- dovecot - dovecot.org

Selective authentication mechanism
by Brian Topping 16 Feb '18

16 Feb '18

Hi all! I have been using GSSAPI authentication method for all my externally reachable endpoints for some time under the theory that they cannot be hit with a dictionary attack. Unfortunately, this means iOS devices cannot log in since they (oddly) cannot use GSSAPI. I say “oddly” because desktop Mac mail can use GSSAPI just fine and https://samuelyates.wordpress.com/2013/10/11/kerberos-single-sign-on-in-ios… goes through how to set it up for web pages. In any event, what I’m looking to do is use a filter (https://wiki.dovecot.org/ConfigFile#Filters) around the auth_mechanisms such that it will allow plain authentication when the client is on a local network or the VPN. Unfortunately, the fine print on filters says "These filters work for most of the settings, but most importantly auth settings currently only support the protocol filter”. I guess it’s kind of academic, but I thought I’d ask why this is a limitation? If there is not a profound security reason to not support this, is this a good enough use case to consider it? Thanks! Brian

2 1

ACLs, shared, public, virtual mailboxes not working
by David Mehler 15 Feb '18

15 Feb '18

Hello, I'm running Dovecot 2.2.3, and am having issues with my public folders, shared folders, and virtual/ALl folders apparently ACLs are on that list as well. I was debugging an unrelated problem with my smtp server and got the following dovecot debug log output. Below is also a doveconf -n output as well as my shared-folder definition file and my global-acls file. What I'm trying to accomplish is: 1. Have a public folder that any user on the system can put messages into and respond to. 2. Have a shared folder in which user1(a)example.com and user1(a)example2.com can exchange messages. 3. For each user on the system give them a Virtual/All folder for *all of their messages. I'd appreciate any help. As an aside if anyone sees an issue with my SSL ciphers list i'd appreciate knowing that as well, in brief I'm trying to get the most secure list, pfs, and not worrying about backware compatibility. If it's not TLS 1.2 I don't touch it. Thanks. Dave. Feb 12 08:48:40 imap(user(a)example.com): Debug: Module loaded: /usr/local/lib/dovecot/lib01_acl_plugin.so Feb 12 08:48:40 imap(user(a)example.com): Debug: Module loaded: /usr/local/lib/dovecot/lib02_imap_acl_plugin.so Feb 12 08:48:40 imap(user(a)example.com): Debug: Effective uid=999, gid=999, home=/home/vmail/example.com/user Feb 12 08:48:40 imap(user(a)example.com): Debug: Namespace inbox: type=private, prefix=, sep=/, inbox=yes, hidden=no, list=yes, subscriptions=yes location=maildir:~/mail/:LAYOUT=fs:INDEX=~/mail/ Feb 12 08:48:40 imap(user(a)example.com): Debug: fs: root=/home/vmail/example.com/user/mail, index=, indexpvt=, control=, inbox=/home/vmail/example.com/user/mail, alt= Feb 12 08:48:40 imap(user(a)example.com): Debug: acl: initializing backend with data: vfile:/usr/local/etc/dovecot/global-acls:cache_secs=300 Feb 12 08:48:40 imap(user(a)example.com): Debug: acl: acl username = user(a)example.com Feb 12 08:48:40 imap(user(a)example.com): Debug: acl: owner = 1 Feb 12 08:48:40 imap(user(a)example.com): Debug: acl vfile: Global ACL file: /usr/local/etc/dovecot/global-acls Feb 12 08:48:40 imap(user(a)example.com): Debug: Namespace : type=public, prefix=public/, sep=/, inbox=no, hidden=no, list=yes, subscriptions=yes location=maildir:/home/vmail/public/:LAYOUT=fs:CONTROL=~/mail/public:INDEXPVT=~/mail/public:INDEX=~/mail/public Feb 12 08:48:40 imap(user(a)example.com): Debug: fs: root=/home/vmail/public, index=/home/vmail/example.com/user/mail/public, indexpvt=/home/vmail/example.com/user/mail/public, control=/home/vmail/example.com/user/mail/public, inbox=, alt= Feb 12 08:48:40 imap(user(a)example.com): Debug: acl: initializing backend with data: vfile:/usr/local/etc/dovecot/global-acls:cache_secs=300 Feb 12 08:48:40 imap(user(a)example.com): Debug: acl: acl username = user(a)example.com Feb 12 08:48:40 imap(user(a)example.com): Debug: acl: