- dovecot - dovecot.org

Setting up individual encrypted user keys using mail-crypt-plugin
by emordin 16 May '19

16 May '19

Hi, I have setup up a simple mail server using the ISPMail tutorial and I'm trying to learn how to create email encryption at rest. I'm having a tough time understanding how to set this up... So say a user logins thru roundcube and they type in their password...so the password authenticates to the mysql database which is storing their encrypted private key?? And once they access that private key, how do they use that private key to unencrypt their mailbox? I'm a super noob at this, and I may be off, but I don't know where to start when it comes to setting this up... if I'm way off could you just recommend some tutorials or other basics I should learn first before moving on to setting this up? Sent with [ProtonMail](https://protonmail.com) Secure Email.

2 1

Mutual auth and MS Outlook
by dovecot＠scottsavarese.com 16 May '19

16 May '19

I am trying to get Dovecot IMAP and Outlook to talk to each other with SSL and client certificates enabled. In Dovecot, I have the following options enabled: ssl_ca = ... ssl_verify_client_cert = yes auth_ssl_require_client_cert = yes auth_ssl_username_from_cert = yes when I try to connect with Outlook, I get: May 12 08:07:50 mail dovecot: imap-login: Disconnected (client didn't send a cert): user=<>, method=PLAIN, rip=192.168.1.245, lip=192.168.2.5, TLS: Disconnected, session=<is7gpa+Im97AqAH1> But when I use openssl directly with the same certificates it seems to pass the certificate in just fine. Does anybody have any ideas? Thanks in advance.

2 1

Permissions fix
by Lefteris Tsintjelis 16 May '19

16 May '19

Is there a fast way for dovecot to set and/or fix its directory permissions?

2 2

Anyone using object storage ceph?
by Marc Roos 15 May '19

15 May '19

Just curious if there are already people actively using object storage? https://github.com/ceph-dovecot/dovecot-ceph-plugin https://docplayer.net/docs-images/40/9935441/images/page_13.jpg

2 1

Re: weakforced and GeoIP lookups
by Neil Cook 15 May '19

15 May '19

Hi Tobi, This looks like you haven’t included the libmaxmind libraries before running configure. GeoIP support is only compiled in if it finds the right libs. This would be libmaxminddb-dev on Ubuntu for example. Neil >> Hi list >> >> hope it's okay to ask weakforced questions here as well, but I could not >> find a dedicated mailinglist for wforce. >> >> I want to enable GeoIP lookups in my wforce daemon. In a first step I >> installed luarocks and lua-compat53 to install mmdblua module. >> Then I added >> >> newGeoIP2DB("country", "/usr/local/share/GeoIP/GeoLite2-Country.mmdb") >> local mygeodb = getGeoIP2DB("country") >> if(mygeodb:lookupCountry(lt.remote) == 'XX') >> then >> return -1, "country blocked", "country blocked", { country="XX" } >> end >> >> to wforce.conf and tried to restart wforce but that ends up in a >> >> > Fatal Lua error: [string "chunk"]:28: attempt to call global >> > 'newGeoIP2DB' (a nil value) >> >> Any ideas what I could be missing here? >> >> Cheers >> >> tobi > > > Neil Cook > neil.cook(a)open-xchange.com <mailto:neil.cook@open-xchange.com> > > ------------------------------------------------------------------------------------- > Open-Xchange AG, Rollnerstr. 14, 90408 Nuremberg, District Court Nuremberg HRB 24738 > Managing Board: Rafael Laguna de la Vera, Carsten Dirks, Michael Knapstein, Stephan Martin > Chairman of the Board: Richard Seibt > > European Office: > Open-Xchange GmbH, Olper Huette 5f, D-57462 Olpe, Germany, District Court Siegen, HRB 8718 > Managing Director: Frank Hoberg > > US Office: > Open-Xchange. Inc., 530 Lytton Avenue, Palo Alto, CA 94301, USA > ------------------------------------------------------------------------------------- > Neil Cook neil.cook(a)open-xchange.com <mailto:neil.cook@open-xchange.com> ------------------------------------------------------------------------------------- Open-Xchange AG, Rollnerstr. 14, 90408 Nuremberg, District Court Nuremberg HRB 24738 Managing Board: Rafael Laguna de la Vera, Carsten Dirks, Michael Knapstein, Stephan Martin Chairman of the Board: Richard Seibt European Office: Open-Xchange GmbH, Olper Huette 5f, D-57462 Olpe, Germany, District Court Siegen, HRB 8718 Managing Director: Frank Hoberg US Office: Open-Xchange. Inc., 530 Lytton Avenue, Palo Alto, CA 94301, USA -------------------------------------------------------------------------------------

