- dovecot - dovecot.org

Dovecot Proxy with mysql passdb and oauth2 authentication: upgrade from 2.3.21 to 2.4.3 does not work
by Urban Loesch 07 Apr '26

07 Apr '26

Hi, I am running a Dovecot IMAP/POP3 proxy in my test environment using the latest version, 2.3.21, installed from the Dovecot repository. It functions as a pure IMAP/POP3 proxy for 7 different IMAP backends (currently always Dovecot 2.3.21). The proxy retrieves all its information from a MySQL database mainly the ip-address to which backend he should pass the connection and forwards all authentication information to the backend. This has always worked without any issues so far. Now I'm trying to upgrade the proxy from 2.3.21 to 2.4.3. I tried to convert my 2.3.21 configuration to 2.4.3 with your very helpfull tool from https://dovecot.org/upgrader/. But now when I try to start dovecot I get the followong error in my logs: ... 2026-04-07T12:00:57.692994+02:00 imap-dev dovecot: auth: Debug: Loading modules from directory: /usr/lib/dovecot/modules/auth 2026-04-07T12:00:57.695908+02:00 imap-dev dovecot: auth: Debug: Module loaded: /usr/lib/dovecot/modules/auth/libdriver_mysql.so 2026-04-07T12:00:57.696532+02:00 imap-dev dovecot: auth: Fatal: Cannot initialize oauth2: Missing oauth2_introspection_mode setting 2026-04-07T12:00:57.697569+02:00 imap-dev dovecot: master: Error: service(auth): command startup failed, throttling for 4.000 secs ... As I just said, the server only works as a proxy (no mailboxes hosted on itself, etc). Have you any idea how I can solve this issues? Below my current .deb packages installed and "doveconf -n" from 2.4.3. Many thanks in advance Urban ----------------------- # dpkg -l |grep dovecot ii dovecot-core 2:2.4.3-1+debian12 amd64 secure POP3/IMAP server - core files ii dovecot-imapd 2:2.4.3-1+debian12 amd64 secure POP3/IMAP server - IMAP daemon ii dovecot-ldap 2:2.4.3-1+debian12 amd64 secure POP3/IMAP server - LDAP support ii dovecot-lmtpd 2:2.4.3-1+debian12 amd64 secure POP3/IMAP server - LMTP server ii dovecot-managesieved 2:2.4.3-1+debian12 amd64 secure POP3/IMAP server - ManageSieve server ii dovecot-mysql 2:2.4.3-1+debian12 amd64 secure POP3/IMAP server - MySQL support ii dovecot-pop3d 2:2.4.3-1+debian12 amd64 secure POP3/IMAP server - POP3 daemon ii dovecot-sieve 2:2.4.3-1+debian12 amd64 secure POP3/IMAP server - Sieve filters support ------------------------ # 2.4.3-1+debian12 (c1b22ef978): /etc/dovecot/dovecot.conf # Pigeonhole version 2.4.3-1+debian12 (99939e07) # OS: Linux 6.1.0-31-amd64 x86_64 Debian 12.13 # Hostname: imap-dev.domain.com dovecot_config_version = 2.4.3 auth_cache_negative_ttl = 0 auth_cache_size = 128 M auth_cache_ttl = 0 auth_debug = yes auth_debug_passwords = yes auth_failure_delay = 5 secs auth_mechanisms = plain login oauthbearer xoauth2 auth_username_chars = abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ01234567890.-_%@ auth_username_translation = %@ dovecot_storage_version = 2.4.0 login_log_format_elements = user=<%{user}> method=%{mechanism} rip=%{remote_ip} lip=%{local_ip} mpid=%{mail_pid} %{secured} %{ssl_security} managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext protocols = imap sieve sql_driver = mysql ssl_min_protocol = TLSv1 verbose_proctitle = yes namespace inbox { inbox = yes mailbox Drafts { special_use = "\\Drafts" } mailbox Junk { special_use = "\\Junk" } mailbox Sent { special_use = "\\Sent" } mailbox "Sent Messages" { special_use = "\\Sent" } mailbox Trash { special_use = "\\Trash" } } passdb sql { default_password_scheme = PLAIN query = SELECT NULL AS password, 'y' AS nodb, SUBSTRING_INDEX(SUBSTRING_INDEX(param, '[', -1), ']', 1) AS host, '%{user}' AS destuser, 'Y' AS nologin, 'Y' AS nopassword, 'Y' AS proxy, '%{mechanism}' AS proxy_mech FROM mail_username WHERE user = '%{user}' AND allow_login = 'y' AND ('%{protocol}' = 'imap' OR '%{protocol}' = 'sieve'); } mysql devdb1.domain.com { dbname = mailconfig_dev password = # hidden, use -P to show it user = imap-dev } sieve_script personal { driver = file path = ~/sieve } service imap-login { process_min_avail = 2 restart_request_count = unlimited vsz_limit = 512 M } service managesieve-login { inet_listener sieve { port = 4190 } } service pop3-login { process_min_avail = 2 restart_request_count = unlimited vsz_limit = 256 M } service tcpwrap { unix_listener login/tcpwrap { group = $SET:default_login_user mode = 0600 user = $SET:default_login_user } } ssl_server { cert_file = /etc/letsencrypt/live/domain.com/fullchain.pem dh_file = /etc/dovecot/dh.pem key_file = /etc/letsencrypt/live/domain.com/privkey.pem prefer_ciphers = server } protocol imap { imap_capability = IMAP4rev1 LITERAL+ SASL-IR LOGIN-REFERRALS ID ENABLE IDLE login_greeting = Domain-Dev IMAP Server ready. } protocol pop3 { login_greeting = Domain-Dev POP3 Server ready. pop3_enable_last = yes pop3_uidl_format = %{uid | substr(0, 8)}%{uidvalidity | substr(0, 8)} }

