- dovecot - dovecot.org

OpenLDAP Pass-through Authentication
by Dino Edwards 04 Feb '25

04 Feb '25

Hi, Trying to get pass-through authentication working however, I'm running to the following error in OpenLDAP: openldap | 679ceede.3aa31e0a 0x7f2ff617e6c0 conn=1004 op=1 SRCH attr=uid mail displayName openldap | 679ceede.3aa4b816 0x7f2ff617e6c0 conn=1004 op=1 SEARCH RESULT tag=101 err=0 qtime=0.000019 etime=0.000172 nentries=1 text= openldap | 679ceede.3aaafd88 0x7f2ff597d6c0 conn=1005 fd=14 ACCEPT from IP=172.16.32.1:47082 (IP=0.0.0.0:1389) openldap | 679ceede.3aab8f34 0x7f2ff597d6c0 conn=1005 op=0 BIND dn="cn=username(a)domain.tld,ou=users,dc=domain,dc=local" method=128 openldap | 679ceede.3aac9267 0x7f2ff597d6c0 SASL [conn=1005] Failure: cannot connect to saslauthd server: No such file or directory openldap | 679ceede.3aad25b9 0x7f2ff597d6c0 conn=1005 op=0 RESULT tag=97 err=49 qtime=0.000005 etime=0.000120 text= openldap | 679ceede.3ab0191f 0x7f2ff617e6c0 conn=1005 fd=14 closed (connection lost) openldap | 679ceede.3ab3d76a 0x7f2ff597d6c0 conn=1004 fd=13 closed (connection lost) I followed the admin docs at: https://www.openldap.org/doc/admin26/guide.html#Pass-Through%20authenticatio n Here's what I did: Created /usr/lib/sasl2/slapd.conf with the following content: mech_list: plain pwcheck_method: saslauthd saslauthd_path: /var/run/sasl2/mux Created /etc/saslauthd.conf with the following content: ldap_servers: ldap://192.168.xxx.xxx.xxx ldap_search_base: OU=Users,DC=domain,DC=tld ldap_filter: (uid=%u) ldap_bind_dn: CN=saslauthd,CN=Users,DC=domain,DC=tld ldap_password: somepassword Added a user that already exists in domain.tld in openldap with the following password: {SASL}username(a)domain.tld I would appreciate some help on this. Thanks

1 1

Re: [OFFLIST] Re: IMAP dovecot\postgres low authentication performance
by Anatoliy Zhestov 03 Feb '25

03 Feb '25

> > Long ago in MagicMail we recognized that there was a problem with > Postgres direct back addressing a large number of AUTH attempts at once, > and we went down the road to using a high performace DBFILE mechanisms, > with real time updates from the Postgres database.. allowed us to scale > greatly.. Thank you, this looks interesting but I don't really understand how to organize it correctly. Do you have a link to some manual that could serve as an example? On Mon, Feb 3, 2025 at 8:39 PM Michael Peddemors <michael(a)linuxmagic.com> wrote: > Long ago in MagicMail we recognized that there was a problem with > Postgres direct back addressing a large number of AUTH attempts at once, > and we went down the road to using a high performace DBFILE mechanisms, > with real time updates from the Postgres database.. allowed us to scale > greatly.. > > Don't know much about you, your product or use case, just thought it > might help.. > > On 2025-02-02 21:05, Anatoliy Zhestov via dovecot wrote: > > Hi. We have a performance problem with imap authentication through > > postgresql. > > Our servers(modoboa based) have a big amount of permanent imap > > connections(5000-50000). > > Current performance is about 3000 successful authentications per hour. No > > visible reasons for such low speed. Accordingly, after a network failure > or > > server restart, all clients try to reconnect, but restoring the > connection > > pool takes hours and even tens of hours. Judging by the logs after the > > restart, a huge number of auth requests closed by timeout after 70-90 > > seconds. The postgresql database is not overloaded at the restore > > connections process and the postgresql connection pool (100) does not > > overflow. Manually started sql auth queries work fast, tables have > indexes. > > So I guess there is a bottleneck somewhere in dovecot auth service or > > postgresql driver. > > > > I couldn't find any settings in the documentation that are directly > > responsible for regulating the number of connections to PostgreSQL from > the > > auth service or performance of the driver. Is there any way to manage > this? > > Does it make sense to use pgbouncer in front of the base? What else can > be > > a bottleneck in our configuration and how to regulate the number of > > possible simultaneous authentications via PostgreSQL? I would be happy > for > > any advice on how to increase the performance to at least 100 > > authentications per second. > > > > > > Thanks in advance for your help. > > Anatoliy Zhestov. > > > > ---------------- configs of server with 48 core, 184 gb mem > --------------- > > > > dovecot 2.3.16 > > # 2.3.16 (7e2e900c1a): /etc/dovecot/dovecot.conf > > # Pigeonhole version 0.5.16 (09c29328) > > # OS: Linux 5.15.0-126-generic x86_64 Ubuntu 22.04.5 LTS > > # Hostname: imap.ourcompany.net > > auth_cache_negative_ttl = 0 > > auth_cache_size = 20 M > > auth_cache_ttl = 3 hours > > auth_master_user_separator = * > > auth_mechanisms = plain login > > default_client_limit = 131072 > > default_process_limit = 131072 > > dict { > > quota = pgsql:/etc/dovecot/dovecot-dict-sql.conf.ext > > } > > mail_location = maildir:~/Maildir > > mail_plugins = quota > > managesieve_notify_capability = mailto > > managesieve_sieve_capability = fileinto reject envelope encoded-character > > vacation subaddress comparator-i;ascii-numeric relational regex > imap4flags > > copy include variables body enotify environment mai > > lbox date index ihave duplicate mime foreverypart extracttext editheader > > imapflags notify vnd.dovecot.pipe vnd.dovecot.execute > > namespace inbox { > > inbox = yes > > location = > > mailbox Drafts { > > auto = subscribe > > special_use = \Drafts > > } > > mailbox Junk { > > auto = subscribe > > special_use = \Junk > > } > > mailbox Sent { > > auto = subscribe > > special_use = \Sent > > } > > mailbox Trash { > > auto = subscribe > > special_use = \Trash > > } > > prefix = > > } > > passdb { > > args = /etc/dovecot/dovecot-sql.conf.ext > > driver = sql > > } > > passdb { > > args = /etc/dovecot/dovecot-sql-master.conf.ext > > driver = sql > > master = yes > > pass = yes > > } > > plugin { > > quota = dict:User quota::proxy::quota > > sieve = ~/.dovecot.sieve > > sieve_dir = ~/sieve > > sieve_execute_bin_dir = /usr/lib/dovecot/sieve-execute > > sieve_execute_socket_dir = . > > sieve_extensions = +notify +imapflags +editheader +body > > +vnd.dovecot.execute +vnd.dovecot.pipe > > sieve_pipe_bin_dir = /usr/lib/dovecot/sieve-execute > > sieve_pipe_socket_dir = . > > sieve_plugins = sieve_extprograms > > } > > protocols = " imap lmtp sieve" > > service anvil { > > client_limit = 393219 > > } > > service auth { > > client_limit = 524288 > > unix_listener /var/spool/postfix/private/auth { > > group = postfix > > mode = 0666 > > user = postfix > > } > > unix_listener auth-radicale { > > group = radicale > > mode = 0666 > > user = radicale > > } > > unix_listener auth-userdb { > > user = vmail > > } > > } > > service config { > > vsz_limit = 1 G > > } > > service dict { > > unix_listener dict { > > mode = 0600 > > user = vmail > > } > > } > > service imap { > > executable = imap postlogin > > process_limit = 131072 > > vsz_limit = 1 G > > } > > service lmtp { > > unix_listener /var/spool/postfix/private/dovecot-lmtp { > > group = postfix > > mode = 0600 > > user = postfix > > } > > vsz_limit = 512 M > > } > > service pop3 { > > executable = pop3 postlogin > > } > > service postlogin { > > executable = script-login /usr/local/bin/postlogin.sh > > service_count = 1000 > > process_min_avail = 5 > > user = modoboa > > } > > > > service send-to-click-frontapp1 { > > executable = script > > /usr/lib/dovecot/sieve-execute/clickhouse_log_frontapp1.sh > > unix_listener send-to-click-frontapp1 { > > group = vmail > > mode = 0666 > > user = vmail > > } > > user = dovenull > > vsz_limit = 2 G > > } > > service send-to-click { > > executable = script /usr/lib/dovecot/sieve-execute/clickhouse_log.sh > > unix_listener send-to-click { > > group = vmail > > mode = 0666 > > user = vmail > > } > > user = dovenull > > vsz_limit = 2 G > > } > > service stats { > > unix_listener stats-reader { > > group = vmail > > mode = 0660 > > user = vmail > > } > > unix_listener stats-writer { > > group = vmail > > mode = 0660 > > user = vmail > > } > > vsz_limit = 2 G > > } > > ssl_cert = </etc/letsencrypt/live/imap.ourcompany.net/fullchain.pem > > ssl_cipher_list = > > > EECDH+ECDSA+AESGCM:EECDH+aRSA+AESGCM:EECDH+ECDSA+SHA384:EECDH+ECDSA+SHA256:EECDH+aRSA+SHA384:EECDH+aRSA+SHA256:EECDH+aRSA+RC4:EECDH:EDH+aRSA:!aNULL:!eNULL:!LOW:!3DES:!MD5:!EXP:!PSK:!SRP:!DSS:!RC4 > > ssl_client_ca_dir = /etc/ssl/certs > > ssl_dh = # hidden, use -P to show it > > ssl_key = # hidden, use -P to show it > > ssl_min_protocol = TLSv1 > > stats_writer_socket_path = > > userdb { > > driver = prefetch > > } > > userdb { > > args = /etc/dovecot/dovecot-sql.conf.ext > > driver = sql > > } > > protocol lmtp { > > mail_plugins = quota sieve > > postmaster_address = postmaster(a)imap.ourcompany.net > > } > > protocol imap { > > mail_max_userip_connections = 50 > > mail_plugins = quota imap_quota > > } > > > > > > > > > > /etc/dovecot/dovecot-sql-master.conf.ex > > driver = pgsql > > connect = host=127.0.0.1 port=5432 dbname=modoboa user=modoboa > > password=XXXXXXXXXXXXXXXXX > > password_query = SELECT email AS user, password FROM core_user WHERE > > email='%u' and is_active and master_user > > > > > > /etc/dovecot/dovecot-sql.conf.ext > > driver = pgsql > > connect = host=127.0.0.1 port=5432 dbname=modoboa user=modoboa > > password=XXXXXXXXXXXXXXXXX > > user_query = SELECT '/srv/vmail/%d/%n' AS home, 1003 as uid, 1003 as gid, > > '*:bytes=' || mb.quota || 'M' AS quota_rule FROM admin_mailbox mb INNER > > JOIN admin_domain dom ON mb.domain_id=dom.id INNER JOIN core_user u ON > > u.id=mb.user_id > > WHERE (mb.is_send_only IS NOT TRUE OR '%s' NOT IN ('imap', 'pop3', > 'lmtp')) > > AND mb.address='%n' AND dom.name='%d' > > password_query = SELECT email AS user, password, '/srv/vmail/%d/%n' AS > > userdb_home, 1003 AS userdb_uid, 1003 AS userdb_gid, CONCAT('*:bytes=', > > mb.quota, 'M') AS userdb_quota_rule FROM core_user u INNER JOIN > > admin_mailbox mb ON u.id=mb.user_id INNER JOIN admin_domain dom ON > > mb.domain_id=dom.id WHERE (mb.is_send_only IS NOT TRUE OR '%s' NOT IN > > ('imap', 'pop3')) AND email='%u' AND is_active AND dom.enabled > > iterate_query = SELECT email AS user FROM core_user > > > > > > > > /usr/local/bin/postlogin.sh > > #!/bin/sh > > PATH="/usr/bin:/usr/local/bin:/bin" > > psql -c "UPDATE core_user SET last_login=now() WHERE username='$USER'" > > > /dev/null > > exec "$@" > > > > > > /usr/lib/dovecot/sieve-execute/clickhouse_log_frontapp1.sh > > #!/bin/bash > > cd /tmp > > logger -i -t SIEVE_TEST "$1,$2,$3,$4" > > clickhouse-client -h XXXXXXXXXXXXXXXXX -d default -u some_user --password > > XXXXXXXXXXXXXXXXX \ > > --param_origin_from="$1" \ > > --param_origin_to="$2" \ > > --param_message_id="$3" \ > > --param_forward="$4" \ > > -q "INSERT INTO frontapp1_redirects > > (origin_from_email,origin_to_email,message_id,forward_email) VALUES > > > ({origin_from:String},{origin_to:String},{message_id:String},{forward:String})" > > > > /usr/lib/dovecot/sieve-execute/clickhouse_log.sh > > #!/bin/bash > > cd /tmp > > logger -i -t SIEVE_TEST "$1,$2,$3,$4" > > clickhouse-client -h XXXXXXXXXXXXXXXXX -d default -u some_user --password > > XXXXXXXXXXXXXXXXX \ > > --param_origin_from="$1" \ > > --param_origin_to="$2" \ > > --param_message_id="$3" \ > > --param_forward="$4" \ > > -q "INSERT INTO frontapp_redirects > > (origin_from_email,origin_to_email,message_id,forward_email) VALUES > > > ({origin_from:String},{origin_to:String},{message_id:String},{forward:String})" > > _______________________________________________ > > dovecot mailing list -- dovecot(a)dovecot.org > > To unsubscribe send an email to dovecot-leave(a)dovecot.org > > > -- > "Catch the Magic of Linux..." > ------------------------------------------------------------------------ > Michael Peddemors, President/CEO LinuxMagic Inc. > Visit us at http://www.linuxmagic.com @linuxmagic > A Wizard IT Company - For More Info http://www.wizard.ca > "LinuxMagic" a Reg. TradeMark of Wizard Tower TechnoServices Ltd. > ------------------------------------------------------------------------ > 604-682-0300 Beautiful British Columbia, Canada > >

2 1

Dovecot autoexpunge lock errors - Couldn't create dovecot.autoexpunge.lock
by mihai.aurel88＠gmail.com 03 Feb '25

