- dovecot - dovecot.org

How to Analyze Missing UIDs (and Files) in Maildirs?
by Jochen Bern 11 Nov '16

11 Nov '16

Hello everyone, I would like pointers on how to analyze the following situation, please: I'm running one test and one production dovecot IMAPS server for one of our platforms. The clients are essentially appliances we distribute, auth by client cert, virtual users only, mailboxes in maildir format: > auth_ssl_require_client_cert = yes > auth_ssl_username_from_cert = yes > auth_mechanisms = plain > ssl = required > ssl_cert = </etc/pki/dovecot/certs/... > ssl_key = </etc/pki/dovecot/private/... > ssl_ca = </etc/pki/dovecot/certs/... > ssl_verify_client_cert = yes > mail_location = maildir:~ > userdb { > driver = static > args = uid=... gid=... home=/home/.../%Ld_realm/%Ln > } > passdb { > driver = static > args = password=... > } The client certs have CNs unique to the appliance and no client besides that appliance is supposed to access the mailbox. Appliances take note of the UIDs they've seen (and not yet deleted) and expect to be able to re-access e-mails by the UIDs they know. (Needless to say, I keep my hands away from the cache files so as not to cause the UIDs to be reassigned.) The dovecot version used is updated along with the CentOS 6 source RPMs - which contain a 2.0.9 plus whatever patches CentOS backported - and receives two additional patches from me, one from current dovecot sources to improve closure of inactive SSL connections and one from me that turns the IMAP CREATE command into a NOP; the appliance code doesn't expect mailboxes to have folders besides INBOX. ------- QA is looking into an upcoming new feature that requires appliances to reread old e-mails, and got errors that UIDs the test appliances expected to still be on the (test) server weren't. I verified, the UIDs are indeed absent from the dovecot-uidlist files. The mails in question arrived *sometime* over the course of the last 12 months and must've vanished *sometime* since then ... ugh. No trace of what may have happened to them in any logs, of course. On the test server, I re-enabled logging of DELETE, UNDELETE and EXPUNGE commands, in case the appliances delete mails themselves and forget to update their own cache. Are there other IMAP commands that could remove mails, and thus should be added to the list? Would it be possible to have dovecot configured so that there's a log entry whenever a client tries to retrieve a UID that dovecot doesn't have in the maildir anymore? ------- While looking into the above issue, I noticed that a large number of mailboxes (test as well as production) have UIDs that *are* listed in dovecot-uidlist, yet, no corresponding file is present anymore. Example: > # grep -c : *_realm/$EXAMPLE_USER/dovecot-uidlist > 58 > # grep : *_realm/$EXAMPLE_USER/dovecot-uidlist | sed -e '2,57d' -e 's/ .*//' > 1 > 152 > # for PAIR in `grep : *_realm/$EXAMPLE_USER/dovecot-uidlist | sed -e 's/ .*:/:/'` ; do > > IMAP_UID=`echo $PAIR | sed -e 's/:.*//'`; BASE=`echo $PAIR | sed -e 's/.*://'` > > CNT=`find *_realm/$EXAMPLE_USER -type f -name "$BASE"'*' -ls | wc -l` > > if [ $CNT -ne 1 ]; then echo "Found $CNT files for UID $IMAP_UID"; fi; done > Found 0 files for UID 135 > Found 0 files for UID 136 > Found 0 files for UID 139 > Found 0 files for UID 142 > Found 0 files for UID 143 > Found 0 files for UID 144 > Found 0 files for UID 145 > Found 0 files for UID 150 > Found 0 files for UID 151 Is that normal behaviour? If not, how would I try to find out what happens there? Kind regards, -- Jochen Bern Systemingenieur Fon: +49 6151 9067-231 Fax: +49 6151 9067-290 E-Mail: jochen.bern(a)binect.de www.binect.de www.facebook.de/binect Binect GmbH Robert-Koch-Straße 9, 64331 Weiterstadt, DE Geschäftsführung: Christian Ladner, Dr. Frank Wermeyer, Nils Manegold Unternehmenssitz: Weiterstadt Register: Amtsgericht Darmstadt, HRB 94685 Umsatzsteuer-ID: DE 221 302 264 MAX 21-Unternehmensgruppe

