- dovecot - dovecot.org

Thanks again for Dovecot
by Steve Litt 21 Dec '15

21 Dec '15

Hi all, All email clients suck. IMHO Claws-Mail sucks less, but even on the Claws-Mail mailing list there are all sorts of problems discussed. Most of these problems are a moot point for me, because I use Claws-Mail only as a window into my locally hosted Dovecot IMAP server. Claws-Mail is like a little window into Dovecot. Meanwhile, all those "don't quite work right" functionalities normally done by an email client I do outside of Claws. For filtering, I use Procmail, which sorts messages into the correct (Dovecot) folders and sends trolls to /dev/null. If Claws-Mail ever becomes as lame as Kmail, I can just switch to another email client, because most of my setup is in Dovecot and the input to Dovecot. Email clients are interchangeable for me, and this REALLY makes my life less worrysome. And Dovecot does one thing and does it right. It never breaks. Thank you for this great tool! SteveT Steve Litt November 2015 featured book: Troubleshooting Techniques of the Successful Technologist http://www.troubleshooters.com/techniques

1 0

questions for a unusual master/slave like mail-server setup
by Christoph Anton Mitterer 21 Dec '15

21 Dec '15

Hey folks. I was planning since a long time for some more advanced mail server setup (described below), which basically has some weird ;) master/slave ideas behind. It's probably a bit more complicated (and maybe also a bit more insane) than the usual mail server setup, so I'd be happy about any advice and some questions answered: There are two mailservers (dovecot, as you may have guessed ;) ): - IMAP shall be used; using POP3 is not planned. - A format in which each mail is stored in a separate file shall be used. That leaves for either maildir or sdbox, where I'd prefer maildir, as I like to be able to loose the indexes. - Each (per user) mailbox shall have many subfolders and will receive loads of mail (including from several high traffic mailing lists). - Mail filtering shall take place *at least* on the "online" server, probably either with sieve or maildrop. - One of the mailservers is always "online", directly connected to the internet (and globally available). - The other mailserver is "offline", not directly connected to the internet (and only locally available). The "online" mailserver: - Is in a not fully trusted location (i.e. at some ISP). - Has somewhat limited storage. - Makes the mails on it available to MUAs connecting from anywhere. - Receives mail from various sources, e.g. via postfix/LDA or something like fetchmail. - Has only a parts of *all* mails, that means for example: - *All* mail from some personal contacts. - Only the last 1 year for low volume mailing lists. - Only the last 4 months for high volume mailing lists. The "offline" mailserver: - Is in a trusted location (beneath my pillow ;) ). - Has enough storage for the purposes of mail. - Makes all mails available to MUAs connecting from the LAN. - Receives mails from the "online" mailserver, when manually "moved" to it via some MUA over IMAP. - Has *all* mails. Client's MUAs, may connect to both, but the "offline" server will only be available at home. As you can imagine, the idea is basically the following: I get large amounts of mails, from all kind of mailing lists as well as personal mail. All that is filtered to a tree hierarchy of folders. There's a not fully secure mailserver, where mail arrives and which I can use when I'm on the way. It contains either just recent mails (the amount depending on the traffic of the list) or for selected senders/lists everything, and I control basically on a per folder basis how much should be retained (all, last 10 years, last week, etc.). There's another server, where *all* mail should eventually end up, for archival and security reasons. This implies obviously, that some of the mail is on both servers, some only on the "offline" server, and that this may vary from folder to folder. Further, on both servers, I may want to add filters, which basically split up a folder, e.g. of high traffic lists, so that mail of previous years or months is moved to subfolder structures, e.g.: linux-kernel +--2014 \--2013 and so on. So far, all that wouldn't be too difficult,... but as you can imagine, I'd like to have a bit more, which actually makes things quite tricky. How the two mailservers shall synchronise: I don't want to "simply" rsync - the whole system needs to be a bit smarter: 1) It's okay to assume, that synchronisation happens only at discrete times and not continuously (the "offline" server doesn't run always). 2) It would be ok, if the synchronisation requires a downtime of the "online" mailserver (i.e. the LDA). Since btrfs is used, I could also easily do snapshots. 