- dovecot - dovecot.org

dsync: expunge from pop3 does not replicate
by Jakub Lánský 25 Jul '18

25 Jul '18

Hi, I'm using dovecot 2.3.2.1 on Xenial from upstream packages on two Dovecot servers connected with dsync over TCP. E-mails which are deleted via POP3 protocol are not correctly deleted on second server via dsync. Jul 25 09:29:19 mda11 dovecot: pop3(jakub@***)<7587><8xaJ1c1x9uEqAB7QADwAAAAAAAAAAL7v>: expunge: box=INBOX, msgid=<6a75db5d84ff257216a4340d7c0405b2(a)blesmrt.eu>, size=3238, from=lenny@***, subject=dovecot pop3 test Nothing happened on the second machine then. After running # doveadm replicator replicate "jakub@***", e-mail got expunged immediately on second server. Jul 25 09:50:56 mda22 dovecot: dsync-local(jakub@***)<Xt6oFy8nWFsjIwAA0YRh9g>: expunge: box=INBOX, msgid=<6a75db5d84ff257216a4340d7c0405b2(a)blesmrt.eu>, size=3238, from=lenny@***, subject=dovecot pop3 test Any ideas what to do or test? Thank you -- Jakub Lánský IT administration/support technician jakub(a)lansky.biz GSM: +420776172737 Jabber/GTalk: lenny(a)blesmrt.net

2 1

Dsync fails to connect to remote IMAP server
by Andrzej Polatyński 24 Jul '18

24 Jul '18

Hi, I'm trying to migrate from an old courier IMAP server to Dovecot 2.3.1 (8e2f634). The old server uses self signed SSL certificate. I'm using the following configuration: imapc_host = 10.1.1.3 imapc_user = %u imapc_features = rfc822.size fetch-headers imapc_port = 993 imapc_ssl = imaps imapc_ssl_verify = no mail_prefetch_count = 20 mail_shared_explicit_inbox = no Launching dsync with the command: doveadm -o mail_fsync=never -o imapc_password=PASSWORD -Dv backup -R -u USER @DOMAIN <andrzej(a)datatel.net> imapc: In the output logs I get messages like below: dsync(USER@DOMAIN): Error: imapc(10.1.1.3:993): Couldn't initialize SSL context: Can't verify remote server certs without trusted CAs (ssl_client_ca_* settings) dsync(USER@DOMAIN): Debug: imapc(10.1.1.3:993): Created new connection dsync(USER@DOMAIN): Debug: imapc(10.1.1.3:993): Looking up IP address (reconnect_ok=true, last_connect=1532016643) dsync(USER@DOMAIN): Debug: imapc(10.1.1.3:993): Connecting to 10.1.1.3:993 dsync(USER@DOMAIN): Info: imapc(10.1.1.3:993): Connected to 10.1.1.3:993 (local 172.17.0.5:51972) dsync(USER@DOMAIN): Error: imapc(10.1.1.3:993): No SSL context dsync(USER@DOMAIN): Debug: imapc(10.1.1.3:993): Disconnected Am I missing some configuration parameters? -- Regards, Andrew

2 2

dovecot sometimes sends non-default SSL cert if IMAP client won't send SNI
by Martin Johannes Dauser 24 Jul '18

24 Jul '18

Hi, I recognised some funny behaviour on my server. IMAP clients which won't send an Server Name Indication (SNI) sometimes get the wrong certificate. I would expect that those clients always get the default certificate (of my new domain), instead in about 20 to 50% of connections the certificate of my old domain will be presented. (sample rate was 3 times 30 connections) Clients sending SNI always get the right certificate. A user informed me that offlineIMAP complains 'CA Cert verifying failed: no matching domain name found in certificate' So at least offlineIMAP 7.0.12 from Debain stretch won't send SNI, there is a newer version upstream though. I myself checked the server's behaviour with openssl: $ openssl s_client -showcerts -connect IP-address:993 and $ openssl s_client -showcerts -connect IP-address:993 -servername imap.domain I'm totally clueless about how come. Best regards Martin Johannes Dauser # 2.2.10: /etc/dovecot/dovecot.conf # OS: Linux 3.10.0-862.el7.x86_64 x86_64 Red Hat Enterprise Linux Server release 7.5 (Maipo) ... service imap-login { inet_listener imap { address = 127.0.0.1 port = 143 } inet_listener imaps { port = 993 ssl = yes } process_min_avail = 8 service_count = 0 } ... ssl = required # set default cert ssl_cert = </etc/pki/dovecot/certs/mail_new_domain-chained.cert ssl_cipher_list = DHE-RSA-AES256-SHA:DHE-RSA-AES128- SHA:ALL:!LOW:!SSLv2:!EXP:!aNULL:!MD5:!RC4:!DES:!3DES:!TLSv1 ssl_key = </etc/pki/dovecot/private/mail_new_domain.key ssl_protocols = !SSLv2 !SSLv3 ... # set alternativ cert for old domain local_name mail.old.domain { ssl_cert = </etc/pki/dovecot/certs/mail_old_domain-chained.cert ssl_key = </etc/pki/dovecot/private/mail_old_domain.key } local_name imap.old.domain { ssl_cert = </etc/pki/dovecot/certs/mail_old_domain-chained.cert ssl_key = </etc/pki/dovecot/private/mail_old_domain.key } local_name pop.old.domain { ssl_cert = </etc/pki/dovecot/certs/mail_old_domain-chained.cert ssl_key = </etc/pki/dovecot/private/mail_old_domain.key } # set explicit cert for new domain local_name mail.new.domain { ssl_cert = </etc/pki/dovecot/certs/mail_new_domain-chained.cert ssl_key = </etc/pki/dovecot/private/mail_new_doman.key } local_name imap.new.domain { ssl_cert = </etc/pki/dovecot/certs/mail_new_domain-chained.cert ssl_key = </etc/pki/dovecot/private/mail_new_domain.key } local_name pop.new.domain { ssl_cert = </etc/pki/dovecot/certs/mail_new_domain-chained.cert ssl_key = </etc/pki/dovecot/private/mail_new_domain.key }

