- dovecot - dovecot.org

Forwarding parameters for imapc
by bra＠fsn.hu 26 Jan '21

26 Jan '21

Hi, I have the following IMAP setup: dovecot proxy -> dovecot server -> IMAP backend (imapc) What I want to achieve is to have the original client parameters from the proxy in the IMAP backend. Dovecot in proxy mode sends them via an ID command, like this: ID ("x-session-id" "SESS" "x-originating-ip" "IP" "x-originating-port" "PORT" "x-connected-ip" "IP" "x-connected-port" "PORT" "x-proxy-ttl" "4") Is it possible with current dovecot versions to send this to the imapc backend as well? Of course I would expect that if the dovecot proxy is in login_trusted_networks, information from it should be used (IMAP: ID, POP/LMTP: XCLIENT). If this is not the case, could you please implement it? Thanks,

1 0

Error "collect2: error: ld returned 213 exit status" when build Dovecot 2.3.13 on CentOS 7&8 with Valgrind
by Duc Anh Do 26 Jan '21

26 Jan '21

Hi all, I'm building Dovecot from source of Dovecot 2.3.13. When doing make check, I saw an error: make[1]: Entering directory '/home/xxx/rpmbuild/BUILD/xxx/dovecot-2.3.13/src/lib-ssl-iostream' for bin in test-iostream-ssl; do \ if ! /bin/sh ../../run-test.sh ../.. ./$bin; then exit 1; fi; \ done collect2: error: ld returned 213 exit status Failed to run: ./test-iostream-ssl This is my configuration in spec file: %configure \ INSTALL_DATA="install -c -p -m644" \ --docdir=%{_docdir}/%{name} \ --disable-static \ --disable-rpath \ --with-nss \ --with-shadow \ --with-pam \ --with-gssapi=plugin \ --with-ldap=plugin \ --with-sql=plugin \ --with-pgsql \ --with-mysql \ --with-sqlite \ --with-zlib \ --with-libcap \ --with-ssl=openssl \ --with-ssldir=%{ssldir} \ --with-docs I installed OpenSSL and Valgrind: # yum list installed | egrep "valgrind|openssl" openssl-devel.x86_64 1:1.1.1g-12.el8_3 @BaseOS openssl-libs.x86_64 1:1.1.1g-12.el8_3 @BaseOS valgrind.x86_64 1:3.16.0-2.el8 @AppStream valgrind-devel.x86_64 1:3.16.0-2.el8 @AppStream I investigated the problem and found something: - Unlike other lib-xxx, libtool doesn't generate executable binary test-iostream-ssl inside lib-ssl-iostream directory. That's a shell script and actual executable binary is inside ./libs directory ( https://www.gnu.org/software/libtool/manual/libtool.html#Linking-executables ): $ pwd /home/xxx/rpmbuild/BUILD/xxx/dovecot-2.3.13/src/lib-ssl-iostream $ file test-iostream-ssl test-iostream-ssl: POSIX shell script, ASCII text executable, with very long lines $ file .libs/test-iostream-ssl .libs/test-iostream-ssl: ELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, for GNU/Linux 3.2.0, BuildID[sha1]=c6a800c253c38a7eb78886286ef779d871550a6c, with debug_info, not stripped, too many notes (256) That means when running make check, Valgrind will monitor the shell script generated by libtool instead of the actual test code. And error