- dovecot - dovecot.org

doveadm import - strange warning
by Ralf Hildebrandt 08 Jan '16

08 Jan '16

I'm using the doveadm import command to extract mails from my backup: % doveadm import -u restore(a)backup.invalid mdbox:/home/copymail/mdbox "" \ mailbox INBOX header Delivered-To backup+$SEARCHPATTERN(a)backup.invalid This works like a charm, I'm getting all the mails, and I can access the newly generated mailbox. But when executing the command I'm getting an annoying warning: doveadm(restore(a)backup.invalid): Error: chdir(/root/) failed: Permission denied (euid=1001(copymail) egid=1001(copymail) missing +x perm: /root, dir owned by 0:0 mode=0700) doveadm(restore(a)backup.invalid): Error: chdir(/root) failed: Permission denied I'm using a file based authentication: # cat passwd restore@backup.invalid:{SHA}+/...the.hash...:1001:1001:(gecos):/home/restore:: So why is "restore(a)backup.invalid" being associated with /root? I'm using 2:2.2.18-1~auto+91, but the warning has been around for ages :) -- [*] sys4 AG http://sys4.de, +49 (89) 30 90 46 64 Franziskanerstraße 15, 81669 München Sitz der Gesellschaft: München, Amtsgericht München: HRB 199263 Vorstand: Patrick Ben Koetter, Marc Schiffbauer Aufsichtsratsvorsitzender: Florian Kirstein

5 7

strange interaction with MacOSX calendar server
by Jim Reid 07 Jan '16

07 Jan '16

I’ve installed and configured Apple’s calendar server. It seems to be working just fine. However it keeps trying to speak to my IMAP server — don’t know why — and the authentication attempts fail every 30 seconds or so. Here’s what’s in the calendar server logs: 2016-01-07 22:42:38+0000 [-] [caldav-1] [IMAP4DownloadProtocol (TLSMemoryBIOProtocol),client] [txdav.caldav.datastore.scheduling.imip.inbound.IMAP4DownloadProtocol#error] IMAP login failed for com.apple.calendarserver 2016-01-07 22:43:08+0000 [-] [caldav-1] [IMAP4DownloadProtocol (TLSMemoryBIOProtocol),client] [txdav.caldav.datastore.scheduling.imip.inbound.IMAP4DownloadProtocol#error] IMAP login failed for com.apple.calendarserver 2016-01-07 22:43:39+0000 [-] [caldav-1] [IMAP4DownloadProtocol (TLSMemoryBIOProtocol),client] [txdav.caldav.datastore.scheduling.imip.inbound.IMAP4DownloadProtocol#error] IMAP login failed for com.apple.calendarserver And in dovecot’s logs I see: Jan 7 22:47:43 hutch dovecot[63067]: imap-login: Disconnected (auth failed, 2 attempts in 4 secs): user=<com.apple.calendarserver>, method=PLAIN, rip=195.54.233.70, lip=195.54.233.70, TLS, session=<wkMAQsYoVADDNulG> Jan 7 22:48:10 hutch dovecot[63067]: auth-worker(65378): Error: pam(com.apple.calendarserver,195.54.233.70): pam_acct_mgmt() failed: permission denied Jan 7 22:48:14 --- last message repeated 1 time --- Jan 7 22:48:14 hutch dovecot[63067]: imap-login: Disconnected (auth failed, 2 attempts in 4 secs): user=<com.apple.calendarserver>, method=PLAIN, rip=195.54.233.70, lip=195.54.233.70, TLS, session=<dSvTQ8YoXQDDNulG> Jan 7 22:48:40 hutch dovecot[63067]: auth-worker(65378): Error: pam(com.apple.calendarserver,195.54.233.70): pam_acct_mgmt() failed: permission denied Jan 7 22:48:44 --- last message repeated 1 time — I tweaked dovecot to use AUTH PLAIN as well as CRAM-MD5. [The MD5 stuff has always worked fine for SMTP and IMAP over TLS.] I think /etc/pam.d/dovecot is OK too: % cat /etc/pam.d/dovecot # # as documented on Dovecot wiki auth required pam_opendirectory.so try_first_pass account required pam_nologin.so account required pam_opendirectory.so password required pam_opendirectory.so Here’s my dovecot.conf: # 2.2.5: dovecot.conf # OS: Darwin 12.5.0 x86_64 auth_mechanisms = plain login cram-md5 base_dir = /var/run/dovecot/ listen = *, [::] mail_debug = yes mail_privileged_group = mail mbox_write_locks = fcntl namespace inbox { hidden = yes inbox = yes list = no location = mbox:~/mail:INBOX=/var/mail/%u prefix = "#mbox/" separator = / type = private } namespace { inbox = no list = yes location = maildir:/var/imap/%u:LAYOUT=fs prefix = separator = / type = private } passdb { driver = pam args = failure_show_msg=yes } passdb { args = /usr/local/etc/dovecot-md5 driver = passwd-file } protocols = imap service auth { executable = /usr/local/libexec/dovecot/auth unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0660 user = postfix } user = root } service imap-login { client_limit = 32 executable = /usr/local/libexec/dovecot/imap-login inet_listener imap { port = 0 } process_limit = 128 process_min_avail = 3 service_count = 1 vsz_limit = 64 M } service imap { executable = /usr/local/libexec/dovecot/imap process_limit = 32 } service pop3-login { client_limit = 32 process_limit = 128 process_min_avail = 3 service_count = 1 vsz_limit = 64 M } service pop3 { process_limit = 32 } ssl_cert = </usr/local/etc/ssl/certs/dovecot.pem ssl_cipher_list = ALL:!LOW:!SSLv2 ssl_key = </usr/local/etc/ssl/private/dovecot.pem syslog_facility = local4 userdb { driver = passwd } protocol imap { mail_max_userip_connections = 10 mail_plugin_dir = /usr/local/lib/dovecot/imap } protocol lda { postmaster_address = postmaster(a)example.com } Can someone please explain what’s going on and how to fix/troubleshoot it? Thanks. The endless error messages in the log don’t seem to be causing any problems to either the mail setup or the calendaer server. Famous last words… However they are a bit annoying and probably point to an underlying problem or misconfiguration that really should be fixed. By the way, the password used by the calendar server is for my MacOSX login (which should be getting picked up via PAM, right?) while a different one is used for the SMTP/IMAP MD5 challenge-response. I hope someone can clear up my confusion.

