October 2018 - dovecot

macOS Mojave: setgroups(501) failed: Too many extra groups
by Heiko W. Rupp 18 Nov '18

18 Nov '18

Hello, I have recently upgraded to macOS 10.14 (Mojave) and am running into an issue where one use can no longer log into dovecot via imap. Log shows Oct 11 08:10:27 imap(hwr)<12659><YpC/0+133+EAAAAAAAAAAAAAAAAAAAAB>: Fatal: setgroups(501) failed: Too many extra groups and indeed, the user is in 17 groups, which is more than NGROUPS_MAX (16). Another user with << 16 groups can log in fine. Unfortunately it is not (easily) doable to reduce the number of groups, as macOS seems to set them internally. Is there a config option that I am missing to work around this? Looking at the source, I see this is handled in src/lib/restrict-access.c::fix_groups_list(), where above the call to setgroups() a gid_list2 is constructed. I wonder if one could have a config option to prevent adding all those extra groups, which then make the call to setgroups() fail Any help appreciated Heiko -- hwr(a)pilhuhn.de m:0179/207 4919 b:http://pilhuhn.blogspot.com

4 6

Re: Issue sharing folders with Thunderbird
by Jason Perry 17 Nov '18

17 Nov '18

Hi Aki I see what you are saying, and no I don’t believe so. I’m using typical /etc/passwd for the user db. I reviewed https://wiki.dovecot.org/UserDatabase/ExtraFields <https://wiki.dovecot.org/UserDatabase/ExtraFields> but I’m not clear on how to actually return system_user userdb attribute. I also have set mail_user_groups = sharedusers in dovecot.conf and then in /etc/group put all the users with mailboxes into the sharedusers group. I can see why that wouldn’t work if the above is not set. Can you point me in the right direction on how to pass that information? Thanks! > On Aug 28, 2018, at 12:40 AM, Aki Tuomi <aki.tuomi(a)dovecot.fi> wrote: > > Are you returning system_user userdb attribute? Extra groups from /etc/group are not applied without this. > > --- > Aki Tuomi > Dovecot oy > > -------- Original message -------- > From: Jason Perry <jason.perry(a)dtainc.us> > Date: 28/08/2018 04:27 (GMT+02:00) > To: Aki Tuomi <aki.tuomi(a)dovecot.fi> > Cc: dovecot(a)dovecot.org > Subject: Re: Issue sharing folders with Thunderbird > > Hi Aki, they are. > >> 3. The permissions for the file are: >> root@dal-notify-01 Maildir]# ls -la /var/lib/dovecot/db/shared-mailboxes.db >> -rw-rw-r--. 1 operations sharedusers 197 Aug 26 20:33 /var/lib/dovecot/db/shared-mailboxes.db >> 4. Users I'm testing with are part of the sharedusers group in /etc/group > > The dir /var/lib/dovecot/db has this for permissions: > drwsrwsrwx. 2 root sharedusers 33 Aug 27 21:12 db > > the user operations is a member of “sharedusers” in /etc/group. I even chmod’ed the permissions after to rw for global and I get the same error/result. > > The file does appear to get written to. For example, lets say user u2.name creates a folder called “starbucks” and uses the IMAP commands to share it out to user operations. It seems to write to the acl_shared_dict file in /var/lib/dovecot/db/shared-mailboxes.db with an entry like >> shared/shared-boxes/user/u2.name/operations >> 1 > > And it writes to the ~/Maildir/.starbucks/dovecot-acl file for u2.user with an entry like: > user=operations lrw > > So it appears to be working. However, if I log into Thunderbird with the user operations account and go to subscribe, I do not see “starbucks” in the list of available folders. And I still get the nfs_flush_chown error. > > Is there anything else I can be doing with the file/dir permissions? > > Thanks. > > >> On Aug 27, 2018, at 10:50 AM, Aki