el correo que usted intenta enviar no se puede entregar al destinatario. quota_warning = storage=70%% quota-warning 70 %u quota_warning1 = storage=90%% quota-warning 90 %u quota_warning2 = storage=95%% quota-warning 95 %u quota_warning3 = storage=99%% quota-warning 99 %u sieve = ~/.dovecot.sieve sieve_dir = ~/Maildir/sieve sieve_extensions = +notify +imapflags } postmaster_address = postmaster@domain protocols = imap pop3 sieve service auth { unix_listener auth-userdb { group = vmail mode = 0666 user = vmail } } service imap-login { inet_listener imap { port = 143 } process_min_avail = 20 } service imap { process_limit = 2048 } service managesieve-login { inet_listener sieve { port = 4190 } inet_listener sieve_deprecated { port = 2000 } process_min_avail = 20 } service pop3-login { inet_listener pop3 { port = 110 } process_min_avail = 20 } service pop3 { process_limit = 2048 } service quota-warning { executable = script /etc/dovecot/scripts_notification_quota/quota-warning.sh unix_listener quota-warning { user = vmail } user = vmail } ssl = no ssl_cert = </etc/pki/dovecot/certs/dovecot.pem ssl_key = # hidden, use -P to show it submission_host = smtp.domain:25 syslog_facility = local1 userdb { args = /etc/dovecot/dovecot-ldap.conf.ext driver = ldap } protocol lda { mail_plugins = " quota mail_log notify sieve" } protocol imap { mail_max_userip_connections = 10000 mail_plugins = " quota mail_log notify imap_quota" } protocol pop3 { mail_max_userip_connections = 10 } Can you please help me? Thanks in advance and best regards -- *Gonzalo Palacios Goicolea* U.T de Infraestructura de Equipos Centrales /Tecnologías de la Información/ Universidad Autónoma de Madrid • Campus de Cantoblanco <3D"http://www.uam.es/"> Antes de imprimir este correo piense si es necesario.Cuidemos el medioambiente.

2 5

Issue with masterauth
by Samuel Mutel 02 Mar '21

02 Mar '21

Hello, I would like to setup masterauth account to be able to connect to imap to log in as other users without password. My users are currently setup in LDAP and it is working correctly. I follow the page https://doc.dovecot.org/configuration_manual/authentication/master_users/ to setup this but I think I forgot something. When I try to login with telnet: Master user logging in as toto => it seems that i can connect with master user ldap(toto,127.0.0.1,<quR66Hm8KgB/AAAB>): invalid credentials => however ldap is request for password check, why ? Normmally the goal of master user is to not specify the password of the final user... Thanks.

2 1

Search is uninterruptable
by van der Kamp, John 01 Mar '21

01 Mar '21

Hi, When a user is doing a search, and the data is not indexed, then a search can take a very long time. It seems that search process is uninterruptable. The IMAP connection gets a status message with an ETA every so often, but an administrator on the server cannot stop it. Any SIGTERM or doveadm kick is ignored. Also, when the client times out (it seems clients are not seeing the ETA as a reason to keep the connection open) and the client disconnects is this search process continuing, even though any write to the socket would return an error. I believe the server is stuck in this loop: https://github.com/dovecot/core/blob/master/src/lib-storage/index/index-sea… Somehow the server needs to check for disconnected clients and let the session be kicked from the server too. You probably know better what to do about this then me. John Amazon Development Center (Netherlands) B.V., Johanna Westerdijkplein 1, 2521 EN The Hague, Registration No. Chamber of Commerce 56869649, VAT: NL 852339859B01

3 2

dsync and sieve again
by Edgaras Lukoševičius 01 Mar '21

01 Mar '21

Hi, I'm starting to wonder if dsync is supposed to sync sieve scripts at all? Or should it work only as a part of replicator? Because I was not able to get it working on multiple Dovecot and Pigeon versions, and I see lots of replication/dsync and sieve related questions in the mailing list. I'm trying to get it to work using latest versions on http://repo.dovecot.org/ce-2.3-latest repo. The versions I am testing at the moment are: - Dovecot 2.3.13 (89f716dc2) - Pigeonhole 0.5.13 (cdd19fe3) It's a straightforward setup, nothing fancy. So the question is - is it supposed to work at all without replicator?

2 3

sieve_after seems to not bring any effect to life in dovecot 2.3.13 dovecot-pigeonhole-0.5.13
by Bug Report 26 Feb '21

26 Feb '21

dovecot 2.3.13 (89f716dc2) dovecot-pigeonhole-0.5.13 OS: FreeBSD amd64 12.2-RELEASE After following code ------ require ["copy"]; # rule:[redirect] if true { redirect :copy "mail(a)mail.com"; keep; } ------ (both with keep and without keep) is executed sieve_after seems to not execute at all. Same code together with sieve_after was working as supposed in earlier versions.

3 7

doveadm user '*' vs sssd: enumeration works only once
by Heiko Schlittermann 25 Feb '21

25 Feb '21

Hi, I've a quite simple setup using sssd (id_provider, auth_provider: AD), and dovecot. doveadm user * returns the full user list only once. A 2nd invocation of the same command within a small timeframe returns a subset of the local users only (the users I've in /etc/passwd with uid >= first_valid_uid). If I wait until the dovecot/auth worker processes are gone (or if I kill them), I get the full list again. Calling getent passwd repeateadly always returns the full list of users. Question: - [ ] unfortunate configuration (see attachment) - [ ] misbehaviour of sssd (more specifically its nss module) - [ ] misbehaviour of dovecot/auth processes? Dovecot: 2.3.4.1 (f79e8e7e4) Operating System: Debian GNU/Linux 10 (buster) Sssd: 1.16.30 Best regards from Dresden/Germany Viele Grüße aus Dresden Heiko Schlittermann -- SCHLITTERMANN.de ---------------------------- internet & unix support - Heiko Schlittermann, Dipl.-Ing. (TU) - {fon,fax}: +49.351.802998{1,3} - gnupg encrypted messages are welcome --------------- key ID: F69376CE -

2 8

doveadm copy not respecting quotas?
by MAREN ZUBIZARRETA 24 Feb '21

24 Feb '21

Hello: I have a problema with the quotas at my system with dovecot 2.3.9.2, y use: quota_rule5 = RECUPERADOS_VGTIC:ignore I want to be free of quota limits at that mailbox RECUPERADOS_VGTIC when copying messages from "lazy_expunge" folder To recover from backup I use doveadm copy: doveadm copy -u nppgiibi RECUPERADOS_VGTIC mailbox .BORRADOS_VGTIC/sent-mail ALL But when I do so, quota for this mailbox RECUPERADOS_VGTIC is not ignored, and it grows to 200% Is this a bug? Or there is something that I'm doing wrongly? Thanks for your help. Maren PD: My config file for quotas follows below: /etc/dovecot/conf.d/90-quota.conf # Quota mail_vsize_bg_after_count = 100 # Limits plugin { quota = count:User quota quota_rule = *:storage=10G #for backups and lazy expunge quota_rule3 = .BORRADOS:ignore quota_rule4 = Recuperados_VGTIC:ignore quota_rule5 = RECUPERADOS_VGTIC:ignore quota_rule6 = BORRADOS_VGTIC:ignore quota_rule7 = .BORRADOS_VGTIC:ignore # This is required quota_vsizes = yes } -----Mensaje original----- De: dovecot <dovecot-bounces(a)dovecot.org> En nombre de Aki Tuomi Enviado el: miércoles, 24 de febrero de 2021 8:37 Para: Mark Constable <markc(a)renta.net>; dovecot(a)dovecot.org Asunto: Re: LMDB support? > On 24/02/2021 08:15 Mark Constable <markc(a)renta.net> wrote: > > > Hi all, is there any way I could use LMDB for userdb and passdb lookups? You can use Lua userdb/passdb. See https://doc.dovecot.org/configuration_manual/authentication/lua_based_authe… Aki

1 0

LMDB support?
by Mark Constable 24 Feb '21

24 Feb '21

Hi all, is there any way I could use LMDB for userdb and passdb lookups?

2 1

Problem with fs:User quota: Postfix quota-status returns always DUNNO
by Niccolo Rigacci 23 Feb '21

23 Feb '21

I installed a mail server on a Debian GNU/Linux 10 Buster, which provide Dovecot 2.3.4.1. It works almost everything, but I'm unable to make the Postfix quota service to work as expected. First of all I verify that the Dovecot idea of quota is OK: doveadm quota get -u username(a)example.org Quota name Type Value Limit % User quota STORAGE 2752 3500 78 Then I ask the Postfix quota-status service: printf "recipient=username(a)example.org\nsize=3000000\n\n" \ | nc localhost 12340 action=DUNNO But a size of 3 Mb should trigger the "action=554 5.2.2 Quota exceeded" message. I find a workaround for this problem: just adding the following section will "fix" the problem: plugin { quota_over_flag_value = FALSE quota_over_script = quota-warning mismatch %u } How the quota_over_flag_value is related to the quota over filesystem? Why should I add both the quota_over_flag_value AND the quota_over_script options? The script is executed always for each SMTP check (regardless of the quota_over_flag_value is FALSE or TRUE), obviously I provided a "do nothing" quota-warning script. Here the relevant parts of "dovecot -n" output: plugin { quota = fs:User quota:user quota_grace = 5%% quota_over_flag_value = FALSE quota_over_script = quota-warning mismatch %u quota_status_nouser = DUNNO quota_status_overquota = 554 5.2.2 Quota exceeded quota_status_success = DUNNO quota_warning = storage=90%% quota-warning 90 %u quota_warning2 = storage=80%% quota-warning 80 %u sieve = file:~/sieve;active=~/.dovecot.sieve sieve_before = ~/sieve_before.d/ sieve_extensions = +vnd.dovecot.filter sieve_filter_bin_dir = /usr/local/lib/dovecot/sieve-filter sieve_filter_socket_dir = sieve-filter sieve_plugins = sieve_extprograms } service quota-status { client_limit = 1 executable = quota-status -p postfix inet_listener { port = 12340 } } service quota-warning { executable = script /usr/local/bin/quota-warning.sh unix_listener quota-warning { group = dovecot mode = 0666 user = dovecot } user = root } -- Niccolo Rigacci - http://www.rigacci.net/ Firenze/Prato - Italy Tel. Mobile: +39-327-5619352

