- dovecot - dovecot.org

Convert Maildir to Dbox?
by David Mehler 29 May '19

29 May '19

Hello, I've got a Dovecot 2.3.x setup. Currently it's running Maildir storage. I'd like to convert that to Dbox specifically Sdbox safely. I'm also looking to at the same time or shortly thereafter encrypt the email storage with mail_crypt. Any help appreciated. Thanks. Dave.

6 8

Changes in sieve Dovecot 2.2
by Gter Marcelo 29 May '19

29 May '19

Hi People, I'm use dovecot in my mailbox system, until last month i used the dovecot version 2.0 and now i use version 2.2, version 2.2 works well for me, but i have one small problem, in sieve. In version 2.0 i had rules in sieve similiar to rule bellow: if allof (true){ keep; fileinto "INBOX"; redirect "xxxxxx"xxxxxx.com.br"; stop; } In the new version 2.2 this rules above, i have one problem duplicate messages in account from my clients, in paste INBOX, therefore, i changed rule to bellow ( with remove fileinto inbox) if allof (true){ keep; redirect "xxxxxx"xxxxxx.com.br"; stop; } Dovecot really changed your behavor, i did right to fix this ? Thanks a Lot, Marcelo

2 1

JMAP support in Dovecot
by Andrew Jones 29 May '19

29 May '19

Hi there, I understand there were discussions to try and develop JMAP support for Dovecot. Is this still in the pipeline for Dovecot 2.5? Regards Andrew Sent from my iPhone

10 18

mail_max_userip_connections
by hfh＠cndns.com 29 May '19

29 May '19

mail_max_userip_connections Can I set up an ip whitelist list, and the ip in this whitelist is unrestricted? thanks!!! hfh(a)cndns.com

2 1

Dict issue with PostgreSQL for last_login plugin (duplicate key)
by mabi 29 May '19

29 May '19

Hello, I am trying to setup the last_login plugin on Dovecot 2.3 in order to log a user's last IMAP login into a separate PostgreSQL table called last_login. I am actually following that guide: https://docs.iredmail.org/track.user.last.login.html with the exception that I use PostgreSQL instead of MySQL. So far it works at least for the very first login of a user but it looks like Dict always want to add a new record into my last_login table instead of updating the existing record for a specific user. Here is the error message from Dovecot: May 19 12:45:14-mbox1 dovecot: imap(user(a)domain.tld)<51915><if6KTzuJMZ25D+Vc>: Error: last_login_dict: Failed to write value: dict-server returned failure: sql dict: commit failed: ERROR: duplicate key value violates unique constraint "last_logins_pkey" It looks like Dict with PostgreSQL does not support UPDATEing an already existing record in the table. Or am I missing something? or it does not work with PostgreSQL? Which does not make much sense to me... Regards, Mabi

5 22

SIGABRT on fetching mail
by Peter Nabbefeld 29 May '19

29 May '19

Hello, I've never used gdb, so I don't know why I'm running into problems using "gdb bt". Usually, I'm fetching my mail using "sudo -E getmail", but this doesn't seem to work with backtrace. :-/ Output from "dovecot -n" attached. Kind regards, Peter

2 1

imap userdb Fatal setuid errors
by Steven Smith 28 May '19

28 May '19

I’m trying to configure dovecot lmtp in multi-user mode. My error logs are filled with messages saying that an imap process cannot do a setuid to another user: > May 21 22:28:46 imap(pid 17441 user myuser): Fatal: setuid(512(myuser) from userdb lookup) failed with euid=501(adminuser): Operation not permitted (This binary should probably be called with process user set to 512(myuser) instead of 501(adminuser)) I see that others have had similar issues, but I am not able to apply any of the fixes or workarounds to solve this issue (e.g. setting libexec/dovecot/imap as setuid-root). I’ve also tried other fixes like setting the permissions to 0777 on the userdb auth for postfix smtpd. According to the code (restrict-access.c, linked below), it appears that when a user authenticates, an imap worker process is launched that has the bid of the authenticator. When another user authenticates, this last process is used, but it does not have the permissions to perform a setuid to the new user, resulting in the Fatal error that appears in the logs. Is this a bug, or a configuration issue? I’ve posted my doveconf below. Any pointers would be greatly appreciated. Steve Related: https://serverfault.com/questions/930245/dovecot-operation-not-permitted <https://serverfault.com/questions/930245/dovecot-operation-not-permitted> https://dovecot.org/list/dovecot/2012-May/135549.html <https://dovecot.org/list/dovecot/2012-May/135549.html> https://trac.macports.org/ticket/58506 <https://trac.macports.org/ticket/58506> Code at https://github.com/dovecot/core/blob/master/src/lib/restrict-access.c <https://github.com/dovecot/core/blob/master/src/lib/restrict-access.c>: https://github.com/dovecot/core/blob/863887d4272f962926ab279ac4cf37855dd200… <https://github.com/dovecot/core/blob/863887d4272f962926ab279ac4cf37855dd200…> https://github.com/dovecot/core/blob/863887d4272f962926ab279ac4cf37855dd200… <https://github.com/dovecot/core/blob/863887d4272f962926ab279ac4cf37855dd200…> doveconf -n: > # 2.3.0.1 (ffd8a29): /opt/local/etc/dovecot/dovecot.conf > # Pigeonhole version 0.5.0.1 (d33dca20) > # OS: Darwin 18.6.0 x86_64 apfs > auth_cache_size = 10 M > auth_gssapi_hostname = $ALL > auth_krb5_keytab = /opt/local/etc/dovecot/imap.keytab > auth_mechanisms = plain gssapi > auth_realms = host.domain.tld > auth_socket_path = /opt/local/var/run/dovecot/auth-userdb > auth_username_format = %Ln > debug_log_path = /opt/local/var/log/mail/mail-debug.log > default_internal_user = _dovecot > default_login_user = _dovenull > disable_plaintext_auth = no > first_valid_gid = 6 > first_valid_uid = 6 > imap_id_log = * > imap_id_send = "name" * "version" * > imap_idle_notify_interval = 29 mins > imap_urlauth_submit_user = submit > info_log_path = /opt/local/var/log/mail/mail-info.log > last_valid_gid = 100 > lda_mailbox_autocreate = yes > log_path = /opt/local/var/log/mail/mail-err.log > login_log_format_elements = user=<%u> method=%m rip=%r lip=%l mpid=%e %c > mail_access_groups = mail > mail_attachment_dir = /private/var/mail/tld.domain.mail/attachments > mail_attachment_fs = sis posix:mode=0666 > mail_debug = yes > mail_gid = mail > mail_home = /private/var/mail/tld.domain.mail > mail_location = mdbox:/private/var/mail/tld.domain.mail/%Ln/mdbox > mail_log_prefix = "%s(pid %p user %u): " > mail_plugins = quota zlib acl fts fts_solr fts_lucene > mail_privileged_group = mail > mail_uid = _dovecot > managesieve_notify_capability = mailto > managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext imapsieve vnd.dovecot.imapsieve > mdbox_rotate_size = 200 M > namespace inbox { > inbox = yes > location = > mailbox Archive { > auto = subscribe > special_use = \Archive > } > mailbox Drafts { > auto = subscribe > special_use = \Drafts > } > mailbox Junk { > auto = create > special_use = \Junk > } > mailbox Notspam_train { > auto = create > special_use = \Junk > } > mailbox Sent { > auto = subscribe > special_use = \Sent > } > mailbox Spam_train { > auto = create > special_use = \Junk > } > mailbox Trash { > auto = create > special_use = \Trash > } > prefix = > separator = / > } > passdb { > driver = pam > name = pam > } > plugin { > fts = solr > fts_autoindex = yes > fts_autoindex_exclude = \Junk > fts_solr = url=http://127.0.0.1:8983/solr/dovecot/ > imapsieve_mailbox1_before = file:/opt/local/etc/dovecot/sieve/report-spam.sieve > imapsieve_mailbox1_causes = COPY APPEND > imapsieve_mailbox1_name = Spam_train > imapsieve_mailbox2_before = file:/opt/local/etc/dovecot/sieve/report-ham.sieve > imapsieve_mailbox2_causes = COPY APPEND > imapsieve_mailbox2_name = Notspam_train > mail_log_events = delete undelete expunge copy mailbox_delete mailbox_rename > mail_log_fields = uid box msgid from subject size flags > quota_grace = 10%% > quota_rule = *:storage=16G > quota_rule2 = Trash:storage=+256M > quota_warning = storage=100%% quota-exceeded %u > quota_warning2 = storage=80%% quota-warning %u > recipient_delimiter = + > sieve = /private/var/mail/tld.domain.mail/rules/%Ln/dovecot.sieve > sieve_after = /opt/local/etc/dovecot/sieve-after.d > sieve_before = /opt/local/etc/dovecot/sieve-before.d > sieve_dir = /private/var/mail/tld.domain.mail/rules/%Ln/%u > sieve_global_extensions = +vnd.dovecot.pipe +vnd.dovecot.environment > sieve_pipe_bin_dir = /opt/local/etc/dovecot/sieve > sieve_plugins = sieve_imapsieve sieve_extprograms > sieve_quota_max_storage = 50M > } > postmaster_address = postmaster(a)domain.tld > protocols = imap lmtp sieve > quota_full_tempfail = yes > sendmail_path = /opt/local/sbin/sendmail > service auth-worker { > user = root > } > service auth { > extra_groups = _keytabusers > idle_kill = 15 mins > unix_listener /opt/local/var/spool/postfix/private/auth { > group = mail > mode = 0660 > user = _postfix > } > } > service imap-login { > inet_listener imap { > address = 127.0.0.1, ::1 > port = 143 > } > inet_listener imaps { > port = 993 > ssl = yes > } > process_min_avail = 6 > service_count = 0 > vsz_limit = 2 G > } > service imap { > client_limit = 16 > process_limit = 200 > process_min_avail = 6 > service_count = 0 > } > service lmtp { > unix_listener /opt/local/var/spool/postfix/private/dovecot-lmtp { > group = mail > mode = 0660 > user = _postfix > } > } > ssl = required > ssl_ca = </etc/certificates/chain.pem > ssl_cert = </etc/certificates/cert.pem > ssl_cipher_list = ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256 > ssl_dh = # hidden, use -P to show it > ssl_key = # hidden, use -P to show it > ssl_min_protocol = TLSv1.2 > ssl_prefer_server_ciphers = yes > userdb { > driver = passwd > name = passwd > } > verbose_proctitle = yes > protocol lda { > mail_fsync = optimized > mail_plugins = quota zlib acl fts fts_solr fts_lucene sieve > } > protocol imap { > mail_max_userip_connections = 50 > mail_plugins = quota zlib acl fts fts_solr fts_lucene imap_acl imap_quota imap_zlib imap_sieve > } > protocol lmtp { > mail_fsync = optimized > mail_plugins = quota zlib acl fts fts_solr fts_lucene sieve > }

2 2

ssl_dh
by ＠lbutlr 27 May '19

27 May '19

Does ssl_dh need to be manually updated each time the underlying certificate renews? -- 2+2=5 for sufficiently large values of 2.