1 0

Enterprise Edition: Any known access issues with the repo? Have existing accounts been expired?
by deoren 11 Nov '16

11 Nov '16

Hi, I'm getting errors when attempting to run apt-get update on an Ubuntu 14.04 box where I've had an existing EE installation for some time: > W: Failed to fetch https://apt.dovecot.fi/stable-2.2/ubuntu/trusty/dists/trusty/main/binary-am… HttpError401 > > W: Failed to fetch https://apt.dovecot.fi/stable-2.2/ubuntu/trusty/dists/trusty/main/binary-i3… HttpError401 > > E: Some index files failed to download. They have been ignored, or old ones used instead. I'm running 2.2.25.5 now and when I looked at the announcement forum[1] I see a posting[2] for 2.2.26.1, but nothing about repo changes. For what it is worth, I use the EE credentials on only a single node so I am hopefully not triggering any abuse thresholds. I tried accessing the URL used in the /etc/apt/sources.list.d/FILENAME.list file via a web browser and it isn't accepting the provided username/password. Have existing credentials been expired? If so, what is the next step to restore access? Thanks. References: [1] https://forum.open-xchange.com/forumdisplay.php?35-Dovecot-Announcements [2] http://software.open-xchange.com/products/dovecot/doc/Release_Notes_for_Dov…

2 1

Maildir filename has wrong S value - possible culprit
by Libor Pavlík 11 Nov '16

11 Nov '16

Hi, I'm new to dovecot but as I see in mailinglist archive this issue is old and I didn't find this in archive. One of cuplrits (I believe not the only possible) is spamassassin. It's added headers make exactly the difference between S value and filesize. Probably it's in the way emails are processed in "manufactory" of Qmail+Vpopmail+Spamassassin but now I'm not able to say how can it be repaired. As mentioned above I'm using solution with Qmail+Vpopmail+Spamassassin+Dovecot, my Dovecot version is 2.2.26.0. Libor Pavlík

1 0

post-delivery virus scan
by Brad Koehn 11 Nov '16

11 Nov '16

I have discovered that many times the virus definitions I use for scanning messages (ClamAV, with the unofficial signatures http://sanesecurity.com/usage/linux-scripts/) are updated some time after my server has received an infected email. It seems the virus creators are trying to race the virus definition creators to see who can deliver first; more than half of the infected messages are found after they’ve been delivered. Great. To help detect and remove the infected messages after they’ve been delivered to users’ mailboxes, I created a small script that iterates the INBOX and Junk mailbox directories, scans recent messages for viruses, and deletes them if found. The source of my script (run via cron) is here: https://gitlab.koehn.com/snippets/9 Unfortunately Dovecot doesn’t like it if messages are deleted (dbox) out from under it. I tried a doveadm force-resync on the folder containing the messages, but it seems Dovecot is still unhappy. At least on the new version (2.2.26.0) it doesn’t crash; 2.2.25 would panic and coredump when it discovered messages had been deleted. I’m wondering if there’s a better way to scan recent messages and eradicate them so the Dovecot isn’t upset when it happens. Maybe using doveadm search? Looking for suggestions. --- Brad

6 9

Re: How does one mark all messages as read (imap4flag "seen") with sieve?
by Ben Johnson 11 Nov '16