2 4

LDA-based vacation responses bouncing
by micah anderson 14 May '19

14 May '19

I've got dovecot vacataion auto-responses working via sieve, but when the responses are sent, they are sent as if they are to be locally delivered, which causes them to bounce for domains that I am not local for. How can I get dovecot's sieve vacation response to check the domain is local or not? Here is an example of what happens: The LDA notices it needs to send a vacation response: 2019-05-14T10:50:47.827466-07:00 brant dovecot: lda(user(a)example.org)<14817><xL6LL/f/2lzhOQAAh856Uw>: sieve: msgid=<20190514135045.012486@localhost>: sent vacation response to <someone(a)somewhere.org> but that response was sent via the postfix pipe through the dovecot lda transport... because that is local, and the domain it is sending to is not local, it bounces: 2019-05-14T10:50:47.923333-07:00 brant postfix/pipe[14821]: C998381539: to=<someone(a)somewhere.org>, relay=dovecot, delay=0.11, delays=0.04/0.01/0/0.06, dsn=5.1.1, status=bounced (user unknown) Postfix is set to do this: dovecot unix - n n - - pipe flags=DRhu user=mail argv=/usr/bin/spamc --connect-retries=1 -H -d 10.0.1.92 -s 10240000 -t 100 -u ${recipient} -e /usr/lib/dovecot/dovecot-lda -f ${sender} -d ${recipient} require ["fileinto", "vacation"]; vacation :days 2 :subject "Helllo" "Hi"; Here is my doveconf -n: # 2.3.4.1 (f79e8e7e4): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.4 () # OS: Linux 4.9.0-8-amd64 x86_64 Debian 9.8 auth_worker_max_count = 120 default_client_limit = 6144 default_process_limit = 256 default_vsz_limit = 512 M dict { expire = mysql:/etc/dovecot/dovecot-dict-sql.conf quota = mysql:/etc/dovecot/dovecot-dict-sql.conf } disable_plaintext_auth = no first_valid_gid = 8 first_valid_uid = 8 last_valid_gid = 8 last_valid_uid = 8 listen = * login_greeting = howdy, ready. login_log_format_elements = user=<%u> method=%m rip=%r lip=%l mpid=%e %c %k mail_location = mdbox:~/mdbox mail_plugins = expire quota zlib maildir_very_dirty_syncs = yes namespace { inbox = yes location = prefix = separator = . } namespace { alias_for = hidden = yes inbox = no list = no location = prefix = INBOX. separator = . } passdb { args = /etc/dovecot/dovecot-sql.conf driver = sql } plugin { expire = Trash expire2 = Trash/* expire3 = Spam expire_dict = proxy::expire quota = dict:Your mail quota::proxy::quota quota_rule = *:bytes=100663296 quota_rule2 = Trash:bytes=+20%% quota_rule3 = Spam:bytes=+10%% quota_rule4 = INBOX.Trash:bytes=+20%% quota_rule5 = INBOX.Spam:bytes=+10%% quota_rule6 = INBOX.restored_from_backups:bytes=+500%% sieve = ~/.dovecot.sieve sieve_after = /var/lib/dovecot/sieve/after.sieve sieve_before = /var/lib/dovecot/sieve/default.sieve sieve_dir = ~/sieve zlib_save = gz zlib_save_level = 6 } protocols = " imap pop3" service anvil { unix_listener anvil { group = dovecot mode = 0660 user = root } } service auth { client_limit = 6144 unix_listener auth-userdb { group = mail mode = 0600 user = mail } } service dict { unix_listener dict { group = mail mode = 0600 user = mail } } service imap-login { process_min_avail = 10 service_count = 0 vsz_limit = 512 M } service imap-postlogin { executable = script-login /usr/local/sbin/postlogin_imap } service imap { executable = imap imap-postlogin process_limit = 6144 } service pop3-login { process_min_avail = 10 service_count = 0 vsz_limit = 512 M } service pop3-postlogin { executable = script-login /usr/local/sbin/postlogin_pop } service pop3 { executable = pop3 pop3-postlogin } service stats { unix_listener stats-writer { group = mail mode = 0660 } } ssl_cert = </etc/certs/wildcard/cert.pem ssl_cipher_list = ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA ssl_dh = # hidden, use -P to show it ssl_key = # hidden, use -P to show it ssl_prefer_server_ciphers = yes userdb { args = /etc/dovecot/dovecot-sql.conf driver = sql } verbose_proctitle = yes verbose_ssl = yes protocol lda { mail_plugins = expire quota trees zlib sieve plugin { quota_exceeded_message = Sorry, your message cannot be delivered to that person because their mailbox is full. If you can contact them another way, you may wish to tell them of this problem. quota_rule7 = INBOX:bytes=+10%% } } protocol imap { imap_client_workarounds = delay-newmail tb-extra-mailbox-sep mail_plugins = expire quota trees zlib imap_quota imap_zlib plugin { quota_exceeded_message = You are over quota. To avoid losing mail, immediately empty your Trash and Sent folders and delete emails with large attachments. } } protocol pop3 { mail_plugins = expire quota trees zlib pop3_client_workarounds = outlook-no-nuls oe-ns-eoh pop3_uidl_format = %g } remote 127.0.0.1 { mail_max_userip_connections = 60 } Thanks for any suggestions, micah

