- dovecot - dovecot.org

mailbox encryption
by David Mehler 17 Jun '19

17 Jun '19

Hello, I've got dovecot 2.3 going, and I've got a file 10-mailcrypt.conf which is loading mail_crypt, thinking that that plugin would propagate through all the services, sieve, lmtp, and mailbox message storage. I'm not seeing anything in the logs indicating that the encryption is happening. I am using a file format dbox specifically sdbox format, and in my mailbox I am seeing files like u.5 and others, a file check on them reveals them as data. Should I be seeing encryption in the logs? Thanks. Dave.

2 3

LDA vs LMTP change in header
by ＠lbutlr 17 Jun '19

17 Jun '19

Switching to dovecot LMTP appears to have change the information in the received header, which appears to be causing my spam filter to wig out and mark local to local emails as spam. Here’s what the received header used to look like: Received: from [10.0.5.3] (c-71-229-144-93.hsd1.co.comcast.net [71.229.144.93]) by mail.covisp.net (Postfix) with ESMTPS id B67B8118AD59 for <kreme(a)kreme.com>; Sun, 16 Aug 2009 22:19:02 -0600 (MDT) As opposed to now: Received: from darth.lan (c-73-14.161.160.hsd1.co.comcast.net [73.14.161.160]) by mail.covisp.net(Postfix 3.4.5/8.13.0) with SMTP id unknown; Sun, 16 Jun 2019 15:26:32 -0600 (envelope-from <kreme(a)kreme.com>) The first has an ESMTPS id and the other has SMTP id unknown, which seems to be causing Spamass-milter to treat the LMTP emails as unauthenticated and then ding them for being from public IPs. -- Thanks to the human heart by which we live, Thanks to its tenderness, its joys, and fears, To me the meanest flower that blows can give Thoughts that do often lie too deep for tears

1 0

What does Solr index do and how to handle its high avaliablity?
by luckydog xf 17 Jun '19

17 Jun '19

Hi, guys, Can you give me an example of solr usage in dovecot? As far as I know, you can search email easily by MUA like outlook, so which role does solr play? And based on https://dovecot.org/pipermail/dovecot/2019-April/115575.html I'm going to use an VIP to host 2 mail servers. Currently, it works in fail over and fail back test except solr index, so how to resolve this? Is it possible to put dovecot index on shared storage like NFS? How to if it's a yes. It seems it's under /var/solr/data/dovecot/data/ How to rebuild if I don't put index data on shared storage in case of fail over? Thanks,

