March 2017 - dovecot - dovecot.org

letsencrypt
by David Mehler 04 Mar '17

04 Mar '17

Hello, I know some users here are using letsencrypt for their CA. If this is to off topic write me privately. I'm wanting letsencrypt to take over as my CA, replacing existing self signed certificates. I've got web working, a certificate for https sites and one for webmail as they have different names. What I'm now wanting to do is get letsencrypt going for my email setup, the smtp handled by postfix, but mail, and imap I believe are handled by dovecot. With the web it was easy just let apache serve the token that letsencrypt needed and I got certificates. How do I do this with regards email? I hope that's clear. Any help appreciated. Thanks. Dave.

8 9

Re: letsencrypt
by Joseph Tam 04 Mar '17

04 Mar '17

> Thanks. Is there another way of doing this? I've got a web server > running on 80 and 443. Are there any other options? I'm getting this list in digest mode, so it's possible by the time this gets to you, I will have repeated someone else' suggestion. In this situation, where your dovecot server lives on the same host as a web server (wembail?), and this web server is already going certificate renewal, then just change the certificate to use SNI extension and add all LS services that live on this host. (This does not count as a cert renewal, but a new cert). (E.g. if you are using a certbot to get a certifiticate for "webmail.mydomain", then add "pop3.mydomain", "imap.mydomain" and "smtp.mydomain" to the certificate.) Your web server will have to virtually host those domains for the purposes of mapping the token pickup folder. Then you can use the same certificate for all TLS services hosted on that server. Joseph Tam <jtam.home(a)gmail.com>

1 0

Re: letsencrypt
by Joseph Tam 03 Mar '17

03 Mar '17

David Mehler <dave.mehler(a)gmail.com> writes: > I'm wanting letsencrypt to take over as my CA, replacing existing self > signed certificates. I've got web working, a certificate for https > sites and one for webmail as they have different names. What I'm now > wanting to do is get letsencrypt going for my email setup, the smtp > handled by postfix, but mail, and imap I believe are handled by > dovecot. SMTP is handled by postfix, imap/pop is handled by dovecot. > With the web it was easy just let apache serve the token that > letsencrypt needed and I got certificates. How do I do this with > regards email? You can do the DNS challenge method if your server has the ability to update DNS entries, or you can use certbot clients in standalone-mode that will act as a simple web server just long enough to serve out the token to complete the authentication. Joseph Tam <jtam.home(a)gmail.com>

