- dovecot - dovecot.org

Some questions about mail_crypt setups
by deano-dovecot＠areyes.com 22 Feb '21

22 Feb '21

Some questions about mail_crypt setups I have global mail enecryption working nicely, and replication works nicely between two systems. The main problem is that the private and public keys are *right there* on the server in /etc/dovecot/private ... Fine for a completely controlled system, but not so fine when on a rented VPS etc. When are the keys read in by dovecot ? Are they ever read in again while dovecot is running, or does it cache them in ram until dovecot is restarted ? Would it be possible for dovecot to read the keys as output from a script ? I'm thinking of a small script that would reach out to an authentication service like Authy or Okta or similar. Admin gets an alert on their phone, taps OK, UNLOCK and the two keys are returned to the script, which then hands them back to dovecot and away it goes. The mail_crypt config normally contains > mail_crypt_global_private_key = </etc/dovecot/private/dovecot_crypt_privkey > mail_crypt_global_public_key = </etc/dovecot/private/dovecot_crypt_pubkey Perhaps add another variable like > mail_crypt_global_script = </etc/dovecot/private/dovecot_crypt_script That script would run and feed the two keys back into dovecot (no matter how it got to them). So I started looking into per-user/per-folder encryption to see how that would work, and I have that setup nicely too. The config looks like this > # /etc/dovecot/conf.d/99-mailcrypt.conf > #-------------------------------------- > mail_attribute_dict = file:%h/Maildir/dovecot-attributes > plugin { > mail_crypt_require_encrypted_user_key = yes > mail_crypt_save_version = 2 > mail_crypt_curve = secp521r1 > } > > # /etc/dovecot/dovecot-sql.conf.ext > #---------------------------------- > # CREATE TABLE IF NOT EXISTS `users` ( > # `username` varchar(64) character set utf8 collate utf8_bin NOT NULL COMMENT 'localpart of email-address', > # `domain` varchar(64) character set utf8 collate utf8_bin NOT NULL COMMENT 'domain-part of email-address', > # `name` varchar(64) character set utf8 collate utf8_bin NOT NULL COMMENT 'Full name of user', > # `password` varchar(128) character set utf8 collate utf8_bin NOT NULL COMMENT 'base64-encoded SHA512 hash of password', > # PRIMARY KEY (`username`,`domain`) > # ) ENGINE=InnoDB DEFAULT CHARSET=utf8 COMMENT='users'; > > driver = mysql > connect = host=/var/run/mysqld/mysqld.sock dbname=emailers user=dovecot password=RandomPassword > default_pass_scheme = SHA512-CRYPT > > password_query = SELECT username, password, '%w' AS userdb_mail_crypt_private_password, '/var/mail/%d/%n' AS userdb_home, 'vmail' AS userdb_uid, 'vmail' AS userdb_gid FROM users WHERE username = '%n' AND domain = '%d' > > # For LDA: > user_query = SELECT '/var/mail/%d/%n' AS home, 'vmail' AS uid, 'vmail' AS gid FROM users WHERE username = '%n' AND domain = '%d' > > # For using doveadm -A: > iterate_query = SELECT username, domain FROM users Except that replication doesn't work due to the user password not being available. Actually, indexing