- dovecot - dovecot.org

Conditionally Filter Mails During IMAP Fetch
by Ory Drilon 17 May '17

17 May '17

Hi, is there a way to arbitrarily filter out mails at the moment the IMAP request is made, based on properties of the IMAP session and the mail itself? All the filtering methods I find occur during delivery time.

2 1

Re: ACL and virtual user
by Davide Marchi 15 May '17

15 May '17

...I had under my eyes the solution I have not seen: * user=foo lrw Public user=bar lrwstipekxa Public/* user=bar lrwstipekxa I was enough (in my case) add the initial "*" wildcards, like this: * user=info(a)mydomain.com lrwsi where the "*" wildcards means all groups. I have verified and so the configuration is perfect, the user can not delete their own messages The fact remains that on the wiki dovecot ACL these steps, in the case of virtual users, are not clear, at least in my opinion. :-) I hope at least that my experience can be of assistance to other users. Many many thanks! Davide

1 0

ACL and virtual user
by Davide Marchi 15 May '17

15 May '17

Hi friends, I would like to remove write rights for a specific virtual user/email address. I've read the wiki "https://wiki2.dovecot.org/ACL" but there is nothing about it. So I started reading and rereading some old ML, like this: https://www.dovecot.org/list/dovecot/2006-June/013683.html where they talk about something like that but I would like to implement current guidelines for the "Global ACL file" and for virtual user. So I've try: * user=foo lrw Public user=bar lrwstipekxa Public/* user=bar lrwstipekxa But in my case for virtual user, so I tried (obviously I changed the email address with a generic one): -------------- #user=info(a)mydomain.com lrwsi -------------- Log: May 15 10:40:44 server dovecot: imap(info(a)mydomain.com): Error: Global ACL file /etc/dovecot/dovecot-acl line 1: Unknown ID 'lrwsi' -------------- #owner #user=info at mydomain.com lrwsi -------------- Log: May 15 10:47:58 server dovecot: imap(info(a)mydomain.com): Error: Global ACL file /etc/dovecot/dovecot-acl line 1: Missing ACL rights -------------- #user=info at mydomain.com lrwsi -------------- Log: May 15 10:51:57 server dovecot: imap(info(a)mydomain.com): Error: Global ACL file /etc/dovecot/dovecot-acl line 2: Unknown ID 'at' But none of these gave results, could you explain better or gime me an example? Many many thanks! Davide Italy

1 0

[BUG] doveadm kick doesn't play well with hibernate
by Christian Balzer 14 May '17

14 May '17

Hello, Dovecot 2.2.27 (Debian Jessie backports). When issuing a "doveadm kick" for a specific user I was greeted by: --- "warning: other connections would also be kicked from following users:" --- and a list of 22odd thousand users. As it turns out, kick wants to smack the hibernation proces(ses) that have hibernated sessions for this user, obviously the wrong approach here. If there's doveadm command to wake up and thus un-hibernate sessions for a specific user this could be used as a workaround but a quick glance suggest no such thing. This functionality is absolutely crucial for us as we need this for our custom mailbox migration functionality. If there's no workaround or fix within 2 months I'll be forced to disable hibernation again (with a heavy heart). Regards, Christian -- Christian Balzer Network/Systems Engineer chibi(a)gol.com Global OnLine Japan/Rakuten Communications http://www.gol.com/

