- dovecot - dovecot.org

Dovecot proxy ignores trusted root certificate store
by Alex Bulan 22 Sep '15

22 Sep '15

Dovecot v2.2.18 OS: FreeBSD 10.1/amd64 Dovecot in proxy mode ignores the root certificate store and can't verify the backend's SSL certificate. I've pointed ssl_client_ca_file to my root certificate store, but I suspect ssl_client_ca_file is only used in imapc context. It seems to be ignored in proxy context. doveconf -n ssl_client_ca_file: ssl_client_ca_file = /usr/local/share/certs/ca-root-nss.crt In my password_query I return host set to the backend's IP address, starttls='yes', proxy='y'. The backend's certificate chain is correct and it verifies successfully with "openssl s_client -connect x.x.x.x:110 -starttls pop3 -CAfile /usr/local/share/certs/ca-root-nss.crt". But the Dovecot proxy fails to verify the intermediate certificate it receives from the backend. The inode atime of ca-root-nss.crt is never updated, either at Dovecot start or when it connects to the backend, so Dovecot (via the openssl library) never reads the file. Sep 20 19:59:48 dovecot: pop3-login: Invalid certificate: unable to get local issuer certificate: /C=US/O=GeoTrust Inc./OU=Domain Validated SSL/CN=GeoTrust DV SSL CA - G4 Sep 20 19:59:48 dovecot: pop3-login: Invalid certificate: certificate not trusted: /C=US/O=GeoTrust Inc./OU=Domain Validated SSL/CN=GeoTrust DV SSL CA - G4 Sep 20 19:59:48 dovecot: pop3-login: Error: proxy: Received invalid SSL certificate from x.x.x.x:110: unable to get local issuer certificate: /C=US/O=GeoTrust Inc./OU=Domain Validated SSL/CN=GeoTrust DV SSL CA - G4: user=<xxx>, method=PLAIN, rip=x.x.x.x, lip=x.x.x.x, session=<lz9YjzYgIADYyWAp>

6 13

2.2.18 Regression: Incorrect STATUS response for virtual mailboxes
by Guilhem Moulin 22 Sep '15

22 Sep '15

As shown below, adding a message to TRASH doesn't increase virtual/test's MESSAGES count. However SELECTing virtual/test triggers the increase; so does running `doveadm mailbox status vsize virtual/test` in another shell. $ mkdir -m0700 ~/mail/virtual/test $ echo -e "TRASH\n\tall" > ~/mail/virtual/test/dovecot-virtual $ /usr/lib/dovecot/imap S: * PREAUTH [CAPABILITY IMAP4rev1 … ] Logged in as guilhem C: a STATUS TRASH (MESSAGES UIDNEXT UNSEEN) C: b STATUS virtual/test (MESSAGES UIDNEXT UNSEEN) S: * STATUS TRASH (MESSAGES 5599 UIDNEXT 5619 UNSEEN 0) S: a OK Status completed (0.001 secs). S: * STATUS virtual/test (MESSAGES 5599 UIDNEXT 5600 UNSEEN 0) S: b OK Status completed (0.032 secs). C: c APPEND TRASH {1+} S: x S: c OK [APPENDUID 1442277584 5619] Append completed (0.029 secs). C: d STATUS TRASH (MESSAGES UIDNEXT UNSEEN) C: e STATUS virtual/test (MESSAGES UIDNEXT UNSEEN) S: * STATUS TRASH (MESSAGES 5600 UIDNEXT 5620 UNSEEN 1) S: d OK Status completed (0.000 secs). S: * STATUS virtual/test (MESSAGES 5599 UIDNEXT 5600 UNSEEN 0) S: e OK Status completed (0.000 secs). # it doesn't help to LOGOUT and issue the STATUS command again. However, # it does to execute `doveadm mailbox status vsize virtual/test` in another # shell, or to SELECT virtual/test in the IMAP session. C: f STATUS TRASH (MESSAGES UIDNEXT UNSEEN) C: g STATUS virtual/test (MESSAGES UIDNEXT UNSEEN) S: * STATUS TRASH (MESSAGES 5600 UIDNEXT 5620 UNSEEN 1) S: f OK Status completed (0.000 secs). S: * STATUS virtual/test (MESSAGES 5600 UIDNEXT 5601 UNSEEN 1) S: g OK Status completed (0.000 secs). Cheers, -- Guilhem.