1 0

Regression/Bug report: crypt_private_key_file (for crypt_global_private_key) no longer supports inline base64 (from userdb) in dev branch
by Ömer Güven 07 Apr '26

07 Apr '26

Hi, I’ve run into what appears to be a regression (or at least a behavioral change) in Dovecot 3.3.0+ / current HEAD regarding crypt_private_key_file handling for the crypt_global_private_key. I don‘t use per-folder user keys but a global encryption key per user. Previously, it was possible to provide the private key via userdb using an inline base64:-encoded PEM directly to the crypt_global_private_key_file and Dovecot would correctly parse and use it. With the latest config scheme change, this no longer works, as you cannot really set named config variables from userdb. I did workaround by setting a custom userdb variable and setting the needed named/filter variables manually in the config file. To make it work, I had to enclose the config in a „protocol imap“ scope. The crypt_global_public_key_file is accessible from userdb (as it is not within a named filter scope), so inline-base64 works as with Dovecot 2.3+. When using the following workaround to reach the scoped variables, Dovecot tries to load the file „inline:BASE64ENCODEDPEM“ as a literal filename (error open(inline:AB….C==) failed): protocol imap { crypt_global_private_key user { crypt_private_key_file = %{userdb:private_key_file} crypt_private_key_password = %{userdb:private_key_password} } } As a workaround, I now have to: • store the private key as a file (e.g. %{home}/privkey.pem) • pass only the password via userdb • inject the path indirectly via static config + userdb variables This works, but is less elegant: protocol imap { crypt_global_private_key user { crypt_private_key_file = %{home}/privkey.pem crypt_private_key_password = %{userdb:private_key_password} } } Again, with the new named filter mechanism, it’s no longer possible to directly inject such config values via userdb, which makes fully dynamic per-user key provisioning harder. I now have to export all encrypted private keys from the database to the users home directory. Ömer Hi, I've run into what appears to be a regression (or at least a behavioral change) in Dovecot 3.3.0+ / current HEAD regarding crypt_private_key_file handling for the crypt_global_private_key. I don`t use per-folder user keys but a global encryption key per user. Previously, it was possible to provide the private key via userdb using an inline base64:-encoded PEM directly to the crypt_global_private_key_file and Dovecot would correctly parse and use it. With the latest config scheme change, this no longer works, as you cannot really set named config variables from userdb. I did workaround by setting a custom userdb variable and setting the needed named/filter variables manually in the config file. To make it work, I had to enclose the config in a "protocol imap" scope. The crypt_global_public_key_file is accessible from userdb (as it is not within a named filter scope), so inline-base64 works as with Dovecot 2.3+. When using the following workaround to reach the scoped variables, Dovecot tries to load the file "inline:BASE64ENCODEDPEM" as a literal filename (error open(inline:AB....C==) failed): protocol imap { crypt_global_private_key user { crypt_private_key_file = %{userdb:private_key_file} crypt_private_key_password = %{userdb:private_key_password} } } As a workaround, I now have to: o store the private key as a file (e.g. %{home}/privkey.pem) o pass only the password via userdb o inject the path indirectly via static config + userdb variables This works, but is less elegant: protocol imap { crypt_global_private_key user { crypt_private_key_file = %{home}/privkey.pem crypt_private_key_password = %{userdb:private_key_password} } } Again, with the new named filter mechanism, it's no longer possible to directly inject such config values via userdb, which makes fully dynamic per-user key provisioning harder. I now have to export all encrypted private keys from the database to the users home directory. Oemer

