- dovecot - dovecot.org

dovecot pre-install issue
by soumitri＠iitk.ac.in 17 Nov '16

17 Nov '16

Hello all, I am going for a dovecot director based setup (2 director+ 2 imap), more imap servers will be added later depending on demand/load. Presently I have 12000+ dovecot users with Maildir quota varying from 1 GB to 20GB. (peak hour IOPS 50000+) I am having 2 options in choosing dovecot version. 1) Old stable release. I.e RHEL, with prebuilt binary. This will be having less trouble in managing. Why RHEL still using version 2.2.10. 2) Latest release with best features and lesser known bugs. I.e CentOS7 with with latest compiled version. I have to be more involved if a bug is found. I will prefer a less admin work after the setup, with all/most features working. If you have a recent similar setup/dovecot gurus, Pl. suggest. With thanks & regards, -- Soumitri Mishra http://home.iitk.ac.in/~soumitri/

3 5

New Gmail Android App and Dovecot
by David Flanigan 16 Nov '16

16 Nov '16

Dovecot Users, I have a sudden new problem that has cropped up just recently and I am stumped. My implementation has been working for over a year with no issues. Version Data: Dovecot: v2.2.10 (using self signed certificates) openSSL: v1.01e Gmail Android App: v6.10.23 November 3, 2016 The issue: I use the iphone Gmail App to access my e-mail from phone and tablet. It is simple and supports multiple accounts very nicely. This has worked for better than 18 months without issue. This week I upgraded my Android app to the latest version of Gmail and I stopped getting incoming e-mail. I can still pick up via outlook and other tools I use, but just not the android version of Gmail. When I attempt to pick up mail i see the below error in my log file. _Nov 16 14:18:56 ns1 dovecot: imap-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=10.10.10.198, lip=10.1.1.10, TLS: SSL_read() failed: error:1408F10B:SSL routines:SSL3_GET_RECORD:wrong version number, session=<73vF8W9BdgCmrL7G>_ Disconnect and no new e-mail. There is no error in the Gmail app that I can find. The Gmail app works fine with my other accounts (Gmail, work, etc) so I am wondering if it is a configuration issue on my side or Gmail App stopped supporting something I was using. My SSl config is RPM standard other than SSL=yes and my self signed certificates. Any thoughts would be appreciated. -- Kind Regards, David

