- dovecot - dovecot.org

[feature request] SSL handshake rejection for non-SNI clients
by Serg 16 May '23

16 May '23

I would like to offer to implement a feature to reject SSL handshakes for a default certificate-key pair for efficiently discarding bot requests (i.e. such requests that provide invalid/not configured hostname or do not specify at all, like when doing request to the IP address directly). Nginx has such feature already implemented as seen here[1], and it would be beneficial if dovecot would support this too. Currently I am using the following SSL configuration snippet to mimic such behavior: > ssl_cert = </etc/ssl/dovecot/server.crt > ssl_key = </etc/ssl/dovecot/server.key > > local_name flopster.at.encryp.ch { > ssl_cert = </etc/ssl/domains/flopster.at.encryp.ch/fullchain > ssl_key = </etc/ssl/domains/flopster.at.encryp.ch/key > } But in this case the problem is that the invalid requests (for this example it is requests that don't have Server Name Indication at all or mention anything else but not flopster.at.encryp.ch) are still being replied by Dovecot with a TLS certificate rather than being simply rejected with a TLSV1_UNRECOGNIZED_NAME error code. [1]: <https://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_reject_handshake>

3 3

Re: [External] Re: Help - Permissions issue with new mail
by Mihai Badici 16 May '23

16 May '23

Sorry, I sent the reply directly to you not to the list. I try to find which is the uid expected by dovecot. Usually since in postfix the uid is set as 5000 you need to have the same "virtual" uid set in dovecot. I didn't see this in the fail you sent. Maybe you made some change in the past without restarting dovecot. Anyway i think a line like mail_uid=5000 somewhere in dovecot configuration ( location may differ )should fix your issue. Try to find if this is already set and if not add this in dovecot and restart it. On 2023-05-04 15:16, Michele Clark wrote: > Attached is a copy of my main.cf from postfix and my 10-mail from > dovecot > > Let me know if you see anything that I might try - Thanks in advance > > Michele Clark > Title | Engineering Business Unit > KBR | Government Solutions – US > Office: +1 937-713-8669 > > ------------------------- > > From: Mihai Badici <mihai(a)badici.ro> > Sent: Wednesday, May 3, 2023 3:44 PM > To: Michele Clark <Michele.Clark(a)us.kbr.com> > Subject: Re: [External] Re: Help - Permissions issue with new mail > > You don't often get email from mihai(a)badici.ro. Learn why this is > important [1] > > CAUTION: This email originated from outside of the organization. Do > Re: [External] Re: Help - Permissions issue with new mail Contact photo From Michele Clark on 2023-05-04 15:16 Details Headers Plain text Download all attachmentsSave all to cloud... 10-mail.conf.jpg.docx(~761 KB) MAIN.CF.JPG(~161 KB) Attached is a copy of my main.cf from postfix and my 10-mail from dovecot Let me know if you see anything that I might try - Thanks in advance Michele Clark Title | Engineering Business Unit KBR | Government Solutions – US Office: +1 937-713-8669 From: Mihai Badici <mihai(a)badici.ro> Sent: Wednesday, May 3, 2023 3:44 PM To: Michele Clark <Michele.Clark(a)us.kbr.com> Subject: Re: [External] Re: Help - Permissions issue with new mail You don't often get email from mihai(a)badici.ro. Learn why this is important CAUTION: This email originated from outside of the organization. Do not click links or open attachments unless you recognize the sender and know the content is safe. I think the problem isn't the rights of the files but dovecot need to use the same user for read them. I have something like: mail_uid = 5000 in 10-mail.conf, this uid need to be the same as in postfix On 5/3/23 21:42, Michele Clark via dovecot wrote: > 1: This was previously working but has been down since there was an > unexpected power outage. This install has been in place for several > years > 2: When I chmod -r the CUR folder I can get mail to drop to our > roundcube inbox or if I chmod the actual email file in the cur folder > (have tried > not click links or open attachments unless you recognize the sender > and know the content is safe. > > I think