- dovecot - dovecot.org

SIS feature request
by Daniel Miller 20 Dec '18

20 Dec '18

I tried SIS a couple years ago - I was very excited with the resulting decrease in storage requirements but the undiagnosed intermittent issues became too significant to ignore so I switched away. Recently I was thinking about it again. The primary issue with SIS seemed to be links would be deleted even though the source attachment files and related mails still existed. It was possible to either manually re-build the links or have a script scan the mail error log and perform such. I haven't looked at the code - but a thought for a possible "temporary" fix: 1. Whatever function in dbox code that performs the deletion of links - prior to actually deleting call a new function that will verify if any mails exist that reference it. A new function, without modifying existing code, may catch something the existing functions don't - and if it logs the fact that it was called and found something...perhaps we can find the flaw in the original algorithm. Just a thought. 2. In the mail retrieval function, if the attachment link doesn't exist - perform the relevant scan through the attachment database and if found re-create the link automatically. This should log an error but indicate the recovery. -- Daniel

1 0

Intentionally use weak server key
by Stavros Tsolakos 20 Dec '18

20 Dec '18

Hi list! For some reason I need to use a really weak server key (256 bit) with dovecot for imaps access. Is this possible? I tried but getting this error: dovecot: imap-login: Error: SSL: Stacked error: error:04075070:rsa routines:RSA_sign:digest too big for rsa key This is on an Ubuntu 14.04 on x64. Thank you! Stavros

4 7

High Load average on NFS Spool - v.2.1.15 & 2.2.13
by Albert E. Whale, CEH CHS CISA CISSP 19 Dec '18

19 Dec '18

I have two servers pointing to an NFS mounted mail spool with dovecot. Since I recently switched from using Dovecot v1.X, I have been experiencing high CPU use with the two Dovecot servers. I am not certain why they are not well behaved. Here is the configuration information. This configuration is currently running at a load average of 17. /usr/sbin/dovecot -n # 2.1.15: /etc/dovecot/dovecot.conf # OS: Linux 3.10.54-server-2.mga3 i686 Mageia 3 base_dir = /var/run/dovecot/ disable_plaintext_auth = no lock_method = dotlock login_greeting = SpamZapper Email ready. login_log_format_elements = user=<%u> method=%m rip=%r lip=%l %c mail_debug = yes mail_fsync = always mail_location = maildir:~/Maildir mail_nfs_index = yes mail_nfs_storage = yes mail_privileged_group = mail mbox_lock_timeout = 15 mins mmap_disable = yes passdb { driver = pam } protocols = imap pop3 service anvil { client_limit = 203 process_limit = 1 } service auth { user = root } service imap-login { chroot = login client_limit = 10 user = dovecot vsz_limit = 256 M } service pop3-login { chroot = login client_limit = 20 user = dovecot } ssl = no syslog_facility = local2 userdb { driver = passwd } verbose_proctitle = yes protocol pop3 { mail_max_userip_connections = 20 pop3_logout_format = top=%t/%p, retr=%r/%b, del=%d/%m, size=%s pop3_uidl_format = %08Xv%08Xu } protocol lda { postmaster_address = postmaster(a)example.com } protocol imap { mail_max_userip_connections = 10 } And the other server which is currently running with a load average of 10. dovecot -n # 2.2.13: /etc/dovecot/dovecot.conf doveconf: Warning: service anvil { client_limit=100 } is lower than required under max. load (303) # OS: Linux 4.1.15-server-2.mga5 x86_64 Mageia 4 base_dir = /var/run/dovecot/ disable_plaintext_auth = no listen = * lock_method = dotlock login_greeting = SpamZapper Email ready. login_log_format_elements = user=<%u> method=%m rip=%r lip=%l %c mail_fsync = always mail_location = maildir:~/Maildir mail_nfs_index = yes mail_nfs_storage = yes mail_privileged_group = mail mmap_disable = yes passdb { driver = pam } protocols = imap pop3 service anvil { client_limit = 100 process_limit = 1 } service auth { user = root } service imap-login { chroot = login client_limit = 48 user = dovecot vsz_limit = 256 M } service pop3-login { chroot = login client_limit = 50 user = dovecot } ssl = no syslog_facility = local2 userdb { driver = passwd } verbose_proctitle = yes protocol pop3 { mail_max_userip_connections = 50 pop3_logout_format = top=%t/%p, retr=%r/%b, del=%d/%m, size=%s pop3_uidl_format = %08Xv%08Xu } protocol lda { postmaster_address = postmaster(a)example.com } protocol imap { mail_max_userip_connections = 40 } Can you please offer a suggestion on what is happening? The timeouts to the imap server are frequent due to the load average. Thank you. -- -- -- Albert E. Whale, CEH CHS CISA CISSP *President - Chief Info Security Officer* IT Security, Inc. <http://www.IT-Security-inc.com> - A Service Disabled Veteran Owned Company - (*SDVOSB*) *HUBZone Certified* LinkedIn <https://www.linkedin.com/in/albertwhale> Profile Phone: 412-515-3010 | Email: Albert.Whale(a)IT-Security-inc.com Cell: 412-889-6870

3 5

Re: How to configure Dovecot to disable NIST's curves and still rertain EECDH?
by Kurt Fitzner 19 Dec '18

19 Dec '18

My opinion is that security by RFC is not security, it's mommy medicine. Standards have had a terrible time keeping up with security realities. NITS's curves leak side channel information all over the place. I don't have details on what implementations are set to calculate the NIST curves in constant time, and that's not an easy feat to do anyway so I don't want to depend on implementations that say they are actually doing it the right way. Frankly I can't be bothered to keep up with that. There are better curves TODAY, so yes I intend to use them if I can find a way. Otherwise, I'll just keep EECDH disabled. I have EDH now, and I've not yet run into a client that doesn't support it. I want EECDH, but I won't use it without safe curves. I'm confident that EECDH with safe curves and a second choice of EDH will support any clients that are worth using. OpenSSL supports X25519, and that is half the battle. Is there a way to change the curve selection in Dovecot? On 2018-12-19 01:49, Tributh via dovecot wrote: > Do you really plan to do this? > RFC 8446 section 9.1: > A TLS-compliant application MUST support key exchange with secp256r1 > (NIST P-256) and SHOULD support key exchange with X25519 > > I think your idea could be not future proved. > > Beside that, how many mail-clients will remain usable with this cipher > selection? > > Torsten

2 1

How to configure Dovecot to disable NIST's curves and still rertain EECDH?
by Kurt Fitzner 19 Dec '18

19 Dec '18

I am interested in configuring Dovecot's TLS so as to retain forward secrecy, but eliminate all of NIST's elliptic curves. Besides being subject to side channel attacks [1], in some quarters there is a general distrust of NIST's curves and any of their other cryptographic primitives after the Dual EC DRBG debacle. >From what I can tell, the following will prevent the use of NIST's curves (along with other dangerous primitives) in Dovecot, but this is accomplished by simply disabling EECDH entirely. ssl_cipher_list = HIGH:!DSS:!EECDH:!ECDH:!SHA1:!aNULL:!eNULL:@STRENGTH This should still retain forward secrecy through the use of EDH, but this doesn't leave much in the way of allowable algorithms on my server: $ openssl ciphers -V 'HIGH:!DSS:!EECDH:!ECDH:!SHA1:!aNULL:!eNULL:@STRENGTH' 0x00,0x9F - DHE-RSA-AES256-GCM-SHA384 TLSv1.2 Kx=DH Au=RSA Enc=AESGCM(256) Mac=AEAD 0x00,0x6B - DHE-RSA-AES256-SHA256 TLSv1.2 Kx=DH Au=RSA Enc=AES(256) Mac=SHA256 0x00,0x9D - AES256-GCM-SHA384 TLSv1.2 Kx=RSA Au=RSA Enc=AESGCM(256) Mac=AEAD 0x00,0x3D - AES256-SHA256 TLSv1.2 Kx=RSA Au=RSA Enc=AES(256) Mac=SHA256 0x00,0x9E - DHE-RSA-AES128-GCM-SHA256 TLSv1.2 Kx=DH Au=RSA Enc=AESGCM(128) Mac=AEAD 0x00,0x67 - DHE-RSA-AES128-SHA256 TLSv1.2 Kx=DH Au=RSA Enc=AES(128) Mac=SHA256 0x00,0x9C - AES128-GCM-SHA256 TLSv1.2 Kx=RSA Au=RSA Enc=AESGCM(128) Mac=AEAD 0x00,0x3C - AES128-SHA256 TLSv1.2 Kx=RSA Au=RSA Enc=AES(128) Mac=SHA256 Is there a better way to do this? Is there a way to disable only the suspect NIST curves and still retain EECDH but with side-channel safe curves like X25519? Thanks, Kurt Fitzner Links: ------ [1] https://blog.cr.yp.to/20140323-ecdsa.html

2 1

Errors with missing links to files when using Single Instance Storage and zlib (Dovecot 2.3.4)
by Daniel Schütze 18 Dec '18

