January 2017 - dovecot

Re: dovecot-pigeonhole running external script ends with signal 11
by Stephan Bosch 10 Jan '17

10 Jan '17

Op 1/8/2017 om 10:00 AM schreef Tobi: > Hi Stephan > > according to ps aux the process that segfaults is (pid 18261) > > vmail 18261 0.0 0.0 0 0 pts/0 Z 09:39 0:00 [lmtp] > <defunct> > > the gdb backtrace I attached to my mail was the deepest one I got That looks like it happens in Dovecot still. > @Steffen > the script does not chroot, at least not that I'm aware of. I checked my > dovecot configs and could not find any active chroot config. All > occurences of mail_chroot are commented out and have no path values. What about the version information I asked about? Regards, Stephan. > Am 06.01.2017 um 00:04 schrieb Stephan Bosch: >> Op 1/4/2017 om 9:37 AM schreef Tobi: >>> Hi Aki >>> >>> yes I built dovecot and pigeonhole rpms in the same rpmbuild. pigeonhole >>> rpm is based on 0.4.14 >>> Do you think that the error might come from self building the rpms? >> But what version of Pigeonhole are you actually using? Version 0.4.16 is >> released for Dovecot v2.2.26. >> >> Also: >> >> - Can you find out which process is getting the segfault? GDB shows the >> pid and you should lookup what process that is while GDB is still active. >> - Isn't that GDB backtrace you provided deeper? It shows only two >> levels, but that makes no sense (i.e. main() is not listed). >> >> Regards, >> >> Stephan. >>

4 4

Virtual POP3 namespaces and quota-status
by Aurélien Beaujean 09 Jan '17

09 Jan '17

Hi, I've tried to do configure Virtual POP3 INBOX (dovecot version 2.2.18) as explained here http://wiki.dovecot.org/Plugins/Virtual with a static userdb and nopassword=y so I dont have any database on the dovecot server without the possibility to distinguish POP3 or IMAP in the userdb extra field to change the namespace on the fly. So I've put the namespace virtual informations inside the protocol pop3 { ... }, I did the same for the protocol imap { }: protocol pop3 { mail_plugins = $mail_plugins last_login virtual namespace inbox { prefix = separator = / list = yes } namespace virtual { inbox = yes prefix = virtual/ separator = / location = virtual:/etc/dovecot/virtual:INDEX=MEMORY list = no hidden = yes } namespace real { prefix = RealMails/ separator = / list = no hidden = yes } } protocol imap { mail_plugins = $mail_plugins imap_quota last_login namespace inbox { inbox = yes } } protocol lda { mail_plugins = " quota sieve" namespace inbox { inbox = yes } } passdb { args = nopassword=y uid=vmail gid=vmail home=/var/mail/%2Mn/%2.2Mn/%n driver = static } userdb { args = nopassword=y uid=vmail gid=vmail home=/var/mail/%2Mn/%2.2Mn/%n driver = static } service quota-status { executable = quota-status -p postfix inet_listener { port = 12340 } process_min_avail = 8 } But the service quota-status getting lost with a message: namespace configuration error: inbox=yes namespace missing I didn't find a way to tell quota-status which namespace to use as you can't setup a default one. If I declare a "global" namespace inbox pop3 deamon fails because of duplicated namespace inbox in the configuration files: pop3(xxx): Error: User initialization failed: namespace configuration error: There can be only one namespace with inbox=yes Any idea before I will patch some piece of code to disable the unique restriction of inbox namespace ? Thanks, -- Auré