1 1

Graceful dovecot reload for LE certificate renewals
by Sidsel Jensen 14 May '19

14 May '19

Hi Dovecot-gurus With the introduction of LE certificates the certificate renewal cycle is a lot faster, unfortunately even a "dovecot reload" cuts the existing connections when doing the cert updates, which is quite frustrating - and yes most clients automatically reconnect but still... Is any work going into implementing a more “graceful reload” for dovecot like the one for nginx where existing connections are preserved with the old cert and new connections get the new cert? Kind Regards, Sidsel Jensen Systems Engineer @ One.com <http://one.com/>

2 1

Graceful dovecot reload for LE certificate renewals
by Sidsel Jensen 14 May '19

14 May '19

Hi Dovecot-gurus With the introduction of LE certificates the certificate renewal cycle is a lot faster, unfortunately even a "dovecot reload" cuts the existing connections when doing the cert updates, which is quite frustrating - and yes most clients automatically reconnect but still... Is any work going into implementing a more “graceful reload” for dovecot like the one for nginx where existing connections are preserved with the old cert and new connections get the new cert? Kind Regards, Sidsel Jensen Systems Engineer @ One.com <http://one.com/>

1 0

weakforced and GeoIP lookups
by Tobi 14 May '19

14 May '19

Hi list hope it's okay to ask weakforced questions here as well, but I could not find a dedicated mailinglist for wforce. I want to enable GeoIP lookups in my wforce daemon. In a first step I installed luarocks and lua-compat53 to install mmdblua module. Then I added newGeoIP2DB("country", "/usr/local/share/GeoIP/GeoLite2-Country.mmdb") local mygeodb = getGeoIP2DB("country") if(mygeodb:lookupCountry(lt.remote) == 'XX') then return -1, "country blocked", "country blocked", { country="XX" } end to wforce.conf and tried to restart wforce but that ends up in a > Fatal Lua error: [string "chunk"]:28: attempt to call global > 'newGeoIP2DB' (a nil value) Any ideas what I could be missing here? Cheers tobi

1 0

Is it possible to (re)direct only 1 imap user to the new server
by Marc Roos 14 May '19

14 May '19

I haven't used dovecot proxy or director. If I have a setup where all my users are connecting to HOSTNAMEOLD, is it possible to have 1 imap user that is connecting to HOSTNAMEOLD directed/forwarded to HOSTNAMENEW? Without changing my dns settings and preferably without creating any new servers. I think I can route one users mail to HOSTNAMENEW with sendmail ldap routing. So the only thing I need to be able to do is have the incoming imap requests on HOSTNAMEOLD been handled by HOSTNAMENEW. HOSTNAMEOLD HOSTNAMENEW +--------------+ +--------------+ | SENDMAIL | | SENDMAIL | | | | | | | | | | | V | | V | |--------------| |--------------| | lmtp | | NS /INBOX | | | | | mbox on | | V | | block device | |--------------| | | | NS /INBOX | |--------------| | mdbox on | | NS /ARCHIVE | | block device | | mdbox on | | | | clustered fs | |--------------| | | | NS /ARCHIVE | +--------------+ | mdbox on | | clustered fs | | | +--------------+

1 0