- dovecot - dovecot.org

[Dovecot] What are the options for HA and\or replication and\or storage?
by Eliezer Croitoru 05 Jun '14

05 Jun '14

I am considering couple options of converting a current service into a HA using multi servers or any other solutions. The point is that I am thinking about the options and which I am looking for. NFS can be a storage which has it's own pros and cons. There is the option of DRBD but as of now it's limited for two hosts. What options do exist out-there as a solution? The main issues are that the current service is based on Maildir and is on one server with resierfs. The service is composed of one host with 50k users couple disks in raid6. On the same machine we have postfix as mailer. I would like to hear about HA environment that I can use to replicate the boxes. My basic research leaded me to smtp on one host or more and using lmtp to send the messages to dovecot o another host which will have a replicated host and will be used with storage system based on ISCSI or NFS. Any other idea to enhance the current one or to replace it is more then just welcome. Thanks, Eliezer

3 2

[Dovecot] General questions about TCP replication with dsync
by Patrick De Zordo 05 Jun '14

05 Jun '14

Hi Guys, I would like to question why I see this errors in my logs. Let explain me! Dovecot version: 2.2.9 (on Ubuntu 14.04 LTS) Ive configured our dovecot servers (2 servers) to do the TCP replication with dsync. This is working flawless. 1. Question: In logs I can see this errors on every sync (on the slave server / server without changes which should be updated): ---8<----------------------------------------------------------------------- ---------------------------------------------------------------------------- ---- dsync-server(email(a)example.com): Error: net_connect_unix(/var/run/dovecot/replicator-doveadm) failed: Permission denied ---8<----------------------------------------------------------------------- ---------------------------------------------------------------------------- ---- Googling a bit gave me the information This should be normal..? Well ok, errors in logs are not nice to see, but can someone confirm this is really ok? Timo? 2. Question (much more important): We are using sieve scripts for our users, they are replicated to the replica-host but this errors appears in logs on every synchronized message: ---8<----------------------------------------------------------------------- ---------------------------------------------------------------------------- ---- dsync-server(email(a)example.com): Error: Failed to access mailbox dovecot/sieve: Internal error occurred. Refer to server log for more information. dsync-server(email(a)example.com): Error: stat(/var/vmail/example.com/email/.dovecot.sieve/tmp) failed: Not a directory ---8<----------------------------------------------------------------------- ---------------------------------------------------------------------------- ---- So whats going on there? This is strange and should not be, right? Any hints? Thank you very much! --------------------------------------------------------------------- Mit freundlichen Grüßen / Distinti saluti / Kind regards De Zordo Patrick patrick(a)spamreducer.eu

4 9

[Dovecot] Error with dsync in TCP replication
by Patrick De Zordo 05 Jun '14

05 Jun '14

Hey guys, again this question.. We are trying to get dsync replication over TCP working.. But we are having a bit of troubles.. Our configuration (just most important parts): ---8<--------------------------------------------------------------- # 2.2.13 (304d545927d2): /etc/dovecot/dovecot.conf # OS: Linux 3.13.0-24-generic x86_64 Ubuntu 14.04 LTS ext4 doveadm_password = secret first_valid_uid = 150 last_valid_uid = 150 lda_mailbox_autocreate = yes lda_mailbox_autosubscribe = yes mail_gid = mail mail_location = maildir:/var/vmail/%d/%n mail_plugins = " quota listescape zlib notify replication" mail_uid = vmail managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date ihave duplicate namespace inbox { inbox = yes location = mailbox Archiv { auto = subscribe special_use = \Archive } mailbox Archive { auto = no special_use = \Archive } mailbox Drafts { auto = no special_use = \Drafts } mailbox Entwürfe { auto = no special_use = \Drafts } mailbox Junk { auto = subscribe special_use = \Junk } mailbox Sent { auto = subscribe special_use = \Sent } mailbox "Sent Messages" { auto = no special_use = \Sent } mailbox Trash { auto = no special_use = \Trash } prefix = separator = / } plugin { mail_replica = tcp:mx2.example.com:999 quota = dict:user::proxy::quota quota_rule = *:storage=10MB quota_rule2 = Trash:storage=+10%% quota_warning = storage=95%% quota-warning 95 %u quota_warning2 = storage=80%% quota-warning 80 %u sieve = ~/.dovecot.sieve sieve_dir = ~/sieve zlib_save = bz2 zlib_save_level = 9 } protocols = " imap sieve pop3" replication_max_conns = 1 service aggregator { fifo_listener replication-notify-fifo { mode = 0666 } unix_listener replication-notify { mode = 0666 } } service doveadm { inet_listener { port = 999 } } service replicator { unix_listener replicator-doveadm { mode = 0600 } } protocol lda { mail_plugins = " quota listescape zlib notify replication quota sieve listescape zlib" } protocol imap { mail_plugins = " quota listescape zlib notify replication imap_quota listescape zlib" } protocol sieve { managesieve_max_line_length = 65536 } ---8<--------------------------------------------------------------- The problem: After a user adds a sieve script with his mail application (in this case Thunderbird with plugin): 1. the script is saved in /var/vmail/%d/%n/sieve/script_name == OK 2. this file (/var/vmail/%d/%n/sieve/script_name) is then symlinked to /var/vmail/%d/%n/.dovecot.sieve == OK Now the problem kicks in: 1. On the secondary server (mail_replica server) the script is created + the same symlink == OK 2. In logs (on secondary) there is shown this error every time a sync is done: ---8<--------------------------------------------------------------- dsync-server( <mailto:user@example.com> user(a)example.com) Error: Failed to access mailbox dovecot/sieve: Internal error occurred. Refer to server log for more information. dsync-server( <mailto:user@example.com> user(a)example.com) Error: stat(/var/vmail/example.com/user/.dovecot.sieve/tmp) failed: Not a directory ---8<--------------------------------------------------------------- Issuing doveadm replicator status '*' on first server gives back: username priority fast sync full sync failed user(a)example.com none 00:03:36 23:11:51 y Sync from master->secondary is interrupted but sync from secondary->master is working.. Thanks for any hint! --------------------------------------------------------------------- Mit freundlichen Grüßen / Distinti saluti / Kind regards De Zordo Patrick patrick(a)spamreducer.eu

