- dovecot - dovecot.org

locking question
by Tom Lieuallen 01 Jun '20

01 Jun '20

We're running dovecot 2.3.10 on two different servers (two different environments). Both very similarly configured (sendmail and procmail for mail delivery); same OS and patch levels. One environment has nearly 10,000 users and hasn't seen problems. The other environment has just a handful of users, but one user is very active with email and has a fairly complicated procmail configuration. I'm having ongoing mail file locking problems with that one user... Procmail says it's using dotlocking and fcntl: procmail v3.22 2001/09/10 Locking strategies: dotlocking, fcntl() I'm using defaults for dovecot: #mbox_read_locks = fcntl #mbox_write_locks = dotlock fcntl I have seen this a number of times in dovecot's logs. This signifies a start of locking problems with a mailbox. Mailbox aa_checkme_second: fcntl() failed with mbox: No locks available Procmail's logs show this: procmail: Locking "mail/aa_checkme_second.lock" procmail: Assigning "LASTFOLDER=mail/aa_checkme_second" procmail: Opening "mail/aa_checkme_second" procmail: Acquiring kernel-lock procmail: Kernel-lock failed procmail: Unlocking "mail/aa_checkme_second.lock" These errors were not concurrent; dovecot's errors happened first. I've been suspicious that there was a locking conflict of some kind. My only remaining question on that front is about the read locks. Is it worth trying dotlock for it instead of fcntl? If that's not the problem, then could we be running into some system limitations or a bug in the kernel or mailbox storage? The server running dovecot is Centos 6.10. The mailbox storage is on Isilon OneFS 8.1.2.0. I should probably increase dovecot's logging to see if anything else jumps out at me. thank you for any suggestions. Tom Lieuallen Oregon State Univesity

1 0

Problems with userdb and mail deliveribility
by Chris Bennett 01 Jun '20

01 Jun '20

I briefly got some mails delivered, but not anymore. Attached are dovecot-info.log, dovecot-debug.log, dovecot.log, maillog, /etc/mail/passwd smtpd.conf, vaddr, vusers, vdomains Thanks for any help. Chris Bennett

3 4

auth_policy_server vs client_id and x-originating-ip
by Zdeněk Zámečník 01 Jun '20

