- dovecot - dovecot.org

where to setup virtual_mailbox_maps
by frakass 31 Aug '22

31 Aug '22

Hello, I have a domain in virtual_mailbox_domains: aaa.com I have also the virtual_alias_domains which include: bbb.com I know how to forward x(a)bbb.com to y(a)aaa.com by setting up the file "virtual_alias_maps": x(a)bbb.com y(a)aaa.com (and run postmap after the changes.) But, how can I setup virtual_mailbox_maps (if I name this correctly)? for example, 111(a)aaa.com forwards to 222(a)aaa.com. Thank you.

2 1

multiple / backup sql servers for sql server access
by Jack Snodgrass 31 Aug '22

31 Aug '22

I am using this file: dovecot-sql.conf.ext and in there I have a connect = "host=<dbserver> dbname=<dbname> user=<dbuser> password=<dbpass>" My <dbserver> was down and I lost mail access for a few days before I realized that there was an issue. How can I specify a backup server so that if my primary sql server goes down, a backup sql server will be queried? -- jack

3 4

Redhat 9 Repository for Dovecot
by Istiak Ferdous 29 Aug '22

29 Aug '22

Hello, Redhat 9 is publicly released for some time. Is there any plan to provide repository for it? http://repo.dovecot.org/ce-2.3-latest/rhel/ https://developers.redhat.com/articles/2022/05/18/whats-new-red-hat-enterpr… Thanks, Istiak Ferdous

2 4

Understanding Auth-Worker Logging
by dovecot＠ptld.com 29 Aug '22

29 Aug '22

Sometimes when auth-worker gets logged there is an extra 'field' combined with the username and IP inside the sql() section. dovecot[911]: auth-worker(8131): conn unix:auth-worker (pid=3870,uid=97): auth-worker<2>: sql(user(a)example.com,xxx.xxx.xxx.xxx,<8Q4ycCznAPdoiAwp>): Password mismatch (SHA1 of given password: 6ef33886cc5e17a60590cb4badac98d2960b6914) What is the "<8Q4ycCznAPdoiAwp>" and why is it logged only sometimes? Is there any documentation explaining what's inside of logs for dovecot?

2 1

Replication not working - GUIDs conflict - will be merged later
by Patrick Westenberg 28 Aug '22