occurs. - To confirm, I changed Makefile a bit: $ pwd /home/xxx/rpmbuild/BUILD/xxx/dovecot-2.3.13/src/lib-ssl-iostream $ vim Makefile check-local: for bin in $(test_programs); do \ export LD_LIBRARY_PATH=./.libs; \ if ! $(RUN_TEST) ./.libs/$$bin; then exit 1; fi; \ done Then do make check: $ cd ~/rpmbuild/BUILD/xxx/dovecot-2.3.13 $ make -C src/lib-ssl-iostream/ clean $ make -C src/lib-ssl-iostream/ check make[1]: Entering directory '/home/xxx/rpmbuild/BUILD/xxx/dovecot-2.3.13/src/lib-ssl-iostream' for bin in test-iostream-ssl; do \ export LD_LIBRARY_PATH=./.libs; \ if ! /bin/sh -x ../../run-test.sh ../.. ./.libs/$bin; then exit 1; fi; \ #if ! /bin/sh -x ../../run-test.sh ../.. ./$bin; then exit 1; fi; \ done ssl: handshake ....................................................... : ok ssl: o_stream_get_buffer_avail_size .................................. : ok ssl: small packets ................................................... : ok 0 / 3 tests failed + ret=0 + test -s test.out~19257 + test 0 '!=' 0 + exit 0 + rm -f test.out~19257 make[1]: Leaving directory '/home/xxx/rpmbuild/BUILD/xxx/dovecot-2.3.13/src/lib-ssl-iostream' make: Leaving directory '/home/xxx/rpmbuild/BUILD/xxx/dovecot-2.3.13/src/lib-ssl-iostream' - According to the manual of libtool, if I use libtool to generate library and executable binary, I should use libtool to execute (or debug or anything else). That will avoid misconfiguration and unexpected errors: - https://www.gnu.org/software/libtool/manual/html_node/Debugging-executables… - https://stackoverflow.com/a/14186488 My patch looks like this: diff --git a/src/lib-ssl-iostream/Makefile.am b/src/lib-ssl-iostream/Makefile.am index 5aaea5d..17ebf1d 100644 --- a/src/lib-ssl-iostream/Makefile.am +++ b/src/lib-ssl-iostream/Makefile.am @@ -56,6 +56,6 @@ noinst_PROGRAMS = $(test_programs) check-local: for bin in $(test_programs); do \ - if ! $(RUN_TEST) ./$$bin; then exit 1; fi; \ + if ! $(LIBTOOL) --mode execute $(RUN_TEST) ./$$bin; then exit 1; fi; \ done endif Result: make[2]: Entering directory '/home/xxx/rpmbuild/BUILD/xxx/dovecot-2.3.13/src/lib-ssl-iostream' make check-local make[3]: Entering directory '/home/xxx/rpmbuild/BUILD/xxx/dovecot-2.3.13/src/lib-ssl-iostream' for bin in test-iostream-ssl; do \ if ! /bin/sh ../../libtool --mode execute /bin/sh ../../run-test.sh ../.. ./$bin; then exit 1; fi; \ done ssl: handshake ....................................................... : ok ssl: o_stream_get_buffer_avail_size .................................. : ok ssl: small packets ................................................... : ok 0 / 3 tests failed make[3]: Leaving directory '/home/xxx/rpmbuild/BUILD/xxx/dovecot-2.3.13/src/lib-ssl-iostream' make[2]: Leaving directory '/home/xxx/rpmbuild/BUILD/xxx/dovecot-2.3.13/src/lib-ssl-iostream' Can anyone help to correct my understanding and my patch? Thanks, Anh Do

