- dovecot - dovecot.org

SSL issues when proxying
by Ralf Hildebrandt 25 Sep '14

25 Sep '14

I'm getting this in the log when proxying IMAP (three "valid certificate" messages, two "Invalid certificate" messages) Why is dovecot (acting as a proxy to another dovecot instance here) not recognizing the StartCom Extended Validation Server CA? . LOGIN ralf.hildebrandt(a)charite.de mypassword Sep 25 14:13:04 auth-worker(30859): Info: mysql(sql.charite.de): Connected to database mailservice Sep 25 14:13:04 imap-login: Debug: SSL: where=0x10, ret=1: before/connect initialization [127.0.0.1] Sep 25 14:13:04 imap-login: Debug: SSL: where=0x1001, ret=1: before/connect initialization [127.0.0.1] Sep 25 14:13:04 imap-login: Debug: SSL: where=0x1001, ret=1: unknown state [127.0.0.1] Sep 25 14:13:04 imap-login: Debug: SSL: where=0x1002, ret=-1: unknown state [127.0.0.1] Sep 25 14:13:04 imap-login: Debug: SSL: where=0x1001, ret=1: SSLv3 read server hello A [127.0.0.1] Sep 25 14:13:04 imap-login: Info: Invalid certificate: unable to get local issuer certificate: /C=IL/O=StartCom Ltd./OU=StartCom Certification Authority/CN=StartCom Extended Validation Server CA Sep 25 14:13:04 imap-login: Info: Invalid certificate: certificate not trusted: /C=IL/O=StartCom Ltd./OU=StartCom Certification Authority/CN=StartCom Extended Validation Server CA Sep 25 14:13:04 imap-login: Info: Valid certificate: /C=DE/ST=Berlin/L=Berlin/postalCode=12205/street=Charitestrasse 1/O=Charite Universitaetsmedizin/CN=imap.charite.de/emailAddress=postmaster(a)charite.de/serialNumber=HRAxxxx/businessCategory=Private Organization/1.3.6.1.4.1.311.60.2.1.1=Mitte/1.3.6.1.4.1.311.60.2.1.2=Berlin/1.3.6.1.4.1.311.60.2.1.3=DE Sep 25 14:13:04 imap-login: Info: Valid certificate: /C=IL/O=StartCom Ltd./OU=StartCom Certification Authority/CN=StartCom Extended Validation Server CA Sep 25 14:13:04 imap-login: Info: Valid certificate: /C=DE/ST=Berlin/L=Berlin/postalCode=12205/street=Charitestrasse 1/O=Charite Universitaetsmedizin/CN=imap.charite.de/emailAddress=postmaster(a)charite.de/serialNumber=HRAxxxx/businessCategory=Private Organization/1.3.6.1.4.1.311.60.2.1.1=Mitte/1.3.6.1.4.1.311.60.2.1.2=Berlin/1.3.6.1.4.1.311.60.2.1.3=DE Sep 25 14:13:04 imap-login: Debug: SSL: where=0x1001, ret=1: SSLv3 read server certificate A [127.0.0.1] Sep 25 14:13:04 imap-login: Debug: SSL: where=0x1001, ret=1: SSLv3 read server key exchange A [127.0.0.1] Sep 25 14:13:04 imap-login: Debug: SSL: where=0x1001, ret=1: SSLv3 read server done A [127.0.0.1] Sep 25 14:13:04 imap-login: Debug: SSL: where=0x1001, ret=1: SSLv3 write client key exchange A [127.0.0.1] Sep 25 14:13:04 imap-login: Debug: SSL: where=0x1001, ret=1: SSLv3 write change cipher spec A [127.0.0.1] Sep 25 14:13:04 imap-login: Debug: SSL: where=0x1001, ret=1: SSLv3 write finished A [127.0.0.1] Sep 25 14:13:04 imap-login: Debug: SSL: where=0x1001, ret=1: SSLv3 flush data [127.0.0.1] Sep 25 14:13:04 imap-login: Debug: SSL: where=0x1002, ret=-1: SSLv3 read server session ticket A [127.0.0.1] Sep 25 14:13:04 imap-login: Debug: SSL: where=0x1002, ret=-1: SSLv3 read server session ticket A [127.0.0.1] Sep 25 14:13:04 imap-login: Debug: SSL: where=0x1001, ret=1: SSLv3 read server session ticket A [127.0.0.1] Sep 25 14:13:04 imap-login: Debug: SSL: where=0x1001, ret=1: SSLv3 read finished A [127.0.0.1] Sep 25 14:13:04 imap-login: Debug: SSL: where=0x20, ret=1: SSL negotiation finished successfully [127.0.0.1] Sep 25 14:13:04 imap-login: Debug: SSL: where=0x1002, ret=1: SSL negotiation finished successfully [127.0.0.1] . OK [CAPABILITY ... -- [*] sys4 AG http://sys4.de, +49 (89) 30 90 46 64 Franziskanerstraße 15, 81669 München Sitz der Gesellschaft: München, Amtsgericht München: HRB 199263 Vorstand: Patrick Ben Koetter, Marc Schiffbauer Aufsichtsratsvorsitzender: Florian Kirstein

