- dovecot - dovecot.org

Local access to IMAP mailboxes
by Victor Sudakov 29 Sep '18

29 Sep '18

Dear Colleagues, I have made mailboxes in ~/Mail available via IMAP (Dovecot 2.3.2.1), that is: "mail_location = mbox:~/Mail:INBOX=/var/mail/%u" However, I often read and modify the mailboxes locally with mutt (e.g. append and delete mails). Should I expect any problems wit Dovecot indexes etc? What if I even do "rm ~/Mail/some/mailbox", will Dovecot be mad at me? -- Victor Sudakov, VAS4-RIPE, VAS47-RIPN 2:5005/49@fidonet http://vas.tomsk.ru/

6 19

having problems with Argon
by Adam Gold 28 Sep '18

28 Sep '18

Hello everyone. I'm close to completing my first build of a mail server - Postfix, Dovecot, Postgres (I know, sounds like overkill), Rspamd with Redis and Unbound (please infer a mega lack of experience disclaimer). The model is standalone internet with remoted sasl-authenticated clients. Throughout the process I've been having consistent problems with user password authentication. Both when I began when I was only using flat files and now with pgsql, more often than not my username (full email address) and password combo have been rejected. The postfix logs started with fairly innocent 'failed login' messages and eventually reached the "you don't own this email address, you're a spammer" level. Dovecot has been consistent with "auth: Debug: client passdb out: FAIL" messages. Before I looked at this issue specifically, my guess was it came from a Postfix restriction but having spent quite a while going through it today, I don't think that's where it lies. Finally I went back to basics and changed an account password to {PLAIN}12345 and what do you know - effortless success! Previously I'd been using mainly argon, ssha512 sha512-crypt and a few others. My passwords are strong (well in excess of 20 characters, 'randomly' generated). I spent this afternoon narrowing down the hashes and while I haven't finished, the only one I couldn't get to work with 12345 was argon. I also noticed that the wiki says the 2I and 2ID versions of Argon are available, doveadm pw always returned a "does not exist" error when I tried to use 2ID. I'm using Dovecot version 2.3.2.1 (0719df592)

2 1

Collecting S/MIME Certs from (incoming signed) E-Mails
by Jochen Bern 28 Sep '18

28 Sep '18

Two quick questions, if I may: We've been asked to change an existing application (whose builtin S/MIME capabilities are quite unclear) so that the e-mails it sends will be S/MIME encrypted, if possible. I have some experience in getting an MTA to encrypt e-mails in transit, but the trick is, of course, to maintain a list of addressees' (current) certs. Ideally, users send e-mails *to* the application beforehand, and with a bit of luck, they might even *sign* them (which, in the case of S/MIME, IIUC implies that their cert is attached). 1. Are there features in a) the IMAP protocol and/or b) dovecot in particular that would allow me to extract the certs from incoming e-mails before the application retrieves them from the mailbox? (I know that IMAP allows me to download only a MIME part of an e-mail, but I'ld need to somehow determine *which* MIME part to download, I guess?) 2. Assuming that the incoming e-mail is S/MIME signed *and encrypted*, is it actually possible to extract the sender cert *without* having the application's keypair to *decrypt* the e-mail in the process? Kind regards, -- Jochen Bern Systemingenieur www.binect.de www.facebook.de/binect

1 0

Custom variable
by Ángel L. Mateo 27 Sep '18

27 Sep '18

Hi, I know that there are some variables (as user or username) I could use inside dovecot. They are at https://wiki2.dovecot.org/Variables. My question is if I can create my own variables from attributes at my pass/user db and then use it inside dovecot configuration. -- Angel L. Mateo Martínez Sección de Telemática Área de Tecnologías de la Información y las Comunicaciones Aplicadas (ATICA) http://www.um.es/atica Tfo: 868889150 Fax: 868888337

2 5

Connection and login scripts callback
by Stanislav Humplík 27 Sep '18

27 Sep '18

Hello, currently there is very handy post-login scripting already implemented but it naturally executes only when successful login happens. I would like to have another two script callbacks which runs: 1. immediately after client connects to server - dovecot should run script with connection IP and wait for result and then reject/accept connection with return message accordingly. 2. after failed login - dovecot should exec script with connection IP, login params without waiting for result The main reason behind this idea is to use some logic, database (redis...) or indicators like GeoIP, p0f as bruteforce prevention. It might be also usable for IP based ACLs. AFAIK the only way to create something similar is to proxy whole authentication to some external process, which is not desirable when dovecot manages user database. SH

2 1

Can't authenticate using ARGON2ID crypt scheme from doveadm pw w/rounds != default
by Keith Amidon 27 Sep '18

27 Sep '18

I'm using dovecot version 2.3.2.1 (0719df592) and trying to use the ARGON2ID crypt scheme for authentication using the passdb passwd-file driver. My passdb config is very simple: passdb { driver = passwd-file args = username_format=%u <path-to-file-here> } If I generate a password this way: doveadm pw -s ARGON2ID -p 'This is a test' I get a crypt value for the password that I can place in the password file like: testuser:{ARGON2ID}$argon2id$v=19$m=65536,t=3,p=1$UuqF25QtumNBe9R2FmUZvA$5avvHY5TIaj5Wl5C4k8BOI4bcmNei7BwPLlXYQVybMc And if I test authentication with this command: doveadm auth login testuser 'This is a test' It works as shown by the (lightly redacted) log: Sep 25 22:46:01 myhost dovecot[17538]: auth: Debug: auth client connected (pid=55417) Sep 25 22:46:01 myhost dovecot[17538]: auth: Debug: client in: AUTH 1 PLAIN service=doveadm debug resp=<hidden> Sep 25 22:46:01 myhost dovecot[17538]: auth: Debug: passwd-file(testuser): lookup: user=testuser file=<path-to-passwd-file> Sep 25 22:46:01 myhost dovecot[17538]: auth: Debug: client passdb out: OK 1 user=testuser However, if I instead specify a non-default number of rounds this way: doveadm pw -s ARGON2ID -p 'This is a test' -r 7 and place the result in an entry in the password file like: testuser:{ARGON2ID}$argon2id$v=19$m=1048576,t=7,p=1$kIhnUR13GrtOvvpbJNJmnQ$o7O6Whxs3s8IE09yY9S2dPkJjJyEVc78GRFilYVS9fU Then testing authentication using the same command (repeated here): doveadm auth login testuser 'This is a test' then authentication fails, as shown by this (lightly redacted) log: Sep 25 22:52:05 myhost dovecot[17538]: auth: Debug: auth client connected (pid=55557) Sep 25 22:52:05 myhost dovecot[17538]: auth: Debug: client in: AUTH 1 PLAIN service=doveadm debug resp=<hidden> Sep 25 22:52:05 myhost dovecot[17538]: auth: Debug: passwd-file <path-to-passwd-file>: Read 3 users in 0 secs Sep 25 22:52:05 myhost dovecot[17538]: auth: Debug: passwd-file(testuser): lookup: user=testuser file=<path-to-passwd-file> Sep 25 22:52:05 myhost dovecot[17538]: auth: passwd-file(testuser): Password mismatch Sep 25 22:52:07 myhost dovecot[17538]: auth: Debug: client passdb out: FAIL 1 user=testuser Experimentation with other values for the -r option has not produced a value that works for me. Using the exact same procedure but the BLF-CRYPT scheme, with varying number of rounds, does work. Am I doing something wrong or is there a bug in either the doveadm pw generation or the auth evaluation of the password? I'd like to use ARGON2ID with ~6 rounds if I can make this work. Any help would be greatly appreciated. Thanks, Keith

2 2

What causes folders to be reported as noselect?
by Daniel Miller 27 Sep '18

27 Sep '18

As the subject says. This may be a bit open-ended - but it would really help troubleshooting some obscure folder issues. In my case, I happen to have both some "real" folders and also some "virtual" folders that respond to IMAP LIST commands with the "\NoSelect" flag - and I don't know why. Via telnet, I can manually issue SELECT, SEARCH, and FETCH for such folders without errors. -- Daniel

2 2

Possible bug - otherwise a public admission of oops
by Daniel Miller 27 Sep '18

27 Sep '18

While trying to identify possible causes of wrong mail folder creation I did something...bad. Normally, I would recognize that deleting a mail folder would naturally delete all the contained mails. However...somehow my imaginative self decided that deleting a virtual folder via IMAP would only delete the virtual folder...and not proceed to delete every referenced email via the virtual mapping. So note to self, and possible reminder to others, deleting a virtual folder via a filesystem command is just tiny bit different than via IMAP... Fortunately I keep my feathers numbered for just such an emergency... -- Daniel

1 0

dovecot/FreeBSD and Android IMAP clients
by Victor Sudakov 25 Sep '18

25 Sep '18

Dear Colleagues, I have a fairly vanilla setup of dovecot on FreeBSD, serving IMAP and POP3. Thunderbird/IMAP works fine, and so does mutt/IMAP. However, Android clients (Gmail/IMAP and K-9 Mail) have problems accessing folders other than the INBOX. They either show them empty with no mails (K-9) or just wait forever to view the contents (Gmail app). Do I need to set up some workarounds or hacks in dovecot for Android IMAP clients to work correctly? Any advice is appreciated. My config is below: # 2.3.2.1 (0719df592): /usr/local/etc/dovecot/dovecot.conf # OS: FreeBSD 11.2-RELEASE-p3 amd64 # Hostname: admin.sibptus.ru mail_location = mbox:~/Mail:INBOX=/var/mail/%u mail_privileged_group = mail namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } passdb { driver = pam } protocols = imap pop3 ssl_cert = </usr/local/etc/exim/mail.pem ssl_dh = # hidden, use -P to show it ssl_key = # hidden, use -P to show it userdb { driver = passwd } -- Victor Sudakov, VAS4-RIPE, VAS47-RIPN 2:5005/49@fidonet http://vas.tomsk.ru/

2 2

Nightly builds of Debian packages
by Christoph Pleger 24 Sep '18

24 Sep '18

Hello, how is the future of the automatically built nightly debian packages of dovecot? Has that project been ceased? The current auto-built version is still 2.2.28 from April 28, though 2.2.29 (with a security patch) of dovecot is out now for a while. Regards Christoph

4 3

Last_login plugin and mysql
by Thomas Hooge 24 Sep '18

24 Sep '18

Hello, i have problems configuring the last_login plugin with mysql. I have extended the postfixadmin database with a new field, configured the plugin as described in the wiki. Finally i got errors: table is not writable, INSERT failed. Why is the insert required? The plugin should only UPDATE the column for existing rows. Or am i missing some configuration options? Here is my dictionary config: map { pattern = shared/last-login/$user table = mailbox value_field = x_last_login value_type = uint fields { username = $user } } Dovecot: 2.2.27 (c0f36b0) Kind regards, Thomas

2 2

Error using dsync to convert really old mboxes to Maildir and workaround
by faginbagin 24 Sep '18

24 Sep '18

I ran across what I think may be a bug in dsync when trying to convert from mbox to Maildir format. My first attempt failed with a runaway dsync process spewing out thousands of identical lines of the form: dsync(buus): Error: Duplicate mailbox GUID 00fe691ff60da85b090d0000c8119523 for mailboxes Archive/Personal and Work/VendorInfo - giving a new GUID 00fe691ff60da85b090d0000c8119523 to Archive/Personal These two mail folders happen to be among a number of folders I've had for many years, but also haven't looked at in many years. I used to use UW-IMAP, but switched to dovecot about two years ago, and I'm sure I've never used dovecot to look at those folders. So I suspect the root cause of the above error message was that dovecot had never generated GUIDs for these and some other really old folders. After killing dsync with SIGKILL, which couldn't be killed with SIGTERM, I restored my mbox format Mail folder from backup, restored the mail_location and then coerced dovecot to generate unique GUIDs for all my mail folders with this command: doveadm mailbox status guid `doveadm mailbox list` After the above command, I was able to convert my mail from mbox to Maildir format. Maybe this will help someone else somewhere down the road.