fails too for the same reason. > Feb 21 14:02:13 indexer-worker(testuser(a)example.com)<120846><l8W9BzWuMmAK2AEAqNyxgw:MyoJDDWuMmAO2AEAqNyxgw>: Error: Mailbox INBOX: UID=1: read() failed: read(/var/mail/example.com/testuser/Maildir/INBOX/new/1613934133.M132059P12… failed: Private key not available: Cannot decrypt key f64e7c12a60b3df12ebf865a70bec57fedd3e9b4fd98df93205f1096db14fda7: Cannot decrypt key eca099273f525ca46b2f5640253770ad19e0578543244d8cd34bde183e996bd5: Password not available (read reason=fts indexing) > > Feb 21 14:02:13 indexer-worker(testuser(a)example.com)<120846><l8W9BzWuMmAK2AEAqNyxgw:MyoJDDWuMmAO2AEAqNyxgw>: Error: Failed to read mailbox INBOX mail UID=1 stream: Mailbox INBOX: UID=1: read() failed: read(/var/mail/example.com/testuser/Maildir/INBOX/new/1613934133.M132059P12… failed: Private key not available: Cannot decrypt key f64e7c12a60b3df12ebf865a70bec57fedd3e9b4fd98df93205f1096db14fda7: Cannot decrypt key eca099273f525ca46b2f5640253770ad19e0578543244d8cd34bde183e996bd5: Password not available (read reason=fts indexing) > > Feb 21 14:02:13 indexer-worker(testuser(a)example.com)<120846><l8W9BzWuMmAK2AEAqNyxgw:MyoJDDWuMmAO2AEAqNyxgw>: Error: Mailbox INBOX: Mail search failed: Internal error occurred. Refer to server log for more information. [2021-02-21 14:02:13] > > Feb 21 14:02:13 indexer-worker(testuser(a)example.com)<120846><l8W9BzWuMmAK2AEAqNyxgw:MyoJDDWuMmAO2AEAqNyxgw>: Error: Mailbox INBOX: Transaction commit failed: FTS transaction commit failed: transaction context (attempted to index 1 messages (UIDs 1..1)) > > Feb 21 14:02:13 dsync-local(testuser(a)example.com)<TGxiDTWuMmAN2AEAqNyxgw>: Error: Mailbox INBOX: UID=1: read() failed: read(/var/mail/example.com/testuser/Maildir/INBOX/new/1613934133.M132059P12… failed: Private key not available: Cannot decrypt key f64e7c12a60b3df12ebf865a70bec57fedd3e9b4fd98df93205f1096db14fda7: Cannot decrypt key eca099273f525ca46b2f5640253770ad19e0578543244d8cd34bde183e996bd5: Password not available (read reason=prefetch) What are the options here for providing the decryption password or key ? The user password is already stored in the mysql database as a SHA512-CRYPT so we don't want to store it unencrypted ... I saw the mail_crypt docs (https://doc.dovecot.org/configuration_manual/mail_crypt_plugin/) mention > mail_crypt_private_key - Private key to decrypt user's master key, can be base64 encoded I'm assuming that can just be a key generated with > openssl ecparam -name secp521r1 -genkey | openssl pkey but that leaves the situation almost the same as with a global key - they key is local on the system, though a bit better in that it's not just visible there as a simple file, it can be buried in the database. One could retrieve it with > password_query = SELECT username, password, privkey AS userdb_mail_crypt_private_key, '/var/mail/%d/%n' AS userdb_home, 'vmail' AS userdb_uid, 'vmail' AS userdb_gid FROM users WHERE username = '%n' AND domain = '%d' How are other people handling mail store encryption ? -- Dean Carpenter deano is at areyes dot com 203 six oh four 6644