3 3

vsz_limit is 18,447 PB
by Dan Langille 25 Sep '14

25 Sep '14

I encountered this error on FreeBSD 9.3 with dovecot2-2.2.13_3 Short version; vsz_limit is 18,447 PB and it ran out of RAM. Suggestions for change? Sep 6 03:39:32 mailjail dovecot: imap(dan): Panic: file imap-fetch.c: line 556 (imap_fetch_more): assertion failed: (ctx->client->output_cmd_lock == NULL || ctx->client->output_cmd_lock == cmd) Sep 6 03:39:32 mailjail dovecot: imap(dan): Fatal: master: service(imap): child 71153 killed with signal 6 (core not dumped - set service imap { drop_priv_before_exec=yes }) Sep 6 03:59:41 mailjail dovecot: imap(dan): Fatal: pool_system_realloc(2097152): Out of memory Sep 6 03:59:41 mailjail dovecot: imap(dan): Fatal: master: service(imap): child 67732 returned error 83 (Out of memory (service imap { vsz_limit=256 MB }, you may need to increase it) - set CORE_OUTOFMEM=1 environment to get core dump) Background: I’m in the only user on this system, but this server is accessed by my phone, my laptop, my tablet, and perhaps a web interface. Here are the non-default values: $ doveconf -n # 2.2.13: /usr/local/etc/dovecot/dovecot.conf # OS: FreeBSD 9.3-RELEASE amd64 auth_mechanisms = plain login first_valid_gid = 1001 first_valid_uid = 1001 mail_location = maildir:~/Maildir mail_max_userip_connections = 80 mail_privileged_group = mail passdb { args = scheme=SHA512-CRYPT /var/db/dovecot.users driver = passwd-file } protocols = imap service imap-login { inet_listener imap { address = 10.0.0.1 } inet_listener imaps { port = 0 } } ssl = required ssl_ca = </usr/local/etc/ssl/ca.pem ssl_cert = </usr/local/etc/ssl/server.pem ssl_key = </usr/local/etc/ssl/mailjail.example.org.nopassword.key userdb { args = /var/db/dovecot.users driver = passwd-file } verbose_proctitle = yes verbose_ssl = yes But there are some interesting values when I look at the output of doveconf. Specifically, vsz_limit is 18,447 PB… yeah, that’s pretty big. service imap-login { chroot = login client_limit = 0 drop_priv_before_exec = no executable = imap-login extra_groups = group = idle_kill = 0 inet_listener imap { address = 10.0.0.1 port = 143 reuse_port = no ssl = no } inet_listener imaps { address = port = 0 reuse_port = no ssl = yes } privileged_group = process_limit = 0 process_min_avail = 0 protocol = imap service_count = 1 type = login user = $default_login_user vsz_limit = 18446744073709551615 B }

4 7

Confusing wording on the wiki
by Alan McGinlay 24 Sep '14

24 Sep '14

Hi, I am confused by the wording of this Wiki entry: sieve = ~/.dovecot.sieve The path to the user's main active Sieve script. When ManageSieve is used, this is a symbolic link pointing to the active script in the sieve_dir directory. Avoid placing the active Sieve script inside the sieve_dir directory. So this should be a link *to* the active script in the sieve_dir directory however the active script shouldn't actually be in that directory???? http://wiki2.dovecot.org/Pigeonhole/Sieve/Configuration Confused :S /A