2 2

Released Pigeonhole v0.5.3.rc1 for Dovecot v2.3.3.rc1.
by Stephan Bosch 23 Sep '18

23 Sep '18

Hello Dovecot users, Here is the Pigeonhole release candidate that goes with the Dovecot v2.3.3 release candidate. It consists only of bugfixes. Changelog v0.5.3: - Fix assertion panic occurring when managesieve service fails to open INBOX while saving a Sieve script. This was caused by a lack of cleanup after failure. - Fix specific messages causing an assert panic with actions that compose a reply (e.g. vacation). With some rather weird input from the original message, the header folding algorithm (as used for composing the References header for the reply) got confused, causing the panic. - IMAP FILTER=SIEVE capability: Fix FILTER SIEVE SCRIPT command parsing. After finishing reading the Sieve script, the command parsing sometimes didn't continue with the search arguments. This is a time- critical bug that likely only occurs when the Sieve script is sent in the next TCP frame. The release is available as follows: http://pigeonhole.dovecot.org/releases/2.3/rc/dovecot-2.3-pigeonhole-0.5.3.… http://pigeonhole.dovecot.org/releases/2.3/rc/dovecot-2.3-pigeonhole-0.5.3.… Refer to http://pigeonhole.dovecot.org and the Dovecot wiki for more information. Have fun testing this release candidate and don't hesitate to notify me when there are any problems. Regards, -- Stephan Bosch stephan(a)rename-it.nl

1 0

Global sieve doesn't run and I don't know why
by Ranbir 21 Sep '18

21 Sep '18

Hi Everyone, I have dovecot, postfix, roundcube and piegeonhole managesieve all working nicely together. Personal scripts defined in roundcube run without issue. I have configured the global sieve dir defined in 90-sieve.conf: sieve_global_dir = /var/lib/dovecot/sieve/global/ I pre-compiled the script in there: # ls -l /var/lib/dovecot/sieve/global/ total 8 -rw-r--r--. 1 root root 118 Sep 19 16:52 global.sieve -rw-r--r--. 1 root root 197 Sep 19 16:56 global.svbin But, in the logs for dovecot, I never see the script being run: https://www.pastiebin.com/5ba3faa8628c2 Users are from freeipa. Their home directories are symlinks to where the mail really lives. For example: lrwxrwxrwx. 1 ranbir virtual 42 May 25 2017 ranbir -> /var/spool/mail/domain.tld/ranbir/ And the contents of that dir: [root@mailhost conf.d]# ls -al /home/DOMAIN/ranbir/ total 64 drwxrwx---. 4 ranbir virtual 4096 Sep 18 17:40 . drwxrwx---+ 13 virtual virtual 4096 Jul 8 12:06 .. -rw-------. 1 ranbir ranbir 17808 Sep 20 01:13 .bash_history -rw-------. 1 ranbir ranbir 18 Dec 14 2015 .bash_logout -rw-------. 1 ranbir ranbir 193 Dec 14 2015 .bash_profile -rw-------. 1 ranbir ranbir 231 Dec 14 2015 .bashrc lrwxrwxrwx. 1 virtual virtual 23 Feb 11 2018 .dovecot.sieve -> sieve/managesieve.sieve lrwxrwxrwx. 1 virtual virtual 23 Sep 18 16:53 .dovecot.sieve.log -> sieve/dovecot.sieve.log -rw-rw----. 1 virtual virtual 322 Sep 18 17:40 .dovecot.svbin -rw-------. 1 ranbir ranbir 59 Jun 7 2016 .lesshst drwx------. 56 virtual virtual 4096 Sep 20 15:02 Maildir drwxrwx---. 3 ranbir virtual 89 Sep 18 17:16 sieve -rw-------. 1 ranbir ranbir 6415 Feb 11 2018 .viminfo Did I miss something in the configuration? Dovecot isn't throwing any errors. I can only conclude I haven't completed the setup for global sieve to work or that I've misunderstood what the "sieve_global_dir" paramater is for. Thanks! -- Ranbir

4 11

Re: v2.3.3 release candidate released
by Tuomi, Aki 21 Sep '18

21 Sep '18

It should work if you add it to apt. Directory listing is denied, which causes 403 if you access with browser. Aki -------- Original message --------From: Michael Marley <michael(a)michaelmarley.com> Date: 21/09/2018 18:00 (GMT+02:00) To: Dovecot Mailing List <dovecot(a)dovecot.org> Subject: Re: v2.3.3 release candidate released On 2018-09-21 09:45, Timo Sirainen wrote: > https://dovecot.org/releases/2.3/rc/dovecot-2.3.3.rc1.tar.gz > https://dovecot.org/releases/2.3/rc/dovecot-2.3.3.rc1.tar.gz.sig > > Binary packages are also available in https://repo.dovecot.org/ in > ce-2.3.3 repository (not ce-2.3-latest). > > * doveconf hides more secrets now in the default output. > * ssl_dh setting is no longer enforced at startup. If it's not set and > non-ECC DH key exchange happens, error is logged and client is > disconnected. > > + Added log_debug=<filter> setting. > + Added log_core_filter=<log filter> setting. > + quota-clone: Write to dict asynchronously > + --enable-hardening attempts to use retpoline Spectre 2 mitigations > + lmtp proxy: Support source_ip passdb extra field. > + doveadm stats dump: Support more fields and output stddev by > default. > + push-notification: Add SSL support for OX backend. > - NUL bytes in mail headers can cause truncated replies when fetched. > - director: Conflicting host up/down state changes may in some rare > situations ended up in a loop of two directors constantly > overwriting > each others' changes. > - virtual plugin: Some searches used 100% CPU for many seconds > - dsync assert-crashed with acl plugin in some situations. > - mail_attachment_detection_options=add-flags-on-save assert-crashed > with some specific Sieve scripts. > - Mail snippet generation crashed with mails containing invalid > Content-Type:multipart header. > - Log prefix ordering was different for some log lines. > - quota: With noenforcing option current quota usage wasn't updated. > - auth: Kerberos authentication against Samba assert-crashed. > - stats clients were unnecessarily chatty with the stats server. > - imapc: Fixed various assert-crashes when reconnecting to server. > - lmtp, submission: Fix potential crash if client disconnects while > handling a command. > - quota: Fixed compiling with glibc-2.26 / support libtirpc. > - fts-solr: Empty search values resulted in 400 Bad Request errors > - fts-solr: default_ns parameter couldn't be used > - submission server crashed if relay server returned over 7 lines in > a reply (e.g. to EHLO) It looks like the ce-2.3.3 repository (or at least https://repo.dovecot.org/ce-2.3.3/ubuntu/xenial/) is returning a 403. Michael

1 0

v2.3.3 release candidate released
by Timo Sirainen 21 Sep '18

21 Sep '18

https://dovecot.org/releases/2.3/rc/dovecot-2.3.3.rc1.tar.gz https://dovecot.org/releases/2.3/rc/dovecot-2.3.3.rc1.tar.gz.sig Binary packages are also available in https://repo.dovecot.org/ in ce-2.3.3 repository (not ce-2.3-latest). * doveconf hides more secrets now in the default output. * ssl_dh setting is no longer enforced at startup. If it's not set and non-ECC DH key exchange happens, error is logged and client is disconnected. + Added log_debug=<filter> setting. + Added log_core_filter=<log filter> setting. + quota-clone: Write to dict asynchronously + --enable-hardening attempts to use retpoline Spectre 2 mitigations + lmtp proxy: Support source_ip passdb extra field. + doveadm stats dump: Support more fields and output stddev by default. + push-notification: Add SSL support for OX backend. - NUL bytes in mail headers can cause truncated replies when fetched. - director: Conflicting host up/down state changes may in some rare situations ended up in a loop of two directors constantly overwriting each others' changes. - virtual plugin: Some searches used 100% CPU for many seconds - dsync assert-crashed with acl plugin in some situations. - mail_attachment_detection_options=add-flags-on-save assert-crashed with some specific Sieve scripts. - Mail snippet generation crashed with mails containing invalid Content-Type:multipart header. - Log prefix ordering was different for some log lines. - quota: With noenforcing option current quota usage wasn't updated. - auth: Kerberos authentication against Samba assert-crashed. - stats clients were unnecessarily chatty with the stats server. - imapc: Fixed various assert-crashes when reconnecting to server. - lmtp, submission: Fix potential crash if client disconnects while handling a command. - quota: Fixed compiling with glibc-2.26 / support libtirpc. - fts-solr: Empty search values resulted in 400 Bad Request errors - fts-solr: default_ns parameter couldn't be used - submission server crashed if relay server returned over 7 lines in a reply (e.g. to EHLO)

2 1

Re: Duplicate mails on pop3 expunge with dsync replication on 2.2.35 (2.2.33.2 works)
by Gerald Galster 21 Sep '18

21 Sep '18

Hi Tim, > Do you have any new insights on the problem with reappearing mail using dovecot replication + pop3? > > It's driving me mad. I'm running dovecot 2.2.34 (874deae) on OpenBSD and it looks like I have the same problem as you have. unfortunately there has been no response, I'm stuck with 2.2.33.2 for the time being. I can only suspect it has something to do with mailbox locking which was introduced in 2.2.34 (int dsync_mailbox_lock) or maybe with some cached values (drop_older_timestamp) as it just happens when the mail is deleted on the node that it has been synced to but not if it's deleted on the node where it has originally been received. Best regards, Gerald diff -Nru dovecot-2.2.33.2/src/doveadm/dsync/dsync-brain-mailbox.c dovecot-2.2.34/src/doveadm/dsync/dsync-brain-mailbox.c --- dovecot-2.2.33.2/src/doveadm/dsync/dsync-brain-mailbox.c 2017-10-05 19:10:44.000000000 +0200 +++ dovecot-2.2.34/src/doveadm/dsync/dsync-brain-mailbox.c 2018-02-28 15:45:34.000000000 +0100 @@ -522,25 +529,33 @@ } /* mailbox appears to have changed. do a full sync here and get the - state again */ + state again. Lock before syncing. */ + if (dsync_mailbox_lock(brain, box, &lock) < 0) { + brain->failed = TRUE; + mailbox_free(&box); + return -1; + } if (mailbox_sync(box, MAILBOX_SYNC_FLAG_FULL_READ) < 0) { i_error("Can't sync mailbox %s: %s", mailbox_get_vname(box), mailbox_get_last_internal_error(box, &brain->mail_error)); ... @@ -599,6 +615,7 @@ static void dsync_cache_fields_update(const struct dsync_mailbox *local_box, const struct dsync_mailbox *remote_box, + struct mailbox *box, struct mailbox_update *update) { ARRAY_TYPE(mailbox_cache_field) local_sorted, remote_sorted, changes; @@ -630,7 +647,8 @@ local_fields = array_get(&local_sorted, &local_count); remote_fields = array_get(&remote_sorted, &remote_count); t_array_init(&changes, local_count + remote_count); - drop_older_timestamp = ioloop_time - MAIL_CACHE_FIELD_DROP_SECS; + drop_older_timestamp = ioloop_time - + box->index->optimization_set.cache.unaccessed_field_drop_secs; diff -Nru dovecot-2.2.33.2/src/doveadm/dsync/dsync-mailbox.c dovecot-2.2.34/src/doveadm/dsync/dsync-mailbox.c --- dovecot-2.2.33.2/src/doveadm/dsync/dsync-mailbox.c 2017-06-23 13:18:28.000000000 +0200 +++ dovecot-2.2.34/src/doveadm/dsync/dsync-mailbox.c 2018-02-28 15:45:34.000000000 +0100 @@ -1,7 +1,9 @@ -/* Copyright (c) 2013-2017 Dovecot authors, see the included COPYING file */ +/* Copyright (c) 2013-2018 Dovecot authors, see the included COPYING file */ #include "lib.h" #include "istream.h" +#include "mail-storage-private.h" +#include "dsync-brain-private.h" #include "dsync-mailbox.h" void dsync_mailbox_attribute_dup(pool_t pool, @@ -20,3 +22,40 @@ dest_r->last_change = src->last_change; dest_r->modseq = src->modseq; } + +int dsync_mailbox_lock(struct dsync_brain *brain, struct mailbox *box, + struct file_lock **lock_r) +{ + const char *path, *error; + int ret; + + /* Make sure the mailbox is open - locking requires it */ + if (mailbox_open(box) < 0) { + i_error("Can't open mailbox %s: %s", mailbox_get_vname(box), + mailbox_get_last_internal_error(box, &brain->mail_error)); + return -1; + } + + ret = mailbox_get_path_to(box, MAILBOX_LIST_PATH_TYPE_INDEX, &path); + if (ret < 0) { + i_error("Can't get mailbox %s path: %s", mailbox_get_vname(box), + mailbox_get_last_internal_error(box, &brain->mail_error)); + return -1; + } + if (ret == 0) { + /* No index files - don't do any locking. In theory we still + could, but this lock is mainly meant to prevent replication + problems, and replication wouldn't work without indexes. */ + *lock_r = NULL; + return 0; + } + + if (mailbox_lock_file_create(box, DSYNC_MAILBOX_LOCK_FILENAME, + brain->mailbox_lock_timeout_secs, + lock_r, &error) <= 0) { + i_error("Failed to lock mailbox %s for dsyncing: %s", + box->vname, error); + return -1; + } + return 0; +}

