- dovecot - dovecot.org

Dovecot fts script with solr
by André Rodier 21 May '18

21 May '18

Hello again, I have created a parser script, a little bit more advanced than the one provided with Dovecot. The main feature is probably to index documents inside zip/rar/tgz archives... I am using Ansible, swaks and doveadm to run automatic tests for each supported content. For specific reasons, I am not yet able to add Apache Tika to the distribution. However, I already made some tests with it. For now, I want to talk about the indexing script. I also have noticed a few weird behaviours. I will mention them at the end, albeit I am not 100% sure where they are coming from. I realised last week that using QEMU snapshots was not working as expected, so I am now more careful with this feature. For the developers or users who would be interested and the Dovecot team members to understand my questions, here how the tests are working: To run my tests, I have a set of files in various formats, with a UUID inside. They are office files, text files, or even archives with a text file inside... The first test I am running is the script alone. I check that the script can convert the file to text, and then I use grep to check the UUID is present. This works *perfectly* for all the content, except ppt, but it's minor. The second test is full: - I use swaks to send the email with an attachment and the appropriate mime type. - I then refresh the index using doveadm rescan. - I check that fts search returns a line, with doveadm fts search. - I then expunge the mailbox to be sure that the next test is valid. For the second test, it works almost all the time, except in the following situations: - When the attachment is an email (mime type message/rfc822) - RTF (could be a bug in my script) - Text file in UTF16 (Even if this file is converted to UTF8) *Questions:* 1 - Is there any limitation or special case for the mime message/rfc822 2 - Is the mime type received coming from the email headers? 3 - When the script is called without arguments, what is the purpose of the extension at the end of each supported mime types? 4 - Can I return a wildcard in the supported mime types, for instance "text/* *" ? 5 - I would like to handle attachments of types application/octet-stream. I have added "application/octet-stream *", but I am not sure if dovecot will pass the attachments with these mime type or not. *Notes:* 1 - I used netcat to monitor the solr server. I realise that sometimes, the data sent to the solr server only contains the headers of the email, not the text returned by the parser. Especially with rfc822 messages. I will do more tests. 2 - I just finished to write the script, it's not yet refactored, but at list it is well documented. I will do a full security audit later. I am actually testing an associated AppArmor profile. 3 - I will do more intensive test on the script on bigger mail boxes with more attachments. 4 - I may rewrite the script in Python 5 - Suggestions welcome. I initially attached the current version of the script, but the email is probably pending for review...In this case, the last development version is on Github: https://github.com/progmaticltd/homebox/blob/dev/install/playbooks/roles/do… The configuration of supported mime types is a simple file, accessible on github as well: https://github.com/progmaticltd/homebox/blob/dev/install/playbooks/roles/do… Thanks for your advices or suggestions.

