- dovecot - dovecot.org

transition from 1.x to 2? What did I break?
by Paul Beard 05 Sep '17

05 Sep '17

It’s been awhile since I set up my dovecot instance (like several years) and my transition from 1.x to 2 seems to have not gone well: all I can see is that authentication is banjaxed and I’m not sure what needs to be done to fix it. # 2.2.32 (dfbe293d4): /usr/local/etc/dovecot/dovecot.conf # OS: FreeBSD 10.3-STABLE i386 auth_debug = yes auth_mechanisms = plain login listen = *,[::] log_path = /var/log/dovecot.log mail_access_groups = mail mail_location = /var/mail/%u mail_privileged_group = mail namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } passdb { driver = pam } passdb { driver = pam } passdb { driver = pam } protocols = imap service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0660 user = postfix } user = root } ssl_cert = </etc/ssl/certs/dovecot.pem userdb { driver = passwd } userdb { driver = passwd } userdb { driver = passwd } protocol lda { postmaster_address = postmaster@redacted quota_full_tempfail = no } Sep 02 07:54:08 imap-login: Info: Disconnected (no auth attempts in 0 secs): user=<>, rip=192.168.0.1, lip=192.168.0.25, TLS handshaking: SSL_accept() failed: error:1408A0C1:SSL routines:ssl3_get_client_hello:no shared cipher, session=<2hS8DDZYyN7AqAAB> Sep 02 07:54:08 auth: Debug: auth client connected (pid=47645) Sep 02 07:54:08 imap-login: Info: Disconnected (no auth attempts in 0 secs): user=<>, rip=192.168.0.1, lip=192.168.0.25, TLS handshaking: SSL_accept() failed: error:1408A0C1:SSL routines:ssl3_get_client_hello:no shared cipher, session=<SFK8DDZYyt7AqAAB> Sep 02 07:54:54 auth: Warning: auth client 0 disconnected with 2 pending requests: EOF Sep 02 07:55:19 auth: Debug: auth client connected (pid=47714) Sep 02 07:55:19 imap-login: Info: Disconnected (no auth attempts in 0 secs): user=<>, rip=192.168.0.1, lip=192.168.0.25, TLS handshaking: SSL_accept() failed: error:1408A0C1:SSL routines:ssl3_get_client_hello:no shared cipher, session=<WbD0EDZY2N7AqAAB> Sep 02 07:55:19 auth: Debug: auth client connected (pid=47716) Sep 02 07:55:19 imap-login: Info: Disconnected (no auth attempts in 0 secs): user=<>, rip=192.168.0.1, lip=192.168.0.25, TLS handshaking: SSL_accept() failed: error:1408A0C1:SSL routines:ssl3_get_client_hello:no shared cipher, session=<1Qb1EDZY2d7AqAAB>

