- dovecot - dovecot.org

Re: Multidomain / IP Address Setup (Dovevot 2.2.10 on CentOS7 ) is failing: Fatal: Couldn't parse private ssl_key: error:0906D06C:PEM
by Christian Kivalo 16 Aug '15

16 Aug '15

>But can you explain why you use globally: > >ssl_cert = </etc/ssl/dovecot.pem >ssl_key = </etc/ssl/private/dovecot.pem > >and certs for any additional Domain each? > >## >local_name mail.pettijohn-web.com { > ssl_cert = </etc/ssl/mail.pettijohn-web.com.crt > ssl_key = </etc/ssl/private/mail.pettijohn-web.com.key >} >## he configured the top level "default" ssl_{cert,key} as requested by the documentation i may quote myself >from the dovecot ssl wiki page http://wiki2.dovecot.org/SSL/DovecotConfiguration >Multiple SSL certificates >Different certificates per IP and protocol > >[snip] > >Note that you will still need a top-level "default" ssl_key and ssl_cert as well, or you will receive errors. i think, but untested, this default ssl_{cert,key} are used for those clients that don't support SNI (as with apache, which uses the cert of the first site). >I configured it the way you do, but within the default >/etc/dovecot/confd structure but >i had no luck. I testet local_name (SNI), local, local <IPv6> >(dedicated >IPv6 Address but had no lock it should make no difference whether you use one large config file or the conf.d structure. your doveconf -n output would really be helpful regards - c >Configinfo: >1) MTA (Postfix 2.10.1) and MDA (Dovecot 2.2.10) configured on IPv6 >Addresses >2) The MTA and MDA are connected to MariaDB (the default MySQL >replacement on CentOS7 now for virtual domains, users, passwords, >aliaes ect >3) Postfix uses Dovecots SASL Implementation and Postfix and Dovecot >talking via LMTP and UNIX Sockets. > >Details: >### yum info postfix ### >Name : postfix >Arch : x86_64 >Epoche : 2 >Version : 2.10.1 >Release : 6.el7 >Size : 12 M >From : installed > From Source : debian.n-ix.net_centos_7_os_x86_64_ >Summary : Postfix Mail Transport Agent >URL : http://www.postfix.org >License : IBM and GPLv2+ >Description : Postfix is a Mail Transport Agent (MTA), supporting LDAP, > >SMTP AUTH (SASL), TLS > >### yum info dovecot ### >Name : dovecot >Arch : i686 >Epoche : 1 >Version : 2.2.10 >Ausgabe : 4.el7_0.1 >Größe : 3.2 M >Quelle : debian.n-ix.net_centos_7_os_x86_64_ >Summary : Secure imap and pop3 server >URL : http://www.dovecot.org/ >Lizenz : MIT and LGPLv2 >Description : Dovecot is an IMAP server for Linux/UNIX-like systems, >written with security > : primarily in mind. It also contains a small POP3 >server. It supports mail > : in either of maildir or mbox formats. > >Cheers, >Drav

1 0

Multidomain / IP Address Setup (Dovevot 2.2.10 on CentOS7 ) is failing: Fatal: Couldn't parse private ssl_key: error:0906D06C:PEM
by dravion.smith＠gmx.net 16 Aug '15

