- dovecot - dovecot.org

Re: Dovecot stops responding when I update SSL certificate
by Joseph Tam 06 Mar '16

06 Mar '16

HotSlots Webmaster <webmaster(a)hotslots132.com> writes: > I have had Dovecot working fine with SSL for nearly two years now. It's > time to renew the SSL certificate, so I did (same CA). The new > certificate works fine in Apache and Postfix. But when I update Dovecot > to use the same certificate, and restart the server, Dovecot stops > responding to connects. > ... > Here is the end of the dovecot -n file that mentions SSL: > ... > ssl_dh_parameters_length = 2048 When you start dovecot, does CPU load of dovecot/ssl-params roof to 100%? It's possible it's generating ephemeral DH keys. In a previous post to this list, I note that the run time to generate these keys can vary wildly, and gets worse with longer keys. Sometimes you get lucky, and you'll generate then quickly, sometimes it takes a long while (minutes). http://dovecot.org/pipermail/dovecot/2015-November/102447.html Try running openssl dhparam -noout 2048 to see how it varies for you. If what I suspect is true, you can try using shorter keys. A followup post suggest a way you can precompute the key Joseph Tam <jtam.home(a)gmail.com>

3 2

VS: Re: Implementation of TLS OCSP Stapling
by Aki Tuomi 06 Mar '16

06 Mar '16

Luckily ocsp stapling is an SSL extension and clients not supporting it won't be asking for it either. ---Aki TuomiDovecot oy -------- Alkuperäinen viesti --------Lähettäjä: Andrew McGlashan <andrew.mcglashan(a)affinityvision.com.au> Päivämäärä: 6.3.2016 10.36 (GMT+02:00) Saaja: dovecot(a)dovecot.org Aihe: Re: Implementation of TLS OCSP Stapling On 3/03/2016 11:58 PM, aki.tuomi(a)dovecot.fi wrote: > We will take this feature under consideration and see if it can be implemented > in future release. Thank you for your suggestion! As much as I hate Outlook (Look Out!), there are loads of people using really old versions; 2003 is no longer supported, but loads of people use 2007. Thunderbird can be expected to be far more up to date. Implementing features to work with older clients will always be a problem. Just a simple example, almost unrelated here, but this is either wrong by TB or wrong by Outlook (versions 2007, 2010 and 2013 that I know of). When the IMAP server sends a message, OL will pop up a window that requires the user to acknowledge the message via a popup. TB just pops up the message in the normal 'new mail' notify if that is configured and it might be lost if notify isn't set to show. Either way, the implementation is different b/w the two client products. Is OL right or is TB right... IMAP doco says that the message should be made to be acknowledged by the client; OL's version can't easily be ignored or missed, but TB's can easily be missed. But TB's implementation is more user friendly if the server wants to keep sending messages from time to time. I considered using this for MOTD type stuff and maybe random inspirational or motivational messages; even to remind or inform users to do certain things [one example in the dovecot wiki is to advise that the vacation message is still active]. A TB notification is next to harmless, but an OL one needs to be acknowledged every time, which would be very painful. Anyway, the point is that if a feature is added for OCSP stabling support, you couldn't really expect older versions of Look Out to comply with it (even though M$ could patch it easily, they care less about older versions than getting people to subscribe to Office 365 these days). Cheers A.

1 0

Implementation of TLS OCSP Stapling
by dovecot＠flut.demon.nl 06 Mar '16

06 Mar '16

Hi all, About a year ago, Torsten already asked for OCSP stapling (http://dovecot.org/pipermail/dovecot/2015-April/100632.html) Unfortunately, there was no answer to his question. Now RFC 7633 ("TLS Feature Extension", https://tools.ietf.org/html/rfc7633, a.k.a. "Must Staple") has landed, revocation is getting serious! I personally would like to embed all my TLS certificates with the must-staple extension. The great project Let's Encrypt already supports it: https://github.com/letsencrypt/boulder/pull/1224 I'm aware most MTAs don't really care about the certificate, but big players as Google take TLS encryption very seriously: https://googleblog.blogspot.nl/2016/02/building-safer-web-for-everyone.html So I would like to know if Dovecot is planning to feature OCSP stapling. That way I know for sure my "must staple" certificates can be used by Dovecot. And in my opinion, every TLS offering daemon should be up to par to the capabilities of TLS.. Not lag behind :) What's your opinion on this matter? Thanks in advance for any anwser! Greets, Osiris