3 3

Mac Os mail error while moving msg in subfolder
by Antonello Cioffi 05 Sep '17

05 Sep '17

Hi all we are experiencing several errors like this: WROTE Sep 05 11:30:57.700 [kCFStreamSocketSecurityLevelTLSv1_2] -- host:mail.uniparthenope.it -- port:993 -- socket:0x6000004b1dc0 -- thread:0x60000127b140 35.156 UID COPY 76543 GARR.Eduroam_tech READ Sep 05 11:30:57.702 [kCFStreamSocketSecurityLevelTLSv1_2] -- host:mail.uniparthenope.it -- port:993 -- socket:0x6000004b1dc0 -- thread:0x60000127b140 35.156 NO [CANNOT] Character not allowed in mailbox name: '.' (0.001 + 0.000 secs). WROTE Sep 05 11:30:57.719 [kCFStreamSocketSecurityLevelTLSv1_2] -- host:mail.uniparthenope.it -- port:993 -- socket:0x6000004b1dc0 -- thread:0x60000127b140 36.156 UID STORE 76543 +FLAGS.SILENT (\Deleted) READ Sep 05 11:30:57.733 [kCFStreamSocketSecurityLevelTLSv1_2] -- host:mail.uniparthenope.it -- port:993 -- socket:0x6000004b1dc0 -- thread:0x60000127b140 * 7776 FETCH (UID 76543 MODSEQ (201448)) 36.156 OK Store completed (0.012 + 0.000 + 0.011 secs). WROTE Sep 05 11:30:57.734 [kCFStreamSocketSecurityLevelTLSv1_2] -- host:mail.uniparthenope.it -- port:993 -- socket:0x6000004b1dc0 -- thread:0x60000127b140 37.156 IDLE READ Sep 05 11:30:57.740 [kCFStreamSocketSecurityLevelTLSv1_2] -- host:mail.uniparthenope.it -- port:993 -- socket:0x6000004b1dc0 -- thread:0x60000127b140 + idling READ Sep 05 11:31:08.857 [kCFStreamSocketSecurityLevelTLSv1_2] -- host:mail.uniparthenope.it -- port:993 -- socket:0x6000004b1dc0 -- thread:0x608001475180 * OK Still here READ Sep 05 11:31:09.369 [kCFStreamSocketSecurityLevelTLSv1_2] -- host:mail.uniparthenope.it -- port:993 -- socket:0x6080006ba580 -- thread:0x608001475180 * OK Still here while a mail client on mac os tries to move a message to a subfolder Dovecot version in use is: 2.2.31 and the configuration extract file is: namespace { disabled = no hidden = no ignore_on_failure = no inbox = yes list = yes location = order = 0 prefix = separator = / subscriptions = yes type = private } namespace { disabled = no hidden = yes ignore_on_failure = no inbox = no list = no location = maildir:~/Maildir/expunged order = 0 prefix = .EXPUNGED/ separator = / subscriptions = yes type = private } all other client like thunderbird, outlook and horde imap web interface work fine. Is there something who could help me? thank you regards -- Dott. Antonello Cioffi Ufficio Servizi Informatici Università degli Studi di Napoli Parthenope Tel. 081/5475292 - Fax. 081/5475180

1 0

AW: problem with shared folders and acls - only able to share INBOX
by Christian Eisert 05 Sep '17

