- dovecot - dovecot.org

LDAP Filters as defined for dovecot UserDB and passDB
by Will Merkens 03 Nov '17

03 Nov '17

I have pretty much everything working fine. I have run into one issue with the filters that I am unsure where this a filter is being set. Dovecot 2.2.32 (dfbe293d4) I have setup dovecot-ldap.conf.ext to control my LDAP query's My current layout used filters based on looking at the posixAccount attributes user_filter = (&(objectClass=posixAccount)(uid=%u)) If I connect to a a ldap account that has no posixAccount attributes set I was getting a failure in the logs Nov 02 14:15:48 mail2 dovecot[28715]: auth: Debug: ldap(sales,192.168.123.39,<fd5mpwVddrvAqHsn>): user search: base=ou=People,dc=userful,dc=ca scope=subtree filter=(&(objectClass=posixAccount)(uid=sales)) fields=mail,user_filter Nov 02 14:15:48 mail2 dovecot[28715]: auth: Debug: ldap(sales,192.168.123.39,<fd5mpwVddrvAqHsn>): no fields returned by the server Nov 02 14:15:48 mail2 dovecot[28715]: auth: ldap(sales,192.168.123.39,<fd5mpwVddrvAqHsn>): unknown user Nov 02 14:15:48 mail2 dovecot[28715]: auth: Error: ldap(sales,192.168.123.39,<fd5mpwVddrvAqHsn>): user not found from userdb I changed the filters thinking I needed to look at the attributes seen by one of these accounts, I used the apache studio to find out what was visible. >From that I saw inetOrgPerson could be used. So I changed the filters. user_filter = (&(objectClass=inetOrgPerson)(uid=%u)) pass_filter = (&(objectClass=inetOrgPerson)(uid=%n)) iterate_filter = (objectClass=inetOrgPerson) Nov 02 14:26:44 mail2 dovecot[29047]: auth: Debug: client in: AUTH 1 PLAIN service=imap secured session=Y0GBzgVdlorAqHsn lip=192.168.123.236 Nov 02 14:26:44 mail2 dovecot[29047]: auth-worker(29066): Debug: ldap(sales(a)userful.com,192.168.123.39,<Y0GBzgVdlorAqHsn>): bind search: base=ou=People,dc=userful,dc=ca filter=(&(objectClass=inetOrgPerson)(uid=sales)) Nov 02 14:26:44 mail2 dovecot[29047]: auth-worker(29066): Debug: ldap(sales(a)userful.com,192.168.123.39,<Y0GBzgVdlorAqHsn>): result: uid=sales; uid unused Nov 02 14:26:44 mail2 dovecot[29047]: auth-worker(29066): Debug: ldap(sales(a)userful.com,192.168.123.39,<Y0GBzgVdlorAqHsn>): username changed sales(a)userful.com -> sales Nov 02 14:26:44 mail2 dovecot[29047]: auth-worker(29066): Debug: ldap(sales,192.168.123.39,<Y0GBzgVdlorAqHsn>): result: uid=sales Nov 02 14:26:44 mail2 dovecot[29047]: auth: Debug: ldap(sales(a)userful.com,192.168.123.39,<Y0GBzgVdlorAqHsn>): username changed sales(a)userful.com -> sales Nov 02 14:26:44 mail2 dovecot[29047]: auth: Debug: client passdb out: OK 1 user=sales original_user=sales(a)userful.com so far so good but then I get Nov 02 14:26:44 mail2 dovecot[29047]: auth: Debug: master in: REQUEST 3851550721 29049 1 519189df600c24c010b57158ac01c867 session_pid=29073 request_auth_token Nov 02 14:26:44 mail2 dovecot[29047]: auth-worker(29066): Debug: ldap(sales,192.168.123.39,<Y0GBzgVdlorAqHsn>): user search: base=ou=People,dc=userful,dc=ca scope=subtree filter=(&(objectClass=posixAccount)(uid=sales)) fields=mail,user_filter Nov 02 14:26:44 mail2 dovecot[29047]: auth-worker(29066): Debug: ldap(sales,192.168.123.39,<Y0GBzgVdlorAqHsn>): no fields returned by the server Nov 02 14:26:44 mail2 dovecot[29047]: auth-worker(29066): ldap(sales,192.168.123.39,<Y0GBzgVdlorAqHsn>): unknown user Nov 02 14:26:44 mail2 dovecot[29047]: auth: Error: ldap(sales,192.168.123.39,<Y0GBzgVdlorAqHsn>): user not found from userdb The question then is where did it get filter=(&(objectClass=posixAccount) from since I changed the filters to inetOrgPerson I grep the dovecot settings directory and all My filters are in the one file. The file that hold the ldap settings -- William Merkens IT Support Analyst Userful Corporation +1 403.289.2177 ext.289 +1 866 USERFUL (1-866-873-7385) Suite 300, 736 8th Ave. SW Calgary AB T2P 1H4 Managed Desktops Done Right. http://www.userful.com

