- dovecot - dovecot.org

Use of separate storage for mail delivery
by SAAHIL IFTEKHAR 04 Apr '18

04 Apr '18

Hi I am facing one issue which is mostly about concepts. I have to be clear on that to move forward. I have tried finding solutions about it but couldn't find anything which talks about it. We have a setup which includes postfix and dovecot. We are using lmtp and delivery of mail is happening through dovecot. We want that delivery of mail should happen in a separate node. I was able to achieve it through lmtp by providing ip address and using port 24. But now I have been asked to just try to deliver to a separate storage medium and not node. That means it will have an ip address but no dovecot or other software running. This is in relation to incorporation of storage area network (SAN) later on. Is it possible? I thought there must be some way as many running mail systems are using message store and SAN. All i can find that was close was mailbox sharing and email archiving. Please help me about this as I have already spent 3 days to it with no luck. I just want the right direction to move forward on this. Regards

1 0

2.3.1 Replication is throwing scary errors
by Michael Grimm 03 Apr '18

03 Apr '18

Hi [This is Dovecot 2.3.1 at FreeBSD STABLE-11.1 running in two jails at distinct servers.] I did upgrade from 2.2.35 to 2.3.1 today, and I do become pounded by error messages at server1 (and vice versa at server2) as follows: | Apr 2 17:12:18 <mail.err> server1.lan dovecot: doveadm: Error: dsync(server2.lan): I/O has stalled, \ no activity for 600 seconds (last sent=mail_change, last recv=mail_change (EOL)) | Apr 2 17:12:18 <mail.err> server1.lan dovecot: doveadm: Error: Timeout during state=sync_mails \ (send=changes recv=mail_requests) […] | Apr 2 18:59:03 <mail.err> server1.lan dovecot: doveadm: Error: dsync(server2.lan): I/O has stalled, \ no activity for 600 seconds (last sent=mail, last recv=mail (EOL)) | Apr 2 18:59:03 <mail.err> server1.lan dovecot: doveadm: Error: Timeout during state=sync_mails \ (send=mails recv=recv_last_common) I cannot see in my personal account any missing replications, *but* I haven't tested this thoroughly enough. I do have customers being serviced at these productive servers, *thus* I'm back to 2.2.35 until I do understand or have learned what is going on. Any ideas/feedback? FYI: I haven't seen such errors before. Replication has been working for years now, without any glitches at all. Regards, Michael

1 1

dovecot auth error: Illegal seek
by panetta 03 Apr '18

03 Apr '18

Hi, I recently configured dovecot to manage auth for both local and virtual user. When i login as a virtual user (claudio.panetta) I get the following message: dovecot: auth: Error: passwd(claudio.panetta,160.97.62.1,<WLjlnZ9oRACgYT4B>): getpwnam() failed: Illegal seek but login is ok and sending/receiving email is ok, how can, if possible, I suppress this error message? In the following my dovecot config: host-prompt# dovecot -n # 2.1.7: /etc/dovecot/dovecot.conf # OS: Linux 3.2.0-5-686-pae i686 Debian 7.11 auth_mechanisms = plain login auth_username_format = %Ln listen = * log_timestamp = "%Y-%m-%d %H:%M:%S " login_greeting = Server ready. mail_full_filesystem_access = yes mail_location = mbox:~/:INBOX=/var/mail/%u:INDEX=/var/index/%u mail_privileged_group = mail passdb { driver = pam } passdb { args = scheme=MD5-CRYPT username_format=%n /etc/dovecot/users driver = passwd-file } protocols = " imap" service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0660 user = postfix } user = root } service imap-login { inet_listener imap { port = 0 } } ssl_cert = </etc/ssl/certs/chained-cert-9599-ml.mat.unical.it.pem ssl_key = </etc/ssl/private/csrkey-ml.mat.unical.it.pem userdb { driver = passwd } userdb { args = username_format=%n /etc/dovecot/users uid=vmail gid=vmail home=/var/vmail/%d/%n mail=maildir:/var/vmail/%d/%n/Maildir driver = static } verbose_proctitle = yes host-prompt# cat /etc/dovecot/users claudio.panetta:{MD5-CRYPT}$1$abcdefghijklmnopqrst ciccio.pasticcio:{MD5-CRYPT}$1$abcdefghijklmnopqrst Regards, Claudio