16 Aug '15

Hi, I want to say hello and here is my big problem ;D Iam trying to archive a Postfix/Dovecot 2.2.10 CentOS7 Multidomain Setup with multiple (valid StartSSL Certs), but iam only able to run a single Domain Cert server only. ps: I need a multiple domainssetup for every customer and it is not an option for me redirecting any email to a single domain server. I really need this setup working. IMHO: I think it SELinux could interfere with multiple Certs in diffrent folders (it is activated in CentOs7 by default and is needed by other apps) Ok, here is my logfile data: systemctl start postfix.service [OK] systemctl start dovecot.service [OK] /var/log/messages *systemd: Stopping Dovecot IMAP/POP3 email server... *systemd: Starting Dovecot IMAP/POP3 email server... *systemd: Started Dovecot IMAP/POP3 email server. /var/log/maillog *dovecot: master: Dovecot v2.2.10 starting up for imap, pop3, lmtp (core dumps disabled) ### This works (Thunderbird, Outlook 2013, Opera Mail ect.) #### local mydomain01.tld { protocol imap { ssl_cert = </etc/ssl/domains/mydomain.tld/imap/imap.mydomain02.tld.crt.pem ssl_key = </etc/ssl/domains/mydomain.tld/imap/imap.mydomain02.tld.key.pem } } ### this 10-ssl.conf ### --- FAILS (the error occurs after an email client accesses IMAP Folders) local mydomain01.tld { protocol imap { ssl_cert = </etc/ssl/domains/mydomain.tld/imap/imap.mydomain02.tld.crt.pem ssl_key = </etc/ssl/domains/mydomain.tld/imap/imap.mydomain02.tld.key.pem } } local mydomain02.tld { protocol imap { ssl_cert = </etc/ssl/domains/mydomain.tld/imap/imap.mydomain02.tld.crt.pem ssl_key = </etc/ssl/domains/mydomain.tld/imap/imap.mydomain02.tld.key.pem } } /var/log/mailog ### Error log ### Aug 14 12:50:38 matrix dovecot: imap-login: Fatal: Couldn't parse private ssl_key: error:0906D06C:PEM routines:PEM_read_bio:no start line: Aug 14 12:50:38 matrix dovecot: master: Error: service(imap-login): command startup failed, throttling for 60 secs I really dont know why a single domain is no problem but if i enable multiple domains dovecots start with any error, even if i set debug verbose leven to extrem high but if i access dovecot with Thunderbird my server loggile explodes with something like this Couldn't parse private ssl_key: error:0906D06C:PEM but the certs are 100% valid and checked over and over again. Any help is greatly appreciated! Greetings, Dravion

4 12

ipv4 imap not accepting connections in mixed ipv4/ipv6
by djk 15 Aug '15

15 Aug '15

I have two installations of dovecot 2.18, apart from the necessary changes to allow them to replicate amongst themselves the configs are identical. Both are running Ubuntu 14.04 and are kept up to date. One is running 64bit and the other 32 bit (for historical reasons). Both have ipv4 and ipv6 addresses. The 64 bit installation allows access on port 143 and 993 on both ipv4 and ipv6. The 32 bit installation does not allow access on 143 on ipv4, but allows ipv4/ipv6 on 993. Both installations happily allow connections to any other ports that dovecot might be using on both ipv4/ipv6, as well as everything else that is running (on other ports) on those machines. There are firewalls, but no warning messages. Switching firewalls off makes no difference. Tcpdump shows the SYN packets arriving on the (correct) interface. Any suggestions? Dirk

