- dovecot - dovecot.org

[mail-crypt-plugin] Private key location in Folder Key Mode
by emordin 01 Jun '19

01 Jun '19

Nice. It worked but I think there is a little output error (probably not a big issue): When I type the following command I get this output: user'@'host:~$ doveadm -o plugin/mail_crypt_private_private_password=1234 mailbox cryptokey export -u username -U /var/vmail/domain/username/Maildir/dovecot-attributes Folder: Public ID: <Public key ID> Error: -----BEGIN PRIVATE KEY----- <private_key> -----END PRIVATE KEY----- And when I type the following command I get this output: user'@'host:~$ doveadm mailbox cryptokey export -u username -U /var/vmail/domain/username/Maildir/dovecot-attributes Folder: Public ID: <Public key ID> Error: ERROR: error:03070068:bignum routines:BN_mpi2bn:encoding error Key: So in the first command the private key shows but it's under Error, and I believe it should be under Key. Thanks again. Sent with [ProtonMail](https://protonmail.com) Secure Email.

1 0

macOS Notes.app IMAP Syncing Not Working
by Steven Smith 01 Jun '19

01 Jun '19

I’m requesting help getting macOS’s Notes.app to sync notes with a new dovecot IMAP server. Thanks to dovecot’s excellent online documentation and help from this list, I have a new perfectly functioning IMAP server. The issue is that macOS Note.app does not sync with this server. However, iOS Notes.app *does* sync and work well with this IMAP server, and the differences between macOS and iOS Notes apps are well known. (Thanks, Apple.) https://apple.stackexchange.com/questions/265579/notes-wont-sync-via-imap-i… <https://apple.stackexchange.com/questions/265579/notes-wont-sync-via-imap-i…> https://jpmens.net/2015/09/28/experiments-using-imap-for-notes/ <https://jpmens.net/2015/09/28/experiments-using-imap-for-notes/> … I am migrating from a working Server.app system in which Notes.app syncing does work across all devices, and therefore have a working dovecot configuration from Server.app, although it does not contain an explicit configuration for the “Notes” mailbox. I would greatly appreciate any help or pointers for these questions: Does anyone have a working template for dovecot that works with macOS Notes.app? I’ve posted doveconf -n of both the new server and the old Server.app server below. Would you all be able to provide advice on TO-DO’s and NOT-TO-DO’s for mailbox/name-space reconfiguration as I try to muck around with a nicely working, deployed IMAP server? I believe that the solution has something to do with name spaces and separators, and I’ve already changed the separator from the original ‘/’ to ‘.’ on the working server without success or obvious changes. All the mail boxes on the new IMAP server look like this, *without* a prefix ‘.’: > ls -1 /var/mail/tld.domain.mail/username/mdbox/mailboxes/ > Archive/ > Deleted Messages/ > Drafts/ > INBOX/ > Junk/ > Notes/ > Sent/ > Trash/ All the mailboxes on the working Server.app mailserver look like this, *with* a prefix ‘.’: > $ sudo ls -1 /Library/Server/Mail/Data/mail/users/username > .Archive > .Deleted Messages > .Drafts > .Junk > .Notes > .Sent Messages > cur > … > new > subscriptions > tmp Here are the `doveconf -n` of the new server that doesn’t sync macOS Notes.app, and the old Server.app IMAP server that does: New server `dovecot -n` [Note: original separator was set to ‘/’, now changed to ‘.’ in config.d/10-mail.conf]: > # 2.3.6 (): /opt/local/etc/dovecot/dovecot.conf > # Pigeonhole version 0.5.6 () > # OS: Darwin 18.6.0 x86_64 apfs > # Hostname: newhost.domain.tld > auth_cache_size = 10 M > auth_gssapi_hostname = $ALL > auth_krb5_keytab = /opt/local/etc/dovecot/imap.keytab > auth_mechanisms = plain gssapi > auth_realms = newhost.domain.tld > auth_socket_path = /opt/local/var/run/dovecot/auth-userdb > auth_username_format = %Ln > debug_log_path = /opt/local/var/log/mail/mail-debug.log > disable_plaintext_auth = no > first_valid_gid = 6 > first_valid_uid = 6 > imap_id_log = * > imap_id_send = "name" * "version" * > imap_idle_notify_interval = 29 mins > imap_urlauth_submit_user = submit > info_log_path = /opt/local/var/log/mail/mail-info.log > last_valid_gid = 100 > lda_mailbox_autocreate = yes > log_path = /opt/local/var/log/mail/mail-err.log > login_log_format_elements = user=<%u> method=%m rip=%r lip=%l mpid=%e %c > mail_access_groups = mail > mail_attachment_dir = /private/var/mail/tld.domain.mail/attachments > mail_attachment_fs = sis posix:mode=0666 > mail_debug = yes > mail_gid = mail > mail_home = /private/var/mail/tld.domain.mail > mail_location = mdbox:/private/var/mail/tld.domain.mail/%Ln/mdbox > mail_log_prefix = "%s(pid %p user %u): " > mail_plugins = quota zlib acl fts fts_solr fts_lucene > mail_privileged_group = mail > mail_uid = _dovecot > managesieve_notify_capability = mailto > managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext imapsieve vnd.dovecot.imapsieve > mdbox_rotate_size = 200 M > namespace inbox { > inbox = yes > location = > mailbox Archive { > auto = subscribe > special_use = \Archive > } > mailbox Drafts { > auto = subscribe > special_use = \Drafts > } > mailbox Junk { > auto = create > special_use = \Junk > } > mailbox Notspam_train { > auto = create > special_use = \Junk > } > mailbox Sent { > auto = subscribe > special_use = \Sent > } > mailbox "Sent Messages" { > special_use = \Sent > } > mailbox Spam_train { > auto = create > special_use = \Junk > } > mailbox Trash { > auto = create > special_use = \Trash > } > prefix = > separator = . > } > passdb { > driver = pam > name = pam > } > plugin { > fts = solr > fts_autoindex = yes > fts_autoindex_exclude = \Junk > fts_solr = url=http://127.0.0.1:8983/solr/dovecot/ > imapsieve_mailbox1_before = file:/opt/local/etc/dovecot/sieve/report-spam.sieve > imapsieve_mailbox1_causes = COPY APPEND > imapsieve_mailbox1_name = Spam_train > imapsieve_mailbox2_before = file:/opt/local/etc/dovecot/sieve/report-ham.sieve > imapsieve_mailbox2_causes = COPY APPEND > imapsieve_mailbox2_name = Notspam_train > mail_log_events = delete undelete expunge copy mailbox_delete mailbox_rename > mail_log_fields = uid box msgid from subject size flags > quota_grace = 10%% > quota_rule = *:storage=16G > quota_rule2 = Trash:storage=+256M > quota_warning = storage=100%% quota-exceeded %u > quota_warning2 = storage=80%% quota-warning %u > recipient_delimiter = + > sieve = /private/var/mail/tld.domain.mail/rules/%Ln/dovecot.sieve > sieve_after = /opt/local/etc/dovecot/sieve-after.d > sieve_before = /opt/local/etc/dovecot/sieve-before.d > sieve_dir = /private/var/mail/tld.domain.mail/rules/%Ln/%u > sieve_global_extensions = +vnd.dovecot.pipe +vnd.dovecot.environment > sieve_pipe_bin_dir = /opt/local/etc/dovecot/sieve > sieve_plugins = sieve_imapsieve sieve_extprograms > sieve_quota_max_storage = 50M > } > postmaster_address = postmaster(a)domain.tld > protocols = imap lmtp sieve > quota_full_tempfail = yes > sendmail_path = /opt/local/sbin/sendmail > service auth-worker { > group = mail > user = root > } > service auth { > extra_groups = _keytabusers > idle_kill = 15 mins > unix_listener /opt/local/var/spool/postfix/private/auth { > group = mail > mode = 0660 > user = _postfix > } > } > service imap-login { > inet_listener imap { > address = 127.0.0.1, ::1 > port = 143 > } > inet_listener imaps { > port = 993 > ssl = yes > } > process_min_avail = 6 > service_count = 0 > vsz_limit = 2 G > } > service imap { > process_limit = 200 > process_min_avail = 6 > } > service lmtp { > unix_listener /opt/local/var/spool/postfix/private/dovecot-lmtp { > group = mail > mode = 0660 > user = _postfix > } > } > ssl = required > ssl_ca = </etc/certificates/newhost.domain.tld.SHA1.chain.pem > ssl_cert = </etc/certificates/newhost.domain.tld.SHA1.cert.pem > ssl_cipher_list = ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256 > ssl_dh = # hidden, use -P to show it > ssl_key = # hidden, use -P to show it > ssl_min_protocol = TLSv1.2 > ssl_prefer_server_ciphers = yes > userdb { > driver = passwd > name = passwd > } > verbose_proctitle = yes > protocol lda { > mail_fsync = optimized > mail_plugins = quota zlib acl fts fts_solr fts_lucene sieve > } > protocol imap { > mail_max_userip_connections = 50 > mail_plugins = quota zlib acl fts fts_solr fts_lucene imap_acl imap_quota imap_zlib imap_sieve > } > protocol lmtp { > mail_fsync = optimized > mail_plugins = quota zlib acl fts fts_solr fts_lucene sieve > } Old Server.app server `dovecot -n`: > # 2.2.30.2 (c0c463e): /Library/Server/Mail/Config/dovecot/dovecot.conf > # Pigeonhole version 0.4.18 (29cc74d) > # OS: Darwin 17.7.0 x86_64 apfs > aps_topic = com.apple.mail.XServer.d7d6581e-37ed-4a8a-8775-92c4c5a4bf28 > auth_gssapi_hostname = $ALL > auth_mechanisms = cram-md5 plain login gssapi > auth_realms = host.domain.tld > auth_socket_path = /var/run/dovecot/auth-userdb > auth_username_format = %n > debug_log_path = /Library/Logs/Mail/mail-debug.log > default_internal_user = _dovecot > default_login_user = _dovenull > disable_plaintext_auth = no > first_valid_gid = 6 > first_valid_uid = 6 > imap_id_log = * > imap_id_send = "name" * "version" * > imap_urlauth_submit_user = submit > info_log_path = /Library/Logs/Mail/mail-info.log > log_path = /Library/Logs/Mail/mail-err.log > login_log_format_elements = user=<%u> method=%m rip=%r lip=%l mpid=%e %c > mail_access_groups = mail > mail_attribute_dict = file:/Library/Server/Mail/Data/attributes/attributes.dict > mail_location = maildir:/Library/Server/Mail/Data/mail/%u > mail_log_prefix = "%s(pid %p user %u): " > mail_plugins = quota zlib acl fts fts_sk > managesieve_notify_capability = mailto > managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext > mdbox_rotate_size = 200 M > namespace acl-mailboxes { > list = children > location = maildir:/Library/Server/Mail/Data/mail/users/%%u:INDEX=/Library/Server/Mail/Data/mail/shared/%%u > prefix = shared.%%u. > separator = . > subscriptions = no > type = shared > } > namespace inbox { > inbox = yes > location = > mailbox Drafts { > special_use = \Drafts > } > mailbox Junk { > special_use = \Junk > } > mailbox Sent { > special_use = \Sent > } > mailbox "Sent Messages" { > special_use = \Sent > } > mailbox Trash { > special_use = \Trash > } > prefix = > } > namespace list-archives { > list = children > location = maildir:/Library/Server/Mail/Data/listserver/messages/archive/lists/%%u:INDEX=/Library/Server/Mail/Data/listserver/messages/archive/shared/%%u > prefix = archives.%%u. > separator = . > subscriptions = no > type = shared > } > passdb { > driver = od > } > passdb { > args = /Library/Server/Mail/Config/dovecot/submit.passdb > driver = passwd-file > } > plugin { > acl = vfile:/Library/Server/Mail/Config/dovecot/global-acls:cache_secs=300 > acl_shared_dict = file:/Library/Server/Mail/Data/shared/shared-mailboxes > fts = sk > quota = maildir:User quota > quota_warning = storage=100%% quota-exceeded %u > quota_warning2 = storage=80%% quota-warning %u > sieve = /Library/Server/Mail/Data/rules/%u/dovecot.sieve > sieve_dir = /Library/Server/Mail/Data/rules/%u > stats_refresh = 30 secs > stats_track_cmds = yes > } > postmaster_address = postmaster(a)host.domain.tld > protocols = imap pop3 lmtp sieve > quota_full_tempfail = yes > service auth { > extra_groups = _keytabusers > idle_kill = 15 mins > unix_listener auth-userdb { > user = _dovecot > } > } > service dns_client { > unix_listener dns-client { > mode = 0600 > } > } > service imap-login { > inet_listener imap { > port = 143 > } > inet_listener imaps { > port = 993 > ssl = yes > } > service_count = 0 > } > service imap { > client_limit = 5 > process_limit = 200 > service_count = 0 > } > service indexer-worker { > user = _dovecot > } > service lmtp { > unix_listener lmtp { > mode = 0600 > } > } > service managesieve-login { > inet_listener sieve { > port = 4190 > } > } > service pop3-login { > inet_listener pop3 { > port = 110 > } > inet_listener pop3s { > port = 995 > ssl = yes > } > } > service pop3 { > client_limit = 5 > process_limit = 200 > service_count = 0 > } > service quota-exceeded { > executable = script /Applications/Server.app/Contents/ServerRoot/usr/libexec/dovecot/quota-exceeded.sh > unix_listener quota-exceeded { > group = mail > mode = 0660 > user = _dovecot > } > user = _dovecot > } > service quota-warning { > executable = script /Applications/Server.app/Contents/ServerRoot/usr/libexec/dovecot/quota-warning.sh > unix_listener quota-warning { > group = mail > mode = 0660 > user = _dovecot > } > user = _dovecot > } > service stats { > fifo_listener stats-mail { > mode = 0600 > user = _dovecot > } > } > ssl = required > ssl_ca = </etc/certificates/host.domain.tld.SHA1.chain.pem > ssl_cert = </etc/certificates/host.domain.tld.SHA1.cert.pem > ssl_cipher_list = ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA > ssl_key = # hidden, use -P to show it > ssl_key_path = # hidden, use -P to show it > ssl_protocols = !SSLv2 !SSLv3 > userdb { > args = partition=/Library/Server/Mail/Config/dovecot/partition_map.conf global_quota=8192 enforce_quotas=yes > driver = od > } > userdb { > args = /Library/Server/Mail/Config/dovecot/submit.passdb > driver = passwd-file > } > verbose_proctitle = yes > protocol lmtp { > mail_plugins = quota zlib acl fts fts_sk sieve push_notify > } > protocol lda { > mail_plugins = quota zlib acl fts fts_sk sieve push_notify > } > protocol imap { > mail_max_userip_connections = 20 > mail_plugins = quota zlib acl fts fts_sk imap_acl imap_quota imap_zlib > } > protocol pop3 { > mail_max_userip_connections = 6 > }