2 1

Re: Best mail encryption solution for per-user
by Aki Tuomi 20 May '18

20 May '18

> On 19 May 2018 at 16:40 mail(a)sjemm.net wrote: > > > May 18, 2018 10:01 PM, "Aki Tuomi" <aki.tuomi(a)dovecot.fi> wrote: > >> On 18 May 2018 at 21:44 mail(a)sjemm.net wrote: > >> > >> May 18, 2018 4:43 PM, "Aki Tuomi" <aki.tuomi(a)dovecot.fi> wrote: > >> On 18 May 2018 at 17:38 mail(a)sjemm.net wrote: > >> > >> May 18, 2018 4:05 PM, "Aki Tuomi" <aki.tuomi(a)dovecot.fi> wrote: > >> On 18 May 2018 at 16:43 mail(a)sjemm.net wrote: > >> > >> Hi Tai74 and Aki, > >> I followed your conversation with interest on how to setup per user encryption in dovecot. > >> I have setup my dovecot with the following in a conf file: > >> > >> ============== > >> > >> mail_attribute_dict = file:%h/Maildir/dovecot-attributes > >> mail_plugins = $mail_plugins mail_crypt > >> plugin { > >> > >> mail_crypt_curve = secp521r1 > >> > >> mail_crypt_save_version = 2 > >> > >> } > >> > >> ============== > >> > >> This works nice, all emails are being encrypted and every user/folder has keys. > >> But as I understood from your conversation these keys are not protected. And I want them to be > >> protected by the users password used by imap. > >> > >> Those passwords are stored in a mysql DB file. ( I used a guide from workaround [dot] org to set up > >> the DB and postfix/dovecot) > >> > >> but how would i set it so, that the users password from the DB is used to encrypt the keys? > >> > >> should i use mail_crypt_private_password = ? > >> how do i point it to the mysql db then? > >> im unsure about this > >> > >> Do you have any hints on this? > >> > >> Kind regards, > >> Zjemm > >> > >> The passwords in your MySQL database are, hopefully, not in plaintext. If you want to secure your > >> user's keys using user's login password, you must have a TOOL that manages this. > >> > >> You can use mail_crypt_private_password = %w in (mysql) passdb fields to provide the user's login > >> password as private password. You might want to run it thru some hash, so %{sha1:password} might be > >> a good option. > >> > >> You can change the key password using 'doveadm mailbox cryptokey', this needs to be done every time > >> user changes his password. > >> > >> Also note that if you go down this road, and the user forgets his password, you will not be able to > >> recover the emails without backup copy of the private key. > >> > >> Aki > >> > >> Hi Aki > >> > >> I used the following command: > >> dovecot pw -s SHA256-CRYPT > >> > >> the output on the chosen password looks like: {SHA256-CRYPT}$5$Rokc06a7In4SF3bO$OQpGQWqg........ > >> > >> This output is used to store in the password fields in the database. So no plain text passwords no > >> :) > >> > >> You can use mail_crypt_private_password = %w in (mysql) passdb fields to provide the user's login > >> password as private password. > >> > >> can you explain this a bit more for me? > >> > >> for now i have in the 10-auth.conf file the following: > >> ============== > >> passdb { > >> driver = sql > >> > >> # Path for SQL configuration file, see example-config/dovecot-sql.conf.ext > >> args = /etc/dovecot/dovecot-sql.conf.ext > >> } > >> > >> and: > >> > >> userdb { > >> driver = static > >> args = uid=vmail gid=vmail home=/var/vmail/%d/%n > >> } > >> ============== > >> > >> then i have in dovecot-sql.conf.ext > >> ============== > >> driver = mysql > >> connect = host=x.x.x.x dbname=mailserver user=mailuser password=mailpasswordexample > >> default_pass_scheme = SHA256-CRYPT > >> password_query = SELECT email as user, password FROM virtual_users WHERE email='%u'; > >> ============== > >> Where do i need to set : mail_crypt_private_password = %w ? > >> > >> password as private password. You might want to run it thru some hash, so %{sha1:password} might be > >> a good option. > >> > >> the passwords are allready hashed in the DB using: dovecot pw -s SHA256-CRYPT to genereate the has. > >> so this step isnt nesesary anymore am i right? > >> > >> Thank you for your quick response, very helpfull > >> > >> Zjemm > >> > >> You misunderstood a bit. The idea is to use the *plaintext* password as the password for the > >> private key. Otherwise anyone could just decrypt it by looking at your database where the hashed > >> password is.. > >> > >> So: > >> > >> password_query = SELECT email as