- dovecot - dovecot.org

[bug] Auth cache, proxy and ITERINDEX
by azurit＠pobox.sk 17 Apr '18

17 Apr '18

Hi, today we have exceprienced really major difficulties with our proxy backend servers. Everything started after enabling auth cache: auth_cache_size = 100M auth_cache_verify_password_with_worker = yes auth_cache_ttl = 1 hour auth_cache_negative_ttl = 1 hour Soon after we start receiving lots of calls from our customers about 'missing all e-mail messages'. This was in errors logs on master server: Apr 16 14:37:10 server00 dovecot: imap(<censored_email_address>): Error: autoexpunge: Couldn't create dovecot.autoexpunge.lock lock: file_create_locked(/var/mail/vhosts/<censored_domain>/<censored_name>/home/dovecot.autoexpunge.lock) failed: safe_mkstemp(/var/mail/vhosts/<censored_domain>/<censored_name>/home/dovecot.autoexpunge.lock) failed: No such file or directory Looks like that all users, who are placed on proxy backends, were logged correctly BUT not proxied to the right server so they saw empty mailboxes (Dovecot also created some directories on master server). What is worse, their email software deleted all local emails so they are now downloading everything from scratch (100Gs of mails so it will take some time). After auth cache was disabled, things started to go to normal EXCEPT users were reporting they don't see all folders - which was true, only few on them were visible (INBOX, trash, sent etc.). We tried everything to make them visible again, for example deleting indexes, but nothing helped. Finally, removing option ITERINDEX from mail_location helped. Can anyone explain what happened? Thank you azurIt

2 2

spamc scripts in IMAPSieve docs.
by Reio Remma 17 Apr '18

17 Apr '18

Hello! I noticed SpamAssassin *spamc* usage has entered the documentation at https://wiki2.dovecot.org/HowTo/AntispamWithSieve I'm wondering if the -C (report) option in sa-learn-ham.sh should use revoke instead of report for --ham messages? I started using imapsieve with spamc myself just a few weeks ago, but I haven't used the reporting ability yet. Reio

2 4

File system permissions - setgid bit and Netapp NFS volumes
by Shaun Johnson 17 Apr '18

17 Apr '18

Greetings Dovecot List, I have a bit of an edge case I am trying to resolve. I am currently using dovecot on Ubuntu 14.04 - Ubuntu package version: 1:2.2.9-1ubuntu2.3 I have attached the output of doveconf -n to this email - but to describe the configuration in a nutshell: my server is configured to use Maildir storage I do not use dovecot delivery service (there is a separate program in my system delivering messages) I am using a 'checkpassword' mechanism for authentication My mail storage is mounted via NFSv3 from a Netapp Filer FAS3050 configured to set anonuid=89, read write access, and root access. Dovecot has been configured with: mail_fsync = always mail_nfs_index = yes mail_nfs_storage = yes mmap_disable = yes lock_method = fcntl In order to function with the other components of my system, the Mail Storage directories are expected to have permissions: drwx--S--- uid 89: gid 89 The oddity I am encountering came up recently when I set up a job to monitor and correct directory permissions. I found after observing the system in action that overtime, the ~/Maildir directories for all active mailboxes would mysteriously lose the setgid bit. Now, while the system still functioned, it was something unexpected so I investigated further by turning on auditd to monitor what was changing the permissions on the path. After tracing through the results, I found an entry indicating that the 'imap' process of dovecot was performing a 'chown' call on the directory, with an end result of the previous mode 2700 being changed to 0700. Now I understand that on some filesystems, a 'chown' call can end up losing any setuid or setgid bits on an inode - and apparently Netapp's WAFL file system is one of them. Looking at the dovecot source code, I *believe* the source of the chown call is in src/lib/nfs-workarounds.c function nfs_flush_chown_uid - where a 'chown' call is being used to flush NFS attribute caches? for what I believe is the purposes of ascertaining file lock status? My question for you folks is if anyone else has encountered this on other file systems (or filers) - and if there is a native method in dovecot - either the version I am currently running or an updated newer version - that allows one to either retain the permissions assigned to a directory or specify the permissions I expect on the Maildir directory structures. Any feedback would be welcome, thanks! -- Shaun Johnson LinuxMagic Inc. 604-682-0300 Beautiful British Columbia, Canada

2 2

LDAP Homedir location: Needs dovecot restart after change it
by Andre Luiz Paiz 16 Apr '18

