- dovecot - dovecot.org

lda: Unknown mail storage driver maildir
by Rob De Langhe 17 Mar '19

17 Mar '19

hi all, I have a successful (self-compiled from source code) Dovecot v2.2.16 setup active on my Solaris-10 server, with mails stored in user's $HOME/Maildir The mails are fetched from the ISP with "fetchmail", using a "cron" job fetchmail -f $HOME/etc/pop3.myisp where the file "$HOME/etc/pop3.myisp" contains set logfile fetchmail.log poll pop.myisp.be with proto POP3 user myIspmailLogin there with password myIspPwd is rob here nokeep mda "/programs-3.2/amd64/64/libexec/dovecot/deliver" Now I want to get it also running on a Debian server, with the same Dovecot version, and exactly the same config files, but here I get the following messages in "/var/log/mail.log" when launching a "fetchmail" attempt : Mar 17 14:36:20 apps_b dovecot: lda(rob): Debug: Effective uid=1000, gid=1000, home=/home/rob Mar 17 14:36:20 apps_b dovecot: lda(rob): Debug: Namespace inbox: type=private, prefix=, sep=, inbox=no, hidden=no, list=yes, subscriptions=yes location=maildir:~/Maildir Mar 17 14:36:20 apps_b dovecot: lda(rob): Error: User initialization failed: Namespace '': Unknown mail storage driver maildir Mar 17 14:36:20 apps_b dovecot: lda(rob): Fatal: Invalid user settings. Refer to server log for more information. So it seems to be complaining about "maildir" storage driver ?! My config is: # /programs/3.4/x86_64/64/sbin/dovecot -n -c /usr/local/dovecot/dovecot.conf # 2.2.16: /usr/local/dovecot/dovecot.conf # OS: Linux 3.16.0-4-amd64 x86_64 Debian 8.4 disable_plaintext_auth = no first_valid_gid = 1000 first_valid_uid = 1000 last_valid_gid = 1500 last_valid_uid = 2000 mail_debug = yes mail_location = maildir:~/Maildir namespace inbox { location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } passdb { args = * driver = pam } postmaster_address = rob(a)mydomain.be ssl_cert = </etc/ssl/certs/dovecot.pem ssl_key = </etc/ssl/private/dovecot.pem userdb { driver = passwd }

2 1

LMTP Proxy failure using master login via destuser field
by Dirk 17 Mar '19

17 Mar '19

Hi list, I set up dovecot as IMAP proxy using a master user to login into the backend and it works beautifully. 👍🏻 Next I set out to do LMTP proxying and I struggled (initially). I got the log message: Mar 17 11:23:44 mail postfix/lmtp[2665]: 99A3F219C8: to=<johnny(a)doe.com>, relay=10.15.1.2[10.15.1.2]:24, delay=5.1, delays=4.9/0.05/0.01/0.07, dsn=5.1.1, status=bounced (host 10.15.1.2[10.15.1.2] said: 550 5.1.1 <"johnny(a)doe.com*director"@mail.server.com> User doesn't exist: "johnny(a)doe.com*director"@mail.server.com (in reply to RCPT TO command)) My director's passdb setting looked like this: passdb { driver = sql args = /etc/dovecot/sql/my-passdb.conf result_success = continue-ok result_failure = return-fail result_internalfail = return-fail } # Add director master user credentials if above succeeded passdb { driver = static args = proxy=y starttls=any-cert \ destuser=%u*director(a)example.com \ pass=correcthorsebatterystaple \ nopassword=y skip = unauthenticated } In the end I found that setting the `master` field instead of `destuser` solves the issue. It looks like LMTP does not know how to handle the master user separator although set. I this known/wanted behavior? Maybe this is something to mention on the wiki page, it took a while to figure this out... Kind regards, Dirk Mit freundlichen Grüßen Dirk Weise DevOps Engineer -- bitloft GmbH | Schulstraße 2 | D-42551 Velbert www.bitloft.de | weise(a)bitloft.de Telefon: +49 2051 40514-32 Geschäftsführer: Robin Clemens, Franz-Josef Wieneke Amtsgericht Wuppertal HRB 17297 | USt-IDNr. DE121540053