03 Feb '25

Hello, We are seeing lots of errors like this in the logs: "dovecot: imap(user@domain)<31219><Dly3bTyt4tesENjH>: Error: autoexpunge: Couldn't create dovecot.autoexpunge.lock lock: file_create_locked(/home/virtual/domain/user/dovecot.autoexpunge.lock) failed: fstat(/home/virtual/domain/user/dovecot.autoexpunge.lock) failed: Stale file handle" We don't understand why Dovecot is trying to create the dovecot.autoexpunge.lock file in the mail home directory instead of mail location directory. For some accounts, the dovecot.autoexpunge.lock file is correctly created inside the mail home directory. Any ideas on what could be causing this behavior? # doveadm user user@domain field value uid 150 gid 8 home /home/virtual/domain/user mail maildir:~/Maildir quota_rule *:bytes=8192000000 # doveconf -n # 2.3.21.1 # Pigeonhole version 0.5.21.1 # OS: Linux 6.1.0-29-amd64 x86_64 Debian 12.9 auth_cache_verify_password_with_worker = yes auth_mechanisms = plain login auth_verbose = yes auth_worker_max_count = 256 default_client_limit = 10000 default_process_limit = 10000 default_vsz_limit = 1 G dict { lastlogin = mysql:/etc/dovecot/mysql/dovecot-dict-lastlogin.conf quotadict = mysql:/etc/dovecot/mysql/dovecot-dict-quota.conf } disable_plaintext_auth = no first_valid_uid = 100 imap_hibernate_timeout = 30 secs log_timestamp = "%Y-%m-%d %H:%M:%S " login_log_format_elements = user=<%u> method=%m rip=%r lip=%l pid=%p %c login_trusted_networks = mail_fsync = always mail_gid = 8 mail_home = /home/virtual/%d/%n mail_location = maildir:~/Maildir mail_nfs_index = yes mail_nfs_storage = yes mail_plugins = zlib quota mail_log notify mail_privileged_group = mail mail_uid = 150 maildir_stat_dirs = yes managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date ihave metric imap_command { filter = event=imap_command_finished AND tagged_reply_state=OK group_by = cmd_name } metric imap_select_no { filter = event=imap_command_finished AND cmd_name=SELECT AND tagged_reply_state=NO } metric imap_select_no_notfound { filter = event=imap_command_finished AND cmd_name=SELECT AND tagged_reply="NO*Mailbox doesn't exist:*" } metric storage_http_gets { filter = event=http_request_finished AND category=storage AND method=get } mmap_disable = yes namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { auto = subscribe special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Spam { auto = subscribe autoexpunge = 30 days special_use = \Junk } mailbox Trash { auto = subscribe autoexpunge = 60 days special_use = \Trash } mailbox virtual/All { special_use = \All } prefix = } passdb { args = /etc/dovecot/mysql/dovecot-sql.conf driver = sql } plugin { last_login_dict = proxy::lastlogin last_login_key = # hidden, use -P to show it mail_log_events = delete undelete expunge copy mailbox_delete mailbox_rename mail_log_fields = uid box msgid size quota = dict:user::proxy::quotadict quota_rule2 = Trash:ignore quota_rule3 = Spam:ignore quota_status_nouser = DUNNO quota_status_overquota = 552 5.2.2 The email account that you tried to reach is over quota quota_status_success = DUNNO quota_warning = storage=95%% quota-warning 95 %u quota_warning2 = storage=80%% quota-warning 80 %u sieve = ~/.dovecot.sieve sieve_before = /etc/dovecot/sieve/default.sieve sieve_dir = ~/sieve sieve_vacation_send_from_recipient = yes trash = /etc/dovecot/dovecot-trash.conf zlib_save = gz zlib_save_level = 6 } protocols = imap sieve pop3 lmtp service anvil { client_limit = 50000 unix_listener anvil-auth-penalty { mode = 00 } } service auth { client_limit = 50000 unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0660 user = postfix } unix_listener auth-master { group = mail mode = 0660 user = vmail } user = root vsz_limit = 1 G } service dict { unix_listener dict { mode = 0660 user = vmail } } service imap-hibernate { unix_listener imap-hibernate { group = $default_internal_group mode = 0660 user = vmail } } service imap-login { inet_listener imap { address = * port = 143 } inet_listener imaps { address = * port = 993 } process_min_avail = 1 service_count = 0 } service imap { extra_groups = $default_internal_group process_min_avail = 16 unix_listener imap-master { user = $default_internal_user } vsz_limit = 2 G } service lmtp { process_min_avail = 16 unix_listener /var/spool/postfix/private/dovecot-lmtp { group = postfix mode = 0600 user = postfix } vsz_limit = 1 G } service managesieve-login { inet_listener sieve { port = 4190 } process_min_avail = 16 service_count = 1 } service managesieve { vsz_limit = 1 G } service pop3-login { inet_listener pop3 { address = * port = 110 } inet_listener pop3s { address = * port = 995 } process_min_avail = 16 service_count = 1 } service pop3 { process_min_avail = 16 vsz_limit = 1 G } service quota-status { executable = /usr/lib/dovecot/quota-status -p postfix process_min_avail = 16 unix_listener /var/spool/postfix/private/quota-status { group = postfix mode = 0666 user = postfix } } service quota-warning { executable = script /usr/local/bin/quota-warning.sh unix_listener quota-warning { mode = 0660 user = vmail } user = vmail } service stats { unix_listener stats-reader { mode = 0660 user = vmail } unix_listener stats-writer { mode = 0666 user = vmail } } ssl_cert = </etc/dovecot/ssl/cert.pem ssl_dh = # hidden, use -P to show it ssl_key = # hidden, use -P to show it ssl_min_protocol = TLSv1 userdb { args = /etc/dovecot/mysql/dovecot-sql.conf driver = sql } verbose_proctitle = yes protocol imap { imap_max_line_length = 64 k mail_max_userip_connections = 16 mail_plugins = zlib quota mail_log notify trash imap_quota } protocol pop3 { mail_max_userip_connections = 10 mail_plugins = zlib quota mail_log notify pop3_client_workarounds = outlook-no-nuls oe-ns-eoh pop3_fast_size_lookups = yes pop3_no_flag_updates = yes pop3_uidl_format = %08Xu%08Xv } protocol sieve { mail_max_userip_connections = 10 managesieve_max_compile_errors = 5 } protocol lda { auth_socket_path = /var/run/dovecot/auth-master mail_plugins = zlib quota mail_log notify sieve sendmail_path = /usr/lib/sendmail syslog_facility = mail } protocol lmtp { mail_plugins = zlib quota mail_log notify sieve syslog_facility = mail }

1 0

Clarification Question about migrating_mailboxes and broken doc link
by Aleks 02 Feb '25

02 Feb '25

Hi. I have read the https://doc.dovecot.org/2.3/admin_manual/migrating_mailboxes/#id7 and there is one part which is not 100% clear to me. We have 2 Dovecot servers mail1 (2.2.36.4) and mail2 ( 2.3.21 ). Now I have understood that I need to add this to mail1 ``` service doveadm { inet_listener { port = 12354 } } doveadm_password = supersecret ``` and this on mail2 ``` doveadm_password = supersecret ``` The question is for me now: I think that this command `doveadm backup -Ru username tcp:host:port` should be executed on the mail2. Is this assumption right? What I also found is that on that Page https://doc.dovecot.org/2.3/admin_manual/doveadm_mailbox_commands/ the wiki is linked for the manpages but the wiki link shows this. ``` The old wiki has been closed Our primary documentation is now at https://doc.dovecot.org, please update your links. ``` What's the right link for the manpages in the web? Best regards Aleks

2 2

[Off-topic] ANN: Nauthilus
by Christian Rößner 01 Feb '25

01 Feb '25

Today I am pleased to announce the Nauthilus software. Nauthilus (N-Auth-ilus) is a centralized authentication server with a comprehensive policy engine. The idea behind this project is to connect services centrally in one place and perform extensive tests during authentication. # What can Nauthilus do and what problems does it solve? Many services on the Internet require authentication. Each application must then be connected to databases and must implement its own protective measures to ward off attackers. Every installation carries the risk of compromisation and therefore also access to the databases. With Nauthilus, the task is centralized in one place. Nauthilus is essentially an HTTP REST server that can be accessed by any application. It takes on the role of a guardian. Nauthilus integrates very well with Dovecot and Postfix. # Authentication process Nauthilus uses several authentication steps: ## 1. features Features include tests such as TLS verification, relay domains (is the system even responsible for the requested domain?), blocklists, RBLs and freely definable Lua features. Nauthilus has a powerful brute force concept with buckets to detect even slow attacks over days and weeks. It offers a bucket system for this purpose. ## 2. backend authentication Nauthilus includes LDAP support and Lua to perform the authentication itself. A large library of predefined functions is available in Lua, including SQL support. ## 3 Policies Policies are run through after authentication. Despite a successful login, the system can reject the login (or, conversely, allow it!). There is also space here for GeoIP lookups, etc. ## 4. Post-processing After the 3rd point, authentication has been completed, but at this point further tests can run in the background such as: * Check password policy and take action * Consult the Haveibeenpwnd network * GeoIP tracking across national borders and much more. ## Miscellaneous Nauthilus allows the free definition of so-called hooks. Each hook listens for a specific URI (callback) in the HTTP request. These callbacks are written by the administrator in Lua. In an initial proof of concept, Nauthilus can take on the role of a Dovecot director. This has already been tested with version 2.4.0. Currently, Nauthilus can dynamically delegate incoming connections to backends. The hooks concept is used here as an example. # Final words By integrating a Lua VM into the server, Nauthilus can be integrated and customized in almost any setup. See also the other Nauthilus-related projects listed in the appendix. To enable single sign-on (SSO), it can be operated with an Ory-Hydra server or the sister project nauthilus-keycloak can be used as a custom authenticator in Keycloak. 100% Open-Source 100% Community # Project https://github.com/croessner/nauthilus # Sub projects https://github.com/croessner/nauthilus-demo https://github.com/croessner/nauthilus-keycloak https://github.com/croessner/pfxhttp https://github.com/croessner/geoip-policyd # Mailing lists: https://lists.nauthilus.org N.B.: In the future, announcements are sent over the nauthilus-announce ML. This is just a hello world! Christian Rößner -- Rößner-Network-Solutions Zertifizierter ITSiBe / CISO Marburger Str. 70a, 36304 Alsfeld Fax: +49 6631 78823409, Mobil: +49 171 9905345 USt-IdNr.: DE225643613, https://roessner.website PGP fingerprint: 658D 1342 B762 F484 2DDF 1E88 38A5 4346 D727 94E5

2 2

Replication ade
by Hanns Mattes 01 Feb '25

01 Feb '25

Hei, mit 2.4 verschwindet ja, wenn ich das richtig verstanden habe, die Replication aus dem Werkzeugkasten von Dovecot. Obwohl ich nur ein recht kleines System mit etwa 500 Nutzern betreibe fand ich die Replication als ziemlich beruhigend :-) Meine Frage in die Runde: Wie wollt Ihr die Replikation ersetzen? Irgendwas mit NFS oder gibt es da eine empfohlene Herangehensweise? Fragende Grüße Hanns -- Sig for hire.

4 4

Re: 2.4.0 on MacOS
by John Muccigrosso 01 Feb '25

01 Feb '25

(Looks like I forgot to reply to the list last time.) With `sudo dovecot -F`, I'm now getting: Fatal: setrlimit(RLIMIT_DATA, 2147483648): Invalid argument The old(?) solution doesn't work for me: default_vsz_limit = 0 It reports: doveconf: Fatal: Error in configuration file /opt/homebrew/etc/dovecot/dovecot.conf: service(log): vsz_limit is too low > On Feb 1, 2025, at 08:55, John Muccigrosso <muccigrosso(a)icloud.com> wrote: > > On Feb 1, 2025, at 07:31, Aki Tuomi via dovecot <dovecot(a)dovecot.org> wrote: > >> You sure the default internal group isnt _dovecot as well? > > I'm not sure what you're asking. Do I not have the internal group set via this line?: > > default_internal_group = mail > > I think I may have to dig into group memberships, if this is the issue. I'm getting conflicting result when checking. That is, when I check the group "mail" for members, _dovecot isn't in it, even though checking which groups _dovecot belongs to includes "mail". The opposite happens for the "dovecot" group. And dovecot itself can't find the _dovecot or dovecot group. Seems to be a macOS thing with group membership. > >> You are missing >> >> mail_home = /Users/%{user} > > Thanks. As I said, I was trying to follow the documentation where they give the two lines under Maildir, but not this third one (even though it's given in the first part of this section).

3 4

2.4.0 missing fields in documentation for event smtp_server_transaction_finished
by Christian Rößner 01 Feb '25

01 Feb '25

Hi, Event: smtp_server_transaction_finished remote_ip and remote_port are also available Feature-request: Please also add user to the fields, as lmtp_proxy=yes does a userdb lookup and is aware of the user. Would make things much easier... Regards Christian Rößner -- Rößner-Network-Solutions Zertifizierter ITSiBe / CISO Marburger Str. 70a, 36304 Alsfeld Fax: +49 6631 78823409, Mobil: +49 171 9905345 USt-IdNr.: DE225643613, https://roessner.website PGP fingerprint: 658D 1342 B762 F484 2DDF 1E88 38A5 4346 D727 94E5

2 1

2.4.0 on MacOS
by John Muccigrosso 01 Feb '25

01 Feb '25

I got bitten by the upgrade from 2.3 to 2.4 on my MacOS laptop. I know enough to be dangerous here and had a set-up that was working fine, but now I can't quite figure out how to modify my conf file to work correctly. The current error I'm getting is that there is no group "dovecot" even though I've created one and made the default user a member: > Fatal: service(dict) Group doesn't exist: dovecot More broadly I find the documentation hard to follow, as others seem to have noted in the past. Any help appreciated. Jackie

2 3

Help understanding doveadm-sync stateful
by Bruno MATEU 01 Feb '25

01 Feb '25

Hello, With the removal of the replication plugin in next releases, i'm trying to setup automatic synchronization using doveadm sync between my master and my replica. I managed to make the full sync work from my replica using the following comamnd `sync -A -N -R -f tcp:master-fqdn:12345` However i'd like to do stateful synchronization to avoid doing the full replication each time, and i haven't managed to do that. I tried the following: `doveadm sync -A -N -R -s "$(</var/lib/dovecot/sync-state)" tcp:master-fqdn:12345 > /var/lib/dovecot/sync-state`. However this output a `doveadm(username): Error: Saved sync state is invalid, falling back to full sync: Invalid base64 data` for every user. After looking at the state in /var/lib/dovecot/sync-state, i noticed that there is one line for every user with an associated state, plus one line with only a state. For some reason, the state is the same for every user, except one where the state is much longer. Do i need to run the command for each user, and give as an argument the corresponding state ? Is it enough to run the doveadm sync command with -A argument if i give the state in the last line outputted by doveadm sync ? Is this the right way to do it ? Best regards, Bruno MATEU

