- dovecot - dovecot.org

Created DokuWiki entries for the migration from Dovecot 2.3 to 2.4.
by Klaus Tachtler 10 Jan '26

10 Jan '26

Hello everyone, Over the past few weeks, I have migrated from Dovecot 2.3 to 2.4 and documented this in my DokuWiki. I do not claim that this is complete, nor is it an all-encompassing description. It includes a configuration for Dovecot 2.3 and the respective migration to Dovecot 2.4. I implemented the following configurations: Dovecot ArchLinux Dovecot ArchLinux - SSL/TLS Dovecot ArchLinux - SASL Dovecot ArchLinux - Quotas Dovecot ArchLinux - Mail-Log-Schreibung Dovecot ArchLinux - Zlib-Komprimierung Dovecot ArchLinux - SQL Dovecot ArchLinux - SQL - Quota: SQL Dovecot ArchLinux - Sieve (Pigeonhole) Dovecot ArchLinux - Shares Dovecot ArchLinux - Master-User The DokuWiki entries are in German, but I think the code examples speak for themselves, and if necessary, a translation program can also be used. The Dokuwiki and my implementations can be accessed at the following link: https://dokuwiki.tachtler.net/doku.php?id=index#imap-server_dovecot_imap-se… The documentation was created using the Archlinux operating system, but can certainly be ported to other Linux distributions. I hope someone else might find my notes useful too? Best regards, Klaus Tachtler. -- --------------------------------------- e-Mail : klaus(a)tachtler.net Homepage: https://www.tachtler.net DokuWiki: https://dokuwiki.tachtler.net ---------------------------------------

3 3

Problems building from source under Trixie
by William Silverstein 09 Jan '26

09 Jan '26

I am running Debian Trixie. I try building the, but the configuration fails: I tried building with: ./configure \ --prefix=/usr/local/dovecot \ --with-sql \ --with-mysql \ --without-pam \ --without-pgsql \ --without-sqlite \ --with-solr \ --with-bzlib \ --with-lz4 \ --with-ldap I get configure: error: cannot build with MySQL support: Neither MySQL (mysqlclient) nor MariaDB library (libmariadb) found. But I did install libldb-dev. I also installed libldap2-dev liblz4-dev But when I do: EXPAT_CFLAGS=/usr/include EXPAT_LIBS=/lib/x86_64-linux-gnu \ LZ4_CFLAGS=/usr/include LZ4_LIBS=/usr/lib/x86_64-linux-gnu \ ZLIB_CFLAGS=/usr/include ZLIB_LIBS=/lib/x86_64-linux-gnu \ MARIADB_LIBS=/usr/lib/x86_64-linux-gnu MARIADB_CFLAGS=/usr/include/mariadb \ ./configure \ --prefix=/usr/local/dovecot \ --with-sql \ --with-mysql \ --without-pam \ --without-pgsql \ --without-sqlite \ --with-solr \ --with-bzlib \ --with-lz4 It configures, them fails in the build. I got some LZ4_DEPRECATED("use LZ4_compress_default() instead") LZ4LIB_API int LZ4_compress (const char* src, char* dest, int srcSize); I get a bunch of linker errors: /usr/bin/ld: ./.libs/libcompression.a(istream-lz4.o): in function `i_stream_lz4_read': /usr/local/src/dovecot-2.4.2/src/lib-compression/istream-lz4.c:192:(.text+0x619): undefined reference to `LZ4_decompress_safe' /usr/bin/ld: ./.libs/libcompression.a(istream-zlib.o): in function `i_stream_zlib_init': /usr/local/src/dovecot-2.4.2/src/lib-compression/istream-zlib.c:324:(.text+0x1d): undefined reference to `inflateInit2_' /usr/bin/ld: ./.libs/libcompression.a(istream-zlib.o): in function `i_stream_zlib_close': /usr/local/src/dovecot-2.4.2/src/lib-compression/istream-zlib.c:46:(.text+0xa8): undefined reference to `inflateEnd' /usr/bin/ld: ./.libs/libcompression.a(istream-zlib.o): in function `i_stream_zlib_reset': /usr/local/src/dovecot-2.4.2/src/lib-compression/istream-zlib.c:358:(.text+0x168): undefined reference to `inflateEnd' /usr/bin/ld: /usr/local/src/dovecot-2.4.2/src/lib-compression/istream-zlib.c:358:(.text+0x3a7): undefined reference to `inflateEnd' /usr/bin/ld: ./.libs/libcompression.a(istream-zlib.o): in function `i_stream_zlib_read': /usr/local/src/dovecot-2.4.2/src/lib-compression/istream-zlib.c:264:(.text+0x97f): undefined reference to `inflate' /usr/bin/ld: /usr/local/src/dovecot-2.4.2/src/lib-compression/istream-zlib.c:220:(.text+0xa7f): undefined reference to `inflateEnd' /usr/bin/ld: ./.libs/libcompression.a(ostream-lz4.o): in function `o_stream_lz4_compress': /usr/local/src/dovecot-2.4.2/src/lib-compression/ostream-lz4.c:94:(.text+0x12f): undefined reference to `LZ4_compress' /usr/bin/ld: ./.libs/libcompression.a(ostream-zlib.o): in function `o_stream_zlib_close': /usr/local/src/dovecot-2.4.2/src/lib-compression/ostream-zlib.c:91:(.text+0x1ee): undefined reference to `deflateEnd' /usr/bin/ld: ./.libs/libcompression.a(ostream-zlib.o): in function `o_stream_create_zlib': /usr/local/src/dovecot-2.4.2/src/lib-compression/ostream-zlib.c:412:(.text+0x339): undefined reference to `deflateInit2_' /usr/bin/ld: ./.libs/libcompression.a(ostream-zlib.o): in function `o_stream_zlib_send_flush': /usr/local/src/dovecot-2.4.2/src/lib-compression/ostream-zlib.c:281:(.text+0x577): undefined reference to `deflate' /usr/bin/ld: ./.libs/libcompression.a(ostream-zlib.o): in function `o_stream_zlib_send_chunk': /usr/local/src/dovecot-2.4.2/src/lib-compression/ostream-zlib.c:213:(.text+0x83b): undefined reference to `deflate' Any suggestions? Thanks. -- William G. Silverstein, Esq. 8383 Wilshire Blvd. Suite 630. Beverly Hills, CA 90211

2 1

Error: userdb: client doesn't have lookup permissions for this user
by vwoloszczuk＠tutanota.com 09 Jan '26

