- dovecot - dovecot.org

Unable to authenticate on Dovecot - auth-userdb issue?
by Mark ADAMS 03 Jan '20

03 Jan '20

Some general information: Mageia Linux 5.4.6-desktop-2.mga7 2.3.7.2 (3c910f64b) postfix + dovecot + mysql 192.168.1.105 (shuttle) the email server machine 192.168.1.103 (pvr) the mail client machine I am unable to authenticate to send email. I've looked at postfix but I can't get past dovecot's authentication. Here is what I'm seeing in logs: Jan 02 18:46:47 shuttle sshd[6660]: Connection closed by 192.168.1.100 port 48506 [preauth] Jan 02 18:47:05 shuttle postfix/smtpd[6352]: connect from pvr[192.168.1.103] Jan 02 18:47:16 shuttle postfix/smtpd[6352]: lost connection after CONNECT from pvr[192.168.1.103] Jan 02 18:47:16 shuttle postfix/smtpd[6352]: disconnect from pvr[192.168.1.103] commands=0/0 Jan 02 18:47:36 shuttle postfix/smtpd[6352]: connect from pvr[192.168.1.103] Jan 02 18:47:36 shuttle postfix/smtpd[6352]: 6345D4A4A97: client=pvr[192.168.1.103] Jan 02 18:47:37 shuttle postfix/cleanup[6500]: 6345D4A4A97: message-id=<> Jan 02 18:47:37 shuttle postfix/qmgr[1385]: 6345D4A4A97: from=<madams@pvr>, size=485, nrcpt=1 (queue active) Jan 02 18:47:37 shuttle postfix/smtpd[6352]: disconnect from pvr[192.168.1.103] helo=1 mail=1 rcpt=1 data=1 quit=1 commands=5 Jan 02 18:47:37 shuttle dovecot[6744]: lda(root@shuttle)<6744><>: Error: auth-master: userdb lookup(root@shuttle): connect(/run/dovecot/auth-userdb) failed: Permission denied (euid=8(mail) egid=12(mail) missing +r perm: /run/dovecot/auth-userdb, dir owned by 0:0 mode=0755) Jan 02 18:47:37 shuttle dovecot[6744]: lda: Fatal: Internal error occurred. Refer to server log for more information. Jan 02 18:47:37 shuttle postfix/pipe[6743]: 6345D4A4A97: to=<root@shuttle>, relay=dovecot, delay=1.1, delays=1.1/0.01/0/0.06, dsn=4.3.0, status=deferred (temporary failure. Command output: lda(root@shuttle): Error: net_connect_unix(/run/dovecot/stats-writer) failed: Permission denied ) ^C Note: this error references "/run/dovecot/auth-userdb". That isn't even supposed to be the location of that file. I have no idea why that location shows up. The correct location should be "/etc/dovecot/auth-userdb". The file does exist at that location. There is no "base_dir" configured in /etc/dovecot/dovecot.conf. When I do try an point the configuration at the correct base_dir, I get this when I try to restart dovecot: -- The unit dovecot.service has entered the 'failed' state with result 'exit-code'. Jan 02 18:51:50 shuttle dovecot[7226]: master: Error: service(aggregator): unlink(/etc/dovecot/replication-notify-fifo) failed: Read-only file system Jan 02 18:51:50 shuttle dovecot[7226]: master: Error: service(pop3): unlink(/etc/dovecot/login/pop3) failed: Read-only file system Jan 02 18:51:50 shuttle dovecot[7226]: master: Error: service(old-stats): unlink(/etc/dovecot/old-stats) failed: Read-only file system Jan 02 18:51:50 shuttle dovecot[7226]: master: Error: service(old-stats): unlink(/etc/dovecot/old-stats-mail) failed: Read-only file system Jan 02 18:51:50 shuttle dovecot[7226]: master: Error: service(old-stats): unlink(/etc/dovecot/old-stats-user) failed: Read-only file system Jan 02 18:51:50 shuttle dovecot[7226]: master: Error: service(log): unlink(/etc/dovecot/log-errors) failed: Read-only file system Jan 02 18:51:50 shuttle dovecot[7226]: master: Error: service(lmtp): unlink(/etc/dovecot/lmtp) failed: Read-only file system Jan 02 18:51:50 shuttle dovecot[7226]: master: Error: service(ipc): unlink(/etc/dovecot/ipc) failed: Read-only file system Jan 02 18:51:50 shuttle dovecot[7226]: master: Error: service(ipc): unlink(/etc/dovecot/login/ipc-proxy) failed: Read-only file system Jan 02 18:51:50 shuttle dovecot[7226]: master: Error: service(indexer-worker): unlink(/etc/dovecot/indexer-worker) failed: Read-only file system And there are about 30 lines of "read-only file system" errors. I haven't been able to track down the cause of that. Once the line "base_dir = /etc/dovecot" is commented out in /etc/dovecot/dovecot.conf, I can start dovecot: # systemctl status dovecot ● dovecot.service - Dovecot IMAP/POP3 email server Loaded: loaded (/usr/lib/systemd/system/dovecot.service; enabled; vendor preset: disabled) Active: active (running) since Thu 2020-01-02 18:54:15 MST; 5s ago Docs: man:dovecot(1) http://wiki2.dovecot.org/ Main PID: 7550 (dovecot) Memory: 3.8M CGroup: /system.slice/dovecot.service ├─7550 /usr/sbin/dovecot -F ├─7554 dovecot/anvil ├─7555 dovecot/log └─7556 dovecot/config Jan 02 18:54:15 shuttle systemd[1]: Started Dovecot IMAP/POP3 email server. Jan 02 18:54:15 shuttle dovecot[7550]: master: Dovecot v2.3.7.2 (3c910f64b) starting up for imap, pop3, lmtp Jan 02 18:54:15 shuttle dovecot[7550]: master: Error: t_readlink(/etc/dovecot/dovecot.conf) failed: readlink() failed: Invalid argument I have no idea what's up with the t_readlink error. Might be related to the errors above. I can't really find out much about it. Trying to send email shows no apparent errors: [madams@pvr ~]$ mail root@shuttle Subject: testing test . EOT [madams@pvr ~]$ Trying to send mail in detail looks like this: $ openssl s_client -connect shuttle:25 -starttls smtp CONNECTED(00000003) depth=0 C = US, ST = NM, O = Personal, OU = Private verify error:num=18:self signed certificate verify return:1 depth=0 C = US, ST = NM, O = Personal, OU = Private verify return:1 --- Certificate chain 0 s:/C=US/ST=NM/O=Personal/OU=Private i:/C=US/ST=NM/O=Personal/OU=Private --- Server certificate <It produces all the right certificate information> -----END CERTIFICATE----- subject=/C=US/ST=NM/O=Personal/OU=Private issuer=/C=US/ST=NM/O=Personal/OU=Private --- No client certificate CA names sent Peer signing digest: SHA512 Server Temp Key: ECDH, P-256, 256 bits --- SSL handshake has read 1764 bytes and written 467 bytes --- New, TLSv1/SSLv3, Cipher is ECDHE-RSA-AES256-GCM-SHA384 Server public key is 2048 bit Secure Renegotiation IS supported Compression: NONE Expansion: NONE No ALPN negotiated SSL-Session: <and all the SSL information is good> Start Time: 1578016729 Timeout : 300 (sec) Verify return code: 18 (self signed certificate) --- 250 CHUNKING ehlo shuttle 250-shuttle 250-PIPELINING 250-SIZE 10240000 250-VRFY 250-ETRN 250-AUTH PLAIN 250-ENHANCEDSTATUSCODES 250-8BITMIME 250-DSN 250-SMTPUTF8 250 CHUNKING mail from: madams@pvr 250 2.1.0 Ok rcpt to: root@shuttle 250 2.1.5 Ok data 354 End data with <CR><LF>.<CR><LF> subject: testing test . 250 2.0.0 Ok: queued as A73A84A4AE4 quit 221 2.0.0 Bye closed That transaction produces this in journalctl: an 02 19:04:15 shuttle postfix/smtpd[8856]: connect from pvr[192.168.1.103] Jan 02 19:04:15 shuttle dovecot[7555]: auth: Debug: Loading modules from directory: /usr/lib64/dovecot/modules/auth Jan 02 19:04:15 shuttle dovecot[7555]: auth: Debug: Module loaded: /usr/lib64/dovecot/modules/auth/lib20_auth_var_expand_crypt.so Jan 02 19:04:15 shuttle dovecot[7555]: auth: Debug: Read auth token secret from /run/dovecot/auth-token-secret.dat Jan 02 19:04:15 shuttle dovecot[7555]: auth: Debug: auth client connected (pid=0) Jan 02 19:04:31 shuttle postfix/smtpd[8856]: B621F4A4B0F: client=pvr[192.168.1.103] Jan 02 19:04:39 shuttle postfix/cleanup[8914]: B621F4A4B0F: message-id=<> Jan 02 19:04:40 shuttle postfix/qmgr[1385]: B621F4A4B0F: from=<madams@pvr>, size=184, nrcpt=1 (queue active) Jan 02 19:04:40 shuttle dovecot[8947]: lda(root@shuttle)<8947><>: Error: auth-master: userdb lookup(root@shuttle): connect(/run/dovecot/auth-userdb) failed: Permission denied (euid=8(mail) egid=12(mail) missing +r perm: /run/dovecot/auth-userdb, dir owned by 0:0 mode=0755) Jan 02 19:04:40 shuttle dovecot[8947]: lda: Fatal: Internal error occurred. Refer to server log for more information. Jan 02 19:04:40 shuttle postfix/pipe[8946]: B621F4A4B0F: to=<root@shuttle>, relay=dovecot, delay=13, delays=13/0.01/0/0.06, dsn=4.3.0, status=deferred (temporary failure. Command output: lda(root@shuttle): Error: net_connect_unix(/run/dovecot/stats-writer) failed: Permission denied ) Jan 02 19:04:43 shuttle postfix/smtpd[8856]: disconnect from pvr[192.168.1.103] ehlo=2 starttls=1 mail=1 rcpt=1 data=1 quit=1 commands=7 Jan 02 19:04:48 shuttle sshd[8962]: Connection closed by 192.168.1.100 port 48596 [preauth] I've experimented with ownership and permissions on run/dovecot/auth-userdb. It's running as vmail:dovecot, but the permissions I set on it are not persistent - they keep reverting to srw----- whenever I restart dovecot. This is correct given the configuration in dovecot.conf, but should those permissions be set to 0600? Also, that shouldn't be happening in /run/dovcot, it should all be happening in /etc/dovcot. Attempting to test authentication over TLS isn't working and I'm so confused at this point I'm not even sure I should be doing it. 250 CHUNKING ehlo shuttle 250-shuttle 250-PIPELINING 250-SIZE 10240000 250-VRFY 250-ETRN 250-AUTH PLAIN 250-ENHANCEDSTATUSCODES 250-8BITMIME 250-DSN 250-SMTPUTF8 250 CHUNKING auth login 535 5.7.8 Error: authentication failed: Invalid authentication mechanism auth login bWFkYW1z bm9uZQ== 501 5.5.4 Syntax: AUTH mechanism auth plain bWFkYW1z bm9uZQ== 501 5.5.4 Syntax: AUTH mechanism And those are base64 encoded credentials (bWFkYW1z bm9uZQ==). Here is my config. All I want to do is run from machines on my lan to Thunderbird on my desktop so I can get notices about events and system health from my other servers. Should this be so hard? Is this Postfix's fault? Can anybody help with this? Thanks. And now that config: # dovecot -n # 2.3.7.2 (3c910f64b): /etc/dovecot/dovecot.conf # OS: Linux 5.4.6-desktop-2.mga7 x86_64 Mageia 7 # Hostname: shuttle auth_debug_passwords = yes auth_username_format = %Ln disable_plaintext_auth = no first_valid_uid = 0 last_valid_uid = 10001 mail_gid = 10001 mail_location = mbox:~/mail:INBOX=/var/mail/%u mail_privileged_group = mail mail_uid = 10001 namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } passdb { args = %s driver = pam } plugin { sieve = file:~/sieve;active=~/.dovecot.sieve } service auth-worker { user = vmail } service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0666 user = postfix } unix_listener auth-userdb { group = dovecot mode = 0600 user = vmail } user = dovecot } service imap-login { inet_listener imap { port = 143 } } service lmtp { unix_listener /var/spool/postfix/private/dovecot-lmtp { group = postfix mode = 0600 user = postfix } } service pop3-login { inet_listener pop3s { port = 995 ssl = yes } } ssl = required ssl_cert = </etc/pki/tls/certs/fullchain.cer ssl_dh = # hidden, use -P to show it ssl_key = # hidden, use -P to show it protocol lmtp { hostname = shuttle postmaster_address = postmaster@shuttle }