05 Sep '17

Hi, i found the solution for my problem (RTFM) doveadm acl debug => Folder \.Subfolder cannot be accessed => dots in maildir format I added a 'Layout=fs' to the namespace definition. Thanks and cheers Christian -----Ursprüngliche Nachricht----- Von: Christian Eisert [mailto:christian.eisert@gmx.net] Gesendet: Freitag, 1. September 2017 09:36 An: 'dovecot(a)dovecot.org' Betreff: problem with shared folders and acls - only able to share INBOX Hi everybody, I have a problem that I cannot share subfolders of the mailboxes INBOX , e.g. /Sent / Trash etc. but also no self created folders. The ACLs seem to be set right. I have the suspicion that the dictionary ( /var/lib/dovecot/db/shared-mailboxes.db ) is not updated - there are no entries for the sub folders I just cannot find the problem within my configuration. Many thanks for having a look at it. Cheers from Hamburg, Germany, Christian Configuration attached: ---------------------------------------------------------------------------- ---------------------------------- # 2.2.27 (c0f36b0): /etc/dovecot/dovecot.conf # Pigeonhole version 0.4.16 (fed8554) # OS: Linux 4.9.0-3-amd64 x86_64 Debian 9.1 auth_debug = yes auth_mechanisms = plain login auth_verbose = yes mail_debug = yes mail_gid = vmail mail_home = /var/vmail/mailboxes/%d/%n mail_location = maildir:~/mail:LAYOUT=fs mail_plugins = acl mail_privileged_group = vmail mail_uid = vmail managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext namespace { hidden = no ignore_on_failure = no inbox = no list = yes location = maildir:%%h/mail:INDEX=%h/shared/%%u:CONTROL=%h/shared/%%u:INDEXPVT=%h/share d/%%u prefix = shared/%%u/ separator = / subscriptions = yes type = shared } namespace inbox { inbox = yes location = mailbox Drafts { auto = subscribe special_use = \Drafts } mailbox Sent { auto = subscribe special_use = \Sent } mailbox Spam { auto = subscribe special_use = \Junk } mailbox Trash { auto = subscribe special_use = \Trash } prefix = separator = / subscriptions = yes type = private } passdb { args = /etc/dovecot/dovecot-sql.conf driver = sql } plugin { acl = vfile acl_shared_dict = file:/var/lib/dovecot/db/shared-mailboxes.db antispam_backend = pipe antispam_mail_notspam = learn_ham antispam_mail_sendmail = /usr/bin/rspamc antispam_mail_spam = learn_spam antispam_spam = Spam antispam_trash = Trash quota = maildir:User quota quota_exceeded_message = Benutzer %u hat das Speichervolumen überschritten. / User %u has exhausted allowed storage space. sieve = file:/var/vmail/sieve/%d/%n/scripts;active=/var/vmail/sieve/%d/%n/active-scr ipt.sieve sieve_before = /var/vmail/sieve/global/spam-global.sieve } protocols = imap lmtp sieve service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0660 user = postfix } unix_listener auth-userdb { group = vmail mode = 0660 user = vmail } } service imap-login { inet_listener imap { port = 143 } } service lmtp { unix_listener /var/spool/postfix/private/dovecot-lmtp { group = postfix mode = 0660 user = postfix } user = vmail } service managesieve-login { inet_listener sieve { port = 4190 } } ssl = required ssl_cert = </etc/letsencrypt/live/mail.mydomain.org/fullchain.pem ssl_cipher_list = EDH+CAMELLIA:EDH+aRSA:EECDH+aRSA+AESGCM:EECDH+aRSA+SHA256:EECDH:+CAMELLIA128 :+AES128:+SSLv3:!aNULL:!eNULL:!LOW:!3DES:!MD5:!EXP:!PSK:!DSS:!RC4:!SEED:!IDE A:!ECDSA:kEDH:CAMELLIA128-SHA:AES128-SHA ssl_dh_parameters_length = 2048 ssl_key = # hidden, use -P to show it ssl_prefer_server_ciphers = yes userdb { args = /etc/dovecot/dovecot-sql.conf driver = sql } protocol imap { imap_idle_notify_interval = 29 mins mail_max_userip_connections = 20 mail_plugins = acl quota imap_quota antispam imap_acl } protocol lmtp { mail_plugins = acl sieve postmaster_address = postmaster(a)mydomain.org } ---------------------------------------------------------------------------- ----------------------------------

1 0

questions concerning dovecot
by Rajesh M 04 Sep '17

04 Sep '17

hello all had some basic questions 1) what is the logic behind the numbering of files in the conf.d folder ... is this to define the sequence of execution of the config files ? 2) Concerning global scripts, is the default.sieve, before i understand that they get executed when the user does not have his private sieve script. are sieve_before, sieve_after and sieve_global_path all globalscripts ? thanks rajesh

2 1

Failed to repair mdbox index / wrong dbox version
by Peer Heinlein 04 Sep '17

04 Sep '17

After a filesystem crash dovecot isn't able to repair some of the m-Files. That's okay in general -- but I wonder why he's complaining about "wrong dsync version" if I execute "doveadm force-resync" locally: doveadm(user(a)mailbox.org): Warning: mdbox /mail-mailbox/mailbox.org/1846405//mdbox/storage: rebuilding indexes doveadm(user(a)mailbox.org): Error: Corrupted dbox file /xxxx//mdbox/storage/m.340 (around offset=154): Invalid dbox version I would accept every log that it's too broken to be repaired, but "Invalid dbox version"? Maybe it's somewhere else a bug that this m-file couldn't be repaired? # 2.2.32 (dfbe293): /etc/dovecot/dovecot.conf # Object storage plugin version 2.2.32 (afd3ef1) # Pigeonhole version 0.4.20 (11e3001) # OS: Linux 3.16.0-4-amd64 x86_64 Debian 8.9 with mdbox/zlib. Peer -- Heinlein Support GmbH Schwedter Str. 8/9b, 10119 Berlin http://www.heinlein-support.de Tel: 030 / 405051-42 Fax: 030 / 405051-19 Zwangsangaben lt. §35a GmbHG: HRB 93818 B / Amtsgericht Berlin-Charlottenburg, Geschäftsführer: Peer Heinlein -- Sitz: Berlin

