- dovecot - dovecot.org

dovecot sometimes sends non-default SSL cert if IMAP client won't send SNI
by Martin Johannes Dauser 24 Jul '18

24 Jul '18

Hi, I recognised some funny behaviour on my server. IMAP clients which won't send an Server Name Indication (SNI) sometimes get the wrong certificate. I would expect that those clients always get the default certificate (of my new domain), instead in about 20 to 50% of connections the certificate of my old domain will be presented. (sample rate was 3 times 30 connections) Clients sending SNI always get the right certificate. A user informed me that offlineIMAP complains 'CA Cert verifying failed: no matching domain name found in certificate' So at least offlineIMAP 7.0.12 from Debain stretch won't send SNI, there is a newer version upstream though. I myself checked the server's behaviour with openssl: $ openssl s_client -showcerts -connect IP-address:993 and $ openssl s_client -showcerts -connect IP-address:993 -servername imap.domain I'm totally clueless about how come. Best regards Martin Johannes Dauser # 2.2.10: /etc/dovecot/dovecot.conf # OS: Linux 3.10.0-862.el7.x86_64 x86_64 Red Hat Enterprise Linux Server release 7.5 (Maipo) ... service imap-login { inet_listener imap { address = 127.0.0.1 port = 143 } inet_listener imaps { port = 993 ssl = yes } process_min_avail = 8 service_count = 0 } ... ssl = required # set default cert ssl_cert = </etc/pki/dovecot/certs/mail_new_domain-chained.cert ssl_cipher_list = DHE-RSA-AES256-SHA:DHE-RSA-AES128- SHA:ALL:!LOW:!SSLv2:!EXP:!aNULL:!MD5:!RC4:!DES:!3DES:!TLSv1 ssl_key = </etc/pki/dovecot/private/mail_new_domain.key ssl_protocols = !SSLv2 !SSLv3 ... # set alternativ cert for old domain local_name mail.old.domain { ssl_cert = </etc/pki/dovecot/certs/mail_old_domain-chained.cert ssl_key = </etc/pki/dovecot/private/mail_old_domain.key } local_name imap.old.domain { ssl_cert = </etc/pki/dovecot/certs/mail_old_domain-chained.cert ssl_key = </etc/pki/dovecot/private/mail_old_domain.key } local_name pop.old.domain { ssl_cert = </etc/pki/dovecot/certs/mail_old_domain-chained.cert ssl_key = </etc/pki/dovecot/private/mail_old_domain.key } # set explicit cert for new domain local_name mail.new.domain { ssl_cert = </etc/pki/dovecot/certs/mail_new_domain-chained.cert ssl_key = </etc/pki/dovecot/private/mail_new_doman.key } local_name imap.new.domain { ssl_cert = </etc/pki/dovecot/certs/mail_new_domain-chained.cert ssl_key = </etc/pki/dovecot/private/mail_new_domain.key } local_name pop.new.domain { ssl_cert = </etc/pki/dovecot/certs/mail_new_domain-chained.cert ssl_key = </etc/pki/dovecot/private/mail_new_domain.key }

2 3

Namespace question
by J Doe 24 Jul '18

24 Jul '18

Hi, I have a question about the “inbox” namespace, as mentioned in: conf.d/10-mail.conf. I have written my dovecot.conf file from scratch and do not include: conf.d/10-mail.conf. I have not defined the “inbox” namespace and so I am assuming that one is created by default. When I list the dovecot defaults via “sudo doveconf -d”, I notice that no “namespace inbox” entry exists. If “namespace inbox” is not specified, is one still created by default ? Thanks, - J

2 1

anvil in 2.3.2.1?
by kevin martin 23 Jul '18

23 Jul '18

Has anvil gone away in 2.3.2.1? I ask only because I don't find an example of anvil in the conf.d files anymore and I'm migrating from 2.2.10 version to 2.3.2.1. Thanks.