1 0

Director+NFS Experiences
by Mark Moseley 03 Mar '17

03 Mar '17

As someone who is about to begin the process of moving from maildir to mdbox on NFS (and therefore just about to start the 'director-ization' of everything) for ~6.5m mailboxes, I'm curious if anyone can share any experiences with it. The list is surprisingly quiet about this subject, and articles on google are mainly just about setting director up. I've yet to stumble across an article about someone's experiences with it. * How big of a director cluster do you use? I'm going to have millions of mailboxes behind 10 directors. I'm guessing that's plenty. It's actually split over two datacenters. In the larger, we've got about 200k connections currently, so in a perfectly-balanced world, each director would have 20k connections on it. I'm guessing that's child's play. Any good rule of thumb for ratio of 'backend servers::director servers'? In my larger DC, it's about 5::1. * Do you use the perl poolmon script or something else? The perl script was being weird for me, so I rewrote it in python but it basically does the exact same things. * Seen any issues with director? In testing, I managed to wedge things by having my poolmon script running on all the cluster boxes (I think). I've since rewritten it to run *only* on the lowest-numbered director. When it wedged, I had piles (read: hundreds per second) of log entries that said: Feb 12 06:25:03 director: Warning: director(10.1.20.5:9090/right): Host 10.1.17.3 is being updated before previous update had finished (down -> up) - setting to state=up vhosts=0 Feb 12 06:25:03 director: Warning: director(10.1.20.5:9090/right): Host 10.1.17.3 is being updated before previous update had finished (up -> down) - setting to state=down vhosts=0 Feb 12 06:25:03 director: Warning: director(10.1.20.3:9090/left): Host 10.1.17.3 is being updated before previous update had finished (down -> up) - setting to state=up vhosts=0 Feb 12 06:25:03 director: Warning: director(10.1.20.3:9090/left): Host 10.1.17.3 is being updated before previous update had finished (up -> down) - setting to state=down vhosts=0 Because it was in testing, I didn't notice it and it was like this for several days till dovecot was restarted on all the director nodes. I'm not 100% on what happened, but my *guess* is that two boxes tried to update the status of the same backend server in rapid succession. * Assuming you're using NFS, do you still see non-trivial amounts of indexes getting corrupted? * Again, assuming NFS and assuming at least some corrupted indexes, what's your guess for success rate % for dovecot recovering them automatically? And how about success rate % for ones that dovecot wasn't able to do automatically but you had to use doveadm to repair it? Really what I'm trying to figure out is 1) how often sysops will need to manually recover indexes; and 2) how often admins *can't* manually recover indexes? * if you have unrecoverable indexes (and assuming you have snapshots on your NFS server), does grabbing the most recent indexes from the snapshots always work for recovery (obviously, up till the point that the snapshot was taken)? * Any gotchas you've seen anywhere in a director-fied stack? I realize that's a broad question :) * Does one of your director nodes going down cause any issues? E.g. issues with the left and right nodes syncing with each other? Or when the director node comes back up? * Does a backend node going down cause a storm of reconnects? In the time between deploying director and getting mailboxes converted to mdbox, reconnects for us will mean cold local-disk dovecot caches. But hopefully consistent hashing helps with that? * Do you have consistent hashing turned on? I can't think of any reason not to have it turned on, but who knows * Any other configuration knobs (including sysctl) that you needed to futz with, vs the default? I appreciate any feedback!

8 14

Mailbox size in log file
by Sergio Bastian Rodríguez 03 Mar '17

03 Mar '17

Hello Dovecot list. I need that Dovecot log writes mailbox size in all POP / IMAP connections, but I do not know if Dovecot can do that. I have been searching about that with not successful. For example, this is the log of our last email platform, different than Dovecot: 06:48:14 025BEE83 POP3 LOGIN user 'xxx(a)xxx.com' MailboxSize = 61708 Capacity = 2% ...... 06:49:19 025BEE83 POP3 LOGOUT user 'xxx(a)xxx.com' MailboxSize = 14472 Capacity = 0% In this example we can know the mailbox size before and after the connection, and it shows that user has removed or downloaded all messages from server. Now in Dovecot we have no information about that, and I cannot find any plugin which gives this us functionality. Is it possible to have this feature in Dovecot? Thanks for your help. ________________________________ ------------------------------------------------------------------------ Le informamos, como destinatario de este mensaje, que el correo electrónico y las comunicaciones por medio de Internet no permiten asegurar ni garantizar la confidencialidad de los mensajes transmitidos, así como tampoco su integridad o su correcta recepción, por lo que TELECABLE DE ASTURIAS, S.A. no asume responsabilidad alguna por tales circunstancias. Si no consintiese en la utilización del correo electrónico o de las comunicaciones vía Internet le rogamos nos lo comunique y ponga en nuestro conocimiento de manera inmediata. Este mensaje va dirigido, de manera exclusiva, a su destinatario y contiene información confidencial y sujeta al secreto profesional, cuya divulgación no está permitida por la ley. En caso de haber recibido este mensaje por error, le rogamos que, de forma inmediata, nos lo comunique mediante correo electrónico remitido a nuestra atención o a través del teléfono (+ 34) 984191000 y proceda a su eliminación, así como a la de cualquier documento adjunto al mismo. Asimismo, le comunicamos que la distribución, copia o utilización de este mensaje, o de cualquier documento adjunto al mismo, cualquiera que fuera su finalidad, están prohibidas por la ley. ------------------------------------------------------------------------