2 1

iOS Client Not Showing Email Previews, Dovecot Issue?
by asai＠globalchangemusic.org 02 Jan '20

02 Jan '20

Greetings, Just wondering if anybody would know why one of our users' iOS Mail app client doesn't show the email previews (the first few sentences of the email)? We had migrated from an earlier (2.2.4) version of Dovecot to the latest version and once that was done, the user began to report this issue. I don't know if it's a Dovecot issue or not, but can anyone point me in the right direction to begin to debug? Thank you, Asai

3 2

spamsieve question
by Gerben Wierda 31 Dec '19

31 Dec '19

My new dovecot covers spam/ham training through the standard Spam_train and Notspam_train mailboxes. When a message is copied (I’m using macOS/iOS standard Apple clients) it triggers the spam/ham learning by rspamd. So far so good. When I move a message to Spam_train I’d like it to be removed immediately after learning. When I move a message to Notspam_train, I’d like it to move back where it came from after having been piped The first is I think doable, but how? Is the second doable? Gerben Wierda Chess and the Art of Enterprise Architecture <https://ea.rna.nl/the-book/> Mastering ArchiMate <https://ea.rna.nl/the-book-edition-iii/> Architecture for Real Enterprises <https://www.infoworld.com/blog/architecture-for-real-enterprises/> at InfoWorld On Slippery Ice <https://eapj.org/on-slippery-ice/> at EAPJ

1 0

Problem with big number of pop3-login [1 pre-login]
by Григорий Семенов 30 Dec '19

30 Dec '19

Dear all, I have recently migrated from my old Debian 8 (jessie) system to a new VM with fresh Debian 10 (buster) installation. Previous dovecot version was 2.2.13 and now I have 2.3.4.1. Dovecot was setup from Debian packages. Mostly, it is working, but one problem is just frustrating me. The number of some pop3-login processes are getting higher and higher until they reach my login_max_processes_count option which is equal 1000. From ps aux it looks like this: dovecot 55067 0.0 0.0 8192 6340 ? S 00:09 0:00 dovecot/pop3-login [1 pre-login] dovecot 55344 0.0 0.0 8192 6388 ? S 00:35 0:00 dovecot/pop3-login [1 pre-login] dovecot 55351 0.0 0.0 8192 6268 ? S 00:35 0:00 dovecot/pop3-login [1 pre-login] dovecot 55354 0.0 0.0 8192 6388 ? S 00:35 0:00 dovecot/pop3-login [1 pre-login] dovecot 55594 0.0 0.0 8192 6280 ? S 00:36 0:00 dovecot/pop3-login [1 pre-login] dovecot 56822 0.0 0.0 8192 6300 ? S 00:36 0:00 dovecot/pop3-login [1 pre-login] dovecot 56996 0.0 0.0 8192 6268 ? S 00:36 0:00 dovecot/pop3-login [1 pre-login] … Once it reaches the login_max_processes_count value my users start to complain to no new mail is arriving. Restart resolves the problem just for some time, until it will come to a limit next time (sometimes it take 1 day, sometimes 1 hour). In my old system I had nothing like that, but I guess it could be done something wrong during migration. I don’t know if it is significant but instead of real users I deal with only one third-party application which utilizeses 5 simultaneous tcp connections to check mailboxes via SSL\TLS. My dovecot is not public, and there is nothing else besides these 5 connections. Currently, in a config I have this: service pop3-login { process_min_avail = 4 process_limit = 4 client_limit = 100 service_count = 100 Please friends give me a way how to handle the situation. Might it be a bug? ========= Regards, Greg Semenov

