- dovecot - dovecot.org

Unable to disable TLSv1.3 or fallback to TLSv1.2 when 1 cipher is disabled
by Steve Egbert 10 May '20

10 May '20

I have an operational need to disable TLSv1.3 due to inadequate support to exclude certain ciphers. Much to my dismay, the `ssl_protocols` had been renamed and re-functionalized into `ssl_min_protocol`. Now, there is no way to exclude a specific group of one or more TLS versions. For a new bug report, I think we need two new settings: * `ssl_tls13_ciphersuite` and * `ssl_tls10_cipher` settings introduced into Dovecot for better granularity. ALong with support for fallback to TLSv1.2 as outlined in https://bugzilla.mozilla.org/show_bug.cgi?id=1250568 I'm still being hammered with the following error with Thunderbird 76.0b3, Dovecot 2.3.4.1-5+deb10u1, Debian 11: May 8 11:15:47 ns1 dovecot: imap-login: Debug: SSL: where=0x10, ret=1: before SSL initialization May 8 11:15:47 ns1 dovecot: imap-login: Debug: SSL: where=0x2001, ret=1: before SSL initialization May 8 11:15:47 ns1 dovecot: imap-login: Debug: SSL: where=0x2002, ret=-1: before SSL initialization May 8 11:15:47 ns1 dovecot: imap-login: Debug: SSL: where=0x2001, ret=1: before SSL initialization May 8 11:15:47 ns1 dovecot: imap-login: Debug: SSL alert: where=0x4008, ret=582: fatal protocol version May 8 11:15:47 ns1 dovecot: imap-login: Debug: SSL: where=0x2002, ret=-1: error May 8 11:15:47 ns1 dovecot: imap-login: Debug: SSL error: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol May 8 11:15:47 ns1 dovecot: imap-login: Disconnected (disconnected before auth was ready, waited 0 secs): user=<>, rip=XX.XX.XX.XX, lip=XX.XX.XX.XX, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<GN/GeCSlYuhEhl2U> May 8 11:15:47 ns1 dovecot: imap-login: Debug: SSL error: SSL_accept() syscall failed: Invalid argument This occurred when specifying one TLSv1.3 cipher to be excluded in ssl_cipher via an exclamation mark. On a side note of IMAP client, Latest Mozilla Thunderbird had its pref setting security.tls.version.fallback-limit to 4 (TLSv1.3), of which I have adjusted it to 3 (TLSv1.2) and it .... works when Dovecot is set to TLSv1.2. (Details of Thunderbird security.tls.version.fallback-limit is given in http://kb.mozillazine.org/Security.tls.version.* ) Steve

3 3

Marking all emails in "Trash" as opened, and also prohibiting email clients from creating new mails
by Sebastian Nielsen 10 May '20

10 May '20

Dovecot version: 2.3.7.2 (3c910f64b) (pkg shipped by: Ubuntu-Desktop 20.04) I want to accomplish 2 things in dovecot: 1: I want to force all mails inside Trash to have an "opened"/"read" flag and "Non-Recent" flag. Basically Status: RO This regardless how the flag appears, either by copying/moving the mail into trash, creating a new mail in trash, flagging email in Trash or whatever. Basically, no email in Trash should ever be able to have a recent or unread flag. I tried with a static mail filter and sieve filter to add \\seen to the email upon COPY (as mentioned here: https://dovecot.org/pipermail/dovecot/2017-November/110122.html ), but regardless how I do it, it doesn't work when Samsung Email client trashes an unread email, AND/OR also, it causes weird issues like duplicate email in the trash folder sometimes. Best would be some event filter that executes for every mail that somehow end up in Trash, that checks if \\seen is present, if not, then it will add it, on all emails in trash? But how I do to prevent the duplicate copy that appears sometimes? 2: I want to prohibit email clients from ever creating a new mail in Sent folder. If its possible to allow MOVE and/or COPY, it should be allowed, only new mail should be prohibited. (also note that external processes must be able to create new mail in Sent) HOWEVER - this prohibition must be silent - ergo the newly created email is simply discarded. No error message or error codes should be returned to IMAP client. (The reason I want this, is because I have configured my outgoing SMTP server to populate Sent, and some email clients doesn't have the option to "Don't store a copy of the email in Sent folder" resulting in duplicates) Best regards, Sebastian Nielsen