Tuomi <aki.tuomi(a)dovecot.fi <mailto:aki.tuomi@dovecot.fi>> wrote: >> >> acl_shared_dict file & folder must be readwritable by user performing the sharing as stated in wiki. >> >> https://wiki.dovecot.org/SharedMailboxes/Shared <https://wiki.dovecot.org/SharedMailboxes/Shared> >> --- >> Aki Tuomi >> Dovecot oy >> >> -------- Original message -------- >> From: Jason Perry <jason.perry(a)dtainc.us <mailto:jason.perry@dtainc.us>> >> Date: 27/08/2018 17:01 (GMT+02:00) >> To: dovecot(a)dovecot.org <mailto:dovecot@dovecot.org> >> Subject: Issue sharing folders with Thunderbird >> >> Trying to share folder "JasonAlerts" within mailbox operations to user u1.name >> >> Issues: >> 1. Shared mailboxes do not appear under subscriptions in Thunderbird for another user >> 2. When I try to set permissions via IMAP commands I get in /var/log/dovecot.log >> Aug 26 20:33:24 imap(operations): Error: nfs_flush_chown_uid: chown(/var/lib/dovecot/db) failed: Permission denied >> 3. The permissions for the file are: >> root@dal-notify-01 Maildir]# ls -la /var/lib/dovecot/db/shared-mailboxes.db >> -rw-rw-r--. 1 operations sharedusers 197 Aug 26 20:33 /var/lib/dovecot/db/shared-mailboxes.db >> 4. Users I'm testing with are part of the sharedusers group in /etc/group >> 5. IMAP commands DO write to the file: >> [root@dal-notify-01 Maildir]# cat /var/lib/dovecot/db/shared-mailboxes.db >> shared/shared-boxes/user/u1.name/u2.name >> 1 >> shared/shared-boxes/user/operations/u2.name >> 1 >> shared/shared-boxes/user/u1.name/operations >> 1 >> shared/shared-boxes/user/u1.name/operations >> 1 >> 6. It will also write to the user's /home/operations/Maildir/.JasonAlert/dovecot-acl file >> user=u1.name ilrw >> >> However if I got into Thunderbird and try to subscribe, none of the shared folders are listed. Can anyone help?? Thanks!! >> >> Dovecot version = 2.2.10 >> >> dovecot -n >> [root@server]# dovecot -n >> # 2.2.10: /etc/dovecot/dovecot.conf >> # OS: Linux 3.10.0-693.17.1.el7.x86_64 x86_64 CentOS Linux release 7.4.1708 (Core) >> first_valid_uid = 100 >> listen = * >> log_path = /var/log/dovecot.log >> mail_debug = yes >> mail_location = maildir:~/Maildir >> mail_plugins = acl >> mail_privileged_group = mail >> mbox_write_locks = fcntl >> namespace Private { >> hidden = no >> inbox = no >> list = no >> location = >> prefix = Private/ >> separator = / >> type = private >> } >> namespace Public { >> hidden = no >> inbox = no >> list = no >> location = maildir:/var/mail/public >> prefix = Public/ >> separator = / >> subscriptions = yes >> type = public >> } >> namespace Shared { >> hidden = no >> inbox = no >> list = yes >> location = maildir:/var/mail/%u:INDEXPVT=~/Maildir/%u >> prefix = shared/%u/ >> separator = / >> subscriptions = yes >> type = shared >> } >> namespace inbox { >> inbox = yes >> location = >> mailbox Drafts { >> special_use = \Drafts >> } >> mailbox Junk { >> special_use = \Junk >> } >> mailbox Sent { >> special_use = \Sent >> } >> mailbox "Sent Messages" { >> special_use = \Sent >> } >> mailbox Trash { >> special_use = \Trash >> } >> prefix = >> separator = / >> } >> passdb { >> driver = pam >> } >> passdb { >> driver = pam >> } >> plugin { >> acl = vfile >> acl_shared_dict = file:/var/lib/dovecot/db/shared-mailboxes.db <file:///var/lib/dovecot/db/shared-mailboxes.db> >> } >> protocols = imap >> ssl_cert = </etc/pki/dovecot/certs/dovecot.pem >> ssl_key = </etc/pki/dovecot/private/dovecot.pem >> syslog_facility = local2 >> userdb { >> driver = passwd >> } >> userdb { >> driver = passwd >> } >> protocol imap { >> mail_plugins = acl imap_acl >> } >