11 Nov '16

On 11/10/2016 2:02 AM, Aki Tuomi wrote: > Hi! > > Can you provide bt full from gbd? > > Install debug symbols and acquire core file > > Run gdb /path/to/bin /path/to/core > > Issue bt ful > > Send it to list. > > > Aki Tuomi > > Dovecot oy > > > > On November 10, 2016 at 2:42 AM Larry Rosenman <larryrtx(a)gmail.com> > wrote: > > looks to me from the coredump (although you pointed to the wrong binary) > that > deliver was PANIC()'ing with > > io_add(0x%x) called twice fd=%d, callback=%p -> %p > > I'm not sure what that message means, but maybe one of the dovecot folks > does. > > Are all the packages built together? > > Are you averse to compiling stuff yourself? Thanks so much for the assistance here, Larry and Aki. Aki, you had asked me to send this core-dump to the list when I asked about it back in September; I did post the "bt full" output at that time, but there were no further replies: http://www.dovecot.org/list/dovecot/2016-September/105428.html And for convenience, here is the "bt full" output I posted back then: http://pastebin.com/4xdGNXa6 So, this is where I'm confused: Larry, you mentioned "although you pointed to the wrong binary", which is a concern I had asked about back in September: http://www.dovecot.org/list/dovecot/2016-September/105424.html I still don't understand how this is pointing to the wrong binary: # gdb /usr/lib/dovecot/dovecot-lda /var/vmail/tmp/core-deliver-6-5000-5000-29125-1473732949 Is /usr/lib/dovecot/dovecot-lda not the binary that segfaulted here? Sure, the gdb output says, "Core was generated by `/usr/lib/dovecot/deliver ...", but on the system in question, that is a symlink pointing to /usr/lib/dovecot/dovecot-lda: # ls -lah /usr/lib/dovecot/deliver lrwxrwxrwx 1 root root 11 Sep 21 10:29 /usr/lib/dovecot/deliver -> dovecot-lda What am I missing here? The mismatch message does say something specific about this: warning: the debug information found in "/lib64/ld-2.23.so" does not match "/lib64/ld-linux-x86-64.so.2" (CRC mismatch). Is this the result of pointing to the wrong executable when calling "gdb"? If so, where is the correct executable to pass as the fist argument? Again, for convenience, the pipe script I'm using: http://pastebin.com/zXzBDcvG And the debug output from said pipe script: http://pastebin.com/rz2f4S4G My full "doveconf -n": http://pastebin.com/hCgpA009 Thanks! -Ben

1 0

service doveadm : ssl problems
by nerbrume＠free.fr 10 Nov '16

10 Nov '16

Hello, I'm using dovecot 2.2.13 on Debian stable. My users are authenticated through PAM, and stored in an LDAP backend I'm trying to set-up replication with ssl, following (mainly) this : http://wiki2.dovecot.org/Replication 1) I only diverted from the instructed setup by not setting "doveadm_port = 12345", as it would give me errors of the like: > Fatal: /var/run/dovecot/auth-userdb: Configured passdbs don't support crentials lookups (to see if user is proxied, because doveadm_port is set) but rather specifying the port in the mail_replica setting : "mail_replica = tcps:my.domain.com:1465" (following a mail from here : http://www.dovecot.org/list/dovecot/2016-September/105356.html) So far, this seems to be working for me. 2) However, I'm having ssl problems. I have a let's encrypt certificate, and have concatened the CA cert and my server cert in a fullchain.pem. Excerpt from my ssl config : > ssl = yes > ssl_cert = </etc/letsencrypt/live/my.domain.com/fullchain.pem > ssl_key = </etc/letsencrypt/live/my.domain.comi/privkey.pem doveadm return me these errors (sudo -u dovecot doveadm -v sync -u user tcps:my.domain.com:12345) : > doveadm(casoli): Info: Received invalid SSL certificate: unable to get local issuer certificate: /CN=my.domain.com > doveadm(casoli): Error: doveadm server disconnected before handshake: Received invalid SSL certificate: unable to get local issuer certificate: /CN=my.domain.com > doveadm(casoli): Fatal: Disconnected from remote: Received invalid SSL certificate: unable to get local issuer certificate: /CN=my.domain.com Which I can reproduce with openssl (openssl s_client -showcerts -CApath /etc/ssl/certs -connect my.domain.com:12345) : > (...) > Verify return code: 21 (unable to verify the first certificate) Indeed, in this case, dovecot only returns the local part of the certificate (my.domain.com) and not the full chain (with the intermediate CA). While testing regular IMAPS with openssl is ok (openssl s_client -showcerts -CApath /etc/ssl/certs -connect my.domain.com:993) > (...) > Verify return code: 0 (ok) And I can see the full chain. So, it's seems to me that doveadm is somehow wrongly serving my certificate, truncating it, but I can't see why, and if this is a misconfiguratin on my part. I can post more config files or message outputs if needed, I kept them redacted here for the sake of brevity. Regards, N

