- dovecot - dovecot.org

Dovecot v2.3.10 Released
by Aki Tuomi 07 Mar '20

07 Mar '20

We are pleased to release v2.3.10 of Dovecot. Please find it from locations below: https://dovecot.org/releases/2.3/dovecot-2.3.10.tar.gz https://dovecot.org/releases/2.3/dovecot-2.3.10.tar.gz.sig Binary packages in https://repo.dovecot.org/ Docker images in https://hub.docker.com/r/dovecot/dovecot Aki Tuomi Open-Xchange oy --- * Disable retpoline migitations by default. These can cause severe performance regressions, so they should be only enabled when applicable. * IMAP MOVE now commits transactions in batches of 1000 mails. This helps especially with lazy_expunge when moving a lot of mails. It mainly avoids situations where multiple IMAP sessions are running the same MOVE command and duplicating the mails in the lazy_expunge folder. With this change there can still be some duplication, but the MOVE always progresses forward. Also if the MOVE fails at some point, the changes up to the last 1000 mails are still committed instead of rolled back. Note that the COPY command behavior hasn't changed, because it is required by IMAP standard to be an atomic operation. * IMAP EXPUNGE and CLOSE now expunges mails in batches of 1000 mails. This helps especially with lazy_expunge when expunging a lot of mails (e.g. millions) to make sure that the progress always moves forward even if the process is killed. * Autoexpunging now expunges mails in batches of 1000 mails. This helps especially with lazy_expunge when expunging a lot of mails (e.g. millions) to make sure that the progress always moves forward even if the process is killed. + Add tool for generating sysreport called dovecot-sysreport. This generates a bundle of information usually needed for support requests. + Add support for the new IMAP \Important SPECIAL-USE flag (RFC 8457). + Add metric { group_by } setting. This allows automatically creating new metrics based on the fields you want to group statistics by. NOTE: This feature is considered experimental and syntax is subject to change in future release. + auth: Support SCRAM-SHA-256 authentication mechanism. + imap: Support the new IMAP STATUS=SIZE extension. + Use TCP_QUICKACK to reduce latency for some TCP connections. + quota-status: Made the service more robust against erroneous use with Postfix ACL policies other than smtpd_recipient_restrictions. + Add "revision" field support to imap_id_send setting. Using "revision *" will send in IMAP ID command response the short commit hash of the Dovecot git source tree HEAD (same as in dovecot --version). + IMAP ENVELOPE includes now all addresses when there are multiple headers (From, To, Cc, etc.) The standard way of having multiple addresses is to just list them all in a single header. It's non-standard to have multiple headers. However, since MTAs allow these mails to pass through and different software may handle them in different ways, it's better from security point of view to show all the addresses. + Event filters now support using "field_name=" to match a field that doesn't exist or has an empty value. For example use "error=" to match only events that didn't fail. - acl: INBOX ACLs shouldn't apply for IMAP GETMETADATA/SETMETADATA commands. - cassandra: CASS_ERROR_SERVER_WRITE_FAILURE error should also be treated as "uncertain write failure". - dict-redis: Using quota_clone configured with dict-redis could have crashed when Redis responded slowly. - imap-hibernate: Communication trouble with imap-master leads to segfault. - imap-hibernate: Unhibernation retrying wasn't working. - imap: Fixed auth lookup privilege problem when imap process was reused and user was being un-hibernated. - Fix potential crash when copying/moving mails within the same folder. This happened only when there were a lot of fields in dovecot.index.cache. - lib-index: Recreating dovecot.index.cache file could have crashed when merging bitmask fields. - lib-index: Using public/shared folders with INDEXPVT configured to use private \Seen flags, trying to search seen/unseen in an empty folder crashes with segfault. - lib-mail: Large base64-encoded mails weren't decoded properly. This could have affected searching/indexing mails and message snippet generation. - lib-mail: Message with only quoted text could have caused message snippet to ignore its 200 character limit and return the entire message. This was added also to dovecot.index.cache file, which increased disk space and memory usage unnecessarily. v2.3.9.2 regression (previous versions cached the quoted snippet as empty). In a large mail quoted text could have become wrongly added to the snippet, possibly mixed together with non-quoted text. - lib-smtp: client could have assert-crashed if STARTTLS handshake finished earlier than usually. - lib-ssl-iostream: remove -static flag for lib-ssl-iostream linking to prevent a compile issue. - lib-storage: Mailbox synchronization may have assert-crashed in some rare situations. - lib-storage: mdbox didn't preserve date.saved with dsync. - lib: Don't require EAI_{ADDRFAMILY,NODATA}, breaks FreeBSD - master: Some services could respawn unthrottled if they crash during startup. - push-notification: Do not send push_notification_finished event if nothing was done. This happens when mail transaction is started and ended with no changes. - quota-status: Addresses with special characters in the local part caused problems in the interaction between Postfix and Dovecot. Postfix sent its own internal representation in the recipient field, while Dovecot expected a valid RFC5321 mailbox address. - submission-login: SESSION was not correctly encoded field for the XCLIENT command. Particularly, a '+' character introduced by the session ID's Base64 encoding causes problems. - submission: Fix submission_max_mail_size to work correctly on 32-bit systems. - submission: Trusted connections crashed in second connection's EHLO if submission-login { service_count } is something else than 1 (which is the default). - submission: XCLIENT command was never used in the protocol exchange with the relay MTA when submission_backend_capabilities is configured, even when the relay MTA was properly configured to accept the XCLIENT command.