1 0

Mapping of INBOX.INBOX breaks imapc_list_prefix=INBOX?
by Peer Heinlein 07 Jan '16

07 Jan '16

We're running a huge imapc-Migration from an old Courier-IMAP to Dovecot. Courier always uses "INBOX."-prefix for his folders, so we set namespace inbox { [...] separator = . prefix = INBOX. [...] } on our new Dovecot 2.2.20 system. And also we added: imapc_list_prefix=INBOX to avoid the dublication of the INBOX prefix. At the end, doveadm/dsync/imapc see "INBOX.Virus", adds his Prefix, has "INBOX.INBOX.Virus", deletes his imapc_list_prefix and the end we have "INBOX.Virus" again which is identical to the source folder from Courier. Works perfect BUT: It looks like there is a "hidden feature" in Dovecot that always maps "INBOX.INBOX" back to "INBOX". For me that looks like a workaround for broken mailclients to fix some of the common problems after changing the namespace prefix. I never heard about that "hidden feature", but even if I don't (!) have INBOX.INBOX: root@imap01:~/MIGRATION # doveadm mailbox list -u test INBOX INBOX.Virus INBOX.Spam INBOX.Trash I'm always able to access INBOX.INBOX which is identical to INBOX: root@imap01:~/MIGRATION # doveadm fetch -u test uid mailbox INBOX.INBOX uid: 1 Looks like there is such a magic-mapping and looks like this "hard coded mapping" (?) breaks the imapc_list_prefix-magic. If the user has on the SOURCE-server (Courier): Source-Server: INBOX (5 messages) INBOX.Inbox (3 messages) and I do migrate that user using doveadm/dsync/imapc, this user has on the DESTINATION-server (Dovecot) Destination-server: INBOX (5 messages) INBOX.Inbox (5 messages from "real INBOX") and his 3 messages from INBOX.Inbox are lost. I can NOT find any errors in the debug/error-output of doveadm/dsync/imapc. From the view of doveadm everything worked perfect as you can see in the attached logfile. Or am I completly wrong?! Peer -- Heinlein Support GmbH Schwedter Str. 8/9b, 10119 Berlin http://www.heinlein-support.de Tel: 030 / 405051-42 Fax: 030 / 405051-19 Zwangsangaben lt. §35a GmbHG: HRB 93818 B / Amtsgericht Berlin-Charlottenburg, Geschäftsführer: Peer Heinlein -- Sitz: Berlin

