- dovecot - dovecot.org

How can I override settings in a dovecot protocol section?
by Christian Rößner 25 Mar '24

25 Mar '24

Hi, I have defined a service and a protocol that shall honor quota, but in an non-enforcing mode (required). Therefr I have done this on a test-server: ``` protocols = lmtp lmtp_noenforcing imap pop3 service lmtp_noenforcing { executable = lmtp inet_listener lmtp_noenforcing { port = 24000 } protocol = lmtp_noenforcing } protocol lmtp_noenforcing { postmaster_address = postmaster@**** mail_plugins = quota sieve fts fts_solr # Just for testing, if this works. userdb { driver = ldap args = /etc/dovecot/dovecot-ldap.conf.ext override_fields = quota=count:User quota:noenforcing skip = never result_success = continue result_failure = return-fail } # Just for testing, if this works. userdb { driver = lua args = file=/etc/dovecot/userdb.lua blocking=yes override_fields = quota=count:User quota:noenforcing result_success = return-ok result_failure = continue result_internalfail = continue } # Preferred plugin { quota = count:User quota:noenforcing } } ``` I tried with and without userdbs. With and without plugin{}. It seems that this whole section is never used. I removed "quota" from the mail_plugins parameter, but that seems to show me that the section is not used, because it always fails in a local swaks-test. The test shows that quota is exceeded. I would expect that the quota is ignored. One or the other hand. So why is the protocol not used for this service? We currently use Dovecot 2.3.20 from your repos. Kind regards and thanks in advance Christian Rößner -- Rößner-Network-Solutions Zertifizierter ITSiBe / CISO Karl-Bröger-Str. 10, 36304 Alsfeld Fax: +49 6631 78823409, Mobil: +49 171 9905345 USt-IdNr.: DE225643613, https://roessner.website PGP fingerprint: 658D 1342 B762 F484 2DDF 1E88 38A5 4346 D727 94E5

1 1

virtual user list in a passwd file (without linux user)
by paul＠virtuadv.com 23 Mar '24