18 Dec '18

I'm running Dovecot 2.3.4 with Single Instance Storage (SIS) and zlib and I am frequently seeing errors where files are missing in the attachments directory even though the zipped file in the hash directory is actually there. This appears not to have been an issue in Dovecot 2.3.1 Requested output of the server below. The error looks like this in the log Dec 18 08:58:58 dovecot01 dovecot: imap(username)<3692><RKnPGEh9fC3AqAAB>: Error: Mailbox INBOX/FOLDER: UID=41: read(attachments-connector(zlib(/usr/home/vmail/mail/username//mdbox/storage/m.411))) failed: read(/usr/home/vmail/attachments/91/08/91085773a0774909207852b8f9c98dbe22fe5a31-e88ba0276aae135cd2050000d09efc50[base64:19 b/l]) failed: open(/usr/home/vmail/attachments/91/08/91085773a0774909207852b8f9c98dbe22fe5a31-e88ba0276aae135cd2050000d09efc50) failed: No such file or directory (FETCH BODY[]) I'm also seeing errors when replication fails dovecot: dsync-local(username)<bzg3MqjhGFxmFwAAzRvpBw>: Error: dsync(servername): read(attachments-connector(zlib(/usr/home/vmail/mail/username//mdbox/storage/m.413))) failed: read(/usr/home/vmail/attachments/45/42/4542dcf385f6b4a4dc8752b96db1d7ad8a8023d5-ac735007f6bd135c93440100cd1be907[base64:19 b/l]) failed: open(/usr/home/vmail/attachments/45/42/4542dcf385f6b4a4dc8752b96db1d7ad8a8023d5-ac735007f6bd135c93440100cd1be907) failed: No such file or directory (last sent=mail, last recv=mail (EOL)) It is not the case that every replication fail has a corresponding imap access fail. I am running Dovecot 2.3.4 on FreeBSD11.2 and I did not see this error on Dovecot 2.3.1 FreeBSD 10.4. Both installs had the same configuration for Dovecot. Both installs were made from source code and not packages (as the need for the non standard fts and mysql options). During my testing I had the 2.3.1 install receive mail and replicate to the 2.3.4 and that was working fine (except for tcp connection issues which I saw was fixed in the changelog). Unfortunately having gone into testing with real account and mail being sent to the 2.3.4 install I'm seeing the above errors. My clients are using Thunderbird on desktops and Roundcube for webmail. My users report they can see the e-mails fine in their webmail (Roundcube) and only Thunderbird is giving issues. I admit I don't know how this can be the case as both systems use the same account details. In everycase so far there is a file in the hashes directory I have hand crafted the missing file (i.e. link) using ln and this restores access in Thunderbird. Clearly this is an big issue for my install and I'd appreciate any help! At the moment it looks like my course will be to try and script creation (recreation?) of the links from the error logs (I've seen people talking about this online) but that isn't really what I'm after. DOVECOT CONFIG # 2.3.4 (0ecbaf23d): /usr/local/etc/dovecot/dovecot.conf # Pigeonhole version 0.5.4 (60b0f48d) # OS: FreeBSD 11.2-RELEASE-p5 amd64 # Hostname: dovecot01.cwa.uk.com dict { acl = mysql:/usr/local/etc/dovecot/dovecot-dict-sql.conf.ext } disable_plaintext_auth = no doveadm_password = # hidden, use -P to show it first_valid_uid = 145 last_valid_uid = 145 mail_access_groups = mail mail_attachment_dir = /usr/home/vmail/attachments mail_attachment_min_size = 64 k mail_gid = vmail mail_location = mdbox:~/mdbox:INDEX=/indexdisk/indexes/%n mail_plugins = " fts fts_solr acl zlib notify replication" mail_privileged_group = mail mail_uid = vmail managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext namespace { list = yes location = mdbox:%%h/mdbox:INDEXPVT=~/mdbox/shared/%%n prefix = shared/%%n/ separator = / subscriptions = yes type = shared } namespace inbox { inbox = yes location = mailbox Drafts { auto = subscribe special_use = \Drafts } mailbox Junk { auto = subscribe special_use = \Junk } mailbox Sent { auto = subscribe special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { auto = subscribe special_use = \Trash } prefix = type = private } passdb { args = /usr/local/etc/dovecot/dovecot-sql.conf.ext driver = sql } plugin { acl = vfile acl_shared_dict = proxy::acl fts = solr fts_autoindex = yes fts_solr = url=http://localhost:8983/solr/dovecot/ mail_replica = tcp:192.168.0.138:12345 replication_dsync_parameters = -d -l 30 -U sieve = ~/.dovecot.sieve sieve_dir = ~/sieve sieve_duplicate_default_period = 1h sieve_duplicate_max_period = 1d sieve_global_dir = /usr/home/vmail/sieve/global/ sieve_global_path = /usr/home/vmail/default.sieve sieve_vacation_default_period = 1d zlib_save = gz zlib_save_level = 6 } protocols = imap sieve service aggregator { fifo_listener replication-notify-fifo { user = vmail } unix_listener replication-notify { user = vmail } } service auth { unix_listener auth-userdb { mode = 0777 } } service dict { unix_listener dict { mode = 0600 user = vmail } } service doveadm { inet_listener { port = 12345 } } service replicator { process_min_avail = 1 unix_listener replicator-doveadm { mode = 0600 user = vmail } } ssl = no userdb { driver = prefetch } userdb { args = /usr/local/etc/dovecot/dovecot-sql.conf.ext driver = sql } protocol lda { mail_plugins = " fts fts_solr acl zlib notify replication sieve" submission_host = 192.168.0.1:25 } protocol imap { mail_plugins = " fts fts_solr acl zlib notify replication imap_acl imap_zlib" }

1 0

Change default mode for attachment files
by Олег Кривоносов 18 Dec '18

18 Dec '18

Hi I migrated my dovecot server from Maildir to mdbox with saving attachments to external files and enabled SIS a few days ago. Everything works fine except one issue. I have both virtual and system users. Dovecot saves attachments with mode 0600. So I catch such errors for system users: dovecot: lda(wasya): Error: fs-sis: Couldn't read hash file /var/mail/attachments/2e/dc/hashes/2edc6009bc9b6ba38febb581df03986dcaf134d9: Permission denied I want to fix this issue by changing default file mode to 0660 via group policy. I found such feature in the changelog (v2.1.rc2 2012-01-06): lib-fs: Added "mode" parameter to "posix" backend to specify mode for created files/dirs. Unfortunately I can't find any information about this feature in the dovecot documentation. Can I use it to setup mode 0660 for attachments in the dovecot configuration? uname -a Linux diplo.trueconf.ru 4.9.0-6-amd64 #1 SMP Debian 4.9.88-1+deb9u1 (2018-05-07) x86_64 GNU/Linux dovecot --version 2.2.27 (c0f36b0) 10-mail.conf dovecot configuration: mail_access_groups = vmail mail_location = mdbox:~/mdbox mdbox_preallocate_space = yes mdbox_rotate_interval = 1 weeks mdbox_rotate_size = 5 M mail_attachment_dir = /var/mail/attachments mail_attachment_min_size = 32k mail_attachment_fs = sis posix mail_attachment_hash = %{sha1} Thank you

1 0

Possible attack?
by Daniel Miller 18 Dec '18

18 Dec '18

I found an error in my log today... Dec 17 12:03:30 bubba dovecot: imap(user1(a)amfes.com)<23017><VzQFnjx9WNAKO2EC>: Error: fts_solr: received invalid uid '0' Dec 17 12:04:44 bubba dovecot: imap(user2(a)amfes.com)<25004><FeHDSj19i2ysOCn7>: Fatal: master: service(imap): child 25004 killed with signal 11 (core dumps disabled - https://dovecot.org/bugreport.html#coredumps) I've now enabled core dumps (I think) and restarted - if it comes back hopefully I can get a backtrace. But reading that fts_solr message, and some other comments, leads me to wonder - could this be caused by someone/thing trying to authenticate as root? On that theory - I tried doing so via telnet - and received: Dec 17 15:06:02 bubba dovecot: auth: Error: plain(ultradeitytypeperson(a)amfes.com,127.0.0.1,<4kQr0z99UMZ/AAAB>): user not found from any userdbs Dec 17 15:06:02 bubba dovecot: imap: Error: Authenticated user not found from userdb, auth lookup id=3522297857 (auth connected 1 msecs ago, handshake 0 msecs ago, request took 1 msecs, client-pid=29572 client-id=1) I have root's email aliased to a valid user's email. I'm not sure how I'm able to authenticate as root - there isn't a root user defined in my LDAP database and that should be the only auth backend enabled for Dovecot. Or do I need to explicitly block local users from /etc/passwd on the server? The only auth databases shown in doveconf -n: userdb { driver = prefetch } userdb { args = /usr/local/etc/dovecot/dovecot-ldap.conf.ext driver = ldap } passdb { args = /usr/local/etc/dovecot/master-users driver = passwd-file master = yes } passdb { args = /usr/local/etc/dovecot/dovecot-ldap.conf.ext driver = ldap } and "master-users" doesn't list root either. -- Daniel

1 0

Re: ECDSA client question
by Michael A. Peters 18 Dec '18

18 Dec '18

On 12/16/18 7:52 AM, Tributh via dovecot wrote: > > > Am 16.12.18 um 12:13 schrieb Michael A. Peters: >> Hi, for those who have adopted ECDSA, >> >> Are there still any commonly used IMAPS/POP3S clients that still can not >> handle ECDSA certificates? >> >> I know you can set up Dovecot dor dual cert, I am just trying to >> determine if there still is a real world need to. > > Nearly every client can handle ECDSA, but it depends on the size of the > certificate. > I used years ago ECDSA-384bit certificates, which covered most of the > clients. It came to the point to disable RSA in that time, but than came > Android7.0. This Version can only handle ECDSA-256bit certificates or RSA. > > The coverage of Android7.0 is still over 20%. Google reacted fast and > repaired this bug in 7.1, which is still not coming to most of the phones. > > Cheers > Torsten > Wow - My phone is running Android 6, I just checked with Dad - his phone (Motorola) is running Android 7.0 - the version with the bug. We don't replace phones just because new versions are available, we replace them when they stop working, and when we do we usually get refurbished because we hate how much electronic waste is in the world. I have to admit, the tin foil hat of mine just got an alert. We know there are unexplained constants in the NIST curves including P-256 - what if NSA was partially responsible for this bug (back room deal to avoid anti-trust prosecution, similar deal with IBM was made in the 70s I believe also involving cryptography) so that Android apps that use ECDSA (beyond just the mail client, e.g. chat apps) would use P-256 for compatibility and are maybe vulnerable to MITM for the key exchange. I want Ed25519 now.

2 1

Overrideing pop delete?
by ＠lbutlr 17 Dec '18

17 Dec '18

Is it possible to override the POP3 delete on download command and make sure that messages stay on the server for at least X hours or X days? It is important that the messages be around long enough to hit a snapshot cycle (using rsnapshot to backup ever hour). -- Greedo didn't shoot first, motherfucker!

3 7

Bug in IDLE implementation for virtual mailbox
by Pali Rohár 17 Dec '18

17 Dec '18

Hello! I found bug in Dovecot's IDLE implementation when virtual mailbox is in use. IDLE does not notify about new emails when email appears in newly created mailbox and IDLE was issued in virtual folder which matches "*" wildcard and that mailbox was created after opening virtual mailbox. This problem is present in version 2.2.34 which is available in Debian Stretch system with backports. Reproducer: 1. Create virtual "All" mailbox in Gmail-like style: $ cat All/dovecot-virtual * -Drafts -Spam -Trash ALL 2. Ensure that (real non-virtual) mailbox "Test" does not exist. 3. Create sieve rule which deliver some email to "Test" mailbox. require [ "fileinto", "mailbox" ]; ... fileinto :create "Test"; 4. Open dovecot imap connection, select virtual "All" mailbox and then enter IDLE command. 4. Send email which matches that sieve filter. Email will be processed by dovecot sieve. As "Test" mailbox does not exist, dovecot sieve would first create it and then deliver email into it. Now dovecot imap should notify IDLE client that new message into virtual "All" mailbox was delivered (as it collects emails from all - * - mailboxes). But dovecot for some unknown reason does not notify via IDLE that there is a new email. To get notifications, it is needed to re-open that "All" mailbox again. -- Pali Rohár pali.rohar(a)gmail.com

2 4

Downgrade dovecot if required
by Durga Prasad Malyala 17 Dec '18

17 Dec '18

Hello all, I have version 2.3.3-2 of dovecot and could see version 2.3.4-2 available from the repos. How is feedback after upgrade to 2.3.4-2? Any issues? Can I revert back to older version if I face any problems? Cheers/DP

2 1

ssh_dh?
by Daniel Miller 17 Dec '18

17 Dec '18

Don't know if this was corrected in 2.3.4 (haven't upgraded yet but didn't see it in the notes) - but in 2.3.3 I see this in my log: imap-login: Error: Diffie-Hellman key exchange requested, but no DH parameters provided. Set ssh_dh=</path/to/dh.pem So...either there's an undocumented feature of SSH-over-IMAP (that's Dovecot - always on the cutting edge!) or someone had a coffee shortage during a coding session... -- Daniel

5 5

Sieve scripts not backed up
by Marc Weustink 17 Dec '18

17 Dec '18

Hi all. I try to backup out sieve scripts through doveadm -o stats_writer_socket_path= backup -R -u marc -N tcp:<remote.host>:4191 All mail is backed up but no scripts. What am I doing wrong ? Thanks Marc doveconf -n # 2.3.4 (0ecbaf23d): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.4 (60b0f48d) # OS: Linux 4.4.0-137-generic x86_64 Ubuntu 16.04.5 LTS autofs # Hostname: xxx dict { acl = pgsql:/etc/dovecot/dovecot-dict-sql-local.conf.ext } doveadm_password = # hidden, use -P to show it mail_debug = yes mail_gid = vmail mail_home = /home/mail/backup/%n mail_location = maildir:/home/mail/backup/%n/mail mail_uid = vmail managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext namespace Shared { location = maildir:/home/mail/backup/Common/mail:INDEXPVT=/home/mail/backup/%n/mail/common prefix = Shared/ separator = / subscriptions = no type = public } namespace Users { list = children location = maildir:/home/mail/backup/%%n/mail:INDEXPVT=/home/mail/backup/%n/mail/shared/%%n prefix = Users/%%n/ separator = / subscriptions = no type = shared } namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = separator = / type = private } passdb { args = /etc/dovecot/dovecot-sql.conf.ext driver = sql } plugin { acl = vfile acl_shared_dict = proxy::acl sieve = file:~/sieve;active=~/.dovecot.sieve } protocols = sieve service auth { unix_listener auth-userdb { mode = 0777 } } service dict { unix_listener dict { group = vmail user = vmail } } ssl = no userdb { args = /etc/dovecot/dovecot-sql.conf.ext driver = sql }