2 4

doveadm proxy kick shows always "0 connections kicked"?!
by Peer Heinlein 06 Jan '16

06 Jan '16

On Dovecot 2.2.20: There *IS* a user connected: root@mailproxy02:~ # doveadm proxy list | grep testuser username proto src ip dest ip port testuser imap xx.xx.xx.xx yy.yy.yy.yy 143 But if I kick him there are always "0 connections kicked": root@mailproxy02:~ # doveadm proxy kick testuser 0 connections kicked ...even if the user's gone after I kicked him. Peer -- Heinlein Support GmbH Schwedter Str. 8/9b, 10119 Berlin http://www.heinlein-support.de Tel: 030 / 405051-42 Fax: 030 / 405051-19 Zwangsangaben lt. §35a GmbHG: HRB 93818 B / Amtsgericht Berlin-Charlottenburg, Geschäftsführer: Peer Heinlein -- Sitz: Berlin

1 0

allow_nets=local in passdb gets "auth: Panic"
by SATOH Fumiyasu 05 Jan '16

05 Jan '16

Hi, I have the following configuration in my dovecot.conf for Dovecot 2.2.21: passdb { driver = ldap args = /etc/dovecot/dovecot-ldap.conf.ext default_fields = allow_nets=local,127.0.0.1,10.255.1.0/24 } This triggers "auth: Panic" on POP3/IMAP logins as the below: Dec 22 14:57:39 localhost dovecot: auth: ldap(u0000,::1,<oiF8SHYngqsAAAAAAAAAAAAAAAAAAAAB>): allow_nets: Invalid network 'local' Dec 22 14:57:39 localhost dovecot: auth: Panic: file net.c: line 1137 (net_is_in_network): assertion failed: (IPADDR_IS_V6(ip) == IPADDR_IS_V6(net_ip)) `doveadm auth test <username> <password>` is no problem as expected. What's wrong? Regards, -- -- Name: SATOH Fumiyasu @ OSS Technology Corp. (fumiyas @ osstech co jp) -- Business Home: http://www.OSSTech.co.jp/ -- GitHub Home: https://GitHub.com/fumiyas/ -- PGP Fingerprint: BBE1 A1C9 525A 292E 6729 CDEC ADC2 9DCA 5E1C CBCA

2 3

Replication - user permissions
by Petter Gunnerud 05 Jan '16

05 Jan '16

When setting up dsync for replication, what should the user permissions be for sync over ssh? I'm running virtual users only. Postfix and Dovecot services run as mail:mail. All the maildir folders are owned by mail:mail and permissions are 700. User mail is not allowed login. So whats the best practice in respect to security to allow for dsync over ssh? So of the options I consider: 1) change postfix/dovecot settings so that maildirs are created with 770 permissions, then create a user dsync:mail that is allowed for ssh login. 2) permit user mail to login using ssh 3)go with tcp sync rather than ssh Other suggestions? PG

1 0

Replication - hostname issue
by Petter Gunnerud 04 Jan '16

04 Jan '16

I have postfix/dovecot setup on a virtual gentoo server. It's been in service for almost two years without any issues. Now I want to set up a spare server to replicate mails from the one running. I copied the vm files to the second host server, changed the ip, hostname and hosts file for the copy and followed the dovecot replication doc. The last point in the doc tells to rundovecot --hostdomainto make sure the hostnames differ... To my surprise the command returned "localhost" on both servers. How do I set the hostname for dovecot service?(The hostname command returns the servers hostnames.)Will a change in dovecot hostname make all clients redownload all their mail? A second question. When configuring dovecot replication. Should the settings be done on the master server or the stand by server, or both? (Doc doesn't say anything regarding this) PG