owner = 0 Feb 12 08:48:40 imap(user(a)example.com): Debug: acl vfile: Global ACL file: /usr/local/etc/dovecot/global-acls Feb 12 08:48:40 imap(user(a)example.com): Debug: Namespace : type=shared, prefix=shared/%u/, sep=/, inbox=no, hidden=no, list=yes, subscriptions=yes location=maildir:~/mail/:INDEX=~/mail/shared/%Ld/%Ln Feb 12 08:48:40 imap(user(a)example.com): Debug: shared: root=/var/run/dovecot, index=, indexpvt=, control=, inbox=, alt= Feb 12 08:48:40 imap(user(a)example.com): Debug: acl: initializing backend with data: vfile:/usr/local/etc/dovecot/global-acls:cache_secs=300 Feb 12 08:48:40 imap(user(a)example.com): Debug: acl: acl username = user(a)example.com Feb 12 08:48:40 imap(user(a)example.com): Debug: acl: owner = 0 Feb 12 08:48:40 imap(user(a)example.com): Debug: acl vfile: Global ACL file: /usr/local/etc/dovecot/global-acls Feb 12 08:48:40 imap(user(a)example.com): Debug: Namespace : type=private, prefix=virtual/, sep=/, inbox=no, hidden=no, list=yes, subscriptions=yes location=virtual:/usr/local/etc/dovecot/virtual Feb 12 08:48:40 imap(user(a)example.com): Debug: fs: root=/usr/local/etc/dovecot/virtual, index=, indexpvt=, control=, inbox=, alt= Feb 12 08:48:40 imap(user(a)example.com): Debug: acl: initializing backend with data: vfile:/usr/local/etc/dovecot/global-acls:cache_secs=300 Feb 12 08:48:40 imap(user(a)example.com): Debug: acl: acl username = user(a)example.com Feb 12 08:48:40 imap(user(a)example.com): Debug: acl: owner = 1 Feb 12 08:48:40 imap(user(a)example.com): Debug: acl vfile: Global ACL file: /usr/local/etc/dovecot/global-acls Feb 12 08:48:40 imap(user(a)example.com): Debug: quota: quota_over_flag check: quota_over_script unset - skipping Feb 12 08:48:40 imap(user(a)example.com): Debug: acl vfile: file /home/vmail/example.com/user/mail/dovecot-acl not found Feb 12 08:48:40 imap(user(a)example.com): Debug: acl vfile: file /home/vmail/example.com/user/mail/Drafts/dovecot-acl not found Feb 12 08:48:40 imap(user(a)example.com): Debug: acl vfile: file /home/vmail/example.com/user/mail/Spam/dovecot-acl not found Feb 12 08:48:40 imap(user(a)example.com): Debug: acl vfile: file /home/vmail/example.com/user/mail/Trash/dovecot-acl not found Feb 12 08:48:40 imap(user(a)example.com): Debug: acl vfile: file /home/vmail/example.com/user/mail/Sent/dovecot-acl not found Feb 12 08:48:40 imap(user(a)example.com): Debug: acl vfile: file /home/vmail/example.com/user/mail/Archives/dovecot-acl not found Feb 12 08:48:40 imap(user(a)example.com): Debug: acl vfile: file /home/vmail/example.com/user/mail/logcheck/dovecot-acl not found Feb 12 08:48:40 imap(user(a)example.com): Debug: acl vfile: file /home/vmail/example.com/user/mail/public/dovecot-acl not found Feb 12 08:48:40 imap(user(a)example.com): Debug: Mailbox 'public/TestFolder' matches global ACL pattern 'public/TestFolder' Feb 12 08:48:40 imap(user(a)example.com): Debug: acl vfile: file /home/vmail/example.com/user/mail/public/TestFolder/dovecot-acl not found Feb 12 08:48:40 imap(user(a)example.com): Debug: acl vfile: file /home/vmail/example.com/user/mail/virtual/dovecot-acl not found Feb 12 08:48:40 imap(user(a)example.com): Debug: acl vfile: file /home/vmail/example.com/user/mail/.Junk/dovecot-acl not found Feb 12 08:48:40 imap(user(a)example.com): Debug: acl vfile: file /home/vmail/example.com/user/mail/ham/dovecot-acl not found Feb 12 08:48:40 imap(user(a)example.com): Debug: acl vfile: file /home/vmail/example.com/user/mail/fail2ban/dovecot-acl not found Feb 12 08:48:40 imap(user(a)example.com): Debug: acl vfile: file /home/vmail/example.com/user/mail/.Sent/dovecot-acl not found Feb 12 08:48:40 imap(user(a)example.com): Debug: acl vfile: file /home/vmail/example.com/user/mail/.Trash/dovecot-acl not found Feb 12 08:48:40 imap(user(a)example.com): Debug: acl vfile: file /home/vmail/example.com/user/mail/Maildir/dovecot-acl not found Feb 12 08:48:40 imap(user(a)example.com): Debug: acl vfile: file /home/vmail/example.com/user/mail/Maildir/public/dovecot-acl not found Feb 12 08:48:40 imap(user(a)example.com): Debug: acl vfile: file /home/vmail/example.com/user/mail/Maildir/public/.TestFolder/dovecot-acl not found Feb 12 08:48:40 imap(user(a)example.com): Debug: acl vfile: file /home/vmail/example.com/user/mail/Deleted Items/dovecot-acl not found Feb 12 08:48:40 imap(user(a)example.com): Debug: acl vfile: file /home/vmail/example.com/user/mail/Archive/dovecot-acl not found Feb 12 08:48:40 imap(user(a)example.com): Debug: acl vfile: file /home/vmail/example.com/user/mail/Junk/dovecot-acl not found Feb 12 08:48:40 imap(user(a)example.com): Debug: Mailbox 'public/TestFolder' matches global ACL pattern 'public/TestFolder' Feb 12 08:48:40 imap(user(a)example.com): Debug: acl vfile: reading file /home/vmail/public/TestFolder/dovecot-acl Feb 12 08:48:40 imap(user(a)example.com): Debug: acl vfile: reading file /home/vmail/public/TestFolder1/dovecot-acl Feb 12 08:48:40 imap(user(a)example.com): Debug: acl vfile: reading file /home/vmail/public/dovecot-acl Feb 12 08:48:40 imap(user(a)example.com): Debug: acl: No lookup right to mailbox: public/TestFolder1 Feb 12 08:48:40 imap(user(a)example.com): Debug: Namespace shared/: Using permissions from : mode=0700 gid=default Feb 12 08:48:40 imap(user(a)example.com): Debug: acl vfile: file /usr/local/etc/dovecot/virtual/dovecot-acl not found Feb 12 08:48:40 imap(user(a)example.com): Debug: acl vfile: file /usr/local/etc/dovecot/virtual/All/dovecot-acl not found doveconf -n # 2.2.33.2 (d6601f4ec): /usr/local/etc/dovecot/dovecot.conf # Pigeonhole version 0.4.21 (92477967) # OS: FreeBSD 11.1-RELEASE-p4 amd64 auth_default_realm = example.com auth_mechanisms = plain login auth_realms = example.com example2.com dict { acl = mysql:/usr/local/etc/dovecot/shared-folders.conf sqlquota = mysql:/usr/local/etc/dovecot/quota.conf } first_valid_gid = 999 first_valid_uid = 999 hostname = mail.example.com imap_client_workarounds = delay-newmail tb-extra-mailbox-sep tb-lsub-flags last_valid_gid = 999 last_valid_uid = 999 lda_mailbox_autocreate = yes lda_mailbox_autosubscribe = yes listen = 127.0.0.1 xxx.xxx.xxx.xxx lmtp_rcpt_check_quota = yes mail_access_groups = vmail mail_fsync = never mail_gid = vmail mail_home = /home/vmail/%d/%n mail_location = maildir:~/mail/:LAYOUT=fs:INDEX=~/mail/ mail_plugins = acl mail_log notify quota quota_clone trash virtual welcome zlib mail_server_admin = mailto:postmaster@example.com mail_uid = vmail mailbox_list_index = yes managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext imapflags notify imapsieve vnd.dovecot.imapsieve namespace { hidden = no list = yes location = maildir:/home/vmail/public/:LAYOUT=fs:CONTROL=~/mail/public:INDEXPVT=~/mail/public:INDEX=~/mail/public mailbox TestFolder { auto = subscribe comment = Public Folder for message sharing } prefix = public/ separator = / subscriptions = yes type = public } namespace { list = yes location = maildir:~/mail/:INDEX=~/mail/shared/%%Ld/%%Ln prefix = shared/%%u/ separator = / subscriptions = yes type = shared } namespace { location = virtual:/usr/local/etc/dovecot/virtual mailbox All { auto = subscribe comment = All my messages special_use = \All } prefix = virtual/ separator = / } namespace inbox { inbox = yes location = mailbox Archive { auto = no special_use = \Archive } mailbox Archives { auto = subscribe special_use = \Archive } mailbox "Deleted Messages" { auto = no autoexpunge = 30 days special_use = \Trash } mailbox Drafts { auto = subscribe special_use = \Drafts } mailbox Junk { auto = no autoexpunge = 30 days special_use = \Junk } mailbox "Junk E-mail" { auto = no autoexpunge = 30 days special_use = \Junk } mailbox Sent { auto = subscribe special_use = \Sent } mailbox "Sent Items" { auto = no special_use = \Sent } mailbox "Sent Messages" { auto = no special_use = \Sent } mailbox Spam { auto = subscribe autoexpunge = 30 days special_use = \Junk } mailbox Trash { auto = subscribe autoexpunge = 30 days special_use = \Trash } prefix = separator = / type = private } passdb { args = /usr/local/etc/dovecot/dovecot-sql.conf.ext driver = sql } plugin { acl = vfile:/usr/local/etc/dovecot/global-acls:cache_secs=300 acl_anyone = allow acl_shared_dict = proxy::acl imapsieve_mailbox1_before = file:/usr/local/lib/dovecot/sieve/report-spam.sieve imapsieve_mailbox1_causes = COPY imapsieve_mailbox1_name = Spam imapsieve_mailbox2_before = file:/usr/local/lib/dovecot/sieve/report-ham.sieve imapsieve_mailbox2_causes = COPY imapsieve_mailbox2_from = Spam imapsieve_mailbox2_name = * mail_log_events = delete undelete expunge copy mailbox_delete mailbox_rename mail_log_fields = uid box msgid size quota = count:User quota quota_clone_dict = proxy::sqlquota quota_exceeded_message = Storage quota for this account has been exceeded, please try again later. quota_grace = 10%% quota_status_nouser = DUNNO quota_status_overquota = 552 5.2.2 Mailbox is full quota_status_success = DUNNO quota_vsizes = true quota_warning = storage=100%% quota-exceeded 100 %u quota_warning2 = storage=95%% quota-warning 95 %u quota_warning3 = storage=90%% quota-warning 90 %u quota_warning4 = storage=85%% quota-warning 85 %u quota_warning5 = storage=75%% quota-warning 75 %u sieve = ~/.dovecot.sieve sieve_before = /home/vmail/sieve/before.d sieve_default = /home/vmail/sieve/default.sieve sieve_dir = ~/sieve sieve_extensions = +notify +imapflags sieve_global_dir = /home/vmail/sieve sieve_global_extensions = +vnd.dovecot.pipe +vnd.dovecot.execute sieve_max_redirects = 30 sieve_max_script_size = 1M sieve_pipe_bin_dir = /usr/local/lib/dovecot/sieve sieve_plugins = sieve_imapsieve sieve_extprograms sieve_user_log = /home/vmail/sieve/sieve_error.log trash = /usr/local/etc/dovecot/trash.conf welcome_script = welcome %u welcome_wait = yes } postmaster_address = postmaster(a)example.com protocols = imap lmtp sieve sendmail_path = /usr/local/sbin/sendmail service auth-worker { user = $default_internal_user } service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0660 user = postfix } unix_listener auth-userdb { group = vmail mode = 0666 user = vmail } } service dict { unix_listener dict { group = vmail mode = 0660 user = vmail } } service imap-login { inet_listener imap { address = 127.0.0.1 port = 143 } inet_listener imaps { address = xxx.xxx.xxx.xxx port = 993 ssl = yes } } service imap { executable = imap } service lmtp { unix_listener /var/spool/postfix/private/dovecot-lmtp { group = postfix mode = 0660 user = postfix } } service managesieve-login { inet_listener sieve { address = 127.0.0.1 port = 4190 } } service quota-status { client_limit = 1 executable = quota-status -p postfix unix_listener /var/spool/postfix/private/dovecot-quota { group = postfix mode = 0660 user = postfix } } service quota-warning { executable = script /usr/local/etc/dovecot/quota-warning.sh unix_listener quota-warning { group = vmail mode = 0660 user = vmail } user = vmail } service welcome { executable = script /usr/local/etc/dovecot/welcome.sh unix_listener welcome { user = vmail } user = vmail } ssl = required ssl_cert = </usr/local/etc/ssl/acme/example.com/fullchain.pem ssl_cipher_list = ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256@STRENGTH ssl_dh_parameters_length = 2048 ssl_key = # hidden, use -P to show it ssl_options = no_compression ssl_prefer_server_ciphers = yes ssl_protocols = !SSLv2 !SSLv3 !TLSv1 !TLSv1.1 userdb { args = /usr/local/etc/dovecot/dovecot-sql.conf.ext driver = sql } protocol lmtp { mail_plugins = acl mail_log notify quota quota_clone trash virtual welcome zlib quota sieve } protocol lda { mail_fsync = optimized mail_plugins = acl mail_log notify quota quota_clone trash virtual welcome zlib sieve } protocol imap { mail_plugins = acl mail_log notify quota quota_clone trash virtual welcome zlib imap_acl imap_quota imap_sieve imap_zlib last_login } shared-folders.conf connect = DatabaseConnectionParameters # For shared mailboxes map { pattern = shared/shared-boxes/user/$to/$from table = user_shares value_field = dummy fields { from_user = $from to_user = $to } } # To share mailbox to anyone uncomment acl_anyone=allow in # 90-acl.conf map { pattern = shared/shared-boxes/anyone/$from table = anyone_shares value_field = dummy fields { from_user = $from } } global-acls public/TestFolder user=user lrwstipekxa

