- dovecot - dovecot.org

How to disable BINARY extension
by Ralf Becker 10 Jul '23

10 Jul '23

Reason for disabling are many broken mails containing unescaped equal signs ("=") and our webmailer is using BINARY, when offered, and than does not display the mail and reports Dovecots error "Invalid quoted-printable input trailer: '=' not followed by two hex digits". I'm fully aware that the mails are broken, unfortunately all sorts of programs or senders generate them ... I can use imap_capability = <full-list-of-caps-without-binary> but this is for multiple reasons not ideal: - new caps would never show up - pre-login the are also displayed There seems to be no syntax like: imap_capability = -BINARY Is there any other way to disable just binary? Ralf -- Ralf Becker EGroupware GmbH [www.egroupware.org] Handelsregister HRB Kaiserslautern 3587 Geschäftsführer Birgit und Ralf Becker Leibnizstr. 17, 67663 Kaiserslautern, Germany Telefon +49 631 31657-0

1 0

meaning of LIST output
by joe a 10 Jul '23

10 Jul '23

having trouble using offlineimap to copy folders to a local store for spamassasin to use. Says "no folder to sync (folderfilter issue?)" Thinking I simply did not know the proper folder name, did telnet to dovecot server for list of folders, see this,(snippet): . . . * LIST (\HasNoChildren \UnMarked) "." Cabinet.Missed-SPAM * LIST (\HasNoChildren) "." Cabinet.Missed-HAM * LIST (\HasNoChildren \UnMarked) "." Cabinet.Marked-SPAM . . . What is the significance of not one being not "UnMarked"? joe a.

1 0

rename virtual user?
by joe a 09 Jul '23

09 Jul '23

Possible to change a virtual user account, in passwd file, to another name and or domain?

3 3

Public mailboxes and mailcrypt
by Robert Senger 09 Jul '23

09 Jul '23

Hi there, is there a possibility to combine public mailboxes (as described in the first link below) with mailcrypt plugin using per-user keys (as described in the second link below)? I assume, no. But if there's a solution like, for example, storing the decryption key multiple times with different password protection, or by using a global key for the public mailbox only, let me know... I know that I could simply turn off encryption for the public mailbox, and I know how to do that. That's the fllback solution... ;) Regards, Robert (1) https://doc.dovecot.org/configuration_manual/shared_mailboxes/public_shared… (2) https://doc.dovecot.org/configuration_manual/mail_crypt_plugin/ -- Robert Senger

1 0

Fwd: dovecot and postfix, authentication issue
by jeremy ardley 06 Jul '23

06 Jul '23

On 6/7/23 20:49, joe a wrote: > On 7/6/2023 8:12 AM, jeremy ardley via dovecot wrote: >> >> On 6/7/23 19:15, joe a wrote: >>> >>> If your example was meant to show the correct way, I cannot see any >>> difference between that and what my posted config shows other than >>> the sequential (contiguous?) in your example. >> >> Perhaps try the different configuration out? Or even better, stick to >> one auithentication method only. >> >> >> Jeremy >> > > Sorry, not to appear dense or argumentative, but I did not see any > difference in your example, vs what exists, other than that in your > example they are grouped together. > > Is that what you suggest I try, or are my aging eyes and brain missing > something there? > How about just using PAM? In dovecot.conf : auth_mechanisms = plain login passdb { driver = pam } userdb { driver = passwd } This will then call pam whose config is mainly determined by cat /etc/pam.d/dovecot #%PAM-1.0 #auth required pam_faillock.so preauth silent audit #auth [default=die] pam_faillock.so authfail audit @include common-auth @include common-account @include common-session Assuming the pam config is defaults then you will get pam authenticating local users against the local (unix) passwd file. In turn this will authenticate dovecot users and then postfix users This may sound complex but it's pretty standard to have postfix --> dovecot --> pam --> unix_local