user, password, '%w' AS userdb_mail_crypt_private_password FROM > >> virtual_users WHERE email='%u' > >> > >> Aki > >> > >> Hi Aki, > >> > >> Thank you very much for your help, i realy appreciate that. > >> > >> Ok so if i understand it correctly i'll have to use: > >> > >> password_query = SELECT email as user, password, '%w' AS userdb_mail_crypt_private_password FROM > >> virtual_users WHERE email='%u' > >> > >> in my dovecot-sql.conf.ext file > >> > >> This query selects the user, the password, and %w > >> > >> if i run a little query myself: > >> MariaDB [mailserver]> SELECT email as user, password, '%w' AS userdb_mail_crypt_private_password > >> FROM virtual_users; > >> +------------------+----------------------------------+------------------------------------+ > >> | user | password | userdb_mail_crypt_private_password | > >> +------------------+----------------------------------+------------------------------------+ > >> | john(a)example.org | {SHA256-CRYPT}$5$M/GWzmtjsLroRWI | %w | > >> +------------------+----------------------------------+------------------------------------+ > >> > >> %w is a dovecot variable, and stands for the plaintext password, but the password is not stored as > >> plaintext in the DB, %w get filled with the actual plaintext password by dovecot upon the user that > >> is typing in the password when authenticating. > >> > >> is this correct? > > > > yes. > > > >> so then i have the username the hashed password en the plaintext password as a result of the query. > > > > yes > > > >> now userdb_mail_crypt_private_password = the plaintext password > >> do i need to reference it somewhere? or is userdb_mail_crypt_private_password autmatically used by > >> the dovecot mail_crypt plugin to encrypt the keys? or should it be mail_crypt_private_password? > > > > It gets injected into the mail process as 'mail_crypt_private_password', as if it was set in plugin > > {} section. > > > >> if i have this setup working i'm going to write a blog post on this topic to share this knowledge > >> > >> Thanks again and have a great weekend. > >> > >> Zjemm > > > > Aki > > Hi Aki, > > Cool i'm testing it right now. > I have set up a new mailserver (life is great with lxc containers :) ) > > postfix and dovecot are working like normal > > next i enable mail_crypt > > i did create a file: /etc/dovecot/conf.d/10-mailcrypt.conf > ========================== > mail_attribute_dict = file:%h/Maildir/dovecot-attributes > > mail_plugins = $mail_plugins mail_crypt > > plugin { > mail_crypt_curve = secp521r1 > mail_crypt_save_version = 2 > } > ========================== > > and then i changed the file: /etc/dovecot/dovecot-sql.conf.ext > > so the query is now the new query: > password_query = SELECT email as user, password, '%w' AS userdb_mail_crypt_private_password FROM virtual_users WHERE email='%u'; > > then i restarted dovecot and postfix and send a test email to the one and only testuser that is in there. > > when i open the mailbox with the tool mutt, i can see the new email, and when openening the email the mutt client drops the connection. > > in the log i can see: > > May 19 13:34:48 mailserver1.example.local dovecot[600]: imap-login: Login: user=<john(a)example.org>, method=PLAIN, rip=::1, lip=::1, mpid=713, TLS, session=<E3PnIY9sNM4AAAAAAAAAAAAAAAAAAAAB> > May 19 13:34:49 mailserver1.example.local dovecot[600]: imap(john(a)example.org): Error: read() failed: read(/var/vmail/example.org/john/Maildir/cur/1526736378.M161472P641.mailser… failed: Private key not available: Cannot decrypt key bfc5bb25b1bf64290eea6dc14b516c6a0a25b64551b6e4f0f8677ba7274887cb: error:03070068:bignum routines:BN_mpi2bn:encoding error (FETCH BODY[] for mailbox INBOX UID 8) > > > i think i missed a step, but witch one? > > the userpassword hasnt been changed (that would be the next step in the testing process) > > should i've use doveadm first to encrypt the key with that userpassword? i thought it would do that on the fly, because the initial keys where only just created when enabling the mail_crypt plugin > > please let me know your thougts > Zjemm I noticed you replied directly to me, and not to the list, too... fixed that for you. mail_crypt_private_password is used when key is created, but if you have created it before using password, you'll need to encrypt it before turning the setting on. Aki

