- dovecot - dovecot.org

Re: [Dovecot] Can we know when a user read our email?
by Richard 04 Jun '12

04 Jun '12

> Date: Sunday, June 03, 2012 02:54:32 PM -0400 > From: Jerry <jerry(a)seibercom.net> > >> On Sun, 03 Jun 2012 20:19:20 +0200 >> Reindl Harald articulated: >> >> people are mostly to stupid to realize what they >> are trying to accomplish and why it it a bad idea >> >> this is why we professionals exist and if people >> refuse what you are explaining them kiss them >> goodbye - irt will be better for you over the long > > No offense, but considering your business attitude and disdain for > potential clients and your opinion of them, it would be a far > better thing if they steered clear of you all together. There are > many considerate, intelligent, compassionate professionals out > there who would be willing to take on the difficult client. Any > "asshole" can service the routine, run of the mill, client. It > takes a true professional to work with and service a difficult > one. Something that seems to be missing from this discussion are considerations of privacy and (personal) security. There are fairly serious implications of a sender being able to tell that/when someone has downloaded/opened a message -- including discovery of daily patterns and potentially where the recipient is, or isn't. I think it is our responsibility to understand these issues and explain them to managers/clients in order to bring them along if we refuse (as I would) to provide a capability such as this. [I always set the sendmail "noreceipts" PrivacyOptions so it doesn't respond to these disposition requests.] One approach is to point out to managers/clients that if their system is configured to return read receipts, anyone sending mail to them on that system will be able to get these same types of receipts. When they think about that they may not like the implications and may reconsider their request. Just because it is technically possible to do something (and even if other vendors provide the capability) does not mean that it is the ethically or legally responsible thing to do. - Richard

2 1

[Dovecot] Exposing global (default) sieve script through Managesieve
by Matthijs Kooijman 04 Jun '12

04 Jun '12

Hi folks, I'm setting up a dovecot server with managesieve support. I'd like to offer spamfiltering through a Sieve script to my users by default, but still allow them to modify the filtering rules through Managesieve. I found the sieve_global_path configuration option, which seems perfect for what I want. I can configure a default script there, which will work for all users until they set upload their own sieve script using managesieve. However, when configured like this, the user experience isn't quite perfect. When users open the managesieve interface on their client, there is no trace of the default filters, so users might think the spamfiltering is done in some other manner. Now, when they create a filtering rule (e.g., to sort out mail to mailing lists), that rule will overwrite the default spamfiltering rule causing all the spam to spill into the user's mailbox. I'm afraid that most users won't realize they have to manually recreate the spamfiltering rule to fix this. Also, they might not know how to write the rule, even if they do... I've considered a few existing ways to fix this: - Use sieve_before / sieve_after to make sure that the