- dovecot - dovecot.org

Re: Dovecot permission denied errors on NFS after upgrade to 2.2.17
by Claudio Corvino 29 Sep '20

29 Sep '20

Thanks Jochen, no mixups present at all, file assigned to UID 501. Since this problem started few hours after the Debian upgrade, I think it is related to it. I don't know if something has changed on the NFS client side on Debian, but I don't think so as aptlistchanges didn't notify me about it, nor if Dovecot 2.2.17 treat NFS in other way. I'm stuck. On 13/07/20 16:07, Jochen Bern wrote: > On 07/13/2020 03:45 PM, Claudio Corvino wrote: >> in addition the "permission denied" error is >> random, most of the time Dovecot works well. > In *that* case, I'd say that UID/GID mapping problems can be ruled out. > >> How can I check the mappings NFS uses? > You don't have any relevant options in the client's fstab entry, and > I'll assume that there are none in the server's /etc/exports, either. > That leaves only potential default mappings, which should be documented > in the corresponding manpages. > > Also, since there's only *one* user/group involved, you can always > "chown" a test file on one side and check with "ls -n" on the other to > verify whether there are mixups. > > *Intermittent* failures of an NFS mount over a well-functioning LAN ... > I'm thinking "file locking" now, but that's a *complicated* topic, to > say the least ... > > https://en.wikipedia.org/wiki/File_locking#Problems > https://unix.stackexchange.com/questions/553645/how-to-install-nfslock-daem… > > Regards,

4 8

Re-sieve emails
by ＠lbutlr 29 Sep '20

29 Sep '20

Is it possible to take the contents of a mailbox and feed them to the account's .active_sieve file for reprocessing? (For example, when editing the sieve file for my list account I introduced a typo, so a hundred or some list messages ended up in the inbox instead of filed properly into the maildir hierarchy. Not a huge deal, as it was simple enough to move them manually, but it got me wondering. This would also be useful for testing. -- Clarke's Law: Sufficiently advanced technology is indistinguishable from magic Clark's Law: Sufficiently advanced cluelessness is indistinguishable from malice Clark Slaw: Anything that has been severely damaged or destroyed by application of Clark's Law

2 4

dovecot warns (non-fatal) "invalid EHLO response line: Unexpected character in EHLO keyword" connecting to submission relay ?
by PGNet Dev 29 Sep '20

29 Sep '20

I'm setting up an alternative submission relay host for dovecot. Atm, it's pointing @ fastmail.com. with dovecot config, submission_relay_host = smtp.fastmail.com submission_relay_port = 465 submission_relay_ssl = smtps submission_relay_ssl_verify = no submission_relay_trusted = yes submission_relay_user = 'acctID(a)mydomain.com' submission_relay_password = 'acctPWD' submission relay via dovecot proxy works as expected -- mail's delivered/received by intended recipient. in local dovecot logs I notice ==> /var/log/dovecot/dovecot.log <== 2020-09-24 16:22:19 submission(recipient(a)example.com)<xxxxxxxxxxxxxxxx>: Warning: smtp-client: conn smtp.fastmail.com:465 (66.111.4.140:465) [1]: Received invalid EHLO response line: Unexpected character in EHLO keyword at debug level ==> /var/log/dovecot/dovecot-debug.log <== 2020-09-24 16:22:19 submission(recipient(a)example.com)<xxxxxxxxxxxxxxxx>: Debug: smtp-client: conn smtp.fastmail.com:465 (66.111.4.140:465) [1]: command EHLO: Got reply (1/1): 250 mail.messagingengine.com PIPELINING SIZE 73000000 AUTH DIGEST-MD5 CRAM-MD5 NTLM LOGIN PLAIN AUTH=DIGEST-MD5 CRAM-MD5 NTLM LOGIN PLAIN ENHANCEDSTATUSCODES 8BITMIME (1 commands pending, 0 commands queued) it's clearly non-fatal, simply a warning. i certainly do _not_ see this with every relay host, so suspect it's unique to fastmail's EHLO response. at least within the set of hosts I've tested. i'd like to find/fix it ... either at my dovecot instance, or @ fastmail. what's specifically invalid about 250 mail.messagingengine.com PIPELINING SIZE 73000000 AUTH DIGEST-MD5 CRAM-MD5 NTLM LOGIN PLAIN AUTH=DIGEST-MD5 CRAM-MD5 NTLM LOGIN PLAIN ENHANCEDSTATUSCODES 8BITMIME by dovecot's 'measure'?