3 5

Dovecot v2.3.4.1 Debian 10.3 mbox format - Error: chdir(/var/spool/mail/domain/user) failed: Not a directory
by vik 10 May '20

10 May '20

Hi colleagues, I am trying to setup dovecot and have a strange problem. I configured it to: #dovecot -n|grep ^mail mail_gid = mail mail_location = mbox:/var/spool/mail/%d/mailboxes/%n:INBOX=/var/spool/mail/%d/%n mail_uid = mail And also setup exim4 to use it. I sent a test message and observe a mailbox file /var/spool/mail/domain/user, containing this message. But when I try to access dovecot with a client (thunderbird), client cannot fetch mail, and I observe error in the dovecot's log: May 09 23:35:51 imap(user@domain)<25179><JNFIDz2ldeOsEAE3>: Error: chdir(/var/spool/mail/domain/user) failed: Not a directory What is it, and how to solve it? Thank you. Kind regards, Viktor

1 0

ot: copy physical mail files ?
by Voytek Eymont 09 May '20

09 May '20

dumb question warning: I have two email accounts, me@tld1 and me@tld2 often, get emails intended (by me) for me@tld2 sent to me@tld1 this is purely for my own preferred record keeping preference, as I run the server, is it 'a really bad things' if I simply copy relevant mail files from /var/vmail/vmail1/tld1..../cur to /var/vmail/vmail1/tld2.../cur ? rather than forward emails as I have been doing? thanks

6 7

What's a Reasonable Inbox Size?
by Asai 09 May '20

09 May '20

Greetings, I have several users who have inboxes that are over 20 GB. Lately I have noticed Dovecot logs say it's taking over 30 seconds to sync their mailboxes. As email admins, how do you handle inboxes that are so large? Do you use mailbox types that have better performance like dbox? We're using maildir. What's a reasonable inbox size? Is 20+ GB reasonable and nothing to worry about? Thanks for any insight here. -- Asai7

7 13

Unable to disable TLSv1.3 or fallback to TLSv1.2 when 1 cipher is disabled
by Steve Egbert 09 May '20

09 May '20

I have an operational need to disable TLSv1.3 due to inadequate support to exclude certain ciphers. Much to my dismay, the `ssl_protocols` had been renamed and re-functionalized into `ssl_min_protocol`. Now, there is no way to exclude a specific group of one or more TLS versions. For a new bug report, I think we need two new settings: * `ssl_tls13_ciphersuite` and * `ssl_tls10_cipher` settings introduced into Dovecot for better granularity. ALong with support for fallback to TLSv1.2 as outlined in https://bugzilla.mozilla.org/show_bug.cgi?id=1250568 I'm still being hammered with the following error with Thunderbird 76.0b3, Dovecot 2.3.4.1-5+deb10u1, Debian 11: May 8 11:15:47 ns1 dovecot: imap-login: Debug: SSL: where=0x10, ret=1: before SSL initialization May 8 11:15:47 ns1 dovecot: imap-login: Debug: SSL: where=0x2001, ret=1: before SSL initialization May 8 11:15:47 ns1 dovecot: imap-login: Debug: SSL: where=0x2002, ret=-1: before SSL initialization May 8 11:15:47 ns1 dovecot: imap-login: Debug: SSL: where=0x2001, ret=1: before SSL initialization May 8 11:15:47 ns1 dovecot: imap-login: Debug: SSL alert: where=0x4008, ret=582: fatal protocol version May 8 11:15:47 ns1 dovecot: imap-login: Debug: SSL: where=0x2002, ret=-1: error May 8 11:15:47 ns1 dovecot: imap-login: Debug: SSL error: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol May 8 11:15:47 ns1 dovecot: imap-login: Disconnected (disconnected before auth was ready, waited 0 secs): user=<>, rip=XX.XX.XX.XX, lip=XX.XX.XX.XX, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<GN/GeCSlYuhEhl2U> May 8 11:15:47 ns1 dovecot: imap-login: Debug: SSL error: SSL_accept() syscall failed: Invalid argument This occurred when specifying one TLSv1.3 cipher to be excluded in ssl_cipher via an exclamation mark. On a side note of IMAP client, Latest Mozilla Thunderbird had its pref setting security.tls.version.fallback-limit to 4 (TLSv1.3), of which I have adjusted it to 3 (TLSv1.2) and it .... works when Dovecot is set to TLSv1.2. (Details of Thunderbird security.tls.version.fallback-limit is given in http://kb.mozillazine.org/Security.tls.version.* ) Steve