default script is always executed, in addition to any user-supplied scripts. This removes the surprise, but removes the option for users to tweak the spamfiltering rules. - Don't use sieve_global_path, but instead distribute the default script to each user's homedir on user creation. This prevents making changes to the default script for existing users and in my setup, user creation and (mail)homedir creation are nicely separated through an LDAP directory, I'd rather not go this route. - When using the Roundcube webmail application as the IMAP client, I can point Roundcube at the default sieve script. Now, when Roundcube sees there are no scripts through ManageSieve, it shows a (fake) "default" script with the correct contents. As soon as the user changes this script or creates a new script, it is actually uploaded to Dovecot, causing the edited script to be used instead of the global script. This option has the user experience I'm looking for, but having this out-of-band connection from Roundcube to the default script configured with dovecot is ugly (and tricky, since these run on different hosts in my setup). The biggest problem is of course that this only works for Roundcube, not for any other IMAP client my users might use. So, I was wondering: Wouldn't it make sense for the managesieve plugin to do something similar to roundcube: When the user has no sieve script configured, let it fake a single "default" script, showing the contents of the global script? Since the ManageSieve protocol doesn't seem to support any way to flag this situation, it would be fooling the clients a bit, but I'm not sure if that's really a problem. While the user has not script named "default" in his sieve_dir: - include a script called "default" in the LISTSCRIPTS output. - return the contents of the sieve_global_path in the GETSCRIPT "default" command. - remove any sieve symlink after a SETACTIVE "default" command (as if SETACTIVE "" was given). This causes dovecot to fall back to the sieve_global_path script. - the DELETESCRIPT "default" command should fail. This might confuse clients and users, since it is listed in LISTSCRIPTS but cannot be deleted, but I think most users will understand they can't delete the default script. - RENAMESCRIPT "default" "some_name" should copy the sieve_global_path script into the user's sieve_dir. This will effectively copy the script instead of renaming it (since it will still be magically listed in LISTSCRIPTS), so that might be confusing. All other commands work just like they do now (in particular, PUTSCRIPT "default" uploads a script called "default" into the user's sieve_dir, preventing all of the above from applying. As noted above, this change might cause some confusion, but I think that is manageable. On additional thing is that running SETACTIVE "" will not completely disable sieve processing (as would be expected), but will (again) cause the sieve_global_path script to be run. This is already the case currently, though, and should probably be considered a separate problem (whose root cause is the lack of a difference between "no script script configured yet" and "active script disabled", both remove the sieve symlink). Also, this problem might be a feature in some setups, so fixing it might not be so easy... So, any thoughts on this? Any fundamental problems I'm missing? (Not-so) obvious alternatives? Gr. Matthijs