2 1

Hello some help on login users saying it's disabled
by Remo Mattei 27 May '19

27 May '19

Hello I am experiencing some strange issue with the dovecot, the web round cube works fine but when I try to connect with an iPhone over IMAP IMAPs it tells me that the account is disabled. Please advice here is what I see in the logs: May 25 14:30:32 imap-login: Info: Aborted login (no auth attempts in 0 secs): user=<>, rip=172.10.163.251, lip=208.53.44.237, session=<4AZjBr2J2cisCqP7> May 25 14:30:32 imap-login: Info: Aborted login (no auth attempts in 0 secs): user=<>, rip=172.10.163.251, lip=208.53.44.237, session=<fFVkBr2J2sisCqP7> May 25 14:30:32 imap-login: Info: Aborted login (no auth attempts in 0 secs): user=<>, rip=172.10.163.251, lip=208.53.44.237, session=<TnpkBr2J28isCqP7> May 25 14:30:32 imap-login: Info: Aborted login (no auth attempts in 0 secs): user=<>, rip=172.10.163.251, lip=208.53.44.237, session=<KcplBr2J3MisCqP7> May 25 14:30:34 imap-login: Info: Aborted login (no auth attempts in 0 secs): user=<>, rip=172.10.163.251, lip=208.53.44.237, session=<wPiABr2J3cisCqP7> May 25 14:30:34 imap-login: Info: Aborted login (no auth attempts in 0 secs): user=<>, rip=172.10.163.251, lip=208.53.44.237, session=<gDSCBr2J3sisCqP7> May 25 14:30:37 imap-login: Info: Aborted login (no auth attempts in 0 secs): user=<>, rip=172.10.163.251, lip=208.53.44.237, session=<byuzBr2J4MisCqP7> May 25 14:30:37 imap-login: Info: Aborted login (no auth attempts in 0 secs): user=<>, rip=172.10.163.251, lip=208.53.44.237, session=<ob20Br2J4cisCqP7> May 25 14:30:39 imap-login: Info: Aborted login (no auth attempts in 0 secs): user=<>, rip=172.10.163.251, lip=208.53.44.237, session=<bUfQBr2J4sisCqP7> May 25 14:30:39 imap-login: Info: Aborted login (no auth attempts in 0 secs): user=<>, rip=172.10.163.251, lip=208.53.44.237, session=<tsbRBr2J48isCqP7> And the account does not show any mail whereas the Web shows the mail just fine. Thanks

4 3

pam authentication error?
by unknown＠example.com 27 May '19

27 May '19

Getting this: auth-worker(5045): Error: pam(kremels,xxx.xxx.xxx.xxx: pam_authenticate() failed: authentication error (/etc/pam.d/dovecot missing?) # cat /etc/pam.d/dovcot auth required pam_unix.so nullok account required pam_unix.so (file was last updated in April of 2018) passdb { username_filter = "!*@*" driver = pam } userdb { driver = passwd } service auth { unix_listener auth-userdb { } unix_listener /var/spool/postfix/private/auth { mode = 0666 } } # ls -ls /var/spool/postfix/private/auth 0 srw-rw-rw- 1 root wheel 0 May 27 13:57 /var/spool/postfix/private/auth postfix/main.cf: smtpd_sasl_authenticated_header = yes smtpd_sasl_path = private/auth smtpd_sasl_type = dovecot smtpd_starttls_timeout = 20s smtpd_tls_cert_file = /usr/local/etc/dehydrated/certs/covisp.net/fullchain.pem smtpd_tls_key_file = /usr/local/etc/dehydrated/certs/covisp.net/privkey.pem smtpd_tls_loglevel = 1 smtpd_tls_received_header = yes smtpd_tls_security_level = may 16 -rw------- 1 root 443 4152 May 20 21:08 fullchain-1558408117.pem 0 lrwx------ 1 root 443 24 May 20 21:08 fullchain.pem -> fullchain-1558408117.pem 8 -rw------- 1 root 443 3243 May 20 21:08 privkey-1558408117.pem 0 lrwx------ 1 root 443 22 May 20 21:08 privkey.pem -> privkey-1558408117.pem

2 1

Re: Hello some help on login users saying it's disabled
by Joseph Tam 27 May '19

27 May '19

> Hello I am experiencing some strange issue with the dovecot, the web > round cube works fine but when I try to connect with an iPhone over > IMAP IMAPs it tells me that the account is disabled. > > May 25 14:30:32 imap-login: Info: Aborted login (no auth attempts in 0 secs): user=<>, rip=... > ... It's probably the iPhone mail app trying to be clever and auto-configuring the settings for IMAP (and getting it wrong). To stop this behaviour, hardwire the iPhone IMAP parameters, then disable "Automatic manage connection". If you use SSL/TLS, this will also secure you from plaintext MITM attacks. Other oddities I've seen from Apple mail readers: 1) If you don't disable "Automatic manage connection", it will also hunt around for outgoing mail settings. 2) Once in a while, it initiates an idle authenticated SMTP session (i.e. authenticates, but does nothing). 3) Roofs your user IMAP connection limit when the client does global mail searches. Joseph Tam <jtam.home(a)gmail.com>

1 0

SIGABRT on fetching mail
by Peter Nabbefeld 27 May '19

27 May '19

Hello, I still cannot fetch my mails, relying on my smartphone (which makes it a burden to read my mails ...) - could probably somebody help me? Kind regards, Peter

2 2

Error suggestions please
by Remo Mattei 27 May '19

27 May '19

May 25 15:01:27 imap(xxxxx(a)italy1.com)<10256><LsrOdL2J3uisCqP7>: Error: Mailbox INBOX: UID=208: read(/home/vpopmail/domains/italy1.com/xxxxx/Maildir/cur/1154731221.9257.az… failed: Cached message size smaller than expected (26421 < 26511, box=INBOX, UID=208) (read reason=mail stream) May 25 15:01:27 imap(xxxxxx(a)italy1.com)<10256><LsrOdL2J3uisCqP7>: Error: Corrupted record in index cache file /home/vpopmail/domains/italy1.com/xxxxx/Maildir/dovecot.index.cache: UID 208: Broken physical size in mailbox INBOX: read(/home/vpopmail/domains/italy1.com/xxxxx/Maildir/cur/1154731221.9257.az… failed: Cached message size smaller than expected (26421 < 26511, box=INBOX, UID=208) May 25 15:01:27 imap(xxxxxx(a)italy1.com)<10256><LsrOdL2J3uisCqP7>: Panic: file istream.c: line 315 (i_stream_read_memarea): assertion failed: (old_size <= _stream->pos - _stream->skip) Can someone tell help on how to fix this issue. Thanks

3 3

Unknown error message
by Jerry 26 May '19

26 May '19

dovecot 2.3.6 (7eab80676) FreeBSD 12.0-RELEASE-p5 amd64 I have recently been finding error messages similar to the following in my Dovecot log file: May 26 06:58:32 imap(gerard(a)seibercom.net)<87791><WvXT+LyJHBCubeH6>: Error: stat(/var/mail/vmail/seibercom.net/gerard/.dovecot.sieve/tmp) failed: Not a directory The message is correct as there is no such directory. The question is why has it suddenly started appearing? I checked my maillog file, and there are no messages being transmitted to Dovecot when that error message is created. Neither is there any mail with that ID number either. Could this be someone attempting to hack into my system? Thanks! -- Jerry

2 1

Automatically subscribe to the INBOX folder
by glts 26 May '19

26 May '19

Hello, I am using the ‘auto = subscribe’ feature in the mailbox configuration section in the usual fashion (as shown in conf.d/15-mailboxes.conf): namespace inbox { inbox = yes mailbox Drafts { special_use = \Drafts auto = subscribe } ... } When I connect to an account with the Thunderbird mail client, those mailboxes/folders get autocreated and autosubscribed. Good! INBOX, however, does not get subscribed to automatically. When I look at the account’s subscriptions in Thunderbird, all folders are subscribed, except INBOX. How can I enable autosubscribe for the INBOX folder (like the other folders)? Is there an option for this? This is in Dovecot 2.2.22. Cheers, David

2 1

Workaround for infinite loop in XCLIENT command bug
by mabi 26 May '19

26 May '19

Hello, I am running Dovecot 2.3.5 package on OpenBSD 6.5 and it looks like this bug which has been fixed in 2.3.6 is hitting me: lib-smtp: client: Fix infinite loop in XCLIENT command interaction with server https://github.com/dovecot/core/commit/5d03f39b345127b80d145ee90772739baa7a… so I was wondering if there is any workarounds? Maybe like disabling the XCLIENT command from the config file or something similar? My original post regarding this issue is here: https://www.mail-archive.com/misc@opensmtpd.org/msg04362.html I first thought this was an OpenSMTPD issue but it seems to be that Dovecot bug. Cheers, Mabi

3 6

Dovecot multiple passdb and fail2ban
by Joaquin F 26 May '19

26 May '19

Objective: different password for remote and local imap login Version: 2.2.36 (1f10bfa63) on CentOS 7 Users are from Active Directory, mapped to local users via sssd After much experimentation, I have configured this way: doveconf -n passdb userdb passdb { args = username_format=%Ln /etc/dovecot/remote driver = passwd-file skip = authenticated username_filter = user01 user02 } passdb { driver = pam override_fields = allow_nets=127.0.0.0/8,192.168.1.0/24 skip = authenticated } userdb { driver = passwd } If I put the passdb's in the reverse order, I would get failure messages (when logging in remotely) in /var/log/secure, such as: auth: pam_sss(dovecot:auth): authentication failure; logname= uid=0 euid=0 tty=dovecot ruser=user02 rhost=xx.xx.xx.xx user=user02 Which caused fail2ban to ban that ip /etc/fail2ban/jail.local [dovecot] enabled = true port = imap,imaps If I set "auth_verbose = yes", then I can see messages in (when logging in locally) in /var/log/maillog dovecot: auth: passwd-file(user02,192.168.1.20,<Na/7f8WJC8HAqAEU>): Password mismatch which is probably not a big deal... but seems inefficient? Question: is there a more elegant way to use different passdb depending on ip? Thanks in advance.

1 0

Imap reverse / proxy in front of our clients machines.
by Brent Clark 25 May '19

25 May '19

Good day Guys I have a user story have an imap reverse / proxy in front of our clients servers. Im currently using the following sources for information. https://wiki.failover.de/Email/Dovecot/IMAP/Proxy/ https://gist.github.com/rplessl/dd56d05c84f988706418 https://wiki2.dovecot.org/PasswordDatabase/ExtraFields/Proxy In my vagrant instance, dovecot can connect to the the remote server You can see my debugging and conf: https://pastebin.com/raw/H2AL53Fz https://pastebin.com/raw/hZHSHvcu If anyone can assist it would be greatly appreciated. Many thanks Regards Brent

1 0

Race condition in IMAP NOTIFY for events received NOTIFY_DELAY_MSECS apart
by Guilhem Moulin 25 May '19