23 Mar '24

Hi, I am trying to have a virtual user list in a passwd file (without linux user) but it does not seem to work. I have been trying to make this work for days reading the dovecot documentation and whatever I could find online... Note that I did not enable imap since I only use pop3s to retrieve my emails. I also tried to follow this guide: https://doc.dovecot.org/configuration_manual/howto/simple_virtual_install/ Note that once this works for dovecot, I plan to have postfix use the dovecot auth service to authenticate the virtual users and validate mail boxes. # cat /proc/version Linux version 6.1.0-17-cloud-amd64 (debian-kernel(a)lists.debian.org) (gcc-12 (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40) #1 SMP PREEMPT_DYNAMIC Debian 6.1.69-1 (2023-12-30) # dovecot version Feb 15 15:57:26 master: Info: Dovecot v2.3.19.1 (9b53102964) starting up for pop3, submission, lmtp # doveconf -n # 2.3.19.1 (9b53102964): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.19 (4eae2f79) # OS: Linux 6.1.0-17-cloud-amd64 x86_64 Debian 12.5 # Hostname: 85e10e78339f auth_verbose = yes debug_log_path = /dev/stdout first_valid_uid = 1000 info_log_path = /dev/stdout last_valid_uid = 1000 listen = * log_path = /dev/stdout login_greeting = greeting. mail_debug = yes mail_gid = 1000 mail_home = /srv/vmail/%d/%n mail_location = maildir:~/mail mail_uid = 1000 namespace { inbox = yes location = prefix = separator = / } passdb { args = username_format=%u /path/to/passwd driver = passwd-file } pop3_uidl_format = %g protocols = pop3 submission lmtp service auth { inet_listener { address = <ip> port = 12345 } user = vmail } service lmtp { inet_listener lmtp { address = <ip> port = 12344 } user = vmail } service pop3-login { client_limit = 1000 process_min_avail = 1 service_count = 0 } service submission-login { client_limit = 1000 process_min_avail = 1 service_count = 0 } ssl_cert = <cert.pem ssl_key = # hidden, use -P to show it userdb { args = username_format=%u /path/to/passwd default_fields = uid=vmail gid=vmail home=/srv/vmail/%d/%n driver = passwd-file } verbose_proctitle = yes local_name site1.com { ssl_cert = </etc/apache2/md-ssl/domains/site1.com/pubcert.pem ssl_key = # hidden, use -P to show it } local_name www.site1.com { ssl_cert = </etc/apache2/md-ssl/domains/site1.com/pubcert.pem ssl_key = # hidden, use -P to show it } The passwd file: # user:password:uid:gid:(gecos):home:(shell):extra_fields user1(a)site1.com{PLAIN}password1:::::: user2(a)site2.com{PLAIN}password2:::::: This is the log I am getting when trying to create an account with Thunderbird: Feb 15 15:57:26 master: Info: Dovecot v2.3.19.1 (9b53102964) starting up for pop3, submission, lmtp Feb 15 17:34:45 pop3-login: Info: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=<ip>, lip=<ip>, TLS, session=<cMIeC28RVOImVwz3> Feb 15 17:35:02 auth: Info: passwd-file(user1(a)site1.com,<ip>,<AIAjDG8RVuImVwz3>): unknown user Feb 15 17:35:08 auth: Info: passwd-file(user1(a)site1.com,<ip>,<AIAjDG8RVuImVwz3>): unknown user Feb 15 17:35:10 pop3-login: Info: Disconnected: Aborted login by logging out (auth failed, 2 attempts in 8 secs): user=<user1(a)site1.com>, method=PLAIN, rip=<ip>, lip=<ip>, TLS, session=<AIAjDG8RVuImVwz3> I tried using doveadm: # doveadm user user1 userdb lookup: user user1 doesn't exist field value # doveadm user user1(a)site1.com userdb lookup: user user1(a)site1.com doesn't exist field value I also tried with the verbose on (removed all the 'usually intentional'): # doveadm -Dv user user1(a)site1.com Feb 15 17:38:17 doveadm(user1(a)site1.com)<137><>: Debug: auth-master: userdb lookup(user1(a)site1.com): Started userdb lookup Feb 15 17:38:17 doveadm(user1(a)site1.com)<137><>: Debug: auth-master: conn unix:/run/dovecot/auth-userdb: Connecting Feb 15 17:38:17 doveadm(user1(a)site1.com)<137><>: Debug: auth-master: conn unix:/run/dovecot/auth-userdb (pid=7,uid=0): Client connected (fd=9) Feb 15 17:38:17 doveadm(user1(a)site1.com)<137><>: Debug: auth-master: userdb lookup(user1(a)site1.com): auth USER input: Feb 15 17:38:17 doveadm(user1(a)site1.com)<137><>: Debug: auth-master: userdb lookup(user1(a)site1.com): Userdb lookup failed userdb lookup: user user1(a)site1.com doesn't exist Feb 15 17:38:17 Debug: auth-master: conn unix:/run/dovecot/auth-userdb (pid=7,uid=0): Disconnected: Connection closed (fd=9) field value I could not find a way to list either the mailboxes or virtual user list that dovecot is using/serving.

4 17

Debug on FreeBSD: tries to open linux style /proc
by Larry Rosenman 23 Mar '24

23 Mar '24

Aki, Can you comment on this FreeBSD bug I got? https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=274540 Either here on in the bugzilla bug. Thanks! -- Larry Rosenman http://www.lerctr.org/~ler Phone: +1 214-642-9640 (c) E-Mail: larryrtx(a)gmail.com US Mail: 5708 Sabbia Dr, Round Rock, TX 78665-2106 Aki, Can you comment on this FreeBSD bug I got? https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=274540 Either here on in the bugzilla bug. Thanks! -- Larry Rosenman http://www.lerctr.org/~ler Phone: +1 214-642-9640 (c) E-Mail: larryrtx(a)gmail.com US Mail: 5708 Sabbia Dr, Round Rock, TX 78665-2106