1 1

doveconf error upon boot up
by Jerry 31 Oct '18

31 Oct '18

FreeBSD 11.1-RELEASE-p9 amd64 doveconf # 2.3.1 (8e2f634): /usr/local/etc/dovecot/dovecot.conf # Pigeonhole version 0.5.1 (d9bc6dfe) # OS: FreeBSD 11.1-RELEASE-p9 amd64 zfs # Hostname: localhost I can send the entire output if necessary. Error message upon boot up: doveconf: error: t_readlink(/var/run/dovecot/dovecot.conf) failed: readlink() failed: No such file or directory Starting dovecot. Dovecot appears to start correctly There is a link in the "/var/run/dovecot directory for dovecot.conf" lrwx------ 1 root wheel 35B 2018-04-10 10:21:52 EDT dovecot.conf@-> /usr/local/etc/dovecot/dovecot.conf This error message has only started since the update to the latest version of dovecot. I am assuming it is just a harmless error message; however, I would like to confirm that hypothesis. -- Jerry

3 4

OCSP Stapling and Certificate Transparency
by Felipe Gasper 31 Oct '18

31 Oct '18

Hi, For CAs that do not include a signed certificate timestamp in their newly-issued certificates, does Dovecot support either OCSP stapling or the Certificate Transparency TLS extension? If the TLS extension is supported, how does the admin configure the timestamp for each certificate? I’m wondering if any MUAs will follow Google’s lead and insist on CT. Thank you! -Felipe Gasper Mississauga, Ontario

4 3

Copying from a previous Dovecot server
by Peter Lindgren 31 Oct '18

31 Oct '18

Hello! I have installed a new dovecot server on a new server, using imap and Maildir. The old Maildirs are accessible on a mounted disk. I have tried to copy a few folders manually, by first creating the folder on the new server through the a-mail client, and then copying the contents of the cur folder from the old to the new. Works fine, but is a manual process. I'm looking for a way to script this. Is it safe to copy a template folder to a new folder, and then copy the cur folder contents? The files that Dovecot creates in an empty folder have different contents, will Dovecot update them when the user retrieves the mails in that folder? Or, can I just make a symlink to the old Maildir somewhere? Peter -- Peter Lindgren peter(a)norrskenkonsult.com 0703-393940

2 1

[dovecot quota-status] error "Invalid character in path"
by k675154＠keit.eu 31 Oct '18

31 Oct '18

Hello, I'm using using: - dovecot 2.3.3 (dcead646b) - postfix 3.3.1 - dovecot "quota = maildir:User quota" I'm facing the error: "quota-status: Error: quota-status: Client sent invalid recipient address: Invalid character in path" This occurred with this e-mail address: "John Smith"@keit.eu Well I know it is not a conventional address but it is normally perfectly authorized. When I disable quota check, I can received correctly the incoming e-mail. So is there a mean to enable quota check with this kind of e-mail address ? Thanks

2 1

Dovecot submission announces CHUNKING but backend Postfix does not support it
by Michael Goth 30 Oct '18

30 Oct '18

Hello, I'm setting up Dovecot 2.3.2.1 as a submission proxy to a Postfix backend server. Dovecot announces CHUNKING, but the Postfix backend does not support (or announce) it. HELO from Postfix: 220 backend.mydomain.com ESMTP Postfix (Ubuntu) ehlo test 250-backend.mydomain.com 250-PIPELINING 250-SIZE 104857600 250-VRFY 250-ETRN 250-STARTTLS 250-ENHANCEDSTATUSCODES 250-8BITMIME 250 DSN HELO from Dovecot proxy: 220 proxy.mydomain.com Dovecot ready. ehlo test 250-proxy.mydomain.com 250-8BITMIME 250-AUTH PLAIN LOGIN 250-BURL imap 250-CHUNKING 250-ENHANCEDSTATUSCODES 250-SIZE 250-STARTTLS 250 PIPELINING When a client sends BDAT, Postfix closes the connection. Here's a log snippet from Postfix: < MAIL FROM:<user(a)mydomain.com> > 250 2.1.0 Ok < RCPT TO:<some(a)recipient.com> > 250 2.1.5 Ok < BDAT 114098 LAST > 502 5.5.2 Error: command not recognized < Content-Type: multipart/alternative; boundary=Apple-Mail-55D35F74-2EB7-4B3B-A607-E421DD71C07A > 221 2.7.0 Error: I can break rules, too. Goodbye. Apple Mail seems to ignore the fact that Postfix does not understand BDAT and Postfix does not like that :-) From a quick glance at the code it seems CHUNKING is always added to the capabilities and that's not configurable. Is this a bug or am I doing something wrong? Thanks, Michael

4 7

Request: option to hide user IP/HELO content from mail sent via submissiond
by Lee Maguire 30 Oct '18

