- dovecot - dovecot.org

Re: How to limit Apple Mail (desktop)?
by Joseph Tam 01 Nov '17

01 Nov '17

"@lbutlr" <kremels(a)kreme.com> writes: (Are you the OP, or have I mistakenly atributed this to Rupert Gallagher?) >> So what the composition of all this traffic? Are you saying the mail >> client is ultra dumb and repeatedly downloading entire messages, read >> and unread, attachment and all (i.e. you're truly bandwidth limited?) > > It most certainly does not do that. If this is the case for the OP, it's back to square one to find log entries, and/or nfsstat/iostat/vmstat/etc output to see what is "killing" the server. File locking issues, mail_max_userip_connections and process limit values could also cause service flakiness. Apple mail readers seems to gobble up IMAP connections like candy. Joseph Tam <jtam.home(a)gmail.com>

1 0

IMAP Benchmarking, active/active cluster with GFS2
by Hristo Pavlov 01 Nov '17

01 Nov '17

Hi All, We're on migration stage to a new 2-node active/active cluster with shared iSCSI storage, everything is ready, but we are in the process of I/O testing, before we going to in production. Cluster info: 2 nodes with CentOS 7.4 balancer ( keepalived + ldirectord ), 2 dovecot directors, 2 dovecot IMAP backends, 2 Postfix SMTP, gfs2 ( corosync + dlm ), LMTP between Postfix and Dovecot directors ( proxy ) and Dovecot backends. Everything seems normal, the users are mapped to dovecot backends, the balancers and the directors are working properly. The measurements were created under the following conditions : - operating system : CentOS Linux release 7.4.1708 (Core)- virtual server (KVM) - (2 cores per virtual socket) and 4 GB RAM - RAID 10 ( 6 x 2TB Seagate ST2000NX0273 SAS 7200 RPM ( iSCSI SAN Infrotrend Storage DS 4024 ), partition 5.45 TB formatted with gfs2. - Dovecot 2.2.10 - imaptest v.1.0.0 We run a test with ./imaptest userfile=users.txt mbox=dovecot-crlf secs=300 clients=50 append=100,0 logout=0 msgs=10000000, part of the output is that, but we can't understand what mean these values, anyone who has experience with imaptest can explain what they mean? 100% 50% 50% 100% 100% 100% 50% 100% 100% 100% 30% 0 223 216 0 442 657 219 218 443 438 50/ 50 0 229 212 0 418 596 194 224 428 424 50/ 50 0 217 226 0 436 632 227 223 429 428 50/ 50 0 214 226 0 432 644 207 193 429 435 50/ 50 0 213 204 0 414 587 209 213 414 417 50/ 50 0 195 206 0 427 611 213 203 426 420 50/ 50 0 225 200 0 435 642 215 226 439 445 50/ 50 0 229 194 0 441 637 223 213 441 436 50/ 50 0 213 219 0 434 616 212 232 431 428 50/ 50 0 210 213 0 427 622 203 219 434 440 50/ 