1 0

Thousands of dovecot/dict processes
by Alex 22 Mar '24

22 Mar '24

Hi, I have a fedora38 system with dovecot-2.3.21 for a few hundred users and just noticed there are 4000 dovecot/dict processes running: 2203938 ? S 0:15 dovecot/dict or sleeping, as the case may be. Some time ago I installed the last_login_dict plugin to record login details per user. Here is my config: plugin { last_login_dict = proxy::sql last_login_key = last-login/%{service}/%{user}/%{remote_ip} last_login_precision = ms } dict { sql = mysql:/etc/dovecot/dovecot-dict-sql.conf.ext } There are about 1100 total entries in the last_login table, most of which are localhost for webmail. Is this all to be expected? I don't know how much in terms of resources these 4000 processes are utilizing, and although the system is virtually idle, it does appear to be going into swap. # free -h total used free shared buff/cache available Mem: 62Gi 9.3Gi 2.5Gi 13Mi 51Gi 52Gi Swap: 15Gi 4.4Gi 11Gi Any ideas greatly appreciated. Thanks, Alex Hi, I have a fedora38 system with dovecot-2.3.21 for a few hundred users and just noticed there are 4000 dovecot/dict processes running: 2203938 ? S 0:15 dovecot/dict or sleeping, as the case may be. Some time ago I installed the last_login_dict plugin to record login details per user. Here is my config: plugin { last_login_dict = proxy::sql last_login_key = last-login/%{service}/%{user}/%{remote_ip} last_login_precision = ms } dict { sql = mysql:/etc/dovecot/dovecot-dict-sql.conf.ext } There are about 1100 total entries in the last_login table, most of which are localhost for webmail. Is this all to be expected? I don't know how much in terms of resources these 4000 processes are utilizing, and although the system is virtually idle, it does appear to be going into swap. # free -h total used free shared buff/cache available Mem: 62Gi 9.3Gi 2.5Gi 13Mi 51Gi 52Gi Swap: 15Gi 4.4Gi 11Gi Any ideas greatly appreciated. Thanks, Alex

1 0

Disable sieve redirect filters?
by jarland＠mxroute.com 21 Mar '24

21 Mar '24

Right now we're using Dovecot for sieve filters. Good old fairly standard config: https://mxbin.io/N6hDUi I'm hoping someone has an idea, but I think I'm probably on my own here. The problem is that this is the best solution to preventing people from spoofing external senders when creating redirects to external recipients: sieve_redirect_envelope_from = recipient But also, as great as this is, it kind of sucks because users continually insist on receiving spam and phishing emails. When a user sends a phishing email, I step in to make sure our network isn't being abused. That's how we do what we do for high quality inbox delivery, we police the hell out of our network. So my problem is I end up with all of these users that I need to review every day, only to find out they just created a redirect filter and "redirected" a phishing email. So my long winded question is, how can I disable redirect filters? I don't want users to be able to create them. But I want them to have access to the rest of the functions of the sieve filtering. Is this possible, or would this need to be an entirely new function contributed to the project's code?