7 11

dovecot local indexes and multiple servers
by alex 05 Mar '16

05 Mar '16

Hi, I've been testing mdbox with local indexes on our nfs based directors + multiple imap/lda/pop3 server setup. The performance is noticeably better than maildir with indexes on nfs, so I'd like to make this work. About the possible direction to other servers the wiki says that it will create a new index 'on the fly'. That is true, but after the index is recreated, Thunderbird (imap) re-downloads all the messages and sees all those messages as unread again! This is probably quite logical as the message status is only kept in the indexes, but this is not very customer friendly. Is there a way to avoid this problem? I'd rather not manually sync those local indexes between our servers. In fact, I was planning on deleting (old) indexes when a user moved to another server or even if they haven't checked their mail for XX days. with up to 10Gb mailboxes the indexes themselves can get up to 20-40Mb for a mailbox. that amounts to quite a lot of storage for 200k+ users. Thanks, Alex.

2 2

VS: Dovecot stops responding when I update SSL certificate
by Aki Tuomi 05 Mar '16

05 Mar '16

Did you change dh parameter size as well? This causes dh generation which can take some time. ---Aki TuomiDovecot oy-------- Alkuperäinen viesti --------Lähettäjä: HotSlots Webmaster <webmaster(a)hotslots132.com> Päivämäärä: 5.3.2016 4.10 (GMT+02:00) Saaja: dovecot(a)dovecot.org Aihe: Dovecot stops responding when I update SSL certificate Dovecot 2.2.18 CentOS 6.7 (x86_64) Plesk 12.5.30 I have had Dovecot working fine with SSL for nearly two years now. It's time to renew the SSL certificate, so I did (same CA). The new certificate works fine in Apache and Postfix. But when I update Dovecot to use the same certificate, and restart the server, Dovecot stops responding to connects. I have triple-checked that the ssl_cert and ssl_key files are correct - all I did was change the names in the conf file. There's nothing in the log. I have tried various SSL tests but either they don't work (unspecific error) or they tell me nothing is wrong (and show the correct certificate.) I am running out of time to find a solution to this - what else can I look for? The one difference for the certificates is that I opted for one with a SHA256 root rather than SHA1 root. I have separately used a tool to verify that the certificate and private key match. Here is the end of the dovecot -n file that mentions SSL: ssl = required ssl_cert = </etc/pki/tls/certs/hotslots-cert.pem ssl_cipher_list = EECDH+AESGCM+AES128:EECDH+AESGCM+AES256:EDH+AESGCM+AES128:EDH+AESGCM+AES256:EECDH+SHA256+AES128:EECDH+SHA384+AES256:EDH+SHA256+AES128:EDH+SHA256+AES256:EECDH+SHA1+AES128:EECDH+SHA1+AES256:EDH+SHA1+AES128:EDH+SHA1+AES256:EECDH+HIGH:EDH+HIGH:AESGCM+AES128:AESGCM+AES256:SHA256+AES128:SHA256+AES256:SHA1+AES128:SHA1+AES256:HIGH:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!KRB5:!aECDH:!EDH+3DES ssl_dh_parameters_length = 2048 ssl_key = </etc/ssl/private/hotslots-private.pem ssl_protocols = TLSv1.1 TLSv1.2 !TLSv1 userdb { args = uid=popuser gid=popuser driver = static } protocol imap { mail_plugins = " quota imap_quota" } protocol pop3 { pop3_uidl_format = UID%u-%v } protocol lda { mail_plugins = " quota sieve" } (The !TLSv1 doesn't seem to be honored - I tried it with and without that. A problem for later.) Thanks for any help. Steve L

1 0

Dovecot stops responding when I update SSL certificate
by HotSlots Webmaster 05 Mar '16