1 0

Bug renaming folder hierarchies
by Klaus Steinberger 23 Feb '21

23 Feb '21

Hi, we discovered a major problem with renaming folders with subfolders testszenario: folders: test1 test1/test1-1 test1/test1-2 all 3 folders contain a test message after renaming the top level folder test1 to test2 following folders exist: test2 test2/test1-1 test2/test1-2 the subfolders test1-1 and test1-2 are empty, the top level folder contains the correct message. Now renmaing test2 back to test1: Alle folders again contain their messages. So this looks like during renaming the top level folder just the message references for the subfolders got lost, and with renaming back they are there again. I can reproduce this behavior both with thunderbird and Horde Webmail as a client, also it happens with a second different dovecot setup Here is the dovecot config: root@dmz-sv-dovecot ~]# dovecot -n # 2.3.13 (89f716dc2): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.13 (cdd19fe3) # OS: Linux 3.10.0-1160.15.2.el7.x86_64 x86_64 Scientific Linux release 7.9 (Nitrogen) nfs4 # Hostname: dmz-sv-dovecot.physik.uni-muenchen.de auth_cache_negative_ttl = 5 mins auth_cache_size = 10 M auth_cache_ttl = 5 mins auth_socket_path = /var/run/dovecot/auth-userdb auth_username_format = %Ln auth_verbose = yes default_client_limit = 32768 default_process_limit = 8192 dict { acl = mysql:/etc/dovecot/dovecot-dict-sql.conf.ext quota = mysql:/etc/dovecot/dovecot-dict-sql.conf.ext } first_valid_uid = 8 imap_capability = +SPECIAL-USE imap_hibernate_timeout = 1 mins imapc_features = rfc822.size imapc_host = zarafa.physik.uni-muenchen.de imapc_user = %u lda_original_recipient_header = X-Original-To mail_fsync = always mail_location = mdbox:/var/vmail/%Lu:FULLDIRNAME=DbOx-mAiLs:UTF-8:VOLATILEDIR=/var/dovecot-volatile/%Lu:INDEX=/var/vmail/%Lu/indexes mail_nfs_index = yes mail_plugins = quota acl lazy_expunge fts fts_lucene mail_prefetch_count = 20 mail_server_admin = mailto:helpdesk@physik.uni-muenchen.de mail_server_comment = IMAP Server Fakultätfür Physik LMU München mailbox_list_index_very_dirty_syncs = yes managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext mbox_write_locks = fcntl metric imap_command { filter = event=imap_command_finished AND tagged_reply_state=OK group_by = cmd_name } metric imap_select_no { filter = event=imap_command_finished AND cmd_name=SELECT AND tagged_reply_state=NO } metric imap_select_no_notfound { filter = event=imap_command_finished AND cmd_name=SELECT AND tagged_reply="NO*Mailbox doesn't exist:*" } metric push_notifications { filter = event=push_notification_finished } metric storage_http_gets { filter = event=http_request_finished AND category=storage AND method=get } mmap_disable = yes namespace { list = children location = mdbox:/var/vmail/%%Lu:FULLDIRNAME=DbOx-mAiLs:INDEX=/var/vmail/%%Lu/indexes:INDEXPVT=/var/vmail/%%Lu/indexes.pvt:UTF-8 prefix = shared/%%n/ separator = / subscriptions = no type = shared } namespace { hidden = yes list = children location = mdbox:/var/vmail/%Lu/expunged:FULLDIRNAME=DbOx-mAiLs:UTF-8 prefix = .EXPUNGED/ separator = / subscriptions = no type = private } namespace inbox { inbox = yes location = mailbox Drafts { auto = subscribe special_use = \Drafts } mailbox Junk { auto = subscribe special_use = \Junk } mailbox Sent { auto = subscribe special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { auto = subscribe special_use = \Trash } prefix = separator = / subscriptions = yes type = private } passdb { args = /etc/dovecot/dovecot-ldap.conf.ext driver = ldap } plugin { acl = vfile:/etc/dovecot/dovecot.acl acl_shared_dict = file:/var/vmail/dovecot-dicts/shared-mailboxes fts = lucene fts_lucene = whitespace_chars=@. lazy_expunge = .EXPUNGED/ lazy_expunge_only_last_instance = yes quota = dict:User quota::proxy::quota quota_grace = 10%% quota_rule = *:storage=1G quota_rule2 = Trash:storage=+100M quota_rule3 = Spam:storage=+100M quota_rule4 = .EXPUNGED:ignore recipient_delimiter = + sieve = file:/var/vmail/%Lu/sieve;active=/var/vmail/%Lu/dovecot.sieve sieve_vacation_use_original_recipient = yes } postmaster_address = postmaster(a)physik.uni-muenchen.de protocols = imap lmtp sieve sieve quota_full_tempfail = yes service auth { unix_listener auth-userdb { group = daemon mode = 0666 user = mail } } service dict { unix_listener dict { group = daemon mode = 0600 user = vmail } } service imap-hibernate { client_limit = 8192 unix_listener imap-hibernate { user = vmail } } service imap-login { process_min_avail = 6 service_count = 0 vsz_limit = 1 G } service imap-postlogin { executable = script-login -d /etc/dovecot/acl_groups.py user = $default_internal_user } service imap { executable = imap imap-postlogin process_limit = 8192 unix_listener imap-master { user = dovecot } } service managesieve-login { inet_listener sieve { port = 4190 } process_min_avail = 0 service_count = 1 vsz_limit = 64 M } service managesieve { process_limit = 1024 } service stats { unix_listener stats-reader { group = dovecot mode = 0660 user = vmail } unix_listener stats-writer { group = dovecot mode = 0660 user = vmail } } ssl = required ssl_cert = </etc/pki/tls/certs/dmz-sv-dovecot-with-chain.crt.pem ssl_client_ca_file = /etc/ssl/certs/ca-bundle.crt ssl_dh = # hidden, use -P to show it ssl_key = # hidden, use -P to show it userdb { args = /etc/dovecot/dovecot-ldap.conf.ext driver = ldap } verbose_proctitle = yes protocol lmtp { mail_plugins = quota acl lazy_expunge fts fts_lucene sieve } protocol lda { mail_plugins = quota acl lazy_expunge fts fts_lucene sieve syslog_facility = mail } protocol imap { mail_max_userip_connections = 20 mail_plugins = quota acl lazy_expunge fts fts_lucene imap_quota imap_acl lazy_expunge } protocol sieve { mail_max_userip_connections = 10 managesieve_implementation_string = Dovecot Pigeonhole managesieve_logout_format = bytes=%i/%o managesieve_max_compile_errors = 5 managesieve_max_line_length = 64 k

1 0

Some questions about mail_crypt setups
by deano-dovecot＠areyes.com 23 Feb '21

23 Feb '21

Some questions about mail_crypt setups I have global mail enecryption working nicely, and replication works nicely between two systems. The main problem is that the private and public keys are *right there* on the server in /etc/dovecot/private ... Fine for a completely controlled system, but not so fine when on a rented VPS etc. When are the keys read in by dovecot ? Are they ever read in again while dovecot is running, or does it cache them in ram until dovecot is restarted ? Would it be possible for dovecot to read the keys as output from a script ? I'm thinking of a small script that would reach out to an authentication service like Authy or Okta or similar. Admin gets an alert on their phone, taps OK, UNLOCK and the two keys are returned to the script, which then hands them back to dovecot and away it goes. The mail_crypt config normally contains > mail_crypt_global_private_key = </etc/dovecot/private/dovecot_crypt_privkey > mail_crypt_global_public_key = </etc/dovecot/private/dovecot_crypt_pubkey Perhaps add another variable like > mail_crypt_global_script = </etc/dovecot/private/dovecot_crypt_script That script would run and feed the two keys back into dovecot (no matter how it got to them). So I started looking into per-user/per-folder encryption to see how that would work, and I have that setup nicely too. The config looks like this > # /etc/dovecot/conf.d/99-mailcrypt.conf > #-------------------------------------- > mail_attribute_dict = file:%h/Maildir/dovecot-attributes > plugin { > mail_crypt_require_encrypted_user_key = yes > mail_crypt_save_version = 2 > mail_crypt_curve = secp521r1 > } > > # /etc/dovecot/dovecot-sql.conf.ext > #---------------------------------- > # CREATE TABLE IF NOT EXISTS `users` ( > # `username` varchar(64) character set utf8 collate utf8_bin NOT NULL COMMENT 'localpart of email-address', > # `domain` varchar(64) character set utf8 collate utf8_bin NOT NULL COMMENT 'domain-part of email-address', > # `name` varchar(64) character set utf8 collate utf8_bin NOT NULL COMMENT 'Full name of user', > # `password` varchar(128) character set utf8 collate utf8_bin NOT NULL COMMENT 'base64-encoded SHA512 hash of password', > # PRIMARY KEY (`username`,`domain`) > # ) ENGINE=InnoDB DEFAULT CHARSET=utf8 COMMENT='users'; > > driver = mysql > connect = host=/var/run/mysqld/mysqld.sock dbname=emailers user=dovecot password=RandomPassword > default_pass_scheme = SHA512-CRYPT > > password_query = SELECT username, password, '%w' AS userdb_mail_crypt_private_password, '/var/mail/%d/%n' AS userdb_home, 'vmail' AS userdb_uid, 'vmail' AS userdb_gid FROM users WHERE username = '%n' AND domain = '%d' > > # For LDA: > user_query = SELECT '/var/mail/%d/%n' AS home, 'vmail' AS uid, 'vmail' AS gid FROM users WHERE username = '%n' AND domain = '%d' > > # For using doveadm -A: > iterate_query = SELECT username, domain FROM users Except that replication doesn't work due to the user password not being available. Actually, indexing fails too for the same reason. > Feb 21 14:02:13 indexer-worker(testuser(a)example.com)<120846><l8W9BzWuMmAK2AEAqNyxgw:MyoJDDWuMmAO2AEAqNyxgw>: Error: Mailbox INBOX: UID=1: read() failed: read(/var/mail/example.com/testuser/Maildir/INBOX/new/1613934133.M132059P12… failed: Private key not available: Cannot decrypt key f64e7c12a60b3df12ebf865a70bec57fedd3e9b4fd98df93205f1096db14fda7: Cannot decrypt key eca099273f525ca46b2f5640253770ad19e0578543244d8cd34bde183e996bd5: Password not available (read reason=fts indexing) > > Feb 21 14:02:13 indexer-worker(testuser(a)example.com)<120846><l8W9BzWuMmAK2AEAqNyxgw:MyoJDDWuMmAO2AEAqNyxgw>: Error: Failed to read mailbox INBOX mail UID=1 stream: Mailbox INBOX: UID=1: read() failed: read(/var/mail/example.com/testuser/Maildir/INBOX/new/1613934133.M132059P12… failed: Private key not available: Cannot decrypt key f64e7c12a60b3df12ebf865a70bec57fedd3e9b4fd98df93205f1096db14fda7: Cannot decrypt key eca099273f525ca46b2f5640253770ad19e0578543244d8cd34bde183e996bd5: Password not available (read reason=fts indexing) > > Feb 21 14:02:13 indexer-worker(testuser(a)example.com)<120846><l8W9BzWuMmAK2AEAqNyxgw:MyoJDDWuMmAO2AEAqNyxgw>: Error: Mailbox INBOX: Mail search failed: Internal error occurred. Refer to server log for more information. [2021-02-21 14:02:13] > > Feb 21 14:02:13 indexer-worker(testuser(a)example.com)<120846><l8W9BzWuMmAK2AEAqNyxgw:MyoJDDWuMmAO2AEAqNyxgw>: Error: Mailbox INBOX: Transaction commit failed: FTS transaction commit failed: transaction context (attempted to index 1 messages (UIDs 1..1)) > > Feb 21 14:02:13 dsync-local(testuser(a)example.com)<TGxiDTWuMmAN2AEAqNyxgw>: Error: Mailbox INBOX: UID=1: read() failed: read(/var/mail/example.com/testuser/Maildir/INBOX/new/1613934133.M132059P12… failed: Private key not available: Cannot decrypt key f64e7c12a60b3df12ebf865a70bec57fedd3e9b4fd98df93205f1096db14fda7: Cannot decrypt key eca099273f525ca46b2f5640253770ad19e0578543244d8cd34bde183e996bd5: Password not available (read reason=prefetch) What are the options here for providing the decryption password or key ? The user password is already stored in the mysql database as a SHA512-CRYPT so we don't want to store it unencrypted ... I saw the mail_crypt docs (https://doc.dovecot.org/configuration_manual/mail_crypt_plugin/) mention > mail_crypt_private_key - Private key to decrypt user's master key, can be base64 encoded I'm assuming that can just be a key generated with > openssl ecparam -name secp521r1 -genkey | openssl pkey but that leaves the situation almost the same as with a global key - they key is local on the system, though a bit better in that it's not just visible there as a simple file, it can be buried in the database. One could retrieve it with > password_query = SELECT username, password, privkey AS userdb_mail_crypt_private_key, '/var/mail/%d/%n' AS userdb_home, 'vmail' AS userdb_uid, 'vmail' AS userdb_gid FROM users WHERE username = '%n' AND domain = '%d' How are other people handling mail store encryption ? -- Dean Carpenter deano is at areyes dot com 203 six oh four 6644