1 2

dsync for subscription on public/shared folder
by Mike Fröhner 09 Jan '17

09 Jan '17

Hello, I already wrote regarding that, but maybe it sounded too complex. I will write it a bit softer now. The replication through dsnyc works perfectly with one exception. I am having an issue with the replication of the subscriptions file on shared folder. We have a public mailbox defined: namespace public-test { location = maildir:/opt/mail/_public/test prefix = public/test/ separator = / subscriptions = no type = public } There 2 subfolder .Test1 and .Test2 which I would like to subscribe on my user "ldaptestuser" which is part of the group "ldaptestgroup" The dovecot-acl file on /opt/mail/_public/test and /opt/mail/_public/test/.Test{1,2} are the same and are containing: group=ldaptestgroup lrwstipekxa Now if I login through my client (Thunderbird or Roundcubemail) I can see the following debug log: dovecot: imap(ldaptestuser): Debug: acl: acl username = ldaptestuser dovecot: imap(ldaptestuser): Debug: acl: owner = 0 dovecot: imap(ldaptestuser): Debug: acl: group added: domain users dovecot: imap(ldaptestuser): Debug: acl: group added: ldaptestgroup dovecot: imap(ldaptestuser): Debug: acl: group added: all_mailuser I created one new private folder on the mailbox of my test user and also subscribed it. This subscription is successfully replicated. After that I am trying to subscribe the public folder. I can see the folder in my client after I subscribed them. But on the 2nd dovecot server the subscription file is not updated. imap-1 # cat subscription Private1 public/test/Test1 imap-2 # cat subscription Private1 The debug log on both dovecot server tells me: dovecot: doveadm(<ip>,ldaptestuser): Debug: Effective uid=834603987, gid=991, home=/opt/mail/ldaptestuser dovecot: doveadm(<ip>,ldaptestuser): Debug: acl: No acl_shared_dict setting - shared mailbox listing is disabled dovecot: doveadm(<ip>,ldaptestuser): Debug: maildir++: root=/opt/mail/_public/test, index=, indexpvt=, control=, inbox=, alt= dovecot: doveadm(<ip>,ldaptestuser): Debug: acl: initializing backend with data: vfile dovecot: doveadm(<ip>,ldaptestuser): Debug: acl: acl username = ldaptestuser dovecot: doveadm(<ip>,ldaptestuser): Debug: acl: owner = 0 dovecot: doveadm(<ip>,ldaptestuser): Debug: acl vfile: Global ACLs disabled It looks like the doveadm() cannot find the group or is not checking/initalizing the groups. Anybody any idea if I missconfigured something or is this just a bug? I really would appreciate some help. kind regards, Mike;

1 1

Auth-policy: auth_policy_server_url and https support
by gregc＠olypensupport.com 08 Jan '17

08 Jan '17

When using Auth policy server it doesn’t currently doesn’t support https. In version 2.2.27: Policy server HTTP error: 9002 Couldn't initialize SSL context: Can't verify remote server certs without trusted CAs (ssl_client_ca_* settings) and in version 2.3.devel Policy server HTTP error: 9002 Requested https connection, but no SSL settings given dovecot.conf does have “ssl_client_ca_dir = /etc/ssl/certs” set. Looking around the source, http-client-settings are not given the ssl_ca_dir or ssl_ca_file setting from the config. Admittedly SSL tear up/down is little expensive per auth, but I think it maybe it should still work?

2 1

.dovecot.sieve location issue
by Jibeji 08 Jan '17

08 Jan '17

Hello, I am trying to set sieve up on a Centos 7 server. It's a configuration with postfix, Maildir, MySQL and virtual domains which works fine. I have created a simple .dovecot.sieve in the user's directory: # cat /home/mail/domain.com/user/.dovecot.sieve require "fileinto"; redirect "other_address(a)other_domain.com"; Here are the logs: dovecot: lda(user(a)domain.com): Debug: sieve: Pigeonhole version 0.4.2 initializing lda(user(a)domain.com): Debug: sieve: include: sieve_global_dir is not set; it is currently not possible to include `:global' scripts. dovecot: lda(user(a)domain.com): Debug: sieve: script file /home/mail/ domain.com/.dovecot.sieve not found dovecot: lda(user(a)domain.com): Debug: sieve: user's script ~/.dovecot.sieve doesn't exist (trying default script location instead) lda(user(a)domain.com): Debug: sieve: no default script configured for user lda(user(a)domain.com): Debug: sieve: user has no valid location for a personal script lda(user(a)domain.com): Debug: sieve: no scripts to execute: reverting to default delivery. dovecot: lda(user(a)domain.com): msgid=<005b01d269ca$f287ebf0$d797c3d0$@fr>: saved mail to INBOX It tells that user's script ~/.dovecot.sieve doesn't exis However, on the troubleshooting guide, I can see these logs: dovecot: lda(hendrik): Debug: sieve: using sieve path for user's script: /home/hendrik/.dovecot.sieve dovecot: lda(hendrik): Debug: sieve: opening script /home/hendrik/.dovecot.sieve As you can see, it refers to "lda(hendrik)" but not "lda(user(a)domain.com" I am wondering whether Sieve looks for the file elsewhere than /home/mail/ domain.com/user/.dovecot.sieve Do you have any idea?