2 2

Sieve and output variable for execute
by Adam Raszkiewicz 20 Sep '18

20 Sep '18

I'm trying to get blow Sieve filter to work require ["fileinto", "imap4flags", "mailbox", "body", "envelope", "vnd.dovecot.pipe", "variables", "vnd.dovecot.execute"]; if envelope :matches "To" "*@*" { set "recipient" "${0}"; set "user" "${1}"; set "recip_domain" "${2}"; } if envelope :matches "From" "*" { set "sender" "${0}"; } #Check if recipient is valid user if execute :output "valid_user" "user-verification" "${recipient}" { if string :matches "${valid_user}" "True" { if body :raw :contains ["message/notification"] { setflag "\\Seen"; fileinto :create "Notifications"; stop; } } } Where user-verification is an extprogram which calls API and verify user based on email address then returns boolean (as an output to the console). Everything works fine when I will remove if string :matches "${valid_user}" "True"statement other way it looks like is not recognizing valid_uservariable. When I pipe valid_user to some script just to capture value for that variable it throws an error: error: specified :args item `True?' is invalid. Why question mark was added to the variable in this case? Thoughts?

2 1

[Sieve] Matches on body content - looking for working example
by Adam Raszkiewicz 20 Sep '18

20 Sep '18

I have tried to do something like if body :content ["multipart"] :matches ["Original-Message-ID" “*”] { set "Original_Message_ID" "${0}"; } but instead getting Original Message ID I’m getting value from previous match which was if envelope :matches "From" "*" { set "sender" "${0}"; } Is there any example of working :matches matching-type with body? Thanks

3 3

Fatal: Support not compiled in for passdb driver 'pam'
by Evandro Holderbach 20 Sep '18

20 Sep '18

Hi Guys, Can anyone help me, I'm having trouble halting caching authentication for the PAM module. I follow this procedure: https://wiki.dovecot.org/PasswordDatabase/PAM I got this error Sep 20 10:05:58 pop3-login: Info: Disconnected: Auth process broken (disconnected before auth was ready, waited 0 secs): user=<>, rip=, lip=, session=<QmW2BU52TACsFBTt> Sep 20 10:06:00 auth: Fatal: Support not compiled in for passdb driver 'pam' Sep 20 10:06:00 master: Error: service(auth): command startup failed, throttling for 4 secs Sep 20 10:06:00 auth: Fatal: Support not compiled in for passdb driver 'pam' dovecot -n # 2.2.4: /usr/local/etc/dovecot/dovecot.conf # OS: Linux 2.6.32-754.3.5.el6.x86_64 x86_64 CentOS release 6.10 (Final) ext4 auth_cache_negative_ttl = 1 days auth_cache_size = 10 M auth_cache_ttl = 1 days auth_verbose = yes disable_plaintext_auth = no instance_name = Mail Popper 1 listen = 172.20.20.222 login_greeting = Mail Popper 1 Ready mail_location = mbox:/var/empty:INBOX=/var/mail/%u:INDEX=MEMORY mail_privileged_group = mail namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } passdb { args = session=yes cache_key=%n dovecot driver = pam } passdb { driver = shadow } protocols = pop3 ssl = no userdb { args = blocking=yes driver = passwd } protocol pop3 { pop3_uidl_format = %08Xu%08Xv } Thank you -- Evandro

1 0

dovecot.index.pvt reset
by Chris 20 Sep '18

20 Sep '18

All, maybe that's a similar issue like the one mentioned in [1], nevertheless I started a new thread. Using public folders: location = maildir:/var/vmail/public/:LAYOUT=fs:INDEXPVT=%h/.public-indexes When deleting a public maildir in filesystem (rm -rf ...) and copying back from backup, it's older than the users' dovecot.index.pvt files. (%h is in another directory). Then the following error appears: Sep 19 07:27:00 mail1 dovecot: imap(dr): Error: /var/vmail/users/dr/.public-indexes/folder1/folder2/dovecot.index.pvt reset, view is now inconsistent Sometimes even a panic: Sep 19 07:27:00 mail1 dovecot: imap(dr): Panic: file mail-index-map.c: line 548 (mail_index_map_lookup _seq_range): assertion failed: (first_uid <= last_uid) When deleting such a maildir via IMAP or doveadm, the error isn't appearing. Is there anything else, one has to consider, when restoring public maildirs from rsync backup? TIA! Chris [1] 5e26fce3-5f9f-219e-55fb-48981027dca5(a)shift.agency

2 1

dovecot.index.pvt view is inconsistent
by collect＠shift.agency 20 Sep '18

20 Sep '18

Hi, we currently work on a fresh setup coming from 2.2.13 going to 2.3.2.1 (0719df592) (Debian Dovecot Repo). We make heavily use of Public Folder with Per-user \Seen flag and Subscription. namespace { type = public separator = / prefix = Verteiler/ location = maildir:/var/vmail/public/example.com/verteiler:SUBSCRIPTIONS=subscriptions… subscriptions = yes hidden = no list = children } With our current version 2.2.13 this setup works. With version 2.3.2.1 we experience errors in the logfile: Sep 8 23:12:27 mail dovecot: Error: imap(user(a)example.com)<11328><e6jPlGJ1IxBOXnhS>: /var/vmail/mailboxes/example.com/user/public/example.com/verteiler/.info/dovecot.index.pvt view is inconsistent dovecot.index.pvt.log is beeing created. We found some appearance of this issue in forums but without any sufficient solution. Is the information provided in this email enough? What else would be relevant? Thank you! Tobias

2 1

blacklistd support for dovecot
by Kurt Lidl 20 Sep '18

20 Sep '18

Greetings all! I ported the NetBSD blacklistd support into FreeBSD a while ago (FreeBSD 11.x timeframe). I also added support to several of the system daemons there, so they could all talk to a centralized daemon (blacklistd). One of the third party apps that I added support to was sendmail - that works pretty well. So I'm now finally turning my attention adding blacklistd support to dovecot (which is the imap daemon that I use). I did an implementation to an earlier version, and that worked OK, at least for non-encrypted access to the imap server. However, the encrypted access (TLS) doesn't work right. To authenticate a network connection, the daemon must pass the fd of the remote connection over a unix domain socket to the actual blacklistd daemon. The blacklistd daemon will then call getpeername() on the connection, so it can determine the remote connection endpoint, rather than just having to believe some made-up set of data that is passed to it from process on the local machine. Christos Zoulas' talk on blacklistd is here: https://www.youtube.com/watch?v=fuuf8G28mjs Anyhow -- the problem I've run into is that there doesn't seem to be any way to get access to the fd of the socket that holds the raw connection to the client when TLS encryption is active. It looks like the only connection I get is to the proxy process. Is there any guidance that someone can give with how to implement this? Thank you. -Kurt

2 1

[Sieve] How to retrieve part of message as a variable
by Adam Raszkiewicz 19 Sep '18

19 Sep '18

I need to retrieve some parts of a message which looks like Subject: Test message Message-Id: <2788db2f-b5c3-4b8c-881e-362c3df4f915(a)server.local> Mime-Version: 1.0 Content-Type: multipart/report; boundary="----=_Part_fba0c199dfcd4d60ae506b37a6320a84"; report-type=disposition-notification To: adam(a)test.local Date: Mon, 17 Sep 2018 16:21:45 -0400 (EDT) From: postmaster(a)server.local ------=_Part_fba0c199dfcd4d60ae506b37a6320a84 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit BTW, this is the correct notification ... it should be "failed" not "failure". ------=_Part_fba0c199dfcd4d60ae506b37a6320a84 Content-Type: message/notification Content-Transfer-Encoding: 7bit Final-Recipient: rfc822; eve(a)test.local Original-Message-ID: <06dbfc12-57a5-49bd-84bd-a24bc3ba1e42(a)fake.cernerasp> ------=_Part_fba0c199dfcd4d60ae506b37a6320a84— for an example I need to grab what is after “Final-Recipient: rfc822;” and “Original-Message-ID:” and store them as variables Thanks

1 0

Re: Auth process sometimes stop responding after upgrade
by Simone Lazzaris 19 Sep '18

19 Sep '18

In data martedì 18 settembre 2018 14:07:26 CEST, Aki Tuomi ha scritto: > If you are using systemd, create > /etc/systemd/system/dovecot.service.d/limits.conf and put > [Service]LimitCORE=infinity > > and run > systemctl daemon-reloadsystemctl restart dovecot Nope, I'm on a debian 7, without systemd. Anyway, I've resolved the issue: I had to set fs.suid_dumpable BEFORE starting dovecot. I've got a core dump, and here is the backtrace. Let me know if you want the core file. gdb) bt #0 0xb76e4428 in __kernel_vsyscall () #1 0xb74636c1 in raise () from /lib/i386-linux-gnu/i686/cmov/libc.so.6 #2 0xb7466af2 in abort () from /lib/i386-linux-gnu/i686/cmov/libc.so.6 #3 0xb76485ae in default_fatal_finish (type=<optimized out>, status=status@entry=0) at failures.c:201 #4 0xb7648641 in i_internal_fatal_handler (ctx=0xbf839cc0, format=0x805c274 "file %s: line %d (%s): assertion failed: (%s)", args=0xbf839ce4 "4\370\005\bI\004") at failures.c:670 #5 0xb75ce35e in i_panic (format=format@entry=0x805c274 "file %s: line %d (%s): assertion failed: (%s)") at failures.c:275 #6 0x080574f7 in doveadm_connection_deinit (_conn=_conn@entry=0xbf839d60) at doveadm-connection.c:1097 #7 0x08057f03 in doveadm_connection_input (conn=0x0) at doveadm-connection.c:1051 #8 0xb76613db in io_loop_call_io (io=0x82fb780) at ioloop.c:600 #9 0xb7662e1e in io_loop_handler_run_internal (ioloop=ioloop@entry=0x82bd648) at ioloop-epoll.c:223 #10 0xb7661496 in io_loop_handler_run (ioloop=ioloop@entry=0x82bd648) at ioloop.c:649 #11 0xb7661658 in io_loop_run (ioloop=0x82bd648) at ioloop.c:624 #12 0xb75da45e in master_service_run (service=0x82bd578, callback=callback@entry=0x804d360 <client_connected>) at master-service.c:719 #13 0x0804cf5e in main (argc=1, argv=0x82bd300) at main.c:366 *Simone Lazzaris* *Qcom S.p.A.* simone.lazzaris(a)qcom.it[1] | www.qcom.it[2] * LinkedIn[3]* | *Facebook*[4] [5] -------- [1] mailto:simone.lazzaris@qcom.it [2] https://www.qcom.it [3] https://www.linkedin.com/company/qcom-spa [4] http://www.facebook.com/qcomspa [5] https://www.qcom.it/includes/email-banner.gif

