- dovecot - dovecot.org

Support TLS for pure remote doveadm commands
by Vincent Brillault 11 Nov '20

11 Nov '20

Dear all, A lot of doveadm commands (e.g. backup/sync, deduplicate, mailbox) support a `-S` (a.k.a `socket-path`) argument that allows to run the command remotely. Unfortunately, I think that there is a bug in the handling of the TLS configuration for this feature. After a bit of debugging, I think it's simply due to doveadm_mail_server_user_get_host (https://github.com/dovecot/core/blob/master/src/doveadm/doveadm-mail-server…) bailing out too quickly: It's used by doveadm_mail_server_user (https://github.com/dovecot/core/blob/master/src/doveadm/doveadm-mail-server…) to set its `user`, `host`, `hostip`, `port` and `ssl_flags`. When doveadm_port is not (or set to 0): - `user` is set to `input->username`: OK - `host` is set to `ctx->set->doveadm_socket_path` (the content of the `-S` option): OK - `hostip` is not set: OK (Later on, the `host` is used in that case) - `port` is set to 0: This is OK, as when the `hostip` (or rather the `server->ip` later in the code) is not set, this is only the default, the port is extracted from the `host` (or rather `server->name`) - `ssl_flags` is not modified: this is not OK as there is nothing else modifying it! Bailing out just a few line later (as in https://patch-diff.githubusercontent.com/raw/dovecot/core/pull/145.patch) fixes the issue for me. To reproduce the issue, with dovecot-2.3.11.3-4, you will need two systems, A & B: A needs to have dovecot configured and port 9091 open in its firewall for B. B just need dovecot to be installed. - Testing without TLS: - Add the following to A's dovecot configuration (and reload it): ``` service doveadm { inet_listener { port = 9091 } } doveadm_password=VeryRandomString ``` - On B, create a file X containing (only): ``` doveadm_password=VeryRandomString ``` - On B, running `doveadm -c X mailbox list -u ${existing_user} -S ${A}:9091` should return the mailbox list - Switching to TLS: - Replace what was added to A's dovecot configuration (and reload it) with: ``` service doveadm { inet_listener { port = 9091 ssl = yes } } doveadm_password=VeryRandomString doveadm_ssl = ssl # Not strictly required ``` - On B, create a file Y containing (only): ``` doveadm_password=VeryRandomString doveadm_ssl=yes ``` - On B, running `doveadm -c Y mailbox list -u ${existing_user} -S ${A}:9091` will not work. - On A, you should see in the logs: `dovecot[16435]: doveadm(${B}): Error: SSL handshake failed: SSL_accept() failed: error:140760FC:SSL routines:SSL23_GET_CLIENT_HELLO:unknown protocol` Applying the patch mentioned above makes the 2nd case work. What do you think? Cheers, Vincent

1 0

Re: how to set smtp-client -> submission_relay_host for IPv4 only?
by PGNet Dev 11 Nov '20

11 Nov '20

ref https://dovecot.org/pipermail/dovecot/2020-October/120226.html > On 10/15/20 10:13 PM, Aki Tuomi wrote: >> I'm asking how/where to 'tell', via config, Dovecot's smtp-CLIENT, that's making >> to connection to the submission_relay_host, to use _only_ IPv4. > > > There is currently no (other) way to do this than using /etc/hosts or specifying > IPv4 address for the relay host. Is there a bug request opened for this, then ? Is it planned for implementation ?

1 0

Re: Recovering expunged but not purged e-mails from mdbox with zlib compression
by Aki Tuomi 11 Nov '20

