May 2018 - dovecot - dovecot.org

Letsencrypt certificate for repo.dovecot.org expired May 14th..
by B. Reino 12 Sep '18

12 Sep '18

Dear all, Just in case you've missed it, the certificate for repo.dovecot.org just expired yesterday. This causes errors in e.g. apt-get update. Thanks in advance for fixing it, -- B. Reino

2 6

Set X-Original-To based an ORCPT?
by Peer Heinlein 08 Aug '18

08 Aug '18

Since http://dovecot.org/pipermail/dovecot-cvs/2014-November/025241.html Dovecot's LMTP does support ORCPT. Is it possible to set X-Original-To-Header based on that ORCPT? Peer -- Heinlein Support GmbH Schwedter Str. 8/9b, 10119 Berlin http://www.heinlein-support.de Tel: 030 / 405051-42 Fax: 030 / 405051-19 Zwangsangaben lt. §35a GmbHG: HRB 93818 B / Amtsgericht Berlin-Charlottenburg, Geschäftsführer: Peer Heinlein -- Sitz: Berlin

5 5

[Dovecot] quota-status not working in distributed environment
by Benoit Panizzon 30 Jul '18

30 Jul '18

Hello List Quick overview of our set-up: Postfix / Dovecot (2.2.2.1) / MySQL Cluster on (at the moment) three Servers to create a HA environment where you could easily add additional servers as the demand or load grows. Circular dovecot replication is used so each server uses another one as replication partner and allowing one server to fail. Dovecot Proxy Feature being used, so we can use round-robin DNS and each server can forward the connecting user to the correct 'master' for his mailbox. So far, everything works as expected. Now we want to reject emails to 'full' mailboxes during SMTP to prevent backscatter and use the quota-status policy service from within postfix. That works fine, if the mailbox or it's replica is present on the machine where quota-status is called, but it fails if it's run on a machine where neither the mailbox or the replica is present. In our case, we get a correct SMTP 550 'Mailbox Full' Reject in two cases and a LMTP generated bounce in the later case. Also `doveadm quota get -u user(a)example.com` return the correct quota if run on the two machines which have the mailbox and it's copy locale, but return 0% used if run on the other machine. Is there a way to get quota-status to also use the proxy feature to request the quota information from the correct machine? Or is the postfix policy daemon call to the quota-status socket documented somewhere (it must be, but where?) so we could implement it from within the Milter? (we use the sendmail Milter API from postfix to filter spam and viruses, do sender/recipient rewriting, forward bounce matching, rate limmiting, login/IP statistics to block botnets abusing phished addresses and legal intercept stuff anyway) Kind regards Benoit Panizzon -- I m p r o W a r e A G - ______________________________________________________ Zurlindenstrasse 29 Tel +41 61 826 93 07 CH-4133 Pratteln Fax +41 61 826 93 02 Schweiz Web http://www.imp.ch ______________________________________________________

5 6

SIS: dovecot creates duplicated attachments (sometimes)
by Alexander Moisseev 20 Jul '18