1 0

v2.2.32 released
by Timo Sirainen 04 Sep '17

04 Sep '17

https://dovecot.org/releases/2.2/dovecot-2.2.32.tar.gz https://dovecot.org/releases/2.2/dovecot-2.2.32.tar.gz.sig Two more fixes since rc2. And repeating: There are various changes in this release that can be used to significantly reduce disk IO with: 1) NFS storage especially, but I guess also other remote filesystems and even some with local disks 2) When mail storage and INDEX storage are separated * imapc: Info-level line is logged every time when successfully connected to the remote server. This includes local/remote IP/port, which can be useful for matching against external logs. * config: Log a warning if plugin { key=no } is used explicitly. v2.3 will support "no" properly in plugin settings, but for now any value at all for a boolean plugin setting is treated as "yes", even if it's written as explicit "no". This change will now warn that it most likely won't work as intended. + Various optimizations to avoid accessing files/directories when it's not necessary. Especially avoid accessing mail root directories when INDEX directories point to a different filesystem. + mail_location can now include ITERINDEX parameter. This tells Dovecot to perform mailbox listing from the INDEX path instead of from the mail root path. It's mainly useful when the INDEX storage is on a faster storage. + mail_location can now include VOLATILEDIR=<path> parameter. This is used for creating lock files and in future potentially other files that don't need to exist permanently. The path could point to tmpfs for example. This is especially useful to avoid creating lock files to NFS or other remote filesystems. For example: mail_location=sdbox:~/sdbox:VOLATILEDIR=/tmp/volatile/%2.256Nu/%u + mail_location's LISTINDEX=<path> can now contain a full path. This allows storing mailbox list index to a different storage than the rest of the indexes, for example to tmpfs. + mail_location can now include NO-NOSELECT parameter. This automatically deletes any \NoSelect mailboxes that have no children. These mailboxes are sometimes confusing to users. + mail_location can now include BROKENCHAR=<char> parameter. This can be useful with imapc to access mailbox names that aren't valid mUTF-7 charset from remote servers. + If mailbox_list_index_very_dirty_syncs=yes, the list index is no longer refreshed against filesystem when listing mailboxes. This allows the mailbox listing to be done entirely by only reading the mailbox list index. + Added mailbox_list_index_include_inbox setting to control whether INBOX's STATUS information should be cached in the mailbox list index. The default is "no", but it may be useful to change it to "yes", especially if LISTINDEX points to tmpfs. + userdb can return chdir=<path>, which override mail_home for the chdir location. This can be useful to avoid accessing home directory on login. + userdb can return postlogin=<socket> to specify per-user imap/pop3 postlogin socket path. + cassandra: Add support for result paging by adding page_size=<n> parameter to the connect setting. + dsync/imapc, pop3-migration plugin: Strip also trailing tabs from headers when matching mails. This helps with migrations from Zimbra. + imap_logout_format supports now %{appended} and %{autoexpunged} + virtual plugin: Optimize IDLE to use mailbox list index for finding out when something has changed. + Added apparmor plugin. See https://wiki2.dovecot.org/Plugins/Apparmor - virtual plugin: A lot of fixes. In many cases it was also working very inefficiently or even incorrectly. - imap: NOTIFY parameter parsing was incorrectly "fixed" in v2.2.31. It was actually (mostly) working in previous versions, but broken in v2.2.31. - Modseq tracking didn't always work correctly. This could have caused imap unhibernation to fail or IMAP QRESYNC/CONDSTORE extensions to not work perfectly. - mdbox: "Inconsistency in map index" wasn't fixed automatically - dict-ldap: %variable values used in the LDAP filter weren't escaped. - quota=count: quota_warning = -storage=.. was never executed (try #2). v2.2.31 fixed it for -messages, but not for -storage. - imapc: >= 32 kB mail bodies were supposed to be cached for subsequent FETCHes, but weren't. - quota-status service didn't support recipient_delimiter - acl: Don't access dovecot-acl-list files with acl_globals_only=yes - mail_location: If INDEX dir is set, mailbox deletion deletes its childrens' indexes. For example if "box" is deleted, "box/child" index directory was deleted as well (but mails were preserved). - director: v2.2.31 caused rapid reconnection loops to directors that were down.