05 Mar '16

Dovecot 2.2.18 CentOS 6.7 (x86_64) Plesk 12.5.30 I have had Dovecot working fine with SSL for nearly two years now. It's time to renew the SSL certificate, so I did (same CA). The new certificate works fine in Apache and Postfix. But when I update Dovecot to use the same certificate, and restart the server, Dovecot stops responding to connects. I have triple-checked that the ssl_cert and ssl_key files are correct - all I did was change the names in the conf file. There's nothing in the log. I have tried various SSL tests but either they don't work (unspecific error) or they tell me nothing is wrong (and show the correct certificate.) I am running out of time to find a solution to this - what else can I look for? The one difference for the certificates is that I opted for one with a SHA256 root rather than SHA1 root. I have separately used a tool to verify that the certificate and private key match. Here is the end of the dovecot -n file that mentions SSL: ssl = required ssl_cert = </etc/pki/tls/certs/hotslots-cert.pem ssl_cipher_list = EECDH+AESGCM+AES128:EECDH+AESGCM+AES256:EDH+AESGCM+AES128:EDH+AESGCM+AES256:EECDH+SHA256+AES128:EECDH+SHA384+AES256:EDH+SHA256+AES128:EDH+SHA256+AES256:EECDH+SHA1+AES128:EECDH+SHA1+AES256:EDH+SHA1+AES128:EDH+SHA1+AES256:EECDH+HIGH:EDH+HIGH:AESGCM+AES128:AESGCM+AES256:SHA256+AES128:SHA256+AES256:SHA1+AES128:SHA1+AES256:HIGH:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!KRB5:!aECDH:!EDH+3DES ssl_dh_parameters_length = 2048 ssl_key = </etc/ssl/private/hotslots-private.pem ssl_protocols = TLSv1.1 TLSv1.2 !TLSv1 userdb { args = uid=popuser gid=popuser driver = static } protocol imap { mail_plugins = " quota imap_quota" } protocol pop3 { pop3_uidl_format = UID%u-%v } protocol lda { mail_plugins = " quota sieve" } (The !TLSv1 doesn't seem to be honored - I tried it with and without that. A problem for later.) Thanks for any help. Steve L

1 0

Deliver to Public Mailbox
by Chris 03 Mar '16

03 Mar '16

Dear All, I'd like dovecot-lda (deliver) to post a message to a public mailbox. It doesn't seem to work when I just use the -m parameter with the IMAP-Mailbox path, e.g. Public/info . What parameters are required? Do I have to change the headers with formail in any way? TIA! - Chris

1 1

Dovecot 2.2.21 - segfault
by Robert Blayzor 03 Mar '16

03 Mar '16

pid 31943 (dovecot), uid 0: exited on signal 11 (core dumped) dovecot --version 2.2.21 (5345f22) uname -a FreeBSD 10.3-BETA2 #0 r295966M: amd64 bt full #0 0x00000008008eb037 in t_push (marker=0x0) at data-stack.c:133 133 data-stack.c: No such file or directory. in data-stack.c (gdb) bt full #0 0x00000008008eb037 in t_push (marker=0x0) at data-stack.c:133 frame_block = (struct stack_frame_block *) 0x7fffffffb4e0 #1 0x000000080086a5ec in master_service_env_clean () at master-service.c:534 _data_stack_cur_id = 32767 value = 0x801471056 "TZ CORE_OUTOFMEM CORE_ERROR" #2 0x000000000040df88 in service_process_setup_environment (service=0x8014b11e0, uid=58537, hostdomain=0x801419960 “mta3.xxx.net") at service-process.c:234 No locals. #3 0x000000000040dd6d in service_process_create (service=0x8014b11e0) at service-process.c:322 uid_counter = 58537 process = (struct service_process *) 0x8008eb2f3 uid = 58537 hostdomain = 0x801419960 “mta3.xxx.net" pid = 0 process_forked = true #4 0x000000000040d7ff in service_accept (l=0x8014b1378) at service-monitor.c:299 service = (struct service *) 0x8014b11e0 #5 0x000000080090e57f in io_loop_call_io (io=0x80144e7e0) at ioloop.c:559 ioloop = (struct ioloop *) 0x801421080 t_id = 2 #6 0x0000000800911497 in io_loop_handler_run_internal (ioloop=0x801421080) at ioloop-kqueue.c:151 ctx = (struct ioloop_handler_context *) 0x801419880 events = (struct kevent *) 0x8014b9000 event = (const struct kevent *) 0x8014b9000 tv = {tv_sec = 42682, tv_usec = 705349} ts = {tv_sec = 42682, tv_nsec = 705349000} io = (struct io_file *) 0x80144e7e0 events_count = 67 ret = 1 i = 0 #7 0x000000080090eb0e in io_loop_handler_run (ioloop=0x801421080) at ioloop.c:607 No locals. #8 0x000000080090e92f in io_loop_run (ioloop=0x801421080) at ioloop.c:583 No locals. #9 0x000000080086a8bb in master_service_run (service=0x80141b140, callback=0) at master-service.c:640 No locals. #10 0x0000000000406558 in main (argc=3, argv=0x7fffffffb4c0) at main.c:888 set = (struct master_settings *) 0x801429110 error = 0x800ca9283 "H\203Ä ]Ã\017\037\200" doveconf_arg = 0x0 orig_info_callback = (failure_callback_t *) 0x8008ee880 <i_syslog_error_handler> orig_debug_callback = (failure_callback_t *) 0x8008ee880 <i_syslog_error_handler> foreground = false ask_key_pass = false i = 3 c = -1 doubleopts = 0x7fffffffb3a0 Current language: auto; currently minimal