1 0

testing dovecot LMTP with postfix/spamassassin
by Marek Kozlowski 17 Mar '19

17 Mar '19

:-) My postfix configuration is quite complex with a lot of special cases and rules. However I'd like to make an anti-spam configuration as simple and lightweight as possible (KISS). /etc/postfix/master.cf ------------------------------------------------------------------------ smtp inet n - n - - smtpd -o content_filter=spamassassin spamassassin unix - n n - - pipe user=nobody argv=/usr/bin/vendor_perl/spamc -e /usr/sbin/sendmail -oi -f ${sender} ${recipient} ------------------------------------------------------------------------ then the simplest sieve rule I can think of: ------------------------------------------------------------------------ require "fileinto"; if header :contains "X-Spam-Flag" "YES" { fileinto "Spam"; } ------------------------------------------------------------------------ I'd like to make this rule active for only local deliveries via dovecot LMTP with sieve plugin and setting postfix `mailbox_transport' to dovecot LMTP. I believe it is so simple it should work (am I wrong?). But... It would be more convenient to do some tests before applying changes to a production environment config. The problem is: I have no separate testing environment with my strange configuration I'm able to test a spamassassin score for an e-mail manually. How about dovecot LMTP? Can I test local mail delivery by dovecot LMTP manually? I mean: to simulate "I'm the Postfix" and produce for some testing e-mail the same effect as postfix granting it via `local_transport' to dovecot? Best regards, Marek

4 6

LMTP: Undelivered Mail Returned to Sender: User doesn't exist! :-(
by Marek Kozlowski 17 Mar '19

17 Mar '19

:-) I'm using postfix for mail delivery and dovecot for mailbox access imaps pop3s. Postfix resolves, verifies and overwrites users' addresses by numerous subtle LDAP queries. However users are visible as local ones (openldap, pam, nss) in the sense I can run `id' or `finger' queries and receive replies. Dovecot handles all mailboxes over imap/pop correctly with no additional configuration for LDAP. Just (10-mail.conf): mail_location = maildir:/mailboxes/%u and it works fine. Because I'd like to use pigeonhole I'm trying to make local delivery via dovecot LMTP (https://wiki2.dovecot.org/HowTo/PostfixDovecotLMTP) I've configured the socket and added to `/etc/postfix/main.cf' the line: mailbox_transport = lmtp:unix:/var/spool/postfix/private/dovecot-lmtp I think that id dovecot handles mailboxes correctly over imap/pop it can easily find the users and their mailboxes so it doesn't need any additional configuration for LDAP. Unfortunately it doesn't work and results in: Undelivered Mail Returned to Sender: User doesn't exist! :-( What's the thing I've missed? Best regards, Marek

2 2

How to create sent items, drafts and so on
by Sakuma, Koshiro 17 Mar '19

17 Mar '19

Hello, I've setup Dovecot and Postfix mailing systems. The protocol is imap. Now, I've realized that there are no "sent items, drafts" boxed under Maildir for each users. I would like to take back up Inbox, sent items, draft boxes. For sent items box, it seems to be stored in outlook client file which is "ost". The configuration parameters and version is as follows. I can see that "namespace" has been configured. How can I setup to see these folders? Thank you for your support! 1. Dovecot version ->2.2.36 2. dovecot -n ----------------------------------------------------------------------------------------------------------- #2.2.36 (1f10bfa63): /etc/dovecot/dovecot.conf # OS: Linux 3.10.0-957.5.1.el7.x86_64 x86_64 CentOS Linux release 7.6.1810 (Core) # Hostname: mail.corp-associe.com auth_mechanisms = plain login auth_verbose = yes disable_plaintext_auth = no first_valid_uid = 1000 listen = * log_path = /var/log/dovecot.log mail_debug = yes mail_location = maildir:~/Maildir mbox_write_locks = fcntl namespace inbox { inbox = yes location = mailbox Drafts { auto = subscribe special_use = \Drafts } mailbox Junk { auto = subscribe special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { auto = subscribe special_use = \Trash } prefix = } passdb { args = scheme=CRAM-MD5 username_format=%u /etc/dovecot/users driver = passwd-file } protocols = imap service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0660 user = postfix } } service imap-login { inet_listener imap { port = 0 } inet_listener imaps { port = 993 ssl = yes } } service pop3-login { inet_listener pop3 { port = 0 } inet_listener pop3s { port = 995 ssl = yes } } ssl_cert = </etc/letsencrypt/fullchain1.pem ssl_key = # hidden, use -P to show it userdb { args = username_format=%u /etc/dovecot/users driver = passwd-file } userdb { args = uid=vmail gid=vmail home=/var/spool/virtual/%d/%n driver = static }