3 3

Bug: lmtp proxy does not quote local parts with spaces
by David Zambonini 03 Nov '17

03 Nov '17

There seems to be a bug with RFC822 processing in ltmp proxying that doesn't quote local parts that, for example, contain spaces. director config: director_username_hash = %Ln lmtp_proxy = yes recipient_delimiter = + protocol lmtp { auth_socket_path = director-userdb auth_username_chars = auth_username_format = %Ln passdb { driver = sql args = /etc/director/sql.d/lmtp.ext result_failure = return-fail result_internalfail = return-fail } } lmtp.ext: password_query = SELECT 'y' AS proxy, NULL AS password, 'y' AS nopassword FROM users WHERE userName='%Ln' from exim -> director LMTP network dump: MAIL FROM:<test(a)testdomain.com>\r\n RCPT TO:<"deemzed.uk+Junk E-mail"@mailbox.localhost>\r\n DATA\r\n (etc) .\r\n 501 5.5.4 Invalid parameters\r\n QUIT\r\n from director -> dovecot LMTP network dump: MAIL FROM:<test(a)testdomain.com>\r\n RCPT TO:<deemzed.uk+Junk E-mail>\r\n 501 5.5.4 Invalid.parameters\r\n I'll try to pare down a full config for doveconf that displays this behaviour if required, as currently I have sensitive/extraneous information in there, but this seems fairly cut and dried as a bug to me. -- Dave

3 7

dovecot-2.3 (-git) Warning (Was Re: dovecot Digest, Vol 174, Issue 64)
by Reuben Farrelly 02 Nov '17