09 Jan '26

Hi, I am trying to configure Dovecot 2.4.2 to work as MDA for Postfix 3.10.5, using LMTP and SASL, with virtual users. This is Debian 13. I had Postfix working fine before trying to incorporate Dovecot, and I was also able to get LMTP working with system users (no SASL), but now things are not working. I've followed the guides in the documentation for using Dovecot and Postfix, in particular the following page: https://doc.dovecot.org/2.4.2/howto/sasl/postfix.html I've set up my 'service auth {}' to look like in that page. When I send mail to <user>, I get the following logs and the message is deferred by Postfix: lmtp(119643): Connect from local auth(<user>): Error: userdb: client doesn't have lookup permissions for this user: userdb reply doesn't contain uid (to bypass this check, set: service auth { unix_listener /run/dovecot/auth-userdb { mode=0777 } }) lmtp(<user> <mailto:viktor@woloszcz.uk>)<119643><SRJICIBlYGlb0wEAk6KCeQ>: Error: auth-master: userdb lookup(<user>): Auth USER lookup failed lmtp(119643): Error: lmtp-server: conn unix:pid=119900,uid=101 [3]: rcpt <user>: Failed to lookup user <user>: Internal error occurred. Refer to server log for more information. lmtp(119643): Disconnect from local: Logged out (state=READY) I am using passwd-file passdb '/etc/dovecot/passwd' with entries in the form '<user>:{PLAIN}password'. This file is owned by root and is world-readable.I am not using a userdb but have set 'mail_uid = vmail' and 'mail_gid = vmail' The socket is located at '/var/spool/postfix/dovecot/auth' (i.e. visible to Postfix) and is owned by the postfix user.I've tried changing the permissions of the socket as the error message instructed but this didn't have any effect. I haven't set 'user = doveauth' as in this page:https://doc.dovecot.org/2.4.2/howto/virtual/postfix.html I don't understand what that would do. Please find attached my full dovecot.conf in case it is useful. Thanks in advance, Viktor Hi, I am trying to configure Dovecot 2.4.2 to work as MDA for Postfix 3.10.5, using LMTP and SASL, with virtual users. This is Debian 13. I had Postfix working fine before trying to incorporate Dovecot, and I was also able to get LMTP working with system users (no SASL), but now things are not working. I've followed the guides in the documentation for using Dovecot and Postfix, in particular the following page: [1]https://doc.dovecot.org/2.4.2/howto/sasl/postfix.html I've set up my 'service auth {}' to look like in that page. When I send mail to <user>, I get the following logs and the message is deferred by Postfix: lmtp(119643): Connect from local auth(<user>): Error: userdb: client doesn't have lookup permissions for this user: userdb reply doesn't contain uid (to bypass this check, set: service auth { unix_listener /run/dovecot/auth-userdb { mode=0777 } }) lmtp([2]<user>)<119643><SRJICIBlYGlb0wEAk6KCeQ>: Error: auth-master: userdb lookup(<user>): Auth USER lookup failed lmtp(119643): Error: lmtp-server: conn unix:pid=119900,uid=101 [3]: rcpt <user>: Failed to lookup user <user>: Internal error occurred. Refer to server log for more information. lmtp(119643): Disconnect from local: Logged out (state=READY) I am using passwd-file passdb '/etc/dovecot/passwd' with entries in the form '<user>:{PLAIN}password'. This file is owned by root and is world-readable. I am not using a userdb but have set 'mail_uid = vmail' and 'mail_gid = vmail' The socket is located at '/var/spool/postfix/dovecot/auth' (i.e. visible to Postfix) and is owned by the postfix user. I've tried changing the permissions of the socket as the error message instructed but this didn't have any effect. I haven't set 'user = doveauth' as in this page: [3]https://doc.dovecot.org/2.4.2/howto/virtual/postfix.html I don't understand what that would do. Please find attached my full dovecot.conf in case it is useful. Thanks in advance, Viktor References Visible links 1. https://doc.dovecot.org/2.4.2/howto/sasl/postfix.html 2. mailto:viktor@woloszcz.uk 3. https://doc.dovecot.org/2.4.2/howto/virtual/postfix.html

2 3

how to use dovecot-lda with dovecot.crt?
by Matthias Bodenbinder 09 Jan '26

09 Jan '26

Hi, I have a self signed certificate for dovecot: > [root@rakete] /etc/dovecot > # ll > insgesamt 12K > -rwxr-xr-x 1 root root 1,7K 2026-01-09@09:56 dovecot.conf > -rw-r----- 1 root root 1,4K 2026-01-09@09:54 dovecot.crt > -rw-r----- 1 root root 1,7K 2026-01-09@09:54 dovecot.key in dovecot.conf I have: ssl_server { cert_file = /etc/dovecot/dovecot.crt key_file = /etc/dovecot/dovecot.key } This works fine for the evolution email client. But when I want to use dovecot-lda as part of my getmail6 config I get a permission denied: # getmail --rcfile dogado-rc -n -v getmail version 6.19.10 Copyright (C) 1998-2025 Charles Cazabon and others. Licensed under GPL-2.0. SimpleIMAPSSLRetriever:bodenbinder_de_9@imap.dogado.net:993: Delivery error (command dovecot-lda 1510042 error (89, doveconf: Fatal: Error in configuration file /etc/dovecot/dovecot.conf line 51: cert_file: open(/etc/dovecot/dovecot.crt) failed: Permission denied)) [INBOX] msg 1/1 (1392 bytes), delivery error (command dovecot-lda 1510042 error (89, doveconf: Fatal: Error in configuration file /etc/dovecot/dovecot.conf line 51: cert_file: open(/etc/dovecot/dovecot.crt) failed: Permission denied)) 1 messages (1392 bytes) retrieved, 0 skipped dogado-rc has this delivery section: [destination] type = MDA_external path = /usr/lib/dovecot/dovecot-lda arguments = ("-d", "matthias") When I change ownership of the certificate files it works: # chown root:matthias /etc/dovecot/dovecot.crt /etc/dovecot/dovecot.key [root@rakete] /etc/dovecot # ll /etc/dovecot/dovecot.crt /etc/dovecot/dovecot.key -rw-r----- 1 root matthias 1,4K 2026-01-09@09:54 /etc/dovecot/dovecot.crt -rw-r----- 1 root matthias 1,7K 2026-01-09@09:54 /etc/dovecot/dovecot.key If I do not change permissions for dovecot.key I get a similar error for that file too. But can this be the solution? That would mean that I need to give read access to the crt/key file to every user who wants to use dovecot-lda. Is that correct? Matthias

2 2

Republish of dovecot 2.4.2 packages
by Aki Tuomi 08 Jan '26

08 Jan '26

Hi! Due to mistake in RHEL 10 packaging, we have republished packages for 2.4.2. Content is still the same, build number has increased by one. The important change is that there is now pigeonhole package for RHEL 10. You can find the packages at https://repo.dovecot.org/ as usual. Kind regards, Aki Tuomi