3) One can also assume that, when synchronisation happens, the "offline" server contains at least all those folders, that the "online" server has as well (and possibly more). 4) Obviously, only maildir's cur/ directories should be synced (stuff in tmp&new may be still arriving). 5) As mentioned previously, not all mail may stay on the "online" server, depending on the folder, it will either stay permanently, or only for some period. 6) However, on the "offline" server, all mail stays, unless I manually delete it. 7) One must assume, that mails on *both* servers: - change their IMAP status (as in (S)een, (A)nswered, (F)lagged, etc.) - are moved to other mail folders - may be deleted via MUAs (not clear yet where this can happen) - "Fresh" mail, however, only appears on the "online" server. 8) Mails, once on the "offline" server, shouldn't be rewritten, in the sense that the mail is deleted and recreated (hopefully with the same content), which could happen either wenn the status of the mail changes or when it's moved to another folder (on the other server). The reason is simply, that I wouldn't fully trust the online server, so once the mail is local, it should be immutable (except for the status and folder location). The last, two points make things pretty difficult, or at least I wouldn't see a straightforward solution. (4) would be quite easy, e.g. when rsync would be used, then I'd just rsync all the cur/ directory. The rsync would happen not using --delete, so that mail which is no longer on the "online" server, doesn't get deleted from the "offline" server. (5) one could do, by "simply", on a per folder basis, remove mails older than X on the "online" server, after it has been copied to the "offline" server. An already existing tool for doing that would be nice, though. (7) and (8) is IMHO the most difficult: The only idea I have so far assumes that each mail file has an ID, which is unique for the *whole* mailbox (not just for each folder, as the mails may be moved between folders). The idea would be roughly, the following: * When I synchronise, I either shut down the LDA or make a snapshot of the "online" server's mailbox and work with that. * Then, I make a list (ID, status and pathname) of *all* mails on the online server and another one of *all* mails of the offline server. * Then, I probably scan for duplicate IDs in each list... just to be safe. * Then I process the mail lists as follows: a) If an ID is on *both* servers with the same status and pathname, than that mail had been previously synced already and neither moved nor changed its status since then. Nothing to do. b) If an ID is on *both* servers but with different pathnames or status, then the mail has either been moved or it's status has changed. Consequently, I would move/rename the mail to match the new location and/or IMAP-status. I would move/rename that with the older ctime to match the one with the newer (ctime gets set at move or rename and thus at status change). Even if an attacker would have fiddled with the "online" server's time or somehow else my system times were bogus, the worst that would happen was, that status changes are lost or mail ends up in the wrong folder. c) If an ID is on the "offline" server but not the "online" server, it could be either a mail that has already been garbage collected on the "online" server (so nothing would needed to be done),... or it could be mail hat was removed (via a MUA) on the "online" server and that should as well be removed on the "offline" server, either automatically, or manually after checking. How to find out which of that applies!? d) If an ID is on the "online" server but not the "offline" server, it could be either fresh mail that would needed to be synced,... or it could be mail that was removed on the "offline" server and should as well deleted on the "online" server, either automatically, or manually after checking. (a) and (b) are again rather simple, (c) and (d) not so much... Possible solutions that I could think of: - Either simply don't sync the removal of mails from the "online" server to the "offline" server and vice-versa. It will anyway happen rather rarely. - Remember a list of all IDs, that have been garbage collected on the "online" server. - Remebmer a list of all IDs, that have been removed via MUAs. => not sure if that's easily doable, probably not, is there any dierct way one could do this with dovecot. - Something to find out which mail has been gone on both, the each, the "offline" and the "online" server, since the last synchronisation, via tricks using the snapshot features of btrfs. - Somehow using the date of now and the last synchronisation and the mtimes (which are here basically like creation times, as