3 8

HTTP DoveAdm API - Possible bug?
by Chris Malton 19 Sep '18

19 Sep '18

Hi all, It seems that setting userMask in the doveadm http api's "user" command to anything involving wildcards ?s or *s causes the API to fail. When using the API with a userMask set to the fully qualified email address, I get the expected fields back. From a python shell, with an asterisk causes the following behaviour (note that doveadm is a python module that wrappers the dovecot API into Python's requests module). >>> doveadm.do_query("http://[xxxx:xxxx:xxxx:xxxx::ffff]:24280", "API_KEY_HERE", [ ["user", { "userMask": ["*"] }, "c01"] ]) '[["doveadmResponse",,"c01"]]' If I run the same command with a valid mailbox in the userMask Field, I get the response I expect: >>> doveadm.do_query("http://[[xxxx:xxxx:xxxx:xxxx::ffff]:24280", "API_KEY_HERE", [ ["user", { "userMask": ["test(a)test.mydomain.com"] }, "c01"] ]) '[["doveadmResponse",{"test(a)test.mydomain.com":{"uid":"x","gid":"y","home":"/mail/test.mydomain.com/users/test","mail":"maildir:/mail/test.mydomain.com/users/test/Maildir/:INDEX=/indexes/test.myd…","nice":"10"}},"c01"]]' Chatting with people in #dovecot revealed similar behaviour elsewhere so it doesn't appear to be just me. I've also selectively edited the above to avoid leaking data. We're running on the following # 2.2.34 (874deae): /etc/dovecot/dovecot.conf # Pigeonhole version 0.4.22 (22940fb7) # OS: Linux 4.9.0-7-amd64 x86_64 Debian 9.5 ext4 If you need a full copy of the config, please let me know and I'll talk to my client, however, I don't think this is config related. Thanks in advance. Regards, Chris Malton -- Delta V Technologies Limited 03333 402 402 www.deltav-tech.co.uk Office: 17 Elm Close, Southampton, SO16 7DT Company No. 11006104 Registered in England and Wales

2 2

Re: dovecot (2.2.13) panic on imap-login from iphone se
by Andre Hoepner - i.based: Systemhaus GmbH + Co. KG 18 Sep '18

18 Sep '18

here is our config: (doveconf -n) # 2.2.13: /etc/dovecot/dovecot.conf # OS: Linux 3.6.11-gentoo x86_64 Gentoo Base System release 2.2 auth_cache_size = 10 M auth_mechanisms = plain login default_client_limit = 1024 default_process_limit = 256 hostname = HOSTNAME imap_client_workarounds = delay-newmail tb-extra-mailbox-sep info_log_path = /var/log/dovecot.log listen = * mail_location = maildir:~/Maildir mail_plugins = quota acl zlib mail_privileged_group = mail managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date ihave duplicate namespace { list = yes location = maildir:/home/shared/Maildir:CONTROL=~/Maildir/control/shared:INDEX=~/Maildir/index/shared prefix = Shared separator = / subscriptions = no type = public } namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = separator = / type = private } passdb { args = * driver = pam } passdb { driver = passwd } passdb { driver = shadow } plugin { acl = vfile autocreate = Trash autocreate2 = Junk autocreate3 = Sent autocreate4 = Drafts quota = maildir:User quota quota_rule = *:storage=3800M quota_rule2 = Trash:storage=+500M quota_warning = storage=95%% quota-warning 95 %u quota_warning2 = storage=85%% quota-warning 85 %u sieve = ~/.dovecot.sieve sieve_dir = ~/sieve } postmaster_address = ADMIN-EMAIL protocols = imap lmtp sieve service auth { unix_listener /var/spool/postfix/private/auth { mode = 0666 } } service imap-login { inet_listener imaps { ssl = yes } } service managesieve-login { inet_listener sieve { port = 4190 } } service quota-warning { executable = script /usr/bin/dovecot-quota-warning.sh user = dovecot } ssl_ca = </etc/ssl/ssl.pem ssl_cert = </etc/ssl/ssl.crt ssl_key = </etc/ssl/ssl.key ssl_protocols = !SSLv2 !SSLv3 userdb { driver = passwd } protocol lmtp { mail_fsync = optimized } protocol lda { mail_fsync = optimized mail_plugins = sieve quota } protocol imap { mail_plugins = quota acl zlib imap_quota imap_acl } ############## # doveadm user USERNAME field value uid 950 gid 501 home /home/USERNAME mail maildir:~/Maildir system_groups_user USERNAME ############### Hope this helps. Andre Am 18.09.2018 um 18:49 schrieb Aki Tuomi: > Please keep replies on list. Can you provide doveconf -n and output of > doveadm user victim ? > > --- > Aki Tuomi > Dovecot oy > > -------- Original message -------- > From: "Andre Hoepner - i.based: Systemhaus GmbH + Co. KG" > <a.hoepner(a)ibased.de> > Date: 18/09/2018 19:13 (GMT+02:00) > To: Aki Tuomi <aki.tuomi(a)dovecot.fi> > Subject: Re: dovecot (2.2.13) panic on imap-login from iphone se > > > Sorry. I think upgrade is not possible because it is a very outdated > gentoo installation and im not abe to compile without compiling the > whole source stack of glibc and all other dependencies. > > It is planned to replace the server in the next 8 weeks with a new > system, but this 8 weeks the server must do the work. > > Andre > > > Am 18.09.2018 um 17:09 schrieb Aki Tuomi: >> Can you upgrade to 2.2.36 or 2.3.2.1 and reproduce this issue? 2.2.13 is >> quite old. >> >> >> >> --- >> Aki Tuomi >> Dovecot oy >> >> -------- Original message -------- >> From: "Andre Hoepner - i.based: Systemhaus GmbH + Co. KG" >> <a.hoepner(a)ibased.de> >> Date: 18/09/2018 16:17 (GMT+02:00) >> To: dovecot(a)dovecot.org >> Subject: dovecot (2.2.13) panic on imap-login from iphone se >> >> >> Hi to all, >> >> we have trouble with one user account, when using imap-login with iphone >> se. The user can login and use the account from webmail (roundcube) and >> from thunderbird without any errors and without any restrictions. >> >> But if we use the account on an iphone se and try to use imap based >> emails, there comes the following error (look at the end of the mail). >> I have no idea, what for an error it is. Same account on an iphone 5 >> works without any trouble. >> >> We have delete the homedir of the user and also recreated the user with >> new uid and new password. Webmail and thunderbird are fine, but if we >> use the iphone se we got this error. >> >> Are there any known issues with this combination? >> Thanks for your help. >> >> best regardings >> Andre Hoepner >> >> ---8<---- >> # HOST = hostname of the system; USER = username that gets this error >> >> Sep 18 12:46:02 HOST dovecot: imap(USER): Panic: file mailbox-list.c: >> line 1125 >> (mailbox_list_try_mkdir_root): assertion failed: (strncmp(root_dir, >> path, strlen(root_dir)) == 0) >> >> Sep 18 12:46:02 HOST dovecot: imap(USER): Error: Raw backtrace: >> /usr/lib64/dovecot/libdovecot.so.0(+0x6552e) [0x7f4333e0452e] >> -> /usr/lib64/dovecot/libdovecot.so.0(+0x65596) [0x7f4333e04596] >> -> /usr/lib64/dovecot/libdovecot.so.0(i_fatal+0) [0x7f4333dc423e] >> -> >> > /usr/lib64/dovecot/libdovecot-storage.so.0(mailbox_list_try_mkdir_root+0x469) >> [0x7f43340d3a5a] >> -> >> /usr/lib64/dovecot/libdovecot-storage.so.0(mailbox_list_mkdir_root+0x15) >> [0x7f43340d3ac0] >> -> /usr/lib64/dovecot/libdovecot-storage.so.0(+0x570cb) [0x7f43340c40cb] >> -> /usr/lib64/dovecot/libdovecot-storage.so.0(maildir_set_deleted+0x11a) >> [0x7f43340c465c] >> -> /usr/lib64/dovecot/libdovecot-storage.so.0(+0x563d5) [0x7f43340c33d5] >> -> >> /usr/lib64/dovecot/libdovecot-storage.so.0(maildir_uidlist_sync_init+0x33) >> [0x7f43340c34f7] >> -> /usr/lib64/dovecot/libdovecot-storage.so.0(+0x517ac) [0x7f43340be7ac] >> -> /usr/lib64/dovecot/libdovecot-storage.so.0(+0x51c59) [0x7f43340bec59] >> -> >> /usr/lib64/dovecot/libdovecot-storage.so.0(maildir_storage_sync_init+0xb5) >> [0x7f43340bef35] >> -> /usr/lib64/dovecot/libdovecot-storage.so.0(mailbox_sync_init+0x2b) >> [0x7f43340cc405] >> -> /usr/lib64/dovecot/libdovecot-storage.so.0(mailbox_sync+0x27) >> [0x7f43340cc4f1] >> -> >> /usr/lib64/dovecot/libdovecot-storage.so.0(index_storage_get_status+0x2f) >> [0x7f43340f1f6a] >> -> /usr/lib64/dovecot/lib01_acl_plugin.so(+0xdff9) [0x7f43335ffff9] >> -> /usr/lib64/dovecot/libdovecot-storage.so.0(mailbox_get_status+0x31) >> [0x7f43340cd36c] >> -> dovecot/imap(imap_status_get+0x5f) [0x41dc1d] >> -> dovecot/imap() [0x410cf9] >> -> dovecot/imap(cmd_list_full+0x49d) [0x411297] >> -> dovecot/imap(command_exec+0x37) [0x417f20] >> -> dovecot/imap() [0x4170c9] >> -> dovecot/imap() [0x417174] >> -> dovecot/imap(client_handle_input+0x106) [0x417400] >> -> dovecot/imap(client_input+0x72) [0x417768] >> -> /usr/lib64/dovecot/libdovecot.so.0(io_loop_call_io+0x3f) > [0x7f4333e13536] >> -> /usr/lib64/dovecot/libdovecot.so.0(io_loop_handler_run_internal+0xd1) >> [0x7f4333e142e6] >> -> /usr/lib64/dovecot/libdovecot.so.0(io_loop_handler_run+0x9) >> [0x7f4333e13598] >> >> Sep 18 12:46:02 HOST dovecot: imap(USER): Fatal: master: service(imap): >> child 32253 >> killed with signal 6 (core dumps disabled) >> ---8<---- > > -- > > Sie möchten wissen, warum wir die Richtigen für Ihr > Unternehmen sind? Lesen Sie hier ... > http://www.11-gute-gruende.de > > > i.based: Systemhaus GmbH & Co. KG > Langenstrasse 38 > 18439 Stralsund > Deutschland > > http://www.ibased.de > a.hoepner(a)ibased.de > > fon: 03831-28944-0 > fax: 03831-28944-29 > > Registergericht: > HRA 2072 Amtsgericht Stralsund > > Geschäftsführung: > i.based: Systemhaus Verwaltungs GmbH > > Steuer-Nr: 082/187/38401 > USt.-ID: DE254322988 > > persönlich haftend: > i.based: Systemhaus Verwaltungs- > GmbH, Stralsund > HRB 7189 Amtsgericht Stralsund > > vertreten durch: > André Höpner, Mathias Waldeck > > https://www.linkedin.com/in/andre-hoepner/ > https://www.xing.com/hp/andre_hoepner -- Sie möchten wissen, warum wir die Richtigen für Ihr Unternehmen sind? Lesen Sie hier ... http://www.11-gute-gruende.de i.based: Systemhaus GmbH & Co. KG Langenstrasse 38 18439 Stralsund Deutschland http://www.ibased.de a.hoepner(a)ibased.de fon: 03831-28944-0 fax: 03831-28944-29 Registergericht: HRA 2072 Amtsgericht Stralsund Geschäftsführung: i.based: Systemhaus Verwaltungs GmbH Steuer-Nr: 082/187/38401 USt.-ID: DE254322988 persönlich haftend: i.based: Systemhaus Verwaltungs- GmbH, Stralsund HRB 7189 Amtsgericht Stralsund vertreten durch: André Höpner, Mathias Waldeck https://www.linkedin.com/in/andre-hoepner/ https://www.xing.com/hp/andre_hoepner

