- dovecot - dovecot.org

Spam Blocking by filtering on username / id
by Plutocrat 25 Sep '19

25 Sep '19

This is probably quite an easy question, but I haven't been able to find the answer. I'm running a server where all the email addresses are in the format "user(a)domain.com". I've noticed that a large number of fake login attempts use the format "user" eg. reception, service, root, admin. Is it possible to prevent any such logins to these email users without an @domain.com? Or maybe ignore them. Or drop them from the logging. P.

5 5

'director_tag' field returned from passdb lookup results in 'unknown passdb extra field'
by Dan 25 Sep '19

25 Sep '19

Hello all, I'm working with director in tandem with 'director_tags' to group some backend hosts. I've assigned the groups to the hosts by appending a '@' character after the IP address of a backend host under director_mail_servers: ... director_mail_servers = 192.168.0.1@foo 192.168.0.2@bar 192.168.0.3@foobar ... I can confirm that the backend hosts possess the correct tags by issuing: # doveadm director status mail server ip tag vhosts state state changed users 192.168.0.1 foo 100 up - 0 192.168.0.2 bar 100 up - 0 192.168.0.3 foobar 100 up - 0 And examining that the tags have been assigned correctly. My passdb lookup is using mysql, and it appears as such: passdb { args = /etc/dovecot/dovecot-sql.conf driver = sql } This file looks like: driver = mysql connect = host=localhost dbname=xxx user=xxx password=xxx password_query = select director_tag, username, domain, password, 'Y' as `proxy` from users where username = '%n' and domain = '%d' iterate_query = select director_tag, username, domain from users I have a database that contains the following columns: username, domain, password, home, UID, GID, active, and director_tag To assign users to a backend, I went off of the documentation that states: > " A passdb lookup can return "director_tag" field containing the wanted tag name. " To fulfill this, I return the 'director_tag' in the passdb lookup, through password_query. The mapping seems to work. When I change the row in the database, the user gets proxied to the new backend on the next connection. However, My question is, Why does this appear in the logs? "dovecot[1963]: imap-login: Debug: Ignoring unknown passdb extra field: director_tag" How could this be an unknown passdb extra field, when the documentation states that you may return a field containing this key? In the file core/src/login-common/client-common-auth.c - Starting at line 142, there is no if condition checking for 'director_tag'. This causes that line to be output to debug handle. Is this intentional? Thank you for your time. Full configuration: auth_debug = yes auth_debug_passwords = yes auth_mechanisms = plain login auth_verbose = yes auth_verbose_passwords = yes director_mail_servers = 192.168.0.1@foo 192.168.0.2@bar 192.168.0.3@foobar director_servers = x.x.x.x y.y.y.y director_user_expire = 5 mins disable_plaintext_auth = no doveadm_port = 24245 haproxy_trusted_networks = x.x.x.x y.y.y.y 127.0.0.1 login_greeting = Dovecot At Your Service managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext passdb { args = /etc/dovecot/dovecot-sql.conf driver = sql } protocols = imap pop3 service director { fifo_listener login/proxy-notify { mode = 0666 user = $default_login_user } inet_listener { port = 9090 } unix_listener director-userdb { mode = 0600 } unix_listener login/director { mode = 0666 } } service imap-login { executable = imap-login director inet_listener imap { haproxy = yes port = 143 } inet_listener imaps { haproxy = yes port = 993 ssl = yes } } service ipc { unix_listener ipc { user = dovecot } } service pop3-login { executable = pop3-login director inet_listener pop3 { haproxy = yes port = 110 } inet_listener pop3s { haproxy = yes port = 995 ssl = yes } } ssl_cert = </etc/dovecot/private/dovecot.pem ssl_dh = # hidden, use -P to show it ssl_key = # hidden, use -P to show it userdb { args = /etc/dovecot/dovecot-sql.conf driver = sql } protocol doveadm { auth_socket_path = director-userdb }

