- dovecot - dovecot.org

IMAP Permissions per IP
by Jorge Bastos 10 Aug '20

10 Aug '20

Howdy, Is it possible to define IMAP permissions per IT? What i would like to do is: * IP 1.1.1.1 IS THE ONLY ONE that has permission for EXPUNGE Is it possible? Thanks in advanced,

2 1

is there a way to run doveadm expunge with exception?
by teacup 09 Aug '20

09 Aug '20

is there a way to run this command but with exception to not delete the FLAGGED email? doveadm expunge -u user(a)email.com mailbox Inbox SENTBEFORE 90d -- Sent from: http://dovecot.2317879.n4.nabble.com/

2 2

IPv6 auth failed
by Lefteris Tsintjelis 09 Aug '20

09 Aug '20

I am using latest Windows Thunderbird 68.11.0 and dovecot 2.3.10.1_2 with FreeBSD 12.1-RELEASE-p8. Whenever I enable dovecot IPv6 and I try to login I get auth failed. Aug 09 08:36:11 imap-login: Info: Disconnected: Inactivity (auth failed, 2 attempts in 180 secs): user=<user(a)domain.com>, method=CRAM-MD5, rip=1:2:3:4::5, lip=1:2:3:6::7, TLS, session=<HZeFLGusb8IgAQZ8LNQAEgAAAAAAAAAC> Switching dovecot back to IPv4 only (listen = *) starts to work as expected. Roundcube seems to also have the same problem whenever dovecot IPv6 is enabled.

2 4

Re: [EXT] Re: mail_crypt folder keys without sql database
by Aki Tuomi 06 Aug '20

06 Aug '20

> On 06/08/2020 13:52 secure.light.0417.road <secure.light.0417.road(a)protonmail.com> wrote: > > > Ah, right. The hashed password can't be used to encrypt. > > I want to remove possibility to decrypt mails using materials in mail servers in VPS. I've thought about below scenario: > > 1. The client generates asymmetric keys in local. > 2. The client sends the public key to the dovecot in the mail server. > 3. The dovecot generates a symmetric key. > 4. The dovecot encrypts a received mail with the symmetric key. > 5. The dovecot also encrypts the symmetric key with the public key. > 6. The client get the mail and encrypted symmetric key from server into local and decrypts it using local private key. > You probably want to use PGP then. > Instead of 1 and 2, the way like "the dovecot generates all 3 and removes only private key", can be considered with docker image deployment. mail_crypt plugin is primarily intended to protect storage medium, and not end user as such. While it does support this, it's not perfect tool for it, and can be bit difficult to set up. Dovecot does not support client-supplied private keys. > > Is it possible with mail_crypt? > > narangd > Aki p.s. please keep responses on the list.

1 0

Re: [EXT] Re: mail_crypt folder keys without sql database
by Aki Tuomi 06 Aug '20

06 Aug '20

mail_crypt_private_password cannot be hashed, as it's used to encrypt the key. Aki > On 06/08/2020 10:06 secure.light.0417.road <secure.light.0417.road(a)protonmail.com> wrote: > > > I've tried to append the field "userdb_mail_crypt_private_password=<same-hashed-password-in-passwd-file>" to the end of each user line in userdb as passwd-file. And use the command below to generate keys. > > doveadm -o plugin/mail_crypt_private_password=<not-hashed-user-password> mailbox cryptokey generate -u <username> -U > > I confirmed mail encryption work properly. > > Also I've compared two "dovecot-attribute" files with and without "mail_crypt_require_encrypted_user_key = yes". Seemingly they have no difference. How to check that the private key in dovecot-attribute be encrypted properly? > > narangd > > Sent with ProtonMail Secure Email. > > ‐‐‐‐‐‐‐ Original Message ‐‐‐‐‐‐‐ > On Thursday, August 6, 2020 1:03 AM, Aki Tuomi <aki.tuomi(a)open-xchange.com> wrote: > > > > On 05/08/2020 18:45 secure.light.0417.road secure.light.0417.road(a)protonmail.com wrote: > > > Hello, > > > Can the mail_crypt "folder keys" feature be used with encrypted user keys in passwd-file without sql database? It seems that there is no guide in the docs. > > > Best regards, > > > narangd > > > > Dovecot stores folder and user keys into mail_attribute_dict. This does not have to be SQL database. > > > > You can also add `userdb_mail_crypt_private_password` into passwd-file to provide it if you use passwd-file as userdb. > > > > Aki

1 0

director backend failover?
by Markus Raps 06 Aug '20

06 Aug '20

Hi, i have short question for automatic failover, directors <-> backends is this still the way to go? -> https://dovecot.org/pipermail/dovecot/2012-October/138816.html https://github.com/brandond/poolmon -- Mit freundlichen Grüßen / best regards Markus Raps

1 0

mail_crypt folder keys without sql database
by secure.light.0417.road 05 Aug '20

05 Aug '20

Hello, Can the mail_crypt "folder keys" feature be used with encrypted user keys in passwd-file without sql database? It seems that there is no guide in the docs. Best regards, narangd

