- dovecot - dovecot.org

Ubuntu Auth Issues with new repository code..
by Howard Leadmon 28 Dec '17

28 Dec '17

Saw the new repository notification, and figured what the heck I would try letting it upgrade me from the current v2.2.22 release that apparently is in the Ubuntu 16.04 packages, to the new repository release of v2.3.0. I followed the info on repo.dovecot.org, and first it started bitching about lmtp (dovecot: master: Fatal: service(lmtp) access(/usr/lib/dovecot/lmtp) failed: No such file or directory), so I went back and installed the dovecot-lmtpd package and that seemed to fix that issue. Just FYI, I had dovecot-core, dovecot-imapd, and dovecot-pop3d installed on the system. OK, so now it started up, said it was 2.3.0 and I thought all was good, but now all authentication is failing. I turned on some of the logging debugging, and am seeing the below: dovecot: auth-worker(19578): Debug: pam(toss1,127.0.0.1,<IR3NJlZhFtZ/AAAB>): lookup service=dovecot dovecot: auth-worker(19578): Debug: pam(toss1,127.0.0.1,<IR3NJlZhFtZ/AAAB>): #1/1 style=1 msg=Password: dovecot: auth-worker(19578): pam(toss1,127.0.0.1,<IR3NJlZhFtZ/AAAB>): pam_authenticate() failed: System error dovecot: auth: Debug: client passdb out: FAIL#0111#011user=toss1 dovecot: imap-login: Aborted login (auth failed, 1 attempts in 3 secs): user=<toss1>, method=PLAIN, rip=127.0.0.1, lip=127.0.1.1, session=<IR3NJlZhFtZ/AAAB> I took and compared my auth files like 10-auth.conf, and auth-system.conf.ext, and they are identical between the two versions, even though they were overwritten as part of the upgrade. If I just uninstall the 2.3.0 release, and install 2.2.22 back on the server, it all just starts working again. So for now I am back on 2.2, but was willing to give 2.3 a run if I can get it going. Any ideas as to what to look at to get this working, would be great. As stated above, this is Ubuntu Server 16.04.03, and I am also running Postfix and amavis-new, but don't think they should really impact me using dovecot for email over POP3 or IMAP.. --- Howard Leadmon PBW Communications, LLC http://www.pbwcomm.com

5 6

2.3.0 upgrade from 2.2.x
by Fabian A. Santiago 28 Dec '17

28 Dec '17

Question; So after updating to 2.3.0 and following the recommended warnings / changes from running doveconf -n and then doing that same command > "a new conf file", and then renaming the conf files and restarting dovecot, I should be good to go with my old config updated to the new config spec? Just confirming. Thanks. What I mean is doing the -n to a new file hasn't changed or removed anything from my old config? Unless it was a changed or obsoleted option and in that case it would have warned me anyway, correct? -- Thanks, Fabian S. OpenPGP: 3C3FA072ACCB7AC5DB0F723455502B0EEB9070FC

2 2

Question about imap (expunge response)
by kjonca＠o2.pl 28 Dec '17

28 Dec '17

(This is not neccesarily about dovecot, but rather IMAP protocol) At https://drive.google.com/open?id=1j3oa5jYeSdiPbgaihq02K-u_vHbZLJZQ is fetchmail log from my sessinon with polish email provider "Wirtualna Polska" As you can se fetchmail logged "* 1 EXPUNGE" as a response to "STORE" command. According to https://tools.ietf.org/html/rfc3501#section-7.4.1 EXPUNGE must not be sent as response to STORE command. Am I right that their imap server is erroneous or am I missing something? KJ -- http://stopstopnop.pl/stop_stopnop.pl_o_nas.html Lonely men seek companionship. Lonely women sit at home and wait. They never meet.

2 2

Re: Renewing certificates
by Joseph Tam 28 Dec '17

28 Dec '17

Kenneth Porter <shiva(a)sewingwitch.com> writes: > Thanks. Some digging indicates that this is equivalent to doveadm reload. > Both paths ultimately send a SIGHUP to the server which initiates a full > reload of the configuration. > > I'll be combining this with a restart of sendmail. Alas, I don't see a way > to get it to reload its configuration. Should be the same way: send a SIGHUP signal to the parent process. http://etutorials.org/Server+Administration/Sendmail/Part+II+Administration… I'm not sure whether this will cause the sendmail worker processes to dump their cients, but if it did, SMTP is fault tolerant enough that delivery should be retried later. Joseph Tam <jtam.home(a)gmail.com>

1 0

Renewing certificates
by Kenneth Porter 27 Dec '17

27 Dec '17

I'm setting up certbot/letsencrypt to provide a certificate for dovecot and sendmail. Is it necessary to restart dovecot to load the new certificate, as shown in most examples I find in blogs? That seems rude to established connections. When does dovecot read the cert and key files? Once at startup or each time a connection requests SSL? Is there a preferred locking protocol when changing the two files to keep dovecot from reading one while the other is being replaced and getting a mismatched pair?