2 1

Crash in dovecot snippet when using imapc
by John van der Kamp 20 Mar '24

20 Mar '24

Hello, I've found a crash in a very specific setup. A dovecot server with imapc connection needs to receive an email with no body contents for the intent of generating a preview/snippet. It crashes somewhere deep in the jungle of istream and snapshots. I've included a script which sets up the systems to reproduce the crash. I've tested this with several versions. 2.3.16 doesn't seem to be affected, but 2.3.20 and 2.3.21 are affect. For me it produces a traceback like this, using the ubuntu version from here: https://packages.ubuntu.com/noble/dovecot-core (gdb) bt #0 __pthread_kill_implementation (no_tid=0, signo=6, threadid=140530132887360) at ./nptl/pthread_kill.c:44 #1 __pthread_kill_internal (signo=6, threadid=140530132887360) at ./nptl/pthread_kill.c:78 #2 __GI___pthread_kill (threadid=140530132887360, signo=signo@entry=6) at ./nptl/pthread_kill.c:89 #3 0x00007fcfb8842476 in __GI_raise (sig=sig@entry=6) at ../sysdeps/posix/raise.c:26 #4 0x00007fcfb88287f3 in __GI_abort () at ./stdlib/abort.c:79 #5 0x00007fcfb8b37fe5 in default_fatal_finish (status=0, type=LOG_TYPE_PANIC) at ../lib/failures.c:465 #6 fatal_handler_real (ctx=<optimized out>, format=<optimized out>, args=<optimized out>) at ../lib/failures.c:477 #7 0x00007fcfb8be50d7 in i_internal_fatal_handler (ctx=<optimized out>, format=<optimized out>, args=<optimized out>) at ../lib/failures.c:879 #8 0x00007fcfb8b37eea in i_panic (format=0x7fcfb8c29020 "file %s: line %d (%s): assertion failed: (%s)") at ../lib/failures.c:530 #9 0x00007fcfb8b3387b in i_stream_header_filter_snapshot_free (_snapshot=<optimized out>) at ../lib-mail/istream-header-filter.c:663 #10 i_stream_header_filter_snapshot_free (_snapshot=0x55dabe297a60) at ../lib-mail/istream-header-filter.c:655 #11 0x00007fcfb8bf25ac in i_stream_snapshot_free (_snapshot=_snapshot@entry=0x55dabe29b0d0) at ../lib/istream.c:253 #12 0x00007fcfb8bf2654 in i_stream_unref (stream=0x7ffc16cc7fa0) at ../lib/istream.c:66 #13 0x00007fcfb8d96baa in index_mail_write_body_snippet (mail=0x55dabe292058) at index/index-mail.c:1151 #14 0x00007fcfb8d97e48 in index_mail_parse_bodystructure (mail=0x55dabe292058, field=MAIL_CACHE_BODY_SNIPPET) at index/index-mail.c:1551 #15 0x00007fcfb8d97fe2 in index_mail_fetch_body_snippet (value_r=0x7ffc16cc8050, mail=0x55dabe292058) at index/index-mail.c:1602 #16 index_mail_get_special (_mail=0x55dabe292058, field=<optimized out>, value_r=0x7ffc16cc8050) at index/index-mail.c:1730 #17 0x00007fcfb8d16ffe in mail_get_special (mail=mail@entry=0x55dabe292058, field=field@entry=MAIL_FETCH_BODY_SNIPPET, value_r=value_r@entry=0x7ffc16cc8050) at /home/ubuntu/dovecot/new/dovecot-2.3.21+dfsg1/src/lib-storage/mail.c:418 #18 0x000055dabc52645c in fetch_snippet (ctx=0x55dabe26e050, mail=0x55dabe292058, preview=0x55dabe28f1f8) at ./src/imap/imap-fetch-body.c:615 #19 0x000055dabc52b5cc in imap_fetch_more_int (ctx=0x55dabe26e050, cancel=false) at ./src/imap/imap-fetch.c:562 #20 0x000055dabc52b8ad in imap_fetch_more (ctx=0x55dabe26e050, cmd=0x55dabe26de98) at ./src/imap/imap-fetch.c:617 #21 0x000055dabc51fd07 in cmd_fetch (cmd=0x55dabe26de98) at ./src/imap/cmd-fetch.c:382 #22 0x000055dabc528af4 in command_exec (cmd=0x55dabe26de98) at ./src/imap/imap-commands.c:201 #23 0x000055dabc52e9e2 in client_command_input (cmd=<optimized out>) at ./src/imap/imap-client.c:1237 #24 0x000055dabc52ea96 in client_command_input (cmd=<optimized out>) at ./src/imap/imap-client.c:1307 #25 0x000055dabc52eeed in client_handle_next_command (remove_io_r=<synthetic pointer>, client=0x55dabe26d2c8) at ./src/imap/imap-client.c:1349 #26 client_handle_input (client=0x55dabe26d2c8) at ./src/imap/imap-client.c:1363 #27 0x000055dabc52f2c4 in client_input (client=0x55dabe26d2c8) at ./src/imap/imap-client.c:1407 #28 0x00007fcfb8bfe27d in io_loop_call_io (io=0x55dabe26e660) at ../lib/ioloop.c:737 #29 0x00007fcfb8bff81a in io_loop_handler_run_internal (ioloop=0x55dabe243fd0) at ../lib/ioloop-epoll.c:222 #30 0x00007fcfb8bff8d4 in io_loop_handler_run (ioloop=0x55dabe243fd0) at ../lib/ioloop.c:789 #31 0x00007fcfb8bffa90 in io_loop_run (ioloop=0x55dabe243fd0) at ../lib/ioloop.c:762 #32 0x00007fcfb8b6ce57 in master_service_run (service=0x55dabe243e20, callback=callback@entry=0x55dabc533210 <client_connected>) at ../lib-master/master-service.c:878 #33 0x000055dabc51ad37 in main (argc=<optimized out>, argv=<optimized out>) at ./src/imap/main.c:575 John Hello, I've found a crash in a very specific setup. A dovecot server with imapc connection needs to receive an email with no body contents for the intent of generating a preview/snippet. It crashes somewhere deep in the jungle of istream and snapshots. I've included a script which sets up the systems to reproduce the crash. I've tested this with several versions. 