- dovecot - dovecot.org

multiple SSL certificates story
by Arkadiusz Miśkiewicz 26 Oct '16

26 Oct '16

Hi. Little story :-) I'm playing with dovecot 2.2.25 and multiple SSL certificates. ~7000 certificates which are loaded twice, so my dovecot has ~14 000 certificate pairs (14k key + 14k cert) in config. 14 000 local_name entries. Like these: local_name imap.example.com { ssl_cert = </etc/certs/cert1.pem ssl_key = </etc/certs/cert1.pem } local_name pop3.example.com { ssl_cert = </etc/certs/cert1.pem ssl_key = </etc/certs/cert1.pem } (it needs to be "duplicated" like this because dovecot doesn't support globs/regexps for local_name, so can't use: local_name *.example.com { ssl_cert = </etc/certs/cert1.pem ssl_key = </etc/certs/cert1.pem } ) All certificates take 87MB on disk. Dovecot config for certificates itself is 3MB. Now fun begins. Trying to start dovecot fails Oct 26 12:49:59 ixion dovecot[19831]: master: Dovecot v2.2.25 (7be1766) starting up for imap, pop3, lmtp (core dumps disabled) Oct 26 12:50:01 ixion dovecot[19835]: config: Fatal: pool_system_malloc(1608): Out of memory Oct 26 12:50:01 ixion dovecot[19831]: master: Error: service(config): command startup failed, throttling for 2 secs Oct 26 12:50:01 ixion dovecot[19835]: config: Fatal: master: service(config): child 19837 returned error 83 (Out of memory (service config { vsz_limit=1024 MB }, you may need to increase it) - set CORE_OUTOFMEM=1 environment to get core dump) Oct 26 12:50:01 ixion dovecot[19835]: anvil: Fatal: Error reading configuration: read(/var/run/dovecot/config) failed: read(size=8192) failed: Connection reset by peer Oct 26 12:50:01 ixion dovecot[19835]: ssl-params: Fatal: Error reading configuration: read(/var/run/dovecot/config) failed: read(size=8192) failed: Connection reset by peer Oct 26 12:50:01 ixion dovecot[19831]: master: Error: service(anvil): command startup failed, throttling for 2 secs Oct 26 12:50:01 ixion dovecot[19831]: master: Error: service(ssl-params): command startup failed, throttling for 2 secs vsz_limit=1024 MB not enough. 2048 MB not enough. Raised to 3048 MB - now memory is enough but it still isn't able to start because it hits hardcoded config reading timeout (#define CONFIG_READ_TIMEOUT_SECS 10) Oct 26 13:00:24 ixion dovecot[20272]: master: Dovecot v2.2.25 (7be1766) starting up for imap, pop3, lmtp (core dumps disabled) Oct 26 13:00:34 ixion dovecot[20276]: anvil: Fatal: Error reading configuration: Timeout reading config from /var/run/dovecot/config Oct 26 13:00:34 ixion dovecot[20276]: ssl-params: Fatal: Error reading configuration: Timeout reading config from /var/run/dovecot/config Oct 26 13:00:34 ixion dovecot[20272]: master: Error: service(anvil): command startup failed, throttling for 2 secs Oct 26 13:00:34 ixion dovecot[20272]: master: Error: service(ssl-params): command startup failed, throttling for 2 secs On faster, SSD disk based machine with no load, it starts but then trying to do "doveadm reload" ends up with timeout Oct 26 12:22:12 master: Warning: SIGHUP received - reloading configuration Oct 26 12:22:22 master: Error: Error reading configuration: Timeout reading config from /var/run/dovecot/config dovecot also seem to stop handling clients when such reload happens. What can be done to make it work and how? ps. for comparison on how others handle SSL certificates. Exim MTA for example can easily handle milions of SSL certificates.That's because it loads certificates on demand, when these are actually needed. Core part of exim ssl config is two lines: tls_privatekey = ${if exists{/etc/certs/cert.${lc:${sha1:${lc:${tls_sni}}}}.pem}{/etc/certs//cert.${lc:${sha1:${lc:${tls_sni}}}}.pem}{/etc/certs/default-cert.key}} tls_certificate = ${if exists{/etc/certs/cert.${lc:${sha1:${lc:${tls_sni}}}}.pem}{/etc/certs/cert.${lc:${sha1:${lc:${tls_sni}}}}.pem}{/etc/certs/default-cert.pem}} which means check runtime if file on disk exists; if it exists then use it for tls_XYZ option; if it doesn't exist use default-cert.{pem/key} (sha1/lowercase game is to make sure that attacker cannot put own filename in TLS SNI servername). That's all. There is no memory impact and only little cpu impact with such solution. The other big advantage of exim solution is also no need for daemon to reload its config. You only change/add/remove certificate files on disk. ps2. thanks to letsencrypt project you can have thousands certificates for each domain/subdomain possible, so such usage should grow -- Arkadiusz Miśkiewicz, arekm / ( maven.pl | pld-linux.org )

