- dovecot - dovecot.org

Upgrade 2.3 to 2.4 - Dovecot cannot find user mailbox
by Cam Ellison 22 May '25

22 May '25

The system in question primarily sends emails to group members but also has a few virtual email accounts for officers. Usernames and passwords are looked up from a mysql (MariaDB) database. After the upgrade incoming mail now goes to a vmail account that Dovecot creates because it cannot match the email to the user for whom it is intended (there is no user 'vmail' in the system). Users can log in and read their mail and send mail, but any emails received since the change to 2.4 are understandably inaccessible. Below is the output from doveconf -n. Can anyone see what is wrong? # 2.4.1-4 (7d8c0e5759): /etc/dovecot/dovecot.conf # Pigeonhole version 2.4.1-4 (0a86619f) # OS: Linux 6.1.0-20-rt-686-pae i686 Debian 13.0 ext4 # Hostname: football.scasl.ca # 4 default setting changes since version 2.4.0 dovecot_config_version = 2.4.0 auth_debug = yes auth_debug_passwords = yes auth_mechanisms = plain login base_dir = /var/run/dovecot/ dovecot_storage_version = 2.4.0 first_valid_gid = 5000 first_valid_uid = 5000 fts_autoindex = yes fts_autoindex_max_recent_msgs = 999 fts_search_add_missing = yes hostname = scasl.ca listen = * :: login_trusted_networks = 209.121.143.10/32 mail_debug = yes mail_driver = maildir mail_gid = 5000 mail_home = /var/vmail/%{user|username} mail_inbox_path = /var/vmail/%{user|username}/Maildir/INBOX mail_path = /var/vmail/%{user|username}/Maildir mail_privileged_group = vmail mail_uid = 5000 postmaster_address = postmaster(a)scasl.ca protocols { imap = yes } sql_driver = mysql dict quota { } mysql scasl.ca { dbname = scasl host = localhost password = # hidden, use -P to show it port = 3306 user = scasl } userdb sql { iterate_query = SELECT email_username AS username, domain FROM league query = SELECT CONCAT('/var/vmail/',email_username) AS home, 5000 AS uid, 5000 AS gid FROM league WHERE email_username = '%{user|username}' } passdb sql { default_password_scheme = BLF-CRYPT query = SELECT password FROM login WHERE ID IN (SELECT ID FROM league WHERE email_username='%{user|username}') } maildir { very_dirty_syncs = yes } namespace inbox { mail_driver = maildir mail_home = /var/vmail/%{user|username} mail_inbox_path = /var/vmail/%{user|username}/Maildir/INBOX mail_path = /var/vmail/%{user|username}/Maildir inbox = yes separator = / mailbox Drafts { auto = subscribe special_use = "\\Drafts" } mailbox Junk { special_use = "\\Junk" } mailbox Trash { special_use = "\\Trash" } mailbox Sent { special_use = "\\Sent" } mailbox "Sent Messages" { special_use = "\\Sent" } } service imap-login { inet_listener imap { } inet_listener imaps { } } service submission-login { inet_listener submission { } } service lmtp { unix_listener lmtp { mode = 0666 } } service imap { } service pop3 { } service submission { } service auth { unix_listener auth-userdb { mode = 0666 } unix_listener auth-client { mode = 0666 } } service auth-worker { } service dict { unix_listener dict { } } service stats { unix_listener stats-reader { group = vmail mode = 0666 } unix_listener stats-writer { group = vmail mode = 0666 } } ssl_server { cert_file = /etc/letsencrypt/live/scasl.ca/fullchain.pem key_file = /etc/letsencrypt/live/scasl.ca/privkey.pem } Cheers Cam The system in question primarily sends emails to group members but also has a few virtual email accounts for officers. Usernames and passwords are looked up from a mysql (MariaDB) database. After the upgrade incoming mail now goes to a vmail account that Dovecot creates because it cannot match the email to the user for whom it is intended (there is no user 'vmail' in the system). Users can log in and read their mail and send mail, but any emails received since the change to 2.4 are understandably inaccessible. Below is the output from doveconf -n. Can anyone see what is wrong? # 2.4.1-4 (7d8c0e5759): /etc/dovecot/dovecot.conf # Pigeonhole version 2.4.1-4 (0a86619f) # OS: Linux 6.1.0-20-rt-686-pae i686 Debian 13.0 ext4 # Hostname: football.scasl.ca # 4 default setting changes since version 2.4.0 dovecot_config_version = 2.4.0 auth_debug = yes auth_debug_passwords = yes auth_mechanisms = plain login base_dir = /var/run/dovecot/ dovecot_storage_version = 2.4.0 first_valid_gid = 5000 first_valid_uid = 5000 fts_autoindex = yes fts_autoindex_max_recent_msgs = 999 fts_search_add_missing = yes hostname = scasl.ca listen = * :: login_trusted_networks = 209.121.143.10/32 mail_debug = yes mail_driver = maildir mail_gid = 5000 mail_home = /var/vmail/%{user|username} mail_inbox_path = /var/vmail/%{user|username}/Maildir/INBOX mail_path = /var/vmail/%{user|username}/Maildir mail_privileged_group = vmail mail_uid = 5000 postmaster_address = postmaster(a)scasl.ca protocols { imap = yes } sql_driver = mysql dict quota { } mysql scasl.ca { dbname = scasl host = localhost password = # hidden, use -P to show it port = 3306 user = scasl } userdb sql { iterate_query = SELECT email_username AS username, domain FROM league query = SELECT CONCAT('/var/vmail/',email_username) AS home, 5000 AS uid, 5000 AS gid FROM league WHERE email_username = '%{user|username}' } passdb sql { default_password_scheme = BLF-CRYPT query = SELECT password FROM login WHERE ID IN (SELECT ID FROM league WHERE email_username='%{user|username}') } maildir { very_dirty_syncs = yes } namespace inbox { mail_driver = maildir mail_home = /var/vmail/%{user|username} mail_inbox_path = /var/vmail/%{user|username}/Maildir/INBOX mail_path = /var/vmail/%{user|username}/Maildir inbox = yes separator = / mailbox Drafts { auto = subscribe special_use = "\\Drafts" } mailbox Junk { special_use = "\\Junk" } mailbox Trash { special_use = "\\Trash" } mailbox Sent { special_use = "\\Sent" } mailbox "Sent Messages" { special_use = "\\Sent" } } service imap-login { inet_listener imap { } inet_listener imaps { } } service submission-login { inet_listener submission { } } service lmtp { unix_listener lmtp { mode = 0666 } } service imap { } service pop3 { } service submission { } service auth { unix_listener auth-userdb { mode = 0666 } unix_listener auth-client { mode = 0666 } } service auth-worker { } service dict { unix_listener dict { } } service stats { unix_listener stats-reader { group = vmail mode = 0666 } unix_listener stats-writer { group = vmail mode = 0666 } } ssl_server { cert_file = /etc/letsencrypt/live/scasl.ca/fullchain.pem key_file = /etc/letsencrypt/live/scasl.ca/privkey.pem } Cheers Cam