3 3

managesieve script 'redirect' fails @ "Error: sieve: ... aborted due to temporary failure; Error: smtp-server: ... failed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number"; direct send OK ?
by PGNet Dev 29 Sep '20

29 Sep '20

I run dovecot --version 2.3.10.1 (a3d0e1171) postconf mail_version mail_version = 3.5.7 with three valid accounts on the server, user1(a)example1.net user2(a)example2.net admin(a)mx.example.com I can send/receive from each -- both to/from external addresses, as well as between one another. E.g., on mail sent to user2(a)example2.net -> admin(a)mx.example.com logs of the successful delivery are ==> /var/log/dovecot/dovecot-info.log <== 2020-09-26 16:00:33 submission-login: Info: Login: user=<sender(a)mx.example.com>, method=PLAIN, rip=10.0.1.9, lip=10.0.1.17, mpid=7178, TLS 2020-09-26 16:00:33 submission(sender(a)mx.example.com)<gQePZj+wUuesHgsH>: Info: Successfully relayed message: from=<user2(a)example2.net>, size=449, id=WjpMLRHIb18KHAAA+IOfAw, nrcpt=1, reply=`250 2.0.0 Ok: queued as 4BzPQ95QwwzWf9g' 2020-09-26 16:00:33 submission(sender(a)mx.example.com)<gQePZj+wUuesHgsH>: Info: Disconnect from 10.0.1.9: Client has quit the connection in=566 out=114 (state=READY) 2020-09-26 16:00:33 imap(user2(a)example2.net)<YzPbWj+wzNCsHgsH>: Info: save: box=Sent, uid=42, msgid=<9ca622bd-cdc3-ca26-8650-556d4132fe6c(a)example2.net>, size=434 2020-09-26 16:00:33 lmtp(7183): Info: Connect from local 2020-09-26 16:00:33 lmtp(admin(a)mx.example.com)<2HI4MBHIb18PHAAA+IOfAw>: Info: msgid=<9ca622bd-cdc3-ca26-8650-556d4132fe6c(a)example2.net>: saved mail to INBOX 2020-09-26 16:00:33 lmtp(7183): Info: Disconnect from local: Client has quit the connection (state=READY) ==> /var/log/postfix/postfix.log <== Sep 26 16:00:33 mx postfix/submit-from-dovecot-proxy/smtpd[7179]: connect from internal.mx.example.com[10.0.1.17] Sep 26 16:00:33 mx postfix/submit-from-dovecot-proxy/smtpd[7179]: Trusted TLS connection established from internal.mx.example.com[10.0.1.17]: TLSv1.3 with cipher TLS_CHACHA20_POLY1305_SHA256 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-384) server-digest SHA384 client-signature ECDSA (P-384) client-digest SHA384 Sep 26 16:00:33 mx postfix/submit-from-dovecot-proxy/smtpd[7179]: 4BzPQ95QwwzWf9g: client=internal.mx.example.com[10.0.1.17] Sep 26 16:00:33 mx postfix/qmgr[6928]: 4BzPQ95QwwzWf9g: from=<user2(a)example2.net>, size=824, nrcpt=1 (queue active) Sep 26 16:00:33 mx postfix/submit-from-dovecot-proxy/smtpd[7179]: disconnect from internal.mx.example.com[10.0.1.17] ehlo=1 mail=1 rcpt=1 data=1 quit=1 commands=5 Sep 26 16:00:33 mx postfix/lmtp[7182]: 4BzPQ95QwwzWf9g: to=<admin(a)mx.example.com>, relay=mx.example.com[private/dovecot-lmtp], delay=0.06, delays=0.03/0.01/0.01/0.02, dsn=2.0.0, status=sent (250 2.0.0 <admin(a)mx.example.com> 2HI4MBHIb18PHAAA+IOfAw Saved) Sep 26 16:00:33 mx postfix/qmgr[6928]: 4BzPQ95QwwzWf9g: removed ==> /var/log/dovecot/dovecot-info.log <== 2020-09-26 16:00:33 imap(user2(a)example2.net)<YzPbWj+wzNCsHgsH>: Info: Connection closed (IDLE running for 