2 1

Upgrade to 2.3.1 has failed
by C. Andrews Lavarre 17 Dec '18

17 Dec '18

Problem: We had Dovecot v2.2 working just fine under openSUSE Leap 42.3. But we upgraded openSUSE to Leap 15.0. In the process, Dovecot got upgraded from 2.2 to 2.3.1. It no longer works and I haven't figured out how to downgrade to the older working version. The key issue seems to be the change to requiring dh.pem and changing s sl_protocols to ssl_min_protocols. I think I've navigated both correctly, but it still doesn't work. The error is auth: Error: stats: open(old-stats-user) failed: Permission denied as a consequence of which we get imap-login: Error: Failed to initialize SSL server context: Can't load SSL certificate: There is no valid PEM certificate. We have followed the instructions at https://wiki.dovecot.org/S SL/DovecotConfiguration 1. We have created /etc/dovecot/dh.pem (yes it took five hours) 2. We have edited 10-ssl.conf as directed by the Wiki: ssl = yes ssl_cert = /etc/certbot/live/privustech.com/fullchain.pem ssl_key = /etc/certbot/live/privustech.com/privkey.pem ssl_dh = /etc/dovecot/dh.pem #(yes, it took five hours to create...) ssl_min_protocol = TLSv1 ssl_cipher_list = ALL:!kRSA:!SRP:!kDHd:!DSS:!aNULL:!eNULL:!EXPORT:!DES:!3DES:!MD5:!PSK:!RC4:!ADH:!LOW@STRENGTH ssl_prefer_server_ciphers = no 3. We have checked 10-ssl.conf against the 2.3 default at https://github.com/dovecot/core/blob/master/doc/example-config/conf.d/10-ss… 4. We do NOT include the less than (<) symbol before the paths because then dovecot fails to load complaining it cannot find the files. 5. we have checked all the pem keys, certificates, and dh files with cat, they all exist and are in the expected hash format. 6. We have followed the instructions to set their permissions root:root 0444 and 0400 accordingly. 7. We have rebooted the host. Any help or clues would be most appreciated. Kind regards, Andy

7 20

ECDSA client question
by Michael A. Peters 16 Dec '18

16 Dec '18

Hi, for those who have adopted ECDSA, Are there still any commonly used IMAPS/POP3S clients that still can not handle ECDSA certificates? I know you can set up Dovecot dor dual cert, I am just trying to determine if there still is a real world need to.

2 1

Plugins mailboxalias subfolders
by Marc Roos 16 Dec '18

16 Dec '18

This plugin does not work anymore when subfolders are created. https://wiki2.dovecot.org/Plugins/MailboxAlias

1 0

mailbox locking
by Victor Sudakov 16 Dec '18

16 Dec '18

Dear Colleagues, I use exim's appendfile transport, procmail and a local mutt on my system, they all (to my knowledge) use lockfiles when working with mboxes. However, `doveconf | grep lock` says dotlock_use_excl = yes lock_method = fcntl mail_max_lock_timeout = 0 mbox_dotlock_change_timeout = 2 mins mbox_lock_timeout = 5 mins mbox_read_locks = fcntl mbox_write_locks = dotlock fcntl pop3_lock_session = no Do I need to change anything in dovecot's default locking setup? Does it still use lockfiles on mboxes or not? There are some contradictory parameters IMHO. -- Victor Sudakov, VAS4-RIPE, VAS47-RIPN 2:5005/49@fidonet http://vas.tomsk.ru/

1 1

Re: Feature request SCRAM-SHA-256
by Aki Tuomi 16 Dec '18

16 Dec '18

> On 16 December 2018 at 11:06 Tributh <dovecot-user(a)tributh.net> wrote: > > > > > Am 16.12.18 um 09:42 schrieb Aki Tuomi: > > > >> On 16 December 2018 at 10:27 Tributh via dovecot <dovecot(a)dovecot.org> wrote: > >> > >> > >> Hi, > >> is that here the right place to make feature requests? > >> > >> dovecot supports as authentication mechanism > >> SCRAM-SHA-1 from RFC 5802 > >> which was updated to > >> SCRAM-SHA-256 in RFC 7677 > >> > >> Can SCRAM-SHA-256 be added to the authentication mechanisms? > >> > >> I would not like to request, that SCRAM-SHA-1 will be exchanged by > >> SCRAM-SHA-256, since several applications only support SCRAM-SHA-1 > >> > >> Regards > >> > >> Torsten > > > > Hi! > > > > Adding this is possible, it can even be done as a separate plugin. But I have to ask, why? Do you actually have clients that support this? > > > > Aki > > > Hi Aki, > let me first answer the second question. > Sadly I have no client which supports it, yet. > Here we have a chicken or the egg causality dilemma. > There was some communication with mail-client developers which stated > that they would start developing it, when they have a publicly usable > server to test against. > Now I hope that the most common IMAP server could be the one, which > gives this possibility. > Sadly, most communication is not publicly available. > > In the past CRAM-MD5 was very popular. When the insecurity came out, > everything just shifted to TLS, but that prevented not from sending a > plain password now. If a malicious actor is able to change DNS/TLS > endpoints, he will receive the plain passwords immediately. > I am not the expert in explaining how such an actor could do this. I > just wanted to have possibilities for everybody to prevent this possible > exposure of a plain password, which could than easily used abusively. > > I just hope for better security in the future. > > Regards Torsten > > We'll see if this could be added. Aki

1 0

Re: Feature request SCRAM-SHA-256
by Aki Tuomi 16 Dec '18

16 Dec '18

> On 16 December 2018 at 10:27 Tributh via dovecot <dovecot(a)dovecot.org> wrote: > > > Hi, > is that here the right place to make feature requests? > > dovecot supports as authentication mechanism > SCRAM-SHA-1 from RFC 5802 > which was updated to > SCRAM-SHA-256 in RFC 7677 > > Can SCRAM-SHA-256 be added to the authentication mechanisms? > > I would not like to request, that SCRAM-SHA-1 will be exchanged by > SCRAM-SHA-256, since several applications only support SCRAM-SHA-1 > > Regards > > Torsten Hi! Adding this is possible, it can even be done as a separate plugin. But I have to ask, why? Do you actually have clients that support this? Aki

2 1

Feature request SCRAM-SHA-256
by Tributh 16 Dec '18

16 Dec '18

Hi, is that here the right place to make feature requests? dovecot supports as authentication mechanism SCRAM-SHA-1 from RFC 5802 which was updated to SCRAM-SHA-256 in RFC 7677 Can SCRAM-SHA-256 be added to the authentication mechanisms? I would not like to request, that SCRAM-SHA-1 will be exchanged by SCRAM-SHA-256, since several applications only support SCRAM-SHA-1 Regards Torsten

1 0

[Fwd: Re: Upgrade to 2.3.1 has failed]
by C. Andrews Lavarre 16 Dec '18

16 Dec '18

Alexander hi. Aki caught the STARTTLS issue as well, I corrected it, but it still doesn't work. Enjoy your weekend. I intend to enjoy mine! :-) Thanks again for your time. Andy -------- Forwarded Message -------- From: C. Andrews Lavarre <alavarre(a)gmail.com> To: Aki Tuomi <aki.tuomi(a)open-xchange.com> Subject: Re: Upgrade to 2.3.1 has failed Date: Sat, 15 Dec 2018 15:08:58 -0500 Aki thank you again. If you and Alexander are stumped then surely I am too! I swear I didn't change anything, and indeed have tried going back to the backup of 10- ssl.conf, which worked under 2.2, but doesn't under 2.3 even after making the changes described in the upgrade documentation. All I did was change all the repositories to Leap 15.0 from Leap 42.3 and execute zypper dup. It took several hours to complete at which point everything works just fine, except that Dovecot was upgraded from 2.2.xxx? to 2.3.1 without my even agreeing to it... :-( This version 2.3.1 is the openSUSE repository offering for their Leap 15.0. I tried finding a rollback version yesterday—2.2.3, 2.2.9... I don't need all the bells and whistles, I just want it to work—but all had one kind of dependency hell or another... :-( What I've done in the meantime is to mount /home/alavarre/Maildir with sshfs, and then point KMail at it, so I can read and write email without dovecot, but it would be nice to fix it IDC... So maybe the right answer is to try the latest, perhaps in Tumbleweed... I'm usually allergic to self-compiling, I alway seem to find one dependency hell or another, but I'll go ahead and try anyhow. I'll let you know. In the meantime all the failed logins have put me in jail by the provider (Cox Cable) accusing me of being a spammer... :-( But for now I'll go have a gin and tonic and hit it again tomorrow... :-) Enjoy your weekend, and thank you again for your thoughts and time. Cheers, Andy On Sat, 2018-12-15 at 21:37 +0200, Aki Tuomi wrote: > There is still something wrong with your config. Btw if you are > compiling yourself you might want to use 2.3.4 > > We test the cert functionality in our ci tests so I am fairly > confident this is not a dovecot bug. > > Aki > >

1 0

Multiple SSL certs in a virtual Domain hosting environment
by The Doctor 15 Dec '18

