June 2014 - dovecot - dovecot.org

Re: question on lmtp logged message
by Leonardo Rodrigues 27 Jun '14

27 Jun '14

Hi Steffen, Em 26/06/14 11:06, Steffen Kaiser escreveu: > > maildir_copy_with_hardlinks is set on my server, too. It's the default > now. I do not see these errors. > > Can you check if the failed recipient is _never_ the first one? I > remember some discussions about that the Dovecot LDA has to re-open > the storred message of the first recipient, in order to spool it for > the other ones. That caused problems because the server used an > user-specific encryption key. > > If that applies to LMTP, too, this might become problematic, if the > first recipient deletes the message very quickly. Therefore my > question, if the error pops up for the second recipient and maybe all > following ones. Just did some more scripting and got a total of 1413 distinct emails (distinct queueids) that suffered from this 'message was expunged' problem on the 36 hours i got the problems. As noted before, not even a single one of these 1413 were nrcpt=1. Problems were from nrcpt=2 or greater. So, whatever this is, it really seems to NOT affect single recipient messages. As you suspected, on those 1413 the very first recipient ALWAYS got a status=sent from dovecot/lmtp. "Message was expunged" never happened on the very first recipient delivery. About the first user (the first delivered message) checking the message right after delivery, i tried to confirm that by the logs. To make things a little easier, i used nrcpt=2 and nrcpt=3 situations, just to avoid posting lots of logs here. Case #1 1st recipient delivery OK, failed on 2nd recipient, just delivered successfully on 2nd try Jun 25 17:08:53 correio postfix/qmgr[3059]: 2AFA01BF7496F: from=<alejandro.miguel(a)domain.com.br>, size=49366, nrcpt=2 (queue active) Jun 25 17:09:52 correio postfix/lmtp[6029]: 2AFA01BF7496F: to=<fabio.kado(a)domain.com.br>, relay=correio.domain.com.br[private/dovecot-lmtp], delay=59, delays=0.01/47/0/12, dsn=2.0.0, status=sent (250 2.0.0 <fabio.kado(a)domain.com.br> UbjnEywqq1MTPwAAHvf8vg Saved) Jun 25 17:09:55 correio postfix/lmtp[6029]: 2AFA01BF7496F: to=<marcelo.roberto(a)domain.com.br>, relay=correio.domain.com.br[private/dovecot-lmtp], delay=63, delays=0.01/47/0/16, dsn=4.2.0, status=deferred (host correio.domain.com.br[private/dovecot-lmtp] said: 451 4.2.0 <marcelo.roberto(a)domain.com.br> Message was expunged (received-date) (in reply to end of DATA command)) Jun 25 17:24:11 correio postfix/lmtp[26595]: 2AFA01BF7496F: to=<marcelo.roberto(a)domain.com.br>, relay=correio.domain.com.br[private/dovecot-lmtp], delay=918, delays=908/0/0/10, dsn=2.0.0, status=sent (250 2.0.0 <marcelo.roberto(a)domain.com.br> hWS4JMorq1OIdAAAHvf8vg Saved) and in fact the first recipient was checking its email during the LMTP delivery. This is the actual order of the logs: Jun 25 17:09:47 correio dovecot: pop3-login: Login: user=<fabio.kado(a)domain.com.br>, method=PLAIN, rip=10.253.x.x, lip=10.252.x.x, mpid=21164 Jun 25 17:09:52 correio postfix/lmtp[6029]: 2AFA01BF7496F: to=<fabio.kado(a)domain.com.br>, relay=correio.domain.com.br[private/dovecot-lmtp], delay=59, delays=0.01/47/0/12, dsn=2.0.0, status=sent (250 2.0.0 <fabio.kado(a)domain.com.br> UbjnEywqq1MTPwAAHvf8vg Saved) Jun 25 17:09:52 correio dovecot: pop3(fabio.kado(a)domain.com.br), rip=10.253.x.x, lip=10.252.x.x: Disconnected: Logged out top=0/0, retr=1/49582, del=1/1, size=49550 and by the size= of the 'disconnected' pop3 log (size=49550) and the size from qmgr (size=49366), user really seems to have checked (and deleted after that) exactly the message right BEFORE the 2nd recipient delivery was tried by LMTP Case #2 1st and 2nd recipient delivery OK, failed on 3rd recipient, just delivered successfully on 2nd try Jun 25 10:00:31 correio postfix/qmgr[804]: EFEB31A4BB227: from=<andrei.lunkes(a)domain.com.br>, size=26667, nrcpt=3 (queue