3 4

Dovecot + SpamAssassin through dovecot-antispam
by Bernard 03 Mar '17

03 Mar '17

Hello, I am new to the list. /Waving at everyone/ I got a basic SpamAssassin working on a Debian setup (w/ debian-spamd user), running as a Postfix transport. I am currently trying to switch it to a dovecot plugin in order to make it interactively work with the email storage (react to mail classification, being able to train it from already received emails, aso.) My problem is now making it able to access my emails. Here is my setup: userdb { driver = static args = uid=<fixed> gid=<fixed> home=/var/mail/vhosts/%d/%n } passdb { driver = passwd-file args = <path to passwords file> } mail_location = maildir:~/mail:LAYOUT=fs mail_privileged_group = vmail Translating into this on the FS: drwxrwsr-x root mail /var/mail/ drwxrws--- root vmail /var/mail/vhosts drwx--S--- vmail vmail /var/mail/vhosts/domain1 drwx--S--- vmail vmail /var/mail/vhosts/domain1/user1 drwx--S--- vmail vmail /var/mail/vhosts/domain1/user2 drwx--S--- vmail vmail /var/mail/vhosts/domain2 drwx--S--- vmail vmail /var/mail/vhosts/domain2/user1 The drwx--S--- access rights are propagated into lower branches/leafs. I am having a hard time understanding what to do, reading http://wiki2.dovecot.org/SharedMailboxes/Permissions, to make all the folders and subsequent files readable by the vmail group too. Based on this documentation, the way dovecot propagate permissions from parent folders is a bit cryptic to me. What needs to be done to achieve that? The idea would be that even if I decided to allocated per-virtual-user a system user for stored files, all the files would still be stored and accessible with the same system group. I understand this would be done with the help of mail_access_groups = vmail, right? FWIW, I am getting inspiration from the following explanations: https://www.christianroessler.net/tech/2015/spamassassin-dovecot-postfix.ht… If I understand correctly, the guy is bypassing the authentication completely with allow_all_users=yes, right? I do not want to do that anyway. I hope what I am trying to achieve is clear enough and that I provided information enough. Would you help me? --- Bernard

4 5

passdb evaluation order
by Angel L. Mateo 03 Mar '17

03 Mar '17

Hello, I could have several password databases in dovecot. And according to http://wiki.dovecot.org/PasswordDatabase these passwdbs could allow or deny users and they could have different result_failure and result_sucess behaviors. So the order in which they are evaluated may be significant. So, how do I define this order? -- Angel L. Mateo Martínez Sección de Telemática Área de Tecnologías de la Información y las Comunicaciones Aplicadas (ATICA) http://www.um.es/atica Tfo: 868889150 Fax: 868888337

3 2

Faster way to import Thunderbird pop emails into dovecot imap Maildirs?
by Ian Evans 03 Mar '17

03 Mar '17

Until recently, I was using POP on my desktop and imap to access my email on my phone and laptop. Got tired of not having everything everywhere, so decided to go full imap. Followed the suggestions online and created a new imap account for my site in Thunderbird and copied my pop folders over to the imap ones so that the emails would get uploaded to the dovecot server and Maildir folders. That worked for some smaller folders, but in a couple of folders, I have in excess of 20,000 emails. Thunderbird/Dovecot seems to choke on that, apparently timing out at some point. I've tried doing about 1000 messages at a time, but even that is taking more than an hour and I have to be around for each chunk. I'm sure someone here is going to point me to some eureka moment method of exporting the thunderbird folders to some format, sftp'ing them to the server and importing. Just want to be careful that I don't mess up the current batch of emails on the imap server. Thanks for any suggestions.

