- dovecot - dovecot.org

Errors using dovecot 2.4 container image
by Andreas Achtzehn 26 Jan '25

26 Jan '25

Dear Dovecot team, I ran into troubles using the newly released 2.4 docker image. The dovecot/dovenull users are apparently not part of the image -- hence the dovecot server fails to start up with a fatal error. I'm using a vanilla configuration, default_login_user, etc. are not set. Thanks for having a look! Best regards, Andreas

3 2

Latest docker image broken
by Stephen Benjamin 26 Jan '25

26 Jan '25

I use watchtower to keep my docker images up to date and the image pushed to latest tag yesterday broke everything - I can’t find any docs saying anything about mail_location being removed or replaced…. Any idea? I’m unfortunately away from my laptop for a few days so I can’t do any deep debugging but I’d appreciate any pointer. doveconf: Fatal: Error in configuration file /etc/dovecot/dovecot.conf line 1: mail_location: Unknown setting: mail_location Sent from my iPhone

2 2

Help with migration of Quota config to 2.4.0?
by dovecot.org＠schildbach.de 25 Jan '25

25 Jan '25

I've converted most of my config to 2.4.0, but one thing I don't get from the docs: ``` mail_plugins = $mail_plugins quota protocol imap { mail_plugins = $mail_plugins imap_quota } plugin { quota = maildir:User quota:noenforcing quota_rule = *:storage=7GB quota_rule2 = Trash:storage=+10%% } ``` How would this translate?

2 1

Dovecot 2.4.0 compilation issues (Linux, GCC 8.3.1)
by Andreas M. Kirchwitz 25 Jan '25