1 0

File system errors
by Jyrki Partanen 07 Jan '26

07 Jan '26

I am trying to move from one VPS to another and strange (for me) file system errors arose. On the new VPS the IMAP client can see the Inbox, but not any other mailboxes. I get these errors in the log: Jan 5 04:49:14 partanen dovecot[144921]: imap(jyrki)<145495><65K/GptHn8tVnMi0>: Error: open(/home/jyrki/mail/.imap/dovecot.list.index.log) failed: Permission denied (euid=1000(jyrki) egid=1000(jyrki) missing +r perm: /home/jyrki/mail/.imap/dovecot.list.index.log stat(/home/jyrki/mail/.imap/dovecot.list.index.log) failed: Permission denied) Jan 5 04:49:14 partanen dovecot[144921]: imap(jyrki)<145495><65K/GptHn8tVnMi0>: Error: Mailbox INBOX: open(/home/jyrki/mail/.imap/INBOX/dovecot.index.log) failed: Permission denied (euid=1000(jyrki) egid=1000(jyrki) missing +r perm: /home/jyrki/mail/.imap/INBOX/dovecot.index.log stat(/home/jyrki/mail/.imap/INBOX/dovecot.index.log) failed: Permission denied) Jan 5 04:49:14 partanen dovecot[144921]: imap(jyrki)<145495><65K/GptHn8tVnMi0>: Error: Couldn't create mailbox list lock /home/jyrki/mail/.imap/mailboxes.lock: file_create_locked(/home/jyrki/mail/.imap/mailboxes.lock) failed: safe_mkstemp(/home/jyrki/mail/.imap/mailboxes.lock) failed: Permission denied Jan 5 04:49:14 partanen dovecot[144921]: imap(jyrki)<145499><nxbBGptHoMtVnMi0>: Error: Mailbox INBOX: open(/home/jyrki/mail/.imap/INBOX/dovecot.index.log) failed: Permission denied (euid=1000(jyrki) egid=1000(jyrki) missing +r perm: /home/jyrki/mail/.imap/INBOX/dovecot.index.log stat(/home/jyrki/mail/.imap/INBOX/dovecot.index.log) failed: Permission denied) ...etc... The thing is that the permissions should be OK, the files are not "missing +r perm". Any idea how to fix this? Thanks! I am trying to move from one VPS to another and strange (for me) file system errors arose. On the new VPS the IMAP client can see the Inbox, but not any other mailboxes. I get these errors in the log: Jan 5 04:49:14 partanen dovecot[144921]: imap(jyrki)<145495><65K/GptHn8tVnMi0>: Error: open(/home/jyrki/mail/.imap/dovecot.list.index.log) failed: Permission denied (euid=1000(jyrki) egid=1000(jyrki) missing +r perm: /home/jyrki/mail/.imap/dovecot.list.index.log stat(/home/jyrki/mail/.imap/dovecot.list.index.log) failed: Permission denied) Jan 5 04:49:14 partanen dovecot[144921]: imap(jyrki)<145495><65K/GptHn8tVnMi0>: Error: Mailbox INBOX: open(/home/jyrki/mail/.imap/INBOX/dovecot.index.log) failed: Permission denied (euid=1000(jyrki) egid=1000(jyrki) missing +r perm: /home/jyrki/mail/.imap/INBOX/dovecot.index.log stat(/home/jyrki/mail/.imap/INBOX/dovecot.index.log) failed: Permission denied) Jan 5 04:49:14 partanen dovecot[144921]: imap(jyrki)<145495><65K/GptHn8tVnMi0>: Error: Couldn't create mailbox list lock /home/jyrki/mail/.imap/mailboxes.lock: file_create_locked(/home/jyrki/mail/.imap/mailboxes.lock) failed: safe_mkstemp(/home/jyrki/mail/.imap/mailboxes.lock) failed: Permission denied Jan 5 04:49:14 partanen dovecot[144921]: imap(jyrki)<145499><nxbBGptHoMtVnMi0>: Error: Mailbox INBOX: open(/home/jyrki/mail/.imap/INBOX/dovecot.index.log) failed: Permission denied (euid=1000(jyrki) egid=1000(jyrki) missing +r perm: /home/jyrki/mail/.imap/INBOX/dovecot.index.log stat(/home/jyrki/mail/.imap/INBOX/dovecot.index.log) failed: Permission denied) ...etc... The thing is that the permissions should be OK, the files are not "missing +r perm". Any idea how to fix this? Thanks!

4 4

Non Existent User Login Attempts
by Bryan Simmons 06 Jan '26

06 Jan '26

Log contains several messages from dovecot that are not clear to me exactly what is occurring, single example below. These appear to be login attempts for the same group of non existent user ids from various rip addresses. Am I interpreting these correctly and, if so, is there any issue with just ignoring them? dovecot: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 0 secs): user=<non-existent-user(a)example.net>, rip=0.0.0.0 Thank you, Bryan

6 6

How can I use /etc/passwd auth for linux users and a passwd-file for virtual mailbox users?
by Ethan Merrill 06 Jan '26

06 Jan '26

Hello, I hope this is the right mailing list to send questions to. Please direct me where to go if it is not. Thanks. --- I am setting up a postfix/dovecot email server on a Debian 13 VPS. Dovecot is v2.4.1. I have thus far been able to successfully configure the server for smtp and imap support for my primary domain (we'll say `user(a)example.com` who is a linux user with a home folder). I have been even been able to configure postfix to have virtual mailboxes and aliases, and from ssh I can can even see that the mail gets delivered to the correct place. However, I am struggling to set up dovecot to authenticate a virtual mailbox user (we'll say `user(a)example.net` who only has a virtual mailbox). [This documentation page](https://doc.dovecot.org/2.4.2/core/config/auth/mutltiple.html) describes the process to configure multiple authentication databases. It describes being able to use multiple `passdb` and `userdb` sections in order to authenticate dovecot users. Based upon what it suggested, I tried this configuration: > ## Snippet from /etc/dovecot/dovecot.conf ## > passdb passwd-file { > # So example.net => /etc/dovecot/passwd/example.net > passwd_file_path = /etc/dovecot/passwd/%{user | domain} > } > # Fall thru to PAM for unix users > passdb pam { > } > > userdb passwd-file { > passwd_file_path = /etc/dovecot/passwd/%{user | domain} > } > # Fall thru to /etc/passwd for unix users > userdb passwd { > } > > ## Snippet from /etc/dovecot/passwd/example.net ## > support@example.net:$y$j9...hash...:800:800::/var/postfix/virtual/example.net/support:: This is the configuration I landed on that hypothetically checks multiple databases for authentication that allows at least `user(a)example.com` to still login with Thunderbird and do email stuff. However it does not authenticate `user(a)example.net`. The biggest difference between my config and the example is that they use a `sql` database while I am trying the `passwd-file` database. In principle this seems like it should work, unless I am understanding the dovecot docs or have made my passwd file incorrectly. I even tried reversing the order of `userdb` and `passdb` sections to see if it would help to no avail. [This thread](https://dovecot.org/mailman3/archives/list/dovecot@dovecot.org/thre… seems to address a similar issue, and more or less has the same configuration setup suggested as the one in the snippet above. It's also from 2006 so the API looks kinda different from the current docs. [This thread](https://dovecot.org/mailman3/archives/list/dovecot@dovecot.org/thre… is from 2013 addressing a similar issue, but despite again different API it translates to more or less what the snippet above shows. Here is the journalctl output from when I tried to login as `user(a)example.net`: > # journalctl -xeu dovecot | tail > Dec 29 11:38:19 example.com auth[4719]: pam_unix(dovecot:auth): check pass; user unknown > Dec 29 11:38:19 example.com auth[4719]: pam_unix(dovecot:auth): authentication failure; logname= uid=0 euid=0 tty=dovecot ruser=user(a)example.net rhost=10.0.0.1 > Dec 29 11:38:28 example.com auth[4719]: pam_unix(dovecot:auth): check pass; user unknown > Dec 29 11:38:28 example.com auth[4719]: pam_unix(dovecot:auth): authentication failure; logname= uid=0 euid=0 tty=dovecot ruser=user(a)example.net rhost=10.0.0.1 > Dec 29 11:41:19 example.com dovecot[4700]: imap-login: Login aborted: Inactivity (auth failed, 2 attempts in 180 secs) (auth_failed): user=<user(a)example.net>, method=LOGIN, rip=10.0.0.1, lip=10.0.0.2, TLS, session=<z8Tj3hlHkLxJMmuL> The last message referring to "Inactivity" is because at that point fail2ban blocked my IP, but before that it was consistent with results I have been getting. I'm at an absolute loss. I feel like I've trawled every doc I could find, every config file involved in the setup process, all the Stack Exchange answers that seem to exist. Honestly it baffles me to see that even what looks like the same setup as official documentation, it just doesn't... work? Can anybody point to me what is going wrong? Thanks for reading, ~ Ethan Merrill Hello, I hope this is the right mailing list to send questions to. Please direct me where to go if it is not. Thanks. --- I am setting up a postfix/dovecot email server on a Debian 13 VPS. Dovecot is v2.4.1. I have thus far been able to successfully configure the server for smtp and imap support for my primary domain (we'll say `user(a)example.com` who is a linux user with a home folder). I have been even been able to configure postfix to have virtual mailboxes and aliases, and from ssh I can can even see that the mail gets delivered to the correct place. However, I am struggling to set up dovecot to authenticate a virtual mailbox user (we'll say `user(a)example.net` who only has a virtual mailbox). [1]This documentation page describes the process to configure multiple authentication databases. It describes being able to use multiple `passdb` and `userdb` sections in order to authenticate dovecot users. Based upon what it suggested, I tried this configuration: ## Snippet from /etc/dovecot/dovecot.conf ## passdb passwd-file { # So [2]example.net => /etc/dovecot/passwd/example.net passwd_file_path = /etc/dovecot/passwd/%{user | domain} } # Fall thru to PAM for unix users passdb pam { } userdb passwd-file { passwd_file_path = /etc/dovecot/passwd/%{user | domain} } # Fall thru to /etc/passwd for unix users userdb passwd { } ## Snippet from /etc/dovecot/passwd/example.net ## [3]support@example.net:$y$j9...hash...:800:800::/var/postfix/virtual/example.net/support:: This is the configuration I landed on that hypothetically checks multiple databases for authentication that allows at least `user(a)example.com` to still login with Thunderbird and do email stuff. However it does not authenticate `user(a)example.net`. The biggest difference between my config and the example is that they use a `sql` database while I am trying the `passwd-file` database. In principle this seems like it should work, unless I am understanding the dovecot docs or have made my passwd file incorrectly. I even tried reversing the order of `userdb` and `passdb` sections to see if it would help to no avail. [4]This thread seems to address a similar issue, and more or less has the same configuration setup suggested as the one in the snippet above. It's also from 2006 so the API looks kinda different from the current docs. [5]This thread is from 2013 addressing a similar issue, but despite again different API it translates to more or less what the snippet above shows. Here is the journalctl output from when I tried to login as `user(a)example.net`: # journalctl -xeu dovecot | tail Dec 29 11:38:19 [6]example.com auth[4719]: pam_unix(dovecot:auth): check pass; user unknown Dec 29 11:38:19 [7]example.com auth[4719]: pam_unix(dovecot:auth): authentication failure; logname= uid=0 euid=0 tty=dovecot [8]ruser=user(a)example.net rhost=10.0.0.1 Dec 29 11:38:28 [9]example.com auth[4719]: pam_unix(dovecot:auth): check pass; user unknown Dec 29 11:38:28 [10]example.com auth[4719]: pam_unix(dovecot:auth): authentication failure; logname= uid=0 euid=0 tty=dovecot [11]ruser=user(a)example.net rhost=10.0.0.1 Dec 29 11:41:19 [12]example.com dovecot[4700]: imap-login: Login aborted: Inactivity (auth failed, 2 attempts in 180 secs) (auth_failed): user=<[13]user(a)example.net>, method=LOGIN, rip=10.0.0.1, lip=10.0.0.2, TLS, session=<z8Tj3hlHkLxJMmuL> The last message referring to "Inactivity" is because at that point fail2ban blocked my IP, but before that it was consistent with results I have been getting. I'm at an absolute loss. I feel like I've trawled every doc I could find, every config file involved in the setup process, all the Stack Exchange answers that seem to exist. Honestly it baffles me to see that even what looks like the same setup as official documentation, it just doesn't... work? Can anybody point to me what is going wrong? Thanks for reading, ~ Ethan Merrill References Visible links 1. This documentation page https://doc.dovecot.org/2.4.2/core/config/auth/mutltiple.html 2. http://example.net/ 3. mailto:support@example.net 4. This thread https://dovecot.org/mailman3/archives/list/dovecot@dovecot.org/thread/VMXU2… 5. This thread https://dovecot.org/mailman3/archives/list/dovecot@dovecot.org/thread/YO3DF… 6. http://example.com/ 7. http://example.com/ 8. mailto:ruser=user@example.net 9. http://example.com/ 10. http://example.com/ 11. mailto:ruser=user@example.net 12. http://example.com/ 13. mailto:user@example.net