2 1

Re: dovecot (2.2.13) panic on imap-login from iphone se
by Aki Tuomi 18 Sep '18

18 Sep '18

Please keep replies on list. Can you provide doveconf -n and output of doveadm user victim ? ---Aki TuomiDovecot oy -------- Original message --------From: "Andre Hoepner - i.based: Systemhaus GmbH + Co. KG" <a.hoepner(a)ibased.de> Date: 18/09/2018 19:13 (GMT+02:00) To: Aki Tuomi <aki.tuomi(a)dovecot.fi> Subject: Re: dovecot (2.2.13) panic on imap-login from iphone se Sorry. I think upgrade is not possible because it is a very outdated gentoo installation and im not abe to compile without compiling the whole source stack of glibc and all other dependencies. It is planned to replace the server in the next 8 weeks with a new system, but this 8 weeks the server must do the work. Andre Am 18.09.2018 um 17:09 schrieb Aki Tuomi: > Can you upgrade to 2.2.36 or 2.3.2.1 and reproduce this issue? 2.2.13 is > quite old. > > > > --- > Aki Tuomi > Dovecot oy > > -------- Original message -------- > From: "Andre Hoepner - i.based: Systemhaus GmbH + Co. KG" > <a.hoepner(a)ibased.de> > Date: 18/09/2018 16:17 (GMT+02:00) > To: dovecot(a)dovecot.org > Subject: dovecot (2.2.13) panic on imap-login from iphone se > > > Hi to all, > > we have trouble with one user account, when using imap-login with iphone > se. The user can login and use the account from webmail (roundcube) and > from thunderbird without any errors and without any restrictions. > > But if we use the account on an iphone se and try to use imap based > emails, there comes the following error (look at the end of the mail). > I have no idea, what for an error it is. Same account on an iphone 5 > works without any trouble. > > We have delete the homedir of the user and also recreated the user with > new uid and new password. Webmail and thunderbird are fine, but if we > use the iphone se we got this error. > > Are there any known issues with this combination? > Thanks for your help. > > best regardings > Andre Hoepner > > ---8<---- > # HOST = hostname of the system; USER = username that gets this error > > Sep 18 12:46:02 HOST dovecot: imap(USER): Panic: file mailbox-list.c: > line 1125 > (mailbox_list_try_mkdir_root): assertion failed: (strncmp(root_dir, > path, strlen(root_dir)) == 0) > > Sep 18 12:46:02 HOST dovecot: imap(USER): Error: Raw backtrace: > /usr/lib64/dovecot/libdovecot.so.0(+0x6552e) [0x7f4333e0452e] > -> /usr/lib64/dovecot/libdovecot.so.0(+0x65596) [0x7f4333e04596] > -> /usr/lib64/dovecot/libdovecot.so.0(i_fatal+0) [0x7f4333dc423e] > -> > /usr/lib64/dovecot/libdovecot-storage.so.0(mailbox_list_try_mkdir_root+0x469) > [0x7f43340d3a5a] > -> > /usr/lib64/dovecot/libdovecot-storage.so.0(mailbox_list_mkdir_root+0x15) > [0x7f43340d3ac0] > -> /usr/lib64/dovecot/libdovecot-storage.so.0(+0x570cb) [0x7f43340c40cb] > -> /usr/lib64/dovecot/libdovecot-storage.so.0(maildir_set_deleted+0x11a) > [0x7f43340c465c] > -> /usr/lib64/dovecot/libdovecot-storage.so.0(+0x563d5) [0x7f43340c33d5] > -> > /usr/lib64/dovecot/libdovecot-storage.so.0(maildir_uidlist_sync_init+0x33) > [0x7f43340c34f7] > -> /usr/lib64/dovecot/libdovecot-storage.so.0(+0x517ac) [0x7f43340be7ac] > -> /usr/lib64/dovecot/libdovecot-storage.so.0(+0x51c59) [0x7f43340bec59] > -> > /usr/lib64/dovecot/libdovecot-storage.so.0(maildir_storage_sync_init+0xb5) > [0x7f43340bef35] > -> /usr/lib64/dovecot/libdovecot-storage.so.0(mailbox_sync_init+0x2b) > [0x7f43340cc405] > -> /usr/lib64/dovecot/libdovecot-storage.so.0(mailbox_sync+0x27) > [0x7f43340cc4f1] > -> > /usr/lib64/dovecot/libdovecot-storage.so.0(index_storage_get_status+0x2f) > [0x7f43340f1f6a] > -> /usr/lib64/dovecot/lib01_acl_plugin.so(+0xdff9) [0x7f43335ffff9] > -> /usr/lib64/dovecot/libdovecot-storage.so.0(mailbox_get_status+0x31) > [0x7f43340cd36c] > -> dovecot/imap(imap_status_get+0x5f) [0x41dc1d] > -> dovecot/imap() [0x410cf9] > -> dovecot/imap(cmd_list_full+0x49d) [0x411297] > -> dovecot/imap(command_exec+0x37) [0x417f20] > -> dovecot/imap() [0x4170c9] > -> dovecot/imap() [0x417174] > -> dovecot/imap(client_handle_input+0x106) [0x417400] > -> dovecot/imap(client_input+0x72) [0x417768] > -> /usr/lib64/dovecot/libdovecot.so.0(io_loop_call_io+0x3f) [0x7f4333e13536] > -> /usr/lib64/dovecot/libdovecot.so.0(io_loop_handler_run_internal+0xd1) > [0x7f4333e142e6] > -> /usr/lib64/dovecot/libdovecot.so.0(io_loop_handler_run+0x9) > [0x7f4333e13598] > > Sep 18 12:46:02 HOST dovecot: imap(USER): Fatal: master: service(imap): > child 32253 > killed with signal 6 (core dumps disabled) > ---8<---- -- Sie möchten wissen, warum wir die Richtigen für Ihr Unternehmen sind? Lesen Sie hier ... http://www.11-gute-gruende.de i.based: Systemhaus GmbH & Co. KG Langenstrasse 38 18439 Stralsund Deutschland http://www.ibased.de a.hoepner(a)ibased.de fon: 03831-28944-0 fax: 03831-28944-29 Registergericht: HRA 2072 Amtsgericht Stralsund Geschäftsführung: i.based: Systemhaus Verwaltungs GmbH Steuer-Nr: 082/187/38401 USt.-ID: DE254322988 persönlich haftend: i.based: Systemhaus Verwaltungs- GmbH, Stralsund HRB 7189 Amtsgericht Stralsund vertreten durch: André Höpner, Mathias Waldeck https://www.linkedin.com/in/andre-hoepner/ https://www.xing.com/hp/andre_hoepner

1 0

dovecot (2.2.13) panic on imap-login from iphone se
by Andre Hoepner - i.based: Systemhaus GmbH + Co. KG 18 Sep '18

18 Sep '18

Hi to all, we have trouble with one user account, when using imap-login with iphone se. The user can login and use the account from webmail (roundcube) and from thunderbird without any errors and without any restrictions. But if we use the account on an iphone se and try to use imap based emails, there comes the following error (look at the end of the mail). I have no idea, what for an error it is. Same account on an iphone 5 works without any trouble. We have delete the homedir of the user and also recreated the user with new uid and new password. Webmail and thunderbird are fine, but if we use the iphone se we got this error. Are there any known issues with this combination? Thanks for your help. best regardings Andre Hoepner ---8<---- # HOST = hostname of the system; USER = username that gets this error Sep 18 12:46:02 HOST dovecot: imap(USER): Panic: file mailbox-list.c: line 1125 (mailbox_list_try_mkdir_root): assertion failed: (strncmp(root_dir, path, strlen(root_dir)) == 0) Sep 18 12:46:02 HOST dovecot: imap(USER): Error: Raw backtrace: /usr/lib64/dovecot/libdovecot.so.0(+0x6552e) [0x7f4333e0452e] -> /usr/lib64/dovecot/libdovecot.so.0(+0x65596) [0x7f4333e04596] -> /usr/lib64/dovecot/libdovecot.so.0(i_fatal+0) [0x7f4333dc423e] -> /usr/lib64/dovecot/libdovecot-storage.so.0(mailbox_list_try_mkdir_root+0x469) [0x7f43340d3a5a] -> /usr/lib64/dovecot/libdovecot-storage.so.0(mailbox_list_mkdir_root+0x15) [0x7f43340d3ac0] -> /usr/lib64/dovecot/libdovecot-storage.so.0(+0x570cb) [0x7f43340c40cb] -> /usr/lib64/dovecot/libdovecot-storage.so.0(maildir_set_deleted+0x11a) [0x7f43340c465c] -> /usr/lib64/dovecot/libdovecot-storage.so.0(+0x563d5) [0x7f43340c33d5] -> /usr/lib64/dovecot/libdovecot-storage.so.0(maildir_uidlist_sync_init+0x33) [0x7f43340c34f7] -> /usr/lib64/dovecot/libdovecot-storage.so.0(+0x517ac) [0x7f43340be7ac] -> /usr/lib64/dovecot/libdovecot-storage.so.0(+0x51c59) [0x7f43340bec59] -> /usr/lib64/dovecot/libdovecot-storage.so.0(maildir_storage_sync_init+0xb5) [0x7f43340bef35] -> /usr/lib64/dovecot/libdovecot-storage.so.0(mailbox_sync_init+0x2b) [0x7f43340cc405] -> /usr/lib64/dovecot/libdovecot-storage.so.0(mailbox_sync+0x27) [0x7f43340cc4f1] -> /usr/lib64/dovecot/libdovecot-storage.so.0(index_storage_get_status+0x2f) [0x7f43340f1f6a] -> /usr/lib64/dovecot/lib01_acl_plugin.so(+0xdff9) [0x7f43335ffff9] -> /usr/lib64/dovecot/libdovecot-storage.so.0(mailbox_get_status+0x31) [0x7f43340cd36c] -> dovecot/imap(imap_status_get+0x5f) [0x41dc1d] -> dovecot/imap() [0x410cf9] -> dovecot/imap(cmd_list_full+0x49d) [0x411297] -> dovecot/imap(command_exec+0x37) [0x417f20] -> dovecot/imap() [0x4170c9] -> dovecot/imap() [0x417174] -> dovecot/imap(client_handle_input+0x106) [0x417400] -> dovecot/imap(client_input+0x72) [0x417768] -> /usr/lib64/dovecot/libdovecot.so.0(io_loop_call_io+0x3f) [0x7f4333e13536] -> /usr/lib64/dovecot/libdovecot.so.0(io_loop_handler_run_internal+0xd1) [0x7f4333e142e6] -> /usr/lib64/dovecot/libdovecot.so.0(io_loop_handler_run+0x9) [0x7f4333e13598] Sep 18 12:46:02 HOST dovecot: imap(USER): Fatal: master: service(imap): child 32253 killed with signal 6 (core dumps disabled) ---8<----

2 1

Re: Auth process sometimes stop responding after upgrade
by Timo Sirainen 18 Sep '18

18 Sep '18

On 8 Sep 2018, at 15.18, Simone Lazzaris <simone.lazzaris(a)qcom.it> wrote: > > Timo, unfortunately the patch doesn't compile; I've moved the declaration of > "conn" one line up to make it work. Oops, I guess I was too much in a hurry to even compile it. Here's a new patch that compiles and passes our director CI tests.