4 9

Re: Unable to set quota-fs plugin
by Eric Grammatico 17 Mar '19

17 Mar '19

Hi there, Well.. I didn't find a way to strace imap. If I well understood, the faulty IMAP is launched by dovecot from or after a succesfull imap-login process. I have executed manually '/usr/libexec/dovecot/imap -u eric' and typed getquotaroot "INBOX" which didn't reproduce the error seen in the dovecot logs and reported the correct quota. Any idea how to find the imap command generating the error imap(eric)<3085></M5VXfCBwJejrKVa>: Error: Failed to get quota resource STORAGE: quota-fs: quotactl(Q_GETQUOTA, /dev/vda1) failed: No such file or directory Thanks and regards, - Eric Grammatico _/) 14 mars 2019 11:46 "Eric Grammatico" <e.grammatico(a)gmail.com> a écrit: > I use sendmail and quota-status is not running in background. > > Fully aligned with you about focusing on imap... will try to get other strace and report there. > > thanks and regards, > > - > Eric Grammatico _/) > > 14 mars 2019 11:37 "Yassine Chaouche via dovecot" <dovecot(a)dovecot.org> a écrit: > >> On 3/14/19 9:53 AM, Yassine Chaouche via dovecot wrote: >> >>> On 3/13/19 2:10 PM, Eric Grammatico via dovecot wrote: >>>> Thanks Aki, >>>> >>>> Please find attached strace for imap and quota-status which report an >> error at the end. >>>> >>>> Regards, >>> >>> write(2, "/usr/libexec/dovecot/quota-statu"..., > 57/usr/libexec/dovecot/quota-status: invalid >>> option -- 'u' >>> >>> Please retry with the good options (-u is invalid) >>> >>> Yassine. >> >> Ah, that seems to be the service that is called by the MTA before delivering the mail to the LDA, >> in case the user is over quota, so that the MTA may bounce the e-mail right away instead of >> accepting it first then bouncing afterwards (after the LDA refuses the message). >> >> But according to the error message you posted on your first e-mail, the error happens with imap, I >> don't know if quota-status is involved here (might be) ? >> >> In any case, I would concentrate on imap and not quota-status. Nothing in the imap strace shows any >> trace of errors. Particulary, I was looking for a quotactl line in the strace, but I couldn't find >> it. >> >> In the other hand, it is present in the doveadm quota strace, and has completed successfully >> >> dovecot.strace:quotactl(QCMD(Q_GETQUOTA, USRQUOTA), "/dev/vda1", 1000, {dqb_bhardlimit=4194304, >> dqb_bsoftlimit=3170304, dqb_curspace=638853120, dqb_ihardlimit=0, dqb_isoftlimit=0, >> dqb_curinodes=12784, ...}) = 0 >> >> Someone has to tell us under what conditions will the imap daemon check for quota (at login ? at >> delivery or any other action involving moving mail around like copying or expunging ?) >> >> For the quota-status libexec, I have set it to run with quota-status -f postfix but your setup may >> vary (if it's every configured). If it is running, you can just grep it's pid with pgrep >> quota-status then strace -p $PID and see how it behaves (wait until a quota operation is needed). >> >> Yassine.