3 7

Dovecot and Pigeonhole v2.4.3 released
by Aki Tuomi 07 Apr '26

07 Apr '26

Hi! We are happy to publish version 2.4.3 of Dovecot and Pigeonhole. These contain several CVEs, discovered by external researches. The majority of these have been discovered with help of automated code analysis tools like claude code security, which is why some of these are rather old, missed bugs. No new supported distros have been added or old removed, no new dependencies have been added. Note that there are experimental features in 2.4, one is enabled with `--enable-experimental-mail-utf8`, and another with `--enable-experimental-imap4rev2`, and you also need to set mail_utf8_extensions=yes and imap4rev2_enabled=yes to enable them in config. https://dovecot.org/releases/2.4/dovecot-2.4.3.tar.gz https://dovecot.org/releases/2.4/dovecot-2.4.3.tar.gz.sig https://pigeonhole.dovecot.org/releases/2.4/dovecot-pigeonhole-2.4.3.tar.gz https://pigeonhole.dovecot.org/releases/2.4/dovecot-pigeonhole-2.4.3.tar.gz… Binary packages in https://repo.dovecot.org/ Docker images in https://hub.docker.com/r/dovecot/dovecot --- * CVE-2025-59028: Invalid base64 authentication can cause DoS for other logins. * CVE-2025-59031: decode2text.sh OOXML extraction may follow symlinks and read unintended files during indexing. Fixed by dropping the script. * CVE-2026-24031: SQL injection possible if auth_username_chars is configured empty. Fixed escaping to always happen. v2.4 regression. * CVE-2026-27859: Excessive RFC 2231 MIME parameters in email would cause excessive CPU usage. Fixed by limiting number of parameters to process. * CVE-2026-27860: LDAP query injection possible if auth_username_chars is configured empty. Fixed escaping to always happen. v2.4 regression. * CVE-2026-27857: Sending excessive parenthesis causes imap-login to use excessive memory. * CVE-2026-27856: Doveadm credentials were not checked using timing-safe checking function. * CVE-2026-27855: OTP driver vulnerable to replay attack. * Remove default service/*/service_extra_groups=$SET:default_internal_group. They are now replaced by default mail_access_groups=$SET:default_internal_group. * The version file has been renamed as version.txt to avoid clash with C++ headers. * auth: oauth2 - Do not export token automatically, must be exported using fields. * config: Don't accept 0 as meaning unlimited anymore for last_valid_uid, last_valid_gid, mail_cache_max_headers_count, mail_cache_max_header_name_length, mail_vsize_bg_after_count, mail_sort_max_read_count, message_max_size, submission_max_recipients and quota_mail_size. * imap, pop3: Don't autoexpunge if Dovecot is shutting down or process is killed. * imap: LIST - Handle invalid mUTF-7 mailbox names as never matching anything * lazy-expunge: Change lazy_expunge_only_last_instance default to yes. * lda: Use EX_TEMPFAIL (75) if configuration is invalid instead of 89. v2.4 regression. * lib-master: Increase ANVIL_DEFAULT_LOOKUP_TIMEOUT_MSECS from 5s to 30s * lib: crc32 - Use zlib's built-in CRC32 function + Improve UTF-8 support for mail storage. + auth: Add default auth-token UNIX socket for token-based authentication. + doc: solr-config-9.xml - Make it compatible with Solr 9.8.0 + doveadm: dsync - Search mails when exporting to reduce number of mails exported by dsync-server. + dovecot-sysreport: Add -D|--destdir support. + imap, imap-hibernate: Use DOVECOT-TOKEN authentication for unhibernation. Default imap-master socket permissioms have been changed due to this. + imap: Add APPENDLIMIT capability when configured with quota_mail_size. + imap: Support STATUS (DELETED) for IMAP4rev2. + imapc: Add support for SEARCH MIMEPART + imapc: Improve error forwarding. + imapc: Support SORT and ESORT extensions. + imapc: Support STATUS (DELETED) for IMAP4rev2. + lib-sql: Support parameterized queries. + lib-test: Add new test-dir API for better temporary test directory handling. + lmtp: Advertize SIZE capability when configured with quota_mail_size. + lmtp: Support XCLIENT DESTADDR and DESTPORT + pop3-login: proxy - Add support for XCLIENT DESTIP and DESTPORT + submission-login: proxy - Add support for XCLIENT DESTIP and DESTPORT + Various optimizations have been made to the code. - Fix building dovecot with BSD, Solaris and macOS. - auth: Crash would occur if users were iterated but userdb_ldap_iterate_fields was not set. - auth: Fix request leak when client authenticates with unsupported mechanism. - auth: Some passdbs would default to PLAIN instead of CRYPT scheme. - config: Section and setting names could have been intermixed, resulting in the setting being silently ignored. - configure: Fix checking if BUILD_IMAP_HIBERNATE is set - doveadm: dsync - -e parameter was handled wrong with dsync-server. - fts-flatcurve: Mailbox leak would occur if mailbox failed to open. - imap: Fix potential issues with unhibernation and process state handling. - imapc: SEARCH failure handling was done wrong. - imapc: UID STORE commands included extra comma in uidset. - lib-auth-client: auth-master - Fix panic when reconnecting after handshake timeout. - lib-compression: Lz4 algorithm would assert-crash with malicious data. - lib-dcrypt: Fix digest algorithm handling. - lib-dict: Escape username paths to prevent traversal issues with dict-fs. - lib-http: Fix HTTP parsing edge cases and state handling. - lib-iostream: Disallow empty ssl_min_protocol. - lib-json: Fix incorrect character handling logic. - lib-ldap: Fix various TLS related bugs. - lib-mail: Fix charset translation and MIME parsing edge cases. - lib-mail: Fix multiple bounds checks and parsing issues in message handling. - lib-var-expand: Multiple fixes and improvements for expansion handling. - lib: Fix punycode decoding out-of-bounds reads. - lib: Fix unicode normalization edge cases causing crashes. - lib-http: Chunked transfer trailer size was not limited. - login-common: Improve logging and internal error handling. - login-common: login_log_format_elements was split by spaces naively, which could break variable expansion. Use template aware splitting now. - master: Dovecot would fail to start if listen directive was used and dovenull or dovecot user was missing. - pop3c: Connection might've hung with SSL. - util: Fix handling of environment variables containing control characters. - Many other bugs have been fixed. --- * CVE-2026-27858: managesieve-login can allocate large amount of memory during authentication. * CVE-2025-59032: ManageSieve panic occurs with sieve-connect as a client. * lib-sieve: Don't accept 0 as meaning unlimited anymore for sieve_quota_script_count and sieve_quota_storage_size. * managesieve-login: If mail_max_userip_connections is reached, return LIMIT/CONNECTIONS resp-code. * managesieve-login: proxy - Return unexpected backend failures as TRYLATER/NORETRY resp-code. * managesieve: Remove default service_extra_groups=$SET:default_internal_group. + managesieve-login: proxy - Add support for XCLIENT DESTIP and DESTPORT. - imapsieve: Fix panic occurring upon implicit flag changes. - lib-sieve: include-extension - Fix crash occurring when previous global command has no arguments. - lib-sieve: Fix erroneous attempt to read active script for non-personal storage. - lib-sieve: ldap: Fix linking non-shared LIBDOVECOT.

