- dovecot - dovecot.org

question about %u and %h used in mail_location
by Joe Wong 12 Mar '19

12 Mar '19

Hello, I have defined the following: mail_location = maildir:~:INBOX=~/Maildir:LAYOUT=fs:INDEX=%u %u is retrieve via database in that my username contain ":", in which it create some confusion to dovecot: doveadm index -u user1:site@domain iNBOX doveadm(user1:site@domain): Error: remote(192.168.10.22:24245): Namespace '': Unknown setting: site@domain I cannot change the value in DB so is there a workaround to this problem? TIA. - Joe

2 1

Suggestions for dovecot-submission (XCLIENT NAME attribute)
by Marcelo Coelho 12 Mar '19

12 Mar '19

Hi, Currently, Dovecot Submission doesn't forward NAME attribute when XCLIENT is enable: Received: from server.example.org (localhost [1.2.3.4]) (Authenticated sender: test(a)example.org) by localhost (Postfix) with ESMTPA id AAAAAAAAAA for <user(a)domain.com>; Fri, 8 Mar 2019 12:28:02 Postfix adds a header with the sender IP address (1.2.3.4), but with localhost as hostname. It would be great if Dovecot Submission send NAME attribute, with the resolved hostname of the sender IP (ADDR attribute). Thank you! -- Marcelo Coelho

2 1

Sieve scripts not triggered on IMAP inbound messages using IMAPC
by Fred 12 Mar '19

12 Mar '19

Good morning. I am using Dovecot as an IMAP proxy -- using IMAPC -- and the system is working great. Thank you for contributing such great software to the community! I'm using Dovcot 2.3.5 and Pigeonhole 0.5.5. My server is located behind a content-filtering firewall that will mark incoming messages by adding "[SPAM]" to the subject line. I'm trying to use Sieve to identify those messages and move them into the Spam folder. I have a basic Sieve script that looks like this: require ["fileinto"]; if anyof (header :contains "Subject" "[SPAM]", header :contains "X-Spam-Flag" "Yes") { fileinto "Spam"; stop; } I can see in the logs that Sieve is loaded, and also the imapsieve_plugin Debug: sieve: Pigeonhole version 0.5.5 (2483b085) initializing Debug: sieve: Sieve imapsieve plugin for Pigeonhole version 0.5.5 (2483b085) loaded Sieve detects outbound messages (from the log: Debug: imapsieve: mailbox INBOX.Sent: APPEND event) but nothing registers for inbound, and my spam_rule is never triggered. Any suggestions? Here is the output from "Dovecot -n": # 2.3.5 (513208660): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.5 (2483b085) # OS: Linux 3.10.0-957.5.1.el7.x86_64 x86_64 CentOS Linux release 7.6.1810 (Core) xfs # Hostname: <redacted> auth_master_user_separator = * auth_mechanisms = PLAIN LOGIN auth_verbose_passwords = plain deliver_log_format = from=%{from}, envelope_sender=%{from_envelope}, subject=%{subject}, msgid=%m, size=%{size}, %$ dict { acl = pgsql:/etc/dovecot/dovecot-share-folder.conf quotadict = pgsql:/etc/dovecot/dovecot-used-quota.conf } first_valid_uid = 2000 imapc_features = fetch-bodystructure fetch-headers imapc_host = <redacted> imapc_port = 993 imapc_ssl = imaps imapc_ssl_verify = no last_valid_uid = 2000 listen = * [::] mail_debug = yes mail_gid = 2000 mail_home = /var/mail/imapc/home/%d/%n mail_location = imapc:/var/mail/imapc/%d/%n mail_plugins = mailbox_alias mail_log notify mail_uid = 2000 managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext imapsieve vnd.dovecot.imapsieve namespace inbox { inbox = yes list = yes location = prefix = separator = . type = private } passdb { args = host=<redacted> default_fields = userdb_imapc_user=%u userdb_imapc_password=#hidden_use-P_to_show# driver = imap } passdb { args = /etc/dovecot/dovecot-master-users driver = passwd-file master = yes } plugin { imapsieve_default = /var/vmail/sieve/global/spam_rule.sieve mail_log_events = delete undelete expunge mailbox_delete mailbox_rename mail_log_fields = uid box msgid size from subject mailbox_alias_new = Sent Messages mailbox_alias_new2 = Sent Items mailbox_alias_old = Sent mailbox_alias_old2 = Sent sieve_global_dir = /var/vmail/sieve/global/ sieve_max_redirects = 30 sieve_plugins = sieve_imapsieve sieve_trace_debug = yes sieve_trace_dir = /var/log/dovecot sieve_trace_level = matching } protocols = imap sieve service auth { unix_listener /var/spool/postfix/private/dovecot-auth { group = postfix mode = 0666 user = postfix } unix_listener auth-master { group = vmail mode = 0666 user = vmail } unix_listener auth-userdb { group = vmail mode = 0660 user = vmail } } service dict { unix_listener dict { group = vmail mode = 0660 user = vmail } } service imap-login { process_limit = 500 service_count = 1 } service lmtp { executable = lmtp -L inet_listener lmtp { address = 127.0.0.1 port = 24 } process_min_avail = 5 unix_listener /var/spool/postfix/private/dovecot-lmtp { group = postfix mode = 0600 user = postfix } user = vmail } service managesieve-login { inet_listener sieve { address = 127.0.0.1 port = 4190 } } ssl = required ssl_cert = </etc/letsencrypt/live/mgrids.dynu.com/fullchain.pem ssl_cipher_list = ECDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:ECDH+3DES:DH+ 3DES:RSA+AESGCM:RSA+AES:RSA+3DES:!aNULL:!MD5 ssl_client_ca_file = /etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem ssl_dh = # hidden, use -P to show it ssl_key = # hidden, use -P to show it ssl_prefer_server_ciphers = yes syslog_facility = local5 userdb { driver = prefetch } protocol imap { imap_client_workarounds = tb-extra-mailbox-sep mail_max_userip_connections = 30 mail_plugins = mailbox_alias mail_log notify imap_sieve } protocol sieve { info_log_path = /var/log/dovecot/sieve-info.log log_path = /var/log/dovecot/sieve-err.log managesieve_implementation_string = Dovecot Pigeonhole managesieve_max_line_length = 65536 }