25 May '19

Hi there, There seem to be a race condition in IMAP NOTIFY: when two events for the SELECTED mailbox are received soon after one another, sometimes only the first one is being reported to clients that enabled IMAP NOTIFY. On closer look it seems like this is most often reproducible when the delay between the two events is NOTIFY_DELAY_MSECS (500ms). This is with 2.3.4.1 from Debian sid. $ sed -r 's/^\s*//; s/\s+/ /g' >/tmp/dovecot.conf <<-EOF log_path = /tmp/dovecot.log mailbox_list_index = yes mail_home = /dev/shm/dovecot-test/%u mail_location = dbox:~/mail ssl = no EOF (`doveconf -c /tmp/dovecot.conf -n` output enclosed.) $ rm -rf /dev/shm/dovecot-test && mkdir -m0700 /dev/shm/dovecot-test $ env -i USER=user HOME=/dev/shm/dovecot-test/user PATH=/usr/bin:/bin \ doveadm -c /tmp/dovecot.conf exec imap S: * PREAUTH [CAPABILITY IMAP4rev1 … NOTIFY] Logged in as user C: a NOTIFY SET STATUS (SELECTED (MessageNew MessageExpunge FlagChange)) (MAILBOXES (INBOX test) (MessageNew MessageExpunge FlagChange)) S: * STATUS INBOX (MESSAGES 0 UIDNEXT 1 UIDVALIDITY 1558785754 UNSEEN 0 HIGHESTMODSEQ 1) S: a OK NOTIFY completed (0.004 + 0.000 + 0.003 secs). S: * STATUS INBOX (MESSAGES 0 UIDNEXT 1 UIDVALIDITY 1558785754 UNSEEN 0 HIGHESTMODSEQ 1) C: b SELECT INBOX […] S: b OK [READ-WRITE] Select completed (0.001 + 0.000 secs). Now deliver two messages to INBOX with ~500ms in between: $ env -i USER=user HOME=/dev/shm/dovecot-test/user PATH=/usr/bin:/bin sh -c \ 'echo -n . | doveadm -c /tmp/dovecot.conf exec dovecot-lda -e -m INBOX; \ sleep 0.500; \ echo -n . | doveadm -c /tmp/dovecot.conf exec dovecot-lda -e -m INBOX' Only the the first message is reported in the above IMAP session: S: * 1 EXISTS S: * 1 RECENT An UNSELECT doesn't trigger the notification, but (of course) a NOOP does: C: c NOOP S: * 2 EXISTS S: * 2 RECENT S: c OK NOOP completed (0.001 + 0.000 secs). Similarly, for two flag changes within 0.5s only the first is recorded: $ env -i USER=user HOME=/dev/shm/dovecot-test/user PATH=/usr/bin:/bin sh -c \ 'doveadm -c /tmp/dovecot.conf flags add "\\Seen" mailbox INBOX 1; \ sleep 0.500; \ doveadm -c /tmp/dovecot.conf flags add "\\Answered" mailbox INBOX 2' yields a single unsolicited FETCH response: S: * 1 FETCH (MODSEQ (4) FLAGS (\Seen \Recent)) AFAICT this is only reproducible in the ‘SELECTED’ mailbox specifier: after creating a mailbox "test", $ env -i USER=user HOME=/dev/shm/dovecot-test/user PATH=/usr/bin:/bin sh -c \ 'echo -n . | doveadm -c /tmp/dovecot.conf exec dovecot-lda -e -m test; \ sleep 0.500; \ echo -n . | doveadm -c /tmp/dovecot.conf exec dovecot-lda -e -m test' yields two unsolicited STATUS responses as expected: * STATUS test (MESSAGES 1 UIDNEXT 2 UIDVALIDITY 1558787038 UNSEEN 1 HIGHESTMODSEQ 2) * STATUS test (MESSAGES 2 UIDNEXT 3 UIDVALIDITY 1558787038 UNSEEN 2 HIGHESTMODSEQ 3) (And same thing for two flag updates in the "test" mailbox.) This is not specific to INBOX as once "test" is selected the same problem arises. AFAICT the race is in ‘src/lib-storage/list/mailbox-list-index-notify.c’ which for some reason doesn't acknowledge ST_CHANGED() after inotify_rm_watch(), but I couldn't get my head around that file. Cheers, -- Guilhem.

1 0

SIGABRT on fetching mail
by Peter Nabbefeld 24 May '19

24 May '19

Hello, I'm running dovecot with getmail for several months already, but today it's always crashing: "getmailrc: operation error (child pid 2995 killed by signal 6)". The deliver process aborts due to an unknown reason. > tail /var/log/dovecot-info.log May 24 12:10:28 imap-login: Info: Login: user=<peter.nabbefeld(a)gmx.de>, method=PLAIN, rip=::1, lip=::1, mpid=2970, secured, session=<n/dfaJ+JuIMAAAAAAAAAAAAAAAAAAAAB> May 24 12:10:49 lda(peter.nabbefeld(a)gmx.de)<2994><kCP3FifD51yyCwAA7IIYzw>: Info: sieve: msgid=<318D121B-37FC-4E8C-B4B8-93C87E0692B8(a)gmx.de>: stored mail into mailbox 'Gesendet' May 24 15:14:30 imap-login: Info: Login: user=<peter.nabbefeld(a)gmx.de>, method=PLAIN, rip=::1, lip=::1, mpid=6304, secured, session=<+Rae+qGJ4IUAAAAAAAAAAAAAAAAAAAAB> May 24 15:14:31 imap(peter.nabbefeld(a)gmx.de)<6304><+Rae+qGJ4IUAAAAAAAAAAAAAAAAAAAAB>: Info: Connection closed (append finished 0.562 secs ago) in=157758 out=520 deleted=0 expunged=0 trashed=0 hdr_count=0 hdr_bytes=0 body_count=0 body_bytes=0 May 24 15:14:37 imap-login: Info: Login: user=<peter.nabbefeld(a)gmx.de>, method=PLAIN, rip=::1, lip=::1, mpid=6307, secured, session=<MjwD+6GJ4oUAAAAAAAAAAAAAAAAAAAAB> May 24 15:55:28 imap-login: Info: Login: user=<peter.nabbefeld(a)gmx.de>, method=PLAIN, rip=::1, lip=::1, mpid=7205, secured, session=<T9ofjaKJgIYAAAAAAAAAAAAAAAAAAAAB> May 24 15:57:00 imap-login: Info: Login: user=<peter.nabbefeld(a)gmx.de>, method=PLAIN, rip=::1, lip=::1, mpid=7254, secured, session=<nT6XkqKJhIYAAAAAAAAAAAAAAAAAAAAB> May 24 16:08:22 imap-login: Info: Login: user=<peter.nabbefeld(a)gmx.de>, method=PLAIN, rip=::1, lip=::1, mpid=7507, secured, session=<LI40u6KJJIcAAAAAAAAAAAAAAAAAAAAB> May 24 16:16:40 imap(peter.nabbefeld(a)gmx.de)<6307><MjwD+6GJ4oUAAAAAAAAAAAAAAAAAAAAB>: Info: Connection closed (IDLE running for 0.001 + waiting input for 0.001 secs, 2 B in + 10 B out, state=wait-input) in=4251 out=137885 deleted=0 expunged=0 trashed=0 hdr_count=1 hdr_bytes=661 body_count=0 body_bytes=0 May 24 16:16:54 imap-login: Info: Login: user=<peter.nabbefeld(a)gmx.de>, method=PLAIN, rip=::1, lip=::1, mpid=7662, secured, session=<zV++2aKJOIcAAAAAAAAAAAAAAAAAAAAB> > tail /var/log/dovecot.log May 24 11:25:33 master: Warning: Killed with signal 15 (by pid=12275 uid=0 code=kill) May 24 11:25:35 log(660): Warning: Killed with signal 15 (by pid=1 uid=0 code=kill) May 24 12:10:47 lda(peter.nabbefeld(a)gmx.de)<2994><kCP3FifD51yyCwAA7IIYzw>: Warning: Failed to parse return-path header May 24 12:10:50 lda(peter.nabbefeld(a)gmx.de)<2995><hco1BirD51yzCwAA7IIYzw>: Panic: file istream-crlf.c: line 24 (i_stream_crlf_read_common): assertion failed: (ret != -2) May 24 12:10:50 lda(peter.nabbefeld(a)gmx.de)<2995><hco1BirD51yzCwAA7IIYzw>: Error: Raw backtrace: /usr/lib/dovecot/libdovecot.so.0(+0xeee14) [0x7fd668defe14] -> /usr/lib/dovecot/libdovecot.so.0(+0xeee51) [0x7fd668defe51] -> /usr/lib/dovecot/libdovecot.so.0(+0x46268) [0x7fd668d47268] -> /usr/lib/dovecot/libdovecot.so.0(+0x4892e) [0x7fd668d4992e] -> /usr/lib/dovecot/libdovecot.so.0(+0x1004e6) [0x7fd668e014e6] -> /usr/lib/dovecot/libdovecot.so.0(i_stream_read_memarea+0x81) [0x7fd668dfd681] -> /usr/lib/dovecot/libdovecot.so.0(i_stream_read+0x36) [0x7fd668dfd8a6] -> /usr/lib/dovecot/libdovecot.so.0(+0x1058f8) [0x7fd668e068f8] -> /usr/lib/dovecot/libdovecot.so.0(i_stream_read_memarea+0x81) [0x7fd668dfd681] -> /usr/lib/dovecot/libdovecot.so.0(i_stream_read+0x36) [0x7fd668dfd8a6] -> /usr/lib/dovecot/libdovecot.so.0(i_stream_read_data+0x4c) [0x7fd668dfe33c] -> /usr/lib/dovecot/libdovecot.so.0(io_stream_copy+0x8a) [0x7fd668e18aba] -> /usr/lib/dovecot/libdovecot.so.0(+0x119ac2) [0x7fd668e1aac2] -> /usr/lib/dovecot/libdovecot.so.0(o_stream_send_istream+0x4f) [0x7fd668e1874f] -> /usr/lib/dovecot/libdovecot-storage.so.0(index_storage_save_continue+0x2e) [0x7fd668f981ee] -> /usr/lib/dovecot/libdovecot-storage.so.0(maildir_save_continue+0x27) [0x7fd668f36887] -> /usr/lib/dovecot/libdovecot-storage.so.0(mailbox_save_continue+0x44) [0x7fd668f083f4] -> /usr/lib/dovecot/libdovecot-storage.so.0(mail_storage_copy+0xf8) [0x7fd668ef9828] -> /usr/lib/dovecot/libdovecot-storage.so.0(maildir_copy+0x59) [0x7fd668f32639] -> /usr/lib/dovecot/libdovecot-lda.so.0(+0x3d5c) [0x7fd66902ad5c] -> /usr/lib/dovecot/modules/lib20_fts_plugin.so(+0x10eec) [0x7fd668a90eec] -> /usr/lib/dovecot/libdovecot-storage.so.0(+0x58981) [0x7fd668f08981] -> /usr/lib/dovecot/libdovecot-sieve.so.0(+0x4e6df) [0x7fd66676e6df] -> /usr/lib/dovecot/libdovecot-sieve.so.0(sieve_result_execute+0x4e5) [0x7fd666764065] -> /usr/lib/dovecot/libdovecot-sieve.so.0(+0x57259) [0x7fd666777259] -> /usr/lib/dovecot/libdovecot-sieve.so.0(sieve_multiscript_run+0xa2) [0x7fd6667783f2] -> /usr/lib/dovecot/modules/lib90_sieve_plugin.so(+0x3d45) [0x7fd668cecd45] -> /usr/lib/dovecot/libdovecot-lda.so.0(mail_deliver+0xf9) [0x7fd66902c229] How can I find out which message is causing the crash? It would be very helpful, if the message's subject and receipt time could be logged in case of an abort or anything else that could help identify the corrupt message. This would also enable me to send You the message for further investigation (if appropriate). Kind regards Peter

1 0

Panic: file mail-index-util.c: line 10 (mail_index_uint32_to_offset): assertion failed: (offset < 0x40000000)
by Ralf Hildebrandt 24 May '19