8 11

Bug report: filter `default` in LDAP context does not suppress error logging
by Johannes Nohl 07 Apr '26

07 Apr '26

Bug report: Expanding variables with filter `default` in LDAP context does not suppress error logging if LDAP attribute is missing. Expected behaviour: Missing LDAP attribute does not throw an error. Example `nologin = %{ldap:missingAttribute | default}` Details: Please note: The missing attribute is called `shadowInactive` in reality. There might be another issue, the field nologin is boolean and set true if any value is assigned -- while default without parameter returns empty (thus, you cannot use default with nologin without workaround). The intended behaviour is documented clearly, however due to a bug in rendering you need to look into the doc sources (my PR for that was accepted already: https://doc.dovecot.org/2.4.2/core/config/auth/databases/ldap.html#ldap-spe… https://github.com/dovecot/documentation/pull/1478#pullrequestreview-403461… Full context: passdb ldap { driver = ldap ldap_filter = (&(objectClass=posixAccount)(mail=%{user})) fields { user = %{ldap:uid} nologin = %{ldap:shadowInactive | default} reason = The account for this email address is disabled. } } The same error was reported already a year ago, although among others, see point 4: https://dovecot.org/mailman3/archives/list/dovecot@dovecot.org/thread/TLJ2O… Please excuse my first attempt of 31-03-2026. It was unreadable. Aki already tried to help but was - I guess - distracted from the main point. I found a workaround for the missing attribute translation to boolean fields (if someone is interested) https://dovecot.org/mailman3/archives/list/dovecot@dovecot.org/thread/67Z4C… I tested with dovecot 2.4.2 and 2.4.3 (openSUSE repos) against local LDAP. The check for disabled users throws permanently errors in the log file, whenever the user is missing the ldap attribute for disabled. Thus, for each login of all enabled users (you will probably agree that this not acceptable). This results in the following log line: 2026-03-31T00:46:31.102690+02:00 mailserver dovecot: auth(test,ipv4,sasl:plain)<YE81n0VOVuofEeSD>: Error: ldap: auth_passdb_post settings: Failed to parse configuration: Failed to expand passdb_fields/nologin setting variables: ldap: No such attribute 'shadowinactive' Thank you Johannes -- Johannes Nohl postmaster(a)i-t-cloud.de

2 3

[Dovecot] migration from IMAP/POP3 courier server to a remote dovecot server
by nik600 06 Apr '26

06 Apr '26

Dear all i'm planning a transparent migration from a courier server that provides both IMAP and POP3 access to users to a remote dovecot server with both IMAP and POP3 access. I have to migrate about 2500 users for 250 GB of space. I'm using dovecot 2.2.5.4 on debian6 squeeze. To make a transparent migration i have to maintain old IMAP UIDs and POP3 UIDs, so i've read http://wiki2.dovecot.org/Migration and http://wiki2.dovecot.org/Migration/Courier and http://wiki2.dovecot.org/Migration/Dsync And decided that probably the best tool to use is Dsync, as the courier-dovecot-migrate.pl<http://www.dovecot.org/tools/courier-dovecot-migrate.pl> script works only locally. I've tested the dsync following instructions reported above but after the migration of one test-account the client re-download messages. If i want to keep both IMAP UIDs and POP3 UIDs i have to sync both imapc and pop3c with two commands? doveadm -o imapc_user=foo -o pop3c_user=foo -o imapc_password=bar -o pop3c_password=bar backup -R -u user@domain imapc: doveadm -o imapc_user=foo -o pop3c_user=foo -o imapc_password=bar -o pop3c_password=bar backup -R -u user@domain pop3c: Or imapc is enough? Do you have any suggestion? Thanks -- /*************/ nik600 http://www.kumbe.it