1 0

Re: Issue running Dovecot in Docker Container
by Naveen Reddy 30 Dec '19

30 Dec '19

I'm not using internal logging. I'm running the docker with the logging to the host. I have used the same options you have specified. The problem is that the below processes are not running inside docker container whereas the standalone dovecot is running these processes(meaning without container) dovecot-Dovecot/auth dovecot-Dovecot/ssl-params dovecot-Director/lmtp dovecot-Director/ssl-params dovecot-Director/imap-login director Thanks & Regards, Naveen On Mon, Dec 30, 2019 at 3:16 PM Marc Roos <M.Roos(a)f1-outsourcing.eu> wrote: > > If you are running your container as root. You will not have the issues > I encountered. Dovecot is dropping to the 'dovecot' and 'dovenull'(?) > when needed, this is fine. > > PS. I would not recommend using internal logging, use something like > this to log to the host or remote syslog. > docker run -v /dev/log:/dev/log -it dovecot-proxy > > > -----Original Message----- > Subject: Re: Issue running Dovecot in Docker Container > > Hi Marc, > > I can see the processes are running as a root in container environment. > Do you think that still have issues ? > Here is the processes running inside container: > > bash-4.2# ps -ef > UID PID PPID C STIME TTY TIME CMD > root 1 0 0 Dec27 ? 00:00:00 /bin/bash /bootstrap.sh > root 7 1 0 Dec27 ? 00:00:00 /usr/sbin/dovecot -F -c > /etc/dovecot/director.conf > root 8 1 0 Dec27 ? 00:00:00 /usr/sbin/dovecot -F > root 9 1 0 Dec27 ? 00:00:00 sleep 36000d > dovecot 10 8 0 Dec27 ? 00:00:00 dovecot-Dovecot/anvil > dovecot 14 7 0 Dec27 ? 00:00:00 dovecot-Director/anvil > root 267 8 0 Dec27 ? 00:00:00 dovecot-Dovecot/log > root 269 8 0 Dec27 ? 00:00:08 dovecot-Dovecot/config > root 281 7 0 Dec27 ? 00:00:00 dovecot-Director/log > root 283 7 0 Dec27 ? 00:00:00 dovecot-Director/config > > > > > Thanks & Regards, > Naveen > > > > On Mon, Dec 30, 2019 at 2:56 PM Marc Roos <M.Roos(a)f1-outsourcing.eu> > wrote: > > > > I have noticed several issues with dovecot, trying to run it > without > root. Which is preferable in any container environment. Maybe you > would > like me to document these somewhere? So at some point they can be > applied. > > > -----Original Message----- > From: Naveen Reddy [mailto:naveenreddy99@gmail.com] > Sent: 30 December 2019 09:02 > To: Aki Tuomi > Cc: dovecot(a)dovecot.org > Subject: Re: Issue running Dovecot in Docker Container > > Hi, I can see those values correctly with the doveconf -nc > command. > Here > is the part of output: > > bash-4.2# doveconf -nc /etc/dovecot/director.conf # 2.2.36 > (1f10bfa63): > /etc/dovecot/director.conf # OS: Linux > 4.1.12-112.14.11.el7uek.x86_64 > x86_64 Red Hat Enterprise Linux Server release 7.7 (Maipo) # > Hostname: > 69b492645b56 auth_debug = yes auth_default_realm = > xxxxxxxxxxxxxxxx > > auth_verbose = yes base_dir = /var/run/dovecot_director > debug_log_path = > $log_path director_mail_servers = xxxxxxxxxxxxxxxxxx > director_servers = > xxxxxxxxxxxxxxxxxxxx disable_plaintext_auth = no first_valid_uid = > 1000 > hostname = xxxxxxxxxxxxxxxxxxxx info_log_path = $log_path > instance_name > = Director lmtp_proxy = yes log_path = /dovecot.log > login_log_format_elements = user=<%u> method=%m rip=%r lip=%l > mpid=%e %c > home=%h > > Thanks & Regards, > Naveen > > > > On Fri, Dec 27, 2019 at 10:08 PM Aki Tuomi > <aki.tuomi(a)open-xchange.com> > wrote: > > > > Can you check with `doveconf -nc /path/to/director.conf` > that the > values are actually set correctly? > > Aki > > On 27/12/2019 15:34 Naveen Reddy > <naveenreddy99(a)gmail.com> > wrote: > > > > The conf.d files are not included. I have added > !include > conf.d/*.conf to director.conf and reloaded the dovecot and > director > services. > > conf.d/10-logging also has the following lines: > > log_path = /dovecot.log > info_log_path = $log_path > debug_log_path = $log_path > > > The /dovecot.log file still shows empty. Nothing > is being > logged to that file. > > > Thanks & Regards, > Naveen > > > > On Thu, Dec 26, 2019 at 10:52 PM Aki Tuomi < > aki.tuomi(a)open-xchange.com> wrote: > > > > Do you have !include or !try_include in > director.conf? > The conf.d files are not included otherwise. > > Aki > > On 26/12/2019 