- dovecot - dovecot.org

Replication issue 2.3.7
by Reio Remma 20 Jul '19

20 Jul '19

Hello! I noticed these in the logs since upgrading from 2.3.6. to 2.3.7: Jul 13 11:52:10 turin dovecot: doveadm: Error: dsync-remote(reio(a)mrstuudio.ee)</1ekE7qbKV2gYwAAsNnMGQ>: Error: Exporting mailbox INBOX failed: Mailbox attribute vendor/vendor.dovecot/pvt/server/sieve/files/MR lookup failed: Mailbox attributes not enabled Jul 13 11:52:11 turin dovecot: doveadm: Error: dsync-remote(reio(a)mrstuudio.ee)<MVs/K7ubKV2oYwAAsNnMGQ>: Error: Exporting mailbox INBOX failed: Mailbox attribute vendor/vendor.dovecot/pvt/server/sieve/files/MR lookup failed: Mailbox attributes not enabled After turning on mailbox attributes these errors went away: mail_attribute_dict = file:~/Maildir/dovecot-attributes protocol imap { imap_metadata = yes } But now the errors are replaced with (when deleting mail): Jul 13 12:04:32 turin dovecot: imap(reio(a)mrstuudio.ee): Warning: /home/vmail/mrstuudio.ee/reio/Maildir/dovecot-uidlist: Duplicate file entry at line 2: 1563008644.M18534P25946.orc.mrstuudio.ee,S=4180,W=4262 (uid 23030 -> 23031) - retrying by re-reading from beginning Jul 13 12:04:32 turin dovecot: imap(reio(a)mrstuudio.ee): Warning: Maildir /home/vmail/mrstuudio.ee/reio/Maildir: Expunged message reappeared, giving a new UID (old uid=23030, file=1563008644.M18534P25946.orc.mrstuudio.ee,S=4180,W=4262:2,S) The mail message reappears on the other side of dsync and eventually I end up with 3 identical messages in trash after I've deleted them on both sides. Thanks for any advice, Reio

5 7

Address family not supported by protocol
by Elias Hamaz 19 Jul '19

19 Jul '19

2 1

Address family not supported by protocol
by Elias Hamaz 19 Jul '19

19 Jul '19

Hello, I am trying to run Dovecot on Arch Linux ARM on a Raspberry Pi, and there is an error when calling dovecot. Related information is listed below. Does anybody know if this is a code issue or a configuration issue? Regards, Elias Hamaz $ sudo dovecot: Error: socket() failed: Address family not supported by protocol Error: service(pop3-login): listen(::, 110) failed: Address family not supported by protocol Error: socket() failed: Address family not supported by protocol Error: service(pop3-login): listen(::, 995) failed: Address family not supported by protocol Error: socket() failed: Address family not supported by protocol Error: service(imap-login): listen(::, 143) failed: Address family not supported by protocol Error: socket() failed: Address family not supported by protocol Error: service(imap-login): listen(::, 993) failed: Address family not supported by protocol Fatal: Failed to start listeners $ df -Th: Filesystem Type Size Used Avail Use% Mounted on /dev/root ext4 15G 13G 1.1G 93% / devtmpfs devtmpfs 211M 0 211M 0% /dev tmpfs tmpfs 215M 0 215M 0% /dev/shm tmpfs tmpfs 215M 280K 215M 1% /run tmpfs tmpfs 215M 0 215M 0% /sys/fs/cgroup tmpfs tmpfs 215M 0 215M 0% /tmp /dev/mmcblk0p1 vfat 90M 49M 41M 55% /boot tmpfs tmpfs 43M 0 43M 0% /run/user/1000 $ lscpu: Architecture: armv6l Byte Order: Little Endian CPU(s): 1 On-line CPU(s) list: 0 Thread(s) per core: 1 Core(s) per socket: 1 Socket(s): 1 Vendor ID: ARM Model: 7 Model name: ARM1176 Stepping: r0p7 CPU max MHz: 700.0000 CPU min MHz: 700.0000 BogoMIPS: 697.95 Flags: half thumb fastmult vfp edsp java tls $ dovecot -n: # 2.3.7 (494d20bdc): /etc/dovecot/dovecot.conf # OS: Linux 4.14.50-2-ARCH armv6l # Hostname: alarmpi doveconf: Error: t_readlink(/var/run/dovecot/dovecot.conf) failed: readlink() failed: No such file or directory namespace { inbox = yes location = mailbox { special_use = \Drafts name = Drafts } mailbox { special_use = \Junk name = Junk } mailbox { special_use = \Sent name = Sent } mailbox { special_use = \Sent name = Sent Messages } mailbox { special_use = \Trash name = Trash } prefix = name = inbox } passdb { driver = pam } service replication-notify-fifo { name = aggregator } service anvil-auth-penalty { name = anvil } service auth-worker { name = auth-worker } service auth-client { name = auth } service config { name = config } service dict-async { name = dict-async } service dict { name = dict } service login/proxy-notify { name = director } service dns-client { name = dns_client } service doveadm-server { name = doveadm } service imap-hibernate { name = imap-hibernate } service imap { name = imap-login } service imap-urlauth { name = imap-urlauth-login } service imap-urlauth-worker { name = imap-urlauth-worker } service token-login/imap-urlauth { name = imap-urlauth } service imap-master { name = imap } service indexer-worker { name = indexer-worker } service indexer { name = indexer } service ipc { name = ipc } service lmtp { name = lmtp } service log-errors { name = log } service old-stats-mail { name = old-stats } service pop3 { name = pop3-login } service login/pop3 { name = pop3 } service replicator-doveadm { name = replicator } service stats-reader { name = stats } service submission { name = submission-login } service login/submission { name = submission } ssl_cert = </etc/ssl/certs/dovecot.pem ssl_key = # hidden, use -P to show it userdb { driver = passwd } protocol lmtp { service replication-notify-fifo { name = aggregator } service anvil-auth-penalty { name = anvil } service auth-worker { name = auth-worker } service auth-client { name = auth } service config { name = config } service dict-async { name = dict-async } service dict { name = dict } service login/proxy-notify { name = director } service dns-client { name = dns_client } service doveadm-server { name = doveadm } service imap-hibernate { name = imap-hibernate } service imap { name = imap-login } service imap-urlauth { name = imap-urlauth-login } service imap-urlauth-worker { name = imap-urlauth-worker } service token-login/imap-urlauth { name = imap-urlauth } service imap-master { name = imap } service indexer-worker { name = indexer-worker } service indexer { name = indexer } service ipc { name = ipc } service lmtp { name = lmtp } service log-errors { name = log } service old-stats-mail { name = old-stats } service pop3 { name = pop3-login } service login/pop3 { name = pop3 } service replicator-doveadm { name = replicator } service stats-reader { name = stats } service submission { name = submission-login } service login/submission { name = submission } } protocol !indexer-worker { service replication-notify-fifo { name = aggregator } service anvil-auth-penalty { name = anvil } service auth-worker { name = auth-worker } service auth-client { name = auth } service config { name = config } service dict-async { name = dict-async } service dict { name = dict } service login/proxy-notify { name = director } service dns-client { name = dns_client } service doveadm-server { name = doveadm } service imap-hibernate { name = imap-hibernate } service imap { name = imap-login } service imap-urlauth { name = imap-urlauth-login } service imap-urlauth-worker { name = imap-urlauth-worker } service token-login/imap-urlauth { name = imap-urlauth } service imap-master { name = imap } service indexer-worker { name = indexer-worker } service indexer { name = indexer } service ipc { name = ipc } service lmtp { name = lmtp } service log-errors { name = log } service old-stats-mail { name = old-stats } service pop3 { name = pop3-login } service login/pop3 { name = pop3 } service replicator-doveadm { name = replicator } service stats-reader { name = stats } service submission { name = submission-login } service login/submission { name = submission } } protocol lda { service replication-notify-fifo { name = aggregator } service anvil-auth-penalty { name = anvil } service auth-worker { name = auth-worker } service auth-client { name = auth } service config { name = config } service dict-async { name = dict-async } service dict { name = dict } service login/proxy-notify { name = director } service dns-client { name = dns_client } service doveadm-server { name = doveadm } service imap-hibernate { name = imap-hibernate } service imap { name = imap-login } service imap-urlauth { name = imap-urlauth-login } service imap-urlauth-worker { name = imap-urlauth-worker } service token-login/imap-urlauth { name = imap-urlauth } service imap-master { name = imap } service indexer-worker { name = indexer-worker } service indexer { name = indexer } service ipc { name = ipc } service lmtp { name = lmtp } service log-errors { name = log } service old-stats-mail { name = old-stats } service pop3 { name = pop3-login } service login/pop3 { name = pop3 } service replicator-doveadm { name = replicator } service stats-reader { name = stats } service submission { name = submission-login } service login/submission { name = submission } } protocol imap { service replication-notify-fifo { name = aggregator } service anvil-auth-penalty { name = anvil } service auth-worker { name = auth-worker } service auth-client { name = auth } service config { name = config } service dict-async { name = dict-async } service dict { name = dict } service login/proxy-notify { name = director } service dns-client { name = dns_client } service doveadm-server { name = doveadm } service imap-hibernate { name = imap-hibernate } service imap { name = imap-login } service imap-urlauth { name = imap-urlauth-login } service imap-urlauth-worker { name = imap-urlauth-worker } service token-login/imap-urlauth { name = imap-urlauth } service imap-master { name = imap } service indexer-worker { name = indexer-worker } service indexer { name = indexer } service ipc { name = ipc } service lmtp { name = lmtp } service log-errors { name = log } service old-stats-mail { name = old-stats } service pop3 { name = pop3-login } service login/pop3 { name = pop3 } service replicator-doveadm { name = replicator } service stats-reader { name = stats } service submission { name = submission-login } service login/submission { name = submission } } protocol pop3 { service replication-notify-fifo { name = aggregator } service anvil-auth-penalty { name = anvil } service auth-worker { name = auth-worker } service auth-client { name = auth } service config { name = config } service dict-async { name = dict-async } service dict { name = dict } service login/proxy-notify { name = director } service dns-client { name = dns_client } service doveadm-server { name = doveadm } service imap-hibernate { name = imap-hibernate } service imap { name = imap-login } service imap-urlauth { name = imap-urlauth-login } service imap-urlauth-worker { name = imap-urlauth-worker } service token-login/imap-urlauth { name = imap-urlauth } service imap-master { name = imap } service indexer-worker { name = indexer-worker } service indexer { name = indexer } service ipc { name = ipc } service lmtp { name = lmtp } service log-errors { name = log } service old-stats-mail { name = old-stats } service pop3 { name = pop3-login } service login/pop3 { name = pop3 } service replicator-doveadm { name = replicator } service stats-reader { name = stats } service submission { name = submission-login } service login/submission { name = submission } } protocol submission { service replication-notify-fifo { name = aggregator } service anvil-auth-penalty { name = anvil } service auth-worker { name = auth-worker } service auth-client { name = auth } service config { name = config } service dict-async { name = dict-async } service dict { name = dict } service login/proxy-notify { name = director } service dns-client { name = dns_client } service doveadm-server { name = doveadm } service imap-hibernate { name = imap-hibernate } service imap { name = imap-login } service imap-urlauth { name = imap-urlauth-login } service imap-urlauth-worker { name = imap-urlauth-worker } service token-login/imap-urlauth { name = imap-urlauth } service imap-master { name = imap } service indexer-worker { name = indexer-worker } service indexer { name = indexer } service ipc { name = ipc } service lmtp { name = lmtp } service log-errors { name = log } service old-stats-mail { name = old-stats } service pop3 { name = pop3-login } service login/pop3 { name = pop3 } service replicator-doveadm { name = replicator } service stats-reader { name = stats } service submission { name = submission-login } service login/submission { name = submission } }

1 0

Re: Dovecot 2.3.0 TLS
by Alexandre Urban 19 Jul '19

19 Jul '19

Hello, I don't know who will read this message, but I found this thread: https://www.mail-archive.com/search?l=dovecot@dovecot.org&q=subject:%22Dove… And I'm expected the same issue, I will try to explain to you (english is not my native language, sorry) Since Buster update, so Dovecot update too, I'm not able to connect to my mail server from my iOS mail client (12.2) Thunderbird just work fine. Here is my configuration: Debian Buster (amd64) Dovecot: 2.3.4.1 Postfix : 3.4.5 OpenSSL: 1.1.1c Dovecot configuration file: ssl_min_protocol = TLSv1.2 (I tried different version) When I tried to connect with command line: openssl s_client -showcerts -connect server:993 No client certificate CA names sent Peer signing digest: SHA256 Peer signature type: RSA-PSS Server Temp Key: X25519, 253 bits --- SSL handshake has read 2322 bytes and written 392 bytes Verification error: unable to verify the first certificate --- New, TLSv1.3, Cipher is TLS_AES_256_GCM_SHA384 Server public key is 2048 bit Secure Renegotiation IS NOT supported Compression: NONE Expansion: NONE No ALPN negotiated Early data was not sent Verify return code: 21 (unable to verify the first certificate) When I tried to connect with command line: openssl s_client -showcerts -no_tls1_3 -connect server:993 No client certificate CA names sent Peer signing digest: SHA256 Peer signature type: RSA-PSS Server Temp Key: X25519, 253 bits --- SSL handshake has read 2423 bytes and written 310 bytes Verification error: unable to verify the first certificate --- New, TLSv1.2, Cipher is ECDHE-RSA-AES256-GCM-SHA384 Server public key is 2048 bit Secure Renegotiation IS supported Compression: NONE Expansion: NONE No ALPN negotiated SSL-Session: Protocol : TLSv1.2 Cipher : ECDHE-RSA-AES256-GCM-SHA384 I think the "Secure Renegotiation IS NOT supported" with tls 1.3 could be an issue, but I don't what to do to fix the issue ? Could you help me ? Let me know if you need more informations. Thank you. Regards, Alex

2 1

Panic alert
by marvin alcantara 18 Jul '19

18 Jul '19

Hi, I am getting a panic alert when sending an email in my box. Below is the backtrace: /usr/lib64/dovecot/libdovecot.so.0(+0x9f3de) [0x7fa90b5543de] -> /usr/lib64/dovecot/libdovecot.so.0(+0x9f4be) [0x7fa90b5544be] -> /usr/lib64/dovecot/libdovecot.so.0(i_fatal+0) [0x7fa90b4e577c] -> /usr/lib64/dovecot/libdovecot-storage.so.0(mail_search_args_unref+0xa2) [0x7fa90b827c82] -> /usr/lib64/dovecot/libdovecot-storage.so.0(mailbox_search_result_free+0x7a) [0x7fa90b84029a] -> /usr/lib64/dovecot/libdovecot-storage.so.0(mail_thread_init+0x128) [0x7fa90b8b2e88] -> /usr/lib64/dovecot/libdovecot-storage.so.0(index_storage_search_init+0x471) [0x7fa90b8a78a1] -> /usr/lib64/dovecot/lib20_virtual_plugin.so(virtual_search_init+0x23) [0x7fa90a0ac3d3] -> /usr/lib64/dovecot/libdovecot-storage.so.0(index_search_result_update_flags+0x11f) [0x7fa90b8a4f8f] -> /usr/lib64/dovecot/libdovecot-storage.so.0(index_sync_search_results_update+0x5b) [0x7fa90b8afe9b] -> /usr/lib64/dovecot/libdovecot-storage.so.0(index_mailbox_sync_deinit+0x1a4) [0x7fa90b8b0724] -> /usr/lib64/dovecot/libdovecot-storage.so.0(+0xaa03f) [0x7fa90b89103f] -> /usr/lib64/dovecot/libdovecot-storage.so.0(mailbox_sync_deinit+0x38) [0x7fa90b830cb8] -> dovecot/imap(+0x27111) [0x564ec6db6111] -> dovecot/imap(imap_sync_more+0x10d) [0x564ec6db6ccd] -> dovecot/imap(+0x28356) [0x564ec6db7356] -> dovecot/imap(cmd_sync_delayed+0x1f4) [0x564ec6db7814] -> dovecot/imap(client_handle_input+0x218) [0x564ec6daa968] -> dovecot/imap(client_input+0x85) [0x564ec6daae05] -> /usr/lib64/dovecot/libdovecot.so.0(io_loop_call_io+0x52) [0x7fa90b569cd2] -> /usr/lib64/dovecot/libdovecot.so.0(io_loop_handler_run_internal+0x10f) [0x7fa90b56b3bf] -> /usr/lib64/dovecot/libdovecot.so.0(io_loop_handler_run+0x3c) [0x7fa90b569d6c] -> /usr/lib64/dovecot/libdovecot.so.0(io_loop_run+0x38) [0x7fa90b569f28] -> /usr/lib64/dovecot/libdovecot.so.0(master_service_run+0x13) [0x7fa90b4effa3] -> dovecot/imap(main+0x333) [0x564ec6d9d2e3] -> /lib64/libc.so.6(__libc_start_main+0xf5) [0x7fa90b10a445] -> dovecot/imap(+0xe476) [0x564ec6d9d476] Dovecot version: 2.2.33.2 I would like to ask help on what is happening here. I found in the code that the trigger is in plugins/virtual/virtual-sync.c virtual_sync() call. When does this actually being called? Thank you very much! Regards,Marvin Alcantara

1 0

auth: Warning: Event 0x1280fe20 leaked
by John Doe Vecot 18 Jul '19

18 Jul '19

Lately I get some errors in my logfile, saying: dovecot[72337]: auth: Warning: Event 0x1280fe20 leaked (parent=0x0): auth-client-connection.c:338: 1 Time(s) Can you tell me what is going wrong here? Thanks.