28 Aug '22

Hi everyone, I have a weird problem with replication that I'm unable to solve. A new account is sychronized from an external provider via imapsync. The mails end up on my backend1. I see that the folder structure is immediately replicated to backend2. However, a lot of mails are missing and "doveadm replicator status" also states that something failed: priority fast sync full sync success sync failed mail(a)example.com none 00:02:36 00:39:47 - y There are no error log entries regarding this user at all. After some research I tried to start the replication manually with "doveadm -D backup -u mail(a)example.com -d tcp:x.y.z.11" and finally I got an error message: Jul 31 13:55:37 doveadm(mail(a)example.com)<11341><rm1YCblt5mJNLAAAJFg/Tg>: Debug: brain M: Mailbox INBOX: local=e74590221b6ce6620d29000024583f4e/0/1, remote=20a9ce2b1c6ce662244e0000baba0ddd/0/1: GUIDs conflict - will be merged later As a matter of fact, the mails in the inbox are the ones that are missing on backend2. I always end up with this error, no matter what I do: - I completely removed the folder structure on backend2. - I removed all database entries. - I removed this user from the replication, ran imapsync again followed by "doveadm -D backup ..." I also removed fts-flatcurve to rule this out as a cause of error. I have no idea what to do. This configuration worked for months. I got this error with 2.3.17.1 and 2.3.19.1 Any hints would be highly appreciated. Regards Patrick # 2.3.19.1 (9b53102964): /usr/local/etc/dovecot/dovecot.conf # Pigeonhole version 0.5.19 (4eae2f79) auth_master_user_separator = * auth_mechanisms = plain login doveadm_password = # hidden, use -P to show it doveadm_port = 12345 listen = x.y.z.12 lmtp_save_to_detail_mailbox = yes log_debug = category=fts-flatcurve log_path = /var/log/dovecot.log mail_debug = yes mail_home = /srv/mail/%Ld/%Ln mail_location = maildir:~/Maildir mail_plugins = quota notify replication managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext editheader metric imapc_traffic { fields = bytes_in bytes_out filter = event=imap_command_finished group_by = user } namespace inbox { inbox = yes location = mailbox Drafts { auto = subscribe special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { auto = subscribe special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Spamverdacht { auto = subscribe special_use = \Junk } mailbox Trash { auto = subscribe special_use = \Trash } prefix = INBOX/ separator = / type = private } passdb { args = /usr/local/etc/dovecot/master-user driver = passwd-file master = yes pass = yes } passdb { args = /usr/local/etc/dovecot/dovecot-sql.conf.ext driver = sql } plugin { mail_replica = tcp:x.y.z.11 quota = count:User quota quota_grace = 25M quota_rule2 = INBOX/Trash:storage=+100M quota_status_nouser = DUNNO quota_status_success = DUNNO quota_vsizes = yes quota_warning = storage=100%% quota-full %u quota_warning2 = storage=95%% quota-warning 95 %u quota_warning3 = storage=80%% quota-warning 80 %u quota_warning4 = -storage=100%% quota-ok %u sieve = ~/.dovecot.sieve sieve_after = /usr/local/etc/dovecot/sieve/sieve_after.sieve sieve_default = /usr/local/etc/dovecot/sieve/default.sieve sieve_dir = ~/sieve sieve_extensions = +editheader } protocols = imap pop3 lmtp sieve service aggregator { fifo_listener replication-notify-fifo { user = vmail } unix_listener replication-notify { user = vmail } } service auth { unix_listener auth-userdb { group = vmail mode = 0666 user = vmail } } service config { unix_listener config { mode = 0600 user = vmail } } service doveadm { inet_listener { port = 12345 } } service imap-login { process_min_avail = 2 service_count = 0 } service lmtp { executable = lmtp -L inet_listener lmtp { address = x.y.z.12 port = 24 } process_min_avail = 20 } service managesieve-login { inet_listener sieve { port = 4190 } } service quota-full { executable = script /usr/local/etc/dovecot/quota_full.sh unix_listener quota-full { user = vmail } user = root } service quota-ok { executable = script /usr/local/etc/dovecot/quota_ok.sh unix_listener quota-ok { user = vmail } user = root } service quota-status { client_limit = 1 executable = quota-status -p postfix inet_listener { port = 12340 } } service quota-warning { executable = script /usr/local/etc/dovecot/quota_warning.sh unix_listener quota-warning { user = vmail } user = root } service replicator { process_min_avail = 1 unix_listener replicator-doveadm { mode = 0600 user = vmail } } ssl = required ssl_cert = </etc/ssl/certs/bundle.pem ssl_client_ca_dir = /etc/ssl/certs ssl_dh = # hidden, use -P to show it ssl_key = # hidden, use -P to show it userdb { driver = prefetch } userdb { args = /usr/local/etc/dovecot/dovecot-sql.conf.ext driver = sql } verbose_proctitle = yes protocol lmtp { info_log_path = /var/log/dovecot-lmtp.log mail_plugins = quota notify replication sieve } protocol imap { mail_max_userip_connections = 40 mail_plugins = quota notify replication imap_quota }

5 9

Sieve Symlink Creation
by dovecot＠ptld.com 26 Aug '22

26 Aug '22

The first time when the sieve files and folders get created, the active symlink is created as a full absolute path .active_sieve -> /mnt/email/domain/user/_sieve/filters.sieve After that, if you disable and enable the rule set the symlink gets recreated as relative .active_sieve -> filters.sieve How can i have the symlink always created as a relative path even on first time creation? Having a full absolute path over a mounted NSF is fragile. Dovecot 2.3.16 Pigeonhole 2.3.16 mail_home = /mnt/email/%d/%n/_dovecot mail_location = maildir:/mnt/email/%d/%n/_folders:INDEX=/mnt/email/%d/%n/_dovecot:CONTROL=/mnt/email/%d/%n/_dovecot plugin { sieve = file:~/../_sieve;active=~/../_sieve/.active_sieve sieve_max_script_size = 1M sieve_max_actions = 32 sieve_max_redirects = 4 sieve_quota_max_scripts = 20 sieve_quota_max_storage = 5M sieve_vacation_min_period = 1d sieve_vacation_use_original_recipient = no sieve_vacation_dont_check_recipient = no sieve_vacation_send_from_recipient = no sieve_redirect_envelope_from = sender sieve_user_email = %u }