2 3

Dovecot, quota, warning, and issue with setup?
by David Mehler 16 Jun '19

16 Jun '19

Hello, I'm having an issue or two with my new Dovecot setup. I'm running version 2.3.6 new setup, and using sdbox as the mailbox format. I'm getting the following warning: Jun 16 13:57:16 mail dovecot[9583]: lmtp(59153): Warning: quota: Namespace '' is not Maildir, skipping for Maildir++ quota Jun 16 13:57:16 mail dovecot[9583]: lmtp(username(a)example.net)<59153><rjVgD/yCBl0R5wAATNUJJw>: Warning: quota: Namespace '' is not Maildir, skipping for Maildir++ quota I'm also having issue with the public folder, it's not showing up. Below is my doveconf -n output. Any suggestions welcome. Thanks. Dave. # 2.3.6 (7eab80676): /usr/local/etc/dovecot/dovecot.conf # Pigeonhole version 0.5.6 (92dc263a) # OS: FreeBSD 12.0-RELEASE-p4 amd64 # Hostname: mail.example.local auth_cache_size = 10 M auth_default_realm = example.net auth_mechanisms = plain login auth_realms = example.net example.com dict { acl = mysql:/usr/local/etc/dovecot/dovecot-dict-sql.conf.ext quota = mysql:/usr/local/etc/dovecot/dovecot-dict-sql.conf.ext } first_valid_gid = 2100 first_valid_uid = 2100 hostname = mail.example.net imap_client_workarounds = delay-newmail tb-extra-mailbox-sep tb-lsub-flags imap_idle_notify_interval = 29 mins last_valid_gid = 2100 last_valid_uid = 2100 lda_mailbox_autocreate = yes lda_mailbox_autosubscribe = yes lda_original_recipient_header = X-Original-To listen = 172.16.21.3 lmtp_rcpt_check_quota = yes log_timestamp = "%Y-%m-%d %H:%M:%S " mail_access_groups = vmail mail_fsync = never mail_gid = vmail mail_home = /var/vmail/mailboxes/%d/%n mail_location = dbox:~/sdbox mail_plugins = acl fts fts_lucene mail_log notify quota trash virtual welcome zlib mail_crypt mail_privileged_group = vmail mail_server_admin = mailto:postmaster@example.net mail_uid = vmail managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext spamtest spamtestplus virustest editheader imapflags notify imapsieve vnd.dovecot.imapsieve namespace { location = sdbox:/var/vmail/public/:CONTROL=~/sdbox/public:INDEX=~/sdbox/public prefix = Public/ separator = / subscriptions = yes type = public } namespace inbox { inbox = yes location = mailbox Drafts { auto = subscribe special_use = \Drafts } mailbox Sent { auto = subscribe special_use = \Sent } mailbox Spam { auto = subscribe autoexpunge = 30 days special_use = \Junk } mailbox Trash { auto = subscribe autoexpunge = 30 days special_use = \Trash } prefix = separator = / type = private } passdb { args = /usr/local/etc/dovecot/dovecot-sql.conf.ext driver = sql } plugin { acl = vfile acl_shared_dict = proxy::acl fts = lucene fts_autoindex = yes fts_autoindex_exclude = \Junk fts_autoindex_exclude2 = \Trash fts_autoindex_exclude3 = \Spam fts_autoindex_max_recent_msgs = 80 fts_index_timeout = 90 fts_lucene = whitespace_chars=@. normalize no_snowball imapsieve_mailbox1_before = file:/var/vmail/sieve/global/learn-spam.sieve imapsieve_mailbox1_causes = COPY imapsieve_mailbox1_name = Spam imapsieve_mailbox2_before = file:/var/vmail/sieve/global/learn-ham.sieve imapsieve_mailbox2_causes = COPY imapsieve_mailbox2_from = Spam imapsieve_mailbox2_name = * mail_crypt_curve = prime256v1 mail_crypt_global_private_key = # hidden, use -P to show it mail_crypt_global_public_key = # hidden, use -P to show it mail_crypt_save_version = 2 mail_log_events = delete undelete expunge copy mailbox_delete mailbox_rename mail_log_fields = uid box msgid size quota = maildir:User quota quota_exceeded_message = Storage quota for this account has been exceeded, please try again later. quota_grace = 10%% quota_rule2 = Trash:ignore quota_status_nouser = DUNNO quota_status_overquota = 552 5.2.2 Mailbox is full quota_status_success = DUNNO quota_vsizes = true quota_warning = storage=100%% quota-exceeded 100 %u quota_warning2 = storage=95%% quota-warning 95 %u quota_warning3 = storage=90%% quota-warning 90 %u quota_warning4 = storage=85%% quota-warning 85 %u quota_warning5 = storage=75%% quota-warning 75 %u sieve = file:/var/vmail/sieve/%d/%n/scripts;active=/var/vmail/sieve/%d/%n/active-script.sieve sieve_after = /home/vmail/sieve/after.d sieve_before = /var/vmail/sieve/global/spam-global.sieve sieve_extensions = +notify +imapflags +spamtest +spamtestplus +virustest +editheader sieve_global_dir = /home/vmail/sieve sieve_global_extensions = +vnd.dovecot.pipe +vnd.dovecot.execute +vnd.dovecot.environment sieve_max_redirects = 30 sieve_max_script_size = 1M sieve_pipe_bin_dir = /usr/bin sieve_plugins = sieve_imapsieve sieve_extprograms sieve_spamtest_max_header = X-Spamd-Result: default: [[:alnum:]]+ \[-?[[:digit:]]+\.[[:digit:]]+ / (-?[[:digit:]]+\.[[:digit:]]+)\] sieve_spamtest_status_header = X-Spamd-Result: default: [[:alnum:]]+ \[(-?[[:digit:]]+\.[[:digit:]]+) / -?[[:digit:]]+\.[[:digit:]]+\] sieve_spamtest_status_type = score sieve_user_log = /home/vmail/sieve/sieve_error.log sieve_virustest_status_header = X-Virus-Scan: Found to be (.+)\. sieve_virustest_status_type = text sieve_virustest_text_value1 = clean sieve_virustest_text_value5 = infected trash = /usr/local/etc/dovecot/trash.conf welcome_script = welcome %u postmaster@%d welcome_wait = yes } postmaster_address = postmaster(a)example.net protocols = imap lmtp sieve sendmail_path = /usr/local/sbin/sendmail service auth-worker { user = vmail } service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0660 user = postfix } unix_listener auth-userdb { group = vmail mode = 0666 user = vmail } } service dict { unix_listener dict { mode = 0600 user = vmail } user = root } service imap-login { inet_listener imap { port = 143 } inet_listener imaps { port = 993 ssl = yes } process_min_avail = 1 } service imap { executable = imap } service lmtp { executable = lmtp unix_listener /var/spool/postfix/private/dovecot-lmtp { group = postfix mode = 0660 user = postfix } } service managesieve-login { inet_listener sieve { address = 172.16.21.3 port = 4190 } } service quota-status { client_limit = 1 executable = quota-status -p postfix unix_listener /var/spool/postfix/private/dovecot-quota { group = postfix mode = 0660 user = postfix } } service quota-warning { executable = script /usr/local/etc/dovecot/quota-warning.sh unix_listener quota-warning { group = vmail mode = 0660 user = vmail } user = vmail } service welcome { executable = script /usr/local/etc/dovecot/welcome.sh unix_listener welcome { user = vmail } user = vmail } ssl = required ssl_cert = </usr/local/etc/ssl/acme.sh/example.net/fullchain.crt ssl_cipher_list = ECDH+AESGCM:ECDH+CHACHA20:ECDH+AES256:ECDH+AES128:!aNULL:!SHA1 ssl_curve_list = P-256 ssl_dh = # hidden, use -P to show it ssl_key = # hidden, use -P to show it ssl_min_protocol = TLSv1.2 ssl_options = no_ticket ssl_prefer_server_ciphers = yes userdb { args = /usr/local/etc/dovecot/dovecot-sql.conf.ext driver = sql } protocol lmtp { info_log_path = /var/log/dovecot/dovecot-lmtp.log log_path = /var/log/dovecot/dovecot-lmtp-errors.log mail_fsync = optimized mail_plugins = acl fts fts_lucene mail_log notify quota trash virtual welcome zlib mail_crypt sieve } protocol lda { mail_fsync = optimized mail_plugins = acl fts fts_lucene mail_log notify quota trash virtual welcome zlib mail_crypt sieve } protocol imap { mail_max_userip_connections = 20 mail_plugins = acl fts fts_lucene mail_log notify quota trash virtual welcome zlib mail_crypt imap_acl imap_quota imap_sieve imap_zlib last_login } protocol sieve { info_log_path = /var/log/dovecot/dovecot-sieve.log log_path = /var/log/dovecot/dovecot-sieve-errors.log }