3 3

Dovecot Selinux Setting
by Günther J. Niederwimmer 08 Jan '17

08 Jan '17

Hello, can any tell me the correct selinux Settings for the Maildir Setting ? in the Moment I have this setting Jan 8 15:04:52 2017 from 192.168.100.100 [root@mx03 ~]# ls -Z /srv/vmail drwx------. vmail vmail unconfined_u:object_r:mail_home_rw_t:s0 example.com drwx------. vmail vmail unconfined_u:object_r:mail_home_rw_t:s0 example.at drwx------. vmail vmail unconfined_u:object_r:mail_home_rw_t:s0 eu-example.at drwx------. vmail vmail unconfined_u:object_r:mail_home_rw_t:s0 example1.com -rw-rw----. vmail vmail unconfined_u:object_r:mail_home_rw_t:s0 shared- mailboxes I mean this not correct, I have problems with sieve to enable the Link and with Sync ? I can't found the correct setting with goo..... Thanks for Help and a answer, -- mit freundlichen Grüssen / best regards Günther J. Niederwimmer

2 1

auth: Error: BUG: Authentication client sent unknown handshake command
by Marcus Endberg 08 Jan '17

08 Jan '17

Hello! I run dovecot for many years now, but today it ran into a bug I've never seen before. Searching the archives, this bug seems to occur very seldom. The current server installation & configuration is running since mid 2015, uptime of the server today is more than two months. It is a virtual machine in a data center, debian 7 / reiserfs, 'dovecot -n' output below. Just within normal operation, suddenly my users could no longer check their IMAP accounts, log shows lots of entries like this: ----------------------- /var/log/mail.log excerpt --------------------- 2017-01-08 08:15:23 dovecot: auth: Error: BUG: Authentication client sent unknown handshake command: REQUEST?3484549121?11364?1?74fa603b892f9a262605ae6c2ce1d9a1 2017-01-08 08:15:23 dovecot: imap: Error: Authentication server didn't send valid SPID as expected: MECH#011PLAIN#011plaintext 2017-01-08 08:15:23 dovecot: imap: Error: Disconnected from auth server, aborting (client-pid=11364 client-id=1) 2017-01-08 08:15:23 dovecot: imap-login: Internal login failure (pid=11364 id=1) (internal failure, 1 succesful auths): user=<USER_NAME>, method=PLAIN, rip=<USER_IP>, lip=85.214.143.57, mpid=11368, TLS, session=<0oiwA5BFmQBQhoL1> ----------------------------------------------------------------------- Strangely, sending mails still worked fine (postfix uses dovecot SASL authentification). I could not find any hint what might have caused the error in any logfile. After restarting dovecot everything is back to normal operation. Is there any other information I can / should provide? Thanks for your efforts, Marcus ----------------------- output of 'dovecot -n' ------------------------ # 2.1.7: /etc/dovecot/dovecot.conf # OS: Linux 3.2.41-042stab120.16 i686 Debian 7.11 mail_location = maildir:~/Maildir namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } passdb { driver = pam } protocols = " imap" service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0660 user = postfix } } ssl_cert = </correct_path_to/mailbox.endberg.net-chain.cert ssl_cipher_list = ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA ssl_key = </home/sslcerts/keys/mailbox.endberg.net.key ssl_protocols = !SSLv2 !SSLv3 userdb { driver = passwd } -----------------------------------------------------------------------

1 0

OP/PSA: Net Systems Research mail port diddlers
by lists＠lazygranch.com 07 Jan '17

07 Jan '17

http://netsystemsresearch.com/ dovecot.log.1.bz2:Jan 05 17:28:15 pop3-login: Info: Disconnected (no auth attempts in 3 secs): user=<>, rip=169.54.233.124, lip=MYIP, TLS handshaking: Disconnected, session=<z/L0OVxFetOpNul8> Their "research" pokes your email ports. Block if you want or participate in the (cough cough) research. IP addresses and opt-out email address on webpage.