02 Nov '17

Hi, On 30/10/2017 7:22 PM, dovecot-request(a)dovecot.org wrote: > Message: 6 > Date: Mon, 30 Oct 2017 10:22:42 +0200 > From: Teemu Huovila <teemu.huovila(a)dovecot.fi> > To: dovecot(a)dovecot.org > Subject: Re: dovecot-2.3 (-git) Warning and Fatal Compile Error > Message-ID: <7d2c0b5b-019a-067c-c6be-f36571ed9a96(a)dovecot.fi> > Content-Type: text/plain; charset=utf-8 > > > > On 30.10.2017 09:10, Aki Tuomi wrote: >> >> >> On 30.10.2017 00:23, Reuben Farrelly wrote: >>> Hi Aki, >>> >>> On 30/10/2017 12:43 AM, Aki Tuomi wrote: >>>>> On October 29, 2017 at 1:55 PM Reuben Farrelly >>>>> <reuben-dovecot(a)reub.net> wrote: >>>>> >>>>> >>>>> Hi again, >>>>> >>>>> Chasing down one last problem which seems to have been missed from my >>>>> last email: >>>>> >>>>> On 20/10/2017 9:22 PM, Stephan Bosch wrote: >>>>>> >>>>>> Op 20-10-2017 om 4:23 schreef Reuben Farrelly: >>>>>>> On 18/10/2017 11:40 PM, Timo Sirainen wrote: >>>>>>>> On 18 Oct 2017, at 6.34, Reuben Farrelly <reuben-dovecot(a)reub.net> >>>>>>>> wrote: >>>>> This problem below is still present in 2.3 -git, as of version >>>>> 2.3.devel >>>>> (6fc40674e) >>>>> >>>>>>>> Secondly, this ssl_dh messages is always printed from doveconf: >>>>>>>> >>>>>>>> doveconf: Warning: please set ssl_dh=</etc/dovecot/dh.pem >>>>>>>> doveconf: Warning: You can generate it with: dd >>>>>>>> if=/var/lib/dovecot/ssl-parameters.dat bs=1 skip=88 | openssl dh >>>>>>>> -inform der > /etc/dovecot/dh.pem >>>>>>>> >>>>>>>> Yet the file is there: >>>>>>>> >>>>>>>> thunderstorm conf.d # ls -la /etc/dovecot/dh.pem >>>>>>>> -rw-r--r-- 1 root root 769 Oct 19 21:55 /etc/dovecot/dh.pem >>>>>>>> >>>>>>>> And the config is there as well: >>>>>>>> >>>>>>>> thunderstorm dovecot # doveconf -P | grep ssl_dh >>>>>>>> ssl_dh = </etc/dovecot/dh.pem >>>>>>>> doveconf: Warning: please set ssl_dh=</etc/dovecot/dh.pem >>>>>>>> doveconf: Warning: You can generate it with: dd >>>>>>>> if=/var/lib/dovecot/ssl-parameters.dat bs=1 skip=88 | openssl dh >>>>>>>> -inform der > /etc/dovecot/dh.pem >>>>>>>> ?? ssl_dh = -----BEGIN DH PARAMETERS----- >>>>>>>> ?? ssl_dh = -----BEGIN DH PARAMETERS----- >>>>>>>> ?? ssl_dh = -----BEGIN DH PARAMETERS----- >>>>>>>> ?? ssl_dh = -----BEGIN DH PARAMETERS----- >>>>>>>> ?? ssl_dh = -----BEGIN DH PARAMETERS----- >>>>>>>> ?? ssl_dh = -----BEGIN DH PARAMETERS----- >>>>>>>> ?? ssl_dh = -----BEGIN DH PARAMETERS----- >>>>>>>> ?? ssl_dh = -----BEGIN DH PARAMETERS----- >>>>>>>> thunderstorm dovecot # >>>>>>>> >>>>>>>> It appears that this warning is being triggered by the presence of >>>>>>>> the ssl-parameters.dat file because when I remove it the warning >>>>>>>> goes away. Perhaps the warning could be made a bit more specific >>>>>>>> about this file being removed if it is not required because at the >>>>>>>> moment the warning message is not related to the trigger. >>>>>>>> >>>>>>>> Thanks, >>>>>>>> Reuben >>>>> Thanks, >>>>> Reuben >>>> It is triggered when there is ssl-parameters.dat file *AND* there is >>>> no ssl_dh=< explicitly set in config file. >>>> >>>> Aki >>> >>> I have this already in my 10-ssl.conf file: >>> >>> lightning dovecot # /etc/init.d/dovecot reload >>> doveconf: Warning: please set ssl_dh=</etc/dovecot/dh.pem >>> doveconf: Warning: You can generate it with: dd >>> if=/var/lib/dovecot/ssl-parameters.dat bs=1 skip=88 | openssl dh >>> -inform der > /etc/dovecot/dh.pem >>> ?