15 Dec '18

I am trying to get this correct. ---------------- configuration ------------ # 2.0.0: dovecot.conf auth_cache_negative_ttl = 3600 s base_dir = /var/run/dovecot/ disable_plaintext_auth = no first_valid_uid = 100 info_log_path = /var/log/dovecot-info.log log_path = /var/log/dovecot.log listen = * login_log_format_elements = user=<%u> method=%m rip=%r lip=%l %c mail_debug=yes mail_location = mbox:~/mail:INBOX=/var/mail/%u mail_log_prefix = %Us(%u): mdbox_rotate_size = 2048 passdb { args = /etc/master.passwd driver = passwd-file } protocols = imap pop3 lmtp service auth { executable = /usr/dovecot2/libexec/dovecot/auth user = root } service imap-login { chroot = login client_limit = 256 inet_listener imap { address = 204.209.81.1, 127.0.0.1 port = 143 } inet_listener imaps { address = 204.209.81.1, 127.0.0.1 port = 993 ssl = yes } executable = /usr/dovecot2/libexec/dovecot/imap-login process_limit = 128 process_min_avail = 3 service_count = 1 user = dovecot ##vsz_limit = 1M } service imap { executable = /usr/dovecot2/libexec/dovecot/imap process_limit = 512 ##vsz_limit = 256 } ssl = yes ssl_cert = <//etc/ssl/certs/wilcard.nk.ca.2018.chain.cert ssl_cipher_list = ALL:!LOW:!SSLv2:!EXP:aNULL: !NULL : !RC2 : !RC4 : !SEED : !IDEA : !SSLv3 ssl_key = </etc/ssl/certs/wilcard.nk.ca.2018.key verbose_ssl = yes ssl_dh=</usr/dovecot2/etc/dovecot/ssl/dh.pem userdb { driver = passwd } userdb { args = /etc/passwd driver = passwd-file } protocol imap { imap_client_workarounds = delay-newmail tb-extra-mailbox-sep imap_idle_notify_interval = 120 s imap_logout_format = bytes=%i/%o imap_max_line_length = 65536 mail_max_userip_connections = 10 mail_plugin_dir = /usr/dovecot2/lib/dovecot/imap local_name imap.acebizventures.com { ssl_cert = </etc/ssl/certs/wildcard.acebizventures.com.2019.chain.cert ssl_cipher_list = ALL:!LOW:!SSLv2:!EXP:aNULL: !NULL : !RC2 : !RC4 : !SEED : !IDEA : !SSLv3 ssl_key = </etc/ssl/certs/wildcard.acebizventures.com.2019.key } ssl_cert = </etc/ssl/certs/wilcard.nk.ca.2018.chain.cert ssl_cipher_list = ALL:!LOW:!SSLv2:!EXP:aNULL ssl_key = </etc/ssl/certs/wilcard.nk.ca.2018.key ssl_dh=</usr/dovecot2/etc/dovecot/ssl/dh.pem verbose_ssl = yes } plugin { home=/usr/dovecot2 } service pop3-login { chroot = login client_limit = 256 inet_listener pop3 { address = 204.209.81.1 port = 110 } inet_listener pop3s { address = 204.209.81.1 port = 995 ssl = yes } executable = /usr/dovecot2/libexec/dovecot/pop3-login process_limit = 128 process_min_avail = 4 service_count = 1 user = dovecot } service pop3 { executable = /usr/dovecot2/libexec/dovecot/pop3 process_limit = 512 } protocol pop3 { pop3_no_flag_updates = yes pop3_enable_last = yes pop3_reuse_xuidl = yes pop3_lock_session = no pop3_uidl_format = %08Xu%08Xv pop3_save_uidl = no pop3_logout_format = top=%t/%p, retr=%r/%b, del=%d/%m, size=%s mail_max_userip_connections = 3 mail_plugins = $mail_plugins pop3_client_workarounds = outlook-no-nuls oe-ns-eoh ## oe6-fetch-no-newmail local_name pop3.acebizventures.com { ssl_cert = </etc/ssl/certs/wildcard.acebizventures.com.2019.chain.cert ssl_cipher_list = ALL:!LOW:!SSLv2:!EXP:aNULL: !NULL : !RC2 : !RC4 : !SEED : !IDEA : !SSLv3 ssl_key = </etc/ssl/certs/wildcard.acebizventures.com.2019.key } ssl_cert = </etc/ssl/certs/wilcard.nk.ca.2018.chain.cert ssl_cipher_list = ALL:!LOW:!SSLv2:!EXP:aNULL ssl_key = <//etc/ssl/certs/wilcard.nk.ca.2018.key ssl_dh=</usr/dovecot2/etc/dovecot/ssl/dh.pem verbose_ssl = yes } service lmtp { process_min_avail = 5 inet_listener lmtp { address = 204.209.81.1 127.0.0.1 port = 24 } executable = lmtp -L unix_listener lmtp { } } protocol lmtp { info_log_path = /var/log/dovecot-lmtp.log # use %Ln to strip away the domain part auth_username_format = %Lu } } End configuration. Is it possible to listen on a A.B.C.0/24 ? Anything else to get virtual multiple SSLs to work? Unique domains on each SSL. -- Member - Liberal International This is doctor@@nl2k.ab.ca Ici doctor@@nl2k.ab.ca Yahweh, Queen & country!Never Satan President Republic!Beware AntiChrist rising! https://www.empire.kred/ROOTNK?t=94a1f39b Look at Psalms 14 and 53 on Atheism Merry Christmas 2018 and Happy New Year 2019!!

1 0

Downloading e-mail from a master mail server
by R. Diez 14 Dec '18

14 Dec '18

Hi all: I am trying to migrate a small company from Microsoft Exchange / Outlook to Thunderbird. I am evaluating e-mail server software. We have an Internet provider that we do not really want to rely upon. We also do not have the resources to maintain a mail server visible from the outside, especially regarding security updates. Each employee has an e-mail account on our current Internet provider, and one e-mail account on our internal Exchange Server. Our Exchange server periodically downloads all e-mails from the Internet provider mailboxes to its local mailboxes. Therefore, employees cannot access their e-mails when travelling. We have worked this way for years without problems. There are other ways, like VPN access etc, but we do not have the resources to install or maintain more IT stuff. So I would like to keep this setup, with one important difference: e-mails on the Internet provider mailboxes should remain there for a couple of weeks. This is similar to Thunderbird's option "Leave a copy on server" together with "For at most xx days". This way, employees could access at least their most recent e-mails when travelling, if only over the Internet provider's web interface. I could achieve such a setup without a local mail server at all, only with the Thunderbird clients, but I have not figured out yet how to automatically backup all mailboxes. See this question of mine: https://support.mozilla.org/en-US/questions/1243605 So I am trying to design a solution with Dovecot, but I know too little about mail servers. How could I configure Dovecot / MTAs / whatever in order to achieve the "Leave a copy on server" together with "For at most xx days" mentioned above? This way, Dovecot does not need to be exposed on the Internet. Failing that, could someone tell me at least how to configure Dovecot / whatever to download the external IMAP mailboxes to the internal IMAP mailboxes? When I read about Postfix and the like, I see SMTP and e-mail queues, but that's not what I need. This guy wants a similar setup: https://serverfault.com/questions/500591/fetch-all-mail-from-an-imap-server… But I did not understand the Fetchmail part, which seems to be discouraged anyway: "Fetchmail can be used as a POP/IMAP-to-SMTP gateway for an entire DNS domain, collecting mail from a single drop box on an ISP and SMTP-forwarding it based on header addresses. (We don't really recommend this, though, as it may lose important envelope-header information. ETRN or a UUCP connection is better.)" I also haven't understood yet the backup part with Dovecot. There is no central e-mail database like in Microsoft Exchange, right? How do I backup all mailboxes for all users? I probably need to stop the Dovecot server an any MTAs before backing the raw files underneath, right? Many thanks in advance, rdiez

2 1

Dovecot IMAP connections
by j.emerlik 11 Dec '18

11 Dec '18

What exactly means "deinit". Yesterday I had all IMAP processes with word "deinit" in brackets and dovecot reached the limit of processes. I had to do a restart of the process. eg.: dovecot 32482 0.0 0.0 24832 4256 ? S 03:29 0:00 dovecot_host1/imap [pierrot xxx.xxx.xx.xx (deinit)] Dovecot version 2.2.32. Regards, Jack

1 1

dovecot user id and mail folder permissions, was "no shared cipher"
by Marco Fioretti 11 Dec '18

11 Dec '18

Greetings, I thought it may be better to start a separate thread now that the cipher problem is solved. Background: I have had to recreate from scratch, and without notice, a working server to a new VPS, with different versions of dovecot and other software. Now I am having problems with accessing the imap folders from home. Now I have postfix/procmail successfully delivering email to the right IMAP folders. Problem is, postfix/procmail run as user mail_manager, group mail_management, and the permissions on those folders are currently all set to 755. The consequence is that dovecot, running as user "dovecot", extra group mail_management, cannot modify those folders and their indexes. What is the best/safest configuration in these cases? 1) run dovecot too as user "mail_manager"? (if yes, how, with dovecot 2.2.36?) 2) recursively change permissions of ALL the mail folders and files to 775? 3) both 1) and 2) ? 4) other (e.g. certain permissions for folders, others for specific files? Thanks in advance for any advice! Marco

1 0

"no shared cypher", no matter what I try
by Marco Fioretti 11 Dec '18

11 Dec '18

Greetings, I have had to reinstall my email server on another Linux (centos 7.6) VPS, with a newer version of dovecot, other software and a brand new letsencrypt certificate just for email withpostfix and dovecot (that certificate works fine with postfix). Output of dovecot --version and dovecot -n on the new server is below. Now, messages ARE delivered in the right IMAP mailboxes, but when I try to connect with Mutt from my home computer, mutt says, before prompting for a password: gnutls_handshake: A TLS fatal alert has been received.(Handshake failed) the corresponding output of dovecot in /var/log/maillog is below. The gist of it **seems** to me to be the "no shared cipher" part, but I may be wrong. In any case, I have already tried to search online for that string, and other relevant parts of the log, without success. All I have found is suggestions to change the values of ssl_protocols and/or ssl_cipher_list to some non-default value, but I have tried all those tips without success. Current values of those variables are these: grep -v ^# /etc/dovecot/conf.d/10-ssl.conf ssl_cert = </etc/letsencrypt/live/MYSERVERNAME/fullchain.pem ssl_key = </etc/letsencrypt/live/MYSERVERNAME/privkey.pem ssl_protocols = !SSLv2 !SSLv3 ssl_cipher_list = ALL:!ADH:!LOW:!EXP:!aNULL:+HIGH:+MEDIU any pointer to what to check or change next is VERY welcome. Thanks in advance, Marco ################################################# Dec 8 10:53:43 MYSERVERNAME dovecot: imap-login: Debug: SSL: where=0x10, ret=1: before/accept initialization [47.53.159.60] Dec 8 10:53:43 MYSERVERNAME dovecot: imap-login: Debug: SSL: where=0x2001, ret=1: before/accept initialization [47.53.159.60] Dec 8 10:53:43 MYSERVERNAME dovecot: imap-login: Warning: SSL alert: where=0x4008, ret=552: fatal handshake failure [47.53.159.60] Dec 8 10:53:43 MYSERVERNAME dovecot: imap-login: Debug: SSL: where=0x2002, ret=-1: error [47.53.159.60] Dec 8 10:53:43 MYSERVERNAME dovecot: imap-login: Debug: SSL: where=0x2002, ret=-1: error [47.53.159.60] Dec 8 10:53:43 MYSERVERNAME dovecot: imap-login: Debug: SSL error: SSL_accept() failed: error:1408A0C1:SSL routines:ssl3_get_client_hello:no shared cipher Dec 8 10:53:43 MYSERVERNAME dovecot: imap-login: Disconnected (disconnected before auth was ready, waited 0 secs): user=<>, rip=47.53.159.60, lip=116.202.20.216, TLS handshaking: SSL_accept() failed: error:1408A0C1:SSL routines:ssl3_get_client_hello:no shared cipher, session=<knICtX98UK4vNZ88> Dec 8 10:53:43 MYSERVERNAME dovecot: auth: Debug: Loading modules from directory: /usr/lib64/dovecot/auth Dec 8 10:53:43 MYSERVERNAME dovecot: auth: Debug: Module loaded: /usr/lib64/dovecot/auth/lib20_auth_var_expand_crypt.so Dec 8 10:53:43 MYSERVERNAME dovecot: auth: Debug: Module loaded: /usr/lib64/dovecot/auth/libdriver_sqlite.so Dec 8 10:53:43 MYSERVERNAME dovecot: auth: Debug: Read auth token secret from /var/run/dovecot/auth-token-secret.dat Dec 8 10:53:43 MYSERVERNAME dovecot: auth: Debug: passwd-file /etc/imap.v_users: Read 1 users in 0 secs ################################################# dovecot --version 2.2.36 (1f10bfa63) # 2.2.36 (1f10bfa63): /etc/dovecot/dovecot.conf # OS: Linux 3.10.0-957.1.3.el7.x86_64 x86_64 CentOS Linux release 7.6.1810 (Core) ext4 # Hostname: MYSERVERNAME auth_debug = yes auth_mechanisms = plain login auth_verbose = yes mail_location = maildir:/var/mail//base/ passdb { args = /etc/imap.v_users driver = passwd-file } service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0660 user = postfix } } service imap-login { inet_listener imap { port = 0 } inet_listener imaps { port = 993 } } ssl = required userdb { args = /etc/imap.v_users driver = passwd-file } verbose_ssl = yes

6 12

Log sync error
by Jakobus Schürz 11 Dec '18

11 Dec '18

Hi there! I get a lot of errormessages. My dovecot is: dovecot-core 2:2.3.2.1-1~stretch from Debian stable. I found this: https://www.dovecot.org/list/dovecot/2013-July/091648.html So the bug came back... The Log is attached Thanks Jakob