16 Apr '18

Dear group members. I work with Dovecot and Openldap authentication. Sometimes users change departments and we need to alter their homedir location. Every time this process is needed, I perform this steps: 1 - Change homedir location in openldap 2 - Move homedir folder to the new location 3 - Re-apply permissions 4 - Remove user index folder After I do that, users cannot authenticate unless I restart dovecot, process that I would like to avoid. Can you guys give a tip on what I need to change to avoid this last problematic step? After the restart, everything works. Does the auth_cache feature also store the homedir location? System: CentOS 7 Versions: dovecot-pigeonhole-2.2.10-8.el7.x86_64 dovecot-2.2.10-8.el7.x86_64 Doveconf -n: # 2.2.10: /etc/dovecot/dovecot.conf # OS: Linux 3.10.0-693.5.2.el7.x86_64 x86_64 CentOS Linux release 7.4.1708 (Core) auth_cache_negative_ttl = 0 auth_cache_size = 10 M auth_mechanisms = plain login auth_username_format = %Ln default_client_limit = 1024 default_process_limit = 1024 default_vsz_limit = 1 G listen = * mail_location = maildir:~/Maildir:INDEX=/var/indexes/dovecot/%u mail_plugins = " mail_log notify quota" mail_temp_dir = /var/tmp managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date ihave imapflags notify mbox_write_locks = fcntl mmap_disable = yes namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } passdb { driver = pam } passdb { args = /etc/dovecot/dovecot-ldap.conf.ext driver = ldap } plugin { mail_log_events = delete undelete expunge copy mailbox_delete mailbox_rename mail_log_fields = uid box msgid size quota = maildir quota_exceeded_message = Cota de armazenamento de e-mails excedida. Quota exceeded for mail store. quota_warning = storage=95%% quota-warning 95 %u quota_warning2 = storage=85%% quota-warning 85 %u quota_warning3 = storage=75%% quota-warning 75 %u sieve = ~/.dovecot.sieve sieve_before = /var/lib/dovecot/sieve/default.sieve sieve_default = /var/lib/dovecot/sieve/default.sieve sieve_dir = ~/sieve sieve_extensions = +notify +imapflags } protocols = imap pop3 lmtp sieve service anvil { client_limit = 14100 process_limit = 1 } service auth-worker { client_limit = 1 process_limit = 50 service_count = 1 } service auth { client_limit = 15100 process_limit = 1 } service dict { client_limit = 1 } service imap-login { inet_listener imap { port = 143 } inet_listener imaps { port = 993 ssl = yes } process_limit = 6000 process_min_avail = 10 service_count = 1 vsz_limit = 256 M } service imap { process_limit = 3000 vsz_limit = 1 G } service lmtp { client_limit = 1 inet_listener lmtp { port = 24 } unix_listener lmtp { mode = 0666 } } service managesieve-login { inet_listener sieve { port = 4190 } } service pop3-login { inet_listener pop3 { port = 110 } inet_listener pop3s { port = 995 ssl = yes } process_limit = 6000 process_min_avail = 10 service_count = 1 } service pop3 { process_limit = 3000 } service quota-warning { executable = script /usr/local/bin/quota-warning.sh unix_listener quota-warning { mode = 0666 user = dovecot } user = root } ssl = required ssl_cert = ********** ssl_key = *********** userdb { driver = passwd } userdb { args = /etc/dovecot/dovecot-ldap.conf.ext driver = ldap } protocol lmtp { mail_plugins = " mail_log notify quota sieve quota" } protocol imap { mail_plugins = " mail_log notify quota imap_quota" } Thanks Andre

2 1

Is FTS needed for Subject/Recipient/Sender server-side searches?
by Sebastian Arcus 16 Apr '18

16 Apr '18

I've had a number of Dovecot installs happily running for quite a few years now, but I've just stumbled over a new issue. I am trying to get some iPhones to do server-side email searches through ActiveSync/Exchange protocol -> Horde -> Dovecot. The bit I can't figure out is if I need to enable and configure FTS in Dovecot for that to work? I've tested server-side email searches against the same Dovecot server on Thunderbird - through IMAP (there is an option to force the search on the server in Thunderbird) - and it is working really well and fast. I am only really interested in Sender/Recipient/Subject searches. Server-side searching is not working at the moment on the iPhones side - although I can see the ActiveSync commands being sent to Horde. Anyway, to begin with, does anybody know if server-side IMAP searches need FTS in Dovecot (Horde is talking to Dovecot through IMAP). The fact that they work fine in Thunderbird would suggest the answer is 'no' - but could someone confirm that is correct please? Anticipated thanks for any hints. I am on Dovecot 2.2.33 if in case it matters.