50 0 112 113 0 35 30 30 56 87 111 ms/cmd avg Logi List Stat Sele Fetc Fet2 Stor Dele Expu Appe 100% 50% 50% 100% 100% 100% 50% 100% 100% 100% 30% 0 231 246 0 443 622 204 211 444 440 50/ 50 0 215 211 0 431 601 194 219 428 430 50/ 50 0 230 228 0 445 626 216 235 445 440 50/ 50 0 218 234 0 429 624 182 225 420 428 50/ 50 0 223 222 0 427 640 214 215 430 431 50/ 50 0 210 219 0 424 582 201 213 433 428 50/ 50 0 198 208 0 418 579 212 210 416 412 50/ 50 0 221 211 0 419 617 209 215 418 420 50/ 50 0 208 196 0 405 566 223 189 413 413 50/ 50 0 215 244 0 441 639 198 212 431 435 50/ 50 0 115 114 0 35 30 30 57 87 112 ms/cmd avg Logi List Stat Sele Fetc Fet2 Stor Dele Expu Appe 100% 50% 50% 100% 100% 100% 50% 100% 100% 100% 30% 0 199 219 0 422 608 206 205 424 420 50/ 50 0 214 206 0 429 616 209 208 432 435 50/ 50 0 227 204 0 413 583 200 213 412 410 50/ 50 0 192 214 0 416 609 212 219 411 415 50/ 50 0 212 215 0 426 625 204 225 434 428 50/ 50 0 202 209 0 423 585 224 197 415 421 50/ 50 0 216 221 0 422 599 190 197 427 426 50/ 50 0 208 207 0 414 579 209 211 414 410 50/ 50 0 205 211 0 432 616 212 213 423 427 50/ 50 0 225 207 0 432 642 208 215 436 434 50/ 50 0 115 115 0 36 31 32 59 89 113 ms/cmd avg Logi List Stat Sele Fetc Fet2 Stor Dele Expu Appe 100% 50% 50% 100% 100% 100% 50% 100% 100% 100% 30% 0 211 216 0 431 614 212 221 437 439 50/ 50 0 165 159 0 324 487 160 148 322 315 50/ 50 0 225 199 0 406 568 215 209 403 410 50/ 50 0 213 217 0 441 617 202 220 448 442 50/ 50 0 221 230 0 439 609 229 216 428 437 50/ 50 0 227 211 0 429 595 210 206 432 430 50/ 50 0 196 218 0 423 619 209 207 425 419 50/ 50 0 218 194 0 422 596 199 212 417 422 50/ 50 0 223 213 0 427 599 221 220 434 432 50/ 50 0 185 203 0 405 558 226 211 399 403 50/ 50 0 118 118 0 37 32 31 58 91 116 ms/cmd avg Totals: Logi List Stat Sele Fetc Fet2 Stor Dele Expu Appe 100% 50% 50% 100% 100% 100% 50% 100% 100% 100% 30% 50 61115 61109 50 122229 174619 59582 60969 122229 122229 Both nodеs pick up load average about 20-30 and io wait 14-20%. top - 16:34:50 up 7 days, 1:35, 1 user, load average: 22.22, 9.18, 3.47 Tasks: 244 total, 4 running, 240 sleeping, 0 stopped, 0 zombie %Cpu(s): 28.8 us, 29.8 sy, 0.0 ni, 16.4 id, 14.9 wa, 0.0 hi, 10.1 si, 0.0 st KiB Mem : 4013876 total, 134212 free, 1083648 used, 2796016 buff/cache KiB Swap: 6292476 total, 5974836 free, 317640 used. 2449504 avail Mem Do you think that's normal? Тhis test is only for 50 users, if run it for 100 have many stalled commands... We have about 500-700 mailboxes and we want to testing a load close to a real environment. Can anyone help with ideas? Thank you very much!