4 3

doveadm sync different local vs remote account/mailbox name
by Gregory Sloop 22 Feb '21

22 Feb '21

I'm, trying to sync/backup mailboxes from a current dovecot instance to a new server. But the old server has real system accounts. The new server has virtual users. And the account/user-name is different. Example: Joe Sixpack is joes (on the old system) but is joes(a)sixpack.org (on the new system.) I'm using something like this to attempt the sync doveadm -o mail_fsync=never backup -R -u joes(a)sixpack.org imapc: This works from the new system, as it recognizes the user with a full @domain.com username - but the old system doesn't know who joes(a)sixpack.org is - and just wants joes. I don't see a way to specify the remote account username independently from the local one. What's the best way to handle this? TIA -Greg

1 1

BUG report
by Oleg Pyzin 22 Feb '21

22 Feb '21

Hello! I've compiled Dovecot on a macmini G4 PPC from ports, but couldn't launch it. When Dovecot is trying to launch it's stop launching because got an error. ------------- The error is: Feb 09 19:22:50 master: Panic: kevent(EV_ADD, READ, 21) failed: Invalid argument Feb 09 19:22:50 master: Error: Raw backtrace: 0 libdovecot.0.dylib 0x00216d58 askpass + 136 -> 1 libdovecot.0.dylib 0x00216e78 backtrace_get + 36 -> 2 libdovecot.0.dylib 0x00221fe8 i_set_debug_file + 248 -> 3 libdovecot.0.dylib 0x002220fc default_fatal_handler + 56 -> 4 dovecot 0x000039a0 dup2_append + 1884 -> 5 libdovecot.0.dylib 0x00221a8c i_panic + 120 -> 6 libdovecot.0.dylib 0x0022c13c io_loop_handle_add + 244 -> 7 libdovecot.0.dylib 0x0022f2c8 timeout_add_short + 416 -> 8 libdovecot.0.dylib 0x0022f574 io_add_to + 76 -> 9 dovecot 0x00007dd4 service_monitor_stop_close + 288 -> 10 dovecot 0x00008cdc services_monitor_start + 840 -> 11 dovecot 0x00004aa4 main + 3336 -> 12 dovecot 0x00003048 start + 68 ------------- dovecot -n: admin.MacPPC[/opt/local/var/log/dovecot] <467-7> $ sudo dovecot -n # 2.3.11.3 (): /opt/local/etc/dovecot/dovecot.conf # OS: Darwin 9.8.0 Power Macintosh hfs # Hostname: MacPPC.Dlink default_client_limit = 50 default_internal_group = _dovecot default_process_limit = 10 default_vsz_limit = 128 M info_log_path = /opt/local/var/log/dovecot/info listen = * log_path = /opt/local/var/log/dovecot/error login_plugin_dir = /opt/local/lib/dovecot mail_location = maildir:/private/srv/mail/%u namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } protocols = imap pop3 service imap { process_limit = 32 } service pop3 { process_limit = 32 } service submission { process_limit = 32 } ssl_cert = </etc/ssl/certs/dovecot.pem ssl_key = # hidden, use -P to show it userdb { driver = passwd }

2 1

Policy on folder's name and path's length
by Rupert Gallagher 22 Feb '21

22 Feb '21

Hello, Users can be really good at hanging everybody when you give them enough roope. I spotted a number of problems that I think are of interest to everybody and need mitigation. # length of path A busy Windows user wrote enough mail subfolders, and folder names with soo many characters, that exceed Windows maximum path length. To avoid taxing the mail server, their mail client (Thunderbird) is configured to keep a local copy of emails. I need to enforce a policy on the maximum path length they can create, and the maximum number of characters on any given folder name. # forbidden characters Another problem folder names was the presence of white spaces, note the plural, on both the beginning and end of folder names. For example, to emphasize the importance of folders, the user added white spaces in front of names: > Must be at the top > Very important > A bit less important >Normal stuff And to add insult to injury they wrote spaces at the end of folder names: > This is a folder name with two hidden spaces I need to enfoce a policy that forbids the use white spaces at the beginning and end of folder names, as well as the use of repeated characters: > ____ I spotted your policy and found this new trick # subfolders, everywhere... A user confused their IMAP account for a file system and mind map tool, so they created folders everywhere, including root folders at the same level of inbox, draft, junk, trash, and huge directories under inbox. I need to enforce a policy that allows the creation of folders only under /Archive. I think such policies make good sense on any dovecot server and should be enforced by default.

2 2

Dovecot dsync certificate errors
by Stephan Mending 22 Feb '21

22 Feb '21

Hi *, I've setup two dovecot instances. As soon as i send the syncing part of dovecot to work I see the following errors in my maillogs. $ cat /var/log/mail.log doveadm(inbox(a)sec-level.domain): Error: doveadm server disconnected before handshake: SSL certificate doesn't match expected host name fqdn.of.system: No match to 1 SubjectAltNames doveadm(inbox(a)sec-level.domain): Error: Disconnected from remote: SSL certificate doesn't match expected host name fqdn.of.system: No match to 1 SubjectAltNames A little context: The certificates on the servers are issued by a private CA. The public CA-Certificate has been added to the keystore, though. Shouldn't be a problem. I can confirm that by connecting using s_client -> $ openssl s_client -connect <hostname-of-dovecot-A>:12345 .. ... .... Verify return code: 0 (ok) So far the certificate seems to be ok. **BUT**: As soon as i start dovecot (on the very same machine I issued the s_client command above) ... I am receiving the error messages: doveadm(inbox(a)sec-level.domain): Error: doveadm server disconnected before handshake: SSL certificate doesn't match expected host name fqdn.of.system: No match to 1 SubjectAltNames doveadm(inbox(a)sec-level.domain): Error: Disconnected from remote: SSL certificate doesn't match expected host name fqdn.of.system: No match to 1 SubjectAltNames And yes the SubjectAlternativeName in the certificate matches the configured FQDN in 30-dsync.conf. My 30-dsync.conf: $ cat /etc/dovecot/conf.d/30-dsync.conf service aggregator { fifo_listener replication-notify-fifo { user = dovecot mode = 0666 } unix_listener replication-notify { user = dovecot mode = 0666 } } # Configuring the replicator service service replicator { process_min_avail = 1 unix_listener replicator-doveadm { user = dovecot mode = 0666 } } service doveadm { user = dovecot inet_listener { port = 12345 ssl = yes } } doveadm_port = 12345 doveadm_password = <password> replication_max_conns = 1 plugin { mail_replica = tcps:fqdn.of.system } service config { unix_listener config { user = dovecot } } I'd love to here the answer to this. Thanks alot ! Best regards, Stephan

2 1

Possible minor issue with ~ vs %h
by Marc Delling 21 Feb '21

21 Feb '21

Hi there! The documentation states one should prefer "~" over "%h" as placeholder for mail_home, nevertheless, in an official example for mail_attribute_dict "%h" was used like this: mail_home = /var/vmail/mailboxes/%d/%n mail_location = maildir:~/mail:LAYOUT=fs # this works mail_attribute_dict = file:%h/mail/dovecot-attributes # this works I thought I would be clever and replace "%h" with "~" but if I do this, it does not behave as expected. Instead it creates a new directory named "~" inside mail_home. mail_home = /var/vmail/mailboxes/%d/%n mail_location = maildir:~/mail:LAYOUT=fs # this still works mail_attribute_dict = file:~/mail/dovecot-attributes # this does not work I just wanted to bring it up, maybe I misinterpreted the documentation. I abolished the tilde for now, even if it is the preferred way. All the best Marc