2 2

Upgrade 2.3 to 2.4 - virtual mail - dovecot-lda flags ignored
by Cam Ellison 22 May '25

22 May '25

When running v2.3, Dovecot correctly identifies both recipient and domain when receiving mail from Debian exim4 via dovecot-lda, with no flags set. With v2.4, whether the flags are set or not, Dovecot throws error 75. If lda_mailbox_autocreate is set to yes, it creates the mailuser vmail and delivers to /var/vmail/vmail/INBOX. Users are able to log in and read email as before. doveadm user admin(a)example.ca output is: field value uid 5000 gid 5000 home /var/vmail/admin mail_path /var/vmail/admin/Maildir Here is the full printout of doveconf -n. # 2.4.1-4 (7d8c0e5759): /etc/dovecot/dovecot.conf # Pigeonhole version 2.4.1-4 (0a86619f) # OS: Linux 6.1.0-20-rt-686-pae i686 Debian 13.0 ext4 # Hostname: football.scasl.ca # 4 default setting changes since version 2.4.0 dovecot_config_version = 2.4.0 auth_debug = yes auth_debug_passwords = yes auth_mechanisms = plain login base_dir = /var/run/dovecot/ dovecot_storage_version = 2.4.0 first_valid_gid = 5000 first_valid_uid = 5000 fts_autoindex = yes fts_autoindex_max_recent_msgs = 999 fts_search_add_missing = yes hostname = scasl.ca listen = * :: login_trusted_networks = 209.121.143.10/32 mail_debug = yes mail_driver = maildir mail_gid = 5000 mail_home = /var/vmail/%{user|username} mail_inbox_path = /var/vmail/%{user|username}/Maildir/INBOX mail_path = /var/vmail/%{user|username}/Maildir mail_privileged_group = vmail mail_uid = 5000 postmaster_address = postmaster(a)scasl.ca protocols { imap = yes } sql_driver = mysql mysql scasl.ca { dbname = scasl host = localhost password = # port = 3306 user = scasl } userdb sql { iterate_query = SELECT email_username AS username, domain FROM league query = SELECT CONCAT('/var/vmail/',email_username) AS home, 5000 AS uid, 5000 AS gid FROM league WHERE email_username = '%{user|username}' } passdb sql { default_password_scheme = BLF-CRYPT query = SELECT password FROM login WHERE ID IN (SELECT ID FROM league WHERE email_username='%{user|username}') } maildir { very_dirty_syncs = yes } namespace inbox { mail_driver = maildir mail_home = /var/vmail/%{user|username} mail_inbox_path = /var/vmail/%{user|username}/Maildir/INBOX mail_path = /var/vmail/%{user|username}/Maildir inbox = yes separator = / type = private mailbox Drafts { auto = subscribe special_use = "\\Drafts" } mailbox Junk { special_use = "\\Junk" } mailbox Trash { special_use = "\\Trash" } mailbox Sent { special_use = "\\Sent" } mailbox "Sent Messages" { special_use = "\\Sent" } } service imap-login { inet_listener imap { } inet_listener imaps { } } service submission-login { inet_listener submission { } } service lmtp { unix_listener lmtp { mode = 0666 } } service imap { } service pop3 { } service submission { } service auth { unix_listener auth-userdb { mode = 0666 } unix_listener auth-client { mode = 0666 } } service auth-worker { } service dict { unix_listener dict { } } service stats { unix_listener stats-reader { group = vmail mode = 0666 } unix_listener stats-writer { group = vmail mode = 0666 } } ssl_server { cert_file = /etc/letsencrypt/live/scasl.ca/fullchain.pem key_file = /etc/letsencrypt/live/scasl.ca/privkey.pem } protocol lda { mail_plugins = $mail_plugins } I assume I am missing a parameter that needs setting. Is it that, do I have something