2 1

Commands loging to mail log
by Slobodan Zdravkovic 04 Sep '17

04 Sep '17

Hi, In case when user login with pop3 and only download only mail headers (partial download), but not email body, there is nothing in mail.log Is it possible to configure one of the existing dovecot plugins to log actions like TOP and LIST or is it possible to write new plugin for dovecot which can fetch this actions ? Thank you and regards,

1 0

Mixed Autehtnication and password schemes
by Raymond Sellars 04 Sep '17

04 Sep '17

Hi Looking for some confirmation/direction on how to achieve the following. We have a requirement to support both SASL PLAIN and DIGEST-MD5 authentication (certification reasons). In addition to this we have an application (webmail) that utilises a master password pattern for access, as the contain web portal provides the necessary authentication. I have access to users passwords in PLAIN text and looking to utilise the dict lookup mechanism for passwords. Problem #1 https://wiki2.dovecot.org/Authentication/MultipleDatabases - "Currently the fallback works only with the PLAIN authentication mechanism." The above not suggests I can't use DIGEST-MD5 with master password configuration, if using more than one passdb setup. I don't understand why there would be a restriction as the password validation should just fall through irrespective. Problem #2 How do I enforce some kind of account access policy Currently we're backing the authentication with an Identity and Authentication system. I would like to block IMAP access if a user's account is locked out, expired, or inactive. Similarly if there are too many IMAP attempts with the incorrect password I would like the account system wide to be locked out. With Dict lookup I don't seem a mechanism to keep the IDM system aware of login attempt/failures, since it pulls the plaintext password and validates internally. Is this possible? As a worse case does Dovecot implement any type of account access policies? Out IT security reviewers are hot on account policies, i.e. lockouts, expiries, and back off attempts. Thanks Raymond Solution Architect - Orion Health

2 4

Pigeonhole 0.4.20 source archive based on v. 0.4.20-rc1?
by Markus Schönhaber 02 Sep '17

02 Sep '17

Hi, looking at the source archive of pigeonhole 0.4.20 <https://pigeonhole.dovecot.org/releases/2.2/dovecot-2.2-pigeonhole-0.4.20.t…> I noticed that the contained ChangeLog mentions v0.4.20.rc1 as first entry and pigeonhole-version.h defines git revision 7cd71ba as version where I'd expect 4a55e6c. This is probably no big deal. But since Makefile.in and install-sh also differ (see attached diff) from the patch contained in <http://xi.rename-it.nl/debian.new/pool/jessie-rc-auto/dovecot-2.2/dovecot_2…> I thought I'd ask whether this is something without importance or something which should be changed. -- Regards mks

2 2

mail_log_events and dsync
by manu＠netbsd.org 02 Sep '17

02 Sep '17

Hello mail_log_events is handy to track what happened to a given message. Unfortunatly, it seems dsync activity is not captured. This causes messages to appear or vanish without a log trace. Did I miss a setting to get it? How should I track how something went wrong with dsync? -- Emmanuel Dreyfus http://hcpnet.free.fr/pubz manu(a)netbsd.org

1 0