2 3

[Dovecot] postfix+dovecat: virtual domains with imap+lmtp
by el07694 03 Jun '12

03 Jun '12

Hi to all, I have tryed a few days to configure postfix/dovecot to run into a VPS machine (CentOs) -->The machine has 2 domains (but more in the future) -->i want info(a)mail.domain1.com and info(a)mail.domain2.com to be seperated mailboxes -->i want to use lmtp protocol to connect dovecot with postfix -->It will be perfect if i can use the system users for authentication I /etc/postfix/main.cf file looks like this smtpd_soft_error_limit = 10 smtpd_hard_error_limit = 20 masquerade_domains = mail.going-on.com mail.commundi.de masquerade_exceptions = root, papinhio relocated_maps = hash:/etc/postfix/relocated smtpd_client_restrictions = check_client_access hash:/etc/postfix/access virtual_mailbox_domains = mail.going-on.com mail.commundi.de virtual_mailbox_base = /var/spool/virtual_hosts virtual_mailbox_maps = hash:/etc/postfix/virtual virtual_uid_maps = static:0 virtual_gid_maps = static:0 mailbox_command = /usr/libexec/dovecot/dovecot-lda -f "$SENDER" -a "$RECIPIENT" dovecot_destination_recipient_limit = 1 mailbox_transport = lmtp:unix:private/dovecot-lmtp /etc/postfix/relocated file has only comments the same for /etc/postfix/access file i have made /var/spool/virtual_hosts folder with chmod 777 inside this folder i have made mail.going-on.com folder and mail.commundi.de folder cat /etc/postfix/virtual produce this: papinhio(a)mail.going-on.com mail.going-on.com/papinhio papinhio is a system_user!! uid,gid = 0 (the root user) master.cf file # # Postfix master process configuration file. For details on the format # of the file, see the master(5) manual page (command: "man 5 master"). # # ========================================================================== # service type private unpriv chroot wakeup maxproc command + args # (yes) (yes) (yes) (never) (100) # ========================================================================== smtp inet n - n - - smtpd submission inet n - n - - smtpd -o smtpd_enforce_tls=yes -o smtpd_sasl_auth_enable=yes -o smtpd_sasl_type=dovecot -o smtpd_sasl_path=private/auth -o smtpd_sasl_security_options=noanonymous -o smtpd_sasl_local_domain=$myhostname -o smtpd_client_restrictions=permit_sasl_authenticated,reject -o smtpd_sender_login_maps=hash:/etc/postfix/virtual pickup fifo n - - 60 1 pickup cleanup unix n - - - 0 cleanup qmgr fifo n - n 300 1 qmgr #qmgr fifo n - n 300 1 oqmgr tlsmgr unix - - n 1000? 1 tlsmgr rewrite unix - - n - - trivial-rewrite bounce unix - - n - 0 bounce defer unix - - n - 0 bounce trace unix - - n - 0 bounce verify unix - - n - 1 verify flush unix n - n 1000? 0 flush proxymap unix - - n - - proxymap smtp unix - - n - - smtp relay unix - - n - - smtp -o fallback_relay= showq unix n - n - - showq error unix - - n - - error discard unix - - n - - discard local unix - n n - - local virtual unix - n n - - virtual lmtp unix - - n - - lmtp anvil unix - - n - 1 anvil scache unix - - n - 1 scache maildrop unix - n n - - pipe flags=DRhu user=vmail argv=/usr/local/bin/maildrop -d ${recipient} # # The Cyrus deliver program has changed incompatibly, multiple times. # old-cyrus unix - n n - - pipe flags=R user=cyrus argv=/usr/lib/cyrus-imapd/deliver -e -m ${extension} ${user} # Cyrus 2.1.5 (Amos Gouaux) # Also specify in main.cf: cyrus_destination_recipient_limit=1 cyrus unix - n n - - pipe user=cyrus argv=/usr/lib/cyrus-imapd/deliver -e -r ${sender} -m ${extension} ${user} # # See the Postfix UUCP_README file for configuration details. # uucp unix - n n - - pipe flags=Fqhu user=uucp argv=uux -r -n -z -a$sender - $nexthop!rmail ($recipient) ifmail unix - n n - - pipe flags=F user=ftn argv=/usr/lib/ifmail/ifmail -r $nexthop ($recipient) bsmtp unix - n n - - pipe flags=Fq. user=foo argv=/usr/local/sbin/bsmtp -f $sender $nexthop $recipient dovecot unix - n n - - pipe flags=DRhu user=root:root argv=/usr/local/libexec/dovecot/dovecot-lda -f ${sender} -d ${recipient} Ok, the /etc/dovecot/dovecot.conf file looks like this: !include conf.d/*.conf !include_try local.conf protocols = imap lmtp service lmtp { unix_listener /var/spool/postfix/private/dovecot-lmtp { group = postfix mode = 0660 user = postfix } } protocol lmtp { mail_plugins = quota sieve } mail_location = mbox:/var/spool/virtual_hosts/%d/%n Both of the services can start this no errors/warnings I can send mail from bash with this command : /bin/mail -s "Hello" "el07694(a)mail.ntua.gr" < /etc/dovecot/dovecot.conf Can anyone help me, plz? I don't know what i do wrong Thanks in advance, Chris Pappas