set incorrectly, or is it really a bug? Cheers Cam When running v2.3, Dovecot correctly identifies both recipient and domain when receiving mail from Debian exim4 via dovecot-lda, with no flags set. With v2.4, whether the flags are set or not, Dovecot throws error 75. If lda_mailbox_autocreate is set to yes, it creates the mailuser vmail and delivers to /var/vmail/vmail/INBOX. Users are able to log in and read email as before. doveadm user admin(a)example.ca output is: field value uid 5000 gid 5000 home /var/vmail/admin mail_path /var/vmail/admin/Maildir Here is the full printout of doveconf -n. # 2.4.1-4 (7d8c0e5759): /etc/dovecot/dovecot.conf # Pigeonhole version 2.4.1-4 (0a86619f) # OS: Linux 6.1.0-20-rt-686-pae i686 Debian 13.0 ext4 # Hostname: football.scasl.ca # 4 default setting changes since version 2.4.0 dovecot_config_version = 2.4.0 auth_debug = yes auth_debug_passwords = yes auth_mechanisms = plain login base_dir = /var/run/dovecot/ dovecot_storage_version = 2.4.0 first_valid_gid = 5000 first_valid_uid = 5000 fts_autoindex = yes fts_autoindex_max_recent_msgs = 999 fts_search_add_missing = yes hostname = scasl.ca listen = * :: login_trusted_networks = 209.121.143.10/32 mail_debug = yes mail_driver = maildir mail_gid = 5000 mail_home = /var/vmail/%{user|username} mail_inbox_path = /var/vmail/%{user|username}/Maildir/INBOX mail_path = /var/vmail/%{user|username}/Maildir mail_privileged_group = vmail mail_uid = 5000 postmaster_address = postmaster(a)scasl.ca protocols { imap = yes } sql_driver = mysql mysql scasl.ca { dbname = scasl host = localhost password = # port = 3306 user = scasl } userdb sql { iterate_query = SELECT email_username AS username, domain FROM league query = SELECT CONCAT('/var/vmail/',email_username) AS home, 5000 AS uid, 5000 AS gid FROM league WHERE email_username = '%{user|username}' } passdb sql { default_password_scheme = BLF-CRYPT query = SELECT password FROM login WHERE ID IN (SELECT ID FROM league WHERE email_username='%{user|username}') } maildir { very_dirty_syncs = yes } namespace inbox { mail_driver = maildir mail_home = /var/vmail/%{user|username} mail_inbox_path = /var/vmail/%{user|username}/Maildir/INBOX mail_path = /var/vmail/%{user|username}/Maildir inbox = yes separator = / type = private mailbox Drafts { auto = subscribe special_use = "\\Drafts" } mailbox Junk { special_use = "\\Junk" } mailbox Trash { special_use = "\\Trash" } mailbox Sent { special_use = "\\Sent" } mailbox "Sent Messages" { special_use = "\\Sent" } } service imap-login { inet_listener imap { } inet_listener imaps { } } service submission-login { inet_listener submission { } } service lmtp { unix_listener lmtp { mode = 0666 } } service imap { } service pop3 { } service submission { } service auth { unix_listener auth-userdb { mode = 0666 } unix_listener auth-client { mode = 0666 } } service auth-worker { } service dict { unix_listener dict { } } service stats { unix_listener stats-reader { group = vmail mode = 0666 } unix_listener stats-writer { group = vmail mode = 0666 } } ssl_server { cert_file = /etc/letsencrypt/live/scasl.ca/fullchain.pem key_file = /etc/letsencrypt/live/scasl.ca/privkey.pem } protocol lda { mail_plugins = $mail_plugins } I assume I am missing a parameter that needs setting. Is it that, do I have something set incorrectly, or is it really a bug? Cheers Cam