2 4

Segfault on selecting mailbox twice in a row
by John van der Kamp 15 Feb '18

15 Feb '18

Hi, I was doing some testing with new 2.2 changes. I’m using commit 15d5b8a from origin/master-2.2. The setup is using imapc to connect to a different imap server. If I use the following commands, dovecot will crash every time: A login username password B select inbox C select inbox The logfile snippit is at the end of the mail. Let me know if you need more information. John ---- Feb 15 15:43:06 imap(user1(a)domain.com): Debug: imapc: root=/tmp/tmpVuVTYr/dovecot1/users/user1(a)domain.com/imapc, index=, indexpvt=, control=, inbox=, alt= Feb 15 15:43:06 imap(user1(a)domain.com): Debug: maildir++: root=/tmp/tmpVuVTYr/dovecot1/users/user1(a)domain.com/imapc, index=, indexpvt=, control=, inbox=, alt= Feb 15 15:43:09 imap(user1(a)domain.com): Debug: INBOX: Mailbox opened because: SELECT Feb 15 15:43:12 imap(user1(a)domain.com): Debug: INBOX: Mailbox opened because: SELECT Feb 15 15:43:14 imap(user1(a)domain.com): Error: Log synchronization error at seq=2,offset=80372 for /tmp/tmpVuVTYr/dovecot1/users/user1(a)domain.com/imapc/.INBOX/dovecot.index: Append with UID 10, but next_uid = 10421 Feb 15 15:43:14 imap(user1(a)domain.com): Warning: fscking index file /tmp/tmpVuVTYr/dovecot1/users/user1(a)domain.com/imapc/.INBOX/dovecot.index Feb 15 15:43:14 imap(user1(a)domain.com): Warning: imapc(127.0.0.1:31513): Mailbox 'INBOX' state corrupted: Expunged message uid=10 reappeared - reconnecting (delay 0 ms) Feb 15 15:43:14 imap(user1(a)domain.com): Debug: imapc(127.0.0.1:31513): Disconnected Feb 15 15:43:14 imap(user1(a)domain.com): Debug: imapc(127.0.0.1:31513): Looking up IP address (reconnect_ok=false, last_connect=1518705794) Feb 15 15:43:14 imap(user1(a)domain.com): Debug: imapc(127.0.0.1:31513): Connecting to 127.0.0.1:31513 Feb 15 15:43:14 imap(user1(a)domain.com): Panic: file imapc-client.c: line 410 (imapc_client_mailbox_reconnect): assertion failed: (!box->reconnecting) Feb 15 15:43:14 imap(user1(a)domain.com): Error: Raw backtrace: /usr/local/lib/dovecot/libdovecot.so.0(+0x9fe12) [0x7f2a05301e12] -> /usr/local/lib/dovecot/libdovecot.so.0(+0x9fefd) [0x7f2a05301efd] -> /usr/local/lib/dovecot/libdovecot.so.0(i_fatal+0) [0x7f2a052924d1] -> /usr/local/lib/dovecot/libdovecot-storage.so.0(+0x99704) [0x7f2a0562f704] -> /usr/local/lib/dovecot/libdovecot-storage.so.0(imapc_mailbox_set_corrupted+0xe3) [0x7f2a05628e63] -> /usr/local/lib/dovecot/libdovecot-storage.so.0(+0x97cf5) [0x7f2a0562dcf5] -> /usr/local/lib/dovecot/libdovecot-storage.so.0(+0x97d70) [0x7f2a0562dd70] -> /usr/local/lib/dovecot/libdovecot-storage.so.0(imapc_mailbox_sync_init+0x8bd) [0x7f2a0562e89d] -> /usr/local/lib/dovecot/libdovecot-storage.so.0(mailbox_sync_init+0x44) [0x7f2a055e1c14] -> /usr/local/lib/dovecot/libdovecot-storage.so.0(mailbox_sync+0x37) [0x7f2a055e1cb7] -> dovecot/imap(cmd_select_full+0x171) [0x413e51] -> dovecot/imap(command_exec+0x5c) [0x41b06c] -> dovecot/imap() [0x419662] -> dovecot/imap() [0x4196ec] -> dovecot/imap(client_handle_input+0x155) [0x419a85] -> dovecot/imap(client_input+0x82) [0x419ff2] -> /usr/local/lib/dovecot/libdovecot.so.0(io_loop_call_io+0x52) [0x7f2a053180d2] -> /usr/local/lib/dovecot/libdovecot.so.0(io_loop_handler_run_internal+0x109) [0x7f2a053197c9] -> /usr/local/lib/dovecot/libdovecot.so.0(io_loop_handler_run+0x3c) [0x7f2a0531816c] -> /usr/local/lib/dovecot/libdovecot.so.0(io_loop_run+0x38) [0x7f2a05318318] -> /usr/local/lib/dovecot/libdovecot.so.0(master_service_run+0x13) [0x7f2a0529cd93] -> dovecot/imap(main+0x302) [0x40cb92] -> /lib/x86_64-linux-gnu/libc.so.6(__libc_start_main+0xf0) [0x7f2a04eb8830] -> dovecot/imap(_start+0x29) [0x40cd19] Feb 15 15:43:14 imap(user1(a)domain.com): Fatal: master: service(imap): child 9496 killed with signal 6 (core dumped)