2 2

Replication with SSL
by deZillium 26 Oct '16

26 Oct '16

Hello, - Set up a pair of servers according to http://wiki2.dovecot.org/Replication -Enabled SSL for both servers - Dovecot version: 2.2.13 (Debian 8.6) I couldn't find an option to specify the certificate that doveadm should use when connecting to the other server. Both servers have hostnames that are different, as verified by dovecot --hostdomain(as per the instructions) but use a common certificate when emailclients connect to them (high availability setup). Yes, single server login works as expected, been working for the past few years :-). Setting up a custom ssl_client_ca_file doesn't work, since doveadm doesn't know which certificate it should send when connecting to the other doveadm. Setting the ssl_client_ca_dir tothe directory with the global CAsdoesn't work either, since doveadm doesn't use the hostname that dovecot actually uses. The custom self-signed CA works when used outside dovecot(mysql for example). Is there any configuration thatneeds to be changed in order for doveadm to use a custom self signed certificate? Thank you

1 0

Shared storage for dovecot cluster
by Gandalf Corvotempesta 26 Oct '16

26 Oct '16

As I'm planning some server migrations and a new mail architecture, i would like to create an HA cluster Any advice on which kind of shared storage should i use? Are gluster performances with small files enough for dovecot? Any other solution? It's mandatory to avoid any splibrains or similiar thus the replication must be done on at least 3 storage servers.