4 9

Using both starttls and ssl in passdb on proxy results in timeouts
by Filias Heidt 18 Sep '18

18 Sep '18

Hi List, I have a dovecot which proxies to different backends depending on an entry in a mysql-database. The mysql-query sets ‚ssl‘ to ‚any-cert‘ and this works fine. But this causes me a problem: sieve-backends only support STARTTLS and if I set ‚ssl‘ to ‚any-cert‘ (or yes), it will attempt a TLS-connection to the sieve-backends, which fails. My attempt was to alter the query to include %{real_lport} and return ‚ssl=no‘ and ‚starttls=any-cert‘ if the port matches the sieve-port. It works as expected in that it returns the correct values and proxies to the correct backend. However it seems that TLS is no longer working and I get timeouts from the backends. Debug: client passdb out: OK 1 user=someuser(a)example.com proxy proxy_nopipelining=y host=backend1.example.com nodelay=y nologin starttls=no ssl=any-cert hostip=so.me.i.p pass=<hidden> results in: Sep 17 11:08:47 imapproxy1 dovecot: imap-login: Error: proxy(someuser(a)example.com): Login for so.me.i.p:993 timed out in state=/none (after 30 secs, local=lo.cal.i.p:60524): user=<someuser(a)example.com>, method=PLAIN, rip=re.mo.te.ip, lip=lo.cal.i.p, TLS, session=<OySXgw12auwgARYIAAYABwAAAAAAAwAU> My query looks like this: password_query = SELECT host from proxy_domain, NULL as password, 'y' as nopassword, 'y' as proxy, NULL as destuser, 'y' as proxy_nopipelining, 'y' as nodelay, 'y' as nologin, IF(%{real_lport}=4190, 'any-cert', 'no') as 'starttls', IF(%{real_lport}<>4190, 'any-cert', 'no') as 'ssl‘; As soon as I remove the starttls-part and the passdb only returns ssl=any-cert (without starttls=no) it works flawlessly. Is it possible that I am attacking the problem the wrong way? Or is it not possible to set both starttls and ssl to some values in passdb and enable/disable them as needed? Thanks for any input :) Cheers, Filias

2 2

How to send mail to mailbox with disabled domain?
by Kai Schaetzl 17 Sep '18

17 Sep '18

Given the following: mailboxes: user1(a)example1.com user2(a)example1.com user3(a)example1.com etc. aliases: whatever(a)example1.com -> user1(a)example1.com whatever(a)example2.com -> user1(a)example1.com whatever(a)example3.com -> user1(a)example1.com Now the problem: example1.com MX goes elsewhere (doesn't point to this server anymore). Domains example2.com and example3.com still point to that server and should be able to accept mail. I have to disable mail acceptance for example1.com. If not, mail sent *from* that server (e.g. from a web form) to that domain will not leave the server. However, if I disable example1.com for mail dovecot lmtp will not deliver mail to this mail box anymore, although the mailbox still exists. How can I solve this? Is there a way of solving this, but keeping the domain example1.com in the name for these mailboxes? Or is there a way to tell dovecot to ignore domains for mailbox names? e.g. deliver to "user1"? (All user localparts are unique.) Thanks for any hints. Kai

4 6

Re: Proxy secured incoming POP3/IMAP4 to unsecure backend?
by Alexander Chekalin 17 Sep '18

17 Sep '18

Thank you! Ok, so I can omit ssl=no and startssl=no, and this results in default settings for ssl which is 'off'? Or the defaults are 'on' anyway? Can I somehow specify ports on remote hosts that proxy will use to connect to? Like (just image): 'proxy host_imap=10.1.1.1:143 host_pop=10.1.1.1:110' or somehow? On Mon, Sep 17, 2018 at 4:33 PM Aki Tuomi <aki.tuomi(a)dovecot.fi> wrote: > Due to certain design issues, the ssl=no is actually same as ssl=yes, same > goes for starttls=no. So there is no support actually for "ssl=no" at this > moment. > > Aki > > > On 17 September 2018 at 15:32 Alexander Chekalin < > alexander.chekalin(a)gmail.com> wrote: > > > > > > Surely. > > > > Here it is: > > > > # doveadm auth user(a)domain.com > > Password: > > passdb: chekalin_krg(a)ascon.ru auth succeeded > > extra fields: > > user=user(a)domain.com > > proxy > > host=10.10.14.131 > > ssl=no > > startssl=no > > source_ip=10.10.14.2 > > proxy > > proxy > > pass=password > > > > Two "proxy" are from two "proxy" and "proxy=yes" settings passed from > > passdb. > > > > On Mon, Sep 17, 2018 at 3:03 PM Aki Tuomi <aki.tuomi(a)dovecot.fi> wrote: > > > > > Can you provide output of > > > > > > doveadm auth test some-user > > > Aki > > > > > > On 17.09.2018 14:58, Alexander Chekalin wrote: > > > > > > Dear Aki, > > > > > > we keep our users in LDAP so I when I even return 'proxy > host=backend_ip > > > tls=no' it won't use non-TLS connection. The same is when I remove > 'tls=no' > > > part. May there be any extra things I need to pass when I use LDAP? > > > > > > On Mon, Sep 17, 2018 at 2:07 PM Aki Tuomi <aki.tuomi(a)dovecot.fi> > wrote: > > > > > >> > > >> > > >> On 17.09.2018 13:59, Alexander Chekalin wrote: > > >> > Hi, > > >> > > > >> > I try to set up dovecot as a proxy server, to proxy requests to > > >> > several dovecot-based backend servers. I wand external clients who > > >> > connects to this proxy Dovecot to use TLS (this is easy to set up) > > >> > while want to have unsecured (plain IMAP/POP) connections to > backends. > > >> > > > >> > You see, links to backends are over LAN so no TLS needed, and these > > >> > backends are poor old machines (with old Docecots like 2.0.6) this > is > > >> > why I don't want to use TLS to acces backends. > > >> > > > >> > But as I did the test setup I can see proxy Dovecot uses TLS to > > >> > connect to backends. Is there any way I can specify this aspect of > > >> > Dovecot proxy? > > >> > > > >> > Please advice! > > >> > > > >> > Yours, > > >> > Alexander > > >> > > >> Dovecot does not use TLS/SSL when connecting to a backend server by > > >> default, you are probably specifying this in your proxy config or > > >> password database. > > >> > > >> Aki > > >> > > > > > > >

2 5

Proxy secured incoming POP3/IMAP4 to unsecure backend?
by Alexander Chekalin 17 Sep '18

17 Sep '18

Hi, I try to set up dovecot as a proxy server, to proxy requests to several dovecot-based backend servers. I wand external clients who connects to this proxy Dovecot to use TLS (this is easy to set up) while want to have unsecured (plain IMAP/POP) connections to backends. You see, links to backends are over LAN so no TLS needed, and these backends are poor old machines (with old Docecots like 2.0.6) this is why I don't want to use TLS to acces backends. But as I did the test setup I can see proxy Dovecot uses TLS to connect to backends. Is there any way I can specify this aspect of Dovecot proxy? Please advice! Yours, Alexander

3 2

Problem with envelope from in Pigeonhole after upgrade
by David Dodd 17 Sep '18

17 Sep '18

On our FreeBSD 11.2 servers, we recently upgraded from: dovecot2-2.2.26.0_1 dovecot-pigeonhole-0.4.16_1 to: dovecot-2.3.2.1 dovecot-pigeonhole-0.5.2_3 Prior to the upgrade the envelope sender was as expected. After the upgrade, the envelope sender for a user with a sieve script configured is now being set to: >From MAILER-DAEMON Tue Sep 04 13:31:39 2018 The same user without a sieve script in place gets: >From someone(a)gmail.com Tue Sep 04 11:06:04 2018 This happens when manually testing by directly executing: /usr/local/libexec/dovecot/dovecot-lda -d dgdtst -f someone(a)gmail.com It happens with an empty sieve script i.e. just using the implicit keep functionality. I have groped around looking for a configuration setting that might fix the behaviour but nothing I have tried helps. Can anyone suggest what to set to correct the problem ? -- Dave

2 7

Quotas not working with roundcube
by Mik J 17 Sep '18

17 Sep '18

Hello, I'm trying to have quotas working with roundcube. When I'm logged into roundcube I see 0% quota which seems to correspond to disabled. However I did everything that I could to enable quotas https://wiki.dovecot.org/Quota # doveconf -n auth_mechanisms = cram-md5 loginauth_verbose = yes debug_log_path = /tmp/dovecot.log first_valid_uid = 1000 log_path = /var/log/dovecot.log mail_gid = vmail mail_location = maildir:/home/mail/%d/%n/Maildir mail_plugins = notify replication quota mail_uid = vmail mbox_write_locks = fcntl mmap_disable = yes namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } passdb { driver = bsdauth } passdb { args = /etc/dovecot/dovecot.passwd driver = passwd-file } plugin { quota_grace = 10%% quota_rule = *:storage=2G quota_rule2 = Trash:storage=+200M quota_rule3 = SPAM:ignore quota_status_nouser = DUNNO quota_status_overquota = 552 5.2.2 Mailbox is full quota_status_success = DUNNO quota_warning = storage=95%% quota-warning 95 %u quota_warning2 = storage=80%% quota-warning 80 %u } ssl_ca = /etc/ssl/certs/CA_Intermed_Lets_Encrypt.crt ssl_cert = </etc/ssl/certs/imap.mydomain.org.crt ssl_key = # hidden, use -P to show it ssl_key_password = # hidden, use -P to show it userdb { driver = passwd } userdb { driver = static } protocol lda { mail_plugins = notify replication quota } protocol imap { mail_plugins = notify replication quota imap_quota }

3 5

Dsync deleting mailboxes due to duplicate UIDs
by Andreas Thienemann 16 Sep '18

16 Sep '18

Hi, I am attempting to migrate a mailspool from a cyrus server to a dovecot server using the dsync backup approach as described in the wiki at <https://wiki.dovecot.org/Migration/Dsync>. The first attempt works great. Everything copies over and a quick glance over the spool looks good. Running doveadm backup again though results in the following error: dsync(eggs): Warning: Deleting mailbox 'INBOX.MailRestore': UID=39 already exists locally for a different mail: Headers hashes don't match (18d567fc7e258a67e47b629c8bb16500 vs 230354b2d5cad21ebbb4a7440b977adb) As promised, the folder MailRestore is gone after dsync finishes. Running doveadm backup again for the third time copies the folder again. Running it a fourth time gives the same error and the folder is gone. Trying to figure this out I initially had a few mails where the header hashes were 68b329da9893e34099c7d8ad5cb9c940, the md5sum of an empty string. Turns out that the source mailspool had a few broken emails and cleaning these out fixed most my issues. But in this case, I am stumped. UID 39 on the server is a valid mail with correct headers and everything. Is there a good way of identifying the two mails that seem to clash? I had a quick look at the dovecot code but did not see how the header_stream gets hashed into the hdr_hash used for comparing mails. Thanks, Andreas

3 5

dovecot_deleted_to_trash no longer compiles with dovecot 2.3.2.1
by Robert S 16 Sep '18