3 6

[mail-crypt-plugin] Private key location in Folder Key Mode
by emordin 01 Jun '19

01 Jun '19

Hi, So I am trying to locate the private key in dovecot-attributes but I can't seem to find it. I have went thru the strings in the file with the lib-dcrypt document as a guide but the private key doesn't seem to be in there. I'm guessing the private key is an internal attribute located here '/private/vendor/vendor.dovecot/pvt' , but according to the mail-attribute.h file that location is not accessible. Is this true? Or is there a way to see the private key? Thanks. Sent with [ProtonMail](https://protonmail.com) Secure Email.

2 1

[mail-crypt-plugin] Password Query for Folder Keys questions
by emordin 31 May '19

31 May '19

> Can you try rm dovecot-attributes file? Okay it worked. I kinda did that by 'rm -rf' the entire /var/vmail/domain, and then I ran the following: doveadm -o plugin/mail_crypt_private_password=desired_password mailbox cryptokey generate -u user -UR And I got the check mark and the ID string of characters. I sent a new email to the server, and was able to open and read the email =) I got confused on the docs... So only if using unencrypted folder keys, could I open a CRYPTED email and read it right away. But if using encrypted folder keys, first I would have to set a password for the key before I could open the CRYPTED email ? I thought logging in to the mailbox would connect the password to the key automatically. Thanks again. Sent with [ProtonMail](https://protonmail.com) Secure Email.

1 0

[mail-crypt-plugin] Password Query for Folder Keys questions
by emordin 31 May '19

31 May '19

So when I tried this way I got the following output: user'@'host:~$ doveadm -o plugin/mail_crypt_private_password=desired_password mailbox > cryptokey generate -u user -UR user'@'host:~$ And when I tried this way I got the following output: user'@'host:~$doveadm -o plugin/mail_crypt_private_password=desired_password mailbox cryptokey generate -u user -UR Folder Public ID user'@'host:~$ In both cases I sent a new email to the server, and I got errors stating the mailbox can't be opened Sent with [ProtonMail](https://protonmail.com) Secure Email.

2 1

(4) [mail-crypt-plugin] Password Query for Folder Keys questions
by emordin 31 May '19

31 May '19

>> Can you try >> >> doveadm -o plugin/mail_crypt_private_password=desired_password mailbox > cryptokey generate -u user -UR >> >> Aki > > I tried that and got the following: > > [user at host](https://dovecot.org/mailman/listinfo/dovecot) :~$ doveadm -o plugin/mail_crypt_private_password=desired_password mailbox > cryptokey generate -u user -UR > > Folder Public ID > > [user at host](https://dovecot.org/mailman/listinfo/dovecot) :~$ > > Then I sent a new email to the mail server, and I checked it with mutt but got 'Internal Error' 'error opening mailbox' and I > > checked the email with Roundcube and I can see the subject header but when I open the email its just blank. I apologize I forgot to add the '>', in the last one, so I added it and got this output: [user at host](https://dovecot.org/mailman/listinfo/dovecot):~$ doveadm -o plugin/mail_crypt_private_password=desired_password mailbox > cryptokey generate -u user -UR [user at host](https://dovecot.org/mailman/listinfo/dovecot):~$ However it still didn't work. I sent a new email and tried to access it with mutt and Roundcube and I still can't access the body message. Sent with [ProtonMail](https://protonmail.com) Secure Email.