2.3.16 doesn't seem to be affected, but 2.3.20 and 2.3.21 are affect. For me it produces a traceback like this, using the ubuntu version from here: https://packages.ubuntu.com/noble/dovecot-core (gdb) bt #0 __pthread_kill_implementation (no_tid=0, signo=6, threadid=140530132887360) at ./nptl/pthread_kill.c:44 #1 __pthread_kill_internal (signo=6, threadid=140530132887360) at ./nptl/ pthread_kill.c:78 #2 __GI___pthread_kill (threadid=140530132887360, signo=signo@entry=6) at ./ nptl/pthread_kill.c:89 #3 0x00007fcfb8842476 in __GI_raise (sig=sig@entry=6) at ../sysdeps/posix/ raise.c:26 #4 0x00007fcfb88287f3 in __GI_abort () at ./stdlib/abort.c:79 #5 0x00007fcfb8b37fe5 in default_fatal_finish (status=0, type=LOG_TYPE_PANIC) at ../lib/failures.c:465 #6 fatal_handler_real (ctx=<optimized out>, format=<optimized out>, args=<optimized out>) at ../lib/failures.c:477 #7 0x00007fcfb8be50d7 in i_internal_fatal_handler (ctx=<optimized out>, format=<optimized out>, args=<optimized out>) at ../lib/failures.c:879 #8 0x00007fcfb8b37eea in i_panic (format=0x7fcfb8c29020 "file %s: line %d (%s): assertion failed: (%s)") at ../lib/failures.c:530 #9 0x00007fcfb8b3387b in i_stream_header_filter_snapshot_free (_snapshot=<optimized out>) at ../lib-mail/istream-header-filter.c:663 #10 i_stream_header_filter_snapshot_free (_snapshot=0x55dabe297a60) at ../lib- mail/istream-header-filter.c:655 #11 0x00007fcfb8bf25ac in i_stream_snapshot_free (_snapshot=_snapshot@entry=0x55dabe29b0d0) at ../lib/istream.c:253 #12 0x00007fcfb8bf2654 in i_stream_unref (stream=0x7ffc16cc7fa0) at ../lib/ istream.c:66 #13 0x00007fcfb8d96baa in index_mail_write_body_snippet (mail=0x55dabe292058) at index/index-mail.c:1151 #14 0x00007fcfb8d97e48 in index_mail_parse_bodystructure (mail=0x55dabe292058, field=MAIL_CACHE_BODY_SNIPPET) at index/index-mail.c:1551 #15 0x00007fcfb8d97fe2 in index_mail_fetch_body_snippet (value_r=0x7ffc16cc8050, mail=0x55dabe292058) at index/index-mail.c:1602 #16 index_mail_get_special (_mail=0x55dabe292058, field=<optimized out>, value_r=0x7ffc16cc8050) at index/index-mail.c:1730 #17 0x00007fcfb8d16ffe in mail_get_special (mail=mail@entry=0x55dabe292058, field=field@entry=MAIL_FETCH_BODY_SNIPPET, value_r=value_r@entry=0x7ffc16cc8050) at /home/ubuntu/dovecot/new/dovecot-2.3.21+dfsg1/src/lib-storage/mail.c:418 #18 0x000055dabc52645c in fetch_snippet (ctx=0x55dabe26e050, mail=0x55dabe292058, preview=0x55dabe28f1f8) at ./src/imap/imap-fetch-body.c: 615 #19 0x000055dabc52b5cc in imap_fetch_more_int (ctx=0x55dabe26e050, cancel=false) at ./src/imap/imap-fetch.c:562 #20 0x000055dabc52b8ad in imap_fetch_more (ctx=0x55dabe26e050, cmd=0x55dabe26de98) at ./src/imap/imap-fetch.c:617 #21 0x000055dabc51fd07 in cmd_fetch (cmd=0x55dabe26de98) at ./src/imap/cmd- fetch.c:382 #22 0x000055dabc528af4 in command_exec (cmd=0x55dabe26de98) at ./src/imap/imap- commands.c:201 #23 0x000055dabc52e9e2 in client_command_input (cmd=<optimized out>) at ./src/ imap/imap-client.c:1237 #24 0x000055dabc52ea96 in client_command_input (cmd=<optimized out>) at ./src/ imap/imap-client.c:1307 #25 0x000055dabc52eeed in client_handle_next_command (remove_io_r=<synthetic pointer>, client=0x55dabe26d2c8) at ./src/imap/imap-client.c:1349 #26 client_handle_input (client=0x55dabe26d2c8) at ./src/imap/imap-client.c: 1363 #27 0x000055dabc52f2c4 in client_input (client=0x55dabe26d2c8) at ./src/imap/ imap-client.c:1407 #28 0x00007fcfb8bfe27d in io_loop_call_io (io=0x55dabe26e660) at ../lib/ ioloop.c:737 #29 0x00007fcfb8bff81a in io_loop_handler_run_internal (ioloop=0x55dabe243fd0) at ../lib/ioloop-epoll.c:222 #30 0x00007fcfb8bff8d4 in io_loop_handler_run (ioloop=0x55dabe243fd0) at ../ lib/ioloop.c:789 #31 0x00007fcfb8bffa90 in io_loop_run (ioloop=0x55dabe243fd0) at ../lib/ ioloop.c:762 #32 0x00007fcfb8b6ce57 in master_service_run (service=0x55dabe243e20, callback=callback@entry=0x55dabc533210 <client_connected>) at ../lib-master/ master-service.c:878 #33 0x000055dabc51ad37 in main (argc=<optimized out>, argv=<optimized out>) at ./src/imap/main.c:575 John