1 0

doveadm expunge didn't clear Trash mailbox
by Sophie Loewenthal 23 Jul '18

23 Jul '18

Hi, Why did my 'doveadm expunge' command not clear the Trash out of a mailbox? The oldest messages was put into the Trash on the 26th June 2018 as shown in the file timestamp. -rw------- 1 vmail mail 33056 Jun 26 16:46 1530031582.M768773P18242.mx10,S=33056,W=33510:2,RS # doveadm -D expunge -u testuser(a)example.org mailbox Trash savedbefore 2d Debug: Loading modules from directory: /usr/lib/dovecot/modules/doveadm Debug: Skipping module doveadm_acl_plugin, because dlopen() failed: /usr/lib/dovecot/modules/doveadm/lib10_doveadm_acl_plugin.so: undefined symbol: acl_lookup_dict_iterate_visible_next (this is usually intentional, so just ignore this message) Debug: Skipping module doveadm_expire_plugin, because dlopen() failed: /usr/lib/dovecot/modules/doveadm/lib10_doveadm_expire_plugin.so: undefined symbol: expire_set_deinit (this is usually intentional, so just ignore this message) Debug: Skipping module doveadm_quota_plugin, because dlopen() failed: /usr/lib/dovecot/modules/doveadm/lib10_doveadm_quota_plugin.so: undefined symbol: quota_user_module (this is usually intentional, so just ignore this message) Debug: Module loaded: /usr/lib/dovecot/modules/doveadm/lib10_doveadm_sieve_plugin.so Debug: Skipping module doveadm_fts_lucene_plugin, because dlopen() failed: /usr/lib/dovecot/modules/doveadm/lib20_doveadm_fts_lucene_plugin.so: undefined symbol: lucene_index_iter_deinit (this is usually intentional, so just ignore this message) Debug: Skipping module doveadm_fts_plugin, because dlopen() failed: /usr/lib/dovecot/modules/doveadm/lib20_doveadm_fts_plugin.so: undefined symbol: fts_user_get_language_list (this is usually intentional, so just ignore this message) Debug: Skipping module doveadm_mail_crypt_plugin, because dlopen() failed: /usr/lib/dovecot/modules/doveadm/libdoveadm_mail_crypt_plugin.so: undefined symbol: mail_crypt_box_get_pvt_digests (this is usually intentional, so just ignore this message) doveadm(testuser(a)example.org): Debug: Added userdb setting: mail=maildir:/var/vmail/example.org/testuser@example.org doveadm(testuser(a)example.org): Debug: Added userdb setting: plugin/quota=dirsize:storage= doveadm(testuser(a)example.org): Debug: Effective uid=150, gid=8, home=/var/vmail/example.org/testuser@example.org doveadm(testuser(a)example.org): Debug: Namespace inbox: type=private, prefix=, sep=, inbox=yes, hidden=no, list=yes, subscriptions=yes location=maildir:/var/vmail/example.org/testuser@example.org doveadm(testuser(a)example.org): Debug: maildir++: root=/var/vmail/example.org/testuser@example.org, index=, indexpvt=, control=, inbox=/var/vmail/example.org/testuser@example.org, alt= Sophie

3 6

Dovecot pop3d and imapd problem
by John Paul Iglesia 23 Jul '18

23 Jul '18

Hi, My dovecot version : 2.2.22 Recently, i had issues on dovecot. All packages of dovecot were installed on my system then suddenly when I checked yesterday the packages for dovecot-pop3d and dovecot-imapd were no longer on the list of app installed. Because of this dovecot service stop running. I checked the apt history log, term log and even dpkg log, there were no information about removing the packages. It just shown on my apt list the packages were not longer there. I had to reinstalled these 2 packages just to make dovecot run and for me to be able to receive and send messages. What do you think is the problem, is it dovecot bug? Please advise. Thanks, paul.tcbc

3 3

dovecot lmtp and drop privileges to specific user
by Christos Chatzaras 23 Jul '18

23 Jul '18

Is it possible when dovecot LMTP to drop privileges to a specific user instead of the e-mail account user?

