- dovecot - dovecot.org

ssl_dh required, even though DH is disabled.
by Eric Toombs 16 Jul '18

16 Jul '18

Here's my config: # 2.3.2 (582970113): /etc/dovecot/dovecot.conf # OS: Linux 4.17.5-1-ARCH x86_64 Arch Linux # Hostname: vault passdb { driver = pam } protocols = imap service imap-login { inet_listener imap { port = 0 } } ssl = required ssl_cert = </etc/letsencrypt/live/myhostname.com/fullchain.pem ssl_cipher_list = ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-SHA:ECDHE-ECDSA-AES256-SHA:ECDHE-ECDSA-AES128-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-SHA:ECDHE-RSA-AES256-SHA:ECDHE-RSA-AES128-SHA256:ECDHE-RSA-AES256-SHA384 ssl_key = # hidden, use -P to show it ssl_min_protocol = TLSv1.2 My filesystem is ext4. Even though I use ssl_cipher_list to forbid DH, dovecot still doesn't work unless I provide an ssl_dh, delivering the following error: Jul 14 21:48:08 vault dovecot[8349]: imap-login: Error: Failed to initialize SSL server context: Couldn't parse DH parameters: error:0906D06C:PEM routines:PEM_read_bio:no start line: Expecting: DH PARAMETERS: user=<>, rip=10.0.0.1, lip=10.0.0.2, session=<4sGi5/9w3pwKAAAB> While providing an ssl_dh is only a minor annoyance, it would be nice if I didn't have to.

2 1

Re: Letsencrypt certificate for repo.dovecot.org expired May 14th..
by DurgaPrasad - DatasoftComnet 15 Jul '18

15 Jul '18

:) Rgds/DP 9849111010 Sent from my iPhone. Pls excuse brevity and typos if any. > On 15-Jul-2018, at 5:00 PM, Aki Tuomi <aki.tuomi(a)dovecot.fi> wrote: > > certbot clearly hates me > > --- > Aki Tuomi > Dovecot oy > > -------- Original message -------- > From: "B. Reino" <reinob(a)bbmk.org> > Date: 15/07/2018 11:49 (GMT+02:00) > To: Aki Tuomi <aki.tuomi(a)dovecot.fi> > Cc: Dovecot Mailing List <dovecot(a)dovecot.org> > Subject: Re: Letsencrypt certificate for repo.dovecot.org expired May 14th.. > > Dear Aki, > > I think the renewal failed again. The SSL certificate expired Saturday, > 14 July 2018. > > This affects (at least) the repo.dovecot.org website and debian > repository. > > Thanks, > Bernardo. > > On 2018-05-15 08:15, Aki Tuomi wrote: > > On 15.05.2018 09:14, B. Reino wrote: > >> Dear all, > >> > >> Just in case you've missed it, the certificate for repo.dovecot.org > >> just expired yesterday. > >> > >> This causes errors in e.g. apt-get update. > >> > >> Thanks in advance for fixing it, > >> > >> -- > >> B. Reino > > > > Seems something went wrong during deployment, thanks. It's fixed now. > > > > Aki

1 0

Connection closed (IDLE running for 0.001 + waiting input for
by Sophie Loewenthal 15 Jul '18

15 Jul '18

Hi, Just noticed an Android email client called K9 Mail is producing these entries in a server's dovecot log: Jul 11 21:03:28 mx1 dovecot: imap(me(a)example.org): Connection closed (IDLE running for 0.001 + waiting input for 1728.597 secs, 2 B in + 10+0 B out, state=wait-input) in=353 out=2154 Jul 11 21:03:31 mx1 dovecot: imap(me(a)example.org): Connection closed (IDLE running for 0.001 + waiting input for 1731.069 secs, 2 B in + 10+0 B out, state=wait-input) in=389 out=1910 I cannot find out what this means after googling. Any ideas? Best wishes, Sophie

2 1

Sendmail Dovecot Trouble
by John Rowan 14 Jul '18

14 Jul '18

I've been struggling trying to get Thunderbird to read e-mail off a CentOS 7 server. Sendmail writes mail in /var/spool/mail I've configured dovecot to try to read from there using Thunderbird (POP3/SMTP). The firewall allows ports 25/110. I verified I have mail in /var/spool/mail but Thunderbird is unable to retrieve that mail. I've googled sendmail / dovecot config, I've looked a the wiki but I just can't figure this out. Please don't suggest using postfix, I just want to get sendmail / dovecot working. [@mail conf.d]# dovecot --version 2.2.10 [root@mail conf.d]# dovecot -n # 2.2.10: /etc/dovecot/dovecot.conf # OS: Linux 3.10.0-327.36.3.el7.i686 i686 CentOS Linux release 7.2.1511 (AltArch) auth_mechanisms = plain login disable_plaintext_auth = no mail_location = mbox:~/mail:INBOX=/var/mail/%u mbox_write_locks = fcntl namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } passdb { driver = pam } protocols = ssl_cert = </etc/pki/dovecot/certs/dovecot.pem ssl_key = </etc/pki/dovecot/private/dovecot.pem userdb { driver = passwd } --- This email has been checked for viruses by Avast antivirus software. https://www.avast.com/antivirus