2 3

oath-toolkit pam authentication with dovecot
by "Tóth Attila" 04 Apr '26

04 Apr '26

Anybody has experience in deploying oath-toolkit totp authentication for dovecot? It works for ssh in a challenge response fashion, but I have concernes against concatenating the password with the totp digits, because I have difficulties even with su+oath_toolkit... Thx: Dw. -- dr Tóth Attila, Radiológus, 06-20-825-8057 Attila Toth MD, Radiologist, +36-20-825-8057

2 1

enabling fts_flatcurve on debian
by Stefan G. Weichinger 03 Apr '26

03 Apr '26

Which xapian-related packages do I need? I have issues enabling the plugin ... pls advise

2 6

2.4 upgrade : INBOX does not exist
by Stefan G. Weichinger 02 Apr '26

02 Apr '26

Today I upgraded a server at a customer. I modified the config I had built over the last week, with the help of this list. So far nearly everything works, but thunderbird complains about non-existing mailboxes like INBOX. But we can access it, it's a bit strange. In the filesystem it looks like: # ls -la /home/vmail/our.tld/user\(a)our.tld/ insgesamt 7096 drwx------ 69 vmail vmail 4096 2. Apr 19:00 . drwx------ 129 vmail vmail 12288 2. Apr 18:56 .. drwx------ 5 vmail vmail 4096 8. Jun 2021 .Administrator drwx------ 5 vmail vmail 4096 2. Apr 18:40 .Administrator.Archiv drwx------ 5 vmail vmail 4096 2. Apr 18:40 '.Administrator.Domainwechsel AquaCC' drwx------ 5 vmail vmail 4096 11. Mai 2025 .Archives drwx------ 5 vmail vmail 4096 2. Apr 18:40 .Archives.2001 drwx------ 5 vmail vmail 4096 2. Apr 18:40 .Archives.2002 drwx------ 5 vmail vmail 4096 2. Apr 18:40 .Archives.2003 drwx------ 5 vmail vmail 4096 12. Aug 2024 .Archives.2004 drwx------ 5 vmail vmail 4096 2. Apr 18:40 .Archives.2005 drwx------ 5 vmail vmail 4096 12. Aug 2024 .Archives.2006 drwx------ 5 vmail vmail 4096 12. Aug 2024 .Archives.2007 drwx------ 5 vmail vmail 4096 10. Feb 18:17 .Archives.2008 drwx------ 5 vmail vmail 4096 12. Aug 2024 .Archives.2009 drwx------ 5 vmail vmail 4096 12. Aug 2024 .Archives.2010 drwx------ 5 vmail vmail 4096 10. Feb 18:10 .Archives.2011 drwx------ 5 vmail vmail 4096 12. Aug 2024 .Archives.2012 drwx------ 5 vmail vmail 4096 12. Aug 2024 .Archives.2013 drwx------ 5 vmail vmail 4096 10. Feb 18:09 .Archives.2014 drwx------ 5 vmail vmail 4096 12. Aug 2024 .Archives.2015 drwx------ 5 vmail vmail 4096 2. Apr 17:51 .Archives.2016 drwx------ 5 vmail vmail 4096 11. Feb 11:57 .Archives.2017 drwx------ 5 vmail vmail 4096 10. Jun 2025 .Archives.2018 drwx------ 5 vmail vmail 4096 11. Feb 11:57 .Archives.2019 drwx------ 5 vmail vmail 4096 10. Feb 18:23 .Archives.2020 drwx------ 5 vmail vmail 4096 1. Apr 20:18 .Archives.2021 drwx------ 5 vmail vmail 4096 30. Mär 09:37 .Archives.2022 drwx------ 5 vmail vmail 4096 1. Apr 20:18 .Archives.2023 drwx------ 5 vmail vmail 4096 1. Apr 20:18 .Archives.2024 drwx------ 5 vmail vmail 4096 2. Apr 17:48 .Archives.2025 drwx------ 5 vmail vmail 4096 2. Apr 17:59 .Archives.2026 drwx------ 2 vmail vmail 323584 2. Apr 19:00 cur -rw------- 1 vmail vmail 0 2. Aug 2021 dovecot-acl-list -rw------- 1 vmail vmail 70712 2. Apr 18:37 dovecot.index -rw------- 1 vmail vmail 6266860 2. Apr 19:01 dovecot.index.cache -rw------- 1 vmail vmail 32160 2. Apr 19:00 dovecot.index.log -rw------- 1 vmail vmail 46940 2. Apr 06:20 dovecot.index.log.2 -rw------- 1 vmail vmail 91 18. Aug 2020 dovecot-keywords -rw------- 1 vmail vmail 65 2. Apr 18:37 .dovecot.lda-dupes drwx------ 5 vmail vmail 4096 2. Apr 18:37 .dovecot.lda-dupes.locks -rw------- 1 vmail vmail 6504 2. Apr 18:49 dovecot.list.index -rw------- 1 vmail vmail 3356 2. Apr 19:02 dovecot.list.index.log -rw------- 1 vmail vmail 2904 7. Jän 13:53 dovecot.mailbox.log -rw------- 1 vmail vmail 186894 2. Apr 18:59 dovecot-uidlist -rw------- 1 vmail vmail 8 7. Jän 13:53 dovecot-uidvalidity -r--r--r-- 1 vmail vmail 0 21. Apr 2020 dovecot-uidvalidity.5e9efc52 drwx------ 5 vmail vmail 4096 2. Apr 12:02 .Drafts drwx------ 5 vmail vmail 4096 12. Jun 2025 '.Entw&APw-rfe' drwx------ 5 vmail vmail 4096 6. Mai 2020 .Gesendet drwx------ 5 vmail vmail 4096 2. Apr 18:22 .INBOX.Administrator drwx------ 5 vmail vmail 4096 2. Apr 18:21 .INBOX.Alerts [..] We have mail_home = /home/vmail/%{user | domain}/%{user} I tried mail_home = /home/vmail/%{user | domain}/%{user | username} but that breaks things completely. In 2.3 we had these namespaces: namespace { type = private separator = / prefix = #location defaults to mail_location. inbox = yes } namespace { type = public separator = / prefix = Oeffentlich/ location = maildir:/home/vmail/oeffentlich subscriptions = yes } I