2 2

dovecot Connection closed IDLE running
by Adrian Minta 11 Mar '19

11 Mar '19

Hello, sometimes I get lines like this on mail log. Mar 11 07:57:14 mail2 dovecot: imap(john.one(a)domain.ro): Connection closed (IDLE running for 0.006 + waiting input for 1765.640 secs, 0.001 in locks, 2 B in + 10+0 B out, state=wait-input) in=323201 out=3177999 Mar 11 07:58:56 mail3 dovecot: imap(john.two(a)domain.ro): Connection closed (IDLE running for 0.005 + waiting input for 3535.348 secs, 0.001 in locks, 2 B in + 10+0 B out, state=wait-input) in=1627 out=14872 Mar 11 08:38:50 mail2 dovecot: imap(sam(a)domain.ro): Connection closed (IDLE running for 2.225 + waiting input for 267.413 secs, 0.005 in locks, 2 B in + 10+0 B out, state=wait-input) in=7212 out=2503 Mar 11 09:01:23 mail2 dovecot: imap(john.one(a)domain.ro): Connection closed (FETCH running for 8.784 + waiting input for 0.001 secs, 0.008 in locks, 24 B in + 6291+6291 B out, state=wait-input) in=196 out=43968 Mar 11 09:02:57 mail1 dovecot: imap(bush(a)domain.ro): Connection closed (IDLE running for 0.006 + waiting input for 1031.530 secs, 0.001 in locks, 2 B in + 10+0 B out, state=wait-input) in=9157 out=381003 Mar 11 09:33:31 mail2 dovecot: imap(john.one(a)domain.ro): Connection closed (IDLE running for 0.008 + waiting input for 1737.458 secs, 0.001 in locks, 2 B in + 41+0 B out, state=wait-input) in=7871 out=322122 Our dovecot version is 2.2.27 and the mail storage is maildir. What is the cause ? Could this negatively affects the users ? -- Best regards, Adrian Minta

1 0

Assistance with doveadm backup...
by SH Development 11 Mar '19

11 Mar '19

I am having trouble locating examples of how to use doveadm backup. All the examples I see are for sync. I simply want to create a backup to a network volume of the email server's vmail folders. The goal here is to have a reasonably current backup should the main drive on the email server go south. We currently authenticate our users from a mysql database. User’s mailboxes are stored as domainname/username/Maildir I assume what I will wind up on the network volume is a duplicate directory structure as the vmail folder on the email server? Can someone help get me started here? Jeff

7 13

readonly archive folders using squashfs
by Natu 11 Mar '19

11 Mar '19

I have a dovecot server running under CentOS using maildir format. Due to the issue with minimum blocksize for files I would like to offer some kind of readonly archive using something like the compressed squashfs where I would move messages to be archived to a maildir folder and then convert "cur" directory into a squashfs and mount it in place of the original directory so my biggest users could have readonly access to older messages without it using so much disk space. Has anyone tried anything like this before and is dovecot likely to complain about the readonly cur directory? If the complaints are minimal and didn't cause other problems it might be ok. Any better ideas to implement something like this? Thank You, Natu

2 2

Re: Auto MX Email Client configuration, the right way?
by Davide Marchi 10 Mar '19