2 6

ssl_dh
by sergio 16 Mar '19

16 Mar '19

https://wiki.dovecot.org/SSL/DovecotConfiguration says: "Since v2.3.3+ Diffie-Hellman parameters have been made optional, and you are encouraged to disable non-ECC DH algorithms completely." and a bit later: "From version 2.3, you must specify path to DH parameters file using ssl_dh=</path/to/dh.pem" So. 1. Is ssl_dh an optional or a must? 2. I've disabled ssl_dh in my config. Dovecot works fine except it shows warnings: doveconf: Warning: please set ssl_dh=</etc/dovecot/dh.pem doveconf: Warning: You can generate it with: dd ... I'm using dovecot version 2.3.4.1-1~bpo9+1 from debian stretch-backports -- sergio.

3 5

regarding ssl certificates
by mick crane 15 Mar '19

15 Mar '19

Excuse dopey question. I'm not exactly clear about certificates. Apache2 default install has this snake oil certificate Can make a new one for apache Can make one for dovecot Can make one for ssl Is there supposed to be the one (self signed ) certificate pair in one place for the machine that each process hands out ? Can they be moved to another machine ? mick -- Key ID C7D6E24C

12 16

lua policy for Weakforce and web mail failed login attempts
by Robert Kudyba 15 Mar '19