4 3

doveadm sync different local vs remote account/mailbox name
by Gregory Sloop 22 Feb '21

22 Feb '21

I'm, trying to sync/backup mailboxes from a current dovecot instance to a new server. But the old server has real system accounts. The new server has virtual users. And the account/user-name is different. Example: Joe Sixpack is joes (on the old system) but is joes(a)sixpack.org (on the new system.) I'm using something like this to attempt the sync doveadm -o mail_fsync=never backup -R -u joes(a)sixpack.org imapc: This works from the new system, as it recognizes the user with a full @domain.com username - but the old system doesn't know who joes(a)sixpack.org is - and just wants joes. I don't see a way to specify the remote account username independently from the local one. What's the best way to handle this? TIA -Greg

1 1

BUG report
by Oleg Pyzin 22 Feb '21

22 Feb '21

Hello! I've compiled Dovecot on a macmini G4 PPC from ports, but couldn't launch it. When Dovecot is trying to launch it's stop launching because got an error. ------------- The error is: Feb 09 19:22:50 master: Panic: kevent(EV_ADD, READ, 21) failed: Invalid argument Feb 09 19:22:50 master: Error: Raw backtrace: 0 libdovecot.0.dylib 0x00216d58 askpass + 136 -> 1 libdovecot.0.dylib 0x00216e78 backtrace_get + 36 -> 2 libdovecot.0.dylib 0x00221fe8 i_set_debug_file + 248 -> 3 libdovecot.0.dylib 0x002220fc default_fatal_handler + 56 -> 4 dovecot 0x000039a0 dup2_append + 1884 -> 5 libdovecot.0.dylib 0x00221a8c i_panic + 120 -> 6 libdovecot.0.dylib 0x0022c13c io_loop_handle_add + 244 -> 7 libdovecot.0.dylib 0x0022f2c8 timeout_add_short + 416 -> 8 libdovecot.0.dylib 0x0022f574 io_add_to + 76 -> 9 dovecot 0x00007dd4 service_monitor_stop_close + 288 -> 10 dovecot 0x00008cdc services_monitor_start + 840 -> 11 dovecot 0x00004aa4 main + 3336 -> 12 dovecot 0x00003048 start + 68 ------------- dovecot -n: admin.MacPPC[/opt/local/var/log/dovecot] <467-7> $ sudo dovecot -n # 2.3.11.3 (): /opt/local/etc/dovecot/dovecot.conf # OS: Darwin 9.8.0 Power Macintosh hfs # Hostname: MacPPC.Dlink default_client_limit = 50 default_internal_group = _dovecot default_process_limit = 10 default_vsz_limit = 128 M info_log_path = /opt/local/var/log/dovecot/info listen = * log_path = /opt/local/var/log/dovecot/error login_plugin_dir = /opt/local/lib/dovecot mail_location = maildir:/private/srv/mail/%u namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } protocols = imap pop3 service imap { process_limit = 32 } service pop3 { process_limit = 32 } service submission { process_limit = 32 } ssl_cert = </etc/ssl/certs/dovecot.pem ssl_key = # hidden, use -P to show it userdb { driver = passwd }

2 1

Policy on folder's name and path's length
by Rupert Gallagher 22 Feb '21

22 Feb '21

Hello, Users can be really good at hanging everybody when you give them enough roope. I spotted a number of problems that I think are of interest to everybody and need mitigation. # length of path A busy Windows user wrote enough mail subfolders, and folder names with soo many characters, that exceed Windows maximum path length. To avoid taxing the mail server, their mail client (Thunderbird) is configured to keep a local copy of emails. I need to enforce a policy on the maximum path length they can create, and the maximum number of characters on any given folder name. # forbidden characters Another problem folder names was the presence of white spaces, note the plural, on both the beginning and end of folder names. For example, to emphasize the importance of folders, the user added white spaces in front of names: > Must be at the top > Very important > A bit less important >Normal stuff And to add insult to injury they wrote spaces at the end of folder names: > This is a folder name with two hidden spaces I need to enfoce a policy that forbids the use white spaces at the beginning and end of folder names, as well as the use of repeated characters: > ____ I spotted your policy and found this new trick # subfolders, everywhere... A user confused their IMAP account for a file system and mind map tool, so they created folders everywhere, including root folders at the same level of inbox, draft, junk, trash, and huge directories under inbox. I need to enforce a policy that allows the creation of folders only under /Archive. I think such policies make good sense on any dovecot server and should be enforced by default.

