- dovecot - dovecot.org

[Dovecot] Advise on upgrading from a jurassic version - please help.
by Martin Mielke 10 Mar '12

10 Mar '12

Hi all, I have inherited an old Dovecot installation which is causing headaches almost every day. I know that one of the rules says "Don't bother asking questions about v0.99.x versions. They're no longer supported."...but please bear with me, this will be quick as I only need some advise from experienced Dovecot gurus out there. I have read the Dovecot documentation and there are instructions to upgrade from 0.99.x to 1.x and so on... my question is: can I upgrade from 0.99.11 to 2.x directly or is it a massive leap? If so, what do I have to keep in mind? This is a production system so I should not break anything... or at least have a rollback plan... Thanks a lot in advance! Regards, Martin

2 1

[Dovecot] sieve and utf-7 foldernames
by Andreas Schulze 10 Mar '12

10 Mar '12

Hi all, since many dovecot/pigeonhole versions I have an error: Mails are delivered into wrong folders if the foldername contain a german umlaut. ( ä, ö, ü ) setup: dovecot-2.1.1 / pigeonhole-0.3.0 postfix deliver to dovecot-lda .dovecot.sieve contains this: require ["fileinto","reject","vacation","relational","comparator-i;ascii-numeric","regex"]; if header :contains "To" "green(a)example.org" { fileinto "INBOX.gr&APw-n"; stop; } a mail to the mentioned address produces this logging: Mar 9 22:23:10 test dovecot: lda(foo): save: box=INBOX.gr&APw-n, uid=2, msgid=<4711(a)example.org>, size=4642 also a mail_debug=yes log no more lines related to the foldername but at the end I found the mail not in the expected folder. It places in "INBOX.gr&-APw-n" notice the extra minus after & I think it's pigeonholes fault but I may be wrong ... # doveconf -n # 2.1.1: /etc/dovecot/dovecot.conf # OS: Linux 2.6.26-2-686 i686 Debian 5.0.9 ext3 ... lda_mailbox_autocreate = yes lda_mailbox_autosubscribe = yes listen = 127.0.0.1, ::1 protocols = " imap sieve" protocol lda { mail_plugins = quota notify mail_log sieve } ... Andreas

2 1

[Dovecot] Has dovecot 2.1.1 been built and tested on AIX 6.1???
by Bennett, Tony 09 Mar '12