the mail file contents never change). But I guess that would only work for (d) and not for (c),... and I'd rather not depend on times too much. * In any case, I could give the user a list of mails that would be deleted, for double checking. I actually think this would scale, as I don't expect many mails to be manually deleted through the MUA *once they had been synced*. After that, I think the two servers should be in sync - in the sense described in the beginning. Some further parts of the idea: As said, snapshots and the refcopy feature of btrfs could be quite helpful. So I could basically keep: - the "online" mailserver's mailbox - as of the last sync - as of now - the "offline" mailserver's mailbox - as of the last sync - as of now at the disk of the "offline" server without much additional cost. They'd all share reflinks and wouldn't use (much) additional space (except for fs meta-data) and I could use the snapshots to find out which files were deleted on either of the two servers since last time. Actually copying new mail from the "online" server to the offline server's disk (in the "as of now" area), could then happen via rsync'ing every cur/ from the "online" server to the "offline" server, with --delete and --ignore-existing (as I don't trust the "online" server and mail file contents should be immutable). So... questions... :D 1) Obviously, does anyone know a better solution, or has some improvements, other ideas? Or are there any problems with the above, which I haven't realised, or would you think it would work? 2) Does dovecot *ever* change the contents (i.e. the file contents) of a maildir mail file? 3) As ID I'd have thought that the maildir mail filename might work, e.g. 1234567890.M20046P2137.mailserver,S=4542,W=4642:2,Sb I mean especially the first part: 1234567890.M20046P2137.mailserver Is that unique across *all* folders of a mailbox? AFAIU, that name would be determined by whatever delivers the mail, right? So can I somehow configure that to make it unique? 4) Does dovecot ever change anything from the maildir mail filenames, except anything after the ":" above? I.e. would it ever change: 1234567890.M20046P2137.mailserver,S=4542,W=4642 ? 5) Would dovecot every copy, truncate+copy or somehow else rewrite files, instead of just moving them (i.e. thus possibly changing inodes, reflinks or that like)? 6) AFAIU, when using maildir, dovecots index files can get completely lost,... and one can fully "recover" all mails and their status. The only "bad" thing that might happen is that MUAs re-load all mail, right? 7) How graceful does dovceot handle the situation when mail is added or removed to/from cur/ by not using dovecot's IMAP,... especially with respect to index files. In the above solution I'd do a lot adding/moving/deleting files in maildirs, which would be done purely at the (file) system level, so the index would quite often get invalidated. How does it recognise that (if at all)? And is this generally stable, or should I rather remove any indexes after syncing and have them rebuilt by that? 8) All the above doesn't handle yet the thing of having yearly/monthly/etc. archive subfolders as described above, like: linux-kernel +--2014 \--2013 possibly on *both* "online" and "offline" server and possibly even in a different layout. I'm not yet sure whether this would be easily doable with the above solution,... my basic idea would be simply consider any such "archive" subfolders as the same than the "base" folder during syncing... and afterwards do re-order the mails on the "offline" and "online" server's folders as necessary. For example, if the "online" server has: linux-kernel +--01 +--02 +--03 ... \--12 in other words, one archive folder for the each of the last 12 months. While the "offline" server has: linux-kernel +--2014 \--2013 The script would then e.g. move the files to their new folders. => does anyone know, whether such thing exists already, i.e. a tool that sorts the mails into maildir subfolders, based on years, months, etc? 9) As said before, I'd like to be able to loose any indexes, but AFAICS, my solution wouldn't anyway work with sdbox. But if there's an sdbox based solution that makes everything much easier, do not hesitate to tell me :) 10) In the long-term I hope to be able to do something that makes server-side search (i.e. through the big fat mail archive) much faster (or is that already supported in dovecot?). I haven't really looked at all into that topic (just know about notmuch[0]). Anyway, if anyone sees problems in my above solution, when that would be used with something that gives me better server side search (i.e. some indexing solution),... I'd be happy to hear about that as well. Thanks a lot so far, Chris. [0] https://notmuchmail.org/