the problem isn't the rights of the files but dovecot need to > use the same user for read them. > > I have something like: mail_uid = 5000 in 10-mail.conf, this uid need > to be the same as in postfix > > On 5/3/23 21:42, Michele Clark via dovecot wrote: > >> 1: This was previously working but has been down since there was an >> unexpected power outage. This install has been in place for several >> years >> 2: When I chmod -r the CUR folder I can get mail to drop to our >> roundcube inbox or if I chmod the actual email file in the cur >> folder (have tried both) however new messages still come thru with >> -rw------- >> 3. Attached is a copy of the return from comm -23 <(postconf -n) >> <(postconf -d) with the exception of a few redactions for our >> personal data >> 4. What info would you like to see from dovecot? >> >> Any help is much app >> >> Michele Clark >> Title | Engineering Business Unit >> KBR | Government Solutions – US >> Office: +1 937-713-8669 >> >> ------------------------- >> >> From: John Stoffel <john(a)stoffel.org> >> Sent: Wednesday, May 3, 2023 2:14 PM >> To: Michele Clark <michele.clark(a)us.kbr.com> >> Cc: dovecot(a)dovecot.org <dovecot(a)dovecot.org> >> Subject: [External] Re: Help - Permissions issue with new mail >> >> [You don't often get email from john(a)stoffel.org. Learn why this is >> important at https://aka.ms/LearnAboutSenderIdentification [1] ] >> >> CAUTION: This email originated from outside of the organization. Do >> not click links or open attachments unless you recognize the sender >> and know the content is safe. >> >>>>>>> "michele" == michele clark--- via dovecot >> <dovecot(a)dovecot.org> writes: >> >>> We have an install of Dovecot running with Postfix and Roundcube >>> using virtual mail to allow us to connect to our AD domain which >> got >>> messed up after a power issue. >> >> Was this working before the AD problems, or is this a new install? >> >>> I can log into our Roundcube and see all my old emails, however >> new >>> emails keep getting stuck in the CUR files with permissions of >>> -rw------- >> >>> If I chmod the email it will deliver to the inbox in Roundcube. >> >> Where are you changing the permissions? The destination directory? >> >>> Can anyone advise on how I can adjust this so all new emails will >>> come thru with the correct permissions? - Thanks in advance >> >> It all depends on how your email are delivered, and you need to post >> some of your configuration details, such as the postfix config and >> the >> dovecot config. >> >> For postfix, just post the changed from defaults info, which you can >> get with the following bash sheel command: >> >> comm -23 <(postconf -n) <(postconf -d) >> >> See the postconf man page for details. >> >> Also post your dovecot info as well. >> >> This e-mail, including any attached files, may contain confidential >> information, privileged information and/or trade secrets for the >> sole use of the intended recipient. Any review, use, distribution, >> or disclosure by others is strictly prohibited. If you are not the >> intended recipient (or authorized to receive information for the >> intended recipient), please contact the sender by reply e-mail and >> delete all copies of this message. >> >> _______________________________________________ >> dovecot mailing list -- dovecot(a)dovecot.org >> To unsubscribe send an email to dovecot-leave(a)dovecot.org > This e-mail, including any attached files, may contain confidential > information, privileged information and/or trade secrets for the sole > use of the intended recipient. Any review, use, distribution, or > disclosure by others is strictly prohibited. If you are not the > intended recipient (or authorized to receive information for the > intended recipient), please contact the sender by reply e-mail and > delete all copies of this message. > > Links: > ------ > [1] https://aka.ms/LearnAboutSenderIdentification

4 9

replicator service
by Przemysław Kwiatkowski 15 May '23

15 May '23

I'm confused. Replicator service is bidirectional. Does it mean I should start it only on *one* end of a replication pair? Or on both, working simultaneously? -- MiCHA

