- dovecot - dovecot.org

Doveadm encrypt/decrypt files manually with per-user folder keys
by Ben Burk 21 Jul '21

21 Jul '21

There is an example of manually encrypting/decrypting mail processed by the mail_crypt plugin here: https://doc.dovecot.org/configuration_manual/mail_crypt_plugin/ It outlines how one would manually encrypt/decrypt messages using global keys: doveadm fs get/put crypt private_key_path=foo:public_key_path=foo2:posix:prefix=/path/to/files/root path/to/file Is there a way to accomplish this using per-user folder keys? Is there some way of making sense of the information in the dovecot-attributes file to accomplish this? -- Ben Burk BURK.TECH System Administrator

2 6

Traffic accounting
by Jesús Ángel del Pozo Domínguez 20 Jul '21

20 Jul '21

Hello, Could you please tell me whether is it possible to do traffic accounting using Dovecot 2.3.4? What I'd like to do is to collect network traffic (both in & out) for each user (both POP and IMAP traffic). Regards,

4 4

dovecot-lmtp crashing when setting lmtp_proxy=yes
by Camilo Sperberg 19 Jul '21

19 Jul '21

Hi all: We are currently in the process of setting up dovecot proxy so that we can deploy multiple machines in order to keep growing. We are trying now to create an entry point, and from there send the traffic to either the same machine or another node. For this, we are using a MySQL database with information about which server hosts which mailboxes, which turns out to be working great for sending out mail and general authentification. This was really simple to set up, kudos for that! However, whenever I want to *receive* email, I just have to enable the lmtp_proxy setting which makes the lmtp process segfault. This happens everytime as I can reliable reproduce it + get a stack trace of it. The process will crash on every incoming email. I have attached: - Complete output of dovecot-sysreport - A core dump of the crashed process Main information: Using dovecot v2.3.14 (cee3cbc0d) on Ubuntu 18.04 LTS: Linux 5.4.0-1046-gcp x86_64 Ubuntu 18.04.5 LTS. Our MTA is postfix. Logs around the crashed process: Jul 15 14:53:21 server postfix/postscreen[19402]: CONNECT from [XX.XX.XX.XX]:36411 to [10.164.0.18]:25 Jul 15 14:53:22 server postfix/dnsblog[19406]: addr XX.XX.XX.XX listed by domain dnsbl.sorbs.net as 127.0.0.6 Jul 15 14:53:27 server postfix/postscreen[19402]: PASS NEW [XX.XX.XX.XX]:36411 Jul 15 14:53:27 server postfix/smtpd[19408]: connect from mail-XX.google.com [XX.XX.XX.XX] Jul 15 14:53:28 server postfix/smtpd[19408]: B765F401DB: client= mail-XX.google.com[XX.XX.XX.XX] Jul 15 14:53:28 server postfix/cleanup[19411]: B765F401DB: message-id=< XX+5j3RpXXXXXOK7GHdiDSGSPXXXX(a)mail.gmail.com> Jul 15 14:53:29 server postfix/qmgr[1414]: B765F401DB: from=< unreal4u(a)gmail.com>, size=2815, nrcpt=1 (queue active) Jul 15 14:53:29 server dovecot: lmtp(19413): Connect from local Jul 15 14:53:29 server kernel: [1738624.857507] lmtp[19413]: segfault at 0 ip 00007fd486cd0a37 sp 00007ffc12a6c118 error 4 in libdovecot.so.0.0.0[7fd486ba1000+1aa000] Jul 15 14:53:29 server kernel: [1738624.857514] Code: eb de 90 48 85 d2 75 1e eb 33 66 0f 1f 84 00 00 00 00 00 84 c0 74 18 48 83 c7 01 48 83 c6 01 88 47 ff 48 83 ea 01 48 83 fa 01 <0f> b6 06 77 e4 c6 07 00 31 c0 80 3e 00 0f 95 c0 f7 d8 c3 b8 ff ff Jul 15 14:53:29 server dovecot: lmtp(19413): Fatal: master: service(lmtp): child 19413 killed with signal 11 (core dumped) Jul 15 14:53:29 server postfix/lmtp[19412]: B765F401DB: to=<YYY(a)YYYY.YY>, relay=ZZZ.ZZZ.ZZ[private/dovecot-lmtp], delay=0.88, delays=0.84/0.01/0.01/0.03, dsn=4.4.2, status=deferred (lost connection with ZZZ.ZZZ.ZZ[private/dovecot-lmtp] while sending RCPT TO) Jul 15 14:53:29 server postfix/smtpd[19408]: disconnect from mail-XX.google.com[XX.XX.XX.XX] ehlo=2 starttls=1 mail=1 rcpt=1 data=1 quit=1 commands=7 Am I missing something in the conf? Did I encounter a bug? If you need more information, please let me know. Greetings, Camilo Sperberg