20 Jul '18

SIS deduplication was broken in 2.2.16 and has been fixed with https://github.com/dovecot/core/commit/3b39022ea0513363241cf852b7d454c84158… but still sometimes (just several times in a month or so) dovecot creates duplicated attachments. As you can see in directory listings below all attachments was created at (about) the same time, but one of them has different inode number. It easy to discover using https://github.com/moisseev/doveadm-tools/blob/master/bin/dsisck # dsisck -n mail_uid=vmail mail_attachment_dir=/vmail/attachments ==> Checking SIS... # ln -f ./30/b3/30b367c584a123eee59478adf3e4f4c9e1226545-c56eae04a67c3157287f01003d96bafd ./30/b3/30b367c584a123eee59478adf3e4f4c9e1226545-7ad0a411d17c31572b7a01003d96bafd # mkdir -p -m 700 ./64/8f/hashes && ln ./64/8f/648f5cfa27af6d20c8570fdcaeab997663e15105-55430d2cd4432c571cb600003d96bafd ./64/8f/hashes/648f5cfa27af6d20c8570fdcaeab997663e15105 # ln -f ./6f/3f/6f3fa3e4d374a9c80d07af54960ce0e7adb2e0fe-b1935817ed753557546700003d96bafd ./6f/3f/6f3fa3e4d374a9c80d07af54960ce0e7adb2e0fe-72da1f32e38e3557947b00003d96bafd # ln -f ./dd/d9/ddd97aa6f624d4f54968d2c4956fc3a9d796b31b-6bf7c122fefb3157ad3500003d96bafd ./dd/d9/ddd97aa6f624d4f54968d2c4956fc3a9d796b31b-90fd1415e7e53157112800003d96bafd -------------------------------------------------------------- Unexpected objects found: 0 Attachments processed: 43500 Different attachments with similar hashes skipped: 0 Attachments deduplicated: 3 File system blocks freed up: 1800 Attachment deduplication attempts failed: 0 Hash files created: 1 Hash files creation attempts failed: 0 Hash files re-linked: 0 Hash files re-link attempts failed: 0 Orphaned hash files: 0 Invalid hash files (not a regular file): 0 -------------------------------------------------------------- # cd /vmail/attachments # ls -li ./30/b3/ ./30/b3/hashes/ ./30/b3/: total 1996 7464083 -rw------- 1 vmail vmail 337719 May 10 09:16 30b367c584a123eee59478adf3e4f4c9e1226545-7ad0a411d17c31572b7a01003d96bafd 7464082 -rw------- 6 vmail vmail 337719 May 10 09:16 30b367c584a123eee59478adf3e4f4c9e1226545-bb6eae04a67c3157287f01003d96bafd 7464082 -rw------- 6 vmail vmail 337719 May 10 09:16 30b367c584a123eee59478adf3e4f4c9e1226545-bd6eae04a67c3157287f01003d96bafd 7464082 -rw------- 6 vmail vmail 337719 May 10 09:16 30b367c584a123eee59478adf3e4f4c9e1226545-bf6eae04a67c3157287f01003d96bafd 7464082 -rw------- 6 vmail vmail 337719 May 10 09:16 30b367c584a123eee59478adf3e4f4c9e1226545-c36eae04a67c3157287f01003d96bafd 7464082 -rw------- 6 vmail vmail 337719 May 10 09:16 30b367c584a123eee59478adf3e4f4c9e1226545-c56eae04a67c3157287f01003d96bafd 7464084 drwx------ 2 vmail vmail 512 May 10 09:16 hashes ./30/b3/hashes/: total 332 7464082 -rw------- 6 vmail vmail 337719 May 10 09:16 30b367c584a123eee59478adf3e4f4c9e1226545 # ls -li ./6f/3f/ ./6f/3f/hashes/ ./6f/3f/: total 644 15088414 -rw------- 1 vmail vmail 326656 May 13 11:23 6f3fa3e4d374a9c80d07af54960ce0e7adb2e0fe-72da1f32e38e3557947b00003d96bafd 15088422 -rw------- 2 vmail vmail 326656 May 13 11:23 6f3fa3e4d374a9c80d07af54960ce0e7adb2e0fe-b1935817ed753557546700003d96bafd 15088448 drwx------ 2 vmail vmail 512 May 13 11:23 hashes ./6f/3f/hashes/: total 320 15088422 -rw------- 2 vmail vmail 326656 May 13 11:23 6f3fa3e4d374a9c80d07af54960ce0e7adb2e0fe # ls -li ./dd/d9/ ./dd/d9/hashes/ ./dd/d9/: total 748 80548 -rw------- 3 vmail vmail 250640 May 10 18:19 