* Reloading dovecot configs and restarting auth/login processes >>> ...????? [ ok ] >>> lightning dovecot # >>> >>> However: >>> >>> lightning dovecot # grep ssl_dh conf.d/10-ssl.conf >>> # gives on startup when ssl_dh is unset. >>> ssl_dh=</etc/dovecot/dh.pem >>> lightning dovecot # >>> >>> and the file is there: >>> >>> lightning dovecot # ls -la /etc/dovecot/dh.pem >>> -rw-r--r-- 1 root root 769 Oct 19 19:06 /etc/dovecot/dh.pem >>> lightning dovecot # >>> >>> So it is actually configured and yet the warning still is present. >>> >>> Reuben >> >> Hi! >> >> I gave this a try, and I was not able to repeat this issue. Perhaps you >> are still missing ssl_dh somewhere? >> >> Aki >> > Hello > > Just a guess, but at this point I would recommend reviewing the output of "doveconf -n" to make sure the appropriate settings are present. > > br, > Teemu I still can't see anything amiss. Here's the output from doveconf -n: # 2.3.devel (65ef8330e): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.devel (f4659224) # OS: Linux 4.9.56-x86_64-linode87 x86_64 Gentoo Base System release 2.4.1 auth_mechanisms = plain login auth_socket_path = /var/run/dovecot/auth-userdb auth_username_format = %Ln doveadm_password = # hidden, use -P to show it first_valid_uid = 1000 imap_client_workarounds = tb-lsub-flags tb-extra-mailbox-sep last_valid_uid = 1100 login_log_format_elements = user=<%u> auth-method=%m remote=%r local=%l %k login_trusted_networks = 192.168.0.0/16 mail_location = maildir:~/Maildir mail_plugins = stats notify replication fts fts_lucene managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } passdb { args = failure_show_msg=yes %s driver = pam } plugin { fts = lucene fts_autoindex = yes fts_languages = en fts_lucene = whitespace_chars=@. mail_replica = tcps:inside-mail.reub.net:4813 replication_full_sync_interval = 4 hours sieve = file:~/sieve;active=~/.dovecot.sieve stats_refresh = 30 secs stats_track_cmds = yes } protocols = imap lmtp sieve recipient_delimiter = - service aggregator { fifo_listener replication-notify-fifo { mode = 0666 user = root } unix_listener replication-notify { mode = 0666 user = root } } service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0666 user = postfix } unix_listener auth-userdb { mode = 0777 } } service doveadm { inet_listener { address = 2400:8901:e001:3a::20 port = 4813 ssl = yes } user = root } service imap { executable = imap postlogin } service lmtp { inet_listener lmtp { address = ::1 port = 24 } unix_listener /var/spool/postfix/private/dovecot-lmtp { group = postfix mode = 0660 user = postfix } } service postlogin { executable = script-login -d rawlog } service replicator { process_min_avail = 1 unix_listener replicator-doveadm { mode = 0666 } } service stats { fifo_listener stats-mail { mode = 0666 } } ssl_ca = </etc/ssl/misc/alphassl_intermediate_ca.crt ssl_cert = </etc/ssl/dovecot/*.reub.net.crt ssl_cipher_list = DEFAULT:!EXPORT:!LOW:!MEDIUM:!MD5 ssl_client_ca_dir = /etc/ssl/certs ssl_client_ca_file = /etc/ssl/misc/alphassl_intermediate_ca.crt ssl_dh = # hidden, use -P to show it ssl_key = # hidden, use -P to show it ssl_protocols = !SSLv2 !SSLv3 !TLSv1 userdb { driver = passwd } protocol lmtp { mail_plugins = stats notify replication fts fts_lucene sieve ssl_dh = # hidden, use -P to show it } protocol !indexer-worker { ssl_dh = # hidden, use -P to show it } protocol lda { mail_plugins = stats notify replication fts fts_lucene sieve ssl_dh = # hidden, use -P to show it } protocol imap { mail_plugins = stats notify replication fts fts_lucene imap_stats ssl_dh = # hidden, use -P to show it } protocol sieve { ssl_dh = # hidden, use -P to show it } protocol pop3 { ssl_dh = # hidden, use -P to show it } And showing with -P as an example: protocol pop3 { ssl_dh = -----BEGIN DH PARAMETERS----- MIIBCAKCAQEAo4NpFI4fpUe65FVv1hotVS9pTUbCKs1ypGRZcFMXzpsXPqHU+M4s ... AAAAAAAAAAAAAAAAAAAAAAAAAAA= -----END DH PARAMETERS----- There is a single set of valid DH parameters for every protocol as listed above. It seems odd that ssl_dh is defined all of these protocols specifically too. This specific per-protocol definition of ssl_dh isn't specified in any config file. Reuben