4 4

Dovecot release v2.3.7
by Aki Tuomi 17 Jul '19

17 Jul '19

Hi! We are pleased to release Dovecot release v2.3.7. Tarball is available at https://dovecot.org/releases/2.3/dovecot-2.3.7.tar.gz https://dovecot.org/releases/2.3/dovecot-2.3.7.tar.gz.sig Binary packages are available at https://repo.dovecot.org/ Changes ------- * fts-solr: Removed break-imap-search parameter + Added more events for the new statistics, see https://doc.dovecot.org/admin_manual/list_of_events/ + mail-lua: Add IMAP metadata accessors, see https://doc.dovecot.org/admin_manual/lua/ + Add event exporters that allow exporting raw events to log files and external systems, see https://doc.dovecot.org/configuration_manual/event_export/ + SNIPPET is now PREVIEW and size has been increased to 200 characters. + Add body option to fts_enforced. This triggers building FTS index only on body search, and an error using FTS index fails the search rather than reads through all the mails. - Submission/LMTP: Fixed crash when domain argument is invalid in a second EHLO/LHLO command. - Copying/moving mails using Maildir format loses IMAP keywords in the destination if the mail also has no system flags. - mail_attachment_detection_options=add-flags-on-save caused email body to be unnecessarily opened when FETCHing mail headers that were already cached. - mail attachment detection keywords not saved with maildir. - dovecot.index.cache may have grown excessively large in some situations. This happened especially when using autoexpunging with lazy_expunge folders. Also with mdbox format in general the cache file wasn't recreated as often as it should have. - Autoexpunged mails weren't immediately deleted from the disk. Instead, the deletion from disk happened the next time the folder was opened. This could have caused unnecessary delays if the opening was done by an interactive IMAP session. - Dovecot's TCP connections sometimes add extra 40ms latency due to not enabling TCP_NODELAY. HTTP and SMTP/LMTP connections weren't affected, but everything else was. This delay wasn't always visible - only in some situations with some message/packet sizes. - imapc: Fix various crash conditions - Dovecot builds were not always reproducible. - login-proxy: With shutdown_clients=no after config reload the existing connections could no longer be listed or kicked with doveadm. - "doveadm proxy kick" with -f parameter caused a crash in some situations. - Auth policy can cause segmentation fault crash during auth process shutdown if all auth requests have not been finished. - Fix various minor bugs leading into incorrect behaviour in mailbox list index handling. These rarely caused noticeable problems. - LDAP auth: Iteration accesses freed memory, possibly crashing auth-worker - local_name { .. } filter in dovecot.conf does not correctly support multiple names and wildcards were matched incorrectly. - replicator: dsync assert-crashes if it can't connect to remote TCP server. - config: Memory leak in config process when ssl_dh setting wasn't set and there was no ssl-parameters.dat file. This caused config process to die once in a while with "out of memory". --- Aki Tuomi Open-Xchange oy

5 16

pigeonhole question: filtering on delivered-to in case of fetchmail
by Trever L. Adams 17 Jul '19

17 Jul '19

So, one of the problems I am seeing is that people are trying to fake users into revealing information by sending from an outside domain but with an internal reply to address and claiming to be administration, IT or what not. I can set up something that will reject if from is outside the domain by reply to is internal. The problem is in some setups, there are fetchmail setups. I do not want to reject these with a message. Which is what I am currently doing for the others. Maybe I should discard them all without rejecting. However, my question is this: Since such fetchmail messages will usually end up with two (at least two?!?) Delivered-To headers, one for the fetchmail delivery and one for the original target address's/system's delivery is it possible to do something like this and have it work? require ["fileinto", "regex","reject"]; if address :regex "Reply-To" ".*@<%= @name -%>" { if not address :regex "From" ".*@<%= @name -%>" { if not header :regex "Delivered-To" " .*@<%= @name -%> { reject "We do not allow emails from outside our system to give Reply-To into our system!"; stop; } } } Please, not the <% =@name -%> is just that this is from a puppet module I use to maintain these systems. It is the domain name for the mail system. An example would be .*(a)middleearth.sapphiresunday.org here. Thank you for any help in figuring this out. The reason I want a reject in the case of non-fetchmail email is to let users know if they try to do it (as many have multiple email accounts) and may try it. But in fetchmail cases, no need to leak to the outside world that users are doing fetchmail and what their account is in the other system. Thank you. Trever

2 3

Dovecot v2.3.7 - TLS/SSL issue
by Christos Chatzaras 17 Jul '19

17 Jul '19

I use a helpdesk system that connects to dovecot using POP3 with SSL enabled to fetch the e-mails. After I upgrade to v2.3.7 the helpdesk randomly (some times it works, some times not) doesn't fetch the e-mails. If I configure the e-mail accounts with SSL/TLS disabled then it works. Any idea about this?

2 1

2.3.7 slower than 2.3.6?
by Ralf Hildebrandt 17 Jul '19

17 Jul '19

We're using dovecot (via LMTP) as a backup for all incoming mail. I upgraded from 2.3.6 to 2.3.7 on the 12th: 2019-07-12 14:35:44 upgrade dovecot-imapd:amd64 2:2.3.6-2~bionic 2:2.3.7-8~bionic and it seems that 2.3.7 is slower than 2.3.6 -- mail to the backup IMAP box is suddenly taking quite some time to get delivered and is piling up in the queue. doveconf -n: ============ default_vsz_limit = 2 G lmtp_user_concurrency_limit = 10000 mail_attachment_dir = /home/copymail/attachments mail_fsync = never mail_location = mdbox:~/mdbox mail_plugins = zlib fts mdbox_rotate_size = 128 M ... namespaces ... plugin { fts_autoindex = yes fts_languages = de,en zlib_save = gz zlib_save_level = 5 } protocols = " imap lmtp" userdb { args = username_format=%u /etc/dovecot/passwd driver = passwd-file } protocol lmtp { mail_plugins = zlib fts } -- Ralf Hildebrandt Geschäftsbereich IT | Abteilung Netzwerk Charité - Universitätsmedizin Berlin Campus Benjamin Franklin Hindenburgdamm 30 | D-12203 Berlin Tel. +49 30 450 570 155 | Fax: +49 30 450 570 962 ralf.hildebrandt(a)charite.de | https://www.charite.de

2 5

Auto-duplicate mailstore?
by ＠lbutlr 16 Jul '19

16 Jul '19

I am looking for something that is similar to replication, but without a second server. I currently have a system setup using postfix bcc to write out copies of all email, but what I would rather do is just have all the mail written to /usr/local/virtual/%u/Maildir and also to /backup/usr/local/virtual/%u/Maildir (for example) as this will make restoring messages much simpler. -- Gods don't like people not doing much work. People who aren't busy all the time might start to think.

1 2

Unexpected result from LIST EXTENDED command
by Emil Kalchev 16 Jul '19

16 Jul '19

I am executing this command below to dovecot-2.3.5-6.cp1178.x86_64 server Notice that some status responses are missing (For folders INBOX.Archive, INBOX.spam.&-BD0EOQQ9BDkEPQ-). I wonder If this is a bug or working as expected In rfc5819 there is this: If the server runs into unexpected problems while trying to look up the STATUS information, it MAY drop the corresponding STATUS reply. In such a situation, the LIST command would still return a tagged OK reply. May be that is the reason for this response? Is it possible to find more details in server logs why STATUS is missing? C: B00000007 LIST "" "INBOX.*" RETURN (SUBSCRIBED CHILDREN STATUS (HIGHESTMODSEQ)) S: * LIST (\Subscribed \HasNoChildren \UnMarked) "." INBOX.gfgfee888 S: * STATUS INBOX.gfgfee888 (HIGHESTMODSEQ 1) S: * LIST (\Subscribed \HasNoChildren \UnMarked) "." INBOX.99999999 S: * STATUS INBOX.99999999 (HIGHESTMODSEQ 3) S: * LIST (\Subscribed \HasNoChildren \UnMarked) "." INBOX.yyyyyyyyyyyyy S: * STATUS INBOX.yyyyyyyyyyyyy (HIGHESTMODSEQ 1) S: * LIST (\Subscribed \HasNoChildren \UnMarked) "." INBOX.y S: * STATUS INBOX.y (HIGHESTMODSEQ 1) S: * LIST (\Subscribed \HasNoChildren \UnMarked) "." INBOX.fgfgfg S: * STATUS INBOX.fgfgfg (HIGHESTMODSEQ 61) S: * LIST (\Subscribed \HasChildren \UnMarked) "." INBOX.Mailspring S: * STATUS INBOX.Mailspring (HIGHESTMODSEQ 1) S: * LIST (\Subscribed \HasNoChildren \UnMarked) "." INBOX.Mailspring.Snoozed S: * STATUS INBOX.Mailspring.Snoozed (HIGHESTMODSEQ 1) S: * LIST (\Subscribed \HasNoChildren \UnMarked) "." INBOX.fgfgf S: * STATUS INBOX.fgfgf (HIGHESTMODSEQ 3) S: * LIST (\Subscribed \HasNoChildren \UnMarked) "." INBOX.gggg34 S: * STATUS INBOX.gggg34 (HIGHESTMODSEQ 5) S: * LIST (\Subscribed \HasChildren \UnMarked) "." INBOX.gggg S: * STATUS INBOX.gggg (HIGHESTMODSEQ 2) S: * LIST (\Subscribed \HasNoChildren \UnMarked) "." INBOX.gggg.hhhh S: * STATUS INBOX.gggg.hhhh (HIGHESTMODSEQ 1) S: * LIST (\Subscribed \HasNoChildren \UnMarked) "." INBOX.mkmkm S: * STATUS INBOX.mkmkm (HIGHESTMODSEQ 1) S: * LIST (\Subscribed \HasChildren \UnMarked) "." INBOX.sdfsf S: * STATUS INBOX.sdfsf (HIGHESTMODSEQ 1) S: * LIST (\HasChildren \UnMarked) "." INBOX.sdfsf.sdfsdfsdfsd S: * STATUS INBOX.sdfsf.sdfsdfsdfsd (HIGHESTMODSEQ 1) S: * LIST (\HasNoChildren \UnMarked) "." INBOX.sdfsf.sdfsdfsdfsd.zzzz S: * STATUS INBOX.sdfsf.sdfsdfsdfsd.zzzz (HIGHESTMODSEQ 2263) S: * LIST (\Subscribed \HasChildren \UnMarked) "." INBOX.uuyy S: * STATUS INBOX.uuyy (HIGHESTMODSEQ 1) S: * LIST (\Subscribed \HasChildren \UnMarked) "." INBOX.uuyy.sdfsdf S: * STATUS INBOX.uuyy.sdfsdf (HIGHESTMODSEQ 1) S: * LIST (\Subscribed \HasChildren \UnMarked) "." "INBOX.uuyy.sdfsdf.New Folder" S: * STATUS "INBOX.uuyy.sdfsdf.New Folder" (HIGHESTMODSEQ 1) S: * LIST (\Subscribed \HasChildren \UnMarked) "." "INBOX.uuyy.sdfsdf.New Folder.dfgdfg" S: * STATUS "INBOX.uuyy.sdfsdf.New Folder.dfgdfg" (HIGHESTMODSEQ 1) S: * LIST (\Subscribed \HasChildren \UnMarked) "." "INBOX.uuyy.sdfsdf.New Folder.dfgdfg.sdfsdfsdf" S: * STATUS "INBOX.uuyy.sdfsdf.New Folder.dfgdfg.sdfsdfsdf" (HIGHESTMODSEQ 1) S: * LIST (\Subscribed \HasChildren \UnMarked) "." "INBOX.uuyy.sdfsdf.New Folder.dfgdfg.sdfsdfsdf.sdfsdfsfsdf" S: * STATUS "INBOX.uuyy.sdfsdf.New Folder.dfgdfg.sdfsdfsdf.sdfsdfsfsdf" (HIGHESTMODSEQ 1) S: * LIST (\Subscribed \HasNoChildren \UnMarked) "." "INBOX.uuyy.sdfsdf.New Folder.dfgdfg.sdfsdfsdf.sdfsdfsfsdf.asdasdasd" S: * STATUS "INBOX.uuyy.sdfsdf.New Folder.dfgdfg.sdfsdfsdf.sdfsdfsfsdf.asdasdasd" (HIGHESTMODSEQ 1) S: * LIST (\Subscribed \HasNoChildren \UnMarked) "." INBOX.uuyy.fdfgdfg S: * STATUS INBOX.uuyy.fdfgdfg (HIGHESTMODSEQ 2) S: * LIST (\Subscribed \HasNoChildren \UnMarked) "." INBOX.vvvcv S: * STATUS INBOX.vvvcv (HIGHESTMODSEQ 2627) S: * LIST (\Subscribed \HasNoChildren \UnMarked) "." INBOX.hallo S: * STATUS INBOX.hallo (HIGHESTMODSEQ 96) S: * LIST (\Subscribed \HasChildren \UnMarked) "." "INBOX.New Folder" S: * STATUS "INBOX.New Folder" (HIGHESTMODSEQ 1) S: * LIST (\Subscribed \HasNoChildren \UnMarked) "." "INBOX.New Folder.omgfolder" S: * STATUS "INBOX.New Folder.omgfolder" (HIGHESTMODSEQ 1) S: * LIST (\Subscribed \HasNoChildren \UnMarked) "." "INBOX.New Folder.testfolder" S: * STATUS "INBOX.New Folder.testfolder" (HIGHESTMODSEQ 1) S: * LIST (\HasNoChildren \UnMarked) "." "INBOX.New Folder.hkhk" S: * STATUS "INBOX.New Folder.hkhk" (HIGHESTMODSEQ 1) S: * LIST (\Subscribed \HasNoChildren \UnMarked) "." "INBOX.New Folder.zzz" S: * STATUS "INBOX.New Folder.zzz" (HIGHESTMODSEQ 1) S: * LIST (\Subscribed \HasNoChildren \UnMarked) "." "INBOX.New Folder.aaa" S: * STATUS "INBOX.New Folder.aaa" (HIGHESTMODSEQ 1) S: * LIST (\Subscribed \HasNoChildren \UnMarked) "." "INBOX.New Folder.kgkgkk" S: * STATUS "INBOX.New Folder.kgkgkk" (HIGHESTMODSEQ 1) S: * LIST (\Subscribed \HasNoChildren \UnMarked) "." "INBOX.New Folder.gggfff" S: * STATUS "INBOX.New Folder.gggfff" (HIGHESTMODSEQ 1) S: * LIST (\Subscribed \HasNoChildren \UnMarked) "." "INBOX.New Folder.New Folder" S: * STATUS "INBOX.New Folder.New Folder" (HIGHESTMODSEQ 1) S: * LIST (\Subscribed \HasNoChildren \UnMarked) "." "INBOX.New Folder.hhhh" S: * STATUS "INBOX.New Folder.hhhh" (HIGHESTMODSEQ 1) S: * LIST (\Subscribed \HasNoChildren \UnMarked) "." "INBOX.New Folder.nnnn" S: * STATUS "INBOX.New Folder.nnnn" (HIGHESTMODSEQ 1) S: * LIST (\Subscribed \HasChildren \UnMarked) "." INBOX.asdasd S: * STATUS INBOX.asdasd (HIGHESTMODSEQ 23) S: * LIST (\HasNoChildren \UnMarked) "." INBOX.asdasd.gdfgdfgdfg S: * STATUS INBOX.asdasd.gdfgdfgdfg (HIGHESTMODSEQ 10) S: * LIST (\Subscribed \HasChildren \UnMarked) "." INBOX.spam S: * STATUS INBOX.spam (HIGHESTMODSEQ 44) S: * LIST (\HasChildren \UnMarked) "." INBOX.spam.&-BD0EOQQ9BDkEPQ- S: * LIST (\Subscribed \HasChildren \UnMarked) "." INBOX.spam.&-BD0EOQQ9BDkEPQ-.jhfhg S: * STATUS INBOX.spam.&-BD0EOQQ9BDkEPQ-.jhfhg (HIGHESTMODSEQ 1) S: * LIST (\Subscribed \HasNoChildren \UnMarked) "." "INBOX.spam.&-BD0EOQQ9BDkEPQ-.jhfhg.New Folder" S: * STATUS "INBOX.spam.&-BD0EOQQ9BDkEPQ-.jhfhg.New Folder" (HIGHESTMODSEQ 1) S: * LIST (\Subscribed \HasChildren \UnMarked) "." INBOX.spam.&-BD0EOQQ9BDkEPQ-.jhfhg.aaa S: * STATUS INBOX.spam.&-BD0EOQQ9BDkEPQ-.jhfhg.aaa (HIGHESTMODSEQ 1) S: * LIST (\Subscribed \HasNoChildren \UnMarked) "." INBOX.spam.&-BD0EOQQ9BDkEPQ-.jhfhg.aaa.aaa S: * STATUS INBOX.spam.&-BD0EOQQ9BDkEPQ-.jhfhg.aaa.aaa (HIGHESTMODSEQ 1) S: * LIST (\Subscribed \HasNoChildren \UnMarked) "." INBOX.Sent S: * STATUS INBOX.Sent (HIGHESTMODSEQ 1353) S: * LIST (\Subscribed \HasNoChildren \UnMarked) "." INBOX.Trash S: * STATUS INBOX.Trash (HIGHESTMODSEQ 5823) S: * LIST (\Subscribed \HasChildren \UnMarked) "." INBOX.Junk S: * STATUS INBOX.Junk (HIGHESTMODSEQ 15) S: * LIST (\Subscribed \HasChildren \UnMarked) "." INBOX.Junk.asdasd S: * STATUS INBOX.Junk.asdasd (HIGHESTMODSEQ 1) S: * LIST (\Subscribed \HasChildren \UnMarked) "." INBOX.Junk.asdasd.rgthfgh S: * STATUS INBOX.Junk.asdasd.rgthfgh (HIGHESTMODSEQ 1) S: * LIST (\Subscribed \HasNoChildren \UnMarked) "." INBOX.Junk.asdasd.rgthfgh.Mailspring S: * STATUS INBOX.Junk.asdasd.rgthfgh.Mailspring (HIGHESTMODSEQ 28) S: * LIST (\Subscribed \HasChildren \UnMarked) "." INBOX.Junk.asdasd.asdasdasd S: * STATUS INBOX.Junk.asdasd.asdasdasd (HIGHESTMODSEQ 1) S: * LIST (\Subscribed \HasNoChildren \UnMarked) "." INBOX.Junk.asdasd.asdasdasd.dfgdfg S: * STATUS INBOX.Junk.asdasd.asdasdasd.dfgdfg (HIGHESTMODSEQ 1) S: * LIST (\Subscribed \HasNoChildren \UnMarked) "." INBOX.Drafts S: * STATUS INBOX.Drafts (HIGHESTMODSEQ 1091) S: * LIST (\HasNoChildren \UnMarked) "." INBOX.Archive S: B00000007 OK List completed (0.004 + 0.000 + 0.003 secs).