1 0

Possible bug about the SPECIAL-USE / CREATE-SPECIAL-USE extensions
by Jeff Stedfast 20 Dec '15

20 Dec '15

Hi all, I've locally got Dovecot 2.2.21 (5345f22) installed on my MacBook (via homebrew) that I've been using to test my IMAP library against. What is interesting is that even though Dovecot does not advertise CREATE-SPECIAL-USE, it supports creation of special-use folders via the "CREATE FolderName (USE (\Whatever))" syntax. According to rfc6154, a server is supposed to advertise the CREATE-SPECIAL-USE extension if it supports this: An IMAP server that supports this OPTIONAL feature will advertise the "CREATE-SPECIAL-USE" capability string. Clients MUST NOT use the "USE" parameter unless the server advertises the capability. Note that this capability string is different from the "SPECIAL-USE" string defined above, and a server that supports both functions MUST advertise both capability strings. Has this been fixed in a newer version, perhaps? Or could it be a misconfiguration on my part? Attached is my dovecot configuration (gotten via dovecot -n). Thanks, Jeff

2 2

Multiple IPs and hostname
by Thilo Engelbracht 18 Dec '15

18 Dec '15

Hi, I'm running postfix as SMTP-server and dovecot as IMAP-server. The server has multiple IPs, and postfix is configured that every domain is using a separate IPv4-address. Examle: foo1.com --> 11.22.33.44 foo2.com --> 22.33.44.55 foo3.com --> 33.44.55.66 bar.org --> 66.77.88.99 The hostname of the server is: mail.bar.org Now I have a request from one of my customers, who is using 3 different domains: - foo1.com - foo2.com - foo3.com If he receives a mail to "user(a)foo1.com", the header of the mail looks like this: Return-Path: <somebody(a)web.de> Delivered-To: <user(a)foo1.com> (II) Received: from mail.bar.org by mail.bar.org (Dovecot) with LMTP id V[...]wAAvP/pag for <user(a)foo1.com>; Sun, 29 Nov 2015 13:45:37 +0100 (I) Received: from mout.web.de (mout.web.de [212.227.17.11]) (using TLSv1.2 with cipher ECDHE-[...]-SHA384 (256/256 bits)) (No client certificate requested) by mail.foo1.com (Postfix) with ESMTPS id A[...]9 for <user(a)foo1.com>; Sun, 29 Nov 2015 13:45:36 +0100 (CET) As you can see in (I), postfix receives the mail and added a header with the correct hostname: mail.foo1.com But dovecot adds an additional header (see II). Here, the hostname of the system is visible. This is correct, because dovecot -n | grep -i hostname returns: hostname = mail.bar.org But my customer asks me if it's possible that only his domain is visible in the header: So, if somebody sends a mail to "user(a)foo1.com", only the hostname "mail.foo1.com" should be visible in the mail header. And if somebody sends a mail to "user(a)foo2.com", only the hostname "mail.foo2.com" should be visible in the mail header. Is there a way to do this? Thank you in advance. Kind regards Thilo

2 3

Merry Christmas
by IT Security Inc. 18 Dec '15

18 Dec '15

Merry Christmas from IT Security Inc. 12/18/2015 Visit us online Merry Christmas to you and your family from Hugh Haggerty, myself and everyone else at IT Security,Inc. Albert Whale Hugh Haggerty IT Security Inc. Merry Christmas! IT Security, Inc. 519 Nichols Road Pittsburgh, PA 15237 | in2contact.co/front/tracking.jsp?clientID=858&campaignID=188&userID=731&linkID=B710C911120204FA&emailID=689&sendID=307&triggerID= | in2contact.co/front/tracking.jsp?clientID=858&campaignID=188&userID=731&linkID=EB9D07803CDFE734&emailID=689&sendID=307&triggerID=

