- dovecot - dovecot.org

http pipelining on auth_policy_server
by Adrian M 07 Dec '20

07 Dec '20

Hi, I'm curious to know if dovecot can be configured to do pipelining for auth_policy in order to use less connection to the server and keep them for longer. I'm working on making a small policy server and the lack of persistent connections is a cause of overhead. Thank you !

2 2

[patch] enhancement for adding limits to solr and tika parsing
by John Fawcett 07 Dec '20

07 Dec '20

Hi As mentioned in a previous thread, the solr + tika combination has caused me some issues due to attachment size. While tika seems to be able to parse large attachments, the resulting volume of text can overwhelm the solr server. One solution would be to throw resources at the problem, but in my case such large attachments don't contain anything worthwile indexing. Additionally I don't want people to be able to randomly crash my solr server by sending large compressed attachments that expand into huge volumes for solr. It's also a safety feature to have sane limits on what can be indexed. Attached is a first attempt to address the problem. I did not find a way to easily get actual attachment sizes, so I used an already available information - the overall message size. It may not be ideal but at least introduces limits where none existed. I have introduced two new parameters for the plugin section, for example: plugin { fts_max_size = 2M fts_max_size_tika = 1M } They can be used separately or together. Both sizes refer to the overall message size. The meaning is: fts_max_size - do not parse message bodies if the message size exceeds this value. A value of 0 indicates no limit. If the message body is not parsed, attachments are also not parsed. fts_max_size_tika - do not parse message attachments with tika if the message size exceeds this value. A value of 0 indicates no limit. If using both settings it makes sense to have fts_max_size > fts_max_size_tika, since with a smaller fts_max_size bodies are not indexed including attachments and the fts_max_size_tika will have no effect. The difference (ft_max_size - fts_max_size_tika) places an upper bound on the size of the non attachment body text that will be indexed. However, any attachments over the fts_size will automatically consume this limit and no body text will be indexed for those messages. I've only updated the tika parser not the script parser though the script parser potentially could benefit from this approach. The attached patch also includes the rolled up patch for using basic auth with the tika server and the previous posted patch (not mine) which solves an assert when using solr and tika together. John

1 0

Re: Re: Re: Dovecot+Solr+Tika segmentation fault
by Manuel Josupeit-Walter 07 Dec '20

07 Dec '20

>>> A fix was posted on this list which seems to avoid segfaults when >>> using solr+tika. I reposted it not long ago in response to another >>> question. Before exploring the other segfaults it would be worthwhile >>> getting that fix. If other segfaults continue then I suggest posting >>> the logging from Dovecot >> >> https://github.com/dovecot/core/commit/043d111cea78533cf22d3bfe0872c8376d84… >> (DOV-4090) >> >> Scheduled for 2.3.13. > > I applied the fix and will observe it for the next couple of days. Unfortunately, the issue still persists even with this patch. The log message is slightly different, though, regarding disconnection: Dec 03 17:10:49 server.name tika[988]: INFO tika/ (application/pdf) Dec 03 17:10:49 server.name tika[988]: INFO tika/ (image/png) Dec 03 17:10:49 server.name kernel: indexer-worker[15805]: segfault at 0 ip 00007f140483db64 sp 00007ffc04fa7960 error 4 in libdovecot.so.0.0.0[7f14047f3000+db000] Dec 03 17:10:49 server.name kernel: Code: 89 f5 48 8d b8 f0 01 00 00 48 8b 52 08 4c 8b 62 48 e8 90 89 fb ff 48 8b 44 24 08 be 00 20 00 00 4c 89 ef 48 8b 80 10 01 00 00 <4c> 8b 38 e8 64 b2 fb ff 48 8b 44 24 0 Dec 03 17:10:49 server.name dovecot[988]: Dec 03 16:10:49 indexer: Error: Indexer worker disconnected, discarding 1 requests for username_stripped Dec 03 17:10:49 server.name dovecot[988]: Dec 03 16:10:49 indexer-worker(username_stripped)<1952><Ed3ek5G1BMQgARa4EL8DAKGMINRlZjjS:c+gACAkOyV+gBwAAhFs1yA>: Fatal: master: service(indexer-worker): child 1952 killed It seems that there is something else going wrong in this version. Best, Manuel