3 2

Re: Sendmail Dovecot Trouble
by Alexander Dalloz 14 Jul '18

14 Jul '18

Am 13.07.2018 um 17:44 schrieb Aki Tuomi: > Should your INBOX path be/var/spool/mail/%u then? /var/spool/mail is the same as /var/mail on CentOS 7 as /var/mail is a symlink. Alexander

1 0

mdbox+ ALT storage + lazyexpunge
by Matt Bryant 14 Jul '18

14 Jul '18

All, Anyone know that if you setup lazyexpounge with mdbox that as ALT storage defined, whether the mail location for namespace used by lazyexpunge also need the ALT= specified ?? rgds Matt

1 1

mdbox + alt storage + purge = wtf ...
by Matt Bryant 14 Jul '18

14 Jul '18

All, Is there a bug in doveadm purge ? Configured alt storage and move messages in inbox to the alternate path all well and good. However, after deleting some messages and running a purge on the mailbox found that all messages got recopied over to primary location. I guess this maybe because its re-writing the file and ditching the purged mail .. but shouldnt it keep a track that they were located on alt storage path ?? rgds Matt

1 0

Question about verbose_proctitle
by J Doe 14 Jul '18

14 Jul '18

Hello, I have a question relating to the detail that the verbose_proctitle parameter enables for ps. I have TLS configured for IMAP as follows: /etc/dovecot/dovecot.conf ssl = required ssl_cert = </path/to/cert.pem> ssl_key = </path/to/key.pem> protocols = imap lmtp service imap-login { # Disable insecure IMAP over TCP 143 inet_listener imap { port=0 } } . . . verbose_proctitle = yes If I have a single MUA connect (Apple Mail in this case), I see: $ ps aux | grep -i dovevot dovenull 5552 0.0 0.1 18820 5444 ? S 18:53 0:00 dovecot/imap-login [1 connections (1 TLS)] vmail 5553 0.3 0.1 13612 4304 ? S 18:53 0:00 dovecot/imap [user(a)example.com 1.2.3.4 IDLE] The first part makes sense to me - imap-login is showing the user being connected via imap-login and with TLS. The second part, however, shows the IMAP session with the username, IP address and IMAP command (IDLE), but it does not state TLS. Does this mean that I have logins for IMAP connections protected by TLS but the actual IMAP traffic (mail contents, etc.), is *NOT* configured to use TLS ? That is to say, IMAP traffic is flowing over port 993 without TLS ? From the wiki [1] it appears to state that I only have to configure TLS settings for IMAP if the IMAP protocol is being secured via a *DIFFERENT* TLS certificate. Is this correct ? Thanks, - J Sources: [1] https://wiki2.dovecot.org/SSL/DovecotConfiguration

2 3

Whitelist file for LDAP authentication
by whpang 13 Jul '18

13 Jul '18

Hi, The dovecot version is 2.2.33.2 and we are using LDAP to do the authentication for SMTP service. We have the following configuration in auth-ldap.conf.ext to deny some users for LDAP auth. passdb { args = /etc/dovecot/deny.smtp driver = passwd-file deny = yes } passdb { args = /etc/dovecot/dovecot-ldap.conf driver = ldap } And now we want to change the mechanism and only users in the list can send to LDAP auth and deny all others: passdb { args = /etc/dovecot/allow.smtp driver = passwd-file deny = no result_failure = return-fail result_internalfail = return-fail result_success = continue-fail } passdb { # Path for LDAP configuration file, see example-config/dovecot-ldap.conf.ext args = /etc/dovecot/dovecot-ldap.conf driver = ldap } Since we do not have the users’ password in the plain text file “allow.smtp”, the authentication process will fail and exit in the first passdb. Anyone can help to advice how to configure dovecot to have a whitelist for user LDAP authentication? Thank you very much. Best regards, William Pang Academic Computing and Technology Services Section Information and Communication Technology Office University of Macau Tel: 8822 8407

3 2

Pigeonhole extdata repo?
by tai74＠vfemail.net 13 Jul '18

13 Jul '18

Pigeonhole download page has links for extdata plugin up to v0.4 but nothing more and no link to the master repository https://pigeonhole.dovecot.org/download.html I want to use with dovecot 2.3.2rc1 but v0.4 won't compile with it. Thanks for helping ------------------------------------------------- ONLY AT VFEmail! - Use our Metadata Mitigator to keep your email out of the NSA's hands! $24.95 ONETIME Lifetime accounts with Privacy Features! 15GB disk! No bandwidth quotas! Commercial and Bulk Mail Options!

3 4