1 1

Replication Error - Trying to Interate Users
by Antonino Sidoti 11 Dec '18

11 Dec '18

HI, My first post to this list; I am trying to configure replication between two host, both hosts are having the same errors. Using ‘dovecot log errors’ gives the following errors; Dec 11 18:05:12 Error: auth: Trying to iterate users, but userdbs don't support it (created 0 msecs ago, handshake 0 msecs ago) Dec 11 18:05:12 Error: replicator: User listing returned failure Dec 11 18:05:12 Error: replicator: listing users failed, can't replicate existing data My version of Dovecot version = 2.2.36 My Configuration is attached. Any help is greatly appreciated. Thanks

2 1

Indexer worker small bug
by André Rodier 11 Dec '18

11 Dec '18

Hello, I think I submitted this before, but I am not sure this has been addressed I am using AppArmor with Dovecot, without any issue. However, I think there is a bug in the indexer working, from what I can see, a missing trailing slash. See: ------------ Dec 09 14:35:53 portal2 kernel: audit: type=1400 audit(1544366153.379:3035): apparmor="DENIED" operation="file_mmap" info="Failed name lookup - disconnected path" error=-13 profile="/usr/lib/dovecot/indexer-worker" name="var/cache/nscd/hosts" pid=10540 comm="indexer-worker" requested_mask="r" denied_mask="r" fsuid=1001 ouid=0 ------------ The indexer worker is trying to open the file "var/cache/nscd/hosts" instead of "/var/cache/nscd/hosts", which of course fails. Can someone double check the code of the indexer worker, or this has been fixed? Thanks, André -- https://github.com/progmaticltd/homebox

3 5

QUERY string clarification
by Ralf Hildebrandt 10 Dec '18

10 Dec '18

The manpage https://wiki.dovecot.org/Tools/Doveadm/SearchQuery specifies: BODY string Matches messages, which contain string in the body part. and a bit further down: TEXT string Matches messages, which contain string in the message body. Where's the difference? -- Ralf Hildebrandt Geschäftsbereich IT | Abteilung Netzwerk Charité - Universitätsmedizin Berlin Campus Benjamin Franklin Hindenburgdamm 30 | D-12203 Berlin Tel. +49 30 450 570 155 | Fax: +49 30 450 570 962 ralf.hildebrandt(a)charite.de | https://www.charite.de

2 1

Replication fatal error
by admin 10 Dec '18

10 Dec '18

Dear suscribers. I just dont understand this error. Don't know where to look first. If someone have already meet this problem... Dec 10 16:06:17 prudence dovecot: dsync-server(address(a)domain.fr): Panic: file dsync-brain-mailbox.c: line 370 (dsync_brain_sync_mailbox_deinit): assertion failed: (brain->failed) Dec 10 16:06:17 prudence dovecot: dsync-server(address(a)domain.fr): Error: Raw backtrace: /usr/lib/dovecot/libdovecot.so.0(+0xa0112) [0x7f2c66f62112] -> /usr/lib/dovecot/libdovecot.so.0(+0xa020a) [0x7f2c66f6220a] -> /usr/lib/dovecot/libdovecot.so.0(i_fatal+0) [0x7f2c66ef21d8] -> dovecot/doveadm-server(dsync_brain_sync_mailbox_deinit+0x1b0) [0x5587f89936b0] -> dovecot/doveadm-server(dsync_brain_slave_recv_mailbox+0x417) [0x5587f8994447] -> dovecot/doveadm-server(dsync_brain_run+0x286) [0x5587f8991a86] -> dovecot/doveadm-server(+0x430d9) [0x5587f89920d9] -> dovecot/doveadm-server(+0x595cf) [0x5587f89a85cf] -> /usr/lib/dovecot/libdovecot.so.0(io_loop_call_io+0x52) [0x7f2c66f781a2] -> /usr/lib/dovecot/libdovecot.so.0(io_loop_handler_run_internal+0x12e) [0x7f2c66f7984e] -> /usr/lib/dovecot/libdovecot.so.0(io_loop_handler_run+0x36) [0x7f2c66f78236] -> /usr/lib/dovecot/libdovecot.so.0(io_loop_run+0x38) [0x7f2c66f783e8] -> dovecot/doveadm-server(+0x27eed) [0x5587f8976eed] -> dovecot/doveadm-server(+0x298cd) [0x5587f89788cd] -> dovecot/doveadm-server(+0x3f30b) [0x5587f898e30b] -> /usr/lib/dovecot/libdovecot.so.0(io_loop_call_io+0x52) [0x7f2c66f781a2] -> /usr/lib/dovecot/libdovecot.so.0(io_loop_handler_run_internal+0x12e) [0x7f2c66f7984e] -> /usr/lib/dovecot/libdovecot.so.0(io_loop_handler_run+0x36) [0x7f2c66f78236] -> /usr/lib/dovecot/libdovecot.so.0(io_loop_run+0x38) [0x7f2c66f783e8] -> /usr/lib/dovecot/libdovecot.so.0(master_service_run+0x13) [0x7f2c66efc9f3] -> dovecot/doveadm-server(main+0x1b5) [0x5587f89691c5] -> /lib/x86_64-linux-gnu/libc.so.6(__libc_start_main+0xe7) [0x7f2c66af2b97] -> dovecot/doveadm-server(_start+0x2a) [0x5587f896928a] Dec 10 16:06:17 prudence dovecot: dsync-server(address(a)domain.fr): Fatal: master: service(doveadm): child 22362 killed with signal 6 (core dumped) server 1 dovecot configuration (version 2.2.9): default_client_limit = 2048 default_process_limit = 2048 disable_plaintext_auth = no doveadm_password = xxxxxxxxxxx doveadm_port = 11225 hostname = xxxxxxxxxxxx listen = 127.0.0.1,XX.XX.XX.XX mail_location = maildir:/srv/mail/%d/%n/Maildir mail_plugins = " notify replication" managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date ihave namespace inbox { inbox = yes location = mailbox Drafts { auto = subscribe special_use = \Drafts } mailbox Junk { auto = subscribe special_use = \Junk } mailbox Sent { auto = subscribe special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { auto = subscribe special_use = \Trash } prefix = } passdb { args = /etc/dovecot/dovecot-sql.conf.ext driver = sql } plugin { mail_replica = tcp:xxxxxxxxx:11225 sieve = ~/.dovecot.sieve sieve_default = /etc/dovecot/sieve/Ingenie.sieve sieve_default_name = Ingenie sieve_dir = ~/sieve sieve_max_redirects = 0 sieve_vacation_dont_check_recipient = yes } postmaster_address = admin(a)ingenie.fr protocols = " imap lmtp sieve pop3" service aggregator { fifo_listener replication-notify-fifo { user = vmail } unix_listener replication-notify { user = vmail } } service auth { unix_listener /var/spool/postfix-submission/private/dovecot-auth { group = postfix mode = 0600 user = postfix } } service doveadm { inet_listener { address = XX.XX.XX.XX port = 11225 } vsz_limit = 100 M } service lmtp { inet_listener lmtp { address = 127.0.0.1 port = 11125 } } service replicator { process_min_avail = 1 unix_listener replicator-doveadm { group = vmail mode = 0600 user = vmail } } ssl_ca = </etc/ssl/ingenie.fr/cacrt.pem ssl_cert = </etc/ssl/ingenie.fr/crt.pem ssl_key = </etc/ssl/ingenie.fr/key.pem submission_host = 127.0.0.1:10025 userdb { driver = prefetch } userdb { args = /etc/dovecot/dovecot-sql.conf.ext driver = sql } protocol lmtp { mail_plugins = " sieve" } protocol imap { mail_max_userip_connections = 500 } protocol sieve { mail_max_userip_connections = 500 } protocol pop3 { mail_max_userip_connections = 50 } server 2 configuration (2.2.33.2 (d6601f4ec)) disable_plaintext_auth = no doveadm_password = # hidden, use -P to show it doveadm_port = 11225 hostname = xxxxxxxxxx listen = XX.XX.XX.XX mail_location = maildir:/srv/mail/%d/%n/Maildir mail_plugins = " notify replication" mail_privileged_group = mail managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date ihave namespace inbox { inbox = yes location = mailbox Drafts { auto = subscribe special_use = \Drafts } mailbox Junk { auto = subscribe autoexpunge = 30 days special_use = \Junk } mailbox Sent { auto = subscribe special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { auto = subscribe autoexpunge = 30 days special_use = \Trash } prefix = } passdb { args = /etc/dovecot/sql.conf driver = sql } plugin { mail_replica = tcp:xxxxxxxx:11225 sieve = ~/.dovecot.sieve sieve_default = /etc/dovecot/sieve/Ingenie.sieve sieve_default_name = Ingenie sieve_dir = ~/sieve sieve_max_redirects = 0 sieve_vacation_dont_check_recipient = yes } postmaster_address = admin(a)ingenie.fr protocols = " imap lmtp sieve pop3 sieve" service aggregator { fifo_listener replication-notify-fifo { user = vmail } unix_listener replication-notify { user = vmail } } service auth { unix_listener /var/spool/postfix-submission/private/dovecot-auth { group = postfix mode = 0600 user = postfix } } service doveadm { inet_listener { address = XX.XX.XX.XX port = 11225 } vsz_limit = 100 M } service lmtp { inet_listener lmtp { address = 127.0.0.1 port = 11125 } } service replicator { process_min_avail = 1 unix_listener replicator-doveadm { group = vmail mode = 0600 user = vmail } } ssl_ca = </etc/ssl/ingenie.fr/cacrt.pem ssl_cert = </etc/ssl/ingenie.fr/crt.pem ssl_client_ca_dir = /etc/ssl/certs ssl_key = # hidden, use -P to show it userdb { driver = prefetch } userdb { args = /etc/dovecot/sql.conf driver = sql } protocol lmtp { mail_plugins = " sieve" } Thanks for considering my request.

3 2

set seen flag and junk moving a mail manually to JUNK
by Jakobus Schürz 10 Dec '18

10 Dec '18

Hi there! I want to set the \seen and the Junk Flag to an email, which i move manually to my Junk-Folder. I tried a lot... but nothing worked like expected. I have a sieve-filter, which takes an email and copy it to a pipe to rspamc. This filter is working correctly, i get a debug-message from the script, which is called through the sieve-filter. But adding another rule (addflag "Junk"; setflag "\\seen";) to this rule is getting ignored... Here is my sieve-rule: require ["imap4flags", "vnd.dovecot.pipe", "copy", "imapsieve", "environment", "variables"]; if environment :matches "imap.email" "*" { set "email" "${1}"; } addflag "Junk"; setflag "\\seen"; pipe :copy "learn-spam.sh" [ "${email}" ]; How said before, the script learn-spam.sh is called, when i move a Message via drag&drop in thunderbird from the INBOX to the Junk-Folder. But the message in the Junk-Folder is unseen, recent and has no Junk-Flag... What's wrong? BR Jakob

8 37

Sieve notify variables not working with body?
by Bambero 09 Dec '18

09 Dec '18

Hi, I want to send notification like this: if body :text :matches "*" { notify :importance "3" :message "[NOTIFY] ${1}" "mailto:test@example,com"; } The notification works but the variable ${1} seems to be empty. But in this case: if header :matches "Subject" "*" { notify :importance "3" :message "[NOTIFY] ${1}" "mailto:test@example,com"; } Everything works correct. Regards, Bambero

2 3

Mail aliases plugin not honouring namespace?
by Marc Roos 08 Dec '18

08 Dec '18

I have namespace { disabled = no hidden = no ignore_on_failure = no inbox = yes list = yes location = prefix = separator = / subscriptions = yes type = private } namespace Archive { disabled = no hidden = no ignore_on_failure = no inbox = no list = yes location = mbox:/home/mail-archive/%u/ prefix = Archive/ separator = / subscriptions = yes type = private } Without aliases, folders are created at /home/mail-archive/%u/ which is expected When I am adding these mailbox aliases mailbox_alias_old = Archive mailbox_alias_new = Archives These folders are created in the default namespace .Archive .Archives.2018 .Archives Is this as expected? I am at least not expecting it.