3 3

quota-status for outgoing mail (Dovecot/Postfix)
by Peter Folta 06 Dec '20

06 Dec '20

[Dovecot version 2.3.11.3 (502c39af9)] Hi all, I’m using Dovecot’s quota-status service to let Postfix check the recipient’s quota before accepting emails following the guide here: https://blog.sys4.de/postfix-dovecot-mailbox-quota-en.html <https://blog.sys4.de/postfix-dovecot-mailbox-quota-en.html>. This works well for inbound emails. I would like to set up something similar for outbound email, i.e. if a user is over quota, they should not be allowed to send new emails. At the moment, the setup is in a bit of an inconsistent state: Users that have exceeded their quota are still able to send outbound emails but saving them in their Sent folder will fail leaving them without a copy. I have tried using Dovecot’s quota-status in Postfix’s smtpd_send_restrictions but didn’t get this to work. A quick look at the Dovecot source code seems to suggest that the quota-status plugin is only checking the recipient address: https://github.com/dovecot/core/blob/master/src/plugins/quota/quota-status.… <https://github.com/dovecot/core/blob/master/src/plugins/quota/quota-status.…> and https://github.com/dovecot/core/blob/master/src/plugins/quota/quota-status.… <https://github.com/dovecot/core/blob/master/src/plugins/quota/quota-status.…>. I suspect it’s not possible to use the quota-status service to control outbound email but thought I’d ask to confirm. I’m wondering if there’s a different way to achieve this? Thanks Peter

3 2

Files in tmp directory
by David Morsberger 05 Dec '20

05 Dec '20

I had to restore many thousands of dovecot emails from a crashed Mac Server to a new Ubuntu server. After completing I am noticing a few things that may be okay or may need to be fixed. 1) a couple of mailboxes have a lot (one has 102462) emails in the tmp directory. The files do not have the standard Mairdir++ filename format. An example: 1581262582.M397740P72267.mini.mmpcrofton.com <http://1581262582.m397740p72267.mini.mmpcrofton.com/> (missing the stuff at the end, ,S=,W=:2,S) 2) I see files in the cur directory that do not have the Maildir++ format. An example: 1601287326.V810Ie80087M240104.mmp-mail.mmpcrofton.com:2,S. (do not have the ,S=,W= values and the second value, V810Ie80087M240104, is longer that the other file names) How do I get the emails in (1) out of tmp? Do I need to convert the emails in (2)? David

2 3

Combine director and HAProxy for loadbalancig and failover
by Steven Varco 05 Dec '20