2 2

Dovecot 2 LDAP "unknown user"
by Peter Fraser 10 Nov '16

10 Nov '16

Hi All I am using Dovecot dovecot2-2.2.25_6 on FreeBSD 11. I am trying to set up LDAP authentication to Active Director as I had it in version 1 of Dovecot. My settings are at bottom. When I run doveadm auth test username, I get back root@BSD-11:/usr/local/etc/dovecot # doveadm auth test username Password: passdb: user auth succeeded extra fields: user=username root@BSD-11:/usr/local/etc/dovecot # But when I run telnet 127.0.0.1 110 and try to log in it says unknown user. Error below in maillog. BSD-11 dovecot: pop3: Error: Authenticated user not found from userdb, auth lookup id=2262958081 (client-pid=2273 client-id=1) Nov 1 15:15:41 BSD-11 dovecot: pop3-login: Internal login failure (pid=2273 id=1) (internal failure, 1 successful auths): user= root@BSD-11:/usr/local/etc/dovecot # doveconf -n # 2.2.25 (7be1766): /usr/local/etc/dovecot/dovecot.conf # OS: FreeBSD 11.0-RELEASE-p1 i386 auth_debug = yes auth_verbose = yes listen = * login_greeting = Mail Server ready. mail_location = maildir:~/Maildir namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } passdb { args = /usr/local/etc/dovecot/dovecot-ldap.conf.ext driver = ldap } ssl_cert = </usr/local/etc/certs/certs/dovecot.pem ssl_key = </usr/local/etc/certs/private/dovecot.pem userdb { args = /usr/local/etc/dovecot/dovecot-ldap.conf.ext driver = ldap } protocol lda { mail_plugins = } #Contents of dovecot-ldap.conf.ext hosts = 192.168.153.143 dn = user(a)domain.com dnpass = password auth_bind = yes auth_bind_userdn = domain\%u ldap_version = 3 base = dc=domain,dc=com pass_filter = (&(objectclass=person)(uid=%u)) user_attrs = homeDirectory=/home/vmail/%u,uid=1002,gid=1002 Amy help would be appreciated.

3 9

question concerning junk folder
by Rajesh M 10 Nov '16

10 Nov '16

hi using centos 6.5, qmailtoaster, dovecot, spamassassin. i found that junk folder is specified under /etc/dovecot/conf.d/15-mailboxes.conf the issue is that this folder is getting created automatically and genuine emails from both within the server and also from external domains are being routed to the Junk folder. all these emails are not scanned by spamassasin. i wish to disable to creation of Junk folder and also routing of emails to the Junk folder. help required please. ##################### # NOTE: Assumes "namespace inbox" has been defined in 10-mail.conf. namespace inbox { # These mailboxes are widely used and could perhaps be created automatically: mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Trash { special_use = \Trash } ##################### rajesh

2 1

search body with wildcards
by W. de Hoog 10 Nov '16

10 Nov '16

Hi, A question. We are using fts_solr. When searching for content in BODY I noticed that dovecot only supports full words. "BODY calibration" returns results but "BODY calibra" does not. Nor "BODY calibra*". Solr does support searching with wildcards so why is it that dovecot does not? regards, -- Willem-Jan de Hoog