2 1

Self-signed TLS client certificates
by Marvin Gülker 16 Jun '19

16 Jun '19

Dear List, I self-host my e-mail and run Dovecot since ever I do that. Dovecot version is 2.3.4.1 (f79e8e7e4), running on Debian testing. Now I am trying to configure Dovecot for client TLS certificates. I have a self-signed certificate whose private key resides on a smartcard (Yubikey, to be exact). I wanted Dovecot to accept that TLS client certificate instead of a password. So I searched and found this wiki page: <https://wiki2.dovecot.org/SSL/DovecotConfiguration#Client_certificate_verif…> But that Wiki page says: > The CA file should contain the certificate(s) followed by the matching > CRL(s). Note that the CRLs are required to exist. I have now messed three hours or so with OpenSSL to get a CRL generated for my self-signed certificate, but I can't get that to work (the problem appearently being that OpenSSL doesn't play well with private keys on smartcards). It doesn't make sense anyway, why does one need a CRL for a self-signed certificate? If the self-signed certificate's key gets compromised, the CRL does not help at all. So, here are my questions: 1. Is a CRL really a hard requirement? 2. If not: can I just use the self-signed certificate of my private key for the ssl_ca setting? 3. If yes: any idea how I can generate a CRL for my smartcard-bound self-signed certificate? Marvin -- Blog: https://mg.guelker.eu