1 0

Re: How to limit Apple Mail (desktop)?
by Joseph Tam 01 Nov '17

01 Nov '17

Rupert Gallagher writes: > By default, Apple Mail downloads all e-mails from? server's account. > Previous versions of this client allowed to opt-out. The latest two > versions? however, only allow to opt-out from downloading the > attachments. > > The stress on the server is unbearable. We cannot ask users to be > considerate: this is the default behaviour of Apple Mail. (I'm coming into this thread late.) I'm having a hard time visualizing the cause of your problem. Most big messages have the bulk of their data as attachments (which you state the mail reader can defer downloading). Also, readers usually cache local copies, so they're downloaded once. So what the composition of all this traffic? Are you saying the mail client is ultra dumb and repeatedly downloading entire messages, read and unread, attachment and all (i.e. you're truly bandwidth limited?) Do your users typically have many concurrent readers for the same mailbox? What kind of session numbers are you supporting? 100s? 1000s? 10K+? Your data outflow has an incoming counterpart: if you're having a hard time serving it out, is your MTA also having a hard time with the incoming volume? Can it simply be the case you've underscaled your remote mail service? Joseph Tam <jtam.home(a)gmail.com>

2 1

All over sudden dovecot thinks FS is read only
by Tobi 31 Oct '17

31 Oct '17

Hi list I have to dovecot instances running which host my mailboxes on Centos7 dovecot.x86_64 1:2.2.26.0-2.el7.centos installed dovecot-debuginfo.x86_64 1:2.2.26.0-2.el7.centos installed dovecot-mysql.x86_64 1:2.2.26.0-2.el7.centos installed dovecot-pigeonhole.x86_64 1:2.2.26.0-2.el7.centos installed all over sudden both dovecot "think" that the mailbox filesystem is read only and fill the logs with Oct 28 11:39:50 mbox1 dovecot: lmtp(tobster(a)brain-force.ch): Error: ssY/MGZQ9FnoLgAAC4IaJw:2: sieve: failed to open logfile (LOGGING TO STDERR): open(/home/vmail/brain-force.ch/tobster/.dovecot.sieve.log) failed: Read-only file system But a test at cli shows that I can write to the location $ echo "test" >/home/vmail/brain-force.ch/tobster/.dovecot.test $ cat /home/vmail/brain-force.ch/tobster/.dovecot.test test $ echo "test1" >/home/vmail/brain-force.ch/tobster/.dovecot.test $ cat /home/vmail/brain-force.ch/tobster/.dovecot.test test1 Mounts show that the FS should be rw /dev/vda2 / ext4 rw,relatime,data=ordered 0 0 I restarted dovecot several time already. As well I restarted the physical host on which the dovecot vms reside. Filesystems are not full and are not running out of inodes. Does anyone have an idea why dovecot suddenly behaves like that? Thanks a lot for any hint Regards tobi

4 6

Pigeonhole vacation and envelope extension recipient addresses
by David Zambonini 31 Oct '17

31 Oct '17

I have a situation where my LMTP RCPT TO: goes to a mailbox user account that does not reflect either the final (through aliasing) or envelope email address. SMTP RCPT TO: (envelope-local-part@envelope-domain) Final Recipient: (final-local-part@final-domain) LMTP RCPT TO: (mailbox-local-part@mailbox-domain) I'd like to use the final recipient as the vacation address, but also have the envelope recipient address used in place of the LTMP RCPT TO for the envelope extension. At the moment it looks like I can set one or the other? Let's say I add an x-final-to and x-envelope-to header to the email headers before delivering via LMTP. Then, setting: sieve_vacation_use_original_recipient = yes lda_original_recipient_header = x-final-to will get the vacation replies coming from where I'd like, but the envelope extension will not reflect the original SMTP envelope to. Conversely, setting: lda_original_recipient_header = x-envelope-to might get the envelope extension working correctly, but will not give vacation replies from where I'd like. Is there some way anyone is aware of to configure both final and envelope senders based on email headers (that doesn't involve lda flags, these are on different systems), or am I currently out of luck? I've tried playing with DSN ORCPT but it seems like a non-starter trying to get it passed through (exim) -- David Zambonini