3 4

Replication Upgrade 2.2 -> 2.3 Question
by Cassidy B. Larson 15 Jul '19

15 Jul '19

Finally getting around to upgrading my setup to 2.3.x. All of our front end proxies are fine on 2.3 connecting to a 2.2 backend storage pair. So the question is, if I stage the upgrade, will it break replication between the two backend storage servers? My thought was to upgrade one to 2.3, and keep the other on 2.2 for a couple of days? If so, can 2.2 replicate to 2.3, and 2.3 replicate to 2.2 without any issue? Or am I going to have to go all-in on 2.3 at once on both? Heh. Thanks, -c

1 0

Listing expunged messages
by Mike 15 Jul '19

15 Jul '19

Hello, Following on my last question about broken mdboxes, removing dovecot.map.log and force-resync does work. My last problem now however is that after doing this, messages which were 'deleted' previously, come back in the inbox as new messages. I have the original mailboxes and can subscribe to the expunged folders and everything in EXPUNGED/INBOX on the original, is appearing in INBOX on this migrated system. I would want to return everything to EXPUNDED/INBOX so my users don't see old dead resurrected messages. Is there a procedure to identify these? Thanks. Mike-

1 0

Weird response to LIST EXTENDED
by Emil Kalchev 15 Jul '19

15 Jul '19

Hello, I was discussing weird response from Dovecot on Mailkit (this is client IMAP C# library) github page. We concluded that this is a bug in Dovecot server but I wanted to double check with you. Here are the details about the issue https://github.com/jstedfast/MailKit/issues/879 Sent with OfficeSuite Mail for Windows PC www.officesuitenow.com<https://www.officesuitenow.com>

1 0

Authdb NSS module
by Eugene 15 Jul '19

15 Jul '19

Hello! Upgrading manual tells that authdb [NSS module was removed][1] some time ago. [1]: https://wiki2.dovecot.org/Upgrading/2.3#line-100 > userdb nss was removed. Use userdb passwd instead. Can this change be reverted? I'd like to use only libnss_sss.so.2 as dovecot userdb source. It's also essential for me to enable files backend in nsswitch.conf so the system could use local user db. At the same time dovecot must not see local users at all. Authdb NSS module could help me there. The other solution would be to use another instance of nsswitch.conf for dovecot authdb passwd module. Is it possible? Thanks! -- Eugene Bright IT engineer Tel: + 79257289622

3 3

Error: o_stream_send_istream and Disconnected in APPEND
by Alessio Cecchi 15 Jul '19

15 Jul '19

Hi, I'm running some Dovecot servers configured with LVS + Director + Backend + NFS and version 2.2.36.3 (a7d78f5a2). In the last days I see an increased number of these error: Error: o_stream_send_istream(/nfs/mail/company.com/info/Maildir/.Sent/tmp/15627713… failed: Broken pipe always with action "Disconnected in APPEND", when users try to upload a message in Sent or Drafts. Here the logs: Director: Jul 10 14:53:06 imap-login: Info: proxy(info(a)company.com): started proxying to 10.0.0.20:143: user=<info(a)company.com>, method=PLAIN, rip=84.1.2.3, lip=195.1.2.3, lport=993, TLS, session=<eA6XKFONwP1f5Sh4> Jul 10 15:09:56 imap-login: Info: proxy(info(a)company.com): disconnecting 84.1.2.3 (Disconnected by client: EOF(0s idle, in=648413, out=6602)): user=<info(a)company.com>, method=PLAIN, rip=84.1.2.3, lip=195.1.2.3, lport=993, TLS, session=<eA6XKFONwP1f5Sh4> Backend: Jul 10 14:53:06 pop01 dovecot: imap-login: ID sent: x-session-id=eA6XKFONwP1f5Sh4, x-originating-ip=84.1.2.3, x-originating-port=64960, x-connected-ip=195.1.2.3, x-connected-port=993, x-proxy-ttl=4: user=<>, rip=84.1.2.3, lip=195.1.2.3, secured, session=<eA6XKFONwP1f5Sh4> Jul 10 14:53:06 pop01 dovecot: imap-login: Login: user=<info(a)company.com>, method=PLAIN, rip=84.1.2.3, lip=195.1.2.3, mpid=9151, secured, session=<eA6XKFONwP1f5Sh4> Jul 10 14:53:07 pop01 dovecot: imap(info(a)company.com) session=<eA6XKFONwP1f5Sh4>: ID sent: name=Thunderbird, version=60.7.2 Jul 10 15:09:56 pop01 dovecot: imap(info(a)company.com) session=<eA6XKFONwP1f5Sh4>: Error: o_stream_send_istream(/nfs/mail/company.com/info/Maildir/.Sent/tmp/15627713… failed: Broken pipe Jul 10 15:09:57 pop01 dovecot: imap(info(a)company.com) session=<eA6XKFONwP1f5Sh4>: Disconnected in APPEND (1 msgs, 48 secs, 0/2657336 bytes) in=886661 out=26654 del=1 expu=0 trash=0 I can't understand if is a network problem (Firewall? Load Balancer? Switch?) or a users LAN problem. Or others. When this happen user see an error message like "Unable to save email in Sent folder". Any suggestions? Thanks -- Alessio Cecchi Postmaster @ http://www.qboxmail.it https://www.linkedin.com/in/alessice

2 3

Sieve problem with duplicate and fileinto in the same set of rules
by Gianluca Scaglia 15 Jul '19

15 Jul '19

Hi there, on my mail server (postfix, dovecot 2.2.27 in Debian 9) I have an automatic forwarding (with sender_bcc_maps in Postfix) for all the emails sent in smtp from the same server, that are then put in the Sent folder with a sieve rule. In this way, however, when a user sends an e-mail to himself, both copies end up in the Sent folder and it's not good. To resolve, I tried using the Sieve "duplicate" extension along with "fileinto" but I can't get it to work. I then activated also the "editheader" extension to better understand what the problem was and I get these results. Sieve rules without using "fileinto:" require ["duplicate", "editheader"]; if duplicate { addheader "x-sieve-test1" "duplicate"; } if allof (header :regex ["from"] [".*info(a)example\.com"], header :regex ["x-sieve-test1"] [".*duplicate"]) { addheader "x-sieve-test2" "confirm duplicate"; stop; } elsif header :regex ["from"] [".*info(a)example\.com"] { addheader "x-sieve-test3" "not duplicate"; stop; } and I get these headers in the first mail (in INBOX): X-Sieve-Test2: confirm duplicate X-Sieve-Test1: duplicate and in the second email (always in INBOX) this other: X-Sieve-Test3: not duplicate Everything works perfectly. When I add the fileinto statement to the last if as below require ["duplicate", "editheader"]; if duplicate { addheader "x-sieve-test1" "duplicate"; } if allof (header :regex ["from"] [".*info(a)example\.com"], header :regex ["x-sieve-test1"] [".*duplicate"]) { addheader "x-sieve-test2" "confirm duplicate"; stop; } elsif header :regex ["from"] [".*info(a)example\.com"] { addheader "x-sieve-test3" "not duplicate"; fileinto "Sent"; stop; } I get a completely incorrect result, both mails in the Sent folder with this header line: X-Sieve-Test3: not duplicate in practice it no longer detects the duplicate email. If I use "discard" rather than "fileinto" it works fine and if I put "fileinto" in the first "if" ("if duplicate") it does't work. I did hundreds of tests but the "duplicate" extension stops working in the presence of the fileinto statement (there are exceptions: if I put the "fileinto" in the second "if" - that is in the middle one instead of the last one - it works fine, but it's not that that I want). Any idea how to solve the problem or how to get the same result (one mail in Sent folder and one in INBOX, when a user sends an e-mail to himself) without using the "duplicate" extension? Thanks a lot, Luca

2 1

Error since Dovecot v2.3.7
by Paul Hecker 15 Jul '19

15 Jul '19

Hi, since upgrading to Dovecot 2.3.7 I get the following new errors: 2019-07-15 09:10:52 mail dovecot: imap(paul(a)iwascoding.com)<32484><goWh8rKNSNZfqJ9R>: Error: file_lock_free(): Unexpectedly failed to retry locking /var/spool/mail/iwascoding/paul/mdbox/mailboxes/INBOX/dbox-Mails/dovecot-vsize.lock: fcntl(/var/spool/mail/iwascoding/paul/mdbox/mailboxes/INBOX/dbox-Mails/dovecot-vsize.lock, write-lock, F_SETLK) locking failed: No such file or directory It seems that this is related to moving or deleting mails (IMAP). The file at least sometimes exists, the folder exists. You find my doveconf below. Thanks, Paul # 2.3.7 (494d20bdc): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.7 (5a4e63b5) # OS: Linux 4.9.0-9-amd64 x86_64 Debian 9.9 # Hostname: mail.iwascoding.com auth_cache_size = 10 M auth_cache_ttl = 2 hours auth_mechanisms = plain login default_vsz_limit = 1 G first_valid_gid = 8 first_valid_uid = 8 hostname = mail.iwascoding.com imap_capability = +SPECIAL-USE last_valid_gid = 8 last_valid_uid = 8 lda_mailbox_autocreate = yes lda_mailbox_autosubscribe = yes mail_attachment_detection_options = add-flags-on-save mail_attribute_dict = file:/var/mail/iwascoding/%n/dovecot-attributes mail_gid = 8 mail_home = /var/mail/iwascoding/%n mail_location = mdbox:~/mdbox mail_plugins = quota listescape fts fts_xapian mail_prefetch_count = 200 mail_uid = 8 managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext spamtest spamtestplus mdbox_rotate_size = 16 M namespace inbox { inbox = yes location = mailbox "Sent Messages" { auto = no special_use = \Sent } mailbox archive { auto = no special_use = \Archive } mailbox drafts { auto = no special_use = \Drafts } mailbox junk { auto = no special_use = \Junk } mailbox sent { auto = no special_use = \Sent } mailbox trash { auto = no special_use = \Trash } prefix = separator = / } passdb { args = /etc/dovecot/dovecot-sql.conf.ext driver = sql } plugin { fts = xapian fts_autoindex = yes fts_autoindex_exclude = \Junk fts_autoindex_exclude2 = \Trash fts_autoindex_exclude3 = \Drafts fts_enforced = yes fts_xapian = partial=2 full=20 plugin = fts fts_xapian quota = count:User quota quota_grace = 10%% quota_rule = *:storage=200M quota_vsizes = yes recipient_delimiter = + sieve = /var/mail/iwascoding/%n/.dovecot.sieve sieve_default = /var/lib/dovecot/sieve/default.sieve sieve_dir = /var/mail/iwascoding/%n/sieve sieve_extensions = +spamtest +spamtestplus sieve_global_dir = /var/lib/dovecot/sieve/global sieve_spamtest_max_value = 200 sieve_spamtest_status_header = X-Spam-Score-Int sieve_spamtest_status_type = score } postmaster_address = postmaster(a)iwascoding.com protocols = imap pop3 lmtp sieve submission quota_full_tempfail = yes service auth { unix_listener auth-client { mode = 0600 user = Debian-exim } unix_listener auth-userdb { user = mail } vsz_limit = 4 G } service imap-login { inet_listener imap { port = 0 } } service indexer-worker { vsz_limit = 2 G } service lmtp { user = mail } service managesieve-login { inet_listener sieve { port = 4190 } } service pop3-login { inet_listener pop3 { port = 0 } } service stats { unix_listener stats-writer { user = mail } } service submission-login { inet_listener submission_ssl { port = 465 ssl = yes } } ssl = required ssl_alt_cert = </usr/local/acme/var/iwascoding.com/fullchain.cer ssl_alt_key = # hidden, use -P to show it ssl_cert = </usr/local/acme/var/iwascoding.com_ecc/fullchain.cer ssl_cipher_list = ALL:HIGH:!SSLv2:!SSLv3:!kRSA:!MEDIUM:!LOW:!EXP:!RC4:!MD5:!aNULL:!eNULL:!EXPORT:!DES:!3DES:!PSK:!SRP:!DSS:!SEED:@STRENGTH ssl_client_ca_dir = /etc/ssl/certs ssl_client_ca_file = /etc/ssl/certs/ca-certificates.crt ssl_dh = # hidden, use -P to show it ssl_key = # hidden, use -P to show it ssl_min_protocol = TLSv1.2 ssl_prefer_server_ciphers = yes submission_client_workarounds = whitespace-before-path submission_max_mail_size = 50 M submission_relay_host = mail.iwascoding.com submission_relay_port = 10025 submission_relay_ssl = smtps userdb { args = /etc/dovecot/dovecot-sql.conf.ext driver = sql } protocol lmtp { mail_fsync = optimized mail_plugins = quota listescape fts fts_xapian sieve } protocol !indexer-worker { mail_vsize_bg_after_count = 100 } protocol lda { mail_fsync = optimized mail_plugins = quota listescape fts fts_xapian sieve } protocol imap { imap_metadata = yes mail_max_userip_connections = 40 mail_plugins = quota listescape fts fts_xapian imap_quota imap_zlib } protocol pop3 { mail_max_userip_connections = 30 }

2 2

broken mdboxes
by Mike 15 Jul '19

15 Jul '19

Hello, I was forced to do an emergency server migration with about 3000 mailboxes and I botched it somewhat. Hoping to find some help here. My symptoms are, users showing apparently deleted mail messages, some replicated mail, and a time period of mail that is just 'missing'. The source server is centos 6.10 with dovecot 2.2.5, and the destination is ubuntu 16 / dovecot 2.2.22. User mailboxes are mdbox format and I did an rsync from the old to the new. My screw up however was that my rsync was not --delete files, and had to be run multiple times over the course of a few weeks due to to bandwidth disparities and the sheer size of the mail spool approaching 700GB (source server had 10mbps. Should have used sneakernet instead). The bottom line however is that I wound up having many extra m.* files in each user storage dir that were not actually present on the source when the final, final sync was made and I went live with the migration server. I know this is my fsckup but now I have to deal with it. I first tried to fix the symptoms with a force-resync on the boxes not realizing the above, and that seemed to make things worse by only showing new mail as of the server migration date. Ugh. New mail is being delivered and this does appear in user mail boxes. But as I said, there seems to be some users with a problem with old mail presumably deleted on the prior server suddenly re-appearing (probbly due to the extraneous m.* mdbox files present). A more pressing problem is that there is simply a time period of mail that is in user mailboxes (on the old server) from before the migration, which is not displaying now for these users on the new server. I have investigated this and hacked on "mdbox-recover.pl" somewhat so that it iterates over all mdbox files for a user and I can extract ALL messages, and see that, yes, the mail really is present in the mdbox files, but pop/imap never shows it. This is puzzling to me. I have a test user that when I check imap, it shows only 21 message in inbox and 1 in sent. But if I extract the messages from the mdbox files, then I actually have 1117 messages. I know I can't just rsync the source server again with the right --delete flag, there has been lots of mail deliveries to the migrated boxes and so I don't want to lose all of that and create yet more problems. But I need to find some way to make these present mail messages appear for my users again. Im thinking it's got to be a flag of some kind since the data is there it's just ignored. Wondering what you would reccomend? Thanks. Mike-

2 3

Unable to send the mail but able to receive them
by necktwi 14 Jul '19

14 Jul '19

From my mac mail client I've connected to remote exim+dovecot server. Since few weeks back I was not able to send mail but able to receive. exim in /var/log/messages says: Jul 14 15:22:15 RPi3B exim[3576]: 2019-07-14 20:52:15 dovecot_plain authenticator failed for ([xx.xx.xx.xx]) [yy.yy.yy.yy]: 535 Incorrect authentication data (set_id=necktwi) dovecot in /var/log/dovecot.log says: Jul 14 19:40:27 auth: Debug: client in: AUTH 1 LOGIN service=smtp rip=yy.yy.yy.yy lip=xx.xx.xx.xx nologin resp= (previous base64 data may contain sensitive data) Jul 14 19:40:27 auth: Debug: client passdb out: CONT 1 VXNlcm5hbWU6 Jul 14 19:40:27 auth: Debug: auth client connected (pid=0) Jul 14 19:40:27 auth: Debug: client in: AUTH 1 PLAIN service=smtp secured rip=xx.xx.xx.xx lip=yy.yy.yy.yy nologin resp=aeVja333aQeuZWerdHdpAeRecmezaG9lcw== (previous base64 data may contain sensitive data) Jul 14 19:40:27 auth: Debug: policy(necktwi,xx.xx.xx.xx): Policy check action is continue Jul 14 19:40:27 auth-worker(11866): Debug: pam(necktwi,xx.xx.xx.xx): lookup service=smtp Jul 14 19:40:27 auth-worker(11866): Info: pam(necktwi,xx.xx.xx.xx): pam_authenticate() failed: Authentication failure (Password mismatch?) (given password: xxxxxxx) (log is obfuscated) Is it the problem with dovecot or exim? Should exim contact dovecot prior to sending the mail? I have also tried windows mail client with same error. auth-system.conf.ext: passdb { driver = pam args = %s } userdb { driver = passwd args = blocking=no } ... Necktwi

1 0

Sent messages disappear and don't arrive. (Receiving is ok)
by John 14 Jul '19

14 Jul '19

Hi List, I'm running an email server (Postfix, Dovecot, MySQL) on an RPi. I set it up using this 'howto' https://pestmeester.nl/index.html#11.0. It seemed to work but now sent emails just disappear and are not received. Inward emails are ok. I'm a Linux and Postfix Dovecot learner so please treat me as not being very knowledgeable. I'm not even sure if this is a Postfix or Dovecot issue so I've posted to both. (Nothing from Postfix so far!) I've tried to include what relevant info I thought a helper might need but if I've missed something please let me know. I'll appreciate any help. TIA, John

3 2

Purpose of stats-writer and why doveadm try to open it to dump stats ?
by Jean-Daniel 14 Jul '19

14 Jul '19

Hello, I want to monitor dovecot stats, and so I have an exporter process that run with limited rights. The monitoring user has only access to /var/run/dovecot/stats-reader and it works fine. Doveadm stats dump returns the list of all stats as expected. But each time I run doveadm stats dump, it logs the following error: Error: net_connect_unix(/var/run/dovecot/stats-writer) failed: Permission denied So what is the purpose of the stats-writer socket, and why doveadm try to open it to simply dump stats ? Is it really something it needs and I should update my user permissions or is it a doveadm bug ?