1 1

Different Replicator Crash??
by Kent Borg 31 Jan '25

31 Jan '25

I added the suggested "count--" and recompiled, and it now appears to work, the replication goes both ways, eyeballing the e-mail on the two servers they look the same. Good. But part of the time I am still getting what looks very much like the same crash, is there another "count--" I need to add to that file? > Jan 28 10:53:08 la dovecot[96175]: replicator: Panic: data stack: Out > of memory when allocating 268435496 bytes > Jan 28 10:53:08 la dovecot[96175]: replicator: Error: Raw backtrace: > #0 t_askpass[0x7fb404b0c0] -> #1 backtrace_append[0x7fb404b374] -> #2 > backtr\ > ace_get[0x7fb404b510] -> #3 execvp_const[0x7fb4057ba4] -> #4 > i_syslog_fatal_handler[0x7fb4058510] -> #5 i_panic[0x7fb3fa6808] -> #6 > t_pop_pass_st\ > r[0x7fb4050eb4] -> #7 connection_deinit[0x7fb4056430] -> #8 > pool_datastack_create[0x7fb407e7b0] -> #9 > array_bsearch_insert_pos_i[0x7fb40446d0] ->\ > #10 t_base64_scheme_decode[0x7fb404cb24] -> #11 > buffer_append[0x7fb404d3d0] -> #12 replicator_queue_push[0x558c4b4f40] > -> #13 replicator_brain_i\ > nit[0x558c4b53e4] -> #14 _start[0x558c4b3d70] -> #15 > _start[0x558c4b3f04] -> #16 io_loop_call_io[0x7fb4072f20] -> #17 > io_loop_handler_run_interna\ > l[0x7fb4075450] -> #18 io_loop_handler_run[0x7fb4075680] -> #19 > io_loop_run[0x7fb4075944] -> #20 master_service_run[0x7fb3fd84b0] -> > #21 main[0x5\ > 58c4b3930] -> #22 __libc_init_first[0x7fb3dd76d0] -> #23 > __libc_start_main[0x7fb3dd7780] -> #24 _start[0x558c4b3b80] > Jan 28 10:53:08 la dovecot[96175]: replicator: Fatal: master: > service(replicator): child 96714 killed with signal 6 (core dumps > disabled - https:\ > //dovecot.org/bugreport.html#coredumps) Thanks, -kb

1 0

Replication Question: Who Initiates?
by Kent Borg 31 Jan '25

31 Jan '25

As I understand it, if I am doing replication between a pair of servers, I run the replicator on just one and it makes all the two way changes necessary to make the two machines match. But this only happens when some change happens on that machine that runs the replicator. First, is this correct? If so, is there a way to have that other machine give the first machine poke, to get it to run a replication? Thanks, -kb

2 1

Writing to a Dictionary Using Lua
by Andrea Gabellini 31 Jan '25

31 Jan '25

Hello, I am using the push_notification_lua plugin and would like to modify my script to write data into a dictionary configured as follows: dict_server { dict proxy { idle_timeout = 300s name = sql slow_warn = 1s } dict sql { sql_driver = mysql mysql localhost { dbname = xxx password = xxx user = xxx } dict_map "shared/dsync/$user" { sql_table = dsync dict_map_value_field last_event { type = uint } dict_map_key_field userid { value = $user } } } } I am not very familiar with Lua, and I couldn't find any relevant examples in the documentation or online. Would it be possible to provide a sample code snippet demonstrating how to write to this dictionary using Lua? Thank you! -- TIM San Marino S.p.A. Andrea Gabellini Engineering R&D TIM San Marino S.p.A. - https://www.telecomitalia.sm Via Ventotto Luglio, 212 - Piano -2 47893 - Borgo Maggiore - Republic of San Marino Tel: (+378) 0549 886237 Fax: (+378) 0549 886188 -- Informativa Privacy Questa email ha per destinatari dei contatti presenti negli archivi di TIM San Marino S.p.A.. Tutte le informazioni vengono trattate e tutelate nel rispetto della normativa vigente sulla protezione dei dati personali (Reg. EU 2016/679). Per richiedere informazioni e/o variazioni e/o la cancellazione dei vostri dati presenti nei nostri archivi potete inviare una email a privacy(a)telecomitalia.sm. Avviso di Riservatezza Il contenuto di questa e-mail e degli eventuali allegati e' strettamente confidenziale e destinato alla/e persona/e a cui e' indirizzato. Se avete ricevuto per errore questa e-mail, vi preghiamo di segnalarcelo immediatamente e di cancellarla dal vostro computer. E' fatto divieto di copiare e divulgare il contenuto di questa e-mail. Ogni utilizzo abusivo delle informazioni qui contenute da parte di persone terze o comunque non indicate nella presente e-mail potra' essere perseguito ai sensi di legge.

2 3

"Modseq 34839 no longer in transaction log"
by Kent Borg 29 Jan '25

29 Jan '25

My new custom-built .deb packages seem to work, or at least work better! When new e-mails come in, it quickly attempts a sync, but says it fails: > Jan 29 10:31:49 la dovecot[1199]: doveadm: Error: > doveadm(kentborg)<2465><gL2eARV0mmehCQAAA3PmQQ>: Warning: Failed to do > incremental sync for mai\ > lbox INBOX, retry with a full sync (Modseq 34839 no longer in > transaction log (highest=37557, last_common_uid=12476, nextuid=12614)) Is this a leftover problem from my earlier crashes? I tried a full sync ("doveadm replicator replicate -f kentborg") and rebooting both machines, but I still get the error when new e-mails come in. The number in the error increments by three the several times I have seen this so far. Is there a way to make this happy? Thanks, -kb P.S. I am only doing one-way syncing so far.

1 0

Why does metrics exporter not work anymore?
by Christian Rößner 29 Jan '25

29 Jan '25

Hi, I am trying to get the metrics exporter to work in 2.4.0, but for some reason, I do not see any connection attempts to the named http server nor do I get any errors: $ doveconf -n # 2.4.0 (daeb6bc59c): /etc/dovecot/dovecot.conf # Pigeonhole version 2.4.0 (1b2d5bb9) # OS: Linux 6.10.14-linuxkit x86_64 Debian 12.9 # Hostname: b7638a15bee0 dovecot_config_version = 2.4.0 auth_allow_cleartext = yes auth_cache_verify_password_with_worker = yes auth_failure_delay = 0 secs auth_mechanisms = auth_mechanisms { plain = yes login = yes } auth_username_format = %{user | username | lower} debug_log_path = /dev/stdout default_internal_group = vmail default_internal_user = vmail default_login_user = vmail dovecot_storage_version = 2.4.0 first_valid_uid = 1000 imap_id_retain = yes info_log_path = /dev/stdout last_valid_uid = 1000 listen = listen { * = yes } lmtp_proxy = yes log_path = /dev/stdout mail_debug = yes mail_driver = sdbox mail_gid = vmail mail_home = /srv/mail/%Ln mail_path = ~/Mail mail_uid = vmail protocols { imap = yes pop3 = yes lmtp = yes } ssl = no verbose_proctitle = yes namespace inbox { inbox = yes separator = / } service lmtp { inet_listener lmtp { port = 24 ssl = no } } service imap-login { client_limit = 100 process_min_avail = 1 restart_request_count = unlimited inet_listener imap { port = 143 } } service pop3-login { client_limit = 100 process_min_avail = 1 restart_request_count = unlimited inet_listener pop3 { port = 110 } } event_exporter log { driver = log format = json time_format = rfc3339 } event_exporter conn_state { driver = http-post format = json http_post_url = http://nauthilus:8080/api/v1/custom/dovecot-session-cleaner time_format = rfc3339 http_client_request_absolute_timeout = 5sec } metric client_disconnect_http { exporter = conn_state exporter_include = exporter_include { name = yes hostname = yes timestamps = yes categories = yes fields = yes } filter = event=mail_user_session_finished AND (category=imap OR category=pop3 OR category=lmtp OR category=sieve) } metric imap_noop { exporter = conn_state exporter_include = exporter_include { name = yes hostname = yes timestamps = yes categories = yes fields = yes } filter = event=imap_command_finished AND cmd_name=NOOP } passdb lua { lua_file = /etc/dovecot/auth.lua } userdb prefetch { } userdb lua { auth_verbose = no lua_file = /etc/dovecot/auth.lua result_failure = return-fail result_internalfail = return-fail result_success = continue-ok skip = never } It is an example Docker setup found here: https://github.com/croessner/nauthilus-demo There are no error logs in dovecot. Thanks in advance Christian Rößner -- Rößner-Network-Solutions Zertifizierter ITSiBe / CISO Marburger Str. 70a, 36304 Alsfeld Fax: +49 6631 78823409, Mobil: +49 171 9905345 USt-IdNr.: DE225643613, https://roessner.website PGP fingerprint: 658D 1342 B762 F484 2DDF 1E88 38A5 4346 D727 94E5

4 16

Fwd: dovecot: master: Warning: service(imap-login): process_limit (100) reached, client connections are being dropped
by Stephane De Greef 28 Jan '25

28 Jan '25

-------- Message transféré -------- Sujet : Re: dovecot: master: Warning: service(imap-login): process_limit (100) reached, client connections are being dropped Date : Tue, 28 Jan 2025 11:22:35 +0100 De : Stephane De Greef <stephane.degreef(a)pacapime.be> Pour : dovecot-owner(a)dovecot.org doveconf -n # 2.3.19.1 (9b53102964): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.19 (4eae2f79) # OS: Linux 6.1.0-30-amd64 x86_64 Debian 12.9 ext4 # Hostname: pacapime.ovh auth_mechanisms = plain login mail_gid = 8 mail_home = /var/mail/%n mail_location = maildir:/var/mail/%n mail_plugins = " quota notify push_notification" mail_uid = 500 managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext namespace inbox { inbox = yes location = mailbox Archive { auto = subscribe special_use = \Archive } mailbox Drafts { auto = subscribe special_use = \Drafts } mailbox Junk { auto = subscribe special_use = \Junk } mailbox Sent { auto = subscribe special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { auto = subscribe special_use = \Trash } prefix = } passdb { args = /etc/dovecot/dovecot-ldap.conf driver = ldap } passdb { args = /etc/dovecot/app-senders-passwd driver = passwd-file } plugin { antispam_backend = pipe antispam_debug_target = syslog antispam_pipe_program = /usr/bin/rspamc antispam_pipe_program_args = -h;localhost:11334;-P;q1 antispam_pipe_program_notspam_arg = learn_ham antispam_pipe_program_spam_arg = learn_spam antispam_spam_pattern_ignorecase = junk;spam antispam_trash_pattern_ignorecase = trash;papierkorb;deleted messages antispam_verbose_debug = 0 quota = maildir:User quota quota_rule2 = SPAM:ignore quota_rule3 = Trash:ignore quota_warning = storage=95%% quota-warning 95 %u quota_warning2 = storage=80%% quota-warning 80 %u quota_warning3 = -storage=100%% quota-warning below %u sieve = /var/mail/sievescript/%n/.dovecot.sieve sieve_before = /etc/dovecot/global_script/ sieve_dir = /var/mail/sievescript/%n/scripts/ } protocols = imap sieve service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0660 user = postfix } unix_listener auth-master { group = mail mode = 0660 user = vmail } } service quota-warning { executable = script /usr/bin/quota-warning.sh user = vmail } service stats { unix_listener stats-reader { group = mail mode = 0660 user = vmail } unix_listener stats-writer { group = mail mode = 0660 user = vmail } } ssl = required ssl_cert = </etc/yunohost/certs/pacapime.ovh/crt.pem ssl_cipher_list = ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-CHACHA20-POLY1305 ssl_dh = # hidden, use -P to show it ssl_key = # hidden, use -P to show it userdb { args = /etc/dovecot/dovecot-ldap.conf driver = ldap } userdb { args = username_format=%n /etc/dovecot/app-senders-passwd driver = passwd-file } protocol imap { imap_client_workarounds = mail_plugins = " quota notify push_notification imap_quota antispam" } protocol lda { auth_socket_path = /var/run/dovecot/auth-master mail_plugins = quota sieve postmaster_address = postmaster(a)pacapime.ovh } local_name pacapime.be { ssl_cert = </etc/yunohost/certs/pacapime.be/crt.pem ssl_key = # hidden, use -P to show it } local_name auth.pacapime.be { ssl_cert = </etc/yunohost/certs/auth.pacapime.be/crt.pem ssl_key = # hidden, use -P to show it } local_name ftp.pacapime.be { ssl_cert = </etc/yunohost/certs/ftp.pacapime.be/crt.pem ssl_key = # hidden, use -P to show it } local_name www.pacapime.be { ssl_cert = </etc/yunohost/certs/www.pacapime.be/crt.pem ssl_key = # hidden, use -P to show it } local_name adm.pacapime.ovh { ssl_cert = </etc/yunohost/certs/adm.pacapime.ovh/crt.pem ssl_key = # hidden, use -P to show it } local_name coturn.pacapime.ovh { ssl_cert = </etc/yunohost/certs/coturn.pacapime.ovh/crt.pem ssl_key = # hidden, use -P to show it } local_name doc.pacapime.ovh { ssl_cert = </etc/yunohost/certs/doc.pacapime.ovh/crt.pem ssl_key = # hidden, use -P to show it } local_name drive.pacapime.ovh { ssl_cert = </etc/yunohost/certs/drive.pacapime.ovh/crt.pem ssl_key = # hidden, use -P to show it } local_name exc.pacapime.ovh { ssl_cert = </etc/yunohost/certs/exc.pacapime.ovh/crt.pem ssl_key = # hidden, use -P to show it } local_name graph.pacapime.ovh { ssl_cert = </etc/yunohost/certs/graph.pacapime.ovh/crt.pem ssl_key = # hidden, use -P to show it } local_name mail.pacapime.ovh { ssl_cert = </etc/yunohost/certs/mail.pacapime.ovh/crt.pem ssl_key = # hidden, use -P to show it } local_name mattermost.pacapime.ovh { ssl_cert = </etc/yunohost/certs/mattermost.pacapime.ovh/crt.pem ssl_key = # hidden, use -P to show it } local_name paper.pacapime.ovh { ssl_cert = </etc/yunohost/certs/paper.pacapime.ovh/crt.pem ssl_key = # hidden, use -P to show it } local_name pdf.pacapime.ovh { ssl_cert = </etc/yunohost/certs/pdf.pacapime.ovh/crt.pem ssl_key = # hidden, use -P to show it } local_name pictures.pacapime.ovh { ssl_cert = </etc/yunohost/certs/pictures.pacapime.ovh/crt.pem ssl_key = # hidden, use -P to show it } local_name qr.pacapime.ovh { ssl_cert = </etc/yunohost/certs/qr.pacapime.ovh/crt.pem ssl_key = # hidden, use -P to show it } local_name round.pacapime.ovh { ssl_cert = </etc/yunohost/certs/round.pacapime.ovh/crt.pem ssl_key = # hidden, use -P to show it } local_name rust.pacapime.ovh { ssl_cert = </etc/yunohost/certs/rust.pacapime.ovh/crt.pem ssl_key = # hidden, use -P to show it } local_name sql.pacapime.ovh { ssl_cert = </etc/yunohost/certs/sql.pacapime.ovh/crt.pem ssl_key = # hidden, use -P to show it } local_name stat.pacapime.ovh { ssl_cert = </etc/yunohost/certs/stat.pacapime.ovh/crt.pem ssl_key = # hidden, use -P to show it } local_name talk.pacapime.ovh { ssl_cert = </etc/yunohost/certs/talk.pacapime.ovh/crt.pem ssl_key = # hidden, use -P to show it } local_name test.pacapime.ovh { ssl_cert = </etc/yunohost/certs/test.pacapime.ovh/crt.pem ssl_key = # hidden, use -P to show it } local_name tools.pacapime.ovh { ssl_cert = </etc/yunohost/certs/tools.pacapime.ovh/crt.pem ssl_key = # hidden, use -P to show it } local_name video.pacapime.ovh { ssl_cert = </etc/yunohost/certs/video.pacapime.ovh/crt.pem ssl_key = # hidden, use -P to show it } local_name webmin.pacapime.ovh { ssl_cert = </etc/yunohost/certs/webmin.pacapime.ovh/crt.pem ssl_key = # hidden, use -P to show it } local_name www.pacapime.ovh { ssl_cert = </etc/yunohost/certs/www.pacapime.ovh/crt.pem ssl_key = # hidden, use -P to show it }