05 Dec '20

Hi All I’m trying to achive an active/active cluster with dovecot-director and HAProxy, as the director does not do health checks (loadblancing only) and I want both, loadblancing AND failover, where the latter is far more important to me (loadblancing I would just use as an addon and for curiosity, it is not really need in my setup). However, I’m not sure if this combination can be used that way, as I found almost no documentation on this. What I found is using either directory OR haproxy with dovecot, but not both. So I guess, that the description here is intended to use without the director: https://wiki2.dovecot.org/HAProxy This older list post is basically exaclty, what I’m trying to achive: https://dovecot.org/pipermail/dovecot/2015-July/101487.html Clients --> Load Balancer(HAProxy) --> Dovecot Proxy(DP) --> Dovecot Director(DD) --> MS1 / MS2 As far as I understood, this would require to (statically) set a host= entry for each client which would give another single point of failure? However reading the documentation: https://doc.dovecot.org/configuration_manual/haproxy/ assumes that this setup IS actually possible. Unfortunately it does not describe how dovecot must be setup at this point. So I assume since HAProxy is listening on port 1143 (for IMAP) and dovecot (with directror enabled) is listening on port 143, which is the main entry point for clients. So in this setup dovecot-director should first pass the mail traffic to HAProxy on port 1143 and then HAProxy passes it to the actual imap servers? So how would the dovecot setup on the director servers look like and how on the dovecot imap mail servers? My setup consist of each two machines: loadblancer (with HAProxy and dovecot-director) and dovecot imap servers. Last but not least, I found documentation for „dovemon“, which, if I got that correctly, should replace the external tool „poolmon“: https://doc.dovecot.org/configuration_manual/dovemon/ - However, I could not find out where the configuration YAML file (/etc/dovecot/dovemon.config.yml) should get included in the main dovecot configuration. By default this file would not be included at all and therefore would have no effect… thanks. Steven My setup: LOADBALANCERS: Currently one only running on: 10.0.2.26 haproxy: Exactly as: https://doc.dovecot.org/configuration_manual/haproxy/ where the backend servers line have been replaced with the mail servers. dovecot -n # 2.2.36 (1f10bfa63): /etc/dovecot/dovecot.conf # Pigeonhole version 0.4.24 (124e06aa) # OS: Linux 3.10.0-1127.19.1.el7.x86_64 x86_64 CentOS Linux release 7.8.2003 (Core) # Hostname: lb01.example.com auth_verbose = yes director_mail_servers = 10.0.2.30 10.0.2.29 director_servers = 10.0.2.26 disable_plaintext_auth = no first_valid_uid = 1000 haproxy_trusted_networks = 10.0.2.0/24 mail_location = maildir:~/Maildir managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext mbox_write_locks = fcntl namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } passdb { args = proxy=y ssl=any-cert nopassword=y driver = static } plugin { sieve = file:~/sieve;active=~/.dovecot.sieve } protocols = imap pop3 lmtp sieve service director { fifo_listener login/proxy-notify { mode = 0666 } inet_listener { port = 9090 } unix_listener director-userdb { mode = 0600 } unix_listener login/director { mode = 0666 } } service imap-login { executable = imap-login director inet_listener imap { port = 143 } inet_listener imap_haproxy { haproxy = yes port = 10143 } } service managesieve-login { inet_listener sieve { port = 4190 } } service pop3-login { executable = pop3-login director } ssl_cert = </etc/letsencrypt/live/mail-lb.tech-island.xyz/fullchain.pem ssl_key = # hidden, use -P to show it verbose_proctitle = yes protocol lmtp { auth_socket_path = director-userdb mail_plugins = " sieve" } protocol lda { mail_plugins = " sieve" } MAIL SERVERS: mx01: 10.0.2.30 mx02: 10.0.2.29 dovecot -n # 2.2.36 (1f10bfa63): /etc/dovecot/dovecot.conf # Pigeonhole version 0.4.24 (124e06aa) # OS: Linux 3.10.0-1127.19.1.el7.x86_64 x86_64 CentOS Linux release 7.8.2003 (Core) # Hostname: mx01.example.com auth_mechanisms = plain login auth_verbose = yes dict { sqlquota = mysql:/etc/dovecot/dict-sqlquota.conf.ext } doveadm_password = # hidden, use -P to show it doveadm_port = 14310 first_valid_uid = 1000 login_trusted_networks = 10.0.2.0/24 mail_location = maildir:~/Maildir mail_plugins = quota notify replication managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext mbox_write_locks = fcntl namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = separator = / type = private } passdb { args = /etc/dovecot/dovecot-sql.conf.ext driver = sql } plugin { mail_replica = tcp:10.0.2.29 quota = maildir:User quota quota_exceeded_message = Quota exceeded, please go to http://www.tech-island.xyz/over_quota_help for instructions on how to fix this. quota_rule2 = INBOX.Trash:storage=+100M quota_status_nouser = DUNNO quota_status_overquota = 552 5.2.2 Mailbox is full / Mailbox ist voll quota_status_success = DUNNO quota_warning = storage=90%% quota-warning 90 %u quota_warning2 = -storage=90%% quota-warning below %u sieve = file:~/sieve;active=~/.dovecot.sieve } postmaster_address = postmaster(a)tech-island.xyz protocols = imap pop3 lmtp sieve replication_dsync_parameters = -d -l 30 -U service aggregator { fifo_listener replication-notify-fifo { user = vmail } unix_listener replication-notify { user = vmail } } service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0660 user = postfix } unix_listener auth-userdb { user = vmail } } service dict { unix_listener dict { user = vmail } } service doveadm { inet_listener { port = 14310 } } service managesieve-login { inet_listener sieve { port = 4190 } } service quota-status { client_limit = 1 executable = quota-status -p postfix inet_listener { port = 14340 } } service quota-warning { executable = script /usr/local/libexec/dovecot/quota-warning.sh unix_listener quota-warning { user = vmail } user = vmail } service replicator { process_min_avail = 1 unix_listener replicator-doveadm { mode = 0600 user = vmail } } ssl = required ssl_cert = </etc/ssl/acme/certs/mail.tech-island.xyz.chain.crt ssl_key = # hidden, use -P to show it userdb { args = /etc/dovecot/dovecot-sql.conf.ext driver = sql } verbose_proctitle = yes protocol lmtp { mail_plugins = quota notify replication sieve } protocol lda { mail_plugins = quota notify replication sieve } protocol imap { mail_max_userip_connections = 20 mail_plugins = quota notify replication imap_quota } -- https://steven.varco.ch/