25 Jan '25

Hello users of Dovecot! Currently, Dovecot 2.3.21.1 compiles and runs fine on a Red Hat Linux clone with GCC 8.3.1. Now tried the brandnew sources of Dovecot 2.4.0, but to my surprise it doesn't even compile and I have no clue where to begin my debugging. Besides some minor things (new OpenSSL version check not working, maybe because not using proper include files; and one library is missing -lrt to use clock_gettime), I'm totally stuck at compiling the new "src/lib-http/http-server-settings.c". It fails while including "src/lib/macros.h" with the message "error: size of unnamed array is negative" Dovecot 2.3.21.1 has no http-server-settings.c but a very similar macros.h which everbody seems to be happy about. So what is it that happens while compiling http-server-settings.c to make GCC fail? I ran "./configure" with just LDFLAGS="-lrt -Wl,--no-as-needed" added, and then simply "make". Nothing special here. I'm happy with all the default settings and auto-detected options. Full log of compilation messages is appended at the end of this message. Any help is highly appreciated. Currently I have no idea where to even start my search for a workaround or even a solution. Never had such problems with compiling Dovecot so far. Thanks a lot in advance ... Andreas ====================================================================== Compilation messages where the error occurs: ====================================================================== Making all in lib-http make[3]: Entering directory '/usr/local/src/dovecot-2.4.0/src/lib-http' CC http-server-settings.lo In file included from ../../src/lib/lib.h:37, from http-server-settings.c:3: ../../src/lib/lib.h: In function ‘time_to_uint32’: ../../src/lib/lib.h:145:14: warning: comparison of integer expressions of different signedness: ‘time_t’ {aka ‘long int’} and ‘unsigned int’ [-Wsign-compare] i_assert(ts <= UINT32_MAX); ^~ ../../src/lib/macros.h:198:45: note: in definition of macro ‘unlikely’ # define unlikely(expr) (__builtin_expect((expr) ? 1 : 0, 0) != 0) ^~~~ ../../src/lib/lib.h:145:2: note: in expansion of macro ‘i_assert’ i_assert(ts <= UINT32_MAX); ^~~~~~~~ In file included from http-server-settings.c:3: ../../src/lib/lib.h: In function ‘time_to_uint32_trunc’: ../../src/lib/lib.h:153:9: warning: comparison of integer expressions of different signedness: ‘time_t’ {aka ‘long int’} and ‘unsigned int’ [-Wsign-compare] if (ts > UINT32_MAX) ^ In file included from ../../src/lib/lib.h:37, from http-server-settings.c:3: http-server-settings.c: At top level: ../../src/lib/macros.h:173:14: error: size of unnamed array is negative (sizeof(char[1 - 2 * ((condition) ? 1 : 0)]) > 0 ? FALSE : FALSE) ^ ../../src/lib/macros.h:182:2: note: in expansion of macro ‘COMPILE_ERROR_IF_TRUE’ COMPILE_ERROR_IF_TRUE( \ ^~~~~~~~~~~~~~~~~~~~~ ../../src/lib-settings/settings-parser.h:78:27: note: in expansion of macro ‘COMPILE_ERROR_IF_TYPES_NOT_COMPATIBLE’ { .type = (_enum_type) + COMPILE_ERROR_IF_TYPES_NOT_COMPATIBLE( \ ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ../../src/lib-settings/settings-parser.h:125:2: note: in expansion of macro ‘SETTING_DEFINE_STRUCT_TYPE’ SETTING_DEFINE_STRUCT_TYPE(SET_SIZE, SET_FLAG_HIDDEN, uoff_t, key, name, struct_name) ^~~~~~~~~~~~~~~~~~~~~~~~~~ http-server-settings.c:13:2: note: in expansion of macro ‘SETTING_DEFINE_STRUCT_SIZE_HIDDEN’ SETTING_DEFINE_STRUCT_##type("http_server_"#name, name, struct http_server_settings) ^~~~~~~~~~~~~~~~~~~~~~ http-server-settings.c:34:2: note: in expansion of macro ‘DEF’ DEF(SIZE_HIDDEN, socket_send_buffer_size), ^~~ ../../src/lib/macros.h:173:14: error: size of unnamed array is negative (sizeof(char[1 - 2 * ((condition) ? 1 : 0)]) > 0 ? FALSE : FALSE) ^ ../../src/lib/macros.h:182:2: note: in expansion of macro ‘COMPILE_ERROR_IF_TRUE’ COMPILE_ERROR_IF_TRUE( \ ^~~~~~~~~~~~~~~~~~~~~ ../../src/lib-settings/settings-parser.h:78:27: note: in expansion of macro ‘COMPILE_ERROR_IF_TYPES_NOT_COMPATIBLE’ { .type = (_enum_type) + COMPILE_ERROR_IF_TYPES_NOT_COMPATIBLE( \ ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ../../src/lib-settings/settings-parser.h:125:2: note: in expansion of macro ‘SETTING_DEFINE_STRUCT_TYPE’ SETTING_DEFINE_STRUCT_TYPE(SET_SIZE, SET_FLAG_HIDDEN, uoff_t, key, name, struct_name) ^~~~~~~~~~~~~~~~~~~~~~~~~~ http-server-settings.c:13:2: note: in expansion of macro ‘SETTING_DEFINE_STRUCT_SIZE_HIDDEN’ SETTING_DEFINE_STRUCT_##type("http_server_"#name, name, struct http_server_settings) ^~~~~~~~~~~~~~~~~~~~~~ http-server-settings.c:35:2: note: in expansion of macro ‘DEF’ DEF(SIZE_HIDDEN, socket_recv_buffer_size), ^~~ make[3]: *** [Makefile:1007: http-server-settings.lo] Error 1 make[3]: Leaving directory '/usr/local/src/dovecot-2.4.0/src/lib-http' make[2]: *** [Makefile:587: all-recursive] Error 1 make[2]: Leaving directory '/usr/local/src/dovecot-2.4.0/src' make[1]: *** [Makefile:725: all-recursive] Error 1 make[1]: Leaving directory '/usr/local/src/dovecot-2.4.0' make: *** [Makefile:567: all] Error 2