2 2

Dovecot error symbol mysql_options, version libmysqlclient_16 not defined in file libmysqlclient.so.18
by Condor 03 Mar '16

03 Mar '16

Hello, Im using Dovecot version: 2.2.21 (5345f22) Here is my conf file: auth_debug = yes auth_mechanisms = plain login auth_socket_path = /usr/local/var/run/dovecot/auth-userdb auth_verbose = yes base_dir = /usr/local/var/run/dovecot/ debug_log_path = /var/log/dovecot.log default_login_user = nobody default_process_limit = 200 dict { driver = sql quota = mysql:/usr/local/etc/dovecot/dovecot-dict-sql.conf.ext } mail_debug = yes mail_location = maildir:/var/mailq/postmail/%d/%n/Maildir mail_privileged_group = vmail managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify envir onment mailbox date index ihave duplicate mime foreverypart extracttext namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } passdb { args = /usr/local/etc/dovecot/dovecot-sql.conf.ext driver = sql } passdb { args = /usr/local/etc/dovecot/dovecot-sql.conf.ext driver = sql } plugin { autocreate = Trash autocreate2 = Junk autocreate3 = Sent autocreate4 = Drafts autosubscribe = Trash autosubscribe2 = Junk autosubscribe3 = Sent autosubscribe4 = Drafts sieve = /var/mailq/postmail/%d/%n/.dovecot.sieve sieve_dir = /var/mailq/postmail/%d/%n/sieve/ sieve_global_dir = /usr/local/var/lib/dovecot/sieve sieve_global_path = /usr/local/var/lib/dovecot/sieve/default.sieve sieve_max_actions = 32 sieve_max_redirects = 15 sieve_quota_max_scripts = 20 } protocols = pop3 imap sieve service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0666 user = postfix } } service imap-login { inet_listener imap { port = 143 } inet_listener imaps { port = 993 } } service managesieve-login { inet_listener sieve { port = 4190 } service_count = 1 vsz_limit = 64 M } ssl_cert = </etc/postfix/ssl/certs/dovecot.pem ssl_key = </etc/postfix/ssl/private/dovecot.pem userdb { args = uid=1003 gid=1001 home=/var/mailq/postmail/%d/%n allow_all_users=yes driver = static } userdb { args = /usr/local/etc/dovecot/dovecot-sql.conf.ext driver = sql } protocol pop3 { pop3_uidl_format = %08Xu%08Xv } protocol lmtp { mail_plugins = " sieve" } protocol lda { mail_plugins = " sieve" } protocol imap { imap_max_line_length = 64 k mail_max_userip_connections = 200 mail_plugins = " autocreate" } protocol sieve { managesieve_implementation_string = Dovecot Pigeonhole } dovecot-sql. conf grep -v '^ *$#.*$\?$' dovecot-sql.conf.ext driver = mysql connect = host=localhost dbname=postfix user=xxx password=xxx default_pass_scheme = CRYPT password_query = SELECT username AS user, password FROM mailbox WHERE username = '%u'; I get follow error: dovecot: auth-worker: Error: dovecot/auth: relocation error: dovecot/auth: symbol mysql_options, version libmysqlclient_16 not defined in file libmysqlclient.so.18 with link time reference I delete all binary and libs and source code, download again and compile with option with-mysql and always got the same error when I start it: dovecot: auth-worker: Error: dovecot/auth: relocation error: dovecot/auth: symbol mysql_options, version libmysqlclient_16 not defined in file libmysqlclient.so.18 with link time reference Mar 3 16:50:56 mailcontrol dovecot: master: Error: service(auth-worker): command startup failed, throttling for 60 secs Mar 3 16:50:56 mailcontrol dovecot: auth-worker(3276): Fatal: master: service(auth-worker): child 3276 returned error 127 Mar 3 16:50:56 mailcontrol dovecot: auth: Error: auth worker: Aborted PASSV request for xxx@xxx: Worker process died unexpectedly I even check with ldd is there any banary that use libmysqlclient.16.so but did not found. ldd auth is linked libmysqlclient.so.18 => /usr/lib64/libmysqlclient.so.18 (0x00007fad84696000) I use kernel 4.4.3, gcc 5.3.0 $ gcc -v Reading specs from /usr/lib64/gcc/x86_64-slackware-linux/5.3.0/specs COLLECT_GCC=gcc COLLECT_LTO_WRAPPER=/usr/libexec/gcc/x86_64-slackware-linux/5.3.0/lto-wrapper Target: x86_64-slackware-linux Configured with: ../gcc-5.3.0/configure --prefix=/usr --libdir=/usr/lib64 --mandir=/usr/man --infodir=/usr/info --enable-shared --enable-bootstrap --enable-languages=ada,c,c++,fortran,go,java,lto,objc --enable-threads=posix --enable-checking=release --enable-objc-gc --with-system-zlib --with-python-dir=/lib64/python2.7/site-packages --enable-libstdcxx-dual-abi --with-default-libstdcxx-abi=gcc4-compatible --disable-libunwind-exceptions --enable-__cxa_atexit --enable-libssp --enable-lto --enable-install-libiberty --with-gnu-ld --verbose --enable-java-home --with-java-home=/usr/lib64/jvm/jre --with-jvm-root-dir=/usr/lib64/jvm --with-jvm-jar-dir=/usr/lib64/jvm/jvm-exports --with-arch-directory=amd64 --with-antlr-jar=/tmp/gcc/antlr-runtime-3.4.jar --enable-java-awt=gtk --disable-gtktest --disable-multilib --target=x86_64-slackware-linux --build=x86_64-slackware-linux --host=x86_64-slackware-linux Thread model: posix gcc version 5.3.0 (GCC) Mysql version: mysql Ver 15.1 Distrib 10.0.24-MariaDB, for Linux (x86_64) using readline 5.1 Glibc version 2.23 any one can help me to understand whats happaened ? HS