1 0

Disconnecting unauthenticated IMAP entities faster?
by David Hubbard 20 May '18

20 May '18

Hello, given the 2015 revision date, I was curious if anyone can confirm https://wiki2.dovecot.org/Timeouts is still accurate where the 'before login' IMAP timeout remains hard coded? We're having an issue where blocks of IP's from China and similar locations are crawling IP ranges trying common login credentials, and hanging the connections open in the process. We have clients who have large numbers of employees at single locations, so it isn't possible to reduce the mail_max_userip_connections (assuming it even applies to pre-auth sessions) to a low value. The end result is these connections chew up all the imap-login processes because they sit there until the three-minute timeout is hit, blocking legit users. The only workaround is to raise both the imap and imap-login processes to a massive amount to support all the pre-auth hung open connections. It would be a lot easier to find a reasonable process limit if we could boot these unauthenticated connections off in a more reasonable amount of time, like 5-10 seconds, but I'm not seeing a way to accomplish that? Thanks

3 2

indexer-worker issues on dovecot 2.3.0
by Ricardo Machini Barbosa 18 May '18

18 May '18

Hello, I have some mailbox with error on index-worker process on dovecot 2.3.0 If I move the same mailbox to dovecot 2.2.33.2 this problem dos not happen. See below the backtrace: May 18 10:33:55 Error: imap(xxxxx)<249924><Xpj77npscpYKAQMQ>: indexer failed to index mailbox INBOX May 18 10:33:55 Fatal: indexer-worker(xxxxx)<281701><Xpj77npscpYKAQMQ:UK9sNELW/lplTAQAF3haWw>: master: service(indexer-worker): child 281701 killed with signal 6 (core dumps disabled) May 18 10:34:55 Panic: indexer-worker(xxxxx)<307016><Xpj77npscpYKAQMQ:oEUqNn7W/lpIrwQAF3haWw>: file unichar.c: line 160 (uni_ucs4_to_utf8_c): assertion failed: (uni_is_valid_ucs4(chr)) May 18 10:34:55 Error: indexer-worker(xxxxxxxx)<307016><Xpj77npscpYKAQMQ:oEUqNn7W/lpIrwQAF3haWw>: Raw backtrace: /usr/lib64/dovecot/libdovecot.so.0(+0xc9804) [0x7f157c8eb804] -> /usr/lib64/dovecot/libdovecot.so.0(+0xc98be) [0x7f157c8eb8be] -> /usr/lib64/dovecot/libdovecot.so.0(i_fatal+0) [0x7f157c85e34b] -> /usr/lib64/dovecot/libdovecot.so.0(uni_ucs4_to_utf8_c+0xc0) [0x7f157c9220b0] -> /usr/lib64/dovecot/libdovecot.so.0(+0xaadc9) [0x7f157c8ccdc9] -> /usr/lib64/dovecot/libdovecot.so.0(mail_html2text_more+0xc5) [0x7f157c8ccf85] -> /usr/lib64/dovecot/lib20_fts_plugin.so(+0xc563) [0x7f157be14563] -> /usr/lib64/dovecot/lib20_fts_plugin.so(fts_parser_more+0x27) [0x7f157be14307] -> /usr/lib64/dovecot/lib20_fts_plugin.so(fts_build_mail+0x440) [0x7f157be121a0] -> /usr/lib64/dovecot/lib20_fts_plugin.so(+0x10266) [0x7f157be18266] -> /usr/lib64/dovecot/libdovecot-storage.so.0(mail_precache+0x2e) [0x7f157cbd56ae] -> dovecot/indexer-worker [rogerio(a)alfacorcorretora.com.br INBOX - 200/734](+0x2794) [0x55bff457f794] -> /usr/lib64/dovecot/libdovecot.so.0(io_loop_call_io+0x65) [0x7f157c902df5] -> /usr/lib64/dovecot/libdovecot.so.0(io_loop_handler_run_internal+0x10f) [0x7f157c90469f] -> /usr/lib64/dovecot/libdovecot.so.0(io_loop_handler_run+0x52) [0x7f157c902ef2] -> /usr/lib64/dovecot/libdovecot.so.0(io_loop_run+0x38) [0x7f157c903118] -> /usr/lib64/dovecot/libdovecot.so.0(master_service_run+0x13) [0x7f157c880ce3] -> dovecot/indexer-worker [rogerio(a)alfacorcorretora.com.br INBOX - 200/734](main+0xdb) [0x55bff457f18b] -> /lib64/libc.so.6(__libc_start_main+0xf5) [0x7f157c480c05] -> dovecot/indexer-worker [rogerio(a)alfacorcorretora.com.br INBOX - 200/734](+0x2252) [0x55bff457f252] May 18 10:34:55 Error: indexer: Indexer worker disconnected, discarding 1 requests for xxxxxx May 18 10:34:55 Error: imap(xxxxx)<249924><Xpj77npscpYKAQMQ>: indexer failed to index mailbox INBOX May 18 10:34:55 Fatal: indexer-worker(xxxxx)<307016><Xpj77npscpYKAQMQ:oEUqNn7W/lpIrwQAF3haWw>: master: service(indexer-worker): child 307016 killed with signal 6 (core dumps disabled) uname -a Linux mailsrv01 2.6.32-696.23.1.el6.x86_64 #1 SMP Tue Mar 13 22:44:18 UTC 2018 x86_64 x86_64 x86_64 GNU/Linux dovecot --version 2.3.0.1 (ffd8a29) dovecot -n # 2.3.0.1 (ffd8a29): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.devel (61b47828) # OS: Linux 2.6.32-696.23.1.el6.x86_64 x86_64 CentOS release 6.9 (Final) # Hostname: mailsrv01 auth_master_user_separator = * auth_verbose_passwords = sha1 default_client_limit = 2000 deliver_log_format = subject=%s from:%f sender:%e to: %{to_envelope} size:%p msgid=%m status=%$ delivery_time=%{delivery_time} session_time=%{session_time} disable_plaintext_auth = no doveadm_allowed_commands = quota get,dsync-server,kick,purge,fts rescan,altmove,mailbox list,expunge,mailbox status doveadm_password = # hidden, use -P to show it lda_mailbox_autocreate = yes lda_mailbox_autosubscribe = yes lmtp_rcpt_check_quota = yes login_greeting = IMAP4. login_trusted_networks = x.x.x.x/24 mail_fsync = never mail_gid = xxx mail_location = mdbox:~/mdbox:ALT=/altstorage%h/mdbox mail_plugins = quota quota_clone fts fts_solr zlib mail_uid = xxx managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date ihave duplicate vnd.dovecot .filter namespace inbox { inbox = yes list = yes location = mailbox "Itens Enviados" { auto = subscribe special_use = \Sent } mailbox "Itens Excluídos" { auto = subscribe special_use = \Trash } mailbox Rascunhos { auto = subscribe special_use = \Drafts } mailbox Spam { auto = subscribe special_use = \Junk } prefix = separator = . } passdb { args = /etc/dovecot/dovecot-ldap.conf.ext driver = ldap } plugin { fts = solr fts_solr = url=http://x.x.x.x:8983/solr/dovecot/ imapsieve_mailbox1_before = file:/etc/dovecot/antispam/report-spam.sieve imapsieve_mailbox1_causes = COPY imapsieve_mailbox1_name = Spam imapsieve_mailbox2_before = file:/etc/dovecot/antispam/report-ham.sieve imapsieve_mailbox2_causes = COPY imapsieve_mailbox2_from = Spam imapsieve_mailbox2_name = * last_login_dict = redis:host=x.x.x.x:port=6379 quota = count:User quota quota_clone_dict = redis:host=x.x.x.x:port=6379 quota_rule = *:bytes=0 quota_rule2 = Itens Excluídos:storage=+xM quota_vsizes = yes quota_warning = storage=95%% quota-warning 95 %u quota_warning2 = storage=80%% quota-warning 80 %u sieve = ~/.dovecot.sieve sieve_before = /etc/dovecot/sieve/audit.sieve sieve_before2 = /etc/dovecot/sieve/duplicate.sieve sieve_before3 = /etc/dovecot/sieve/spam.sieve sieve_dir = ~/sieve sieve_global_extensions = +vnd.dovecot.pipe sieve_pipe_bin_dir = /etc/dovecot/antispam sieve_plugins = sieve_imapsieve sieve_extprograms sieve_vacation_default_period = 7d sieve_vacation_max_period = 30d sieve_vacation_min_period = 1h } protocols = imap pop3 lmtp sieve service anvil { client_limit = 2000 } service auth { client_limit = 2000 } service doveadm { inet_listener { port = 9011 } inet_listener http { port = 9010 } vsz_limit = 768 M } service imap-login { process_limit = 800 process_min_avail = 200 service_count = 1 vsz_limit = 512 M } service imap-postlogin { executable = script-login dovecot-postlogin imap unix_listener imap-postlogin { user = mail } user = $default_internal_user } service imap { executable = imap imap-postlogin process_limit = 20000 vsz_limit = 768 M } service indexer-worker { vsz_limit = 512 M } service lmtp { inet_listener lmtp { address = * port = 24 } vsz_limit = 512 M } service managesieve-login { inet_listener sieve { port = 4190 } process_min_avail = 10 } service managesieve { process_limit = 512 } service pop3-postlogin { executable = script-login dovecot-postlogin pop3 unix_listener pop3-postlogin { user = mail } user = $default_internal_user } service pop3 { executable = pop3 pop3-postlogin } service quota-warning { executable = script quota-warning unix_listener quota-warning { user = mail } } service stats { chroot = empty client_limit = 20000 drop_priv_before_exec = no executable = stats extra_groups = group = idle_kill = 4294967295 secs privileged_group = process_limit = 1 process_min_avail = 0 protocol = service_count = 0 type = unix_listener stats-reader { group = mode = 0600 user = } unix_listener stats-writer { group = mode = 0600 user = } user = $default_internal_user vsz_limit = 18446744073709551615 B } ssl = no submission_host = x.x.x.x userdb { driver = prefetch } userdb { args = /etc/dovecot/dovecot-ldap.conf.ext driver = ldap } verbose_proctitle = yes protocol lda { mail_fsync = optimized mail_plugins = quota quota_clone sieve } protocol imap { imap_max_line_length = 128 k mail_max_userip_connections = 30 mail_plugins = quota quota_clone fts fts_solr zlib imap_quota last_login imap_sieve } protocol lmtp { mail_fsync = optimized mail_plugins = quota quota_clone sieve } protocol pop3 { mail_max_userip_connections = 10 mail_plugins = quota quota_clone fts fts_solr zlib last_login pop3_logout_format = in=%i out=%o top=%t/%p, retr=%r/%b, del=%d/%m, size=%s pop3_no_flag_updates = yes pop3_save_uidl = yes pop3_uidl_format = %08Xu%08Xv } Regards, Ricardo