3 2

antispam plugin with IMAPSieve
by j.emerlik 31 Oct '17

31 Oct '17

Hi, my dovecot is configured with IMAP Sieve antispam plugin (sa-learn), everything seems to be working correctly but in debug mode in my log file I noticed "dovecot: imap: Error". Last 14 lines od my log file: Oct 31 15:05:25 mnode1 dovecot: imap: Error: Oct 31 15:05:25.040 [10743] dbg: bayes: tokenized header: 90 tokens Oct 31 15:05:25 mnode1 dovecot: imap: Error: Oct 31 15:05:25.067 [10743] dbg: bayes: seen (8e031cc9fec44b6607dc7f6b37903fc49e9c8526@sa_generated) put Oct 31 15:05:25 mnode1 dovecot: imap: Error: Oct 31 15:05:25.067 [10743] dbg: bayes: learned '8e031cc9fec44b6607dc7f6b37903fc49e9c8526@sa_generated', atime: 1509457623 Oct 31 15:05:25 mnode1 dovecot: imap: Error: Oct 31 15:05:25.068 [10743] dbg: plugin: Mail::SpamAssassin::Plugin::Bayes=HASH(0x2adc340) implements 'learner_close', priority 0 Oct 31 15:05:25 mnode1 dovecot: imap: Error: Oct 31 15:05:25.033 [10743] dbg: bayes: using userid: 7 Oct 31 15:05:25 mnode1 dovecot: imap: Error: Oct 31 15:05:25.037 [10743] dbg: bayes: tokenized body: 174 tokens Oct 31 15:05:25 mnode1 dovecot: imap: Error: Oct 31 15:05:25.037 [10743] dbg: bayes: tokenized uri: 0 tokens Oct 31 15:05:25 mnode1 dovecot: imap: Error: Oct 31 15:05:25.037 [10743] dbg: bayes: tokenized invisible: 0 tokens Oct 31 15:05:25 mnode1 dovecot: imap: Error: Oct 31 15:05:25.040 [10743] dbg: bayes: tokenized header: 90 tokens Oct 31 15:05:25 mnode1 dovecot: imap: Error: Oct 31 15:05:25.067 [10743] dbg: bayes: seen (8e031cc9fec44b6607dc7f6b37903fc49e9c8526@sa_generated) put Oct 31 15:05:25 mnode1 dovecot: imap: Error: Oct 31 15:05:25.067 [10743] dbg: bayes: learned '8e031cc9fec44b6607dc7f6b37903fc49e9c8526@sa_generated', atime: 1509457623 Logs looks good and I don't understand "Error:" from log, It looks like sa-learn is connected to database and learned bayes. Error in log it's normal or It's means that it not work ? Regards, Jack

2 1

Re: Bug#876364: dovecot-sieve: Just discovered imap_sieve/sieve_imapsieve is not set up to work with virtual mailboxes.
by Apollon Oikonomopoulos 31 Oct '17