2 2

Major upgrade of mail server
by Shawn Heisey 18 Jul '21

18 Jul '21

I have a mail server in AWS that is currently running Ubuntu 18. Every time I log in, I am reminded that I can upgrade to Ubuntu 20. On Ubuntu 18, the dovecot version is 3.3.0-1ubuntu0.3. On Ubuntu 20, it is 2.3.7.2-1ubuntu3. Many other packages, probably including the mysql server, would also be upgraded. Dovecot and Postfix use a postfixadmin database in mysql for users, and postfix is using dovecot-lda to deliver mail. I am using managesieve from dovecot on roundcube webmail. As far as I know, my own user is the only one with sieve scripts actually in use ... and I have a LOT of filters/folders for various mailing lists. I've been a little bit terrified of doing an upgrade, because I do have a couple of people using my mail server for real work email and I don't want to disrupt them. I'm writing today to find out what are the likely pain points I might encounter when doing this kind of major upgrade, and if there is any helpful information that can help me get through those problems. I'm hoping that it will go smoothly and everything just works. Here's the doveconf -n output: https://apaste.info/FUgF If I have been silly enough to include sensitive data from the config, I would appreciate a heads up so I know what passwords to change. I did a quick glance and didn't see anything. Thanks, Shawn

5 5

Dovecot book for a newbie
by techlists＠phpcoderusa.com 16 Jul '21

16 Jul '21

Hi, Please recommend a Dovecot book for a newbie... I have a fair amount of Linux PHP hosting experience - LAMP virtual host configurations. I'm new to BIND, Postfix, and Dovecot. I'm running Ubuntu 20.04lts. I have a test server almost working. Can send but not receive. Would like to understand more. I'm guessing it is a Zone (MX) / SSL / Client configuration issue. Thanks in advance!!

5 8

OT somewhat, how to unsubscribe?
by Christy S 16 Jul '21

16 Jul '21

Hi folks, It's been a while since I've subscribed and I don't remember how to get off the mailing list. We've changed how we're handling mail now, so dovecot is no longer being used. Can anyone help? MOst mailing lists have a blurb at the bottom with instructions but this one doesn't seem to. Thanks Christy

3 2

Dovecot geographically distributed
by Claudio Corvino 16 Jul '21

16 Jul '21

Hi, I have a single Dovecot (2.3.4.1) IMAP/LMTP server on HQ "A" and I would like to create a backup server distributed to HQ "B", two HQ are connected through an IPsec tunnel. User mailboxes (type mbox) are on NFS storage. I don't need HA, it could even be an active / passive configuration with a floating IP, but I don't know how to keep in sync the two remote NFS filesystems. I don't know if Dovecot replication is suitable for me. Thanks -- *Claudio Corvino IT Systems Administrator*

1 0

2FA/MFA with IMAP & postfix/submission
by Alex 16 Jul '21

16 Jul '21

Hi, I have a dovecot-2.3.13 system on fedora34 with a few hundred IMAP4 accounts, as well as postfix users using submission. Clients are using primarily Outlook on Windows and old squirrelmail. Are there multi-factor options available? If it is not available, do you have any recommendations on where I should look to do this? All of the links related to this topic appear to be very old, or limited to Linux PAM users.