09 Mar '12

I have downloaded and built dovecot 2.1.1 using gcc on AIX 6.1. (The output of "dovecot -n" is at the bottom of this email.) I'm trying "baby steps" to get it up, before I give it the final configuration. (My apologies: I was pointed to RFC3501 and told to get an IMAP server, build it, configure it, and bring it up) What is currently occurring when I start dovecot is: Error: service(pop3-login): listen(::, 110) failed: Address already in use Error: service(pop3-login): listen(::, 995) failed: Address already in use Error: service(imap-login): listen(::, 143) failed: Address already in use Error: service(imap-login): listen(::, 993) failed: Address already in use Fatal: Failed to start listeners Using TRUSS and recompiling with log messages I've determined that dovecot is successfully creating and binding to AF_INET sockets... but is failing when trying to do the "bind" the same port to an AF_INET6 socket. The failure is "EADDRINUSE". The logic in the dovecot sources seems driven off of the define of HAVE_IPV6 (defined in config.h by configure) So, the questions I have are: - Is this the correct behavior - If this is the correct behavior, has this been tested against AIX 6.1, and if so, does anyone have an idea of what I did wrong...??? If it has not been tested against AIX 6.1 and is NOT the correct behavior, should I just change "config.h", and undefined HAVE_IPV6 ... or is there a better way to move beyond this issue... (like a change to "configure")??? Thanks, -tony Here is the output of "dovecot -n": # 2.1.1: /attic/usr/local/etc/dovecot/dovecot.conf # OS: AIX 1 00C30F654C00 default_login_user = dovecot disable_plaintext_auth = no namespace { inbox = yes location = mailbox { special_use = \Drafts name = Drafts } mailbox { special_use = \Junk name = Junk } mailbox { special_use = \Sent name = Sent } mailbox { special_use = \Sent name = Sent Messages } mailbox { special_use = \Trash name = Trash } prefix = name = inbox } passdb { args = scheme=CRYPT username_format=%u /attic/usr/local/etc/dovecot/users driver = passwd-file } service anvil-auth-penalty { name = anvil } service auth-worker { name = auth-worker } service auth-client { name = auth } service config { name = config } service dict { name = dict } service login/proxy-notify { name = director } service dns-client { name = dns_client } service doveadm-server { name = doveadm } service imap { name = imap-login } service login/imap { name = imap } service indexer-worker { name = indexer-worker } service indexer { name = indexer } service ipc { name = ipc } service lmtp { name = lmtp } service log-errors { name = log } service pop3 { name = pop3-login } service login/pop3 { name = pop3 } service login/ssl-params { name = ssl-params } service stats-mail { name = stats } ssl_cert = </etc/ssl/certs/dovecot.pem ssl_key = </etc/ssl/private/dovecot.pem userdb { args = username_format=%u /attic/usr/local/etc/dovecot/users driver = passwd-file } protocol lmtp { service anvil-auth-penalty { name = anvil } service auth-worker { name = auth-worker } service auth-client { name = auth } service config { name = config } service dict { name = dict } service login/proxy-notify { name = director } service dns-client { name = dns_client } service doveadm-server { name = doveadm } service imap { name = imap-login } service login/imap { name = imap } service indexer-worker { name = indexer-worker } service indexer { name = indexer } service ipc { name = ipc } service lmtp { name = lmtp } service log-errors { name = log } service pop3 { name = pop3-login } service login/pop3 { name = pop3 } service login/ssl-params { name = ssl-params } service stats-mail { name = stats } } protocol lda { service anvil-auth-penalty { name = anvil } service auth-worker { name = auth-worker } service auth-client { name = auth } service config { name = config } service dict { name = dict } service login/proxy-notify { name = director } service dns-client { name = dns_client } service doveadm-server { name = doveadm } service imap { name = imap-login } service login/imap { name = imap } service indexer-worker { name = indexer-worker } service indexer { name = indexer } service ipc { name = ipc } service lmtp { name = lmtp } service log-errors { name = log } service pop3 { name = pop3-login } service login/pop3 { name = pop3 } service login/ssl-params { name = ssl-params } service stats-mail { name = stats } } protocol pop3 { service anvil-auth-penalty { name = anvil } service auth-worker { name = auth-worker } service auth-client { name = auth } service config { name = config } service dict { name = dict } service login/proxy-notify { name = director } service dns-client { name = dns_client } service doveadm-server { name = doveadm } service imap { name = imap-login } service login/imap { name = imap } service indexer-worker { name = indexer-worker } service indexer { name = indexer } service ipc { name = ipc } service lmtp { name = lmtp } service log-errors { name = log } service pop3 { name = pop3-login } service login/pop3 { name = pop3 } service login/ssl-params { name = ssl-params } service stats-mail { name = stats } } protocol imap { service anvil-auth-penalty { name = anvil } service auth-worker { name = auth-worker } service auth-client { name = auth } service config { name = config } service dict { name = dict } service login/proxy-notify { name = director } service dns-client { name = dns_client } service doveadm-server { name = doveadm } service imap { name = imap-login } service login/imap { name = imap } service indexer-worker { name = indexer-worker } service indexer { name = indexer } service ipc { name = ipc } service lmtp { name = lmtp } service log-errors { name = log } service pop3 { name = pop3-login } service login/pop3 { name = pop3 } service login/ssl-params { name = ssl-params } service stats-mail { name = stats } }

2 2

Re: [Dovecot] disabling SSLv2 in dovecot 1.2.17
by Steve Platt 09 Mar '12

09 Mar '12

Hi Mark, I think I may not have been clear enough in my query, sorry! What I'm trying to do is to prevent SSLv2 connections being made to our IMAP server while allowing SSLv3 and TLSv1 connections. I think I've prevented the use of SSLv2 ciphers but this does not prevent SSLv2 protocol connections (as far as I can tell). (Once connected, the SSLv2 client finds it has no ciphers so the session fails at that point but this is not enough to satisfy our security audit. I want to disable the use of the SSLv2 protocol itself, not just the SSLv2 ciphers) steve.platt(a)mrc-bsu.cam.ac.uk said: > I see Dovecot2 had the following change a year or so ago, in file src/ > login-common/ssl-proxy-openssl.c: > > - SSL_CTX_set_options(ssl_ctx, SSL_OP_ALL); > + SSL_CTX_set_options(ssl_ctx, SSL_OP_ALL | SSL_OP_NO_SSLv2); > > I tried making the same change to dovecot1's src tree on our test system and > it seems to have the desired effect ... I'm testing this by using: openssl s_client -ssl2 -connect mailhost:993 This should fail immediately with "ssl handshake failure" (for a happy audit!). Thanks again, Steve