3 4

Replication to wrong mailbox
by Ralf Becker 02 Nov '17

02 Nov '17

It happened now twice that replication created folders and mails in the wrong mailbox :( Here's the architecture we use: - 2 Dovecot (2.2.32) backends in two different datacenters replicating via a VPN connection - Dovecot directors in both datacenters talks to both backends with vhost_count of 100 vs 1 for local vs remote backend - backends use proxy dict via a unix domain socket and socat to talk via tcp to a dict on a different server (kubernetes cluster) - backends have a local sqlite userdb for iteration (also containing home directories, as just iteration is not possible) - serving around 7000 mailboxes in a roughly 200 different domains Everything works as expected, until dict is not reachable eg. due to a server failure or a planed reboot of a node of the kubernetes cluster. In that situation it can happen that some requests are not answered, even with Kubernetes running multiple instances of the dict. I can only speculate what happens then: it seems the connection failure to the remote dict is not correctly handled and leads to situation in which last mailbox/home directory is used for the replication :( When it happened the first time we attributed it to the fact that the Sqlite database at that time contained no home directory information, which we fixed after. This first time (server failure) took a couple of minutes and lead to many mailboxes containing mostly folders but also some new arrived mails belonging to other mailboxes/users. We could only resolve that situation by rolling back to a zfs snapshot before the downtime. The second time was last Friday night during a (much shorter) reboot of a Kubernetes node and lead only to a single mailbox containing folders and mails of other mailboxes. That was verified by looking at timestamps of directories below $home/mdbox/mailboxes and files in $home/mdbox/storage. I can not tell if adding the home directory to the Sqlite database or the shorter time of the failure limited the wrong replication to a single mailbox. Can someone with more knowledge of the Dovecot code please check/verify how replication deals with failures in proxy dict. I'm of cause happy to provide more information of our configuration if needed. Here is an exert of our configuration (full doveconf -n is attached): passdb { args = /etc/dovecot/dovecot-dict-master-auth.conf driver = dict master = yes } passdb { args = /etc/dovecot/dovecot-dict-auth.conf driver = dict } userdb { driver = prefetch } userdb { args = /etc/dovecot/dovecot-dict-auth.conf driver = dict } userdb { args = /etc/dovecot/dovecot-sql.conf driver = sql } dovecot-dict-auth.conf: uri = proxy:/var/run/dovecot_auth_proxy/socket:backend password_key = passdb/%u/%w user_key = userdb/%u iterate_disable = yes dovecot-dict-master-auth.conf: uri = proxy:/var/run/dovecot_auth_proxy/socket:backend password_key = master/%{login_user}/%u/%w iterate_disable = yes dovecot-sql.conf: driver = sqlite connect = /etc/dovecot/users.sqlite user_query = SELECT home,NULL AS uid,NULL AS gid FROM users WHERE userid = '%n' AND domain = '%d' iterate_query = SELECT userid AS username, domain FROM users -- Ralf Becker EGroupware GmbH [www.egroupware.org] Handelsregister HRB Kaiserslautern 3587 Geschäftsführer Birgit und Ralf Becker Leibnizstr. 17, 67663 Kaiserslautern, Germany Telefon +49 631 31657-0

3 5

How to limit Apple Mail (desktop)?
by Rupert Gallagher 02 Nov '17

02 Nov '17

By default, Apple Mail downloads all e-mails from server's account. Previous versions of this client allowed to opt-out. The latest two versions? however, only allow to opt-out from downloading the attachments. The stress on the server is unbearable. We cannot ask users to be considerate: this is the default behaviour of Apple Mail. We need a server-side solution to the problem. Please share your ideas.

6 13

LDAP authentication and shadowExpire
by Mantas Gegužis 02 Nov '17

02 Nov '17

Hi, I am trying to configure Dovecot (2.2.27) with LDAP passdb, specifically with authentication binds (https://wiki.dovecot.org/AuthDatabase/LDAP/AuthBinds) Atribute shadowExpire has a unix time stamp value. Is there a way to write pass_filter like shadowExpire<ToDay? Or maybe there is better way to implement password expiration in Dovecot? -- Pagarbiai Mantas Gegužis VU Informacinių technologijų taikymo centras

2 1

Re: How to limit Apple Mail (desktop)?
by Joseph Tam 01 Nov '17

01 Nov '17

"@lbutlr" <kremels(a)kreme.com> writes: (Are you the OP, or have I mistakenly atributed this to Rupert Gallagher?) >> So what the composition of all this traffic? Are you saying the mail >> client is ultra dumb and repeatedly downloading entire messages, read >> and unread, attachment and all (i.e. you're truly bandwidth limited?) > > It most certainly does not do that. If this is the case for the OP, it's back to square one to find log entries, and/or nfsstat/iostat/vmstat/etc output to see what is "killing" the server. File locking issues, mail_max_userip_connections and process limit values could also cause service flakiness. Apple mail readers seems to gobble up IMAP connections like candy. Joseph Tam <jtam.home(a)gmail.com>