2 8

Is this safe?
by Jaroslaw Rafa 25 Aug '22

25 Aug '22

Hello, I asked about this a few days ago, but since nobody answered in that thread, I'd like to bring it up again as a separate thread. Maybe somebody answers... I have written a policy service for Postfix that checks whether the connecting IP address has currently an IMAP session open. For this, it needs to access the socket /var/run/dovecot/anvil. But by default, this socket is accessible only for root, and I obviously DON'T want my service to run as root: srw------- 1 root root 0 May 22 2020 /var/run/dovecot/anvil By modifying Dovecot configuration I was able to chnge the permissions on that socket to: srw-rw---- 1 root dovecot 0 Aug 21 20:47 /var/run/dovecot/anvil Then my service can run under the user "dovecot" and access the socket. Here's my question: did I create any security risk by changing the socket permissions like above and running my service under "dovecot" user? Or will it be better that I create a special user dedicated only for this service and run the service under that user? -- Regards, Jaroslaw Rafa raj(a)rafa.eu.org -- "In a million years, when kids go to school, they're gonna know: once there was a Hushpuppy, and she lived with her daddy in the Bathtub."

2 3

Maybe a bit offtopic, Sieve beaviour
by João Silva 25 Aug '22

25 Aug '22

Hi If a sieve filter contains a rule if header :regex ["From"] ["@xxx.com","@yyy.pt"] { fileinto :create "ac"; } The mail should be copied to the folder ac and then proceed to other rules that a user might have or I understood the fileinto wrong? Using dovecot-pigeonhole-2.2.36-8.el7.x86_64

4 6

namespace directives from userdb not being applied
by Brendan Braybrook 24 Aug '22

24 Aug '22

hi all, i'm having a strange issue. i have a few dovecot instances running: 1- debian 10 with debian's dovecot-core 1:2.3.4.1-5+deb10u5 2- debian 10 with debian's dovecot-core 1:2.3.4.1-5+deb10u6 3- debian 11 with dovecot's dovecot-core 2:2.3.19.1-2+debian11 for all these, i've just been testing with a static userdb (ignore if the login user was different; they all had the same userdb data.. various different passdb configs were tried (none do any userdb prefetching): userdb { driver = static args = mail=maildir:/mail/mailstore03/492/177/b@b.com/:INDEX=/mail/index03/492/177/b@b.com/ home=/mail/mailstore03/492/177/b(a)b.com/ namespace=inbox,share namespace/inbox/separator=/ namespace/share/separator=/ namespace/share/prefix=boop/ } instance #2 and #3 don't seem to pass all the namespace directives i'm passing through to the imap process. (i originally found it happening with a lua userdb script then noticed it with a dict userdb, but the simpler static userdb still shows it happening so i don't think it's related to the different userdb mechanisms themselves) debug looks like: auth: Debug: master userdb out: USER 3466461185 b(a)b.com mail=maildir:/mail/mailstore03/492/177/b@b.com/:INDEX=/mail/index03/492/177/b@b.com/ home=/mail/mailstore03/492/177/b(a)b.com/ namespace=inbox,share namespace/inbox/separator=/ namespace/share/separator=/ namespace/share/prefix=boop/ auth_mech=PLAIN auth_token=bcdb366d56f4fceee83775a1b28ca89ccdf881fd script-login(b(a)b.com)<56895><>: Debug: Added userdb setting: mail=maildir:/mail/mailstore03/492/177/b@b.com/:INDEX=/mail/index03/492/177/b@b.com/ script-login(b(a)b.com)<56895><>: Debug: Added userdb setting: namespace=inbox,share script-login(b(a)b.com)<56895><>: Debug: Added userdb setting: namespace/inbox/separator=/ script-login(b(a)b.com)<56895><>: Debug: Added userdb setting: namespace/share/prefix=boop/ script-login(b(a)b.com)<56895><>: Debug: Added userdb setting: namespace/share/separator=/ imap(b(a)b.com)<56894><9mFyornjaMcKyAUI>: Debug: Added userdb setting: mail=maildir:/mail/mailstore03/492/177/b@b.com/:INDEX=/mail/index03/492/177/b@b.com/ imap(b(a)b.com)<56894><9mFyornjaMcKyAUI>: Debug: Added userdb setting: namespace=inbox,share imap(b(a)b.com)<56894><9mFyornjaMcKyAUI>: Debug: Namespace inbox: type=private, prefix=, sep=, inbox=yes, hidden=no, list=yes, subscriptions=yes location=maildir:/mail/mailstore03/492/177/b@b.com/:INDEX=/mail/index03/492/177/b@b.com/ imap(b(a)b.com)<56894><9mFyornjaMcKyAUI>: Debug: Namespace : type=private, prefix=, sep=, inbox=no, hidden=no, list=yes, subscriptions=yes location=maildir:/mail/mailstore03/492/177/b@b.com/:INDEX=/mail/index03/492/177/b@b.com/ the script-login task notes that these userdb settings are being added: namespace=inbox,share namespace/inbox/separator=/ namespace/share/prefix=boop/ namespace/share/separator=/ but the imap task only notes one: namespace=inbox,share both of these two instances end up getting an error because the imap task didn't pick up the prefix: Error: namespace configuration error: Duplicate namespace prefix: "" instance #1 behaves differently. it's script-login task debug is the same, but the imap debug notes: imap(bigip-imap(a)nagios.tucows.com)<2146><s3ctO7njd6cKBS39>: Debug: Added userdb setting: mail=maildir:/mail/mailstore03/492/177/b@b.com/:INDEX=/mail/index03/492/177/b@b.com/ imap(bigip-imap(a)nagios.tucows.com)<2146><s3ctO7njd6cKBS39>: Debug: Added userdb setting: namespace=inbox,share imap(bigip-imap(a)nagios.tucows.com)<2146><s3ctO7njd6cKBS39>: Debug: Added userdb setting: namespace/inbox/separator=/ imap(bigip-imap(a)nagios.tucows.com)<2146><s3ctO7njd6cKBS39>: Debug: tc_empty_notify_plugin init imap(bigip-imap(a)nagios.tucows.com)<2146><s3ctO7njd6cKBS39>: Debug: Namespace inbox: type=private, prefix=, sep=/, inbox=yes, hidden=no, list=yes, subscriptions=yes location=maildir:/mail/mailstore03/492/177/b@b.com/:INDEX=/mail/index03/492/177/b@b.com/ imap(bigip-imap(a)nagios.tucows.com)<2146><s3ctO7njd6cKBS39>: Debug: Namespace : type=private, prefix=, sep=, inbox=no, hidden=no, list=yes, subscriptions=yes location=maildir:/mail/mailstore03/492/177/b@b.com/:INDEX=/mail/index03/492/177/b@b.com/ on this one, the imap task notes that it added ALL the namespace directives, and consequently doesn't have any namespace prefix collisions. the difference between 1:2.3.4.1-5+deb10u5 and 1:2.3.4.1-5+deb10u6 doesn't seem that great, and the bug tracker for it doesn't indicate anything around userdb would be patched (https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=970386) but the problem still seems to exist in 2.3.19 - can anyone else see the same thing happening with the current builds? thanks! -brendan