24 May '19

I'm encountering a crash which this command: % doveadm import -u restore(a)backup.invalid mdbox:/home/copymail2/mdbox '' mailbox INBOX header X-Spam Yes SAVEDBEFORE 2019-05-23 doveadm(restore(a)backup.invalid): Panic: file mail-index-util.c: line 10 (mail_index_uint32_to_offset): assertion failed: (offset < 0x40000000) doveadm(restore(a)backup.invalid): Error: Raw backtrace: /usr/lib/dovecot/libdovecot.so.0(+0xd9f9e) [0x7fbc52ba7f9e] -> /usr/lib/dovecot/libdovecot.so.0(+0xd9fe1) [0x7fbc52ba7fe1] -> /usr/lib/dovecot/libdovecot.so.0(i_fatal+0) [0x7fbc52b0cc54] -> /usr/lib/dovecot/libdovecot-storage.so.0(mail_index_uint32_to_offset+0x78)[0x7fbc52f525e8] -> /usr/lib/dovecot/libdovecot-storage.so.0(mail_cache_add+0x83b)[0x7fbc52f3ac2b] -> /usr/lib/dovecot/libdovecot-storage.so.0(index_mail_parse_header+0x449)[0x7fbc52f1c969] -> /usr/lib/dovecot/libdovecot.so.0(+0xb6af9) [0x7fbc52b84af9] -> /usr/lib/dovecot/libdovecot.so.0(i_stream_read_memarea+0x7a) [0x7fbc52bb531a] -> /usr/lib/dovecot/libdovecot.so.0(i_stream_read+0x2f) [0x7fbc52bb565f] -> /usr/lib/dovecot/libdovecot.so.0(i_stream_read_data+0x3d)[0x7fbc52bb604d] -> /usr/lib/dovecot/libdovecot.so.0(message_parse_header_next+0x68)[0x7fbc52b8b3f8] -> /usr/lib/dovecot/libdovecot.so.0(message_parse_header+0x52)[0x7fbc52b8bdd2] -> /usr/lib/dovecot/libdovecot-storage.so.0(+0xcadae) [0x7fbc52f26dae] -> /usr/lib/dovecot/libdovecot-storage.so.0(+0xcc0ac) [0x7fbc52f280ac] -> /usr/lib/dovecot/libdovecot-storage.so.0(index_storage_search_next_nonblock+0x11d)[0x7fbc52f288bd] -> /usr/lib/dovecot/libdovecot-storage.so.0(mailbox_search_next_nonblock+0x28)[0x7fbc52ea92e8] -> /usr/lib/dovecot/libdovecot-storage.so.0(mailbox_search_next+0x3d)[0x7fbc52ea934d] -> doveadm(+0x31443) [0x5635b4760443] -> doveadm(+0x2bdb1) [0x5635b475adb1] -> doveadm(+0x2caf9) [0x5635b475baf9] -> doveadm(doveadm_cmd_ver2_to_mail_cmd_wrapper+0x20e) [0x5635b475c9ce] -> doveadm(doveadm_cmd_run_ver2+0x55e) [0x5635b476db7e] -> doveadm(doveadm_cmd_try_run_ver2+0x37) [0x5635b476dbd7] -> doveadm(main+0x1d1) [0x5635b474aec1] -> /lib/x86_64-linux-gnu/libc.so.6(__libc_start_main+0xe7) [0x7fbc5210fb97] -> doveadm(_start+0x2a) [0x5635b474b39a] Version info: ii dovecot-core 2:2.3.6-2~bionic amd64 secure POP3/IMAP server - core files ii dovecot-dbg 2:2.3.6-2~bionic amd64 secure POP3/IMAP server - debug symbols ii dovecot-imapd 2:2.3.6-2~bionic amd64 secure POP3/IMAP server - IMAP daemon ii dovecot-lmtpd 2:2.3.6-2~bionic amd64 secure POP3/IMAP server - LMTP server Backtrace: Program received signal SIGABRT, Aborted. __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:51 51../sysdeps/unix/sysv/linux/raise.c: No such file or directory. (gdb) bt #0 __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:51 #1 0x00007ffff68fa801 in __GI_abort () at abort.c:79 #2 0x00007ffff7373f51 in default_fatal_finish (status=0, type=LOG_TYPE_PANIC) at failures.c:459 #3 fatal_handler_real (ctx=<optimized out>, format=<optimized out>, args=<optimized out>) at failures.c:471 #4 0x00007ffff7373fe1 in default_fatal_handler (ctx=<optimized out>, format=<optimized out>, args=<optimized out>) at failures.c:479 #5 0x00007ffff72d8c54 in i_panic (format=format@entry=0x7ffff772e440 "file %s: line %d (%s): assertion failed: (%s)") at failures.c:523 #6 0x00007ffff771e5e8 in mail_index_uint32_to_offset (offset=<optimized out>) at mail-index-util.c:10 #7 0x00007ffff7706c2b in mail_cache_header_fields_write (ctx=0x55555583d960, buffer=<optimized out>, buffer=<optimized out>) at mail-cache-transaction.c:609 #8 mail_cache_header_add_field (field_idx=15, ctx=0x55555583d960) at mail-cache-transaction.c:690 #9 mail_cache_add (ctx=0x55555583d960, seq=1, field_idx=field_idx@entry=15, data=0x7ffff773ba56, data_size=0) at mail-cache-transaction.c:739 #10 0x00007ffff76eafdc in index_mail_cache_add_idx (mail=mail@entry=0x55555583e2f8, field_idx=field_idx@entry=15, data=data@entry=0x7ffff773ba56, data_size=data_size@entry=0) at index-mail.c:621 #11 0x00007ffff76e8969 in index_mail_parse_header_finish (mail=<optimized out>) at index-mail-headers.c:132 #12 index_mail_parse_header (part=<optimized out>, hdr=<optimized out>, mail=<optimized out>) at index-mail-headers.c:312 #13 0x00007ffff7350af9 in read_header (mstream=0x55555584b7f0) at istream-header-filter.c:357 #14 i_stream_header_filter_read (stream=0x55555584b7f0) at istream-header-filter.c:447 #15 0x00007ffff738131a in i_stream_read_memarea (stream=stream@entry=0x55555584b870) at istream.c:313 #16 0x00007ffff738165f in i_stream_read (stream=stream@entry=0x55555584b870) at istream.c:271 #17 0x00007ffff738204d in i_stream_read_data (stream=0x55555584b870, data_r=data_r@entry=0x7fffffffdbe8, size_r=size_r@entry=0x7fffffffdbf0, threshold=threshold@entry=1) at istream.c:745 #18 0x00007ffff73573f8 in i_stream_read_bytes (wanted=2, size_r=0x7fffffffdbf0, data_r=0x7fffffffdbe8, stream=<optimized out>) at ../../src/lib/istream.h:217 #19 message_parse_header_next (ctx=0x55555584ca70, hdr_r=hdr_r@entry=0x7fffffffdc50) at message-header-parser.c:85 #20 0x00007ffff7357dd2 in message_parse_header (input=<optimized out>, hdr_size=hdr_size@entry=0x0,flags=flags@entry=MESSAGE_HEADER_PARSER_FLAG_CLEAN_ONELINE, callback=callback@entry=0x7ffff76f2310 <search_header>, context=context@entry=0x7fffffffdcc0) at message-header-parser.c:392 #21 0x00007ffff76f2dae in search_arg_match_text (ctx=0x55555583dd20, args=0x555555809690) at index-search.c:760 #22 search_match_once (ctx=0x55555583dd20) at index-search.c:1400 #23 0x00007ffff76f40ac in search_match_next (ctx=0x55555583dd20) at index-search.c:1507 #24 search_more_with_mail (mail=<optimized out>, ctx=0x55555583dd20) at index-search.c:1624 #25 search_more_with_prefetching (mail_r=<optimized out>, ctx=<optimized out>) at index-search.c:1706 #26 search_more (ctx=ctx@entry=0x55555583dd20, mail_r=mail_r@entry=0x7fffffffddf0) at index-search.c:1780 #27 0x00007ffff76f48bd in index_storage_search_next_nonblock(_ctx=0x55555583dd20, mail_r=0x7fffffffdec0, tryagain_r=0x7fffffffde57) at index-search.c:1808 #28 0x00007ffff76752e8 in mailbox_search_next_nonblock (ctx=0x55555583dd20, mail_r=0x7fffffffdec0, tryagain_r=<optimized out>) at mail-storage.c:2141 #29 0x00007ffff767534d in mailbox_search_next (ctx=0x55555583dd20, mail_r=mail_r@entry=0x7fffffffdec0) at mail-storage.c:2126 #30 0x0000555555586682 in doveadm_mail_iter_next (iter=<optimized out>, mail_r=mail_r@entry=0x7fffffffdec0) at doveadm-mail-iter.c:160 #31 0x0000555555585443 in cmd_import_box (search_args=<optimized out>, info=0x555555832118, dest_user=<optimized out>, ctx=0x555555807d78) at doveadm-mail-import.c:142 #32 cmd_import_run (_ctx=0x555555807d78, user=0x55555581c688) at doveadm-mail-import.c:202 #33 0x000055555557fdb1 in doveadm_mail_next_user (ctx=ctx@entry=0x555555807d78, error_r=error_r@entry=0x7fffffffe0a0) at doveadm-mail.c:462 #34 0x0000555555580a0b in doveadm_mail_single_user (ctx=ctx@entry=0x555555807d78, error_r=error_r@entry=0x7fffffffe0a0) at doveadm-mail.c:492 #35 0x0000555555580af9 in doveadm_mail_cmd_exec (ctx=ctx@entry=0x555555807d78, wildcard_user=wildcard_user@entry=0x0) at doveadm-mail.c:653 #36 0x00005555555819ce in doveadm_cmd_ver2_to_mail_cmd_wrapper (cctx=<optimized out>) at doveadm-mail.c:1144 #37 0x0000555555592b7e in doveadm_cmd_run_ver2 (argc=12, argv=0x5555557f5ae8, cctx=cctx@entry=0x7fffffffe290) at doveadm-cmd.c:574 #38 0x0000555555592bd7 in doveadm_cmd_try_run_ver2 (cmd_name=<optimized out>, argc=<optimized out>, argv=<optimized out>, cctx=0x7fffffffe290) at doveadm-cmd.c:496 #39 0x000055555556fec1 in main (argc=<optimized out>, argv=<optimized out>) at doveadm.c:391 -- Ralf Hildebrandt Geschäftsbereich IT | Abteilung Netzwerk Charité - Universitätsmedizin Berlin Campus Benjamin Franklin Hindenburgdamm 30 | D-12203 Berlin Tel. +49 30 450 570 155 | Fax: +49 30 450 570 962 ralf.hildebrandt(a)charite.de | https://www.charite.de

2 2

MailCrypt plugin questions
by MRob 23 May '19

23 May '19

I read the mailcrypt plugin document on the wiki and had couple questions. 1. If I want per-user encryption am I correct I should configure global keys with all related settings override in the userdb lookup? 2. If I do not want to encrypt some user accounts, is it enough to omit the mail_crypt_global_private_key from the userdb lookup? In other word, mail_plugins still active with mail_crypt, will that cause user account to be encrypted unexpectedly if no private key is given? 3. Example command to create EC key does not ask for password, openssl ecparam command does not seem to have password arg. If I want password-protection should I use RSA key which the doc tell to be discouraged?