1 0

IMAP folder separator issue
by Alex 15 Aug '15

15 Aug '15

Hi, I'm using dovecot-2.2.18 on fedora22 and having a problem with Thunderbird. I reported this problem some time ago, and received some tips, but no solution that's worked. I'm now trying to fix this in earnest, and having problems. The problem is sub-folders are created with a caret in them, instead of a new folder below the parent folder. So instead of folder/sub-folder, folder^sub-folder is created. I'm using mbox folders, and it worked under previous versions of fedora and dovecot. I believe it has to do with the separator character that's used, based on this wiki page: http://wiki2.dovecot.org/Plugins/Listescape The problem is that those instructions cause errors: Aug 14 20:00:01 orion dovecot: pop3(cerberus): Error: User initialization failed: namespace configuration error: Duplicate namespace prefix: "" Aug 14 20:00:01 orion dovecot: pop3(cerberus): Error: Invalid user settings. Refer to server log for more information. I've also had to change the "namespace private" to "namespace { type=private }" as that's apparently a deprecated syntax. Perhaps there's an updated page with more instruction and correct information? I'm unsure where this duplicate namespace is that it's talking about... I've included my doveconf output below, in hopes someone can help. I should also point out that "separator = $" is quoted in the original doveconf.conf but apparently doveconf doesn't properly print it. # 2.2.18: /etc/dovecot/dovecot.conf # OS: Linux 4.0.7-300.fc22.x86_64 x86_64 Fedora release 22 (Twenty Two) default_client_limit = 2000 mail_gid = mail mail_location = mbox:~/mail:INBOX=/var/spool/mail/%u mail_plugins = " listescape" mail_privileged_group = mail mbox_write_locks = fcntl namespace { inbox = yes location = prefix = separator = $ type = private } namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } passdb { driver = pam } passdb { driver = pam } protocols = imap pop3 service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0660 user = postfix } } service imap-login { inet_listener imap { port = 0 } inet_listener imaps { port = 993 } process_min_avail = 20 service_count = 0 } service pop3-login { inet_listener pop3 { port = 0 } inet_listener pop3s { address = 192.168.1.100 port = 995 } } ssl_ca = </etc/pki/dovecot/certs/ca-bundle.pem ssl_cert = </etc/pki/dovecot/certs/orion-2015.pem ssl_key = </etc/pki/dovecot/certs/orion-2015.key userdb { driver = passwd } userdb { driver = passwd }

2 1

backing up email / saving maildir on external hard drives
by Kevin Laurie 15 Aug '15

15 Aug '15

Hello, Yesterday I tried to back up a 40GB maildir . I tried to move the maildir from home to external HDD but failed. Decided then to compress it(which took several hours). Now changing the disk format from FAT to exFAT to allow the transfer for the large compressed file. How does one back up emails on a external drive? Some advice would be greatly appreciated.

7 12

need help debugging deleted mails
by Vu Ngoc VU 13 Aug '15

13 Aug '15

hello, one of our users complained about the fact that he doesn't receive some messages (randomly) that his teamates have. Grepping for the message-ID in the mail.log, I can see lmtp says it is saved : Aug 12 15:23:23 imap-01 dovecot: lmtp(4943, johndoe(a)example.net) fFuCO09Hy1VPEwAA2t/0+w: sieve: vsize= msgid=<037e01d0d502$0e3687d0$2aa39770$(a)example.net>: stored mail into mailbox 'INBOX' The only difference with others recipients is the 'sieve:... stored mail' instead of 'saved mail to' when there is no sieve. But when he asked me, the message was no more in his maildir (I checked with doveadm search). As we have checked and disabled all the filters in his MUA and on the server (sieve) and this issue still continue, I did mkdir a dovecot.rawlog inside his home. With the help of rawlog, I can see that the message can be found in a .out file (by grepping the Message-ID). And by reading this .out log raw log, the entire message were sent to the client. So I guess that : * the message was written to disk * it was sent to the MUA But I need your help because I don't get how this message disappear from his maildir. My assumptions was that the client must do some commands like : * STORE the \Deleted flag to this message UID * and then, later do EXPUNGE but I did : * grep -i expunge * 20150812* => no match * grep -iE '\+flags .*\\deleted' => a few matches but not with the appropriate UID snippet from the 20150812-133858-13317.in file: 8nk1 UID FETCH 208209 (UID FLAGS RFC822.SIZE BODY.PEEK[HEADER] INTERNALDATE) p7uv IDLE DONE 6yk3 NOOP 83g6 IDLE DONE yhbd UID FETCH 208209 (UID FLAGS BODY.PEEK[]) fy16 IDLE DONE snippet from the 20150812-133858-13317.out file: * 56295 FETCH (UID 208209) wn2p OK Fetch completed. * 56295 FETCH (UID 208209 FLAGS (\Deleted \Seen \Recent) RFC822.SIZE 17138 INTERNALDATE "12-Aug-2015 15:23:22 +0200" BODY[HEADER] {2836} Considering these points: * I cannot find any match with 208209 early in raw logs * I don't see any expunge for the whole day * I've grepped for \Deleted (insensitive) and didn't find matching like a interval of messages UID. What did I miss to find out how/when the message got \Deleted flag and was removed from his maildir? A few about my setup : * system is ubuntu 14.04 inside OpenVZ containers (Proxmox) * dovecot version is 2.2.9 from Ubuntu packages * 2 director with Internet and local ip addresses * 2 backends with only local addresses * these dovecot access storage servers by NFSv3 (that's why we have director) * imap/lmtp are proxied Thanks a lot for reading, I'm really disappointed about this problem. For the moment, I'll delete his script even if all rules are disabled (via roundcube, and I checked the rule is commented in the file). And also I'll try to watch what happens with inotify on the storage server.