2 1

acl replication
by micha＠micha.waw.pl 15 May '23

15 May '23

What is correct way to sync ACLs across two servers? Example: I want user1 to have access to user2 mailbox. I do this on server1: doveadm acl set shared/user2 user=user1 admin create delete expunge insert lookup read write write-deleted write-see Now user1 can see shared/user2 when logged to server1. (Looks good!) He still has no access when logged to server2. (Seems correct.) So I do synchronization: doveadm sync -u user2 remote:server2 ...and nothing changes. He still have access only when logged to server1. So I force full synchronization: doveadm sync -u -f user2 remote:server2 ...and success! User1 has access to shared/user2 on both servers now. But now I want to remove access. So I do this on server1: doveadm acl delete shared/user2 user=user1 Of course the above affects only server1, so user1 still have access when logged to server2. So now I do synchronization: doveadm sync -u user2 remote:server2 Nothing happens. :-( So I try do do full synchro: doveadm sync -u user2 -f remote:server2 ...disaster! The ACL is COPIED BACK from server2 to server1 and effectively restoring access to shared/user2 on on both servers again. (WTH?) So big question is: Who to do it properly? It would be enough for me if ACL's were copied only one way (server1->server2), but bidirectional replication would of course also be nice. :-) Configs: namespace { disabled = no hidden = no ignore_on_failure = no inbox = no list = children location = maildir:%%h/.maildir:LAYOUT=fs:INDEX=~/.shared/%%u order = 0 prefix = shared/%%u/ separator = / subscriptions = no type = shared } plugin { acl = vfile:/etc/dovecot/mailconfig/global-acls acl_defaults_from_inbox = yes acl_shared_dict = file:/etc/dovecot/mailconfig/shared/shared-mailboxes }

3 4

Conclusion about plus address setup
by Tom Reed 14 May '23

14 May '23

Hello Just FYI, After simple putting this line into postfix's main.cf: recipient_delimiter = + And reload postfix, the plus alias address should work. I am using dovecot LMTP as delivery agent. Nothing changes to dovecot configuration. Here are the versions: Postfix 3.6.4 Dovecot 2.3.16 OS Ubuntu 22.04 Thank you very much for all helps. regards Tom

1 0

dovecot for plus address
by Tom Reed 13 May '23

13 May '23

Hello How to setup dovecot to accept the plus address? such as user+foo(a)sample.com will be delivered into user(a)sample.com Thank you. Tom R.

3 4

Sieve with several redirects stops if one redirect fails
by Matteo Staglianò 12 May '23

12 May '23

Hello, I have this block on my sieve filter: |if not header :matches "X-Spam-Status" "Yes*" {|| || redirect "atest(a)non-existent.tld";|| || redirect "info(a)existent.tld";|| ||}|| ||keep;| when the first redirect fails: |sieve: info: started log at May 12 10:33:21.|| ||error: msgid=<20230512103320.070708@candy>: redirect action: failed to redirect message to <atest(a)non-existent.tld>: smtp(host.smtp.tld): RCPT TO failed: 550 5.1.1|| ||<atest(a)non-existent.tld> recipient rejected (permanent failure).| the second one is not even triggered. I would like to know if this is an expected behaviour or a misconfiguration on my side. |dovecot-core 2:2.3.8-4~buster|| ||dovecot-imapd 2:2.3.8-4~buster|| ||dovecot-lmtpd 2:2.3.8-4~buster|| ||dovecot-mysql 2:2.3.8-4~buster|| ||dovecot-pigeonhole-dbg 2:2.3.8-4~buster|| ||dovecot-pop3d 2:2.3.8-4~buster|| ||dovecot-sieve 2:2.3.8-4~buster|| |||| ||sieve = ~/.dovecot.sieve|| ||sieve_extensions = +editheader|| ||sieve_global_extensions = +vnd.dovecot.pipe|| ||sieve_max_redirects = 15|| ||sieve_pipe_bin_dir = /usr/lib/dovecot/|| ||sieve_plugins = sieve_imapsieve sieve_extprograms|| ||sieve_vacation_default_period = 1h|| ||mail_plugins = notify mail_log quota imap_quota imap_sieve|| ||mail_plugins = notify mail_log quota sieve|| || | Thank you

1 0

doveadm on remote socket SSL problem
by miro.igov＠pharmya.com 11 May '23

11 May '23

Hello, trying to exec doveadm commands on remote server: doveadm search -S domain.com:12333 -u user@domaincom mailbox Sent This produces error in remote server log: doveadm(192.168.10.19): Error: SSL handshake failed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number How to do it right?