2 2

multi-site SSL certificates
by Jeff Abrahamson 03 Apr '18

03 Apr '18

I'm handling mail for several domains, let's call them a.com, b.com, and c.com. I have certificates for each of these domains individually via certbot (letsencrypt) and nginx is happy with all of that. Since I initially configured the site to handle mail only for a.com, my /etc/postfix/main.cf file currently has these two lines: smtpd_tls_cert_file = /etc/letsencrypt/live/mail.a.com/fullchain.pem smtpd_tls_key_file = /etc/letsencrypt/live/mail.a.com/privkey.pem But I see that mail test tools are reporting that MX for b.com and c.com are misconfigured due to an SSL name mismatch. Indeed, this is true! So I believe I should generate a multi-site SSL cert. I try this: sudo certbot certonly --cert-name postfix --webroot \ --webroot-path /var/www/a-com -d www.a.com -d a.com -d mail.a.com \ --webroot-path /var/www/b-com -d www.b.com -d b.com \ --webroot-path /var/www/c-com -d www.c.com -d c.com And that fails with a bunch of errors like this: Domain: www.a.com Type: unauthorized Detail: Invalid response from http://www.a.com/.well-known/acme-challenge/IT7-YURAep4bniD9zYpKpdRUBQcgCRJ…: "<html> <head><title>404 Not Found</title></head> <body bgcolor="white"> <center><h1>404 Not Found</h1></center> <hr><center>" I see that the file .well-known/acme-challenge/IT7-YURAep4bniD9zYpKpdRUBQcgCRJ6FflmZzWQGNg is being created (and one other file, too) but that nginx reports that the _directory_ .well-known/acme-challenge/IT7-YURAep4bniD9zYpKpdRUBQcgCRJ6FflmZzWQGNg doesn't exist. Multi-site + letsencrypt + postfix is a subject that has recently changed quite a bit, so I'm suspecting my web reading is merely leading me astray. It is also entirely possible I've misunderstood things about SSL certificates. Any pointers how to generate (or point to) the certificates that I need to make those who contact my postfix instance happy with their SSL conversation? Thanks!