4 6

backing up IMAP server on a hard drive
by Kevin Laurie 13 Aug '15

13 Aug '15

Hi, I am trying to back up my IMAP server to a hard drive. Later I intend to extract all mails for attachments. What do you reckon is the best too to perform this ? Imapsync or Thunderbird (or something else, please recommend) One problem I am having with imapsync is the setting for host2 (being a localhost computer). How does one set a parameter for host2 being a desktop computer. Thanks Kevin

3 6

Error when reading attachment - one byte overhead?
by Ачилов Рашид Нурмухамед ович 13 Aug '15

13 Aug '15

After converting maildir to mdbox mail periodically obtained these messages: Aug 13 11:22:27 mailsrv dovecot: imap(user-aaa): Error: read(/usr/share/smbusers/user-aaa/mail/attachments/a0/8e/a08e3e63e11aae3f37020bdca0da7d-7b39ab07ea73ba559d450000dec08558[base64:18 b/l]) failed: Stream is larger than expected (434427 > 434426, eof=1) Aug 13 11:22:27 mailsrv dovecot: imap(user-aaa): Error: read(attachments-connector(/usr/share/smbusers/user-aaa/mail/storage/m.23)) failed: read(/usr/share/smbusers/user-aaa/mail/attachments/a0/8e/a08e3e63e11aae3f37020bdca0da7d-7b39ab07ea73ba559d450000dec08558[base64:18 b/l]) failed: Stream is larger than expected (434427 > 434426, eof=1) (FETCH BODY[] for mailbox Разное полезное/Для памяти UID 20) Aug 13 11:22:27 mailsrv dovecot: imap(user-aaa): Disconnected: FETCH read() failed in=16923 out=497431 How to correct it? Conversion was did with 2.2.8 version, next will installed 2.2.18. -- С Уважением. Ачилов Рашид Нурмухамедович (AchilovRN(a)granch.ru) Главный специалист по защите информации ООО НПФ "Гранч", тел: +7 (383) 233-35-12, доб. 107