2 2

Re: Upgrade 2.3 to 2.4 - virtual mail - dovecot-lda flags ignored
by Cam Ellison 22 May '25

22 May '25

On 2025-05-21 14:11, Odhiambo Washington wrote: > Hi Cam, > > I suffered something similar during my migration and an old post > somewhere saved the day for me: https://skeletor.org.ua/?p=2497 > I hope it helps you too. > It was worth a try, and at least has changed the focus to Exim from Dovecot: the existing lookups for identifying user@domain in Exim are not working. What he has is not significantly different from my own setup. Thank you for the link Cam

1 1

Large Server with Dovecot
by Odhiambo Washington 21 May '25

21 May '25

Hello Admins, I have at hand a task to setup Dovecot (2.4.1) to handle about 10,000 mailboxes using IMAP/POP3. It's a migration from another system. The current total storage for the mailboxes is 350GB. I believe several Mail admins are managing such systems, and bigger. What do you recommend as the baseline for the optimization Dovecot engine itself? Assuming the storage is on SSD, is there something you recommend I add to the dovecot.configuration for fast access? Indexing? Anything else? How about the system specs - CPU/RAM? Thank you in advance. -- Best regards, Odhiambo WASHINGTON, Nairobi,KE +254 7 3200 0004/+254 7 2274 3223 In an Internet failure case, the #1 suspect is a constant: DNS. "Oh, the cruft.", egrep -v '^$|^.*#' ¯\_(ツ)_/¯ :-) [How to ask smart questions: http://www.catb.org/~esr/faqs/smart-questions.html] Hello Admins, I have at hand a task to setup Dovecot (2.4.1) to handle about 10,000 mailboxes using IMAP/POP3. It's a migration from another system. The current total storage for the mailboxes is 350GB. I believe several Mail admins are managing such systems, and bigger. What do you recommend as the baseline for the optimization Dovecot engine itself? Assuming the storage is on SSD, is there something you recommend I add to the dovecot.configuration for fast access? Indexing? Anything else? How about the system specs - CPU/RAM? Thank you in advance. -- Best regards, Odhiambo WASHINGTON, Nairobi,KE +254 7 3200 0004/+254 7 2274 3223 In an Internet failure case, the #1 suspect is a constant: DNS. "Oh, the cruft.", egrep -v '^$|^.*#' ¯\_(ツ)_/¯ :-) [How to ask smart questions: http://www.catb.org/~esr/faqs/smart- questions.html]

1 0

prohibit subfolders under INBOX
by dentar＠fnsheppard.com 20 May '25

20 May '25

I know this is a n00b question but I've done my diligence... Is there a way (Maildir not MBOX) to ONLY prohibit creation of folders under INBOX e.g. no INBOX.Fred allowed, but the user MAY create subfolders under other folders, e.g. Fred.Barney? We've discovered that when people create INBOX.anything it causes Outlook to go insane.