16 Sep '18

I have just upgraded to the latest version of dovecot (Gentoo amd64). When I try to compile the dovecot_deleted_to_trash plugin it won't compile. Is this plugin going to be updated (from https://github.com/lexbrugman/dovecot_deleted_to_trash - same error from https://github.com/NethServer/dovecot-deleted-to-trash)? # make cc \ -fPIC -shared -Wall \ -I/usr/include/dovecot \ -I/usr/include/dovecot/src \ -I/usr/include/dovecot/src/lib \ -I/usr/include/dovecot/src/lib-storage \ -I/usr/include/dovecot/src/lib-mail \ -I/usr/include/dovecot/src/lib-imap \ -I/usr/include/dovecot/src/lib-index \ -DHAVE_CONFIG_H \ src/deleted-to-trash-plugin.c -o lib_deleted_to_trash_plugin.so src/deleted-to-trash-plugin.c: In function ‘copy_deleted_mail_to_trash’: src/deleted-to-trash-plugin.c:117:16: error: too few arguments to function ‘mail box_transaction_begin’ dest_trans = mailbox_transaction_begin(trash_box, MAILBOX_TRANSACTION_FLAG_EX TERNAL); ^~~~~~~~~~~~~~~~~~~~~~~~~ In file included from /usr/include/dovecot/mail-storage-private.h:7:0, from src/deleted-to-trash-plugin.h:5, from src/deleted-to-trash-plugin.c:4: /usr/include/dovecot/mail-storage.h:656:1: note: declared here mailbox_transaction_begin(struct mailbox *box, ^~~~~~~~~~~~~~~~~~~~~~~~~ make: *** [Makefile:32: lib_deleted_to_trash_plugin.so] Error 1 Some further info: # dovecot -n # 2.3.2.1 (0719df592): /etc/dovecot/dovecot.conf # OS: Linux 4.14.8-gentoo-r1 x86_64 Gentoo Base System release 2.4.1 # Hostname: basement-vm.schmidli.com.au doveconf: Warning: please set ssl_dh=</etc/dovecot/dh.pem doveconf: Warning: You can generate it with: dd if=/var/lib/dovecot/ssl-parameters.dat bs=1 skip=88 | openssl dhparam -inform der > /etc/dovecot/dh.pem dict { expire = db:/var/lib/dovecot/expire.db } disable_plaintext_auth = no listen = * mail_location = maildir:~/.maildir mail_plugins = deleted_to_trash mailbox_alias namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } passdb { args = * driver = pam } plugin { deleted_to_trash_folder = Trash expire = Trash 7 Spam 30 expire_dict = proxy::expire

1 0

Re: auth_policy in a non-authenticating proxy chain
by Peter Mogensen 15 Sep '18

15 Sep '18

On 09/15/2018 10:41 AM, Aki Tuomi wrote: > Point of sending the success ones is to maintain whitelist as well as > blacklist so you know which ones you should not tarpit anymore. We > know it does scale as we have very large deployments using the whole > three request per login model. > > "Success" in a proxy which is not it self authenticating is only whether it know where to proxy the requested username to. I'm not sure whether this would be input to a whitelist. I'm not doubting that 3 req/login scales. /Peter

2 1

auth_policy in a non-authenticating proxy chain
by Peter Mogensen 15 Sep '18

15 Sep '18

Hi, I was looking into the new Authentication Policy feature: https://wiki2.dovecot.org/Authentication/Policy I had kinda hoped that I would be able to enfore this in a proxy running in front of several backends. This proxy does not authenticate. It use "nopassword". But I realize that the "succes" reported in the final authpolicy req. (command=report) is not what is actaully happening on the IMAP protocol level, but rather the result of the passdb chain in the proxy. (I should probably have predicted this, it's kinda reasonable). However... since the proxy use "nopassword", ALL passdb lookups result in "success", so the proxy will never report an authentication failure to the authpolicy server. This, of course, forces me to do the authpolicy check on the backend with a shared state, but It would still have been nice to have the proxy being able to do the first "command=allow" req. and reject attemps already there even though the backend does "command=report". /Peter

3 4

encryption issue in outlook 2016
by ChandranManikandan 14 Sep '18

14 Sep '18

Hi Friends, Am facing the serious issue in outlook 2016. When i tried to configure the email in outlook 2016 it's asking encrypted connection and checked automatically and if not available then it showing unencrypted. but finally unable to configure the email account in outlook 2016 and not permitted. Do i need to update any in the server. Am using COS 6 32 and 64 bit servers with qmailtoaster + dovecot 2.2.7. Currently configured in outlook 2010 it's working without any issue. And always showing in outlook 2010 when i open the account. Do you want to continue yes or no for the certification. Because i have configured in advanced selected Auto in outlook 2010. If i select none it was not working the email. Anyone facing the same issue. How do i rectify it in outlook 2016 and how can i stop the certificate warning message in outlook. If possible to use without encryption and what's the configuration. Please advice and let me know the process. Am seriously cannot access the email from outlook. I have attached the message while open outlook. If i click yes then it will open Is the certificate expired. How do renew it or reload it with the fresh certificate. -- *Thanks & Best Regards,Manikandan.C*

4 4

Occasional crash in db-auth.c (Valgrind: Invalid read of size 4 et al.), Dovecot 2.2.27+
by Jonas Wielicki 14 Sep '18

14 Sep '18

Dear list, We are encountering troubles with dovecot using LDAP userdbs on Debian stretch (but if I’m reading valgrind correctly, we can reproduce this with vanilla dovecot master). Minimal reproducer below. While testing an upgrade to Debian stretch (dovecot-core=1:2.2.27-3+deb9u1), auth-worker has stopped working. We are using two LDAP user databases; one which is iterable, and one which is not (for reasons; I think this is not relevant; if it is, we’re happy to elaborate). The issue seems to be present in any LDAP userdb iteration handling, but it only seems to cause a crash in certain conditions which seem to be reproducibly caused by our setup for some reason. We’re seeing one of two errors. Variant A: Jan 27 13:40:05 up2 dovecot: auth-worker: Error: *** Error in `dovecot/auth': free(): corrupted unsorted chunks: 0x000056553f0fcfa0 *** Jan 27 13:40:05 up2 dovecot: auth-worker: Error: ======= Backtrace: ========= Jan 27 13:40:05 up2 dovecot: auth-worker: Error: /lib/x86_64-linux-gnu/ libc.so.6(+0x70bcb)[0x7f78426adbcb] Jan 27 13:40:05 up2 dovecot: auth-worker: Error: /lib/x86_64-linux-gnu/ libc.so.6(+0x76f96)[0x7f78426b3f96] Jan 27 13:40:05 up2 dovecot: auth-worker: Error: /lib/x86_64-linux-gnu/ libc.so.6(+0x777de)[0x7f78426b47de] Jan 27 13:40:05 up2 dovecot: auth-worker: Error: /usr/lib/dovecot/modules/ auth/libauthdb_ldap.so(+0x5bde)[0x7f7842008bde] Jan 27 13:40:05 up2 dovecot: auth-worker: Error: /usr/lib/dovecot/ libdovecot.so.0(io_loop_call_io+0x52)[0x7f78430cfdd2] Jan 27 13:40:05 up2 dovecot: auth-worker: Error: /usr/lib/dovecot/ libdovecot.so.0(io_loop_handler_run_internal+0x109)[0x7f78430d1409] Jan 27 13:40:05 up2 dovecot: auth-worker: Error: /usr/lib/dovecot/ libdovecot.so.0(io_loop_handler_run+0x3c)[0x7f78430cfe6c] Jan 27 13:40:05 up2 dovecot: auth-worker: Error: /usr/lib/dovecot/ libdovecot.so.0(io_loop_run+0x38)[0x7f78430d0018] Jan 27 13:40:05 up2 dovecot: auth-worker: Error: /usr/lib/dovecot/ libdovecot.so.0(master_service_run+0x13)[0x7f7843057e93] Jan 27 13:40:05 up2 dovecot: auth-worker: Error: dovecot/auth(main+0x398) [0x56553da45f98] Jan 27 13:40:05 up2 dovecot: auth-worker: Error: /lib/x86_64-linux-gnu/ libc.so.6(__libc_start_main+0xf1)[0x7f784265d2b1] Jan 27 13:40:05 up2 dovecot: auth-worker: Error: dovecot/auth(_start+0x2a) [0x56553da461aa] Variant B: Jan 27 13:06:56 up2 dovecot: auth-worker(27495): Panic: file db-ldap.c: line 840 (db_ldap_result_unref): assertion failed: (res->refcount > 0) Jan 27 13:06:56 up2 dovecot: auth-worker(27495): Error: Raw backtrace: /usr/ lib/dovecot/libdovecot.so.0(+0x95272) [0x7f027a4fc272] -> /usr/lib/dovecot/ libdovecot.so.0(+0x9536d) [0x7f027a4fc36d] -> /usr/lib/dovecot/libdovecot.so. 0(i_fatal+0) [0x7f027a492951] -> /usr/lib/dovecot/modules/auth/ libauthdb_ldap.so(+0x3868) [0x7f0279447868] -> /usr/lib/dovecot/modules/auth/ libauthdb_ldap.so(+0x5d7c) [0x7f0279449d7c] -> /usr/lib/dovecot/libdovecot.so. 0(io_loop_call_io+0x52) [0x7f027a510dd2] -> /usr/lib/dovecot/libdovecot.so. 0(io_loop_handler_run_internal+0x109) [0x7f027a512409] -> /usr/lib/dovecot/ libdovecot.so.0(io_loop_handler_run+0x3c) [0x7f027a510e6c] -> /usr/lib/ dovecot/libdovecot.so.0(io_loop_run+0x38) [0x7f027a511018] -> /usr/lib/ dovecot/libdovecot.so.0(master_service_run+0x13) [0x7f027a498e93] -> dovecot/ auth(main+0x398) [0x55b981cd2f98] -> /lib/x86_64-linux-gnu/libc.so. 6(__libc_start_main+0xf1) [0x7f0279a9e2b1] -> dovecot/auth(_start+0x2a) [0x55b981cd31aa] When running auth-worker within valgrind, we get more information (valgrind extract from mail.log attached for two versions of dovecot). We have attached mail.log contents for the respective valgrind runs. This seems to affect at least 2.2.27 onwards. We can reproduce the crash with our production data 100% of the time. The valgrind error is present even with very minimal setups (see below). Unfortunately, I haven’t been able so far to create an LDAP database which produces the crash as reliable as our production database does (which we cannot share for obvious reasons). Minimal Reproducer of Valgrind error: - Install dovecot 2.2.27 from debian stretch, or compile from master. - Install valgrind - In conf.d/10-auth.conf, disable auth-system.conf.ext - In conf.d/10-auth.conf, enable auth-ldap.conf.ext - Set contents of dovecot-ldap.conf.ext to: hosts = localhost base = dc=nodomain - In conf.d/10-master.conf, in section "service auth-worker", set executable = /usr/bin/valgrind /usr/lib/dovecot/auth -w (path may differ on your system) - Install an LDAP server with a database for dc=nodomain; this is trivial to do with debian: Simply install slapd and systemctl start slapd. - Start dovecot - Run doveadm user '*' - You should find the error in the mail.log. I hope this is somehow useful to fix our crash issue. We’ll be happy to provide more information as needed. kind regards, Jonas

4 4

Status of SMTPUTF8?
by Noah Tilton 14 Sep '18

14 Sep '18

I was wondering whether there is a roadmap for adding SMTPUTF8 support to Dovecot? My delivery pattern is Postfix -> Dovecot LMTP and it is choking on utf8 messages. I might be able to volunteer some of my time as a developer. Another thread about this seemed to go unanswered: http://dovecot.org/list/dovecot/2016-September/105474.html http://unix.stackexchange.com/questions/320091/configure-postfix-and-doveco… -Noah

4 3

LMTP tcp listener with auth?
by Andreas Thienemann 14 Sep '18

14 Sep '18

I am wondering if it's possible to have a tcp listener for LMTP do authentication and not accept any unauthenticated mail. My configuration looks like the following: service lmtp { inet_listener lmtp { address = 192.168.0.1 127.0.0.1 port = 24 } } This gives me a network reachable lmtp socket, but of course no autentication. When reading the docs, it seems though that only userdb lookup and no actual authentication is supported? Is that understanding correct? cheers, Andreas

4 3

Server certificate verification error with Dovecot 2.3.2.1
by Robert Gill 13 Sep '18

13 Sep '18

I'm attempting to upgrade my Dovecot installation to 2.3.2.1. My SSL certificate authority provides a bundle containing their CA, plus intermediate CAs, which I configure using the 'ssl_ca' option. The comments in the configuration file say to only set this when you're requiring client certificates, which I'm not, but fetchmail complains with a "Server certificate verification error, Broken certificate chain" error if that setting is not set. This works fine with Dovecot 2.2.34. After upgrading to 2.3.2.1, fetchmail throws that error whether 'ssl_ca' is set or not. Dovecot 2.3.2.1 reports the error SSL routines:ssl3_read_bytes:tlsv1 alert unknown ca: SSL alert number 48 in the logs when attempting the TLS handshake. The permissions on the CA bundle haven't changed and should still be readable by Dovecot. I'm running Gentoo Linux on x86_64 and mail is stored on an ext4 file system. I'm attaching my config files for both Dovecot 2.2.34 and Dovecot 2.3.2.1.