2 1

LMTP proxying
by Ralf Hildebrandt 24 Sep '14

24 Sep '14

How exactly is LMTP proxying supposed to work? According to the example on http://wiki2.dovecot.org/PasswordDatabase/ExtraFields/Proxy I'm only seeing "proxy" in the password_query statements. But LMTP never sends a password. IMAP Proxying is working OK: Sep 24 12:51:09 imap-login: Info: proxy(ralf.hildebrandt(a)charite.de): started proxying to dovecot.charite.de:993: user=<ralf.hildebrandt(a)charite.de>, method=PLAIN, rip=127.0.0.1, lip=127.0.0.1, secured Sep 24 12:51:13 imap-login: Info: proxy(ralf.hildebrandt(a)charite.de): disconnecting 127.0.0.1 (Disconnected by server): user=<ralf.hildebrandt(a)charite.de>, method=PLAIN, rip=127.0.0.1, lip=127.0.0.1, secured But LMTP is logging this: Sep 24 13:13:25 lmtp(17727): Info: Connect from 127.0.0.1 Sep 24 13:13:51 auth-worker(19603): Info: mysql(sql.posteo.local): Connected to database mailservice Sep 24 13:14:11 lmtp(17727, ralf.hildebrandt(a)charite.de) Info: save: box=INBOX, uid=1, msgid=, size=304 Sep 24 13:14:11 lmtp(17727, ralf.hildebrandt(a)charite.de) Info: pH2yN1WnIlQ/RQAAoQzodQ: msgid=unspecified: saved mail to INBOX Sep 24 13:14:11 dict: Info: mysql(sql.charite.de): Connected to database mailservice Sep 24 13:14:13 lmtp(17727): Info: Disconnect from 127.0.0.1: Client quit (in reset) Sep 24 13:15:29 master: Warning: Killed with signal 15 (by pid=25892 uid=0 code=kill) I read that there's no "default port for LMTP", but how can I adapt the query in such a way that the default port 24 is being used ONLY FOR LMTP? I'm using (snippet): ... NULL AS password, \ 'Y' AS nopassword, \ 'Y' AS proxy, 'dovecot.charite.de' AS host, 'any-cert' AS 'ssl', \ ... -- [*] sys4 AG http://sys4.de, +49 (89) 30 90 46 64 Franziskanerstraße 15, 81669 München Sitz der Gesellschaft: München, Amtsgericht München: HRB 199263 Vorstand: Patrick Ben Koetter, Marc Schiffbauer Aufsichtsratsvorsitzender: Florian Kirstein

3 3

Empty mailboxes
by Daniel Miller 24 Sep '14

24 Sep '14

This is driving me nuts. I need to rebuild a server - got a notification the main drive is failing, and it's been a year or two, so it's time. Got a new drive, fresh install of Ubuntu Tantric, started installing everything needed. Data stored on a RAID array - nicely available separate from the boot/operation drive. Did a fresh compile of Dovecot, copied over the configs from the old drive, mounted the RAID...and... Dovecot starts, authenticates users - and shows empty mailboxes. Nothing shown. Full panic - reboot on old drive. All mails present. Change back - no mail. Executing "doveadm user -u username" seems to give valid results. Mailbox location appears correct (using mdbox). I setup uid/gid the same - I thought it was a rights issue but everything looks correct. What can I do to try to find the stupid mistake I'm making? -- Daniel

3 4

quota recalc problem for big maildirs
by Dawid Stawiarski - nazwa.pl 24 Sep '14

24 Sep '14

hi, we use dovecot 2.2.13, and we've lately started using maildir quota (previously fs quota was used, right now it's "quota = maildir:User quota" changed from "quota = fs:User quota:user:inode_per_mail"). When the change was applied we didn't manually forced generating maildirsize files. So, when the first deliver happens (or the file grows larger then 5KB) it starts quota recalc. However for users with big maildirs, receiving email every couple of seconds, there are tens of delivery processes each doing its own recalc (as they open file for APPEND and there's no locking). What's even worse, after all the stats and getdents (it takes a lot of IO for 60GB account with 2M emails), deliver makes stat on 'new' dir and detects changes after which it unlinks freshly created maildirsize. So possibly this will never be finished as every process drops its own work. The same thing happened when we checked the native dovecot LMTP server (every connection has its own forked process - each running independently of the others). Is it a known unwanted "feature" of maildir quota (and we should use dict quota instead) or a bug that will be fixed? cheers, Dawid Stawiarski