11:27 Naveen Reddy < > naveenreddy99(a)gmail.com> wrote: > > > I have tried these in the > 10-logging.conf but no > luck. There is nothing logged to the file. > > bash-4.2# ps -ef > UID PID PPID C STIME TTY > > TIME CMD > root 1 0 0 Dec23 ? > > 00:00:00 > /bin/bash /bootstrap.sh > root 8 1 0 Dec23 ? > > 00:00:00 > sleep 36000d > root 15681 0 0 08:51 > pts/1 > 00:00:00 bash > root 16340 0 0 09:19 ? > > 00:00:00 > /usr/sbin/dovecot -c /etc/dovecot/director.conf > dovecot 16341 16340 0 09:19 ? > > 00:00:00 > dovecot-Director/anvil > root 16342 16340 0 09:19 ? > > 00:00:00 > dovecot-Director/log > root 16344 16340 0 09:19 ? > > 00:00:00 > dovecot-Director/config > root 16390 0 0 09:22 ? > > 00:00:00 > /usr/sbin/dovecot -c /etc/dovecot/dovecot.conf > dovecot 16391 16390 0 09:22 ? > > 00:00:00 > dovecot-Dovecot/anvil > root 16392 16390 0 09:22 ? > > 00:00:00 > dovecot-Dovecot/log > root 16394 16390 0 09:22 ? > > 00:00:00 > dovecot-Dovecot/config > root 16406 15681 0 09:22 > pts/1 > 00:00:00 ps > -ef > > > The below processes are not > starting as well. > > dovecot-Dovecot/auth > dovecot-Dovecot/ssl-params > dovecot-Director/lmtp > dovecot-Director/ssl-params > dovecot-Director/imap-login > director > > Thanks & Regards, > Naveen > > > > On Tue, Dec 24, 2019 at 10:54 PM > Aki Tuomi < > aki.tuomi(a)open-xchange.com> wrote: > > > > > > On 24/12/2019 > 12:33 > Naveen Reddy < > naveenreddy99(a)gmail.com> wrote: > > > Hello, > > We need help with > an issue that we are > running into when we are trying to run Dovecot in Docker > container. > > Also how do we > enable debugging for > dovecot. Logs doesn't show any info about the issue. > > Below processes > are > not running when a > Director service is started: > > > dovecot-Dovecot/auth > > dovecot-Dovecot/ssl-params > > dovecot-Director/lmtp > > dovecot-Director/ssl-params > > dovecot-Director/imap-login director > > Here is the > version > that I'm running and > including the dovecot -n output below: > > bash-4.2# dovecot > --version > 2.2.36 > > > bash-4.2# dovecot > -n > # 2.2.36 (xxxxx): > /etc/dovecot/dovecot.conf > # OS: Linux > 4.1.12-112.14.11.el7uek.x86_64 > x86_64 Red Hat Enterprise Linux Server release 7.7 (Maipo) > # Hostname: XXXXXXX > auth_debug = yes > auth_default_realm > = xxxxxxxxxxxx > auth_verbose = yes > > disable_plaintext_auth = no > dotlock_use_excl = > no > hostname = > xxxxxxxxxxxxxxxx > instance_name = > Dovecot > > login_log_format_elements = user=<%u> > method=%m rip=%r lip=%l mpid=%e %c home=% domain=%d > mail_debug = yes > mail_fsync = always > mail_gid = imapd > mail_home = > /xxxxxxxxxxx/%d/%n > mail_location = > dbox:~/ > mail_uid = imapd > mmap_disable = yes > passdb { > args = > /etc/dovecot/lookups/ldap-pass.conf > driver = ldap > } > passdb { > args = > /etc/dovecot/lookups/xxxx.conf > driver = ldap > } > plugin { > stats_refresh = > 30 secs > stats_track_cmds > = yes > } > protocols = imap > lmtp > service auth { > client_limit = > 4096 > unix_listener > auth-userdb { > mode = 0777 > } > } > service imap-login > { > chroot = login > client_limit = 0 > > drop_priv_before_exec = no > executable = > imap-login > extra_groups = > group = > idle_kill = 0 > inet_listener > imap { > address = > port = 1144 > ssl = no > } > inet_listener > imaps { > address = > port = 994 > ssl = yes > } > privileged_group > = > process_limit = 0 > > process_min_avail > = 0 > protocol = imap > service_count = > 50 > type = login > user = > $default_login_user > vsz_limit = > 18446744073709551615 B > } > service imap { > service_count = > 50 > } > service lmtp { > executable = > lmtp > -L > inet_listener > lmtp { > address = > port = 10025 > } > } > service stats { > fifo_listener > stats-mail { > mode = 0600 > user = imapd > } > } > ssl_cert = > </xxxxxxx/cert/dovecot.pem > ssl_cipher_list = > XXXXXX > ssl_key = # > hidden, use -P to show it > ssl_protocols = > XXXXX > userdb { > args = > /etc/dovecot/lookups/ldap-user.conf > driver = ldap > } > userdb { > args = > /etc/dovecot/lookups/xxxxxxx.conf > driver = ldap > } > > > Thanks & Regards, > Naveen > > > > Try setting > > log_path=/dovecot.log > info_log_path=$log_path > debug_log_path=$log_path > --- > Aki Tuomi > > > --- > Aki Tuomi > > > --- > Aki Tuomi > > > > > >