1 0

[Dovecot] seeking advice: dovecot versions; mailbox formats.
by Vincent Schut 09 Mar '12

09 Mar '12

Hi, I'm currently migrating our old (colocated) mail server (running a [terribly outdated, I know] dovecot 1.1.11) to a new VPS (virtual private server). The old server was running gentoo linux (which is mainly the culprit of the old dovecot version: gentoo was too much trouble to keep updating); the new server will run debian (stable: 6). Debian currently has dovecot 1.2.15 in its repositories; not that much newer... I read in the docs about the auto-generated-from-hg debian dovecot packages for 2.0, 2.1 and 2.2. Which leaves me to the choice what version to use... OK, 2.2 is development, which leaves the choice to: 1.2.15; 2.0.x, or 2.1.x. I would appreciate any consideration or thoughts on what version to choose. On a related note, there is the possibility to switch from maildir to dbox. I did not really find much pros or cons, except from performance and standards-compliance (ability to use e.g. mutt on the server itself). Any thoughts? About the server: we're just a small company. Think about 15 accounts, normal mail traffic, sometimes relatively large attachments (20mb+). Some accounts have many folders; some accounts are very large (5Gb+). Storage is on ext3, raid10. Performance has never been an issue; reliability and ease of maintenance is more important. Thanks, Vincent Schut.

5 7

[Dovecot] disabling SSLv2 in dovecot 1.2.17
by Steve Platt 09 Mar '12

09 Mar '12

I've set up a list of ciphers that excludes SSLv2 ciphers (and other weak ones) in the hope of preventing SSLv2 connections: ssl_cipher_list = TLSv1+HIGH : !SSLv2 : RC4+MEDIUM : !aNULL : !eNULL : !3DES : @STRENGTH However, this doesn't prevent the SSLv2 connection being allowed as our Nessus scans show and I'm tasked with trying to plug that "hole". I see Dovecot2 had the following change a year or so ago, in file src/login-common/ssl-proxy-openssl.c: - SSL_CTX_set_options(ssl_ctx, SSL_OP_ALL); + SSL_CTX_set_options(ssl_ctx, SSL_OP_ALL | SSL_OP_NO_SSLv2); I tried making the same change to dovecot1's src tree on our test system and it seems to have the desired effect; however I am very hesitant about putting this into our production system without seeking advice here first :-) Have I missed anything that's obviously bad about doing this please? Thanks again, Steve Platt

2 1

[Dovecot] [PATCH] Pop3 order in courier migration script
by Christoph Bußenius 08 Mar '12

08 Mar '12

Hi, I found a problem in the courier conversion script (courier-dovecot-migrate.pl). In some cases, it does not correctly preserve the order of POP3 UIDLs. Consider the following case, when courierpop3dsizelist contains: /2 9000 1327481629 AAA1:2,S 10000 21:1327481629 AAA2:2,S 10000 22:1327481629 AAA3:2,S 10000 23:1327481629 AAA4:2,S 10000 24:1327481629 AAA5:2,S 10000 25:1327481629 BBB11:2,S 10000 11:1327481629 BBB12:2,S 10000 12:1327481629 BBB13:2,S 10000 13:1327481629 BBB14:2,S 10000 14:1327481629 BBB15:2,S 10000 15:1327481629 and courierimapuiddb contains: 1 1327480919 9000 11 BBB11 12 BBB12 13 BBB13 14 BBB14 15 BBB15 16 CCC16 17 CCC17 18 CCC18 19 CCC19 20 CCC20 21 AAA1 22 AAA2 23 AAA3 24 AAA4 25 AAA5 then call courier-dovecot-migrate.pl --to-dovecot --convert and it will create dovecot-uidlist: 3 V1327480919 N9010 21 PUID21-1327481629 W10000 :AAA1:2,S 22 PUID22-1327481629 W10000 :AAA2:2,S 23 PUID23-1327481629 W10000 :AAA3:2,S 24 PUID24-1327481629 W10000 :AAA4:2,S 25 PUID25-1327481629 W10000 :AAA5:2,S 9000 :CCC17 9001 PUID12-1327481629 W10000 :BBB12:2,S 9002 :CCC16 9003 PUID15-1327481629 W10000 :BBB15:2,S 9004 :CCC20 9005 PUID14-1327481629 W10000 :BBB14:2,S 9006 PUID13-1327481629 W10000 :BBB13:2,S 9007 :CCC18 9008 PUID11-1327481629 W10000 :BBB11:2,S 9009 :CCC19 The problem here is that the BBB files are not in the same order as in courierpop3dsizelist, and will therefore have a different order in the UIDL response in POP3. Also, the CCC files are interleaved while they should appear at the end. The reason is how the script assigns new UIDs: It does not do this in the order of courierpop3dsizelist. In fact the order is random because it depends on how perl traverses hashes. The attached patch fixes this by sorting the messages: First the POP3 messages get their new UIDs in order of their appearance in courierpop3dsizelist (so that the UIDL order will really be the same as in Courier), after that, the IMAP-only messages will be checked for UID clashes. The patch also changes how the $prev_uid variable is handled because that was also needed to always get the order right. The algorithm could probably be optimized to reduce the number of UID re-assignments to a minimum, however this would complicate the code and would only be noticed in a few cases. The patched courier-dovecot-migrate.pl will create dovecot-uidlist like this: 3 V1327480919 N9010 21 PUID21-1327481629 W10000 :AAA1:2,S 22 PUID22-1327481629 W10000 :AAA2:2,S 23 PUID23-1327481629 W10000 :AAA3:2,S 24 PUID24-1327481629 W10000 :AAA4:2,S 25 PUID25-1327481629 W10000 :AAA5:2,S 9000 PUID11-1327481629 W10000 :BBB11:2,S 9001 PUID12-1327481629 W10000 :BBB12:2,S 9002 PUID13-1327481629 W10000 :BBB13:2,S 9003 PUID14-1327481629 W10000 :BBB14:2,S 9004 PUID15-1327481629 W10000 :BBB15:2,S 9005 :CCC16 9006 :CCC17 9007 :CCC18 9008 :CCC19 9009 :CCC20 Cheers, Christoph -- Christoph Bußenius Rechnerbetriebsgruppe der Fakultäten Informatik und Mathematik Technische Universität München +49 89-289-18519 <> Raum 00.05.055 <> Boltzmannstr. 3 <> Garching