2 1

Dovecot dsync tcps sends incomplete certificate chain
by Juri 06 Jan '17

06 Jan '17

Hi, I'm trying to configure a Dovecot dsync service between two servers, using a tcp+ssl connection and a valid Let's Encrypt certificate. I followed the guide on the wiki (http://wiki.dovecot.org/Replication) using the tcps method, but when I launch the replication it fails writing on the log (/var/log/mail.err): (Server 1 - sync "client" )| Error: sync: Disconnected from remote: Received invalid SSL certificate: unable to get local issuer certificate: /CN=mail.dividebyzero.it (Server 2 - sync "server")| Error: doveadm client disconnected before handshake: <no error> If I try to connect to the server using openssl s_client, on the port 993 (imaps) the server correctly sends the full chain: $ openssl s_client -connect server1.fqdn:993 CONNECTED(00000003) depth=2 O = Digital Signature Trust Co., CN = DST Root CA X3 verify return:1 depth=1 C = US, O = Let's Encrypt, CN = Let's Encrypt Authority X3 verify return:1 depth=0 CN = mail.dividebyzero.it verify return:1 --- Certificate chain 0 s:/CN=mail.dividebyzero.it i:/C=US/O=Let's Encrypt/CN=Let's Encrypt Authority X3 1 s:/C=US/O=Let's Encrypt/CN=Let's Encrypt Authority X3 i:/O=Digital Signature Trust Co./CN=DST Root CA X3 ... while on the doveadm port it fails: $ openssl s_client -connect server1.fqdn:7557 CONNECTED(00000003) depth=0 CN = mail.dividebyzero.it verify error:num=20:unable to get local issuer certificate verify return:1 depth=0 CN = mail.dividebyzero.it verify error:num=21:unable to verify the first certificate verify return:1 --- Certificate chain 0 s:/CN=mail.dividebyzero.it i:/C=US/O=Let's Encrypt/CN=Let's Encrypt Authority X3 ... I run Dovecot 2.2.13 on Debian 8.6: $ dovecot -n # 2.2.13: /etc/dovecot/dovecot.conf # OS: Linux 3.16.0-4-amd64 x86_64 Debian 8.6 auth_default_realm = dividebyzero.it auth_mechanisms = plain login doveadm_password = (redacted) doveadm_port = 7557 mail_location = maildir:~/Maildir mail_plugins = " notify replication" namespace inbox { (removed) } passdb { driver = pam } passdb { args = username_format=%n /etc/vmail/%d/passwd driver = passwd-file } plugin { mail_replica = tcps:otherserver.fqdn } protocols = " imap lmtp" service aggregator { fifo_listener replication-notify-fifo { user = dovecot } unix_listener replication-notify { user = dovecot } } service auth { unix_listener auth-client { group = Debian-exim mode = 0660 } unix_listener auth-userdb { user = vmail } } service doveadm { inet_listener { port = 7557 ssl = yes } } service imap-login { inet_listener imap { port = 143 } inet_listener imaps { port = 993 ssl = yes } } service replicator { process_min_avail = 1 unix_listener replicator-doveadm { mode = 0666 } } ssl = required ssl_cert = </etc/letsencrypt/live/mail.dividebyzero.it/fullchain.pem ssl_client_ca_file = /etc/letsencrypt/live/mail.dividebyzero.it/chain.pem ssl_key = </etc/letsencrypt/live/mail.dividebyzero.it/privkey.pem userdb { driver = passwd } userdb { args = uid=vmail gid=vmail home=/var/local/vmail/%d/%n driver = static } Is it a known problem, or has it been resolved in a subsequent version? If it is not, can you suggest me a workaround in the meantime? Thank you.

3 5

IMAP proxy for Exchange - encrypted backend Communication?
by tom 06 Jan '17

06 Jan '17

Hello, I try to setup a IMAP proxy for my old Exchange server. Running Dovecot v2.x on Centos 7. So far I follow http://wiki2.dovecot.org/HowTo/ImapcProxy and it seem to work. The only but major thing is with this setup - the communication between proxy and backend is not encrypted. :( To fix this, I changed the config and add: imapc_ssl=imaps imapc_port=993 but it doesnt work, because of verify failure of the self signed backend certificate: Jan 5 21:48:55 imap dovecot: imap(user1): Error: imapc(192.168.1.1:993): Couldn't initialize SSL context: Can't verify remote server certs without trusted CAs (ssl_client_ca_* settings) Jan 5 21:48:55 imap dovecot: imap(user1): Error: imapc(192.168.1.1:993): No SSL context Jan 5 21:48:55 imap dovecot: imap(user1): Error: imapc: Command failed: Disconnected from server Jan 5 21:48:55 imap dovecot: imap(user1): Error: user tkoenig: Initialization failed: Initializing mail storage from mail_location setting failed: Mailbox list driver imapc: Failed to access imapc backend Jan 5 21:48:55 imap dovecot: imap(user1): Error: Invalid user settings. Refer to server log for more information. I didnt found anything in the documentation which tells dovcot not verify the backend certificate. Is there a know way to get it runing? Many thanks for any hint! regrds, Tom

3 2