2 2

Deliver to different namespace with address detail
by Tobia Grosselle [ Terralink ] 25 Jan '21

25 Jan '21

can anyone confirm this?

1 0

Re: [BUG REPORT] In some cases dovecot sends (huge) binary data to solr for indexing
by Alexey Panov 25 Jan '21

25 Jan '21

Hello John, Sorry for a bit delayed reply. For some reason some of dovecot mail list messages are not reaching my inbox :( Indeed, I can confirm that your patch works as expected: meaning strips out just the message body. So yes, in my report I supposed to say: message bodies of affected messages are being ignored completely. Sorry for confusion and thanks again for such a useful patch!

1 0

New dovecot server, authentication confusion
by Jeff Abrahamson 24 Jan '21

24 Jan '21

I've set up a new dovecot+postfix instance with virtual (not system) users. I've a few questions, mostly about auth. I /think/ that postfix handles auth by asking dovecot. Users need to provide user + password to send (smtps) and receive (imaps). I see where I've configured this for dovecot, which is /etc/dovecot/passwd.db. That file contains lines like this: jeff@mobilitains.fr:{BLF-CRYPT}$2y$05$c... What concerns me is that I see occasional log items like this: Jan 24 11:26:33 nantes-m1 postfix/smtpd[4597]: fatal: no SASL authentication mechanisms (Also, I can't connect with thunderbird.) But I think I've configured SASL auth, so I'm not sure what to look at / how to debug this. I'm looking for suggestions how to approach this. I do not see how postfix knows who is allowed to connect, however. Am I correct that postfix delegates SASL to dovecot? This is the relevant config, I think: [T] jeff@nantes-m1:log $ doveconf -n # 2.3.7.2 (3c910f64b): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.7.2 () # OS: Linux 5.4.0-64-generic x86_64 Ubuntu 20.04.1 LTS # Hostname: nantes-m1.p27.eu auth_verbose = yes mail_location = mbox:~/mail:INBOX=/var/mail/%u mail_privileged_group = mail namespace inbox { inbox = yes location = mailbox Archive { auto = subscribe special_use = \Archive } mailbox Drafts { auto = subscribe special_use = \Drafts } mailbox Junk { auto = subscribe special_use = \Junk } mailbox Sent { auto = subscribe special_use = \Sent } mailbox Trash { auto = subscribe special_use = \Trash } prefix = } passdb { args = username_format=%u scheme=blf-crypt /etc/dovecot/passwd.db driver = passwd-file } plugin { sieve = file:~/sieve;active=~/.dovecot.sieve sieve_after = /var/mail/vmail/sieve-after sieve_before = /var/mail/vmail/sieve-before sieve_dir = ~/sieve } protocols = " imap" ssl = required ssl_cert = </etc/letsencrypt/live/nantes-m1.p27.eu/fullchain.pem ssl_client_ca_dir = /etc/ssl/certs ssl_dh = # hidden, use -P to show it ssl_key = # hidden, use -P to show it userdb { args = uid=4000 gid=4000 home=/var/mail/vmail/%d/%n driver = static } protocol lda { deliver_log_format = msgid=%m: %$ mail_plugins = sieve postmaster_address = postmaster@{{ primary_domain }} quota_full_tempfail = yes rejection_reason = Your message to <%t> was automatically rejected:%n%r } protocol imap { imap_client_workarounds = delay-newmail tb-extra-mailbox-sep tb-lsub-flags mail_max_userip_connections = 20 } [T] jeff@nantes-m1:log $ [T] jeff@nantes-m1:log $ postconf -n | grep -i sasl broken_sasl_auth_clients = yes smtpd_recipient_restrictions = reject_unknown_client_hostname,reject_unknown_sender_domain,reject_unknown_recipient_domain,permit_mynetworks,permit_sasl_authenticated,reject_unauth_destination,reject_invalid_hostname,reject_non_fqdn_sender smtpd_relay_restrictions = permit_mynetworks permit_sasl_authenticated defer_unauth_destination smtpd_sasl_auth_enable = yes smtpd_sasl_authenticated_header = yes smtpd_sasl_local_domain = smtpd_sasl_path = private/auth smtpd_sasl_security_options = noanonymous smtpd_sasl_type = dovecot [T] jeff@nantes-m1:log $ postconf -Mf smtp inet n - y - - smtpd submission inet n - y - - smtpd -o syslog_name=postfix/submission -o smtpd_tls_security_level=encrypt -o smtpd_sasl_auth_enable=yes -o smtpd_client_restrictions= -o smtpd_helo_restrictions= -o smtpd_sender_restrictions= -o smtpd_recipient_restrictions= -o smtpd_relay_restrictions=permit_sasl_authenticated,reject -o milter_macro_daemon_name=ORIGINATING smtps inet n - y - - smtpd -o syslog_name=postfix/smtps -o smtpd_tls_wrappermode=yes -o smtpd_sasl_auth_enable=yes -o smtpd_reject_unlisted_recipient=no -o smtpd_client_restrictions= -o smtpd_helo_restrictions= -o smtpd_sender_restrictions= -o smtpd_recipient_restrictions= -o smtpd_relay_restrictions=permit_sasl_authenticated,reject -o milter_macro_daemon_name=ORIGINATING ... Many thanks for any pointers. I'm also a bit confused on how to test it, really, short of connecting with a regular email client (mutt, thunderbird, etc.). If there are more appropriate tools that I've missed, I'm quite open to pointers. -- Jeff Abrahamson +33 6 24 40 01 57 +44 7920 594 255 http://p27.eu/jeff/ http://transport-nantes.com/