1 0

bug report: "Corrupted transaction log file" PLUS request for improvement of the documentation about mmap_disable
by Patrick Cernko 20 May '25

20 May '25

Hello Dovecot developers, hello list, since more than two years we had occasional log messages like this: Error: Mailbox INBOX: Corrupted transaction log file /IMAP/mail/mailboxes/USER/mdbox/mailboxes/INBOX/dbox-Mails/dovecot.index.log seq 45532: Unexpected garbage at EOF (sync_offset=4856) Mostly I had to repair the affected mailbox manually after such events. Luckily I could prevent any data corruptions by using the healthy mailbox from the replication partner. Those errors occurred rather seldom (once a month) but started get more often. At the end of last year, they occurred about once a week for 800 users with up to 200 folders. The reporting process was always different, like the indexer, imapd, lmtpd, replicator or doveadm (on cmdline). It was obviously some sort of race-condition between the different processes accessing the index. I did not see any hints how to reproduce it. At the beginning of this year I started to debug this issue by adding debugging log output to our productive system, mostly in lib-index. I was hoping to find the cause of the issue and maybe even provide a patch to fix this. But about 5 weeks ago, I discovered, that the error can be simply avoided by setting mmap_disable=yes. Since this change, the error did not occur again even with specific tests, that previously likely triggered the bug. That's where I stopped to debug further. We are running Dovecot in master-master mode using replication plugin behind a Dovecot director setup. The storage on the backends is provided by local disks on Linux with newest ZFS filesystem. We use mdbox storage and FTS. While testing I also checked ext4 instead of ZFS and different FTS backends without success. I can provide more information for the developers if you are interested! --------------------------------- About mmap_disable: The documentation only mentions, that you should set this to "yes" for SHARED filesystems (I don't think local ZFS or ext4 qualify for that). https://doc.dovecot.org/2.3/settings/core/#core_setting-mmap_disable On another page (https://doc.dovecot.org/2.3/admin_manual/mailbox_formats/#memory-mapping) it is mentioned, that "If mmap() is supported by your filesystem, it’s still not certain that it gives better performance. Try benchmarking to make sure." I also found an old mail from Timo (https://dovecot.org/list/dovecot/2011-December/079975.html) which lists 3 cases, where mmap_disable=yes is required or at least suggested. In only one case, he wrote "With local filesystems mmap_disable=no _should_ be faster." I did not do extensive benchmarks but I did not see any performance issues since we disabled mmap on our IMAP backends. So, I wonder, if it would not be better to switch the default for mmap_disable to YES: 1. There are configurations, where the current default might cause data corruption! 2. There are configurations, where disabling mmap is suggested. 3. Even on local storage, the performance benefits are unsure. 4. According to my observations, even on local storage, enabling mmap can cause data corruption. Changing the default to NO would protect users from accidental data corruption. Users that aim for maximum performance can still enable mmap and test if it improves performance. IMHO the documentation should mention, that even for local disks, mmap CAN cause data corruption (until the above mentioned bug is found and fixed). Best regards, -- Patrick Cernko <pcernko(a)mpi-klsb.mpg.de> +49 681 9325 5815 Joint Scientific IT and Technical Service Max-Planck-Institute für Informatik & Softwaresysteme

1 0

Change the way folders are displayed via IMAP protocol
by Lafiel 19 May '25

19 May '25

Hi. How can I patch the source code so that the server forces the list of all folders to be displayed in quotes? Or add the corresponding parameter to the configuration file? -- Best regards, Lafiel mailto:lafiel@elven.pw

1 0

Dovecot 3.21.1 -> 2.4.0 SegFault
by Cata S 19 May '25

19 May '25

Hi guys, There seems to be some issue with Dovecot deployed on alpine. More specifically, the dovecot.config file is not properly read. I have run some debugging and the SegFault is returned in the function below: #0 0x000055555556779b in config_parsed_get_setting () No symbol table info available. #1 0x0000555555563708 in config_dump_full () No symbol table info available. #2 0x000055555555c814 in main () No symbol table info available. This was also addressed by alpine here: https://gitlab.alpinelinux.org/alpine/aports/-/issues/17050 Any idea what could be causing this? Thanks for looking into it, Cata