3 3

newbie dsync problems
by Kent Borg 25 Jan '25

25 Jan '25

I have a very basic postfix/dovecot server, with just a few users, and it works. But in the past I have had hardware failures…so I would like use dsync to a nearly matching server for some extra safety, and I have not yet been successful. I am trying to do this as root over ssh, with a private key for authentication. I do not managed to get the whole replicator thing working, so as part of simplifying things I am trying to run dsync manually, just on one user (myself). I hope this isn't a silly approach. What would the manual command look like? The closest example on the man page is: > $ doveadm sync -u username(a)example.com ssh -i id_dsa.dovecot \ > mailuser(a)example.com doveadm dsync-server -u username(a)example.com I try to change that to match my case and it has never heard of me: > root@la:/etc/dovecot# doveadm sync -1 -u kentborg(a)mail.borg.org ssh -i > /root/.ssh/id_rsa_rc.borg.org.dsync kentborg(a)mail.borg.org doveadm > dsync-server -u kentborg(a)mail.borg.org > doveadm(kentborg(a)mail.borg.org): Error: User doesn't exist > root@la:/etc/dovecot# I drop the machine part of the name and it knows who I am on this end but can't get to the other end: > root@la:/etc/dovecot# doveadm sync -1 -u kentborg ssh -i > /root/.ssh/id_rsa_rc.borg.org.dsync kentborg(a)mail.borg.org doveadm > dsync-server -u kent\ > borg(a)mail.borg.org > kentborg(a)mail.borg.org's password: I think I have root's ssh keys set up correctly, I can run this: > root@la:/etc/dovecot# ssh -i /root/.ssh/id_rsa_rc.borg.org.dsync > mail.borg.org > PTY allocation request failed on channel 0 > C-c C-croot@la:/etc/dovecot# …and on the remote end I see some debugging output I put in the remote script, outputting an empty username. Makes sense. If I try to put that in this (incomplete) dsync command: > root@la:/etc/dovecot# doveadm sync -u kentborg -1 ssh -i > /root/.ssh/id_rsa_rc.borg.org.dsync mail.borg.org > Error: Extraneous arguments found: 3 5 > doveadm(kentborg)<1029674><QvOnDPmKkmcqtg8AA8+vgQ>: Error: > read(remote) failed: EOF (version not received) > doveadm(kentborg)<1029674><QvOnDPmKkmcqtg8AA8+vgQ>: Error: Remote > command returned error 64: ssh -i /root/.ssh/id_rsa_rc.borg.org.dsync > mail.borg\ > .org dsync-server > root@la:/etc/dovecot# And the remote end outputs the username as "VERSION dsync 3 5", okay, maybe progress. But when I try to make the command more complete and send a username to the remote end, and now I am no longer talking to the remote end: > root@la:/etc/dovecot# doveadm sync -u kentborg -1 ssh -i > /root/.ssh/id_rsa_rc.borg.org.dsync remoteprefix(a)mail.borg.org > remoteprefix(a)mail.borg.org's password: Suggestions? Thanks, -kb

2 8

TLS Connections Between Dovecot & MariaDB
by duluxoz 25 Jan '25

25 Jan '25

Hi All, I'm using a MariaDB backend to a Dovecot server, with TLS required by the MariaDB server for connections. My sql_dovecot.conf.ext file is using the following connection line: `connect = host=mariadb.example.com dbname=mail_server user=vmail password={REDACTED} ssl_ca=/etc/pki/tls/certs/root_ca.crt`. I can't work out from the doco or Google what else I need in that line, but I suspect it'll be something like: `ssl_cert=/etc/pki/tls/certs/vmail_rsa.pem ssl_key=/etc/pki/tls/certs/vmail_rsa.key`. Could someone please confirm this and let me know the actual extra commands/options - thanks Cheers Dulux-Oz

2 3

Virtual folders in top level hierarchy
by Robert Sanchez 25 Jan '25

25 Jan '25

Hi, I've got a virtual "Flagged" folder but it appears as a subfolder of "virtual" instead of being alongside Inbox, Sent, etc. I've seen some previous messages where this was asked, but they didn't really seem to achieve what I want. My expectation was that calling the defined "virtual.Flagged" folder in the inbox namespace would link it there, but either that is not the expected behavior or I'm doing something wrong. This is my current config: namespace virtual { location = virtual:/etc/dovecot/virtual:INDEX=~/virtual:CONTROL=~/virtual:VOLATILEDIR=~/virtual/ prefix = virtual. separator = . list = yes hidden = no } namespace inbox { # (...) default Drafts, Junk, etc. # If you have a virtual "Flagged" mailbox: mailbox virtual.Flagged { special_use = \Flagged auto = subscribe comment = All my flagged messages } } I've also tried "hidden = yes" and "list = no", but I don't see any differences in the client. This is Dovecot 2.3.21 (47349e2482) on Ubuntu 24.04, btw. Thanks.