1 0

Messages sent to alias+detail end up in INBOX
by ml＠shadrinden.ru 21 Feb '21

21 Feb '21

Hi, everyone! I have seemingly correct settings for details to work: when I send a message to user+detail(a)mydomain.tld, it goes into the "detail" folder of user(a)mydomain.tld. Also I have working aliases, so when I send a message to alias(a)mydomain.tld, it goes into the INBOX folder of user(a)mydomain.tld. I expected that when I send a message to alias+detail(a)mydomain.tld, it would go into the "detail" folder of user(a)mydomain.tld. However, it goes into the INBOX folder of user(a)mydomain.tld. Is it the intended behavior? Pertinent settings: recipient_delimiter·=·+ lda_mailbox_autocreate·=·yes Or are these settings not the only ones pertinent to the case? -- Respectfully, Denis Shadrin

7 21

Sieve by the addressee
by ml＠shadrinden.ru 21 Feb '21

21 Feb '21

Hi, everyone! I have a sieve that is supposed to put all messages addressed to this mailing list into a separate folder: if anyof (address :is "to" "ml(a)shadrinden.ru", address :is "to" "dovecot(a)dovecot.org") { fileinto "mail_list"; stop; } Generally, it's working, but today I have got two mailing list messages that weren't put in that folder, they arrived straight into INBOX. I suppose that was because they were replies and were addressed to the person who asked the questions, so they had his address in "To:", and only in "Cc:" they had dovecot(a)dovecot.org. So, am I right that, when filtering messages by the addressee, it's generally a good idea to use not just "to", but ["to", "cc', "bcc"] ? -- Respectfully, Denis Shadrin

6 5

mail_crypt_global_private_key: Couldn't parse private key: Unknown/invalid PEM key type
by Antti Antinoja 20 Feb '21

20 Feb '21

Version: Dovecot 2.3.13 (89f716dc2) Issue: Dovecot states it can't parse the private key = Background = == Creating private EC key == * Curve: secp521r1 * Encryption: aes-256-ctr * Format: pkey * Enacapsulation: Base64 # openssl ecparam -name secp521r1 -genkey | openssl pkey |\ openssl ec -aes-256-ctr | base64 -w0 > test_keys_remove/private_key_encrypted.pem == Extract public key == # cat test_keys_remove/private_key_encrypted.pem | base64 -d |\ openssl ec -pubout | base64 -w0 > test_keys_remove/public_key.pem == Checking keys == * 592 Feb 20 07:27 private_key_encrypted.pem: LS0tLS1CRUdJTiBFQyBQUklWQVRFIEtFWS0tLS0tClByb2MtVHlwZTogNCxFTkNSWVBURUQKREVLLUluZm86IEFFUy0yNTYtQ1RSLEY3QzRCMUU3MDQxRDBBNDU1QjFGOUUwODA0NkRBNDAxCgpQdGE4T0F0QTN1anYwdlNNY3RpSGlUZDJqMEdTU2R6VjU3UUdtVXdDTU1RcDdRb3FCSHQvZERNRVBiUEY1bEcxCmowUER1NS9GVnVUdFVsUlpTMTYrTlNXaW9yZ2t2VkhUaDMrNDd0eC91dmlRd1FQLzQzdEVhRnBmNzdTQVpsRHcKeEIyU2pNNFp2MWhkU3BqeFdER0dKRkJEdi8yL2RqOVVwVHh3a0F3dVgrUVFoUmxWelN5cjBCQVhHOXlPcS9HVAp3czhRNUdldnp2SEdoMVl5UGdwTDlqdGJpekdJYTRVUzBmN2hFZkdHSGZKLzNSSWR6MHhlaWh2OEdhMGh1ajQ4CmRTL1FTY0U3QnYrWW16emNnMmRsdlk5Nkc1eFJJT3dCOEFEd1IvbHdidz09Ci0tLS0tRU5EIEVDIFBSSVZBVEUgS0VZLS0tLS0K * 360 Feb 20 07:28 public_key.pem: LS0tLS1CRUdJTiBQVUJMSUMgS0VZLS0tLS0KTUlHYk1CQUdCeXFHU000OUFnRUdCU3VCQkFBakE0R0dBQVFBK2w2M0ZIckpuT0dPZ1lDTG5PRVpOaHpSdW5YWgpoMHd5dTNPS1VzSEozUDJPVWxNWmxKOFFjZTF0SExUTWFxMWxkOTIwbkdJQmo1TGNYUklVdWRweElTd0I2Tld0Ck1TWncrZFBEUVRjc0hQMFRqWUh5Njl4d25BZHV4ZHZYdnh0Uk5TRzZGNlJPUnR0L2t2ekk3bWRPM0NpQ1FyMTQKTjZWalZyYWVpaXZkR2dPQ250bz0KLS0tLS1FTkQgUFVCTElDIEtFWS0tLS0tCg== == Notes == * The keys are then saved in database and fetched to userdb by Dovecot via passdb lookup (Details in the logs) * mail-crypt settings: mail_plugins = $mail_plugins mail_crypt plugin { mail_crypt_curve = secp521r1 mail_crypt_save_version = 0 } * Note: User record on database has mail_crypt_save_version = 2 as can be seen from the log extract below. = Dovecot log on client IMAP message retrieval = Feb 20 07:45:01 pf1 dovecot[19612]: auth: Debug: sql(test1(a)g1.fi,x.x.x.x,<wFzVEb67CMQKZgkb>): Performing passdb lookup Feb 20 07:45:02 pf1 dovecot[19612]: auth: Debug: sql(test1(a)g1.fi,x.x.x.x,<wFzVEb67CMQKZgkb>): Finished passdb lookup Feb 20 07:45:02 pf1 dovecot[19612]: auth: Debug: auth(test1(a)g1.fi,x.x.x.x,<wFzVEb67CMQKZgkb>): Auth request finished Feb 20 07:45:02 pf1 dovecot[19612]: auth: Debug: client passdb out: OK 1 user=test1(a)g1.fi Feb 20 07:45:02 pf1 dovecot[19612]: auth: Debug: sql(test1(a)g1.fi,x.x.x.x,<wFzVEb67CMQKZgkb>): Performing userdb lookup Feb 20 07:45:02 pf1 dovecot[19612]: auth: Debug: sql(test1(a)g1.fi,x.x.x.x,<wFzVEb67CMQKZgkb>): Finished userdb lookup Feb 20 07:45:02 pf1 dovecot[19612]: auth: Debug: master userdb out: USER 1609957377 test1(a)g1.fi mail_crypt_global_private_password=key_pass_we_know_this_is_correct mail_crypt_global_private_key=LS0tLS1CRUdJTiBFQyBQUklWQVRFIEtFWS0tLS0tClByb2MtVHlwZTogNCxFTkNSWVBURUQKREVLLUluZm86IEFFUy0yNTYtQ1RSLEY3QzRCMUU3MDQxRDBBNDU1QjFGOUUwODA0NkRBNDAxCgpQdGE4T0F0QTN1anYwdlNNY3RpSGlUZDJqMEdTU2R6VjU3UUdtVXdDTU1RcDdRb3FCSHQvZERNRVBiUEY1bEcxCmowUER1NS9GVnVUdFVsUlpTMTYrTlNXaW9yZ2t2VkhUaDMrNDd0eC91dmlRd1FQLzQzdEVhRnBmNzdTQVpsRHcKeEIyU2pNNFp2MWhkU3BqeFdER0dKRkJEdi8yL2RqOVVwVHh3a0F3dVgrUVFoUmxWelN5cjBCQVhHOXlPcS9HVAp3czhRNUdldnp2SEdoMVl5UGdwTDlqdGJpekdJYTRVUzBmN2hFZkdHSGZKLzNSSWR6MHhlaWh2OEdhMGh1ajQ4CmRTL1FTY0U3QnYrWW16emNnMmRsdlk5Nkc1eFJJT3dCOEFEd1IvbHdidz09Ci0tLS0tRU5EIEVDIFBSSVZBVEUgS0VZLS0tLS0K mail_crypt_global_public_key=LS0tLS1CRUdJTiBQVUJMSUMgS0VZLS0tLS0KTUlHYk1CQUdCeXFHU000OUFnRUdCU3VCQkFBakE0R0dBQVFBK2w2M0ZIckpuT0dPZ1lDTG5PRVpOaHpSdW5YWgpoMHd5dTNPS1VzSEozUDJPVWxNWmxKOFFjZTF0SExUTWFxMWxkOTIwbkdJQmo1TGNYUklVdWRweElTd0I2Tld0Ck1TWncrZFBEUVRjc0hQMFRqWUh5Njl4d25BZHV4ZHZYdnh0Uk5TRzZGNlJPUnR0L2t2ekk3bWRPM0NpQ1FyMTQKTjZWalZyYWVpaXZkR2dPQ250bz0KLS0tLS1FTkQgUFVCTElDIEtFWS0tLS0tCg== mail_crypt_save_version=2 quota_rule=*:bytes=0 home=/var/vmail/g1.fi/test1 uid=10000 gid=10000 auth_mech=PLAIN auth_token=66d2d0f66bcce2758235fb53dbfe821804c6e79c Feb 20 07:45:02 pf1 dovecot[19612]: imap-login: Login: user=<test1(a)g1.fi>, method=PLAIN, rip=x.x.x.x, lip=y.y,y,y, mpid=19618, TLS, session=<wFzVEb67CMQKZgkb> Feb 20 07:45:02 pf1 dovecot[19612]: imap(test1(a)g1.fi)<19618><wFzVEb67CMQKZgkb>: Debug: Added userdb setting: plugin/mail_crypt_global_private_key=LS0tLS1CRUdJTiBFQyBQUklWQVRFIEtFWS0tLS0tClByb2MtVHlwZTogNCxFTkNSWVBURUQKREVLLUluZm86IEFFUy0yNTYtQ1RSLEY3QzRCMUU3MDQxRDBBNDU1QjFGOUUwODA0NkRBNDAxCgpQdGE4T0F0QTN1anYwdlNNY3RpSGlUZDJqMEdTU2R6VjU3UUdtVXdDTU1RcDdRb3FCSHQvZERNRVBiUEY1bEcxCmowUER1NS9GVnVUdFVsUlpTMTYrTlNXaW9yZ2t2VkhUaDMrNDd0eC91dmlRd1FQLzQzdEVhRnBmNzdTQVpsRHcKeEIyU2pNNFp2MWhkU3BqeFdER0dKRkJEdi8yL2RqOVVwVHh3a0F3dVgrUVFoUmxWelN5cjBCQVhHOXlPcS9HVAp3czhRNUdldnp2SEdoMVl5UGdwTDlqdGJpekdJYTRVUzBmN2hFZkdHSGZKLzNSSWR6MHhlaWh2OEdhMGh1ajQ4CmRTL1FTY0U3QnYrWW16emNnMmRsdlk5Nkc1eFJJT3dCOEFEd1IvbHdidz09Ci0tLS0tRU5EIEVDIFBSSVZBVEUgS0VZLS0tLS0K Feb 20 07:45:02 pf1 dovecot[19612]: imap(test1(a)g1.fi)<19618><wFzVEb67CMQKZgkb>: Debug: Added userdb setting: plugin/mail_crypt_global_private_password=<hidden> Feb 20 07:45:02 pf1 dovecot[19612]: imap(test1(a)g1.fi)<19618><wFzVEb67CMQKZgkb>: Debug: Added userdb setting: plugin/mail_crypt_global_public_key=LS0tLS1CRUdJTiBQVUJMSUMgS0VZLS0tLS0KTUlHYk1CQUdCeXFHU000OUFnRUdCU3VCQkFBakE0R0dBQVFBK2w2M0ZIckpuT0dPZ1lDTG5PRVpOaHpSdW5YWgpoMHd5dTNPS1VzSEozUDJPVWxNWmxKOFFjZTF0SExUTWFxMWxkOTIwbkdJQmo1TGNYUklVdWRweElTd0I2Tld0Ck1TWncrZFBEUVRjc0hQMFRqWUh5Njl4d25BZHV4ZHZYdnh0Uk5TRzZGNlJPUnR0L2t2ekk3bWRPM0NpQ1FyMTQKTjZWalZyYWVpaXZkR2dPQ250bz0KLS0tLS1FTkQgUFVCTElDIEtFWS0tLS0tCg== Feb 20 07:45:02 pf1 dovecot[19612]: imap(test1(a)g1.fi)<19618><wFzVEb67CMQKZgkb>: Debug: Added userdb setting: plugin/=2 Feb 20 07:45:02 pf1 dovecot[19612]: imap(test1(a)g1.fi)<19618><wFzVEb67CMQKZgkb>: Debug: Added userdb setting: plugin/quota_rule=*:bytes=0 Feb 20 07:45:02 pf1 dovecot[19612]: imap(test1(a)g1.fi)<19618><wFzVEb67CMQKZgkb>: Error: mail_crypt_plugin: mail_crypt_global_private_key: Couldn't parse private key: Unknown/invalid PEM key type == Question == Any idea why Dovecot can't parse the private key? I tested this with several keys. Even with some without encryption -> Always same error. According to the debug messages the private key is correctly loaded (and indeed matches the one created on command line). Thank you for your time. Cheers, Antti -- Antti Antinoja <reader(a)fennosys.fi>