1 0

Plugins/MailboxAlias configuration not working when not successive
by Marc Roos 08 Dec '18

08 Dec '18

This is not working because the numbering is not successive. This whole configuration implementation is of course nothing to be proud of. plugin { #setting_name = value # archive folder mailbox_alias_old = Archive mailbox_alias_new = Archief mailbox_alias_old2 = Archive mailbox_alias_new2 = Archief mappen mailbox_alias_old3 = Archive mailbox_alias_new3 = Archived messages mailbox_alias_old4 = Archive mailbox_alias_new4 = Archived mail mailbox_alias_old5 = Archive mailbox_alias_new5 = Archives # spam folder mailbox_alias_old10 = Spam mailbox_alias_new10 = Junk mailbox_alias_old11 = Spam mailbox_alias_new11 = Junk E-mail mailbox_alias_old12 = Spam mailbox_alias_new12 = Ongewenste e-mail # drafst folder mailbox_alias_old20 = Drafts mailbox_alias_new20 = Concepten } https://wiki2.dovecot.org/Plugins/MailboxAlias

2 1

doveadm move and create folders for the archive
by Michael Wagner 08 Dec '18

08 Dec '18

Hello guys, I'm on a few mailinglists, which I want to archive at the end of the year. I know the command to do this, but must I create the folders for the archive by myself or is there a switch for doveadm? I tested this, but it exits with an error about the missing mailbox. doveadm -D copy -u michael Archiv/debian-user/2018 mailbox debian-user since 365d error message: doveadm(michael): Debug: Effective uid=1000, gid=1000, home=/home/michael doveadm(michael): Debug: Namespace inbox: type=private, prefix=, sep=, inbox=yes, hidden=no, list=yes, subscriptions=yes location=maildir:~/Maildir:LAYOUT=fs doveadm(michael): Debug: fs: root=/home/michael/Maildir, index=, indexpvt=, control=, inbox=/home/michael/Maildir, alt= doveadm(michael): Error: Can't open mailbox 'Archiv/debian-user/2018': Mailbox doesn't exist: Archiv/debian-user/2018 Sorry for the long lines. Tia Michael -- Psychoceramics: The study of crackpots.

3 2

Segfault when using doveadm batch -A : kick
by Apollon Oikonomopoulos 08 Dec '18

08 Dec '18

Hi, Apparently the "kick" doveadm_cmd_ver2 struct lacks a .mail_cmd member pointing to an appropriate allocation function, causing a NULL pointer dereference when used via `doveadm batch`. (gdb) bt #0 0x0000000000000000 in ?? () #1 0x0000555555585882 in doveadm_mail_cmd_init (cmd=cmd@entry=0x7fffffffe680, set=0x5555555f2440) at doveadm-mail.c:596 #2 0x0000555555586f68 in cmd_batch_add (argv=<optimized out>, argc=<optimized out>, batchctx=0x555555606538) at doveadm-mail-batch.c:78 #3 cmd_batch_preinit () at doveadm-mail-batch.c:126 #4 0x00005555555854ce in doveadm_mail_cmd_exec () at doveadm-mail.c:632 #5 0x0000555555585e66 in doveadm_mail_cmd (argv=<optimized out>, argc=4, cmd=0x555555602a00) at doveadm-mail.c:748 #6 doveadm_mail_try_run () at doveadm-mail.c:821 #7 0x0000555555575e7f in main () at doveadm.c:404 #8 0x00007ffff74acb17 in __libc_start_main (main=0x555555575990 <main>, argc=5, argv=0x7fffffffea18, init=<optimized out>, fini=<optimized out>, rtld_fini=<optimized out>, stack_end=0x7fffffffea08) at ../csu/libc-start.c:310 #9 0x0000555555575fca in _start () at doveadm-mail.c:1127 (gdb) p *cmd $5 = {alloc = 0x0, name = 0x5555555bdd0c "kick", usage_args = 0x5555555be738 "[-a <anvil socket path>] <user mask>[|]<ip/bits>"} (This is Debian bug #915411[1]) Regards, Apollon [1] https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=915411

2 2

Different listeners with different config
by Peter Mogensen 07 Dec '18

07 Dec '18

Hi, I was wondering about the status on being able to create a dedicated listener in Dovecot with - say - extra features enabled. As an example... If I wanted to have Dovecot listening on port 144 with a slightly different set of auth mechanisms enabled. /Peter

1 0

argonid and dovecote
by Jerry 06 Dec '18

06 Dec '18

on a FreeBSD 11.2 amd64 machine, I am trying to get Dovecot 2.3.4 to play nice with "argonid" encryption. In the "10-auth.conf" file, I tried: auth_mechanisms = plain argon2id Upon restarting dovecot, I received an error message when attempting to actually it: auth: FATAL: Unknown authentication mechanism "ARGON2ID" Output from doveadm pw -l doveadm pw -l SHA1 SSHA512 BLF-CRYPT PLAIN HMAC-MD5 OTP SHA512 SHA RPA DES-CRYPT CRYPT SSHA MD5-CRYPT SKEY PLAIN-MD4 PLAIN-MD5 SCRAM-SHA-1 LANMAN SHA512-CRYPT CLEAR CLEARTEXT ARGON2I ARGON2ID SSHA256 NTLM MD5 PBKDF2 SHA256 CRAM-MD5 PLAIN-TRUNC SHA256-CRYPT SMD5 DIGEST-MD5 LDAP-MD5 I assume I am making a stupid mistake, but I do not know what it is. -- Jerry

3 8

Dovecot 2.3.4 crashing on Solaris 10 - "Panic: output stream is missing error handling"
by Fabian Fritz 06 Dec '18

06 Dec '18

Hi, I just compiled Dovecot for Solaris 10 and try to run it now. Other than setting a custom port, I did not add custom settings. When I tried running doveconf for the first time, it crashed immediately: doveconf -n # 2.3.4 (): /export/dovecot/etc/dovecot/dovecot.conf # OS: SunOS 5.10 sun4u~~ # Hostname: merlin service pop3-login { inet_listener pop3 { port = 1110 } } submission_max_mail_size = 0 doveconf: Panic: output stream is missing error handling doveconf: Error: Raw backtrace: 0xff01b3a8 -> 0xff063b04 -> 0x1673c -> 0x1797c -> 0x14478 Abort (core dumped) The same error appears when I run dovecot -F. Unfortunately I currently don't have access to the core dumps (I might do later), but I could run it with the Debugger with user process debugging enabled: (This is the part when it crashes. I can provide the full output if requested) truss -u "libdovecot" /export/dovecot/bin/doveconf -n service pop3-login { inet_listener pop3 { port = 1110 } } submission_max_mail_size = 0 /1: write(1, " s e r v i c e p o p 3".., 95) = 95 /1@1: <- libdovecot:o_stream_uncork() = 0xa1918 /1@1: -> libdovecot:buffer_free(0xa1a10, 0x0, 0x0, 0x0) /1@1: -> libdovecot:pool_system_free(0xff0fb050, 0x4af10, 0xff0fb030, 0xff059470) /1@1: <- libdovecot:buffer_free() = 0 /1@1: -> libdovecot:buffer_free(0xa1a18, 0x1c00, 0xfec47940, 0x0) /1@1: -> libdovecot:pool_system_free(0xff0fb050, 0x4af60, 0xff0fb030, 0xff059470) /1@1: <- libdovecot:buffer_free() = 0 /1@1: -> libdovecot:pool_datastack_create(0xc3ed8, 0xc4200, 0x328, 0x0) /1@1: <- libdovecot:pool_datastack_create() = 0x42a58 /1@1: -> libdovecot:buffer_create_dynamic(0x42a58, 0x20, 0x8000, 0xff0f44f4) /1@1: <- libdovecot:buffer_create_dynamic() = 0x42a68 /1@1: -> libdovecot:buffer_append(0x42a68, 0x525c8, 0x4, 0x42a68) /1@1: -> libdovecot:buffer_write(0x42a68, 0x0, 0x525c8, 0x4) /1@1: <- libdovecot:buffer_append() = 0x42a88 /1@1: -> libdovecot:array_sort_i(0xffbfec38, 0x1cd70, 0x0, 0x52830) /1@1: <- libdovecot:array_sort_i() = 0x42a88 /1@1: -> libdovecot:buffer_append_space_unsafe(0x42a68, 0x4, 0x4, 0x1cd70) /1@1: -> libdovecot:buffer_get_space_unsafe(0x42a68, 0x4, 0x4, 0x1cd70) /1@1: <- libdovecot:buffer_append_space_unsafe() = 0x42a8c /1@1: -> libdovecot:o_stream_uncork(0xa1968, 0xffbfedb0, 0x0, 0x1) /1@1: <- libdovecot:o_stream_uncork() = 0xa1918 /1@1: -> libdovecot:o_stream_destroy(0xffbfed3c, 0x0, 0x0, 0x1) /1@1: -> libdovecot:o_stream_unref(0xffbfed3c, 0x0, 0x0, 0x1) doveconf: Panic: output stream is missing error handling /1: write(2, " d o v e c o n f : P a".., 58) = 58 /1: getcontext(0xFFBFE988) /1: open("/proc/self/as", O_RDONLY) = 8 /1: fstat64(8, 0xFFBFE7B8) = 0 /1: pread(8, "FFBFEB H", 4, 0xFFBFE958) = 4 /1: pread(8, "FF\0CBD0", 4, 0xFFBFE95C) = 4 /1: pread(8, "FFBFEBA8", 4, 0xFFBFEB80) = 4 /1: pread(8, "FF01B11C", 4, 0xFFBFEB84) = 4 /1: pread(8, "FFBFEC\b", 4, 0xFFBFEBE0) = 4 /1: pread(8, "FF01B3A8", 4, 0xFFBFEBE4) = 4 /1: pread(8, "FFBFEC80", 4, 0xFFBFEC40) = 4 /1: pread(8, "FF06 ;04", 4, 0xFFBFEC44) = 4 /1: pread(8, "FFBFECE0", 4, 0xFFBFECB8) = 4 /1: pread(8, "\001 g <", 4, 0xFFBFECBC) = 4 /1: pread(8, "FFBFED @", 4, 0xFFBFED18) = 4 /1: pread(8, "\001 y |", 4, 0xFFBFED1C) = 4 /1: pread(8, "FFBFEDF0", 4, 0xFFBFED78) = 4 /1: pread(8, "\001 D x", 4, 0xFFBFED7C) = 4 /1: pread(8, "\0\0\0\0", 4, 0xFFBFEE28) = 4 /1: pread(8, "\0\0\0\0", 4, 0xFFBFEE2C) = 4 /1: close(8) = 0 doveconf: Error: Raw backtrace: 0xff01b3a8 -> 0xff063b04 -> 0x1673c -> 0x1797c -> 0x14478 /1: write(2, " d o v e c o n f : E r".., 90) = 90 /1: sigaction(SIGABRT, 0x00000000, 0xFFBFEB88) = 0 /1: sigaction(SIGABRT, 0xFFBFEA38, 0xFFBFEAD8) = 0 /1: lwp_sigmask(SIG_SETMASK, 0x00000000, 0x00000000) = 0xFFBFFEFF [0x0000FFFF] /1: lwp_kill(1, SIGABRT) = 0 /1: Received signal #6, SIGABRT [default] /1: siginfo: SIGABRT pid=25172 uid=0 code=-1 I have no idea about what that error means. Thanks, Fabian