2 2

Dovecot - spam training through Outlook
by Özgür Kazancci 06 Mar '20

06 Mar '20

Greetings everyone. My dovecot mail server doesn't execute *train-spam.sh* script I set, when moving an e-mail from "Inbox" to "Junk" within Outlook. However, it does it fine when using an online webmail client a.k.a. Roundcube Webmail. Here are few lines from my maillog file showing the situation. Any idea would be much appreciated. Log output of the mentioned process: >From Outlook 2016 (Move from Inbox to Junk folder) Mar 5 07:50:37 mailserver1 dovecot: imap(info(a)mydomain.com)<72501><uGYu6hWgeupOrFX1>: delete: box=INBOX, uid=10, msgid=<016f01d5f248$45900090$d0b001b0$(a)test.xxx>, size=3344 Mar 5 07:50:37 mailserver1 dovecot: imap(info(a)mydomain.com)<72501><uGYu6hWgeupOrFX1>: expunge: box=INBOX, uid=10, msgid=<016f01d5f248$45900090$d0b001b0$(a)test.xxx>, size=3344 >From Roundcube Webmail (Move from Inbox to Junk folder) Mar 5 07:48:45 mailserver1 dovecot: imap(info(a)mydomain.com)<14673></W6k7RWgyEl/AAAB>: sieve: pipe action: piped message to program `train-spam.sh' Mar 5 07:48:45 mailserver1 dovecot: imap(info(a)mydomain.com)<14673></W6k7RWgyEl/AAAB>: sieve: left message in mailbox 'Junk' Mar 5 07:48:45 mailserver1 dovecot: imap(info(a)mydomain.com)<14673></W6k7RWgyEl/AAAB>: copy from INBOX: box=Junk, uid=9, msgid=<2eed864c2c38a690349e87dbd271e474(a)test.xxx>, size=1214 Mar 5 07:48:45 mailserver1 dovecot: imap(info(a)mydomain.com)<14673></W6k7RWgyEl/AAAB>: expunge: box=INBOX, uid=15, msgid=<2eed864c2c38a690349e87dbd271e474(a)test.xxx>, size=1214 Dovecot version: 2.3.9.3 running on OpenBSD 6.6 Many thanks, Özgür.

6 11

Updated Roadmap for Dovecot?
by Tanstaafl 06 Mar '20

06 Mar '20

Hello, Just wanted to go take a peek at the latest Roadmap for dovecot, and note that the current wiki page is flagged as obsolete: https://wiki.dovecot.org/Roadmap Is there an updated version somewhere? I'm interested in the list of new features being worked on - especially JMAP support - and a rough idea of when said features might be expected to make it into a release. Thanks!

1 0

Pigeonhole v0.5.10 Released
by Aki Tuomi 06 Mar '20

06 Mar '20

We are doing a pigeonhole 0.5.10 release to maintain version number parity with dovecot. You can download it from locations below: https://pigeonhole.dovecot.org/releases/2.3/dovecot-2.3-pigeonhole-0.5.10.t… https://pigeonhole.dovecot.org/releases/2.3/dovecot-2.3-pigeonhole-0.5.10.t… Binary packages in https://repo.dovecot.org/ Docker images in https://hub.docker.com/r/dovecot/dovecot There are no other changes than version number. --- Aki Tuomi Open-Xchange oy

1 0

encrypted storage on the fly using user's password without storing password on the server
by Alex Knowles 05 Mar '20

05 Mar '20

Hi all, I just joined the list. I've read through the mail-crypt plugin docs here https://doc.dovecot.org/configuration_manual/mail_crypt_plugin/ I'm still unclear (I'm not an expert) about the following: Is it possible to obtain on-the-fly encrypted storage using the user's password without the password being stored on the server? Basically a zero-knowledge solution. Theoretically this should be possible as the user provides the password when storing or retrieving emails. The above plugin docs don't make it clear for me whether it is supported. Could a kind clarify? I'd also be very grateful for a working conf as an example. Best wishes and thanks in advance, Alex.