1 1

Re: Catch all for dovecot authentication?
by Joseph Tam 23 May '19

23 May '19

> as stated by Aki > > > passdb { > > driver = static > > args = nopassword > >} > > works fine and does what I want: accept any SMTP AUTH :-) (Brings back memories of good fun I had with patched Qpopper snare feeding custom messages to the hacker.) Another alternative is to use the checkpassword hook that will accept any username/password. The advantage is you can do post-analysis of credentials as the script has access to them. Joseph Tam <jtam.home(a)gmail.com>

1 0

Catch all for dovecot authentication?
by Tobi 23 May '19

23 May '19

Hi I'm aware that there are several good reasons not to do what I want, but in my use-case it would be an interesting feature. So please no discussions about the reasonableness I have some spamtrap SMTP servers (postfix). Currently SMTP AUTH is disabled. But as I daily have thousands of AUTH tries I thought it would be nice to be able to accept any AUTH request from postfix in dovecot. Is something like this possible with dovecot? If so any good description available on how to achieve? Thanks -- tobi

4 5

How to get original recipient from Postfix when using LMTP?
by MRob 22 May '19

22 May '19

Many people prefer to use LMTP for delivery from postfix for better efficiency but X-Original-to header support still missing after many years. One affect of this is need to set sieve_vacation_dont_check_recipient = yes which violate Sieve standard and cause auto-replyies sent to messages that should not happen. Or abandon LMTP. or abandon postfix?? So while feature request is stalled are there any realistic workarounds?

3 3

weakforced: Possible to access the ip address of report/allow?
by Tobi 22 May '19

22 May '19

Hi I wonder if the information about the origin of report or allow can be accessed somehow. lt.remote gives the IP of the client trying to login but is there anything in lt which gives the ip of the system that connects to wforced? Thanks and have a good one -- tobi

2 3

lmtp report permission denied on delivery to multiple recipients
by Patrick Cernko 22 May '19

22 May '19

Hello, when receiving mails for multiple recipients via LMTP, I often see the following messages on our servers: > May 22 11:06:10 sinon dovecot[44304]: lmtp(119718): Connect from $IP$ > May 22 11:06:11 sinon dovecot[44304]: lmtp($USER1$)<119718><2HnmOgIR5Vym0wEA22L5Rg>: msgid=<$MSGID$>: saved mail to INBOX > May 22 11:06:11 sinon dovecot[44304]: lmtp($USER2$)<119718><2HnmOgIR5Vym0wEA22L5Rg:2>: Error: stat(/IMAP/mail/mailboxes/$USER1$/mdbox/mailboxes/INBOX/dbox-Mails/dovecot.index.cache) failed: Permission denied (euid=$UID2$($USER2$) egid=$GID2$(rbg) missing +x perm: /IMAP/mail/mailboxes/$USER1$, dir owned by $UID1$:$GID2$ mode=0700) > May 22 11:06:11 sinon dovecot[44304]: lmtp($USER2$)<119718><2HnmOgIR5Vym0wEA22L5Rg:2>: Error: open(/IMAP/mail/mailboxes/$USER1$/mdbox/mailboxes/INBOX/dbox-Mails/dovecot.index.cache) failed: Permission denied (euid=$UID2$($USER2$) egid=$GID2$(rbg) missing +x perm: /IMAP/mail/mailboxes/$USER1$, dir owned by $UID1$:$GID2$ mode=0700) > May 22 11:06:11 sinon dovecot[44304]: lmtp($USER2$)<119718><2HnmOgIR5Vym0wEA22L5Rg:2>: Error: lstat(/IMAP/mail/mailboxes/$USER1$/mdbox/mailboxes/INBOX/dbox-Mails/dovecot.index.cache.lock) failed: Permission denied > May 22 11:06:11 sinon dovecot[44304]: lmtp($USER2$)<119718><2HnmOgIR5Vym0wEA22L5Rg:2>: Error: file_dotlock_open(/IMAP/mail/mailboxes/$USER1$/mdbox/mailboxes/INBOX/dbox-Mails/dovecot.index.cache) failed: Permission denied (euid=$UID2$($USER2$) egid=$GID2$(rbg) missing +x perm: /IMAP/mail/mailboxes/$USER1$, dir owned by $UID1$:$GID2$ mode=0700) > May 22 11:06:11 sinon dovecot[44304]: lmtp($USER2$)<119718><2HnmOgIR5Vym0wEA22L5Rg:2>: Error: open(/IMAP/mail/mailboxes/$USER1$/mdbox/mailboxes/INBOX/dbox-Mails/dovecot.index.cache) failed: Permission denied (euid=$UID2$($USER2$) egid=$GID2$(rbg) missing +x perm: /IMAP/mail/mailboxes/$USER1$, dir owned by $UID1$:$GID2$ mode=0700) > May 22 11:06:11 sinon dovecot[44304]: lmtp($USER2$)<119718><2HnmOgIR5Vym0wEA22L5Rg:2>: 2HnmOgIR5Vym0wEA22L5Rg:2: sieve: msgid=<$MSGID$>: stored mail into mailbox 'INBOX' > May 22 11:06:11 sinon dovecot[44304]: lmtp(119718): Disconnect from $IP$: Successful quit (usernames, uids, gids and IP addresses anonymized) So far, I was not able to reproduce this issue on a simple test setup, but I have the strong impression, that is has something to do with the fact, if some of the affected users have a active sieve script and others do not use sieve. In the example above $USER1$ did not have a sieve script configured but $USER2$ had one, as you can see. As a workaround, I configured an empty sieve script for all users with out sieve configured. This seems to work but actually I do not want to have users with empty sieve scripts. This bug seems to be related to https://dovecot.org/list/dovecot/2013-February/088540.html where Timo stated: "LMTP always delivers the mail to the first user. Then it tries to copy the first mail to the second user, because in some setups this can be done using hard links. With mbox that of course doesn't work, but looks like instead of failing silently it logs an error. So everything is working as it should, except there are these unnecessary errors logged. I'll see about getting rid of them." Is it possible to get rid of these error messages, either by a config setting that prevents if they do not lead to a real problem or by changing the code to avoid the behaviour described by Timo? Attached you can find doveconf -n output and the used ldap.conf (both anonymized), the referenced /etc/dovecot/passdb.deny and /etc/dovecot/userdb.overrides are usually empty files and only used during mailbox migrations. Best regards, -- Patrick Cernko <pcernko(a)mpi-klsb.mpg.de> +49 681 9325 5815 Joint Administration: Information Services and Technology Max-Planck-Institute fuer Informatik & Softwaresysteme

1 0

Integrity check mdbox?
by Marc Roos 22 May '19

22 May '19

Is it possible to do some sort of integrity check on mdbox's

2 1

Converting user mailboxes from maildir to sdbox
by David Mehler 22 May '19

22 May '19

Hello, I've got a Postfix/Dovecot server setup. Currently Dovecot is version 2.3.6, and it's using Maildir storage. The mailbox is: mail_home = /home/vmail/mailboxes/%d/%n mail_location = maildir:~/mail:LAYOUT=fs I'm wanting to convert from Maildir to sdbox. I looked at: https://wiki2.dovecot.org/MailboxFormat I was initially thinking mdbox but that's multiple messages per file, which I do not believe is what I want. Am I correct that in the sdbox format if a single message file is corrupted only that message is corrupt and not the rest of the messages as would be the case in a mdbox setup? On the page: https://wiki2.dovecot.org/Migration/MailFormat " maildir -> sdbox migration. Set mail_location=sdbox:~/sdbox and run dsync -u username mirror maildir:~/Maildir " If I set mail_location=sdbox:~/sdbox will that put the user mailboxes in mail_home/sdbox? So it would be: /home/vmail/mailboxes/example.com/username/sdbox I am needing to do this migration, but am paranoid about loosing mail or corrupting mailboxes. All of my users are virtual users and they are stored in a mysql database. Thanks. Dave.

2 1

[mail-crypt-plugin] How to decrypt mailbox?
by emordin 21 May '19

21 May '19

How do I enable the mail-crypt-plugin globally? Do I have to place 'mail_plugins = $mail_plugins mail_crypt' inside ever conf.d file where there is a protocol code block? Like for example the protocol lda codeblock in 15-lda.conf and the protocol imap codeblock in 20-imap.conf I placed 'mail_plugins = $mail_plugins mail_crypt' in 20-lmtp.conf inside the protocol lmtp code block, and the actual plugin settings are inside 90-plugin.conf inside the plugin codeblock. And I was able to get CRYPTED mail with this config. If I place 'mail_plugins = $mail_plugins mail_crypt' inside 90-plugin.conf, I get an error telling me to put 'mail_plugins = $mail_plugins mail_crypt' in 20-lmtp.conf Sent with [ProtonMail](https://protonmail.com) Secure Email.

2 1

Problems after upgrade from 2.2 to 2.3
by Lampa 21 May '19

21 May '19

Hello, i was using dovecot version 2.2 on debian server. After upgrade to debian version 2.3 i have problems. After some time imap doesn't work. There are lot of messages in log 2019-05-21T10:27:49.186373+02:00 hermes dovecot: imap-login: Error: master(imap): net_connect_unix(imap) failed: Resource temporarily unavailable - http://wiki2.dovecot.org/SocketUnavailable (client-pid=24810, client-id=148, rip=2.2.2.2, created 551 msecs ago, received 0/4 bytes) 2019-05-21T10:27:50.808136+02:00 hermes dovecot: imap-login: Error: master(imap): net_connect_unix(imap) failed: Resource temporarily unavailable - http://wiki2.dovecot.org/SocketUnavailable (client-pid=24810, client-id=169, rip=2.2.2.2, created 531 msecs ago, received 0/4 bytes) Tried client_limit set to 1 , service_count to 1 or 0 , still same results. It's imap server for 3k users. Any suggestions, please let me know. Thank you very much. Regards -- Lampa

1 0

Dovecot with LDAP Proxy
by Federico Bartolucci 21 May '19

21 May '19

Hello, configuring Dovecot with LDAP authentication, adding the parameter in ther sql config file: pass_attrs = \ =proxy=y I see then backend connections always addressed to localhot port 143: /user=utente1(a)domanin.com proxy lip=127.0.0.1 lport=143 / while I expect that connections would be managed by the director and then addressed to my backend IPs and specific port. Is there a way to configure ldap proxy to get that behavior? Thanks in advance. -federico

2 3

Dovecot documentation
by ＠lbutlr 21 May '19

21 May '19

the make config options for dovecot on FreeBSD list list [x] ICU Use libicu for FTS unicode normalization but https://wiki2.dovecot.org/Plugins/FTS makes no mention of libicu (nor of icu at all). is linicu simply in addition to the four options of Solar, Lucene, fts-xapian, and fts-dovecot? Also, the link to fts-dovecot goes to https://wiki2.dovecot.org/Plugins/FTS/Dovecot which is a 404. -- Man is born free, but is everywhere in chains.

1 0

[mail-crypt-plugin] How to decrypt mailbox?
by emordin 21 May '19

21 May '19

Hi, So I am able to encrypt email using the crypt plugin, but when I try to access the email by logging in thru mutt or roundcube the email is still encrypted. Is the decryption process automatic or do I have to create a custom program with the decrypt.rb code? Thanks. Sent with [ProtonMail](https://protonmail.com) Secure Email.