2 2

2.2.21 imap core dump after enabling autoexpunge
by Tomi Vainio 04 Jan '16

04 Jan '16

Hi, I've enabled autoexpunge for Trash and Junk. Now imap process core dumps occasionally. Tomppa > program terminated by signal SEGV (no mapping at the fault address) > 0xff0dc2e0: o_stream_get_buffer_used_size : ld [%o0 + 20], %o0 > Current function is notify_ok (optimized) > 13 if (o_stream_get_buffer_used_size(client->output) != 0) > (dbx) where > [1] o_stream_get_buffer_used_size(0x0, 0x83ee8, 0x83ee8, 0x5f520, 0xfffe681c, 0xff13a978), at 0xff0dc2e0 > =>[2] notify_ok(mailbox = 0x90188, text = 0x83ee8 "Stale mailbox lock file detected, will override in 0 seconds", context = 0xa3588) (optimized), at 0x5f524 (line ~13) in "mail-storage-callbacks.c" > [3] dotlock_callback(0x0, 0x1, 0x90188, 0x567a61fe, 0xff1352a0, 0x2), at 0xff1ff478 > [4] dotlock_create(0xcc3d8, 0x2dc6c0, 0x1, 0x0, 0x0, 0x567a61fe), at 0xff0b0e68 > [5] file_dotlock_create_real(0xcc3d8, 0x1, 0x541c, 0x4, 0xff1352a0, 0xff13a6bc), at 0xff0b1104 > [6] file_dotlock_create(0xbf674, 0x8f990, 0x1, 0xbf690, 0x5, 0xcc3d8), at 0xff0b126c > [7] maildir_uidlist_lock_timeout(0xbf648, 0x1, 0x1, 0x1, 0x3f, 0x26c00), at 0xff1ff0ec > [8] maildir_uidlist_sync_lock(0xbf648, 0x8, 0xffbff59f, 0x1, 0x1, 0xf19c8), at 0xff2035bc > [9] maildir_uidlist_sync_init(0xbf648, 0x8, 0x83d20, 0x1, 0x44, 0xff2f502c), at 0xff203680 > [10] maildir_sync_context(0x83d08, 0x1, 0x0, 0xffbff707, 0x83d20, 0x83d08), at 0xff1fe290 > [11] maildir_sync_run(0x90188, 0x44, 0x0, 0x0, 0x0, 0x90420), at 0xff1fe74c > [12] maildir_storage_sync_init(0x90188, 0x44, 0x541c, 0x0, 0x80, 0xff2f502c), at 0xff1feaa0 > [13] mailbox_sync(0x90188, 0x44, 0x0, 0x4, 0x44, 0x90388), at 0xff1b91cc > [14] index_mailbox_get_metadata(0x90188, 0x40, 0xffbff910, 0x0, 0xff2f502c, 0x0), at 0xff273858 > [15] maildir_mailbox_get_metadata(0x90188, 0x40, 0xffbff910, 0xfffffff8, 0x0, 0xff2f502c), at 0xff1f9e4c > [16] mailbox_get_metadata(0x90188, 0x40, 0xffbff910, 0x0, 0xff2f502c, 0x2), at 0xff1b8ecc > [17] mailbox_autoexpunge(0x90188, 0x5651837e, 0xa1e28, 0xa2630, 0x0, 0x0), at 0xff1a6fcc > [18] mail_user_autoexpunge(0x9eaf4, 0x8, 0x5651837e, 0xff2f502c, 0x9c290, 0xffbff9ac), at 0xff1a72e8 > [19] mail_user_unref(0x9de20, 0xfffd135c, 0xff2f502c, 0x1, 0xff2c6388, 0xa35d4), at 0xff1c328c > [20] client_default_destroy(client = 0xa3588, reason = <value unavailable>) (optimized), at 0x41c8c (line ~390) in "imap-client.c" > [21] io_loop_call_io(0x9ca18, 0xfffdbba8, 0x0, 0xff1352a0, 0x8c6b8, 0x24400), at 0xff0c8fd4 > [22] io_loop_handler_run_internal(0x8c6b8, 0x1, 0x0, 0x8d1b8, 0x1, 0x9ca18), at 0xff0cadd8 > [23] io_loop_run(0x8c6b8, 0x1, 0xc0, 0xff13b26c, 0xff1352a0, 0x8d1b8), at 0xff0c90fc > [24] master_service_run(0x8c608, 0x60fe0, 0x1, 0x80, 0x27c00, 0x2), at 0xff0236c8 > [25] main(argc = <value unavailable>, argv = 0x1) (optimized), at 0x619c4 (line ~442) in "main.c" > (dbx) > # 2.2.21 (5345f22): /usr/local/etc/dovecot/dovecot.conf > # OS: SunOS 5.10 sun4u > base_dir = /var/run/dovecot/ > dsync_remote_cmd = ssh -l%{login} %{host} /usr/local/bin/doveadm dsync-server -u%u -U > first_valid_uid = 100 > last_valid_uid = 199 > mail_location = maildir:~/Maildir > mail_plugins = fts fts_solr > namespace inbox { > inbox = yes > location = > mailbox "Deleted Messages" { > special_use = \Trash > } > mailbox Drafts { > special_use = \Drafts > } > mailbox Junk { > auto = create > autoexpunge = 31 days > special_use = \Junk > } > mailbox Sent { > auto = subscribe > special_use = \Sent > } > mailbox "Sent Messages" { > special_use = \Sent > } > mailbox Spam { > special_use = \Junk > } > mailbox Trash { > autoexpunge = 31 days > special_use = \Trash > } > prefix = > } > passdb { > driver = pam > } > plugin { > fts = solr > fts_autoindex = yes > fts_solr = url=http://127.0.0.1:8983/solr/ break-imap-search > } > protocols = imap > service auth { > user = root > } > service imap-login { > inet_listener imap { > address = localhost > port = 143 > } > inet_listener imaps { > address = * > port = 993 > } > } > ssl_cert = </etc/mail/certs/server-all.crt > ssl_cipher_list = AES128+EECDH:AES128+EDH > ssl_dh_parameters_length = 2048 > ssl_key = </etc/mail/certs/server.key > ssl_prefer_server_ciphers = yes > ssl_protocols = !SSLv2 !SSLv3 > userdb { > driver = passwd > }