5 7

dovecot lastlogin tracking
by David Mehler 03 Apr '18

03 Apr '18

Hello, I am trying to get Dovecot 2.3.1 to track lastlogins of users. I'm using a MySQL database. When I log in I am getting this in the error log: 2018-04-02 18:24:21 imap(user(a)domain.com)<61855><6R0rDeVodcl/AAAB>: Error: last_login_dict: Failed to write value for user user(a)domain.com: dict-server returned failure: sql dict: commit failed: Field 'name' doesn't have a default value (reply took 0.026 secs (0.000 in dict wait, 0.020 in other ioloops, 0.001 in locks, async-id reply 0.000 secs ago, started on dict-server 0.019 secs ago, took 0.005 secs)) Here's an excerpt from my dovecot-dict-sql.conf.ext file: map { pattern = shared/last-login/$username table = accounts username_field = username value_field = lastlogin fields { username = $username } } I've got all users in the accounts table and there is a lastlogin column: describe accounts; +-----------+------------------+------+-----+---------+----------------+ | Field | Type | Null | Key | Default | Extra | +-----------+------------------+------+-----+---------+----------------+ | id | int(10) unsigned | NO | PRI | NULL | auto_increment | | name | varchar(255) | NO | | NULL | | | username | varchar(64) | NO | MUL | NULL | | | domain | varchar(255) | NO | MUL | NULL | | | password | varchar(255) | NO | | NULL | | | quota | int(10) unsigned | YES | | 0 | | | enabled | tinyint(1) | YES | | 0 | | | sendonly | tinyint(1) | YES | | 0 | | | lastlogin | int(11) unsigned | NO | | 0 | | Thanks. Dave. doveconf -n # 2.3.1 (8e2f634): /usr/local/etc/dovecot/dovecot.conf # Pigeonhole version 0.5.1 (d9bc6dfe) # OS: FreeBSD 11.1-RELEASE-p4 amd64 # Hostname: localhost auth_cache_size = 24 M auth_cache_ttl = 18 hours auth_default_realm = example.com auth_mechanisms = plain login auth_realms = example.com example2.com dict { acl = mysql:/usr/local/etc/dovecot/dovecot-dict-sql.conf.ext lastlogin = mysql:/usr/local/etc/dovecot/dovecot-dict-sql.conf.ext quota = mysql:/usr/local/etc/dovecot/dovecot-dict-sql.conf.ext } first_valid_gid = 999 first_valid_uid = 999 hostname = mail.example.com imap_idle_notify_interval = 10 mins last_valid_gid = 999 last_valid_uid = 999 lda_mailbox_autocreate = yes lda_mailbox_autosubscribe = yes lda_original_recipient_header = X-Original-To listen = 127.0.0.1 xxx.xxx.xxx.xxx log_path = /var/log/dovecot/dovecot.log log_timestamp = "%Y-%m-%d %H:%M:%S " mail_access_groups = vmail mail_gid = vmail mail_home = /home/vmail/mailboxes/%d/%n mail_location = maildir:~/mail:LAYOUT=fs mail_plugins = acl mail_log notify quota trash virtual welcome zlib mail_privileged_group = vmail mail_server_admin = mailto:postmaster@example.com mail_uid = vmail mailbox_idle_check_interval = 59 secs managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext spamtest spamtestplus virustest editheader imapflags notify imapsieve vnd.dovecot.imapsieve namespace { location = maildir:/home/vmail/public/:CONTROL=~/mail/public:INDEX=~/mail/public mailbox TestFolder { auto = subscribe comment = Public Folder for message sharing } prefix = Public/ separator = / subscriptions = yes type = public } namespace { list = children location = maildir:/home/vmail/mail/%%d/%%n:LAYOUT=fs:INDEX=/home/vmail/indexes/%d/%n/shared/%%u:INDEXPVT=/home/vmail/indexes/%d/%n/shared/%%u prefix = shared/%%d/%%n/ separator = / subscriptions = no type = shared } namespace inbox { inbox = yes location = mailbox Archives { auto = subscribe special_use = \Archive } mailbox Drafts { auto = subscribe special_use = \Drafts } mailbox Sent { auto = subscribe special_use = \Sent } mailbox Spam { auto = subscribe autoexpunge = 30 days special_use = \Junk } mailbox Trash { auto = subscribe autoexpunge = 30 days special_use = \Trash } mailbox virtual/All { comment = All my messages special_use = \All } prefix = separator = / type = private } namespace virtual { location = virtual:/usr/local/etc/dovecot/virtual:INDEX=~/virtual:CONTROL=~/virtual prefix = virtual/ separator = / } passdb { args = /usr/local/etc/dovecot/dovecot-sql.conf.ext driver = sql } plugin { acl = vfile acl_shared_dict = proxy::acl fts = lucene fts_autoindex = yes fts_autoindex_max_recent_msgs = 80 fts_index_timeout = 90 fts_lucene = whitespace_chars=@. normalize no_snowball imapsieve_mailbox1_before = file:/home/vmail/sieve/global/learn-spam.sieve imapsieve_mailbox1_causes = COPY imapsieve_mailbox1_name = Spam imapsieve_mailbox2_before = file:/home/vmail/sieve/global/learn-ham.sieve imapsieve_mailbox2_causes = COPY imapsieve_mailbox2_from = Spam imapsieve_mailbox2_name = * last_login_dict = proxy::lastlogin last_login_key = last-login/%n mail_log_events = delete undelete expunge copy mailbox_delete mailbox_rename mail_log_fields = uid box msgid size quota = dict:User quota::proxy::quota quota_exceeded_message = Storage quota for this account has been exceeded, please try again later. quota_grace = 10%% quota_status_nouser = DUNNO quota_status_overquota = 552 5.2.2 Mailbox is full quota_status_success = DUNNO quota_vsizes = true quota_warning = storage=100%% quota-exceeded 100 %u quota_warning2 = storage=95%% quota-warning 95 %u quota_warning3 = storage=90%% quota-warning 90 %u quota_warning4 = storage=85%% quota-warning 85 %u quota_warning5 = storage=75%% quota-warning 75 %u sieve = ~/.dovecot.sieve sieve_before = /home/vmail/sieve/before.d sieve_default = /home/vmail/sieve/default.sieve sieve_dir = ~/sieve sieve_extensions = +notify +imapflags +spamtest +spamtestplus +virustest +editheader sieve_global_dir = /home/vmail/sieve sieve_global_extensions = +vnd.dovecot.pipe +vnd.dovecot.execute +vnd.dovecot.environment sieve_max_redirects = 30 sieve_max_script_size = 1M sieve_pipe_bin_dir = /home/vmail/sieve sieve_plugins = sieve_imapsieve sieve_extprograms sieve_spamtest_max_header = X-Spamd-Result: default: [[:alnum:]]+ \[-?[[:digit:]]+\.[[:digit:]]+ / (-?[[:digit:]]+\.[[:digit:]]+)\] sieve_spamtest_status_header = X-Spamd-Result: default: [[:alnum:]]+ \[(-?[[:digit:]]+\.[[:digit:]]+) / -?[[:digit:]]+\.[[:digit:]]+\] sieve_spamtest_status_type = score sieve_user_log = /home/vmail/sieve/sieve_error.log sieve_virustest_status_header = X-Virus-Scan: Found to be (.+)\. sieve_virustest_status_type = text sieve_virustest_text_value1 = clean sieve_virustest_text_value5 = infected trash = /usr/local/etc/dovecot/trash.conf welcome_script = welcome %u welcome_wait = yes } postmaster_address = postmaster(a)example.com protocols = imap lmtp sieve sendmail_path = /usr/local/sbin/sendmail service auth-worker { user = vmail } service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0666 user = postfix } unix_listener auth-userdb { group = vmail mode = 0666 user = vmail } } service dict { unix_listener dict { group = vmail mode = 0660 user = vmail } user = root } service imap-login { inet_listener imap { address = 127.0.0.1 port = 143 } inet_listener imaps { address = xxx.xxx.xxx.xxx port = 993 ssl = yes } } service imap { executable = imap } service lmtp { unix_listener /var/spool/postfix/private/dovecot-lmtp { group = postfix mode = 0666 user = postfix } } service managesieve-login { inet_listener sieve { address = 127.0.0.1 port = 4190 } } service quota-status { client_limit = 1 executable = quota-status -p postfix unix_listener /var/spool/postfix/private/dovecot-quota { group = postfix mode = 0660 user = postfix } } service quota-warning { executable = script /usr/local/etc/dovecot/quota-warning.sh unix_listener quota-warning { group = vmail mode = 0660 user = vmail } user = vmail } service welcome { executable = script /usr/local/etc/dovecot/welcome.sh unix_listener welcome { user = vmail } user = vmail } ssl = required ssl_cert = </usr/local/etc/ssl/acme/example.com/fullchain.pem ssl_cipher_list = ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256 ssl_dh = # hidden, use -P to show it ssl_key = # hidden, use -P to show it ssl_min_protocol = TLSv1.2 ssl_prefer_server_ciphers = yes userdb { args = /usr/local/etc/dovecot/dovecot-sql.conf.ext driver = sql } protocol lmtp { info_log_path = /var/log/dovecot/dovecot-lmtp.log log_path = /var/log/dovecot/dovecot-lmtp-errors.log mail_plugins = acl mail_log notify quota trash virtual welcome zlib sieve } protocol lda { mail_plugins = acl mail_log notify quota trash virtual welcome zlib sieve } protocol imap { mail_max_userip_connections = 20 mail_plugins = acl mail_log notify quota trash virtual welcome zlib imap_acl imap_quota imap_sieve imap_zlib last_login fts fts_lucene } protocol sieve { info_log_path = /var/log/dovecot/dovecot-sieve.log log_path = /var/log/dovecot/dovecot-sieve-errors.log }

1 0

domain email autoconfiguration
by David Mehler 01 Apr '18

01 Apr '18

Hello, If anyone has autoconfiguration going with their email domain please email me privately. I'd like to ask you some questions about your setup. What do you use? Thanks. Dave.