2 1

Re: Purpose of stats-writer and why doveadm try to open it to dump stats ?
by Jean-Daniel 14 Jul '19

14 Jul '19

> Le 14 juil. 2019 à 11:58, Reio Remma <reio(a)mrstuudio.ee> a écrit : > > On 14.07.2019 10:10, Jean-Daniel via dovecot wrote: >> Hello, >> >> I want to monitor dovecot stats, and so I have an exporter process that run with limited rights. >> The monitoring user has only access to /var/run/dovecot/stats-reader and it works fine. >> Doveadm stats dump returns the list of all stats as expected. >> >> But each time I run doveadm stats dump, it logs the following error: >> >> Error: net_connect_unix(/var/run/dovecot/stats-writer) failed: Permission denied >> >> So what is the purpose of the stats-writer socket, and why doveadm try to open it to simply dump stats ? >> Is it really something it needs and I should update my user permissions or is it a doveadm bug ? >> > > Hello! > > Depending on the system you're running on, there may be SELinux etc. doing its work. > I know why stats-writer is not accessible, this is on purpose (doveadm run with a uid that explicitly don’t have access to stats-writer). What I want to know is why does doveadm even try to open it to simply dump the stats.

1 0

Getting SSL certificate/key from database
by Yevgeny Kosarzhevsky 14 Jul '19

14 Jul '19

Hello, I am not finding how to read SSL keys/certificates from database. Is this possible? Or only file reads allowed? -- Regards, Yevgeny

2 1

Pigeonhole-0.5.7 fails to build from sources
by Lefteris Tsintjelis 13 Jul '19

13 Jul '19

Latest update fails to build from sources in FreeBSD 12-STABLE --- lda-sieve-plugin.lo --- lda-sieve-plugin.c:82:27: error: variable has incomplete type 'struct smtp_submit_input' struct smtp_submit_input submit_input; ^ lda-sieve-plugin.c:82:9: note: forward declaration of 'struct smtp_submit_input' struct smtp_submit_input submit_input; ^ 1 error generated. *** [lda-sieve-plugin.lo] Error code 1 make[6]: stopped in /usr/ports/mail/dovecot-pigeonhole/work/dovecot-2.3-pigeonhole-0.5.7/src/plugins/lda-sieve --- lda-sieve-log.lo --- mv -f .deps/lda-sieve-log.Tpo .deps/lda-sieve-log.Plo 1 error make[6]: stopped in /usr/ports/mail/dovecot-pigeonhole/work/dovecot-2.3-pigeonhole-0.5.7/src/plugins/lda-sieve *** [all-recursive] Error code 1 make[5]: stopped in /usr/ports/mail/dovecot-pigeonhole/work/dovecot-2.3-pigeonhole-0.5.7/src/plugins 1 error make[5]: stopped in /usr/ports/mail/dovecot-pigeonhole/work/dovecot-2.3-pigeonhole-0.5.7/src/plugins *** [all-recursive] Error code 1 make[4]: stopped in /usr/ports/mail/dovecot-pigeonhole/work/dovecot-2.3-pigeonhole-0.5.7/src 1 error make[4]: stopped in /usr/ports/mail/dovecot-pigeonhole/work/dovecot-2.3-pigeonhole-0.5.7/src *** [all-recursive] Error code 1 make[3]: stopped in /usr/ports/mail/dovecot-pigeonhole/work/dovecot-2.3-pigeonhole-0.5.7 1 error make[3]: stopped in /usr/ports/mail/dovecot-pigeonhole/work/dovecot-2.3-pigeonhole-0.5.7 *** [all] Error code 2 make[2]: stopped in /usr/ports/mail/dovecot-pigeonhole/work/dovecot-2.3-pigeonhole-0.5.7 1 error make[2]: stopped in /usr/ports/mail/dovecot-pigeonhole/work/dovecot-2.3-pigeonhole-0.5.7 ===> Compilation failed unexpectedly. Ensure that dovecot-pigeonhole's GSSAPI backend is the same as dovecot2 (make config). Try to set MAKE_JOBS_UNSAFE=yes and rebuild before reporting the failure to the maintainer. *** Error code 1 Stop. make[1]: stopped in /usr/ports/mail/dovecot-pigeonhole *** Error code 1 Stop. make: stopped in /usr/ports/mail/dovecot-pigeonhole

2 3

Re: Applying Dovecot for a large / deep folder-hierarchy archive - BUG REPORTS!
by Adam D. Barratt 13 Jul '19

13 Jul '19

On Wed, 2019-07-10 at 12:26 +0100, Arnold Opio Oree wrote: > Understood Adam, > > My thinking is that this is a package released with Debian 10. And so > has everything to do with the release. For clarity here - debian-release is neither a support forum nor a discussion list, nor a means of reporting issues in software contained within a Debian release. Debian has support fora and a bug tracking system to handle such reports and issues, as per https://www.debian.org /support . Having a single list that discusses any issue in any piece of software shipped by Debian cannot possibly scale. Rather, this list is the contact point and team alias for the Release Team, who oversee and manage the release process. It is up to individual package maintainers to triage and deal with issues reported against their packages and then to liaise with us if required. Regards, Adam

2 1

Error: file_ostream.net_set_tcp_nodelay
by Lefteris Tsintjelis 13 Jul '19

13 Jul '19

After upgrading to 2.3.7_1 I get those errors every now and then. Running FreeBSD 12-RELEASE. Any idea what they may be? Jul 13 08:07:11 pop3-login: Error: file_ostream.net_set_tcp_nodelay(, FALSE) failed: Connection reset by peer Jul 13 08:19:10 imap-login: Error: file_ostream.net_set_tcp_nodelay(, TRUE) failed: Connection reset by peer Jul 13 08:24:09 imap-login: Error: file_ostream.net_set_tcp_nodelay(, TRUE) failed: Connection reset by peer Jul 13 08:34:53 imap-login: Error: file_ostream.net_set_tcp_nodelay(, TRUE) failed: Connection reset by peer Lefteris

1 0

Pigeonhole release v0.5.7
by Aki Tuomi 12 Jul '19

12 Jul '19

Hi! We are pleased to release Pigeonhole release v0.5.7. Tarball is available at https://pigeonhole.dovecot.org/releases/2.3/dovecot-2.3-pigeonhole-0.5.7.ta… https://pigeonhole.dovecot.org/releases/2.3/dovecot-2.3-pigeonhole-0.5.7.ta… Binary packages are available at https://repo.dovecot.org/ Changes ------- + vacation: Made the subject for the automatic response message produced by the Sieve vacation action configurable. Both the default subject (if the script defines none) and the subject template (e.g. used to add a subject prefix) can be configured. - dsync: dsync-replication does not synchronize Sieve scripts. - imap_sieve_filter: Reduce FILTER=SIEVE verbosity over IMAP connection. - testsuite: Pigeonhole testsuite segfaulted if it was compiled with GCC 9 --- Aki Tuomi Open-Xchange oy

3 4

2.3.7/FreeBSD: Seeing lots of stats-writer errors.
by Larry Rosenman 12 Jul '19

12 Jul '19

A user reported this to me, and I'm seeing it too: Hi all :) After mail/dovecot upgrade to v2.3.7 it seems something went wrong with stat-writer... IMAP and POP3 logs: Jul 12 19:45:34 mail dovecot: imap-login: Error: file_ostream.net_set_tcp_nodelay((conn:unix:/var/run/dovecot/stats-writer), TRUE) failed: Invalid argument Jul 12 19:45:34 mail dovecot: imap-login: Error: file_ostream.net_set_tcp_nodelay((conn:unix:login), TRUE) failed: Invalid argument Jul 12 19:45:35 mail dovecot: imap: Error: file_ostream.net_set_tcp_nodelay((conn:unix:/var/run/dovecot/stats-writer), TRUE) failed: Invalid argument Jul 12 19:45:35 mail dovecot: imap: Error: file_ostream.net_set_tcp_nodelay((conn:unix:/var/run/dovecot/auth-master), TRUE) failed: Invalid argument Jul 12 19:45:35 mail dovecot: imap-login: Login: user=<someone(a)domain.tld>, method=PLAIN, rip=192.168.0.28, lip=192.168.0.1, mpid=47811, TLS, session=<aelAen+NKpDAqAAc> Jul 12 19:45:41 mail dovecot: imap(someone(a)domain.tld)<47811><aelAen+NKpDAqAAc>: Connection closed (UID SEARCH finished 6.727 secs ago) in=128 out=2015 deleted=0 expunged=0 trashed=0 hdr_count=0 hdr_bytes=0 body_count=0 body_bytes=0 Jul 12 19:51:21 mail dovecot: pop3-login: Error: file_ostream.net_set_tcp_nodelay((conn:unix:/var/run/dovecot/stats-writer), TRUE) failed: Invalid argument Jul 12 19:51:21 mail dovecot: auth: Error: file_ostream.net_set_tcp_nodelay((conn:unix:/var/run/dovecot/stats-writer), TRUE) failed: Invalid argument Jul 12 19:51:21 mail dovecot: pop3-login: Error: file_ostream.net_set_tcp_nodelay((conn:unix:login), TRUE) failed: Invalid argument Jul 12 19:51:21 mail dovecot: pop3: Error: file_ostream.net_set_tcp_nodelay((conn:unix:/var/run/dovecot/stats-writer), TRUE) failed: Invalid argument Jul 12 19:51:21 mail dovecot: pop3: Error: file_ostream.net_set_tcp_nodelay((conn:unix:/var/run/dovecot/auth-master), TRUE) failed: Invalid argument Jul 12 19:51:21 mail dovecot: pop3-login: Login: user=<someone(a)domain.tld>, method=PLAIN, rip=192.168.0.33, lip=192.168.0.1, mpid=47877, TLS, session=<h+3jjn+NcPrAqAAh> Jul 12 19:51:21 mail dovecot: pop3(someone(a)domain.tld)<47877><h+3jjn+NcPrAqAAh>: Disconnected: Logged out top=0/0, retr=0/0, del=0/0, size=0 Ideas? -- Larry Rosenman http://www.lerctr.org/~ler Phone: +1 214-642-9640 (c) E-Mail: larryrtx(a)gmail.com US Mail: 5708 Sabbia Dr, Round Rock, TX 78665-2106

2 1

new dovecot, selinux Problem ?
by Günther J. Niederwimmer 12 Jul '19

12 Jul '19

Hello List, after the last update I have a selinux "Problem" with dovecot. My system is a centos 7. After a new start from dovecot selinux block a connection. Jul 12 16:24:24 mx01 systemd: Starting Dovecot IMAP/POP3 email server... Jul 12 16:24:54 mx01 systemd: Started Dovecot IMAP/POP3 email server. Jul 12 16:24:54 mx01 dovecot: Warning: Corrected permissions for login directory /var/run/dovecot/token-login Jul 12 16:24:54 mx01 dbus[3008]: [system] Activating service name='org.fedoraproject.Setroubleshootd' (using servicehelper) Jul 12 16:24:55 mx01 dbus[3008]: [system] Successfully activated service 'org.fedoraproject.Setroubleshootd' Jul 12 16:24:55 mx01 setroubleshoot: SELinux is preventing dovecot from getattr access on the file /proc/sys/fs/suid_dumpable. For complete SELinux messages run: sealert -l c46ae6a7-64c4-49a7-9e3d-477547fb6da8 Jul 12 16:24:55 mx01 python: SELinux is preventing dovecot from getattr access on the file /proc/sys/fs/suid_dumpable.#012#012***** Plugin catchall (100. confidence) suggests **************************#012#012If you believe that dovecot should be allowed getattr access on the suid_dumpable file by default.#012Then you should report this as a bug.#012You can generate a local policy module to allow this access.#012Do#012allow this access for now by executing:#012# ausearch -c 'dovecot' --raw | audit2allow -M my-dovecot#012# semodule -i my-dovecot.pp#012 is this a bad Error? When I install this local Policy i have a Problem with selinux wrong policy. sealert -a /var/log/audit/audit.log 13% donetype=AVC msg=audit(1562936830.462:61868): avc: denied { getattr } for pid=31288 comm="dovecot" path="/proc/sys/fs/suid_dumpable" dev="proc" ino=35734 scontext=system_u:system_r:dovecot_t:s0 tcontext=system_u:object_r:proc_security_t:s0 tclass=file permissive=0 **** Invalid AVC allowed in current policy *** 100% done found 0 alerts in /var/log/audit/audit.log Can any tell / help me for a correct installation? -- mit freundliche Grüßen / best regards, Günther J. Niederwimmer

1 0

[bug] success field never emited in auth_request_finished event
by Jean-Daniel Dupas 12 Jul '19

12 Jul '19

Hi, I'm playing with the new events, and encounter some issues: First the 'auth_request_finished' event is documented as having a 'successful' field, but in the code, the field is defined as 'success' (e->add_str("success", "yes")). But more important, in the function "auth_request_success_continue()" (auth/auth-request.c:288), "auth_request_log_finished(request)" is call (line 303) before updating the request status: "request->successful = TRUE" (line 312) So the log function never set the success field to "yes" as at this point request->successful is still false. Jean-Daniel

2 3

Getting login stats
by Jean-Daniel Dupas 12 Jul '19

12 Jul '19

Hello, I'm trying to get some IMAP auth stats on a Dovecot 2.3.6 instance, but whatever I declare in metric, it always show 0. What I want basically is how many IMAP auth attempts there was on the server, and optional a way to filter on the auth attempt status (successful or failed). My server uses a simple auth (with LDAP backend) and supports only "auth_mechanisms = plain login" I tried using the following metrics: -------------------------------- metric auth_request_finished { event_name = auth_request_finished } metric auth_passdb_request_finished { event_name = auth_passdb_request_finished } metric auth_userdb_request_finished { event_name = auth_userdb_request_finished } metric auth_client_request_started { event_name = auth_client_request_started } metric auth_client_userdb_lookup_started { event_name = auth_client_userdb_lookup_started } metric auth_client_passdb_lookup_started { event_name = auth_client_passdb_lookup_started } metric auth_client_cache_flush_started { event_name = auth_client_cache_flush_started } metric imap_command_finished { event_name = imap_command_finished filter { name = LOGIN } } -------------------------------- But even after many successful logins, doveadm reports 0 for all events: metric_name field count sum min max avg median stddev %95 auth_request_finished duration 0 0 0 0 0.00 0 0.00 0 auth_passdb_request_finished duration 0 0 0 0 0.00 0 0.00 0 auth_userdb_request_finished duration 0 0 0 0 0.00 0 0.00 0 auth_client_request_started duration 0 0 0 0 0.00 0 0.00 0 auth_client_userdb_lookup_started duration 0 0 0 0 0.00 0 0.00 0 auth_client_passdb_lookup_started duration 0 0 0 0 0.00 0 0.00 0 auth_client_cache_flush_started duration 0 0 0 0 0.00 0 0.00 0 imap_command_finished duration 0 0 0 0 0.00 0 0.00 0

2 2

dovecot 2.3.6 on FreeBSD 12.0-RELEASE inside a JAIL does not see dovecot/replication-notify-fifo
by Lars Schotte 12 Jul '19

12 Jul '19

Hi, I see dovecot[47939]: imap(gustik(a)gustik.eu)<48079><XVTMe3qNFpQqAchEJAsZAoGuBtbxcZmK>: Error: open(/var/run/dovecot/replication-notify-fifo) failed: No such file or directory even though, right after: Jul 12 13:54:41 madarka dovecot[47939]: aggregator: Error: Client sent invalid input when I send echo 1 > /var/run/dovecot/replication-notify-fifo and yes, of course prw-rw-rw- 1 dovecot vmail 0B Jul 12 13:57 /var/run/dovecot/replication-notify-fifo exists. FreeBSD madarka.gustik.eu 12.0-RELEASE FreeBSD 12.0-RELEASE r342152 GENERIC amd64 Dovecot running inside a jail with a version of 2.3.6 just recently compiled from ports! I ve allowed raw sockets and sysvipc for this jail but it did not help. Also making explicit imap mail plugins notify and replicator did not help. Any ideas? -- Lars Schotte Mudroňova 13 92101 Piešťany