6 10

Putting a file in a shared namespace causes Panic in quota.c
by Christopher V. 06 Jan '26

06 Jan '26

Dear all, I guess I found a bug. I'm currently testing a migration of my Debian based dovecot bare metal installation from 2.3.19 --> 2.4.1 I'm using shared mailboxes. My understanding from the documentation is: "Quota plugin considers shared namespaces against owner's quota" and "The quota limits are also taken from the userdb." The following setup leads to a "Panic: file quota.c": * Quota is defined per-user and defined in a MySQL Database (and looked up as part of userdb) * User A shares directory "Inbox/teilemich" with user B. * User B has full access rights (details see below) * User A has a quota of 100MB - currently using 60% * User B has a quota of 4GB - currently using 550MB * User A puts mail xyz in the shared directory --> works * User B puts mail abc in the shared directory --> error message (see below) and mail is not stored. Defining the following not-overwritable global quota > 550 MB eliminates the error message. Defining a global quota < 550 MB still leads to the error message. quota "User quota" { storage_size = 560M storage_grace = 10M } Defining an overwritable global quota that is > 550 MB still leads to the error message. quota_storage_size = 560M quota "User quota" { storage_grace = 10M } Can you please check, if this is a bug? If you need some details I'm happy to provide it. Also - I would be very grateful for a workaround / fix. Thanks for all the effort & Best regards, Christopher ----------------------------------------------------- Detailed error message: ==================== Jan 04 17:27:25 <Servername> dovecot[135430]: imap(test@<Servername>.de)<135441><JJetaZJH7O1P12UP>: Panic: file quota.c: line 512 (quota_root_is_visible): assertion failed: (box->list->ns->type == MAIL_NAMESPACE_TYPE_SHARED) Jan 04 17:27:25 <Servername> dovecot[135430]: imap(test@<Servername>.de)<135441><JJetaZJH7O1P12UP>: Error: Raw backtrace: #1 [unw_get_proc_name() failed: -10] -> #2 [unw_get_proc_name() failed: -10] -> #3 i_panic[0x7fa1b4c655e6] -> #4 [unw_get_proc_name() failed: -10] -> #5 [unw_get_proc_name() failed: -10] -> #6 quota_test_alloc[0x7fa1b45a7850] -> #7 quota_try_alloc[0x7fa1b45aa4e0] -> #8 [unw_get_proc_name() failed: -10] -> #9 mailbox_save_finish[0x7fa1b508c7f0] -> #10 mail_storage_copy[0x7fa1b507e670] -> #11 [unw_get_proc_name() failed: -10] -> #12 [unw_get_proc_name() failed: -10] -> #13 [unw_get_proc_name() failed: -10] -> #14 [unw_get_proc_name() failed: -10] -> #15 [unw_get_proc_name() failed: -10] -> #16 mailbox_move[0x7fa1b508cc10] -> #17 [unw_get_proc_name() failed: -10] -> #18 command_exec[0x55da1ef57080] -> #19 [unw_get_proc_name() failed: -10] -> #20 [unw_get_proc_name() failed: -10] -> #21 [unw_get_proc_name() failed: -10] -> #22 client_handle_input[0x55da1ef5d990] -> #23 client_input[0x55da1ef5ded0] -> #24 io_loop_call_io[0x7fa1b4d51710] -> #25 io_loop_handler_run_internal[0x7fa1b4d534b0] -> #26 io_loop_handler_run[0x7fa1b4d53640] -> #27 io_loop_run[0x7fa1b4d53820] -> #28 master_service_run[0x7fa1b4ca6330] -> #29 main[0x55da1ef48880] -> #30 [unw_get_proc_name() failed: -10] -> #31 __libc_start_main[0x7fa1b4e52ce0] -> #32 _start[0x55da1ef48f30] Jan 04 17:27:25 <Servername> dovecot[135430]: imap(test@<Servername>.de)<135441><JJetaZJH7O1P12UP>: Fatal: master: service(imap): child 135441 killed with signal 6 (core dumps disabled - https://dovecot.org/bugreport.html#coredumps) Output of "doveadm acl get -A inbox/teilemich": ======================================= Username ID Global Rights <user A> user=<user B> admin create delete expunge insert lookup post read write write-deleted write-seen Output of "doveconf -a": ==================== # 2.4.1-4 (7d8c0e5759): /etc/dovecot/dovecot.conf # Pigeonhole version 2.4.1-4 (0a86619f) # OS: Linux 6.12.57+deb13-cloud-amd64 x86_64 Debian 13.2 ext4 # Hostname: <Servername> # 4 default setting changes since version 2.4.0 dovecot_config_version = 2.4.0 # NOTE: Send doveconf -n output instead when asking for help. acl_cache_ttl = 30 secs acl_defaults_from_inbox = no acl_driver = vfile acl_global_path = acl_globals_only = no acl_groups = acl_id = acl_ignore = no acl_rights = acl_user = %{master_user} apparmor_hats = auth_allow_cleartext = no auth_allow_weak_schemes = no auth_anonymous_username = anonymous auth_cache_negative_ttl = 180 seconds auth_cache_size = 1024 auth_cache_ttl = 180 seconds auth_cache_verify_password_with_worker = no auth_debug = no auth_debug_passwords = no auth_default_domain = <servername> auth_failure_delay = 2 secs auth_gssapi_hostname = auth_internal_failure_delay = 2 secs auth_krb5_keytab = auth_master_user_separator = auth_mechanisms = plain login auth_policy_check_after_auth = yes auth_policy_check_before_auth = yes auth_policy_hash_mech = sha256 auth_policy_hash_nonce = auth_policy_log_only = no auth_policy_reject_on_fail = no auth_policy_report_after_auth = yes auth_policy_request_attributes = auth_policy_server_api_header = auth_policy_server_url = auth_proxy_self = auth_realms = auth_socket_path = auth-userdb auth_ssl_require_client_cert = no auth_ssl_username_from_cert = no auth_use_winbind = no auth_username_chars = abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ01234567890.-_@ auth_username_format = %{user|lower} auth_verbose = no auth_verbose_passwords = no auth_winbind_helper_path = /usr/bin/ntlm_auth charset_aliases = compress_bz2_block_size_100k = 9 compress_deflate_level = 6 compress_gz_level = 6 compress_zstd_level = 3 crypt_acl_require_secure_key_sharing = no crypt_global_public_key_file = crypt_private_key_file = crypt_private_key_name = crypt_private_key_password = crypt_user_key_curve = crypt_user_key_password = crypt_user_key_require_encrypted = no crypt_write_algorithm = aes-256-gcm-sha256 debug_log_path = default_client_limit = 1000 default_idle_kill_interval = 1 mins default_internal_group = dovecot default_internal_user = dovecot default_login_user = dovenull default_process_limit = 100 default_vsz_limit = 256 M deliver_log_format = msgid=%{msgid}: %{message} dict_driver = dict_file_lock_method = dotlock dict_file_path = dict_map_expire_field = dict_map_key_field_name = dict_map_key_field_type = string dict_map_key_field_value = dict_map_ldap_filter = dict_map_pattern = dict_map_sql_table = dict_map_username_field = dict_map_value = dict_map_value_field_name = dict_map_value_field_type = string dict_name = dict_proxy_idle_timeout = 0 dict_proxy_name = dict_proxy_slow_warn = 5 secs dict_proxy_socket_path = dict dotlock_use_excl = yes doveadm_allowed_commands = doveadm_api_key = doveadm_password = doveadm_port = 0 doveadm_socket_path = doveadm-server doveadm_ssl = no doveadm_username = doveadm doveadm_worker_count = 0 dovecot_storage_version = 2.4.0 dsync_alt_char = _ dsync_commit_msgs_interval = 100 dsync_features = dsync_remote_cmd = ssh -l%{login} %{host} doveadm dsync-server -u%{user} -U event_exporter_driver = log event_exporter_file_path = event_exporter_format = event_exporter_http_post_url = event_exporter_name = event_exporter_time_format = rfc3339 event_exporter_unix_connect_timeout = 250 ms event_exporter_unix_path = execute_args = execute_driver = unix execute_fork_path = execute_name = execute_tcp_host = execute_tcp_port = 0 execute_unix_socket_path = fifo_listener_group = fifo_listener_mode = 0600 fifo_listener_path = fifo_listener_type = fifo_listener_user = first_valid_gid = 1 first_valid_uid = 500 fs_compress_read_plain_fallback = no fs_compress_write_method = fs_crypt_read_plain_fallback = no fs_dict_value_encoding = raw fs_driver = fs_name = fs_posix_accurate_mtime = no fs_posix_fsync = yes fs_posix_lock_method = flock fs_posix_mode = 0600 fs_posix_prefix = fs_randomfail_ops = fs_sis_queue_path = fts_autoindex = yes fts_autoindex_max_recent_msgs = 999 fts_decoder_driver = fts_decoder_script_socket_path = fts_decoder_tika_url = fts_driver = fts_flatcurve_commit_limit = 500 fts_flatcurve_min_term_size = 2 fts_flatcurve_optimize_limit = 10 fts_flatcurve_rotate_count = 5000 fts_flatcurve_rotate_time = 5 secs fts_flatcurve_substring_search = no fts_header_excludes = fts_header_includes = fts_message_max_size = unlimited fts_search = yes fts_search_add_missing = yes fts_search_read_fallback = yes fts_search_timeout = 30 secs haproxy_timeout = 3 secs haproxy_trusted_networks = hostname = http_client_connect_timeout = 0 http_client_delete_request_max_attempts = 0 http_client_delete_request_timeout = 0 http_client_max_connect_attempts = 0 http_client_max_idle_time = 0 http_client_max_parallel_connections = 1 http_client_max_pipelined_requests = 1 http_client_proxy_password = http_client_proxy_socket_path = http_client_proxy_ssl_tunnel = yes http_client_proxy_url = http_client_proxy_username = http_client_rawlog_dir = http_client_read_request_max_attempts = 0 http_client_read_request_timeout = 0 http_client_request_absolute_timeout = 0 http_client_request_max_attempts = 1 http_client_request_max_redirects = 0 http_client_request_timeout = 1 mins http_client_write_request_max_attempts = 0 http_client_write_request_timeout = 0 http_server_max_client_idle_time = 0 http_server_max_pipelined_requests = 1 http_server_rawlog_dir = imap_acl_allow_anyone = no imap_capability = imap_client_workarounds = imap_fetch_failure = disconnect-immediately imap_hibernate_timeout = 5s imap_id_retain = no imap_id_send = imap_literal_minus = no imap_logout_format = in=%{input} out=%{output} deleted=%{deleted} expunged=%{expunged} trashed=%{trashed} hdr_count=%{fetch_hdr_count} hdr_bytes=%{fetch_hdr_bytes} body_count=%{fetch_body_count} body_bytes=%{fetch_body_bytes} imap_metadata = no imap_urlauth_host = imap_urlauth_logout_format = in=%{input} out=%{output} imap_urlauth_port = 143 imap_urlauth_stream_user = imap_urlauth_submit_user = imapc_cmd_timeout = 5 mins imapc_connection_retry_count = 1 imapc_connection_retry_interval = 1 secs imapc_connection_timeout_interval = 30 secs imapc_features = imapc_host = imapc_list_prefix = imapc_master_user = imapc_max_idle_time = 29 mins imapc_max_line_length = unlimited imapc_password = imapc_port = 143 imapc_rawlog_dir = imapc_sasl_mechanisms = imapc_ssl = no imapc_user = %{owner_user} imapsieve_expunge_discarded = no imapsieve_from_name = imapsieve_url = import_environment = inet_listener_haproxy = no inet_listener_name = inet_listener_port = 0 inet_listener_reuse_port = no inet_listener_ssl = no inet_listener_type = info_log_path = instance_name = dovecot language_default = no language_filter_normalizer_icu_id = Any-Lower; NFKD; [: Nonspacing Mark :] Remove; NFC; [\x20] Remove language_filter_stopwords_dir = /usr/share/dovecot/stopwords language_filters = normalizer-icu snowball stopwords language_name = language_tokenizer_address_token_maxlen = 250 language_tokenizer_generic_algorithm = simple language_tokenizer_generic_explicit_prefix = no language_tokenizer_generic_token_maxlen = 30 language_tokenizer_generic_wb5a = no language_tokenizers = generic email-address last_login_key = # hidden, use -P to show it last_login_precision = s last_valid_gid = 0 last_valid_uid = 0 lazy_expunge_mailbox = lazy_expunge_only_last_instance = no lda_mailbox_autocreate = yes lda_mailbox_autosubscribe = yes lda_original_recipient_header = X-Original-To ldap_auth_dn = ldap_auth_dn_password = ldap_auth_sasl_authz_id = ldap_auth_sasl_mechanisms = ldap_auth_sasl_realm = ldap_base = ldap_debug_level = 0 ldap_deref = never ldap_max_idle_time = 0 ldap_scope = subtree ldap_starttls = no ldap_timeout = 30 secs ldap_uris = ldap_version = 3 listen = lmtp_add_received_header = yes lmtp_client_workarounds = lmtp_hdr_delivery_address = final lmtp_proxy = no lmtp_proxy_rawlog_dir = lmtp_rawlog_dir = lmtp_rcpt_check_quota = no lmtp_save_to_detail_mailbox = no lmtp_user_concurrency_limit = 0 lock_method = fcntl log_core_filter = log_debug = log_path = syslog log_timestamp = "%b %d %H:%M:%S " login_log_format = %{message}: %{elements} login_log_format_elements = user=<%{user}> method=%{mechanism} rip=%{remote_ip} lip=%{local_ip} mpid=%{mail_pid} %{secured} session=<%{session}> login_plugin_dir = /usr/lib/dovecot/modules/login login_plugins = login_proxy_max_disconnect_delay = 0 login_proxy_max_reconnects = 3 login_proxy_notify_path = proxy-notify login_proxy_rawlog_dir = login_proxy_timeout = 30 secs login_socket_path = login_source_ips = login_trusted_networks = lua_file = lua_settings = mail_access_groups = mail_alt_path = mail_always_cache_fields = mail_attachment_detection_options = mail_cache_fields = mail_chroot = mail_compress_write_method = mail_control_path = mail_debug = no mail_driver = Maildir mail_ext_attachment_min_size = 128 k mail_ext_attachment_path = mail_fsync = optimized mail_full_filesystem_access = no mail_gid = vmail mail_home = /var/spool/dovecot/%{user|domain}/%{user|username}/home mail_inbox_path = mail_index_path = mail_index_private_path = mail_log_cached_only = no mail_log_events = mail_log_fields = mail_log_prefix = "%{service}(%{user})<%{process:pid}><%{session}>: " mail_max_lock_timeout = 0 mail_max_userip_connections = 10 mail_never_cache_fields = mail_nfs_index = no mail_nfs_storage = no mail_path = /var/spool/dovecot/%{user|domain}/%{user|username}/mail mail_plugin_dir = /usr/lib/dovecot/modules mail_plugins { acl = yes quota = yes fts = yes fts_flatcurve = yes quota_clone = yes } mail_prefetch_count = 0 mail_privileged_group = mail mail_server_admin = mailto:admin@<servername> mail_server_comment = mail_shared_explicit_inbox = no mail_sort_max_read_count = 0 mail_temp_dir = /tmp mail_temp_scan_interval = 1 weeks mail_uid = vmail mail_utf8_extensions = no mail_volatile_path = mail_vsize_bg_after_count = 0 mailbox_auto = no mailbox_autoexpunge = 0 mailbox_autoexpunge_max_mails = 0 mailbox_comment = mailbox_directory_name_legacy = yes mailbox_list_index = yes mailbox_list_index_include_inbox = no mailbox_list_index_prefix = dovecot.list.index mailbox_list_index_very_dirty_syncs = no mailbox_list_layout = fs mailbox_list_storage_escape_char = mailbox_list_visible_escape_char = mailbox_name = mailbox_notify_status = no mailbox_special_use = maildir_broken_filename_sizes = no maildir_copy_with_hardlinks = yes maildir_empty_new = no maildir_stat_dirs = no maildir_very_dirty_syncs = no managesieve_client_workarounds = managesieve_implementation_string = Dovecot Pigeonhole managesieve_logout_format = bytes=%{input}/%{output} managesieve_max_compile_errors = 5 managesieve_max_line_length = 64 k managesieve_notify_capability = managesieve_sieve_capability = mbox_dirty_syncs = yes mbox_dotlock_change_timeout = 2 