15 Mar '19

The good news is I believe I got Weakforce running 1) curl -X GET http://127.0.0.1:8084/?command=ping -u wforce:ourpassword {"status":"ok"}[ 2) after running the sample for loop: for a in {1..101}; do curl -X POST -H "Content-Type: application/json" --data '{"login":"ahu", "remote": "127.0.0.1", "pwhash":"1234'$a'", "success":"false"}' http://127.0.0.1:8084/?command=report -u wforce:ourpassword; done The result is: {"status":"ok"}{"status":"ok"}{"status":"ok"}{ 3) So checking the stats: curl -X POST -H "Content-Type: application/json" --data '{"ip":"127.0.0.1"}' http://127.0.0.1:8084/?command=getDBStats -u wforce:ourpassword {"bl_expire": "", "bl_reason": "", "blacklisted": false, "ip": "127.0.0.1", "stats": {"OneHourDB": {"diffFailedPasswords": 93}}} Notice the 93. 4) the reset works but I believe there's a bug in Getdbstats v2.0.0 where "blacklisted" is always shown: curl -X POST -H "Content-Type: application/json" --data '{"ip":"127.0.0.1"}' http://127.0.0.1:8084/?command=getDBStats -u wforce:ourpassword {"bl_expire": "", "bl_reason": "", "blacklisted": false, "ip": "127.0.0.1", "stats": {"OneHourDB": {"diffFailedPasswords": 0}}}[ 5) wforce -c Read configuration from '/usr/local/etc/wforce.conf' Connecting to 127.0.0.1:4004 > stats() 101 reports, 0 allow-queries (0 denies) The 3 big questions I have: a: how do I know IP's are being banned/rejected? Is there an alert creation or a way to see in the logs that the rules are in affect? b: since I installed via Git and ran "make" how to I get wforce --daemon to start on reboot? Is there a systemd file available? c: How do I create a lua policy that would catch these web dovecot login attempts? Feb 27 08:19:53 ourserver auth[15085]: pam_unix(dovecot:auth): check pass; user unknown Feb 27 08:19:53 ourserver auth[15085]: pam_unix(dovecot:auth): authentication failure; logname= uid=0 euid=0 tty=dovecot ruser= user(a)ourserver.ourdomain.edu rhost=177.72.0.158 Feb 27 08:20:35 ourserver auth[15085]: pam_unix(dovecot:auth): check pass; user unknown Feb 27 08:20:35 ourserver auth[15085]: pam_unix(dovecot:auth): authentication failure; logname= uid=0 euid=0 tty=dovecot ruser=user rhost=213.156.111.236 Feb 27 08:27:07 ourserver auth[16831]: pam_unix(dovecot:auth): check pass; user unknown Feb 27 08:27:07 ourserver auth[16831]: pam_unix(dovecot:auth): authentication failure; logname= uid=0 euid=0 tty=dovecot ruser= nobody(a)ourserver.ourdomain.edu rhost=79.106.35.59 Feb 27 08:27:27 ourserver auth[16831]: pam_unix(dovecot:auth): authentication failure; logname= uid=0 euid=0 tty=dovecot ruser=nobody rhost=95.38.212.65 user=nobody Feb 27 08:27:27 ourserver auth[16831]: pam_succeed_if(dovecot:auth): requirement "uid >= 1000" not met by user "nobody" Feb 27 08:31:12 ourserver auth[17875]: pam_unix(dovecot:auth): check pass; user unknown Feb 27 08:31:12 ourserver auth[17875]: pam_unix(dovecot:auth): authentication failure; logname= uid=0 euid=0 tty=dovecot ruser= ouruser(a)ourserver.ourdomain.edu rhost=80.78.70.1 Feb 27 08:31:33 ourserver auth[17875]: pam_unix(dovecot:auth): authentication failure; logname= uid=0 euid=0 tty=dovecot ruser=ouruser rhost=45.225.236.198 user=ouruser Feb 27 09:32:22 ourserver auth[32689]: pam_unix(dovecot:auth): check pass; user unknown Feb 27 09:32:22 ourserver auth[32689]: pam_unix(dovecot:auth): authentication failure; logname= uid=0 euid=0 tty=dovecot ruser= nobody(a)ourserver.ourdomain.edu rhost=37.205.81.41 Feb 27 09:32:42 ourserver auth[32689]: pam_unix(dovecot:auth): authentication failure; logname= uid=0 euid=0 tty=dovecot ruser=nobody rhost=201.148.100.198 user=nobody Feb 27 09:32:42 ourserver auth[32689]: pam_succeed_if(dovecot:auth): requirement "uid >= 1000" not met by user "nobody" Feb 27 09:44:09 ourserver auth[3271]: pam_unix(dovecot:auth): check pass; user unknown Feb 27 09:44:09 ourserver auth[3271]: pam_unix(dovecot:auth): authentication failure; logname= uid=0 euid=0 tty=dovecot ruser= otheruser(a)ourserver.ourdomain.edu rhost=177.69.145.193 Feb 27 09:44:35 ourserver auth[3271]: pam_unix(dovecot:auth): check pass; user unknown Feb 27 09:44:35 ourserver auth[3271]: pam_unix(dovecot:auth): authentication failure; logname= uid=0 euid=0 tty=dovecot ruser=otheruser rhost=175.143.51.221 Feb 27 09:47:32 ourserver auth[4048]: pam_unix(dovecot:auth): check pass; user unknown Feb 27 09:47:32 ourserver auth[4048]: pam_unix(dovecot:auth): authentication failure; logname= uid=0 euid=0 tty=dovecot ruser= yetanotheruser(a)ourserver.ourdomain.edu rhost=162.245.81.231 Feb 27 09:47:56 ourserver auth[4048]: pam_unix(dovecot:auth): authentication failure; logname= uid=0 euid=0 tty=dovecot ruser=yetanotheruser rhost=83.243.88.236 user=yetanotheruser Feb 27 20:44:41 ourserver auth[5828]: pam_unix(dovecot:auth): authentication failure; logname= uid=0 euid=0 tty=dovecot ruser=ouruser rhost=166.171.184.200 user=ouruser

1 0

Re: ACL Folders are open but not being displayed ? [2.3.3]
by Aki Tuomi 15 Mar '19