2 2

Example configs and packaging scripts
by Aki Tuomi 28 Jan '25

28 Jan '25

Hi! To make the transition from 2.3 to 2.4 easier, especially for package maintainers, we have prepared one-time conversion of 2.3 example configurations to 2.4. Please find them at https://github.com/dovecot/tools/blob/main/dovecot-2.4.0-example-config.tar… Please review release notes and changelogs for needed changes in future releases. Also, would like to remind that https://repo.dovecot.org/ce-2.4-latest/debian/bookworm/pool/main/ contains the debian.tar.xz used to build our packages, and similarly for rhel based https://repo.dovecot.org/ce-2.4-latest/rhel/9/SRPMS/ has the source RPMs. Kind regards, Aki Tuomi

3 3

dovecot: master: Warning: service(imap-login): process_limit (100) reached, client connections are being dropped
by Stephane De Greef 28 Jan '25

28 Jan '25

Hello, I would need a little help. I have the following message in the logs dovecot: master: Warning: service(imap-login): process_limit (100) reached, client connections are being dropped I have already modified the file /etc/dovecot/conf.d/10-master.conf The first 2 lines are default_process_limit = 200 default_client_limit = 1250 and if i make: grep -r process_limit /etc/ he found that: /etc/dovecot/conf.d/10-master.conf:default_process_limit = 200 /etc/dovecot/conf.d/10-master.conf: process_limit = 1024 /etc/dovecot/conf.d/10-master.conf: #process_limit = 1024 /etc/dovecot/conf.d/10-master.conf: process_limit = 1024 /etc/dovecot/conf.d/10-master.conf.original:default_process_limit = 150 /etc/dovecot/conf.d/10-master.conf.original: #process_limit = 1024 /etc/dovecot/conf.d/10-master.conf.original: #process_limit = 1024 /etc/dovecot/conf.d/10-master.conf.original: #process_limit = 1024 /etc/dovecot/conf.d/20-managesieve.conf: #process_limit = 1024 And so I don’t really understand why this error message remains at 100, I specify that the postfix and dovecot services were restarted after the modification,

2 1

doveadm backup and sieve scripts
by Maksim Rodin 28 Jan '25

28 Jan '25

Hello, What is the best way to backup (migrate) sieve rules? I tried: "doveadm backup -u somebox@somedomain maildir:/backup_dir" "doveadm backup -u somebox@somedomain remote:newmailserver.somedomain" Messages are copied but sieve rules are not. dovecot --version: 2.3.21.1 doveconf -n: # 2.3.21.1 (d492236fa0): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.21.1 (49005e73) # OS: OpenBSD 7.5 amd64 # Hostname: mail first_valid_uid = 1000 mail_attachment_dir = /work/vmail/attaches mail_attachment_min_size = 10 k mail_gid = 2000 mail_home = /work/vmail/%n mail_location = sdbox:~/dbox mail_plugins = " zlib acl" mail_uid = 2000 managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational r mbox_write_locks = fcntl mmap_disable = yes namespace { list = children location = sdbox:/work/vmail/%%d/%%n/dbox:INDEXPVT=~/dbox/shared/%%u prefix = shared/%%u/ separator = / subscriptions = no type = shared } namespace inbox { inbox = yes location = mailbox Drafts { auto = subscribe special_use = \Drafts } mailbox Junk { auto = subscribe special_use = \Junk } mailbox Sent { auto = subscribe special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { auto = subscribe special_use = \Trash } prefix = separator = / type = private } passdb { driver = bsdauth } passdb { args = /etc/dovecot/dovecot-shared.conf.ext driver = ldap } passdb { args = /etc/dovecot/dovecot-ldap_somedomain.conf.ext driver = ldap } plugin { acl = vfile acl_shared_dict = file:/var/db/dovecot/db/shared-mailboxes.db sieve = file:~/sieve;active=~/.dovecot.sieve zlib_save = lz4 zlib_save_level = 9 } protocols = imap lmtp submission sieve service decode2text { executable = script /usr/local/libexec/dovecot/decode2text.sh unix_listener decode2text { mode = 0666 } user = _dovecot } service lmtp { user = vmail } service managesieve-login { inet_listener sieve { port = 4190 } inet_listener sieve_deprecated { port = 2000 } } ssl_cert = </etc/letsencrypt/live/somedomain/fullchain.pem ssl_key = # hidden, use -P to show it submission_relay_host = localhost submission_relay_trusted = yes userdb { driver = passwd } userdb { args = /etc/dovecot/dovecot-shared.conf.ext default_fields = uid=vmail gid=vmail home=/work/vmail/%n_%{domain_first} driver = ldap } userdb { args = uid=vmail gid=vmail driver = static } verbose_proctitle = yes protocol lmtp { mail_plugins = " zlib acl sieve" } protocol imap { mail_max_userip_connections = 100 mail_plugins = " zlib acl imap_acl" } protocol submission { mail_max_userip_connections = 100 } -- Best regards Maksim Rodin

1 0

Tests failed in 2.4.0 (Possibly time-zone-related?)
by Peter 27 Jan '25

27 Jan '25

I'm getting the following failed test: test-var-expand.c:464: Assert failed: labs(t0 - t1) < 10 3600 < 10 is not true var_expand(providers) ................................................ : FAILED This test appears to be a timestamp comparison as per this comment: /* Ensure the time is within 10 seconds */ being exactly one hour off makes me suspect a time-zone issue on the build machine. This machine is in NZDT which is currently in daylight savings time which makes me suspect that this is an issue that is specific to dovecot being built in a timezone in the southern hemisphere. Shouldn't the comparison be done on UTC time instead of localtime to avoid these issues? Peter

2 3

2.4 , error with virtual plugin
by Luigi Trovato 26 Jan '25

26 Jan '25

Hello, even with updated config for virtual plugin: mail_plugins { virtual = yes } namespace virtual { prefix = virtual. separator = . mail_driver = virtual mail_path = ~/virtual } I get this error: imap(lonestar(a)lonestar.it)<2991><64ab1o8sDJl/AAAB>: Error: Namespace virtual: Unknown mail storage driver virtual imap(lonestar(a)lonestar.it)<2991><64ab1o8sDJl/AAAB>: Info: Disconnected: Namespace virtual: Unknown mail storage driver virtual in=0 out=442 deleted=0 expunged=0 trashed=0 hdr_count=0 hdr_bytes=0 body_count=0 body_bytes=0 What could it be? -- Ciao, Luigi

2 2

Errors using dovecot 2.4 container image
by Andreas Achtzehn 26 Jan '25

26 Jan '25

Dear Dovecot team, I ran into troubles using the newly released 2.4 docker image. The dovecot/dovenull users are apparently not part of the image -- hence the dovecot server fails to start up with a fatal error. I'm using a vanilla configuration, default_login_user, etc. are not set. Thanks for having a look! Best regards, Andreas

3 2

Latest docker image broken
by Stephen Benjamin 26 Jan '25

26 Jan '25

I use watchtower to keep my docker images up to date and the image pushed to latest tag yesterday broke everything - I can’t find any docs saying anything about mail_location being removed or replaced…. Any idea? I’m unfortunately away from my laptop for a few days so I can’t do any deep debugging but I’d appreciate any pointer. doveconf: Fatal: Error in configuration file /etc/dovecot/dovecot.conf line 1: mail_location: Unknown setting: mail_location Sent from my iPhone

2 2

Help with migration of Quota config to 2.4.0?
by dovecot.org＠schildbach.de 25 Jan '25

25 Jan '25

I've converted most of my config to 2.4.0, but one thing I don't get from the docs: ``` mail_plugins = $mail_plugins quota protocol imap { mail_plugins = $mail_plugins imap_quota } plugin { quota = maildir:User quota:noenforcing quota_rule = *:storage=7GB quota_rule2 = Trash:storage=+10%% } ``` How would this translate?

2 1

Dovecot 2.4.0 compilation issues (Linux, GCC 8.3.1)
by Andreas M. Kirchwitz 25 Jan '25

25 Jan '25

Hello users of Dovecot! Currently, Dovecot 2.3.21.1 compiles and runs fine on a Red Hat Linux clone with GCC 8.3.1. Now tried the brandnew sources of Dovecot 2.4.0, but to my surprise it doesn't even compile and I have no clue where to begin my debugging. Besides some minor things (new OpenSSL version check not working, maybe because not using proper include files; and one library is missing -lrt to use clock_gettime), I'm totally stuck at compiling the new "src/lib-http/http-server-settings.c". It fails while including "src/lib/macros.h" with the message "error: size of unnamed array is negative" Dovecot 2.3.21.1 has no http-server-settings.c but a very similar macros.h which everbody seems to be happy about. So what is it that happens while compiling http-server-settings.c to make GCC fail? I ran "./configure" with just LDFLAGS="-lrt -Wl,--no-as-needed" added, and then simply "make". Nothing special here. I'm happy with all the default settings and auto-detected options. Full log of compilation messages is appended at the end of this message. Any help is highly appreciated. Currently I have no idea where to even start my search for a workaround or even a solution. Never had such problems with compiling Dovecot so far. Thanks a lot in advance ... Andreas ====================================================================== Compilation messages where the error occurs: ====================================================================== Making all in lib-http make[3]: Entering directory '/usr/local/src/dovecot-2.4.0/src/lib-http' CC http-server-settings.lo In file included from ../../src/lib/lib.h:37, from http-server-settings.c:3: ../../src/lib/lib.h: In function ‘time_to_uint32’: ../../src/lib/lib.h:145:14: warning: comparison of integer expressions of different signedness: ‘time_t’ {aka ‘long int’} and ‘unsigned int’ [-Wsign-compare] i_assert(ts <= UINT32_MAX); ^~ ../../src/lib/macros.h:198:45: note: in definition of macro ‘unlikely’ # define unlikely(expr) (__builtin_expect((expr) ? 1 : 0, 0) != 0) ^~~~ ../../src/lib/lib.h:145:2: note: in expansion of macro ‘i_assert’ i_assert(ts <= UINT32_MAX); ^~~~~~~~ In file included from http-server-settings.c:3: ../../src/lib/lib.h: In function ‘time_to_uint32_trunc’: ../../src/lib/lib.h:153:9: warning: comparison of integer expressions of different signedness: ‘time_t’ {aka ‘long int’} and ‘unsigned int’ [-Wsign-compare] if (ts > UINT32_MAX) ^ In file included from ../../src/lib/lib.h:37, from http-server-settings.c:3: http-server-settings.c: At top level: ../../src/lib/macros.h:173:14: error: size of unnamed array is negative (sizeof(char[1 - 2 * ((condition) ? 1 : 0)]) > 0 ? FALSE : FALSE) ^ ../../src/lib/macros.h:182:2: note: in expansion of macro ‘COMPILE_ERROR_IF_TRUE’ COMPILE_ERROR_IF_TRUE( \ ^~~~~~~~~~~~~~~~~~~~~ ../../src/lib-settings/settings-parser.h:78:27: note: in expansion of macro ‘COMPILE_ERROR_IF_TYPES_NOT_COMPATIBLE’ { .type = (_enum_type) + COMPILE_ERROR_IF_TYPES_NOT_COMPATIBLE( \ ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ../../src/lib-settings/settings-parser.h:125:2: note: in expansion of macro ‘SETTING_DEFINE_STRUCT_TYPE’ SETTING_DEFINE_STRUCT_TYPE(SET_SIZE, SET_FLAG_HIDDEN, uoff_t, key, name, struct_name) ^~~~~~~~~~~~~~~~~~~~~~~~~~ http-server-settings.c:13:2: note: in expansion of macro ‘SETTING_DEFINE_STRUCT_SIZE_HIDDEN’ SETTING_DEFINE_STRUCT_##type("http_server_"#name, name, struct http_server_settings) ^~~~~~~~~~~~~~~~~~~~~~ http-server-settings.c:34:2: note: in expansion of macro ‘DEF’ DEF(SIZE_HIDDEN, socket_send_buffer_size), ^~~ ../../src/lib/macros.h:173:14: error: size of unnamed array is negative (sizeof(char[1 - 2 * ((condition) ? 1 : 0)]) > 0 ? FALSE : FALSE) ^ ../../src/lib/macros.h:182:2: note: in expansion of macro ‘COMPILE_ERROR_IF_TRUE’ COMPILE_ERROR_IF_TRUE( \ ^~~~~~~~~~~~~~~~~~~~~ ../../src/lib-settings/settings-parser.h:78:27: note: in expansion of macro ‘COMPILE_ERROR_IF_TYPES_NOT_COMPATIBLE’ { .type = (_enum_type) + COMPILE_ERROR_IF_TYPES_NOT_COMPATIBLE( \ ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ../../src/lib-settings/settings-parser.h:125:2: note: in expansion of macro ‘SETTING_DEFINE_STRUCT_TYPE’ SETTING_DEFINE_STRUCT_TYPE(SET_SIZE, SET_FLAG_HIDDEN, uoff_t, key, name, struct_name) ^~~~~~~~~~~~~~~~~~~~~~~~~~ http-server-settings.c:13:2: note: in expansion of macro ‘SETTING_DEFINE_STRUCT_SIZE_HIDDEN’ SETTING_DEFINE_STRUCT_##type("http_server_"#name, name, struct http_server_settings) ^~~~~~~~~~~~~~~~~~~~~~ http-server-settings.c:35:2: note: in expansion of macro ‘DEF’ DEF(SIZE_HIDDEN, socket_recv_buffer_size), ^~~ make[3]: *** [Makefile:1007: http-server-settings.lo] Error 1 make[3]: Leaving directory '/usr/local/src/dovecot-2.4.0/src/lib-http' make[2]: *** [Makefile:587: all-recursive] Error 1 make[2]: Leaving directory '/usr/local/src/dovecot-2.4.0/src' make[1]: *** [Makefile:725: all-recursive] Error 1 make[1]: Leaving directory '/usr/local/src/dovecot-2.4.0' make: *** [Makefile:567: all] Error 2