mins mbox_lazy_writes = yes mbox_lock_timeout = 5 mins mbox_read_locks = mbox_very_dirty_syncs = no mbox_write_locks = mdbox_preallocate_space = no mdbox_rotate_interval = 0 mdbox_rotate_size = 10 M metric_description = metric_exporter = metric_exporter_include = metric_fields = metric_filter = metric_group_by_field = metric_group_by_method_discrete_modifier = metric_group_by_method_exponential_base = 10 metric_group_by_method_exponential_max_magnitude = 0 metric_group_by_method_exponential_min_magnitude = 0 metric_group_by_method_linear_max = 0 metric_group_by_method_linear_min = 0 metric_group_by_method_linear_step = 0 metric_group_by_method_method = discrete metric_name = mmap_disable = no mysql_client_flags = 0 mysql_connect_timeout = 5 secs mysql_connection_limit = 5 mysql_dbname = mysql_host = mysql_option_file = mysql_option_group = client mysql_password = mysql_port = 0 mysql_read_timeout = 30 secs mysql_ssl = no mysql_user = mysql_write_timeout = 30 secs namespace_alias_for = namespace_disabled = no namespace_hidden = no namespace_ignore_on_failure = no namespace_inbox = no namespace_list = yes namespace_name = namespace_order = 0 namespace_prefix = namespace_separator = namespace_subscriptions = yes namespace_type = private notify_status_value = {"messages":%{messages},"unseen":%{unseen}} oauth2_active_attribute = oauth2_active_value = oauth2_client_id = oauth2_client_secret = oauth2_fields = oauth2_force_introspection = no oauth2_grant_url = oauth2_introspection_mode = oauth2_introspection_url = oauth2_issuers = oauth2_openid_configuration_url = oauth2_scope = oauth2_send_auth_headers = no oauth2_tokeninfo_url = oauth2_use_worker_with_mech = no oauth2_username_attribute = email oauth2_username_validation_format = %{user} passdb_default_password_scheme = PLAIN passdb_deny = no passdb_driver = passdb_fields = passdb_fields_import_all = yes passdb_master = no passdb_mechanisms_filter = passdb_name = passdb_pam_failure_show_msg = no passdb_pam_max_requests = 100 passdb_pam_service_name = dovecot passdb_pam_session = no passdb_pam_setcred = no passdb_result_failure = continue passdb_result_internalfail = continue passdb_result_success = return-ok passdb_skip = never passdb_sql_query = passdb_sql_update_query = passdb_static_password = passdb_use_cache = yes passdb_use_worker = no passdb_username_filter = passwd_file_path = pop3_client_workarounds = pop3_delete_type = default pop3_deleted_flag = pop3_enable_last = no pop3_fast_size_lookups = no pop3_lock_session = no pop3_logout_format = top=%{top_count}/%{top_bytes}, retr=%{retr_count}/%{retr_bytes}, del=%{deleted_count}/%{deleted_bytes}, size=%{message_bytes} pop3_migration_all_mailboxes = no pop3_migration_ignore_extra_uidls = no pop3_migration_ignore_missing_uidls = no pop3_migration_mailbox = pop3_migration_skip_size_check = no pop3_migration_skip_uidl_cache = no pop3_no_flag_updates = no pop3_reuse_xuidl = no pop3_save_uidl = no pop3_uidl_duplicates = allow pop3_uidl_format = %{uid | hex(8)}%{uidvalidity | hex(8)} pop3c_features = pop3c_host = pop3c_master_user = pop3c_password = pop3c_port = 110 pop3c_quick_received_date = no pop3c_rawlog_dir = pop3c_ssl = no pop3c_ssl_verify = yes pop3c_user = %{user} postmaster_address = postmaster@%{user|domain|default(hostname)} process_shutdown_filter = protocols { imap = yes lmtp = yes sieve = yes } push_notification_driver = push_notification_name = push_notification_ox_cache_ttl = 1 mins push_notification_ox_url = push_notification_ox_user_from_metadata = no quota_clone_unset = no quota_driver = count quota_enforce = yes quota_exceeded_message = Quota exceeded (mailbox for user is full) quota_fs_message_limit = no quota_fs_mount_path = quota_fs_type = any quota_full_tempfail = yes quota_hidden = no quota_ignore = no quota_ignore_unlimited = no quota_imapc_mailbox_name = INBOX quota_imapc_root_name = quota_mail_size = unlimited quota_mailbox_count = unlimited quota_mailbox_message_count = unlimited quota_message_count = unlimited quota_message_percentage = 100 quota_name = quota_over_status_current = quota_over_status_lazy_check = no quota_over_status_mask = quota_status_nouser = REJECT Unknown user quota_status_overquota = 554 5.2.2 %{error} quota_status_success = OK quota_status_toolarge = quota_storage_extra = 0 quota_storage_grace = 10 M quota_storage_percentage = 100 quota_storage_size = 50M quota_warning_name = quota_warning_resource = storage quota_warning_threshold = over rawlog_dir = recipient_delimiter = + redis_db_id = 0 redis_expire = 0 redis_host = 127.0.0.1 redis_key_prefix = redis_password = redis_port = 6379 redis_request_timeout = 30 secs redis_socket_path = rejection_reason = Your message to <%{to}> was automatically rejected:%{literal('\r\n')}%{reason} rejection_subject = Rejected: %{subject} sendmail_path = /usr/sbin/sendmail service_chroot = service_client_limit = 0 service_drop_priv_before_exec = no service_executable = service_extra_groups = service_group = service_idle_kill_interval = 0 service_name = service_privileged_group = service_process_limit = 0 service_process_min_avail = 0 service_protocol = service_restart_request_count = unlimited service_type = service_user = service_vsz_limit = 0 shutdown_clients = yes sieve_duplicate_default_period = 12 hours sieve_duplicate_max_period = 2 days sieve_editheader_header_forbid_add = no sieve_editheader_header_forbid_delete = no sieve_editheader_header_name = sieve_editheader_max_header_size = 2 k sieve_enabled = yes sieve_environment = sieve_execute_bin_dir = sieve_execute_exec_timeout = 10 secs sieve_execute_input_eol = crlf sieve_execute_socket_dir = sieve_extensions { fileinto = yes reject = yes envelope = yes encoded-character = yes vacation = yes subaddress = yes comparator-i;ascii-numeric = yes relational = yes regex = yes imap4flags = yes copy = yes include = yes body = yes variables = yes enotify = yes environment = yes mailbox = yes date = yes index = yes ihave = yes duplicate = yes mime = yes foreverypart = yes extracttext = yes editheader = no spamtest = yes mboxmetadata = yes virustest = yes } sieve_filter_bin_dir = sieve_filter_exec_timeout = 10 secs sieve_filter_input_eol = crlf sieve_filter_socket_dir = sieve_global_extensions = sieve_implicit_extensions = sieve_include_max_includes = 255 sieve_include_max_nesting_depth = 10 sieve_max_actions = 32 sieve_max_cpu_time = 0 sieve_max_redirects = 4 sieve_max_script_size = 1 M sieve_notify_mailto_envelope_from = sieve_pipe_bin_dir = sieve_pipe_exec_timeout = 10 secs sieve_pipe_input_eol = crlf sieve_pipe_socket_dir = sieve_plugin_dir = /usr/lib/dovecot/modules/sieve sieve_plugins = sieve_quota_script_count = 0 sieve_quota_storage_size = 0 sieve_redirect_duplicate_period = 43200 sieve_redirect_envelope_from = sieve_report_from = sieve_resource_usage_timeout = 1 hours sieve_script_active_path = sieve_script_bin_path = sieve_script_cause = sieve_script_driver = file sieve_script_ldap_filter = sieve_script_ldap_modified_attribute = sieve_script_ldap_script_attribute = sieve_script_name = sieve_script_path = sieve_script_precedence = unlimited sieve_script_storage = sieve_script_type = personal sieve_spamtest_score_max_header = sieve_spamtest_score_max_value = sieve_spamtest_status_header = sieve_spamtest_status_type = score sieve_spamtest_text_value = sieve_trace_addresses = no sieve_trace_debug = no sieve_trace_dir = sieve_trace_level = none sieve_user_email = sieve_user_log_path = sieve_vacation_check_recipient = yes sieve_vacation_default_period = 1 weeks sieve_vacation_default_subject = sieve_vacation_default_subject_template = sieve_vacation_max_period = 60 days sieve_vacation_min_period = 1 days sieve_vacation_send_from_recipient = no sieve_vacation_to_header_ignore_envelope = no sieve_vacation_use_original_recipient = no sieve_variables_max_scope_count = 255 sieve_variables_max_value_size = 4 k sieve_virustest_score_max_header = sieve_virustest_score_max_value = sieve_virustest_status_header = sieve_virustest_status_type = score sieve_virustest_text_value = sql_driver = mysql ssl = yes ssl_cipher_list = ALL:!kRSA:!SRP:!kDHd:!DSS:!aNULL:!eNULL:!EXPORT:!DES:!3DES:!MD5:!PSK:!RC4:!ADH:!LOW@STRENGTH:!AECDH:!RC4-SHA:!SHA1 ssl_cipher_suites = ssl_client_ca_dir = ssl_client_ca_file = ssl_client_cert_file = ssl_client_key_file = ssl_client_key_password = ssl_client_require_valid_cert = yes ssl_crypto_device = ssl_curve_list = ssl_min_protocol = TLSv1.2 ssl_options = ssl_server_alt_cert_file = ssl_server_alt_key_file = ssl_server_ca_file = ssl_server_cert_file = ssl_server_cert_username_field = commonName ssl_server_dh_file = ssl_server_key_file = ssl_server_key_password = ssl_server_prefer_ciphers = client ssl_server_request_client_cert = no ssl_server_require_crl = yes stats_writer_socket_path = stats-writer submission_add_received_header = yes submission_backend_capabilities = submission_client_workarounds = submission_host = submission_logout_format = in=%{input} out=%{output} submission_max_mail_size = 0 submission_max_recipients = 0 submission_relay_command_timeout = 5 mins submission_relay_connect_timeout = 30 secs submission_relay_host = submission_relay_master_user = submission_relay_max_idle_time = 29 mins submission_relay_password = submission_relay_port = 25 submission_relay_rawlog_dir = submission_relay_ssl = no submission_relay_ssl_verify = yes submission_relay_trusted = no submission_relay_user = submission_ssl = no submission_timeout = 30 secs syslog_facility = mail textcat_config_path = trash_priority = 0 unix_listener_group = unix_listener_mode = 0600 unix_listener_path = unix_listener_type = unix_listener_user = userdb_driver = userdb_fields = userdb_fields_import_all = yes userdb_name = userdb_result_failure = continue userdb_result_internalfail = continue userdb_result_success = return-ok userdb_skip = never userdb_sql_iterate_query = userdb_sql_query = userdb_static_allow_all_users = no userdb_use_cache = yes userdb_use_worker = no valid_chroot_dirs = verbose_proctitle = no version_ignore = no virtual_max_open_mailboxes = 64 welcome_wait = no mysql localhost { dbname = sys_mail password = # hidden, use -P to show it ssl = no user = sys_dovecot } userdb sql { iterate_query = SELECT username AS user FROM mailbox query = SELECT CONCAT('/var/spool/dovecot/',maildir,'mail') AS mail_path, CONCAT('/var/spool/dovecot/',maildir) AS home, 5000 AS uid, 5000 AS gid, CONCAT(quota,'B') AS quota_storage_size FROM mailbox WHERE username = '%{user|lower}' } passdb pam { default_password_scheme = CRYPT service_name = dovecot skip = authenticated } namespace inbox { inbox = yes separator = / type = private mailbox Drafts { auto = subscribe special_use = "\\Drafts" } mailbox Junk { auto = subscribe special_use = "\\Junk" } mailbox Trash { auto = subscribe special_use = "\\Trash" quota_storage_percentage = 110 } mailbox Sent { auto = subscribe special_use = "\\Sent" } mailbox "Sent Messages" { auto = no special_use = "\\Sent" } } namespace shared { mail_driver = maildir mail_index_path = /var/spool/dovecot/%{user|domain}/%{user|username}/sharedmailboxes/%{owner_user|domain}/%{owner_user|username} mail_path = /var/spool/dovecot/%{owner_user|domain}/%{owner_user|username}/mail list = children prefix = shared/$user/ separator = / type = shared } service imap-login { inet_listener imap { listen = 127.0.0.1 } inet_listener imaps { } } service lmtp { unix_listener lmtp { } } service auth { unix_listener auth-userdb { group = vmail mode = 0600 user = vmail } unix_listener /var/spool/postfix/private/auth { group = mail mode = 0666 user = postfix } } service auth-worker { user = $SET:default_internal_user } service dict { unix_listener dict { group = vmail mode = 0600 user = vmail } } service imap-hibernate { unix_listener imap-hibernate { group = vmail mode = 0660 user = dovecot } } service imap { unix_listener imap-master { user = dovecot } } ssl_server { cert_file = /etc/letsencrypt/live/<Servername>.de/fullchain.pem dh_file = /etc/dovecot/dh.pem key_file = /etc/letsencrypt/live/<Servername>.de/privkey.pem prefer_ciphers = server } protocol lda { mail_plugins { sieve = yes } } protocol imap { mail_max_userip_connections = 30 mail_plugins { imap_sieve = yes imap_quota = yes imap_acl = yes imap_zlib = no } } protocol lmtp { auth_username_format = %{user | username | lower} mail_plugins { sieve = yes } } service managesieve-login { process_min_avail = 1 restart_request_count = 1 vsz_limit = 64M inet_listener sieve { port = 4190 listen = 127.0.0.1 } } service managesieve { process_limit = 1024 } protocol sieve { mail_max_userip_connections = 10 managesieve_max_line_length = 65536 } dict_server { dict mysql { driver = sql hostname = localhost sql_driver = mysql ssl = no dict_map priv/quota/storage { sql_table = quota2 username_field = username dict_map_value_field bytes { type = uint } } dict_map priv/quota/messages { sql_table = quota2 username_field = username dict_map_value_field messages { type = uint } } dict_map "shared/shared-boxes/user/$to/$from" { sql_table = user_shares dict_map_value_field dummy { } dict_map_key_field from_user { value = $from } dict_map_key_field to_user { value = $to } } dict_map "shared/shared-boxes/anyone/$from" { sql_table = anyone_shares dict_map_value_field dummy { } dict_map_key_field from_user { value = $from } } } } acl_sharing_map { dict proxy { name = mysql } } language en { filters = lowercase snowball english-possessive stopwords } language de { default = yes filters = snowball stopwords normalizer-icu } fts flatcurve { substring_search = yes } quota "User quota" { driver = count storage_grace = 10M quota_warning warn-100 { quota_storage_percentage = 100 execute quota-full { args = 100 %{user} } } quota_warning warn-95 { quota_storage_percentage = 95 execute quota-warning { args = 95 %{user} } } quota_warning warn-80 { quota_storage_percentage = 80 execute quota-warning { args = 80 %{user} } } } service quota-warning { executable = script /usr/local/bin/quota-warning.sh unix_listener quota-warning { user = vmail } } service quota-full { executable = script /usr/local/bin/quota-warning-full.sh unix_listener quota-full { user = vmail } } quota_clone { dict proxy { name = mysql } } sieve_script personal { active_path = /var/spool/dovecot/%{user|domain}/%{user|username}/sieve/.dovecot.sieve driver = file path = /var/spool/dovecot/%{user|domain}/%{user|username}/sieve } sieve_script default { driver = file name = default path = /var/spool/dovecot/sieve/default.sieve type = default } service indexer-worker { executable = /usr/bin/nice -n 10 /usr/lib/dovecot/indexer-worker process_limit = 1 user = vmail }