tried "prefix = INBOX/" ... not good. I share the config, a little bit anonymized, acls removed ... # doveconf -n # 2.4.1-4 (7d8c0e5759): /etc/dovecot/dovecot.conf # Pigeonhole version 2.4.1-4 (0a86619f) # OS: Linux 6.12.74+deb13+1-amd64 x86_64 Debian 13.4 # Hostname: xxxx dovecot_config_version = 2.4.1 auth_allow_weak_schemes = yes auth_cache_size = 4M auth_debug = yes auth_mechanisms = plain login auth_verbose = yes default_process_limit = 300 dovecot_storage_version = 2.4.0 import_environment { CORE_ERROR = %{env:CORE_ERROR} CORE_OUTOFMEM = %{env:CORE_OUTOFMEM} LISTEN_FDS = %{env:LISTEN_FDS} LISTEN_PID = %{env:LISTEN_PID} MALLOC_MMAP_THRESHOLD_ = 131072 NOTIFY_SOCKET = %{env:NOTIFY_SOCKET} PATH = %{env:PATH} TZ = :/etc/localtime } info_log_path = /var/log/dovecot.info listen = * [::] log_path = /var/log/dovecot.log mail_debug = yes mail_driver = maildir mail_gid = 5000 mail_home = /home/vmail/%{user | domain}/%{user} mail_path = ~ mail_plugins { acl = yes notify = yes quota = no } mail_uid = 5000 protocols = imap sieve lmtp sieve_extensions { fileinto = yes reject = yes envelope = yes encoded-character = yes vacation = yes subaddress = yes comparator-i;ascii-numeric = yes relational = yes regex = yes imap4flags = yes copy = yes include = yes body = yes variables = yes enotify = yes environment = yes mailbox = yes date = yes index = yes ihave = yes duplicate = yes mime = yes foreverypart = yes extracttext = yes editheader = yes mboxmetadata = yes servermetadata = yes spamtest = yes spamtestplus = yes virustest = yes } sieve_global_extensions { vnd.dovecot.debug = yes vnd.dovecot.environment = yes vnd.dovecot.pipe = yes } sieve_pipe_bin_dir = /usr/lib/dovecot/sieve sieve_plugins = sieve_imapsieve sieve_extprograms sieve_spamtest_score_max_value = 15 sieve_spamtest_status_header = X-Spamd-Result: .*? \[([[:digit:]]+\.[[:digit:]]+) / [[:digit:]]+\.[[:digit:]]+\]; sql_driver = mysql ssl = required verbose_proctitle = yes mysql /var/run/mysqld/mysqld.sock { dbname = postfix_db password = # hidden, use -P to show it user = postfix_user } passdb sql { default_password_scheme = MD5-CRYPT query = SELECT username as user, password FROM mailbox WHERE ((username = '%{user | username}(a)domain1.at') OR (username = '%{user | username}(a)domain2.at')) AND active = '1' } userdb sql { iterate_query = SELECT userid AS username, domain FROM users query = SELECT username as user FROM mailbox WHERE ((username = '%{user | username}(a)domain1.at') OR (username = '%{user | username}(a)domain2.at') ) AND active = '1' } namespace inbox { inbox = yes prefix = separator = / type = private } namespace oeffentlich { mail_path = /home/vmail/oeffentlich prefix = Oeffentlich/ separator = / subscriptions = yes type = public mailbox Oeffentlich { acl [DELETED for now] } service imap-login { process_min_avail = 8 inet_listener imap { port = 0 ssl = no listen = } inet_listener imaps { port = 993 ssl = yes listen = } } service lmtp { extra_groups = $SET:default_internal_group user = vmail unix_listener /var/spool/postfix/private/dovecot-lmtp { group = postfix mode = 0660 user = postfix } } service imap { } service auth { client_limit = 1200 user = root unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0666 user = postfix } unix_listener auth-client { group = postfix mode = 0660 user = postfix } unix_listener auth-userdb { mode = 0660 } } service auth-worker { } service dict { unix_listener dict { } } ssl_server { cert_file = /etc/letsencrypt/pfsense/cloud_imap_mail_smtp_LE_cert.fullchain key_file = /etc/letsencrypt/pfsense/cloud_imap_mail_smtp_LE_cert.key } protocol lda { mail_plugins = sieve } protocol imap { imap_idle_notify_interval = 29 mins mail_max_userip_connections = 50 mail_plugins { imap_acl = yes imap_quota = no imap_sieve = yes } } protocol lmtp { mail_plugins = sieve postmaster_address = logs(a)xunil.at } service managesieve-login { inet_listener sieve { port = 4190 } } service managesieve { } protocol sieve { managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date ihave } sieve_script personal { active_path = /home/vmail/%{user | domain}/%{user}/sieve/scripts/.dovecot.sieve driver = file path = /home/vmail/%{user | domain}/%{user}/sieve/scripts } sieve_script before-0 { driver = file path = /usr/lib/dovecot/sieve/global-spam.sieve type = before } service anvil { unix_listener anvil { group = $SET:default_internal_group mode = 0660 } } I assume I am not far from full success, I'd just like to get rid of these errors because tomorrow dozens of users will access their mailboxes ... Thanks for any pointers!