1 0

[Dovecot] IMAP copy fails because the mailbox size of user1 is exceeding the quota limit of user2??
by Katja Wegner 05 Jun '14

05 Jun '14

Hi all, I do have a mailbox-quota problem in dovecot 2.0.19 that is beond my understanding. Could someone pls. give me a hint. - user1 max. mailbox quota is set to 1GB, the current mailbox size of user1 is 15MB - user2 max. mailbox quota is set to 10MB, the current mailbox size of user1 is 10kB - user1 shares the folder 'shared_folder' to user2 with all rights (read, write ...) - user2 has subscribed to 'shared_folder' the problem: - user2 tries to move a mail (20kB) to the shared folder via telnet: ". copy 1:1 shared/user1/shared_folder" - it fails with: "NO [OVERQUOTA] Quota exceeded (mailbox for user is full)" - copying the same mail to a local folder of user2 works without problems. - After I raised the max. mailbox quota of user2 from 10MB to 16MB it was possible to move the mail to the 'shared_folder' of user1. It looks like the copy operation fails because the mailbox size of user1 is exceeding the quota limit of user2! Is this possible? Is this a bug? Do I have a configuration problem? dovecot -n # 2.0.19: /etc/dovecot/dovecot.conf # OS: Linux 3.5.0-51-generic x86_64 Ubuntu 12.04.4 LTS ext4 auth_debug = yes auth_debug_passwords = yes auth_mechanisms = plain login auth_verbose = yes dict { sqldomainquota = mysql:/etc/dovecot/dovecot-sql-domain.conf sqluserquota = mysql:/etc/dovecot/dovecot-dict-sql-user.conf } first_valid_uid = 150 last_valid_uid = 150 mail_debug = yes mail_gid = mail mail_location = maildir:/var/vmail/%d/%n mail_plugins = " quota quota acl" mail_uid = vmail managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacati on subaddress comparator-i;ascii-numeric relational regex imap4flags copy includ e variables body enotify environment mailbox date ihave namespace { inbox = yes location = prefix = separator = / type = private } namespace { list = children location = maildir:/var/vmail/mydomain.de/%%n:CONTROL=/var/vmail/mydomain.de/%n/ shared/%%n:INDEX=/var/vmail/mydomain.de/%n/shared/%%n prefix = shared/%%n/ separator = / subscriptions = yes type = shared } passdb { args = /etc/dovecot/dovecot-sql.conf.ext driver = sql } passdb { args = /etc/dovecot/dovecot-sql.conf.ext driver = sql } plugin { acl = vfile acl_shared_dict = file:/var/lib/dovecot/shared-mailboxes.db quota = dict:User quota::proxy::sqluserquota quota_rule2 = shared:ignore sieve = ~/_dovecot_sieve sieve_dir = ~/sieve } postmaster_address = kontakt(a)mydomain.de protocols = imap pop3 sieve service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0660 user = postfix } unix_listener /var/spool/postfix/private/dovecot-auth { group = postfix mode = 0660 user = postfix } unix_listener auth-userdb { group = mail mode = 0600 user = vmail } } service dict { unix_listener dict { mode = 0600 user = vmail } } ssl_cert = </etc/ssl/certs/dovecot.pem ssl_cipher_list = ALL:!LOW:!SSLv2:ALL:!aNULL:!ADH:!eNULL:!EXP:RC4+RSA:+HIGH:+MED IUM ssl_key = </etc/ssl/private/dovecot.pem userdb { args = /etc/dovecot/dovecot-sql.conf.ext driver = sql } userdb { args = /etc/dovecot/dovecot-sql.conf.ext driver = sql } protocol imap { imap_client_workarounds = delay-newmail mail_max_userip_connections = 10 mail_plugins = " quota imap_quota imap_quota acl imap_acl" } protocol pop3 { mail_max_userip_connections = 10 pop3_client_workarounds = outlook-no-nuls oe-ns-eoh } protocol lda { deliver_log_format = msgid=%m: %$ mail_plugins = acl postmaster_address = postmaster quota_full_tempfail = yes rejection_reason = Your message to <%t> was automatically rejected:%n%r }