active) Jun 25 10:00:47 correio postfix/lmtp[6549]: EFEB31A4BB227: to=<marcos.pereira(a)domain.com.br>, relay=correio.domain.com.br[private/dovecot-lmtp], delay=16, delays=0/0/0/16, dsn=2.0.0, status=sent (250 2.0.0 <marcos.pereira(a)domain.com.br> uTsNO+/HqlOHGQAAHvf8vg Saved) Jun 25 10:00:54 correio postfix/lmtp[6549]: EFEB31A4BB227: to=<mario.cabreira(a)domain.com.br>, relay=correio.domain.com.br[private/dovecot-lmtp], delay=22, delays=0/0/0/22, dsn=2.0.0, status=sent (250 2.0.0 <mario.cabreira(a)domain.com.br> uTsNO+/HqlOHGQAAHvf8vg Saved) Jun 25 10:00:55 correio postfix/lmtp[6549]: EFEB31A4BB227: to=<wellington.camargo(a)domain.com.br>, relay=correio.domain.com.br[private/dovecot-lmtp], delay=24, delays=0/0/0/24, dsn=4.2.0, status=deferred (host correio.domain.com.br[private/dovecot-lmtp] said: 451 4.2.0 <wellington.camargo(a)domain.com.br> Message was expunged (received-date) (in reply to end of DATA command)) Jun 25 10:03:57 correio postfix/lmtp[7312]: EFEB31A4BB227: to=<wellington.camargo(a)domain.com.br>, relay=correio.domain.com.br[private/dovecot-lmtp], delay=205, delays=202/1/0/2.2, dsn=2.0.0, status=sent (250 2.0.0 <wellington.camargo(a)domain.com.br> j1dRAU/IqlN6QAAAHvf8vg Saved) 1st recipient in fact checked email (and deleted the message) right after the delivery. Actual log sequence is: Jun 25 10:00:40 correio dovecot: pop3-login: Login: user=<marcos.pereira(a)domain.com.br>, method=PLAIN, rip=10.253.22.56, lip=10.252.38.2, mpid=7233 Jun 25 10:00:47 correio postfix/lmtp[6549]: EFEB31A4BB227: to=<marcos.pereira(a)domain.com.br>, relay=correio.domain.com.br[private/dovecot-lmtp], delay=16, delays=0/0/0/16, dsn=2.0.0, status=sent (250 2.0.0 <marcos.pereira(a)domain.com.br> uTsNO+/HqlOHGQAAHvf8vg Saved) Jun 25 10:00:48 correio dovecot: pop3(marcos.pereira(a)domain.com.br), rip=10.253.22.56, lip=10.252.38.2: Disconnected: Logged out top=0/0, retr=1/26872, del=1/1, size=26849 2nd recipient did NOT checked email near the delivery Jun 25 09:54:08 correio dovecot: pop3-login: Login: user=<mario.cabreira(a)domain.com.br>, method=PLAIN, rip=10.253.22.72, lip=10.252.38.2, mpid=29125 Jun 25 09:54:12 correio dovecot: pop3(mario.cabreira(a)domain.com.br), rip=10.253.22.72, lip=10.252.38.2: Disconnected: Logged out top=0/0, retr=11/1408320, del=11/11, size=1408058 Jun 25 10:06:49 correio dovecot: pop3-login: Login: user=<mario.cabreira(a)domain.com.br>, method=PLAIN, rip=10.253.22.72, lip=10.252.38.2, mpid=13391 Jun 25 10:06:50 correio dovecot: pop3(mario.cabreira(a)domain.com.br), rip=10.253.22.72, lip=10.252.38.2: Disconnected: Logged out top=0/0, retr=10/1923222, del=10/10, size=1923004 this is interesting ... logs seems to show clearly that right after the message was delivered to the 1st recipient, it was checked and deleted. Despite of that, 2nd recipient got the message successfully delivered. But we have also a delay=22 ... maybe lmtp instance had already opened the message BEFORE it was erased by the 1st user ? this delay is high, i know that and, usually, server do NOT suffer from this delays on deliveries. Anyway, during this problem period, queues were pretty large and, thus, load was very high, which i think explains this unusual delays. With these two cases, it really seems that this is somehow related to: - lmtp as delivery agent - multiple recipient messages - first (or previous users in fact) checked and deleted the message before all the recipients got the message delivery About the two parameters, maildir_copy_with_hardlinks and pop3_fast_size_lookups, i'll try to change them one at a time and try to reproduce the problems. Fact is i only had the problem with both set to yes and problems were completly vanished when both were set to no. -- Atenciosamente / Sincerily, Leonardo Rodrigues Solutti Tecnologia http://www.solutti.com.br Minha armadilha de SPAM, NÃO mandem email gertrudes(a)solutti.com.br My SPAMTRAP, do not email it