ddd97aa6f624d4f54968d2c4956fc3a9d796b31b-68f7c122fefb3157ad3500003d96bafd 80548 -rw------- 3 vmail vmail 250640 May 10 18:19 ddd97aa6f624d4f54968d2c4956fc3a9d796b31b-6bf7c122fefb3157ad3500003d96bafd 80547 -rw------- 1 vmail vmail 250640 May 10 18:19 ddd97aa6f624d4f54968d2c4956fc3a9d796b31b-90fd1415e7e53157112800003d96bafd 80549 drwx------ 2 vmail vmail 512 May 10 18:19 hashes ./dd/d9/hashes/: total 248 80548 -rw------- 3 vmail vmail 250640 May 10 18:19 ddd97aa6f624d4f54968d2c4956fc3a9d796b31b # doveconf -n # 2.2.24 (a82c823): /usr/local/etc/dovecot/dovecot.conf # Pigeonhole version 0.4.14 (099a97c) # OS: FreeBSD 10.3-RELEASE i386 auth_default_realm = example.com auth_mechanisms = digest-md5 cram-md5 plain apop doveadm_password = # hidden, use -P to show it first_valid_gid = 1000 first_valid_uid = 1000 lda_mailbox_autosubscribe = yes listen = * mail_attachment_dir = /vmail/attachments mail_gid = vmail mail_home = /vmail/%d/%n mail_location = mdbox:~/mdbox mail_plugins = quota zlib acl mail_shared_explicit_inbox = yes mail_uid = vmail managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext namespace { list = children location = mdbox:%%h/mdbox:INDEXPVT=~/mdbox/shared/%%u prefix = shared/%%u/ separator = / subscriptions = no type = shared } namespace inbox { inbox = yes location = mailbox Archives { special_use = \Archive } mailbox Drafts { special_use = \Drafts } mailbox Junk { auto = subscribe special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = separator = / } passdb { args = scheme=plain username_format=%n /usr/local/etc/dovecot/dovecot.auth/%d.passwd driver = passwd-file } plugin { acl = vfile acl_shared_dict = file:/vmail/shared-mailboxes.db antispam_backend = mailtrain antispam_mail_notspam = report_ham antispam_mail_sendmail = /usr/local/libexec/dovecot/dovecot-lda antispam_mail_sendmail_args = -d;spam(a)example.com;-m antispam_mail_spam = report_spam antispam_spam = Junk antispam_trash = Trash;train_ham;train_prob;train_spam quota = dict:User quota::file:%h/dovecot-quota quota_rule = *:storage=2G quota_rule2 = Trash:storage=+10%% quota_rule3 = Spam:storage=+20%% quota_status_nouser = DUNNO quota_status_success = DUNNO sieve_after = /usr/local/etc/dovecot/sieve/sieve.after sieve_before = /usr/local/etc/dovecot/sieve/sieve.before sieve_vacation_min_period = 0 zlib_save = gz zlib_save_level = 3 } postmaster_address = postmaster(a)example.com protocols = imap lmtp sieve pop3 quota_full_tempfail = yes service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0660 user = postfix } unix_listener auth-userdb { user = vmail } } service config { unix_listener config { mode = 0600 user = vmail } } service imap-login { inet_listener imaps { port = 0 } process_limit = 200 } service lmtp { unix_listener /var/spool/postfix/private/dovecot-lmtp { group = postfix mode = 0660 user = postfix } user = vmail } service pop3-login { inet_listener pop3s { port = 0 } } service quota-status { client_limit = 1 executable = quota-status -p postfix unix_listener /var/spool/postfix/private/quota-status { user = postfix } } ssl_cert = </etc/ssl/certs/mx.example.com.crt ssl_key = </etc/ssl/private/mx.example.com.key userdb { args = username_format=%n /usr/local/etc/dovecot/dovecot.auth/%d.passwd driver = passwd-file } verbose_proctitle = yes protocol imap { mail_plugins = quota zlib acl antispam imap_quota imap_zlib imap_acl } protocol lmtp { mail_plugins = quota zlib acl sieve }