2 2

New dovecot server, authentication confusion
by Jeff Abrahamson 24 Jan '21

24 Jan '21

I've set up a new dovecot+postfix instance with virtual (not system) users. I've a few questions, mostly about auth. I /think/ that postfix handles auth by asking dovecot. Users need to provide user + password to send (smtps) and receive (imaps). I see where I've configured this for dovecot, which is /etc/dovecot/passwd.db. That file contains lines like this: jeff@mobilitains.fr:{BLF-CRYPT}$2y$05$c... What concerns me is that I see occasional log items like this: Jan 24 11:26:33 nantes-m1 postfix/smtpd[4597]: fatal: no SASL authentication mechanisms (Also, I can't connect with thunderbird.) But I think I've configured SASL auth, so I'm not sure what to look at / how to debug this. I'm looking for suggestions how to approach this. I do not see how postfix knows who is allowed to connect, however. Am I correct that postfix delegates SASL to dovecot? This is the relevant config, I think: [T] jeff@nantes-m1:log $ doveconf -n # 2.3.7.2 (3c910f64b): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.7.2 () # OS: Linux 5.4.0-64-generic x86_64 Ubuntu 20.04.1 LTS # Hostname: nantes-m1.p27.eu auth_verbose = yes mail_location = mbox:~/mail:INBOX=/var/mail/%u mail_privileged_group = mail namespace inbox { inbox = yes location = mailbox Archive { auto = subscribe special_use = \Archive } mailbox Drafts { auto = subscribe special_use = \Drafts } mailbox Junk { auto = subscribe special_use = \Junk } mailbox Sent { auto = subscribe special_use = \Sent } mailbox Trash { auto = subscribe special_use = \Trash } prefix = } passdb { args = username_format=%u scheme=blf-crypt /etc/dovecot/passwd.db driver = passwd-file } plugin { sieve = file:~/sieve;active=~/.dovecot.sieve sieve_after = /var/mail/vmail/sieve-after sieve_before = /var/mail/vmail/sieve-before sieve_dir = ~/sieve } protocols = " imap" ssl = required ssl_cert = </etc/letsencrypt/live/nantes-m1.p27.eu/fullchain.pem ssl_client_ca_dir = /etc/ssl/certs ssl_dh = # hidden, use -P to show it ssl_key = # hidden, use -P to show it userdb { args = uid=4000 gid=4000 home=/var/mail/vmail/%d/%n driver = static } protocol lda { deliver_log_format = msgid=%m: %$ mail_plugins = sieve postmaster_address = postmaster@{{ primary_domain }} quota_full_tempfail = yes rejection_reason = Your message to <%t> was automatically rejected:%n%r } protocol imap { imap_client_workarounds = delay-newmail tb-extra-mailbox-sep tb-lsub-flags mail_max_userip_connections = 20 } [T] jeff@nantes-m1:log $ [T] jeff@nantes-m1:log $ postconf -n | grep -i sasl broken_sasl_auth_clients = yes smtpd_recipient_restrictions = reject_unknown_client_hostname,reject_unknown_sender_domain,reject_unknown_recipient_domain,permit_mynetworks,permit_sasl_authenticated,reject_unauth_destination,reject_invalid_hostname,reject_non_fqdn_sender smtpd_relay_restrictions = permit_mynetworks permit_sasl_authenticated defer_unauth_destination smtpd_sasl_auth_enable = yes smtpd_sasl_authenticated_header = yes smtpd_sasl_local_domain = smtpd_sasl_path = private/auth smtpd_sasl_security_options = noanonymous smtpd_sasl_type = dovecot [T] jeff@nantes-m1:log $ postconf -Mf smtp inet n - y - - smtpd submission inet n - y - - smtpd -o syslog_name=postfix/submission -o smtpd_tls_security_level=encrypt -o smtpd_sasl_auth_enable=yes -o smtpd_client_restrictions= -o smtpd_helo_restrictions= -o smtpd_sender_restrictions= -o smtpd_recipient_restrictions= -o smtpd_relay_restrictions=permit_sasl_authenticated,reject -o milter_macro_daemon_name=ORIGINATING smtps inet n - y - - smtpd -o syslog_name=postfix/smtps -o smtpd_tls_wrappermode=yes -o smtpd_sasl_auth_enable=yes -o smtpd_reject_unlisted_recipient=no -o smtpd_client_restrictions= -o smtpd_helo_restrictions= -o smtpd_sender_restrictions= -o smtpd_recipient_restrictions= -o smtpd_relay_restrictions=permit_sasl_authenticated,reject -o milter_macro_daemon_name=ORIGINATING ... Many thanks for any pointers. I'm also a bit confused on how to test it, really, short of connecting with a regular email client (mutt, thunderbird, etc.). If there are more appropriate tools that I've missed, I'm quite open to pointers. -- Jeff Abrahamson +33 6 24 40 01 57 +44 7920 594 255 http://p27.eu/jeff/ http://transport-nantes.com/