2 1

Re: Problem with CentOS package for 2.3.0 and old dependency in systemd with clean install
by TG Servers 15 Feb '18

15 Feb '18

Ok thanks, for the moment : can I just delete the lines in the dovecot-init.service file or what is proposed here? It's no problem for me to make the necessary changes I just need to know which of them because I don't know if you just need this fiel internally or not. Thanks Am 14.02.2018 um 21:28 schrieb Aki Tuomi: > We are planning to fix this for 2.3.1 release. > > > > --- > Aki Tuomi > Dovecot oy > > -------- Original message -------- > From: TG Servers <srvrs(a)prvtmail.net> > Date: 14/02/2018 22:10 (GMT+02:00) > To: dovecot(a)dovecot.org > Subject: Re: Problem with CentOS package for 2.3.0 and old dependency in > systemd with clean install > > Hi, > > are there any news on this? > Or do we have to go the way install old dovecot/remove it or upgrade > instead of clean install? > Because as the ssl-params executaböe is missing in 2.3.0 I don't know > how else I should create it. If this file isn't even needed for 2.3.0 > can it be a file with any content eg 'touch > /var/lib/dovecot/ssl-parameters.dat' so that the file is just there and > dovecot-init.servive doesn't want to call the > /usr/libexec/dovecot/ssl-params executable? > > Thanks, > Thomas > > Am 02.02.2018 um 09:26 schrieb Aki Tuomi: >> >>> On February 2, 2018 at 5:09 AM TG Servers wrote: >>> >>> >>> Hi, >>> >>> you definitely have a problem with the packages out of your own repo for >>> version 2.3.0 and CentOS. >>> And this is only if you do a clean install, meaning there was no lower >>> dovecot version ever running on the system. >>> >>> If you want to 'systemctl start dovecot' it breaks with a dependency >>> error which comes from dovecot-init.service. >>> >>> dovecot-init.service : >>> [Unit] >>> Description=One-time Dovecot init service >>> ConditionPathExists=|!/var/lib/dovecot/ssl-parameters.dat >>> ConditionPathExists=|!/etc/pki/dovecot/certs/dovecot.pem >>> >>> [Service] >>> Type=oneshot >>> RemainAfterExit=no >>> ExecStart=/bin/sh -c '\ >>> if [ ! -f /etc/pki/dovecot/certs/dovecot.pem ]; \ >>> then\ >>> SSLDIR=/etc/pki/dovecot/ >>> OPENSSLCONFIG=/etc/pki/dovecot/dovecot-openssl.cnf >>> /usr/libexec/dovecot/mkcert.sh /dev/null 2>&1;\ >>> fi;\ >>> if [ ! -f /var/lib/dovecot/ssl-parameters.dat ]; \ >>> then\ >>> /usr/libexec/dovecot/ssl-params >/dev/null 2>&1; \ >>> fi' >>> >>> It wants to call /usr/libexec/dovecot/ssl-params if >>> /var/lib/dovecot/ssl-parameters.dat (which is deprecated now as I >>> understood) is not existing. >>> The problem is in 2.3.0 /usr/libexec/dovecot/ssl-params is not existent >>> anymore. >>> >>> This error does not occur if you