2 2

Dovecot 2.2.29.1 + VPopMail 5.4.33
by Nicholas Chua 12 May '17

12 May '17

Hi all, I have a fresh installation of a Vpopmail 5.4.33 + Dovecot 2.2.29.1 + SQL As usual I followed the AuthDatabase/VPopMail wiki password_query = SELECT CONCAT(pw_name, '@', pw_domain) AS user, \ pw_clear_passwd AS password \ FROM vpopmail \ WHERE pw_name = '%n' AND pw_domain = '%d' user_query = SELECT pw_dir as home, \ 89 AS uid, 89 AS gid \ FROM vpopmail \ WHERE pw_name = '%n' AND pw_domain = '%d' For VPopMail, I prefer to have an individual table in the vpopmail database for each domain. So my structure will be something like this vpopmail.abc_com vpopmail.xyz_com To achieve this I add this configure when compiling VPopMail --disable-many-domains But dovecot will not read vpopmail.abc_com, instead it keep looking for vpopmail.vpopmail auth-worker(8643): Warning: mysql: Query failed, retrying: Table 'vpopmail.vpopmail' doesn't exist If I remove --disable-many-domains in the configuration, I have no issue. Is there a new password and user query to have this working? The last working version I had installed is Dovecot 2.2.15 Thank you nic

1 0

folders in public namespace only visable to 2nd folder level in 2.2.29.1
by Andreas Oster 11 May '17

11 May '17

Hi all, I am currently facing an issue with Dovevot version 2.2.29.1 where subfolders in a public namespace are only visible to the 2nd folder level: namespace Public -> folder "1st" -> folder -> "2nd" -> folder "3rd" .... When one user creates a subfolder below the 2nd level other users do not see that folder and are unable to subscribe to this folder. Folders created under the 1st level however are visible and subscribable by other users. namespace { disabled = no hidden = no ignore_on_failure = no inbox = no list = children type = public separator = / prefix = Public/ location = maildir:/var/vmail/public:INDEXPVT=~/Maildir/public subscriptions = no } I do not know at which point ( dovecot update ) this issue appeared. Does anyone face the same problem ? Thank you for your kind help best regards Andreas

5 5

Example for doveadm-save using Doveadm HTTP API
by KT Walrus 11 May '17

11 May '17

I could use an example of how to use curl to save a new message to a user’s INBOX using the Doveadm HTTP API. https://wiki2.dovecot.org/Design/DoveadmProtocol/HTTP <https://wiki2.dovecot.org/Design/DoveadmProtocol/HTTP> Do I really use the -d option and inline the entire new message in the command-line? Or, should I create a temporary .json file with the message wrapped in JSON and pass this filename to the -d option? Does anyone have a PHP class that abstracts the HTTP API commands? I’ve been using the Roundcube Framework to deliver new messages by IMAP, but I’m experimenting whether the Doveadm HTTP API might be a better solution. I eventually want my PHP code to do full administration of my users mailboxes. I was planning on using Sieve pipe PHP scripts in conjunction with IMAP to do full admin on mailboxes (as they receive new messages or change a flag, I would trigger maintenance on the mailbox such as deleting or moving to the trash old messages or filing a copy of a new message in a folder). Finally, is the Doveadm HTTP API stable enough to use in production? It seems like the documentation is rather minimal. Can this interface really be used for new message delivery instead of LMTP in production? Or, is this a bad idea to combine mailbox administration with new message delivery? Does anyone here use the Doveadm HTTP API in production? Kevin

3 5

confused with ssl settings and some error - need help
by Poliman - Serwis 09 May '17