2 3

dovecot-lda quota warning email add BCC
by Admin Beckspaced 08 May '20

08 May '20

Dear dovecot users, I have setup doveot with quota warning. Once a quota wearning is reached a shell script is called which then sends an email to the user via dovecot LDA this is the command in the shell script: /usr/lib/dovecot/dovecot-lda -d $USER -o "plugin/quota=dict:User quota::noenforcing:proxy::quota" I already have looked in the docs: https://wiki.dovecot.org/LDA but can't find an option to add a BCC I would like to receive a copy of the quota warning email so I also get notified and know if user mailboxes get filled up. How could I achieve that? thanks & greetings Becki

1 1

courier-dovecot-migrate.pl and courier-5: UTF-8 flag
by Maxim Nikulin 08 May '20

08 May '20

Hi, Courier to dovecot migration script https://dovecot.org/tools/courier-dovecot-migrate.pl referenced at the https://wiki.dovecot.org/Migration/Courier page has a couple of problems. One of them is that the script could not process courierpop3dsizelist generated by courier-5. File format has been changed a bit to mark UTF-8 messages with an additional attribute. Is it safe to ignore such flag or its value should be stored somewhere for dovecot? Internally courier assumes false value during migration from the previous format version (v2 to v3). --- courier-dovecot-migrate.pl.orig 2012-07-28 17:14:20.000000000 +0000 +++ courier-dovecot-migrate.pl 2020-05-08 09:54:53.249214022 +0000 @@ -170,8 +170,9 @@ my $pop3_fname = "$dir/$courier_pop3_uidfile"; open( $f, $pop3_fname ) || die $!; my $pop3_hdr = <$f>; - if ( $pop3_hdr =~ /^\/2 (\d+) (\d+)$/ ) { + if ( $pop3_hdr =~ /^\/[23] (\d+) (\d+)$/ ) { # /2 <next uid> <uidvalidity> + # /3 <next uid> <uidvalidity> $_ = <$f>; } elsif ( $pop3_hdr =~ /^\/1 (\d+)$/ ) { @@ -193,9 +194,13 @@ chomp $_; $line++; - my ( $full_fname, $fsize, $uid, $uidv ); + my ( $full_fname, $fsize, $uid, $uidv, $_is_utf8 ); - if ( /^([^ ]+) (\d+) (\d+):(\d+)$/ ) { + if ( /^([^ ]+) (\d+) (\d+):(\d+):(\d+)$/ ) { + # v3 + ( $full_fname, $fsize, $uid, $uidv, $_is_utf8 ) = ( $1, $2, $3, $4, $5 ); + } + elsif ( /^([^ ]+) (\d+) (\d+):(\d+)$/ ) { # v2 ( $full_fname, $fsize, $uid, $uidv ) = ( $1, $2, $3, $4 ); }