15 Mar '19

It's a file, `touch subscriptions` Aki On 15.3.2019 11.36, Kunal A. wrote: > Oh okay. How do correct this? Create the file/folder for this? ie > mkdir suscriptions ? > > > On Fri, Mar 15, 2019 at 5:29 AM Aki Tuomi <aki.tuomi(a)open-xchange.com > <mailto:aki.tuomi@open-xchange.com>> wrote: > > Nevertheless, the subscriptions file needs to be there. > > Aki > > On 15.3.201911.28, Kunal A. wrote: >> Dear Aki, >> Got it corrected. Many thanks for pointing it out. There is >> another error about suscriptions. I don't have any folder with >> subscriptions. See the error below :- >> >> Mar 15 05:22:10 machine dovecot[4804]: imap(email1(a)example.com >> <mailto:email1@example.com>)<4970><XjWwkh6EBsAAAAAAAAAAAAAAAAAAAAAB>: >> Error: stat(/mnt/computer/Email/fastmail/subscriptions) failed: >> Permission denied >> >> dr-xr-xr-x root root / >> drwxr-xr-x root root mnt >> drwxr-xr-x vmail vmail computer >> drwxrwxr-x vmail vmail Email >> drwxrwxr-x vmail vmail fastmail >> subscriptions - No such file or directory >> >> Best Regards >> >> >> On Fri, Mar 15, 2019 at 3:02 AM Aki Tuomi >> <aki.tuomi(a)open-xchange.com <mailto:aki.tuomi@open-xchange.com>> >> wrote: >> >> >> On 15.3.2019 8.40, Kunal A. via dovecot wrote: >>> Hey, >>> Could someone help figure out whats wrong with my config >>> based on the debug below? >>> >>> What I am trying to achieve is to get email1(a)example.com >>> <mailto:email1@example.com> to read emails in the Public >>> directory that is stored on >>> /run/media/computer/Storage/Email/fastmail/Archive with the >>> preface Public/Archive . >>> >>> The ACL has been set for anyone with permissions to >>> lookup,read,write as shown below:- >>> >>> doveadm acl get -u email1(a)example.com >>> <mailto:email1@example.com> Public/Archive >>> ID Global >>> Rights >>> anyone lookup read write >>> >>> But when I try to access the emails for email1(a)example.com >>> <mailto:email1@example.com> , there are no folders. >>> Could someone here help review my debug log and advise what >>> could be causing this (dovecot -n output is provided below >>> the debug message) >>> >>> Many thanks for assistance. >>> Thanks >>> >> >>> Mar 15 01:29:28 machine dovecot[2100]: >>> imap(email1(a)example.com >>> <mailto:email1@example.com>)<5167><i8fdSBuE8uMAAAAAAAAAAAAAAAAAAAAB>: >>> Error: >>> open(/run/media/computer/Storage/Email/fastmail/dovecot-acl-list) >>> failed: Permission denied >> >>> Mar 15 01:29:28 machine dovecot[2100]: >>> imap(email1(a)example.com >>> <mailto:email1@example.com>)<5167><i8fdSBuE8uMAAAAAAAAAAAAAAAAAAAAB>: >>> Error: stat(/run/media/computer/Storage/Email/fastmail) >>> failed: Permission denied (euid=5000(vmail) egid=5000(vmail) >>> missing +w perm: /run/media/computer/Storage/Email/fastmail >>> stat(/run/media/computer/Storage/Email/fastmail) failed: >>> Permission denied, dir owned by 0:0 mode=0775) >> >>> Mar 15 01:29:28 machine dovecot[2100]: >>> imap(email1(a)example.com >>> <mailto:email1@example.com>)<5167><i8fdSBuE8uMAAAAAAAAAAAAAAAAAAAAB>: >>> Error: >>> stat(/run/media/computer/Storage/Email/fastmail/.temp.e480machine.5167.a6506e27bd37a68a) >>> failed: Permission denied >> >>> Mar 15 01:30:14 machine dovecot[2100]: >>> imap(email1(a)example.com >>> <mailto:email1@example.com>)<5167><i8fdSBuE8uMAAAAAAAAAAAAAAAAAAAAB>: >>> Error: mkdir(/run/media/computer/Storage/Email/fastmail) >>> failed: Permission denied (euid=5000(vmail) egid=5000(vmail) >>> missing +w perm: /run/media/computer, we're not in group >>> 0(root), dir owned by 0:0 mode=0775) >>> >> >> Maybe try fix these? >> >> >> Aki >>

2 1