2 2

Re: segfault in dict_transaction_rollback() on doveadm quota recalc -u
by Lazy 04 Jan '16

04 Jan '16

Bump > Hi, > > We have a dovecot cluster with nfs storage, 2 directors and 3 > imap/pop3/lmtp backends. > > Redis is used as a dict backend with a dict proxy. > > dict { > quota = redis:host=127.0.0.1:prefix=user/ > } > > plugin { > > quota = dict:User quota::proxy::quota > > } > > Redis server is behind haproxy working in tcp mode. > > doveadm quota recalc -u user always couses dict process segfault (called > from imap backend or director host), otherwise quota is working correctly. > > > #0 dict_transaction_rollback (_ctx=_ctx@entry=0xea5fd0) at dict.c:194 > 194 ctx->dict->v.transaction_rollback(ctx); > (gdb) bt > #0 dict_transaction_rollback (_ctx=_ctx@entry=0xea5fd0) at dict.c:194 > #1 0x0000000000404d4d in dict_connection_destroy (conn=conn@entry=0xea5af0) > at dict-connection.c:166 > #2 0x0000000000405098 in dict_connection_input (conn=<optimized out>) at > dict-connection.c:127 > #3 dict_connection_input (conn=0xea5af0) at dict-connection.c:96 > #4 0x00007fbf886fe4fb in io_loop_call_io (io=0xeab550) at ioloop.c:501 > #5 0x00007fbf886ff54b in io_loop_handler_run_internal (ioloop=ioloop@entry=0xe9f730) > at ioloop-epoll.c:220 > #6 0x00007fbf886fe589 in io_loop_handler_run (ioloop=ioloop@entry=0xe9f730) > at ioloop.c:548 > #7 0x00007fbf886fe608 in io_loop_run (ioloop=0xe9f730) at ioloop.c:525 > #8 0x00007fbf8869fbc3 in master_service_run (service=0xe9f5c0, > callback=callback@entry=0x4059c0 <client_connected>) at > master-service.c:581 > #9 0x0000000000404ad8 in main (argc=1, argv=0xe9f390) at main.c:105 > (gdb) p ctx > $1 = (struct dict_transaction_context *) 0x0 > > > dovecot 2.2.18, redis server 2.8 > > > > Regards Michal >