1 0

Seive + Spamprobe terminates with signal 6
by Mark Constable 08 May '20

08 May '20

Ubuntu 20.04, Dovecot 2.3.7.2, SpamProbe v1.4d. For the past weeks my sieve filters that call spamprobe have been crashing out for some users. I have a dozen similar server setups and this is not happening on any of the other servers and it was working just fine for a year up until recently. This particular server is quite busy. There is plenty of disk space and inode usage is about 2.5%. Permissions look the same as on the other servers. I'm hoping someone might have a suggestion as to the cause of this? Apr 22 10:31:24 mail dovecot: lmtp(xxxx(a)example.com)<33016><oCuzElyQn174gAAA4xLzLg>: Error: program exec:/etc/dovecot/sieve/spamprobe (38010): Terminated abnormally with signal 6 Apr 22 10:31:24 mail dovecot: lmtp(xxxx(a)example.com)<33016><oCuzElyQn174gAAA4xLzLg>: Error: sieve: global: line 6: execute action: failed to execute to program `spamprobe': refer to server log for more information. [2020-04-22 10:31:24] ~ cat /etc/dovecot/sieve/global.sieve require ["vnd.dovecot.execute", "fileinto", "envelope", "variables", "editheader"]; if header :contains "from" ["root@", "daemon@", "postmaster@"] { fileinto "Trash"; } elsif header :contains "to" ["root@", "daemon@", "postmaster@"] { fileinto "Trash"; } if envelope :localpart :matches "to" "*" { set "lhs" "${1}"; } if envelope :domain :matches "to" "*" { set "rhs" "${1}"; } execute :pipe :output "SCORE" "spamprobe" ["-c", "-d", "/home/u/${rhs}/home/${lhs}/.spamprobe", "receive"]; addheader :last "X-Spam" "${SCORE}"; if header :matches "X-Spam" "SPAM*" { fileinto "Junk"; } plugin { imapsieve_mailbox1_before = file:/etc/dovecot/sieve/retrain-as-spam.sieve imapsieve_mailbox1_causes = COPY imapsieve_mailbox1_name = Junk imapsieve_mailbox2_before = file:/etc/dovecot/sieve/retrain-as-good.sieve imapsieve_mailbox2_causes = COPY imapsieve_mailbox2_from = Junk imapsieve_mailbox2_name = * listescape_char = mail_log_cached_only = yes mail_log_events = delete undelete expunge copy mailbox_delete mailbox_rename mail_log_fields = uid box msgid size sieve_before = file:/etc/dovecot/sieve/global.sieve sieve_dir = ~/sieve sieve_execute_bin_dir = /etc/dovecot/sieve sieve_extensions = +notify +imapflags +vacation-seconds sieve_global_dir = /etc/dovecot/sieve/ sieve_global_extensions = +vnd.dovecot.debug +editheader +vnd.dovecot.pipe +vnd.dovecot.execute sieve_max_redirects = 30 sieve_max_script_size = 1M sieve_pipe_bin_dir = /etc/dovecot/sieve sieve_plugins = sieve_imapsieve sieve_extprograms sieve_quota_max_scripts = 0 sieve_quota_max_storage = 0 sieve_redirect_envelope_from = recipient sieve_vacation_default_period = 60s sieve_vacation_max_period = 0 sieve_vacation_min_period = 5s sieve_vacation_send_from_recipient = yes } -- Mark Constable 0419 530 037 https://spiderweb.com.au

2 2

auto: mdbox is automatically recognized as sdbox
by 刘莹莹 08 May '20

08 May '20

Hi:   I did a simple test with Dovecot-2.3.9:            First step : A test account uses mdbox format to store emails with 'mail_location = mdbox:%h/%Ld/%Ln:ALT=%h/altstorage/%Ld/%Ln',           Second step: I adjust 'mail_location = auto:'  and dovecot restart           Third step: telnet 127.0.0.1 143  then log in and fetch emails.     When I fetch email data , the log shows that the storage format is automatically recognized as sdbox and index is Rebuild, as the result, all emails is lost： May 08 12:22:15 mail imap(q2(a)a.com)<30883><+nFkVxul5oF/AAAB>: Debug: Mailbox INBOX: Mailbox opened because: SELECT May 08 12:22:15 mail imap(q2(a)a.com)<30883><+nFkVxul5oF/AAAB>: Warning: sdbox /srv/vmail/a.com/q2/mailboxes/INBOX/dbox-Mails: Rebuilding index May 08 12:23:12 mail auth-worker(30882): Debug: conn unix:auth-worker (pid=29526,uid=12348): Disconnected: Connection closed (fd=-1) May 08 12:24:19 mail imap(q2(a)a.com)<30883><+nFkVxul5oF/AAAB>: Info: Logged out in=50 out=881 deleted=0 expunged=0 trashed=0 hdr_count=0 hdr_bytes=0 body_count=0 body_bytes=0          I am confused why mdbox and sdbox cannot be recognized automatically or there are same problem with my test ??   Thanks

1 0