1 0

Server-side threading
by ohw.giles＠gmail.com 04 Dec '20

04 Dec '20

Hi list, Considering a message A in INBOX, where a reply B is sent and copied to the recipient's SENT folder, and to which a reply-to-reply C is received, again in INBOX, how should the list of threads in INBOX be (ideally) retrieved? Using THREADS=REFS when listing threads in INBOX to avoid matching unrelated threads unfortunately seems to miss the above example because B is only in SENT, not INBOX. REFERENCES allows A to be linked to C, but the sent message is missing from the returned thread. Of course this is by design. When listing messages in a selected mailbox, many modern clients provide the experience of listing the messages grouped by thread, showing all threads where *at least one message in the thread is in the selected mailbox*. IIUC, clients usually build their own indexes to achieve this, which seems wasteful. Does dovecot provide a server-side way to list or search messages and return threaded results in this manner?

1 0

doveadm sync return "failed: EOF (version not received)"
by Olivier Mars 04 Dec '20

04 Dec '20

Hi, I have 2 dovecot servers, server1.domain.tld and server2.domain.tld and I'm not able to do a simple doveadm backup command between them. Dovecot version 2.3.11.3, on debian buster, (installed from apt) I try to execute this cmd between to of my dovecot servers : doveadm sync -u postmaster(a)domain.tld remote:root@server2.domain.tld and it returns : doveadm(postmaster(a)domain.tld): Debug: remote(/var/run/dovecot/doveadm-server): auth-master: userdb lookup(postmaster(a)domain.tld): Started userdb lookup doveadm(postmaster(a)domain.tld): Debug: remote(/var/run/dovecot/doveadm-server): auth-master: conn unix:/var/run/dovecot/auth-userdb: Connecting doveadm(postmaster(a)domain.tld): Debug: remote(/var/run/dovecot/doveadm-server): auth-master: conn unix:/var/run/dovecot/auth-userdb (pid=118292,uid=0): Client connected (fd=15) doveadm(postmaster(a)domain.tld): Debug: remote(/var/run/dovecot/doveadm-server): auth-master: userdb lookup(postmaster(a)domain.tld): auth USER input: postmaster(a)domain.tld mail=maildir:/mails/2/domain.tld/postmaster/Maildir:INDEX=/var/lib/dovecot/indexes/domain.tld/postmaster@domain.tld home=/mails/2/domain.tld/postmaster quota_rule=*:storage=3145728000b:messages=500k doveadm(postmaster(a)domain.tld): Debug: remote(/var/run/dovecot/doveadm-server): auth-master: userdb lookup(postmaster(a)domain.tld): Finished userdb lookup (username=postmaster(a)domain.tld mail=maildir:/mails/2/domain.tld/postmaster/Maildir:INDEX=/var/lib/dovecot/indexes/domain.tld/postmaster@domain.tld home=/mails/2/domain.tld/postmaster quota_rule=*:storage=3145728000b:messages=500k) doveadm(postmaster(a)domain.tld): Debug: remote(/var/run/dovecot/doveadm-server): Added userdb setting: mail=maildir:/mails/2/domain.tld/postmaster/Maildir:INDEX=/var/lib/dovecot/indexes/domain.tld/postmaster@domain.tld doveadm(postmaster(a)domain.tld): Debug: remote(/var/run/dovecot/doveadm-server): Added userdb setting: plugin/quota_rule=*:storage=3145728000b:messages=500k doveadm(postmaster(a)domain.tld): Debug: remote(/var/run/dovecot/doveadm-server): Effective uid=65534, gid=65534, home=/mails/2/domain.tld/postmaster doveadm(postmaster(a)domain.tld): Debug: remote(/var/run/dovecot/doveadm-server): Quota root: name=Mailbox