2 2

Re: director
by Eduardo Ramos 23 Sep '14

23 Sep '14

The configuration use to be in /etc/dovecot, and the working dir is /var/run/dovecot. You should store your configuration file in the /etc/dovecot. The dovecot.conf file can be copied to dovecot-backend.conf and dovecot-director, for example, and you will use '-c' argument of dovecot binary to load on or another. If you do this, you will need create two separated working dir, that will be defined in base_dir on each configuration file. On 09/23/2014 05:39 PM, jjhoffart wrote: > Thanks for the replies, > I am still fairly new to dovecot and still learning. This is a quick run down of my setup: 3 servers running iRedMail (this is a package that installs dovecot 2.1.7, postfix, and LDAP). All three servers share an NFS backend. The same 3 servers are also sitting behind a load balancer. What I want to do is use these three servers as directors and mail servers. So from the replies I have gotten I understand that I need to create 2 config files 1 for director and 1 for dovecot. Now my next question is do these config files need to be stored in /etc/dovecot or /var/run/dovecot? Also is creating the second config file as simple as copying and renaming the dovecot.conf file? > > On Sep 23, 2014, at 2:26 PM, Eduardo Ramos <eduardo(a)freedominterface.org> wrote: > >> Hi, >> >> In fact you don't NEED a director. You can use two dovecot servers sharing a NFS storage with a normal (backend) implementation. It's good to see that page: http://wiki2.dovecot.org/NFS for some good recomendations. >> >> You must have a base_dir for each instance of dovecot you want to run, and a dovecot.conf as well. One could be director and other backend. I suggest you have two separated configuration directories, /etc/dovecot-director and /etc/dovecot-backend. Each with the respective configuration. Start dovecot with "dovecot -c /etc/dovecot-director/dovecot.conf". Backend is the same. >> >> In order to help more, provide us more details about your environment and doulbts. >> >> On 09/23/2014 03:57 PM, jjhoffart wrote: >>> Hello, >>> I am currently trying to setup a cluster of mail servers. I currently have two servers I am trying to cluster together. These servers will also have a shared NFS backend. I have read on the site that I will need to configure director since I am using NFS. I have read through all of the documentation on director but still need a little guidance to get things up and running. One of the questions I have is about the base_dir on the Multiple Invocations section of the wiki. It states that I will need to change the bas_dir to the new run directory, not sure what needs to happen here, can anyone help me out?

1 0

director
by jjhoffart 23 Sep '14

23 Sep '14

Hello, I am currently trying to setup a cluster of mail servers. I currently have two servers I am trying to cluster together. These servers will also have a shared NFS backend. I have read on the site that I will need to configure director since I am using NFS. I have read through all of the documentation on director but still need a little guidance to get things up and running. One of the questions I have is about the base_dir on the Multiple Invocations section of the wiki. It states that I will need to change the bas_dir to the new run directory, not sure what needs to happen here, can anyone help me out?

3 2

dsync error: Error: Can't delete mailbox INBOX: INBOX can't be deleted.
by Helge Kraak 23 Sep '14