2 3

[Dovecot] attachment sis + EMLINK (too many links) = segfault bug (2.2.12)
by Pavel Stano 05 Jun '14

05 Jun '14

Hi, we use attachment dedup with lots of emails (still migrating to it from maildir). We use netapp storage with wafl filesystem over nfs. Problem is that netapp has hard limit of 100k hardlinks to one file. And we encountered it. Problem is that dovecot start do segfault (lmtp,dsync,pop3 etc) when it happend when tried to deliver new emails with that attachment. Here is strace of dsync: 6740 link("/nfsmnt/mailatch1/f9/10/hashes/f9108ddaa156ac15738e41ed3bedec1eda50175d", "/nfsmnt/mailatch1/f9/10/f9108ddaa156ac15738e41ed3bedec1eda50175d-7bb7a20ddb598853541a000028db4a9f") = -1 EMLINK (Too many links) 6740 --- SIGSEGV (Segmentation fault) @ 0 (0) --- ls -lh: -rw------- 100000 vmail vmail 4.7K Apr 28 16:54 /nfsmnt/mailatch1/f9/10/hashes/f9108ddaa156ac15738e41ed3bedec1eda50175d We were using mail_attachment_min_size=4kb, we solve it by increasing it to 8kb. It would be nice to somehow fix this problem. Like not crash when EMLINK happend and maybe do not deduplicate attachments but deliver email without dedup. Or create second file in hashes/ and start hardlinking it instead of original. AFAIK ext4 has also hard-link limit 64k (http://en.wikipedia.org/wiki/Hard_link#Limitations_of_hard_links) So this can happen to anyone with lots of emails. Thanks -- [ Ohodnotte kvalitu mailu: http://nicereply.com/websupport/Stano/ ] Pavel Stano | Troubleshooter http://WebSupport.sk *** BERTE A VYCHUTNAVAJTE ***

1 1

[Dovecot] Plugin mail-filter tangles
by Stanislas SABATIER 05 Jun '14

05 Jun '14

System installed : Dovecot 2.2.12 as IMAP server and Postfix as MTA. Dovecot and Postfix connected via LMTP + Dovecot mail plugin 'mail-filter' to encrypt/decrypt emails on the fly with public/private users' RSA keys. Case study : You have 3 (virtuals) users belonging to 3 different domains, all managed by your Dovecot server. One of these users is connected to Dovecot with MUA Thunderbird, and he's writing an email to someone outside of yours domains, but he puts the two others users' email addresses in CC : mail from user1(a)domain1.dovecot --> to: someone@outside, CC: user2(a)domain2.dovecot, user3(a)domaine3.dovecot What happens (as far as I can understand) : The email is submitted to Postfix : one copy is delivered outside, the other is passed to Dovecot via LMTP for user2 & user3 @dovecot Dovecot is handling the final delivery, through mail-filter plugin as follow : 1. both users contexts are created from user_db queries 2. mail-filter plugin is init for user2 3. /mail_user_created/ for user2 4. mai-filter plugin arguments are parsed for user2 5. â¦/mail_allocated/ then /mail_save_begin/ for user2 (at this stage, the email is encrypted with users2 params) 6. Dovecot tells to LMTP that mail for user2 is delivered 7. then, â we are still in user2 context â, an other /mail_allocated/ is run, followed by a /istream_opened/ 8. mail user context is swithed to user3 --> /mail_user_created/ --> plugin's args parsed --> â¦ /mail_allocated/ 9. andâ¦ Dovecot tells to LMTP that mail for user3 is delivered So, it appears that Dovecot is re-using user2's email to pass it to user3 by opening an istream in user2's context. In my configuration, Dovecot can't do that because it has not the user2's private rsa key to reopen the email it has just encrypted, so it passes the email to user3 with user2 encryption params. Final result : user3 is receiving the email encrypted with user2's rsa key ! Problem : how to force Dovecot to deinit then reinit mail-filter plugin for each user to be sure that each email is encrypted with the right key before it is saved to users' mailboxes ? Thank you in advance for your help. Stan.