01 Jun '20

I run into troubles when trying to set up auth_policy_server in Dovecot 2.3.10.1. It works almost as expected but I cannot get client ID in this process. By setting up "imap_id_log=*" I see in log that Dovecot gets details about mail client like name and version: May 31 14:20:58 mail dovecot: imap(xxx(a)example.xxx)<24796><ft7ytfCmjdZWMSZQ>: ID sent: name=Thunderbird, version=68.8.1 But the auth_policy_server is getting all details except this ID, it's empty: May 31 14:20:58 mail auth-policy[10357]: { May 31 14:20:58 mail auth-policy[10357]: device_id: '', May 31 14:20:58 mail auth-policy[10357]: login: 'xxx(a)example.xxx', May 31 14:20:58 mail auth-policy[10357]: protocol: 'imap', May 31 14:20:58 mail auth-policy[10357]: pwhash: '097a', May 31 14:20:58 mail auth-policy[10357]: remote: '1.2.3.4', May 31 14:20:58 mail auth-policy[10357]: tls: true May 31 14:20:58 mail auth-policy[10357]: } However in some cases I see that client_id is passed to auth_policy_server: May 31 14:27:41 mail auth-policy[10357]: { May 31 14:27:41 mail auth-policy[10357]: device_id: '"name" "Outlook-iOS-Android" "version" "2.0"', May 31 14:27:41 mail auth-policy[10357]: login: 'yyy(a)example.xxx', May 31 14:27:41 mail auth-policy[10357]: protocol: 'imap', May 31 14:27:41 mail auth-policy[10357]: pwhash: '0b63', May 31 14:27:41 mail auth-policy[10357]: remote: '3.4.5.6', May 31 14:27:41 mail auth-policy[10357]: tls: true May 31 14:27:41 mail auth-policy[10357]: } I think I am missing some important point. Maybe IMAP command ID and client_id are totally different. Can you please advise? Is it possible to pass details about mail client to auth_policy_server? Second question is: how I can get "x-originating-ip" from ID command to auth_policy_server? Below is my config file: # 2.3.10.1 (a3d0e1171): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.10 (67bf5bd7) # OS: Linux 5.3.18-2-pve x86_64 Debian 10.4 # Hostname: mail.z-technics.com auth_cache_size = 2 M auth_cache_ttl = 5 mins auth_master_user_separator = * auth_mechanisms = plain login auth_policy_check_before_auth = no auth_policy_hash_nonce = # hidden, use -P to show it auth_policy_report_after_auth = no auth_policy_server_timeout_msecs = 1500 auth_policy_server_url = http://127.0.0.1:8090/ dict { acl = pgsql:/etc/dovecot/dovecot-dict-sql.conf.ext quota = pgsql:/etc/dovecot/dovecot-dict-sql.conf.ext } disable_plaintext_auth = no imap_client_workarounds = delay-newmail imap_hibernate_timeout = 5 secs imap_id_log = * imap_id_retain = yes login_trusted_networks = 127.0.0.1 mail_gid = 2000 mail_home = /var/vmail/%d/%n mail_location = mdbox:~/mdbox:ALT=/var/vmail-archive/%d/%n/mdbox mail_max_userip_connections = 60 mail_plugins = acl zlib fts quota mail_uid = 2000 managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext vacation-seconds editheader imapsieve vnd.dovecot.imapsieve mdbox_rotate_interval = 1 days mdbox_rotate_size = 16 M passdb { args = /etc/dovecot/dovecot-ldap.conf driver = ldap } passdb { args = /etc/dovecot/masters.db driver = passwd-file master = yes pass = yes } plugin { acl = vfile acl_shared_dict = proxy::acl imapsieve_mailbox1_before = file:/var/vmail/sieve/report-spam.sieve imapsieve_mailbox1_causes = COPY imapsieve_mailbox1_name = Spam imapsieve_mailbox2_before = file:/var/vmail/sieve/report-ham.sieve imapsieve_mailbox2_causes = COPY imapsieve_mailbox2_from = Spam imapsieve_mailbox2_name = * imapsieve_mailbox3_before = file:/var/vmail/sieve/report-spam.sieve imapsieve_mailbox3_causes = COPY imapsieve_mailbox3_name = Junk imapsieve_mailbox4_before = file:/var/vmail/sieve/report-ham.sieve imapsieve_mailbox4_causes = COPY imapsieve_mailbox4_from = Junk imapsieve_mailbox4_name = * mailbox_alias_new = Sent Messages mailbox_alias_new2 = Sent Items mailbox_alias_new3 = Deleted Items mailbox_alias_old = Sent mailbox_alias_old2 = Sent mailbox_alias_old3 = Trash quota = dict:User quota::proxy::quota quota_grace = 10%% quota_rule2 = Trash:ignore quota_rule3 = Junk:ignore quota_warning = storage=80%% quota-warning 90 %u quota_warning2 = storage=85%% quota-warning 95 %u quota_warning3 = storage=95%% quota-warning 105 %u sieve = /var/vmail/%d/%n/sieve/.sieve sieve_after = /var/vmail/%d/%n/sieve/autoreply.sieve sieve_before = /var/vmail/sieve/global.sieve sieve_dir = /var/vmail/%d/%n/sieve sieve_extensions = +editheader +vacation-seconds sieve_global_dir = /var/vmail/sieve/ sieve_global_extensions = +vnd.dovecot.pipe +vnd.dovecot.environment sieve_max_redirects = 20 sieve_pipe_bin_dir = /usr/lib/dovecot sieve_plugins = sieve_imapsieve sieve_extprograms sieve_vacation_send_from_recipient = yes } protocols = imap sieve lmtp pop3 service auth-worker { unix_listener auth-worker { user = vmail } user = $default_internal_user } service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0660 user = postfix } unix_listener auth-userdb { mode = 0600 user = vmail } user = vmail } service dict { unix_listener dict { mode = 0600 user = vmail } } service imap-hibernate { unix_listener imap-hibernate { group = $default_internal_group mode = 0660 } } service imap-login { process_min_avail = 10 service_count = 0 vsz_limit = 512 M } service imap { executable = imap process_limit = 3500 unix_listener imap-master { user = $default_internal_user } vsz_limit = 2 G } service lmtp { unix_listener /var/spool/postfix/private/dovecot-lmtp { group = postfix mode = 0600 user = postfix } } service managesieve-login { inet_listener sieve { port = 4190 } process_min_avail = 0 service_count = 1 vsz_limit = 64 M } service managesieve { process_limit = 400 } service pop3-login { process_min_avail = 3 service_count = 0 vsz_limit = 320 M } service pop3 { process_limit = 200 vsz_limit = 320 M } service quota-warning { executable = script /etc/dovecot/quota_warning.sh unix_listener quota-warning { mode = 0666 user = vmail } user = vmail } ssl_cert = </etc/ssl/private/multi.z-technics.cz.dovecot.pem ssl_dh = # hidden, use -P to show it ssl_key = # hidden, use -P to show it stats_writer_socket_path = userdb { args = /etc/dovecot/dovecot-ldap.conf driver = ldap } protocol sieve { managesieve_implementation_string = Dovecot Pigeonhole managesieve_max_compile_errors = 5 } protocol imap { mail_plugins = quota imap_quota fts mailbox_alias imap_acl acl imap_zlib imap_sieve } protocol lda { mail_fsync = optimized } protocol lmtp { mail_fsync = optimized mail_plugins = quota sieve acl }