1 0

limiting autoexpunge to a service
by Burckhard Schmidt 18 Dec '15

18 Dec '15

Hello, like described at wiki "Mailbox settings": protocol imap { namespace inbox { mailbox Spam { autoexpunge = 10d } } } I tried to use autoexpunge inside lmtp: 20-lmtp.conf: protocol lmtp { mail_plugins = $mail_plugins sieve postmaster_address = ... info_log_path = /var/log/dovecot-lmtp.log sendmail_path = /opt/csw/sbin/sendmail namespace inbox { mailbox Junk { autoexpunge = 10d } } (line 23) } But I get an error during start of dovecot (same with service imap): doveconf: Fatal: Error in configuration file /usr/dovecot/etc/dovecot/conf.d/20-lmtp.conf line 23: Garbage after '{' /usr/dovecot/sbin/dovecot -n # 2.2.21 (): /usr/dovecot-2.2.21/etc/dovecot/dovecot.conf # Pigeonhole version 0.4.10 Is it only a problem of doveconf? -- Regards --- Burckhard Schmidt Abteilung Systemsoftware und Kommunikation ZE Computer- und Medienservice der Humboldt-Universität zu Berlin Postanschrift: Unter den Linden 6, 10099 Berlin Standort: Rudower Chaussee 26; 12489 Berlin Tel.: +49-30-2093-70058 Fax: +49-30-2093-70199 Mail: bschmidt(a)cms.hu-berlin.de

1 0

Last chance to order the Dovecot book
by Peer Heinlein 18 Dec '15

18 Dec '15

Hi, as some people migth know I've written a book about Dovecot that has also been translated and published in English. Thanks for Timos great help and detailled background informations he provided to me. Unfortunately my book publisher has to shutdown his business at the end of 2015 -- right now. During the next few days you'll have the last chance to order the english version of the dovecot book at amazon, if you're interested in. Please don't wait too long. I think they'll stop offering the book before christmas and then it's gone. http://www.dovecot-book.com/online-shop/als-e-book-bestellen/ MAYBE we'll be able to re-publish it next year. Maybe. If not -- this will be the last chance to order it. Peer (The german version of the book will be still available at http://www.dovecot-buch.de) -- Heinlein Support GmbH Schwedter Str. 8/9b, 10119 Berlin http://www.heinlein-support.de Tel: 030 / 405051-42 Fax: 030 / 405051-19 Zwangsangaben lt. §35a GmbHG: HRB 93818 B / Amtsgericht Berlin-Charlottenburg, Geschäftsführer: Peer Heinlein -- Sitz: Berlin

2 1

Deleting Public Mailbox?
by Dag Nygren 17 Dec '15

17 Dec '15

Hi! What am I doing wrong here? Mission: Delete old empty sub mailboxes in our Public mailspace acl-file contents: MailingLists user=dag lrwstipekxa MailingLists/* user=dag lrwstipekxa Didn't work from my mail client so tried: Command tried: % doveadm mailbox delete -s MailingLists/Glibc -u dag doveadm(dag): Error: Can't delete mailbox MailingLists/Glibc: Permission denied % doveadm acl debug -u dag "MailingLists/Egcs" doveadm(dag): Info: Mailbox 'Egcs' is in namespace 'MailingLists/' doveadm(dag): Info: Mailbox path: /usr/local/var/mail/MailingLists/mailboxes/Egcs/dbox-Mails doveadm(dag): Info: All message flags are shared across users in mailbox doveadm(dag): Info: User dag has rights: lookup read write write-seen write-deleted insert post expunge create delete admin doveadm(dag): Error: Mailbox not found from dovecot-acl-list, rebuilding doveadm(dag): Info: Mailbox is in public namespace doveadm(dag): Info: Mailbox MailingLists/Egcs is visible in LIST Must be a config I have wrong. Would like to get rid of them... Best Dag