0.001 + waiting input for 0.009 secs, 2 B in + 10 B out, state=wait-input) in=1199 out=3082 deleted=0 expunged=0 trashed=0 hdr_count=1 hdr_bytes=271 body_count=0 body_bytes=0 2020-09-26 16:00:33 imap-login: Info: Login: user=<user2(a)example2.net>, method=PLAIN, rip=10.0.1.9, lip=10.0.1.17, mpid=7185, TLS I've added a user sieve script for user == user2(a)example2.net cat /srv/mail/sieve-scripts/user2(a)example2.net.sieve # rule:[SIEVETEST] if header :contains "subject" "SIEVETEST" { redirect "admin(a)mx.example.com"; } where the redirect is to the valid address tested/demonstrated above, admin(a)mx.example.com in dovecot config, submission_host = internal.mx.example.com:60465 currently, host mx.example.com mx.example.com has address 10.0.1.17 mx.example.com has IPv6 address fd70:10:0:1::17 host internal.mx.example.com internal.mx.example.com has address 10.0.1.17 internal.mx.example.com has IPv6 address fd70:10:0:1::17 on test send from user1(a)example1.net to user2(a)example2.net, with Subject == SIEVETEST the user sieve _is_ triggered/executed cat 20200926-160636.7461.1.trace Sieve trace log for message delivery: Username: user2(a)example2.net Session ID: E851MXzJb18lHQAA+IOfAw Sender: <user1(a)example1.net> Final recipient: <user2(a)example2.net> Default mailbox: INBOX ## Started executing script 'managesieve' 2: not jumping 4: redirect action 4: forward message to address <admin(a)mx.example.com> ## Finished executing script 'managesieve' but the mail redirect delivery fails 2020-09-26 16:06:36 submission-login: Info: Login: user=<sender(a)mx.example.com>, method=PLAIN, rip=10.0.1.9, lip=10.0.1.17, mpid=7455, TLS 2020-09-26 16:06:36 submission(sender(a)mx.example.com)<VbsxfD+wXOesHgsH>: Info: Successfully relayed message: from=<user1(a)example1.net>, size=466, id=lvK6LnzJb18fHQAA+IOfAw, nrcpt=1, reply=`250 2.0.0 Ok: queued as 4BzPY85g9czWf8L' 2020-09-26 16:06:36 submission(sender(a)mx.example.com)<VbsxfD+wXOesHgsH>: Info: Disconnect from 10.0.1.9: Client has quit the connection in=567 out=114 (state=READY) 2020-09-26 16:06:36 lmtp(7461): Info: Connect from local 2020-09-26 16:06:36 imap(user1(a)example1.net)<0ZZlej+w2NCsHgsH>: Info: save: box=Sent, uid=13177, msgid=<28930f55-5a39-c8bd-67c2-39e581aa7551(a)example1.net>, size=450 ==> /var/log/postfix/postfix.log <== Sep 26 16:06:36 mx postfix/submit-from-dovecot-proxy/smtpd[7456]: connect from internal.mx.example.com[10.0.1.17] Sep 26 16:06:36 mx postfix/submit-from-dovecot-proxy/smtpd[7456]: Trusted TLS connection established from internal.mx.example.com[10.0.1.17]: TLSv1.3 with cipher TLS_CHACHA20_POLY1305_SHA256 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-384) server-digest SHA384 client-signature ECDSA (P-384) client-digest SHA384 Sep 26 16:06:36 mx postfix/submit-from-dovecot-proxy/smtpd[7456]: 4BzPY85g9czWf8L: client=internal.mx.example.com[10.0.1.17] Sep 26 16:06:36 mx postfix/qmgr[7362]: 4BzPY85g9czWf8L: from=<user1(a)example1.net>, size=812, nrcpt=1 (queue active) Sep 26 16:06:36 mx postfix/submit-from-dovecot-proxy/smtpd[7456]: disconnect