2 1

[Dovecot] sieve with dovecot v1.x
by Andreas Meyer 02 Jun '12

02 Jun '12

Hello! Is there a chance to have sieve working with dovecot version 1.0.5? /usr/lib/dovecot looks like this: -rwxr-xr-x 1 root root 43932 22. Sep 2007 checkpassword-reply -rwxr-xr-x 1 root root 538996 22. Sep 2007 deliver -rwxr-xr-x 1 root root 127728 22. Sep 2007 dict -rwxr-xr-x 1 root root 270248 22. Sep 2007 dovecot-auth -rwxr-xr-x 1 root root 43952 22. Sep 2007 gdbhelper -rwxr-xr-x 1 root root 48080 22. Sep 2007 idxview -rwxr-xr-x 1 root root 596364 22. Sep 2007 imap -rwxr-xr-x 1 root root 135912 22. Sep 2007 imap-login -rwxr-xr-x 1 root root 43952 22. Sep 2007 logview drwxr-xr-x 5 root root 4096 23. Dez 2008 modules -rwxr-xr-x 1 root root 529512 22. Sep 2007 pop3 -rwxr-xr-x 1 root root 127660 22. Sep 2007 pop3-login -rwxr-xr-x 1 root root 69056 22. Sep 2007 rawlog -rwxr-xr-x 1 root root 134748 22. Sep 2007 sievec -rwxr-xr-x 1 root root 68748 22. Sep 2007 sieved -rwxr-xr-x 1 root root 44116 22. Sep 2007 ssl-build-param so there is a sievec and a sieved, but in the dovecot.conf there is no mention about sieve. I would compile the latest version of dovecot if I knew, how the running 1.0.5 was built. I need it for an openSUSE 10.3 Kind regards Andreas

3 5

[Dovecot] Strange Dovecot 2.0.20 auth chokes and cores
by Alan Brown 02 Jun '12

02 Jun '12

> From: "Konrad ."<len7hir(a)gmail.com> > When we upgrade our kernels from 2.6.32.2 to 3.2.16 something strange > has happened. > On high traffic dovecot/auth looks like not responding. > > We found a lot of this lines at the log: [snip] > We compile Dovecot with poll instead of epoll (--with-ioloop=poll) and > this works for us. > > > Is any problem with epoll on 3.2.x kernels? Yes - and it's been discussed here. Some "bright spark" rewrote the kernel epoll code to prevent DoS attacks caused by "excessive forking". That "bright spark" clearly doesn't use imap or webserver software. Redhat backported this change to kernels released after February 2012 and are about to release an emergency kernel release which removes it. A number of $LARGE companies were "not happy" As you've posted, compiling without epoll fixes the problem, but that doesn't help anyone using distro or repo packages.

3 2

[Dovecot] interesting stats pattern
by Cor Bosman 02 Jun '12

02 Jun '12

Hey all, im experimenting with dovecot stats service, and graphing the result. My initial results are kind of interesting. Check out this graph showing connected sessions and users: http://grab.by/dReu At first I thought maybe one of our 35 imap servers was having issues sending data, but all individual servers show this patters. Here is a bunch of individual servers: http://grab.by/dReC Anyone have any idea what could cause such a pattern? Maybe dovecot does some cleaning up of idle sessions at specific intervals? Or maybe our loadbalancers do, or the imapdirectors. regards, Cor

5 7

[Dovecot] auth trouble
by Glenn English 02 Jun '12

02 Jun '12

Debian Lenny, Dovecot v 1.0.15. I'm getting a lot of what I think is a local socket asking dovecot:auth to verify username/passwords: > May 31 09:00:54 server dovecot-auth: pam_unix(dovecot:auth): authentication failure; logname= uid=0 euid=0 tty=dovecot ruser=admin rhost= Note the empty 'rhost='. That's why I think it's on the server. I see others that look like bots: > May 30 23:08:43 server dovecot-auth: pam_unix(dovecot:auth): authentication failure; logname= uid=0 euid=0 tty=dovecot ruser=admin rhost=200.119.139.22 And I know how to promote the latter to a firewall. But with no rhost, I'm stumped... I've read books, googled, read docs, and asked for help on other mailing lists, and I've learned a lot. And I no longer think it really has much to do with Dovecot, other than the login attempt going through it to get to PAM. But has anyone here seen this before? Is my current theory correct? What did you do to make it go away? (I suspect that upgrading to Debian Squeeze might get rid of it, but I'm afraid that if I don't figure out what's going on, it might just come back.) -- Glenn English hand-wrapped from my Apple Mail

1 1

[Dovecot] Inconsistent search results and crash on force-resync
by Joe Beaubien 01 Jun '12