2 2

dovecot and postfix, authentication issue
by joe a 06 Jul '23

06 Jul '23

Greetings from a new dovecot user. Have setup dovecot on openSuse 15.4 with postfix as the MTA. Both are the latest version in that distribution. Simple virtual user setup using /etc/dovecot/passwd Dovecot seems to be working and all the defined users are authenticating well enough for imapsync to migrate files to the mailboxes. However, when attempting to send test mail via postfix, only some users are authenticated and have mail delivered. Using swaks (smtp toolkit) the failures are: 550 5.1.1 <some.user(a)mydomain.com>: Recipient address rejected: User unknown in local recipient table I'm puzzled, probably some simple thing overlooked. To avoid clutter, I won't include postfix items unless asked. dovecot --version 2.3.20 (80a5ac675d) dovecot -n # 2.3.20 (80a5ac675d): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.20 (149edcf2) # OS: Linux 5.14.21-150400.24.66-default x86_64 # Hostname: flitch auth_verbose = ob-fuskate disable_plaintext_auth = no first_valid_uid = 100 info_log_path = /var/log/dovecot-info.log log_path = /var/log/dovecot.log mail_location = maildir:~/Maildir managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } passdb { driver = pam } passdb { args = /etc/dovecot/passwd driver = passwd-file } plugin { sieve = file:~/sieve;active=~/.dovecot.sieve } protocols = imap lmtp service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0660 user = postfix } } service lmtp { unix_listener /var/spool/postfix/private/dovecot-lmtp { group = postfix mode = 0600 user = postfix } } ssl = no ssl_cipher_list = ALL:!aNULL:!eNULL:!EXPORT:!DES:!3DES:!MD5:!PSK:!RC4:!ADH:!LOW@STRENGTH ssl_options = no_compression ssl_prefer_server_ciphers = yes userdb { driver = passwd } userdb { args = uid=vmail gid=vmail home=/home/vmail/%u driver = static }

3 6

director_username_hash usable variables
by Stefano Cecconello 06 Jul '23

06 Jul '23

Hi, From the documentation of the director_username_hash core setting ( https://doc.dovecot.org/settings/core/#core_setting-director_username_hash ), it seems that it is possible to use some variables for the hashing of the username from a proxy\director : . Variables that can be used for this setting: * Global variables * %{user}, %u \ Username (username@domain) * %{username}, %n \ Username * %{domain}, %d \ Domain . If i need to use in the hash calculation some variables that are not global, like domain_first \ orig_username authentication_variables ( https://doc.dovecot.org/configuration_manual/config_file/config_variables/#a uthentication-variables ), are those be parsed\read from the director_hash_username settings ? Or the only variables allowed to be used are : * %{user}, %u \ Username (username@domain) * %{username}, %n \ Username * %{domain}, %d \ Domain * Global: %% * Global: env:<name> * Global: uid * Global: gid * Global: pid * Global: hostname In order to see if these variables are read\parsed during the hashing, somebody know if there is a way to log their value in the dovecot log ? Thanks Stefano

1 0

Chrooting
by Alexey Vlasov 30 Jun '23

30 Jun '23

Hi, I have the following hier for chrooting local users: /var/mail/.u336084 /var/mail/.u336084/bin /var/mail/.u336084/dev [cut here] /var/mail/.u336084/proc /var/mail/.u336084/var/ [cut here] /var/mail/.u336084/var/mail/ /var/mail/.u336084/var/mail/u336084 /var/mail/.u336084/var/mail/u336084/Mail /var/mail/.u336084/Mail -> var/mail/u336084/Mail (symlink) passwd file: u336084:x:1340334:255::/var/mail/.u336084:/bin/bash Chroot works fine, for SSH, FTP and etc, for example: # chroot /var/mail/.u336084 /bin/bash Given the current hierarchy, is it possible to tell the dovecot to do the same chroot? I found strange behavior that users cannot delete IMAP-folders: [pid 25055] stat("/var/mail/.u336084/Mail/.www1", {st_mode=S_IFDIR|0700, st_size=167, ...}) = 0 [pid 25055] stat("/var/mail/.u336084/Mail/.Trash.www1", 0x7ffeddc3d5c0) = -1 ENOENT (No such file or directory) [pid 25055] stat("/var/mail/.u336084/Mail/.Trash", {st_mode=S_IFDIR|0777, st_size=198, ...}) = 0 [pid 25055] fcntl(16, F_SETLK, {l_type=F_UNLCK, l_whence=SEEK_SET, l_start=0, l_len=0}) = 0 [pid 25055] fcntl(16, F_SETLK, {l_type=F_WRLCK, l_whence=SEEK_SET, l_start=0, l_len=0}) = 0 [pid 25055] fstat(16, {st_mode=S_IFREG|0600, st_size=0, ...}) = 0 [pid 25055] stat("/var/mail/.u336084/Mail/mailboxes.lock", {st_mode=S_IFREG|0600, st_size=0, ...}) = 0 [pid 25055] unlink("/var/mail/.u336084/Mail/mailboxes.lock") = 0 [pid 25055] close(16) = 0 [pid 25055] write(7, "96 NO [CANNOT] Renaming not supported across conflicting directory permissions (0.002 + 0.000 + 0.001 secs).\r\n", 110) = 110 [pid 25055] epoll_wait(11, [{EPOLLIN, {u32=1794732256, u64=94916277006560}}], 7, 1800000) = 1 Btw I don't see any conflicting dirs: root@:/var/mail/u336084# ls -ld /var/mail/.u336084/Mail/.www1 drwx------ 5 u336084 virtmail 167 Jun 27 13:26 /var/mail/.u336084/Mail/.www1 root@:/var/mail/u336084# ls -ld /var/mail/.u336084/Mail lrwxrwxrwx 1 u336084 virtmail 26 Apr 28 21:43 /var/mail/.u336084/Mail -> var/mail/u336084/Mail root@:/var/mail/u336084# ls -ld Mail drwx------ 16 u336084 virtmail 4096 Jun 30 01:25 Mail All folders have right owner u336084. With this configuration Courier worked properly, I noteced the problem after migration to Dovecot. Thanks in advance.