1 0

Restricting sending mail to domain or group
by admin 06 Dec '18

06 Dec '18

Hi folks, has anybody a simple solution for the following request? I have a group alias (all(a)company.com) (1) Only company.com accounts should be able to send an email to everybody in that company via all(a)company.com. (2) - rather optional: refine the restrictions, e.g. two groups, grp1(a)company.com and grp2(a)company.com. Grp1 members should be able to send mails to grp2 but not vice versa. What else than sieve would keep dealing with that demands as simple as possible? Thanks in advance and sorry for abusing this list for this kind of „problem“ which is not a bug. Regards, -M

5 7

Error: Corrupted record in index cache file
by Orion Poplawski 05 Dec '18

05 Dec '18

With dovecot-2.2.36-3.el7.x86_64 we had a couple hours where mail_plugins did not properly include zlib for all of the needed services. This seems to have led to some corruption in our mdbox mailboxes. I've run doveadm force-resync on a number of users, but I'm still seeing messages like this: dovecot[13563]: imap(USER): Error: Corrupted record in index cache file /var/spool/imap/USER/mailboxes/INBOX/dbox-Mails/dovecot.index.cache: UID 67976: Broken physical size in mailbox INBOX: read(zlib(/var/spool/mail/USER/storage/m.1203)) failed: Cached message size smaller than expected (2978 < 8192, box=INBOX, UID=67976) Is there anything that can be done about this? Can I safely delete the dovecot.index.cache file? I'm hesitant to do so since I understand that the mdbox format uses the index to store mailbox information and deleting at least some index files is a destructive operation. Thanks! -- Orion Poplawski Manager of NWRA Technical Systems 720-772-5637 NWRA, Boulder/CoRA Office FAX: 303-415-9702 3380 Mitchell Lane orion(a)nwra.com Boulder, CO 80301 https://www.nwra.com/

2 2

vacation script issue
by fins 05 Dec '18

05 Dec '18

Hello, I have a complete Postfix + Dovecot + openLDAP setup almost working, the only issue I have is the vacation script auto-reply that doesn't work properly. If I send an email to a user with the vacation filter enabled, the auto-reply is send to a local recipient with the same account name. So for example if I send a mail from test(a)xyz.com to test(a)example.com, the auto-reply is received on the test(a)example.com address instead of the test(a)xyz.com who's the original sender. Here's a log file: Dec 3 13:52:48 imap dovecot: lda(test(a)example.com): Debug: sieve: executing script from /var/mail/example.com/test/.dovecot.svbin Dec 3 13:52:48 imap dovecot: lda(test(a)example.com): sieve: msgid=< dovecot-sieve-1543841568-836314-0(a)imap.example.com>: discarding vacation response to auto-submitted message from <MAILER-DAEMON> Dec 3 13:52:48 imap dovecot: lda(test(a)example.com): sieve: msgid=< dovecot-sieve-1543841568-836314-0(a)imap.example.com>: stored mail into mailbox 'INBOX' Dec 3 13:52:48 imap postfix/pipe[6663]: D835A300E05: to=<test(a)example.com>, orig_to=<test(a)xyz.com>, relay=dovecot, delay=0.1, delays=0.03/0.01/0/0.06, dsn=2.0.0, status=sent (delivered via dovecot service) Can somebody help with this issue and/or point where to go for debugging? Please find my dovecot configuration bellow: dovecot -n > # 2.2.10: /etc/dovecot/dovecot.conf > # OS: Linux 3.10.0-862.11.6.el7.x86_64 x86_64 CentOS Linux release 7.5.1804 (Core) xfs > auth_debug = yes > auth_mechanisms = plain login > auth_verbose = yes > lda_mailbox_autocreate = yes > lda_mailbox_autosubscribe = yes > mail_debug = yes > mail_gid = mail > mail_home = /var/mail/%d/%n > mail_location = maildir:/var/mail/%d/%n/Maildir > mail_plugins = " quota" > mail_uid = vmail > managesieve_notify_capability = mailto > managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date ihave > mbox_write_locks = fcntl > namespace inbox { > inbox = yes > location = > mailbox Drafts { > special_use = \Drafts > } > mailbox Junk { > special_use = \Junk > } > mailbox Sent { > special_use = \Sent > } > mailbox "Sent Messages" { > special_use = \Sent > } > mailbox Trash { > special_use = \Trash > } > prefix = > } > passdb { > args = /etc/dovecot/dovecot-ldap.conf.ext > driver = ldap > } > plugin { > quota = maildir:User quota > quota_grace = 10%% > quota_rule2 = Trash:storage=+100M > quota_status_nouser = DUNNO > quota_status_overquota = 552 5.2.2 Mailbox is full > quota_status_success = DUNNO > quota_warning = storage=95%% quota-warning 95 %u it > quota_warning2 = storage=80%% quota-warning 80 %u it > sieve = ~/.dovecot.sieve > sieve_dir = ~/sieve > } > protocols = imap pop3 lmtp sieve > service auth { > unix_listener /var/spool/postfix/private/auth { > group = postfix > mode = 0666 > user = postfix > } > unix_listener auth-userdb { > group = mail > mode = 0600 > user = vmail > } > } > service imap-login { > inet_listener imap { > port = 0 > } > } > service managesieve-login { > inet_listener sieve { > port = 4190 > } > } > service pop3-login { > inet_listener pop3 { > port = 0 > } > inet_listener pop3s { > port = 0 > } > } > service quota-status { > client_limit = 1 > executable = quota-status -p postfix > inet_listener { > port = 12340 > } > } > service quota-warning { > executable = script /usr/local/bin/quota-warning.sh > unix_listener quota-warning { > user = vmail > } > user = vmail > } > ssl = required > ssl_cert = </etc/pki/tls/certs/imap.example.com.crt > ssl_key = </etc/pki/tls/private/imap.example.com.key > userdb { > args = /etc/dovecot/dovecot-ldap.conf.ext > driver = ldap > } > protocol lda { > mail_plugins = " quota sieve" > } > protocol imap { > mail_plugins = " quota imap_quota" > } > > dovecot-ldap.conf.ext hosts = example.com > base = ou=People,dc=example,dc=com > ldap_version = 3 > auth_bind = yes > user_filter = (&(objectClass=posixAccount)(uid=%n)) > pass_filter = (&(objectClass=posixAccount)(uid=%n)) > > user_attrs = \ > mailRoutingAddress=user, \ > =uid=vmail, \ > =gid=mail, \ > =home=/var/mail/%d/%n, \ > =quota_rule=*:bytes=%{ldap:departmentNumber} > > > pass_attrs= mailRoutingAddress=user > > tls = yes > My vacation script: require ["date","relational","vacation"]; > # rule:[Vacation] > if allof (currentdate :zone "+0100" :value "ge" "iso8601" > "2018-12-02T02:00:00+01:00", currentdate :zone "+0100" :value "le" > "iso8601" "2018-12-24T04:00:00+01:00") > { > vacation :addresses "test(a)example.com" :subject "Away" "I'm away"; > } >

1 2

Random issue on mailbox "assertion failed"
by Thomas Durand 05 Dec '18

05 Dec '18

Hi, Since few weeks, I have regularly the issue below with some mailboxes - This is happening randomly. Users are complaining emails are not visible. The situation is recovered by removing indexes but I would like to have it fix permanently. Ruuning dovecot 2.2.10 - Anyone to advise me what is wrong ? Thanks. Dec 05 08:03:37 justyna.rezoo.org dovecot[18684]: imap(XXX): Panic: file mail-index-sync-keywords.c: line 227 (keywords_update_records): assertion failed: (data_offset >= sizeof(struct mail_index_record)) Dec 05 08:03:37 justyna.rezoo.org dovecot[18684]: imap(xxx: Error: Raw backtrace: /usr/lib64/dovecot/libdovecot.so.0(+0x6a06e) [0x7fb890be706e] -> /usr/lib64/dovecot/libdovecot.so.0(+0x6a14e) [0x7fb890be714e] -> /usr/lib64/dovecot/libdovecot.so.0(i_fatal+0) [0x7fb890b9f52c] -> /usr/lib64/dovecot/libdovecot-storage.so.0(mail_index_sync_keywords+0x808) [0x7fb890f205c8] -> /usr/lib64/dovecot/libdovecot-storage.so.0(mail_index_sync_record+0xfd) [0x7fb890f20eed] -> /usr/lib64/dovecot/libdovecot-storage.so.0(mail_index_sync_map+0x21e) [0x7fb890f21e8e] -> /usr/lib64/dovecot/libdovecot-storage.so.0(mail_index_map+0x3e7) [0x7fb890f12b77] -> /usr/lib64/dovecot/libdovecot-storage.so.0(+0xb937d) [0x7fb890f0e37d] -> /usr/lib64/dovecot/libdovecot-storage.so.0(+0xb9990) [0x7fb890f0e990] -> /usr/lib64/dovecot/libdovecot-storage.so.0(mail_index_open+0x8c) [0x7fb890f0ea7c] -> /usr/lib64/dovecot/libdovecot-storage.so.0(index_storage_mailbox_open+0x87) [0x7fb890eff9c7] -> /usr/lib64/dovecot/libdovecot-storage.so.0(+0x4d882) [0x7fb890ea2882] -> /usr/lib64/dovecot/libdovecot-storage.so.0(+0x4d963) [0x7fb890ea2963] -> /usr/lib64/dovecot/lib20_zlib_plugin.so(+0x2a4c) [0x7fb89018fa4c] -> /usr/lib64/dovecot/libdovecot-storage.so.0(+0x802b4) [0x7fb890ed52b4] -> /usr/lib64/dovecot/libdovecot-storage.so.0(mailbox_open+0x20) [0x7fb890ed5430] -> dovecot/imap(cmd_select_full+0x172) [0x7fb8913b0432] -> dovecot/imap(command_exec+0x3c) [0x7fb8913b601c] -> dovecot/imap(+0x17f1f) [0x7fb8913b4f1f] -> dovecot/imap(+0x18005) [0x7fb8913b5005] -> dovecot/imap(client_handle_input+0x14d) [0x7fb8913b52fd] -> dovecot/imap(client_input+0x85) [0x7fb8913b56c5] -> /usr/lib64/dovecot/libdovecot.so.0(io_loop_call_io+0x27) [0x7fb890bf7a87] -> /usr/lib64/dovecot/libdovecot.so.0(io_loop_handler_run+0xff) [0x7fb890bf890f] -> /usr/lib64/dovecot/libdovecot.so.0(io_loop_run+0x38) [0x7fb890bf75d8] -> /usr/lib64/dovecot/libdovecot.so.0(master_service_run+0x13) [0x7fb890ba49e3] -> dovecot/imap(main+0x2c4) [0x7fb8913a9324] -> /lib64/libc.so.6(__libc_start_main+0xf5) [0x7fb8907cf3d5] Thomas Durand +336 12 07 31 87 thomas.durand(a)rezoo.org

1 0

Re: Re[2]: BUG: sieve does not set seen-Flag
by Tuomi, Aki 05 Dec '18

05 Dec '18

please send mail to dovecot-unsubscribe(a)dovecot.org Sent from my Samsung Galaxy smartphone. -------- Original message --------From: "Сергей . via dovecot" <dovecot(a)dovecot.org> Date: 05/12/2018 08:26 (GMT+02:00) To: dovecot(a)dovecot.org Subject: Re[2]: BUG: sieve does not set seen-Flag Unsubscribe me please. I've been seeing these messages for several days and don't want anymore. Please. Среда, 5 декабря 2018, 3:22 +03:00 от Ralph Seichter <m16+dovecot(a)monksofcool.net>: * Jakobus Schürz: > 1543935543.M447415P13997.mymail,S=726,W=748:2,Sa > > Then i move this email to another IMAP-Folder, and then there is the > filename > > 1543935543.M447415P13997.mymail,S=726,W=748:2, > > As expected, the seen-flag disappeared... the same as thunderbird > shows. And what about the "dovecot-keywords" files in both folders? Do they match? The letter "a" seems to indicates that there is at least one non-standard flag defined in the source folder's keywords. By the way, can I assume you move messages only by using Thunderbird/IMAP and not by manipulating the file system? Here's how things look on my server: # On arrival (UNSEEN) 1543968031.M941319P5841.foo,S=1390,W=1422:2, # After reading (SEEN) 1543968031.M941319P5841.foo,S=1390,W=1422:2,S # After being moved to another folder (SEEN) 1543968031.M941319P5841.foo,S=1390,W=1422:2,S I can use IMAP search terms SEEN and UNSEEN as indicated above, and I see the same message state displayed in Notmuch mail (my default, it accesses Dovecot's Maildir storage directly) and various IMAP clients connecting to Dovecot. Things are working just fine here. -Ralph -- Сергей .