1 0

Confused about dovecot ACL
by HTMLServices.it 12 Jul '19

12 Jul '19

Hello everyone sorry i'm not very experienced and also my english I installed a centos 7 server with ispconfig postfix dovecot 2.2.36 and roundcube, this server is only a mail archive, so my need is that ALL the mailboxes are read-only on roundcube/imap and any user must NOT delete the messages. ... so I configured dovecot's ALC following the guide "https://wiki2.dovecot.org/ACL" I think I did everything correctly and I don't get errors but entering the webmail roundcube I CAN DELETE MESSAGES ..... it seems that the acl have no effect .... added to the dovecot configuration file /etc/dovecot/dovecot.conf ______________________________________ .... plugin { acl = vfile: / etc / dovecot / dovecot-acl } ..... protocol imap { mail_plugins = $ mail_plugins imap_acl } mail_plugins = acl ..... ______________________________________ created the "global" file /etc/dovecot/dovecot-acl and inserted that the test user has only lookup and reading rights (lr): * user=test(a)test.com lr ______________________________________ my dovecot.conf ********************************* listen = *,[::] protocols = imap pop3 auth_mechanisms = plain login disable_plaintext_auth = no log_timestamp = "%Y-%m-%d %H:%M:%S " mail_privileged_group = vmail ssl_cert = </etc/postfix/smtpd.cert ssl_key = </etc/postfix/smtpd.key ssl_protocols = !SSLv3 passdb { args = /etc/dovecot-sql.conf driver = sql } userdb { driver = prefetch } userdb { args = /etc/dovecot-sql.conf driver = sql } plugin { acl = vfile:/etc/dovecot/dovecot-acl quota = dict:user::file:/var/vmail/%d/%n/.quotausage sieve=/var/vmail/%d/%n/.sieve } service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0660 user = postfix } unix_listener auth-userdb { group = vmail mode = 0600 user = vmail } user = root } service lmtp { unix_listener /var/spool/postfix/private/dovecot-lmtp { group = postfix mode = 0600 user = postfix } } service imap-login { client_limit = 1000 process_limit = 500 } protocol imap { mail_plugins = $mail_plugins imap_acl mail_plugins = quota imap_quota } protocol pop3 { pop3_uidl_format = %08Xu%08Xv mail_plugins = quota } protocol lda { mail_plugins = sieve quota postmaster_address = root@localhost } protocol lmtp { postmaster_address = admin(a)htmlservices.it mail_plugins = quota sieve } mail_plugins = $mail_plugins quota mail_plugins = acl ********************************* my dovecot-acl ********************************* * user=test(a)test.com lr ********************************* "debug" ********************************* [root@archivio ~]# doveadm -Dv acl debug -u test(a)test.com INBOX Debug: Loading modules from directory: /usr/lib64/dovecot Debug: Module loaded: /usr/lib64/dovecot/lib01_acl_plugin.so Debug: Loading modules from directory: /usr/lib64/dovecot/doveadm Debug: Module loaded: /usr/lib64/dovecot/doveadm/lib10_doveadm_acl_plugin.so Debug: Skipping module doveadm_expire_plugin, because dlopen() failed: /usr/lib64/dovecot/doveadm/lib10_doveadm_expire_plugin.so: undefined symbol: expire_set_deinit (this is usually intentional, so just ignore this message) Debug: Skipping module doveadm_quota_plugin, because dlopen() failed: /usr/lib64/dovecot/doveadm/lib10_doveadm_quota_plugin.so: undefined symbol: quota_user_module (this is usually intentional, so just ignore this message) Debug: Module loaded: /usr/lib64/dovecot/doveadm/lib10_doveadm_sieve_plugin.so Debug: Skipping module doveadm_fts_lucene_plugin, because dlopen() failed: /usr/lib64/dovecot/doveadm/lib20_doveadm_fts_lucene_plugin.so: undefined symbol: lucene_index_iter_deinit (this is usually intentional, so just ignore this message) Debug: Skipping module doveadm_fts_plugin, because dlopen() failed: /usr/lib64/dovecot/doveadm/lib20_doveadm_fts_plugin.so: undefined symbol: fts_user_get_language_list (this is usually intentional, so just ignore this message) Debug: Skipping module doveadm_mail_crypt_plugin, because dlopen() failed: /usr/lib64/dovecot/doveadm/libdoveadm_mail_crypt_plugin.so: undefined symbol: mail_crypt_box_get_pvt_digests (this is usually intentional, so just ignore this message) doveadm(test(a)test.com): Debug: Added userdb setting: mail=maildir:/var/vmail/test.com/test/Maildir doveadm(test(a)test.com): Debug: Added userdb setting: plugin/quota_rule=*:storage=0B doveadm(test(a)test.com): Debug: Added userdb setting: plugin/sieve=/var/vmail/test.com/test/.sieve doveadm(test(a)test.com): Debug: Effective uid=5000, gid=5000, home=/var/vmail/test.com/test doveadm(test(a)test.com): Debug: acl: No acl_shared_dict setting - shared mailbox listing is disabled doveadm(test(a)test.com): Debug: maildir++: root=/var/vmail/test.com/test/Maildir, index=, indexpvt=, control=, inbox=/var/vmail/test.com/test/Maildir, alt= doveadm(test(a)test.com): Debug: acl: initializing backend with data: vfile:/etc/dovecot/dovecot-acl doveadm(test(a)test.com): Debug: acl: acl username = test(a)test.com doveadm(test(a)test.com): Debug: acl: owner = 1 doveadm(test(a)test.com): Debug: acl vfile: Global ACL file: /etc/dovecot/dovecot-acl doveadm(test(a)test.com): Info: Mailbox 'INBOX' is in namespace '' doveadm(test(a)test.com): Info: Mailbox path: /var/vmail/test.com/test/Maildir doveadm(test(a)test.com): Info: All message flags are shared across users in mailbox doveadm(test(a)test.com): Debug: Mailbox 'INBOX' matches global ACL pattern '*' doveadm(test(a)test.com): Debug: Mailbox 'INBOX' matches global ACL pattern '*' doveadm(test(a)test.com): Debug: Mailbox 'INBOX' matches global ACL pattern '*' doveadm(test(a)test.com): Debug: acl vfile: file /var/vmail/test.com/test/Maildir/dovecot-acl not found doveadm(test(a)test.com): Info: User test(a)test.com has rights: lookup read doveadm(test(a)test.com): Info: Mailbox in user's private namespace doveadm(test(a)test.com): Info: Mailbox INBOX is visible in LIST [root@archivio ~]# ********************************* if I see the line "Info: User test(a)test.com has rights: lookup read" it seems that the ACL (lookup and read) are correctly applied, but as I was saying above, entering the user test(a)test.com on the webmail, I can do everything I want to also delete the e-mails ..... these are days I try to understand but I don't understand what I'm wrong and how to solve .... thank you all in advance