3 2

Replication fails with dsync-server(admin@asergis.com): Error: Couldn't create lock /home/admin/.dovecot-sync.lock: No such file or directory
by Vladimir Tiukhtin 31 Mar '18

31 Mar '18

Hello I have configured replication using dsync. It fails with a message Error: Couldn't create lock /home/admin/.dovecot-sync.lock: No such file or directory This directory predictably does not exist - all my users are supposed to be virtual. I can not find an option to switch this off. At the same time if I try manual replication I get segfault error Mar 30 17:17:24 localhost.localdomain dovecot[29063]: dsync-server(admin(a)asergis.com): Error: Couldn't create lock /home/admin/.dovecot-sync.lock: No such file or directory Mar 30 17:17:54 localhost.localdomain dovecot[29063]: dsync-server(admin(a)asergis.com): Error: sieve-storage: couldn't find storage root directory; sieve_dir was left unconfigured and autodetection failed Mar 30 17:17:54 localhost.localdomain dovecot[29063]: dsync-server(admin(a)asergis.com): Fatal: master: service(doveadm): child 29133 killed with signal 11 (core dumps disabled) Mar 30 17:17:54 localhost.localdomain kernel: doveadm-server[29133]: segfault at 58 ip 00007fa0608c9ca1 sp 00007fffbf349480 error 4 in lib10_doveadm_sieve_plugin.so[7fa0608c2000+b000] Mar 30 17:22:25 localhost.localdomain dovecot[29063]: dsync-server(admin(a)asergis.com): Error: Couldn't create lock /home/admin/.dovecot-sync.lock: No such file or directory Mar 30 17:27:58 localhost.localdomain kernel: doveadm[29153]: segfault at 58 ip 00007fc1e65baca1 sp 00007ffd1a78b020 error 4 in lib10_doveadm_sieve_plugin.so[7fc1e65b3000+b000] ** *My OS*: # cat /etc/os-release NAME="CentOS Linux" VERSION="7 (Core)" ID="centos" ID_LIKE="rhel fedora" VERSION_ID="7" PRETTY_NAME="CentOS Linux 7 (Core)" ANSI_COLOR="0;31" CPE_NAME="cpe:/o:centos:centos:7" HOME_URL="https://www.centos.org/" BUG_REPORT_URL="https://bugs.centos.org/" CENTOS_MANTISBT_PROJECT="CentOS-7" CENTOS_MANTISBT_PROJECT_VERSION="7" REDHAT_SUPPORT_PRODUCT="centos" REDHAT_SUPPORT_PRODUCT_VERSION=" *My dovecot:* # dovecot --version 2.2.10 *My config*: auth_cache_size = 12 M auth_cache_ttl = 1 days auth_debug = yes auth_mechanisms = plain login auth_username_chars = abcdefghijklmnopqrstuvwxyz.@ auth_verbose = yes base_dir = /var/run/dovecot/ default_client_limit = 1024 default_process_limit = 128 doveadm_password = mysecretpasswordsharedamongservers first_valid_uid = 1000 instance_name = powergate login_greeting = with a great power comes great responsibility mail_location = mdbox:/var/mail/%d/%n mail_plugins = replication notify mail_privileged_group = mail mbox_write_locks = fcntl namespace inbox { inbox = yes location = mailbox Drafts { auto = no special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { auto = subscribe special_use = \Sent } mailbox "Sent Messages" { auto = no special_use = \Sent } mailbox Spam { auto = create special_use = \Junk } mailbox Trash { auto = no special_use = \Trash } mailbox virtual/All { auto = no special_use = \All } prefix = } passdb { args = /etc/dovecot/dovecot-sql.conf.ext driver = sql } plugin { mail_replica = tcp:192.168.100.11:54321 } protocols = imap lmtp service aggregator { fifo_listener replication-notify-fifo { mode = 0666 user = $default_internal_user } unix_listener replication-notify { mode = 0666 user = $default_internal_user } } service auth { client_limit = 512 inet_listener auth-client { port = 12345 } unix_listener auth-userdb { mode = 0666 } } service doveadm { inet_listener { port = 54321 } } service imap-login { inet_listener imap { port = 0 } inet_listener imaps { port = 993 ssl = yes } process_min_avail = 2 service_count = 1 } service imap { service_count = 1 } service lmtp { unix_listener lmtp { group = postfix mode = 0600 user = postfix } } ssl = required ssl_cert = </etc/pki/dovecot/certs/dovecot.pem ssl_dh_parameters_length = 2048 ssl_key = </etc/pki/dovecot/private/dovecot.pem userdb { args = /etc/dovecot/dovecot-sql.conf.ext driver = sql }