2 1

Stopping login via "nologin" parameter
by J Doe 23 Jul '18

23 Jul '18

Hello, I have a basic e-mail server with Postfix 3.1 and Dovecot 2.2.22. I am using a passwd-file for both userdb and passdb: /etc/dovecot/dovecot.conf userdb { driver = passwd-file args = /etc/dovecot/passwd } passdb { driver = passwd-file args = /etc/dovecot/passwd } } In the passwd file, I want to have user account names for SMTP SASL AUTH and IMAP that are NOT e-mail addresses. For example, employee one of ABC corp would have a SMTP SASL AUTH/IMAP account name in the form: abc_company_employeeid (for example: abc_company_03284). The idea behind that is that I do not want someone outside of the company to be able to know the first half of the username and password pair just because they have an employee's e-mail address. For the e-mail address I specify something like: bob(a)abc.com however I never want someone to be able to login via their e-mail address. Originally, I specified the password field as empty, with the understanding being that the default encryption of a password is {CRYPT}. Since crypt() cannot output a null string, this meant that there was never a valid password. So passwd looked like this: /etc/dovecot/passwd # SMTP SASL AUTH and IMAP accounts abc_company_03284:::::::userdb_mail=maildir:/var/mail/vhosts/abc.com/abc_co… # IMAP bob@abc.com:vmail:vmail::/home/vmail/bob::userdb_maill=maildir:/var/mail/vhosts/abc.com/abc_company_03284 I tested SMTP SASL AUTH and IMAP via the openssl s_client and can confirm that I can login and send e-mail as well as retrieve mail only via the: abc_company_03284 account, but because an empty password field isn’t mentioned on the Dovecot wiki, I was wondering if I should add “nologin” to explicitly make it impossible for: bob(a)abc.com. “nologin” was mentioned to me in a previous e-mail to this list. So passwd would now look like this: /etc/dovecot/passwd # SMTP SASL AUTH and IMAP accounts abc_company_03284:::::::userdb_mail=maildir:/var/mail/vhosts/abc.com/abc_co… # IMAP bob@abc.com:vmail:vmail::/home/vmail/bob::userdb_mail=maildir:/var/mail/vhosts/abc.com/abc_company_03284 nologin I restarted Dovecot and tested this with openssl s_client for SMTP SASL AUTH and IMAP, but just wanted to make sure that this STOPS ANY LOGINS via the e-mail address: bob(a)abc.com ? Thanks, - J

1 1

ot: LE server conf setup/ iPhone 'expired cert' message
by Voytek Eymont 22 Jul '18

22 Jul '18

I've installed LE certs on my Dovecot a while back, and, it has been working OK since, but, today, an iPhone user said he can't get emails as iphone says 'cert is expired', searching around, I see some other iPhone similar issues reported, do I have my conf correct, I have; # cat dovecot.conf | grep ssl ssl = required verbose_ssl = no ssl_cert = </etc/letsencrypt/live/fqn.myserver/fullchain.pem ssl_key = </etc/letsencrypt/live/fqn.myserver/privkey.pem is fullchain.pem and privkey.pem is what I should be using ? anythought how to force an iphone to reload cert ? actual cert was renewed 15/7, old/previous one expired earlier today ls /etc/letsencrypt/live/fqn.myserver/ cert.pem chain.pem fullchain.pem privkey.pem (if I open mailserver host in browser, padlock shows current/valid cert) -- Voytek

6 8

Dbox lost messages
by Fineware PM 20 Jul '18

20 Jul '18

Hello, I use dovecot with dbox storage system. Today I receive 2 mail (I see that in the maillog ) but I don't find in INBOX using my IMAP client. I look in the files m.* and I find the message that I receive. But I cannot find it in any IMAP folder. I try to run "doveadm force-resync -u user inbox" but nothing change. I export all email using the command "doveadm backup -u user mbox:/tmp/mail:INDEX:/tmp/imap:LAYOUT:maildir++ and in the mbox file for inbox I found the 2 mails arrived. How I can understand why I cannot see the messages ? or how I can recover it ? Bet regards.

2 5

OT: 'lost' emails
by Voytek 20 Jul '18

20 Jul '18

I suspect this is mail client issue, but looking for any suggestions: user with Thunderbird says " I'm losing emails, mail is not in inbox, but, when I search, that email shows in search result, but, I can't open the email body" i don't fully understand what he was trying to say, and, won't be able to look at his PC till Monday. Looking at inbox's 'cur' directory, I can see the'missing' email amongst the other 2000 emails in 'cur' Is there any indexing I should do on the user's email folder, how? or, is this purely Thunderbird issue, and, I need to re index Thunderbird? V -- Sent from my Android device with K-9 Mail. Please excuse my brevity.

3 2