for instance install 2.2.x from the >>> base repo, start it once, and then update the version from your repo. >>> This is because the ssl-parameters.dat was created with the old version >>> then. >>> >>> But this should not be the expected behaviour I think. It should be >>> possible to do a fresh install of 2.3.0 on a fresh system. >>> >>> Can you please get back to me on that? >>> >>> Thanks, >>> Thomas >> >> >> Thank you for reporting this, we'll look into it. >> >> --- >> Aki Tuomi >> >> Dovecot oy >>

2 1

doveadm with wildcard users?
by ＠lbutlr 14 Feb '18

14 Feb '18

# 2.2.33.2 (d6601f4ec): If I do doveadm index -u user "*" for a local user, it works fine, but if I do doveadm -u "*(a)sqldomain.tld" "*" or doveadm -u "*(a)localaliasdomain.tld" "*" or doveadm -u "*(a)localdomain.tld" "*" or doveadm -u "user(a)localdomain.tld" "*" it fails, … -u "user(a)sqldomain.tld" Seems to work <https://wiki2.dovecot.org/Tools/Doveadm/Index> -u user/mask Run the command only for the given user. It's also possible to use '*' and '?' wildcards (e.g. -u *(a)example.org)

2 4

Problem with CentOS package for 2.3.0 and old dependency in systemd with clean install
by TG Servers 14 Feb '18

14 Feb '18

Hi, you definitely have a problem with the packages out of your own repo for version 2.3.0 and CentOS. And this is only if you do a clean install, meaning there was no lower dovecot version ever running on the system. If you want to 'systemctl start dovecot' it breaks with a dependency error which comes from dovecot-init.service. dovecot-init.service : [Unit] Description=One-time Dovecot init service ConditionPathExists=|!/var/lib/dovecot/ssl-parameters.dat ConditionPathExists=|!/etc/pki/dovecot/certs/dovecot.pem [Service] Type=oneshot RemainAfterExit=no ExecStart=/bin/sh -c '\ if [ ! -f /etc/pki/dovecot/certs/dovecot.pem ]; \ then\ SSLDIR=/etc/pki/dovecot/ OPENSSLCONFIG=/etc/pki/dovecot/dovecot-openssl.cnf /usr/libexec/dovecot/mkcert.sh /dev/null 2>&1;\ fi;\ if [ ! -f /var/lib/dovecot/ssl-parameters.dat ]; \ then\ /usr/libexec/dovecot/ssl-params >/dev/null 2>&1; \ fi' It wants to call /usr/libexec/dovecot/ssl-params if /var/lib/dovecot/ssl-parameters.dat (which is deprecated now as I understood) is not existing. The problem is in 2.3.0 /usr/libexec/dovecot/ssl-params is not existent anymore. This error does not occur if you for instance install 2.2.x from the base repo, start it once, and then update the version from your repo. This is because the ssl-parameters.dat was created with the old version then. But this should not be the expected behaviour I think. It should be possible to do a fresh install of 2.3.0 on a fresh system. Can you please get back to me on that? Thanks, Thomas