2 2

[PATCH] lib-imap: imap-bodystructure: add test with empty header field
by Simon Ser 03 Mar '20

03 Mar '20

This causes the body structure to be incorrect. The RFC says it's fine o have empty header field values. --- This just adds a failing test, inspired from an e-mail spotted in the wild. Ideas welcome to fix it. src/lib-imap/test-imap-bodystructure.c | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/src/lib-imap/test-imap-bodystructure.c b/src/lib-imap/test-imap-bodystructure.c index 6f456a44530b..b8f215d689c4 100644 --- a/src/lib-imap/test-imap-bodystructure.c +++ b/src/lib-imap/test-imap-bodystructure.c @@ -41,6 +41,19 @@ struct parse_test parse_tests[] = { "\"text\" \"plain\" (\"charset\" \"utf-8\") NIL NIL \"8bit\" 8 2 NIL NIL NIL NIL", .body = "\"text\" \"plain\" (\"charset\" \"utf-8\") NIL NIL \"8bit\" 8 2" + },{ + .message = + "From: user(a)domain.org\n" + "Date: Sat, 24 Mar 2017 23:00:00 +0200\n" + "X-Spam-Level:\n" + "Content-Transfer-Encoding: quoted-printable\n" + "\n" + "body\n" + "\n", + .bodystructure = + "\"text\" \"plain\" (\"charset\" \"us-ascii\") NIL NIL \"quoted-printable\" 8 2 NIL NIL NIL NIL", + .body = + "\"text\" \"plain\" (\"charset\" \"us-ascii\") NIL NIL \"quoted-printable\" 8 2" },{ .message = "From: user(a)domain.org\n" -- 2.25.1

3 3

Dovecot autoexpunge
by Philip Colmer 03 Mar '20

03 Mar '20

Following a previous suggestion I'd received to turn on autoexpunge (https://dovecot.org/pipermail/dovecot/2020-February/118281.html) I'm now trying to confirm whether or not it is doing what I expect it to do. I've set the expiration to be 12 weeks (as shown below in the config) but a lot of the mailboxes have email in them that is much older. Reading http://dovecot.2317879.n4.nabble.com/Dovecot-2-2-20-autoexpunge-td54644.html, I've tried using "doveadm search -u user mailbox INBOX savedbefore 2w" to see if it finds any email that is older than 2 weeks (just as a test) and it doesn't. If I change "savedbefore" to be "sentbefore" then it works. If "autoexpunge" is dependent on "savedbefore" working then what do I need to do to fix this? Thanks. Regards Philip Below is the output of doveconf -n: # 2.2.33.2 (d6601f4ec): /etc/dovecot/dovecot.conf # Pigeonhole version 0.4.21 (92477967) # OS: Linux 4.15.0-1041-aws x86_64 Ubuntu 18.04.3 LTS auth_username_format = %Ln auth_verbose = yes disable_plaintext_auth = no listen = 127.0.0.1 mail_location = mbox:~/mail:INBOX=/var/mail/%u mail_privileged_group = mail mailbox_list_index = yes namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox INBOX { autoexpunge = 12 weeks } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } passdb { driver = pam } protocols = " imap lmtp" service lmtp { unix_listener /var/spool/postfix/private/dovecot-lmtp { group = postfix mode = 0600 user = postfix } } ssl = no ssl_cert = </etc/dovecot/private/dovecot.pem ssl_client_ca_dir = /etc/ssl/certs ssl_key = # hidden, use -P to show it userdb { driver = passwd }

1 0

Re: Sieve junks mail script creating links
by Aki Tuomi 02 Mar '20

02 Mar '20

On 19.2.2020 8.51, @lbutlr wrote: > On 18 Feb 2020, at 22:52, Aki Tuomi <aki.tuomi(a)open-xchange.com> wrote: >> Why not turn on autoexpunge after next nuke? https://doc.dovecot.org/configuration_manual/namespace/#namespace-settings > I should have mentioned I did this: > > mailbox Junk { > auto = subscribe > autoexpunge = 2 weeks > special_use = \Junk > > It’s not working. There were over half a million files in my Junk folder, almost all hard links with over 3,000 links. > Keeping reply in-list... Does this happen after each nuke or was it just first time? Aki