11 Nov '20

> On 10/11/2020 20:07 Daniel Schütze <dms(a)cwa.uk.com> wrote: > > > Dear Aki > Thank you. Unfortunately I'm struggling to get the right syntax for this as it looks like someone else was here too > https://dovecot.org/pipermail/dovecot/2018-July/112441.html > The location in my dovecot.conf is > > mdbox:%%h/mdbox:INDEX=/indexdisk/indexes/%%n:INDEXPVT=~/mdbox/shared/%%n This syntax is for accessing shared folders. You probably should try doveadm -Dv -o mail_location=mdbox_deleted:/path/to/mdbox fetch -u victim text ALL > I'm trying to fetch a message (for testing purposes now) based on it's guid as that is available from doveadm dump. > So my syntax is (based on the previous person who didn't get it to work). > > doveadm -o "mail_location=mdbox_deleted:%%h/mdbox:INDEX=/indexdisk/indexes/%%n:INDEXPVT=~/mdbox/shared/%%n" fetch "body" guid (msg.guid from doveadm dump) > Doveadm does not support var expand, so this will not work. See above for syntax. > But that's getting no response. I've tried putting in the hard path in case there is any trouble with the %%h etc but that doesn't help either. > I've also tried the fetch with the subject of a known deleted message and also adding mailbox Drafts (as I know that's where it is or rather was) but to no avail. > Given doveadm dump gives msg.uid and no subject I'd prefer to use that in any case. > There are no error messages, I do with doveadm was a little more verbose to help over these bumps! > > Any chance of a helping hand? > > > > Aki > > > > Daniel Schütze > Director > > ------------------ > > CWA International Ltd > 5th Floor, 42 Trinity Square > London > EC3N 4DJ > > (t) + 44 (0)20 7242 8444 > (e) dms(a)cwa.uk.com > (w) http://www.cwa.international/ > On 10/11/20 10:53, Aki Tuomi wrote: > > > You can use mdbox_deleted driver to access mails with refcount 0. See > > https://wiki2.dovecot.org/MailboxFormat/dbox > > > > Aki > > > > On 10.11.2020 12.42, Daniel Schütze wrote: > > > > > Yesterday I had to recover an e-mail which a user had deleted. If I > > > understand this correctly the message was expunged but not purged > > > (doveadm purge had not been run). > > > > > > This e-mail was clearly still in the mdbox stored with zlib > > > compression as I could tell using the doveadm dump command (doveadm > > > dump -t dbox filename). > > > > > > I could however not reveal the e-mail with the normal doveadm fetch -u > > > username "body" guid (guid from dump output) > > > > > > In the end I was able to recover the e-mail by cutting it out from the > > > mdbox and running gunzip over it, but this method was very fiddly and > > > would not have worked for a bulk job. I appreciate I could have just > > > deleted the index files and gotten all the deleted messages back by > > > having the index rebuilt but that would have been the proverbial > > > "hammer to crack a nut". > > > > > > Fortunately this e-mail had no attachment for me to worry about, as > > > those are also detached for sis by dovecot. > > > > > > Can anyone tell me of a quick and easy way to recover one or multiple > > > e-mails marked as expunged but not purged which are stored in a mdbox > > > with zlib compression? I'm sure I'll have to do this again the future > > > and my method wouldn't work with a folder! > > > > > > Clearly if I was not using zlib compression I could just have read the > > > contents of the mdbox without any complication. > > > > > > > > > -- > > > Daniel Schütze > > > Director > > > > > > ------------------ > > > > > > CWA International Ltd > > > 5th Floor, 42 Trinity Square > > > London > > > EC3N 4DJ > > > > > > (t) + 44 (0)20 7242 8444 > > > (e) dms(a)cwa.uk.com > > > (w) http://www.cwa.international/ > > >

3 2

Recommended Protocols?
by Raymond Herrera 11 Nov '20

11 Nov '20

Hello all: For several years I have been running the following in a Linux server. Dovecot Version: 2.0.9 *IMAP:* Connection Security: SSL/TLS Port: 993 Authentication Method: Normal Password *SMTP:* Connection Security: STARTTLS Port: 587 Authentication Method: Normal Password The E-mail client is Thunderbird on Windows. I am preparing a new server, with Dovecot 2.2.36 and would like to know the currently recommended protocols. Should I stick to what I have? I would prefer to start with the easiest configuration possible, which I will revise later. This is the command that I have been using to verify the server's functionality: % openssl s_client -connect localhost:imaps TIA