1 0

Proper syntax for using `allow_nets` with dovecot passdb sql
by Kevin Farley 24 Jan '25

24 Jan '25

Hi there, I posted this question in ServerFault (https://serverfault.com/questions/1170095/proper-syntax-for-using-allow-net…) but haven't gotten an answer after 10 days so thought I'd try here, I appreciate any help you can offer! I want to allow for two auth methods in dovecot via SQL. First, the traditional route where the password is hashed with |SHA512-CRYPT| and compared to the DB response. Second, where the request is coming from a user already authenticated by a different part of the local system, and the hash itself is passed and compared as |PLAIN|. It works perfectly with the following |auth-sql.conf.ext| and associated sql files... |# Passdb for traditional method passdb { driver = sql args = /etc/dovecot/conf.d/dovecot-sql.conf.ext } # Passdb for hybrid method (direct hash comparison) passdb { driver = sql args = /etc/dovecot/conf.d/dovecot-sql-hybrid.conf.ext } # Userdb prefetch to use attributes from the passdb query userdb { driver = prefetch } # Userdb static as fallback for default attributes userdb { driver = static args = uid=vmail gid=vmail home=/srv/mail/%d/%n } | The problem I'm having is that I want to secure the second hybrid |PLAIN| method so that it can only be used by the local host using the |allow_nets| argument. In the documentation <https://doc.dovecot.org/2.3/configuration_manual/authentication/allow_nets/…> it shows that I should simply add it to the |args| like this... |args = /etc/dovecot/conf.d/dovecot-sql-hybrid.conf.ext allow_nets=local,127.0.0.1/32 | But as soon as I do this, the logs show that it's trying to open the entire string as if the |allow_nets...| argument is part of the path, and fails to find the file. I've tried moving the |allow_nets| argument to the beginning, but that had the same result. What is the correct syntax for using |allow_nets| with |passdb sql|? # 2.3.16 (7e2e900c1a): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.16 (09c29328) # OS: Linux 5.14.0-503.21.1.el9_5.x86_64 x86_64 Rocky Linux release 9.5 (Blue Onyx) xfs Thanks, Kevin.

1 0

doveadm mailbox list permission failure for virtual user
by leo1subscr＠zudiewiener.com 24 Jan '25

24 Jan '25

I'm using Dovecot 2.3.21 (47349e2482) on Ubuntu and have convigured virtual mail users. Everything is working finem but a few doevadm commands fail sudo doveadm mailbox list returns doveadm(root): Error: chdir(/root/) failed: Permission denied (euid=1001(vmail) egid=1001(vmail) missing +x perm: /root, dir owned by 0:0 mode=0700)

3 2

Fwd: Fwd: [OFFLIST] Re: connection refused, no error anywhere
by Marco Fioretti 23 Jan '25