2 2

dovecot-lmtp dont see otherMailbox record?
by pi0trek75 01 Mar '20

01 Mar '20

Hello Postfix + LDAP , Samba as LDAP server, Dovecot virtual_transport set in postfix to dovecot-lmtp ( for autoresponder support ) Users have their email aliases in the otherMailbox record For example, account_test@example-domain user has an alias: test@exmaple-domain Query from command line works fine: postmap -q test@example-domain ldap://etc/postfix/ad_virtual_ account_test/Maildir/ (The filter in the query ad_virtual_mailbox_maps2.cf looks like this: [cut] scope = sub query_filter = (&(objectclass=person)(|(mail= result_attribute= uid result_format = %u/Maildir/ ) However, sending an email to the alias test@example-domain ends: Feb 28 12:31:40 mbox-01 postfix/lmtp[13474]: 2367A6EF: to=<test@example-domain>, relay=mbox-01[private/dovecot- delay=0.05, delays=0.02/0/0.02, dsn=5.1.1, status=bounced (host mbox-01[private/dovecot-lmtp] said: 550 5.1.1 <test@example-domain> User doesn't exist: test@example-domain (in reply to RCPT TO command)) I modified dovecot-ldap.conf.ext: I changed: user_filter = (&(objectClass=person)(uid=%u) to: user_filter = (&(objectClass=person)(|(uid=% but that didn't solve the problem. Where's the bug? Any hint? Below dovecot configuration: # 2.3.4.1 (f79e8e7e4): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.4 () # OS: Linux 4.19.0-6-amd64 x86_64 Debian 10.2 # Hostname: mbox-01 auth_cache_negative_ttl = 0 auth_username_format = %Ln disable_plaintext_auth = no mail_gid = vmail mail_location = mbox:~/mail:INBOX=/var/mailbox mail_privileged_group = mail mail_uid = vmail managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext vacation-seconds namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } passdb { args = /etc/dovecot/dovecot-ldap.conf driver = ldap } plugin { sieve = /var/mailbox-store/%u/.dovecot sieve_dir = /var/mailbox-store/%u sieve_extensions = +vacation-seconds sieve_trace_debug = yes sieve_trace_dir = /tmp/sieve/ sieve_trace_level = matching sieve_vacation_default_period = 10d sieve_vacation_max_period = 30d sieve_vacation_min_period = 1h } protocols = " imap lmtp sieve pop3 sieve" service auth { unix_listener /var/spool/postfix/private/aut { group = postfix mode = 0666 user = postfix } unix_listener auth-userdb { mode = 0666 user = vmail } } service lmtp { unix_listener /var/spool/postfix/private/dov { group = postfix mode = 0600 user = postfix } } service managesieve-login { inet_listener sieve { port = 4190 } process_min_avail = 0 service_count = 1 vsz_limit = 64 M } service managesieve { process_limit = 1024 } service stats { unix_listener stats-reader { group = vmail mode = 0660 user = vmail } unix_listener stats-writer { group = vmail mode = 0660 user = vmail } } ssl_cert = </etc/dovecot/private/dovecot. ssl_client_ca_dir = /etc/ssl/certs ssl_dh = # hidden, use -P to show it ssl_key = # hidden, use -P to show it userdb { args = /etc/dovecot/dovecot-ldap.conf driver = ldap } protocol lmtp { mail_plugins = " sieve" } protocol lda { info_log_path = /var/log/dovecot-lda.log log_path = /var/log/dovecot-lda-errors.lo mail_plugins = " sieve" } and dovecot-ldap.conf.ext: [cut] deref = never scope = subtree user_attrs = =mail=maildir:/var/mailbox-sto user_filter = (&(objectClass=person)(|(uid=% pass_attrs = uid=user,userPassword=password pass_filter = (&(objectClass=person)(uid=%u) default_pass_scheme = CRYPT

1 0

max number of connections per ip
by Esteban L 29 Feb '20

29 Feb '20

I have been haunted by the following error message or months, that we see using Thunderbird. Unable to connect to your IMAP server. You may have exceeded the maximum number of connections to this server. If so, use the Advanced IMAP Server Settings dialogue to reduce the number of cached connections. If I change my location, via a VPN, the error message goes away and I can connect. I have edited my /etc/dovcot/conf.d/20-imap.conf file by adding the following: protocol imap { # Space separated list of plugins to load (default is global mail_plugins). mail_plugins = $mail_plugins imap_quota # Maximum number of IMAP connections allowed for a user from each IP address. # NOTE: The username is compared case-sensitively. mail_max_userip_connections = 500 } And, I still get the error message. I know myself, I have about 8-9 accounts, some with as many as 10 folders (I know each one count's as it's own mailbox), as does my partner--who would access the internet from my IP. Does that number really have to be like 10,000, or something? If so, why does it start out so small in the first place. If not, what else could I do to avoid this message going forward??

4 9