2 1

Further issues on FTS engine
by Joan Moreau 20 May '19

20 May '19

Hi, Additionally to the long list of problem on the FTS previously discussed, here a new: WHen I reset the indexes, the indexer-worker seems paralelleizing the indexing (which is good), however, the number available in "ps aux | grep dove" shows that it does not move: dovecot 28549 0.0 0.0 8620 3920 ? S 06:20 0:00 dovecot/indexer [0 clients, 3 requests] mailuse+ 28550 98.6 0.1 167412 86916 ? R 06:20 5:28 dovecot/indexer-worker [jom(a)grosjo.net XXXX - 800/37755] Looking further, if I put a tracer in teh backend, it treats the *same* message several times in parallel, and therefore does not move very fast on the global indexing of the box ANy clue ? THanks

2 1

enforcing multiple per-mailbox quotas for shared mailboxes
by Jost-Philip Matysik 20 May '19

20 May '19

Hi! I'm trying to get quotas for shared mailboxes set up on my server. It's not working, and I fail to understand why. Documentation for setup of this complexity is rather scarce on the web, and the discussions I found either don't directly apply or terminate with "I got it working" but no explanation. Can someone please help? The setup is rather lengthy and complicated, so I'll try to give a summary first for easier understanding. All help is appreciated! Please respond if you need more info! Thanks! Best regards, Jost Basic setup (where am I coming from?): ====================================== - This is a Debian 9 system with a more recent version of dovecot installed from https://repo.dovecot.org/ce-2.3-latest/debian/stretch - users have individual mailboxes with individual quotas -- this works great! - users can share mailboxes with other users through ACLs. To achieve this, there exists a wildcarded namespace with prefix="ZZZ_Freigaben/%%u" --this also works great! ==> up to here it's pretty much following the examples from the Wiki to the letter. Configuration goal (what do I want to achieve?): ================================================ - attach quotas to mailboxes, not logins - when copying/moving mails across shared mailboxes during imap sessions, enforce quota based on target mailbox, not logged-in user doing the copying. To clarify: ==> so if Bob has a quota of 500MB, all messages in Bob's mailbox should count against (and only against!) Bob's quota, regardless of who put them there. ==> if Alice has access to her own mailbox (directly), as well as Bob's mailbox and Dave's mailbox (through sharing), she should see 3 individual quotas when logging in: her own quota (200MB) for everything in her mailbox, bob's quota (300MB) for everything in Bob's mailbox, and Dave's quota (10GB) for everything in Dave's mailbox. These 3 quotas should be completely independant and neither block, nor override each other. Setup Idea (how I tried to get there): ====================================== - "quota=..." "quota_rule" and "quota_rule2" always refer to the user's own mailbox (with an additional rule for Trash). Everyone has those, so these are loaded statically from dovecot config file. - "quota_rule" is overwritten from userdb with the user's individual mailbox quota (the more I like you, the more space you get...) - since the number of different additional quotas required per user depends on how many mailboxes are shared with that user, individual "quota2=...", "quota3=...", "quotaN=..." fields are dynamically generated by the MySQL backend and loaded from userdb upon login. - consequently, for each "quotaN=..." entry, a corresponding "quotaN_rule=*:storage=XXX" is generated and returned from userdb (substitute N=1,2,3,4,... accordingly) Observations: ============= 1. enforcing quota for the user's personal mailbox works as expected, both through IMAP and when delivering incoming mail 2. overriding "quota_rule=..." from userdb for the user's personal mailbox works great. Individual quota is recognized and enforced both through IMAP and when delivering incoming mail. 3. dynamically loading "quota2=...", "quota3=..." etc. from userdb doesn't seem to work at all! I can see them being added as extra fields in the logs upon user login, but the quota-plugin seems to completely ignore them. They are not enforces, and tools like 'doveadm quota' list the userdb fields in the debug messages, but do not interpret them in any way. They do not throw errors either, the additional quota roots are just silently ignored. 4. the end result is that in an IMAP session the logged-in user's quota is enforced for their individual mailbox, but as soon as they write to someone else's mailbox (move a mail to /ZZZFreigaben/bob/Some-Subfolder), no quota is enforced at all! Additional debugging done: ========================== if I hardcode a "quota2=" and/or "quota3=" in the config file, I can observe the following: - If I hardcode "quota2=count:some_name:ns=ZZZ_Freigaben/", dovecot and doveadm will recognize the additional quota root. But since the folder "ZZZ_Freigaben/" on its own isn't a mailbox (it's just a path CONTAINING mailboxes), the quota is neither displayed in clients, nor enforced. It has no real-word effect, other than 'doveadm quota' showing an additional line. - If I hardcode "quota2=count:other_name:ns=ZZZ_Freigaben/postmaster/" in the config file (with that path being the real IMAP path to a shared mailbox), dovecot will complain in the log saying Error: quota: Unknown namespace: ZZZ_Freigaben/postmaster/ dovecot will start and work for the most part, but again completely ignore settings for the additional quota. - additionally, trying to override "quota2_rule=..." from userdb doesn't work as it does with "quota_rule=..."! If I have both "quota_rule=..." and "quota2_rule=..." in the config file as well as returned from userdb (with different values), dovecot will use "quota_rule" from userdb, but "quota2_rule" from config file. This behavior seems inconsistent! - I tried both maildir and count backends (seperately or mixed). Both show the same behavior. - I tried appending or removing an empty "ns=" to the first "quota=..." entry (the wiki shows some examples with it, some without). Makes no difference... Configuration Dumps below (slightly redacted to remove complete email addresses or IPs) ========================== output of dovecot -n: # 2.3.6 (7eab80676): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.6 (92dc263a) # OS: Linux 4.9.0-9-amd64 x86_64 Debian 9.9 # Hostname: [censored] auth_failure_delay = 10 secs auth_mechanisms = plain login default_vsz_limit = 512 M dict { acl = mysql:/etc/dovecot/dovecot-dict-sql.conf.ext } listen = * lmtp_rcpt_check_quota = yes login_greeting = Mail system ready. mail_gid = vmail mail_location = maildir:~/Maildir mail_plugins = " quota acl" mail_uid = vmail managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext imapsieve vnd.dovecot.imapsieve namespace Freigaben { list = children location = maildir:%%h/Maildir:INDEXPVT=%h/Maildir/Freigaben/%%u prefix = ZZZ_Freigaben/%%u/ separator = / subscriptions = no type = shared } namespace inbox { inbox = yes location = mailbox Drafts { auto = subscribe special_use = \Drafts } mailbox Junk { auto = subscribe autoexpunge = 61 days special_use = \Junk } mailbox Sent { auto = subscribe special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { auto = subscribe autoexpunge = 61 days special_use = \Trash } prefix = separator = / subscriptions = yes type = private } passdb { args = /etc/dovecot/dovecot-sql.conf.username driver = sql } plugin { acl = vfile:/etc/dovecot/dovecot-acl acl_defaults_from_inbox = yes acl_shared_dict = proxy::acl imapsieve_mailbox1_before = file:/etc/dovecot/sieve/learn-spam.sieve imapsieve_mailbox1_causes = COPY imapsieve_mailbox1_name = Junk imapsieve_mailbox2_before = file:/etc/dovecot/sieve/learn-ham.sieve imapsieve_mailbox2_causes = COPY imapsieve_mailbox2_from = Junk imapsieve_mailbox2_name = * quota = count:User quota:ns= quota_grace = 1%% quota_rule = *:storage=5G quota_rule2 = Trash:storage=+100M quota_status_nouser = DUNNO quota_status_overquota = 552 5.2.2 Mailbox is full quota_status_success = DUNNO quota_vsizes = yes sieve = file:~/sieve;active=~/.dovecot.sieve sieve_after = /etc/dovecot/sieve-after sieve_global_extensions = +vnd.dovecot.pipe +vnd.dovecot.environment sieve_max_script_size = 10M sieve_pipe_bin_dir = /etc/dovecot/sieve sieve_plugins = sieve_imapsieve sieve_extprograms sieve_quota_max_storage = 50M } postmaster_address = postmaster(a)matysik-ingenieurwesen.de protocols = " imap lmtp sieve" service auth-worker { user = vmail } service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0660 user = postfix } unix_listener auth-userdb { mode = 0666 } } service dict { unix_listener dict { group = vmail mode = 0660 user = dovecot } } service imap-login { inet_listener imap { port = 0 } inet_listener imaps { address = [censored] port = 993 ssl = yes } } service imap { process_limit = 1024 } service lmtp { unix_listener /var/spool/postfix/private/dovecot-lmtp { group = postfix mode = 0600 user = postfix } } service managesieve-login { inet_listener sieve { address = [censored] port = 4190 } service_count = 1 } service managesieve { process_limit = 64 } ssl_cert = </etc/letsencrypt/live/fullchain.pem ssl_cipher_list = ECDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:ECDH+3DES:DH+3DES:RSA+AESGCM:RSA+AES:RSA+3DES:!aNULL:!MD5:!DSS ssl_dh = # hidden, use -P to show it ssl_key = # hidden, use -P to show it ssl_min_protocol = TLSv1.2 ssl_options = no_compression ssl_prefer_server_ciphers = yes # comment: since imap logins differ from email-addresses I have 2 # userdb queries. One will return fields for %u='login', the other will # return fields for %u='email(a)domain.tld'. # no %u will ever make BOTH userdbs return rows (they are mutually exclusive) userdb { args = /etc/dovecot/dovecot-sql.conf.email driver = sql } userdb { args = /etc/dovecot/dovecot-sql.conf.username driver = sql } protocol lmtp { mail_plugins = " quota acl sieve" } protocol imap { mail_plugins = " quota acl imap_sieve imap_quota imap_acl" } example userdb output: ======================= root@server:/# doveadm -Dv user jost Debug: Loading modules from directory: /usr/lib/dovecot/modules Debug: Module loaded: /usr/lib/dovecot/modules/lib01_acl_plugin.so Debug: Module loaded: /usr/lib/dovecot/modules/lib10_quota_plugin.so Debug: Loading modules from directory: /usr/lib/dovecot/modules/doveadm Debug: Module loaded: /usr/lib/dovecot/modules/doveadm/lib10_doveadm_acl_plugin.so Debug: Skipping module doveadm_expire_plugin, because dlopen() failed: /usr/lib/dovecot/modules/doveadm/lib10_doveadm_expire_plugin.so: undefined symbol: expire_set_deinit (this is usually intentional, so just ignore this message) Debug: Module loaded: /usr/lib/dovecot/modules/doveadm/lib10_doveadm_quota_plugin.so Debug: Module loaded: /usr/lib/dovecot/modules/doveadm/lib10_doveadm_sieve_plugin.so Debug: Skipping module doveadm_fts_lucene_plugin, because dlopen() failed: /usr/lib/dovecot/modules/doveadm/lib20_doveadm_fts_lucene_plugin.so: undefined symbol: lucene_index_iter_deinit (this is usually intentional, so just ignore this message) Debug: Skipping module doveadm_fts_plugin, because dlopen() failed: /usr/lib/dovecot/modules/doveadm/lib20_doveadm_fts_plugin.so: undefined symbol: fts_user_get_language_list (this is usually intentional, so just ignore this message) Debug: Skipping module doveadm_mail_crypt_plugin, because dlopen() failed: /usr/lib/dovecot/modules/doveadm/libdoveadm_mail_crypt_plugin.so: undefined symbol: mail_crypt_box_get_pvt_digests (this is usually intentional, so just ignore this message) field valuedoveadm(jost)<25290><>: Debug: auth USER input: jost home=/var/vmail/matysik.it/jost-philip uid=5000 gid=5000 acl_groups=matysik,admin quota_rule=*:storage=10G quota_rule2 = Trash:storage=+100M quota2 = count:shared quota for maschinen:ns=ZZZ_Freigaben/maschinen/ quota2_rule = *:storage=500M quota3 = count:shared quota for matysik:ns=ZZZ_Freigaben/matysik/ quota3_rule = *:storage=10G quota4 = count:shared quota for postmaster:ns=ZZZ_Freigaben/postmaster/ quota4_rule = *:storage=1G uid 5000 gid 5000 home /var/vmail/matysik.it/jost-philip mail maildir:~/Maildir acl_groups matysik,admin quota_rule *:storage=10G quota_rule2 Trash:storage=+100M quota2 count:shared quota for maschinen:ns=ZZZ_Freigaben/maschinen/ quota2_rule *:storage=500M quota3 count:shared quota for matysik:ns=ZZZ_Freigaben/matysik/ quota3_rule *:storage=10G quota4 count:shared quota for postmaster:ns=ZZZ_Freigaben/postmaster/ quota4_rule *:storage=1G

1 0

Create a malicious directory
by lty 20 May '19

20 May '19

Use scripts to create some malicious directories. Here is my creation process. How can I prevent the creation of these directories? I used the python imapclient script to create a directory. There may be no big threat to dovecot, but it is dangerous for doveadm.