09 May '17

Hi, To default dovecot.conf file I added (based on found documentation): ssl = required disable_plaintext_auth = yes #change default 'no' to 'yes' ssl_prefer_server_ciphers = yes ssl_options = no_compression ssl_dh_parameters_length = 2048 ssl_cipher_list = ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:CAMELLIA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA 1. Are these settings good or can be improved? 2. Is this line proper: ssl_protocols = !SSLv2 !SSLv3 !TLSv1 !TLSv1.1 or maybe should be: ssl_protocols = !SSLv2 !SSLv3 3. Last thing. I have below errors (they appear in loop in mail.err log file): #Apr 25 14:08:09 serwer-1 dovecot: imap-login: Error: SSL: Stacked error: error:140760FC:SSL routines:SSL23_GET_CLIENT_HELLO:unknown protocol #Apr 25 14:08:09 serwer-1 dovecot: imap-login: Error: SSL: Stacked error: error:1408A10B:SSL routines:ssl3_get_client_hello:wrong version number #Apr 25 14:08:51 serwer-1 dovecot: imap-login: Error: SSL: Stacked error: error:1408F119:SSL routines:SSL3_GET_RECORD:decryption failed or bad record mac #Apr 25 14:08:51 serwer-1 dovecot: imap-login: Error: SSL: Stacked error: error:1408A0C1:SSL routines:ssl3_get_client_hello:no shared cipher When I setup in postfix main.cf file (other lines default): tls_ssl_options = no_ticket, no_compression tls_preempt_cipherlist = yes smtpd_sasl_security_options=noanonymous,noplaintext smtpd_sasl_tls_security_options=noanonymous,noplaintext smtpd_tls_mandatory_ciphers = high smtpd_tls_dh1024_param_file = /etc/postfix/dh2048.pem #instead of below I tried smtpd_tls_mandatory_exclude_ciphers but I don't know what should be setup smtpd_tls_exclude_ciphers = aNULL, eNULL, EXPORT, DES, RC4, MD5, PSK, aECDH, EDH-DSS-DES-CBC3-SHA, EDH-RSA-DES-CBC3-SHA, ECDHE-RSA-DES-CBC3-SHA, DES-CBC3-SHA, RC4-MD5, RC4-SHA, ECDHE-RSA-RC4-SHA smtp_tls_exclude_ciphers = aNULL, eNULL, EXPORT, DES, RC4, MD5, PSK, aECDH, EDH-DSS-DES-CBC3-SHA, EDH-RSA-DES-CBC3-SHA, ECDHE-RSA-DES-CBC3-SHA, DES-CBC3-SHA, RC4-MD5, RC4-SHA, ECDHE-RSA-RC4-SHA Is between dovecot and postfix some communication using above ciphers or something that generate that errors in log or maybe some public client try connect and can't establish connection? Server with Ubuntu 16.04 LTS, postfix 3.1 and dovecot 2.2.22 and openssl 1.0.2k. -- *Pozdrawiam / Best Regards* *Piotr Bracha* *tel. 534 555 877* *serwis(a)poliman.pl <serwis(a)poliman.pl>*

2 8

error trying to access the doveadm http api
by KT Walrus 09 May '17

09 May '17

I’m trying out the the doveadm http api for the first time. When I do: $ curl -H "Authorization: Basic <base64 doveadm:doveadm_password>" http://localhost:8888 curl: (52) Empty reply from server In the logs, I see the following error: May 09 11:58:05 doveadm(10.0.0.17): Error: doveadm client not compatible with this server (mixed old and new binaries?) I am running Dovecot 2.2.29.1 in Docker containers. What am I doing wrong? Kevin

1 0

DoS (was IMAP-auth on LAN and otherwise)
by Rupert Gallagher 09 May '17

09 May '17

Today the problem raised its head again, with a twist. A LAN client lost the DNS setting that pointed directly to the LAN address of the IMAP server, and two things happened: the LAN client could not connect to IMAP as we know, and a telephone call from the external client reported the same. When the LAN client closed Thunderbird, then the external client regained access. There were no other clients online at the same time. It turns out that the single LAN client was making enough requests to saturate dovecot's authentication service. I already described the detail with wireshark. On Tue, May 2, 2017 at 3:46 PM, Rupert Gallagher <ruga(a)protonmail.com> wrote: Hello, Thunderbird has been bugging us with connection errors. Dovecot is installed on a local server that carries a local IP and a public IP. When Thunderbird on a local client connects successfully, Wireshark shows a SYN request from the client's IP on LAN to the public IP of the server, followed by the ACK from the same public IP. When Thunderbird on the same local client fails to connect, Wireshark shows a SYN request from the client's IP on LAN to the public IP of the server, followed by the ACK from the server's LAN address, the client does not accept the ACK as valid and sends a new SYN request. The loop eventually leads to time-out. At the client's console, the DNS query of the IMAP server always responds with the server's public IP address. It is evident from Wireshark that the dovecot server sends ACKs from two IPs. Is it possible to instruct Dovecot to use the public IP only?

2 2