2 1

2.3.10 + lazy expunge
by Matt Bryant 01 Jun '20

01 Jun '20

Hi, so currently run dovecot 2.2.x on CentOS 7 box and was looking to upgrade to 2.3.10. I use lazy expunge atm into a different namespace but saw on the new doco pages that is is depracted in 2.3.0. Have tested and still seems to work so question is more around why ? Why would this be deprecated given using a different namespace allows 2 things a) the folder where message is located is taken accross so if I want to restore and know where it went b) namespace allows me to specify an alternate location for storing the messages. Also given it does still work is there any indication as to what version the deprecation basically equates to it not working. rgds Matt ------ 8< --------- namespace Deprecated since version v2.3.0.

1 0

identify 143 vs 993 clients
by mj 01 Jun '20

01 Jun '20

Hi, I am trying to find a nice way to identify dovecot clients that are still configured to use port 143 to connect to our mailserver, from the dovecot logs. I would then ask them to move over to 993, and finally disable port 143 altogether. When looking at the dovecot logs, it seems this is not logged in any obvious way. Of course I could use netflow etc, but that would not give us usernames, but IP's, etc. So, is there a nice way to somehow indicate in the dovecot logs, if a client connected on 143 or on 993? Thanks!

13 25

Running doveadm without config file?
by Joseph Tam 31 May '20

31 May '20

It would be useful to run the "doveadm" utility on a non-dovecot server e.g. generating password hashes: # echo plaintextpass | doveadm pw -s BLF-CRYPT doveadm(user): Fatal: Error reading configuration: stat(/etc/dovecot/dovecot.conf) failed: No such file or directory Is there a way to circumvent the need for a configuration file? Joseph Tam <jtam.home(a)gmail.com>

2 4

Current thinking on backups ?
by Laura Smith 30 May '20

30 May '20

Hi, What are people doing for backups ? My current process is LVM snapshot and backup from that to NFS share. But there seems to be hints around the internet that people use/abuse "doveadm backup" for backup purposes even though it seems its original intention was for transferring mailboxes between dovecot instances. Assuming its ok to "doveadm backup" to an NFS share, is it ok to use "doveadm backup" when dovecot has replication setup (replication-notify etc.) ? Or will it interfere ? Thanks! Laura

4 4

Operation not permitted - fchown() failed for /run/dovecot/login
by Dshah 30 May '20