2 1

Can't Get SASL to Work
by Christopher Wooley 25 Sep '19

25 Sep '19

I have been fighting with this for almost 2 days. I can't seem to get the SMTP server to authenticate through SASL. I have turned so many things off and on, I don't remember what I've done, anymore. Can someone look at these and tell me what I'm missing. I get this in the log, anytime postfix tries to authenticate. Sep 24 19:48:14 ubuntu postfix/smtpd[14464]: warning: SASL: Connect to smtpd failed: No such file or directory Sep 24 19:48:14 ubuntu postfix/smtpd[14464]: fatal: no SASL authentication mechanisms Sep 24 19:48:15 ubuntu postfix/master[14048]: warning: process /usr/lib/postfix/sbin/smtpd pid 14464 exit status 1 srw-rw-rw- 1 postfix postfix 0 Sep 24 19:10 auth 10-auth.conf disable_plaintext_auth = no auth_ssl_require_client_cert = no auth_mechanisms = plain !include auth-system.conf.ext -------------- 10-master.conf service imap-login { inet_listener imap { } inet_listener imaps { } } service pop3-login { inet_listener pop3 { } inet_listener pop3s { } } service lmtp { unix_listener /var/spool/postfix/private/dovecot-lmtp { mode = 0666 user = postfix group = postfix } } service imap { } service pop3 { } service auth { unix_listener /var/spool/postfix/private/auth { mode = 0666 user = postfix group = postfix } unix_listener auth-userdb { mode = 0666 user = postfix group = postfix } } service auth-worker { } service dict { unix_listener dict { } } -------------- main.cf smtpd_banner = $myhostname ESMTP $mail_name (Ubuntu) biff = no append_dot_mydomain = no readme_directory = no compatibility_level = 2 smtpd_tls_cert_file = /etc/ssl/certs/ssl-cert-snakeoil.pem smtpd_tls_key_file = /etc/ssl/private/ssl-cert-snakeoil.key smtpd_use_tls=yes smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache smtpd_relay_restrictions = permit_mynetworks permit_sasl_authenticated defer_unauth_destination myhostname = ubuntu.local.acr-live.com alias_maps = hash:/etc/aliases alias_database = hash:/etc/aliases mydestination = $myhostname, ubuntu, localhost.localdomain, xyz.com , localhost mynetworks = 127.0.0.0/8 [::ffff:127.0.0.0]/104 [::1]/128 mailbox_size_limit = 0 recipient_delimiter = + inet_interfaces = all inet_protocols = all smtpd_sasl_type = dovecot smtpd_sasl_auth_enable = yes smtp_sasl_auth_enable = yes broken_sasl_auth_clients = yes smtpd_tls_security_level = may ---------------------------------- master.cf smtp inet n - y - - smtpd submission inet n - y - - smtpd -o syslog_name=postfix/submission -o smtpd_tls_security_level=encrypt -o smtpd_sasl_auth_enable=yes -o smtpd_tls_auth_only=yes -o smtpd_reject_unlisted_recipient=no -o smtpd_sasl_type=dovecot -o smtpd_sasl_path=private/auth -o smtpd_recipient_restrictions= -o smtpd_relay_restrictions=permit_sasl_authenticated,reject -o milter_macro_daemon_name=ORIGINATING pickup unix n - y 60 1 pickup cleanup unix n - y - 0 cleanup qmgr unix n - n 300 1 qmgr tlsmgr unix - - y 1000? 1 tlsmgr rewrite unix - - y - - trivial-rewrite bounce unix - - y - 0 bounce defer unix - - y - 0 bounce trace unix - - y - 0 bounce verify unix - - y - 1 verify flush unix n - y 1000? 0 flush proxymap unix - - n - - proxymap proxywrite unix - - n - 1 proxymap smtp unix - - y - - smtp relay unix - - y - - smtp -o syslog_name=postfix/$service_name showq unix n - y - - showq error unix - - y - - error retry unix - - y - - error discard unix - - y - - discard local unix - n n - - local virtual unix - n n - - virtual lmtp unix - - y - - lmtp anvil unix - - y - 1 anvil scache unix - - y - 1 scache maildrop unix - n n - - pipe flags=DRhu user=vmail argv=/usr/bin/maildrop -d ${recipient} uucp unix - n n - - pipe flags=Fqhu user=uucp argv=uux -r -n -z -a$sender - $nexthop!rmail ($recipient) ifmail unix - n n - - pipe flags=F user=ftn argv=/usr/lib/ifmail/ifmail -r $nexthop ($recipient) bsmtp unix - n n - - pipe flags=Fq. user=bsmtp argv=/usr/lib/bsmtp/bsmtp -t$nexthop -f$sender $recipient scalemail-backend unix - n n - 2 pipe flags=R user=scalemail argv=/usr/lib/scalemail/bin/scalemail-store ${nexthop} ${user} ${extension} mailman unix - n n - - pipe flags=FR user=list argv=/usr/lib/mailman/bin/postfix-to-mailman.py ${nexthop} ${user}

2 2

Mail messages are occasionally getting "stuck" behind one message on the server with POP3
by David Salisbury 24 Sep '19