3 3

zlib plugin aborts without zlib_save
by Adam Weinberger 26 Dec '17

26 Dec '17

This is in follow-up to https://dovecot.org/pipermail/dovecot/2017-December/110443.html I had mail_plugins = "zlib", but zlib_save wasn't set (my mailboxes were not compressed). It seems that when the zlib plugin is enabled, but zlib_save isn't set, the zlib plugin aborts on a regular basis---on a single-user system, I was seeing it about 150 times a day. Panic: file ostream-zlib.c: line 36 (o_stream_zlib_close): assertion failed: (zstream->ostream.finished || zstream->ostream.ostream.stream_errno != 0) Fatal: master: service(imap): child 80128 killed with signal 6 (core not dumped - set service imap { drop_priv_before_exec=yes }) Removing the (unused) zlib plugin made the errors disappear, at least. # Adam -- Adam Weinberger adamw(a)adamw.org http://www.adamw.org

1 0

Sieve 0.5.0/Dovecot 2.3.0
by Larry Rosenman 26 Dec '17

26 Dec '17

Using 2.3.0/0.5 and the below scripts/config, why doesn’t a mail addressed to ler_freebsd(a)lerctr.org get the FreeBSD flag? .dovecot.sieve points to master.sieve. Scripts: http://www.lerctr.org/~ler/sieve/ doveconf -n: thebighonker.lerctr.org /home/ler/sieve $ doveconf -n # 2.3.0 (c8b89eb): /usr/local/etc/dovecot/dovecot.conf # Pigeonhole version 0.5.0 (d68c23a1) # OS: FreeBSD 11.1-STABLE amd64 auth_mechanisms = plain login auth_realms = lerctr.org thebighonker.lerctr.org tbh.lerctr.org thejonesonair.com thejonesonair.net default_vsz_limit = 1 G deliver_log_format = msgid=%m: %$ (subject=%s from=%f size=%w) doveadm_password = # hidden, use -P to show it first_valid_gid = 0 first_valid_uid = 0 lda_mailbox_autocreate = yes listen = 192.147.25.65, :: lmtp_save_to_detail_mailbox = yes login_access_sockets = tcpwrap mail_attribute_dict = file:%h/mail/.imap/dovecot-mail-attributes mail_location = mbox:~/mail:INBOX=~/mail/INBOX mail_log_prefix = "%s(%u/%p): " mail_plugins = " fts fts_solr notify virtual" mail_privileged_group = mail mail_server_admin = mailto:ler@lerctr.org mail_server_comment = LERCTR Mail Server managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext vacation-seconds editheader mboxmetadata servermetadata imapsieve vnd.dovecot.imapsieve namespace archive { hidden = no list = no location = mbox:~/MAIL-ARCHIVE prefix = ARCHIVE/ separator = / } namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox INBOX { auto = create } mailbox SENT { special_use = \Sent } mailbox SPAM { special_use = \Junk } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } mailbox virtual/Flagged { special_use = \Flagged } mailbox virtual/all { special_use = \All } prefix = separator = / } namespace virtual { hidden = no list = yes location = virtual:~/MAIL-VIRTUAL:INDEX=MEMORY prefix = Virtual/ separator = / } passdb { args = /usr/local/etc/dovecot/dovecot-sql.conf.ext driver = sql } passdb { args = user=%Ln noauthenticate driver = static skip = authenticated } passdb { args = failure_show_msg=yes session=yes max_requests=20 driver = pam skip = authenticated } plugin { fts = solr fts_autoindex = yes fts_solr = url=http://thebighonker.lerctr.org:8983/solr/dovecot/ fts_tika = http://localhost:9998/tika/ imapsieve_mailbox1_before = file:/usr/local/share/dovecot-pigeonhole/sieve/report-spam.sieve imapsieve_mailbox1_causes = COPY imapsieve_mailbox1_name = SPAM imapsieve_mailbox2_before = file:/usr/local/share/dovecot-pigeonhole/sieve/report-ham.sieve imapsieve_mailbox2_causes = COPY imapsieve_mailbox2_from = SPAM imapsieve_mailbox2_name = * imapsieve_url = sieve://thebighonker.lerctr.org mail_log_events = delete undelete expunge copy mailbox_delete mailbox_rename flag_change append mail_log_fields = uid box msgid size from subject vsize flags sieve = ~/.dovecot.sieve sieve_dir = ~/sieve sieve_execute_bin_dir = /usr/local/share/dovecot-pigeonhole/sieve sieve_extensions = +editheader +vacation-seconds +mboxmetadata +servermetadata sieve_global_extensions = +vnd.dovecot.pipe +vnd.dovecot.execute sieve_pipe_bin_dir = /usr/local/share/dovecot-pigeonhole/sieve sieve_plugins = sieve_imapsieve sieve_extprograms } protocols = imap pop3 lmtp sieve recipient_delimiter = +-_ service anvil { unix_listener anvil { group = mail mode = 0660 } } service auth { unix_listener auth-client { mode = 0666 } unix_listener auth-master { mode = 0666 } } service doveadm { inet_listener http { port = 8080 ssl = yes } } service indexer-worker { drop_priv_before_exec = yes } service lmtp { inet_listener lmtp { address = 127.0.0.1 port = 24 } } service managesieve-login { inet_listener sieve { port = 4190 } inet_listener sieve_deprecated { port = 2000 } } service stats { unix_listener stats-reader { group = mail mode = 0660 user = } unix_listener stats-writer { group = mail mode = 0660 user = } } service tcpwrap { unix_listener login/tcpwrap { group = $default_login_user mode = 0600 user = $default_login_user } } ssl_cert = </home/ler/letsencrypt-home/lerctr.org/fullchain.cer ssl_cipher_list = EECDH+ECDSA+AESGCM:EECDH+aRSA+AESGCM:EECDH+ECDSA+SHA384:EECDH+ECDSA+SHA256:EECDH+aRSA+SHA384:EECDH+aRSA+SHA256:EECDH+AESGCM:EECDH:EDH+AESGCM:EDH+aRSA:HIGH:!MEDIUM:!LOW:!aNULL:!eNULL:!LOW:!RC4:!MD5:!EXP:!PSK:!SRP:!DSS ssl_dh = # hidden, use -P to show it ssl_key = # hidden, use -P to show it userdb { args = /usr/local/etc/dovecot/dovecot-sql.conf.ext driver = sql } userdb { args = username_format=%Ln /etc/passwd driver = passwd-file } verbose_proctitle = yes protocol lmtp { mail_plugins = " fts fts_solr notify virtual sieve mail_log" } protocol lda { mail_plugins = " fts fts_solr notify virtual sieve mail_log" } protocol pop3 { mail_plugins = " fts fts_solr notify virtual mail_log" } protocol !doveadm { mail_plugins = " fts fts_solr notify virtual mail_log" } protocol imap { imap_client_workarounds = tb-extra-mailbox-sep tb-lsub-flags imap_logout_format = in=%i out=%o fhc=%{fetch_hdr_count} fhb=%{fetch_hdr_bytes} fbc=%{fetch_body_count} fbb=%{fetch_body_bytes} del=%{deleted} exp=%{expunged} trash=%{trashed} imap_metadata = yes mail_max_userip_connections = 50 mail_plugins = " fts fts_solr notify virtual mail_log imap_sieve" } thebighonker.lerctr.org /home/ler/sieve $ -- Larry Rosenman http://www.lerctr.org/~ler Phone: +1 214-642-9640 E-Mail: larryrtx(a)gmail.com US Mail: 5708 Sabbia Drive, Round Rock, TX 78665-2106

2 5

Crash in sieve_extprogram_create() after dovecot/pigeonhole update
by Oleksandr Natalenko 25 Dec '17