23 Jan '25

Hi Robert, I corrected the service imap-login section of both dovecot.conf AND conf.d/10-master.conf as you suggested, The files in ssl_cert and ssl_key exist and are readable by dovecot. I have even changed for testing the permission of /etc/letsencrypt/live /etc/letsencrypt/archive to 0755 and restarted dovecot. However, the output of ss -tuln | grep 993 is still null. What next? Thanks ---------- Forwarded message --------- Da: Robert Nowotny <rnowotny(a)rotek.at> Date: mar 21 gen 2025 alle ore 23:47 Subject: RE: Fwd: [OFFLIST] Re: connection refused, no error anywhere To: Marco Fioretti <marco.fioretti(a)gmail.com> To resolve the connection refused error when accessing Dovecot on the new server, you need to adjust the Dovecot configuration to enable the appropriate IMAP service ports. 1. Enable IMAPS (Port 993) for Secure Connections: - Modify the `service imap-login` section in your Dovecot configuration (likely in `/etc/dovecot/conf.d/10-master.conf`) to include an `imaps` listener: ```conf service imap-login { inet_listener imap { port = 0 # Disables plain IMAP (port 143) } inet_listener imaps { port = 993 ssl = yes } } ``` - This configuration disables plaintext IMAP on port 143 and enables IMAPS on port 993 with SSL. 2. Ensure SSL Certificates Are Correct: - Verify the paths to your SSL certificate and key in `/etc/dovecot/conf.d/10-ssl.conf`: ```conf ssl_cert = </etc/letsencrypt/live/example.com/fullchain.pem ssl_key = </etc/letsencrypt/live/example.com/privkey.pem ``` - Confirm the files exist and have proper permissions (readable by Dovecot). 3. Restart Dovecot: ```bash sudo systemctl restart dovecot ``` 4. Verify Dovecot is Listening: ```bash sudo ss -tuln | grep 993 ``` - You should see Dovecot listening on port 993. 5. Test the Connection Using SSL: ```bash openssl s_client -connect example.com:993 ``` - This should establish a secure connection to the IMAPS port. Additional Recommendations: - Disable Plaintext IMAP: Keeping `port = 0` for the `imap` listener ensures unencrypted IMAP is disabled, enhancing security. - Firewall Configuration: Confirm UFW allows port 993: ```bash sudo ufw allow 993/tcp ``` By enabling IMAPS on port 993 and ensuring SSL is properly configured, secure email access will be restored. If you must use port 143 (not recommended), set `port = 143` in the `imap` listener and enforce STARTTLS by adding `ssl = required` in your SSL configuration. *Von:* Marco Fioretti via dovecot <dovecot(a)dovecot.org> <dovecot(a)dovecot.org> *Gesendet:* Dienstag, 21. Januar 2025 um 23:22 MEZ *An:* Dovecot <dovecot(a)dovecot.org> <dovecot(a)dovecot.org> *Betreff:* FW: [OFFLIST] Re: connection refused, no error anywhere ---------- Forwarded message --------- Da: Marco Fioretti <marco.fioretti(a)gmail.com> <marco.fioretti(a)gmail.com> Date: mar 21 gen 2025 alle ore 19:33 Subject: Re: [OFFLIST] Re: connection refused, no error anywhere To: Michael Peddemors <michael(a)linuxmagic.com> <michael(a)linuxmagic.com> Hi Michel, I cannot say which NGO it is. What I know is that everything with that configuration was working fine, as far as they know, on the old server. So, any help to change the configuration to make it work with the current version of dovecot on Ubuntu 24.04LTS is very welcome... Il giorno mar 21 gen 2025 alle ore 19:11 Michael Peddemors <michael(a)linuxmagic.com> ha scritto: Which NGO? Don't listen on port 143 any more, make sure to only listen on 587/465/993/995 with TLS/SSL.. NGO's are often targeted.. On 2025-01-21 09:50, Marco Fioretti via dovecot wrote: Greetings, I was just tasked with rebuilding from scratch the mail server of an NGO, on a brand new Ubuntu 24.04 LTS VPS. I have copied the whole dovecot configuration to the new server, and now am stuck because: - dovecot IS running, dovecot service status shows no errors, but: - if I try to connect with mutt from my desktop I get "connection refused" - the ufw firewall does allow imap/imaps connections, and there are no errors in its log - even "telnet localhost 143" fails: Trying ::1... Connection failed: Connection refused Trying 127.0.0.1... telnet: Unable to connect to remote host: Connection refused - I see no related errors in /var/log/mail.log or /var/log/syslog. output of dovecot -n is pasted below, I only changed the actual domain name to "example.com" TIA for any pointer, I really need to get this server back online as soon as possible... Marco # 2.3.21 (47349e2482): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.21 (f6cd4b8e) doveconf: Warning: NOTE: You can get a new clean config file with: doveconf -Pn > dovecot-new.conf doveconf: Warning: Obsolete setting in /etc/dovecot/conf.d/10-ssl.conf:9: ssl_dh_parameters_length is no longer needed # OS: Linux 6.8.0-51-generic x86_64 Ubuntu 24.04.1 LTS ext4 # Hostname: example.com auth_debug = yes auth_verbose = yes auth_verbose_passwords = plain mail_location = maildir:/var/mail/mymail_storage/base/ mbox_write_locks = fcntl passdb { args = /etc/imap.v_users driver = passwd-file } passdb { driver = pam } service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0660 user = postfix } } service imap-login { inet_listener imap { port = 0 } } ssl_cert = </etc/letsencrypt/live/example.com/fullchain.pem ssl_cipher_list = ALL ssl_key = # hidden, use -P to show it ssl_prefer_server_ciphers = yes userdb { args = /etc/imap.v_users driver = passwd-file } userdb { driver = passwd } verbose_ssl = yes _______________________________________________ dovecot mailing list -- dovecot(a)dovecot.org To unsubscribe send an email to dovecot-leave(a)dovecot.org -- "Catch the Magic of Linux..." ------------------------------------------------------------------------ Michael Peddemors, President/CEO LinuxMagic Inc. Visit us at http://www.linuxmagic.com @linuxmagic A Wizard IT Company - For More Info http://www.wizard.ca "LinuxMagic" a Reg. TradeMark of Wizard Tower TechnoServices Ltd. ------------------------------------------------------------------------ 604-682-0300 Beautiful British Columbia, Canada _______________________________________________ dovecot mailing list -- dovecot(a)dovecot.org To unsubscribe send an email to dovecot-leave(a)dovecot.org

6 13