3 2

Users losing mail from their mailboxes
by Nikolaos Milas 18 May '25

18 May '25

Hello, We are on Dovecot 2.3.18. Some users are occasionally complaining that all mail vanishes from their inbox. However, we cannot find any indication of deletions or expunge in the log. One explanation could be that mail files are deleted externally (at the file system level), but I can't imagine what could cause such deletions. How would you suggest us to troubleshoot this further? We could enable "mail_debug = yes", but this would flood the logs and cause performance drop, and the issue is happening rarely. Any other ideas to troubleshoot these cases in the past (through logs) or monitor (whatever) for the future? (The config is listed at the end.) Thanks in advance. Best regards, Nick The config follows: ======================================================================= protocols = imap pop3 sieve lmtp login_greeting = Dovecot OUR ORG log_path = /var/log/dove.log mail_location = maildir:~/Maildir/ mail_gid = 500 mail_uid = 500 auth_mechanisms = plain login auth_username_format = %Ln auth_verbose = no auth_debug = no mail_debug = no disable_plaintext_auth = no mail_plugins = quota mail_log notify protocol imap { imap_client_workarounds = "delay-newmail" mail_plugins = quota imap_quota mail_log notify mail_max_userip_connections = 400 namespace inbox { mailbox Trash { autoexpunge = 15d } } } protocol pop3 { mail_max_userip_connections = 3 mail_plugins = quota notify pop3_client_workarounds = outlook-no-nuls oe-ns-eoh pop3_uidl_format = %08Xu%08Xv namespace inbox { mailbox Trash { autoexpunge = 15d } } } protocol lda { auth_socket_path = /var/run/dovecot/auth-master mail_plugins = quota notify sieve postmaster_address = sysadmin(a)noa.gr sendmail_path = /usr/lib/sendmail } protocol lmtp { auth_socket_path = /var/run/dovecot/auth-master postmaster_address = sysadmin(a)noa.gr mail_plugins = quota notify sieve sendmail_path = /usr/lib/sendmail } protocol sieve { managesieve_max_line_length = 65536 mail_max_userip_connections = 10 managesieve_logout_format = bytes=%i/%o managesieve_max_compile_errors = 10 } userdb { args = /etc/dovecot/dovecot-usrdb-ldap.conf driver = ldap } passdb { args = /etc/dovecot/dovecot-passdb-ldap.conf driver = ldap } plugin { mail_log_events = delete undelete expunge copy mailbox_delete mailbox_rename flag_change save mailbox_create mail_log_fields = uid box msgid size flags vsize from subject quota = maildir:User quota quota_rule = *:storage=15G quota_rule2 = Trash:storage=+3%% quota_warning = storage=75%% quota-warning 75 %u quota_warning2 = storage=90%% quota-warning 90 %u # Used by both the Sieve plugin and the ManageSieve protocol sieve = file:~/sieve;active=~/.dovecot.sieve sieve_max_script_size = 0 sieve_max_actions = 0 sieve_max_redirects = 2 } service quota-warning { executable = script /opt/mail1.sh user = vmail unix_listener quota-warning { user = vmail } } service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0660 user = postfix } unix_listener auth-master { group = vmail mode = 0660 user = vmail } user = root } service imap-login { service_count = 100 vsz_limit = 64 M process_limit = 500 } service pop3-login { service_count = 100 vsz_limit = 64 M } service managesieve-login { inet_listener sieve { port = 4190 } service_count = 100 process_min_avail = 0 vsz_limit = 64M } service managesieve { process_limit = 1024 } service imap { executable = imap postlogin process_limit = 2048 } service pop3 { executable = pop3 postlogin } service postlogin { executable = script-login -d rawlog unix_listener postlogin { } } service lmtp { unix_listener /var/spool/postfix/private/dovecot-lmtp { group = postfix mode = 0600 user = postfix } } ssl = yes ssl_cert = </etc/pki/tls/certs/servercert.crt ssl_key = </etc/pki/tls/private/serverkey.key namespace inbox { separator = . prefix = inbox = yes mailbox Drafts { special_use = \Drafts auto = subscribe } mailbox Junk { special_use = \Junk auto = subscribe } mailbox Trash { special_use = \Trash auto = subscribe } mailbox Sent { special_use = \Sent auto = subscribe } } ======================================================================= Hello, We are on Dovecot 2.3.18. Some users are occasionally complaining that all mail vanishes from their inbox. However, we cannot find any indication of deletions or expunge in the log. One explanation could be that mail files are deleted externally (at the file system level), but I can't imagine what could cause such deletions. How would you suggest us to troubleshoot this further? We could enable "mail_debug = yes", but this would flood the logs and cause performance drop, and the issue is happening rarely. Any other ideas to troubleshoot these cases in the past (through logs) or monitor (whatever) for the future? (The config is listed at the end.) Thanks in advance. Best regards, Nick The config follows: ======================================================================= protocols = imap pop3 sieve lmtp login_greeting = Dovecot OUR ORG log_path = /var/log/dove.log mail_location = maildir:~/Maildir/ mail_gid = 500 mail_uid = 500 auth_mechanisms = plain login auth_username_format = %Ln auth_verbose = no auth_debug = no mail_debug = no disable_plaintext_auth = no mail_plugins = quota mail_log notify protocol imap { imap_client_workarounds = "delay-newmail" mail_plugins = quota imap_quota mail_log notify mail_max_userip_connections = 400 namespace inbox { mailbox Trash { autoexpunge = 15d } } } protocol pop3 { mail_max_userip_connections = 3 mail_plugins = quota notify pop3_client_workarounds = outlook-no-nuls oe-ns-eoh pop3_uidl_format = %08Xu%08Xv namespace inbox { mailbox Trash { autoexpunge = 15d } } } protocol lda { auth_socket_path = /var/run/dovecot/auth-master mail_plugins = quota notify sieve postmaster_address = sysadmin(a)noa.gr sendmail_path = /usr/lib/sendmail } protocol lmtp { auth_socket_path = /var/run/dovecot/auth-master postmaster_address = sysadmin(a)noa.gr mail_plugins = quota notify sieve sendmail_path = /usr/lib/sendmail } protocol sieve { managesieve_max_line_length = 65536 mail_max_userip_connections = 10 managesieve_logout_format = bytes=%i/%o managesieve_max_compile_errors = 10 } userdb { args = /etc/dovecot/dovecot-usrdb-ldap.conf driver = ldap } passdb { args = /etc/dovecot/dovecot-passdb-ldap.conf driver = ldap } plugin { mail_log_events = delete undelete expunge copy mailbox_delete mailbox_rename flag_change save mailbox_create mail_log_fields = uid box msgid size flags vsize from subject quota = maildir:User quota quota_rule = *:storage=15G quota_rule2 = Trash:storage=+3%% quota_warning = storage=75%% quota-warning 75 %u quota_warning2 = storage=90%% quota-warning 90 %u # Used by both the Sieve plugin and the ManageSieve protocol sieve = file:~/sieve;active=~/.dovecot.sieve sieve_max_script_size = 0 sieve_max_actions = 0 sieve_max_redirects = 2 } service quota-warning { executable = script /opt/mail1.sh user = vmail unix_listener quota-warning { user = vmail } } service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0660 user = postfix } unix_listener auth-master { group = vmail mode = 0660 user = vmail } user = root } service imap-login { service_count = 100 vsz_limit = 64 M process_limit = 500 } service pop3-login { service_count = 100 vsz_limit = 64 M } service managesieve-login { inet_listener sieve { port = 4190 } service_count = 100 process_min_avail = 0 vsz_limit = 64M } service managesieve { process_limit = 1024 } service imap { executable = imap postlogin process_limit = 2048 } service pop3 { executable = pop3 postlogin } service postlogin { executable = script-login -d rawlog unix_listener postlogin { } } service lmtp { unix_listener /var/spool/postfix/private/dovecot-lmtp { group = postfix mode = 0600 user = postfix } } ssl = yes ssl_cert = </etc/pki/tls/certs/servercert.crt ssl_key = </etc/pki/tls/private/serverkey.key namespace inbox { separator = . prefix = inbox = yes mailbox Drafts { special_use = \Drafts auto = subscribe } mailbox Junk { special_use = \Junk auto = subscribe } mailbox Trash { special_use = \Trash auto = subscribe } mailbox Sent { special_use = \Sent auto = subscribe } } =======================================================================