1 0

quota warning configuration problem
by Przemysław Orzechowski 27 Jun '14

27 Jun '14

Hi Im trying to setup automatic quota warning in dovecot but somehow cant get it to work Quota usage is displayed properly in roundcube so quota plugin is working. But somehow i cant get quota warning to work my dovecot is 2.2.9 (stock version in ubuntu) doveconf -n output in attached file dovecot-quota-warning-sh is as found in wiki Best regards Przemysław Orzechowski

2 2

RE: quota warning configuration problem
by ihab_mishriki 26 Jun '14

26 Jun '14

Hello I faced the problem but try to stop mail debug conf from devcot.conf -------- Original message -------- From: Przemysław Orzechowski <przemek.orzechowski(a)makolab.pl> Date:26/06/2014 17:53 (GMT+02:00) To: dovecot(a)dovecot.org Subject: quota warning configuration problem Hi Im trying to setup automatic quota warning in dovecot but somehow cant get it to work Quota usage is displayed properly in roundcube so quota plugin is working. But somehow i cant get quota warning to work my dovecot is 2.2.9 (stock version in ubuntu) doveconf -n output in attached file dovecot-quota-warning-sh is as found in wiki Best regards Przemysław Orzechowski

2 1

Re: question on lmtp logged message
by Leonardo Rodrigues 26 Jun '14

26 Jun '14

Em 26/06/14 03:32, Steffen Kaiser escreveu: > > On Wed, 25 Jun 2014, Leonardo Rodrigues wrote: > >> Anyway, sometimes LMTP seems to not be able to deliver some >> messages and keep them on postfixqueue. And on the next or third try, >> the message gets delivered successfully. The logged message, however, >> is not helping me identify what is happening.Example: >> >> (error - message was expunged) >> Jun 25 11:49:39 correio postfix/lmtp[21835]: ADB0A1AC05108: >> to=<vanilson.parreira(a)domain.com.br>, >> relay=correio.domain.com.br[private/dovecot-lmtp], conn_use=6, >> delay=13, delays=0.07/0/0/13, dsn=4.2.0, status=deferred (host >> correio.domain.com.br[private/dovecot-lmtp] said: 451 4.2.0 >> <vanilson.parreira(a)domain.com.br> Message was expunged >> (received-date) (in reply to end of DATA command)) > > What does the Dovecot log says for the delivery attempt? exactly what's reported by postfix, no extra information there Jun 25 11:49:39 correio dovecot: lmtp(766, vanilson.parreira(a)domain.com.br) 645hNV7hqlP+AgAAHvf8vg: msgid=<F12DAC80721942C1842481355A0D08F8(a)corporate.ad>: save failed to INBOX: Message was expunged (received-date) > How many recipients does the message has and, if so, what about the > other recipients? > After analyzing lots of cases (made a script for doing that), this seems to occur only on messages with more than 1 recipient, usually on messages with lots of recipients (>10) altough i got some on messages with 2 or 3. Some days ago, when trying to optimize somethings on the server, i changed two dovecot parameters: maildir_copy_with_hardlinks to yes pop3_fast_size_lookups to yes previously, both were no. I have returned both values to 'no' and this situation, 'message was expunged' seems to not be occurring anymore. Can this behavior by any chance related to these settings ? -- Atenciosamente / Sincerily, Leonardo Rodrigues Solutti Tecnologia http://www.solutti.com.br Minha armadilha de SPAM, NÃO mandem email gertrudes(a)solutti.com.br My SPAMTRAP, do not email it