1 0

Found bug in quota-status + patch
by Thierry Coppey 03 Mar '16

03 Mar '16

Hello, I've found a bug in the quota-status util (Dovecot 2.2.21, and probably below): it always return OK (sufficient quota) because it fails to load the user properly. More specifically, the branch " if (quser == NULL) return 1; " in src/plugins/quota/quota-status.c:59 is always taken. (at least with postgresql backend, test your config with the (adapted) command below: printf "recipient=mailbox(a)example.com\nsize=10000000000\n\n" | nc inet:mailstore.example.com 12340 it should reject, unless you have no quota, or more than 10G). Therefore it is pointless to configure the quota-status service as described in http://wiki2.dovecot.org/Quota because of that bug: the mail would be always accepted from the client and rejected at the end of the (Postfix) processing by lda. It is possible to reject directly at SMTP level when the mailbox is full using Postfix and main.cf: smtpd_recipient_restrictions = ... reject_unauth_destination, ... check_policy_service inet:mailstore.example.com:12340 smtpd_end_of_data_restrictions = check_policy_service inet:mailstore.example.com:12340 However there remain a *small inconsistency* as lda will count the size of message including headers whereas smtpd_end_of_data_restrictions seems not to count them towards the message size (or additional headers might be added by other preprocessing e.g. antispam etc...) I propose the patch below to fix quota-status. Could an expert double-check that it doesn't have memory leaks? (it shouldn't but I'm not yet comfortable enough with Dovecot memory management). Best regards, Thierry C.

3 3