2 3

failed to pipe to program sa-learn-spam.sh
by ＠lbutlr 16 Jun '19

16 Jun '19

Error: program `/usr/lib/dovecot/sieve/sa-learn-spam.sh' terminated abnormally, signal 11 Error: sieve: pipe action: failed to pipe message to program `sa-learn-spam.sh': refer to server log for more information. [2019-05-29 17:59:12] What server log? This is all that get logged. # pwd /usr/lib/dovecot/sieve # ls -lsa > total 96 > 8 drwxrwxrwx 3 root wheel 512 Jun 18 2018 . > 8 drwxr-xr-x 3 root wheel 512 May 17 17:54 .. > 8 -rw-r--r-- 1 root wheel 86 Jun 15 2018 default.sieve > 8 drwxr-xr-x 2 root wheel 512 Jun 13 2018 global > 8 -rw-r--r-- 1 root wheel 62 May 14 2018 mark-read.sieve > 8 -rw-r--r-- 1 kremels wheel 192 Jun 17 2018 mark-read.svbin > 8 -rwxr-xr-x 1 root wheel 314 Feb 12 2018 report-ham.sieve > 8 -rw-r--r-- 1 lbutler wheel 448 Jun 18 2018 report-ham.svbin > 8 -rwxr-xr-x 1 root wheel 199 Feb 12 2018 report-spam.sieve > 8 -rw-r--r-- 1 kreme wheel 354 Jun 15 2018 report-spam.svbin > 8 -rwxr-xr-x 1 root wheel 131 Jun 18 2018 sa-learn-ham.sh > 8 -rwxr-xr-x 1 root wheel 54 Feb 12 2018 sa-learn-spam.sh # cat sa-learn-spam.sh > #!/bin/sh > exec /usr/local/bin/sa-learn -u ${1} --spam # ls -ls /usr/local/bin/sa-learn > 96 -rwxr-xr-x 1 root wheel 45939 May 29 09:59 /usr/local/bin/sa-learn report-spam.sieve: > require ["vnd.dovecot.pipe", "copy", "imapsieve", "environment", "variables"]; > > if environment :matches "imap.user" "*" { > set "username" "${1}"; > } > > pipe :copy "sa-learn-spam.sh" [ "${username}" ]; in doveconf I have: > managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date ihave > > plugin { > imapsieve_mailbox1_before = file:/usr/lib/dovecot/sieve/report-spam.sieve > imapsieve_mailbox1_causes = COPY > imapsieve_mailbox1_name = Junk > … It WAS working. -- Women and cats will do as they please, and men and dogs should relax an get used to the idea.

3 6

NOTIFY: bug on mailbox renaming and deletion ?
by kael 16 Jun '19

16 Jun '19

Hello, Testing the NOTIFY extension on imap.vivaldi.net, seems there's a bug when a mailbox is renamed or deleted. Requesting events with: A1 NOTIFY SET (inboxes (SubscriptionChange MailboxName)) Here are the sent events: - mailbox creation with automatic subscription (ok): * LIST () "." foo * LIST (\Subscribed) "." foo - mailbox renaming (bug ?): * LIST () "." bar ("OLDNAME" (foo)) * LIST (\Subscribed) "." bar * LIST () "." foo - mailbox deletion (bug ?): * LIST (\NonExistent) "." Trash.bar * LIST () "." Trash.bar It seems that for the two latter cases, the last received event is incorrect, Dovecot notifying of mailbox unsubscription after the mailbox has been renamed or deleted. In that case a client would consider those two last events not as mailbox renaming or deletion, but as a mailbox creation, wouldn't it ? Am I missing something ? Cheers. -- kael

1 0

sdbox format, quota not maildir, and public folder
by David Mehler 16 Jun '19

16 Jun '19

Hello, I'm using Dovecot 2.3.x and using dbox as mailbox storage format, specifically sdbox. I'm getting an error from quota about namespace is not maildir is there a setting I have to use for quota to use the sdbox?

1 0

Dovecot 2.3 error, FreeBSD 12 in a jail
by David Mehler 15 Jun '19

15 Jun '19

Hello, I'm trying to get Dovecot going on my system. It's a FreeBSD 12.0-RELEASE system and it's running dovecot 2.3 via ports in a jail. I'm getting the same error message(s) as in this bug report, which has been marked as closed: https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=225078 Dovecot is not starting at all in this jail when starting with service dovecot start. A service dovecot status also reveals the error message about /var/run/dovecot/dovecot.conf file, but a doveconf -n does not reveal any configuration file issues. I did put a symlink in /var/run/dovecot to /usr/local/etc/dovecot/dovecot.conf, this did not correct the issue. Any suggestions welcome. Thanks. Dave.