2 3

Documentation Bug
by Andrew Beck 13 Feb '18

13 Feb '18

In https://wiki2.dovecot.org/Tools/Doveadm/Sync#section_arguments the destination list 5 possible options for the destination but in the page on migration https://wiki2.dovecot.org/Migration/Dsync it seems to use a sixth undocumented "imapc:" option for destination e.g. doveadm -o mail_fsync=never backup -R -u user@domain imapc: "imapc:" is also referenced on https://wiki2.dovecot.org/Migration/Gmail Is https://wiki2.dovecot.org/Tools/Doveadm/Sync#section_arguments missing this option? Andrew

3 2

deny passdb match messages logged only with auth_verbose=yes
by Marco Giunta 13 Feb '18

13 Feb '18

Hi at all, using deny passwd to restrict IMAP/POP3 access (https://wiki.dovecot.org/Authentication/RestrictAccess) I get deny passdb match messages: Feb 13 16:09:33 server-02 dovecot: auth: passwd-file(USERNAME,10.10.10.46,<9hzaYRllbsCTehgu>): User found from deny passdb only with auth_verbose=yes, sets global or defined in passdb block. But if I set auth_verbose=yes, for every user not present in passwd-file, Dovecot logs: Feb 13 16:09:57 server-02 dovecot: auth: passwd-file(USERNAME,10.10.10.46,<9hzaYRllbsCTehgu>): unknown user I know that if the account does not exist in the first passdb (deny passdb), then the error occur, even if it exists in the other passdb. This is normal, but auth_verbose shouldn't be used only to " Log unsuccessful authentication attempts and the reasons why they failed." ?? Again, I'm not a programmer, but 'auth_request_log_info' function in 'https://github.com/dovecot/core/blob/release-2.2.33/src/auth/auth-request.c' seems to log events only when 'auth_verbose=yes'. Is there another way to get deny passdb match messages, without enable verbose log ? Thanks, Marco -- Marco Giunta - ITCS SysAdmin Via Bonomea, 265 34136 - Trieste, Italy Tel: +39-040-3787-503 Fax: +39-040-3787-244

1 0

Certificate of package repository expired
by Marc Weustink 13 Feb '18

13 Feb '18

Hi, I just happened to do an apt update and got a notice that repo.dovecot.org was disabled. According to firefox: repo.dovecot.org uses an invalid security certificate. The certificate expired on dinsdag 13 februari 2018 12:48. The current time is dinsdag 13 februari 2018 16:39. Thanks, Marc

2 2

dovecot: master: Panic: kevent() failed: Invalid argument
by Adrian Gonzalez 13 Feb '18

13 Feb '18

Hello I've been seeing these panics with dovecot 2.2.31 (and older versions) under FreeBSD about once every 2-3 months or so. I know it's been discussed here in the list, but I didn't see a definitive fix. If it's been fixed, please ignore this post (sorry!). I finally managed to observe the bug on a server that has the patch that prints out the kevent() timespec values and got: Nov 29 16:46:27 mail dovecot: master: Panic: kevent(events=74, ts=59.1000000000) failed: Invalid argument Looking through the code, the panic is triggered in io_loop_handler_run_internal(). The timeout values for the kevent() call are obtained by calling io_loop_get_wait_time(), which in turn calls timeout_get_wait_time() (both in ioloop.c). The timeout is computed by subtracting the value returned by gettimeofday() from timeout->next_run, and it looks like in very rare cases the result in tv_r->tv_usec is 1000000uS (1 second). So, it seems that if gettimeofday() returns exactly 0 microseconds, and timeout->next_run has exactly 1000000 microseconds, the kevent() call will fail (1 in 1e12 chance?). I'm not entirely sure where timeout->next_run is computed, but looking at timeout_update_next(), it adjusts the seconds only if the microseconds are greater than 1000000: (ioloop.c, line 235) if (timeout->next_run.tv_usec > 1000000) { timeout->next_run.tv_sec++; timeout->next_run.tv_usec -= 1000000; } It seems like the comparison here should be greater or equal, but I'm not familiar enough with the code to say with absolute certainty. I added more debug error messages to the code in timeout_update_next(), and although I do see next_run->tv_usec at 1000000 several times a day, I haven't seen a panic since early December on any of our servers, so I decided to post this to see if this analysis makes sense.

2 1