1 0

Massive /tmp files
by MRob 22 Jan '21

22 Jan '21

Hello, I just found user who has single folder (standard maildir format) that filled with over 8mil files and 800GB in the /tmp subdirectory of that folder: /email/domain/username/.Folder/tmp The files in there are normal maildir email files. I think the dir ran out of inode space so its not ongoing problem. My question is only can I purge that folder without breaking something more? If it tries to re-fill again I will try to debug Thankyou!!

5 8

[BUG REPORT] In some cases dovecot sends (huge) binary data to solr for indexing
by Alexey Panov 21 Jan '21

21 Jan '21

In some cases (exact condition still unknown) dovecot sends binary data (attachments) to SOLR for indexing. This reduces index and overall FTS efficiency dramatically. In extreme condition (below an example of 20MB) dovecot’s hardwired timeout of 60s gets triggered during HTTP exchange with SOLR on just a single file. This results in an unfinished index which, by initial indexing, gets restarted over and over. With multiple affected mailboxes even on moderate usage this can cause an IO overload of the whole system. Message example (doveadm fetch text): https://filebin.ca/5oy5Wc1QrBK3/fetch-text.obfuscated.txt <https://filebin.ca/5oy5Wc1QrBK3/fetch-text.obfuscated.txt> Corresponding raw log data: https://filebin.ca/5oy6yqLSCr3H/rawlog.obfuscated.txt <https://filebin.ca/5oy6yqLSCr3H/rawlog.obfuscated.txt> (Both files were processed with perl doveadm-obfuscate.pl <https://www.dovecot.org/tools/doveadm-obfuscate.pl>; the script doesn’t replace non-latin characters so they were replaced with ‘R’ manually) Workaround: there is a useful patch by John Fawcett <https://www.mail-archive.com/dovecot@dovecot.org/msg82296.html> that allows to set the FTS indexing message body maximum size. It works perfectly, but affected messages are getting completely ignored by FTS. This bug report is a summarised result of this discussion <https://www.mail-archive.com/dovecot@dovecot.org/msg82599.html>.

2 1

Deliver to different namespace with address detail
by Tobia Grosselle [ Terralink ] 21 Jan '21

21 Jan '21

Hello, with this settings: Dovecot 2.3.7.2 (3c910f64b) namespace { list = yes type = private inbox = yes prefix = INBOX/ separator = / } namespace Archive { list = yes type = private inbox = no prefix = Archive/ separator = / mailbox Incoming { auto = create } } lmtp_save_to_detail_mailbox = yes recipient_delimiter = + userdb_query = SELECT accounts.username AS user, accounts.home AS home, CONCAT('mdbox:', accounts.home, '/mdbox') AS mail, CONCAT('mdbox:', accounts.home, '/archive') AS 'namespace/Archive/location', 'vmail' AS uid, 'vmail' as gid FROM accounts WHERE accounts.username = '%u' it is possible to deliver an email to Archive namespace instead of inbox with address detail (email+Archive/Incoming@domain)? If i try i see that the lmtp service search the path from the inbox namespace (so INBOX/Archive/Incoming). Thanks

2 2

Sieve fileinto :create is failing
by Ron Garret 21 Jan '21

21 Jan '21

I’m trying to get a sieve script to move messages into a folder, and to create that folder if it doesn’t already exist. I’m following the example code at: https://doc.dovecot.org/configuration_manual/sieve/examples/ and doing this: > require ["fileinto", "mailbox”]; > … > fileinto :create “myfolder”; > … That results in this error in the log file: error: unknown tagged argument ':create' for the fileinto command What am I doing wrong? rg

4 8