01 Jun '12

Hi, I am seeing inconsistencies in search results (finding 2 emails when only 1 exists, finding the email when it has been moved to another folder, etc). I figured I should run force-resync to fix any issues. I ran the following: doveadm -v force-resync -u <user> <mailbox> and I got some worrysome logs. - I should mention that I have been seeing some crashes of fts-lucene in my logs. I sent a traceback of this on the mailing list 1-2 days ago under the subject "[Dovecot] fts_lucene crashing". - I should also mention that all the problems I am having are only in 1 email account. This email account contains folders of over 100k emails. Do I need to tweak dovecot somehow for this? Up until now all I did was change vsz_limit to 1024 MB for "service imap". Here are the logs: Jun 1 11:15:01 XXXXX dovecot: imap(form): Error: Recent flags state corrupted for mailbox INBOX2 Jun 1 11:15:01 XXXXX dovecot: imap(form): Error: /data/emails/form/mailboxes/INBOX2/dbox-Mails/dovecot.index reset, view is now inconsistent Jun 1 11:15:01 XXXXX dovecot: imap(form): Error: /data/emails/form/mailboxes/INBOX2/dbox-Mails/dovecot.index reset, view is now inconsistent Jun 1 11:15:01 XXXXX dovecot: imap(form): Error: Recent flags state corrupted for mailbox contrat Jun 1 11:15:01 XXXXX dovecot: imap(form): Error: /data/emails/form/mailboxes/contrat/dbox-Mails/dovecot.index reset, view is now inconsistent Jun 1 11:15:01 XXXXX dovecot: imap(form): Error: /data/emails/form/mailboxes/rep_Immigation soi-m&AOo-me/dbox-Mails/dovecot.index reset, view is now inconsistent Jun 1 11:15:01 XXXXX dovecot: imap(form): Error: /data/emails/form/mailboxes/Templates/dbox-Mails/dovecot.index reset, view is now inconsistent Jun 1 11:15:02 XXXXX dovecot: imap(form): Error: Recent flags state corrupted for mailbox rep_eval_positive Jun 1 11:15:02 XXXXX dovecot: imap(form): Error: /data/emails/form/mailboxes/rep_eval_positive/dbox-Mails/dovecot.index reset, view is now inconsistent Jun 1 11:15:02 XXXXX dovecot: imap(form): Error: Recent flags state corrupted for mailbox Sent Jun 1 11:15:02 XXXXX dovecot: imap(form): Error: /data/emails/form/mailboxes/Sent/dbox-Mails/dovecot.index reset, view is now inconsistent Jun 1 11:15:02 XXXXX dovecot: imap(form): Error: Recent flags state corrupted for mailbox form_positif Jun 1 11:15:02 XXXXX dovecot: imap(form): Error: /data/emails/form/mailboxes/form_positif/dbox-Mails/dovecot.index reset, view is now inconsistent Jun 1 11:15:02 XXXXX dovecot: imap(form): Error: /data/emails/form/mailboxes/Archives/contrat/dbox-Mails/dovecot.index reset, view is now inconsistent Jun 1 11:15:02 XXXXX dovecot: imap(form): Error: /data/emails/form/mailboxes/form_positif/dbox-Mails/dovecot.index reset, view is now inconsistent Jun 1 11:15:02 XXXXX dovecot: imap(form): Error: /data/emails/form/mailboxes/form_positif/dbox-Mails/dovecot.index reset, view is now inconsistent Jun 1 11:15:03 XXXXX dovecot: imap(form): Error: /data/emails/form/mailboxes/Archives/form_indetermine/dbox-Mails/dovecot.index reset, view is now inconsistent Jun 1 11:15:03 XXXXX dovecot: imap(form): Error: /data/emails/form/mailboxes/Archives/form_indetermine/dbox-Mails/dovecot.index reset, view is now inconsistent Jun 1 11:15:15 XXXXX dovecot: imap(form): Error: Recent flags state corrupted for mailbox form_indetermine Jun 1 11:15:15 XXXXX dovecot: imap(form): Error: /data/emails/form/mailboxes/form_indetermine/dbox-Mails/dovecot.index reset, view is now inconsistent Jun 1 11:15:25 XXXXX dovecot: indexer-worker: Error: indexer-worker: /home/jd/work/clucene-core-2.3.3.4/src/core/CLucene/index/DocumentsWriter.cpp:210: std::string lucene::index::DocumentsWriter::closeDocStore(): Assertion `numDocsInStore*8 == directory->fileLength( (docStoreSegment + "." + IndexFileNames::FIELDS_INDEX_EXTENSION).c_str() )' failed. Jun 1 11:15:25 XXXXX dovecot: indexer: Error: Indexer worker disconnected, discarding 28 requests for form Jun 1 11:15:25 XXXXX dovecot: indexer-worker(form): Fatal: master: service(indexer-worker): child 9909 killed with signal 6 (core not dumped) I have 3 questions: 1) When the log says "/mailboxes/INBOX2/dbox-Mails/dovecot.index reset, view is now inconsistent" should I be worried, or this will fix itself? 2) Should I expect to see "Error: Recent flags state corrupted for mailbox Sent"??? I ran the force-resync 3 times and I still see this message. 3) Any idea why clucene is crashing? Regards, -Joe