2 3

Namespace question
by J Doe 24 Jul '18

24 Jul '18

Hi, I have a question about the “inbox” namespace, as mentioned in: conf.d/10-mail.conf. I have written my dovecot.conf file from scratch and do not include: conf.d/10-mail.conf. I have not defined the “inbox” namespace and so I am assuming that one is created by default. When I list the dovecot defaults via “sudo doveconf -d”, I notice that no “namespace inbox” entry exists. If “namespace inbox” is not specified, is one still created by default ? Thanks, - J

2 1

anvil in 2.3.2.1?
by kevin martin 23 Jul '18

23 Jul '18

Has anvil gone away in 2.3.2.1? I ask only because I don't find an example of anvil in the conf.d files anymore and I'm migrating from 2.2.10 version to 2.3.2.1. Thanks.

1 0

doveadm expunge didn't clear Trash mailbox
by Sophie Loewenthal 23 Jul '18

23 Jul '18

Hi, Why did my 'doveadm expunge' command not clear the Trash out of a mailbox? The oldest messages was put into the Trash on the 26th June 2018 as shown in the file timestamp. -rw------- 1 vmail mail 33056 Jun 26 16:46 1530031582.M768773P18242.mx10,S=33056,W=33510:2,RS # doveadm -D expunge -u testuser(a)example.org mailbox Trash savedbefore 2d Debug: Loading modules from directory: /usr/lib/dovecot/modules/doveadm Debug: Skipping module doveadm_acl_plugin, because dlopen() failed: /usr/lib/dovecot/modules/doveadm/lib10_doveadm_acl_plugin.so: undefined symbol: acl_lookup_dict_iterate_visible_next (this is usually intentional, so just ignore this message) Debug: Skipping module doveadm_expire_plugin, because dlopen() failed: /usr/lib/dovecot/modules/doveadm/lib10_doveadm_expire_plugin.so: undefined symbol: expire_set_deinit (this is usually intentional, so just ignore this message) Debug: Skipping module doveadm_quota_plugin, because dlopen() failed: /usr/lib/dovecot/modules/doveadm/lib10_doveadm_quota_plugin.so: undefined symbol: quota_user_module (this is usually intentional, so just ignore this message) Debug: Module loaded: /usr/lib/dovecot/modules/doveadm/lib10_doveadm_sieve_plugin.so Debug: Skipping module doveadm_fts_lucene_plugin, because dlopen() failed: /usr/lib/dovecot/modules/doveadm/lib20_doveadm_fts_lucene_plugin.so: undefined symbol: lucene_index_iter_deinit (this is usually intentional, so just ignore this message) Debug: Skipping module doveadm_fts_plugin, because dlopen() failed: /usr/lib/dovecot/modules/doveadm/lib20_doveadm_fts_plugin.so: undefined symbol: fts_user_get_language_list (this is usually intentional, so just ignore this message) Debug: Skipping module doveadm_mail_crypt_plugin, because dlopen() failed: /usr/lib/dovecot/modules/doveadm/libdoveadm_mail_crypt_plugin.so: undefined symbol: mail_crypt_box_get_pvt_digests (this is usually intentional, so just ignore this message) doveadm(testuser(a)example.org): Debug: Added userdb setting: mail=maildir:/var/vmail/example.org/testuser@example.org doveadm(testuser(a)example.org): Debug: Added userdb setting: plugin/quota=dirsize:storage= doveadm(testuser(a)example.org): Debug: Effective uid=150, gid=8, home=/var/vmail/example.org/testuser@example.org doveadm(testuser(a)example.org): Debug: Namespace inbox: type=private, prefix=, sep=, inbox=yes, hidden=no, list=yes, subscriptions=yes location=maildir:/var/vmail/example.org/testuser@example.org doveadm(testuser(a)example.org): Debug: maildir++: root=/var/vmail/example.org/testuser@example.org, index=, indexpvt=, control=, inbox=/var/vmail/example.org/testuser@example.org, alt= Sophie