25 Dec '17

Hi all. My dovecot setup: pf@vulcan:~ » dovecot --version 2.3.0 (c8b89eb) on Arch Linux, x86_64 (full config here: [0]) uses sieve plugin to train rspamd system as described in the wiki [1]. It used to work fine prior to 2.3.0/0.5.0 update, but now "imap" process crashes when I move spam letters from the inbox to the junk folder. I've recompiled both dovecot and pigeonhole with debug symbols and got this stacktrace [2]. As you can see, it fails (with a SIGSEGV) in sieve_extprogram_create(), sieve- extprograms-common.c:562, which corresponds to this code: === 562 if ( !smtp_address_isnull(msgdata->envelope.rcpt_params->orcpt.addr) ) { 563 program_client_set_env 564 (sprog->program_client, "ORIG_RECIPIENT", 565 smtp_address_encode(msgdata->envelope.rcpt_params- >orcpt.addr)); 566 } === When I dump msgdata structure, I see that rcpt_params is NULL: [3]. Thus, NULL pointer dereference occurs. Here is my report-spam.sieve file: [4] What I'm doing wrong here? Or is this some bug within pigeonhole? Could you please help me with resolving this? Thanks. [0] https://gist.github.com/92be2a4abe04149fd4b6971b6b4fa38d [1] https://wiki2.dovecot.org/HowTo/AntispamWithSieve [2] https://gist.github.com/8b202ebe9310845b59bcdeed7567026e [3] https://gist.github.com/a7e30b9e7a6c315d729bdcfe7142f532 [4] https://gist.github.com/fd1aa8943af106408a30155dffe052ab

1 1

ssl_curve_list seems to be ignored with Dovecot 2.3
by Marcel Menzel 25 Dec '17

25 Dec '17

Hi all, after upgrading to Dovecot 2.3, I've noticed the new "ssl_curve_list" TLS option in 10-ssl.conf. Setting it to "ssl_curve_list = X25519:P-256" or leaving it blank (auto) does not change anything, Dovecot keeps on negotiating P-384: Server Temp Key: ECDH, P-384, 384 bits When using "-curves X25519" in s_client, it does a fallback to DH: Server Temp Key: DH, 4096 bits I'm on Dovecot 2.3.0 (c8b89eb) with OpenSSL 1.1.0g 2 Nov 2017 on Arch Linux 4.14.8-1-ARCH. Am I missing something here? OpenSSL 1.1 defaults to Curve25519 when leaving it on auto. Greetings, Marcel Menzel

1 0

Dovecot 2.3.0 generates all index files at once
by Andreas M. Kirchwitz 25 Dec '17

25 Dec '17

Merry Christmas! The brandnew Dovecot 2.3.0 seems to generate index (cache) files for all IMAP folders at once when a user logs in the first time. (Those "dovecot.index" files that live in ".imap" directories.) Previous versions generated these index files on demand when a folder was actually accessed (so if a folder was never used, no resources were wasted to ever generate an index file for it). For large mailboxes with lots of mail this may take hours, and during this time the user's mail client hangs (like Mutt) or exits with a timeout (like Thunderbird). Access to this user's mailbox hangs/fails with locking errors for obvious reasons. For fresh installations with pre-existing folders (but no index files yet) this kind of brings down the machine running Dovecot as soon as multiple users try to access their mail. I haven't analyzed the IMAP commands in detail. Just tried with Mutt and Thunderbird and they both trigger the issue. However, maybe Dovecot is just fine and the clients do something wrong which was just tolerated by Dovecot until now. My configuration is pretty simple: # 2.3.0 (c8b89eb): /usr/local/Dovecot-2.3.0/etc/dovecot/dovecot.conf # OS: Linux 2.6.32-042stab124.2 i686 CentOS release 6.9 (Final) auth_mechanisms = plain login digest-md5 cram-md5 first_valid_gid = 1000 first_valid_uid = 1000 mail_location = mbox:~/Mail:INBOX=/var/spool/mail/%u passdb { args = /usr/local/dovecot/etc/dovecot/dovecot.passwd driver = passwd-file } protocols = imap ssl_cert = </usr/local/dovecot/etc/dovecot/certs/server.crt ssl_dh = # hidden, use -P to show it ssl_key = # hidden, use -P to show it userdb { args = /usr/local/dovecot/etc/dovecot/dovecot.passwd driver = passwd-file } verbose_proctitle = yes protocol imap { imap_client_workarounds = tb-extra-mailbox-sep tb-lsub-flags mail_max_userip_connections = 20 } Good news is, Dovecot 2.3.0 compiles without errors and it also runs fine once all index files have been created. Maybe there's a new configuration option to toggle this behaviour but I haven't spotted anything obvious yet. Any help is appreciated. Thanks a lot and keep up the good work, Andreas

1 0