3 4

Re: Issue running Dovecot in Docker Container
by Naveen Reddy 30 Dec '19

30 Dec '19

Hi Marc, I can see the processes are running as a root in container environment. Do you think that still have issues ? Here is the processes running inside container: bash-4.2# ps -ef UID PID PPID C STIME TTY TIME CMD root 1 0 0 Dec27 ? 00:00:00 /bin/bash /bootstrap.sh root 7 1 0 Dec27 ? 00:00:00 /usr/sbin/dovecot -F -c /etc/dovecot/director.conf root 8 1 0 Dec27 ? 00:00:00 /usr/sbin/dovecot -F root 9 1 0 Dec27 ? 00:00:00 sleep 36000d dovecot 10 8 0 Dec27 ? 00:00:00 dovecot-Dovecot/anvil dovecot 14 7 0 Dec27 ? 00:00:00 dovecot-Director/anvil root 267 8 0 Dec27 ? 00:00:00 dovecot-Dovecot/log root 269 8 0 Dec27 ? 00:00:08 dovecot-Dovecot/config root 281 7 0 Dec27 ? 00:00:00 dovecot-Director/log root 283 7 0 Dec27 ? 00:00:00 dovecot-Director/config Thanks & Regards, Naveen On Mon, Dec 30, 2019 at 2:56 PM Marc Roos <M.Roos(a)f1-outsourcing.eu> wrote: > > I have noticed several issues with dovecot, trying to run it without > root. Which is preferable in any container environment. Maybe you would > like me to document these somewhere? So at some point they can be > applied. > > > -----Original Message----- > From: Naveen Reddy [mailto:naveenreddy99@gmail.com] > Sent: 30 December 2019 09:02 > To: Aki Tuomi > Cc: dovecot(a)dovecot.org > Subject: Re: Issue running Dovecot in Docker Container > > Hi, I can see those values correctly with the doveconf -nc command. Here > is the part of output: > > bash-4.2# doveconf -nc /etc/dovecot/director.conf # 2.2.36 (1f10bfa63): > /etc/dovecot/director.conf # OS: Linux 4.1.12-112.14.11.el7uek.x86_64 > x86_64 Red Hat Enterprise Linux Server release 7.7 (Maipo) # Hostname: > 69b492645b56 auth_debug = yes auth_default_realm = xxxxxxxxxxxxxxxx > auth_verbose = yes base_dir = /var/run/dovecot_director debug_log_path = > $log_path director_mail_servers = xxxxxxxxxxxxxxxxxx director_servers = > xxxxxxxxxxxxxxxxxxxx disable_plaintext_auth = no first_valid_uid = 1000 > hostname = xxxxxxxxxxxxxxxxxxxx info_log_path = $log_path instance_name > = Director lmtp_proxy = yes log_path = /dovecot.log > login_log_format_elements = user=<%u> method=%m rip=%r lip=%l mpid=%e %c > home=%h > > Thanks & Regards, > Naveen > > > > On Fri, Dec 27, 2019 at 10:08 PM Aki Tuomi <aki.tuomi(a)open-xchange.com> > wrote: > > > > Can you check with `doveconf -nc /path/to/director.conf` that the > values are actually set correctly? > > Aki > > On 27/12/2019 15:34 Naveen Reddy <naveenreddy99(a)gmail.com> > > wrote: > > > > The conf.d files are not included. I have added !include > conf.d/*.conf to director.conf and reloaded the dovecot and director > services. > > conf.d/10-logging also has the following lines: > > log_path = /dovecot.log > info_log_path = $log_path > debug_log_path = $log_path > > > The /dovecot.log file still shows empty. Nothing is being > logged to that file. > > > Thanks & Regards, > Naveen > > > > On Thu, Dec 26, 2019 at 10:52 PM Aki Tuomi < > aki.tuomi(a)open-xchange.com> wrote: > > > > Do you have !include or !try_include in > director.conf? > The conf.d files are not included otherwise. > > Aki > > On 26/12/2019 11:27 Naveen Reddy < > naveenreddy99(a)gmail.com> wrote: > > > I have tried these in the 10-logging.conf > but no > luck. There is nothing logged to the file. > > bash-4.2# ps -ef > UID PID PPID C STIME TTY > TIME CMD > root 1 0 0 Dec23 ? > 00:00:00 > /bin/bash /bootstrap.sh > root 8 1 0 Dec23 ? > 00:00:00 > sleep 36000d > root 15681 0 0 08:51 pts/1 > 00:00:00 bash > root 16340 0 0 09:19 ? > 00:00:00 > /usr/sbin/dovecot -c /etc/dovecot/director.conf > dovecot 16341 16340 0 09:19 ? > 00:00:00 > dovecot-Director/anvil > root 16342 16340 0 09:19 ? > 00:00:00 > dovecot-Director/log > root 16344 16340 0 09:19 ? > 00:00:00 > dovecot-Director/config > root 16390 0 0 09:22 ? > 00:00:00 > /usr/sbin/dovecot -c /etc/dovecot/dovecot.conf > dovecot 16391 16390 0 09:22 ? > 00:00:00 > dovecot-Dovecot/anvil > root 16392 16390 0 09:22 ? > 00:00:00 > dovecot-Dovecot/log > root 16394 16390 0 09:22 ? > 00:00:00 > dovecot-Dovecot/config > root 16406 15681 0 09:22 pts/1 > 00:00:00 ps > -ef > > > The below processes are not starting as > well. > > dovecot-Dovecot/auth > dovecot-Dovecot/ssl-params > dovecot-Director/lmtp > dovecot-Director/ssl-params > dovecot-Director/imap-login director > > Thanks & Regards, > Naveen > > > > On Tue, Dec 24, 2019 at 10:54 PM Aki Tuomi > < > aki.tuomi(a)open-xchange.com> wrote: > > > > > > On 24/12/2019 12:33 Naveen > Reddy < > naveenreddy99(a)gmail.com> wrote: > > > Hello, > > We need help with an issue > that we are > running into when we are trying to run Dovecot in Docker container. > Also how do we enable > debugging for > dovecot. Logs doesn't show any info about the issue. > > Below processes are not > running when a > Director service is started: > > dovecot-Dovecot/auth > dovecot-Dovecot/ssl-params > dovecot-Director/lmtp > dovecot-Director/ssl-params > > dovecot-Director/imap-login director > > Here is the version that > I'm running and > including the dovecot -n output below: > > bash-4.2# dovecot --version > 2.2.36 > > > bash-4.2# dovecot -n > # 2.2.36 (xxxxx): > /etc/dovecot/dovecot.conf > # OS: Linux > 4.1.12-112.14.11.el7uek.x86_64 > x86_64 Red Hat Enterprise Linux Server release 7.7 (Maipo) > # Hostname: XXXXXXX > auth_debug = yes > auth_default_realm = > xxxxxxxxxxxx > auth_verbose = yes > disable_plaintext_auth = no > dotlock_use_excl = no > hostname = xxxxxxxxxxxxxxxx > instance_name = Dovecot > login_log_format_elements > = user=<%u> > method=%m rip=%r lip=%l mpid=%e %c home=% domain=%d > mail_debug = yes > mail_fsync = always > mail_gid = imapd > mail_home = > /xxxxxxxxxxx/%d/%n > mail_location = dbox:~/ > mail_uid = imapd > mmap_disable = yes > passdb { > args = > /etc/dovecot/lookups/ldap-pass.conf > driver = ldap > } > passdb { > args = > /etc/dovecot/lookups/xxxx.conf > driver = ldap > } > plugin { > stats_refresh = 30 secs > stats_track_cmds = yes > } > protocols = imap lmtp > service auth { > client_limit = 4096 > unix_listener > auth-userdb { > mode = 0777 > } > } > service imap-login { > chroot = login > client_limit = 0 > drop_priv_before_exec = > no > executable = imap-login > extra_groups = > group = > idle_kill = 0 > inet_listener imap { > address = > port = 1144 > ssl = no > } > inet_listener imaps { > address = > port = 994 > ssl = yes > } > privileged_group = > process_limit = 0 > process_min_avail = 0 > protocol = imap > service_count = 50 > type = login > user = > $default_login_user > vsz_limit = > 18446744073709551615 B > } > service imap { > service_count = 50 > } > service lmtp { > executable = lmtp -L > inet_listener lmtp { > address = > port = 10025 > } > } > service stats { > fifo_listener stats-mail > { > mode = 0600 > user = imapd > } > } > ssl_cert = > </xxxxxxx/cert/dovecot.pem > ssl_cipher_list = XXXXXX > ssl_key = # hidden, use > -P to show it > ssl_protocols = XXXXX > userdb { > args = > /etc/dovecot/lookups/ldap-user.conf > driver = ldap > } > userdb { > args = > /etc/dovecot/lookups/xxxxxxx.conf > driver = ldap > } > > > Thanks & Regards, > Naveen > > > > Try setting > > log_path=/dovecot.log > info_log_path=$log_path > debug_log_path=$log_path > --- > Aki Tuomi > > > --- > Aki Tuomi > > > --- > Aki Tuomi > > >