2 2

time diff miscalculation on 32-bit systems
by Andy Spiegl 06 Jan '26

06 Jan '26

Dear dovecot team, I believe I found a bug in dovecot on 32-bit systems. Dovecot version: 1:2.4.1+dfsg1-6 (Architecture: i386) Operating system: Linux lar 6.13.7-64+ #1 SMP PREEMPT Fri Mar 21 08:33:47 MEZ 2025 x86_64 GNU/Linux Distributor ID: Debian Description: Debian GNU/Linux 13 (trixie) Release: 13 Codename: trixie * What led up to the situation? Upgrade from 2.3.21.1 to 1:2.4.1 * What was the outcome of this action? Logs are flooded with messages "Warning: Time moved forward" * Problem Description: The function io_loop_get_wait_time in ioloop.c contains the line: ioloop->next_max_time.tv_sec = (1ULL << (TIME_T_MAX_BITS-1)) - 1; On 32-bit systems TIME_T_MAX_BITS is 31 such that the result of this calculation is 1073741823. Far from the intended "infinity" and even before "now". This leads to problems in the function io_loop_handle_timeouts_real: the calculation of the time difference between now and next_max_time is then something like -693628953 seconds which confuses dovecot and floods the logs with these warnings: Jan 02 17:43:43 lmtp(38364): Warning: Time moved forward 693630400.301863 seconds Jan 02 17:43:43 lmtp(38364): Warning: Time moved forward 693630400.304144 seconds Jan 02 17:45:43 lmtp(38364): Warning: Time moved forward 693630520.416053 seconds * Possible solution/workaround ? ioloop->next_max_time.tv_sec = INT_MAX; Thanks for your consideration, Andy

2 1