23 Sep '14

Hello, I'm aware of these two threads http://www.dovecot.org/pipermail/dovecot/2012-March/thread.html#134311 http://dovecot.org/pipermail/dovecot/2012-June/thread.html#136488 but unfortunately I wasn't successful with my dsync mailbox migration attempt despite the information I could find there. I'm using iRedMail setup for the dovecot server. I made sure that the dovecot mailbox for the mail import had been freshly created and untouched before I tried to run the following command. Running this command: sudo doveadm -vvv -o imapc_host=s04.srv-net.de -o imapc_user=username -o imapc_password=password -o mail_fsync=never -o mail_prefetch_count=20 -o imapc_features=rfc822.size -o imapc_features=fetch-headers -o imapc_port=993 -o imapc_ssl=imaps -o imapc_ssl_ca_dir=/etc/ssl -o imapc_ssl_verify=no -o imapc_features=rfc822.size -o mailbox_list_index=no -D backup -R -u michael(a)domain.com imapc: I get the following output (I took out some lines obviously not relevant): doveadm(root): Debug: Loading modules from directory: /usr/lib/dovecot/modules doveadm(root): Debug: Module loaded: /usr/lib/dovecot/modules/lib10_quota_plugin.so doveadm(root): Debug: Loading modules from directory: /usr/lib/dovecot/modules/doveadm doveadm(root): Debug: Skipping module doveadm_acl_plugin, because dlopen() failed: /usr/lib/dovecot/modules/doveadm/lib10_doveadm_acl_plugin.so: undefined symbol: acl_user_module (this is usually intentional, so just ignore this message) doveadm(root): Debug: Skipping module doveadm_expire_plugin, because dlopen() failed: /usr/lib/dovecot/modules/doveadm/lib10_doveadm_expire_plugin.so: undefined symbol: expire_set_deinit (this is usually intentional, so just ignore this message) doveadm(root): Debug: Module loaded: /usr/lib/dovecot/modules/doveadm/lib10_doveadm_quota_plugin.so doveadm(root): Debug: Skipping module doveadm_zlib_plugin, because dlopen() failed: /usr/lib/dovecot/modules/doveadm/lib10_doveadm_zlib_plugin.so: undefined symbol: i_stream_create_deflate (this is usually intentional, so just ignore this message) doveadm(root): Debug: Skipping module doveadm_fts_plugin, because dlopen() failed: /usr/lib/dovecot/modules/doveadm/lib20_doveadm_fts_plugin.so: undefined symbol: fts_backend_rescan (this is usually intentional, so just ignore this message) doveadm(michael(a)domain.com): Debug: Added userdb setting: plugin/master_user=michael(a)domain.com doveadm(michael(a)domain.com): Debug: Added userdb setting: plugin/quota_rule=*:bytes=41943040000 doveadm(michael(a)domain.com): Debug: Effective uid=2000, gid=2000, home=/var/vmail/vmail1/domain.com/m/i/c/michael-2014.09.03.14.32.59/ doveadm(michael(a)domain.com): Debug: Namespace : type=private, prefix=, sep=/, inbox=yes, hidden=no, list=yes, subscriptions=yes location=maildir://var/vmail/vmail1/domain.com/m/i/c/michael-2014.09.03.14.… doveadm(michael(a)domain.com): Debug: maildir++: root=//var/vmail/vmail1/domain.com/m/i/c/michael-2014.09.03.14.32.59//Maild…, index=, control=, inbox=//var/vmail/vmail1/domain.com/m/i/c/michael-2014.09.03.14.32.59//Mail…, alt= doveadm(michael(a)domain.com): Debug: Namespace : type=shared, prefix=Shared/%u/, sep=/, inbox=no, hidden=no, list=children, subscriptions=yes location=maildir:/%Lh/Maildir/:INDEX=/%Lh/Maildir/Shared/%u doveadm(michael(a)domain.com): Debug: shared: root=/var/run/dovecot, index=, control=, inbox=, alt= dsync(michael(a)domain.com): Debug: Namespace : type=private, prefix=, sep=/, inbox=yes, hidden=no, list=yes, subscriptions=yes