3 3

Re: Re: welcome plugin
by Larry Rosenman 03 Mar '17

03 Mar '17

Directory probably needs rx to allow search. On Mar 2, 2017 at 6:52 PM, <David Mehler <dave.mehler(a)gmail.com>> wrote: Hello, Thank you. My configuration is below. It looks like a perm problem, i've set +r on the directory and it is readable. One other thing I noticed when going through the log the testuser logs in, then logs out. Then logs in again, and then gets the error. Any ideas why the two logins? I see this all the time, a log in log out, then another log in log out then the email transaction. Thanks. Dave. # 2.2.28 (bed8434): /usr/local/etc/dovecot/dovecot.conf # Pigeonhole version 0.4.17 (e179378) # OS: FreeBSD 10.3-RELEASE-p11 amd64 ufs auth_default_realm = domain.tld auth_mechanisms = plain login cram-md5 dict { sqlquota = mysql:/usr/local/etc/dovecot/dovecot-dict-sql.conf.ext } first_valid_gid = 999 first_valid_uid = 999 hostname = mail.domain.tld imap_client_workarounds = delay-newmail tb-extra-mailbox-sep tb-lsub-flags last_valid_gid = 999 last_valid_uid = 999 lmtp_rcpt_check_quota = yes mail_gid = vmail mail_home = /home/vmail/%d/%n/home mail_location = maildir:/home/vmail/%d/%n:LAYOUT=fs mail_plugins = acl quota zlib welcome mail_server_admin = mailto:postmaster@domain.tld mail_uid = vmail mailbox_list_index = yes maildir_broken_filename_sizes = yes maildir_empty_new = yes maildir_stat_dirs = yes maildir_very_dirty_syncs = yes managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress tldparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext imapflags notify imapsieve namespace { list = yes location = maildir:/home/vmail/public:LAYOUT=fs prefix = public/ separator = / subscriptions = yes type = public } namespace inbox { hidden = no inbox = yes list = yes location = mailbox Drafts { auto = no special_use = \Drafts } mailbox Sent { auto = subscribe special_use = \Sent } mailbox Spam { auto = subscribe special_use = \Junk } mailbox Trash { auto = no special_use = \Trash } prefix = separator = / subscriptions = yes type = private } passdb { args = /usr/local/etc/dovecot/dovecot-sql.conf.ext driver = sql } plugin { imapsieve_mailbox1_before = file:/usr/local/lib/dovecot/sieve/report-spam.sieve imapsieve_mailbox1_causes = COPY imapsieve_mailbox1_name = Spam imapsieve_mailbox2_before = file:/usr/local/lib/dovecot/sieve/report-ham.sieve imapsieve_mailbox2_causes = COPY imapsieve_mailbox2_from = Spam imapsieve_mailbox2_name = * last_login_dict = redis:host=127.0.0.1:port=6379 quota = dict:User quota::proxy::sqlquota quota_grace = 10%% quota_status_nouser = DUNNO quota_status_overquota = 552 5.2.2 Mailbox is full quota_status_success = DUNNO sieve = ~/.dovecot.sieve sieve_before = /usr/local/etc/dovecot/sieve/before.d sieve_extensions = +notify +imapflags sieve_global_extensions = +vnd.dovecot.pipe +vnd.dovecot.execute sieve_pipe_bin_dir = /usr/local/lib/dovecot/sieve sieve_plugins = sieve_imapsieve sieve_extprograms } postmaster_address = postmaster(a)domain.tld protocols = imap service auth-worker { user = vmail } service auth { unix_listener /var/spool/postfix/private/auth { mode = 0666 } unix_listener auth-userdb { mode = 0600 user = vmail } } service dict { unix_listener dict { mode = 0600 user = vmail } } service imap-login { inet_listener imap { port = 143 } inet_listener imaps { port = 993 ssl = yes } } service lmtp { unix_listener dovecot-lmtp { group = postfix mode = 0660 user = postfix } } service quota-status { client_limit = 1 executable = quota-status -p postfix