backend=count args= doveadm(postmaster(a)domain.tld): Debug: remote(/var/run/dovecot/doveadm-server): Quota rule: root=Mailbox mailbox=* bytes=3145728000 messages=512000 doveadm(postmaster(a)domain.tld): Debug: remote(/var/run/dovecot/doveadm-server): Quota grace: root=Mailbox bytes=314572800 (10%) doveadm(postmaster(a)domain.tld): Debug: remote(/var/run/dovecot/doveadm-server): Namespace inbox: type=private, prefix=INBOX., sep=., inbox=yes, hidden=no, list=yes, subscriptions=yes location=maildir:/mails/2/domain.tld/postmaster/Maildir:INDEX=/var/lib/dovecot/indexes/domain.tld/postmaster@domain.tld doveadm(postmaster(a)domain.tld): Debug: remote(/var/run/dovecot/doveadm-server): maildir++: root=/mails/2/domain.tld/postmaster/Maildir, index=/var/lib/dovecot/indexes/domain.tld/postmaster(a)domain.tld, indexpvt=, control=, inbox=/mails/2/domain.tld/postmaster/Maildir, alt= doveadm(postmaster(a)domain.tld): Debug: remote(/var/run/dovecot/doveadm-server): Namespace : type=private, prefix=, sep=, inbox=no, hidden=yes, list=no, subscriptions=no location=fail::LAYOUT=none doveadm(postmaster(a)domain.tld): Debug: remote(/var/run/dovecot/doveadm-server): none: root=, index=, indexpvt=, control=, inbox=, alt= doveadm(postmaster(a)domain.tld): Debug: remote(/var/run/dovecot/doveadm-server): quota: quota_over_flag check: quota_over_script unset - skipping doveadm(postmaster(a)domain.tld): Debug: remote(/var/run/dovecot/doveadm-server): brain M: Namespace INBOX. has location maildir:/mails/2/domain.tld/postmaster/Maildir:INDEX=/var/lib/dovecot/indexes/domain.tld/postmaster@domain.tld doveadm(postmaster(a)domain.tld): Debug: remote(/var/run/dovecot/doveadm-server): Namespace INBOX.: Using permissions from /mails/2/domain.tld/postmaster/Maildir: mode=0700 gid=default doveadm(postmaster(a)domain.tld): Error: remote(/var/run/dovecot/doveadm-server): read(root(a)server2.domain.tld) failed: EOF (version not received) doveadm(postmaster(a)domain.tld): Debug: remote(/var/run/dovecot/doveadm-server): auth-master: conn unix:/var/run/dovecot/auth-userdb (pid=118292,uid=0): Disconnected: Connection closed (fd=15) On the destination server, I can see that the destination server is well retrieving the user's info in userdb, before saying : server2 dovecot: doveadm: Error: read(<local>) failed: EOF (version not received) I tried to activate verbosity everywhere, but It does not show anything, like : ssh -v -lroot server2.domain.tld doveadm dsync-server -upostmaster(a)domain.tld -U debug1: Authentication succeeded (publickey). Authenticated to server2;domain.tld ([w.x.y.z]:22). debug1: channel 0: new [client-session] debug1: Requesting no-more-sessions(a)openssh.com debug1: Entering interactive session. debug1: pledge: network debug1: client_input_global_request: rtype hostkeys-00(a)openssh.com want_reply 0 debug1: Remote: /root/.ssh/authorized_keys:4: key options: agent-forwarding port-forwarding pty user-rc x11-forwarding debug1: Remote: /root/.ssh/authorized_keys:4: key options: agent-forwarding port-forwarding pty user-rc x11-forwarding debug1: Sending environment. debug1: Sending env LANG = fr_FR.UTF-8 debug1: Sending command: doveadm dsync-server -upostmaster(a)domain.tld -U debug1: client_input_channel_req: channel 0 rtype exit-status reply 0 debug1: client_input_channel_req: channel 0 rtype eow(a)openssh.com reply 0 debug1: channel 0: free: client-session, nchannels 1 Transferred: sent 2800, received 2820 bytes, in 0.1 seconds Bytes per second: sent 25466.2, received 25648.1 debug1: Exit status 0 If somebody can tell me some hints to go further, it'll be very apreciate. Thanks ! Here is the doveconf -n output (the two servers have the same) # 2.3.11.3 (502c39af9): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.11 (6c69c917) # OS: Linux 4.19.0-12-amd64 x86_64 Debian 10.6 # Hostname: server1 auth_cache_negative_ttl = 0 auth_cache_size = 100 M auth_cache_ttl = 5 mins auth_master_user_separator = * default_client_limit = 2000 disable_plaintext_auth = no doveadm_api_key = # hidden, use -P to show it doveadm_worker_count = 50 listen = w.x.y.z mail_fsync = always mail_gid = nogroup mail_location = maildir:~/Maildir:INDEX=/var/lib/dovecot/indexes/%d/%n mail_max_userip_connections = 300 mail_plugins = quota mail_uid = nobody maildir_very_dirty_syncs = yes namespace inbox { inbox = yes location = mailbox Drafts { auto = subscribe special_use = \Drafts } mailbox Junk { auto = subscribe autoexpunge = 90 days special_use = \Junk } mailbox Sent { auto = subscribe special_use = \Sent } mailbox "Sent Messages" { auto = no special_use = \Sent } mailbox Trash { auto = subscribe autoexpunge = 90 days special_use = \Trash } prefix = INBOX. separator = . } passdb { args = /etc/dovecot/master-users driver = passwd-file master = yes result_success = continue } passdb { args = /etc/dovecot/dovecot-sql.conf.ext driver = sql } plugin { imapsieve_mailbox1_before = file:/var/lib/dovecot/sieve/report-spam.sieve imapsieve_mailbox1_causes = COPY imapsieve_mailbox1_name = INBOX.Junk imapsieve_mailbox2_before = file:/var/lib/dovecot/sieve/report-ham.sieve imapsieve_mailbox2_causes = COPY imapsieve_mailbox2_from = INBOX.Junk imapsieve_mailbox2_name = * quota = count:Mailbox quota_rule = *:storage=1G:messages=500k quota_vsizes = yes sieve = file:~/sieve;active=~/.dovecot.sieve sieve_before = /var/lib/dovecot/sieve/antispam.sieve sieve_global_extensions = +vnd.dovecot.pipe +vnd.dovecot.environment +spamtest +spamtestplus sieve_pipe_bin_dir = /var/lib/dovecot/sieve sieve_plugins = sieve_imapsieve sieve_extprograms sieve_spamtest_max_header = X-Spam-Status: [[:alnum:]]+, score=-?[[:digit:]]+\.[[:digit:]] required=([[:digit:]]+\.[[:digit:]]).* sieve_spamtest_status_header = X-Spam-Status: [[:alnum:]]+, score=(-?[[:digit:]]+\.[[:digit:]]) sieve_spamtest_status_type = score } pop3_fast_size_lookups = yes pop3_reuse_xuidl = yes pop3_save_uidl = yes pop3_uidl_format = %f protocols = imap pop3 lmtp service anvil { client_limit = 5000 unix_listener anvil-auth-penalty { mode = 00 } } service auth { client_limit = 0 } service doveadm { inet_listener http { port = 8080 } vsz_limit = 2 G } service imap-login { process_limit = 2000 service_count = 1 } service imap { client_limit = 1 process_limit = 5000 vsz_limit = 1 G } service indexer-worker { process_limit = 20 } service lmtp { client_limit = 1 inet_listener lmtp { port = 24 } process_limit = 200 process_min_avail = 20 vsz_limit = 1 G } service pop3-login { process_limit = 2000 service_count = 1 } ssl = no submission_host = smtp.domain.tld:25 userdb { args = /etc/dovecot/dovecot-sql.conf.ext driver = sql } protocol lmtp { mail_plugins = quota sieve } protocol imap { mail_plugins = quota imap_sieve imap_quota }