location=imapc: dsync(michael(a)domain.com): Debug: imapc: root=, index=, control=, inbox=, alt= dsync(michael(a)domain.com): Debug: imapc(s04.xxx.de:993): Looking up IP address dsync(michael(a)domain.com): Debug: imapc(s04.xxx.de:993): Connecting to 78.138.89.136:993 dsync(michael(a)domain.com): Debug: imapc(s04.xxx.de:993): Starting SSL handshake dsync(michael(a)domain.com): Debug: imapc(s04.xxx.de:993): Server capabilities: IMAP4rev1 LITERAL+ SASL-IR LOGIN-REFERRALS ID ENABLE AUTH=PLAIN AUTH=LOGIN dsync(michael(a)domain.com): Debug: imapc(s04.xxx.de:993): Authenticating as username dsync(michael(a)domain.com): Debug: imapc(s04.xxx.de:993): Server capabilities: IMAP4rev1 LITERAL+ SASL-IR LOGIN-REFERRALS ID ENABLE SORT SORT=DISPLAY THREAD=REFERENCES THREAD=REFS MULTIAPPEND UNSELECT IDLE CHILDREN NAMESPACE UIDPLUS LIST-EXTENDED I18NLEVEL=1 CONDSTORE QRESYNC ESEARCH ESORT SEARCHRES WITHIN CONTEXT=SEARCH LIST-STATUS QUOTA dsync(michael(a)domain.com): Debug: imapc(s04.xxx.de:993): Authenticated successfully dsync(michael(a)domain.com): Debug: Namespace : type=shared, prefix=Shared/%u/, sep=/, inbox=no, hidden=no, list=children, subscriptions=yes location=maildir:/%Lh/Maildir/:INDEX=/%Lh/Maildir/Shared/%u dsync(michael(a)domain.com): Debug: shared: root=/var/run/dovecot, index=, control=, inbox=, alt= dsync(michael(a)domain.com): Debug: Namespace : Using permissions from //var/vmail/vmail1/domain.com/m/i/c/michael-2014.09.03.14.32.59//Maildir: mode=0700 gid=-1 dsync(michael(a)domain.com): Error: Can't delete mailbox INBOX: INBOX can't be deleted. dsync(michael(a)domain.com): Info: Amazon: uidnext changed: 1056 != 1 dsync(michael(a)domain.com): Info: INBOX: only in dest (guid=3c68c835800a07547d45000029cbe4c2)= 1 dsync(michael(a)domain.com): Info: Deleted Messages: uidnext changed: 109 != 1 dsync(michael(a)domain.com): Info: MBA Mails: uidnext changed: 444 != 1 dsync(michael(a)domain.com): Info: Archive: highest_modseq changed: 0 != 1 dsync(michael(a)domain.com): Info: Spam: uidnext changed: 3 != 1 dsync(michael(a)domain.com): Info: Apple Mail To Do: highest_modseq changed: 0 != 1 dsync(michael(a)domain.com): Info: Jobsuche: uidnext changed: 22436 != 1 dsync(michael(a)domain.com): Info: Trash (Messages): uidnext changed: 697 != 1 dsync(michael(a)domain.com): Debug: imapc(s04.xxx.de:993): Looking up IP address dsync(michael(a)domain.com): Debug: imapc(s04.xxx.de:993): Connecting to IP-Adress:993 dsync(michael(a)domain.com): Debug: imapc(s04.xxx.de:993): Starting SSL handshake dsync(michael(a)domain.com): Debug: imapc(s04.xxx.de:993): Server capabilities: IMAP4rev1 LITERAL+ SASL-IR LOGIN-REFERRALS ID ENABLE AUTH=PLAIN AUTH=LOGIN dsync(michael(a)domain.com): Debug: imapc(s04.xxx.de:993): Authenticating as username dsync(michael(a)domain.com): Debug: imapc(s04.xxx.de:993): Server capabilities: IMAP4rev1 LITERAL+ SASL-IR LOGIN-REFERRALS ID ENABLE SORT SORT=DISPLAY THREAD=REFERENCES THREAD=REFS MULTIAPPEND UNSELECT IDLE CHILDREN NAMESPACE UIDPLUS LIST-EXTENDED I18NLEVEL=1 CONDSTORE QRESYNC ESEARCH ESORT SEARCHRES WITHIN CONTEXT=SEARCH LIST-STATUS QUOTA dsync(michael(a)domain.com): Debug: imapc(s04.xxx.de:993): Authenticated successfully dsync(michael(a)domain.com): Error: Trying to open a non-listed mailbox with guid=3c68c835800a07547d45000029cbe4c2 dsync(michael(a)domain.com): Error: msg iteration failed: Couldn't open mailbox 3c68c835800a07547d45000029cbe4c2 dsync(michael(a)domain.com): Error: Trying to