1 0

Problem to configure dovecot-ldap.conf.ext
by Günther J. Niederwimmer 26 Oct '16

26 Oct '16

Hello, Dovecot 2.2.25 CentOS 7 I setup ldap (FreeIPA) to have a user for dovecot that can (read search compare) all attributes that I need for dovecot. I must also have mailAlternateAddress When I make a ldapsearch with this user, I found all I need to configure dovecot. But for me it is not possible to configure this correct ? I can make for user doveadm auth test office and doveadm auth test office(a)examle.com with success authentication but when I make a doveadm auth test info(a)example.co (mailAlternateAddress) I have a broken authentication Can any give me a hint what is wrong, or is this not possible ? # Space separated list of LDAP hosts to use. host:port is allowed too. #hosts = 192.168.100.204 192.168.100.214 #hosts = 192.168.100.204 hosts = ipa.example.com # LDAP URIs to use. You can use this instead of hosts list. Note that this # setting isn't supported by all LDAP libraries. #uris = ldap://ipa.example.com ldap://ipa1.example.com # Distinguished Name - the username used to login to the LDAP server. # Leave it commented out to bind anonymously (useful with auth_bind=yes). dn = uid=system,cn=sysaccounts,cn=etc,dc=example,dc=com # Password for LDAP server, if dn is specified. dnpass = 'XXXXXXXXXXXXXX' # Use SASL binding instead of the simple binding. Note that this changes # ldap_version automatically to be 3 if it's lower. Also note that SASL binds # and auth_bind=yes don't work together. sasl_bind = yes # SASL mechanism name to use. sasl_mech = gssapi # SASL realm to use. sasl_realm = EXAMPLE.COM # SASL authorization ID, ie. the dnpass is for this "master user", but the # dn is still the logged in user. Normally you want to keep this empty. sasl_authz_id = imap/mx01.example.com(a)EXAMPLE.COM # Use TLS to connect to the LDAP server. #tls = yes # TLS options, currently supported only with OpenLDAP: tls_ca_cert_file = /etc/ipa/ca.crt #tls_ca_cert_dir = #tls_cipher_suite = # TLS cert/key is used only if LDAP server requires a client certificate. #tls_cert_file = #tls_key_file = # Valid values: never, hard, demand, allow, try tls_require_cert = demand # Use the given ldaprc path. #ldaprc_path = # LDAP library debug level as specified by LDAP_DEBUG_* in ldap_log.h. # -1 = everything. You may need to recompile OpenLDAP with debugging enabled # to get enough output. #debug_level = 0 # Use authentication binding for verifying password's validity. This works by # logging into LDAP server using the username and password given by client. # The pass_filter is used to find the DN for the user. Note that the pass_attrs # is still used, only the password field is ignored in it. Before doing any # search, the binding is switched back to the default DN. auth_bind = yes # If authentication binding is used, you can save one LDAP request per login # if users' DN can be specified with a common template. The template can use # the standard %variables (see user_filter). Note that you can't # use any pass_attrs if you use this setting. # # If you use this setting, it's a good idea to use a different # dovecot-ldap.conf.ext for userdb (it can even be a symlink, just as long as # the filename is different in userdb's args). That way one connection is used # only for LDAP binds and another connection is used for user lookups. # Otherwise the binding is changed to the default DN before each user lookup. # # For example: # auth_bind_userdn = cn=%u,ou=people,o=org # auth_bind_userdn = uid=%n,cn=users,cn=accounts,dc=example,dc=com # LDAP protocol version to use. Likely 2 or 3. ldap_version = 3 # LDAP base. %variables can be used here. # For example: dc=mail, dc=example, dc=org base = cn=users,cn=accounts,dc=example,dc=com # Dereference: never, searching, finding, always #deref = never # Search scope: base, onelevel, subtree scope = subtree #scope = onelevel # User attributes are given in LDAP-name=dovecot-internal-name list. The # internal names are: # uid - System UID # gid - System GID # home - Home directory # mail - Mail location # # There are also other special fields which can be returned, see # http://wiki2.dovecot.org/UserDatabase/ExtraFields #user_attrs = homeDirectory=home,uidNumber=uid,gidNumber=gid user_attrs = uid=user,uid=home=/srv/vmail/%$,=uid=10000,=gid=10000 # Filter for user lookup. Some variables can be used (see # http://wiki2.dovecot.org/Variables for full list): # %u - username # %n - user part in user@domain, same as %u if there's no domain # %d - domain part in user@domain, empty if user there's no domain user_filter = (&(objectClass=mailrecipient)(|(uid=%Ln)(mail=%Lu) (mailAlternateAddress=%Lu))) # Password checking attributes: # user: Virtual user name (user@domain), if you wish to change the # user-given username to something else # password: Password, may optionally start with {type}, eg. {crypt} # There are also other special fields which can be returned, see # http://wiki2.dovecot.org/PasswordDatabase/ExtraFields pass_attrs = uid=user,userPassword=password,mailAlternateAddress=user # If you wish to avoid two LDAP lookups (passdb + userdb), you can use # userdb prefetch instead of userdb ldap in dovecot.conf. In that case you'll # also have to include user_attrs in pass_attrs field prefixed with "userdb_" # string. For example: #pass_attrs = uid=user,userPassword=password,\ # homeDirectory=userdb_home,uidNumber=userdb_uid,gidNumber=userdb_gid # Filter for password lookups #pass_filter = (&(objectClass=posixAccount)(uid=%u)) pass_filter = (&(objectClass=mailrecipient)(|(uid=%Ln)(mail=%Lu) (mailAlternateAddress=%Lu))) # Attributes and filter to get a list of all users iterate_attrs = uid=user, mailAlternateAddress=user iterate_filter = (objectClass=posixAccount) # Default password scheme. "{scheme}" before password overrides this. # List of supported schemes is in: http://wiki2.dovecot.org/Authentication #default_pass_scheme = CRYPT -- mit freundlichen Grüßen / best regards, Günther J. Niederwimmer