from internal.mx.example.com[10.0.1.17] ehlo=1 mail=1 rcpt=1 data=1 quit=1 commands=5 ==> /var/log/dovecot/dovecot.log <== 2020-09-26 16:07:06 lmtp(user2(a)example2.net)<E851MXzJb18lHQAA+IOfAw>: Error: smtp-client: conn internal.mx.example.com:60465 (10.0.1.17:60465) [1]: connect(internal.mx.example.com:60465) failed: Connection timed out after 30 seconds 2020-09-26 16:07:06 lmtp(user2(a)example2.net)<E851MXzJb18lHQAA+IOfAw>: Error: sieve: msgid=<28930f55-5a39-c8bd-67c2-39e581aa7551(a)example1.net>: redirect action: failed to redirect message to <admin(a)mx.example.com>: smtp(internal.mx.example.com:60465): RCPT TO failed: Connect timed out (temporary failure) 2020-09-26 16:07:06 lmtp(user2(a)example2.net)<E851MXzJb18lHQAA+IOfAw>: Error: sieve: Execution of script /srv/mail/sieve-scripts/user2(a)example2.net.sieve was aborted due to temporary failure (user logfile /srv/mail/sieve-scripts/user2(a)example2.net.sieve.log may reveal additional details) 2020-09-26 16:07:06 submission-login: Error: smtp-server: conn 10.0.1.17:50578 [1]: Connection lost: read((conn:10.0.1.17:50578,id=1)) failed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number 2020-09-26 16:07:06 submission-login: Info: Read failure (client didn't send a cert): user=<>, rip=10.0.1.17, lip=10.0.1.17, TLS handshaking: SSL_accept() syscall failed: Invalid argument 2020-09-26 16:07:06 lmtp(7461): Info: Disconnect from local: Client has quit the connection (state=READY) ==> /var/log/postfix/postfix.log <== Sep 26 16:07:06 mx postfix/lmtp[7460]: 4BzPY85g9czWf8L: to=<user2(a)example2.net>, relay=mx.example.com[private/dovecot-lmtp], delay=30, delays=0.04/0/0/30, dsn=4.2.0, status=deferred (host mx.example.com[private/dovecot-lmtp] said: 451 4.2.0 <user2(a)example2.net> Execution of Sieve filters was aborted due to temporary failure (in reply to end of DATA command)) & cat /srv/mail/sieve-scripts/user2(a)example2.net.sieve.log sieve: info: started log at Sep 26 16:07:06. error: msgid=<28930f55-5a39-c8bd-67c2-39e581aa7551(a)example1.net>: redirect action: failed to redirect message to <admin(a)mx.example.com>: smtp(internal.mx.example.com:60465): RCPT TO failed: Connect timed out (temporary failure). and remains stuck in postfix queue postqueue -p ----Queue ID----- --Size-- ---Arrival Time---- --Sender/Recipient------ 4BzPY85g9czWf8L 812 Sat Sep 26 16:06:36 user1(a)example1.net (host mx.example.com[private/dovecot-lmtp] said: 451 4.2.0 <user2(a)example2.net> Execution of Sieve filters was aborted due to temporary failure (in reply to end of DATA command)) user2(a)example2.net -- 0 Kbytes in 1 Request. it appears there's an SSL/cert problem -- but only in the case of the redirect. i.e.., this direct send, user2(a)example2.net --SEND--> admin(a)mx.example.com works, but the redirect user1(a)example1.net (subjet == "SIEVETEST") --SEND--> user2(a)example2.net --REDIRECT--> admin(a)mx.example.com does not, failing as above. i suspect i'm missing config, but what/where in the dovecot submission/sieve configs addresses this^ point in the SSL transaction?