1 2

tons of dovecot/config processes
by Arkadiusz Miśkiewicz 10 Nov '16

10 Nov '16

Hi. I've noticed that dovecot (using 2.2.26.0 here) starts dovecot/config processes that stay for long time. Example: [root@ixion-pld ~]# service dovecot restart Stopping Dovecot service.......................................................................................................................................[ DONE ] Starting Dovecot service.......................................................................................................................................[ DONE ] [root@ixion-pld ~]# ps aux|grep dovecot root 25333 0.0 0.0 13736 2480 ? Ss 09:40 0:00 /usr/sbin/dovecot dovecot 25336 0.0 0.0 9480 924 ? S 09:40 0:00 dovecot/anvil [0 connections] root 25337 0.0 0.0 9612 2416 ? S 09:40 0:00 dovecot/log root 25339 0.0 0.0 12496 3256 ? S 09:40 0:00 dovecot/config root 25341 0.0 0.0 132168 888 pts/1 S+ 09:40 0:00 grep dovecot [root@ixion-pld ~]# doveadm reload [root@ixion-pld ~]# ps aux|grep dovecot root 25333 0.0 0.0 13872 2720 ? Ss 09:40 0:00 /usr/sbin/dovecot dovecot 25336 0.0 0.0 9480 924 ? S 09:40 0:00 dovecot/anvil [0 connections] root 25344 0.0 0.0 9612 2428 ? S 09:40 0:00 dovecot/log root 25346 0.0 0.0 12496 3192 ? S 09:40 0:00 dovecot/config root 25348 0.0 0.0 132168 876 pts/1 S+ 09:40 0:00 grep dovecot so far good - only one dovecot/config. Lets connect to pop3 and keep connection [root@ixion-pld ~]# telnet localhost pop3 Trying 127.0.0.1.110... Connected to localhost. Escape character is '^]'. +OK Mail server ready. on the other console [root@ixion-pld ~]# ps aux|grep dovecot root 25333 0.0 0.0 13872 2720 ? Ss 09:40 0:00 /usr/sbin/dovecot dovecot 25336 0.0 0.0 9480 924 ? S 09:40 0:00 dovecot/anvil [2 connections] root 25344 0.0 0.0 9612 2428 ? S 09:40 0:00 dovecot/log root 25346 0.0 0.0 12496 3192 ? S 09:40 0:00 dovecot/config dovenull 25364 0.0 0.0 20908 4080 ? S 09:41 0:00 dovecot/pop3-login [127.0.0.1] dovecot 25365 0.0 0.0 100236 7776 ? S 09:41 0:00 dovecot/auth [0 wait, 0 passdb, 0 userdb] root 25368 0.0 0.0 132168 856 pts/1 S+ 09:41 0:00 grep dovecot so there is a client connected and one dovecot/config. Lets reload: [root@ixion-pld ~]# doveadm reload [root@ixion-pld ~]# ps aux|grep dovecot root 25333 0.0 0.0 13872 2752 ? Ss 09:40 0:00 /usr/sbin/dovecot dovecot 25336 0.0 0.0 9480 924 ? S 09:40 0:00 dovecot/anvil [2 connections] root 25344 0.0 0.0 9612 2428 ? S 09:40 0:00 dovecot/log root 25346 0.0 0.0 12920 3700 ? S 09:40 0:00 dovecot/config dovenull 25364 0.0 0.0 20908 4080 ? S 09:41 0:00 dovecot/pop3-login [127.0.0.1] dovecot 25365 0.0 0.0 100236 7776 ? S 09:41 0:00 dovecot/auth [0 wait, 0 passdb, 0 userdb] root 25371 0.0 0.0 9612 2196 ? S 09:41 0:00 dovecot/log root 25373 0.0 0.0 12496 3196 ? S 09:41 0:00 dovecot/config root 25375 0.0 0.0 132168 856 pts/1 S+ 09:41 0:00 grep dovecot now we have two dovecot/config processes. Second dovecot/config stays there until client disconnects (what for?). When clients disconnects we are back to single dovecot/config: [root@ixion-pld ~]# ps aux|grep dovecot root 25333 0.0 0.0 13872 2752 ? Ss 09:40 0:00 /usr/sbin/dovecot dovecot 25336 0.0 0.0 9480 924 ? S 09:40 0:00 dovecot/anvil [0 connections] root 25371 0.0 0.0 9612 2196 ? S 09:41 0:00 dovecot/log root 25373 0.0 0.0 12496 3196 ? S 09:41 0:00 dovecot/config root 25418 0.0 0.0 132168 852 pts/1 S+ 09:43 0:00 grep dovecot Now on production server where are tons of clients this looks more insane: # ps aux|grep dovecot/config | wc -l 56 Note that I'm running with shutdown_clients = no here (+ high performance auth/login variant). So looks like something is not right here. Obviously with shutdown_clients=yes this doesn't occur since clients are disconnected. doveadm reload can happen every 2 minutes (because dovecot requires reload when SSL certificates change; new domain gets added, new cert gets automatically created -> reload, certificate is renewed (every 2 months) -> reload etc) -- Arkadiusz Miśkiewicz, arekm / ( maven.pl | pld-linux.org )

1 0