3 3

dovecot + centos 7 + internal ca + hostname change
by Matt Bryant 13 Sep '18

13 Sep '18

Not sure if this is dovecot or not but can find very little ie no info around on this ... and added the pem file into /etc/pki/ca-trust/source/anchors and run udpate-ca-trust .. all works ok .. (this is on centos 7 btw) So wanted to change the hostname away from ip-x-x-x-x to something a little bit more descriptive .. but then kaboom .. doesnt work any more and the following errors are seen. Have created and internal CA for domain and added it to Sep 13 10:42:04 ip-10-0-40-230 dovecot: master: Dovecot v2.2.33.2 (d6601f4ec) starting up for imap, pop3, lmtp, sieve (core dumps disabled) Sep 13 10:42:04 ip-10-0-40-230 dovecot: auth: Error: p11-kit: 'attr->pValue != NULL' not true at attrs_build Sep 13 10:42:04 ip-10-0-40-230 dovecot: auth: Error: p11-kit: 'lexer->tok.field.name && lexer->tok.field.value' not true at p11_lexer_next Sep 13 10:42:04 ip-10-0-40-230 dovecot: auth: Error: p11-kit: 'attrs != NULL' not true at attrs_build Sep 13 10:42:04 ip-10-0-40-230 dovecot: message repeated 16 times: [ auth: Error: p11-kit: 'attrs != NULL' not true at attrs_build] Sep 13 10:42:04 ip-10-0-40-230 dovecot: auth: Error: p11-kit: 'new_memory != NULL' not true at maybe_expand_array Sep 13 10:42:04 ip-10-0-40-230 dovecot: auth: Error: p11-kit: shouldn't be reached at p11_array_push Sep 13 10:42:04 ip-10-0-40-230 dovecot: auth: Error: p11-kit: shouldn't be reached at sink_object Sep 13 10:42:04 ip-10-0-40-230 dovecot: auth: Error: p11-kit: 'attrs != NULL' not true at attrs_build Sep 13 10:42:04 ip-10-0-40-230 dovecot: auth: Error: p11-kit: 'new_memory != NULL' not true at maybe_expand_array Sep 13 10:42:04 ip-10-0-40-230 dovecot: auth: Error: p11-kit: shouldn't be reached at p11_array_push Sep 13 10:42:04 ip-10-0-40-230 dovecot: auth: Error: p11-kit: shouldn't be reached at sink_object ... ... Sep 13 10:42:04 ip-10-0-40-230 dovecot: auth: Error: p11-kit: 'new_memory != NULL' not true at maybe_expand_array Sep 13 10:42:04 ip-10-0-40-230 dovecot: auth: Error: p11-kit: shouldn't be reached at p11_array_push Sep 13 10:42:04 ip-10-0-40-230 dovecot: auth: Error: p11-kit: shouldn't be reached at sink_object Sep 13 10:42:04 ip-10-0-40-230 dovecot: auth: Error: p11-kit: 'attr->pValue != NULL' not true at attrs_build Sep 13 10:42:04 ip-10-0-40-230 dovecot: auth: Error: p11-kit: 'new_memory != NULL' not true at maybe_expand_array Sep 13 10:42:04 ip-10-0-40-230 dovecot: auth: Error: p11-kit: shouldn't be reached at p11_array_push Sep 13 10:42:04 ip-10-0-40-230 dovecot: auth: Error: p11-kit: shouldn't be reached at sink_object Sep 13 10:42:04 ip-10-0-40-230 dovecot: auth: Error: p11-kit: no CKA_CLASS attribute found Sep 13 10:42:04 ip-10-0-40-230 dovecot: auth: Error: p11-kit: couldn't load file into objects: /usr/share/pki/ca-trust-source/ca-bundle.trust.p11-kit Sep 13 10:42:05 ip-10-0-40-230 dovecot: auth-worker: Error: p11-kit: 'attrs != NULL' not true at attrs_build Sep 13 10:42:05 ip-10-0-40-230 dovecot: auth-worker: Fatal: master: service(auth-worker): child 14389 killed with signal 11 (core dumps disabled) Sep 13 10:42:05 ip-10-0-40-230 dovecot: auth-worker: Error: p11-kit: 'attrs != NULL' not true at attrs_build Sep 13 10:42:05 ip-10-0-40-230 dovecot: auth-worker: Fatal: master: service(auth-worker): child 14391 killed with signal 11 (core dumps disabled) Sep 13 10:42:05 ip-10-0-40-230 dovecot: auth-worker: Error: p11-kit: 'attrs != NULL' not true at attrs_build Sep 13 10:42:05 ip-10-0-40-230 dovecot: auth-worker: Fatal: master: service(auth-worker): child 14393 killed with signal 11 (core dumps disabled) why would a hostname change make any difference here .. the certs specified in dovecot config are all complete in their chain so not sure what its trying to do ... set hostname back to original works find .. so something is obviously tied or keyed to hostname though cant find anything specific anyone seen anything like this at all ?? rgds Matt

1 1

Re: make check (pigeonhole)
by Eric Broch 12 Sep '18

12 Sep '18

Must be non root user as well On 9/12/2018 1:05 PM, Aki Tuomi wrote: > Ok. We have that fix as well but for other reasons. Good to know this. > > --- > Aki Tuomi > Dovecot oy > > -------- Original message -------- > From: Eric Broch <ebroch(a)whitehorsetc.com> > Date: 12/09/2018 21:36 (GMT+02:00) > To: Aki Tuomi <aki.tuomi(a)dovecot.fi>, dovecot(a)dovecot.org > Subject: Re: make check (pigeonhole) > > Hi Aki, > > I needed this patch > <https://src.fedoraproject.org/cgit/rpms/dovecot.git/tree/dovecot-2.3.0.1-li…> > (fedora): > > |diff -up dovecot-2.3.0.1/src/auth/mycrypt.c.libxcrypt > dovecot-2.3.0.1/src/auth/mycrypt.c --- > dovecot-2.3.0.1/src/auth/mycrypt.c.libxcrypt 2018-02-28 > 15:28:58.000000000 +0100 +++ dovecot-2.3.0.1/src/auth/mycrypt.c > 2018-03-27 10:57:38.447769201 +0200 @@ -14,6 +14,7 @@ # define _XPG6 > /* Some Solaris versions require this, some break with this */ #endif > #include <unistd.h> +#include <crypt.h> #include "mycrypt.h" All works > well now. Thanks for your help Eric | > > On 9/12/2018 12:35 AM, Aki Tuomi wrote: >> >> I tried reproducing your problem and I only can make it happen if I >> run the test suite as root, which is not supported. >> >> Aki >> >> >> On 12.09.2018 06:49, Eric Broch wrote: >>> >>> I'll give those a look and make change accordingly. >>> >>> >>> On 9/11/2018 9:26 PM, Aki Tuomi wrote: >>>> You know we have rpm packages for 2.3.2.1 available at >>>> https://repo.dovecot.org if you are in a hurry? >>>> >>>> >>>> >>>> --- >>>> Aki Tuomi >>>> Dovecot oy >>>> >>>> -------- Original message -------- >>>> From: Eric Broch <ebroch(a)whitehorsetc.com> >>>> Date: 12/09/2018 00:35 (GMT+02:00) >>>> To: dovecot(a)dovecot.org >>>> Subject: Re: make check (pigeonhole) >>>> >>>> Any news on this error on CentOS 7 ? >>>> >>>> Help! >>>> >>>> >>>> On 9/10/2018 9:32 AM, Eric Broch wrote: >>>>> >>>>> I attempted as non-root user and got the exact same error. >>>>> >>>>> >>>>> On 9/10/2018 9:10 AM, Aki Tuomi wrote: >>>>>> Have you attempted this as non-root user? >>>>>> >>>>>> >>>>>> >>>>>> --- >>>>>> Aki Tuomi >>>>>> Dovecot oy >>>>> >>>>> -- >>>>> Eric Broch >>>>> White Horse Technical Consulting (WHTC) >>>> >>>> -- >>>> Eric Broch >>>> White Horse Technical Consulting (WHTC) >>> >>> -- >>> Eric Broch >>> White Horse Technical Consulting (WHTC) >> > > -- > Eric Broch > White Horse Technical Consulting (WHTC) -- Eric Broch White Horse Technical Consulting (WHTC)

1 0

Re: make check (pigeonhole)
by Eric Broch 12 Sep '18

12 Sep '18

I'll give those a look and make change accordingly. On 9/11/2018 9:26 PM, Aki Tuomi wrote: > You know we have rpm packages for 2.3.2.1 available at > https://repo.dovecot.org if you are in a hurry? > > > > --- > Aki Tuomi > Dovecot oy > > -------- Original message -------- > From: Eric Broch <ebroch(a)whitehorsetc.com> > Date: 12/09/2018 00:35 (GMT+02:00) > To: dovecot(a)dovecot.org > Subject: Re: make check (pigeonhole) > > Any news on this error on CentOS 7 ? > > Help! > > > On 9/10/2018 9:32 AM, Eric Broch wrote: >> >> I attempted as non-root user and got the exact same error. >> >> >> On 9/10/2018 9:10 AM, Aki Tuomi wrote: >>> Have you attempted this as non-root user? >>> >>> >>> >>> --- >>> Aki Tuomi >>> Dovecot oy >> >> -- >> Eric Broch >> White Horse Technical Consulting (WHTC) > > -- > Eric Broch > White Horse Technical Consulting (WHTC) -- Eric Broch White Horse Technical Consulting (WHTC)

2 3

Adding namespace alias_for causes index resync?
by Tom Sommer 12 Sep '18

12 Sep '18

I just added a new namespace-alias with alias_for. Apparently this causes all mailbox indexes to be resynced? Is this intentional and/or is there some way to avoid this? My NFS storage pretty much kills its elf when hundreds of thausands of users needs to resync indexes :) Thanks -- Tom

1 1

Re: LMTP tcp listener with auth?
by Andreas Thienemann 12 Sep '18

12 Sep '18

Hi Stephan, On Wed, 12 Sep 2018, Stephan Bosch wrote: > LMTP currently does not support AUTH. Bummer. Thought so. > What is your use case? Most people hide LMTP behind a firewall, or don't > expose it through TCP/IP in the first place. The port is currently only available to a few trusted machines, but having auth available would have been a nice benefit in case the firewall gets misconfigured. Cyrus for example will expose the LMTP port via TCP if configured, but expects valid user credentials. The larger use-case is a migration from cyrus to dovecot. As it's not just the MDA but also the MTA installation that is being migrated I need a way to deliver mail from the old MTA to the new MDA. LMTP comes in handy. https://github.com/ixs/lmtp_proxy/blob/master/README.md#minmal-downtime-mig… has a rough invocation of the steps needed for that. As I said, LMTP auth isn't critical for this, but would have been a nice addition. cheers, Andreas

1 0