2 3

Re: keent() from Tika - with doveadm
by Aki Tuomi 25 Oct '16

25 Oct '16

Hi, can you run doveadm in gdb, wait for it to crash, and then go to frame 6 ( io_loop_handler_run_internal) and run p errno p ret p *ioloop p *ctx p *events Sorry but the crash doesn't make enough sense yet to me, we need to determine what the invalid parameter is. > Larry Rosenman http://www.lerctr.org/~ler > Phone: +1 214-642-9640 (c) E-Mail: larryrtx(a)gmail.com > US Mail: 17716 Limpia Crk, Round Rock, TX 78664-7281

2 9

Break up massive INBOX?
by mrobti＠insiberia.net 25 Oct '16

25 Oct '16

I have inherited a 10+ GB mailbox which dsync converted to maildir very nicely. But 15GB in tens of thousands of messages is too much in one INBOX when used in webmail. I guess it's best to divide the messages into subfolders for date. Is there a server-side way to safely move messages into new subfolders so that Dovecot indexes and UIDs won't break? If I write a shell script to move maildir files based on date of the files, I think Dovecot would not like this? Also, is there any way to automatically create delivery or archive folders by date eg., on the 1st of each month? And deliver mails to the subfolder for the current month? I know I can create Sieve rules for such by hand, but prefer if there is a plugin or something to do this automatically.

2 3

ssl_options missing no_ticket documentation in example config
by Christopher Head 25 Oct '16

25 Oct '16

Hello! I have a very minor bug to report. The ssl_options configuration directive takes a space-separated list of options, each of which must be in the set {“no_compression”, “no_ticket”}, according to the 2.2.25 source code. However, the file doc/example-config/conf.d/10-ssl.conf shipped in the tarball only mentions the “no_compression” option; it makes no mention of the “no_ticket” option. Oh, and by the way, the changelog <http://dovecot.org/doc/NEWS> linked from the download page is missing information for anything newer than 2.2.21. Please include me in replies; I am not subscribed to the list. -- Christopher Head