2 2

[BUG] 2.2.21 Panic: file imap-client.c: line 841 (client_check_command_hangs): assertion failed: (!have_wait_unfinished || unfinished_count > 0)
by Florian Pritz 04 Jan '16

04 Jan '16

Hi, I'm seeing the following in my logs. Twice so far, no idea what caused it. I do however have the core dump if that is of any use. > Jan 4 11:14:11 karif dovecot[20876]: imap(username): Panic: file imap-client.c: line 841 (client_check_command_hangs): assertion failed: (!have_wait_unfinished || unfinished_count > 0) > Jan 4 11:14:11 karif dovecot[20876]: imap(username): Error: Raw backtrace: /usr/lib/dovecot/libdovecot.so.0(+0xa64ea) [0x7f6f99fa64ea] -> /usr/lib/dovecot/libdovecot.so.0(+0xa7a18) [0x7f6f99fa7a18] -> /usr/lib/dovecot/libdovecot.so.0(i_ > fatal+0) [0x7f6f99fa686d] -> dovecot/imap() [0x41dde6] -> dovecot/imap(client_continue_pending_input+0xd6) [0x41df50] -> dovecot/imap() [0x4122a9] -> /usr/lib/dovecot/libdovecot.so.0(io_loop_call_io+0xcd) [0x7f6f99fc3b01] -> /usr/lib/dovec > ot/libdovecot.so.0(io_loop_handler_run_internal+0x209) [0x7f6f99fc606e] -> /usr/lib/dovecot/libdovecot.so.0(io_loop_handler_run+0x24) [0x7f6f99fc3caa] -> /usr/lib/dovecot/libdovecot.so.0(io_loop_run+0xaf) [0x7f6f99fc3bf6] -> /usr/lib/dovec > ot/libdovecot.so.0(master_service_run+0x2e) [0x7f6f99f317af] -> dovecot/imap(main+0x2da) [0x430da2] -> /usr/lib/libc.so.6(__libc_start_main+0xf0) [0x7f6f99b7c610] -> dovecot/imap(_start+0x29) [0x40c639] > Jan 4 11:14:11 karif dovecot[20876]: imap(username): Fatal: master: service(imap): child 19463 killed with signal 6 (core dumped) In case it is easier to read, here's a gdb backtrace: > #0 0x00007f6f99b8f5f8 in raise () from /usr/lib/libc.so.6 > #1 0x00007f6f99b90a7a in abort () from /usr/lib/libc.so.6 > #2 0x00007f6f99fa6539 in default_fatal_finish (type=LOG_TYPE_PANIC, status=0) at failures.c:201 > #3 0x00007f6f99fa7a18 in i_internal_fatal_handler (ctx=0x7ffe660d4700, format=0x438a60 "file %s: line %d (%s): assertion failed: (%s)", args=0x7ffe660d4720) at failures.c:670 > #4 0x00007f6f99fa686d in i_panic (format=0x438a60 "file %s: line %d (%s): assertion failed: (%s)") at failures.c:275 > #5 0x000000000041dde6 in client_check_command_hangs (client=0x2363450) at imap-client.c:841 > #6 0x000000000041df50 in client_continue_pending_input (client=0x2363450) at imap-client.c:884 > #7 0x00000000004122a9 in idle_client_input (ctx=0x23642a8) at cmd-idle.c:111 > #8 0x00007f6f99fc3b01 in io_loop_call_io (io=0x2374600) at ioloop.c:559 > #9 0x00007f6f99fc606e in io_loop_handler_run_internal (ioloop=0x232c740) at ioloop-epoll.c:220 > #10 0x00007f6f99fc3caa in io_loop_handler_run (ioloop=0x232c740) at ioloop.c:607 > #11 0x00007f6f99fc3bf6 in io_loop_run (ioloop=0x232c740) at ioloop.c:583 > #12 0x00007f6f99f317af in master_service_run (service=0x232c5e0, callback=0x430a35 <client_connected>) at master-service.c:640 > #13 0x0000000000430da2 in main (argc=1, argv=0x232c390) at main.c:442 Florian

3 3