2 2

Dovecot dsync certificate errors
by Stephan Mending 21 Feb '21

21 Feb '21

Hi *, I've setup two dovecot instances. As soon as i send the syncing part of dovecot to work I see the following errors in my maillogs. $ cat /var/log/mail.log doveadm(inbox(a)sec-level.domain): Error: doveadm server disconnected before handshake: SSL certificate doesn't match expected host name fqdn.of.system: No match to 1 SubjectAltNames doveadm(inbox(a)sec-level.domain): Error: Disconnected from remote: SSL certificate doesn't match expected host name fqdn.of.system: No match to 1 SubjectAltNames A little context: The certificates on the servers are issued by a private CA. The public CA-Certificate has been added to the keystore, though. Shouldn't be a problem. I can confirm that by connecting using s_client -> $ openssl s_client -connect <hostname-of-dovecot-A>:12345 .. ... .... Verify return code: 0 (ok) So far the certificate seems to be ok. **BUT**: As soon as i start dovecot (on the very same machine I issued the s_client command above) ... I am receiving the error messages: doveadm(inbox(a)sec-level.domain): Error: doveadm server disconnected before handshake: SSL certificate doesn't match expected host name fqdn.of.system: No match to 1 SubjectAltNames doveadm(inbox(a)sec-level.domain): Error: Disconnected from remote: SSL certificate doesn't match expected host name fqdn.of.system: No match to 1 SubjectAltNames And yes the SubjectAlternativeName in the certificate matches the configured FQDN in 30-dsync.conf. My 30-dsync.conf: $ cat /etc/dovecot/conf.d/30-dsync.conf service aggregator { fifo_listener replication-notify-fifo { user = dovecot mode = 0666 } unix_listener replication-notify { user = dovecot mode = 0666 } } # Configuring the replicator service service replicator { process_min_avail = 1 unix_listener replicator-doveadm { user = dovecot mode = 0666 } } service doveadm { user = dovecot inet_listener { port = 12345 ssl = yes } } doveadm_port = 12345 doveadm_password = <password> replication_max_conns = 1 plugin { mail_replica = tcps:fqdn.of.system } service config { unix_listener config { user = dovecot } } I'd love to here the answer to this. Thanks alot ! Best regards, Stephan

2 1

Possible minor issue with ~ vs %h
by Marc Delling 21 Feb '21

21 Feb '21

Hi there! The documentation states one should prefer "~" over "%h" as placeholder for mail_home, nevertheless, in an official example for mail_attribute_dict "%h" was used like this: mail_home = /var/vmail/mailboxes/%d/%n mail_location = maildir:~/mail:LAYOUT=fs # this works mail_attribute_dict = file:%h/mail/dovecot-attributes # this works I thought I would be clever and replace "%h" with "~" but if I do this, it does not behave as expected. Instead it creates a new directory named "~" inside mail_home. mail_home = /var/vmail/mailboxes/%d/%n mail_location = maildir:~/mail:LAYOUT=fs # this still works mail_attribute_dict = file:~/mail/dovecot-attributes # this does not work I just wanted to bring it up, maybe I misinterpreted the documentation. I abolished the tilde for now, even if it is the preferred way. All the best Marc

1 0

Messages sent to alias+detail end up in INBOX
by ml＠shadrinden.ru 21 Feb '21

21 Feb '21

Hi, everyone! I have seemingly correct settings for details to work: when I send a message to user+detail(a)mydomain.tld, it goes into the "detail" folder of user(a)mydomain.tld. Also I have working aliases, so when I send a message to alias(a)mydomain.tld, it goes into the INBOX folder of user(a)mydomain.tld. I expected that when I send a message to alias+detail(a)mydomain.tld, it would go into the "detail" folder of user(a)mydomain.tld. However, it goes into the INBOX folder of user(a)mydomain.tld. Is it the intended behavior? Pertinent settings: recipient_delimiter·=·+ lda_mailbox_autocreate·=·yes Or are these settings not the only ones pertinent to the case? -- Respectfully, Denis Shadrin

7 21

Sieve by the addressee
by ml＠shadrinden.ru 20 Feb '21

20 Feb '21

Hi, everyone! I have a sieve that is supposed to put all messages addressed to this mailing list into a separate folder: if anyof (address :is "to" "ml(a)shadrinden.ru", address :is "to" "dovecot(a)dovecot.org") { fileinto "mail_list"; stop; } Generally, it's working, but today I have got two mailing list messages that weren't put in that folder, they arrived straight into INBOX. I suppose that was because they were replies and were addressed to the person who asked the questions, so they had his address in "To:", and only in "Cc:" they had dovecot(a)dovecot.org. So, am I right that, when filtering messages by the addressee, it's generally a good idea to use not just "to", but ["to", "cc', "bcc"] ? -- Respectfully, Denis Shadrin

6 5

mail_crypt_global_private_key: Couldn't parse private key: Unknown/invalid PEM key type
by Antti Antinoja 20 Feb '21

