- dovecot - dovecot.org

Updated my Dovecot certificate for the first time
by Steve Litt 25 Nov '16

25 Nov '16

Hi all, I've used Dovecot since February 2012, but because I kept reinstalling Linux with every major version, I never had a Dovecot self-signed certificate go bad on me before. Til now. I started using rolling release Void Linux about a year ago, and my Dovecot self-signed certificate just expired. The solution I used is contained in these documents: http://wiki2.dovecot.org/SSL/CertificateCreation http://wiki2.dovecot.org/SSL/CertificateClientImporting file:///etc/ssl/dovecot-openssl.cnf http://www.faqforge.com/linux/renew-the-dovecot-ssl-certificate-on-ubuntu-l… I basically moved my old /etc/ssl/certs/dovecot.pem and /etc/ssl/private/dovecot.pem, then edited /etc/ssl/dovecot-openssl.cnf specifically to give myself the common name of 192.168.100.2. I had earlier used my hostname, but that produced a conflict, so I just used the ip address. Then I ran dovecot-mkcert.sh to create the new self-signed cert, and finally, configured Claws-Mail to use /etc/ssl/certs/dovecot.pem as its cert. Obviously, if my Claws-Mail were on a different machine than my Dovecot, I would have had Claws-Mail point to a local copy. Alpine still gives me a bad cert warning, saying I should either fix it or disable checking. I haven't yet found a way to get Alpine to discriminate between a valid self-signed cert and a bad one. Anyway, all's good. SteveT Steve Litt November 2016 featured book: Quit Joblessness: Start Your Own Business http://www.troubleshooters.com/startbiz

7 9

Re: Updated my Dovecot certificate for the first time
by Joseph Tam 24 Nov '16

24 Nov '16

On Thu, 24 Nov 2016, Steve Litt wrote >> add the public part of the cert into your system's trusted CA store. > > Silly question, but how would you do that? You didn't say which OS you're running on (alpine runs on Windows as well), but I'll assume *nix. A previous poster showed you how to do it with a real certificate, and the steps are the same. However, the way I found out without too much fuss was to process trace my alpine process and see where it tied to load a cert $ strace -o trace.out alpine ... quit after connection $ grep -F cert traceout /1: open64("/etc/openssl/cert.pem", O_RDONLY) Err#2 ENOENT /1: stat("/etc/openssl/certs/cbf06781.0", 0xFFBF8E54) Err#2 ENOENT ... Your output will be different of course. The first load is the default pre-loaded root CAs (Thawte, etc.) supplied by OpenSSL, and the second, etc. are chained certificate lookups. You would replace the missing cert with your own self-signed public pem file. e.g. cp mypub.pem /etc/openssl/certs/cbf06781.0 For Windows, I don't know where it fetches it from. Joseph Tam <jtam.home(a)gmail.com>

1 0

Re: Updated my Dovecot certificate for the first time
by Joseph Tam 24 Nov '16

24 Nov '16

> Alpine still gives me a bad cert warning, saying I should either fix it > or disable checking. I haven't yet found a way to get Alpine to > discriminate between a valid self-signed cert and a bad one. Well, it can't discriminate since any certificate (except those in your trusted store) that asserts its own validity is suspect. You can either get alpine to not complain e.g. inbox-path={192.168.100.2:143/user=whatever/tls/novalidate-cert} or add the public part of the cert into your system's trusted CA store. Joseph Tam <jtam.home(a)gmail.com>