2 1

vacation stumbles over invalid headers
by Militades Sunfire 18 May '18

18 May '18

# 2.2.13: /etc/dovecot/dovecot.conf # OS: Linux 3.16.0-4-amd64 x86_64 Debian 8.10 the vacation feature stumbles over invalid headers in several cases, causing an even more invalid header f.ex. if the original mail contains a line with only spaces in the vacation reply the header breaks apart displying not only the inteded vacation message but also parts of the message header. depends a bit on the client what happends of course, thunderbird and the mac client are two examples. Greetings

1 0

Decryption method for Maildir messages stored by mail_crypt plugin
by Ben Harrison 17 May '18

17 May '18

I've successfully implemented the mail_crypt plugin on v2.2.27 and it's working like a champ, but some of our administrative operations require access to Maildir messages in plaintext. I've found numerous threads detailing help with mail_crypt setup, but none of my research has yielded a method of decrypting the stored messages. Relevant plugin config: mail_crypt_curve = prime256v1 mail_crypt_global_private_key = <pirvkey> mail_crypt_global_public_key = <pubkey> mail_crypt_save_version = 2 Method I attempted for manual decryption is listed below: openssl pkeyutl -derive -inkey mailcrypt.key -peerkey mailcrypt.pub -out shared_secret.bin openssl enc -aes256 -base64 -k $(base64 shared_secret.bin) -d -in test.enc -out test.txt Openssl reports an error reading the input file, but it isn't permissions related. I started looking for the encryption/decryption method in the source but figure it's worth seeing if there's some existing methodology I can employ here. Appreciate any feedback. Thanks, -- -- -- *Ben Harrison* *BHarrison.IT*843.492.4870

2 1

External Program for Authentication?
by Marc Perkel 17 May '18

17 May '18

Is it possible to run a bash script for authentication where a 0 exit code indicates success and a non-zero is failure? What I'm trying to do is create a shadow IMAP server that authenticates against a different server. That way my server will use the same passwords as an existing server. So what I would need is for dovecot to pass the username and password to my script, I attempt to log in remotely and if I succeed I allow access on my side. My side will be used to configure black lists and where spam is dragged from their side to my side. (I'm a spam filtering company)

4 3

Maillog warning
by forums＠mehl-family.fr 16 May '18

16 May '18

Hi, In my maillog I see this warning message at every reception of e-mail: _STATUS=SENT (DELIVERED VIA DOVECOT SERVICE (DOVECONF: WARNING: /ETC/DOVECOT/CONF.D/90-QUOTA.CONF LINE 39: GLOBAL SETTING MAIL_PLUGINS WON'T CHAN....._ It is just a warning, the e-mail was delivered. I don't find where is the problem. Thank's. -- ########## Philippe - Forums