2 1

imap/pop3/lmtp proxy question/problem
by Jogi Hofmüller 25 Jun '14

25 Jun '14

Dear list, We are finally back to our task of migrating from cyrus to dovecot. dovecot mostly does what we want in terms of POP3/IMAP server. Now we are preparing for migration. The plan is to use dovecot as proxy for not-yet migrated accounts. This works wonderfully for IMAP but not for LMTP. Here's what I find in the logs when I try to deliver e-mail to the dovecot lmtp port: Jun 25 19:03:06 klee dovecot: lmtp(5037): Debug: none: root=, index=, indexpvt=, control=, inbox=, alt= Jun 25 19:03:06 klee dovecot: lmtp(5037): Connect from IP-address Jun 25 19:03:06 klee dovecot: lmtp(5037): Debug: user USER: Auth PASS lookup returned temporary failure: reason=Configured passdbs don't support crentials lookups Jun 25 19:03:06 klee dovecot: lmtp(5037): Debug: auth input: reason=Configured passdbs don't support crentials lookups Delivery works fine without proxy (lmtp_proxy = no). What I would need to do is to configure the proxy part so that POP3/IMAP uses the accounts username/password and LMTP uses a special account to deliver e-mail. This is dovecot-ldap.auth (the =proxy=y will be replaced by a field from ldap once the tests work): uris = ldaps://our.ldap.server/ tls = no auth_bind = yes base = dc=mur,dc=at deref = never scope = subtree user_attrs = =home=/srv/vmail/mail/%Lu,=uid=999,=gid=999 user_filter = (&(objectClass=posixAccount)(uid=%u)) pass_attrs = uid=user,userPassword=password,=proxy=y,=host=our.imap.server,=starttls=yes iterate_attrs = uid=user iterate_filter = (objectClass=posixAccount) dovecot -n # 2.2.13: /etc/dovecot/dovecot.conf # OS: Linux 3.14-1-amd64 x86_64 Debian jessie/sid auth_verbose = yes disable_plaintext_auth = no lmtp_proxy = yes login_greeting = Dovecot is spitze! mail_debug = yes mail_location = maildir:/srv/vmail/mail/%u mail_plugins = acl namespace { hidden = no inbox = no list = children location = maildir:/srv/vmail/mail/%%u:INDEX=/srv/vmail/mail/%u/shared/%%u prefix = shared.%%u. separator = . subscriptions = yes type = shared } namespace inbox { hidden = no ignore_on_failure = no inbox = yes list = yes location = mailbox Drafts { auto = subscribe special_use = \Drafts } mailbox Junk { auto = subscribe special_use = \Junk } mailbox Sent { auto = subscribe special_use = \Sent } mailbox Trash { auto = subscribe special_use = \Trash } prefix = INBOX. separator = . subscriptions = yes type = private } passdb { args = /etc/dovecot/dovecot-ldap.conf.ext driver = ldap } plugin { acl = vfile acl_shared_dict = file:/var/lib/dovecot/db/shared-mailboxes.db sieve = ~/.dovecot.sieve sieve_dir = ~/sieve } protocols = " imap lmtp pop3" service auth { unix_listener auth-userdb { group = vmail user = vmail } } service lmtp { inet_listener lmtp { address = 172.16.16.78 port = 24 } user = vmail } ssl_cert = </etc/dovecot/server.pem ssl_key = </etc/dovecot/private/server.pem userdb { driver = prefetch } userdb { args = /etc/dovecot/dovecot-ldap.conf.ext driver = ldap } protocol lmtp { mail_plugins = acl quota sieve postmaster_address = postmaster(a)mur.at } protocol imap { mail_plugins = acl imap_acl } Regards, -- j.hofmüller Gerüchtegenerator http://plagi.at/geruecht