24 Sep '19

I'm currently using Dovecot 2.2.33.2, although I've had this particular issue happen periodically over the last few years with other Dovecot versions. It seems to only affect accounts I'm receiving with POP3, not IMAP ones. What happens is the "top-most" (or, oldest) message in the "cur" folder seems to get "stuck". So I'll, say, come back in after a break to check my email (Thunderbird in my case, latest version), and in one of my folders I'll have 30 copies of the same email (all with the same timestamp), and no newer messages delivered since the timestamp of that message. If I go look in the "cur" folder, it has lots of messages in it. The "new" folder is empty. Every time I click "Get Messages" in the mail client, I get another new copy of the same email and no other mail. If I go manually into the cur folder and move the top-most (again, meaning "oldest") message out (which of course corresponds to the message that I'm receiving copies of over-and-over repeatedly) then when I click "Get Messages" all of the other messages come pouring into my mail client just fine and everything becomes "un-stuck". I've done some experiments, and if I copy that same "bad" message back in to cur with its original filename, it gets stuck again. It is an encrypted message, so I tried decrypting it and putting it back in cur with the original name, and it gets stuck in the same fashion even when it is decrypted. I tried putting the bad message into an account that receives with IMAP, just to see if it would maybe keep messages from delivering or something, but new messages come into the IMAP account just fine, even with the bad message present, so the issue seems specific to POP3. Any ideas what might cause something like that? I've had it happen twice over the last two days (which is unusually frequent, hence my message here), and the message sources are varied. Today it was a normal email message from a person, and yesterday it was a Twitch notification. I don't see anything unusual in the logs (and I did turn on debugging to see if it gave some additional info), just normal POP3 logins and connections closings when I'm clicking "Get Messages". -David

1 0

Any need to be worried about occasional dsync errors ?
by Laura Smith 24 Sep '19

24 Sep '19

I am occasionally (maybe every 4 hours or less frequently) seeing the following two errors appear in my logs. Are they any cause for concern ? Error: Timeout during state=sync_mails (send=done recv=mails) I/O has stalled, no activity for 600 seconds (last sent=mail_request (EOL)

1 0

Quota plug-in, do the directors also need it enabled?
by Kristijan Savic - ratiokontakt GmbH 23 Sep '19

23 Sep '19

I am having an issue with the quota display not showing up in e.g. Roundcube. There are multiple Dovecot servers and three directors. A load balancer also does it's thing. The quota plug-in is enabled everywhere, except on the directors. Do those also need it enabled? -- Kristijan Savic

1 0

pigeonhole sieve "standalone"
by Greg Minshall 22 Sep '19

22 Sep '19

hi. i've been thinking (but, for years now!) of a replacement for procmail, and pigeonhold sieve seems like a good candidate. but, i run nmh, not dovecot. as i started install it (on arch linux), i started to worry that it may be foolish of me to try to run it outside of a dovecot system. any wisdom about that would be gratefully received. thanks in advance, and thanks for the software. Greg Minshall

1 0

mdbox + sis attachments. Error stream is larger than expected by 1 byte
by Oleg Krivonosov 20 Sep '19

20 Sep '19

Hello! I use Dovecot 2.3.4.1-5+deb10u1 (Debian 10 x64) with mdbox, sis and imap. I catch many errors with attachments "Stream is larger than expected" by 1 byte in emails from Xerox WorkCentre 3345. Examples: Sep 20 23:20:04 mailserver dovecot: imap(wasya)<606><AG1zywGTVodVrE84>: Error: Mailbox INBOX: UID=5002: read(attachments-connector(/var/mail/virtual/wasya/mdbox/storage/m.210)) failed: read(/var/mail/attachments/b3/56/b3563977baf186928d38f81480b6443cf6d6d7e4-b86d80062ab36f5d7f190000f7ccf497[base64:18 b/l]) failed: Stream is larger than expected (882801 > 882800, eof=0) (FETCH BODY[]) Sep 20 23:32:27 mailserver dovecot: imap(wasya)<4831><n0a39wGTZ8hVyu8l>: Error: Mailbox INBOX: UID=654996: read(attachments-connector(/var/mail/virtual/wasya/mdbox/storage/m.4372)) failed: read(/var/mail/virtual/wasya/mdbox/storage/m.4372 trailer) failed: Stream is larger than expected (38 > 37, eof=0) (FETCH BODY[]). This error breaks getting email in MS Outlook and breaks viewing attachment in the problem email. Please help me to debug and to fix this issue. -- Best regards Oleg

1 0

Re: Bug] Sieve vacation :addresses match only,>, case-sensitive?
by Klaus Steinberger 20 Sep '19

20 Sep '19

Hi, >> I never saw any mail system in which the local Part ist Case sensitive! > > Every Unix/Linux system (I?d say that represents the majority of mail systems) has a case sensitive local part. Most mail admins have set their systems up to normalize all users on lowercase names, but that is not and has not always been the case. at least in every large installation LDAP User Backend's (or AD or similar) are used, and they are definitly case insensitive for the CN or UID attributes. Really nobody who cares about his systems and users uses mailboxnames which just differ in case (too much danger of confusion!) At least sieve must reflect the same settings as the MDA, so if the MDA is set to downcase (which in my opionion is the only valuable setting) sieve must also downcase. Sincerly, Klaus