3 10

dovecot + cephfs - sdbox vs mdbox
by Webert de Souza Lima 16 May '18

16 May '18

I'm sending this message to both dovecot and ceph-users ML so please don't mind if something seems too obvious for you. Hi, I have a question for both dovecot and ceph lists and below I'll explain what's going on. Regarding dbox format (https://wiki2.dovecot.org/MailboxFormat/dbox) when using sdbox, a new file is stored for each email message. When using mdbox, multiple messages are appended to a single file until it reaches/passes the rotate limit. I would like to understand better how the mdbox format impacts on IO performance. I think it's generally expected that fewer larger file translate to less IO and more troughput when compared to more small files, but how does dovecot handle that with mdbox? If dovecot does flush data to storage upon each and every new email is arrived and appended to the corresponding file, would that mean that it generate the same ammount of IO as it would do with one file per message? Also, if using mdbox many messages will be appended to a said file before a new file is created. That should mean that a file descriptor is kept open for sometime by dovecot process. Using cephfs as backend, how would this impact cluster performance regarding MDS caps and inodes cached when files from thousands of users are opened and appended all over? I would like to understand this better. Why? We are a small Business Email Hosting provider with bare metal, self hosted systems, using dovecot for servicing mailboxes and cephfs for email storage. We are currently working on dovecot and storage redesign to be in production ASAP. The main objective is to serve more users with better performance, high availability and scalability. * high availability and load balancing is extremely important to us * On our current model, we're using mdbox format with dovecot, having dovecot's INDEXes stored in a replicated pool of SSDs, and messages stored in a replicated pool of HDDs (under a Cache Tier with a pool of SSDs). All using cephfs / filestore backend. Currently there are 3 clusters running dovecot 2.2.34 and ceph Jewel (10.2.9-4). - ~25K users from a few thousands of domains per cluster - ~25TB of email data per cluster - ~70GB of dovecot INDEX [meta]data per cluster - ~100MB of cephfs metadata per cluster Our goal is to build a single ceph cluster for storage that could expand in capacity, be highly available and perform well enough. I know, that's what everyone wants. Cephfs is an important choise because: - there can be multiple mountpoints, thus multiple dovecot instances on different hosts - the same storage backend is used for all dovecot instances - no need of sharding domains - dovecot is easily load balanced (with director sticking users to the same dovecot backend) On the upcoming upgrade we intent to: - upgrade ceph to 12.X (Luminous) - drop the SSD Cache Tier (because it's deprecated) - use bluestore engine I was said on freenode/#dovecot that there are many cases where SDBOX would perform better with NFS sharing. In case of cephfs, at first, I wouldn't think that would be true because more files == more generated IO, but thinking about what I said in the beginning regarding sdbox vs mdbox that could be wrong. Any thoughts will be highlt appreciated. Regards, Webert Lima DevOps Engineer at MAV Tecnologia *Belo Horizonte - Brasil* *IRC NICK - WebertRLZ*

2 2

Re: [ceph-users] dovecot + cephfs - sdbox vs mdbox
by Webert de Souza Lima 16 May '18