2 1

sieve_extprograms - run any individual script?
by Hajo Locke 22 Sep '15

22 Sep '15

Hello, i use sieve extension sieve_extprograms to send incoming mail to some script. For security reasons it is needed that script-paths etc. are registered in dovecot.conf This is my current dovecot.conf plugin { sieve = ~/.dovecot.sieve sieve_plugins = sieve_extprograms sieve_extensions = +vnd.dovecot.pipe +vnd.dovecot.filter +vnd.dovecot.execute sieve_pipe_bin_dir = /usr/local/bin/ sieve_filter_bin_dir = /usr/local/bin/ } .dovecot.sieve example: if address "to" "test(a)example.com" { filter "myfilter"; } This is all working without problems. Is there a possibility to allow users the execution of individual scripts in own homepath? Some people need to pipe mails to scripts for immediately processing (some ticketsystems need this). Is there a way to make this possible with sieve? Thanks, Hajo

4 4

Multiple passwords for a user (SQL)
by Marco Fretz 22 Sep '15

22 Sep '15

Hi everyone, I'm not sure if this has been discuessed already as I coun't find anything in the archives - maybe I'm looking for the wrong thing. I want to build something similar to googles "app passwords" where your use a different password (strong, auto generated) for each device / app. In general I think this is pretty easy on the database side as I just need a password table and link say the passwords with an user_id to the corresponding user in the users table - one use has many passwords (1:n). for dovecot this means that it will get multiple rows with passwords back from the "password_query". is there a way to tell dovecot to check all those returned passwords and "pass" the request if one of those passwords match? thank you, best regards Marco

2 3

[Dovecot] Pigeonhole sieve re-filter extension?
by T.B. 22 Sep '15

22 Sep '15

Dear Stephan Bosch, dear Dovecot community, "sieve-filter" re-filtering of existing mails is already a great progress for everyone using sieve! But as far as I know this functionality is just accessible by the server administrator. In the meanwhile everyone knows the comfort of re-executing filter scripts on his own existing mailboxes - triggered by himself! This service is already very widespread. Examples are MUA's like Outlook or Thunderbird which provide this service just on the client side. Or almost every web-mail provider offers this. Is there already an managesieve protocol extension that allows client triggered server side re-filtering? If not, maybe you could design a RFC for this? What do you think? Best regards. T.B.

4 8

ssl_key_password loaded from file: 'Couldn't parse private ssl_key'
by B. R. 22 Sep '15

22 Sep '15

As this is my first message to this ML: Hello! I am using a password-protected SSL key for my dovecot MDA. When I tried to use the ssl_key_password configuration directive as follow: ssl_key_password = </path/to/passfile it did not work as I logged the following: dovecot: imap-login: Error: SSL: Stacked error: error:06065064:digital envelope routines:EVP_DecryptFinal_ex:bad decrypt dovecot: imap-login: Fatal: Couldn't parse private ssl_key: error:0906A065:PEM routines:PEM_do_header:bad decrypt However, not using the fille inclusion but directly configuring as follow: ssl_key_password = mypass did work... I am loading my certificate & key with the file inclusion trick... How come cannot I use that for the password file? It would avoid input the password directly into the dovecot configuraiton files, forcing me to change permissions and duplicating it... When renewing the private key I will be force to edit the password at every location. Is it a bug? or a feature? :D --- *B. R.*