31 Oct '17

Control: tags -1 + moreinfo upstream [Forwarding this to the Dovecot mailing list, just in case someone can help] Hi, Thanks for the report! See my comments inline. On 11:56 Thu 21 Sep , Thurgood Angelou wrote: > Package: dovecot-core > Version: 1:2.2.32-2 > > I've just discovered a bug where the sieve plugin (especially IMAP) > will not work with a virtual mailbox. I recently found this out when > testing a virtual mailbox setup and I use imap_sieve for SPAM > filtering so to lose that would be painful. > > This is what is reported in dovecot's debug log... > > Sep 21 10:53:01 imap(personal(a)othersider92.com): Panic: file mail-index-map.c: line 549 (mail_index_map_lookup_seq_range): assertion failed: (first_uid > 0) > Sep 21 10:53:01 imap(personal(a)othersider92.com): Error: Raw backtrace: /usr/lib/dovecot/libdovecot.so.0(+0x9f0a2) [0x7f4226fd50a2] -> /usr/lib/dovecot/libdovecot.so.0(+0x9f19a) [0x7f4226fd519a] -> /usr/lib/dovecot/libdovecot.so.0(i_fatal+0) [0x7f4226f65cf8] -> /usr/lib/dovecot/libdovecot-storage.so.0(mail_index_map_lookup_seq_range+0x120) [0x7f422733dae0] -> /usr/lib/dovecot/libdovecot-storage.so.0(+0xe8d1d) [0x7f422734cd1d] -> /usr/lib/dovecot/libdovecot-storage.so.0(mail_index_lookup_seq+0xf) [0x7f4227350e9f] -> /usr/lib/dovecot/modules/lib20_virtual_plugin.so(+0x82aa) [0x7f422678a2aa] -> /usr/lib/dovecot/modules/lib95_imap_sieve_plugin.so(+0x708c) [0x7f422657d08c] -> /usr/lib/dovecot/libdovecot-storage.so.0(mailbox_transaction_commit_get_changes+0x52) [0x7f42272adca2] -> dovecot/imap(+0x10084) [0x556502adb084] -> dovecot/imap(command_exec+0x5c) [0x556502ae7d9c] -> dovecot/imap(+0x1b322) [0x556502ae6322] -> dovecot/imap(+0x1b3bc) [0x556502ae63bc] -> dovecot/imap(client_handle_input > +0x18d) [0x556502ae677d] -> dovecot/imap(client_input+0xac) [0x556502ae6ccc] -> /usr/lib/dovecot/libdovecot.so.0(io_loop_call_io+0x52) [0x7f4226fea742] -> /usr/lib/dovecot/libdovecot.so.0(io_loop_handler_run_internal+0x12e) [0x7f4226febd8e] -> /usr/lib/dovecot/libdovecot.so.0(io_loop_handler_run+0x36) [0x7f4226fea7d6] -> /usr/lib/dovecot/libdovecot.so.0(io_loop_run+0x38) [0x7f4226fea988] -> /usr/lib/dovecot/libdovecot.so.0(master_service_run+0x13) [0x7f4226f70353] -> dovecot/imap(main+0x329) [0x556502ad9139] -> /lib/x86_64-linux-gnu/libc.so.6(__libc_start_main+0xf1) [0x7f4226bb92e1] -> dovecot/imap(_start+0x2a) [0x556502ad92ca] After mixing in the debug symbols, this backtrace becomes: /usr/lib/dovecot/libdovecot.so.0(+0x9f0a2) [0x7f4226fd50a2] default_fatal_finish at ./src/lib/failures.c:195 /usr/lib/dovecot/libdovecot.so.0(+0x9f19a) [0x7f4226fd519a] ?? at ./src/lib/failures.c:670 /usr/lib/dovecot/libdovecot.so.0(i_fatal+0) [0x7f4226f65cf8] i_fatal at ./src/lib/failures.c:280 /usr/lib/dovecot/libdovecot-storage.so.0(mail_index_map_lookup_seq_range+0x120) [0x7f422733dae0] mail_index_map_lookup_seq_range at ./src/lib-index/mail-index-map.c:550 /usr/lib/dovecot/libdovecot-storage.so.0(+0xe8d1d) [0x7f422734cd1d] tview_lookup_seq_range at ./src/lib-index/mail-index-transaction-view.c:178 /usr/lib/dovecot/libdovecot-storage.so.0(mail_index_lookup_seq+0xf) [0x7f4227350e9f] mail_index_lookup_seq at ./src/lib-index/mail-index-view.c:522 /usr/lib/dovecot/modules/lib20_virtual_plugin.so(+0x82aa) [0x7f422678a2aa] virtual_mail_set_uid at ./src/plugins/virtual/virtual-mail.c:213 /usr/lib/dovecot/modules/lib95_imap_sieve_plugin.so(+0x708c) [0x7f422657d08c] imap_sieve_mailbox_transaction_run at ./pigeonhole/src/plugins/imapsieve/imap-sieve-storage.c:752 (inlined by: imap_sieve_mailbox_transaction_commit at ./pigeonhole/src/plugins/imapsieve/imap-sieve-storage.c:807) /usr/lib/dovecot/libdovecot-storage.so.0(mailbox_transaction_commit_get_changes+0x52) [0x7f42272adca2] mailbox_transaction_commit_get_changes at ./src/lib-storage/mail-storage.c:2083 dovecot/imap(+0x10084) [0x556502adb084] cmd_copy_full at ./src/imap/cmd-copy.c:146 dovecot/imap(command_exec+0x5c) [0x556502ae7d9c] command_exec at ./src/imap/imap-commands.c:200 dovecot/imap(+0x1b322) [0x556502ae6322] client_command_input at ./src/imap/imap-client.c:1088 dovecot/imap(+0x1b3bc) [0x556502ae63bc] client_command_input at ./src/imap/imap-client.c:1150 dovecot/imap(client_handle_input+0x18d) [0x556502ae677d] client_handle_input at ./src/imap/imap-client.c:1203 dovecot/imap(client_input+0xac) [0x556502ae6ccc] client_input at ./src/imap/imap-client.c:1249 /usr/lib/dovecot/libdovecot.so.0(io_loop_call_io+0x52) [0x7f4226fea742] io_loop_call_io at ./src/lib/ioloop.c:600 /usr/lib/dovecot/libdovecot.so.0(io_loop_handler_run_internal+0x12e) [0x7f4226febd8e] io_loop_handler_run_internal at ./src/lib/ioloop-epoll.c:223 /usr/lib/dovecot/libdovecot.so.0(io_loop_handler_run+0x36) [0x7f4226fea7d6] io_loop_handler_run at ./src/lib/ioloop.c:648 /usr/lib/dovecot/libdovecot.so.0(io_loop_run+0x38) [0x7f4226fea988] io_loop_run at ./src/lib/ioloop.c:622 /usr/lib/dovecot/libdovecot.so.0(master_service_run+0x13) [0x7f4226f70353] master_service_run at ./src/lib-master/master-service.c:667 dovecot/imap(main+0x329) [0x556502ad9139] main at ./src/imap/main.c:491 /lib/x86_64-linux-gnu/libc.so.6(__libc_start_main+0xf1) [0x7f4226bb92e1] __libc_start_main at ../csu/libc-start.c:325 dovecot/imap(_start+0x2a) [0x556502ad92ca] start at ??:0 > -- System Information: > Debian Release: 8.2 > APT prefers oldstable-updates > APT policy: (500, 'oldstable-updates'), (500, 'unstable'), (500, 'testing'), (500, 'oldstable') > Architecture: amd64 (x86_64) > > Kernel: Linux 3.16.0-4-amd64 (SMP w/2 CPU cores) > Locale: LANG=en_GB.UTF-8, LC_CTYPE=en_GB.UTF-8 (charmap=UTF-8), LANGUAGE=en_GB:en (charmap=UTF-8) > Shell: /bin/sh linked to /bin/dash > Init: systemd (via /run/systemd/system) > > Versions of packages dovecot-sieve depends on: > ii dovecot-core 1:2.2.32-2 > ii libc6 2.24-17 > ii ucf 3.0030 > > dovecot-sieve recommends no packages. > > dovecot-sieve suggests no packages. > > Versions of packages dovecot-sieve is related to: > ii dovecot-core [dovecot-common] 1:2.2.32-2 > pn dovecot-dbg <none> > pn dovecot-dev <none> > ii dovecot-gssapi 1:2.2.32-2 > ii dovecot-imapd 1:2.2.32-2 > ii dovecot-ldap 1:2.2.32-2 > ii dovecot-lmtpd 1:2.2.32-2 > ii dovecot-managesieved 1:2.2.32-2 > ii dovecot-mysql 1:2.2.32-2 > pn dovecot-pgsql <none> > pn dovecot-pop3d <none> > ii dovecot-sieve 1:2.2.32-2 > pn dovecot-sqlite <none> Could you also include the output of doveconf -n? Regards, Apollon