2 4

Monitoring Dovecot Replication
by MK 19 Feb '21

19 Feb '21

Hello, I have a cluster with two dovecot nodes with dovecot replication between them. The setup works fine and now I'm searching for a way to monitor the users so that I can get an information if the replication fails for one user for a longer time and I have to trigger the replication manually. Most of the time if I see a replication failure the self healing of dovecot replication repairs this in max. 10 min. I have tried different combinations of querying " doveadm replicator status '*' " and search for failed users and then send an alarm if one of fast sync, full sync or success sync reaches a threshold. But there is no combination that seems to be working if I only want to trigger this if I have to fix the replication manualy. Can someone tell me what I have to query to get only the user who's replication failed for a longer time (10 min +) and that I have to fix manually? Thank you. Oliver

4 6

Sieve regex error "invalid preceding regular expression"
by ml＠shadrinden.ru 19 Feb '21

19 Feb '21

Hi, everyone! I'm trying to get the detail part of the address (i.e. anything that comes between + and @ in the address of this type: alias+detail(a)mydomain.tld) in this sieve: if address :regex :localpart "to" "\+(.*)" { fileinto :create "${1}"; stop; } However, when I try to compile it with sievec, I get this error: error: invalid regular expression '+(.*)' for regex match: invalid preceding regular expression. Why is that? Shouldn't I escape the plus sign? Itried also not escaping it, but I get the same error. (A note why I don't use "envelope :detail" for that purpose: because the detail part of the address is not preserved in the "Envelope-To" after the message is redirected from alias to user. After that redirection the "Envelope-To" contain only user(a)mydomain.tld, not user+detail(a)mydomain.tld.) -- Respectfully, Denis Shadrin

2 2

Dovecot v2.3.14.rc1 released
by Aki Tuomi 18 Feb '21

18 Feb '21

We are pleased to release first release candidate for v2.3.14. We have done changes to packaging so please give us any feedback on how it works. https://dovecot.org/releases/2.3/rc/dovecot-2.3.14.rc1.tar.gz https://dovecot.org/releases/2.3/rc/dovecot-2.3.14.rc1.tar.gz.sig Binary packages in https://repo.dovecot.org/ Docker images are not available for this release candidate. Kind regards, Aki Tuomi Open-Xchange oy --- * Added new aliases for some variables. Usage of the old ones is possible, but discouraged. (These were partially added already to v2.3.13.) See https://doc.dovecot.org/configuration_manual/config_file/config_variables/ for more information. * Optimize imap/pop3/submission/managesieve proxies to use less CPU at the cost of extra memory usage. * Remove autocreate, expire, snarf and mail-filter plugins. * Remove cydir storage driver. * doveadm -D: Add timestamps to debug output even when LOG_STDERR_TIMESTAMP environment variable is not set. Timestamp format is taken from log_timestamp setting. * If BROKENCHAR or listescape plugin is used, the escaped folder names may be slightly different from before in some situations. This is unlikely to cause issues, although caching clients may redownload the folders. * imapc: It now enables BROKENCHAR=~ by default to escape remote folder names if necessary. This also means that if there are any '~' characters in the remote folder names, they will be visible as "~7e". * imapc: When using local index files folder names were escaped on filesystem a bit differently. This affects only if there are folder names that actually require escaping, which isn't so common. The old style folders will be automatically deleted from filesystem. * stats: Update exported metrics to be compliant with OpenMetrics standard. + doveadm: Add an optional '-p' parameter to metadata list command. If enabled, "/private", and "/shared" metadata prefixes will be prepended to the keys in the list output. + doveconf: Support environment variables in config files. See https://doc.dovecot.org/configuration_manual/config_file/config_file_syntax… for more details. + indexer-worker: Change indexer to disconnect from indexer-worker after each request. This allows service indexer-worker's service_count & idle_kill settings to work. These can be used to restart indexer-worker processes once in a while to reduce their memory usage. - auth: "nodelay" with various authentication mechanisms such as apop and digest-md5 crashed AUTH process if authentication failed. - auth: Auth lua script generating an error triggered an assertion failure: Panic: file db-lua.c: line 630 (auth_lua_call_password_verify): assertion failed: (lua_gettop(script->L) == 0). - configure: Fix libunwind detection to work on other than x86_64 systems. - doveadm-server: Process could crash if logging was done outside command handling. For example http-client could have done debug logging afterwards, resulting in either segfault or Panic: file http-client.c: line 642 (http_client_context_close): assertion failed: (cctx->clients_list == NULL). - dsync: Folder name escaping with BROKENCHAR didn't work completely correctly. This especially caused problems with dsync-migrations using imapc where some of the remote folder names may not have been accessible. - dsync: doveadm sync + imapc doesn't always sync all mails when doing an incremental sync (-1), which could lead to mail loss when it's used for migration. This happens only when GUIDs aren't used (i.e. imapc without imapc_features=guid-forced). - lib-imap: imapc parsing illegal BODYSTRUCTUREs with NILs could have resulted in crashes. This exposed that Dovecot was wrongly accepting atoms in "nstring" handling. Changed the IMAP parsing to be more strict about this now. - lib-index: If dovecot.index.cache has corrupted message size, fetching BODY/BODYSTRUCTURE may cause assert-crash: Panic: file index-mail.c: line 1140 (index_mail_parse_body_finish): assertion failed: (mail->data.parts != NULL). - lib-index: Minor error handling and race condition fixes related to rotating dovecot.index.log. These didn't usually cause problems, unless the log files were rotated rapidly. - lib-lua: Lua scripts using coroutines or lua libraries using coroutines (e.g., cqueues) panicked. - Message PREVIEW handled whitespace wrong so first space would get eaten from between words. - FTS and message PREVIEW (snippet) parsed HTML &entities case-sensitively. - lib-mail: When max nested MIME parts were reached, IMAP BODYSTRUCTURE was written in a way that may have caused confusion for IMAP clients and also Dovecot itself when parsing it. The truncated part is now written out using application/octet-stream MIME type. - lib-oauth2: HS512 and HS384 JWT token algorithms crash when you try to use them: Panic: file hmac.c: line 26 (hmac_init): assertion failed: (meth->context_size <= MAC_MAX_CONTEXT_SIZE). - event filters: NOT keyword did not have the correct associativity. NOT a AND b were getting parsed as NOT (a AND b) instead of (NOT a) AND b. - Ignore ECONNRESET when closing socket. This avoids logging useless errors on systems like FreeBSD. - event filters: event filter syntax error may lead to Panic: file event-filter.c: line 137 (event_filter_parse): assertion failed: (state.output == NULL) - lib: timeval_cmp_margin() was broken on 32-bit systems. This could potentially have caused HTTP timeouts to be handled incorrectly. - log: instance_name wasn't used as syslog ident by the log process. - master: After a service reached process_limit and client_limit, it could have taken up to 1 second to realize that more client connections became available. During this time client connections could have been unnecessarily rejected and a warning logged: Warning: service(...): process_limit (...) reached, client connections are being dropped - stats: Crash would occur when generating openmetrics data for metrics using aggregating functions. - stats: Event filters comparing against empty strings crash the stats process.