2 1

Issue running Dovecot in Docker Container
by Naveen Reddy 30 Dec '19

30 Dec '19

Hello, We need help with an issue that we are running into when we are trying to run Dovecot in Docker container. Also how do we enable debugging for dovecot. Logs doesn't show any info about the issue. Below processes are not running when a Director service is started: dovecot-Dovecot/auth dovecot-Dovecot/ssl-params dovecot-Director/lmtp dovecot-Director/ssl-params dovecot-Director/imap-login director Here is the version that I'm running and including the dovecot -n output below: bash-4.2# dovecot --version 2.2.36 bash-4.2# dovecot -n # 2.2.36 (xxxxx): /etc/dovecot/dovecot.conf # OS: Linux 4.1.12-112.14.11.el7uek.x86_64 x86_64 Red Hat Enterprise Linux Server release 7.7 (Maipo) # Hostname: XXXXXXX auth_debug = yes auth_default_realm = xxxxxxxxxxxx auth_verbose = yes disable_plaintext_auth = no dotlock_use_excl = no hostname = xxxxxxxxxxxxxxxx instance_name = Dovecot login_log_format_elements = user=<%u> method=%m rip=%r lip=%l mpid=%e %c home=% domain=%d mail_debug = yes mail_fsync = always mail_gid = imapd mail_home = /xxxxxxxxxxx/%d/%n mail_location = dbox:~/ mail_uid = imapd mmap_disable = yes passdb { args = /etc/dovecot/lookups/ldap-pass.conf driver = ldap } passdb { args = /etc/dovecot/lookups/xxxx.conf driver = ldap } plugin { stats_refresh = 30 secs stats_track_cmds = yes } protocols = imap lmtp service auth { client_limit = 4096 unix_listener auth-userdb { mode = 0777 } } service imap-login { chroot = login client_limit = 0 drop_priv_before_exec = no executable = imap-login extra_groups = group = idle_kill = 0 inet_listener imap { address = port = 1144 ssl = no } inet_listener imaps { address = port = 994 ssl = yes } privileged_group = process_limit = 0 process_min_avail = 0 protocol = imap service_count = 50 type = login user = $default_login_user vsz_limit = 18446744073709551615 B } service imap { service_count = 50 } service lmtp { executable = lmtp -L inet_listener lmtp { address = port = 10025 } } service stats { fifo_listener stats-mail { mode = 0600 user = imapd } } ssl_cert = </xxxxxxx/cert/dovecot.pem ssl_cipher_list = XXXXXX ssl_key = # hidden, use -P to show it ssl_protocols = XXXXX userdb { args = /etc/dovecot/lookups/ldap-user.conf driver = ldap } userdb { args = /etc/dovecot/lookups/xxxxxxx.conf driver = ldap } Thanks & Regards, Naveen

3 7

Dovecot Postfix MySQL Authentication Issues
by jason hirsh 29 Dec '19

29 Dec '19

I aim using mysql 5.7.28 Postfix 3.4,8 Dovecot 2.3.9.2 It began a whole and I was using the Purple Hat Organiation installation guide which was loaded with minor errors Now dead in water