5 8

Problem with Dovecot on a FIPS enabled system
by Eric Berry 16 May '25

16 May '25

This bug was submitted on an Ubuntu Jammy system with FIPS enabled. Here is the Ubuntu bug report: https://bugs.launchpad.net/ubuntu/+source/openssl/+bug/2107773 Pull Request submitted: https://github.com/dovecot/core/pull/241 [ Impact ] - When one enables FIPS mode on a Jammy system and then attempts to use Dovecot to create an encrypted mailbox, the module returns a invalid salt length error. - FIPS mode requires a 16 byte salt for PBEKDF2 and Dovecot is only requesting 8 bytes of salt. The solution is to modify Dovecot to request 16 bytes of salt. [ Test Plan ] - Install Dovecot on the system - sudo apt install dovecot-auth-lua dovecot-core dovecot-gssapi dovecot-imapd dovecot-ldap dovecot-lmtpd dovecot-managesieved dovecot-mysql dovecot-pgsql dovecot-pop3d dovecot-sieve dovecot-solr dovecot-sqlite dovecot-submissiond - Enable mailbox encryption. - Add /etc/dovecot/conf.d//mail-crypt.conf to enable mailbox encryption: mail_location = mbox:~/mail:INBOX=/var/mail/%u listen = * mbox_write_locks = fcntl namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } passdb { driver = pam } userdb { driver = passwd } mail_plugins = $mail_plugins mail_crypt plugin { mail_crypt_curve = secp521r1 mail_crypt_save_version=2 } mail_attribute_dict = file:%h/Maildir/dovecot-attributes imap_metadata = yes - Issue the following command to create an encrypted mailbox: - sudo doveadm -o plugin/mail_crypt_private_password=e32f1f174d7576716d5df899e7d5cb6b64cdb33584c71882e9f7e1f79f2e695e mailbox cryptokey generate -u - Verify that no error occurs. - Enable FIPS on a Jammy system. - sudo pro attach - sudo pro enable fips-updates - sudo reboot - Reboot - Delete the mailbox - rm -rf ~/mail - Issue the following command to create an encrypted mailbox: - sudo doveadm -o plugin/mail_crypt_private_password=e32f1f174d7576716d5df899e7d5cb6b64cdb33584c71882e9f7e1f79f2e695e mailbox cryptokey generate -u <username> - Verify that an error occurs. - Update Dovecot to the fixed version. - Repeat the commands to delete the mailbox and to create an encrypted mailbox. - After installing the fix, verify that no error occurs. [ Where problems could occur ] - The increased salt size of 16 bytes could potentially cause issues in allocated data structures, but I've attempted to mitigate this by increasing the size of potentially problematic data structures. [ Other Info ] This is really only needed on systems where FIPS is supported, i.e. Jammy and Noble and 26.04. This bug was submitted on an Ubuntu Jammy system with FIPS enabled. Here is the Ubuntu bug report: https://bugs.launchpad.net/ubuntu/+source/openssl/+bug/2107773 Pull Request submitted: https://github.com/dovecot/core/pull/241 [ Impact ] * When one enables FIPS mode on a Jammy system and then attempts to use Dovecot to create an encrypted mailbox, the module returns a invalid salt length error. * FIPS mode requires a 16 byte salt for PBEKDF2 and Dovecot is only requesting 8 bytes of salt. The solution is to modify Dovecot to request 16 bytes of salt. [ Test Plan ] * Install Dovecot on the system o sudo apt install dovecot-auth-lua dovecot-core dovecot-gssapi dovecot-imapd dovecot-ldap dovecot-lmtpd dovecot-managesieved dovecot-mysql dovecot-pgsql dovecot-pop3d dovecot-sieve dovecot- solr dovecot-sqlite dovecot-submissiond * Enable mailbox encryption. o Add /etc/dovecot/conf.d//mail-crypt.conf to enable mailbox encryption: mail_location = mbox:~/mail:INBOX=/var/mail/%u listen = * mbox_write_locks = fcntl namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } passdb { driver = pam } userdb { driver = passwd } mail_plugins = $mail_plugins mail_crypt plugin { mail_crypt_curve = secp521r1 mail_crypt_save_version=2 } mail_attribute_dict = file:%h/Maildir/dovecot-attributes imap_metadata = yes * Issue the following command to create an encrypted mailbox: o sudo doveadm -o plugin/ mail_crypt_private_password=e32f1f174d7576716d5df899e7d5cb6b64cdb33584c71882e9f7e1f79f2e695e mailbox cryptokey generate -u * Verify that no error occurs. * Enable FIPS on a Jammy system. o sudo pro attach o sudo pro enable fips-updates o sudo reboot * Reboot * Delete the mailbox o rm -rf ~/mail * Issue the following command to create an encrypted mailbox: o sudo doveadm -o plugin/ mail_crypt_private_password=e32f1f174d7576716d5df899e7d5cb6b64cdb33584c71882e9f7e1f79f2e695e mailbox cryptokey generate -u <username> * Verify that an error occurs. * Update Dovecot to the fixed version. * Repeat the commands to delete the mailbox and to create an encrypted mailbox. * After installing the fix, verify that no error occurs. [ Where problems could occur ] * The increased salt size of 16 bytes could potentially cause issues in allocated data structures, but I've attempted to mitigate this by increasing the size of potentially problematic data structures. [ Other Info ] This is really only needed on systems where FIPS is supported, i.e. Jammy and Noble and 26.04.

1 0