3 2

Getting panic in http-client-request.c: line 1240 during indexing on Ubuntu 20.04
by Dean Carpenter 18 Feb '21

18 Feb '21

Getting panic in http-client-request.c: line 1240 during indexing I'm testing the install/setup of dovecot on an Ubuntu Focal 20.04 system, using the dovecot repo. The packages that are installed are harryb@dove1:~$ dpkg -l dovecot* solr* jetty* tesser* | fgrep ii ii dovecot-core 2:2.3.13-2+ubuntu20.04 amd64 secure POP3/IMAP server - core files ii dovecot-imapd 2:2.3.13-2+ubuntu20.04 amd64 secure POP3/IMAP server - IMAP daemon ii dovecot-lmtpd 2:2.3.13-2+ubuntu20.04 amd64 secure POP3/IMAP server - LMTP server ii dovecot-managesieved 2:2.3.13-2+ubuntu20.04 amd64 secure POP3/IMAP server - ManageSieve server ii dovecot-mysql 2:2.3.13-2+ubuntu20.04 amd64 secure POP3/IMAP server - MySQL support ii dovecot-sieve 2:2.3.13-2+ubuntu20.04 amd64 secure POP3/IMAP server - Sieve filters support ii dovecot-solr 2:2.3.13-2+ubuntu20.04 amd64 secure POP3/IMAP server - Solr support ii jetty9 9.4.26-1 all Java servlet engine and webserver ii solr-common 3.6.2+dfsg-22 all Enterprise search server based on Lucene3 - common files ii solr-jetty 3.6.2+dfsg-22 all Enterprise search server based on Lucene3 - Jetty integration ii tesseract-ocr 4.1.1-2build2 amd64 Tesseract command line OCR tool ii tesseract-ocr-eng 1:4.00~git30-7274cfa-1 all tesseract-ocr language files for English ii tesseract-ocr-osd 1:4.00~git30-7274cfa-1 all tesseract-ocr language files for script and orientation Apache Tika v1.25 is also installed harryb@dove1:~$ l /usr/local/bin/tika* -rw-r--r-- 1 root root 79337717 Feb 3 12:40 /usr/local/bin/tika-server-1.25.jar and running pretty standard-ish /usr/bin/java -jar /usr/local/bin/tika-server-1.25.jar --port 9998 --host localhost -enableUnsecureFeatures -enableFileUrl --log info I use mbsync to pull in sample mailboxes for testing The solr conf in /etc/dovecot/conf.d/ is as follows plugin { fts = solr fts_solr = url=http://localhost:8693/solr/ fts_autoindex = yes fts_filters = lowercase snowball stopwords fts_tokenizers = generic email-address fts_tokenizer_generic = algorithm=simple fts_autoindex_exclude = Junk fts_autoindex_exclude2 = Trash fts_autoindex_exclude3 = Spam } plugin { fts_tika = http://localhost:9998/tika/ } Unfortunately indexing is panic'ing. Whether I index a test folder manually, or just looking in /var/log/dovecot.log I'll see the following very consistently : harryb@dove1:~$ sudo doveadm -D index -u harryb(a)example.com Receipts Debug: Loading modules from directory: /usr/lib/dovecot/modules Debug: Module loaded: /usr/lib/dovecot/modules/lib10_mail_crypt_plugin.so Debug: Module loaded: /usr/lib/dovecot/modules/lib15_notify_plugin.so Debug: Module loaded: /usr/lib/dovecot/modules/lib20_fts_plugin.so Debug: Module loaded: /usr/lib/dovecot/modules/lib20_replication_plugin.so Debug: Module loaded: /usr/lib/dovecot/modules/lib20_zlib_plugin.so Debug: Module loaded: /usr/lib/dovecot/modules/lib21_fts_solr_plugin.so Debug: Loading modules from directory: /usr/lib/dovecot/modules/doveadm Debug: Module loaded: /usr/lib/dovecot/modules/doveadm/lib20_doveadm_fts_plugin.so Debug: Module loaded: /usr/lib/dovecot/modules/doveadm/libdoveadm_mail_crypt_plugin.so doveadm(harryb(a)example.com): Debug: auth-master: passdb lookup(harryb(a)example.com): Started passdb lookup doveadm(harryb(a)example.com): Debug: auth-master: conn unix:/var/run/dovecot/auth-userdb: Connecting doveadm(harryb(a)example.com): Debug: auth-master: conn unix:/var/run/dovecot/auth-userdb (pid=165148,uid=0): Client connected (fd=9) doveadm(harryb(a)example.com): Debug: auth-master: passdb lookup(harryb(a)example.com): auth PASS input: user=harryb(a)example.com doveadm(harryb(a)example.com): Debug: auth-master: passdb lookup(harryb(a)example.com): Finished passdb lookup (user=harryb(a)example.com ) doveadm(harryb(a)example.com)<180749><>: Debug: auth-master: userdb lookup(harryb(a)example.com): Started userdb lookup doveadm(harryb(a)example.com)<180749><>: Debug: auth-master: userdb lookup(harryb(a)example.com): auth USER input: harryb(a)example.com home=/var/mail/example.com/harryb uid=1001 gid=1001 doveadm(harryb(a)example.com)<180749><>: Debug: auth-master: userdb lookup(harryb(a)example.com): Finished userdb lookup (username=harryb(a)example.com home=/var/mail/example.com/harryb uid=1001 gid=1001) doveadm(harryb(a)example.com): Debug: Effective uid=1001, gid=1001, home=/var/mail/example.com/harryb doveadm(harryb(a)example.com): Debug: Namespace inbox: type=private, prefix=, sep=, inbox=yes, hidden=no, list=yes, subscriptions=yes location=maildir:~/Maildir:LAYOUT=fs:INBOX=~/Maildir/INBOX doveadm(harryb(a)example.com): Debug: fs: root=/var/mail/example.com/harryb/Maildir, index=, indexpvt=, control=, inbox=/var/mail/example.com/harryb/Maildir/INBOX, alt= doveadm(harryb(a)example.com): Debug: Mailbox Receipts: Mailbox opened because: index doveadm(harryb(a)example.com): Info: Receipts: Caching mails seq=1..72 doveadm(harryb(a)example.com): Debug: Mailbox Receipts: UID 1: Opened mail because: prefetch doveadm(harryb(a)example.com): Debug: Mailbox Receipts: UID 1: Opened mail because: fts indexing doveadm(harryb(a)example.com): Debug: http-client: peer [::1]:9998 (shared): Peer created doveadm(harryb(a)example.com): Debug: http-client: peer [::1]:9998: Peer pool created doveadm(harryb(a)example.com): Debug: http-client[2]: peer [::1]:9998: Peer created doveadm(harryb(a)example.com): Debug: http-client[2]: queue http://localhost:9998: Setting up connection to [::1]:9998 (1 requests pending) doveadm(harryb(a)example.com): Debug: http-client[2]: peer [::1]:9998: Linked queue http://localhost:9998 (1 queues linked) doveadm(harryb(a)example.com): Debug: http-client[2]: queue http://localhost:9998: Started new connection to [::1]:9998 doveadm(harryb(a)example.com): Debug: http-client[2]: request [Req2: PUT http://localhost/tika/] Submitted (requests left=1) doveadm(harryb(a)example.com): Debug: http-client[2]: request [Req2: PUT http://localhost/tika/] Waiting for request to finish doveadm(harryb(a)example.com): Debug: http-client[2]: peer [::1]:9998: Creating 1 new connections to handle requests (already 0 usable, connecting to 0, closing 0) doveadm(harryb(a)example.com): Debug: http-client[2]: peer [::1]:9998: Making new connection 1 of 1 (0 connections exist, 0 pending) doveadm(harryb(a)example.com): Debug: http-client: conn [::1]:9998 [2]: Connecting doveadm(harryb(a)example.com): Debug: http-client: conn [::1]:9998 [2]: Waiting for connect (fd=20) to finish for max 0 msecs doveadm(harryb(a)example.com): Debug: http-client: conn [::1]:9998 [2]: HTTP connection created (1 parallel connections exist) doveadm(harryb(a)example.com): Panic: file http-client-request.c: line 1240 (http_client_request_send_more): assertion failed: (req->payload_input != NULL) doveadm(harryb(a)example.com): Error: Raw backtrace: /usr/lib/dovecot/libdovecot.so.0(backtrace_append+0x41) [0x7ffb60d697a1] -> /usr/lib/dovecot/libdovecot.so.0(backtrace_get+0x22) [0x7ffb60d698c2] -> /usr/lib/dovecot/libdovecot.so.0(+0x104b3b) [0x7ffb60d75b3b] -> /usr/lib/dovecot/libdovecot.so.0(+0x104b77) [0x7ffb60d75b77] -> /usr/lib/dovecot/libdovecot.so.0(+0x5b4d5) [0x7ffb60ccc4d5] -> /usr/lib/dovecot/libdovecot.so.0(+0x5291e) [0x7ffb60cc391e] -> /usr/lib/dovecot/libdovecot.so.0(http_client_connection_output+0xf2) [0x7ffb60d19f82] -> /usr/lib/dovecot/libdovecot.so.0(+0x12b1c5) [0x7ffb60d9c1c5] -> /usr/lib/dovecot/libdovecot.so.0(io_loop_call_io+0x6d) [0x7ffb60d8bd4d] -> /usr/lib/dovecot/libdovecot.so.0(io_loop_handler_run_internal+0x145) [0x7ffb60d8d395] -> /usr/lib/dovecot/libdovecot.so.0(io_loop_handler_run+0x54) [0x7ffb60d8bdf4] -> /usr/lib/dovecot/libdovecot.so.0(io_loop_run+0x48) [0x7ffb60d8bf68] -> /usr/lib/dovecot/libdovecot.so.0(+0xa482d) [0x7ffb60d1582d] -> /usr/lib/dovecot/libdovecot.so.0(http_client_request_send_payload+0x34) [0x7ffb60d159c4] -> /usr/lib/dovecot/modules/lib20_fts_plugin.so(+0x1068d) [0x7ffb604ef68d] -> /usr/lib/dovecot/modules/lib20_fts_plugin.so(fts_parser_more+0x2b) [0x7ffb604ee4ab] -> /usr/lib/dovecot/modules/lib20_fts_plugin.so(+0xd77f) [0x7ffb604ec77f] -> /usr/lib/dovecot/modules/lib20_fts_plugin.so(fts_build_mail+0x52) [0x7ffb604ecec2] -> /usr/lib/dovecot/modules/lib20_fts_plugin.so(+0x13573) [0x7ffb604f2573] -> /usr/lib/dovecot/libdovecot-storage.so.0(mail_precache+0x32) [0x7ffb60e92ed2] -> doveadm(+0x3982f) [0x55d3519ed82f] -> doveadm(+0x33e35) [0x55d3519e7e35] -> doveadm(+0x34a16) [0x55d3519e8a16] -> doveadm(doveadm_cmd_ver2_to_mail_cmd_wrapper+0x225) [0x55d3519e97b5] -> doveadm(doveadm_cmd_run_ver2+0x500) [0x55d3519f9e50] -> doveadm(doveadm_cmd_try_run_ver2+0x3e) [0x55d3519f9eae] -> doveadm(main+0x1d4) [0x55d3519d8dc4] -> /lib/x86_64-linux-gnu/libc.so.6(__libc_start_main+0xf3) [0x7ffb608fd0b3] -> doveadm(_start+0x2e) [0x55d3519d92ae] Aborted The key line above is doveadm(harryb(a)example.com): Panic: file http-client-request.c: line 1240 (http_client_request_send_more): assertion failed: (req->payload_input != NULL) It's the same each time. In /var/log/syslog there are usually a couple of extra lines Feb 03 13:25:17 indexer: Error: Indexer worker disconnected, discarding 1 requests for harryb(a)example.com Feb 03 13:25:17 indexer-worker(harryb(a)example.com)<202106><p+xgBonqGmAIFQMATj4HXg:IvE7Eo3qGmB6FQMATj4HXg>: Fatal: master: service(indexer-worker): child 202106 killed with signal 6 (core dumps disabled - https://dovecot.org/bugreport.html#coredumps) -- Dean Carpenter deano is at areyes dot com 203 six oh four 6644