open a non-listed mailbox with guid=3c68c835800a07547d45000029cbe4c2 dsync(michael(a)domain.com): Debug: imapc(s04.xxx.de:993): Disconnected sudo dovecot -n # 2.1.7: /etc/dovecot/dovecot.conf # OS: Linux 3.2.0-4-amd64 x86_64 Debian 7.6 auth_master_user_separator = * auth_mechanisms = PLAIN LOGIN dict { acl = mysql:/etc/dovecot/dovecot-share-folder.conf quotadict = mysql:/etc/dovecot/dovecot-used-quota.conf } first_valid_uid = 2000 last_valid_uid = 2000 listen = * log_path = /var/log/dovecot.log mail_gid = 2000 mail_location = maildir:/%Lh/Maildir/:INDEX=/%Lh/Maildir/ mail_plugins = quota mail_uid = 2000 managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date ihave namespace { inbox = yes location = mailbox Drafts { auto = subscribe special_use = \Drafts } mailbox Junk { auto = subscribe special_use = \Junk } mailbox Sent { auto = subscribe special_use = \Sent } mailbox "Sent Messages" { auto = no special_use = \Sent } mailbox Spam { auto = no special_use = \Junk } mailbox Trash { auto = subscribe special_use = \Trash } prefix = separator = / type = private } namespace { list = children location = maildir:/%%Lh/Maildir/:INDEX=/%%Lh/Maildir/Shared/%%u prefix = Shared/%%u/ separator = / subscriptions = yes type = shared } passdb { args = /etc/dovecot/dovecot-mysql.conf driver = sql } passdb { args = /etc/dovecot/dovecot-master-users-password driver = passwd-file master = yes } plugin { acl = vfile acl_shared_dict = proxy::acl auth_socket_path = /var/run/dovecot/auth-master quota = dict:user::proxy::quotadict quota_rule = *:storage=1G quota_warning = storage=85%% quota-warning 85 %u quota_warning2 = storage=90%% quota-warning 90 %u quota_warning3 = storage=95%% quota-warning 95 %u sieve = /%Lh/sieve/dovecot.sieve sieve_default = /var/vmail/sieve/dovecot.sieve sieve_dir = /%Lh/sieve sieve_global_dir = /var/vmail/sieve } protocols = pop3 imap sieve lmtp service auth { unix_listener /var/spool/postfix/private/dovecot-auth { group = postfix mode = 0666 user = postfix } unix_listener auth-master { group = vmail mode = 0666 user = vmail } unix_listener auth-userdb { group = vmail mode = 0660 user = vmail } } service dict { unix_listener dict { group = vmail mode = 0660 user = vmail } } service imap-login { process_limit = 500 service_count = 1 } service lmtp { executable = lmtp -L inet_listener lmtp { port = 24 } process_min_avail = 5 unix_listener /var/spool/postfix/private/dovecot-lmtp { group = postfix mode = 0600 user = postfix } user = vmail } service pop3-login { service_count = 1 } service quota-warning { executable = script /usr/local/bin/dovecot-quota-warning.sh unix_listener quota-warning { group = vmail mode = 0660 user = vmail } } ssl = required ssl_cert = </etc/ssl/certs/iRedMail_CA.pem ssl_key = </etc/ssl/private/iRedMail.key userdb { args = /etc/dovecot/dovecot-mysql.conf driver = sql } protocol lda { auth_socket_path = /var/run/dovecot/auth-master lda_mailbox_autocreate = yes log_path = /var/log/dovecot-sieve.log mail_plugins = quota sieve postmaster_address = root } protocol lmtp { info_log_path = /var/log/dovecot-lmtp.log lmtp_save_to_detail_mailbox = yes mail_plugins = quota sieve postmaster_address = postmaster recipient_delimiter = + } protocol imap { imap_client_workarounds = tb-extra-mailbox-sep mail_plugins = quota imap_quota } protocol pop3 { mail_plugins = quota pop3_client_workarounds = outlook-no-nuls oe-ns-eoh pop3_uidl_format = %08Xu%08Xv } Any assistance is highly appreciated. Thank you. Helge