8 13

SSL alert number 42
by Raymond Herrera 11 Nov '20

11 Nov '20

This is a followup to my thread "Recommended Protocols?". The error message is as follows: dovecot: imap-login: Disconnected: TLS: SSL_read() failed: SSL routines:ssl3_read_bytes:sslv3 alert bad certificate: SSL alert number 42 I have selected both SSL/TLS and STARTTLS on the Thunderbird side, with identical results. The first question that I have is this. Is there any way to know whether that error messages comes from an attempt to read: (a) The server SSL certificate? (b) The client SSL certificate? Please find attached 2 log files. I am essentially using the distribution files as they come from the box. TIA

3 6

Recovering expunged but not purged e-mails from mdbox with zlib compression
by Daniel Schütze 10 Nov '20

10 Nov '20

Yesterday I had to recover an e-mail which a user had deleted. If I understand this correctly the message was expunged but not purged (doveadm purge had not been run). This e-mail was clearly still in the mdbox stored with zlib compression as I could tell using the doveadm dump command (doveadm dump -t dbox filename). I could however not reveal the e-mail with the normal doveadm fetch -u username "body" guid (guid from dump output) In the end I was able to recover the e-mail by cutting it out from the mdbox and running gunzip over it, but this method was very fiddly and would not have worked for a bulk job. I appreciate I could have just deleted the index files and gotten all the deleted messages back by having the index rebuilt but that would have been the proverbial "hammer to crack a nut". Fortunately this e-mail had no attachment for me to worry about, as those are also detached for sis by dovecot. Can anyone tell me of a quick and easy way to recover one or multiple e-mails marked as expunged but not purged which are stored in a mdbox with zlib compression? I'm sure I'll have to do this again the future and my method wouldn't work with a folder! Clearly if I was not using zlib compression I could just have read the contents of the mdbox without any complication. -- Daniel Schütze Director ------------------ CWA International Ltd 5th Floor, 42 Trinity Square London EC3N 4DJ (t) + 44 (0)20 7242 8444 (e) dms(a)cwa.uk.com (w) http://www.cwa.international/

2 2

Sieve body test
by ＠lbutlr 10 Nov '20

10 Nov '20

I have an email where I need to edit the body. I know this is generally a bad idea, but in this case I need to do it. The email comes in automatically every week or two, and so I thought that SIEVE would be the way to go. if header :contains "from" "theaddress@tehdomain" { if body :raw :contains "A string" { # Magic happens here } } It looks like what I need to do is enable and use vnd.dovecot.filter to pipe the message to a script. (Er. | not vnd.dovecot.pipe) So, if I wanted to transform the message so that the string "foobar13" was changed to "foo-bar-13" I would add filter :try "myfoobarfix.sh" After "magic happens here"> OK so far? Now, what are the requirements on the executable script? Would it literally be as simple as an executable file that simply said sed -e '|foobar13|foo-bar-13|g' Or does it need to be a shebang script and take input on $1 and … ? And lastly, where do the executable scripts need to be? https://raw.githubusercontent.com/dovecot/pigeonhole/master/doc/rfc/spec-bo… says "the external programs cannot be chosen arbitrarily; the available programs are restricted through administrator configuration", but no details on exactly how that is configured. -- "Are you pondering what I'm pondering?" Pinky: I think so, Brain. But if I put on two tutu's, would I really be wearing a four-by-four? Brain: Why do I even bother asking? Pinky: I dunno, Brain. Maybe it's all part of some huge, cosmic plot formula!

2 7

DOP-1414 sieve vacation address matching is case sensitive
by Mathieu Gosset 09 Nov '20

09 Nov '20

Hello, One year ago a bug was reported regarding pigeonhole vacation plugin https://www.mail-archive.com/dovecot@dovecot.org/msg78588.html a mail sent to User(a)domain.com instead of user(a)domain.com will generate a " vacation action: discarding vacation response for implicitly delivered message; no known (envelope) recipient address found in message headers (recipient=<user(a)domain.com>, and no additional `:addresses' are specified)" and no auto-response will be sent the problem seems to be located in /src/lib-sieve/plugins/vacation/cmd-vacation.c and the _contains_my_address_() function the comparison is done using dovecot's lib-smtp (src/lib-smtp/smtp-address.h) smtp_address_equals() function, which returns smtp_address_cmp(.) == 0; smtp_address_cmp() does a case insensitive comparison of the domain parts (using null_strcasecmp()) and a case sensitive comparison of the local parts (using null_strcmp()) There is probably a good reason why the local parts comparison is case sensitive within smtp_address_cmp(), but having vacation rely on that function causes the problem described above. Is there any plan to fix that ? Regards