7 17

doveadm import uninterruptable?
by Ralf Hildebrandt 17 Feb '21

17 Feb '21

I'm using % doveadm import -u restore(a)backup.invalid mdbox:/home/archive/mdbox "" mailbox INBOX header From $PATTERN sometimes, I mistype the pattern and immediately try to stop the doveadm command with CTRL-C - and this never succeeds. Is it inentional that I cannot interrupt the "doveadm import" command? Using 2.3.13 here. -- Ralf Hildebrandt Geschäftsbereich IT | Abteilung Netzwerk Charité - Universitätsmedizin Berlin Campus Benjamin Franklin Hindenburgdamm 30 | D-12203 Berlin Tel. +49 30 450 570 155 | Fax: +49 30 450 570 962 ralf.hildebrandt(a)charite.de | https://www.charite.de

2 1

Pigeonhole v0.5.14.rc1 released
by Aki Tuomi 17 Feb '21

17 Feb '21

We are pleased to release first release candidate for v0.5.14. We have done changes to packaging so please give us any feedback on how it works. https://pigeonhole.dovecot.org/releases/2.3/rc/dovecot-2.3-pigeonhole-0.5.1… https://pigeonhole.dovecot.org/releases/2.3/rc/dovecot-2.3-pigeonhole-0.5.1… Binary packages in https://repo.dovecot.org/ Docker images are not available for this release candidate. Kind regards, Aki Tuomi Open-Xchange oy --- * IMAP FILTER command: cmd-filter-sieve - Do not allow NIL as script name argument.

1 0

imapc settings for specific mailbox / namespaces
by Tobia Grosselle [ Terralink ] 17 Feb '21

17 Feb '21

Hello, Is it possible to use imapc for specific mailbox or namespace? Something like this: namespace Test { list = no type = private inbox = no hidden=no prefix = TEST/ separator = / location = imapc: imapc_host = imap.example.com imapc_password = secret imapc_port = 143 imapc_user = user(a)example.com } or is only intended for general use as general proxy in the global configuration?

1 0

Logfile flooding with lookup failure for root user using pam
by Michael Ruiz 16 Feb '21

16 Feb '21

Hi all, I am getting the error where root is constantly being lookedup over imap I am guessing. I am pretty sure services like fail2ban and logwatch are setup to send from another user instead of root @ localhost so I think this may be an imap issue. I tried adding root to /etc/dovecot/deny-users , but this error still persists. I know imap as root is a big security issue and is disabled, but I cannot pinpoint how or why this is happening so often. I am using PAM and passwd for authentication and authorization. How can I prevent root user from being looked up in the first place ? Regards, Michael dovecot[606167]: lmtp(606199): Error: lmtp-server: conn unix:pid=606196,uid=73 [2]: rcpt root@<domain>: Failed to lookup user root@<domain>: Invalid settings in userdb: userdb returned 0 as uid replaced my domain name with <domain> in this example.

2 1

quota_max_mail_size and dsync
by Edgaras Lukoševičius 15 Feb '21

15 Feb '21

Hello, as we have enabled quota_max_mail_size, dsync is now having problems moving oversized emails between servers. Is there a way to configure dovecot (dsync) to allow syncing of emails larger than quota_max_mail_size but keep limiting clients over imap/pop/lmtp? The error logged is: dsync(local(a)domain.tld): Info: imapc(remote.imap.host.tld): Connected to II.III.III.II:PPP (local II.III.III.II:PPPPP) dsync(local(a)domain.tld): Warning: Failed to copy source UID=24 mail: Mail size is larger than the maximum size allowed by server configuration - falling back to regular saving dsync(local(a)domain.tld): Error: Mailbox INBOX.Sent: Saving failed: Mail size is larger than the maximum size allowed by server configuration

2 1

Mail.app namespaces
by Dan Mahoney (Gushi) 15 Feb '21

15 Feb '21

All, Dovecot 2.3.13 under Freebsd 11.3, installed via pkg. I had a question related to dovecot and OSX mail.app. My primary mailer is "alpine". Sometimes I need to see a message in a graphical app so I occasionally turn to mail.app. I keep a lot of old mail. Mail.app on recent macos versions insist on downloading *everything* for easier searching and indexing. Most of which I don't need. (20G of mail over the last 20+ years, plus a bunch of mailing lists I keep archived, but only read when I need to search them). ios mail doesn't do this. Subscriptions don't work (in mail.app, subscriptions are only for public/shared folders). Ergo, is there a server-side way to make just one client not able to see/list/download ALL folders? Perhaps by presenting them as subscription folders, or perhaps by hiding them in the namespace. I'm not unwilling to configure an alternate namespace for myself. (It's helps that I'm the sysadmin here). Ideally, this would be a thing I could only set for my account -- match on a user-agent/username string of some sort? (My other option has been "create a different username and forward to myself there", but this feels like it should be solvable). -Dan My doveconf follows: # 2.3.13 (89f716dc2): /usr/local/etc/dovecot/dovecot.conf # OS: FreeBSD 11.4-RELEASE-p3 amd64 # Hostname: prime.gushi.org disable_plaintext_auth = no mail_full_filesystem_access = yes mail_location = mbox:%h/mail:INBOX=%h/.mail:INDEX=/var/db/indexes/%u namespace { alias_for = hidden = yes list = no location = prefix = mail/ separator = / } namespace { alias_for = hidden = no list = yes location = prefix = ~/mail/ separator = / subscriptions = yes } namespace { alias_for = hidden = yes list = no location = prefix = ~%u/mail/ separator = / } namespace { hidden = no list = yes location = mbox:~%u/.incoming/ prefix = Inbounds/ separator = / } namespace inbox { inbox = yes location = prefix = separator = / } passdb { driver = pam } plugin { mail_log_events = delete undelete expunge copy mailbox_delete mailbox_rename mail_log_fields = uid box msgid size } service imap-login { inet_listener imap { port = 143 } inet_listener imap_other { port = 1143 } inet_listener imaps { port = 993 ssl = yes } inet_listener imaps_other { port = 1993 ssl = yes } } service pop3-login { inet_listener pop3 { port = 110 } inet_listener pop3_other { port = 1110 } inet_listener pop3s { port = 995 ssl = yes } inet_listener pop3s_other { port = 1995 ssl = yes } } ssl_cert = </etc/mail/certs/prime.gushi.org.certkey ssl_dh = # hidden, use -P to show it ssl_key = # hidden, use -P to show it userdb { driver = passwd } -- --------Dan Mahoney-------- Techie, Sysadmin, WebGeek Gushi on efnet/undernet IRC FB: fb.com/DanielMahoneyIV LI: linkedin.com/in/gushi Site: http://www.gushi.org ---------------------------

2 3

fts_encoder
by Joan Moreau 11 Feb '21

11 Feb '21

Hello, I am trying to deal properly with email attachements in fts-xapian plugins. I tried the default script with a PDF file. The data I receive in the fts plugin part ("xxx_build_more") is the original document, no the output of the pdftotext Is there anything I am missing ? Here my config: plugin { plugin = fts_xapian managesieve sieve fts = xapian fts_xapian = partial=2 full=20 verbose=1 attachments=1 fts_autoindex = yes fts_enforced = yes fts_autoindex_exclude = \Trash fts_autoindex_exclude2 = \Drafts fts_decoder = decode2text sieve = /data/mail/%d/%n/local.sieve sieve_after = /data/mail/after.sieve sieve_before = /data/mail/before.sieve sieve_dir = /data/mail/%d/%n/sieve sieve_global_dir = /data/mail sieve_global_path = /data/mail/global.sieve } ... service decode2text { executable = script /usr/libexec/dovecot/decode2text.sh user = dovecot unix_listener decode2text { mode = 0666 } } Thank you

3 18

doveadm expunge logging
by Arkadiusz Miśkiewicz 11 Feb '21

11 Feb '21

Hello. dovecot 2.3.13 here, using doveadm -c /etc/my.conf expunge -A mailbox SomeFolder savedbefore 31d and my.conf includes plugin { mail_log_events = delete undelete expunge copy mailbox_delete mailbox_rename save } unfortunately expunged messages are not logged anywhere. Tried -v and -D to see if these will get logged to output (so I could pipe these to syslog) but verbose/debug also don't show which messages were expunged. Is there a way to get this logged? Log like regular dovecot logs would be nice: doveadm(arekm): pid=<14783>, expunge: box=INBOX, uid=0, msgid=<E1l2ZJp-0002NM-Vv(a)example.com>, size=15077 -- Arkadiusz Miśkiewicz, arekm / ( maven.pl | pld-linux.org )

3 4

Re: Quota-status service on Director
by Richard Pablo Mérida González 11 Feb '21

11 Feb '21

Did you solve this problem of quota status? I am in the same situation right now, i would appreciate you let me know any helpfull information Sent with Aqua Mail for Android https://www.mobisystems.com/aqua-mail

1 0

SQL-AUTH driver replace for VPOPMAIL-AUTH
by Pablo Murillo 11 Feb '21

11 Feb '21

Hi I'm made a lot of test trying to get SLQ auth driver work with vpopmail/mysql configured with many domains (one table for each domain) Finally I made it work, but ... only with PLAIN password Is there a way to make SQL auth work with vpopmail/mysql tables with encrypted password (CRAM-MD5 / MD5-CRYPT) ? Thanks Pablo Murillo -- This email has been checked for viruses by AVG. https://www.avg.com

4 6

Re: SQL-AUTH driver replace for VPOPMAIL-AUTH
by steve＠keptprivate.com 10 Feb '21