2 1

antispam plugin not working correctly
by Felix Zielcke 23 Nov '16

23 Nov '16

Hi, I've configured the antispam plugin like in the wiki to use the sa- learn-pipe.sh shell script. But it's not creating the log file in /tmp. Even if I add a "touch /tmp/x" in sa-learn-pipe.sh it's not created. So how I can check if it works correctly? dovecot version 2.2.26.0 /var/log/debug although contains: Nov 23 18:36:49 daedalus imap [fzielcke(a)z-51.de 80.187.96.201 UID MOVE]: antispam: mail copy: src spam: 1, dst spam: 0, src unsure: 0 Nov 23 18:36:49 daedalus imap [fzielcke(a)z-51.de 80.187.96.201 UID MOVE]: antispam: running mailtrain backend program /usr/bin/sa-learn-pipe.sh Nov 23 18:36:49 daedalus imap [fzielcke(a)z-51.de 80.187.96.201 UID MOVE]: antispam: running mailtrain backend program /usr/bin/sa-learn-pipe.sh Nov 23 18:36:49 daedalus imap [fzielcke(a)z-51.de 80.187.96.201 UID MOVE]: antispam: running mailtrain backend program parameter 1 --ham # doveconf -n |grep antispam antispam_backend = pipe antispam_debug_target = syslog antispam_pipe_program = /usr/bin/sa-learn-pipe.sh antispam_pipe_program_notspam_arg = --ham antispam_pipe_program_spam_arg = --spam antispam_pipe_tmpdir = /tmp antispam_spam_pattern_ignorecase = SPAM antispam_trash_pattern_ignorecase = trash;Deleted * antispam_verbose_debug = 1 mail_plugins = acl zlib quota imap_zlib imap_acl imap_quota antispam

1 0

Active sieve script symbolic link doesn't update when changed.
by Steven Mainor 23 Nov '16

23 Nov '16

While setting up sieve on my email server I mistakenly setup a symlink (~/sieve/myfilter.svbin > ~/.dovecot.sieve) but I think that that should have been (~/sieve/myfilter.sieve > ~/.dovecot.sieve). I have fixed the mistake but dovecot/sieve still throws an error saying that the symlink still links to the wrong file. I have made sure the symlink is fixed (it links to ~/sieve/myfilter.sieve) and I tried restarting dovecot and the server but nothing works. I still get the error and my sieve filters aren't processed. Any help would be greatly appreciated. ~# grep sieve /var/log/syslog | nano temp.save Nov 23 01:32:09 1 dovecot: lda(steve(a)degga.net): Warning: sieve: file storage: Active Sieve script symlink /var/mail/vmail/degga.net/steve/.dovecot.sieve is broken: Invalid scriptname (points to myfilter.svbin). vmail@1:/var/mail/vmail/degga.net/steve/mail$ ls -l -a #redacted irrelevant stuff lrwxrwxrwx 1 vmail vmail 14 Nov 23 02:43 .dovecot.sieve -> myfilter.sieve vmail@1:/var/mail/vmail$ dovecot -n # 2.2.22 (fe789d2): /etc/dovecot/dovecot.conf # Pigeonhole version 0.4.13 (7b14904) # OS: Linux 4.4.0-47-generic x86_64 Ubuntu 16.04.1 LTS ext4 auth_mechanisms = plain login auth_verbose = yes mail_home =/var/mail/vmail/%d/%n mail_location = maildir:/var/mail/vmail/%d/%n/mail:LAYOUT=fs managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext namespace inbox { inbox = yes location = mailbox Drafts { auto = subscribe special_use = \Drafts } mailbox Junk { auto = subscribe special_use = \Junk } mailbox Sent { auto = subscribe special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { auto = subscribe special_use = \Trash } prefix = } passdb { args = username_format=%u scheme=ssha512 /etc/dovecot/passwd.db driver = passwd-file } plugin { sieve = ~/.dovecot.sieve sieve_after = /var/mail/vmail/sieve-after sieve_before = /var/mail/vmail/sieve-before sieve_dir = ~/sieve } protocols = imap sieve service auth { unix_listener /var/spool/postfix/private/dovecot-auth { group = postfix mode = 0660 user = postfix } } # SSL information redacted here. userdb { args = uid=vmail gid=vmail home=/var/mail/vmail/%d/%n driver = static } protocol lda { deliver_log_format = msgid=%m: %$ mail_plugins = sieve postmaster_address =postmaster(a)degga.net quota_full_tempfail = yes rejection_reason = Your message to <%t> was automatically rejected:%n% r } protocol imap { imap_client_workarounds = delay-newmail tb-extra-mailbox-sep mail_max_userip_connections = 10 }

2 2

Exim still accepting emails to nonexistent users
by Marti Markov 23 Nov '16

23 Nov '16

After adding the configuration bit: deny message = invalid recipient domains = +local_domains !verify = recipient/callout=no_cache from: http://wiki2.dovecot.org/LMTP/Exim <http://wiki2.dovecot.org/LMTP/Exim> running update-exim4.conf and service exim4 restart the server is still accepting emails to recipients that do not exist in dovecot. Any ideas?