1 3

maildir -> sdbox migration command for _all_ accounts, with split maildir/CONTROL/INDEX locations?
by PGNet Dev 26 Sep '20

26 Sep '20

in a recent post, sven made a clear/cogent arg for sdbox vs maildir > While Maildir seems to be an obvious choice, it has some hidden > performance impacts, namely it relies heavily on information encoded in > the filename, which results in a big overhead in meta-operations, > because Dovecot needs to stat() every file in a directory to gather > those information. i've initially avoided sdbox, assuming the index-file dependency to be an additional failure pt, but that^^ is somewhat compelling. i'd like to migrate maildir -> sdbox. the given migration example $ doveadm -D -v -o backup -u sven sdbox:~/sdbox examples in the docs generally demonstrate a single user migration, from a consolidated ~/Maildir tree, and use the 'dsync ...' command (full alias?) atm, my 'mail_location' is set with split CONTROL & INDEX locations, in fs-layout, as mail_location = maildir:/data/vmail/%d/%n/Maildir:CONTROL=/data/vmail/%d/%n/_control:INDEX=/var/vmail-index/%d/%n:LAYOUT=fs:UTF-8 and I've a significant number of domains & users. I'd like to migrate the ENTIRE server -- all domain/user accounts. For the moment, I'd like to ensure that I do not change/destroy the current Maildir stores/indexes, and end up with a parallel store in mail_location = sdbox:/data/vmail/%d/%n/Sdbox:CONTROL=/data/vmail/sdbox/%d/%n/_control:INDEX=/var/sdbox/vmail-index/%d/%n:LAYOUT=fs:UTF-8 which I can then double-check, and eventually switch to. What's the correct procedure/syntax for an all-accounts, in-place migration command from maildir->sdbox?

1 0

Shared folders using mbox format
by Alex 26 Sep '20

26 Sep '20

Hi, I'd like to create a shared folder to be used with an Outlook client and a Thunderbird client. We're currently using mboxes. I've read the documentation here about creating a shared folder: https://wiki.dovecot.org/SharedMailboxes/Shared It doesn't make reference to how to do this using mbox format. Is it possible? Should we convert to Maildir? Perhaps there's a way to provide both formats?

3 4

dovecot TSL 1.3 config option 'ssl_ciphersuites' causes fatal error on launch. not supported, bad config, or bug?
by PGNet Dev 24 Sep '20