1 0

IMAP Benchmarking, active/active cluster with GFS2
by Hristo Pavlov 01 Nov '17

01 Nov '17

Hi All, We're on migration stage to a new 2-node active/active cluster with shared iSCSI storage, everything is ready, but we are in the process of I/O testing, before we going to in production. Cluster info: 2 nodes with CentOS 7.4 balancer ( keepalived + ldirectord ), 2 dovecot directors, 2 dovecot IMAP backends, 2 Postfix SMTP, gfs2 ( corosync + dlm ), LMTP between Postfix and Dovecot directors ( proxy ) and Dovecot backends. Everything seems normal, the users are mapped to dovecot backends, the balancers and the directors are working properly. The measurements were created under the following conditions : - operating system : CentOS Linux release 7.4.1708 (Core)- virtual server (KVM) - (2 cores per virtual socket) and 4 GB RAM - RAID 10 ( 6 x 2TB Seagate ST2000NX0273 SAS 7200 RPM ( iSCSI SAN Infrotrend Storage DS 4024 ), partition 5.45 TB formatted with gfs2. - Dovecot 2.2.10 - imaptest v.1.0.0 We run a test with ./imaptest userfile=users.txt mbox=dovecot-crlf secs=300 clients=50 append=100,0 logout=0 msgs=10000000, part of the output is that, but we can't understand what mean these values, anyone who has experience with imaptest can explain what they mean? 100% 50% 50% 100% 100% 100% 50% 100% 100% 100% 30% 0 223 216 0 442 657 219 218 443 438 50/ 50 0 229 212 0 418 596 194 224 428 424 50/ 50 0 217 226 0 436 632 227 223 429 428 50/ 50 0 214 226 0 432 644 207 193 429 435 50/ 50 0 213 204 0 414 587 209 213 414 417 50/ 50 0 195 206 0 427 611 213 203 426 420 50/ 50 0 225 200 0 435 642 215 226 439 445 50/ 50 0 229 194 0 441 637 223 213 441 436 50/ 50 0 213 219 0 434 616 212 232 431 428 50/ 50 0 210 213 0 427 622 203 219 434 440 50/ 50 0 112 113 0 35 30 30 56 87 111 ms/cmd avg Logi List Stat Sele Fetc Fet2 Stor Dele Expu Appe 100% 50% 50% 100% 100% 100% 50% 100% 100% 100% 30% 0 231 246 0 443 622 204 211 444 440 50/ 50 0 215 211 0 431 601 194 219 428 430 50/ 50 0 230 228 0 445 626 216 235 445 440 50/ 50 0 218 234 0 429 624 182 225 420 428 50/ 50 0 223 222 0 427 640 214 215 430 431 50/ 50 0 210 219 0 424 582 201 213 433 428 50/ 50 0 198 208 0 418 579 212 210 416 412 50/ 50 0 221 211 0 419 617 209 215 418 420 50/ 50 0 208 196 0 405 566 223 189 413 413 50/ 50 0 215 244 0 441 639 198 212 431 435 50/ 50 0 115 114 0 35 30 30 57 87 112 ms/cmd avg Logi List Stat Sele Fetc Fet2 Stor Dele Expu Appe 100% 50% 50% 100% 100% 100% 50% 100% 100% 100% 30% 0 199 219 0 422 608 206 205 424 420 50/ 50 0 214 206 0 429 616 209 208 432 435 50/ 50 0 227 204 0 413 583 200 213 412 410 50/ 50 0 192 214 0 416 609 212 219 411 415 50/ 50 0 212 215 0 426 625 204 225 434 428 50/ 50 0 202 209 0 423 585 224 197 415 421 50/ 50 0 216 221 0 422 599 190 197 427 426 50/ 50 0 208 207 0 414 579 209 211 414 410 50/ 50 0 205 211 0 432 616 212 213 423 427 50/ 50 0 225 207 0 432 642 208 215 436 434 50/ 50 0 115 115 0 36 31 32 59 89 113 ms/cmd avg Logi List Stat Sele Fetc Fet2 Stor Dele Expu Appe 100% 50% 50% 100% 100% 100% 50% 100% 100% 100% 30% 0 211 216 0 431 614 212 221 437 439 50/ 50 0 165 159 0 324 487 160 148 322 315 50/ 50 0 225 199 0 406 568 215 209 403 410 50/ 50 0 213 217 0 441 617 202 220 448 442 50/ 50 0 221 230 0 439 609 229 216 428 437 50/ 50 0 227 211 0 429 595 210 206 432 430 50/ 50 0 196 218 0 423 619 209 207 425 419 50/ 50 0 218 194 0 422 596 199 212 417 422 50/ 50 0 223 213 0 427 599 221 220 434 432 50/ 50 0 185 203 0 405 558 226 211 399 403 50/ 50 0 118 118 0 37 32 31 58 91 116 ms/cmd avg Totals: Logi List Stat Sele Fetc Fet2 Stor Dele Expu Appe 100% 50% 50% 100% 100% 100% 50% 100% 100% 100% 30% 50 61115 61109 50 122229 174619 59582 60969 122229 122229 Both nodеs pick up load average about 20-30 and io wait 14-20%. top - 16:34:50 up 7 days, 1:35, 1 user, load average: 22.22, 9.18, 3.47 Tasks: 244 total, 4 running, 240 sleeping, 0 stopped, 0 zombie %Cpu(s): 28.8 us, 29.8 sy, 0.0 ni, 16.4 id, 14.9 wa, 0.0 hi, 10.1 si, 0.0 st KiB Mem : 4013876 total, 134212 free, 1083648 used, 2796016 buff/cache KiB Swap: 6292476 total, 5974836 free, 317640 used. 2449504 avail Mem Do you think that's normal? Тhis test is only for 50 users, if run it for 100 have many stalled commands... We have about 500-700 mailboxes and we want to testing a load close to a real environment. Can anyone help with ideas? Thank you very much!