2 1

Issue with a bug with imap-login
by Grant Keller 31 Mar '18

31 Mar '18

Hello, Currently working on migrating our existing directors from 2.1.13 to 2.2.10. In 2.2.10 when issuing the logout command on an unauthenticated connection, the connection is closed before the server sends the BYE line to the client. The new version works as expected with a non-secure connection. I will include the strace output from the imap-login process that shows the connection closing before the message can be sent. # 2.2.10: /etc/dovecot/dovecot.conf # OS: Linux 3.10.0-693.21.1.el7.x86_64 x86_64 CentOS Linux release 7.4.1708 (Core) auth_master_user_separator = * auth_username_format = %Ln auth_verbose = yes default_client_limit = 20000 director_mail_servers = removed director_servers = c.director.imapd.sonic.net d.director.imapd.sonic.net disable_plaintext_auth = no doveadm_port = 1842 login_trusted_networks = removed mbox_write_locks = fcntl passdb { args = /etc/dovecot/master-users driver = passwd-file master = yes pass = yes } passdb { args = proxy=y nopassword=y driver = static } service anvil { client_limit = 40103 } service auth { client_limit = 41704 } service director { fifo_listener login/proxy-notify { mode = 0666 } inet_listener { port = 9321 } unix_listener login/director { mode = 0666 } } service imap-login { executable = imap-login director process_limit = 20000 process_min_avail = 1 } service imap { process_limit = 20480 } service pop3-login { executable = pop3-login director process_limit = 20000 process_min_avail = 32 } ssl_ca = </etc/dovecot/ssl/gd_bundle.crt ssl_cert = </etc/dovecot/ssl/imap.sonic.net.crt ssl_cipher_list = ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA ssl_key = </etc/dovecot/ssl/imap.sonic.net.key ssl_parameters_regenerate = 1 days ssl_protocols = !SSLv2 !SSLv3 syslog_facility = local0 protocol imap { imap_max_line_length = 128 k ssl_ca = </etc/dovecot/ssl/gd_bundle.crt ssl_cert = </etc/dovecot/ssl/imap.sonic.net.crt ssl_key = </etc/dovecot/ssl/imap.sonic.net.key } protocol pop3 { ssl_ca = </etc/dovecot/ssl/pop.sonic.net.ca-bundle ssl_cert = </etc/dovecot/ssl/pop.sonic.net.crt ssl_key = </etc/dovecot/ssl/pop.sonic.net.key } STRACE: 263563 epoll_wait(14<anon_inode:[eventpoll]>, [{EPOLLIN, {u32=2772983280, u64=94500643429872}}], 8, -1) = 1 263563 accept(9<TCP:[0.0.0.0:993]>, {sa_family=AF_INET, sin_port=htons(39552), sin_addr=inet_addr("64.142.18.25")}, [16]) = 18<TCP:[64.142.111.79:993->64.142.18.25:39552]> 263563 fcntl(18<TCP:[64.142.111.79:993->64.142.18.25:39552]>, F_GETFL) = 0x2 (flags O_RDWR) 263563 fcntl(18<TCP:[64.142.111.79:993->64.142.18.25:39552]>, F_SETFL, O_RDWR|O_NONBLOCK) = 0 263563 write(5<pipe:[1445541]>, "\213\5\4\0\223\16\0\0\0\0\0\0", 12) = 12 263563 write(2<pipe:[1445512]>, "\1\010263563 ip=64.142.18.25\n", 25) = 25 263563 getsockname(18<TCP:[64.142.111.79:993->64.142.18.25:39552]>, {sa_family=AF_INET, sin_port=htons(993), sin_addr=inet_addr("64.142.111.79")}, [16]) = 0 263563 socket(AF_LOCAL, SOCK_STREAM, 0) = 19<UNIX:[1458853]> 263563 fcntl(19<UNIX:[1458853]>, F_GETFL) = 0x2 (flags O_RDWR) 263563 fcntl(19<UNIX:[1458853]>, F_SETFL, O_RDWR|O_NONBLOCK) = 0 263563 connect(19<UNIX:[1458853]>, {sa_family=AF_LOCAL, sun_path="ssl-params"}, 110) = 0 263563 fcntl(19<UNIX:[1458853]>, F_GETFL) = 0x802 (flags O_RDWR|O_NONBLOCK) 263563 fcntl(19<UNIX:[1458853]>, F_SETFL, O_RDWR) = 0 263563 read(19<UNIX:[1458853]>, "\0\2\0\0", 4) = 4 263563 read(19<UNIX:[1458853]>, "H\0\0\0", 4) = 4 263563 read(19<UNIX:[1458853]>, "0F\2A\0\246@\4\253O,\222\10\300\237\334\240>\331\270\24K\261w\300\16\0076\230\2039\1"..., 72) = 72 263563 read(19<UNIX:[1458853]>, "\0\4\0\0", 4) = 4 263563 read(19<UNIX:[1458853]>, "\212\0\0\0", 4) = 4 263563 read(19<UNIX:[1458853]>, "0\201\207\2\201\201\0\213:7H\"\251}6d\371}\212\312\276\177p!