3 3

newbie dsync problems
by Kent Borg 25 Jan '25

25 Jan '25

I have a very basic postfix/dovecot server, with just a few users, and it works. But in the past I have had hardware failures…so I would like use dsync to a nearly matching server for some extra safety, and I have not yet been successful. I am trying to do this as root over ssh, with a private key for authentication. I do not managed to get the whole replicator thing working, so as part of simplifying things I am trying to run dsync manually, just on one user (myself). I hope this isn't a silly approach. What would the manual command look like? The closest example on the man page is: > $ doveadm sync -u username(a)example.com ssh -i id_dsa.dovecot \ > mailuser(a)example.com doveadm dsync-server -u username(a)example.com I try to change that to match my case and it has never heard of me: > root@la:/etc/dovecot# doveadm sync -1 -u kentborg(a)mail.borg.org ssh -i > /root/.ssh/id_rsa_rc.borg.org.dsync kentborg(a)mail.borg.org doveadm > dsync-server -u kentborg(a)mail.borg.org > doveadm(kentborg(a)mail.borg.org): Error: User doesn't exist > root@la:/etc/dovecot# I drop the machine part of the name and it knows who I am on this end but can't get to the other end: > root@la:/etc/dovecot# doveadm sync -1 -u kentborg ssh -i > /root/.ssh/id_rsa_rc.borg.org.dsync kentborg(a)mail.borg.org doveadm > dsync-server -u kent\ > borg(a)mail.borg.org > kentborg(a)mail.borg.org's password: I think I have root's ssh keys set up correctly, I can run this: > root@la:/etc/dovecot# ssh -i /root/.ssh/id_rsa_rc.borg.org.dsync > mail.borg.org > PTY allocation request failed on channel 0 > C-c C-croot@la:/etc/dovecot# …and on the remote end I see some debugging output I put in the remote script, outputting an empty username. Makes sense. If I try to put that in this (incomplete) dsync command: > root@la:/etc/dovecot# doveadm sync -u kentborg -1 ssh -i > /root/.ssh/id_rsa_rc.borg.org.dsync mail.borg.org > Error: Extraneous arguments found: 3 5 > doveadm(kentborg)<1029674><QvOnDPmKkmcqtg8AA8+vgQ>: Error: > read(remote) failed: EOF (version not received) > doveadm(kentborg)<1029674><QvOnDPmKkmcqtg8AA8+vgQ>: Error: Remote > command returned error 64: ssh -i /root/.ssh/id_rsa_rc.borg.org.dsync > mail.borg\ > .org dsync-server > root@la:/etc/dovecot# And the remote end outputs the username as "VERSION dsync 3 5", okay, maybe progress. But when I try to make the command more complete and send a username to the remote end, and now I am no longer talking to the remote end: > root@la:/etc/dovecot# doveadm sync -u kentborg -1 ssh -i > /root/.ssh/id_rsa_rc.borg.org.dsync remoteprefix(a)mail.borg.org > remoteprefix(a)mail.borg.org's password: Suggestions? Thanks, -kb

2 8

TLS Connections Between Dovecot & MariaDB
by duluxoz 25 Jan '25

25 Jan '25

Hi All, I'm using a MariaDB backend to a Dovecot server, with TLS required by the MariaDB server for connections. My sql_dovecot.conf.ext file is using the following connection line: `connect = host=mariadb.example.com dbname=mail_server user=vmail password={REDACTED} ssl_ca=/etc/pki/tls/certs/root_ca.crt`. I can't work out from the doco or Google what else I need in that line, but I suspect it'll be something like: `ssl_cert=/etc/pki/tls/certs/vmail_rsa.pem ssl_key=/etc/pki/tls/certs/vmail_rsa.key`. Could someone please confirm this and let me know the actual extra commands/options - thanks Cheers Dulux-Oz

2 3

Virtual folders in top level hierarchy
by Robert Sanchez 25 Jan '25

25 Jan '25

Hi, I've got a virtual "Flagged" folder but it appears as a subfolder of "virtual" instead of being alongside Inbox, Sent, etc. I've seen some previous messages where this was asked, but they didn't really seem to achieve what I want. My expectation was that calling the defined "virtual.Flagged" folder in the inbox namespace would link it there, but either that is not the expected behavior or I'm doing something wrong. This is my current config: namespace virtual { location = virtual:/etc/dovecot/virtual:INDEX=~/virtual:CONTROL=~/virtual:VOLATILEDIR=~/virtual/ prefix = virtual. separator = . list = yes hidden = no } namespace inbox { # (...) default Drafts, Junk, etc. # If you have a virtual "Flagged" mailbox: mailbox virtual.Flagged { special_use = \Flagged auto = subscribe comment = All my flagged messages } } I've also tried "hidden = yes" and "list = no", but I don't see any differences in the client. This is Dovecot 2.3.21 (47349e2482) on Ubuntu 24.04, btw. Thanks.

1 0

Proper syntax for using `allow_nets` with dovecot passdb sql
by Kevin Farley 24 Jan '25

24 Jan '25

Hi there, I posted this question in ServerFault (https://serverfault.com/questions/1170095/proper-syntax-for-using-allow-net…) but haven't gotten an answer after 10 days so thought I'd try here, I appreciate any help you can offer! I want to allow for two auth methods in dovecot via SQL. First, the traditional route where the password is hashed with |SHA512-CRYPT| and compared to the DB response. Second, where the request is coming from a user already authenticated by a different part of the local system, and the hash itself is passed and compared as |PLAIN|. It works perfectly with the following |auth-sql.conf.ext| and associated sql files... |# Passdb for traditional method passdb { driver = sql args = /etc/dovecot/conf.d/dovecot-sql.conf.ext } # Passdb for hybrid method (direct hash comparison) passdb { driver = sql args = /etc/dovecot/conf.d/dovecot-sql-hybrid.conf.ext } # Userdb prefetch to use attributes from the passdb query userdb { driver = prefetch } # Userdb static as fallback for default attributes userdb { driver = static args = uid=vmail gid=vmail home=/srv/mail/%d/%n } | The problem I'm having is that I want to secure the second hybrid |PLAIN| method so that it can only be used by the local host using the |allow_nets| argument. In the documentation <https://doc.dovecot.org/2.3/configuration_manual/authentication/allow_nets/…> it shows that I should simply add it to the |args| like this... |args = /etc/dovecot/conf.d/dovecot-sql-hybrid.conf.ext allow_nets=local,127.0.0.1/32 | But as soon as I do this, the logs show that it's trying to open the entire string as if the |allow_nets...| argument is part of the path, and fails to find the file. I've tried moving the |allow_nets| argument to the beginning, but that had the same result. What is the correct syntax for using |allow_nets| with |passdb sql|? # 2.3.16 (7e2e900c1a): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.16 (09c29328) # OS: Linux 5.14.0-503.21.1.el9_5.x86_64 x86_64 Rocky Linux release 9.5 (Blue Onyx) xfs Thanks, Kevin.

1 0

doveadm mailbox list permission failure for virtual user
by leo1subscr＠zudiewiener.com 24 Jan '25

24 Jan '25

I'm using Dovecot 2.3.21 (47349e2482) on Ubuntu and have convigured virtual mail users. Everything is working finem but a few doevadm commands fail sudo doveadm mailbox list returns doveadm(root): Error: chdir(/root/) failed: Permission denied (euid=1001(vmail) egid=1001(vmail) missing +x perm: /root, dir owned by 0:0 mode=0700)

3 2

Fwd: Fwd: [OFFLIST] Re: connection refused, no error anywhere
by Marco Fioretti 23 Jan '25

23 Jan '25

Hi Robert, I corrected the service imap-login section of both dovecot.conf AND conf.d/10-master.conf as you suggested, The files in ssl_cert and ssl_key exist and are readable by dovecot. I have even changed for testing the permission of /etc/letsencrypt/live /etc/letsencrypt/archive to 0755 and restarted dovecot. However, the output of ss -tuln | grep 993 is still null. What next? Thanks ---------- Forwarded message --------- Da: Robert Nowotny <rnowotny(a)rotek.at> Date: mar 21 gen 2025 alle ore 23:47 Subject: RE: Fwd: [OFFLIST] Re: connection refused, no error anywhere To: Marco Fioretti <marco.fioretti(a)gmail.com> To resolve the connection refused error when accessing Dovecot on the new server, you need to adjust the Dovecot configuration to enable the appropriate IMAP service ports. 1. Enable IMAPS (Port 993) for Secure Connections: - Modify the `service imap-login` section in your Dovecot configuration (likely in `/etc/dovecot/conf.d/10-master.conf`) to include an `imaps` listener: ```conf service imap-login { inet_listener imap { port = 0 # Disables plain IMAP (port 143) } inet_listener imaps { port = 993 ssl = yes } } ``` - This configuration disables plaintext IMAP on port 143 and enables IMAPS on port 993 with SSL. 2. Ensure SSL Certificates Are Correct: - Verify the paths to your SSL certificate and key in `/etc/dovecot/conf.d/10-ssl.conf`: ```conf ssl_cert = </etc/letsencrypt/live/example.com/fullchain.pem ssl_key = </etc/letsencrypt/live/example.com/privkey.pem ``` - Confirm the files exist and have proper permissions (readable by Dovecot). 3. Restart Dovecot: ```bash sudo systemctl restart dovecot ``` 4. Verify Dovecot is Listening: ```bash sudo ss -tuln | grep 993 ``` - You should see Dovecot listening on port 993. 5. Test the Connection Using SSL: ```bash openssl s_client -connect example.com:993 ``` - This should establish a secure connection to the IMAPS port. Additional Recommendations: - Disable Plaintext IMAP: Keeping `port = 0` for the `imap` listener ensures unencrypted IMAP is disabled, enhancing security. - Firewall Configuration: Confirm UFW allows port 993: ```bash sudo ufw allow 993/tcp ``` By enabling IMAPS on port 993 and ensuring SSL is properly configured, secure email access will be restored. If you must use port 143 (not recommended), set `port = 143` in the `imap` listener and enforce STARTTLS by adding `ssl = required` in your SSL configuration. *Von:* Marco Fioretti via dovecot <dovecot(a)dovecot.org> <dovecot(a)dovecot.org> *Gesendet:* Dienstag, 21. Januar 2025 um 23:22 MEZ *An:* Dovecot <dovecot(a)dovecot.org> <dovecot(a)dovecot.org> *Betreff:* FW: [OFFLIST] Re: connection refused, no error anywhere ---------- Forwarded message --------- Da: Marco Fioretti <marco.fioretti(a)gmail.com> <marco.fioretti(a)gmail.com> Date: mar 21 gen 2025 alle ore 19:33 Subject: Re: [OFFLIST] Re: connection refused, no error anywhere To: Michael Peddemors <michael(a)linuxmagic.com> <michael(a)linuxmagic.com> Hi Michel, I cannot say which NGO it is. What I know is that everything with that configuration was working fine, as far as they know, on the old server. So, any help to change the configuration to make it work with the current version of dovecot on Ubuntu 24.04LTS is very welcome... Il giorno mar 21 gen 2025 alle ore 19:11 Michael Peddemors <michael(a)linuxmagic.com> ha scritto: Which NGO? Don't listen on port 143 any more, make sure to only listen on 587/465/993/995 with TLS/SSL.. NGO's are often targeted.. On 2025-01-21 09:50, Marco Fioretti via dovecot wrote: Greetings, I was just tasked with rebuilding from scratch the mail server of an NGO, on a brand new Ubuntu 24.04 LTS VPS. I have copied the whole dovecot configuration to the new server, and now am stuck because: - dovecot IS running, dovecot service status shows no errors, but: - if I try to connect with mutt from my desktop I get "connection refused" - the ufw firewall does allow imap/imaps connections, and there are no errors in its log - even "telnet localhost 143" fails: Trying ::1... Connection failed: Connection refused Trying 127.0.0.1... telnet: Unable to connect to remote host: Connection refused - I see no related errors in /var/log/mail.log or /var/log/syslog. output of dovecot -n is pasted below, I only changed the actual domain name to "example.com" TIA for any pointer, I really need to get this server back online as soon as possible... Marco # 2.3.21 (47349e2482): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.21 (f6cd4b8e) doveconf: Warning: NOTE: You can get a new clean config file with: doveconf -Pn > dovecot-new.conf doveconf: Warning: Obsolete setting in /etc/dovecot/conf.d/10-ssl.conf:9: ssl_dh_parameters_length is no longer needed # OS: Linux 6.8.0-51-generic x86_64 Ubuntu 24.04.1 LTS ext4 # Hostname: example.com auth_debug = yes auth_verbose = yes auth_verbose_passwords = plain mail_location = maildir:/var/mail/mymail_storage/base/ mbox_write_locks = fcntl passdb { args = /etc/imap.v_users driver = passwd-file } passdb { driver = pam } service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0660 user = postfix } } service imap-login { inet_listener imap { port = 0 } } ssl_cert = </etc/letsencrypt/live/example.com/fullchain.pem ssl_cipher_list = ALL ssl_key = # hidden, use -P to show it ssl_prefer_server_ciphers = yes userdb { args = /etc/imap.v_users driver = passwd-file } userdb { driver = passwd } verbose_ssl = yes _______________________________________________ dovecot mailing list -- dovecot(a)dovecot.org To unsubscribe send an email to dovecot-leave(a)dovecot.org -- "Catch the Magic of Linux..." ------------------------------------------------------------------------ Michael Peddemors, President/CEO LinuxMagic Inc. Visit us at http://www.linuxmagic.com @linuxmagic A Wizard IT Company - For More Info http://www.wizard.ca "LinuxMagic" a Reg. TradeMark of Wizard Tower TechnoServices Ltd. ------------------------------------------------------------------------ 604-682-0300 Beautiful British Columbia, Canada _______________________________________________ dovecot mailing list -- dovecot(a)dovecot.org To unsubscribe send an email to dovecot-leave(a)dovecot.org