inet_listener { address = 127.0.0.1 port = 12345 } } ssl_ca = /etc/ssl/certs/cacert.crt ssl_cert = </etc/ssl/certs/server.crt ssl_cipher_list = EECDH+ECDSA+AESGCM:EECDH+aRSA+AESGCM:EECDH+ECDSA+SHA384:EECDH+ECDSA+SHA256:EECDH+aRSA+SHA384:EECDH+aRSA+SHA256:EECDH+aRSA+RC4:EECDH:EDH+aRSA:!aNULL:!eNULL:!LOW:!3DES:!MD5:!EXP:!PSK:!SRP:!DSS:!RC4 ssl_dh_parameters_length = 2048 ssl_key = # hidden, use -P to show it ssl_options = no_tldpression ssl_prefer_server_ciphers = yes ssl_protocols = !SSLv2 !SSLv3 userdb { args = /usr/local/etc/dovecot/dovecot-sql.conf.ext driver = sql } protocol lmtp { mail_plugins = acl quota zlib welcome sieve } protocol lda { mail_plugins = acl quota zlib welcome quota sieve } protocol imap { mail_plugins = acl quota zlib welcome imap_acl imap_quota imap_sieve imap_zlib last_login } /var/log/maillog: Feb 28 14:52:06 hostname dovecot: imap-login: Login: user=<testuser(a)domain.tld>, method=PLAIN, rip=127.0.0.1, lip=127.0.0.1, mpid=5840, secured, session=<5EXYh5xJesx/AAAB> Feb 28 14:52:06 hostname dovecot: imap(testuser(a)domain.tld): Logged out in=102 out=1373 Feb 28 14:52:06 hostname dovecot: imap-login: Login: user=<testuser(a)domain.tld>, method=PLAIN, rip=127.0.0.1, lip=127.0.0.1, mpid=7724, secured, session=<0nPch5xJMeR/AAAB> Feb 28 14:52:06 hostname dovecot: lda(testuser(a)domain.tld): Error: userdb lookup: connect(/var/run/dovecot/auth-userdb) failed: Permission denied (euid=143(dovecot) egid=143(dovecot) missing +r perm: /var/run/dovecot/auth-userdb, dir owned by 0:0 mode=0755) Feb 28 14:52:06 hostname dovecot: lda: Fatal: Internal error occurred. Refer to server log for more information. Feb 28 14:52:06 hostname dovecot: welcome: Fatal: master: service(welcome): child 8781 returned error 75 Feb 28 14:52:06 hostname dovecot: imap(testuser(a)domain.tld): Logged out in=234 out=1549 On 3/2/17, @lbutlr <kremels(a)kreme.com> wrote: > On 2017-03-02 (16:54 MST), David Mehler <dave.mehler(a)gmail.com> wrote: >> >> Is anyone using the welcome plugin? I'm trying to utilize it to send a >> message when a user first logs in to the system, containing important >> information for them to know. The plugin loads, I don't have a >> configuration problem, but the message never gets sent. > > I would say you DO have a configuration problem if the mail doesn’t get > sent. > >> What can I provide to more easily troubleshoot this? > > I’d start with the settings for the welcome plugin and any logs. > > > -- > Apple broke AppleScripting signatures in Mail.app, so no random signatures. >

1 0

IMAP MOVE command with FTS
by TACHIBANA Masashi 03 Mar '17

03 Mar '17

Hi, I'm using Dovecot 2.2.28 with fts. It seems to work fine almost things. But I found a bug (or my setting problem?) My setting is "fts_autoindex=yes" in /etc/dovecot/conf.d/90-fts.conf Then, I have mailboxes like bellow: a a/lot a/lot/of There are some mails is in "a/lot" folder, then create sub like: a/lot/of/apples And move the mails from "a/lot" to "a/lot/of/apples" by MOVE command. In this case, FTS function fts_backend_xx_update_expunge is called. But fts_backend_xx_update_set_build_key is not called. Another case, follow functions are called and mails will be indexed. fts_backend_xx_update_expunge() fts_backend_xx_update_set_build_key() By the way, in the first case, I tried a command as bellow, then the mails ware indexed correctly: # doveadm index -u user1(a)example.com \* I think MOVE is better way to move mails than COPY+FLAG DEL+EXPUNGE. My settings problem? Any hints? Regards, -- Astro.M

1 0