24 Sep '20

I've installed grep PRETTY /etc/os-release PRETTY_NAME="Fedora 32 (Server Edition)" dovecot --version 2.3.10.1 (a3d0e1171) openssl version OpenSSL 1.1.1g FIPS 21 Apr 2020 iiuc, Dovecot has apparently had support for setting TLS 1.3 ciphersuites since v2.3.9, per this commit lib-ssl-iostream: Support TLSv1.3 ciphersuites https://github.com/dovecot/core/commit/8f6f04eb21276f28b81695dd0d3df57c7b8f… checking openssl rpm -ql openssl-devel-1.1.1g-1.fc32.x86_64 | grep -i ciphersuites /usr/share/man/man3/SSL_CTX_set_ciphersuites.3ssl.gz /usr/share/man/man3/SSL_set_ciphersuites.3ssl.gz man SSL_set_ciphersuites ... SSL_set_cipher_list() sets the list of ciphers (TLSv1.2 and below) only for ssl. SSL_CTX_set_ciphersuites() is used to configure the available TLSv1.3 ciphersuites for ctx. This is a simple colon (":") separated list of TLSv1.3 ciphersuite names in order of preference. Valid TLSv1.3 ciphersuite names are: TLS_AES_128_GCM_SHA256 TLS_AES_256_GCM_SHA384 TLS_CHACHA20_POLY1305_SHA256 TLS_AES_128_CCM_SHA256 TLS_AES_128_CCM_8_SHA256 An empty list is permissible. The default value for the this setting is: "TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256" SSL_set_ciphersuites() is the same as SSL_CTX_set_ciphersuites() except it configures the ciphersuites for ssl. ... checkin in dovecot tag 2.3.10.1's src, m4/ssl.m4 (m4) ... AC_CHECK_LIB(ssl, SSL_CTX_set_ciphersuites, [ AC_DEFINE(HAVE_SSL_CTX_SET_CIPHERSUITES,, [Build with SSL_CTX_set_ciphersuites() support]) ],, $SSL_LIBS) ... and, src/lib-ssl-iostream/iostream-openssl.c ... #ifdef HAVE_SSL_CTX_SET_CIPHERSUITES if (set->ciphersuites != NULL && strcmp(ctx_set->ciphersuites, set->ciphersuites) != 0) { if (SSL_set_ciphersuitesl(ssl_io->ssl, set->ciphersuites) == 0) { *error_r = t_strdup_printf( "Can't set ciphersuites to '%s': %s", set->ciphersuites, openssl_iostream_error()); return -1; } } #endif ... suggests that ciphersuite support exists. bug, checking in ./src/lib-master/master-service-ssl.c ... void master_service_ssl_ctx_init(struct master_service *service) { const struct master_service_ssl_settings *set; struct ssl_iostream_settings ssl_set; const char *error; if (service->ssl_ctx_initialized) return; service->ssl_ctx_initialized = TRUE; /* must be called after master_service_init_finish() so that if initialization fails we can close the SSL listeners */ i_assert(service->listeners != NULL || service->socket_count == 0); set = master_service_ssl_settings_get(service); if (strcmp(set->ssl, "no") == 0) { /* SSL disabled, don't use it */ return; } i_zero(&ssl_set); ssl_set.min_protocol = set->ssl_min_protocol; ssl_set.cipher_list = set->ssl_cipher_list; ssl_set.curve_list = set->ssl_curve_list; ssl_set.ca = set->ssl_ca; ... there's only mention of set->ssl_cipher_list , not set->ssl_ciphersuites or equivalent, afaict. if in dovecot's 10-ssl.conf I set ssl_cipher_list = ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256 + ssl_ciphersuites = TLS_CHACHA20_POLY1305_SHA256:TLS_AES_256_GCM_SHA384:TLS_AES_128_GCM_SHA256 on restart journalctl -f -u dovecot -- Logs begin at Sun 2020-09-20 14:30:30 PDT. -- Sep 23 18:28:42 mx.example.com dovecot[4269]: doveconf: Fatal: Error in configuration file /etc/dovecot/conf.d/10-ssl.conf line 92: Unknown setting: ssl_ciphersuites _is_ setting TLS 1.3 ssl_ciphersuites = in fact currently supported, and usage is wrong here^?

3 3

Importing Mail
by Odhiambo Washington 24 Sep '20

24 Sep '20

Hi good people, I have an old server that holds old mail (mdbox) and a new server that also uses mdbox. I'd like to import the old mail from the old server into the live/new server. The imported mail should not be treated as new mail for the existing mail accounts. What is the best way to achieve this? Lastly, is there a way to convert mdbox to Maildir? -- Best regards, Odhiambo WASHINGTON, Nairobi,KE +254 7 3200 0004/+254 7 2274 3223 "Oh, the cruft.", grep ^[^#] :-)