1 0

Migration from Maildir to mdbox on another server preserving POP3 UIDLS
by DurgaPrasad - DatasoftComnet 15 Apr '18

15 Apr '18

Hi all, Does anyone have a good migration document for Migration from Maildir (old server 2.1.x) to mdbox onto another new server with SIS preserving POP3 UIDLS. Preserving UIDLs is of paramount importance so that clients don't download mails again into outlook. Regards/DP --- This email has been checked for viruses by Avast antivirus software. https://www.avast.com/antivirus

1 0

52.184.164.73 in my logs
by daniel_1983＠protonmail.com 15 Apr '18

15 Apr '18

Dear list, One of my users is reading e-mail from his phone. When he logs in, this is what I see in my logs : Apr 10 16:17:58 auth-worker(17101): Debug: sql(xxx(a)mydomain.tld,52.184.164.73): query: SELECT email as user, password FROM users WHERE email = LOWER('xxx(a)mydomain.tld') [...] Apr 10 16:17:58 imap-login: Info: Login: user=<xxx(a)mydomain.tld>, method=LOGIN, rip=52.184.164.73, lip=10.10.10.19, mpid=19286, TLS, session=<E6cEB4BprgA0uKRJ> Both lines show a remote IP of 52.184.164.73, which is strange since all my users are, and connect from, Algeria. According to the ispinfo website (http://www.ispinfo.net/isp/52.184.164.73.html) this IP belongs to Microsoft. Could it be that the outlook app uses microsoft's servers to fetch the mail before handing them to the user ? Daniel.

2 2

imapsieve fail to pipe to sa-learn-spam.sh
by David Mehler 14 Apr '18

14 Apr '18

Hello, I'm trying to get Dovecot 2.31, pidgeonhole 0.51 going with imapsieve and rspamd. I'm getting the below in my errorlog: cat dovecot.log 2018-04-13 17:35:34 imap-login: Info: Login: user=<testuser(a)domain.com>, method=PLAIN, rip=127.0.0.1, lip=127.0.0.1, mpid=57977, secured, session=<o4T2psFpje5/AAAB> 2018-04-13 17:35:34 imap(testuser(a)domain.com)<57977><o4T2psFpje5/AAAB>: Error: sieve: pipe action: failed to pipe message to program: program `sa-learn-spam.sh' not found 2018-04-13 17:35:34 imap(testuser(a)domain.com)<57977><o4T2psFpje5/AAAB>: Info: sieve: left message in mailbox 'Spam' 2018-04-13 17:35:34 imap(testuser(a)domain.com)<57977><o4T2psFpje5/AAAB>: Error: sieve: Execution of script /usr/home/vmail/sieve/global/report-spam.sieve failed 2018-04-13 17:35:34 imap(testuser(a)domain.com)<57977><o4T2psFpje5/AAAB>: Info: copy from INBOX: box=Spam, uid=1, msgid=, size=1638 2018-04-13 17:35:34 imap(testuser(a)domain.com)<57977><o4T2psFpje5/AAAB>: Info: delete: box=INBOX, uid=2, msgid=, size=1638 2018-04-13 17:35:34 imap(testuser(a)domain.com)<57977><o4T2psFpje5/AAAB>: Info: expunge: box=INBOX, uid=2, msgid=, size=1638 2018-04-13 17:35:34 indexer-worker(testuser(a)domain.com)<59488><o4T2psFpje5/AAAB:5O+4G6Yi0Vpg6AAA0J78UA>: Info: Indexed 0 messages in Spam 2018-04-13 17:35:34 imap(testuser(a)domain.com)<57977><o4T2psFpje5/AAAB>: Info: Logged out in=144 out=1227 deleted=1 expunged=1 trashed=0 hdr_count=0 hdr_bytes=0 body_count=0 body_bytes=0 90-plugin.conf excerpt: plugin { sieve_plugins = sieve_imapsieve sieve_extprograms sieve_before = /home/vmail/sieve/global/admin.sieve sieve = file:/home/vmail/sieve/%d/%n/scripts;active=/home/vmail/sieve/%d/%n/active-script.sieve # Spam learning # From elsewhere to Spam folder imapsieve_mailbox1_name = Spam imapsieve_mailbox1_causes = COPY imapsieve_mailbox1_before = file:/home/vmail/sieve/global/report-spam.sieve # From Spam folder to elsewhere imapsieve_mailbox2_name = * imapsieve_mailbox2_from = Spam imapsieve_mailbox2_causes = COPY imapsieve_mailbox2_before = file:/home/vmail/sieve/global/report-ham.sieve sieve_pipe_bin_dir = /home/vmail/sieve sieve_global_extensions = +vnd.dovecot.pipe +vnd.dovecot.execute +vnd.dovecot.environment Here are my sieve scripts, they have been compiled, and the shell scripts, all are owned and group of vmail:vmail and the scripts are 775. home/vmail/sieve/global#cat report-spam.sieve require ["vnd.dovecot.pipe", "copy", "imapsieve", "environment", "variables"]; if environment :matches "imap.user" "*" { set "username" "${1}"; } pipe :copy "sa-learn-spam.sh" [ "${username}" ]; /home/vmail/sieve/global#cat report-ham.sieve require ["vnd.dovecot.pipe", "copy", "imapsieve", "environment", "variables"]; if environment :matches "imap.mailbox" "*" { set "mailbox" "${1}"; } if string "${mailbox}" "Trash" { stop; } if environment :matches "imap.user" "*" { set "username" "${1}"; } pipe :copy "sa-learn-ham.sh" [ "${username}" ]; /home/vmail/sieve/global#cat sa-learn-spam.sh #!/bin/sh exec /usr/local/bin/rspamc -h /var/run/rspamd/rspamd.sock -P "Password" learn_spam /home/vmail/sieve/global#cat sa-learn-ham.sh #!/bin/sh exec /usr/local/bin/rspamc -h /var/run/rspamd/rspamd.sock -P "password" learn_ham I'd appreciate any suggestions. Thanks. Dave.