3 3

Messages lost from imap folders
by Nikolaos Milas 19 Sep '15

19 Sep '15

Hello, We have one user who is complaining that he has lost mails from 3 imap folders, administered through squirrelmail. The folders suddenly appeared unregistered, and once manually registered they were empty. Has anyone observed something like this? We are running two servers (as VMs) with Dovecot v2.2.18, synced (two-way) using dsync. The configurations follow. Can you please help me understand what may have gone wrong? Can I try to find actions regarding these folders in the logs? What should I search for? Could this be an issue involving dsync? How can I trace back dsync activity in detail? Server configs follow (I have only altered the real domain name and the login greeting.) Thanks in advance, Nick ----------------------------------------------------------------------------- SERVER 1 ----------------------------------------------------------------------------- protocols = imap pop3 login_greeting = Hello World! mail_location = maildir:~/Maildir/ mail_gid = 500 mail_uid = 500 auth_mechanisms = plain login auth_username_format = %Lu auth_verbose = yes auth_debug = no mail_debug = no disable_plaintext_auth = no mail_plugins = quota notify replication protocol imap { imap_client_workarounds = "delay-newmail" mail_plugins = quota imap_quota notify replication } protocol pop3 { mail_max_userip_connections = 3 mail_plugins = quota notify replication pop3_client_workarounds = outlook-no-nuls oe-ns-eoh pop3_uidl_format = %08Xu%08Xv } protocol lda { auth_socket_path = /var/run/dovecot/auth-master info_log_path = log_path = mail_plugins = quota notify replication postmaster_address = sysadmin(a)example.com sendmail_path = /usr/lib/sendmail } userdb { args = /etc/dovecot/dovecot-usrdb-ldap.conf driver = ldap } passdb { args = /etc/dovecot/dovecot-passdb-ldap.conf driver = ldap } dsync_remote_cmd = ssh -l root vmail1.example.com doveadm dsync-server -u%u replication_dsync_parameters = -d -N -l 30 -U plugin { mail_replica = remote:vmail@vmail1.example.com } plugin { quota = maildir:User quota quota_rule = *:storage=5G quota_rule2 = Trash:storage=+3%% quota_warning = storage=75%% quota-warning 75 %u quota_warning2 = storage=90%% quota-warning 90 %u } service quota-warning { executable = script /opt/mail1.sh user = vmail unix_listener quota-warning { user = vmail } } service aggregator { fifo_listener replication-notify-fifo { user = vmail } unix_listener replication-notify { user = vmail } } service replicator { unix_listener replicator-doveadm { mode = 0600 } } service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0660 user = postfix } unix_listener auth-master { group = vmail mode = 0660 user = vmail } user = root } service imap-login { service_count = 1 vsz_limit = 64 M } service pop3-login { service_count = 1 vsz_limit = 64 M } service replicator { process_min_avail = 1 } service imap { executable = imap postlogin } service pop3 { executable = pop3 postlogin } service postlogin { executable = script-login -d rawlog unix_listener postlogin { } } ssl_ca = </etc/pki/tls/certs/chain-1552.pem ssl_cert = </etc/pki/tls/certs/cert-1552.pem ssl_key = </etc/pki/tls/private/key-1552.pem ssl_protocols = !SSLv2 !SSLv3 syslog_facility = local1 ----------------------------------------------------------------------------- SERVER 2 ----------------------------------------------------------------------------- protocols = imap pop3 login_greeting = Hello World! mail_location = maildir:~/Maildir/ mail_gid = 5000 mail_uid = 5000 auth_mechanisms = plain login auth_username_format = %Lu auth_verbose = yes disable_plaintext_auth = no mail_plugins = quota notify replication protocol imap { imap_client_workarounds = "delay-newmail " mail_plugins = quota imap_quota notify replication } protocol pop3 { mail_max_userip_connections = 3 mail_plugins = quota notify replication pop3_client_workarounds = outlook-no-nuls oe-ns-eoh pop3_uidl_format = %08Xu%08Xv } protocol lda { auth_socket_path = /var/run/dovecot/auth-master info_log_path = log_path = mail_plugins = quota notify replication postmaster_address = sysadmin(a)example.com sendmail_path = /usr/lib/sendmail } userdb { args = /etc/dovecot/dovecot-usrdb-ldap.conf driver = ldap } passdb { args = /etc/dovecot/dovecot-passdb-ldap.conf driver = ldap } dsync_remote_cmd = ssh -l root vmail.example.com doveadm dsync-server -u%u replication_dsync_parameters = -d -N -l 30 -U plugin { mail_replica = remote:vmail@vmail.example.com } plugin { quota = maildir:User quota quota_rule = *:storage=5G quota_rule2 = Trash:storage=+3%% quota_warning = storage=75%% quota-warning 75 %u quota_warning2 = storage=90%% quota-warning 90 %u } service quota-warning { executable = script /opt/mail1.sh user = vmail unix_listener quota-warning { user = vmail } } service aggregator { fifo_listener replication-notify-fifo { user = vmail } unix_listener replication-notify { user = vmail } } service replicator { unix_listener replicator-doveadm { mode = 0600 } } service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0660 user = postfix } unix_listener auth-master { group = vmail mode = 0660 user = vmail } user = root } service imap-login { service_count = 1 vsz_limit = 64 M } service pop3-login { service_count = 1 vsz_limit = 64 M } service replicator { process_min_avail = 1 } ssl_ca = </etc/pki/tls/certs/chain-2228.pem ssl_cert = </etc/pki/tls/certs/cert-2228.pem ssl_key = </etc/pki/tls/private/key-2228.pem syslog_facility = local1 ssl_protocols = !SSLv2 !SSLv3 -----------------------------------------------------------------------------