20 Feb '21

Version: Dovecot 2.3.13 (89f716dc2) Issue: Dovecot states it can't parse the private key = Background = == Creating private EC key == * Curve: secp521r1 * Encryption: aes-256-ctr * Format: pkey * Enacapsulation: Base64 # openssl ecparam -name secp521r1 -genkey | openssl pkey |\ openssl ec -aes-256-ctr | base64 -w0 > test_keys_remove/private_key_encrypted.pem == Extract public key == # cat test_keys_remove/private_key_encrypted.pem | base64 -d |\ openssl ec -pubout | base64 -w0 > test_keys_remove/public_key.pem == Checking keys == * 592 Feb 20 07:27 private_key_encrypted.pem: LS0tLS1CRUdJTiBFQyBQUklWQVRFIEtFWS0tLS0tClByb2MtVHlwZTogNCxFTkNSWVBURUQKREVLLUluZm86IEFFUy0yNTYtQ1RSLEY3QzRCMUU3MDQxRDBBNDU1QjFGOUUwODA0NkRBNDAxCgpQdGE4T0F0QTN1anYwdlNNY3RpSGlUZDJqMEdTU2R6VjU3UUdtVXdDTU1RcDdRb3FCSHQvZERNRVBiUEY1bEcxCmowUER1NS9GVnVUdFVsUlpTMTYrTlNXaW9yZ2t2VkhUaDMrNDd0eC91dmlRd1FQLzQzdEVhRnBmNzdTQVpsRHcKeEIyU2pNNFp2MWhkU3BqeFdER0dKRkJEdi8yL2RqOVVwVHh3a0F3dVgrUVFoUmxWelN5cjBCQVhHOXlPcS9HVAp3czhRNUdldnp2SEdoMVl5UGdwTDlqdGJpekdJYTRVUzBmN2hFZkdHSGZKLzNSSWR6MHhlaWh2OEdhMGh1ajQ4CmRTL1FTY0U3QnYrWW16emNnMmRsdlk5Nkc1eFJJT3dCOEFEd1IvbHdidz09Ci0tLS0tRU5EIEVDIFBSSVZBVEUgS0VZLS0tLS0K * 360 Feb 20 07:28 public_key.pem: LS0tLS1CRUdJTiBQVUJMSUMgS0VZLS0tLS0KTUlHYk1CQUdCeXFHU000OUFnRUdCU3VCQkFBakE0R0dBQVFBK2w2M0ZIckpuT0dPZ1lDTG5PRVpOaHpSdW5YWgpoMHd5dTNPS1VzSEozUDJPVWxNWmxKOFFjZTF0SExUTWFxMWxkOTIwbkdJQmo1TGNYUklVdWRweElTd0I2Tld0Ck1TWncrZFBEUVRjc0hQMFRqWUh5Njl4d25BZHV4ZHZYdnh0Uk5TRzZGNlJPUnR0L2t2ekk3bWRPM0NpQ1FyMTQKTjZWalZyYWVpaXZkR2dPQ250bz0KLS0tLS1FTkQgUFVCTElDIEtFWS0tLS0tCg== == Notes == * The keys are then saved in database and fetched to userdb by Dovecot via passdb lookup (Details in the logs) * mail-crypt settings: mail_plugins = $mail_plugins mail_crypt plugin { mail_crypt_curve = secp521r1 mail_crypt_save_version = 0 } * Note: User record on database has mail_crypt_save_version = 2 as can be seen from the log extract below. = Dovecot log on client IMAP message retrieval = Feb 20 07:45:01 pf1 dovecot[19612]: auth: Debug: sql(test1(a)g1.fi,x.x.x.x,<wFzVEb67CMQKZgkb>): Performing passdb lookup Feb 20 07:45:02 pf1 dovecot[19612]: auth: Debug: sql(test1(a)g1.fi,x.x.x.x,<wFzVEb67CMQKZgkb>): Finished passdb lookup Feb 20 07:45:02 pf1 dovecot[19612]: auth: Debug: auth(test1(a)g1.fi,x.x.x.x,<wFzVEb67CMQKZgkb>): Auth request finished Feb 20 07:45:02 pf1 dovecot[19612]: auth: Debug: client passdb out: OK 1 user=test1(a)g1.fi Feb 20 07:45:02 pf1 