6 13

dovecot not listening, but doing passw checks? Was: connection refused, no error anywhere
by Marco Fioretti 22 Jan '25

22 Jan '25

Greetings, I just woke up and went back to try to diagnose the problem I first reported in my other thread, and noticed something weird. After your suggestions, the situation is as follow: 0) FTR, postfix is working, if I open the local mailboxes with mutt running on the server I do see email coming in as expected, from mailing lists and our correspondents 1) output of dovecot -n is below 2) both "ss -tuln | grep 993" and "netstat -tanp" show NO activity /presence on port 993 3) BUT, running "service dovecot status" (see output below, I only changed server and user name) I noticed a failed authentication attempt from SOMEUSER2, happened ~15/20 minutes before I checked, where "SOMEUSER" (without the trailing "2") is an ACTUAL user of the old server, and 200.89.159.59 an IP address I don't know (not my desktop's for sure, and AFAIK no legitimate user is trying to use the server at this time, they know I'm rebuilding it...) Now the question is, OK, that attempt may be some attacker trying to get in, this happens but... HOW is he succeeding to TRY to connect, if dovecot doesn't appear to be listening at all??? And of course, does this help in any way to figure out what is wrong with my configuration? Thanks, Marco ######################################### OUTPUT of dovecot -n (actual domain name changed to example.com) # 2.3.21 (47349e2482): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.21 (f6cd4b8e) doveconf: Warning: NOTE: You can get a new clean config file with: doveconf -Pn > dovecot-new.conf doveconf: Warning: Obsolete setting in /etc/dovecot/conf.d/10-ssl.conf:9: ssl_dh_parameters_length is no longer needed # OS: Linux 6.8.0-51-generic x86_64 Ubuntu 24.04.1 LTS ext4 # Hostname: nexaima auth_debug = yes auth_verbose = yes auth_verbose_passwords = plain mail_debug = yes mail_location = maildir:/var/mail/mymail_storage/base/ mbox_write_locks = fcntl passdb { args = /etc/imap.v_users driver = passwd-file } passdb { driver = pam } service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0660 user = postfix } } service imap-login { inet_listener imap { port = 0 } inet_listener imaps { port = 993 ssl = yes } } ssl_cert = </etc/letsencrypt/live/example.com/fullchain.pem ssl_cipher_list = ALL ssl_key = # hidden, use -P to show it ssl_prefer_server_ciphers = yes userdb { args = /etc/imap.v_users driver = passwd-file } userdb { driver = passwd } verbose_ssl = yes ###################################################### FULL OUTPUT OF "service dovecot status": root@example:/# service dovecot status ● dovecot.service - Dovecot IMAP/POP3 email server Loaded: loaded (/usr/lib/systemd/system/dovecot.service; enabled; preset: enabled) Active: active (running) since Tue 2025-01-21 23:41:45 UTC; 5h 24min ago Docs: man:dovecot(1) https://doc.dovecot.org/ Main PID: 35241 (dovecot) Status: "v2.3.21 (47349e2482) running" Tasks: 5 (limit: 4543) Memory: 3.6M (peak: 5.5M) CPU: 503ms CGroup: /system.slice/dovecot.service ├─35241 /usr/sbin/dovecot -F ├─35242 dovecot/anvil ├─35243 dovecot/log ├─35246 dovecot/config └─35323 dovecot/stats Jan 22 04:49:06 example dovecot[35243]: auth-worker(37492): Debug: conn unix:auth-worker (pid=37491,uid=111): auth-worker<2>: pam(SOMEUSER2,200.89.159.59): #1/1 style=1 > Jan 22 04:49:06 example auth[37492]: pam_unix(dovecot:auth): check pass; user unknown Jan 22 04:49:06 example auth[37492]: pam_unix(dovecot:auth): authentication failure; logname= uid=0 euid=0 tty=dovecot ruser=SOMEUSER2 rhost=200.89.159.59 Jan 22 04:49:08 example dovecot[35243]: auth-worker(37492): conn unix:auth-worker (pid=37491,uid=111): auth-worker<2>: pam(SOMEUSER2,200.89.159.59): pam_authenticate() f> Jan 22 04:49:08 example dovecot[35243]: auth-worker(37492): Debug: conn unix:auth-worker (pid=37491,uid=111): auth-worker<2>: pam(SOMEUSER2,200.89.159.59): Finished pass> Jan 22 04:49:08 example dovecot[35243]: auth-worker(37492): Debug: conn unix:auth-worker (pid=37491,uid=111): auth-worker<2>: Finished: password_mismatch Jan 22 04:49:08 example dovecot[35243]: auth: Debug: pam(SOMEUSER2,200.89.159.59): Finished passdb lookup Jan 22 04:49:08 example dovecot[35243]: auth: Debug: auth(SOMEUSER2,200.89.159.59): Auth request finished Jan 22 04:49:10 example dovecot[35243]: auth: Debug: client passdb out: FAIL 2 user=SOMEUSER2 Jan 22 04:50:06 example dovecot[35243]: auth-worker(37492): Debug: conn unix:auth-worker (pid=37491,uid=111): Disconnected: Connection closed (fd=-1) lines 1-27/27 (END)

3 5

Fwd: [OFFLIST] Re: connection refused, no error anywhere
by Marco Fioretti 22 Jan '25

22 Jan '25

---------- Forwarded message --------- Da: Marco Fioretti <marco.fioretti(a)gmail.com> Date: mar 21 gen 2025 alle ore 19:33 Subject: Re: [OFFLIST] Re: connection refused, no error anywhere To: Michael Peddemors <michael(a)linuxmagic.com> Hi Michel, I cannot say which NGO it is. What I know is that everything with that configuration was working fine, as far as they know, on the old server. So, any help to change the configuration to make it work with the current version of dovecot on Ubuntu 24.04LTS is very welcome... Il giorno mar 21 gen 2025 alle ore 19:11 Michael Peddemors < michael(a)linuxmagic.com> ha scritto: > Which NGO? > > Don't listen on port 143 any more, make sure to only listen on > 587/465/993/995 with TLS/SSL.. > > NGO's are often targeted.. > > > > On 2025-01-21 09:50, Marco Fioretti via dovecot wrote: > > Greetings, > > > > I was just tasked with rebuilding from scratch the mail server of an NGO, > > on a brand new Ubuntu 24.04 LTS VPS. > > > > I have copied the whole dovecot configuration to the new server, and now > am > > stuck because: > > > > - dovecot IS running, dovecot service status shows no errors, but: > > > > - if I try to connect with mutt from my desktop I get "connection > refused" > > > > - the ufw firewall does allow imap/imaps connections, and there are no > > errors in its log > > > > - even "telnet localhost 143" fails: > > Trying ::1... > > Connection failed: Connection refused > > Trying 127.0.0.1... > > telnet: Unable to connect to remote host: Connection refused > > > > - I see no related errors in /var/log/mail.log or /var/log/syslog. > > > > > > output of dovecot -n is pasted below, I only changed the actual domain > name > > to "example.com" > > > > TIA for any pointer, I really need to get this server back online as soon > > as possible... > > > > Marco > > > > # 2.3.21 (47349e2482): /etc/dovecot/dovecot.conf > > # Pigeonhole version 0.5.21 (f6cd4b8e) > > doveconf: Warning: NOTE: You can get a new clean config file with: > doveconf > > -Pn > dovecot-new.conf > > doveconf: Warning: Obsolete setting in /etc/dovecot/conf.d/10-ssl.conf:9: > > ssl_dh_parameters_length is no longer needed > > # OS: Linux 6.8.0-51-generic x86_64 Ubuntu 24.04.1 LTS ext4 > > # Hostname: example.com > > auth_debug = yes > > auth_verbose = yes > > auth_verbose_passwords = plain > > mail_location = maildir:/var/mail/mymail_storage/base/ > > mbox_write_locks = fcntl > > passdb { > > args = /etc/imap.v_users > > driver = passwd-file > > } > > passdb { > > driver = pam > > } > > service auth { > > unix_listener /var/spool/postfix/private/auth { > > group = postfix > > mode = 0660 > > user = postfix > > } > > } > > service imap-login { > > inet_listener imap { > > port = 0 > > } > > } > > ssl_cert = </etc/letsencrypt/live/example.com/fullchain.pem > > ssl_cipher_list = ALL > > ssl_key = # hidden, use -P to show it > > ssl_prefer_server_ciphers = yes > > userdb { > > args = /etc/imap.v_users > > driver = passwd-file > > } > > userdb { > > driver = passwd > > } > > verbose_ssl = yes > > _______________________________________________ > > dovecot mailing list -- dovecot(a)dovecot.org > > To unsubscribe send an email to dovecot-leave(a)dovecot.org > > > -- > "Catch the Magic of Linux..." > ------------------------------------------------------------------------ > Michael Peddemors, President/CEO LinuxMagic Inc. > Visit us at http://www.linuxmagic.com @linuxmagic > A Wizard IT Company - For More Info http://www.wizard.ca > "LinuxMagic" a Reg. TradeMark of Wizard Tower TechnoServices Ltd. > ------------------------------------------------------------------------ > 604-682-0300 Beautiful British Columbia, Canada > >

1 0

Fwd: connection refused, no error anywhere
by Marco Fioretti 22 Jan '25

22 Jan '25

Hi Nick, honestly, I don't know why that port was set to 0, I just inherited the whole server... however, even changing that number to 143 and restarting dovecot makes no difference in the output of netstat I just pasted in another reply.... Il giorno mar 21 gen 2025 alle ore 19:00 Nick Howitt via dovecot < dovecot(a)dovecot.org> ha scritto: > Any reason why the imap-listener port is set to 0 and not 143 or > commented out? > > Have you checked if dovecot is listening on 143? > > > On 21/01/2025 17:50, Marco Fioretti via dovecot wrote: > > Greetings, > > > > I was just tasked with rebuilding from scratch the mail server of an NGO, > > on a brand new Ubuntu 24.04 LTS VPS. > > > > I have copied the whole dovecot configuration to the new server, and now > am > > stuck because: > > > > - dovecot IS running, dovecot service status shows no errors, but: > > > > - if I try to connect with mutt from my desktop I get "connection > refused" > > > > - the ufw firewall does allow imap/imaps connections, and there are no > > errors in its log > > > > - even "telnet localhost 143" fails: > > Trying ::1... > > Connection failed: Connection refused > > Trying 127.0.0.1... > > telnet: Unable to connect to remote host: Connection refused > > > > - I see no related errors in /var/log/mail.log or /var/log/syslog. > > > > > > output of dovecot -n is pasted below, I only changed the actual domain > name > > to "example.com" > > > > TIA for any pointer, I really need to get this server back online as soon > > as possible... > > > > Marco > > > > # 2.3.21 (47349e2482): /etc/dovecot/dovecot.conf > > # Pigeonhole version 0.5.21 (f6cd4b8e) > > doveconf: Warning: NOTE: You can get a new clean config file with: > doveconf > > -Pn > dovecot-new.conf > > doveconf: Warning: Obsolete setting in /etc/dovecot/conf.d/10-ssl.conf:9: > > ssl_dh_parameters_length is no longer needed > > # OS: Linux 6.8.0-51-generic x86_64 Ubuntu 24.04.1 LTS ext4 > > # Hostname: example.com > > auth_debug = yes > > auth_verbose = yes > > auth_verbose_passwords = plain > > mail_location = maildir:/var/mail/mymail_storage/base/ > > mbox_write_locks = fcntl > > passdb { > > args = /etc/imap.v_users > > driver = passwd-file > > } > > passdb { > > driver = pam > > } > > service auth { > > unix_listener /var/spool/postfix/private/auth { > > group = postfix > > mode = 0660 > > user = postfix > > } > > } > > service imap-login { > > inet_listener imap { > > port = 0 > > } > > } > > ssl_cert = </etc/letsencrypt/live/example.com/fullchain.pem > > ssl_cipher_list = ALL > > ssl_key = # hidden, use -P to show it > > ssl_prefer_server_ciphers = yes > > userdb { > > args = /etc/imap.v_users > > driver = passwd-file > > } > > userdb { > > driver = passwd > > } > > verbose_ssl = yes > > _______________________________________________ > > dovecot mailing list --dovecot(a)dovecot.org > > To unsubscribe send an email todovecot-leave(a)dovecot.org > _______________________________________________ > dovecot mailing list -- dovecot(a)dovecot.org > To unsubscribe send an email to dovecot-leave(a)dovecot.org >

1 0

Fwd: connection refused, no error anywhere
by Marco Fioretti 22 Jan '25

22 Jan '25

---------- Forwarded message --------- Da: Marco Fioretti <marco.fioretti(a)gmail.com> Date: mar 21 gen 2025 alle ore 19:27 Subject: Re: connection refused, no error anywhere To: Marc <Marc(a)f1-outsourcing.eu> Hi Marc, this is the output of netstat -tanp (I only removed the line showing the details of my ssh connection): Active Internet connections (servers and established) Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name tcp 0 0 127.0.0.53:53 0.0.0.0:* LISTEN 516/systemd-resolve tcp 0 0 127.0.0.54:53 0.0.0.0:* LISTEN 516/systemd-resolve tcp 0 0 127.0.0.1:10023 0.0.0.0:* LISTEN 28575/postgrey --in tcp6 0 0 :::80 :::* LISTEN 26990/apache2 tcp6 0 0 ::1:10023 :::* LISTEN 28575/postgrey --in and indeed it there is no tracce of dovecot there, but what should I do then? "service dovecot status" says the service IS active... Thanks! Il giorno mar 21 gen 2025 alle ore 19:00 Marc <Marc(a)f1-outsourcing.eu> ha scritto: > You are sure dovecot is running on the ports (netstat -tanp). You are sure > this firewall is ok? Maybe flush it, just to be sure. > > > Greetings, > > > > I was just tasked with rebuilding from scratch the mail server of an > > NGO, > > on a brand new Ubuntu 24.04 LTS VPS. > > > > I have copied the whole dovecot configuration to the new server, and now > > am > > stuck because: > > > > - dovecot IS running, dovecot service status shows no errors, but: > > > > - if I try to connect with mutt from my desktop I get "connection > > refused" > > > > - the ufw firewall does allow imap/imaps connections, and there are no > > errors in its log > > > > - even "telnet localhost 143" fails: > > Trying ::1... > > Connection failed: Connection refused > > Trying 127.0.0.1... > > telnet: Unable to connect to remote host: Connection refused > > > > - I see no related errors in /var/log/mail.log or /var/log/syslog. > > > > > > output of dovecot -n is pasted below, I only changed the actual domain > > name > > to "example.com" > > > > TIA for any pointer, I really need to get this server back online as > > soon > > as possible... > > > > Marco > > > > # 2.3.21 (47349e2482): /etc/dovecot/dovecot.conf > > # Pigeonhole version 0.5.21 (f6cd4b8e) > > doveconf: Warning: NOTE: You can get a new clean config file with: > > doveconf > > -Pn > dovecot-new.conf > > doveconf: Warning: Obsolete setting in /etc/dovecot/conf.d/10- > > ssl.conf:9: > > ssl_dh_parameters_length is no longer needed > > # OS: Linux 6.8.0-51-generic x86_64 Ubuntu 24.04.1 LTS ext4 > > # Hostname: example.com > > auth_debug = yes > > auth_verbose = yes > > auth_verbose_passwords = plain > > mail_location = maildir:/var/mail/mymail_storage/base/ > > mbox_write_locks = fcntl > > passdb { > > args = /etc/imap.v_users > > driver = passwd-file > > } > > passdb { > > driver = pam > > } > > service auth { > > unix_listener /var/spool/postfix/private/auth { > > group = postfix > > mode = 0660 > > user = postfix > > } > > } > > service imap-login { > > inet_listener imap { > > port = 0 > > } > > } > > ssl_cert = </etc/letsencrypt/live/example.com/fullchain.pem > > ssl_cipher_list = ALL > > ssl_key = # hidden, use -P to show it > > ssl_prefer_server_ciphers = yes > > userdb { > > args = /etc/imap.v_users > > driver = passwd-file > > } > > userdb { > > driver = passwd > > } > > verbose_ssl = yes >