1 0

fts_solr: Error: fts_solr: received invalid uid '0'
by Fabian 20 Sep '19

20 Sep '19

Hi, we are trying to add full text search functionality with Solr to our Doveoct setup. Our Versions: OS: Debian 9 Tried versions: - Dovecot 2.2.7 with Solr 3.6 - Dovecot 2.3.4 with Solr 8.2 (2.2.7 from offical Debian repository, 2.3.4 from backports) Search is working mostly of the time perfrectly smooth. But sometimes following message appears in mail.err: dovecot: imap(username)<16189><UxYWLVuSYMasEQoK>: Error: fts_solr: received invalid uid '0' If this error occurs our webmail frontend delivers most of the time a timeout. Sometimes the search only takes really long. Are there any ideas why this error occurs? We are not able to reproduce the error in such a way that it would always be reproducible. However, we can reproduce the behavior in some form over and over again - but we do not know exactly what is decisive. If you need any further information please ask - thanks! :-) dovecont -n: 2.3.4.1 (f79e8e7e4): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.4 () # OS: Linux 4.9.0-11-amd64 x86_64 Debian 9.11 ext4 # Hostname: localhost auth_master_user_separator = * auth_username_format = %Ln default_client_limit = 5000 default_process_limit = 1000 default_vsz_limit = 256M dict { sqlquota = mysql:/etc/dovecot/dovecot-dict-sql.conf.ext } disable_plaintext_auth = no first_valid_uid = 480 imap_capability = +XDOVECOT lmtp_save_to_detail_mailbox = yes mail_attribute_dict = file:/var/spool/dovecot/user/%n/Maildir/dovecot-attributes mail_gid = vmail mail_location = maildir:/var/spool/dovecot/user/%d/%n/Maildir:LAYOUT=fs mail_plugins = " listescape mail_log notify quota acl fts fts_solr virtual" mail_privileged_group = vmail mail_uid = vmail managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext namespace { hidden = yes inbox = yes list = no location = prefix = separator = / subscriptions = yes } namespace { list = yes location = maildir:%%h/Maildir:INDEXPVT=~/shared/%%u:LAYOUT=fs prefix = shared/%%n/ separator = / subscriptions = no type = shared } namespace Public { list = children location = maildir:/var/spool/dovecot/public:INDEXPVT=~/public:LAYOUT=fs prefix = Public/ separator = / subscriptions = no type = public } namespace Virtual { hidden = no list = yes location = virtual:/etc/dovecot/virtual:INDEX=/var/spool/dovecot/user/%u/virtual prefix = Virtual/ separator = / subscriptions = no } namespace inbox { inbox = no location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = INBOX/ separator = / subscriptions = no type = private } passdb { args = /etc/dovecot/masteruser.%s driver = passwd-file master = yes } passdb { args = /etc/dovecot/dovecot-ldap.conf.ext driver = ldap } passdb { args = scheme=CRYPT username_format=%u /etc/dovecot/users driver = passwd-file } plugin { acl = vfile acl_anyone = allow acl_shared_dict = file:/var/spool/dovecot/public/shared-mailboxes.db fts = solr fts_autoindex = yes fts_solr = url=<a href="http://172.17.10.12:8983/solr/dovecot/" rel="noreferrer noopener" target="_blank">172.17.10.12:8983/solr/dovecot/</a> quota = dict:User quota::no-unset:proxy::sqlquota quota_rule = *:storage=10G sieve = file:~/sieve;active=~/.dovecot.sieve sieve_before = /var/spool/dovecot/globalsieve/duplicate.sieve sieve_duplicate_default_period = 1h sieve_duplicate_max_period = 1d } protocols = " imap lmtp sieve pop3" service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0660 user = postfix } } service decode2text { executable = script /usr/lib/dovecot/<a href="http://decode2text.sh" rel="noreferrer noopener" target="_blank">decode2text.sh</a> unix_listener decode2text { mode = 0666 } user = dovecot } service dict { unix_listener dict { group = vmail user = vmail } } service lmtp { unix_listener /var/spool/postfix/private/dovecot-lmtp { group = postfix mode = 0600 user = postfix } } service managesieve-login { inet_listener sieve { port = 4190 } } ssl = no userdb { args = /etc/dovecot/mysql-userdb.conf.ext driver = sql } protocol lmtp { mail_plugins = " listescape mail_log notify quota acl fts fts_solr virtual acl quota sieve notify" quota_full_tempfail = yes } protocol imap { imap_capability = +XDOVECOT mail_max_userip_connections = 100 mail_plugins = " listescape mail_log notify quota acl fts fts_solr virtual imap_acl imap_quota" } remote <a href="http://172.17.10.10" rel="noreferrer noopener" target="_blank">172.17.10.10</a> { protocol imap { imap_metadata = yes } }

2 3