10 Mar '19

> Now I've seen the new RFC 6186 specification > (https://tools.ietf.org/html/rfc6186) that describe a "DNS way" to > achieve the same goal. > > [..] > again: > [..] > When a user identifier is required, MUAs MUST first > use the full email address provided by the user, and if that > results > in an authentication failure, SHOULD fall back to using the "local- > part" extracted from the email address. This is in line with the > guidance outlined in Section 5. If both these user identifiers > result in authentication failure, the MUA SHOULD prompt the user > for > a valid identifier. > [..] > > here I have the biggest doubt, in fact Thunderbird often uses only the > username and not the whole email address, both for incoming and > outgoing > server... > Is any of you using this second way? And possibly, do you kniw if it > works with different clients (desktop and mobile)? I've made some tests and this solution seems very serviceable, for the only exception for the user name on Thunderbird. Unlike what is stated in this RFC, Thunderbird "takes" only the name and not the entire email address as the username. Anyone knows if is it possible to communicate the username type via RFC? Many thanks again! Davide

2 1

GSSAPI and usernames, not Kerberos ticket names
by Dmitry Donskih 09 Mar '19

09 Mar '19

Hi all, I've got a Dovecot v2.3.3 IMAP with GSSAPI auth set up. This server is in main domain, 'contoso.com'. I also have several subdomains. My problem is usernames with GSSAPI authentication: When I try to login as 'user' or as 'user(a)CONTOSO.COM' - everything works. But, 'user(a)contoso.com' auth fails. But when I try to login as subdomain user, 'user2' - it fails to login. 'user2(a)sub.contoso.com' fails also. However, 'user2(a)SUB.CONTOSO.COM' works ok. It looks like PAM uses domain part of login as Kerberos realm name, regardless of Kerberos domain-realm mapping. Also, if domain part is not specified, PAM (Kerberos?) fails to determine non-default realm. What am I missing? Is there a way to use traditional 'user@domain' login names with PAM/GSSAPI, instead of Kerberos ticket names? Or maybe to tell PAM module to convert domain part of username to uppercase before using? Thanks on any help or advice. ===== dovecot.conf: ===== auth_mechanisms = gssapi plain login external auth_gssapi_hostname = "$ALL" auth_krb5_keytab = /etc/krb5.keytab auth_default_realm = passdb { driver = pam args = cache_key=%d%r%n failure_show_msg=yes dovecot } userdb { driver = static args = uid=502 gid=502 home=/var/vmail/%L{auth_domain}/%L{auth_username} mail=maildir:/var/vmail/%L{auth_domain}/%L{auth_username}/Maildir allow_all_users=yes } ===== ===== pam.d/dovecot: ===== auth sufficient pam_krb5.so use_first_pass account [default=bad success=ok user_unknown=ignore] pam_krb5.so password sufficient pam_krb5.so use_authtok session optional pam_krb5.so ===== ===== krb5.conf: ===== [libdefaults] default_realm = CONTOSO.COM dns_lookup_realm = true dns_lookup_kdc = true [realms] CONTOSO.COM = { kdc = dc.contoso.com:88 admin_server = dc.contoso.com:749 } [domain_realm] contoso.com = CONTOSO.COM .contoso.com = CONTOSO.COM sub.contoso.com = CONTOSO.COM .sub.contoso.com = CONTOSO.COM SUB.CONTOSO.COM = CONTOSO.COM .SUB.CONTOSO.COM = CONTOSO.COM [appdefaults] pam = { ticket_lifetime = 36000 renew_lifetime = 36000 forwardable = true krb4_convert = false } ===== klist server ==== Default principal: imap/mail2.contoso.com(a)CONTOSO.COM ===== klist client ==== Default principal: user2(a)SUB.CONTOSO.COM ===== Logging in with user2(a)SUB.CONTOSO.COM - OK: ===== auth: Debug: client in: AUTH 1 GSSAPI service=imap secured=tls session=.... auth: Debug: gssapi(?,192.168.....,<MR1yvq6DftfAqAoP>): Using all keytab entries auth: Debug: client passdb out: CONT 1 auth: Debug: client in: CONT<hidden> auth: Debug: gssapi(user2(a)sub.contoso.com,192.168....,<MR1yvq6DftfAqAoP>): security context state completed. auth: Debug: client passdb out: CONT 1 YIGVB.... auth: Debug: client in: CONT<hidden> auth: Debug: gssapi(user2(a)sub.contoso.com,192.168.....,<MR1yvq6DftfAqAoP>): Negotiated security layer auth: Debug: client passdb out: CONT 1 BQQF/..... auth: Debug: client in: CONT<hidden> auth: Debug: pam(user2(a)sub.contoso.com,192.168.....,<MR1yvq6DftfAqAoP>): passdb doesn't support credential lookups auth: Debug: gssapi(user2(a)sub.contoso.com,192.168.....,<MR1yvq6DftfAqAoP>): skipping passdb: mechanism filtered auth: Debug: client passdb out: OK 1 user=user2(a)sub.contoso.com original_user=user2(a)SUB.CONTOSO.COM ===== Logging in with user2(a)sub.contoso.com - FAIL: ===== auth: Debug: client in: AUTH 1 GSSAPI service=imap secured=tls session=... auth: Debug: gssapi(?,192.168....,<Hgh4zq6DhNfAqAoP>): Using all keytab entries auth: Debug: client passdb out: CONT 1 auth: Debug: client in: CONT<hidden> auth: Debug: gssapi(user2(a)sub.contoso.com,192.168....,<Hgh4zq6DhNfAqAoP>): security context state completed. auth: Debug: client passdb out: CONT 1 YIGVB..... auth: Debug: client in: CONT<hidden> auth: Debug: gssapi(user2(a)sub.contoso.com,192.168....,<Hgh4zq6DhNfAqAoP>): Negotiated security layer auth: Debug: client passdb out: CONT 1 BQQF/..... auth: Debug: client in: CONT<hidden> auth: Debug: pam(user2(a)sub.contoso.com,192.168.....,<Hgh4zq6DhNfAqAoP>): passdb doesn't support credential lookups auth: Debug: gssapi(user2(a)sub.contoso.com,192.168.....,<Hgh4zq6DhNfAqAoP>): skipping passdb: mechanism filtered auth: Debug: client passdb out: FAIL 1 user=user2(a)sub.contoso.com original_user=user2(a)SUB.CONTOSO.COM