30 Oct '18

For reasons of user privacy and security I usually configure submission servers to not include accurate IP address and HELO information of authenticated users. (Usually replacing it with a private-use domain / IPv6 address.) Dovecot submission (2.3.2) will produce a header something like this (where “10.22.36.10" is a public IP address) Received: from [192.168.1.184] ([10.22.36.10]) by x.example.com with ESMTPSA id xY/yDFD9yVtsFwAARu9lhg (envelope-from <test(a)example.com>) for <test(a)example.net>; Fri, 19 Oct 2018 18:50:40 +0100 It would be good if a local administrator could override the trace “from” content with syntactically valid, but privacy respecting, content. e.g. Received: from submission.local ([fdf7:c4e4:1c1e::10]) by x.example.com with ESMTPSA id xY/yDFD9yVtsFwAARu9lhg (envelope-from <test(a)example.com>) for <test(a)example.net>; Fri, 19 Oct 2018 18:50:40 +0100 RFC 5321 specifies that the “from” MUST exist but only specifies that the content SHOULD be the source host. (Assuming that Submission is “an SMTP environment”. RFC 6409 makes some provision for header rewriting to hide machine names. https://tools.ietf.org/html/rfc6409#section-8.8 ) https://tools.ietf.org/html/rfc5321#section-4.4 The FROM clause, which MUST be supplied in an SMTP environment, SHOULD contain both (1) the name of the source host as presented in the EHLO command and (2) an address literal containing the IP address of the source, determined from the TCP connection.

3 2

Panic: file istream-crlf.c: line 24 (i_stream_crlf_read_common): assertion failed: (ret != -2)
by Peter Nabbefeld 30 Oct '18

30 Oct '18

Hello, cannot fetch mails from an IMAP folder because of the error in the subject - fetching always stops with SIGABRT. Could anybody help me, please? Kind regards Peter