1 1

Re: concerning dovecot settings for high volume server
by Rajesh M 17 Sep '15

17 Sep '15

thanks very much urban. this was very helpful. i have around 12500 users spread over 3 independent servers each having around 4000+ users i am using qmailtoaster, vpopmail, spamassassin and dovecot. in future i am planning to consolidate all using a HA cluster. if it is ok with you could you kindly share some information about your email server configuration. if you do not wish to put it on the list then you can directly email me. 1) is your email volume high ? 2) server hardware to support 28000 users 3) mailserver software - exim or postfix ??. 4) antispam software like spamassassin if any also if you have faced any email re-download issues with dovecot sometimes randomly incase of pop3 users storing emails on the server ? thanks rajesh ----- Original Message ----- From: Urban Loesch [mailto:bind@enas.net] To: dovecot(a)dovecot.org Sent: Sun, 13 Sep 2015 09:33:14 +0200 Subject: Re: concerning dovecot settings for high volume server Hi, I have running dovecot with about 28k users. Here comes my relevant config for pop3 and imap from "doveconf -n". No problems so far. -- snip -- default_client_limit = 2000 ... service imap-login { inet_listener imap { port = 143 } process_limit = 256 process_min_avail = 50 service_count = 1 } service imap { process_limit = 2048 process_min_avail = 50 service_count = 1 vsz_limit = 512 M } ... service pop3-login { inet_listener pop3 { port = 110 } process_limit = 256 process_min_avail = 25 service_count = 1 } service pop3 { process_limit = 256 process_min_avail = 25 service_count = 1 } ... protocol imap { imap_client_workarounds = tb-extra-mailbox-sep imap_id_log = * imap_logout_format = bytes=%i/%o session=<%{session}> mail_max_userip_connections = 40 mail_plugins = " quota mail_log notify zlib imap_quota imap_zlib" } ... protocol pop3 { mail_plugins = " quota mail_log notify zlib" pop3_logout_format = bytes_sent=%o top=%t/%p, retr=%r/%b, del=%d/%m, \ size=%s uidl_hash=%u session=<%{session}> } -- snip -- Regards Urban Am 12.09.2015 um 20:53 schrieb Rajesh M: > hi > > centos 6 64 bit > > hex core processor with hyperthreading ie display shows 12 cores > 16 gb ram > 600 gb 15000 rpm drive > > we are having around 4000 users on a server > > > i wish to allow 1500 pop3 and 1500 imap connections simultaneously. > > need help regarding the settings to handle the above > > imap-login, pop3-login > imap pop3 service settings > > i recently i got an error > imap-login: Error: read(imap) failed: Remote closed connection (process_limit reached?) > > > my current dovecot config file > > # 2.2.7: /etc/dovecot/dovecot.conf > # OS: Linux 2.6.32-431.23.3.el6.x86_64 x86_64 CentOS release 6.5 (Final) > auth_cache_negative_ttl = 0 > auth_cache_ttl = 0 > auth_mechanisms = plain