3 6

Dovecot pop3d and imapd problem
by John Paul Iglesia 23 Jul '18

23 Jul '18

Hi, My dovecot version : 2.2.22 Recently, i had issues on dovecot. All packages of dovecot were installed on my system then suddenly when I checked yesterday the packages for dovecot-pop3d and dovecot-imapd were no longer on the list of app installed. Because of this dovecot service stop running. I checked the apt history log, term log and even dpkg log, there were no information about removing the packages. It just shown on my apt list the packages were not longer there. I had to reinstalled these 2 packages just to make dovecot run and for me to be able to receive and send messages. What do you think is the problem, is it dovecot bug? Please advise. Thanks, paul.tcbc

3 3

dovecot lmtp and drop privileges to specific user
by Christos Chatzaras 23 Jul '18

23 Jul '18

Is it possible when dovecot LMTP to drop privileges to a specific user instead of the e-mail account user?

2 1

Stopping login via "nologin" parameter
by J Doe 23 Jul '18

23 Jul '18

Hello, I have a basic e-mail server with Postfix 3.1 and Dovecot 2.2.22. I am using a passwd-file for both userdb and passdb: /etc/dovecot/dovecot.conf userdb { driver = passwd-file args = /etc/dovecot/passwd } passdb { driver = passwd-file args = /etc/dovecot/passwd } } In the passwd file, I want to have user account names for SMTP SASL AUTH and IMAP that are NOT e-mail addresses. For example, employee one of ABC corp would have a SMTP SASL AUTH/IMAP account name in the form: abc_company_employeeid (for example: abc_company_03284). The idea behind that is that I do not want someone outside of the company to be able to know the first half of the username and password pair just because they have an employee's e-mail address. For the e-mail address I specify something like: bob(a)abc.com however I never want someone to be able to login via their e-mail address. Originally, I specified the password field as empty, with the understanding being that the default encryption of a password is {CRYPT}. Since crypt() cannot output a null string, this meant that there was never a valid password. So passwd looked like this: /etc/dovecot/passwd # SMTP SASL AUTH and IMAP accounts abc_company_03284:::::::userdb_mail=maildir:/var/mail/vhosts/abc.com/abc_co… # IMAP bob@abc.com:vmail:vmail::/home/vmail/bob::userdb_maill=maildir:/var/mail/vhosts/abc.com/abc_company_03284 I tested SMTP SASL AUTH and IMAP via the openssl s_client and can confirm that I can login and send e-mail as well as retrieve mail only via the: abc_company_03284 account, but because an empty password field isn’t mentioned on the Dovecot wiki, I was wondering if I should add “nologin” to explicitly make it impossible for: bob(a)abc.com. “nologin” was mentioned to me in a previous e-mail to this list. So passwd would now look like this: /etc/dovecot/passwd # SMTP SASL AUTH and IMAP accounts abc_company_03284:::::::userdb_mail=maildir:/var/mail/vhosts/abc.com/abc_co… # IMAP bob@abc.com:vmail:vmail::/home/vmail/bob::userdb_mail=maildir:/var/mail/vhosts/abc.com/abc_company_03284 nologin I restarted Dovecot and tested this with openssl s_client for SMTP SASL AUTH and IMAP, but just wanted to make sure that this STOPS ANY LOGINS via the e-mail address: bob(a)abc.com ? Thanks, - J

1 1

ot: LE server conf setup/ iPhone 'expired cert' message
by Voytek Eymont 22 Jul '18

22 Jul '18

I've installed LE certs on my Dovecot a while back, and, it has been working OK since, but, today, an iPhone user said he can't get emails as iphone says 'cert is expired', searching around, I see some other iPhone similar issues reported, do I have my conf correct, I have; # cat dovecot.conf | grep ssl ssl = required verbose_ssl = no ssl_cert = </etc/letsencrypt/live/fqn.myserver/fullchain.pem ssl_key = </etc/letsencrypt/live/fqn.myserver/privkey.pem is fullchain.pem and privkey.pem is what I should be using ? anythought how to force an iphone to reload cert ? actual cert was renewed 15/7, old/previous one expired earlier today ls /etc/letsencrypt/live/fqn.myserver/ cert.pem chain.pem fullchain.pem privkey.pem (if I open mailserver host in browser, padlock shows current/valid cert) -- Voytek

6 8