5 16

[Dovecot] SQL passdb, LDAP userdb
by Kristof Bajnok 05 Jun '14

05 Jun '14

Hi, in my current setup, LDAP authentication + userdb works fine. I'd like to integrate Dovecot with Shibboleth. I have a custom module at the IdP (*) that inserts short-time tokens to an SQL table at user authentication, and I want Dovecot to use the token table for passdb but keep LDAP for storing the userdb (uid, quota, etc) I thought it was simple as omitting the sql user_query, but I got: Warning: mysql: Query failed, retrying: Table 'webmail.users' doesn't exist Error: sql(user@domain,ipaddr): User query failed: Table 'webmail.users' doesn't exist (using built-in default user_query: SELECT home, uid, gid FROM users WHERE username = '%n' AND domain = '%d') Do you have any hints how to do this? Thanks, Kristof (*): in SAML there is an Identity Provider that does user authentication, which is separated from the services

2 2

[Dovecot] [dovecot]Quota per user from openldap
by Selcuk Yazar 05 Jun '14

05 Jun '14

Hi, in dovecot documentation i try to implement quota per users. i added dovecot-ldap.conf file user_attrs = homeDirectory=home, uidNumber=uid, gidNumber=gid, mailbox=mail, quota=quota_rule=*:bytes=%$ and i see in logs quota(quota_rule=*:bytes=%$)=*:bytes=241800 Debug: Added userdb setting: plugin/quota_rule=*:bytes=241800 but still mail is delivering , i'not sure other settings about 20-imap.conf and 20-pop3.conf from documentation. what is the correct steps for this? thanks in advance -- Selçuk YAZAR

3 2

Re: [Dovecot] R: Info about sharing mail folder
by Steffen Kaiser 05 Jun '14

05 Jun '14

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On Tue, 3 Jun 2014, Gianluca Calloni wrote: > In folder /var/vmail/example.com/user_a i've a dovecot-acl file with " > user=test(a)example.com lrwstipekxa " > > IN mysql table user_shares i set: > > +---------------------+------------------+-------+ > | from_user | to_user | dummy | > +---------------------+------------------+-------+ > | user_a(a)example.com | test(a)example.com | 1 | > +---------------------+------------------+-------+ > > and the doveadm acl command: > > doveadm acl get -u user_a(a)example.com INBOX > ID > Global Rights > user=test(a)example.com > admin create delete expunge insert lookup post read write write-deleted > write-seen You have shared user_a's INBOX to test(a)example.com > doveadm acl get -u user_a(a)example.com INBOX.FOLDER_A > ID > Global Rights > user=test(a)example.com > admin create delete expunge insert lookup post read write write-deleted > write-seen > > doveadm acl get -u user_a(a)example.com INBOX.FOLDER_B > ID > Global Rights > user=test(a)example.com > admin create delete expunge insert lookup post read write write-deleted > write-seen > > doveadm acl get -u user_a(a)example.com INBOX.FOLDER_C > ID > Global Rights > user=test(a)example.com > admin create delete expunge insert lookup post read write write-deleted > write-seen > > Of course, user test(a)example.com can see all subfolder. Reading your post.. > I can set an dovecot-acl file in each subfolder to set the permission? Yes, remove all dovecot-acl files and add it into those folders you want to share. Or remove all dovecot-acl files and: doveadm acl add -u user_a(a)example.com INBOX.FOLDER_B \ user=test(a)example.com create read ... > > -----Messaggio originale----- > Da: dovecot [mailto:dovecot-bounces@dovecot.org] Per conto di Steffen Kaiser > Inviato: martedì 3 giugno 2014 15:45 > A: Dovecot Mailing List > Oggetto: Re: [Dovecot] Info about sharing mail folder > > -----BEGIN PGP SIGNED MESSAGE----- > Hash: SHA1 > > On Tue, 3 Jun 2014, Gianluca Calloni wrote: > >> But i need to know if is possible for user_a(a)mydomain.com to share >> only 1 or >> 2 subfolder (E.g. .INBOX.FOLDER_A and .INBOX.FOLDER_B shared, >> .INBOX_FOLDER_C not shared) > > What's the dovecot-acl in .INBOX and the three directories mentioned above? > > Or: > > doveadm acl get -u user_a(a)mydomain.com INBOX > doveadm acl get -u user_a(a)mydomain.com INBOX.FOLDER_A > doveadm acl get -u user_a(a)mydomain.com INBOX.FOLDER_B > doveadm acl get -u user_a(a)mydomain.com INBOX.FOLDER_C > > Did you've share "INBOX" instead of the the subfolders A and B? > - -- Steffen Kaiser -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.11 (GNU/Linux) iQEVAwUBU477Wnz1H7kL/d9rAQJQTgf+MF+++/j56SbuXae8wZismkJhL5Z1NNHF bd8i5JqMhpSzh4dPb7IhdzJySZ7T5zJgDviCvnscldLrlb9+wAQwx6aB+iw929R4 wdtgjEE0hAnZuMpyTPvCL8gwmL4B/kpbvXZIGJbmIVgkh6iBGorHRKbSxFjlUKQW 9ZuiUsAmX4UJslJDisScJuPT6uB93K/cdOoMCa5D8a9IacDYoP3nrhH1kn3K7IXo xCNId2YoeDqA3OWzp+NM8ahS6MYqIN432oYP1eViAmY0pTHdoWKMBmTeskGY2ajz FG7CSv1x6WeEyyzdE7dSth+j4nqQIh0hkIS6vQYMuMTLuwq/rJW4dA== =8fCy -----END PGP SIGNATURE-----