3 3

Problem with cached userdb info
by Ángel L. Mateo 30 Oct '18

30 Oct '18

Hi, I'm having a problem with my cached userdb information. These are my passdb and userdbs: passdb { driver = ldap args = /etc/dovecot/dovecot-ldap.conf.ext } userdb { driver = prefetch } userdb { driver = ldap args = /etc/dovecot/dovecot-ldap-userdb.conf.ext } In /etc/dovecot/dovecot-ldap-userdb.conf.ext (userdb) I have: user_attrs = =user=%{ldap:mail},=quota_rule=%{ldap:quota:*:storage=10G},=home_prefix=/mail/mailboxes/%L{domain},=index_prefix=/mail/indexes/%L{domain},=relpath=%2L{ldap:umServiceUniqueId}/%L{ldap:umServiceUniqueId},=uuid=%L{ldap:umPersonalUniqueId} user_filter = (&(objectClass=CourierMailAccount)(irisUserStatus=urn:mace:rediris.es:um.es:userstatus:correo:estado:activo)(irisMailhost=popimapclu11.um.es)(|(uid=%{auth_user})(mail=%{auth_user}))) and in /etc/dovecot/dovecot-ldap.conf.ext (passdb) I have: pass_attrs = =userdb_user=%{ldap:mail},=userdb_quota_rule=%{ldap:quota:*:storage=10G},=userdb_home_prefix=/mail/mailboxes/%L{domain},=userdb_index_prefix=/mail/indexes/%L{domain},=userdb_relpath=%2L{ldap:umServiceUniqueId}/%L{ldap:umServiceUniqueId},=userdb_uuid=%L{ldap:umPersonalUniqueId},=uuid=%L{ldap:umPersonalUniqueId} pass_filter = (&(objectClass=CourierMailAccount)(irisUserStatus=urn:mace:rediris.es:um.es:userstatus:correo:estado:activo)(irisMailhost=popimapclu11.um.es)(|(uid=%u)(mail=%u))) The problem I have is that quota information is not updated when I changed in my ldap. These are the steps I'm running: 1. First, I check current quota (dovecot just restarted): amateo_adm@myotis60:/etc/dovecot/conf.d$ sudo doveadm user -f quota_rule angel.luis(a)um.es *:storage=2G in the log I get: Oct 29 14:29:46 myotis60 dovecot: auth: Debug: master in: USER#0111#011angel.luis(a)um.es#011service=doveadm#011debug Oct 29 14:29:46 myotis60 dovecot: auth: Debug: prefetch(angel.luis(a)um.es): passdb didn't return userdb entries, trying the next userdb Oct 29 14:29:46 myotis60 dovecot: auth: Debug: ldap(angel.luis(a)um.es): userdb cache miss Oct 29 14:29:46 myotis60 dovecot: auth: Debug: ldap(angel.luis(a)um.es): user search: base=ou=Usuarios,dc=Telematica scope=subtree filter=(&(objectClass=CourierMailAccount)(irisUserStatus=urn:mace:rediris.es:um.es:userstatus:correo:estado:activo)(irisMailhost=popimapclu11.um.es)(|(uid=angel.luis@um.es)(mail=angel.luis@um.es))) fields=mail,quota,umServiceUniqueId,umServiceUniqueId,umPersonalUniqueId Oct 29 14:29:46 myotis60 dovecot: auth: Debug: ldap(angel.luis(a)um.es): result: mail=angel.luis(a)um.es umServiceUniqueId=3aa35516-d2bd-11e8-8708-d0cb8a49c4ef umPersonalUniqueId=3aa34f3a-d2bd-11e8-8708-d0cb8a49c4ef quota=*:storage=2G; mail,umPersonalUniqueId,quota,umServiceUniqueId unused Oct 29 14:29:46 myotis60 dovecot: auth: Debug: ldap(angel.luis(a)um.es): result: mail=angel.luis(a)um.es umServiceUniqueId=3aa35516-d2bd-11e8-8708-d0cb8a49c4ef umPersonalUniqueId=3aa34f3a-d2bd-11e8-8708-d0cb8a49c4ef quota=*:storage=2G Oct 29 14:29:46 myotis60 dovecot: auth: Debug: userdb out: USER#0111#011angel.luis@um.es#011quota_rule=*:storage=2G#011home_prefix=/mail/mailboxes/um.es#011index_prefix=/mail/indexes/um.es#011relpath=3a/3aa35516-d2bd-11e8-8708-d0cb8a49c4ef#011uuid=3aa34f3a-d2bd-11e8-8708-d0cb8a49c4ef 2. Then I change user quota. 3. And later, I flush auth cache: amateo_adm@myotis60:/etc/dovecot/conf.d$ sudo doveadm auth cache flush angel.luis(a)um.es 0 cache entries flushed with debug log: Oct 29 14:31:00 myotis60 dovecot: auth: Debug: master in: CACHE-FLUSH#0111#011angel.luis(a)um.es 4. Finally, I get again the quota: amateo_adm@myotis60:/etc/dovecot/conf.d$ sudo doveadm user -f quota_rule angel.luis(a)um.es *:storage=2G with debug log: Oct 29 14:31:49 myotis60 dovecot: auth: Debug: master in: USER#0111#011angel.luis(a)um.es#011service=doveadm#011debug Oct 29 14:31:49 myotis60 dovecot: auth: Debug: prefetch(angel.luis(a)um.es): passdb didn't return userdb entries, trying the next userdb Oct 29 14:31:49 myotis60 dovecot: auth: Debug: ldap(angel.luis(a)um.es): userdb cache hit: quota_rule=*:storage=2G#011home_prefix=/mail/mailboxes/um.es#011index_prefix=/mail/indexes/um.es#011relpath=3a/3aa35516-d2bd-11e8-8708-d0cb8a49c4ef#011uuid=3aa34f3a-d2bd-11e8-8708-d0cb8a49c4ef Oct 29 14:31:49 myotis60 dovecot: auth: Debug: userdb out: USER#0111#011angel.luis@um.es#011quota_rule=*:storage=2G#011home_prefix=/mail/mailboxes/um.es#011index_prefix=/mail/indexes/um.es#011relpath=3a/3aa35516-d2bd-11e8-8708-d0cb8a49c4ef#011uuid=3aa34f3a-d2bd-11e8-8708-d0cb8a49c4ef I'm also confussed about that dovecot is always loggin: prefetch(angel.luis(a)um.es): passdb didn't return userdb entries, trying the next userdb even if I have made a imap/pop3 before the doveadm user command. Am I doing something wrong? Is there any way to flush this userdb cache (without restarting dovecot)? -- Angel L. Mateo Martínez Sección de Telemática Área de Tecnologías de la Información y las Comunicaciones Aplicadas (ATICA) http://www.um.es/atica Tfo: 868889150 Fax: 868888337

1 0