dovecot[19612]: auth: Debug: sql(test1(a)g1.fi,x.x.x.x,<wFzVEb67CMQKZgkb>): Performing userdb lookup Feb 20 07:45:02 pf1 dovecot[19612]: auth: Debug: sql(test1(a)g1.fi,x.x.x.x,<wFzVEb67CMQKZgkb>): Finished userdb lookup Feb 20 07:45:02 pf1 dovecot[19612]: auth: Debug: master userdb out: USER 1609957377 test1(a)g1.fi mail_crypt_global_private_password=key_pass_we_know_this_is_correct mail_crypt_global_private_key=LS0tLS1CRUdJTiBFQyBQUklWQVRFIEtFWS0tLS0tClByb2MtVHlwZTogNCxFTkNSWVBURUQKREVLLUluZm86IEFFUy0yNTYtQ1RSLEY3QzRCMUU3MDQxRDBBNDU1QjFGOUUwODA0NkRBNDAxCgpQdGE4T0F0QTN1anYwdlNNY3RpSGlUZDJqMEdTU2R6VjU3UUdtVXdDTU1RcDdRb3FCSHQvZERNRVBiUEY1bEcxCmowUER1NS9GVnVUdFVsUlpTMTYrTlNXaW9yZ2t2VkhUaDMrNDd0eC91dmlRd1FQLzQzdEVhRnBmNzdTQVpsRHcKeEIyU2pNNFp2MWhkU3BqeFdER0dKRkJEdi8yL2RqOVVwVHh3a0F3dVgrUVFoUmxWelN5cjBCQVhHOXlPcS9HVAp3czhRNUdldnp2SEdoMVl5UGdwTDlqdGJpekdJYTRVUzBmN2hFZkdHSGZKLzNSSWR6MHhlaWh2OEdhMGh1ajQ4CmRTL1FTY0U3QnYrWW16emNnMmRsdlk5Nkc1eFJJT3dCOEFEd1IvbHdidz09Ci0tLS0tRU5EIEVDIFBSSVZBVEUgS0VZLS0tLS0K mail_crypt_global_public_key=LS0tLS1CRUdJTiBQVUJMSUMgS0VZLS0tLS0KTUlHYk1CQUdCeXFHU000OUFnRUdCU3VCQkFBakE0R0dBQVFBK2w2M0ZIckpuT0dPZ1lDTG5PRVpOaHpSdW5YWgpoMHd5dTNPS1VzSEozUDJPVWxNWmxKOFFjZTF0SExUTWFxMWxkOTIwbkdJQmo1TGNYUklVdWRweElTd0I2Tld0Ck1TWncrZFBEUVRjc0hQMFRqWUh5Njl4d25BZHV4ZHZYdnh0Uk5TRzZGNlJPUnR0L2t2ekk3bWRPM0NpQ1FyMTQKTjZWalZyYWVpaXZkR2dPQ250bz0KLS0tLS1FTkQgUFVCTElDIEtFWS0tLS0tCg== mail_crypt_save_version=2 quota_rule=*:bytes=0 home=/var/vmail/g1.fi/test1 uid=10000 gid=10000 auth_mech=PLAIN auth_token=66d2d0f66bcce2758235fb53dbfe821804c6e79c Feb 20 07:45:02 pf1 dovecot[19612]: imap-login: Login: user=<test1(a)g1.fi>, method=PLAIN, rip=x.x.x.x, lip=y.y,y,y, mpid=19618, TLS, session=<wFzVEb67CMQKZgkb> Feb 20 07:45:02 pf1 dovecot[19612]: imap(test1(a)g1.fi)<19618><wFzVEb67CMQKZgkb>: Debug: Added userdb setting: plugin/mail_crypt_global_private_key=LS0tLS1CRUdJTiBFQyBQUklWQVRFIEtFWS0tLS0tClByb2MtVHlwZTogNCxFTkNSWVBURUQKREVLLUluZm86IEFFUy0yNTYtQ1RSLEY3QzRCMUU3MDQxRDBBNDU1QjFGOUUwODA0NkRBNDAxCgpQdGE4T0F0QTN1anYwdlNNY3RpSGlUZDJqMEdTU2R6VjU3UUdtVXdDTU1RcDdRb3FCSHQvZERNRVBiUEY1bEcxCmowUER1NS9GVnVUdFVsUlpTMTYrTlNXaW9yZ2t2VkhUaDMrNDd0eC91dmlRd1FQLzQzdEVhRnBmNzdTQVpsRHcKeEIyU2pNNFp2MWhkU3BqeFdER0dKRkJEdi8yL2RqOVVwVHh3a0F3dVgrUVFoUmxWelN5cjBCQVhHOXlPcS9HVAp3czhRNUdldnp2SEdoMVl5UGdwTDlqdGJpekdJYTRVUzBmN2hFZkdHSGZKLzNSSWR6MHhlaWh2OEdhMGh1ajQ4CmRTL1FTY0U3QnYrWW16emNnMmRsdlk5Nkc1eFJJT3dCOEFEd1IvbHdidz09Ci0tLS0tRU5EIEVDIFBSSVZBVEUgS0VZLS0tLS0K