3 2

Re: Disconnected: Inactivity (no auth attempts in 180 secs)
by Joseph Tam 31 Oct '17

31 Oct '17

Alexandre <byalefp(a)yahoo.com.br> wrote: > I can send and receive mails using: > IMAP 143 with TLS OK, IMAP STARTTLS is working in some sense. (Your MTA handles SMTP, not dovecot.) > The hangup occours inside of my LAN using Outlook 2016, and Outside > also trying access on 4G from my Android smartphone. > > My goal is enable also POP3s and IMAPs using TLS. [voluminous diagnostics] I can't really see from what you present what the problem is. Can you report the output of openssl s_client -starttls imap {imap-server}:143 openssl s_client -starttls pop3 {imap-server}:110 (from both inside and outside), as well as any matching log entries. Joseph Tam <jtam.home(a)gmail.com>

1 0

Re: Password encription
by Joseph Tam 30 Oct '17

30 Oct '17

> Aki, (Not speaking for Aki) > I understand that salted passwords saved in my database and stronger hash > algorithm course that it will require more processor time/power to crack my > passwords. > > But only when hackers have direct access to my database what means that > hackers have access to my passwords hashes (eg. hackers stolen my database). > > My Dovecot use passwords saved in database as SHA256 and hackers can use > only SMTP, IMAP or POP3 services to try crack it using dictionary attack (I > understand that they using plain text dictionaty passwords). > > Stronger hash algorithm and salt is useful when hackers have direct access > to my database but when they use services as SMTP, IMAP or POP3 > to crack passwords only longer and more complicated password can be more > secure. > > I do not understand this correctly ? Yes, your understanding is basically correct. However, history gives lots of examples of broken systems that explicitly or implicitly relied on one critical system not failing -- they lacked defense in depth or resilience. Examples are "this system has no bugs", "my system does not leak hashes", "this algorithm is unbreakable", "we'll never see a CAT5 hurricane", etc. If these critical assumption ever becomes untrue, the foundation of your defense crumbles. If you narrow your attack definition to only include in-protocol remote brute forcing, then any decent password will take far too long to break that way (esp. with throttling controls that are built-in). Your log files will overflow recording the attempts long before you can expect a password to be cracked. However, you're still susceptable to the qwerty passwords. If this is your *only* line of defense, it is brittle. A robustly secure system will overlap protection: strong hashes, password compliance systems, brute force countermeasures, file permissions/OS hardening, network origins vetting, anti-DoS measures, etc. Keep this picture in mind that I found on CLCERT https://www.clcert.cl/humor/img/weakest-link-road.jpg Joseph Tam <jtam.home(a)gmail.com>