1 0

Hierarchy separator and LAYOUT=FS change
by Simeon Ott 25 Oct '16

25 Oct '16

Hello, I stumbled across a 5-year-old post on the dovecot list about changing the dovecot hierarchy separator to enable shared mailboxes (http://www.dovecot.org/list/dovecot/2011-January/056201.html <http://www.dovecot.org/list/dovecot/2011-January/056201.html>). At the moment I’m stuck in a pretty similar situation. Migrated from courier to dovecot 2 years ago and preserved the dot-separator. Because I’m using the e-mail adress as a username, the dots for folder separation and the dots in the email adresses getting messed up - I do have a pretty small mailserver with about 150 accounts. The Maildir filestructur of a typical mail account looks like this: drwx------ 2 vmail vmail 4096 Oct 10 20:02 cur drwx------ 5 vmail vmail 4096 Oct 3 07:48 .Daten.Administration drwx------ 5 vmail vmail 4096 Oct 3 09:51 .Daten.Anfragen, Werbung drwx------ 5 vmail vmail 4096 Oct 3 08:02 .Daten drwx------ 5 vmail vmail 4096 Oct 6 09:57 .Daten.Intern drwx------ 5 vmail vmail 4096 Oct 3 08:03 .Daten.Intern.Fahrzeuge drwx------ 5 vmail vmail 4096 Oct 6 12:57 .Daten.Intern.Infos, FileMaker etc drwx------ 5 vmail vmail 4096 Oct 3 09:19 .Daten.Intern.Sonstiges drwx------ 5 vmail vmail 4096 Oct 3 07:47 .Daten.Kunden drwx------ 5 vmail vmail 4096 Sep 16 08:29 .Daten.Lieferanten drwx------ 5 vmail vmail 4096 Oct 3 08:28 .Daten.Marketing drwx------ 2 vmail vmail 4096 Oct 10 20:02 new drwx------ 5 vmail vmail 4096 Oct 10 18:00 .Sent drwx------ 5 vmail vmail 4096 Oct 10 18:00 .Spam drwx------ 5 vmail vmail 4096 Oct 10 18:00 .Trash When changing the separator in my inbox namespace the documentation mentions that the filestructur doesn’t change. This means I will get the same problems when using shared boxes with email adresses as usernames. I definitly need to change to maildir:~/Maildir:LAYOUT=fs When changing to LAYOUT=fs i need to convert all the mailboxes manually, is that correct? Is dsync is the way to go? Or is it better to leave the separator and change to a different username schema (without dots in it) and advise the clients to change their credentials? I know there are people out there who successfully converted this - but I can’f find that many information about this subject. doveconf -n: # 2.1.7: /etc/dovecot/dovecot.conf # OS: Linux 3.2.0-4-amd64 x86_64 Debian 7.11 auth_mechanisms = plain login auth_verbose = yes lda_mailbox_autocreate = yes lda_mailbox_autosubscribe = yes listen = * login_log_format_elements = user=<%u> method=%m rip=%r lip=%l mpid=%e %c mail_gid = 5000 mail_location = maildir:~/Maildir mail_plugins = zlib quota acl mail_uid = 5000 managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date ihave namespace inbox { inbox = yes location = mailbox Drafts { auto = subscribe special_use = \Drafts } mailbox Sent { auto = subscribe special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Spam { auto = subscribe special_use = \Junk } mailbox Trash { auto = subscribe special_use = \Trash } prefix = INBOX. separator = . } passdb { args = /etc/dovecot/dovecot-ldap.conf driver = ldap } plugin { acl = vfile acl_shared_dict = file:/var/spool/postfix/virtual/shared-mailboxes quota = maildir:User quota quota_exceeded_message = 4.2.2 Mailbox full quota_rule = *:storage=1G quota_rule2 = INBOX.Trash:storage=+100M quota_rule3 = INBOX.Spam:ignore quota_warning = storage=95%% quota-warning 95 %u sieve = ~/.dovecot.sieve sieve_before = /var/lib/dovecot/sieve/default.sieve sieve_dir = ~/sieve sieve_max_actions = 32 sieve_max_redirects = 4 sieve_max_script_size = 1M sieve_quota_max_scripts = 0 sieve_quota_max_storage = 0 } protocols = " imap lmtp sieve pop3" service auth { group = dovecot unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0660 user = postfix } unix_listener auth-master { group = vmail mode = 0660 user = vmail } user = dovecot } service lmtp { unix_listener lmtp { mode = 0666 } } service managesieve-login { inet_listener sieve { port = 4190 } inet_listener sieve_deprecated { port = 2000 } process_min_avail = 1 service_count = 1 vsz_limit = 64 M } ssl_cert = </etc/ssl/private/startssl-onnet.ch <http://startssl-onnet.ch/>-chain.crt ssl_cipher_list = ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-SHA256:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA:AES256-SHA:DHE-RSA-CAMELLIA128-SHA:DHE-RSA-CAMELLIA256-SHA:CAMELLIA128-SHA:CAMELLIA256-SHA:ECDHE-RSA-DES-CBC3-SHA:DES-CBC3-SHA:!SSLv2 ssl_key = </etc/ssl/private/startssl-onnet.ch.key userdb { args = /etc/dovecot/dovecot-ldap.conf driver = ldap } protocol lmtp { mail_plugins = zlib quota acl sieve } protocol lda { auth_socket_path = /var/run/dovecot/auth-master deliver_log_format = msgid=%m: %$ mail_plugins = zlib quota acl sieve postmaster_address = postmaster(a)onnet.ch <mailto:postmaster@onnet.ch> } protocol imap { mail_plugins = zlib quota acl imap_quota imap_acl } protocol sieve { info_log_path = /var/log/sieve.log log_path = /var/log/sieve.log mail_max_userip_connections = 10 managesieve_implementation_string = Dovecot Pigeonhole managesieve_logout_format = bytes=%i/%o managesieve_max_compile_errors = 5 managesieve_max_line_length = 65536 } … parts of the ldap config user_attrs = homeDirectory=home=/var/spool/postfix/virtual/%$,uidNumber=uid,gidNumber=gid,quota=quota_rule=*:bytes=%$ user_filter = (&(objectClass=CourierMailAccount)(mail=%u)) … my shared configuration is currently commented out. # namespace { # type = shared # separator = . # prefix = shared.%%u. # location = maildir:%h/Maildir:INDEX=~/Maildir/shared/%%u # subscriptions = yes # list = children #} thanks in advance for any help Sincerely, Simeon - onnet.ch <http://onnet.ch/>