3 2

Crashing when run against OpenSSL 1.1.0c
by Michael Marley 15 Nov '16

15 Nov '16

Hi, I am running Dovecot 2.2.26.0 compiled against OpenSSL 1.1 and, since upgrading to OpenSSL 1.1.0c, the "lmtp" process has been crashing with SIGSEGV whenever it receives SIGINT. This always happens a minute or so after the lmtp process handles a message. It can also be manually reproduced by sending SIGINT to one of the running lmtp processes. I am compiling and running on an Ubuntu 17.04 x86_64 system using GCC 6.2. Here is the output of me reproducing it with gdb: (gdb) signal SIGINT Continuing with signal SIGINT. Program received signal SIGSEGV, Segmentation fault. 0x00007f6748cc2fb0 in ?? () (gdb) bt #0 0x00007f6748cc2fb0 in ?? () #1 0x00007f674872ac60 in ossl_init_thread_stop (locals=<optimized out>) at crypto/init.c:336 #2 0x00007f674872aee4 in OPENSSL_cleanup () at crypto/init.c:391 #3 0x00007f67491052e0 in __run_exit_handlers (status=0, listp=0x7f674948c5d8 <__exit_funcs>, run_list_atexit=run_list_atexit@entry=true, run_dtors=run_dtors@entry=true) at exit.c:83 #4 0x00007f674910533a in __GI_exit (status=<optimized out>) at exit.c:105 #5 0x00007f67490eb3f8 in __libc_start_main (main=0x555b35fbfbc0 <main>, argc=1, argv=0x7ffd4ede3588, init=<optimized out>, fini=<optimized out>, rtld_fini=<optimized out>, stack_end=0x7ffd4ede3578) at ../csu/libc-start.c:325 #6 0x0000555b35fbfe3a in _start () Here is the output of "doveconf -n": # 2.2.26.0 (23d1de6): /etc/dovecot/dovecot.conf # Pigeonhole version 0.4.devel (623ae77) # OS: Linux 4.8.7-040807-generic x86_64 Ubuntu Zesty Zapus (development branch) auth_mechanisms = plain login auth_username_format = %Ln mail_location = mdbox:~/mdbox mailbox_list_index = yes managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } passdb { driver = pam } plugin { sieve = file:~/sieve;active=~/.dovecot.sieve } postmaster_address = michael(a)michaelmarley.com protocols = imap sieve lmtp service auth { client_limit = 1624 unix_listener /var/spool/postfix/private/dovecot-auth { group = postfix mode = 0660 user = postfix } } service imap-login { inet_listener imaps { port = 0 } } service lmtp { process_min_avail = 5 unix_listener /var/spool/postfix/private/dovecot-lmtp { group = postfix mode = 0600 user = postfix } } ssl = required ssl_ca = </etc/ssl/private/COMODORSADomainValidationSecureServerCA.crt ssl_cert = </etc/ssl/private/michaelmarley.com.crt ssl_cipher_list = HIGH !RC4 !aNULL !eNULL !3DES @STRENGTH ssl_dh_parameters_length = 4096 ssl_key = # hidden, use -P to show it ssl_protocols = !SSLv3 userdb { driver = passwd } protocol lmtp { mail_plugins = " sieve" } protocol lda { mail_plugins = " sieve" } local_name matthewtmarley.com { ssl_ca = </etc/ssl/private/COMODORSADomainValidationSecureServerCA.crt ssl_cert = </etc/ssl/private/matthewtmarley.com.crt ssl_key = # hidden, use -P to show it } I tried recompiling Dovecot to see if that might do any good, but I got the same result. Also, I noticed that the "test-crypto" test in src/lib-dcrypt also crashes on exit (despite the fact that all the tests succeeded) with a very similar stacktrace: (gdb) run Starting program: /home/michael/Source/dovecot/core/src/lib-dcrypt/test-crypto [Thread debugging using libthread_db enabled] Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1". test_cipher_test_vectors ............................................. : ok test_cipher_aead_test_vectors ........................................ : ok test_hmac_test_vectors ............................................... : ok test_load_v1_keys .................................................... : ok test_load_v1_key ..................................................... : ok test_load_v1_public_key .............................................. : ok test_load_v2_key ..................................................... : ok test_load_v2_public_key .............................................. : ok test_get_info_v2_key ................................................. : ok test_gen_and_get_info_rsa_pem ........................................ : ok test_get_info_rsa_private_key ........................................ : ok test_get_info_invalid_keys ........................................... : ok test_get_info_key_encrypted .......................................... : ok test_get_info_pw_encrypted ........................................... : ok test_password_change ................................................. : ok test_load_invalid_keys ............................................... : ok 0 / 16 tests failed Program received signal SIGSEGV, Segmentation fault. 0x00007ffff75a5480 in ?? () (gdb) bt #0 0x00007ffff75a5480 in ?? () #1 0x00007ffff6ff7c60 in ossl_init_thread_stop (locals=<optimized out>) at crypto/init.c:336 #2 0x00007ffff6ff7ee4 in OPENSSL_cleanup () at crypto/init.c:391 #3 0x00007ffff78472e0 in ?? () from /lib/x86_64-linux-gnu/libc.so.6 #4 0x00007ffff784733a in exit () from /lib/x86_64-linux-gnu/libc.so.6 #5 0x00007ffff782d3f8 in __libc_start_main () from /lib/x86_64-linux-gnu/libc.so.6 #6 0x000055555555f68a in _start () If there is anything I have missed or if there is any other way I can help, please let me know. Thanks, Michael Marley

3 3

lazy-load SNI?
by Felipe Gasper 15 Nov '16

15 Nov '16

Hello, We’re rolling out large SNI deployments for our mail servers. Each domain gets an entry like this in the config: local_name mail.foo.com { ssl_cert = </ssl/domain_tls/*.foo.com/combined ssl_key = </ssl/domain_tls/*.foo.com/combined } There are a couple problems we’re finding with this approach: 1) Dovecot wants to load everything at once, which has some machines taking up many GiB of memory just for Dovecot. Is there any way to defer loading of an SSL cert until a client actually requests it? 2) Any time we add or remove a domain, Dovecot’s SNI config matrix needs to be rebuilt. Is there a way to handle SNI requests dynamically via some sort of configuration plugin, so we wouldn’t need to rebuild the config on domain add/remove? I looked through the docs but couldn’t see a way to do this. Thank you in advance! -Felipe Gasper Mississauga, ON

4 12

[PATCH] ssl: fix reference to SSLv2 and disable SSLv3
by Apollon Oikonomopoulos 15 Nov '16

15 Nov '16

This is driven by the fact that OpenSSL 1.1 does not know about SSLv2 at all and dovecot's defaults simply make OpenSSL error out with "Unknown protocol 'SSLv2'"[1]. So we change the defaults to refer to SSLv2 iff OpenSSL seems to know something about it. While at it, it's also a good idea to disable SSLv3 by default as well. [1] https://bugs.debian.org/844347 Signed-off-by: Apollon Oikonomopoulos <apoikos(a)debian.org> --- doc/example-config/conf.d/10-ssl.conf | 2 +- src/lib-master/master-service-ssl-settings.c | 6 +++++- 2 files changed, 6 insertions(+), 2 deletions(-) diff --git a/doc/example-config/conf.d/10-ssl.conf b/doc/example-config/conf.d/10-ssl.conf index 31b750c..2cd445b 100644 --- a/doc/example-config/conf.d/10-ssl.conf +++ b/doc/example-config/conf.d/10-ssl.conf @@ -46,7 +46,7 @@ ssl_key = </etc/ssl/private/dovecot.pem #ssl_dh_parameters_length = 1024 # SSL protocols to use -#ssl_protocols = !SSLv2 +#ssl_protocols = !SSLv3 # SSL ciphers to use #ssl_cipher_list = ALL:!LOW:!SSLv2:!EXP:!aNULL diff --git a/src/lib-master/master-service-ssl-settings.c b/src/lib-master/master-service-ssl-settings.c index 4a05045..6b43f6c 100644 --- a/src/lib-master/master-service-ssl-settings.c +++ b/src/lib-master/master-service-ssl-settings.c @@ -44,7 +44,11 @@ static const struct master_service_ssl_settings master_service_ssl_default_setti .ssl_key = "", .ssl_key_password = "", .ssl_cipher_list = "ALL:!LOW:!SSLv2:!EXP:!aNULL", - .ssl_protocols = "!SSLv2", +#ifdef SSL_TXT_SSLV2 + .ssl_protocols = "!SSLv2 !SSLv3", +#else + .ssl_protocols = "!SSLv3", +#endif .ssl_cert_username_field = "commonName", .ssl_crypto_device = "", .ssl_verify_client_cert = FALSE, -- 2.10.1