2 1

Re: Best mail encryption solution for per-user
by Aki Tuomi 12 Jul '19

12 Jul '19

On 27.05.2018 21:16, mail(a)sjemm.net wrote: > May 27, 2018 8:52 AM, "Aki Tuomi" <aki.tuomi(a)dovecot.fi> wrote: >>> On 26 May 2018 at 10:36 mail(a)sjemm.net wrote: >>> >>> May 23, 2018 10:10 AM, mail(a)sjemm.net wrote: >>> May 23, 2018 9:46 AM, "Aki Tuomi" <aki.tuomi(a)dovecot.fi> wrote: >>> >>> On 23.05.2018 10:15, mail(a)sjemm.net wrote: >>> >>> May 23, 2018 8:31 AM, "Aki Tuomi" <aki.tuomi(a)dovecot.fi> wrote: >>> >>> On 23.05.2018 09:13, mail(a)sjemm.net wrote: >>> May 20, 2018 8:01 PM, mail(a)sjemm.net wrote: >>> May 20, 2018 2:47 PM, "Aki Tuomi" <aki.tuomi(a)dovecot.fi> wrote: >>> On 19 May 2018 at 16:40 mail(a)sjemm.net wrote: >>> >>> May 18, 2018 10:01 PM, "Aki Tuomi" <aki.tuomi(a)dovecot.fi> wrote: >>> On 18 May 2018 at 21:44 mail(a)sjemm.net wrote: >>> >>> May 18, 2018 4:43 PM, "Aki Tuomi" <aki.tuomi(a)dovecot.fi> wrote: >>> On 18 May 2018 at 17:38 mail(a)sjemm.net wrote: >>> >>> May 18, 2018 4:05 PM, "Aki Tuomi" <aki.tuomi(a)dovecot.fi> wrote: >>> On 18 May 2018 at 16:43 mail(a)sjemm.net wrote: >>> >>> Hi Tai74 and Aki, >>> I followed your conversation with interest on how to setup per user encryption in dovecot. >>> I have setup my dovecot with the following in a conf file: >>> >>> ============== >>> >>> mail_attribute_dict = file:%h/Maildir/dovecot-attributes >>> mail_plugins = $mail_plugins mail_crypt >>> plugin { >>> >>> mail_crypt_curve = secp521r1 >>> >>> mail_crypt_save_version = 2 >>> >>> } >>> >>> ============== >>> >>> This works nice, all emails are being encrypted and every user/folder has keys. >>> But as I understood from your conversation these keys are not protected. And I want them to be >>> protected by the users password used by imap. >>> >>> Those passwords are stored in a mysql DB file. ( I used a guide from workaround [dot] org to set up >>> the DB and postfix/dovecot) >>> >>> but how would i set it so, that the users password from the DB is used to encrypt the keys? >>> >>> should i use mail_crypt_private_password = ? >>> how do i point it to the mysql db then? >>> im unsure about this >>> >>> Do you have any hints on this? >>> >>> Kind regards, >>> Zjemm >>> >>> The passwords in your MySQL database are, hopefully, not in plaintext. If you want to secure your >>> user's keys using user's login password, you must have a TOOL that manages this. >>> >>> You can use mail_crypt_private_password = %w in (mysql) passdb fields to provide the user's login >>> password as private password. You might want to run it thru some hash, so %{sha1:password} might be >>> a good option. >>> >>> You can change the key password using 'doveadm mailbox cryptokey', this needs to be done every time >>> user changes his password. >>> >>> Also note that if you go down this road, and the user forgets his password, you will not be able to >>> recover the emails without backup copy of the private key. >>> >>> Aki >>> >>> Hi Aki >>> >>> I used the following command: >>> dovecot pw -s SHA256-CRYPT >>> >>> the output on the chosen password looks like: {SHA256-CRYPT}$5$Rokc06a7In4SF3bO$OQpGQWqg........ >>> >>> This output is used to store in the password fields in the database. So no plain text passwords no >>> :) >>> >>> You can use mail_crypt_private_password = %w in (mysql) passdb fields to provide the user's login >>> password as private password. >>> >>> can you explain this a bit more for me? >>> >>> for now i have in the 10-auth.conf file the following: >>> ============== >>> passdb { >>> driver = sql >>> >>> # Path for SQL configuration file, see example-config/dovecot-sql.conf.ext >>> args = /etc/dovecot/dovecot-sql.conf.ext >>> } >>> >>> and: >>> >>> userdb { >>> driver = static >>> args = uid=vmail gid=vmail home=/var/vmail/%d/%n >>> } >>> ============== >>> >>> then i have in dovecot-sql.conf.ext >>> ============== >>> driver = mysql >>> connect = host=x.x.x.x dbname=mailserver user=mailuser password=mailpasswordexample >>> default_pass_scheme = SHA256-CRYPT >>> password_query = SELECT email as user, password FROM virtual_users WHERE email='%u'; >>> ============== >>> Where do i need to set : mail_crypt_private_password = %w ? >>> >>> password as private password. You might want to run it thru some hash, so %{sha1:password} might be >>> a good option. >>> >>> the passwords are allready hashed in the DB using: dovecot pw -s SHA256-CRYPT to genereate the has. >>> so this step isnt nesesary anymore am i right? >>> >>> Thank you for your quick response, very helpfull >>> >>> Zjemm >>> >>> You misunderstood a bit. The idea is to use the *plaintext* password as the password for the >>> private key. Otherwise anyone could just decrypt it by looking at your database where the hashed >>> password is.. >>> >>> So: >>> >>> password_query = SELECT email as user, password, '%w' AS userdb_mail_crypt_private_password FROM >>> virtual_users WHERE email='%u' >>> >>> Aki >>> >>> Hi Aki, >>> >>> Thank you very much for your help, i realy appreciate that. >>> >>> Ok so if i understand it correctly i'll have to use: >>> >>> password_query = SELECT email as user, password, '%w' AS userdb_mail_crypt_private_password FROM >>> virtual_users WHERE email='%u' >>> >>> in my dovecot-sql.conf.ext file >>> >>> This query selects the user, the password, and %w >>> >>> if i run a little query myself: >>> MariaDB [mailserver]> SELECT email as user, password, '%w' AS userdb_mail_crypt_private_password >>> FROM virtual_users; >>> +------------------+----------------------------------+------------------------------------+ >>> | user | password | userdb_mail_crypt_private_password | >>> +------------------+----------------------------------+------------------------------------+ >>> | john(a)example.org | {SHA256-CRYPT}$5$M/GWzmtjsLroRWI | %w | >>> +------------------+----------------------------------+------------------------------------+ >>> >>> %w is a dovecot variable, and stands for the plaintext password, but the password is not stored as >>> plaintext in the DB, %w get filled with the actual plaintext password by dovecot upon the user that >>> is typing in the password when authenticating. >>> >>> is this correct? >>> >>> yes. >>> >>> so then i have the username the hashed password en the plaintext password as a result of the query. >>> >>> yes >>> >>> now userdb_mail_crypt_private_password = the plaintext password >>> do i need to reference it somewhere? or is userdb_mail_crypt_private_password autmatically used by >>> the dovecot mail_crypt plugin to encrypt the keys? or should it be mail_crypt_private_password? >>> >>> It gets injected into the mail process as 'mail_crypt_private_password', as if it was set in plugin >>> {} section. >>> >>> if i have this setup working i'm going to write a blog post on this topic to share this knowledge >>> >>> Thanks again and have a great weekend. >>> >>> Zjemm >>> >>> Aki >>> >>> Hi Aki, >>> >>> Cool i'm testing it right now. >>> I have set up a new mailserver (life is great with lxc containers :) ) >>> >>> postfix and dovecot are working like normal >>> >>> next i enable mail_crypt >>> >>> i did create a file: /etc/dovecot/conf.d/10-mailcrypt.conf >>> ========================== >>> mail_attribute_dict = file:%h/Maildir/dovecot-attributes >>> >>> mail_plugins = $mail_plugins mail_crypt >>> >>> plugin { >>> mail_crypt_curve = secp521r1 >>> mail_crypt_save_version = 2 >>> } >>> ========================== >>> >>> and then i changed the file: /etc/dovecot/dovecot-sql.conf.ext >>> >>> so the query is now the new query: >>> password_query = SELECT email as user, password, '%w' AS userdb_mail_crypt_private_password FROM >>> virtual_users WHERE email='%u'; >>> >>> then i restarted dovecot and postfix and send a test email to the one and only testuser that is in >>> there. >>> >>> when i open the mailbox with the tool mutt, i can see the new email, and when openening the email >>> the mutt client drops the connection. >>> >>> in the log i can see: >>> >>> May 19 13:34:48 mailserver1.example.local dovecot[600]: imap-login: Login: user=<john(a)example.org>, >>> method=PLAIN, rip=::1, lip=::1, mpid=713, TLS, session=<E3PnIY9sNM4AAAAAAAAAAAAAAAAAAAAB> >>> May 19 13:34:49 mailserver1.example.local dovecot[600]: imap(john(a)example.org): Error: read() >>> failed: >>> read(/var/vmail/example.org/john/Maildir/cur/1526736378.M161472P641.mailser…, >>> =571:2,) failed: Private key not available: Cannot decrypt key >>> bfc5bb25b1bf64290eea6dc14b516c6a0a25b64551b6e4f0f8677ba7274887cb: error:03070068:bignum >>> routines:BN_mpi2bn:encoding error (FETCH BODY[] for mailbox INBOX UID 8) >>> >>> i think i missed a step, but witch one? >>> >>> the userpassword hasnt been changed (that would be the next step in the testing process) >>> >>> should i've use doveadm first to encrypt the key with that userpassword? i thought it would do that >>> on the fly, because the initial keys where only just created when enabling the mail_crypt plugin >>> >>> please let me know your thougts >>> Zjemm >>> I noticed you replied directly to me, and not to the list, too... fixed that for you. >>> >>> mail_crypt_private_password is used when key is created, but if you have created it before using >>> password, you'll need to encrypt it before turning the setting on. >>> >>> Aki >>> Hi, Ok i'm sorry about that, thank you for fixing that. i'm a bit new to mailing lists :) >>> >>> are you a dovecot devoloper? or a enthusiastic user? >>> >>> anyway, i managed to get it working now with all your help :) >>> >>> to start fresh i did a: >>> rm -rf /var/vmail/example.org >>> >>> so all email is gone, and i assume all dovecot keys are gone that way. >>> >>> Then i tried to set a password first: >>> >>> root@mailserver1:/var/vmail# doveadm mailbox cryptokey password -u john(a)example.org -n summersun >>> result: Changed password for 0 key(s) >>> >>> (summersun = the password for this user) >>> >>> but then it says there are 0 keys, so then i send the test user an email and try to open the >>> mailbox, i'll get: >>> >>> imap(john(a)example.org): Error: read() failed: >>> read(/var/vmail/example.org/john/Maildir/cur/1526827992.M149712P883.mailser…, >>> =561:2,) failed: Private key not available: Cannot decrypt key >>> 71849013a70b0c631c06112077e7c2fe39b0b2737b4933b219793841209d4e7f: error:03070068:bignum >>> routines:BN_mpi2bn:encoding error >>> >>> but hey, now the key's are created, so i tried to set the password again: >>> >>> root@mailserver1:/var/vmail# doveadm mailbox cryptokey password -u john(a)example.org -n summersun >>> result: dcrypt_key_load_private(787701bd677dd69a26842547a3926cbaa625b0b5a91751f06678c3e9708343d9) >>> failed: password missing >>> ========= >>> >>> Lets start over again, i did a new: >>> rm -rf /var/vmail/example.org >>> >>> i disabled the mail_crypt_private_password in the sql query and send an email to the test user. >>> now again new keys are generated. >>> >>> then i did set the password via doveadm: >>> >>> root@mailserver1:/var/vmail# doveadm mailbox cryptokey password -u john(a)example.org -n summersun >>> result: Changed password for 1 key(s) >>> >>> i enabled the mail_crypt_private_password again in the sql query part and now it works :) >>> >>> YESSS!!! >>> >>> if i now change the password for the user, i cannot read the email anymore. that is what should >>> happen. >>> so now i changed the password for this user also with doveadm: >>> - doveadm mailbox cryptokey password -u john(a)example.org -n qwerty -o summersun >>> >>> and now i'm able to read the emails again. so it all works now as expected. >>> >>> i have now only one thing remaining. >>> >>> when i want to add a new user, i have to somehow: >>> - create the new user in the mysql DB >>> - start with dovecot not using mail_crypt_private_password (so disabled) >>> - send an initial email to let the users mailbox be created and generate the keys >>> - set the users password with doveadm >>> - restart dovecot again with mail_crypt_private_password (so enabled) >>> >>> but this would be disruptive to existing users, and i would have to script the whole thing as a >>> "add-new-user" script to make it usable i guess. >>> >>> do you know of a more easy way of acomplishing this? >>> could i use doveadm for all steps, and get around the mail_crypt_private_password disable part? >>> >>> or could i add a column in the mysql db called userdb_mail_crypt_private_password and fill that >>> column with %w for users that allready exist, and empty for new users. >>> when being empty, it might not set the mail_crypt_private_password for new users >>> >>> or is this the wrong way of thinking? >>> >>> let me know your thoughts on this. >>> >>> And last but not least, i really want to thank you for all your help. It is a really nice >>> experience. >>> Bless you! >>> >>> Zjemm >>> Hi Aki, >>> >>> You did fix the posting on the mail archive, i can see our conversation on there, all but the last >>> email i send to you. >>> Maybe you did not received the last email? >>> >>> would you be willing to take a look at my last question in the email See below: >>> Thank you very much. >>> >>> ================================ >>> i have now only one thing remaining. >>> >>> when i want to add a new user, i have to somehow: >>> - create the new user in the mysql DB >>> - start with dovecot not using mail_crypt_private_password (so disabled) >>> - send an initial email to let the users mailbox be created and generate the keys >>> - set the users password with doveadm >>> - restart dovecot again with mail_crypt_private_password (so enabled) >>> >>> but this would be disruptive to existing users, and i would have to script the whole thing as a >>> "add-new-user" script to make it usable i guess. >>> >>> do you know of a more easy way of acomplishing this? >>> could i use doveadm for all steps, and get around the mail_crypt_private_password disable part? >>> >>> or could i add a column in the mysql db called userdb_mail_crypt_private_password and fill that >>> column with %w for users that allready exist, and empty for new users. >>> when being empty, it might not set the mail_crypt_private_password for new users >>> >>> or is this the wrong way of thinking? >>> >>> let me know your thoughts on this. >>> >>> And last but not least, i really want to thank you for all your help. It is a really nice >>> experience. >>> Bless you! >>> >>> Zjemm >>> >>> If you have mail_crypt_private_password set *when* keys are generated, >>> dovecot should use that password to encrypt the user key. >>> >>> Aki >>> Hi Aki, >>> >>> well, if there is a new email user setup in the mysql DB, and no email has been send to that new >>> user. at that point there are no keys. >>> >>> So trying to set a password on those key's wont work. see: >>> root@mailserver1:/var/vmail/example.org# doveadm mailbox cryptokey password -u john2(a)example.org -n >>> qwerty >>> result: Changed password for 0 key(s) >>> >>> the keys need to be generated first. And that only happens when sending a mail to that new user. >>> Also, at the point of creating the keys, the mail_crypt_private_password should be disabled >>> otherwise the keys are generated and also encrypted with no user password, and then im unable to >>> set a new pasword for that key >>> >>> How can i set the password before the keys are generated? >>> or can i manually generate key's and then set the password? >>> >>> so at this point i have to do the following: >>> >>> You can use doveadm mailbox cryptokey generate -u user -U >>> >>> to generate a user key. >>> >>> Aki >>> >>> - create the new user in the mysql DB >>> - start with dovecot not using mail_crypt_private_password (so disabled) >>> - send an initial email to let the users mailbox be created and generate the keys >>> - set the users password with doveadm >>> - restart dovecot again with mail_crypt_private_password (so enabled) >>> can i somehow enable the mail_crypt_private_password per user? >>> because this mysql query always returns: %w >>> and thus allways sets: userdb_mail_crypt_private_password >>> SELECT email as user, password, '%w' AS userdb_mail_crypt_private_password FROM virtual_users; >>> >>> Hi Aki, >>> >>> You are correct >>> >>> doveadm mailbox cryptokey generate -u user -U generates the keys, but i have to first remove: >>> '%w' AS userdb_mail_crypt_private_password >>> from dovecot configuration and restart dovecot. >>> >>> if i don't do that, the keys are generated, but also somehow encrypted using: no >>> password/empty/something else (i don't know) >>> >>> here you can see that happening: >>> >>> root@mailserver1:/var/vmail/example.org# doveadm mailbox cryptokey generate -u john2(a)example.org -U >>> Folder Public ID >>> ✓ <userkey> 53004acf9886f887ca081c83d7392a5aa3fac4b5a20ce013db91a341fb4644c4 >>> root@mailserver1:/var/vmail/example.org# doveadm mailbox cryptokey password -u john2(a)example.org -n >>> qwerty >>> result: dcrypt_key_load_private(53004acf9886f887ca081c83d7392a5aa3fac4b5a20ce013db91a341fb4644c4) >>> failed: password missing >>> >>> it expects an old password wich is never set in my opinion. >>> >>> so the last part of this setup would be to figure out a way to disable '%w' AS >>> userdb_mail_crypt_private_password for new users without manually removing that part from the query >>> and restarting dovecot. As that would mean connection interruption while adding new users >>> >>> if we could add new users to the DB and somehow not give '%w' AS userdb_mail_crypt_private_password >>> for that new user in the query, we can add the password afterward, and then enable '%w' AS >>> userdb_mail_crypt_private_password in the query for this user >>> >>> could we add a column in the user db lets say called: encrypted (yes/no) >>> >>> and then change the existing query: SELECT email as user, password, '%w' AS >>> userdb_mail_crypt_private_password FROM virtual_users; >>> >>> to firrt check if encryption is set to 'yes', if so retrun: >>> SELECT email as user, password, '%w' AS userdb_mail_crypt_private_password FROM virtual_users; >>> >>> if not return: >>> SELECT email as user, password FROM virtual_users; >>> >>> but then in one mysql query so dovecot can work with it >>> >>> ? >>> >>> Hi Aki, >>> >>> would you be willing to respond to my last question i had send to you last week? >>> its this one: >>> ================================== >>> doveadm mailbox cryptokey generate -u user -U generates the keys, but i have to first remove: >>> '%w' AS userdb_mail_crypt_private_password >>> from dovecot configuration and restart dovecot. >>> >>> if i don't do that, the keys are generated, but also somehow encrypted using: no >>> password/empty/something else (i don't know) >>> >>> here you can see that happening: >>> >>> root@mailserver1:/var/vmail/example.org# doveadm mailbox cryptokey generate -u john2(a)example.org -U >>> Folder Public ID >>> ✓ <userkey> 53004acf9886f887ca081c83d7392a5aa3fac4b5a20ce013db91a341fb4644c4 >>> root@mailserver1:/var/vmail/example.org# doveadm mailbox cryptokey password -u john2(a)example.org -n >>> qwerty >>> result: dcrypt_key_load_private(53004acf9886f887ca081c83d7392a5aa3fac4b5a20ce013db91a341fb4644c4) >>> failed: password missing >>> >>> it expects an old password wich is never set in my opinion. >>> >>> could this be a bug? or am i doing it wrong? if needed i could send in a bug report? >>> >>> or might we need to enable the userdb_mail_crypt_private_password "per user" ? >>> >>> so the last part of this setup would be to figure out a way to disable '%w' AS >>> userdb_mail_crypt_private_password for new users without manually removing that part from the query >>> and restarting dovecot. As that would mean connection interruption while adding new users >>> >>> if we could add new users to the DB and somehow not give '%w' AS userdb_mail_crypt_private_password >>> for that new user in the query, we can add the password afterward, and then enable '%w' AS >>> userdb_mail_crypt_private_password in the query for this user >>> >>> could we add a column in the user db lets say called: encrypted (yes/no) >>> >>> and then change the existing query: SELECT email as user, password, '%w' AS >>> userdb_mail_crypt_private_password FROM virtual_users; >>> >>> to firrt check if encryption is set to 'yes', if so retrun: >>> SELECT email as user, password, '%w' AS userdb_mail_crypt_private_password FROM virtual_users; >>> >>> if not return: >>> SELECT email as user, password FROM virtual_users; >>> >>> but then in one mysql query so dovecot can work with it >>> >>> Please let me know your thougts, after this last thing im done :) >>> also let me know if i can support this project in some way, im willing to contribute >>> >>> Zjemm >> You can select it as userdb_mail_crypt_save_version=0 to disable encryption (it won't disable >> decryption). You can use value '2' for enabling encryption. DO NOT USE 1. >> >> Also I tried the SQL based thing, and if you had EMPTY mail_crypt_private_password, try these to >> change the password. If the one that works is the second one, let me know =) >> >> doveadm mailbox cryptokey password -u testuser -nnewpass -o "" >> >> doveadm mailbox cryptokey password -u testuser -nnewpass -o "yes" >> >> Aki > Hi Aki, > > Thanks for replying > > So if i understand you correctly i could enable encryption per user by using: userdb_mail_crypt_save_version= in the database as an extra column. the column would be called "userdb_mail_crypt_save_version" and the value is "0" or "2" > > if a user has: userdb_mail_crypt_save_version=0, encryption is disabled for that user > if a user has: userdb_mail_crypt_save_version=2, encryption is enabled for that user > > would this also override the setting: mail_crypt_save_version = 2 > in the mailcryp.conf file where that is a global setting? or should i delete it there and only use userdb_mail_crypt_save_version= from the database? > > for the password set command i hve testest some things: > > new user with no keys yet: > doveadm -o plugin/mail_crypt_private_password=password mailbox cryptokey generate -u john2(a)example.org -U > > i can set a password with: > new password: > doveadm mailbox cryptokey password -u john2(a)example.org -n newpass -o password > > > if i do not use new user doveadm: (doveadm -o plugin/mail_crypt_private_password=password mailbox cryptokey generate -u john2(a)example.org -U) > then use this: > doveadm mailbox cryptokey password -u john2(a)example.org -n newpass -o "yes" > > > so yes it is the second one > > Kind regards, > > Zjemm It's unfortunate problem with 2.2 that it defaults empty userdb variables into yes. This has been remedied in 2.3. Unfortunately there is no clean fix to this, they all resort to various levels of trickery. Variables set in passdb/userdb overwrite the ones in plugin {} section. Aki

2 2

Connection statistics per user and IP
by Lefteris Tsintjelis 11 Jul '19

11 Jul '19

Is it possible to enable statistics and keep track of the maximum number of connections per user and also per IP? Lefteris

3 2

Frequent Out of Memory for service(config)
by Root Kev 11 Jul '19

11 Jul '19

Hello Group, We have dovecot deployed as solely a Pop3 service that is used by our applications to pass mail from one application to another internally. We have roughly 4 applications that connect to the Pop3 service every 2 seconds, to check for new messages and pop them for processing if they are present. Depending on the site, we have between 1024-2048MB of memory set for default_vsz_limit. In all systems we see the Out of memory alert several times a day. We previously did not see this at all when running on CentOS6, with less memory. We have tried increasing the memory to the vsz_limit up to 2gb without success. We are running on CentOS 7 servers, running dovecot 2.3.6 (7eab80676) (from the dovecot repo). Can anyone advise any other settings that could be modified in order to correct these out of memory issues? # dovecot -n # 2.3.6 (7eab80676): /etc/dovecot/dovecot.conf # OS: Linux 3.10.0-957.5.1.el7.x86_64 x86_64 CentOS Linux release 7.6.1810 (Core) # Hostname: ****** #<modified for security> auth_cache_size = 10 M auth_verbose = yes default_vsz_limit = 1 G instance_name = Pop3 Mail Service listen = 10.*.*.* #<modified for security> log_path = /var/log/dovecot.log login_greeting = Pop3 Mail Service login_trusted_networks = 10.*.*.* 10.*.*.* 10.*.*.* 10.*.*.* 10.*.*.* #<modified for security> mail_location = maildir:~/Maildir namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } passdb { args = cache_key=#hidden_use-P_to_show# driver = pam } protocols = pop3 ssl_cert = </etc/pki/dovecot/certs/dovecot.pem ssl_key = # hidden, use -P to show it userdb { driver = passwd } verbose_ssl = yes May 10 06:44:05 config: Fatal: pool_system_malloc(8192): Out of memory May 10 06:44:05 config: Fatal: master: service(config): child 27887 returned error 83 (Out of memory (service config { vsz_limit=1024 MB }, you may need to increase it) - set CORE_OUTOFMEM=1 environment to get core dump) May 10 14:56:31 config: Fatal: pool_system_malloc(8192): Out of memory May 10 14:56:31 config: Fatal: master: service(config): child 2495 returned error 83 (Out of memory (service config { vsz_limit=1024 MB }, you may need to increase it) - set CORE_OUTOFMEM=1 environment to get core dump) May 10 23:09:02 config: Fatal: pool_system_malloc(8192): Out of memory May 10 23:09:02 config: Fatal: master: service(config): child 10581 returned error 83 (Out of memory (service config { vsz_limit=1024 MB }, you may need to increase it) - set CORE_OUTOFMEM=1 environment to get core dump) May 11 10:18:43 config: Fatal: pool_system_malloc(8192): Out of memory May 11 10:18:43 config: Fatal: master: service(config): child 30511 returned error 83 (Out of memory (service config { vsz_limit=1024 MB }, you may need to increase it) - set CORE_OUTOFMEM=1 environment to get core dump) May 11 18:30:59 config: Fatal: pool_system_malloc(1608): Out of memory May 11 18:30:59 config: Fatal: master: service(config): child 12134 returned error 83 (Out of memory (service config { vsz_limit=1024 MB }, you may need to increase it) - set CORE_OUTOFMEM=1 environment to get core dump) May 12 02:57:28 config: Fatal: pool_system_malloc(8192): Out of memory May 12 02:57:28 config: Fatal: master: service(config): child 24940 returned error 83 (Out of memory (service config { vsz_limit=1024 MB }, you may need to increase it) - set CORE_OUTOFMEM=1 environment to get core dump) May 12 11:07:34 config: Fatal: pool_system_malloc(8192): Out of memory May 12 11:07:35 config: Fatal: master: service(config): child 8203 returned error 83 (Out of memory (service config { vsz_limit=1024 MB }, you may need to increase it) - set CORE_OUTOFMEM=1 environment to get core dump) May 12 19:17:52 config: Fatal: pool_system_malloc(8192): Out of memory May 12 19:17:52 config: Fatal: master: service(config): child 14623 returned error 83 (Out of memory (service config { vsz_limit=1024 MB }, you may need to increase it) - set CORE_OUTOFMEM=1 environment to get core dump) May 13 03:26:34 config: Fatal: pool_system_malloc(8192): Out of memory May 13 03:26:35 config: Fatal: master: service(config): child 21479 returned error 83 (Out of memory (service config { vsz_limit=1024 MB }, you may need to increase it) - set CORE_OUTOFMEM=1 environment to get core dump) May 13 11:35:42 config: Fatal: pool_system_malloc(8192): Out of memory May 13 11:35:43 config: Fatal: master: service(config): child 26900 returned error 83 (Out of memory (service config { vsz_limit=1024 MB }, you may need to increase it) - set CORE_OUTOFMEM=1 environment to get core dump) May 13 19:34:26 config: Fatal: pool_system_malloc(8192): Out of memory May 13 19:34:26 config: Fatal: master: service(config): child 32187 returned error 83 (Out of memory (service config { vsz_limit=1024 MB }, you may need to increase it) - set CORE_OUTOFMEM=1 environment to get core dump). Thanks, Kevin

4 6

Re: Segfault of doveconf
by Claudio Prono 11 Jul '19

11 Jul '19

On 9.7.2019 13.40, Aki Tuomi via dovecot wrote: On 9.7.2019 12.54, Claudio Prono wrote: On 4.7.2019 19.00, Claudio Prono via dovecot wrote: Sorry to bother again, but the problem persist. I have checked all the configurations of dovecot, and seems all ok, but randomly the segfault pops up again, without no apparently reason. My packages are: ii dovecot-core 1:2.2.22-1ubuntu2.10 amd64 secure POP3/IMAP server - core files ii dovecot-imapd 1:2.2.22-1ubuntu2.10 amd64 secure POP3/IMAP server - IMAP daemon ii dovecot-managesieved 1:2.2.22-1ubuntu2.10 amd64 secure POP3/IMAP server - ManageSieve server ii dovecot-mysql 1:2.2.22-1ubuntu2.10 amd64 secure POP3/IMAP server - MySQL support ii dovecot-pop3d 1:2.2.22-1ubuntu2.10 amd64 secure POP3/IMAP server - POP3 daemon ii dovecot-sieve 1:2.2.22-1ubuntu2.10 amd64 secure POP3/IMAP server - Sieve filters support Can be a temporarly solution to uninstall dovecot-managesieved ? Cordially, Claudio. On 5.7.2019 09:59 Aki via dovecot wrote: You should install dovecot-dbg, and follow https://www.dovecot.org/bugreport-mail, then we could figure out why it's crashing in the first place. Aki I have followed the instructions to debug the problem, and I have uploaded the crash log at this location: https://justpaste.it/5wlot Yesterday the system have got some I/O Errors on the hard disk (virtual system hosted from Seeweb). The problems on the disk now are solved by the provider, and the crash reported is before that. So, now my question is: the doveconf crash can be linked to the hardware problem ? Or something else? Thanks for your help. Cordially, Claudio Prono. I tried unpacking the crash file you pastebin, can you please send it as attachment to me? Aki It seems you are at least missing postmaster_address in your config. I was not able to actually make dovecot crash when I tested, so can you try adding this setting and see if it helps? Aki On 9.7.2019 09:59 Claudio Prono via dovecot wrote: I have added it to the configuration, and restarted dovecot. Now I wait and see if this error again. Thank you for your time. Cheers, Claudio. ---- Just a rapid update, the problem of the segmentation fault of doveconf was not occourred again in the past two days. I think the problem was somehow related to the hardware failure on the virtual disk where the system is hosted. Now, the hardware problem is resolved from the virtual system maintainer, and doveconf has stopped to crash. Anyway, thanks for the support. Claudio.