1 1

BUG-Report: mysql: SSL support not compiled in (remove ssl_client_ca_file and ssl_client_ca_dir settings) third attempt!
by Klaus Tachtler 02 Apr '26

02 Apr '26

Hello everyone, Problem info: ============ An error occurs, while trying to establish a TLS/SSL secured connection to a database (mariadb), which has the ability to accept TLS/SSL connections. Analysis from Archlinux Gitlab Issue, which could be found under following link by - Toolybird: https://gitlab.archlinux.org/archlinux/packaging/packages/dovecot/-/issues/… > Thanks for reporting. It would appear to be some kind of (upstream?) > bug in the autofoo. The error message can be traced back to > HAVE_MYSQL_SSL being undefined when it should be defined. This is > reflected in log: https://reproducible.archlinux.org/api/v0/builds/946041/log > It took quite some debugging, but adding the following hack before the > autoreconf call appears to make it work: > checking for mysql_ssl_set in -llibmariadb... no > sed -i 's/mysql_driver="libmariadb"/mysql_driver="mariadb"/' m4/ > want_mysql.m4 > After that it now shows: > checking for mysql_ssl_set in -lmariadb... yes Steps to reproduce: ================== 1. Configure dovecot 2.4.2-4 as described below 2. Restart dovecot 2.4.2-4 3. Try send an email (echo "Test-E-Mail" | /usr/sbin/sendmail root) 4. Determine error messages inside dovecot 2.4.2-4-Log > 01 Dec 22 04:57:38 server dovecot[842]: auth: Error: > mysql(db.idmz.tachtler.net): mysql: SSL support not compiled in > (remove ssl_client_ca_file and ssl_client_ca_dir settings) > 02 Dec 22 04:57:38 server dovecot[842]: auth-worker: Error: > mysql(db.idmz.tachtler.net): mysql: SSL support not compiled in > (remove ssl_client_ca_file and ssl_client_ca_dir settings) Additional info: =============== OS version: Archlinux package version(s): dovecot 2.4.2-4 necessary config file part: > 45 sql_driver = mysql > 46 > 47 mysql db.idmz.tachtler.net { > 48 host = db.idmz.tachtler.net > 49 port = 3306 > 50 user = postfixuser > 51 password = secret > 52 dbname = postfix > 53 ssl = yes > 54 ssl_client_ca_file = /etc/dovecot/ssl/certs/CAcert.pem > 55 ssl_client_cert_file = > /etc/dovecot/ssl/certs/client.idmz.tachtler.net.pem > 56 ssl_client_key_file = > /etc/dovecot/ssl/private/client.idmz.tachtler.net.key.pem > 57 ssl_cipher_list = DHE-RSA-AES256-SHA > 58 } WITHOUT the following line, a database connections is possible and works as expected: > 53 ssl = yes > 54 ssl_client_ca_file = /etc/dovecot/ssl/certs/CAcert.pem > 55 ssl_client_cert_file = > /etc/dovecot/ssl/certs/client.idmz.tachtler.net.pem > 56 ssl_client_key_file = > /etc/dovecot/ssl/private/client.idmz.tachtler.net.key.pem > 57 ssl_cipher_list = DHE-RSA-AES256-SHA Thanky you in advance for your help! Klaus Tachtler. -- --------------------------------------- e-Mail : klaus(a)tachtler.net Homepage: https://www.tachtler.net DokuWiki: https://dokuwiki.tachtler.net ---------------------------------------