30 May '20

# dovecot --version 2.3.10.1 (a3d0e1171) Dovecot is unable to start, I see error " Fatal: fchown() failed for /run/dovecot/login: Operation not permitted" what could be the problem? any help please $ls -la /var/mail/ drwxr-xr-x 1 root root 4096 May 29 17:32 . drwxr-xr-x 1 root root 4096 May 28 17:08 .. drw------- 2 root root 4096 May 29 17:32 domains ====# cat /etc/dovecot/dovecot.conf===== auth_mechanisms = plain login auth_username_format = %Lu auth_verbose = yes auth_debug = yes auth_debug_passwords = no log_timestamp = "%Y-%m-%d %H:%M:%S " login_greeting = IMAP server ready disable_plaintext_auth = no protocols = imap pop3 log_timestamp = "%Y-%m-%d %H:%M:%S " mail_location = maildir:/var/mail/domains/%d/%n first_valid_gid = 105 first_valid_uid = 102 last_valid_gid = 105 last_valid_uid = 102 service anvil { client_limit = 2100 } ssl_cert = </secret/tls.crt ssl_key = </secret/tls.key ssl_ca = </secret/ca.crt namespace inbox { inbox = yes mailbox Trash { auto = create special_use = \Trash } mailbox Spam { auto = no special_use = \Junk } mailbox Ham { auto = no } mailbox Sent { auto = subscribe special_use = \Sent } } # service auth { # unix_listener auth-master { # mode = 0600 # user = vmail # } # unix_listener /var/spool/postfix/private/auth { # mode = 0666 # user = postfix # group = postfix # } # user = root # } # service auth-worker { # user = root # } # protocol lda { # log_path = /home/vmail/dovecot-deliver.log # auth_socket_path = /var/run/dovecot/auth-master # postmaster_address = postmaster(a)razalabs.com # } protocol pop3 { pop3_uidl_format = %08Xu%08Xv } userdb { driver = static args = uid=102 gid=105 home=/var/mail/domains/%d/%n allow_all_users=yes } passdb { driver = sql args = /etc/dovecot/dovecot-sql.conf.ext } =================/etc/dovecot/dovecot-sql.conf.ext=============== driver = mysql connect = host=localhost dbname=mail user=root password=pass default_pass_scheme = CRYPT password_query = SELECT email as user, password FROM users WHERE email='%u'; =================dovecot-sql.conf.ext=============== =================/etc/dovecot/dovecot-sql.conf.ext=============== driver = mysql connect = host=localhost dbname=mail user=root password=pass default_pass_scheme = CRYPT password_query = SELECT email as user, password FROM users WHERE email='%u'; =================dovecot-sql.conf.ext=============== and postfix =================/etc/postfix/main.cf=============== inet_protocols = all meta_directory = /etc/postfix shlib_directory = /usr/lib/postfix myhostname = mail.my-domain.com mynetworks = 127.0.0.0/8 message_size_limit = 30720000 virtual_alias_domains = virtual_alias_maps = proxy:mysql:/etc/postfix/mysql-virtual_forwardings.cf, mysql:/etc/postfix/mysql-virtual_email2email.cf virtual_mailbox_domains = proxy:mysql:/etc/postfix/mysql-virtual_domains.cf virtual_mailbox_maps = proxy:mysql:/etc/postfix/mysql-virtual_mailboxes.cf virtual_mailbox_base = /var/mail/domains virtual_uid_maps = static:102 virtual_gid_maps = static:105 smtpd_sasl_type = dovecot smtpd_sasl_path = /var/spool/postfix/private/auth smtpd_sasl_auth_enable = yes broken_sasl_auth_clients = yes smtpd_sasl_authenticated_header = yes smtpd_recipient_restrictions = permit_mynetworks, permit_sasl_authenticated, reject_unauth_destination smtpd_use_tls = yes smtpd_tls_cert_file = /secret/tls.crt smtpd_tls_key_file = /secret/tls.key #virtual_create_maildirsize = yes #virtual_maildir_extended = yes proxy_read_maps = $local_recipient_maps $mydestination $virtual_alias_maps $virtual_alias_domains $virtual_mailbox_maps $virtual_mailbox_domains $relay_recipient_maps $relay_domains $canonical_maps $sender_canonical_maps $recipient_canonical_maps $relocated_maps $transport_maps $mynetworks virtual_transport = dovecot dovecot_destination_recipient_limit = 1 smtpd_milters = inet:127.0.0.1:8891 milter_default_action = accept =================/etc/postfix/main.cf===============

1 1

migrating dovecot to new server
by David Mehler 30 May '20

30 May '20

Hello, I'm needing to migrate my dovecot installation it's 2.3 on FreeBSD 12.1 to a new server. I'd ideally like to back up all the mails in the maildir location, copy that over, load in my configuration files, and bring the system back up. I doubt it's that easy, any pitfalls I should watch out for? Thanks. Dave.

4 4

director -> POP3s/IMAPs -> mailbox host
by patosec 28 May '20

28 May '20

Hello again, I did a lot of trial and error already, but I can't seem to find a way to encrypt my dovecot director to dovceot mailbox traffic. Is there a way to configure dovecot director to only use ssl/tls encrypted connections for specific tagged mailbox clusters? (or all clusters, in fact does not matter if it could be restricted to tags) Looks like there is also no documentation available for this sort of configuration. I tried setting my mailbox nodes to "ssl = require" butt after doing so I can't login through director proxy anymore. It always looks like ssl/tls termination is finally done on director side. Anyone tried this already or has a running setup doing encryption from lets say frontend to backend? Thanks, greetings Patrick

2 2