3 6

Single user to have lrw to all mailboxes
by Marti Markov 23 Nov '16

23 Nov '16

I have implemented a global acl: * owner lrwstipkae INBOX.Spam owner lrwstipeka .Trash owner lrwsti INBOX.Trash owner lrw * user=master-user(a)mydomain.com lrs * owner lrwstipkae But the master-user then loses all other permissions on his own mailbox, he is left only with: lrs Any pointers on how to fix this?

1 0

Good email client to use with Dovecot?
by Steve Litt 22 Nov '16

22 Nov '16

Hi all, When I use an email client, its purpose is as a window into my Dovecot IMAP, and as a mechanism to reply to and send emails. I don't do filtering or calendaring on my email client (filtering via procmail direct to Dovecot). What email clients are all of you using to look at your IMAP email? Thanks, SteveT Steve Litt November 2016 featured book: Quit Joblessness: Start Your Own Business http://www.troubleshooters.com/startbiz

20 40

LDAP auth problems "unknown user"
by Nikolai Lusan 22 Nov '16

22 Nov '16

Hi, I am setting up a dovecot instance to host a bunch of virtual domains, with ldap backing for auth. I am using a single hostname for test purposes, with a couple of entries in the diectory. If I use auth binds I get a result, but this does not suit the end purpose of the server. If I use ldapsearch with the same base, search filter, and credentials as the ldap auth config I get the correct attributes returned, and I have bit of perl that verifies the password hash matches the password provided. I am running out of ideas here, I had thought of putting in a custom bit of perl and using the checkpassword method, but this is sub optimal. If anyone can help with this I'd be grateful. # dovecot --version 2.2.26.0 (23d1de6) # dovecot -n # 2.2.26.0 (23d1de6): /etc/dovecot/dovecot.conf # Pigeonhole version 0.4.16 (fed8554) # OS: Linux 4.8.0-1-amd64 x86_64 Debian stretch/sid ext3 auth_cache_size = 2 M auth_debug = yes auth_debug_passwords = yes auth_default_realm = maliuta.org auth_master_user_separator = * auth_mechanisms = plain login auth_realms = maliuta.org auth_verbose = yes auth_verbose_passwords = yes first_valid_uid = 117 last_valid_uid = 117 lda_mailbox_autocreate = yes login_log_format_elements = user=<%u> method=%m rip=%r lip=%l mpid=%e %c mail_gid = vmail mail_location = maildir:/var/spool/vmail/%d/%n/Maildir mail_uid = vmail managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded- character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext namespace inbox { inbox = yes list = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } passdb { args = /etc/dovecot/ldap/maliuta.org-ldap.conf.ext driver = ldap } plugin { sieve = file:~/sieve;active=~/.dovecot.sieve } protocols = " imap lmtp sieve" service auth-worker { user = $default_internal_user } service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0660 user = postfix } unix_listener auth-userdb { group = vmail mode = 0660 user = vmail } user = $default_internal_user } service dict { unix_listener dict { group = vmail mode = 0660 user = vmail } } service imap-login { inet_listener imap { port = 143 } inet_listener imaps { port = 0 } } service lmtp { unix_listener /var/spool/postfix/private/dovecot-lmtp { group = postfix mode = 0660 user = postfix } } ssl_cert = # grep -v '^ *$#.*$\?