12 19

function for whitelisting IPs
by White, Daniel E. (GSFC-770.0)[NICS] 16 Jul '21

16 Jul '21

Sebastian, Do you have any examples of such a function and how/where it is used ? -----Original Message----- From: dovecot <dovecot-bounces(a)dovecot.org> on behalf of Sebastian <sebastian(a)sebbe.eu> Reply-To: Dovecot Mailing List <dovecot(a)dovecot.org> Date: Thursday, July 15, 2021 at 01:19 To: 'Mailing List' <dovecot(a)dovecot.org> Subject: [EXTERNAL] Sv: 2FA/MFA with IMAP & postfix/submission Main problem is that not many clients do natively support multifactor. Some clients, do popup a login dialog if the server rejects the password as invalid, which can be used to create a "cheaty variant" of multifactor, but some clients just popup an error dialog and tell the user to just correct password in settings. Some clients even go as long as requiring the user to delete the account with wrong password and set up a new connection. So no, it cannot be relied upon. I have a better idea: Have a function for whitelisting IPs, possible /24's or similiar, where a login to roundcube or other webmail client (with 2FA) will add the IP onto a whitelist for that account. Or perhaps, just "set" the country of the account based on GeoIP. When an account tries to login via IMAP or SMTP, you just check if IP and/or GeoIP country is right, and reject the login as invalid if so not. The only thing a client needs to do to get his IMAP or SMTP client to work again if it stops working, is to login once via the web client. -----Ursprungligt meddelande----- Från: dovecot-bounces(a)dovecot.org <dovecot-bounces(a)dovecot.org> För Alex Skickat: den 15 juli 2021 02:10 Till: dovecot(a)dovecot.org Ämne: 2FA/MFA with IMAP & postfix/submission Hi, I have a dovecot-2.3.13 system on fedora34 with a few hundred IMAP4 accounts, as well as postfix users using submission. Clients are using primarily Outlook on Windows and old squirrelmail. Are there multi-factor options available? If it is not available, do you have any recommendations on where I should look to do this? All of the links related to this topic appear to be very old, or limited to Linux PAM users.

7 10

TLS Security
by Stefan Schumacher 15 Jul '21

15 Jul '21

Hi, I wish to build a new secure email server. It seems I am on the right way – at least I get no more error messages for Postfix – but Dovecot is still making trouble. I am using Dovecot 1:2.3.4.1-5+deb10u6 and I am using ISPconfig 3.25 to do the rough configuring and nano and whats left of my brain to do the finer details. Lets start with what I added to conf.d/10-ssl.conf ssl_cert = </etc/letsencrypt/live/servername/fullchain.pem ssl_key = </etc/letsencrypt/live/servername/privkey.pem ssl_cipher_list = EECDH+ECDSA+AESGCM:EECDH+aRSA+AESGCM:EECDH+ECDSA+SHA384:EECDH+ECDSA+SHA256:EECDH+aRSA+SHA384:EECDH+aR$ ssl_protocols = !SSLv2 !SSLv3 !TLSv1 !TLSv1.1 ssl_min_protocol = TLSv1.2 As you can see, I clearly do not want to use TLS before v1.2. I think this is not unreasonable in the year 2021. Now, after the changes I ran Kali (I use it to verify the results of my experiments) and - this is a mailing list, so no screenshots: It says: SSL/TLS Deprecated TLS v1.0 and TLS v1.1 Detection. I get this for the ports 143, 110, 993 and 995. I thought I had done everything one could to disable old TLS-Versions. What am I doing wrong? Yours sincerely Stefan Schumacher

4 6