2 1

save failed to open mailbox quarantine
by Eggert Ehmke FTV Spandau 15 Nov '16

15 Nov '16

I have dovecot 2.2.13 set up with spamassassin and amavis. This works fine so far, Spam emails are forwarded to "username+Quarantine(a)mydomain.de". The recipient_delimiter=+ is set, the Quarantine folder exists. However, Dovecot tries to deliver it to a folder quarantine, that does not exist. In the dovecot-deliver.log there are these lines: Nov 14 14:16:13 lda(username(a)mydomain.de): Info: msgid=<2707212.2aHC3KDWrN@wookie>: save failed to open mailbox quarantine: Mailbox doesn't exist: quarantine Nov 14 14:16:13 lda(username(a)mydomain.de): Info: msgid=<2707212.2aHC3KDWrN@xxxxxx>: saved mail to INBOX Indeed the message is found in the inbox. What can be done so the folder name is not converted to lower case?

2 5

How does one mark all messages as read (imap4flag "seen") with sieve?
by Ben Johnson 15 Nov '16

15 Nov '16

Hello! I had hoped that marking all messages that arrive to a specific mailbox as read/seen would be as simple as applying the following sieve script to all incoming mail for that mailbox user: ######################## require ["imap4flags"]; addflag "\\Seen"; ######################## With this script in-place, mail does not appear to be marked as read/seen. It arrives as it normally would, and my email client sees it as new mail. Is something more required? Or is it a bug/limitation in my email client? I've found many examples of "addflag "\\Seen";" on the web, but all of them are wrapped in conditional logic of some variety. This is a spam-training mailbox and I simply want everything marked as seen/read upon arrival so I'm not bothered/notified every time. Thanks for any pointers here! -Ben

3 12

dovecot / tcp-wrappers / FBSD 10.3
by Jim Pazarena 14 Nov '16

14 Nov '16

Can anyone share the proper config to get wrappers working in dovecot on FreeBSD? The dovecot examples do not seem to work, and I thought perhaps FBSD needs slightly different configs. I've compiled with: -DHAVE_LIBWRAP which I presume is the first step. The example for dovecot.conf in uncommenting: login_access_sockets = tcpwrap merely causes a log error of "imap-login: Error: connect(tcpwrap) failed: No such file or directory" Suggestions/Direction much appreciated.

3 2

Self-Signed Certificate issue
by Darryl Baker 13 Nov '16

13 Nov '16

My apologies if this is a repeat but my search of the archive did not turn it up in the recent past. If this has been covered just point me at the previous thread, please. I am running a small email site which I am moving from uw-imapd and Solaris to Ubuntu and Dovecot imaps and pop3s. I am trying to use a self-signed certificate for this site. I am using Thunderbird as the test client. I've tried both the pre-built snakeoil certificate and building a special one for dovecot. In /var/log/mail.err I keep getting what I am interpreting as a missing CA cert. The message is: dovecot: imap-login: Error: SSL: Stacked error: error:14094418:SSL routines:ssl3_read_bytes:tlsv1 alert unknown ca: SSL alert number 48 The certificate was created by: openssl req -new -x509 -days 365 -nodes -out /etc/ssl/certs/dovecot.pem -keyout /etc/ssl/private/dovecot.pem The Dovecot version is 2.2.22 (fe789d2) The Ubuntu version is 16.04 LTS current patches. *Darryl Baker*

3 3

help needed configuration of quota warning mails
by Götz Reinicke 13 Nov '16

13 Nov '16

Hi, we run dovecot 2.2.24 and from what I see, quota management with warning message is configured currently with "noenforcing". Our individual quota limit is stored in the users ldap DN which is fetched as I see from the logs and by "doveadm quota get -u" I tried to trigger the warning mail by going over the limit on my account step by step and can see that values are counted with the command above and in thunderbird by showing the orange and than red warning symbol at the bottom for me. But the warning mail script is not triggert. How may I debug this? /usr/local/bin/quota-warning.sh is owned currently by vmail and executable by vmail. Thanks for feedback and suggestion . /Götz

1 0