4 3

Directory name have some malicious characters.
by hfh＠cndns.com 19 May '19

19 May '19

Directory name have some malicious characters, is it safe?How can I exclude some characters,thanks!

1 0

Plugins/Mailcrypt: mail_crypt_private_password not assigned by password_query
by Max Kostikov 19 May '19

19 May '19

I try to use Mailcrypt encrypted user keys with conjustion with dbsync replication(Dovecot 2.3.6 in FreeBSD 12.0 enviroment) but was unsuccessful. If I provide a password in mail_crypt_private_password variable directly in Dovecot config all things works as expected plugin { mail_crypt_curve = prime256v1 mail_crypt_save_version = 2 mail_crypt_require_encrypted_user_key = yes mail_crypt_private_password = 12345 } but when I remove this and trying to get the same user password in password_query it seems password doesn't assigned password_query = SELECT username AS user, password, \ '%w' AS userdb_mail_crypt_private_password \ FROM mailbox WHERE username = LCASE('%u') \ AND active = '1' with errors like this in log at server where message was accepted from remote system May 20 00:40:31 server1 dovecot[35417]: dsync-local(foo(a)example.com)<Y51qBF/b4VyHigAAJQnBKg>: Error: dsync(server1.example.com): read() failed: read(/var/mail/example.com/foo/new/1558305609.M674400P35456.server1.example… failed: Private key not available: Cannot decrypt key a4ceb2df0287c0c0ccb0d76e31d91824e1f13e9ffe63d1e04a9a233a073d8a64: Cannot decrypt key 5d19a9246ddce2759a21462974add562dd90f2cb2aa3ff6a5af1af1e3e9b58e6: Password not available (last sent=mail, last recv=mail_request (EOL)) and errors at replica server May 20 00:40:31 server2 dovecot[63985]: dsync-local(foo(a)example.com)<MpW+HV/b4VwD+wAAfP91Tw>: Error: dsync(server2.example.com): read() failed: read() failed: dot-input stream ends without '.' line (last sent=mail_request (EOL), last recv=mail) The question is it possible to have password encrypted user keys with Dovecot dbsync replication or we found a new bug? -- With best regards, Max Kostikov W: https://kostikov.co | DeltaChat: mk(a)eprove.net

1 0

Permission denied
by ＠lbutlr 19 May '19

19 May '19

mail dovecot: lda(user@domain)<955><rPK3B2Gr4Vy7AwAAIdGjjQ>: msgid=<4562Sm6YyYzvmrD(a)mail.covisp.net>: save failed to INBOX: Mailbox INBOX: open(/usr/local/virtual/user(a)domain/tmp/1558293345.M130062P955.mail.covisp.net) failed: Permission denied The permissions on /usr/local/virual have not changed and are still owed by user/group 89/89 dovecot-sql.conf.ext: user_query = select 89 as uid, 89 as gid, concat('/usr/local/virtual/', maildir) as home FROM mailbox where username = '%u' dovecot.conf: first_valid_uid = 89 # ls -lsdn /usr/local/virtual/ 8 drwx------ 29 89 89 1536 Mar 12 23:30 /usr/local/virtual/ # ls -lsdn /usr/local/virtual/backup\(a)southgaylord.com 184 drwx------ 2056 89 89 92672 May 19 12:43 /usr/local/virtual/user@domain Do I need to compile dovecot with vpopmail support? -- I WILL NOT DO THE DIRTY BIRD Bart chalkboard Ep. AABF08

1 0

Repo for RHEL8
by TG Servers 19 May '19

19 May '19

2 2

Merging existing mailboxes to aliases
by Lefteris Tsintjelis 19 May '19

19 May '19

I am trying to merge all, existing or not, different mailboxes in one with the mailbox alias plugin. If I add the following lines, will the existing mailboxes automatically merge in one mailbox and corresponding links auto create? If not, do I have to do this manually? mailbox_alias_new = Spam mailbox_alias_new2 = Junk E-mail mailbox_alias_new3 = Sent Items mailbox_alias_new4 = Sent Messages mailbox_alias_new5 = Deleted Items mailbox_alias_old = Junk mailbox_alias_old2 = Junk mailbox_alias_old3 = Sent mailbox_alias_old4 = Sent mailbox_alias_old5 = Trash Lefteris

3 4

Do we need ssl_dh_parameters_length in version 2.3
by MRob 19 May '19

19 May '19

Hi, I couldn't really find documentation about ssl_dh_parameters_length except for mention in passing on the page https://wiki2.dovecot.org/SSL/DovecotConfiguration For version 2.3 and above is that setting necessary? If so what are the values I can use, is setting it high like 4096 beneficial or make any problems for clients? Thanks for assistance.

2 1

Re: imap failing
by LuKreme 18 May '19

18 May '19

Ugh. Sorry about this, using gmail and it’s weird and annoying meant to send to list On Thu, May 16, 2019 at 00:46 LuKreme <kremels(a)kreme.com> wrote: > One more bit of info. After leaving s_client up for a bit, I got another > line > > CONNECTED(00000003) > 675481056:error:140790E5:SSL routines:ssl23_write:ssl handshake > failure:/usr/src/crypto/openssl/ssl/s23_lib.c:177: > --- > no peer certificate available > --- > No client certificate CA names sent > --- > SSL handshake has read 0 bytes and written 307 bytes > --- > New, (NONE), Cipher is (NONE) > Secure Renegotiation IS NOT supported > Compression: NONE > Expansion: NONE > No ALPN negotiated > SSL-Session: > Protocol : TLSv1.2 > Cipher : 0000 > Session-ID: > Session-ID-ctx: > Master-Key: > Key-Arg : None > PSK identity: None > PSK identity hint: None > SRP username: None > Start Time: 1557988789 > Timeout : 300 (sec) > Verify return code: 0 (ok) > --- > > I guess I wasn't patient enough before. But the certs are in the exact > same place as they've been all along and are working fine with apache. > I can also send mail, if that is at all relevant. (postconf -n is in > another post in this thread) > -- Sent from Gmail Mobile

3 3

Find last day of login
by Lefteris Tsintjelis 18 May '19

18 May '19

I am using dovecot virtual maildir accounts. Is it possible to find last day of login for an account by checking the last modification time of the maildir files? Lefteris

3 4

How to continuously gather statistics?
by Roel van Duijnhoven 17 May '19

17 May '19

Hello, I recently upgraded to the latest version of Dovecot, and want to use the newly introduced logging / event system. I want to fetch the statistics every couple of seconds, and push those to our logging platform. Metrics such as: number of IMAP commands, average time they took, etc. However the metrics as reported by Dovecot continously increment. So I see two solutions: - Our solution could keep track of the previous values. But that could also break if the statistics are reset for some reason (e.g. threshold reached). - My second thought was to use "stats -r". That *should* clear the statistics directly after fetching them. And thus, give a better picture. However I am not sure if this gives me actual useful results. Or is there maybe a better approach to fetch statistics that I overlooked? Thanks a lot. Best, Roel van Duijnhoven

2 1

Dovecot Separator change
by Oliver Werner 16 May '19

16 May '19

Hi community, actually we are using dovecot 2.2.27 without shares mailboxes. Now we would like to implement it. So the problem is that our separator is dot „.“ and the username like „firstname.surname“. That’s doesn’t works with shared mailboxes. Are there a migration guide for changing „.“ to „/„ or it's not possible? kind regards Oliver

1 0

File-dictionary based quotas and SETQUOTA
by Ganael Laplanche 16 May '19

16 May '19

Hello, I am trying to set up file-dictionary based quotas while supporting the SETQUOTA IMAP command. I am using the following configuration : ---- plugin { quota = dict:User quota::file:%h/Maildir/dovecot-quota quota_set = dict:file:%h/Maildir/dovecot-quota } ---- which enables correct quota accounting + setting through SETQUOTA. A user's dovecot-quota file ends with the following contents : ---- priv/quota/limit/storage 5242880 priv/quota/limit/messages 20 priv/quota/messages 1 priv/quota/storage 8506282 ---- which shows a correct accounting (1 mail received, ~8MB used) and correct setting after having used the following IMAP command through a master user : A2 SETQUOTA "User quota" (STORAGE 5242880 MESSAGE 20) *But* the problem is that I am unable to fetch the limits and consume them from userdb (as a consequence, the limits are never applied). On the consuming side, I am using a dictionary userdb to try to fetch the 'priv/quota/limit/storage' value from the file but it does not work because the key is never found. Here is my configuration : ---- userdb { driver = dict args = /etc/dovecot/dovecot-dict-quota.conf.ext } ---- and my dovecot-dict-quota.conf.ext file : ---- uri = file:%h/Maildir/dovecot-quota iterate_disable = yes key quota { key = priv/quota/limit/storage default_value = 100 } userdb_fields { quota_rule = *:storage=%{dict:quota} } ---- If I try to fetch the quota for that user : # doveadm quota get -u ganael.laplanche(a)centralesupelec.fr Quota name Type Value Limit % User quota STORAGE 8307 100 8307 User quota MESSAGE 1 - 0 the default rule is returned (100). The logs show : May 16 12:02:45 mailhost1-saclay dovecot: auth-worker(12899): Debug: dict(Ganael.Laplanche(a)centralesupelec.fr): Lookup: shared/priv/quota/limit/ storage not found, using default value 100 We can see that the default quota rule has been applied because the key is not found. The problem is that a "shared/" prefix is always prepended when looking for the key I configured (priv/quota/limit/storage). If I test the dictionary manually, the key is found : # doveadm dict get -u ganael.laplanche(a)centralesupelec.fr "file:/var/vmail/l/ laplanche_gan/Maildir/dovecot-quota" priv/quota/limit/storage 5242880 Does anyone know how to prevent Dovecot from adding that prefix and make it fetch the correct value from userdb ? Best regards, -- Ganael Laplanche <ganael.laplanche(a)centralesupelec.fr> Unix Systems Engineer @CentraleSupelec Rennes

1 0

Password database - external verification
by Richard Hector 16 May '19

16 May '19

Hi all, I'm currently using a PostgreSQL database for my user/password db, directly from dovecot. The trouble with that is that I'm stuck with whatever hash algorithms dovecot supports - which IIRC means (a subset of?) what libc has been compiled with, which can be a bit restrictive. So I'd like to use an external tool, which would also let me integrate other applications (eg web apps). PAM seems to be most suited to sharing accounts with the OS, which isn't what I want. BSDAuth likewise, but I'm not using BSD. CheckPassword looks like a somewhat convoluted protocol, but maybe the best bet? IMAP - well, that's circular :-) OAuth2 looks possible, but seems to be focused on http? Any suggestions? And recommended implementations? How hard is it to add extra methods? Thanks, Richard