1 0

connection refused, no error anywhere
by Marco Fioretti 21 Jan '25

21 Jan '25

Greetings, I was just tasked with rebuilding from scratch the mail server of an NGO, on a brand new Ubuntu 24.04 LTS VPS. I have copied the whole dovecot configuration to the new server, and now am stuck because: - dovecot IS running, dovecot service status shows no errors, but: - if I try to connect with mutt from my desktop I get "connection refused" - the ufw firewall does allow imap/imaps connections, and there are no errors in its log - even "telnet localhost 143" fails: Trying ::1... Connection failed: Connection refused Trying 127.0.0.1... telnet: Unable to connect to remote host: Connection refused - I see no related errors in /var/log/mail.log or /var/log/syslog. output of dovecot -n is pasted below, I only changed the actual domain name to "example.com" TIA for any pointer, I really need to get this server back online as soon as possible... Marco # 2.3.21 (47349e2482): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.21 (f6cd4b8e) doveconf: Warning: NOTE: You can get a new clean config file with: doveconf -Pn > dovecot-new.conf doveconf: Warning: Obsolete setting in /etc/dovecot/conf.d/10-ssl.conf:9: ssl_dh_parameters_length is no longer needed # OS: Linux 6.8.0-51-generic x86_64 Ubuntu 24.04.1 LTS ext4 # Hostname: example.com auth_debug = yes auth_verbose = yes auth_verbose_passwords = plain mail_location = maildir:/var/mail/mymail_storage/base/ mbox_write_locks = fcntl passdb { args = /etc/imap.v_users driver = passwd-file } passdb { driver = pam } service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0660 user = postfix } } service imap-login { inet_listener imap { port = 0 } } ssl_cert = </etc/letsencrypt/live/example.com/fullchain.pem ssl_cipher_list = ALL ssl_key = # hidden, use -P to show it ssl_prefer_server_ciphers = yes userdb { args = /etc/imap.v_users driver = passwd-file } userdb { driver = passwd } verbose_ssl = yes

3 2

Mail with single \r, partial fetch, error "Broken virtual size in mailbox"
by Ewald Dieterich 17 Jan '25

17 Jan '25

I run Dovecot 2.3.21 with the mdbox mailbox format. If I do a certain partial fetch on a mail with a single carriage return \r Dovecot closes the connection and logs the following error: Error: Mailbox INBOX: Deleting corrupted cache record uid=1: UID 1: Broken virtual size in mailbox INBOX: read(/var/spool/dovecot/user/storage/m.1): FETCH BODY[]<18.100> got too little data: 5 vs 6 This happens every time, doveadm force-resync doesn't help. Here's how to reproduce the issue: Deliver a mail with a single carriage return \r (here after the header/body separator, but that's not important): echo -ne "Subject: Test\r\n\r\n\rBody\r\n" | doveadm save -u user Then do a partial fetch from a specific offset: . fetch 1 body[]<18.100> * 1 FETCH (BODY[]<18> {6} ody Connection closed by foreign host. Offset 18 with length 6 should "Body\r\n", that's why the response is 1 byte short ("got too little data: 5 vs 6" in the error message), by why is \r causing this? Other offsets seem to work.

4 5

find mailbox (path) of message
by Marc 13 Jan '25

13 Jan '25

How should I use 'doveadm search -u' to get the mailbox path where the message is stored?

4 4

Bug report on attachment search in dovecot fts plugin
by h.murakami＠lab8.co.jp 10 Jan '25

10 Jan '25

Hi. I am using dovecot's fts plugin and have found a bug-like behavior. I have confirmed that dovecot by itself with fts plugin disabled works fine. dovecot --version 2.3.19.1 (9b53102964) The pattern we found is as follows 1. search with `with attachments` condition from RoundCube linked to dovecot 2. dovecot fts plugin executes the following query to solr but no document is found hdr:application%5c%2f+OR+hdr:multipart%5c%2fm+OR+hdr:multipart%5c%2fsigned+OR+hdr:multipart%5c%2freport 3. roundcube search results also show no items found That's all I have to report. If there is any way to improve the situation, we would like to receive it.

3 2

Re: Problem email client iPhone ios18.2
by Michael Slusarz 09 Jan '25

09 Jan '25

> On 01/08/2025 11:06 AM MST Len Padilla via dovecot <dovecot(a)dovecot.org> wrote: > > Details: > https://github.com/st3fan/dovecot-xaps-daemon > https://github.com/st3fan/dovecot-xaps-plugin Discussion of Apple Push Notifications is kind of irrelevant, since Apple doesn't support this anymore (more accurately: it has been deprecated, and existing users will eventually lose the functionality). See, e.g., https://blog.mxroute.com/important-update-regarding-ios-push-notifications/ michael

2 2

repo.dovecot.org status
by Jasper Spaans 06 Jan '25

06 Jan '25

Hello list, We're using the packages from repo.dovecot.org to run the latest version of dovecot on our systems running ubuntu focal (20.04). We'd like to upgrade these to a more recent ubuntu version[1], but those builds are not available on repo.dovecot.org. Is that repo still supported? If so, what would it take to get builds for ubuntu 22.04 and/or 24.04 on there? I can spend some time on that, but I also have the impression that the build infra (including the scripts) that generate the packages for this repo is not very public. Cheers, Jasper [1] for reasons that are out of scope for this message, using a dockerized build or upgrading to 24.04 (which does come with 2.3.21) is not an option at this moment, so we are currently looking at 22.04. unfortunately that also comes with a dovecot from 2022

2 1

SCRAM-SHA -PLUS variants and Dovecot (Channel Binding)
by * Neustradamus * 04 Jan '25

04 Jan '25

Dear all, In first, I wish you a Happy New Year 2025! In the past, I have requested SCRAM support in Dovecot, etc. I would like to know the situation with -PLUS variants (Channel Binding)? This feature for more security is always missing. RFC 9266: Channel Bindings for TLS 1.3: - https://datatracker.ietf.org/doc/html/rfc9266 Little details, to know easily: - tls-unique for TLS =< 1.2 - tls-server-end-point - tls-exporter for TLS = 1.3 Can you add tls-unique, tls-server-end-point and tls-exporter to be perfect? Stephan Bosch has started but no news since one year: - https://github.com/dovecot/core/compare/main...stephanbosch:dovecot-core:sa… Other links: SASL2 I-D: Extensible Simple Authentication and Security Layer (SASL): - https://datatracker.ietf.org/doc/html/draft-melnikov-sasl2 It is in several XEPs too: - XEP-0388: Extensible SASL Profile: https://xmpp.org/extensions/xep-0388.html - XEP-0440: SASL Channel-Binding Type Capability: https://xmpp.org/extensions/xep-0440.html - XEP-0474: SASL SCRAM Downgrade Protection: https://xmpp.org/extensions/xep-0474.html - XEP-0480: SASL Upgrade Tasks: https://xmpp.org/extensions/xep-0480.html Thanks in advance. Regards, Neustradamus