2 1

Migration issue
by Kishore Potnuru 05 Aug '20

05 Aug '20

Hi All, I have tried the below command to migrate the data from the old server(dovecot version: 2.0.9) to new servers(dovecot version: 2.2.36 (1f10bfa63)). But it's throwing an error. old server name: production1 new server1 name: production2 (for HA/Replication) new server2 name: production3 (for HA/Replication) I have configured replication between production2 and production3, which is working fine. The issue is, the below command I am trying is from production2 server and trying to take the data from production1 server. ------------- [root@production2 log]# doveadm backup -a All -R -u kishore(a)test.testorg.com imapc: dsync(kishore(a)test.testorg.com): Info: imapc(production1.testorg.com:143): Connected to xxx.xxx.xxx.xxx:143 (local yyy.yyy.yyy.yyy:45992) dsync(kishore(a)test.testorg.com): Warning: imapc(production1.testorg.com:143): connect(xxx.xxx.xxx.xxx, 143) timed out after 30 seconds - reconnecting (delay 0 ms) dsync(kishore(a)test.testorg.com): Info: imapc(production1.testorg.com:143): Connected to xxx.xxx.xxx.xxx:143 (local yyy.yyy.yyy.yyy:46014) dsync(kishore(a)test.testorg.com): Error: imapc(production1.testorg.com:143): connect(xxx.xxx.xxx.xxx, 143) timed out after 30 seconds - disconnecting dsync(kishore(a)test.testorg.com): Error: User initialization failed: imapc: Login to production1.testorg.com failed: Disconnected from server [root@production2 log]# -------------- I looked into the production1 (old server) logs. I see the below error. =============== Jul 28 11:14:23 auth: Fatal: Master passdb can't have pass=yes if there are no passdbs Jul 28 11:14:23 master: Error: service(auth): command startup failed, throttling =============== after the above error, I have commented "pass=yes" in production1 (old server) server, then I see the below error. ================ Jul 28 11:17:10 auth: Fatal: No passdbs specified in configuration file. PLAIN mechanism needs one Jul 28 11:17:10 master: Error: service(auth): command startup failed, throttling =============== Please suggest me on fixing the issue. Adding the dovecot.conf configuration from old and new servers: ========================================= My old server dovecot.conf (production1): ========================================= disable_plaintext_auth = no listen = * log_path = /var/log/dovecot.log mail_location = maildir:/z1dev/mail/virtual/%d/%n/Maildir/ passdb { args = /etc/dovecot/passwd driver = passwd-file master = yes pass = yes } pop3_uidl_format = %g protocols = pop3 imap ssl = yes ssl_cert = </etc/pki/dovecot/certs/dovecot.pem ssl_key = </etc/pki/dovecot/private/dovecot.pem userdb { args = uid=vmail gid=vmail home=/z1dev/mail/virtual/%d/%n driver = static } mail_debug = no verbose_ssl = no ========================================= My New server dovecot.conf(production2): ========================================= disable_plaintext_auth = no listen = * log_path = /var/log/dovecot.log mail_location = maildir:/z1devenv/mail/virtual/%d/%n/Maildir/ passdb { args = /etc/dovecot/passwd driver = passwd-file } pop3_uidl_format = %g protocols = pop3 imap ssl = yes ssl_cert = </etc/pki/dovecot/certs/dovecot.pem ssl_key = </etc/pki/dovecot/private/dovecot.pem userdb { args = uid=vmail gid=vmail home=/z1devenv/mail/virtual/%d/%n driver = static } mail_debug = yes verbose_ssl = no # Enable the replication plugin globally mail_plugins = $mail_plugins notify replication service replicator { process_min_avail = 1 } dsync_remote_cmd = ssh -l%{login} %{host} doveadm dsync-server -u%u plugin { mail_replica = remote:vmail@production3.testorg.com } service aggregator { fifo_listener replication-notify-fifo { user = vmail } unix_listener replication-notify { user = vmail } } service replicator { unix_listener replicator-doveadm { mode = 0600 user = vmail } } replication_max_conns = 10 imapc_host = production1.testorg.com imapc_password = vmail imapc_master_user = vmail imapc_user = %u =================================== Please let me know if you need any other details. Thanks, Kishore Potnuru

3 8

How to access mailbox metadata in Lua push driver
by Ralf Becker 04 Aug '20

04 Aug '20

We're currently using the OX push driver, which is straight forward (simple web hook) and allows to store (multiple) push tokens of our webmailer direct in mailbox metadata. Only drawback is that it only supports new arriving mails in the INBOX, even mails moved via Sieve to other folders are NOT reported. Therefore we updated now to Dovecot 2.3(.10.1) to also get mails moved by user or Sieve scripts, deleted mails or flag changes. As far as I read the example Lua scripts and (a little) the Dovecot C code, the nice indirection of using mailbox metadata to a) enable push and b) store push tokens (modify reported user attribute with them) does NOT exist in the Lua driver by default. So my questions is: how can I access mailbox metadata from within the Lua script, to make eg. the example script behave like the OX driver with user_from_metadata set? I'm happy to update the Lua examples, if that's any help ... Ralf -- Ralf Becker EGroupware GmbH [www.egroupware.org] Handelsregister HRB Kaiserslautern 3587 Geschäftsführer Birgit und Ralf Becker Leibnizstr. 17, 67663 Kaiserslautern, Germany Telefon +49 631 31657-0

2 7

Question about migration 2.2 - 2.3 with replication
by Ralf Becker 03 Aug '20

03 Aug '20

Do both replication nodes need to be updated at the same time? Or can a 2.2(.36.4) node replicate with a 2.3(.10.1)? Ralf -- Ralf Becker EGroupware GmbH [www.egroupware.org] Handelsregister HRB Kaiserslautern 3587 Geschäftsführer Birgit und Ralf Becker Leibnizstr. 17, 67663 Kaiserslautern, Germany Telefon +49 631 31657-0

1 1