2 2

Dovecot not connecting to OpenLDAP
by Elias Falconi 16 May '19

16 May '19

Hi, We recently shutdown our old LDAP server and repointed our mail server (dovecot + postfix) to our new LDAP server and ever since we've been unable to fetch mail. Mail is getting delivered, but we just can't pop it. We're using Ubuntu 16.04, btw. We keep on getting the following error messages in /var/log/dovecote: 2019-05-15 16:27:43 auth: Error: LDAP /etc/dovecot/dovecot-ldap.conf.ext: ldap_start_tls_s() failed: Can't contact LDAP server 2019-05-15 16:39:36 auth: Error: LDAP /etc/dovecot/dovecot-ldap.conf.ext: ldap_start_tls_s() failed: Connect error 2019-05-15 16:39:43 auth: Error: LDAP /etc/dovecot/dovecot-ldap.conf.ext: ldap_start_tls_s() failed: Local error However, our server is finding our LDAP users and postfix doesn't seem to have a problem, just Dovecot. Also, when we try to connect via Dovecot, we get the following message: -ERR [SYS/TEMP] Temporary authentication failure. [mail:2019-05-15 21:40:06] Our /etc/dovecot/dovecot.conf contains the following: ## Dovecot configuration file # If you're in a hurry, see http://wiki2.dovecot.org/QuickConfiguration # "doveconf -n" command gives a clean output of the changed settings. Use it # instead of copy&pasting files when posting to the Dovecot mailing list. # '#' character and everything after it is treated as comments. Extra spaces # and tabs are ignored. If you want to use either of these explicitly, put the # value inside quotes, eg.: key = "# char and trailing whitespace " # Most (but not all) settings can be overridden by different protocols and/or # source/destination IPs by placing the settings inside sections, for example: # protocol imap { }, local 127.0.0.1 { }, remote 10.0.0.0/8 { } # Default values are shown for each setting, it's not required to uncomment # those. These are exceptions to this though: No sections (e.g. namespace {}) # or plugin settings are added by default, they're listed only as examples. # Paths are also just examples with the real defaults being based on configure # options. The paths listed here are for configure --prefix=/usr # --sysconfdir=/etc --localstatedir=/var # Enable installed protocols !include_try /usr/share/dovecot/protocols.d/*.protocol # A comma separated list of IPs or hosts where to listen in for connections. # "*" listens in all IPv4 interfaces, "::" listens in all IPv6 interfaces. # If you want to specify non-default ports or anything more complex, # edit conf.d/master.conf. #listen = *, :: # Base directory where to store runtime data. #base_dir = /var/run/dovecot/ # Name of this instance. In multi-instance setup doveadm and other commands # can use -i <instance_name> to select which instance is used (an alternative # to -c <config_path>). The instance name is also added to Dovecot processes # in ps output. #instance_name = dovecot # Greeting message for clients. #login_greeting = Dovecot ready. # Space separated list of trusted network ranges. Connections from these # IPs are allowed to override their IP addresses and ports (for logging and # for authentication checks). disable_plaintext_auth is also ignored for # these networks. Typically you'd specify your IMAP proxy servers here. #login_trusted_networks = # Space separated list of login access check sockets (e.g. tcpwrap) #login_access_sockets = # With proxy_maybe=yes if proxy destination matches any of these IPs, don't do # proxying. This isn't necessary normally, but may be useful if the destination # IP is e.g. a load balancer's IP. #auth_proxy_self = # Show more verbose process titles (in ps). Currently shows user name and # IP address. Useful for seeing who are actually using the IMAP processes # (eg. shared mailboxes or if same uid is used for multiple accounts). #verbose_proctitle = no # Should all processes be killed when Dovecot master process shuts down. # Setting this to "no" means that Dovecot can be upgraded without # forcing existing client connections to close (although that could also be # a problem if the upgrade is e.g. because of a security fix). #shutdown_clients = yes # If non-zero, run mail commands via this many connections to doveadm server, # instead of running them directly in the same process. #doveadm_worker_count = 0 # UNIX socket or host:port used for connecting to doveadm server #doveadm_socket_path = doveadm-server # Space separated list of environment variables that are preserved on Dovecot # startup and passed down to all of its child processes. You can also give # key=value pairs to always set specific settings. #import_environment = TZ ## ## Dictionary server settings ## # Dictionary can be used to store key=value lists. This is used by several # plugins. The dictionary can be accessed either directly or though a # dictionary server. The following dict block maps dictionary names to URIs # when the server is used. These can then be referenced using URIs in format # "proxy::<name>". dict { #quota = mysql:/etc/dovecot/dovecot-dict-sql.conf.ext #expire = sqlite:/etc/dovecot/dovecot-dict-sql.conf.ext quota = ldap:/etc/dovecot/dovecot-ldap.conf.ext expire = ldap:/etc/dovecot/dovecot-ldap.conf.ext } # Most of the actual configuration gets included below. The filenames are # first sorted by their ASCII value and parsed in that order. The 00-prefixes # in filenames are intended to make it easier to understand the ordering. !include conf.d/*.conf # A config file can also tried to be included without giving an error if # it's not found: !include_try local.conf # Added by Elias protocols = pop3 imap #ssl_cert = </etc/ssl/certs/server.crt #ssl_key = </etc/ssl/private/server.key ssl_cert = </etc/ssl/certs/ssl-cert-snakeoil.pem ssl_key = </etc/ssl/private/ssl-cert-snakeoil.key log_path = /var/log/dovecote info_log_path = /var/log/dovecote_info log_timestamp = "%Y-%m-%d %H:%M:%S " #syslog_facility = mail_dovecote #ssl = no #mail_location = mbox:~/:INBOX=/var/mail/%u #namespace { # type = private # separator = . # inbox = yes #} mail_privileged_group = mail mail_full_filesystem_access = yes mail_debug = yes mmap_disable = yes mail_nfs_storage = yes mail_nfs_index = yes mail_fsync = always mbox_read_locks = dotlock mbox_write_locks = dotlock passdb ldap { driver = ldap # Path for LDAP configuration file args = /etc/dovecot/dovecot-ldap.conf.ext } userdb { driver=passwd } userdb ldap { driver = ldap # Path for LDAP configuration file args = /etc/dovecot/dovecot-ldap.conf.ext } And our /etc/dovecot/dovecot-ldap.conf.ext has this: # This file is commonly accessed via passdb {} or userdb {} section in # conf.d/auth-ldap.conf.ext # This file is opened as root, so it should be owned by root and mode 0600. # # http://wiki2.dovecot.org/AuthDatabase/LDAP # # NOTE: If you're not using authentication binds, you'll need to give # dovecot-auth read access to userPassword field in the LDAP server. # With OpenLDAP this is done by modifying /etc/ldap/slapd.conf. There should # already be something like this: # access to attribute=userPassword # by dn="<dovecot's dn>" read # add this # by anonymous auth # by self write # by * none # Space separated list of LDAP hosts to use. host:port is allowed too. hosts = 139.147.9.135 # LDAP URIs to use. You can use this instead of hosts list. Note that this # setting isn't supported by all LDAP libraries. #uris = ldaps://139.147.9.135 # Distinguished Name - the username used to login to the LDAP server. # Leave it commented out to bind anonymously (useful with auth_bind=yes). dn = cn=admin,dc=cs,dc=lafayette,dc=edu # Password for LDAP server, if dn is specified. dnpass = blahblah123 # Use SASL binding instead of the simple binding. Note that this changes # ldap_version automatically to be 3 if it's lower. Also note that SASL binds # and auth_bind=yes don't work together. #sasl_bind = no # SASL mechanism name to use. #sasl_mech = # SASL realm to use. #sasl_realm = # SASL authorization ID, ie. the dnpass is for this "master user", but the # dn is still the logged in user. Normally you want to keep this empty. #sasl_authz_id = # Use TLS to connect to the LDAP server. tls = yes # TLS options, currently supported only with OpenLDAP: #tls_ca_cert_file =/etc/ssl/certs/ldap.crt tls_ca_cert_file =/etc/ssl/certs/ldap6_cacert.pem #tls_ca_cert_dir =/etc/ssl/certs/ #tls_cipher_suite = # TLS cert/key is used only if LDAP server requires a client certificate. #tls_cert_file = /etc/ssl/certs/ldap01_slapd_cert.pem #tls_key_file = /etc/ssl/private/ldap01_slapd_key.pem # Valid values: never, hard, demand, allow, try #tls_require_cert = demand # Use the given ldaprc path. #ldaprc_path = # LDAP library debug level as specified by LDAP_DEBUG_* in ldap_log.h. # -1 = everything. You may need to recompile OpenLDAP with debugging enabled # to get enough output. #debug_level = 0 # Use authentication binding for verifying password's validity. This works by # logging into LDAP server using the username and password given by client. # The pass_filter is used to find the DN for the user. Note that the pass_attrs # is still used, only the password field is ignored in it. Before doing any # search, the binding is switched back to the default DN. auth_bind = yes # If authentication binding is used, you can save one LDAP request per login # if users' DN can be specified with a common template. The template can use # the standard %variables (see user_filter). Note that you can't # use any pass_attrs if you use this setting. # # If you use this setting, it's a good idea to use a different # dovecot-ldap.conf.ext for userdb (it can even be a symlink, just as long as # the filename is different in userdb's args). That way one connection is used # only for LDAP binds and another connection is used for user lookups. # Otherwise the binding is changed to the default DN before each user lookup. # # For example: # auth_bind_userdn = cn=%u,ou=people,o=org # #auth_bind_userdn = # LDAP protocol version to use. Likely 2 or 3. ldap_version = 3 # LDAP base. %variables can be used here. # For example: dc=mail, dc=example, dc=org base = ou=People,dc=cs,dc=lafayette,dc=edu # Dereference: never, searching, finding, always deref = never # Search scope: base, onelevel, subtree scope = subtree # User attributes are given in LDAP-name=dovecot-internal-name list. The # internal names are: # uid - System UID # gid - System GID # home - Home directory # mail - Mail location # # There are also other special fields which can be returned, see # http://wiki2.dovecot.org/UserDatabase/ExtraFields user_attrs = homeDirectory=home,uidNumber=uid,gidNumber=gid # Filter for user lookup. Some variables can be used (see # http://wiki2.dovecot.org/Variables for full list): # %u - username # %n - user part in user@domain, same as %u if there's no domain # %d - domain part in user@domain, empty if user there's no domain user_filter = (&(objectClass=posixAccount)(uid=%u)) # Password checking attributes: # user: Virtual user name (user@domain), if you wish to change the # user-given username to something else # password: Password, may optionally start with {type}, eg. {crypt} # There are also other special fields which can be returned, see # http://wiki2.dovecot.org/PasswordDatabase/ExtraFields pass_attrs = uid=user,userPassword=password # If you wish to avoid two LDAP lookups (passdb + userdb), you can use # userdb prefetch instead of userdb ldap in dovecot.conf. In that case you'll # also have to include user_attrs in pass_attrs field prefixed with "userdb_" # string. For example: #pass_attrs = uid=user,userPassword=password,\ # homeDirectory=userdb_home,uidNumber=userdb_uid,gidNumber=userdb_gid # Filter for password lookups pass_filter = (&(objectClass=posixAccount)(uid=%u)) # Attributes and filter to get a list of all users #iterate_attrs = uid=user #iterate_filter = (objectClass=posixAccount) # Default password scheme. "{scheme}" before password overrides this. # List of supported schemes is in: http://wiki2.dovecot.org/Authentication #default_pass_scheme = CRYPT What do you suppose could be the problem? Thanks, Elias

3 2