1 0

Dovecot Postfix MySQL Authentication Issues
by jason hirsh 29 Dec '19

29 Dec '19

I am I a situation where I have to wipe my remote server and reinstall, Its been a while since I built a server and I am not as sharp as I use to be I am running FreeBSD 12.1. well at least the server is... I am getting constant authentication errors like Dec 28 22:10:18 triggerfish dovecot[21809]: imap-login: Aborted login (auth failed, 1 attempts in 6 secs): user=<jason(a)example.com>, method=PLAIN, rip=73.150.178.106, lip=x.x.x.x, TLS, session=<QFSvEM+aA8lJlrJq> Dec 28 22:10:19 triggerfish dovecot[21809]: imap-login: Aborted login (client didn't finish SASL auth, waited 4 secs): user=<>, method=LOGIN, rip=73.150.178.106, lip=x.x.x.x, TLS, session=<FNjXEM+aBMlJlrJq> Dec 28 22:10:19 triggerfish dovecot[21809]: imap-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=73.150.178.106, lip=x,x,x,x, TLS: Connection closed, session=<pNccEc+aBslJlrJq> Dec 28 22:10:24 triggerfish dovecot[21809]: imap-login: Aborted login (auth failed, 1 attempts in 6 secs): user=<jason(a)example.com>, method=LOGIN, rip=73.150.178.106, lip=x,x,x,x, TLS, session=<hukLEc+aBclJlrJq> results of postconf -n are broken_sasl_auth_clients = yes command_directory = /usr/local/sbin compatibility_level = 2 daemon_directory = /usr/local/libexec/postfix data_directory = /var/db/postfix debug_peer_level = 2 debugger_command = PATH=/bin:/usr/bin:/usr/local/bin:/usr/X11R6/bin ddd $daemon_directory/$process_name $process_id & sleep 5 dovecot_destination_recipient_limit = 1 html_directory = /usr/local/share/doc/postfix inet_protocols = ipv4 mail_owner = postfix mailq_path = /usr/local/bin/mailq manpage_directory = /usr/local/man message_size_limit = 25600000 meta_directory = /usr/local/libexec/postfix mydestination = localhost mydomain = example.com myhostname = mail.example.com mynetworks_style = host newaliases_path = /usr/local/bin/newaliases queue_directory = /var/spool/postfix readme_directory = /usr/local/share/doc/postfix relay_recipient_maps = mysql:/usr/local/etc/postfix/mysql-virtual-mailbox-maps.cf sample_directory = /usr/local/etc/postfix sendmail_path = /usr/local/sbin/sendmail setgid_group = maildrop shlib_directory = /usr/local/lib/postfix smtp_tls_note_starttls_offer = yes smtp_use_tls = yes smtpd_delay_reject = yes smtpd_helo_required = yes smtpd_helo_restrictions = permit_mynetworks, permit_sasl_authenticated, reject_invalid_hostname, reject_unknown_hostname, reject_non_fqdn_hostname, reject_non_fqdn_helo_hostname, reject_invalid_helo_hostname, permit smtpd_recipient_restrictions = permit_mynetworks, permit_sasl_authenticated, reject_non_fqdn_hostname, reject_non_fqdn_sender, reject_non_fqdn_recipient, reject_unauth_destination, reject_unauth_pipelining, reject_rbl_client bl.spamcop.net, reject_rbl_client sbl-xbl.spamhaus.org, reject_rbl_client zen.spamhaus.org, reject_rbl_client dnsbl.sorbs.net, reject_rbl_client rhsbl.sorbs.net, reject_rbl_client db.wpbl.info, reject_rbl_client cbl.abuseat.org, reject_rbl_client proxies.blackholes.wirehub.net, reject_rbl_client query.bondedsender.org permit smtpd_relay_restrictions = permit_mynetworks permit_sasl_authenticated defer_unauth_destination smtpd_sasl_auth_enable = yes smtpd_sasl_path = private/auth smtpd_sasl_type = dovecot smtpd_sender_restrictions = permit_mynetworks, permit_sasl_authenticated, reject_non_fqdn_sender, reject_unknown_sender_domain, reject_unlisted_sender, permit smtpd_tls_auth_only = yes smtpd_tls_cert_file = /usr/local/etc/ssl/more/server.crt smtpd_tls_key_file = /usr/local/etc/ssl/more/server.key smtpd_tls_loglevel = 0 smtpd_tls_mandatory_protocols = !SSLv2,!SSLv3 smtpd_tls_received_header = yes smtpd_tls_session_cache_timeout = 3600s smtpd_use_tls = yes soft_bounce = no tls_random_source = dev:/dev/urandom unknown_local_recipient_reject_code = 550 virtual_alias_maps = mysql:/usr/local/etc/postfix/mysql-virtual-alias-maps.cf virtual_mailbox_domains = mysql:/usr/local/etc/postfix/mysql-virtual-domains-maps.cf virtual_mailbox_limit = 51200000 virtual_mailbox_maps = mysql:/usr/local/etc/postfix/mysql-virtual-mailbox-maps.cf virtual_transport = lmtp:unix:private/dovecot-lmtp Not sure if I need to post main.cf. I have been beating my head against the screen for a week and thought I'd try here. Probably some stupid typo or stupid action on my part. Feel free to slap me around

2 1

Using "doveadm pw" as unpriviledged user
by Ralf Jung 29 Dec '19

29 Dec '19

Hi all, Some time ago, I wrote a small CGI script to let users change their IMAP password. The script runs as www-data user and uses "doveadm pw" to check if a password hash matches a password. Unfortunately, this means that I have to make large parts of my dovecot config world-readable, as otherwise I get errors like this: doveconf: Fatal: Error in configuration file /etc/dovecot/conf.d/10-auth.conf line 123: Couldn't open include file /etc/dovecot/conf.d/auth-sql.conf.ext: Permission denied I understand doveadm also does plenty of things that interact with the running dovecot instance and thus need access to the config, but for generating hashes or comparing hashes with passwords, it should not be necessary to read the dovecot config. This shouldn't require a properly setup dovecot on this machine at all, in fact. I'd prefer to make the config not world-readable, and indeed the Debian packaging sometimes makes those files not-world-readable on upgrades, breaking my setup. Is there any way to call "doveadm pw" as a users that cannot read the dovecot config on the current machine? This happens with the following versions of the dovecot debian package: 1:2.3.4.1-5+deb10u1~bpo9+1, 1:2.3.4.1-5+deb10u1 Thanks! Ralf PS: Please keep me in Cc, as I am not subscribed to the list.

1 0