2 1

HIGHESTMODSEQ replication issue
by Gustavo Ajeitos [Office365] 09 Nov '20

09 Nov '20

Hello, I'm using dovecot 2.3.10 in OpenSUSE and I have configured a master/master replication between two backends, it works well but I have found an issue with the replication of the HIGHESTMODSEQ. When I move a set of message from a mailbox to other, e.g. move 3 messages from INBOX to Junk, the HIGHESTMODSEQ get different on each server, with no errors in the log: [Borrador] 34:34 [Sent] 63:63 [Drafts] 12:12 [Trash] 146:146 [Junk] 219:218 [INBOX] 1133:1130 It can be fixed executing a full sync: $ sudo doveadm -D -v sync -u user(a)test.priv -d -l 30 -U But it is not a solution because it happens all the time that a user move messages. I'm using ActiveSync and the ActiveSync server use the HIGHESTMODSEQ as part of the synchronization key (sync_key), so in that situation the server detect changes on the mailbox if it connects to the backend with a different HIGHESTMODSEQ that it previously cached, causing a loop beetween the ActiveSync server and the the email client, where the server constantly inform email client about nonexistent changes. Could it be a bug in Dovecot replication? How can I solve it? Best regards, Gustavo Ajeitos

4 7

Re: vsz_limit
by Aki Tuomi 06 Nov '20

06 Nov '20

Duh... src/lib/restrict-process-size.h Should be in the installed include files as well, /usr/include/dovecot/restrict-process-size.h Aki > On 06/11/2020 15:56 Joan Moreau <jom(a)grosjo.net> wrote: > > > Hello > I can't find "src/lib/restrict.h" . Is it in dovecot source ? > > > On 2020-11-06 13:20, Aki Tuomi wrote: > > Seems I had forgotten that you can use src/lib/restrict.h, in particular, restrict_get_process_size() to figure out the limit. You can combine this with getrusage to find out current usage. > > > > Aki > > > > > > > On 06/11/2020 13:26 Joan Moreau <jom(a)grosjo.net> wrote: > > > > > > > > > yes, will do so. > > > It would be nice however to be able to access the actual dovecot config from the plugin side > > > > > > > > > > > > On 2020-11-04 06:46, Aki Tuomi wrote: > > > > You could also add it as setting for the fts_xapian plugin parameters? > > > > > > > > Aki > > > > > > > > > > > > > > > > > On 04/11/2020 08:42 Joan Moreau <jom(a)grosjo.net> wrote: > > > > > > > > > > > > > > > For machines with low memory, I would like to detect how much ram remains available before starting indexing a mail, so I can commit everything on disk before the ram is exhausted (and break the process) > > > > > I tried to put a "fake" allocation to test if it fails, (so it can fail separately, and I can "if ram remaining is above X") but the is really not clean > > > > > > > > > > > > > > > > > > > > On 2020-11-04 06:28, Aki Tuomi wrote: > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > On 04/11/2020 05:19 Joan Moreau <jom(a)grosjo.net> wrote: > > > > > > > > > > > > > > > > > > > > > Hello > > > > > > > I am looking for help around memory management > > > > > > > 1 - How to get the current value of "vsz_limit" from inside a plugin (namely https://github.com/grosjo/fts-xapian/ ) , especially for indexer-worker > > > > > > > 2 - Is there a macro or function in dovecot to get the remaining free memory from this vsz value ? > > > > > > > Thank you > > > > > > > > > > > > > > > > > > > > > > > > > > Hi Joan, > > > > > > > > > > > > I don't think there is a feasible way to access this setting as of now. Is there a reason you need this? We usually recommend setting vsz_limit=0 for indexer-worker. > > > > > > > > > > > > Aki > > > > > >

2 2