2 1

Lda fatal: setgid (102 from userdb lookup) failed
by James Brown 05 Dec '18

05 Dec '18

Sorry if this is a nubbie question, but I’m getting: lda(jlbrown(a)bordo.com.au)<4444><QFg5KRHVBBxcEQAAYBwt+A>: Fatal: setgid(102 from userdb lookup) failed with euid=501(jlbrown), gid=20(staff), egid=20(staff): Operation not permitted (This binary should probably be called with process group set to 102 instead of 20(staff)) How can I fix this? (macOS Mojave, Dovecot 2.3.4) Thanks, James.

2 2

Compilation error
by Joan Moreau 04 Dec '18

04 Dec '18

Hi USing git, I reach the following error (below). Here is my configure parameters : CPPFLAGS="-I/include -I/usr/include/tirpc/" LDFLAGS="-L/lib -ltirpc" ./configure --prefix=/usr --sysconfdir=/etc --localstatedir=/var --libexec=/usr/libexec --with-sql=yes --without-sqlite --with-mysql --with-ssl --without-shadow --without-nss --without-pam --without-ldap --with-zlib --with-bzlib --with-libwrap --with-libcap --without-solr --without-gssapi --without-docs --without-sia --without-pgsql --without-lucene --without-stemmer THanks libtool: link: gcc -std=gnu99 -g -O2 -fstack-protector-strong -U_FORTIFY_SOURCE -D_FORTIFY_SOURCE=2 -mfunction-return=thunk -mindirect-branch=thunk -Wall -W -Wmissing-prototypes -Wmissing-declarations -Wpointer-arith -Wchar-subscripts -Wformat=2 -Wbad-function-cast -fno-builtin-strftime -Wstrict-aliasing=2 -Wl,--as-needed -o test-lib test_lib-test-lib.o test_lib-test-array.o test_lib-test-aqueue.o test_lib-test-base32.o test_lib-test-base64.o test_lib-test-bits.o test_lib-test-bsearch-insert-pos.o test_lib-test-buffer.o test_lib-test-byteorder.o test_lib-test-crc32.o test_lib-test-data-stack.o test_lib-test-event-filter.o test_lib-test-event-log.o test_lib-test-failures.o test_lib-test-file-create-locked.o test_lib-test-guid.o test_lib-test-hash.o test_lib-test-hash-format.o test_lib-test-hash-method.o test_lib-test-hmac.o test_lib-test-hex-binary.o test_lib-test-imem.o test_lib-test-ioloop.o test_lib-test-iso8601-date.o test_lib-test-iostream-pump.o test_lib-test-iostream-proxy.o test_lib-test-iostream-temp.o test_lib-test-istream.o test_lib-test-istream-base64-decoder.o test_lib-test-istream-base64-encoder.o test_lib-test-istream-chain.o test_lib-test-istream-concat.o test_lib-test-istream-crlf.o test_lib-test-istream-failure-at.o test_lib-test-istream-jsonstr.o test_lib-test-istream-multiplex.o test_lib-test-istream-seekable.o test_lib-test-istream-sized.o test_lib-test-istream-tee.o test_lib-test-istream-try.o test_lib-test-istream-unix.o test_lib-test-json-parser.o test_lib-test-json-tree.o test_lib-test-lib-signals.o test_lib-test-llist.o test_lib-test-log-throttle.o test_lib-test-malloc-overflow.o test_lib-test-memarea.o test_lib-test-mempool.o test_lib-test-mempool-allocfree.o test_lib-test-mempool-alloconly.o test_lib-test-pkcs5.o test_lib-test-net.o test_lib-test-numpack.o test_lib-test-ostream-buffer.o test_lib-test-ostream-failure-at.o test_lib-test-ostream-file.o test_lib-test-ostream-multiplex.o test_lib-test-multiplex.o test_lib-test-path-util.o test_lib-test-primes.o test_lib-test-printf-format-fix.o test_lib-test-priorityq.o test_lib-test-random.o test_lib-test-seq-range-array.o test_lib-test-stats-dist.o test_lib-test-str.o test_lib-test-strescape.o test_lib-test-strfuncs.o test_lib-test-strnum.o test_lib-test-str-find.o test_lib-test-str-sanitize.o test_lib-test-str-table.o test_lib-test-time-util.o test_lib-test-unichar.o test_lib-test-utc-mktime.o test_lib-test-uri.o test_lib-test-var-expand.o test_lib-test-wildcard-match.o -L/lib ../lib-test/.libs/libtest.a ./.libs/liblib.a -ltirpc -lm /usr/bin/ld: test_lib-test-lib.o:(.data.rel.ro+0x108): undefined reference to `test_connection' collect2: error: ld returned 1 exit status make[4]: *** [Makefile:1211: test-lib] Error 1 make[4]: Leaving directory '/usr/src/dovecot/src/lib' make[3]: *** [Makefile:1152: all] Error 2 make[3]: Leaving directory '/usr/src/dovecot/src/lib' make[2]: *** [Makefile:564: all-recursive] Error 1 make[2]: Leaving directory '/usr/src/dovecot/src' make[1]: *** [Makefile:682: all-recursive] Error 1 make[1]: Leaving directory '/usr/src/dovecot' make: *** [Makefile:526: all] Error 2

2 2

dovecot and argon2 encryption
by Jerry 04 Dec '18

04 Dec '18

I am using a FreeBSD 11-2 amd/64 system with dovecot version 2.3.4 installed. I was playing around with different encryption schemes. doveadm pw -l SHA1 SSHA512 BLF-CRYPT PLAIN HMAC-MD5 OTP SHA512 SHA RPA DES-CRYPT CRYPT SSHA MD5-CRYPT SKEY PLAIN-MD4 PLAIN-MD5 SCRAM-SHA-1 LANMAN SHA512-CRYPT CLEAR CLEARTEXT SSHA256 NTLM MD5 PBKDF2 SHA256 CRAM-MD5 PLAIN-TRUNC SHA256-CRYPT SMD5 DIGEST-MD5 LDAP-MD5 There is no mention of "argon2" shown. Now, from the command line I can enter this command: ~ $ echo -n "Secret-Password" | argon2 somesalt Type: Argon2i Iterations: 3 Memory: 4096 KiB Parallelism: 1 Hash: e6432f595e999988c7c54c30d530b0fc7d9953510e5ccf295359258f4ea22a3d Encoded: $argon2i$v=19$m=4096,t=3,p=1$c29tZXNhbHQ$5kMvWV6ZmYjHxUww1TCw/H2ZU1EOXM8pU1klj06iKj0 0.039 seconds Verification ok However, this fails: doveadm pw -p "Secret-Password" -s argon2 Fatal: Unknown scheme: ARGON2 I have tried different ways to enter "argon2", but nothing works. Can someone tell me what I am doing wrong? Thanks :) -- Jerry

3 3

Panic: file dsync-brain-mailbox-tree.c: line 448: unreached
by Marc Weustink 04 Dec '18

04 Dec '18

Hi all, To backup our imap folders I've a cronjob running in the night: /usr/bin/doveadm -o stats_writer_socket_path= backup -R -A -N tcp:xxx.yyy.zzz:4191 This ran successful when I set it up and didn't look at it anymore. Recently I noticed errors: dsync-local(administration)<uO/qHjXS6FteLAAA3i05xw>: Panic: file dsync-mailbox-tree-sync.c: line 1253 (sync_create_mailboxes): assertion failed: (node->ns == other_node->ns) dsync-local(administration)<uO/qHjXS6FteLAAA3i05xw>: Error: Raw backtrace: /usr/lib/dovecot/libdovecot.so.0(+0xcceca) [0x7f7029099eca] -> /usr/lib/dovecot/libdovecot.so.0(+0xccf21) [0x7f7029099f21] -> /usr/lib/dovecot/libdovecot.so.0(i_fatal+0) [0x7f7029006f44] -> /usr/bin/doveadm(+0x5206c) [0x558ba9fec06c] -> /usr/bin/doveadm(dsync_mailbox_trees_sync_init+0x2a2) [0x558ba9fedba2] -> /usr/bin/doveadm(dsync_brain_recv_mailbox_tree_deletes+0x246) [0x558ba9fdf6d6] -> /usr/bin/doveadm(dsync_brain_run+0x5b8) [0x558ba9fdbec8] -> /usr/bin/doveadm(+0x42260) [0x558ba9fdc260] -> /usr/bin/doveadm(+0x585bf) [0x558ba9ff25bf] -> /usr/lib/dovecot/libdovecot.so.0(io_loop_call_io+0x69) [0x7f70290b2029] -> /usr/lib/dovecot/libdovecot.so.0(io_loop_handler_run_internal+0x109) [0x7f70290b3959] -> /usr/lib/dovecot/libdovecot.so.0(io_loop_handler_run+0x52) [0x7f70290b2132] -> /usr/lib/dovecot/libdovecot.so.0(io_loop_run+0x38) [0x7f70290b2348] -> /usr/bin/doveadm(+0x27e39) [0x558ba9fc1e39] -> /usr/bin/doveadm(+0x2a3c7) [0x558ba9fc43c7] -> /usr/bin/doveadm(+0x2b1f6) [0x558ba9fc51f6] -> /usr/bin/doveadm(doveadm_mail_try_run+0x1fa) [0x558ba9fc597a] -> /usr/bin/doveadm(main+0x45b) [0x558ba9fb4ceb] -> /lib/x86_64-linux-gnu/libc.so.6(__libc_start_main+0xf0) [0x7f702891a830] -> /usr/bin/doveadm(_start+0x29) [0x558ba9fb4e69] Aborted (core dumped) I've added the dovecot repo to get dovecot automatically updated, so I cannot tell with which version it started. my doveconf -n: [sudo] password for infraadmin: # 2.3.3 (dcead646b): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.3 (f018bbab) # OS: Linux 4.4.0-137-generic x86_64 Ubuntu 16.04.5 LTS autofs # Hostname: xxx.xxx.xxx dict { acl = pgsql:/etc/dovecot/dovecot-dict-sql-local.conf.ext } doveadm_password = # hidden, use -P to show it mail_debug = yes mail_gid = vmail mail_home = /home/mail/backup/%n mail_location = maildir:/home/mail/backup/%n/mail mail_uid = vmail managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = separator = / type = private } namespace public { location = maildir:/home/mail/backup/Common/mail:INDEXPVT=/home/mail/backup/%n/mail/common prefix = Common/ separator = / subscriptions = no type = public } passdb { args = /etc/dovecot/dovecot-sql.conf.ext driver = sql } plugin { acl = vfile acl_shared_dict = proxy::acl sieve = file:~/sieve;active=~/.dovecot.sieve } protocols = " sieve" service auth { unix_listener auth-userdb { mode = 0777 } } service dict { unix_listener dict { group = vmail user = vmail } } ssl = no userdb { args = /etc/dovecot/dovecot-sql.conf.ext driver = sql }

1 1