2 1

ACL for system users?
by Rubén Fernández Asensio 13 Apr '18

13 Apr '18

Hello all, I'm setting up an IMAP server with dovecot. I've set up system users with PAM authentication and Maildir maiboxes. I'd like to share mailboxes among them, but regardless of what I try, I bump into filesystem permissions. I want to have Maildirs created for new users with the right permissions. I even changed "UMASK" in file /etc/login.defs from 022 to 002, but the Maildirs are still created with 700 permissions: ls -l /home/ximplet2/ total 4 drwx------ 9 ximplet2 users 4096 Apr 12 19:10 Maildir Really there's no better way than running "chmod -R g=u /home/ximplet2/Maildir" and "chmod g+s /home/ximplet2/Maildir" for every user? Really?? I read that, before v.2, Dovecot had a "umask" option to do precisely want I need, but it was removed. How are we supposed to use ACL with system users nowadays? Rubeno P.S: my doveconf -n: # 2.2.31 (65cde28): /etc/dovecot/dovecot.conf # Pigeonhole version 0.4.19 (e5c7051) # OS: Linux 4.4.0-119-generic x86_64 Ubuntu 16.04.4 LTS auth_mechanisms = plain login auth_verbose = yes auth_verbose_passwords = plain mail_access_groups = kundividantoj mail_location = maildir:~/Maildir:LAYOUT=fs mail_plugins = acl managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext imapsieve vnd.dovecot.imapsieve namespace { list = yes location = maildir:%%h/Maildir:INDEXPVT=~/Maildir/Komunujo/%%n prefix = Komunujo/%%n/ subscriptions = no type = shared } namespace inbox { inbox = yes location = mailbox Malnetujo { auto = subscribe comment = Mesaĝoj ne finitaj nek senditaj special_use = \Drafts } mailbox Rubujo { auto = subscribe autoexpunge = 120 days comment = Ĉi tien iras la forviŝitaj mesaĝoj special_use = \Trash } mailbox Senditujo { auto = subscribe special_use = \Sent } mailbox Spamujo { auto = create autoexpunge = 30 days comment = Mesaĝoj markitaj kiel ne deziritaj special_use = \Junk } prefix = subscriptions = yes type = private } passdb { driver = pam } plugin { acl = vfile acl_shared_dict = file:/var/lib/dovecot/kundividitaj/shared-mailboxes imapsieve_mailbox1_before = file:/etc/dovecot/sieve/imapsieve/report-spam.sieve imapsieve_mailbox1_causes = COPY FLAG imapsieve_mailbox1_name = Spamujo imapsieve_mailbox2_before = file:/etc/dovecot/sieve/imapsieve/report-ham.sieve imapsieve_mailbox2_causes = COPY imapsieve_mailbox2_from = Spamujo imapsieve_mailbox2_name = * sieve = file:~/sieve;active=~/.dovecot.sieve sieve_after = /etc/dovecot/sieve/final sieve_extensions = +vnd.dovecot.pipe +vnd.dovecot.debug sieve_global_extensions = +vnd.dovecot.pipe +vnd.dovecot.debug sieve_pipe_bin_dir = /usr/bin sieve_plugins = sieve_imapsieve sieve_extprograms } protocols = " imap lmtp sieve" service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0660 user = postfix } unix_listener auth-userdb { group = mode = 0777 user = } } ssl = required ssl_cert = </etc/ssl/certs/ssl-cert-snakeoil.pem ssl_key = # hidden, use -P to show it userdb { driver = passwd } protocol lda { mail_plugins = acl sieve } protocol imap { mail_plugins = acl imap_acl imap_sieve }