1 0

Auto MX Email Client configuration, the right way?
by Davide Marchi 09 Mar '19

09 Mar '19

Hi Friends! An opinion. I would like to facilitate the configuration of one's mail client (desktop or mobile) to my users server. Some time ago I asked the same question and you suggested me to use "Automx". So I started of good will and I looked for the Automx documentation. And here the problems started as I found several inconsistencies, even parameters (in official documentation) that produce Apache errors.. to complicate things, different path between deb packages and official version :-) Now I've seen the new RFC 6186 specification (https://tools.ietf.org/html/rfc6186) that describe a "DNS way" to achieve the same goal. [..] 4. Guidance for MUAs By using SRV records as above, MUAs need initially only to prompt the user for their email address [RFC5322]. The "local-part" and "domain" portions are then extracted from the email address by the MUA. The MUA uses the "domain" portion as the service domain to perform SRV lookups for the services it wants to configure. If the SRV lookup is successful, the target FQDN and port for the service can be determined and used to complete MUA configuration. If an SRV record is not found, the MUA will need to prompt the user to enter the FQDN and port information directly, or use some other heuristic. In the case of multiple SRV records returned for a particular service, the MUA MUST use the priority and weight fields in the record to determine which one to use (as per [RFC2782]). [..] again: [..] When a user identifier is required, MUAs MUST first use the full email address provided by the user, and if that results in an authentication failure, SHOULD fall back to using the "local- part" extracted from the email address. This is in line with the guidance outlined in Section 5. If both these user identifiers result in authentication failure, the MUA SHOULD prompt the user for a valid identifier. [..] here I have the biggest doubt, in fact Thunderbird often uses only the username and not the whole email address, both for incoming and outgoing server... Is any of you using this second way? And possibly, do you kniw if it works with different clients (desktop and mobile)? Many many thanks! Davide

3 2

Dovecot v2.3.5 released
by Aki Tuomi 08 Mar '19

08 Mar '19

Hi! We are happy to release dovecot v2.3.5. Please find sources at https://dovecot.org/releases/2.3/dovecot-2.3.5.tar.gz https://dovecot.org/releases/2.3/dovecot-2.3.5.tar.gz.sig You can find precompiled binaries at https://repo.dovecot.org/ NEWS: + Lua push notification driver: mail keywords and flags are provided in MessageNew and MessageAppend events. + submission: Implement support for plugins. + auth: When auth_policy_log_only=yes, only log what the policy server response would do without actually doing it. + auth: Always log policy server decisions with auth_verbose=yes - v2.3.[34]: doveadm log errors: Output was missing user/session - lda: Debug log lines could have shown slightly corrupted - login proxy: Login processes may have crashed in various ways when login_proxy_max_disconnect_delay was set. - imap: Fix crash with Maildir+zlib if client disconnects during APPEND - lmtp proxy: Fix potential assert-crash - lmtp/submission: Fix crash when SMTP client transaction times out - submission: Split large XCLIENT commands to 512 bytes per command, so Postfix accepts them. - submission: Fix crash when client sends invalid BURL command - submission: relay backend: VRFY command: Avoid forwarding 500 and 502 replies back to client. - lib-http: Fix potential assert-crash when DNS lookup fails - lib-fts: Fix search query generation when one language ignores a token (e.g. via stopwords). --- Aki Tuomi Open-Xchange Oy

3 5