1 0

Warning sqlpool(mysql): Query failed
by Alessio Cecchi 27 Jun '23

27 Jun '23

Hi, with the last dovecot version (2.3.13) I see many of this warnings via "doveadm log errors": Feb 17 03:26:28 Warning: dict(31513): conn unix:dict (pid=31330,uid=95): dict(mysql)<email1(a)company1.com>: sqlpool(mysql): Query failed, retrying: MySQL server has gone away (idled for 679 secs) Feb 17 03:48:53 Warning: dict(31013): conn unix:dict (pid=31805,uid=95): dict(mysql)<email2(a)company2.com>: sqlpool(mysql): Query failed, retrying: MySQL server has gone away (idled for 685 secs) Feb 17 03:54:12 Warning: dict(32529): conn unix:dict (pid=3147,uid=95): dict(mysql)<email3(a)company3.com>: sqlpool(mysql): Query failed, retrying: MySQL server has gone away (idled for 670 secs) What do they mean? I thinks are related to inactivity timeout on mysql server (where I have a wait_timeout=600), but these warnings could be problems or can be fixed with some setting in dovecot? My dovecot configuration about dict: dict { acl = mysql:/etc/dovecot/dovecot-dict-sql.conf.ext expire = mysql:/etc/dovecot/dovecot-dict-sql.conf.ext sieve = mysql:/etc/dovecot/dovecot-dict-sieve-sql.conf.ext sqlquota = mysql:/etc/dovecot/dovecot-dict-sql.conf.ext } plugin { [...] acl_shared_dict = proxy::acl expire_dict = proxy::expire quota2 = dict:Quota Usage::noenforcing:proxy::sqlquota sieve = file:~/sieve;active=~/.dovecot.sieve sieve_before = dict:proxy::sieve;name=activesql [...] } service dict { process_limit = 500 unix_listener dict { group = vmail mode = 0660 user = vmail } } Thanks -- Alessio Cecchi Postmaster @ http://www.qboxmail.it https://www.linkedin.com/in/alessice

2 1

Re: Postfix: running a script on authentication failure
by Joseph Tam 27 Jun '23

27 Jun '23

On Thu, 22 Jun 2023, Michael Peddemors wrote: > * Use services like RATS-AUTH to block IPs that can safely be blocked as known hackers.. Cool. Are there other DNSRBLs (apart from bl.blocklist.de) that list BFD attack IPs? > * Use services like RATS-NULL (or SpamHaus DROP lists) right in the firewall level. There are SOME networks > that should simply be 'unplugged' Can't find it in https://spamrats.com/. Is it an DNSRBL or downloadable file? > * Turn off port 110 (well, all plain text authentication) 90% less email compromise reports when you do.. That will disable STARTTLS though. Even though it's not plaintext, maybe that is a good thing as it avoids MITM banner stripping attacks. Joseph Tam <jtam.home(a)gmail.com>

2 1