1 0

Any RPMs for aarch64 available?
by Peter Cooper Jr. 04 Dec '20

04 Dec '20

Hey, I really appreciate Dovecot being available with standard repos in repo.dovecot.org. I'm currently using the "CentOS 7" one on Amazon Linux 2 and it works great for x86_64. I'm wondering if there are any plans for also providing arm builds (aarch64) at some point? Or if they're available somewhere else already? I may play around with compiling things myself, but just downloading an official package is generally the easier way to go so I thought it couldn't hurt to ask. Thanks, Peter

3 4

follow up to my mail issues I posted about
by Christy S 02 Dec '20

02 Dec '20

Okay. A few days late, but I've gone through the replies I received from several of you and consolidated responses into one mail. Of course life gets crazy when I need to sit down and work on things. "It seems to me Thunderbird is struggling to write to the Sent mailbox, so disk space, and file permissions are the obvious ones to check. And yes, on the server rather than your local machine, as you're using IMAP" It's definitely not disc space. I wouldn't think an upgrade would change permissions, but it's a place to check. I'm showing my newbieness here but, I'm not even sure what account should have access to those files. I know, it's a miracle I got all this working in the first place. I should have taken notes, but I did so much fiddling with this and that to make it behave that I didn't know what to write down. "Anything interesting in the dovecot logs at the time when you check?" So I looked up dovecot logs on google, and what I'm seeing is that dovecot generally writes to mail logs under /var/log. The stuff I sent in my first email came from mail.err in that folder. The only other file I could find was mail.log. Using tail on that file, I see entries like these. Dec 2 20:53:07 kylesmith-music postfix/smtpd[396853]: warning: unknown[212.70.149.37]: SASL LOGIN authentication failed: UGFzc3dvcmQ6 Dec 2 20:53:07 kylesmith-music postfix/smtpd[396853]: disconnect from unknown[212.70.149.37] ehlo=1 auth=0/1 rset=1 quit=1 commands=3/4 There are similar entries from a different ip address, but interestingly neither match the ip address of our fiber modem so I have no idea what's going on there. "First, do you have a backup prior to upgrading the server? You may want to refer to that to get a clean idea of how the configuration was set up initially. Sometimes the upgrade process can reset configuration files and its usually easier to work from a known working configuration. " I really wish I did, but I'm not sure how to effectively back up a VPS. "Second, can you describe how you set the mail stack you are using up?" I can tell you it's postfix and dovecot. That's what a lot of articles recommended, so I went with that. We use different devices so I chose to use imap as it interfaces directly with the stored mail on the server. Usually this is good, except now when it breaks. "Its possible the issue is SSL related but its difficult to say. There have been a number of breaks with SSL encryption in recent years which is why the cipher list has been adjusted," SSL is definitely my weakest point of knowledge. I know I had it working smoothly but it was basically following how to stuff. The reason we're using it even for mail has to do with someone in my husband's life who would get in and mess things up if he had the chance, so I'm trying to make sure he doesn't have that chance by locking things down tight. "google can also be out of date I'd recommend using a date filter when using it for checking configurations and limit it only to the last 1-2 years as you will get more relevant information typically." Oh my gosh, that alone would be extremely helpful. The number of seriously outdated articles I had to filter through when I set this up in the first place is just unreal. Mind telling me how to do a date filter? Otherwise, I'll google how to use google, hahaha. "The configuration parameter for the cipher list uses HIGH as a default profile and if I recall correctly that disables lower TLS versions that are susceptible to certain types of attacks. (SSL3,TLS1,TLS1.1,1.2 I think) The dovecot documentation explains what the defaults are for HIGH. The ! prevents using specifica protocols and configuration is usually a chain (processed from left to right until a match is found). DH is the diffie-helman exchange. Usually this file is recalculated on a per server basis to prevent pre-calculation attacks on SSL and usually it must meet a certain key length. DH Groups 1 and 2 are known to be insecure." Okay, that went way over my head, but it sounds like good information to have and study up more on, hopefully after I get the immediate issue solved. If I'm following you correctly at all though I could see that potentially being my issue, hmm. I will for sure see if I can get my hands on that book. "Some quick thoughts here — if the changes you mentioned did not solve the issue, I would definitely comment those back out so you are only troubleshooting one thing at a time." Fair point. I commented out the one about dh high, then hopefully reloaded the configuration, dovecot reload? That done, I tried sending an email from the domain to my gmail using thunderbird. I got the same message, but it did actually send this time. However, when I replied to the test message with my gmail account, it wasn't received by thunderbird. I do see it using the mail app on the server, though. "Next, are you able to send email using any other client?" I can send mail locally on the server from one account to another for sure. I managed it once, at least. Those mail clients seem clunky though so I may not be doing things correctly to test. "Third, try disabling all SSL and see if you are able to send via Thunderbird or really, any client at all…" Is there an easy way to disable ssl for now and then reenable it? That would definitely help narrow this down. "Your DH parameters are too weak. You should generate at least 2048 byte parameters." To be honest, I don't even recall setting up DH parameters. I would guess that probably happened when I was setting up ssl? Again, thank you to each of you for helping with this. I really try not to send stuff like this to mailing lists that are technical in nature, but this is important business mail he's potentially missing and I'm a bit out of my league. First project once this gets fixed will be learning how to back up the server. Christy

3 2