1 0

Dovecot and the Maildir path
by Will Merkens 30 Oct '17

30 Oct '17

System basics Centos 7.3 Dovecot 2.2.32 (dfbe293d4) I am working on a replacement mail server for work and one of the features I wanted was ldap authentication After much fiddling I got it to work. But I encountered a issue where two different methods of testing a mail account resulted in the mail_location being different I set mail_location = maildir:/var/spool/maildir/%d/%n/Maildir in dovecot.conf when I test the authentication and to see if the folders are created correctly on first use I have two results depending on how I test. First test was from openssl openssl s_client -connect mail2:993 I have no problem connecting, I issue the following commands * OK [CAPABILITY IMAP4rev1 LITERAL+ SASL-IR LOGIN-REFERRALS ID ENABLE IDLE AUTH=PLAIN] Dovecot ready. a login testuser(a)userful.com ******** a OK [CAPABILITY IMAP4rev1 LITERAL+ SASL-IR LOGIN-REFERRALS ID ENABLE IDLE SORT SORT=DISPLAY THREAD=REFERENCES THREAD=REFS THREAD=ORDEREDSUBJECT MULTIAPPEND URL-PARTIAL CATENATE UNSELECT CHILDREN NAMESPACE UIDPLUS LIST-EXTENDED I18NLEVEL=1 CONDSTORE QRESYNC ESEARCH ESORT SEARCHRES WITHIN CONTEXT=SEARCH LIST-STATUS BINARY MOVE] Logged in a list "" * * LIST (\HasNoChildren) "." INBOX a OK List completed (0.001 + 0.000 secs). * BYE Disconnected for inactivity. closed But when I look in the mail server at /var/spool/maildir the testuser is not created inside of userful.com but at the same level as userful.com contrary to the %d in mail_location settings. Now second method doveadm -D mailbox list -u 'testuser(a)userful.com' This correctly creates the user under the domain as specified. for logs I have from journalctl for openssl Oct 30 07:37:12 mail2 dovecot[10722]: auth: Debug: client in: AUTH 2 PLAIN service=imap secured session=VgBmvMNcQoTAqHsn lip=192.168. 123.236 rip=192.168.123.39 lport=993 rport=33858 resp=AHRlc3R1c2VyQHVzZXJmdWwuY29tADk5dGVzdHVzZXI5OQ== (previous base64 data may contain sensitive data) Oct 30 07:37:12 mail2 dovecot[10722]: auth: Debug: ldap(testuser(a)userful.com,192.168.123.39,<VgBmvMNcQoTAqHsn>): bind search: base=ou=People,dc=userful,dc=ca filter=(&(objectClass=posixAccount)(uid=testuser)) Oct 30 07:37:12 mail2 dovecot[10722]: auth: Debug: ldap(testuser(a)userful.com,192.168.123.39,<VgBmvMNcQoTAqHsn>): result: uid=testuser; uid unused Oct 30 07:37:12 mail2 dovecot[10722]: auth: Debug: ldap(testuser(a)userful.com,192.168.123.39,<VgBmvMNcQoTAqHsn>): username changed testuser(a)userful.com -> testuser Oct 30 07:37:12 mail2 dovecot[10722]: auth: Debug: ldap(testuser,192.168.123.39,<VgBmvMNcQoTAqHsn>): result: uid=testuser Oct 30 07:37:12 mail2 dovecot[10722]: auth: Debug: client passdb out: OK 2 user=testuser original_user=testuser(a)userful.com Oct 30 07:37:12 mail2 dovecot[10722]: auth: Debug: master in: REQUEST 2784755713 10725 2 d4a357fe811a1da8bd725b82fc1da2ab session_pid=11051 request_auth_token Oct 30 07:37:12 mail2 dovecot[10722]: auth: Debug: ldap(testuser,192.168.123.39,<VgBmvMNcQoTAqHsn>): user search: base=ou=People,dc=userful,dc=ca scope=subtree filter=(&(objectClass=posixAccount)(uid=testuser)) fields=homeDirectory,uidNumber,gidNumber Oct 30 07:37:12 mail2 dovecot[10722]: auth: Debug: ldap(testuser,192.168.123.39,<VgBmvMNcQoTAqHsn>): result: homeDirectory=/nfs/home/test-user uidNumber=6000 gidNumber=1000; homeDirectory,uidNumber,gidNumber unused Oct 30 07:37:12 mail2 dovecot[10722]: auth: Debug: ldap(testuser,192.168.123.39,<VgBmvMNcQoTAqHsn>): result: homeDirectory=/nfs/home/test-user uidNumber=6000 gidNumber=1000 Oct 30 07:37:12 mail2 dovecot[10722]: auth: Debug: master userdb out: USER 2784755713 testuser home=/nfs/home/test-user uid=6000 gid=1000 auth_token=29e6ac32c85cf1b69eeabbe8e4f8e4810e9a3468 auth_user=testuser(a)userful.com Oct 30 07:37:12 mail2 dovecot[10722]: imap-login: Login: user=<testuser>, method=PLAIN, rip=192.168.123.39, lip=192.168.123.236, mpid=11051, TLS, session=<VgBmvMNcQoTAqHsn> for doveadm Oct 30 07:39:12 mail2 dovecot[10722]: auth: Debug: master in: USER 1 testuser(a)userful.com service=doveadm Oct 30 07:39:12 mail2 dovecot[10722]: auth: Debug: ldap(testuser(a)userful.com): user search: base=ou=People,dc=userful,dc=ca scope=subtree filter=(&(objectClass=posixAccount)(uid=testuser)) fields=homeDirectory,uidNumber,gidNumber Oct 30 07:39:12 mail2 dovecot[10722]: auth: Debug: ldap(testuser(a)userful.com): result: homeDirectory=/nfs/home/test-user uidNumber=6000 gidNumber=1000; homeDirectory,uidNumber,gidNumber unused Oct 30 07:39:12 mail2 dovecot[10722]: auth: Debug: ldap(testuser(a)userful.com): result: homeDirectory=/nfs/home/test-user uidNumber=6000 gidNumber=1000 Oct 30 07:39:12 mail2 dovecot[10722]: auth: Debug: userdb out: USER 1 testuser(a)userful.com home=/nfs/home/test-user uid=6000 gid=1000 Any ideas and any settings files that I need to post. -- William Merkens IT Support Analyst Userful Corporation +1 403.289.2177 ext.289 +1 866 USERFUL (1-866-873-7385) Suite 300, 736 8th Ave. SW Calgary AB T2P 1H4 Managed Desktops Done Right. http://www.userful.com

2 1