1 0

sievec drops privileges unexpectedly
by Matthijs Kooijman 25 Jun '14

25 Jun '14

(Please keep me CC'd, I'm not subscribed) Hi folks, I'm using dovecot 2.1.7 (from Debian stable) with sieve. I have default sieve script configured, which lives in /etc/dovecot/sieve. I use dovecot-lda running under the virtual-mail user, which does not have write access to the /etc/dovecot/sieve directory. Now, when a mail gets delivered, I get the following message in my logs. Jun 25 14:29:43 mail dovecot: lda(2001): Error: sieve: binary save: failed to create temporary file: open(/etc/dovecot/sieve/default.svbin.mail.local.18902.) failed: Permission denied (euid=2009(virtual-mail) egid=2009(virtual-mail) missing +w perm: /etc/dovecot/sieve, dir owned by 0:0 mode=0755) Jun 25 14:29:43 mail dovecot: lda(2001): Error: sieve: the lda sieve plugin does not have permission to save global sieve script binaries; global sieve scripts like /etc/dovecot/sieve/default need to be pre-compiled using the sievec tool Due to the lack of permissions, this is of course expected. However, when I then try to precompile the script using sievec, that also fails: # sievec /etc/dovecot/sieve/default sievec(root): Error: sieve: binary save: failed to create temporary file: open(/etc/dovecot/sieve/default.svbin.mail.local.18952.) failed: Permission denied (euid=2009(virtual-mail) egid=2009(virtual-mail) missing +w perm: /etc/dovecot/sieve, dir owned by 0:0 mode=0755) So, apparently sievec drops privileges to the virtual-mail user. Why does this happen? It seems kind of counter-productive - I don't see a way to properly run sievec as root now? How is this supposed to work? Now I wrote this, I realized that it might be related that I have specified mail_uid and mail_gid globally in my dovecot.conf file. Perhaps those are intended to only be put inside the protocol imap and protocol lda blocks? This would mean duplicating of this bit of configuration, which doesn't really sound nice. Gr. Matthijs PS, here's my dovecot -n output: # 2.1.7: /etc/dovecot/dovecot.conf # OS: Linux 3.10-1-amd64 x86_64 Debian 7.5 log_timestamp = "%Y-%m-%d %H:%M:%S " mail_access_groups = spamd-access mail_debug = yes mail_gid = virtual-mail mail_location = Maildir:~/Folders:INBOX=~/INBOX:LAYOUT=fs mail_uid = virtual-mail managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date ihave passdb { args = /etc/dovecot/dovecot-ldap.conf driver = ldap } plugin { antispam_backend = pipe antispam_pipe_program = /usr/bin/spamc antispam_pipe_program_args = --socket=/var/run/spamd.socket antispam_pipe_program_notspam_arg = --learntype=ham antispam_pipe_program_spam_arg = --learntype=spam antispam_spam = Spam antispam_trash_pattern_ignorecase = trash;Deleted *;Prullenbak;Verwijderde * sieve = ~/sieve sieve_dir = ~/sieve.d sieve_global_path = /etc/dovecot/sieve/default } protocols = imap sieve service auth { unix_listener auth-client { group = Debian-exim mode = 0600 user = Debian-exim } unix_listener auth-master { group = virtual-mail mode = 0600 user = virtual-mail } user = nobody } ssl_cert = <ssl/mail.tikatika.nl.crt-chain ssl_key = <ssl/mail.tikatika.nl.key userdb { args = home=/data/mail/%u allow_all_users=yes uid=virtual-mail gid=virtual-mail driver = static } protocol imap { mail_plugins = antispam } protocol lda { lda_mailbox_autocreate = yes lda_mailbox_autosubscribe = yes mail_plugins = sieve postmaster_address = }

2 2

Remove all messages in a mailbox
by Murray Trainer 25 Jun '14

25 Jun '14

Hi All, I am having trouble removing all messages in a mailbox. The command below doesn't remove all the messages: doveadm expunge -u user@domain mailbox '*' all Do I need to add .* or other? THanks Murray

2 1

ot: accepting self certs into win pc?
by voytek＠sbt.net.au 24 Jun '14

24 Jun '14

few month ago, I've got a new Dovecot/Postfix server with self issued certificate (like the previous server), transferred users, all went well EXCEPT for one user on Win/Outlook (or Outlook Express) who tells me his new PC 'doesn't want to accept certificate' (sorry, I'm short on exact details at this time) I need to get it sorted out, I expect it 'should just work' like it did for other users, BUT, before I start looking, trying to 'educate myself' better if any one has any pointers, dos or don't regarding win email clients with self certified server, pls point me that way is using IE with www.dom.com/mycert.crt good point to start ? (after copying mycer.crt to web linked directory first?) thanks, V

7 17

Wheezy Dovecot workarounds
by Steve Litt 24 Jun '14

24 Jun '14

Hi all, In switching from Ubuntu to Debian Wheezy (7.5 64bit, network install), I'm finding some surprises in getting Dovecot to work. PROBLEM: As installed, the package manager doesn't give you the dovecot executable. WORKAROUND: To install the dovecot executable, you need to follow these instructions: http://wiki2.dovecot.org/HowTo/DebianStable PROBLEM: Even when you install Dovecot, it doesn't work, as evidenced by the inability of a local email client to talk to it. Further elements of the symptom are that nmap -A -T4 LocalIPAddress, whether LocalIPAddress is the IP of eth0, or 127.0.0.1, fails to find any open ports. Telnet can't operate dovecot at port 143, and openssl can't operate it at 993. However, bizarrly, executing these same commands on a remote machine into the original machine (including accessing the machine's Dovecot from an email client) work perfectly. WORKAROUND To "solve" this problem, do the following raindance as root: ifdown lo ifup lo After the raindance, local access to Dovecot works perfectly, and all nmap commands perform as expected. LOL, hey man, don't shoot me, I'm just the messenger. SteveT Steve Litt * http://www.troubleshooters.com/ Troubleshooting Training * Human Performance

4 3

Mangesieve security question
by Vijay Rajah 24 Jun '14

24 Jun '14

Hello, I have a dovecot 2.2.6 on a Linux platform. I have configured manageseive extension. I have opened the manageseive port (4190) to entire world. (since I need my thunderbird and other clients to create seive scripts). I just wanted to know if it is ok to open that port to everyone, and get some feedback on some security measures specific to manageseive. -Thanks in advance Vijay PS: I have taken reasonable server hardening measures. This question is specific to manageseive.

2 1