2 6

Notifications to over-quota accounts
by N V 15 Mar '24

15 Mar '24

Hello! I'm trying to allow a system email address to send notifications to over-quota accounts. Is there a way to do it? Thanks in advance! Hello! I'm trying to allow a system email address to send notifications to over-quota accounts. Is there a way to do it? Thanks in advance!

3 2

Question about sieve language
by Lev Serebryakov 15 Mar '24

15 Mar '24

Hello! I need to match all messages sent from some specific domain and all its sub-domains. I can achieve this with: if address :match :domain "From" [ "domain.com", "*.domain.com" ] { ... } But it looks ugly, especially if repeated for 5-6 domains. Is here way better? `:match ["*domain.com"]` will match "notdomain.com" and `:is [ "domain.com" ] doesn't match sub-domains. I understand, that it is (slightly?) off-topic, but I can not find any sieve-specific resources (all google find ins questions about PronotMail and FastMail filters, and these questions are very basic). Thank you. -- // Black Lion AKA Lev Serebryakov

3 4

antispoofing with dovecot submission
by Adrian M 15 Mar '24

15 Mar '24

Hi, it is possible to do antispoofing, like reject_authenticated_sender_login_mismatch from postfix ? Hi, it is possible to do antispoofing, like reject_authenticated_sender_login_mismatch from postfix ?

4 3

How to get a memory pointer in the core process
by Joan Moreau 15 Mar '24

15 Mar '24

Hi Is it possible, from a plugin perspective, to create and recover a pointer in the core process (i.e. memory not lost between 2 calls to the plugin, even after the "deinit" of the plugin" ) ? Thanks Hi Is it possible, from a plugin perspective, to create and recover a pointer in the core process (i.e. memory not lost between 2 calls to the plugin, even after the "deinit" of the plugin" ) ? Thanks

4 11