16 May '18

Hello Jack, yes, I imagine I'll have to do some work on tuning the block size on cephfs. Thanks for the advise. I knew that using mdbox, messages are not removed but I though that was true in sdbox too. Thanks again. We'll soon do benchmarks of sdbox vs mdbox over cephfs with bluestore backend. We'll have to do some some work on how to simulate user traffic, for writes and readings. That seems troublesome. Thanks for the plugins recommendations. I'll take the change and ask you how is the SIS status? We have used it in the past and we've had some problems with it. Regards, Webert Lima DevOps Engineer at MAV Tecnologia *Belo Horizonte - Brasil* *IRC NICK - WebertRLZ* On Wed, May 16, 2018 at 4:19 PM Jack <ceph(a)jack.fr.eu.org> wrote: > Hi, > > Many (most ?) filesystems does not store multiple files on the same block > > Thus, with sdbox, every single mail (you know, that kind of mail with 10 > lines in it) will eat an inode, and a block (4k here) > mdbox is more compact on this way > > Another difference: sdbox removes the message, mdbox does not : a single > metadata update is performed, which may be packed with others if many > files are deleted at once > > That said, I do not have experience with dovecot + cephfs, nor have made > tests for sdbox vs mdbox > > However, and this is a bit out of topic, I recommend you look at the > following dovecot's features (if not already done), as they are awesome > and will help you a lot: > - Compression (classic, https://wiki.dovecot.org/Plugins/Zlib) > - Single-Instance-Storage (aka sis, aka "attachment deduplication" : > https://www.dovecot.org/list/dovecot/2013-December/094276.html) > > Regards, > On 05/16/2018 08:37 PM, Webert de Souza Lima wrote: > > I'm sending this message to both dovecot and ceph-users ML so please > don't > > mind if something seems too obvious for you. > > > > Hi, > > > > I have a question for both dovecot and ceph lists and below I'll explain > > what's going on. > > > > Regarding dbox format (https://wiki2.dovecot.org/MailboxFormat/dbox) > when > > using sdbox, a new file is stored for each email message. > > When using mdbox, multiple messages are appended to a single file until > it > > reaches/passes the rotate limit. > > > > I would like to understand better how the mdbox format impacts on IO > > performance. > > I think it's generally expected that fewer larger file translate to less > IO > > and more troughput when compared to more small files, but how does > dovecot > > handle that with mdbox? > > If dovecot does flush data to storage upon each and every new email is > > arrived and appended to the corresponding file, would that mean that it > > generate the same ammount of IO as it would do with one file per message? > > Also, if using mdbox many messages will be appended to a said file > before a > > new file is created. That should mean that a file descriptor is kept open > > for sometime by dovecot process. > > Using cephfs as backend, how would this impact cluster performance > > regarding MDS caps and inodes cached when files from thousands of users > are > > opened and appended all over? > > > > I would like to understand this better. > > > > Why? > > We are a small Business Email Hosting provider with bare metal, self > hosted > > systems, using dovecot for servicing mailboxes and cephfs for email > storage. > > > > We are currently working on dovecot and storage redesign to be in > > production ASAP. The main objective is to serve more users with better > > performance, high availability and scalability. > > * high availability and load balancing is extremely important to us * > > > > On our current model, we're using mdbox format with dovecot, having > > dovecot's INDEXes stored in a replicated pool of SSDs, and messages > stored > > in a replicated pool of HDDs (under a Cache Tier with a pool of SSDs). > > All using cephfs / filestore backend. > > > > Currently there are 3 clusters running dovecot 2.2.34 and ceph Jewel > > (10.2.9-4). > > - ~25K users from a few thousands of domains per cluster > > - ~25TB of email data per cluster > > - ~70GB of dovecot INDEX [meta]data per cluster > > - ~100MB of cephfs metadata per cluster > > > > Our goal is to build a single ceph cluster for storage that could expand > in > > capacity, be highly available and perform well enough. I know, that's > what > > everyone wants. > > > > Cephfs is an important choise because: > > - there can be multiple mountpoints, thus multiple dovecot instances on > > different hosts > > - the same storage backend is used for all dovecot instances > > - no need of sharding domains > > - dovecot is easily load balanced (with director sticking users to the > > same dovecot backend) > > > > On the upcoming upgrade we intent to: > > - upgrade ceph to 12.X (Luminous) > > - drop the SSD Cache Tier (because it's deprecated) > > - use bluestore engine > > > > I was said on freenode/#dovecot that there are many cases where SDBOX > would > > perform better with NFS sharing. > > In case of cephfs, at first, I wouldn't think that would be true because > > more files == more generated IO, but thinking about what I said in the > > beginning regarding sdbox vs mdbox that could be wrong. > > > > Any thoughts will be highlt appreciated. > > > > Regards, > > > > Webert Lima > > DevOps Engineer at MAV Tecnologia > > *Belo Horizonte - Brasil* > > *IRC NICK - WebertRLZ* > > > > > > > > _______________________________________________ > > ceph-users mailing list > > ceph-users(a)lists.ceph.com > > http://lists.ceph.com/listinfo.cgi/ceph-users-ceph.com > > > > _______________________________________________ > ceph-users mailing list > ceph-users(a)lists.ceph.com > http://lists.ceph.com/listinfo.cgi/ceph-users-ceph.com >

1 0