1 0

[mail-crypt-plugin] Password Query for Folder Keys questions
by emordin 31 May '19

31 May '19

> Can you try > > doveadm -o plugin/mail_crypt_private_password=desired_password mailbox > cryptokey generate -u user -UR > > Aki I tried that and got the following: user@host:~$ doveadm -o plugin/mail_crypt_private_password=desired_password mailbox > cryptokey generate -u user -UR Folder Public ID user@host:~$ Then I sent a new email to the mail server, and I checked it with mutt but got 'Internal Error' 'error opening mailbox' and I checked the email with Roundcube and I can see the subject header but when I open the email its just blank. Sent with [ProtonMail](https://protonmail.com) Secure Email.

2 1

[mail-crypt-plugin] Password Query for Folder Keys questions
by emordin 31 May '19

31 May '19

So I believe I generated a key successfully with: 'doveadm mailbox cryptokey generate -u user -UR' because I got the output with the check mark and the Public ID string of characters. However I still can't read the CRYPTED emails when logging in with IMAP.. i'm still getting the following error in the mail log: Error: read() failed: read(/var/vmail/[domain . com/user/Maildir/cur/](http://domain.com/user/Maildir/cur/)<email_index>) failed: Private key not available: Cannot decrypt key ... : error:03070068:big num routines:BN_mpi2bn:encoding error I've tried to list the key with 'doveadm mailbox cryptokey list -u user' but I'm only getting the following output: Folder Active Public ID And I've tried to create a password with 'doveadm mailbox cryptokey password -u user -n Password1' and I'm getting the following output: result: dcrypt_key_load_private(...) failed: password missing Also my settings in conf.d: 10-mail.conf - mail_attribute_dict = file:%h/Maildir/dovecot-attributes mail_plugins = $mail_plugins mail_crypt plugins{ mail_crypt_curve = secp512r1 mail_crypt_save_version = 2 mail_crypt_require_encrypted_user_key = yes } 20-lmtp.conf - protocol lmtp{ mail_plugins = $mail_plugins sieve } And my settings in dovecot-sql.conf.ext: driver = mysql connect = host=127.0.0.1 dbname=mailserver user=mailuser password=1234 password_query = SELECT email as user,password, '%w' AS userdb_mail_crypt_private_password FROM virtual_users WHERE email='%u'; In the virtual_users table I have: id, domain_id, email, password Any ideas what the issue may be? Also am I suppose to add the 'userdb_mail_crypt_private_password' into the table and put the virtual users email login password in there? Or is it suppose to be a temporary query? Thanks. Sent with [ProtonMail](https://protonmail.com) Secure Email.

2 1

Problem SSL entrust certificate
by Il Neofita 30 May '19

30 May '19

Hi I have compiled dovecot 2.3.6 on RH 8, and I copied the configuration from dovecot 2.0.9 however, when I try to connect the new machine the certificate is not recognized The same certificate is working with apache CONNECTED(00000004) depth=0 ... verify error:num=20:unable to get local issuer certificate verify return:1 depth=0 ... verify error:num=21:unable to verify the first certificate verify return:1 ... --- No client certificate CA names sent Peer signing digest: SHA256 Peer signature type: RSA-PSS Server Temp Key: X25519, 253 bits --- SSL handshake has read 2311 bytes and written 404 bytes Verification error: unable to verify the first certificate

1 0

[mail-crypt-plugin] Password Query for Folder Keys questions
by emordin 30 May '19

30 May '19

Please disregard the previous question. But I have another... I have set up Folder Key encryption, and have sent an email to my mail server which is CRYPTED, however when I try to login to read the email I'm getting a 'Private key not available: Cannot decrypt <...>: error:03070068:bignum routines:BN_mpi2bn:encoding error'. I've tried to list the user key and generate a new keypair two different ways and have gotten the following output: doveadm mailbox cryptokey list -U user output: Folder Active Public ID doveadm mailbox cryptokey generate -u user -U output: Folder Public ID doveadm mailbox cryptokey generate -u user -Uf output: Panic: file doveadm-mail.c: line 405 (doveadm_mail_next_user): assertion failed: (ctx->exit_code !=0) Error: Raw backtrace: ............. Aborted Any advice? Sent with [ProtonMail](https://protonmail.com) Secure Email.

1 0