1 0

Re: How to limit Apple Mail (desktop)?
by Joseph Tam 01 Nov '17

01 Nov '17

Rupert Gallagher writes: > By default, Apple Mail downloads all e-mails from? server's account. > Previous versions of this client allowed to opt-out. The latest two > versions? however, only allow to opt-out from downloading the > attachments. > > The stress on the server is unbearable. We cannot ask users to be > considerate: this is the default behaviour of Apple Mail. (I'm coming into this thread late.) I'm having a hard time visualizing the cause of your problem. Most big messages have the bulk of their data as attachments (which you state the mail reader can defer downloading). Also, readers usually cache local copies, so they're downloaded once. So what the composition of all this traffic? Are you saying the mail client is ultra dumb and repeatedly downloading entire messages, read and unread, attachment and all (i.e. you're truly bandwidth limited?) Do your users typically have many concurrent readers for the same mailbox? What kind of session numbers are you supporting? 100s? 1000s? 10K+? Your data outflow has an incoming counterpart: if you're having a hard time serving it out, is your MTA also having a hard time with the incoming volume? Can it simply be the case you've underscaled your remote mail service? Joseph Tam <jtam.home(a)gmail.com>

2 1

All over sudden dovecot thinks FS is read only
by Tobi 31 Oct '17

31 Oct '17

Hi list I have to dovecot instances running which host my mailboxes on Centos7 dovecot.x86_64 1:2.2.26.0-2.el7.centos installed dovecot-debuginfo.x86_64 1:2.2.26.0-2.el7.centos installed dovecot-mysql.x86_64 1:2.2.26.0-2.el7.centos installed dovecot-pigeonhole.x86_64 1:2.2.26.0-2.el7.centos installed all over sudden both dovecot "think" that the mailbox filesystem is read only and fill the logs with Oct 28 11:39:50 mbox1 dovecot: lmtp(tobster(a)brain-force.ch): Error: ssY/MGZQ9FnoLgAAC4IaJw:2: sieve: failed to open logfile (LOGGING TO STDERR): open(/home/vmail/brain-force.ch/tobster/.dovecot.sieve.log) failed: Read-only file system But a test at cli shows that I can write to the location $ echo "test" >/home/vmail/brain-force.ch/tobster/.dovecot.test $ cat /home/vmail/brain-force.ch/tobster/.dovecot.test test $ echo "test1" >/home/vmail/brain-force.ch/tobster/.dovecot.test $ cat /home/vmail/brain-force.ch/tobster/.dovecot.test test1 Mounts show that the FS should be rw /dev/vda2 / ext4 rw,relatime,data=ordered 0 0 I restarted dovecot several time already. As well I restarted the physical host on which the dovecot vms reside. Filesystems are not full and are not running out of inodes. Does anyone have an idea why dovecot suddenly behaves like that? Thanks a lot for any hint Regards tobi

4 6