Hi, I please need help. Dovecot 2.4.1-4 (docker-mailserver 16.0.1), Maildir, passwd-file for both passdb and userdb.

Config: mail_plugins = mail_crypt mail_attribute { dict file { path = %{home}/Maildir/dovecot-attributes } } crypt_user_key_curve = secp521r1 crypt_user_key_require_encrypted = yes

I also added a second passdb in Lua that returns the login password as a sha256 hex string: passdb passdb-default { result_success = continue-ok } passdb lua { lua_file = /etc/dovecot/lua/crypt.lua skip = unauthenticated use_worker = yes } The Lua script returns PASSDB_RESULT_OK with: { noauthenticate = "yes", userdb_crypt_user_key_password = <sha256 hex> }

What I have verified so far: doveadm auth login lists crypt_user_key_password under "userdb extra fields", so the field reaches userdb. With crypt_user_key_require_encrypted = no and the attributes file removed, an IMAP login auto-creates a user key. That key is unencrypted. With crypt_user_key_require_encrypted = yes and the attributes file removed, no key is created. IMAP logs: dict(file): stat(.../Maildir/dovecot-attributes) failed: No such file or directory So I generated the key manually: doveadm -o crypt_user_key_password=<sha256 hex>
mailbox cryptokey generate -u user@example.com -Uf This succeeded. The new key is active, the old one shows as inactive, and the attributes file grew from 2280 to 3147 bytes. Now incoming mail is stored encrypted, the files start with CRYPTED. However, this still returns the headers in clear text, without any password and without error: doveadm fetch -u user@example.com hdr mailbox INBOX So the key appears to be usable without the password at all.

My main question is: Does -o crypt_user_key_password actually encrypt the user key when it is generated, or is it only used to unlock an already encrypted key? Related to that: Can an old inactive user key still be used for decryption in this setup? Is there any marker that indicates in the attributes dict whether a user key is password-encrypted? With passwd-file as userdb (no prefetch), should an extra field from a passdb reach the IMAP process that creates or loads the key?

Any pointers apreciated. Best regards, Twinsen