1 0

Dovecot 2.3.6 on Solaris10: build issues, segfaults
by Joseph Tam 10 Jul '19

10 Jul '19

Hopefully, there is some fix for issue 3 which is beyond my skill to fix. Issue 1) Need recent gcc version Building Dovecot versions <=2.2.x using gcc 3.4.4 worked, but this gcc version fails to build 2.3.x properly: symptoms include compile failures and executable crashes that depended on the amount of optimization used, which is usually a sign of compiler bugs. (It could also be issue 3 in disguise.) Either way, I updated to gcc 9.1.0. Issue 2) Cannot build with --enable-hardening Using gcc 9.1.0, "configure" step fails because fd passing was broken, but the real problem was a compilation failure when "--enable-hardening" is used. Demonstration: # echo 'int main(){char a[1]; strcpy(a,a);} ' | gcc -w -fstack-protector-strong -x c - Undefined first referenced symbol in file __stack_chk_guard /var/tmp//cc12L9zV.o (symbol scope specifies local binding) ld: fatal: symbol referencing errors. No output written to a.out collect2: error: ld returned 1 exit status I'm not sure if this is a Solaris10 fumble, but configuring "--disable-hardening" removes the "-fstack-protector-strong" compiler option, which resolves this issue. Issue 3) dovecot/doveconf segfaults on startup It crashes here while processing dovecot.conf, as does "doveconf" (settings-parser.c:1519 in setting_copy()) *dest_size = *src_size; It appears *src_size is not an 8-byte address aligned (0x5597c). It inherits this value from the calling routine as the sum of "set" (8-byte aligned) + "def->offset"=20 => misaligned address. (settings-parser.c:1597 in settings_dup_full()) src = CONST_PTR_OFFSET(set, def->offset); (gdb) p set $2 = (const void *) 0x55968 (gdb) p *def $3 = {type = SET_SIZE, key = 0x2d548 "submission_max_mail_size", offset = 20, list_info = 0x0} (gdb) bt full #0 0xff190690 in setting_copy (type=SET_SIZE, src=0x5798c, dest=0xf7ed4, pool=0xf29a0, keep_values=false) at settings-parser.c:1519 src_size = 0x5798c dest_size = 0xf7ed4 __func__ = "setting_copy" #1 0xff190bc4 in settings_dup_full (info=0x2d9ac <submission_setting_parser_info>, set=0x57978, pool=0xf29a0, keep_values=false) at settings-parser.c:1600 def = 0x2d7d4 <submission_setting_defines+80> src = 0x5798c dest_set = 0xf7ec0 dest = 0xf7ed4 children = 0x2c i = 1105688 count = 4279837964 #2 0xff192724 in settings_parser_dup (old_ctx=0x9ec08, new_pool=0xf29a0) at settings-parser.c:1946 new_ctx = 0x10def0 iter = 0x0 links = {_table = 0xa23c0, _key = 0xa23c0, _keyp = 0xa23c0, _const_key = 0xa23c0, _value = 0xa23c0, _valuep = 0xa23c0} new_link = 0x10b488 value = 0x0 key = 0x0 i = 0 parser_pool = 0x10ded8 keep_values = false __func__ = "settings_parser_dup" #3 0x0001fc0c in config_filter_parsers_get (ctx=0x657a8, pool=0xf29a0, modules=0x0, filter=0x583e8, parsers_r=0xffbff9c4, output_r=0xffbff9bc, error_r=0xffbffa44) at config-filter.c:372 src = 0xf29d8 dest = 0xf2a48 error = 0x0 error_p = 0x52cfc i = 26 count = 33 __func__ = "config_filter_parsers_get" #4 0x00021be4 in config_all_parsers_check (ctx=0xffbffac8, new_filter=0x657a8, error_r=0xffbffa44) at config-parser.c:441 parsers = 0x58180 tmp_parsers = 0x4 output = {specific_services = 0xf2a20, service_uses_local = false, service_uses_remote = false, used_local = false, used_remote = false, permission_denied = false} i = 0 count = 3 ssl_set = 0x4 <error: Cannot access memory at address 0x4> global_ssl_set = 0x32188 "" tmp_pool = 0xf29a0 ssl_warned = false ret = 0 __func__ = "config_all_parsers_check" #5 0x00022ec8 in config_parse_finish (ctx=0xffbffac8, error_r=0xffbffb98) at config-parser.c:747 new_filter = 0x657a8 error = 0x33c22 "/user=%s" ret = 0 #6 0x00024230 in config_parse_file (path=0x50468 "/local/dovecot/etc/dovecot/dovecot.conf", expand_values=false, modules=0x0, error_r=0xffbffb98) at config-parser.c:1064 root = {prev = 0x0, input = 0x0, path = 0x50468 "/local/dovecot/etc/dovecot/dovecot.conf", linenum = 400} ctx = {pool = 0x52b58, path = 0x50468 "/local/dovecot/etc/dovecot/dovecot.conf", , all_parsers = {arr = {buffer = 0x58160, element_size = 4}, v = 0x58160, v_modifiable = 0x58160}, root_parsers = 0x52b70, cur_section = 0x58388, cur_input = 0x0, str = 0x58458, pathlen = 0, section_counter = 6, error = 0x0, old = 0x58580, seen_settings = {_table = 0x0, _key = 0x0, _keyp = 0x0, _const_key = 0x0, _value = 0x0, _valuep = 0x0}, filter = 0x0, expand_values = false, hide_errors = false} i = 33 count = 33 key = 0x0 value = 0x0 full_line = 0x0 type = CONFIG_LINE_TYPE_SKIP line = 0x0 fd = -1 ret = 0 handled = false #7 0x000188dc in main (argc=1, argv=0xffbffc94) at doveconf.c:979 master_service_flags = (MASTER_SERVICE_FLAG_STANDALONE | MASTER_SERVICE_FLAG_NO_INIT_DATASTACK_FRAME | MASTER_SERVICE_FLAG_DONT_SEND_STATS) scope = CONFIG_DUMP_SCOPE_ALL orig_config_path = 0x46300 "/local/dovecot/etc/dovecot/dovecot.conf" config_path = 0x50468 "/local/dovecot/etc/dovecot/dovecot.conf" module = 0x1c00 <error: Cannot access memory at address 0x1c00> module_names = {arr = {buffer = 0x46338, element_size = 4}, v = 0x46338, v_modifiable = 0x46338} filter = {service = 0x0, local_name = 0x0, local_host = 0x0, remote_host = 0x0, local_net = {family = 0, u = {ip6 = {_S6_un = {_S6_u8 = '\000' <repeats 15 times>, _S6_u32 = {0, 0, 0, 0}, __S6_align = 0}}, ip4 = {S_un = {S_un_b = { s_b1 = 0 '\000', s_b2 = 0 '\000', s_b3 = 0 '\000', s_b4 = 0 '\000'}, S_un_w = { s_w1 = 0, s_w2 = 0}, S_addr = 0}}}}, remote_net = {family = 0, u = {ip6 = { _S6_un = {_S6_u8 = '\000' <repeats 15 times>, _S6_u32 = {0, 0, 0, 0}, __S6_align = 0}}, ip4 = {S_un = {S_un_b = {s_b1 = 0 '\000', s_b2 = 0 '\000', s_b3 = 0 '\000', s_b4 = 0 '\000'}, S_un_w = {s_w1 = 0, s_w2 = 0}, S_addr = 0}}}}, local_bits = 0, remote_bits = 0} wanted_modules = 0x0 error = 0xfef47940 <_uberdata> "" exec_args = 0x0 setting_name_filters = 0x0 i = 5 c = -1 ret = -4195172 ret2 = 4 config_path_specified = false expand_vars = false hide_key = false parse_full_config = false simple_output = false dump_defaults = false host_verify = false print_plugin_banner = true hide_passwords = true Joseph Tam <jtam.home(a)gmail.com>

4 6

Dovecot behind Load Balancer
by Paolo Daniele 10 Jul '19

10 Jul '19

Hi, i've a question for you. I've two dovecot imap/pop server behind a zen load balancer. Load balancing is made by lx4nat so the public ip address of my load balancer contact directly the dovecot servers. Since few months i've a message from thunderbird that i've reached the imap limit login for ip. I've triend to increase the max user ip parameter but sometimes i've the same problem. It's a strange things that actually i'm able to mitigate by reduce the number of cached connections in Thunderbird but it's not normal. What do you think about that? Maybe there's some tuning that you can suggest. Thank you, Paolo

5 10

solr
by Maciej Milaszewski IQ PL 10 Jul '19

10 Jul '19

Hi I have set up SOLR in accordance with documentation and it runs well. I use solr like: ....... fts = solr fts_solr = debug url=http://IP:8983/solr/ (solr in external machine) ...... Is replication of this system really essential ?? Due to my tests, rollback of the solr server on external machine lasts less than minute and it is nearly non-visible from client side. On the other hand solr replication is quite complicated process and rollback or master-slave switch in this case is non-trivial task, that may have result in whole dataset inconsistency. Do you have any experience in such cases ? Maby load-balance in HAProxy colud do the thing ? Something like: ......... server search1 192.168.1.1:8983 check port 8983 inter 20s fastinter 2 server search2 192.168.1.2:8983 backup ......... Best Regards

2 1

Some questions
by Jérôme Bardot 10 Jul '19

10 Jul '19

Hello, This is my first email here. I want to understand well how dovecot is integrate with ldap in a postfix/dovecot/ldap setup. I use a debian server. More specifically what dovecot need in ldap to work. I saw we can use several "mode" related to virtual domain, etc. For "start" i only need one domain with several address. I currently use fusiondirectory for manage my ldap users. i guess i can use that schema to auto create users email (name.firstname(a)domain.tld for ie) ? I also want to setup some aliases and share directory based on ldap group/role can i do it ? An other question is can we have two domain name for imap.domain.tld && smtp.domain.tld ? IF some questions are out of topic let me know. thx jerome

4 3

Re: Applying Dovecot for a large / deep folder-hierarchy archive - BUG REPORTS!
by Arnold Opio Oree 10 Jul '19