\10\26\1[\241\265\254\216"..., 138) = 138 263563 read(19<UNIX:[1458853]>, "\0\0\0\0", 4) = 4 263563 read(19<UNIX:[1458853]>, "", 1) = 0 263563 close(19<UNIX:[1458853]>) = 0 263563 socketpair(AF_LOCAL, SOCK_STREAM, 0, [19<UNIX:[1401333->1401334]>, 20<UNIX:[1401334->1401333]>]) = 0 263563 fcntl(19<UNIX:[1401333->1401334]>, F_GETFL) = 0x2 (flags O_RDWR) 263563 fcntl(19<UNIX:[1401333->1401334]>, F_SETFL, O_RDWR|O_NONBLOCK) = 0 263563 fcntl(20<UNIX:[1401334->1401333]>, F_GETFL) = 0x2 (flags O_RDWR) 263563 fcntl(20<UNIX:[1401334->1401333]>, F_SETFL, O_RDWR|O_NONBLOCK) = 0 263563 fcntl(18<TCP:[64.142.111.79:993->64.142.18.25:39552]>, F_GETFL) = 0x802 (flags O_RDWR|O_NONBLOCK) 263563 fcntl(18<TCP:[64.142.111.79:993->64.142.18.25:39552]>, F_SETFL, O_RDWR|O_NONBLOCK) = 0 263563 fstat(20<UNIX:[1401334->1401333]>, {st_mode=S_IFSOCK|0777, st_size=0, ...}) = 0 263563 lseek(20<UNIX:[1401334->1401333]>, 0, SEEK_CUR) = -1 ESPIPE (Illegal seek) 263563 getsockname(20<UNIX:[1401334->1401333]>, {sa_family=AF_LOCAL, NULL}, [2]) = 0 263563 epoll_ctl(14<anon_inode:[eventpoll]>, EPOLL_CTL_ADD, 20<UNIX:[1401334->1401333]>, {EPOLLIN|EPOLLPRI|EPOLLERR|EPOLLHUP, {u32=2773038880, u64=94500643485472}}) = 0 263563 write(20<UNIX:[1401334->1401333]>, "* OK [CAPABILITY IMAP4rev1 LITER"..., 103) = 103 263563 brk(NULL) = 0x55f2a549d000 263563 brk(0x55f2a54c2000) = 0x55f2a54c2000 263563 read(18<TCP:[64.142.111.79:993->64.142.18.25:39552]>, "\26\3\1\0\253\1\0\0\247\3\3", 11) = 11 263563 read(18<TCP:[64.142.111.79:993->64.142.18.25:39552]>, "\205\224\354\263zY\200p\240T\21\377\276\224\251(\343\255x\277\273.\223\304\"<R\222\16\3538s"..., 165) = 165 263563 write(18<TCP:[64.142.111.79:993->64.142.18.25:39552]>, "\26\3\3\0=\2\0\0009\3\0033\336\314\231\205\305\330\206M\361qQ\240\272\225\317^\331Ysc"..., 4096) = 4096 263563 write(18<TCP:[64.142.111.79:993->64.142.18.25:39552]>, "http://ocsp.usertrust.com0\r\6\t*\206H"..., 680) = 680 263563 read(18<TCP:[64.142.111.79:993->64.142.18.25:39552]>, 0x55f2a5498db3, 5) = -1 EAGAIN (Resource temporarily unavailable) 263563 epoll_ctl(14<anon_inode:[eventpoll]>, EPOLL_CTL_ADD, 18<TCP:[64.142.111.79:993->64.142.18.25:39552]>, {EPOLLIN|EPOLLPRI|EPOLLERR|EPOLLHUP, {u32=2773128976, u64=94500643575568}}) = 0 263563 epoll_ctl(14<anon_inode:[eventpoll]>, EPOLL_CTL_DEL, 7<TCP:[0.0.0.0:143]>, 0x7ffcd4f4f270) = 0 263563 epoll_ctl(14<anon_inode:[eventpoll]>, EPOLL_CTL_DEL, 8<TCPv6:[:::143]>, 0x7ffcd4f4f270) = 0 263563 epoll_ctl(14<anon_inode:[eventpoll]>, EPOLL_CTL_DEL, 9<TCP:[0.0.0.0:993]>, 0x7ffcd4f4f270) = 0 263563 epoll_ctl(14<anon_inode:[eventpoll]>, EPOLL_CTL_DEL, 10<TCPv6:[:::993]>, 0x7ffcd4f4f270) = 0 263563 close(7<TCP:[0.0.0.0:143]>) = 0 263563 close(8<TCPv6:[:::143]>) = 0 263563 close(9<TCP:[0.0.0.0:993]>) = 0 263563 close(10<TCPv6:[:::993]>) = 0 263563 epoll_wait(14<anon_inode:[eventpoll]>, [{EPOLLIN, {u32=2773128976, u64=94500643575568}}], 10, 179981) = 1 263563 read(18<TCP:[64.142.111.79:993->64.142.18.25:39552]>, "\26\3\3\0f", 5) = 5 263563 read(18<TCP:[64.142.111.79:993->64.142.18.25:39552]>, "\20\0\0ba\4:tZW\323_&\31\205\274\254\242\246\203\342\324O\350\36\206uX\36@/\r"..., 102) = 102 263563 read(18<TCP:[64.142.111.79:993->64.142.18.25:39552]>, "\24\3\3\0\1", 5) = 5 263563 read(18<TCP:[64.142.111.79:993->64.142.18.25:39552]>, "\1", 1) = 1 263563 read(18<TCP:[64.142.111.79:993->64.142.18.25:39552]>, "\26\3\3\0(", 5) = 5 263563 read(18<TCP:[64.142.111.79:993->64.142.18.25:39552]>, "\224\204\216\367\254\217z\253$S\325\242F\t\256<'vz\3\355\37\fmz\204\261li\307\23\225"..., 40) = 40 263563 write(18<TCP:[64.142.111.79:993->64.142.18.25:39552]>, "\26\3\3\0\252\4\0\0\246\0\0\1,\0\240q/\300C\32\250\251\253I>\177\205A\3\331&\\"..., 