1 0

[Dovecot] inet_listener imaps { port = 0 } question
by henrixd 01 Jun '12

01 Jun '12

Hi Why commenting out "inet_listener imaps {}" won't stop dovecot to listen port 993? I think this would be expected behavior. Just curious, finally got it working with port = 0. :) - Henri

2 1

Re: [Dovecot] High level of pop3 popping causing server to become unresponsive
by Root Kev 30 May '12

30 May '12

Missed CCing on last reply. See below.. Also, would having Nagios checking the number of messages in a mailbox cause issues with the popping of messages? And/Or would having a user accessing the mailbox from two different applications cause issues? Ie. from Outlook and mobile device? I am under the impression that a lock file is generated which should deal with the issue of contention, deleting mail, etc. Thanks for any information. Kevin Sorry for the delay in responding, long weekend in Canada... > > When trying to SSH into the server, the server prompts for user name then > password, then just hangs. Same if there is already a console connection > over, when trying to SU to root, it just hangs after entering the password. > > Our passwords are in the shadow file, and because this is a server > dedicated for this task, there is only the default linux users, and maybe 8 > other user accounts in the shadow file. > > There shouldn't be high IO as all this box does is postfix, pop3ad and > dovecot. This box is seeing less then 3000 emails a day, and only has 5 > mailboxes on it. > > Thanks for the continued suggestions... > > Kevin > > > On Sat, May 19, 2012 at 3:33 PM, Timo Sirainen <tss(a)iki.fi> wrote: > >> On Fri, 2012-05-18 at 09:21 -0400, Root Kev wrote: >> > During the last time that the load went up, it became unable to login / >> su >> > to root for the entire period that dovecot was running, we had to kill >> > dovecot and go back to Popa3d until the mailq was cleared up. We are >> > running CentOS 5.6 server. Based on TOP running at the time the CPU >> usage >> > was running under 10%. Once Dovecot was killed, we were then able to >> log >> > in /su again. >> >> Like Kelsey said, a very high disk IO might explain this, although >> normally the login should still eventually succeed. Another thing I'm >> wondering is if some process limit reached. How does the login/su fail, >> does it just hang or immediately fail with some error? >> >> > We were under the impression that checking to shadow directly should be >> the >> > fastest and least amount of overhead, is any of the other ways to >> connect >> > have less load on authentication to PAM? >> >> Your passwords really are in /etc/shadow file, not LDAP/something else? >> I don't think the problem is with authentication. Reading /etc/shadow is >> pretty fast (unless maybe if it's a huge file) and it anyway can't block >> login/su from working. >> >> >> >

5 8