1 0

Possible SSL Related Issue
by bcs＠nanomail.net 02 Jan '25

02 Jan '25

Need some help in resolving the issue described below and would greatly appreciate any assistance. Please let me know if any additional information is required. Thank you. Updated Postfix with signed certificates from self signed and am experiencing several new log entries that I am unable to identify. See history that follows. * Self signed certificate in Postfix with pop3. Has worked this way since original install. Dec 29 00:12:41 mail dovecot: pop3-login: Login: user=<usr1>, method=PLAIN, rip=209.197.77.67, lip=10.0.1.211, mpid=15448, TLS, session=<CuXLvmEqzM/RxU1D> Dec 29 00:12:41 mail dovecot: pop3(usr1): Disconnected: Logged out top=0/0, retr=0/0, del=0/2825, size=204691614 * Updated log entry for signed certificate in Postfix. Original self signed certificate still used in Dovecot. Note new disconnect record with information such as <136791><t3CWAKwqpieu9RkM> before the Disconnected message. Unable to find anything about these codes. Jan 1 16:48:12 mail dovecot: pop3-login: Login: user=<usr1>, method=PLAIN, rip=174.245.25.12, lip=10.0.1.211, mpid=136791, TLS, session=<t3CWAKwqpieu9RkM> Jan 1 16:48:13 mail dovecot: pop3(usr1)<136791><t3CWAKwqpieu9RkM>: Disconnected: Logged out top=0/0, retr=0/0, del=0/2867, size=206803370 * Self signed certificate in Postfix with imap. Dec 29 00:06:30 mail dovecot: imap-login: Login: user=<usr2>, method=PLAIN, rip=10.0.1.101, lip=10.0.1.211, mpid=15104, TLS, session=<bZezqGEqBMMKAAFl> Dec 29 00:06:31 mail dovecot: imap(usr2): Connection closed (SELECT finished 0.177 secs ago) in=102 out=952 * Updated non self signed certificate in Postfix. Original self signed certificate still used in Dovecot. Similar information before Disconnect message. Jan 1 16:55:00 mail dovecot: imap-login: Login: user=<usr2>, method=PLAIN, rip=10.0.1.4, lip=10.0.1.211, mpid=136855, TLS, session=<Z/7hGKwqntEKAAEE> Jan 1 16:55:00 mail dovecot: imap(usr2)<136855><Z/7hGKwqntEKAAEE>: Connection closed (SELECT finished 0.117 secs ago) in=106 out=1012 deleted=0 expunged=0 trashed=0 hdr_count=0 hdr_bytes=0 body_count=0 body_bytes=0 Issue persists and appears worse when attempting to access the mail server with the Rainloop web application. Rainloop log messages before signed certificate update appeared as the following: Dec 29 07:09:17 mail dovecot: imap-login: Login: user=<usr>, method=PLAIN, rip=10.0.1.211, lip=10.0.1.211, mpid=20215, TLS, session=<xTGtkGcqKNgKAAHT> Dec 29 07:09:17 mail dovecot: imap-login: Login: user=<usr>, method=PLAIN, rip=10.0.1.211, lip=10.0.1.211, mpid=20216, TLS, session=<azKtkGcqMtgKAAHT> Dec 29 07:09:17 mail dovecot: imap-login: Login: user=<usr>, method=PLAIN, rip=10.0.1.211, lip=10.0.1.211, mpid=20217, TLS, session=<Qz2tkGcqOtgKAAHT> Dec 29 07:09:17 mail dovecot: imap(usr): Logged out in=211 out=2047 Dec 29 07:09:17 mail dovecot: imap(usr): Logged out in=28 out=787 Dec 29 07:09:17 mail dovecot: imap(usr): Logged out in=80 out=1449 Dec 29 07:09:17 mail dovecot: imap-login: Login: user=<usr>, method=PLAIN, rip=10.0.1.211, lip=10.0.1.211, mpid=20218, TLS, session=<0EetkGcqRNgKAAHT> Dec 29 07:09:17 mail dovecot: imap(usr): Logged out in=350 out=1381 Dec 29 07:09:17 mail dovecot: imap-login: Login: user=<usr>, method=PLAIN, rip=10.0.1.211, lip=10.0.1.211, mpid=20220, TLS, session=<U8+vkGcqVNgKAAHT> Dec 29 07:09:17 mail dovecot: imap(usr): Logged out in=713 out=66680 Dec 29 07:09:24 mail dovecot: imap(usr): Connection closed (SELECT finished 0.176 secs ago) in=110 out=970 But now contain the same type of <141032><n0r2ZbAqLLMKAAHT> entries before Logged out and seems to be completing significantly more logins and logouts. Note the web interface is working. Jan 1 22:02:53 mail dovecot: imap-login: Login: user=<usr>, method=PLAIN, rip=10.0.1.211, lip=10.0.1.211, mpid=141032, TLS, session=<n0r2ZbAqLLMKAAHT> Jan 1 22:02:53 mail dovecot: imap(usr)<141032><n0r2ZbAqLLMKAAHT>: Logged out in=11 out=457 deleted=0 expunged=0 trashed=0 hdr_count=0 hdr_bytes=0 body_count=0 body_bytes=0 Jan 1 22:02:53 mail dovecot: imap-login: Login: user=<usr>, method=PLAIN, rip=10.0.1.211, lip=10.0.1.211, mpid=141034, TLS, session=<4OP7ZbAqOLMKAAHT> Jan 1 22:02:53 mail dovecot: imap(usr)<141034><4OP7ZbAqOLMKAAHT>: Logged out in=80 out=1470 deleted=0 expunged=0 trashed=0 hdr_count=0 hdr_bytes=0 body_count=0 body_bytes=0 Jan 1 22:02:54 mail dovecot: imap-login: Login: user=<usr>, method=PLAIN, rip=10.0.1.211, lip=10.0.1.211, mpid=141038, TLS, session=<Grz9ZbAqSLMKAAHT> Jan 1 22:02:54 mail dovecot: imap(usr)<141038><Grz9ZbAqSLMKAAHT>: Logged out in=342 out=1473 deleted=0 expunged=0 trashed=0 hdr_count=0 hdr_bytes=0 body_count=0 body_bytes=0 Jan 1 22:02:54 mail dovecot: imap-login: Login: user=<usr>, method=PLAIN, rip=10.0.1.211, lip=10.0.1.211, mpid=141039, TLS, session=<+Mf9ZbAqVLMKAAHT> Jan 1 22:02:54 mail dovecot: imap(usr)<141039><+Mf9ZbAqVLMKAAHT>: Logged out in=693 out=37481 deleted=0 expunged=0 trashed=0 hdr_count=20 hdr_bytes=20978 body_count=0 body_bytes=0 Jan 1 22:02:59 mail dovecot: imap-login: Login: user=<usr>, method=PLAIN, rip=10.0.1.211, lip=10.0.1.211, mpid=141041, TLS, session=<MxRKZrAq6IcKAAHT> Jan 1 22:02:59 mail dovecot: imap(usr)<141041><MxRKZrAq6IcKAAHT>: Logged out in=28 out=881 deleted=0 expunged=0 trashed=0 hdr_count=0 hdr_bytes=0 body_count=0 body_bytes=0 Jan 1 22:03:07 mail dovecot: imap-login: Login: user=<usr>, method=PLAIN, rip=10.0.1.211, lip=10.0.1.211, mpid=141043, TLS, session=<SsLKZrAq7ocKAAHT> Jan 1 22:03:07 mail dovecot: imap(usr)<141043><SsLKZrAq7ocKAAHT>: Logged out in=525 out=10554 deleted=0 expunged=0 trashed=0 hdr_count=1 hdr_bytes=3522 body_count=1 body_bytes=4807 Jan 1 22:03:08 mail dovecot: imap-login: Login: user=<usr>, method=PLAIN, rip=10.0.1.211, lip=10.0.1.211, mpid=141045, TLS, session=<b2/bZrAq/IcKAAHT> Jan 1 22:03:08 mail dovecot: imap(usr)<141045><b2/bZrAq/IcKAAHT>: Logged out in=523 out=15895 deleted=0 expunged=0 trashed=0 hdr_count=1 hdr_bytes=947 body_count=1 body_bytes=13215 Jan 1 22:03:09 mail dovecot: imap-login: Login: user=<usr>, method=PLAIN, rip=10.0.1.211, lip=10.0.1.211, mpid=141047, TLS, session=<P3XrZrAqsJYKAAHT> Jan 1 22:03:09 mail dovecot: imap(usr)<141047><P3XrZrAqsJYKAAHT>: Logged out in=523 out=8719 deleted=0 expunged=0 trashed=0 hdr_count=1 hdr_bytes=779 body_count=1 body_bytes=6300 Jan 1 22:03:10 mail dovecot: imap-login: Login: user=<usr>, method=PLAIN, rip=10.0.1.211, lip=10.0.1.211, mpid=141049, TLS, session=<JmD7ZrAqwJYKAAHT> Jan 1 22:03:10 mail dovecot: imap(usr)<141049><JmD7ZrAqwJYKAAHT>: Logged out in=523 out=13125 deleted=0 expunged=0 trashed=0 hdr_count=1 hdr_bytes=780 body_count=1 body_bytes=10700 Jan 1 22:03:11 mail dovecot: imap-login: Login: user=<usr>, method=PLAIN, rip=10.0.1.211, lip=10.0.1.211, mpid=141051, TLS, session=<kkoLZ7Aq0JYKAAHT> Jan 1 22:03:11 mail dovecot: imap(usr)<141051><kkoLZ7Aq0JYKAAHT>: Logged out in=523 out=8022 deleted=0 expunged=0 trashed=0 hdr_count=1 hdr_bytes=800 body_count=1 body_bytes=5582 Jan 1 22:03:12 mail dovecot: imap-login: Login: user=<usr>, method=PLAIN, rip=10.0.1.211, lip=10.0.1.211, mpid=141055, TLS, session=<7ywbZ7Aq4JYKAAHT> Jan 1 22:03:12 mail dovecot: imap(usr)<141055><7ywbZ7Aq4JYKAAHT>: Logged out in=523 out=13955 deleted=0 expunged=0 trashed=0 hdr_count=1 hdr_bytes=1113 body_count=1 body_bytes=11104 Jan 1 22:03:13 mail dovecot: imap-login: Login: user=<usr>, method=PLAIN, rip=10.0.1.211, lip=10.0.1.211, mpid=141057, TLS, session=<JAMrZ7Aq6JYKAAHT> Jan 1 22:03:13 mail dovecot: imap(usr)<141057><JAMrZ7Aq6JYKAAHT>: Logged out in=523 out=14232 deleted=0 expunged=0 trashed=0 hdr_count=1 hdr_bytes=774 body_count=1 body_bytes=11814 Jan 1 22:03:14 mail dovecot: imap-login: Login: user=<usr>, method=PLAIN, rip=10.0.1.211, lip=10.0.1.211, mpid=141059, TLS, session=<lvE6Z7Aq9JYKAAHT> Jan 1 22:03:14 mail dovecot: imap(usr)<141059><lvE6Z7Aq9JYKAAHT>: Logged out in=523 out=6987 deleted=0 expunged=0 trashed=0 hdr_count=1 hdr_bytes=749 body_count=1 body_bytes=4599 Jan 1 22:03:15 mail dovecot: imap-login: Login: user=<usr>, method=PLAIN, rip=10.0.1.211, lip=10.0.1.211, mpid=141061, TLS, session=<6NdKZ7AqBJcKAAHT> Jan 1 22:03:15 mail dovecot: imap(usr)<141061><6NdKZ7AqBJcKAAHT>: Logged out in=523 out=7126 deleted=0 expunged=0 trashed=0 hdr_count=1 hdr_bytes=812 body_count=1 body_bytes=4676 Jan 1 22:03:16 mail dovecot: imap-login: Login: user=<usr>, method=PLAIN, rip=10.0.1.211, lip=10.0.1.211, mpid=141063, TLS, session=<ebpaZ7AqCJcKAAHT> Jan 1 22:03:16 mail dovecot: imap(usr)<141063><ebpaZ7AqCJcKAAHT>: Logged out in=523 out=26116 deleted=0 expunged=0 trashed=0 hdr_count=1 hdr_bytes=861 body_count=1 body_bytes=23498 Jan 1 22:03:17 mail dovecot: imap-login: Login: user=<usr>, method=PLAIN, rip=10.0.1.211, lip=10.0.1.211, mpid=141065, TLS, session=<2aRqZ7AqDJcKAAHT> Jan 1 22:03:17 mail dovecot: imap(usr)<141065><2aRqZ7AqDJcKAAHT>: Logged out in=523 out=8776 deleted=0 expunged=0 trashed=0 hdr_count=1 hdr_bytes=775 body_count=1 body_bytes=6374 Jan 1 22:03:18 mail dovecot: imap-login: Login: user=<usr>, method=PLAIN, rip=10.0.1.211, lip=10.0.1.211, mpid=141067, TLS, session=<b4d6Z7AqAOIKAAHT> Jan 1 22:03:18 mail dovecot: imap(usr)<141067><b4d6Z7AqAOIKAAHT>: Logged out in=523 out=9875 deleted=0 expunged=0 trashed=0 hdr_count=1 hdr_bytes=749 body_count=1 body_bytes=7498 Jan 1 22:03:20 mail dovecot: imap-login: Login: user=<usr>, method=PLAIN, rip=10.0.1.211, lip=10.0.1.211, mpid=141069, TLS, session=<a3GKZ7AqCuIKAAHT> Jan 1 22:03:20 mail dovecot: imap(usr)<141069><a3GKZ7AqCuIKAAHT>: Logged out in=523 out=61311 deleted=0 expunged=0 trashed=0 hdr_count=1 hdr_bytes=1153 body_count=1 body_bytes=58591 Jan 1 22:03:21 mail dovecot: imap-login: Login: user=<usr>, method=PLAIN, rip=10.0.1.211, lip=10.0.1.211, mpid=141071, TLS, session=<AHuaZ7AqDuIKAAHT> Jan 1 22:03:21 mail dovecot: imap(usr)<141071><AHuaZ7AqDuIKAAHT>: Logged out in=523 out=9458 deleted=0 expunged=0 trashed=0 hdr_count=1 hdr_bytes=1150 body_count=1 body_bytes=6745 Jan 1 22:03:22 mail dovecot: imap-login: Login: user=<usr>, method=PLAIN, rip=10.0.1.211, lip=10.0.1.211, mpid=141073, TLS, session=<X2WqZ7AqGuIKAAHT> Jan 1 22:03:22 mail dovecot: imap(usr)<141073><X2WqZ7AqGuIKAAHT>: Logged out in=523 out=11885 deleted=0 expunged=0 trashed=0 hdr_count=1 hdr_bytes=772 body_count=1 body_bytes=9482 Jan 1 22:03:23 mail dovecot: imap-login: Login: user=<usr>, method=PLAIN, rip=10.0.1.211, lip=10.0.1.211, mpid=141075, TLS, session=<eEu6Z7AqKOIKAAHT> Jan 1 22:03:23 mail dovecot: imap(usr)<141075><eEu6Z7AqKOIKAAHT>: Logged out in=523 out=8665 deleted=0 expunged=0 trashed=0 hdr_count=1 hdr_bytes=777 body_count=1 body_bytes=6326 Jan 1 22:03:24 mail dovecot: imap-login: Login: user=<usr>, method=PLAIN, rip=10.0.1.211, lip=10.0.1.211, mpid=141077, TLS, session=</i3KZ7AqOOIKAAHT> Jan 1 22:03:24 mail dovecot: imap(usr)<141077></i3KZ7AqOOIKAAHT>: Logged out in=523 out=42692 deleted=0 expunged=0 trashed=0 hdr_count=1 hdr_bytes=778 body_count=1 body_bytes=40360 Jan 1 22:03:25 mail dovecot: imap-login: Login: user=<usr>, method=PLAIN, rip=10.0.1.211, lip=10.0.1.211, mpid=141079, TLS, session=<NCDaZ7AqOuIKAAHT> Jan 1 22:03:25 mail dovecot: imap(usr)<141079><NCDaZ7AqOuIKAAHT>: Logged out in=523 out=19469 deleted=0 expunged=0 trashed=0 hdr_count=1 hdr_bytes=1641 body_count=1 body_bytes=16070 Jan 1 22:03:26 mail dovecot: imap-login: Login: user=<usr>, method=PLAIN, rip=10.0.1.211, lip=10.0.1.211, mpid=141081, TLS, session=<QAfqZ7AqPuIKAAHT> Jan 1 22:03:26 mail dovecot: imap(usr)<141081><QAfqZ7AqPuIKAAHT>: Logged out in=523 out=9596 deleted=0 expunged=0 trashed=0 hdr_count=1 hdr_bytes=858 body_count=1 body_bytes=7098 Jan 1 22:03:29 mail dovecot: imap-login: Login: user=<usr>, method=PLAIN, rip=10.0.1.211, lip=10.0.1.211, mpid=141083, TLS, session=<AgEYaLAqgLUKAAHT> Jan 1 22:03:29 mail dovecot: imap(usr)<141083><AgEYaLAqgLUKAAHT>: Logged out in=523 out=11342 deleted=0 expunged=0 trashed=0 hdr_count=1 hdr_bytes=1188 body_count=1 body_bytes=8581 Jan 1 22:10:40 mail dovecot: imap(usr)<141310><rUXLgbAqGq8KAAE8>: Connection closed (SELECT finished 0.074 secs ago) in=101 out=966 deleted=0 expunged=0 trashed=0 hdr_count=0 hdr_bytes=0 body_count=0 body_bytes=0

2 1

Hard-coded upper limit for sieve_max_redirects ?
by Maciej Polewczynski 02 Jan '25

02 Jan '25

Hello, After upgrading Dovecot from version 2.3.4 to 2.3.19 i noticed errors for some users having sieve redirects. Before upgrade all worked fine. In sieve plugin i have two limits: sieve_max_actions = 500 sieve_max_redirects = 150 If user have up to 100 redirects all works fine but if there are 101 or more none of them works and there is error: dovecot: lmtp(test2.mbox) Error: sieve: msgid=<***l>: redirect action: failed to check for duplicate forward to <101th.email.address> It seams that there is another limit but cant find where. When checked "dovecot -n|grep 100" there was only "default_process_limit". Increasing this changed nothing. Still the same error. File ".dovecot.sieve.log" in user home dir don't have any additional information. There is only: redirect action: failed to check for duplicate forward: internal error occurred: refer to server log for more information. Do you have any ideas how to fix it? -- Best regards, Maciej Polewczyński Do or do not. There is no try.

3 4

Moving all mail from one user to another
by Peter Reinhold 29 Dec '24

29 Dec '24

Hi all I have a user that has changed domain, and I am looking to move all her mail from her old account into her new one, but I am really unsure about how to go about it I would think that I am should use https://doc.dovecot.org/main/core/man/doveadm-move.1.html to do it, but the example supplied and all discussion about that tool I can find online is only about moving a users mail across folders on their account, and not the entire accounts content to another account. Has anyone tried to do something like this? -- Peter Reinhold

3 2

993 SSL 143 No encryption
by Dino Edwards 26 Dec '24

26 Dec '24

Hello, I have a dovecot server that listens on both 143 and 993 using SSL. I'm trying to get the 143 port to be unencrypted while 993 to remain encrypted. Is there any way to accomplish this? Thanks

2 3

vacation auto reply mail line endings CR LF
by tobias.niethammer＠projektb.net 21 Dec '24

21 Dec '24

Hi all, I tried to setup dovecot 2.3.21.1 (d492236fa0) (dovecot-pigeonhole-0.5.21.1) with the sieve vacation function. I'm getting here a bit into trouble. if I sent an e-mail to an receipient dovecot does via dma and the local mailserver an mail reply but the mail does only have the header inside. After a bit research my conclusion is that the reply mail which gets generated has line endings CR LF. I have to remove this manualy and set it to \LF to get the mail correcly transfered. I Setup the sieve rule with roundcube. I tried to manualy change the .dovecot.sieve file endings and comipled with sievec .dovecot.sieve .dovecot.svbin the binary again, with no change in the behavior. I guess i missed somewhere an variable to fix this issue? here the sieve file: #################################################### require ["vacation"];^M # rule:[Urlaub]^M if true^M {^M vacation :addresses "test02(a)projektb-mail.net" :subject "test Urlaub" text:^M test 1 test 2 test 3^M .^M ;^M }^M #################################################### thank you for your Support Tobias

4 5

Sekt
by Michael Grimm 20 Dec '24

20 Dec '24

.

1 1

COPY vs MOVE
by Scott Q. 19 Dec '24

19 Dec '24

Anyone that knows a bit about the dovecot internals. is move in any way faster than copy / set deleted flag / expunge ? Thanks! Scott

1 0

failed: error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown: SSL alert number 46, session=
by Marc 19 Dec '24

19 Dec '24

What is the best way to get rid of this message? I think clients start generating after ssl crt update.

3 8