226) = 226 263563 epoll_ctl(14<anon_inode:[eventpoll]>, EPOLL_CTL_ADD, 19<UNIX:[1401333->1401334]>, {EPOLLIN|EPOLLPRI|EPOLLERR|EPOLLHUP, {u32=2773039024, u64=94500643485616}}) = 0 263563 read(18<TCP:[64.142.111.79:993->64.142.18.25:39552]>, 0x55f2a5498db3, 5) = -1 EAGAIN (Resource temporarily unavailable) 263563 epoll_wait(14<anon_inode:[eventpoll]>, [{EPOLLIN, {u32=2773039024, u64=94500643485616}}], 10, 179974) = 1 263563 read(19<UNIX:[1401333->1401334]>, "* OK [CAPABILITY IMAP4rev1 LITER"..., 1024) = 103 263563 setsockopt(18<TCP:[64.142.111.79:993->64.142.18.25:39552]>, SOL_TCP, TCP_CORK, [1], 4) = 0 263563 write(18<TCP:[64.142.111.79:993->64.142.18.25:39552]>, "\27\3\3\0\177[\202'O\267-\354\\\301@\225\301\363YeQ\213\341\204!x\347\314\305\327\16\366"..., 132) = 132 263563 read(19<UNIX:[1401333->1401334]>, 0x55f2a5492a54, 1024) = -1 EAGAIN (Resource temporarily unavailable) 263563 setsockopt(18<TCP:[64.142.111.79:993->64.142.18.25:39552]>, SOL_TCP, TCP_CORK, [0], 4) = 0 263563 epoll_wait(14<anon_inode:[eventpoll]>, [{EPOLLIN, {u32=2773128976, u64=94500643575568}}], 10, 179973) = 1 263563 read(18<TCP:[64.142.111.79:993->64.142.18.25:39552]>, "\27\3\3\0!", 5) = 5 263563 read(18<TCP:[64.142.111.79:993->64.142.18.25:39552]>, "\224\204\216\367\254\217z\254\366W\2765\27\22l\277\262\v\217f\323\254i\272\214\364\264#q\254n\323"..., 33) = 33 263563 sendto(19<UNIX:[1401333->1401334]>, "? logout\n", 9, 0, NULL, 0) = 9 263563 read(18<TCP:[64.142.111.79:993->64.142.18.25:39552]>, 0x55f2a5498db3, 5) = -1 EAGAIN (Resource temporarily unavailable) 263563 epoll_wait(14<anon_inode:[eventpoll]>, [{EPOLLIN, {u32=2773038880, u64=94500643485472}}], 10, 177320) = 1 263563 read(20<UNIX:[1401334->1401333]>, "? logout\n", 863) = 9 263563 write(2<pipe:[1445512]>, "\1\010263563 prefix=imap-login: \n", 29) = 29 263563 write(2<pipe:[1445512]>, "\1\002263563 Aborted login (no auth "..., 131) = 131 263563 epoll_ctl(14<anon_inode:[eventpoll]>, EPOLL_CTL_DEL, 18<TCP:[64.142.111.79:993->64.142.18.25:39552]>, 0x7ffcd4f4f2d0) = 0 263563 epoll_ctl(14<anon_inode:[eventpoll]>, EPOLL_CTL_DEL, 19<UNIX:[1401333->1401334]>, 0x7ffcd4f4f2d0) = 0 263563 write(18<TCP:[64.142.111.79:993->64.142.18.25:39552]>, "\25\3\3\0\32[\202'O\267-\354]\221\344\235?\351'\270g\262\2-\31\216V\236\364\314\253", 31) = 31 263563 close(18<TCP:[64.142.111.79:993->64.142.18.25:39552]>) = 0 263563 close(19<UNIX:[1401333->1401334]>) = 0 263563 setsockopt(20<UNIX:[1401334->1401333]>, SOL_TCP, TCP_CORK, [1], 4) = -1 EOPNOTSUPP (Operation not supported) 263563 write(20<UNIX:[1401334->1401333]>, "* BYE Logging out\r\n? OK Logout c"..., 43) = -1 EPIPE (Broken pipe) 263563 --- SIGPIPE {si_signo=SIGPIPE, si_code=SI_USER, si_pid=263563, si_uid=994} --- 263563 epoll_ctl(14<anon_inode:[eventpoll]>, EPOLL_CTL_DEL, 20<UNIX:[1401334->1401333]>, 0x7ffcd4f4f2e0) = 0 263563 close(20<UNIX:[1401334->1401333]>) = 0 263563 epoll_ctl(14<anon_inode:[eventpoll]>, EPOLL_CTL_DEL, 17<UNIX:[1347141->1423948]>, 0x7ffcd4f4f280) = 0 263563 close(17<UNIX:[1347141->1423948]>) = 0 263563 epoll_ctl(14<anon_inode:[eventpoll]>, EPOLL_CTL_DEL, 13<UNIX:[1347139->1250858]>, 0x7ffcd4f4f400) = 0 263563 close(13<UNIX:[1347139->1250858]>) = 0 263563 close(11<UNIX:[1347138->1449033]>) = 0 263563 epoll_ctl(14<anon_inode:[eventpoll]>, EPOLL_CTL_DEL, 6<pipe:[1445521]>, 0x7ffcd4f4f420) = 0 263563 epoll_ctl(14<anon_inode:[eventpoll]>, EPOLL_CTL_DEL, 15<pipe:[1347140]>, 0x7ffcd4f4f3f0) = 0 263563 close(15<pipe:[1347140]>) = 0 263563 close(16<pipe:[1347140]>) = 0 263563 close(14<anon_inode:[eventpoll]>) = 0 263563 exit_group(0) = ? 263563 +++ exited with 0 +++ Grant Keller System Operations grant.keller(a)sonic.com