2 4

userdb username change ignored when using (My)SQL was: Re: userdb username changed
by Péter Márton 17 Dec '15

17 Dec '15

Hi! It works when using LDAP. I've duplicated the "username change" debug line, just to see that the variables are really updated: Apr 20 14:30:27 imap21 dovecot: auth-worker(27127): Debug: sql(ppp(a)example.net): username changed ppp(a)example.net -> uppp Apr 20 14:30:27 imap21 dovecot: auth-worker(27127): Debug: sql(uppp): username changed uppp -> uppp Apr 20 14:30:27 imap21 dovecot: auth: Debug: userdb out: USER#0111#011ppp@example.net#011home=/home/ppp#011uid=500#011gid=500#011quota_rule=*:storage=3100b:messages=1024 And the answer is of course yes. Just the userdb out string has the wrong value. The right value is lost somewhere. But where? Regards, Peter Log of the (for me unusable) LDAP query: Apr 20 14:28:07 imap21 dovecot: auth: Debug: master in: USER#0111#011m2500j6#011service=doveadm Apr 20 14:28:07 imap21 dovecot: auth: Debug: ldap(m2500j6): user search: base=ou=Users,ou=Mail,dc=bnet,dc=at scope=subtree filter=(uid=m2500j6) fields=mailHost Apr 20 14:28:07 imap21 dovecot: auth: Debug: ldap(m2500j6): result: mailHost=localhost; mailHost unused Apr 20 14:28:07 imap21 dovecot: auth: Debug: ldap(m2500j6): username changed m2500j6 -> localhost Apr 20 14:28:07 imap21 dovecot: auth: Debug: ldap(localhost): username changed localhost -> localhost Apr 20 14:28:07 imap21 dovecot: auth: Debug: ldap(localhost): result: mailHost=localhost Apr 20 14:28:07 imap21 dovecot: auth: Debug: userdb out: USER#0111#011localhost#011

2 4

doveadm-server does NOT know fts commands
by SATOH Fumiyasu 16 Dec '15

16 Dec '15

Hi, I'm using Dovecot 2.2.13 with Dovecot Director, Doveadm server and FTS. I want to run doveadm on Director hosts, but Dovecot server on backend hosts reject "fts *" commands. On Dovecot Director hosts: # doveadm fts optimize -u u0001(a)example.jp # echo $? 75 # doveadm fts rescan -u u0001(a)example.jp # echo $? 75 doveadm index -u u0001(a)example.jp INBOX # echo $? 0 On Dovecot backend hosts: # grep doveadm /var/log/maillog Jul 14 10:25:40 backend dovecot: doveadm: Error: doveadm: Client sent unknown command: fts optimize Jul 14 10:25:51 backend dovecot: doveadm: Error: doveadm: Client sent unknown command: fts rescan Is this doveadm-server restriction? On Dovecot backend hosts (2): # doveadm fts optimize -u u0001(a)example.jp -S /var/run/dovecot/doveadm-server # echo $? 75 # doveadm fts rescan -u u0001(a)example.jp -S /var/run/dovecot/doveadm-server # echo $? 75 # doveadm index -u u0001(a)example.jp -S /var/run/dovecot/doveadm-server INBOX # echo $? 0 # doveadm fts optimize -u u0001(a)example.jp # echo $? 0 # doveadm fts rescan -u u0001(a)example.jp # echo $? 0 # doveadm index -u u0001(a)example.jp INBOX # echo $? 0 -- -- Name: SATOH Fumiyasu @ OSS Technology Corp. (fumiyas @ osstech co jp) -- Business Home: http://www.OSSTech.co.jp/ -- GitHub Home: https://GitHub.com/fumiyas/ -- PGP Fingerprint: BBE1 A1C9 525A 292E 6729 CDEC ADC2 9DCA 5E1C CBCA

2 3