1 1

Re: keent() from Tika - with doveadm
by larryrtx 23 Oct '16

23 Oct '16

Any news Ali? Sent from my Sprint Samsung Galaxy S7. -------- Original message --------From: Larry Rosenman <larryrtx(a)gmail.com> Date: 10/21/16 12:27 PM (GMT-06:00) To: Aki Tuomi <aki.tuomi(a)dovecot.fi> Cc: Dovecot Mailing List <dovecot(a)dovecot.org> Subject: Re: keent() from Tika - with doveadm Unfortuantely it doesn't seem to log that, and it's not 100% consistent. I did catch one, but the log file is huge so it's at: http://www.lerctr.org/~ler/Dovecot/doveadm0-tika On Fri, Oct 21, 2016 at 12:17 PM, Aki Tuomi <aki.tuomi(a)dovecot.fi> wrote: > On October 21, 2016 at 8:06 PM Larry Rosenman <larryrtx(a)gmail.com> wrote: > > > getting the following: > > Oct 21, 2016 12:04:25 PM org.apache.tika.server.resource.TikaResource > logRequest > INFO: tika/ > (application/vnd.openxmlformats-officedocument.wordprocessingml.document) > doveadm(ctr): Debug: http-client: conn 127.0.0.1:9998 [1]: Got 200 response > for request [Req69: PUT http://localhost:9998/tika/] (took 91 ms + 210 ms > in queue) > doveadm(ctr): Panic: kevent(): Invalid argument > Abort trap (core dumped) > > if I turn off tika, I do NOt get it. > > 2.2.26-RC1 > > what else do you need? > > > -- > Larry Rosenman http://www.lerctr.org/~ler > Phone: +1 214-642-9640 (c) E-Mail: larryrtx(a)gmail.com > US Mail: 17716 Limpia Crk, Round Rock, TX 78664-7281 Any hope for exact request? Aki Tuomi Dovecot oy -- Larry Rosenman http://www.lerctr.org/~ler Phone: +1 214-642-9640 (c) E-Mail: larryrtx(a)gmail.com US Mail: 17716 Limpia Crk, Round Rock, TX 78664-7281

3 6

Messed up dovecot mail store, need some repair advice
by Gerben Wierda 23 Oct '16

23 Oct '16

Hello folks, I have an older dovecot 2.0 (which I will migrate to a 2.2 asap, but at this point in time I need a fix). This is a dovecot 2.0 that came with Mac OS X 10.8.5 Server 2.2.5. Today, my spam/virus filtering (clamav) on the Server broke down. As a result, all my meesages got the ***UNCHECKED*** tag added to each subject. That was clearly unacceptable. SO, for the tim ebeing I have set that tag to undef so the tag is no longer added. But I also wanted to repair the messages that already ended up in dovecot 2.0 So, I did something simple: stopped all mail services on the server, went into the dovecot mail store and edited the messages. I first tried with one small ccount and it seemed OK. But now my mail client is experiencing problems with the messages (cannot display) and I think I've been to simplistic. I have for instance notedthat th esizeof the message is part of the filename. So, I can change these of course, but probably I need to change more. Can someone enlighten me how I can repair the broken data store? Thanks, (Foolish) Gerben

2 3