$' /etc/dovecot/ldap/maliuta.org-ldap.conf.ext uris = ldap://localhost dn = cn=admin,dc=maliuta,dc=org dnpass = <secret> tls = yes tls_ca_cert_dir = /etc/ssl/certs auth_bind = no ldap_version = 3 base = ou=mail,dc=mailuta,dc=org scope = subtree default_pass_scheme = SSHA deref = never user_attrs = postfixDeliveryAddress=user user_filter = (&(postfixDeliveryEnabled=TRUE)(objectClass=postfixMailPerson)) pass_attrs = postfixDeliveryAddress=user,userPassword=password pass_filter = (&(postfixDeliveryEnabled=TRUE)(objectClass=postfixMailPerson)(postfixD eliveryAddress=%u)) iterate_attrs = uid=user iterate_filter = (objectClass=postfixMailPerson) # ldapsearch -H ldap://localhost:389 -x -D 'cn=admin,dc=maliuta,dc=org' -W -b "ou=mail,dc=maliuta,dc=org" -s sub -LLL -ZZ '(&(postfixDeliveryEnabled=TRUE)(objectClass=postfixMailPerson)(postfixDeliveryAddress=nikolai(a)test.maliuta.org))' uid userPassword Enter LDAP Password: dn: mail=nikolai(a)test.maliuta.org,ou=mail,dc=maliuta,dc=org uid: nikolai userPassword:: e1NTSEF9QVBZMTlaeGw1cWd0a25XeGxURXdqM2g5Yk5YL3BxOGY= ## From /var/log/mail.log Nov 20 07:24:20 kiliya dovecot: auth: Debug: auth client connected (pid=27086) Nov 20 07:24:20 kiliya dovecot: auth: Debug: client in: AUTH#0111#011PLAIN#011service=imap#011secured#011session=1kW2C65BFI2WZbl8#011lip=<local_ip>#011rip=<remote_ip>#011lport=143#011rport=36116#011local_name=<hostname>#011resp=AG5pa29sYWlAdGVzdC5tYWxpdXRhLm9yZwBmb29iYXIzMzQ0 (previous base64 data may contain sensitive data) Nov 20 07:24:20 kiliya dovecot: auth: Debug: ldap(nikolai(a)test.maliuta.org,<remote_ip>,<1kW2C65BFI2WZbl8>): cache miss Nov 20 07:24:20 kiliya dovecot: auth: Debug: ldap(nikolai(a)test.maliuta.org,<remote_ip,<1kW2C65BFI2WZbl8>): pass search: base=ou=mail,dc=mailuta,dc=org scope=subtree filter=(&(postfixDeliveryEnabled=TRUE)(objectClass=postfixMailPerson)(postfixDeliveryAddress=nikolai(a)test.maliuta.org)) fields=postfixDeliveryAddress,userPassword Nov 20 07:24:20 kiliya dovecot: auth: ldap(nikolai(a)test.maliuta.org,<remote_ip>,<1kW2C65BFI2WZbl8>): unknown user (given password: <correct_password>) Nov 20 07:24:22 kiliya dovecot: auth: Debug: client passdb out: FAIL#0111#011user=nikolai(a)test.maliuta.org -- Nikolai Lusan <nikolai(a)lusan.id.au>

2 2

Maildir migration from Dovecot to Dovecot
by Marco Hofmann (XenAdmin) 22 Nov '16

22 Nov '16

Hello everbody, I'm a proud user of Dovecot 2.2.9 on Ubuntu 14.04 LTS. I currently migrate all my Linux services to a new Debian 8 Jessie Server. On this server I installed and configured Dovecot 2.2.24. Now I search a way to migrate the two IMAP users I have on this server preserving all timestamps, folders and flags. Yes, only two ;-) I read the following two articles: http://wiki2.dovecot.org/Tools/Doveadm/Sync http://wiki2.dovecot.org/Migration/Dsync But I must say, that either these articles are not so good, or I act quite dumb. I understand that I have to use "doveadm backup" against my old server to make a one sync with all properties of each mail. What I miss are proper examples and that there are so many options, I could set. But what confuses me most is the the configuration file in (http://wiki2.dovecot.org/Migration/Dsync) which I don't know how to reference? Am I using the wrong guides, are the article someway misleading or is there anything else I'm overlooking? Thank you so much! -- Marco Hofmann https://www.meinekleinefarm.net/ Twitter: @ZomboBrain

2 1