10 Feb '21

It seems like it would be possible to use a view table (with a union query) to "make" the many domain style table out of the tables by domain. You wouldn't want to do that if you were adding domains often... but it should make the dovecot auth for many domains work on top of the old tables instantly.Sent from my T-Mobile 4G LTE device------ Original message------From: Eric BrochDate: Wed, Feb 10, 2021 2:58 PMTo: dovecot(a)dovecot.org;Cc: Subject:Re: SQL-AUTH driver replace for VPOPMAIL-AUTHPablo, Can you share your dovecot-sql.conf.ext file for 'one table for each domain'. Eric On 2/10/2021 9:24 AM, Pablo Murillo wrote: > Hi Aki > > > Don't work, but you give me a new idea > I set default_pass_scheme = PLAIN on dovecot-sql.conf.ext anda I send > the pass encrypted and now is working ! > > On 2/10/2021 3:34 AM, Aki Tuomi wrote: >> Return the password with {CRAM-MD5} or {MD5-CRYPT} prefix, then >> dovecot will know the password scheme. >> >> Aki >> >>> On 10/02/2021 05:04 Pablo Murillo wrote: >>> >>> Hi >>> >>> I'm made a lot of test trying to get SLQ auth driver work with >>> vpopmail/mysql configured with many domains (one table for each domain) >>> Finally I made it work, but ... only with PLAIN password >>> Is there a way to make SQL auth work with vpopmail/mysql tables with >>> encrypted password (CRAM-MD5 / MD5-CRYPT) ? >>> >>> Thanks >>> Pablo Murillo >>> >>> >>> >>> -- >>> This email has been checked for viruses by AVG. >>> https://www.avg.com

1 0

Problem enabling the mail_log plugin
by Mike Quigley 09 Feb '21

09 Feb '21

I need to track some issues with deleted messages so I have been trying to set up the mail_log plugin. I have Dovecot v2..27 running on Debian 9. I have configured /etc/dovecot/conf.d/10-logging.conf, 20-imap.conf, and 20-lmtp.conf and restarted dovecot, but I see so difference in /var/log/mail.info & /var/log/syslog when I delete a message from my Inbox in Roundcube. Here is the abbreviated output from doveconf -n: # 2.2.27 (): /etc/dovecot/dovecot.conf # Pigeonhole version 0.4.16 () # OS: Linux 4.9.0-14-amd64 x86_64 Debian 9.13 ext4 plugin { mail_log_events = delete undelete mailbox_delete mailbox_rename mail_log_fields = uid box msgid size sieve = ~/.dovecot.sieve sieve_after = /etc/dovecot/sieve-after sieve_dir = ~/sieve } protocols = " imap lmtp sieve pop3" protocol lmtp { mail_plugins = " sieve notify mail_log" } protocol imap { mail_max_userip_connections = 50 mail_plugins = " notify mail_log" } What am I missing?

3 6

stat writer error
by Jeff Abrahamson 08 Feb '21

08 Feb '21

On postfix/pipe lines in my log, I see this error: Error: net_connect_unix(/var/run/dovecot/stats-writer) failed: Permission )) even though I also set [T] jeff@nantes-m1:postfix $ ll /var/run/dovecot/*stat* srw------- 1 root root 0 Feb 4 14:55 /var/run/dovecot/old-stats prw------- 1 root root 0 Feb 4 14:55 /var/run/dovecot/old-stats-mail prw------- 1 root root 0 Feb 4 14:55 /var/run/dovecot/old-stats-user srw-rw---- 1 dovecot dovecot 0 Feb 4 14:55 /var/run/dovecot/stats-reader srw-rw---- 1 dovecot dovecot 0 Feb 4 14:55 /var/run/dovecot/stats-writer [T] jeff@nantes-m1:postfix $ I've not found documentation on what should be happening there or what the right config is, though I did find some suggestions that 0660 and dovecot:dovecot is right. (I've also not understood why I care, except I don't like to see regular errors in my logs if I can avoid it.) Any pointers? Thanks. -- Jeff Abrahamson +33 6 24 40 01 57 +44 7920 594 255 http://p27.eu/jeff/ http://mobilitains.fr/

2 1

I'm unable to get Claws-Mail to work with SSL/993 with a passphrased selfsigned cert
by Steve Litt 06 Feb '21

06 Feb '21

Hi all, First, thanks to everyone on Freenode #dovecot who helped me with my extreme problems a couple days ago. I once again have Claws-Mail able to connect to my SSL/993 only Dovecot IMAP, after making my own cert and a few other things. Here's the deal though. When I try to use an rsa:4096 cert with a passphrase for dovecot, Claws-Mail cannot connect, even though I put the cert's passphrase in Claws-Mail's passphrase field right below the field for the cert's location/filename. It tells me it can't import the p12 cert. This happens whether I put in the location of the public cert, or the private one. What do I need to do to get Claws-Mail and Dovecot to work together with a passphrased cert? Naturally, this could be a deficency in Claws-Mail, and I've written a similar email to the Claws-Mail group, but either way I'd like to get this solved so I'm not using a no-password cert. By the way, when I do: openssl s_client -connect 192.168.0.2:993 \ -cert/etc/ssl/dovecot_certs/private/dovecot.pem openssl asks me for the passphrase and upon receiving it gives me the information. This does not happen if I give it the location of the public key. Thanks, SteveT Steve Litt Autumn 2020 featured book: Thriving in Tough Times http://www.troubleshooters.com/thrive

1 0

Zlib problem - dovecot.index.cache
by julio covolato 05 Feb '21

05 Feb '21

Hi I'm having problems with zlib giving an error in dovecot.index.cache, when I move a message from one folder to another, this error often appears "Cached message size smaller / biger than expected": Feb 03 19:02:07 imap(julio(a)xxx.com.br): Error: Corrupted record in index cache file /var/spool/vmail/vmail01/xxx.com.br/julio//Maildir/.Trash/dovecot.index.cache: UID 503914: Broken physical size in mailbox Trash: read(zlib(/var/spool/vmail/vmail01/xxx.com.br/julio//Maildir/.Trash/cur/1612388618.M2222P27195.saturn,S=34225,W=34342:2,S)) failed: Cached message size smaller than expected (34225 < 40960, box=Trash, UID=503914) I'm using the [1] dovecot-maildir-compress.sh script in crontab daily to compress old messages with 7 days old with bzip2. Crontab line: 30 2 * * * /usr/local/sbin/dovecot-maildir-compress.sh -t 7 /var/spool/vmail/vmail01/ > /dev/null 2>&1 Any suggestions on how to fix this error? [1] - https://github.com/extremeshok/dovecot-maildir-compression/blob/master/dove… Thanks. -- ---------------------------------- _ Engº Julio Cesar Covolato 0v0 <julio(a)psi.com.br> /(_)\ F: 55-11-99175-9260 ^ ^ PSI INTERNET ----------------------------------

1 0

Service unavailable, lots of idle dovecot-login processes
by Wolfgang 05 Feb '21

05 Feb '21

Hi, Web search turned no results to this problem: We have a small site running private e-mail for maybe 12 people, dovecot is used by Postfix-SASL and IMAP clients. PROBLEM: When starting dovecot, after a few hours, IMAP clients are no longer able to connect. Thunderbird indicates that connection is refused. On the server, we see 100 dovecot/imap-login processes. This is the process limit. If we increase the process limit to 200, same thing, we survive a few hours longer but eventually we're seeing 200 imap-login processes and rejected connections. When listing TCP connections via lsof, there are only around 30 connections open to IMAP and we have exactly the same amount of dovecot/imap processes. These connections are held by 30 dovecot/imap-login processes. The other 70 dovecot/imap-login processes seem to do nothing. They're all sitting in "epoll_wait(14," according to strace but don't have TCP connections open. The only way out of this that we have found is re-starting dovecot every few hours. BTW, service_count = 1 for improved security. Dovecot Version: 2.3.4.1 (f79e8e7e4) Interestingly we were using nearly the same config on our old server with 2.2.13 and did not see this issue. Any ideas how to solve that properly? Thank you, Wolfgang

3 8

BUG report: dbox movealt doesn't move reverse (to default location)
by Vitalii 05 Feb '21

05 Feb '21

Hi, Here is the problem that occured: #sudo doveadm -D altmove -u vv(a)vito.pp.ua all works properly and moves all storage to alt dir. However, to move it back to default storage I add '-r' by manual: #sudo doveadm -D altmove -u vv(a)vito.pp.ua -r all That seems behave like the original command ignoring '-r'. my dovecot conf: # 2.3.4.1 (f79e8e7e4): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.4 () # OS: Linux 4.19.0-9-amd64 x86_64 Debian 10.4 # Hostname: qemu7.internetguru.ca auth_mechanisms = plain login disable_plaintext_auth = no imapc_features = rfc822.size fetch-headers imapc_host = imap.gmail.com imapc_port = 993 imapc_ssl = imaps imapc_user = %u listen = *,[::] log_timestamp = "%Y-%m-%d %H:%M:%S " mail_attachment_dir = /wd640/mdbox-att/%d/%n mail_max_userip_connections = 100 mail_prefetch_count = 20 mail_privileged_group = vmail passdb { args = /etc/dovecot/dovecot-sql.conf driver = sql } plugin { quota = dict:user::file:/var/vmail/%d/%n/.quotausage sieve = /var/vmail/%d/%n/.sieve sieve_max_redirects = 25 } protocols = imap pop3 service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0660 user = postfix } unix_listener auth-userdb { group = vmail mode = 0600 user = vmail } user = root } service imap-login { client_limit = 1000 process_limit = 512 } service lmtp { unix_listener /var/spool/postfix/private/dovecot-lmtp { group = postfix mode = 0600 user = postfix } } service stats { unix_listener stats-reader { group = vmail mode = 0660 user = vmail } unix_listener stats-writer { group = vmail mode = 0660 user = vmail } } ssl_cert = </etc/postfix/smtpd.cert ssl_client_ca_dir = /etc/ssl/certs ssl_dh = # hidden, use -P to show it ssl_key = # hidden, use -P to show it userdb { driver = prefetch } userdb { args = /etc/dovecot/dovecot-sql.conf driver = sql } protocol imap { mail_plugins = quota imap_quota } protocol pop3 { mail_plugins = quota pop3_uidl_format = %08Xu%08Xv } protocol lda { mail_plugins = sieve quota postmaster_address = postmaster(a)some.ca } protocol lmtp { mail_plugins = quota sieve postmaster_address = postmaster(a)some.ca } I am using debian 10. P.S. I have not found much information about dbox attachments commands. Seems none needs them.

3 3