2 1

Re: [Dovecot] Odd ownership of the dovecot-uidlist file
by Bruce 05 Jun '14

05 Jun '14

Hi, Please see my responses below, On 04/06/14 01:35, dovecot-request(a)dovecot.org wrote: > Message: 4 > Date: Tue, 3 Jun 2014 09:33:48 +0200 (CEST) > From: Steffen Kaiser >> >Jun 3 11:38:51 brio dovecot: Dovecot postlogin.sh running as hamish@XXXXX >> >(/mnt/spool/keepers/h/XXXXX/hamish) userid = 7053 (7053) - uidlist = 26624 >> >Jun 3 11:38:51 brio dovecot: Dovecot for hamish@XXXXX finished, uidlist now = >> >26624 > who is user 26624? Is the uid valid at all? If it is invalid, are there > other files owned by this uid? Maybe only one of your NFS server has this > uid in its /etc/passwd? Is user "hamish" shared to another user somehow, > either via symlinks, ACLs, ...? UID 26624 is a valid user ('info' of domain14552) but under a compleltly different domain name (hamish is under domain25367). However that user has also not logged in around the time the ownership was changed. There is no relevance to the two users, except that they exist on the system and for some reason this issue happened to the hamish user. The NFS server does not know about the UIDs, it just provides the numeric IDs which is translated on the dovecot/exim servers by NSS and Dovecotr using the replicated MySQL database. Additionally both users have existed for some time and the databases are in sync. Customers also do not have any access to the file system so there will be no symlinks in place. Its also not a single server that we are seeing the issue on, it maybe one Dovecot server accessing one NFS server. Then the next time its a different Dovecot server accessing a different NFS server. >> >the logs for that time which is abnormal (a whole bunch of other logins from >> >other customers but nothing from those two users and no errors) > What about cron jobs, message delivery, backups, ... anything that > possibly can alter that file. I don't think, it's a Dovecot issue, unless > the uid 26624 is valid and hamish is shared with that user. Nothing besides Courier being replaced by Dovecot has changed in the server setup (although I could be wrong there, but we are going through one component at a time and until this issue is resolved we are not moving onto the next), and the only file which is being modified is a file which only Dovecot maintains. There are hourly backups which do an rsync to another server in case of hardware failure, there are scripts which move mailboxes between NFS servers but they show up in logs. Exim has no need to touch a dovecot controlled file, and when it writes mail into the maildir its writing as the correct user. It also seem odd that one login is fine then randomly the next login the file ownership has changed, nothing happens in between the two logins which are in some cases only 5 to 10 minutes apart. All I am really looking for is ideas on where to look, as it seems odd that nobody else is reporting this, and since its a reasonably new setup its possibly something we have done in the config (which I posted in my first email). Is there a reliable way to run a script directly when a dovecot session starts and finishes so we could output the ownership before and after which may also help eliminate the session itself. Cheers, Bruce

3 3