2 1

LMTP doesn't save to +mailbox
by ＠lbutlr 14 Jun '19

14 Jun '19

Since switching to lmtp in dovecot, mail to user+mailboix(a)example.com does not get saved in ‘.mailbox’ as it did with LDA, instead it gets saved into the INBOX. If it matters, these are users who do NOT have a ~/.active_sieve file. I could understand (though it would bene a bit annoying) if the save overrode this mechanism. I did add lmtp_save_to_detail_mailbox = yes in the protocol lmtp block protocol lmtp { postmaster_address = postmaster(a)covisp.net # required mail_plugins = quota sieve info_log_path = /var/log/dovecot-lmtp.log lmtp_save_to_detail_mailbox = yes } This is the error I am getting when sending to luser+covisp(a)covisp.net lmtp(luser(a)covisp.net)<91193><EqkiJV70A105ZAEAIdGjjQ>: Error: sieve: msgid=<A3ED963A-97FB-4A1F-9F09-45F2AEA96CF6(a)kreme.com>: failed to store into mailbox 'covisp': Mailbox doesn't exist: covisp lmtp(luser(a)covisp.net)<91193><EqkiJV70A105ZAEAIdGjjQ>: Error: sieve: Execution of script /usr/lib/dovecot/sieve/default.sieve failed with unsuccessful implicit keep # cat /usr/lib/dovecot/sieve/default.sieve [13:32] [/var/log] require "fileinto"; if header :contains "X-spam-flag" "YES" { fileinto "Junk"; } (This file hasn’t changed in a year, so it worked fine with the lda instead of the lmtp setup. I mean, I can probably just write a sieve to do it. Let me think… if header :regex "to" “+(.*)@" { fileinto :create “${1}"; stop; } Seems like it should work. Should I add this to default.sieve? # 2.3.6 (7eab80676): /usr/local/etc/dovecot/dovecot.conf # Pigeonhole version 0.5.6 (92dc263a) # OS: FreeBSD 11.2-RELEASE-p10 i386 # Hostname: mail.covisp.net auth_failure_delay = 5 secs auth_mechanisms = PLAIN LOGIN default_client_limit = 4096 default_process_limit = 1024 default_vsz_limit = 768 M disable_plaintext_auth = no first_valid_uid = 89 imap_id_log = * login_log_format_elements = user=<%u> %r %m %c mail_location = maildir:~/Maildir mail_max_userip_connections = 90 managesieve_notify_capability = mailto managesieve_sieve_capability = editheader fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date ihave namespace inbox { inbox = yes location = mailbox Archive { auto = subscribe special_use = \Archive } mailbox Drafts { special_use = \Drafts } mailbox Junk { auto = subscribe special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } passdb { args = /usr/local/etc/dovecot/sql.conf driver = sql } plugin { imapsieve_mailbox1_before = file:/usr/lib/dovecot/sieve/report-spam.sieve imapsieve_mailbox1_causes = COPY imapsieve_mailbox1_name = Junk imapsieve_mailbox2_before = file:/usr/lib/dovecot/sieve/report-ham.sieve imapsieve_mailbox2_causes = COPY imapsieve_mailbox2_from = Junk imapsieve_mailbox2_name = * imapsieve_mailbox3_before = file:/usr/lib/dovecot/sieve/mark-read.sieve imapsieve_mailbox3_causes = COPY imapsieve_mailbox3_name = Archive quota_rule2 = .EXPUNGED:ignore sieve = file:~/.sieve;active=~/.active_sieve sieve_default = /usr/lib/dovecot/sieve/default.sieve sieve_default_name = spamassassin sieve_extensions = +editheader sieve_global_extensions = +vnd.dovecot.pipe +vnd.dovecot.environment sieve_pipe_bin_dir = /usr/lib/dovecot/sieve sieve_plugins = sieve_imapsieve sieve_extprograms sieve_user_log = ~/sieve.log } service auth { unix_listener /var/spool/postfix/private/auth { mode = 0666 } } service imap-login { inet_listener imaps { port = 993 ssl = yes } } service lmtp { unix_listener /var/spool/postfix/private/dovecot-lmtp { group = postfix mode = 0600 user = postfix } } service pop3-login { inet_listener pop3 { port = 0 } inet_listener pop3s { port = 995 ssl = yes } } service stats { unix_listener stats-reader { group = dovecot mode = 0666 user = } unix_listener stats-writer { group = dovecot mode = 0666 user = } } ssl_cert = </usr/local/etc/dehydrated/certs/covisp.net/fullchain.pem ssl_dh = # hidden, use -P to show it ssl_key = # hidden, use -P to show it ssl_min_protocol = TLSv1.1 userdb { args = /usr/local/etc/dovecot/sql.conf default_fields = uid=vpopmail gid=vchkpw mail_location=maildir:/usr/local/virtual/%u/Maildir mail=maildir:/usr/local/virtual/%u/Maildir driver = sql } protocol imap { mail_plugins = " imap_sieve" } protocol lmtp { info_log_path = /var/log/dovecot-lmtp.log lmtp_save_to_detail_mailbox = yes mail_plugins = quota sieve postmaster_address = postmaster(a)covisp.net }

1 2