2 2

Vacation sieve explained: how does it work?
by Graham Leggett 24 Sep '20

24 Sep '20

Hi all, I have a legacy system that uses gnarwl to handle vacation messages, most specifically the vacation messages are stored in LDAP. We have a web based tool that allows people to update their vacation message, all they’re doing is modifying LDAP. I am trying to find out if dovecot’s vacation sieve can do the same thing. I am struggling however to find something that describes to me how dovecot vacation sieve is configured. Is there a howto or walkthrough anywhere? Specific burning questions: - If I was to configure the dovecot vacation sieve, where is the body of each vacation message stored? File on disk? In a store like an LDAP store? Somewhere else? - How is the body of vacation message modified? Does this happen through the IMAP protocol, a command line tool, something else? - How is the vacation message switched on and off? Does this happen through the IMAP protocol, a command line tool, or something else? The docs at https://wiki2.dovecot.org/Pigeonhole/Sieve/Extensions/Vacation describe how to control how often the vacation messages are sent, but very little else. I am very confused :( Regards, Graham —

4 8

BUG: _presence_ of valid openssl.cnf Option = 'ServerPreference' causes Dovecot submission relay FAIL: "failed: Failed to initialize SSL: ..."
by PGNet Dev 24 Sep '20

24 Sep '20

I've dovecot --version 2.3.10.1 (a3d0e1171) openssl version OpenSSL 1.1.1g FIPS 21 Apr 2020 , atm on Fedora32. I configure /etc/pki/tls/openssl.cnf to set preferences for apps' usage, e.g. Postfix etc; Typically, here cat /etc/pki/tls/openssl.cnf openssl_conf = default_conf [default_conf] ssl_conf = ssl_sect [ssl_sect] system_default = system_default_sect [system_default_sect] MinProtocol = TLSv1.2 Ciphersuites = TLS_CHACHA20_POLY1305_SHA256:TLS_AES_256_GCM_SHA384:TLS_AES_128_GCM_SHA256 CipherString = ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA256 Options = PrioritizeChaCha,ServerPreference However, any/all sends from local client via Dovecot submission -- from an instance on the same server -- FAILS with that^^ openssl.cnf, ==> /var/log/dovecot/dovecot.log <== ... 2020-08-24 17:04:42 submission(testuser(a)example.com)<D4c5c6itUg2sHgsH>: Error: smtp-client: conn int.mx.example.net:465 (10.0.4.65:465) [1]: connect(int.mx.example.net:465) failed: Failed to initialize SSL: Couldn't initialize SSL context: Can't load SSL certificate: error:14187180:SSL routines:ssl_do_config:bad value: section=system_default, cmd=Options, arg=ServerPreference,PrioritizeChaCha 2020-08-24 17:04:42 submission(testuser(a)example.com)<D4c5c6itUg2sHgsH>: Error: Failed to establish relay connection: Failed to connect to remote server ... editing, - Options = PrioritizeChaCha,ServerPreference + Options = PrioritizeChaCha cures the error ==> /var/log/dovecot/dovecot.log <== ... 2020-08-24 17:08:04 submission(testuser(a)example.com)<Uow+f6itZg2sHgsH>: Info: Successfully relayed message: from=<testuser(a)example.com>, size=433, id=Mh4pJWRWRF9jHQAAVDn7pA, nrcpt=1, reply=`250 2.0.0 Ok: queued as 4Bb8TJ4VQbz7v6t' ... checking ssl docs https://www.openssl.org/docs/man1.1.1/man3/SSL_CONF_cmd.html BOTH are valid 'Options', ... ServerPreference: use server and not client preference order when determining which cipher suite, signature algorithm or elliptic curve to use for an incoming connection. Equivalent to SSL_OP_CIPHER_SERVER_PREFERENCE. Only used by servers. PrioritizeChaCha: prioritizes ChaCha ciphers when the client has a ChaCha20 cipher at the top of its preference list. This usually indicates a mobile client is in use. Equivalent to SSL_OP_PRIORITIZE_CHACHA. Only used by servers. ... The mere presence of that option in a system-wide openssl.cnf shouldn't cause a Dovecot submission failure.

2 7