1 0

dsync start/end date issue
by miro.igov＠pharmya.com 11 May '23

11 May '23

Hello, i am trying to do a backup with doveadm backup command. I need to set date filter with argument [-e end date]. Doing so with -e 2020-01-01 or -e 1577829600 shows error: dovecot: doveadm: Error: dsync(mail-archive.domain.com): handshake: Invalid sync_until_timestamp: 0 What is the correct way of time filter?

1 0

Best practice for Dovecot with LDAP and Postfix
by Moritz Pflanzer 09 May '23

09 May '23

Hi all, so far I had a setup where Dovecot was using a passwd file as userdb and passdb. Postfix was then authenticating with Dovecot via SASL to validate user accounts. Now I added an LDAP backend and would like to use that for Dovecot and Postfix. My first approach was to change the passdb to use the LDAP driver with the following settings: hosts = openldap:1389 base = ou=users,dc=example,dc=com auth_bind = yes auth_bind_userdn = uid=%n,ou=users,dc=example,dc=com And I changed the userdb driver to static since anyway there is just the vmail system account for all virtual user mailboxes. This is working as expected for the IMAP connections. But postfix authentication fails as it is apparently using a wrong user_filter. This is what I see in the logs from OpenLDAP: docker-openldap-1 | 645908ae.1d975b70 0x7fe379297700 conn=1347 fd=12 ACCEPT from IP=172.19.0.7:52144 (IP=0.0.0.0:1389) docker-openldap-1 | 645908ae.1d98571f 0x7fe379a98700 conn=1347 op=0 BIND dn="" method=128 docker-openldap-1 | 645908ae.1d993bd7 0x7fe379a98700 conn=1347 op=0 RESULT tag=97 err=0 qtime=0.000009 etime=0.000072 text= docker-postfix-1 | May 08 14:35:26 nest postfix/smtpd[12455]: 8A9FC1E03C5: client=mo4-p01-ob.smtp.rzone.de[85.215.255.51] docker-postfix-1 | May 08 14:35:26 nest postfix/cleanup[12461]: 8A9FC1E03C5: message-id=<713569303.508224.1683556526256(a)webmail.strato.de> docker-postfix-1 | May 08 14:35:26 nest postfix/qmgr[951]: 8A9FC1E03C5: from=<moritz(a)pflanzer.eu>, size=3340, nrcpt=1 (queue active) docker-postfix-1 | May 08 14:35:26 nest postfix/smtpd[12455]: disconnect from mo4-p01-ob.smtp.rzone.de[85.215.255.51] ehlo=2 starttls=1 mail=1 rcpt=1 data=1 quit=1 commands=7 docker-openldap-1 | 645908ae.2616b031 0x7fe379297700 conn=1347 op=1 SRCH base="ou=users,dc=example,dc=com" scope=2 deref=0 filter="(&(objectClass=posixAccount)(uid=moritz(a)example.com))" docker-openldap-1 | 645908ae.26179272 0x7fe379297700 conn=1347 op=1 SRCH attr=uid docker-openldap-1 | 645908ae.2619389b 0x7fe379297700 conn=1347 op=1 SEARCH RESULT tag=101 err=32 qtime=0.000017 etime=0.000221 nentries=0 text= I tried setting the user_filter manually to "user_filter = (mail=%u)" but that doesn't have any effect. Is this the expected behavior from Dovecot? I guess I can get it working by using the ldap driver for the userdb as well. But is that the best approach since I technically don't need it for dovecot itself. Or should I now change the postfix config as well to directly authenticate against the LDAP server instead of using SASL with Dovecot? Looking forward to recommendations, Moritz

7 16