1 0

SiS does not work
by Ачилов Рашид Нурмухамед ович 13 Aug '15

13 Aug '15

How do you do. I have tried to use SiS to deduplicate attachments in mail storage. Unsuccesful. When goes mail with reasonable size, and SiS try to start, I have receive error, when this mail must be delivered for group of receivers (i.e. through aliases). Below is error log, valuable parts of mail addresses masked by X and Y chars Aug 6 16:11:12 mailsrv dovecot: lmtp(xxxxx): AL1SNrkyw1VPBAAABJcpmA: msgid=<2015080614471325760993(a)chinacoalchem.com> (from zsy(a)chinacoalchem.com) saved mail to INBOX This receiver has received mail. But next one does not. And to receive I must restart _sendmail_ (not dovecot!). I must restart sendmail as many times as there were recipients in envelope. Aug 6 16:11:12 mailsrv dovecot: lmtp(yyyy): Error: read(/usr/share/smbusers/xxxxx/mail/attachments /e4/3d/e43db6e8af6fb1df4a08f9c1f3f31e93e61781c4c1d2395e04dd96a583aa-01bd5236b932c3554f04000004972998[base64 :19 b/l]) failed: Stream is smaller than expected (0 < 4080128) Aug 6 16:11:12 mailsrv dovecot: lmtp(yyyy): Error: read(attachments-connector(/usr/share/smbusers/xxxxx/mail/storage/m.35)) failed: read(/usr/share/smbusers/xxxxx/mail/attachments/e4/3d/e43db6e8af6f b1df4a08f9c1f3f31e93e61781c4c1d2395e04dd96a583aa-01bd5236b932c3554f04000004972998[base64:19 b/l]) failed: Stream is smaller than expected (0 < 4080128) Aug 6 16:11:12 mailsrv dovecot: lmtp(yyyy): Error: copy: i_stream_read(attachments-connector(/usr/share/smbusers/xxxxx/mail/storage/m.35)) failed: read(/usr/share/smbusers/xxxxx/mail/attachments/e4/ 3d/e43db6e8af6fb1df4a08f9c1f3f31e93e61781c4c1d2395e04dd96a583aa-01bd5236b932c3554f04000004972998[base64:19 b/l]) failed: Stream is smaller than expected (0 < 4080128) Aug 6 16:11:12 mailsrv dovecot: lmtp(yyyy): Error: read(attachments-connector(/usr/share/smbusers/xxxxx/mail/storage/m.35)) failed: read(/usr/share/smbusers/xxxxx/mail/attachments/e4/3d/e43db6e8af6f b1df4a08f9c1f3f31e93e61781c4c1d2395e04dd96a583aa-01bd5236b932c3554f04000004972998[base64:19 b/l]) failed: Stream is smaller than expected (0 < 4080128) (uid=0, box=INBOX) Aug 6 16:11:12 mailsrv dovecot: lmtp(yyyy): AL1SNrkyw1VPBAAABJcpmA: msgid=<2015080614471325760993(a)chinacoalchem.com> (from zsy(a)chinacoalchem.com) save failed to INBOX: Internal error occurred. Refer to server log for more information. [2015-08-06 16:11:12] Why LMTP, when try to deliver mail to local user yyyy tries to look up into a home directory of local user xxxxx? All these and similar home directories has a 'mail' subdir, which keeps mail and rights on this subdir is 0700. To avoid this completely misunderstood occassion, I have temporary set mail_attachment_min_size to 2048kb - but now I cannot receive advantage from SiS. -- С Уважением. Ачилов Рашид Нурмухамедович (AchilovRN(a)granch.ru) Главный специалист по защите информации ООО НПФ "Гранч", тел: +7 (383) 233-35-12, доб. 107

2 2

userdb / user map with director
by Will Yardley 10 Aug '15

10 Aug '15

This is with dovecot-ee 2.2.18.2 on RHEL6.... To handle backend and frontend on same machine, I'm using the following hack, as previously outlined here: [in director instance config] passdb { # See thread ending in: # http://dovecot.org/pipermail/dovecot/2012-June/083817.html # for why this has to be sql instead of 'static' driver = sql args = /etc/dovecot/dovecot-sql.conf } [in /etc/dovecot/dovecot-sql.conf] driver = sqlite connect = /etc/dovecot/empty.db password_query = select 'y' as proxy, \ NULL as password, \ 'y' as nopassword, \ case '%a' \ when '110' then '10110' \ when '995' then '10110' \ when '143' then '10143' \ when '993' then '10143' end \ as port; This works, but I was getting a failure on usernames, since director instance didn't have a userdb. So I tried the following: [in config] passdb { driver = sql args = /etc/dovecot/dovecot-sql.conf } userdb { driver = prefetch } and appended the following to the SQL query: password_query = select '%u' AS user, \ Then I see the following error in the log when I try to run the map "Trying to iterate users, but userdbs don't support it" and doveadm -i director director map returns: Error: User listing returned failure Error: user listing failed [...] I'm sure I'm missing something obvious, so is there an easy fix to make this mapping work? w

1 0