3 4

Dovecot ACLs and XOAUTH2
by Felix Auringer 23 Aug '22

23 Aug '22

Hi, we're trying to set up an IMAP server using Dovecot as part of a new email system in a middle-sized company (around 150 employees). We have a keycloak identity server that is used for all logins and we would also like to use it for the new email system so that the non-technical employees (the majority) will have no issues using it. It's very nice that XOAUTH2 is already included in Dovecot, it works very well with our Roundcube web client. However, it seems that other clients like Thunderbird or Android Apps like FairEmail are not easy to set up as they have their XOAUTH providers hardcoded somewhere (https://bugzilla.mozilla.org/show_bug.cgi?id=1602166) Are you aware of any solution to integrate a dovecot server using XOAUTH2 into local clients (like Thunderbird)? We are currently trying to do it with passwords that can be set in Keycloak only for the purpose of email that can then be used to receive a valid token via a direct access grant but it's not a really nice solution as it introduces an additional password. Additionally, we would like to have all permission-related information saved in our identity server. For email, this includes shared mailboxes that a user is allowed to access. The ACL plugin that is used for shared mailboxes currently reads the permissions from disk which is not really feasible if the user base is large and setting these permissions should happen automatically. We are thinking the best way to do this is to encode the user's permissions in the token that dovecot receives in the login process. But as the token is only available in the authentication process and it does not seem to be intended to return such information from the password database (https://doc.dovecot.org/configuration_manual/authentication/password_databa…) we are unsure on how to process these information from the token. We did not find any plugin hooks in the authentication processes and the normal plugin hooks do not have access to information from the token anymore. What do you think is the best way to do this? We would be okay modifying some dovecot source code and contributing it back if desired. Best regards, Felix Auringer --- Gesellschaft für interkulturelles Zusammenleben gGmbH (GIZ) Felix Auringer IT Reformationsplatz 2 13597 Berlin Tel: 030/513 0100 00; Fax: 030/513 0100 09 www.giz.berlin; felix.auringer(a)giz.berlin Amtsgericht Charlottenburg HRB 200872 B Geschäftsführerin: Dr. Britta Marschke

2 6