2 3

[Dovecot] v2.1 latest hg: untagged reply to namespace command
by e-frog 08 Mar '12

08 Mar '12

Hello Timo, There seems to be something broken in v2.1 latest hg version: # 2.1.1 (94de7605f50f) 1 namespace * NAMESPACE (("" "/")("virtual/" "/")) NIL NIL * OK Namespace completed. Please note that the "OK Namespace completed." is send untagged. It worked on below version: # 2.1.1 (315f0d8cc2b2) 1 namespace * NAMESPACE (("" "/")("virtual/" "/")) NIL NIL 1 OK Namespace completed. Thanks, e-frog

1 1

[Dovecot] Shared mboxes
by Steve Campbell 08 Mar '12

08 Mar '12

I've been looking at some documentation on shared mail accounts. But I'm getting mixed thoughts on how this can or should be done. I use mbox for all my pop and imap folders since I've converted from a uw-imap server. The first thing that makes me wonder about setup is that I've been told to not use maildir and mbox on the same machine, although I'm not really sure why since it seems this would work OK, but anyway, I'm guessing I should stick with mbox for the shared accounts. Secondly, I'm sure I'd need a namespace to use which ever format, so there's private, public, and shared types. Most of the stuff I'm reading seems to suggest "public" as a type instead of "shared". So what's shared for anyway? I want to use this shared account so that email can be sent to this account, and be shared by only a few people, but I'm reading where locks and such don't work with mbox, so in my mind, how do you avoid corruption and why not just make a normal account and let people hack away at the data? I've not even got to the questions in my mind about how to set up the account, but figured if I could get the above straight, I might be able to fuddle my way through it. Help would be truly appreciated. steve campbell

2 6

Re: [Dovecot] dsync replication available for testing
by Michael Grimm 08 Mar '12

08 Mar '12

Hi -- On 08.03.2012 12:35, Timo Sirainen wrote: > On Thu, 2012-03-08 at 11:26 +0100, Michael Grimm wrote: > You can do for example: > > service config { > unix_listener config { > user = vmail > } > } I will try that later. >> It seems to me, that whenever a larger number of mails arrive on >> both >> servers simultaneously, the replicator gets into trouble [1]. I am >> unsure if one can expect that a replicator should deal with such >> stress, >> though. Or? > > Were these mails delivered via LMTP or dovecot-lda? LMTP > The locks should prevent duplicates I think, so there's something > still > going wrong. Just to be sure that I didn't misunderstand your proposed configuration: @mx1: plugin { mail_replica = remote:vmail@mx2.example.tld } @mx2: plugin { mail_replica = remote:vmail@mx1.example.tld } I do need to define one mail_replica plugin at each server pointing to the other one, correct? Regards, Michael

1 0