Feb 20 07:45:02 pf1 dovecot[19612]: imap(test1(a)g1.fi)<19618><wFzVEb67CMQKZgkb>: Debug: Added userdb setting: plugin/mail_crypt_global_private_password=<hidden> Feb 20 07:45:02 pf1 dovecot[19612]: imap(test1(a)g1.fi)<19618><wFzVEb67CMQKZgkb>: Debug: Added userdb setting: plugin/mail_crypt_global_public_key=LS0tLS1CRUdJTiBQVUJMSUMgS0VZLS0tLS0KTUlHYk1CQUdCeXFHU000OUFnRUdCU3VCQkFBakE0R0dBQVFBK2w2M0ZIckpuT0dPZ1lDTG5PRVpOaHpSdW5YWgpoMHd5dTNPS1VzSEozUDJPVWxNWmxKOFFjZTF0SExUTWFxMWxkOTIwbkdJQmo1TGNYUklVdWRweElTd0I2Tld0Ck1TWncrZFBEUVRjc0hQMFRqWUh5Njl4d25BZHV4ZHZYdnh0Uk5TRzZGNlJPUnR0L2t2ekk3bWRPM0NpQ1FyMTQKTjZWalZyYWVpaXZkR2dPQ250bz0KLS0tLS1FTkQgUFVCTElDIEtFWS0tLS0tCg== Feb 20 07:45:02 pf1 dovecot[19612]: imap(test1(a)g1.fi)<19618><wFzVEb67CMQKZgkb>: Debug: Added userdb setting: plugin/=2 Feb 20 07:45:02 pf1 dovecot[19612]: imap(test1(a)g1.fi)<19618><wFzVEb67CMQKZgkb>: Debug: Added userdb setting: plugin/quota_rule=*:bytes=0 Feb 20 07:45:02 pf1 dovecot[19612]: imap(test1(a)g1.fi)<19618><wFzVEb67CMQKZgkb>: Error: mail_crypt_plugin: mail_crypt_global_private_key: Couldn't parse private key: Unknown/invalid PEM key type == Question == Any idea why Dovecot can't parse the private key? I tested this with several keys. Even with some without encryption -> Always same error. According to the debug messages the private key is correctly loaded (and indeed matches the one created on command line). Thank you for your time. Cheers, Antti -- Antti Antinoja <reader(a)fennosys.fi>

2 4

Monitoring Dovecot Replication
by MK 18 Feb '21

18 Feb '21

Hello, I have a cluster with two dovecot nodes with dovecot replication between them. The setup works fine and now I'm searching for a way to monitor the users so that I can get an information if the replication fails for one user for a longer time and I have to trigger the replication manually. Most of the time if I see a replication failure the self healing of dovecot replication repairs this in max. 10 min. I have tried different combinations of querying " doveadm replicator status '*' " and search for failed users and then send an alarm if one of fast sync, full sync or success sync reaches a threshold. But there is no combination that seems to be working if I only want to trigger this if I have to fix the replication manualy. Can someone tell me what I have to query to get only the user who's replication failed for a longer time (10 min +) and that I have to fix manually? Thank you. Oliver

4 6