login digest-md5 cram-md5 > default_login_user = vpopmail > disable_plaintext_auth = no > first_valid_gid = 89 > first_valid_uid = 89 > log_path = /var/log/dovecot.log > login_greeting = ready. > mail_max_userip_connections = 50 > mail_plugins = " quota" > managesieve_notify_capability = mailto > managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date ihave > namespace { > inbox = yes > location = > prefix = > separator = . > type = private > } > passdb { > args = cache_key=%u webmail=127.0.0.1 > driver = vpopmail > } > plugin { > quota = maildir:ignore=Trash > quota_rule = ?:storage=0 > } > protocols = imap pop3 > service imap-login { > client_limit = 256 > process_limit = 400 > process_min_avail = 4 > service_count = 0 > vsz_limit = 512 M > } > service pop3-login { > client_limit = 1000 > process_limit = 400 > process_min_avail = 12 > service_count = 0 > vsz_limit = 512 M > } > ssl_cert = </var/qmail/control/servercert.pem > ssl_dh_parameters_length = 2048 > ssl_key = </var/qmail/control/servercert.pem > userdb { > args = cache_key=%u quota_template=quota_rule=*:backend=%q > driver = vpopmail > } > protocol imap { > imap_client_workarounds = delay-newmail > mail_plugins = " quota imap_quota" > } > protocol pop3 { > pop3_client_workarounds = outlook-no-nuls oe-ns-eoh > pop3_fast_size_lookups = yes > pop3_lock_session = no > pop3_no_flag_updates = yes > } > > > thanks very much, > > rajesh >

3 2

restrict map-login by geoip?
by Terry Barnum 17 Sep '15

17 Sep '15

Is there a way to restrict my user logins from a set of IPs? For example, all my users are in the US so there shouldn't be any logins from other countries. Can I tell dovecot to restrict logins to a CIDR list of US IPs? Can someone point me to docs on how to set this up? I've searched but haven't found how to accomplish this. Thanks, -Terry Terry Barnum digital OutPost http://www.dop.com

4 5

New created users can not log in
by Ferdinand Gruber 17 Sep '15

17 Sep '15

Hi, I am using dovecot 2.2 for some time. All users on the system can log in using Horde Webmail. But now, after creating a new user on the server with <useradd -m username> this new user is not able to log in. Of course I have set a password for the new user. In the log file I can see: Sep 16 23:04:05 servername auth: gkr-pam: error looking up user information Sep 16 23:04:07 servername HORDE: [imp] [login] Authentication failed. [pid 1584 on line 730 of "/srv/www/htdocs/horde/imp/lib/Imap.php"] Sep 16 23:04:07 servername HORDE: [imp] FAILED LOGIN for calendar (93.82.157.132) to {imap://localhost/} [pid 1584 on line 157 of "/srv/www/htdocs/horde/imp/lib/Auth.php"] Sep 16 23:04:07 servername HORDE: [horde] FAILED LOGIN for calendar to horde (93.82.157.132) [pid 1584 on line 199 of "/srv/www/htdocs/horde/login.php"] Please give me a hint. -- Ferdinand

2 2