10 Jul '19

Hello Timo, I have scheduled some time to carry through the test requested by Aki. I will add responding to you as part of that process. Not sure if I have said or done anything to offend you, as your tone appears quite abrasive, even where you do not have an actual response to an observation. It is my view that it is a privilege to provide an open source platform, and therefore a responsibility wherever feasible not only to properly maintain and support it, but also to properly document it; both of which from my experience and findings to date, Dovecot have failed to do. Kind regards, Arnold Opio Oree Chief Executive Officer Parallax Digital Technologies arnoldoree(a)parallaxdt.com http://www.parallaxdt.com tel : +44 (0) 333 577 8587 fax : +44 (0) 20 8711 2477 Parallax Digital Technologies is a trading name of Parallax Global Limited. U.K. Co. No. 08836288 The contents of this e-mail are confidential. If you are not the intended recipient you are to delete this e-mail immediately, disregard its contents and disclose them to no other persons. -----Original Message----- From: Timo Sirainen via dovecot <dovecot(a)dovecot.org> Reply-To: Timo Sirainen <timo(a)sirainen.com> To: Arnold Opio Oree <arnold.oree(a)parallaxict.com> Cc: Dovecot Mailing List <dovecot(a)dovecot.org> Subject: Re: Applying Dovecot for a large / deep folder-hierarchy archive - BUG REPORTS! Date: Wed, 10 Jul 2019 11:09:57 +0300 On 7 Jul 2019, at 18.12, Arnold Opio Oree via dovecot < dovecot(a)dovecot.org> wrote: > > Dovecot Team, > > > > I'd like to report a number of bugs, that are to my view all > > critical. It would help to get your doveconf -n, example command lines causing the problems and the error messages it outputs or what the wrong behavior looks like in filesystem. It's now rather difficult to guess what exactly you tried and what happened. Also what kind of output does readpst make? I'm not sure why you're using DIRNAMEs here. > > doveadm-sync -1/general > > > > 1) If DIRNAMEs are not different between command line and > > mail_location doveadm sync will fail, saying that the source and > > destination directories are the same This sounds very strange. I'm not sure what exactly you did, and I couldn't reproduce with a small test. > > 2) The -n / -N flags do not work, and a sync will fail strangely if > > location is specified in the namespace definition Again, sounds strange. > > 3) Adds mbox to path name under mailbox directory (where syncing > from > > an mbox source) Probably with different parameters you could avoid it. > > 4) Not having the mailboxes at source named the same as those at > > destination causes errors and partial sync > > > > 5) Not having the target mailboxes formatted to receive the sync > > (/<mailboxroot>/DIRNAME/) will cause sync errors. I don't understand these. Target mailboxes are supposed to be empty initially, and after the initial sync they should be in the expected format. Why would they be different? > > doveadm-sync > > > > 1) With large synchronizations UIDs are corrupted where multiple > > syncs are executed and the program can no longer synchronize What exactly is the error message? > > dovecot > > > > 1) Panics and fails to expand ~ to user home: observed cases are > > where multiple namespaces are being used Panic message and more details would also help. > > With regards to the last error that I requested help on i.e. > > \Noselect. This has been resolved more-or-less by the workarounds > > that I have implemented for the bugs reported above. > > > > I have seen a number of threads whilst researching the \Noselect > > issue where people have been very confused. My finding was that > > \Noselect is a function of the IMAP specification server-side > > implementation RFC3501 ( > > https://tools.ietf.org/html/rfc3501#section-6.3.6) And for me the > > server was returning directories with \Noselect because the > mailboxes > > were malformed on account of dovadm-sync errors. In order to fix > this > > I formed a bash command to transverse the mailbox hierarchy and > > create the missing folders critical to the sdbox format, namely > > DIRNAME. Nowadays we have also an option to disable creation of \Noselect folders, because they confuse people. Using mail_location = ...:NO- NOSELECT - It won't affect existing folders immediately though. -----Original Message----- From: Arnold Opio Oree <arnoldoree(a)parallaxict.com> Reply-To: arnoldoree(a)parallaxict.com To: Aki Tuomi <aki.tuomi(a)open-xchange.com>, Dovecot Mailing List < dovecot(a)dovecot.org> Cc: debian-release(a)lists.debian.org Subject: Re: Applying Dovecot for a large / deep folder-hierarchy archive - BUG REPORTS! Date: Mon, 08 Jul 2019 13:21:51 +0100 Hello Aki, Thanks for looking into these. I will as requested attempt the relevant procedures under Dovecot 2.3.6. To make the test fair, I will need to fork the relevant production groupware stack (which is now stable and in operation, with our enterprise (email) data successfully migrated from Microsoft Exchange) to a new staging server; given that the current staging server is now of a materially different configuration to the production server (where the most controlled observations of these bugs were made). Kindly give me some time, as I have an urgent internal openstack deployment project to kick-off, that has been delayed by an overrun of this internal groupware stack deployment project. Best regards, Arnold Opio Oree Chief Executive Officer Parallax Digital Technologies arnoldoree(a)parallaxdt.com http://www.parallaxdt.com tel : +44 (0) 333 577 8587 fax : +44 (0) 20 8711 2477 Parallax Digital Technologies is a trading name of Parallax Global Limited. U.K. Co. No. 08836288 The contents of this e-mail are confidential. If you are not the intended recipient you are to delete this e-mail immediately, disregard its contents and disclose them to no other persons. -----Original Message----- From: Aki Tuomi via dovecot < dovecot(a)dovecot.org > Reply-To: Aki Tuomi < aki.tuomi(a)open-xchange.com > To: arnoldoree(a)parallaxict.com , Arnold Opio Oree < arnold.oree(a)parallaxict.com >, Arnold Opio Oree via dovecot < dovecot(a)dovecot.org > Cc: debian-release(a)lists.debian.org Subject: Re: Applying Dovecot for a large / deep folder-hierarchy archive - BUG REPORTS! Date: Mon, 8 Jul 2019 08:48:08 +0300 (EEST) Hi! Thank you for reporting these. We will look into them. In the mean time, can you see if any of these are fixed in 2.3.6? Aki > On 07/07/2019 18:12 Arnold Opio Oree via dovecot < > dovecot(a)dovecot.org > > > wrote: > > > Dovecot Team, > > I'd like to report a number of bugs, that are to my view all > critical. > > System: Replicated on multiple Debian 10 (Buster) systems > Dovecot Version(s): 2.3.4.1 > > doveadm-sync -1/general > > 1) If DIRNAMEs are not different between command line and > mail_location doveadm sync will fail, saying that the source and > destination directories are the same > > 2) The -n / -N flags do not work, and a sync will fail strangely if > location is specified in the namespace definition > > 3) Adds mbox to path name under mailbox directory (where syncing from > an mbox source) > > 4) Not having the mailboxes at source named the same as those at > destination causes errors and partial sync > > 5) Not having the target mailboxes formatted to receive the sync > (/<mailboxroot>/DIRNAME/) will cause sync errors. > > doveadm-sync > > 1) With large synchronizations UIDs are corrupted where multiple > syncs are executed and the program can no longer synchronize > > dovecot > > 1) Panics and fails to expand ~ to user home: observed cases are > where multiple namespaces are being used > > Please let me know if you need me to elaborate or to provide any > further information that you may need to replicate the bugs, or if I > can help in any other way. > > With regards to the last error that I requested help on i.e. > \Noselect. This has been resolved more-or-less by the workarounds > that I have implemented for the bugs reported above. > > I have seen a number of threads whilst researching the \Noselect > issue where people have been very confused. My finding was that > \Noselect is a function of the IMAP specification server-side > implementation RFC3501 ( > https://tools.ietf.org/html/rfc3501#section-6.3.6 > ). And for me the > server was returning directories with \Noselect because the mailboxes > were malformed on account of dovadm-sync errors. In order to fix this > I formed a bash command to transverse the mailbox hierarchy and > create the missing folders critical to the sdbox format, namely > DIRNAME. > > Kind regards, > > Arnold Opio Oree > Chief Executive Officer > Parallax Digital Technologies > > arnoldoree(a)parallaxdt.com > > > http://www.parallaxdt.com > > > tel : +44 (0) 333 577 8587 > fax : +44 (0) 20 8711 2477 > > Parallax Digital Technologies is a trading name of Parallax Global > Limited. U.K. Co. No. 08836288 > > The contents of this e-mail are confidential. If you are not the > intended recipient you are to delete this e-mail immediately, > disregard its contents and disclose them to no other persons. > > -----Original Message----- > From: Arnold Opio Oree via dovecot < > dovecot(a)dovecot.org > > > Reply-To: > arnoldoree(a)parallaxict.com > , Arnold Opio Oree < > arnold.oree(a)parallaxict.com > > > To: > dovecot(a)dovecot.org > > Cc: > rs(a)sys4.de > , > aki.tuomi(a)open-xchange.com > > Subject: Re: Applying Dovecot for a large / deep folder-hierarchy > archive. > Date: Thu, 04 Jul 2019 14:52:28 +0100 > > > Hi all, > > The guidance provided so far has been really helpful, and has helped > a great deal to bringing down wasted energy on finding and executing > a viable path. I am now at the final due action to complete our > Dovecot application to our use-case, but am stuck on an issue that I > cannot find any easily accessible documentation on. > > Generally this is what has been done: > > 1. Uploaded the enterprise data PST to the target groupware server. > 2. Prepared the server by changing the mailbox format to sdbox and > the the Dovecot mail location to > mail_location=/var/vmail/domain/user/mail/ > 3. Converted the pst (on-server) to a recursive mbox hierarchy using > readpst > 4. Executed doveadm-sync to convert mbox hierarchy data into sdbox > and to copy it into the enterprise archive user's mailboxes > 4.i. The biggest issue I faced at this point was doveadm-sync saying > that the source and destination pointed to the same location, whereas > they clearly did not. > 4.i.a. I resolved this by removing the location= setting from the > target namespace, and allowing it to default to mail_location = > setting, and then using a completely different DIRNAME for the import > doveadm-sync execution (which was the desired final DIRNAME); I then > once the sync had been successful, changed the mail_location DIRNAME > so that it pointed to the imported mail DIRNAME; and hence the > imported email data was in the live mailboxes > 4.i.b. doveadm-import failed several times, and was throwing quite > inexplicable errors, so I moved onto doveadm-sync > 4.i.c. I also had to make sure that the source and destination folder > names matched, otherwise doveadm-syc threw very many errors and only > partially imported the data > 4.i.d. An issue which I decided just to live with is that an mbox > DIRNAME was added to each mailbox as well as the DIRNAME specified so > the path to mail is mbox/dbox-Mails. My thought is that with the data > live on an IMAP server it will be possible to do a dysync through TCP > to correct this problem. > > The final issue that I am facing now, is that when readpst finds > empty folders in the source pst hierarchy, it does not create an mbox > file in the mbox hierarchy folder space. This causes doveadm-sync to > not create the target data required for its mailbox structure i.e. > DIRNAME sub-folder and index file (with our configuration). At this > point either doveadm-sync or the dovecot process makes these empty > folders not selectable. > > The question now is how would I go about making all of these folders > selectable, e.g. with an internal or external command line tool to > change flags / create necessary sdbox mailbox constituent data? > > Many thanks, > > Arnold Opio Oree > Chief Executive Officer > Parallax Digital Technologies > > arnoldoree(a)parallaxdt.com > > > http://www.parallaxdt.com > > > tel : +44 (0) 333 577 8587 > fax : +44 (0) 20 8711 2477 > > Parallax Digital Technologies is a trading name of Parallax Global > Limited. U.K. Co. No. 08836288 > > The contents of this e-mail are confidential. If you are not the > intended recipient you are to delete this e-mail immediately, > disregard its contents and disclose them to no other persons. > > -----Original Message----- > From: Arnold Opio Oree via dovecot < > dovecot(a)dovecot.org > > > Reply-To: > arnoldoree(a)parallaxict.com > , Arnold Opio Oree < > arnold.oree(a)parallaxict.com > > > To: Robert Schetterer < > rs(a)sys4.de > >, > dovecot(a)dovecot.org > > Subject: Re: Applying Dovecot for a large / deep folder-hierarchy > archive. > Date: Thu, 27 Jun 2019 12:05:35 +0100 > > > Also you may run into client limits.... i ve seen this with > > outlook, > > apple mail, thunderbird via imap in the past > > Thanks for this note Robert, it was not really an aspect that I was > considering. > > We are operating our groupware services user access through both > Evolution Groupware and KDE Kontact / KMail on Debian Linux > workstations. Hopefully if there is a client issue it should be local > to only one groupware client. > > I will be sure to study / investigate in this - client - area should > any issues that are not traceable to the server-side arise. > > Many thanks, > > Arnold Opio Oree > Chief Executive Officer > Parallax Digital Technologies > > arnoldoree(a)parallaxdt.com > > > > http://www.parallaxdt.com > > > > tel : +44 (0) 333 577 8587 > fax : +44 (0) 20 8711 2477 > > Parallax Digital Technologies is a trading name of Parallax Global > Limited. U.K. Co. No. 08836288 > > The contents of this e-mail are confidential. If you are not the > intended recipient you are to delete this e-mail immediately, > disregard > its contents and disclose them to no other persons. > > > -----Original Message----- > From: Robert Schetterer via dovecot < > dovecot(a)dovecot.org > > > Reply-To: Robert Schetterer < > rs(a)sys4.de > > > To: > dovecot(a)dovecot.org > > > Subject: Re: Applying Dovecot for a large / deep folder-hierarchy > archive. > Date: Thu, 27 Jun 2019 12:53:49 +0200 > > Am 27.06.2019 um 07:35 schrieb Aki Tuomi via dovecot: > > On 26.6.2019 22.12, Arnold Opio Oree via dovecot wrote: > > > Hello to you all, > > > > > > I'd like to ask about my intended application of Dovecot to > > > create > > > a folder-hierarchy for storing our enterprise emails, which are > > > treated as live data rather than archives for compliance or > > > occasional / reactive retrieval. > > > > > > The data is presently not that large (a few gigabytes), but it is > > > expected to grow rapidly. Up to this stage the data has been > > > contained > > > in a Microsoft Exchange mailbox (2013), and then in an offline > > > PST. > > > The move to the offline PST was by necessity, as the large number > > > of > > > folders, and depth of hierarchy to my best understanding caused > > > the > > > exchange server / outlook / evolution mail clients to begin to > > > malfunction. To cope with this the archive was broken up and the > > > bulk stored in the offline PST and the most active components > > > stored in > > > online Exchange mailboxes. > > > > > > I have some understanding of the fs mbox format, and also the > > > mitigations to be made for certain characters / strings. My main > > > concern is whether Dovecot is likely to be able to cope well with > > > a > > > large number of folders / depth of hierarcy. > > > > > > I will really appreciate any help / advice you can give. > > > > > > Best regards, > > > > > > Arnold Opio Oree > > > > > > > Hi! > > > > Dovecot 2.2.34/2.3 supports unlimited folder depth, the only > > limiting > > factor is that the total name may not exceed 4096 bytes. Also > > individual > > folder names may not exceed 255 bytes. > > > > Prior to that the limit is 255 per folder up to 16 levels. > > > > I can't recommend using 'mbox' storage format, please consider > > using > > maildir or sdbox instead. > > > > Aki > > > > > > > > > > --- Aki Tuomi

2 2

Re: Applying Dovecot for a large / deep folder-hierarchy archive - BUG REPORTS!
by Adam D. Barratt 10 Jul '19

10 Jul '19

On 2019-07-10 12:01, Arnold Opio Oree wrote: Please stop CCing this thread to the Debian Release Management mailing list. If there are issues with the Dovecot packages in Debian then they should be reported as bugs against the packages. Thanks. Adam (Debian Release Team member)

2 1

Error: last_login_dict: Failed to write value: dict-server returned failure: sql dict: commit failed: Field 'password' doesn't have a default value
by Lefteris Tsintjelis 10 Jul '19

10 Jul '19

Hi, after upgrading my database I kept on getting those errors. It seems like later versions of databases have strict mode enabled by default and it must either be disabled or change the dovecot database schema. Besides the password, would anyone know what other fields must be changed to the dovecot schema and have a default value? Is there any other dovecot schema for strict mode? Lefteris

1 0

Applying Dovecot for a large / deep folder-hierarchy archive.
by Arnold Opio Oree 10 Jul '19

10 Jul '19

Hello to you all, I'd like to ask about my intended application of Dovecot to create a folder-hierarchy for storing our enterprise emails, which are treated as live data rather than archives for compliance or occasional / reactive retrieval. The data is presently not that large (a few gigabytes), but it is expected to grow rapidly. Up to this stage the data has been containedin a Microsoft Exchange mailbox (2013), and then in an offline PST. The move to the offline PST was by necessity, as the large number offolders, and depth of hierarchy to my best understanding caused the exchange server / outlook / evolution mail clients to begin tomalfunction. To cope with this the archive was broken up and the bulk stored in the offline PST and the most active components stored inonline Exchange mailboxes. I have some understanding of the fs mbox format, and also the mitigations to be made for certain characters / strings. My main concern is whether Dovecot is likely to be able to cope well with a large number of folders / depth of hierarcy. I will really appreciate any help / advice you can give. Best regards, Arnold Opio OreeChief Executive OfficerParallax Digital Technologies arnoldoree(a)parallaxdt.com http://www.parallaxdt.com tel : +44 (0) 333 577 8587fax : +44 (0) 20 8711 2477 Parallax Digital Technologies78A Hatfeild MeadLondonSM4 5PF Parallax Digital Technologies is a trading name of Parallax GlobalLimited. U.K. Co. No. 08836288 The contents of this e-mail are confidential. If you are not theintended recipient you are to delete this e-mail immediately, disregardits contents and disclose them to no other persons.

5 11

10-ssl.conf
by Nicholas Chua 10 Jul '19

10 Jul '19

Hi, I am having an error, doveconf: Fatal: Error in configuration file /usr/local/dovecot/etc/dovecot/conf.d/10-ssl.conf line 6: Unknown setting: service { ssl I am on dovecot 2.3.6. My 10-ssl.conf as follows https://pastebin.com/sYXsmm5b Any idea what went wrong? Thanks nic

2 1

Segfault of doveconf
by Claudio Prono 09 Jul '19

09 Jul '19

Hi, I have some problems of segfault at doveconf: Jul 2 08:13:16 mail kernel: [1415540.297823] doveconf[7103]: segfault at 560cb801e000 ip 00007f861da742d0 sp 00007ffe2d671548 error 6 in libc-2.23.so[7f861d9e5000+1c0000] Jul 2 15:45:38 mail kernel: [1442682.919193] doveconf[11915]: segfault at 563b32420000 ip 00007fcb127ae2d0 sp 00007ffecfc7b598 error 6 in libc-2.23.so[7fcb1271f000+1c0000] Jul 2 20:27:37 mail kernel: [1459601.781407] doveconf[14680]: segfault at 55618f01b000 ip 00007f44137202d0 sp 00007ffcbb8d8628 error 6 in libc-2.23.so[7f4413691000+1c0000] Jul 2 21:35:36 mail kernel: [1463680.435538] doveconf[15090]: segfault at 55ea7521d000 ip 00007f0bfe79f2d0 sp 00007ffd272793b8 error 6 in libc-2.23.so[7f0bfe710000+1c0000] Jul 3 00:44:28 mail kernel: [1475013.132492] doveconf[16253]: segfault at 561feea20000 ip 00007f34be2be2d0 sp 00007ffe731ef4b8 error 6 in libc-2.23.so[7f34be22f000+1c0000] System configuration follows: lsb_release -d Description: Ubuntu 16.04.6 LTS doveconf -n # 2.2.22 (fe789d2): /etc/dovecot/dovecot.conf # Pigeonhole version 0.4.13 (7b14904) # OS: Linux 4.4.0-45-generic x86_64 Ubuntu 16.04.6 LTS disable_plaintext_auth = no first_valid_gid = 8 first_valid_uid = 150 last_valid_gid = 8 last_valid_uid = 150 mail_location = mbox:~/mail:INBOX=/var/mail/%u managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = INBOX. } passdb { args = /etc/dovecot/dovecot-sql.conf.ext driver = sql } plugin { quota_warning = storage=95%% quota-warning 95 %u quota_warning2 = storage=80%% quota-warning 80 %u sieve = /var/vmail/%d/%u/.dovecot.sieve sieve_dir = /var/vmail/%d/%u/sieve sieve_global_dir = /var/lib/dovecot/sieve/ sieve_storage = /var/vmail/%d/%u/sieve } protocols = " imap sieve pop3" service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0660 user = postfix } unix_listener auth-userdb { group = mail mode = 0600 user = vmail } } service quota-warning { executable = script /usr/bin/quota-warning.sh unix_listener quota-warning { user = vmail } user = dovecot } ssl_ca = </etc/ssl/certs/SecureTrust_CA_mauri2.pem ssl_cert = </etc/ssl/certs/dovecot6.pem ssl_cipher_list = TLSv1+HIGH:!SSLv2:!RC4:!aNULL:!eNULL:!3DES:!IDEA:!SEED ssl_key = </etc/ssl/private/dovecot3.pem ssl_prefer_server_ciphers = yes userdb { args = /etc/dovecot/dovecot-sql.conf.ext driver = sql } protocol lda { mail_plugins = " sieve" } protocol pop3 { pop3_uidl_format = %Mf } dovecot --version 2.2.22 (fe789d2) apt-get update Hit:1 http://ubuntu.seeweb.it/ubuntu xenial InRelease Hit:2 http://ubuntu.seeweb.it/ubuntu xenial-updates InRelease Hit:3 http://ubuntu.seeweb.it/ubuntu xenial-backports InRelease Get:4 http://ubuntu.seeweb.it/ubuntu-security xenial-security InRelease [109 kB] Fetched 109 kB in 1s (99.1 kB/s) Reading package lists... Done apt-get upgrade Reading package lists... Done Building dependency tree Reading state information... Done Calculating upgrade... Done 0 upgraded, 0 newly installed, 0 to remove and 0 not upgraded. apt-get dist-upgrade Reading package lists... Done Building dependency tree Reading state information... Done Calculating upgrade... Done 0 upgraded, 0 newly installed, 0 to remove and 0 not upgraded. Any hint about it ? Sometimes, from my webmail I receive an error communicating with server, but no other errors. Cordially, Claudio Prono. -- ---------------------------------------------------------------------------- Claudio Prono OPST System Developer @Mediaservice.net Srl Tel: +39-011-07.49.338 Via Santorelli, 15 Fax: +39-011-32.46.497 10095 Grugliasco (TO) http://mediaservice.net/disclaimer ITALY ---------------------------------------------------------------------------- PGP Key - http://keys.mediaservice.net/c_prono.asc

2 7

Orphaned processes after doveadm log reopen
by Tom Sommer 09 Jul '19

09 Jul '19

I rotate logs every night on my Director, running "doveadm log reopen" I've noticed a problem with processes not closing correctly, they can be open for days and cause corrupt index files because they are connected to different backends (so it writes to the wrong server when the process disconnects) 23518 ? S 140:53 dovecot/anvil [4 connections] 23519 ? S 444:45 dovecot/log 23520 ? S 497:19 dovecot/imap-login [8 pre-login + 27 proxies] 23531 ? S 0:27 dovecot/config 26201 ? S 551:53 dovecot/imap-login [7 pre-login + 33 proxies] 22126 ? S 960:15 dovecot/pop3-login [28 pre-login + 396 proxies] 59515 ? S 218:32 dovecot/pop3-login [44 pre-login + 468 proxies] Is there any way to force these orphaned processes to terminate after a certain time? -- Tom

2 4