2 2

Re: two unrelated issues, lastlogin, and an out of memory fatal error
by David Mehler 13 Apr '18

13 Apr '18

Hello Aki and everyone, "Increase memory, your cache takes more memory than you have anticipated." What setting do I need to update in dovecot? I hope your not talking about the vps it has 4GB of ram. Thanks. Dave. On 4/12/18, Reio Remma <reio(a)mrstuudio.ee> wrote: > Hey, > > maybe it's like Aki said, you need more memory. :) Other than that I > can't think of anything. :/ > > Good luck, > Reio > > On 12.04.18 2:42, David Mehler wrote: >> Hello, >> >> Thanks a lot. That did it. >> >> Do you have any idea as to my other issue, the fatal out of memory one? >> >> Thanks. >> Dave. >> >> >> On 4/11/18, Reio Remma <reio(a)mrstuudio.ee> wrote: >>> Hello, try: >>> >>> SELECT userid, FROM_UNIXTIME(last_login) FROM users; >>> >>> Reio >>> >>> On 11.04.2018 21:39, David Mehler wrote: >>>> Hi, >>>> >>>> Can I get the database display to display those timestamps in a >>>> particular format? >>>> >>>> Thanks. >>>> Dave. >>>> >>>> >>>> On 4/11/18, Reio Remma <reio(a)mrstuudio.ee> wrote: >>>>> On 11.04.18 18:23, David Mehler wrote: >>>>>> Hello Aki, >>>>>> >>>>>> Thanks for your suggestion. I followed it and the wiki at: >>>>>> >>>>>> https://wiki.dovecot.org/Plugins/LastLogin >>>>>> >>>>>> Good news, I get a record in the users table, with the username that >>>>>> just logged in. This is good. Bad news is I got unexpected output >>>>>> from >>>>>> the last_login time stamp. Here's the table and the user: >>>>>> >>>>>> mysql> describe users; >>>>>> +------------+--------------+------+-----+---------+-------+ >>>>>> | Field | Type | Null | Key | Default | Extra | >>>>>> +------------+--------------+------+-----+---------+-------+ >>>>>> | userid | varchar(255) | NO | PRI | NULL | | >>>>>> | last_login | int(11) | YES | | NULL | | >>>>>> +------------+--------------+------+-----+---------+-------+ >>>>>> 2 rows in set (0.00 sec) >>>>>> >>>>>> mysql> select * from users; >>>>>> +------------------------+------------+ >>>>>> | userid | last_login | >>>>>> +------------------------+------------+ >>>>>> | user(a)domain.com | 1523459718 | >>>>>> +------------------------+------------+ >>>>>> 1 row in set (0.01 sec) >>>>>> >>>>>> >>>>>> The issue is the 1523459718 I was expecting something like a time >>>>>> stamp. Is this fixable? Also, can I use last_login to see on which IP >>>>>> the user last logged in from? >>>>> SELECT FROM_UNIXTIME(1523459718) >>>>> >>>>> Maybe that will help? >>>>> >>>>> Good luck, >>>>> Reio >>>>> >>> > > > -- > Tervitades > Reio Remma > > > MR Stuudio 25 aastat > > *MR Stuudio OÜ* > Tondi 17b, 11316, Tallinn > Tel +372 650 4808 > Mob +372 56 22 00 33 > reio(a)mrstuudio.ee > www.mrstuudio.ee > > > >

1 0