2 3

sieve redirect to foreign email gets “Relay access denied”
by Henry Stack 23 Sep '14

23 Sep '14

I have a postfix mail server with sql authentication and I want to implement sieve on it. Sieve is working relative good, rules who contain 'fileinto' are executed perfectly. The problem is the redirect to other servers. I configured a rule in Sieve to redirect any email containing "redirect" in subject to a specified foreign destination. # So practically a email coming from sender(a)live.de for the local user testuser(a)server.net should be redirected to destination(a)gmail.com when the subject contains "redirect" if header :contains ["subject"] ["redirect"] {redirect "destination(a)gmail.com"; stop;} when I test it I get the following log entry /postfix/smtpd[32114]: NOQUEUE: reject: RCPT from mail.server.net[xx.xx.xx.xx]: 554 5.7.1 <destination(a)gmail.com>: Relay access denied; from=<sender(a)live.de> to=<destination(a)gmail.com> proto=ESMTP helo=<mail.server.net>/ How can I tell postfix to let dovecot/sieve relay the email? can somebody give a hint? postconf -n alias_database = hash:/etc/aliases alias_maps = hash:/etc/aliases append_dot_mydomain = no biff = no broken_sasl_auth_clients = yes config_directory = /etc/postfix content_filter = smtp-amavis:[127.0.0.1]:10024 default_process_limit = 15 disable_vrfy_command = yes dovecot_destination_recipient_limit = 1 home_mailbox = mail/ inet_interfaces = all mailbox_size_limit = 0 mydestination = mail.server.net, localhost myhostname = mail.server.net mynetworks = 127.0.0.0/8 [::ffff:127.0.0.0]/104 [::1]/128 myorigin = /etc/mailname readme_directory = no recipient_delimiter = + smtp_tls_note_starttls_offer = yes smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache smtp_use_tls = yes smtpd_banner = $myhostname ESMTP $mail_name (Debian/GNU) smtpd_data_restrictions = reject_unauth_pipelining smtpd_helo_restrictions = reject_unknown_helo_hostname smtpd_recipient_restrictions = permit_sasl_authenticated, reject_unknown_sender_domain, reject_unknown_reverse_client_hostname, reject_unknown_recipient_domain, reject_unverified_recipient, reject_unauth_destination, reject_rbl_client zen.spamhaus.org, reject_rhsbl_helo dbl.spamhaus.org, reject_rhsbl_sender dbl.spamhaus.org, check_policy_service inet:127.0.0.1:10023 smtpd_sasl_auth_enable = yes smtpd_sasl_authenticated_header = yes smtpd_sasl_local_domain = $myhostname smtpd_sasl_path = private/auth smtpd_sasl_security_options = noanonymous smtpd_sasl_type = dovecot smtpd_sender_restrictions = permit_sasl_authenticated, permit_mynetworks, reject_authenticated_sender_login_mismatch, reject_unknown_sender_domain smtpd_tls_auth_only = no smtpd_tls_cert_file = /etc/ssl/certs/ssl-cert-snakeoil.pem smtpd_tls_key_file = /etc/ssl/private/ssl-cert-snakeoil.key smtpd_tls_loglevel = 2 smtpd_tls_received_header = yes smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache smtpd_use_tls = yes soft_bounce = no virtual_alias_domains = mysql:/etc/postfix/mysql_virtual_alias_domains.cf virtual_alias_maps = mysql:/etc/postfix/mysql_virtual_alias_maps.cf virtual_mailbox_base = /var/vmail virtual_mailbox_domains = mysql:/etc/postfix/mysql_virtual_domains_maps.cf virtual_mailbox_limit = 512000000 virtual_mailbox_maps = mysql:/etc/postfix/mysql_virtual_mailbox_maps.cf virtual_transport = dovecot dovecot -n # 2.1.7: /etc/dovecot/dovecot.conf # OS: Linux 3.2.0-4-amd64 x86_64 Debian 7.6 auth_debug_passwords = yes auth_mechanisms = plain login auth_verbose = yes auth_verbose_passwords = plain debug_log_path = /var/log/dovecot/dovecot.debug.log disable_plaintext_auth = no first_valid_gid = 99 first_valid_uid = 99 hostname = maxi.zp1.net info_log_path = /var/log/mail.info lda_mailbox_autocreate = yes lda_mailbox_autosubscribe = yes listen = xxx.xxx.xxx.xxx log_path = /var/log/dovecot/dovecot.log login_greeting = Dovecot ready, Sir. mail_debug = yes mail_gid = 99 mail_location = maildir:~/mail:LAYOUT=fs:INBOX=/var/vmail/%u/mail/ mail_plugins = acl mail_uid = 99 managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date ihave namespace { location = maildir:/var/mail/public prefix = Public/ separator = / subscriptions = no type = public } namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = type = private } passdb { args = /etc/dovecot/dovecot-sql.conf.ext driver = sql } plugin { acl = vfile acl_anyone = allow acl_shared_dict = file:/var/lib/dovecot/shared-mailboxes mail_log_events = delete undelete expunge copy mailbox_delete mailbox_rename mail_log_fields = uid box from subject msgid size sieve = ~/.dovecot.sieve sieve_default = /var/lib/dovecot/sieve/default.sieve sieve_dir = ~/sieve sieve_global_dir = /var/lib/dovecot/sieve/global/ sieve_max_actions = 64 sieve_user_log = ~/.dovecot.sieve.log } postmaster_address = root(a)server.net protocols = " imap sieve pop3" service auth { unix_listener /var/spool/postfix/private/auth { mode = 0666 } unix_listener auth-userdb { group = postfix mode = 0666 user = postfix } } service managesieve-login { inet_listener sieve { port = 4190 } service_count = 1 } ssl_cert = </etc/dovecot/dovecot.pem ssl_key = </etc/dovecot/private/dovecot.pem submission_host = smtp.server.net userdb { args = uid=vmail gid=vmail home=/var/vmail/%u driver = static } verbose_proctitle = yes protocol lda { mail_plugins = acl sieve } protocol imap { mail_plugins = acl autocreate acl imap_acl } protocol sieve { mail_max_userip_connections = 10 }

5 9