3 17

Error: sieve: fail2ban: line 23: read(<lmtp DATA local>) failed: Seeking past EOF by 2364 bytes
by Graham Cobb 01 Apr '26

01 Apr '26

Hi, dovecot is crashing for me while doing sieve processing for messages received via lmtp. This is reproducible, and seems to hit every message which runs a particular sieve script. Any thoughts or help would be appreciated! The error is: Error: sieve: fail2ban: line 23: read(<lmtp DATA local>) failed: Seeking past EOF by 2364 bytes Note: the number of bytes is always one of: 2169, 2272, 2259, 2364. I have many of these. I cannot see how the "Seeking past EOF" error can be caused by a bug in my sieve script. But please let me know if it can! Background: I have (and have had for many years) a complex set of sieve scripts for controlling my incoming email. They have worked fine for all that time. However, recently (ish), processing which uses a particular script is crashing dovecot. The actual log extract is below. The sieve script line 23, mentioned in the error report, is a large "if anyof (" statement containing many clauses like: body :raw :regex "country:[[:space:]]+KR", I can provide the full sieve script if required. This is what I see in the dovecot log (note: I reformatted the backtrace to make it easier to read. I also changed all my server names): Mar 29 03:03:52 SERVER dovecot-HOST: lmtp(4008073): Connect from local Mar 29 03:03:52 SERVER dovecot-HOST: lmtp(cobb)<4008073><PiAQHoiIyGmJKD0Ay7SJiA>: Error: sieve: fail2ban: line 23: read(<lmtp DATA local>) failed: Seeking past EOF by 2364 bytes Mar 29 03:03:52 SERVER dovecot-HOST: lmtp(cobb)<4008073><PiAQHoiIyGmJKD0Ay7SJiA>: Error: sieve: Execution of script 'auto:personal/.dovecot' was aborted due to temporary failure (user logfile /home/cobb/.dovecot.sieve.log may reveal additional details) Mar 29 03:03:52 SERVER dovecot-HOST: lmtp(cobb)<4008073><PiAQHoiIyGmJKD0Ay7SJiA>: Panic: file istream-concat.c: line 27 (i_stream_concat_close): assertion failed: (cstream->cur_input == cstream->input[cstream->cur_idx]) Mar 29 03:03:52 SERVER dovecot-HOST: lmtp(cobb)<4008073><PiAQHoiIyGmJKD0Ay7SJiA>: Error: Raw backtrace: #1 [unw_get_proc_name() failed: -10] -> #2 [unw_get_proc_name() failed: -10] -> #3 i_panic[0x7f41540655e6] -> #4 [unw_get_proc_name() failed: -10] -> #5 io_stream_unref[0x7f415413c120] -> #6 i_stream_unref[0x7f4154145c30] -> #7 index_storage_mailbox_close[0x7f4154383e70] -> #8 mailbox_close[0x7f41542fd9e0] -> #9 mailbox_free[0x7f4154302ab0] -> #10 lmtp_local_deinit[0x55dfa9c4e320] -> #11 client_state_reset[0x55dfa9c4f0d0] -> #12 smtp_server_transaction_free[0x7f4154091880] -> #13 smtp_server_connection_reset_state[0x7f4154093c90] -> #14 smtp_server_command_call_hooks[0x7f415408be60] -> #15 smtp_server_command_send_replies[0x7f4154090050] -> #16 [unw_get_proc_name() failed: -10] -> #17 [unw_get_proc_name() failed: -10] -> #18 io_loop_call_io[0x7f4154151710] -> #19 io_loop_handler_run_internal[0x7f41541534b0] -> #20 io_loop_handler_run[0x7f4154153640] -> #21 io_loop_run[0x7f4154153820] -> #22 master_service_run[0x7f41540a6330] -> #23 main[0x55dfa9c4a260] -> #24 __libc_start_call_main[0x7f4153e32c30] -> #25 __libc_start_main_alias_2[0x7f4153e32ce0] -> #26 _start[0x55dfa9c4a470] Mar 29 03:03:54 SERVER dovecot-HOST: lmtp(cobb)<4008073><PiAQHoiIyGmJKD0Ay7SJiA>: Fatal: master: service(lmtp): child 4008073 killed with signal 6 (core dumped) Mar 29 03:04:05 SERVER postfix/lmtp[4008072]: 005083DC75D: to=<MYADDRESS@MYDOMAIN>, orig_to=<ANOTHER@ANOTHERDOMAIN>, relay=SERVERNAME[private/dovecot-lmtp], delay=1740676, delays=1740674/0.25/0.04/1.5, dsn=4.4.2, status=deferred (lost connection with SERVERNAME[private/dovecot-lmtp] while sending end of data -- message may be sent more than once) The only message in .dovecot.sieve.log is: fail2ban: line 23: error: failed to read input message: internal error occurred: refer to server log for more information. [2026-04-01 18:54:13]. Thanks in advance for any thoughts! Graham

2 1