2 1

debian lintian warn: hardening-no-fortify-functions
by A. Schulze 30 Mar '18

30 Mar '18

Hello, to build + packages dovecot I use the usual Debian tool chain. That includes build with selected GCC options and running lintian. I notice since a long time (read: many earlier versions, up to 2.2.35) this lintian warnings: I: dovecot-core: hardening-no-fortify-functions usr/lib/dovecot/auth N: N: This package provides an ELF binary that lacks the use of fortified libc N: functions. Either there are no potentially unfortified functions called N: by any routines, all unfortified calls have already been fully validated N: at compile-time, or the package was not built with the default Debian N: compiler flags defined by dpkg-buildflags. If built using N: dpkg-buildflags directly, be sure to import CPPFLAGS. N: N: NB: Due to false-positives, Lintian ignores some unprotected functions N: (e.g. memcpy). N: N: Refer to https://wiki.debian.org/Hardening and N: https://bugs.debian.org/673112 for details. N: N: Severity: normal, Certainty: wild-guess N: N: Check: binaries, Type: binary, udeb N: I: dovecot-core: hardening-no-fortify-functions usr/lib/dovecot/config I: dovecot-core: hardening-no-fortify-functions usr/lib/dovecot/director I: dovecot-core: hardening-no-fortify-functions usr/lib/dovecot/gdbhelper I: dovecot-core: hardening-no-fortify-functions usr/lib/dovecot/imap I: dovecot-core: hardening-no-fortify-functions usr/lib/dovecot/libdovecot-login.so.0.0.0 I: dovecot-core: hardening-no-fortify-functions usr/lib/dovecot/libdovecot-storage.so.0.0.0 I: dovecot-core: hardening-no-fortify-functions usr/lib/dovecot/modules/lib10_quota_plugin.so I: dovecot-core: hardening-no-fortify-functions usr/lib/dovecot/modules/lib20_fts_plugin.so I: dovecot-core: hardening-no-fortify-functions usr/lib/dovecot/modules/lib20_replication_plugin.so I: dovecot-core: hardening-no-fortify-functions usr/lib/dovecot/modules/lib99_welcome_plugin.so I: dovecot-core: hardening-no-fortify-functions usr/lib/dovecot/quota-status I: dovecot-core: hardening-no-fortify-functions usr/lib/dovecot/script I: dovecot-core: hardening-no-fortify-functions usr/lib/dovecot/script-login I: dovecot-core: hardening-no-fortify-functions usr/lib/dovecot/xml2text As you may note, not all binaries are affected. doveadm, doveconf or dovecot aren't for example. My (simplyfied) debian/rules: #!/usr/bin/make -f export DEB_BUILD_MAINT_OPTIONS = hardening=+all DPKG_EXPORT_BUILDFLAGS = 1 include /usr/share/dpkg/buildflags.mk include /usr/share/cdbs/1/rules/debhelper.mk include /usr/share/cdbs/1/class/autotools.mk DEB_DH_STRIP_ARGS = --dbg-package=dovecot-core-dbg This result in that call to configure: CFLAGS="-g -O2 -fdebug-prefix-map=/<<PKGBUILDDIR>>=. -fstack-protector-strong -Wformat -Werror=format-security" CXXFLAGS="-g -O2 -fdebug-prefix-map=/<<PKGBUILDDIR>>=. -fstack-protector-strong -Wformat -Werror=format-security" CPPFLAGS="-Wdate-time -D_FORTIFY_SOURCE=2" LDFLAGS="-Wl,-z,relro -Wl,-z,now" /<<PKGBUILDDIR>>/./configure --build=x86_64-linux-gnu --prefix=/usr --includedir="\${prefix}/include" --mandir="\${prefix}/share/man" --infodir="\${prefix}/share/info" --sysconfdir=/etc --localstatedir=/var --libexecdir="\${prefix}/lib/dovecot" --srcdir=. --disable-maintainer-mode --disable-dependency-tracking --disable-silent-rules --libexecdir=/usr/lib --localstatedir=/var --with-statedir=/var/lib/dovecot --with-moduledir=/usr/lib/dovecot/modules --without-docs I may provide a full build log if that would be helpful. To me that looks like not all binaries are build with same CFLAGS / CXXFLAGS / CPPFLAGS / LDFLAGS Andreas

2 2

mail_max_userip_connections from userdb query
by Arkadiusz Miśkiewicz 30 Mar '18

30 Mar '18

Hello. Is still true that mail_max_userip_connections cannot be overriden in userdb query? Want lower global and raise for some logins. https://www.dovecot.org/pipermail/dovecot/2017-July/108520.html -- Arkadiusz Miśkiewicz, arekm / ( maven.pl | pld-linux.org )

2 1