1 1

Re: Make fails with 2.3.0.1 & 2.2.34 on Mac OS X 10.7.5
by James Brown 11 Jul '18

11 Jul '18

> On 2 Mar 2018, at 6:11 pm, James Brown <jlbrown(a)bordo.com.au> wrote: > > > >> On 2 Mar 2018, at 5:59 pm, Aki Tuomi <aki.tuomi(a)dovecot.fi> wrote: >> >> >> We have attempted to compile our code with OpenSSL 1.0, 1.0.2 and 1.1.0, but I'll try the specific releases too. >> >> Can you try this patch? >> >> diff --git a/src/lib-dcrypt/dcrypt-openssl.c b/src/lib-dcrypt/dcrypt-openssl.c >> index 26c9b91..187bb75 100644 >> --- a/src/lib-dcrypt/dcrypt-openssl.c >> +++ b/src/lib-dcrypt/dcrypt-openssl.c >> @@ -9,17 +9,17 @@ >> #include "array.h" >> #include "module-dir.h" >> #include "dovecot-openssl-common.h" >> -#include <openssl/evp.h> >> -#include <openssl/sha.h> >> -#include <openssl/err.h> >> -#include <openssl/rsa.h> >> -#include <openssl/ec.h> >> -#include <openssl/bio.h> >> -#include <openssl/pem.h> >> -#include <openssl/x509.h> >> -#include <openssl/engine.h> >> -#include <openssl/hmac.h> >> -#include <openssl/objects.h> >> +#include "openssl/evp.h" >> +#include "openssl/sha.h" >> +#include "openssl/err.h" >> +#include "openssl/rsa.h" >> +#include "openssl/ec.h" >> +#include "openssl/bio.h" >> +#include "openssl/pem.h" >> +#include "openssl/x509.h" >> +#include "openssl/engine.h" >> +#include "openssl/hmac.h" >> +#include "openssl/objects.h" >> #include "dcrypt.h" >> #include "dcrypt-private.h" >> >> And if it does not work, add after the includes >> >> #pragma message("OpenSSL version is " OPENSSL_VERSION_TEXT) >> #error See above >> >> And provide output? >> >> Aki Hi Aki, Change src/lib-dcrypt/dcrypt-openssl.c start to: /* Copyright (c) 2016-2017 Dovecot authors, see the included COPYING file */ #include "lib.h" #include "buffer.h" #include "str.h" #include "hex-binary.h" #include "safe-memset.h" #include "randgen.h" #include "array.h" #include "module-dir.h" #include "dovecot-openssl-common.h" #include "openssl/evp.h" #include "openssl/sha.h" #include "openssl/err.h" #include "openssl/rsa.h" #include "openssl/ec.h" #include "openssl/bio.h" #include "openssl/pem.h" #include "openssl/x509.h" #include "openssl/engine.h" #include "openssl/hmac.h" #include "openssl/objects.h" #include "dcrypt.h" #include "dcrypt-private.h" #pragma message("OpenSSL version is " OPENSSL_VERSION_TEXT) #error See above /** Ie changed the < and > to double quotes. Ran make clean, then ./configure and but it still fails. :-( dcrypt-openssl.c:25: warning: ignoring #pragma message dcrypt-openssl.c:26:2: error: #error See above dcrypt-openssl.c:118: error: field 'ctx' has incomplete type dcrypt-openssl.c: In function 'dcrypt_openssl_ctx_hmac_destroy': dcrypt-openssl.c:452: warning: implicit declaration of function 'HMAC_cleanup' dcrypt-openssl.c: In function 'dcrypt_openssl_generate_ec_key': dcrypt-openssl.c:556: error: dereferencing pointer to incomplete type dcrypt-openssl.c:557: error: dereferencing pointer to incomplete type dcrypt-openssl.c: In function 'dcrypt_openssl_ecdh_derive_secret_local': dcrypt-openssl.c:589: error: dereferencing pointer to incomplete type dcrypt-openssl.c: In function 'dcrypt_openssl_ecdh_derive_secret_peer': dcrypt-openssl.c:669: error: dereferencing pointer to incomplete type dcrypt-openssl.c:698: error: dereferencing pointer to incomplete type dcrypt-openssl.c:699: error: dereferencing pointer to incomplete type dcrypt-openssl.c: In function 'dcrypt_openssl_store_private_key_dovecot': dcrypt-openssl.c:1462: error: dereferencing pointer to incomplete type dcrypt-openssl.c:1483: error: dereferencing pointer to incomplete type dcrypt-openssl.c:1490: error: dereferencing pointer to incomplete type dcrypt-openssl.c: In function 'dcrypt_openssl_load_private_key': dcrypt-openssl.c:1616: error: dereferencing pointer to incomplete type dcrypt-openssl.c: In function 'dcrypt_openssl_store_public_key': dcrypt-openssl.c:1766: error: dereferencing pointer to incomplete type dcrypt-openssl.c: In function 'dcrypt_openssl_private_to_public_key': dcrypt-openssl.c:1802: error: dereferencing pointer to incomplete type dcrypt-openssl.c: In function 'dcrypt_openssl_name2oid': dcrypt-openssl.c:2063: error: dereferencing pointer to incomplete type dcrypt-openssl.c: In function 'dcrypt_openssl_public_key_id_old': dcrypt-openssl.c:2113: error: dereferencing pointer to incomplete type dcrypt-openssl.c: In function 'dcrypt_openssl_private_key_id_old': dcrypt-openssl.c:2136: error: dereferencing pointer to incomplete type dcrypt-openssl.c: In function 'dcrypt_openssl_public_key_id_evp': dcrypt-openssl.c:2154: error: dereferencing pointer to incomplete type make[3]: *** [libdcrypt_openssl_la-dcrypt-openssl.lo] Error 1 make[2]: *** [all-recursive] Error 1 make[1]: *** [all-recursive] Error 1 make: *** [all] Error 2 Thanks for your help. James.

1 1

use instance-name for syslog?
by A. Schulze 26 Jun '18

26 Jun '18

Hello, When running multiple instances of dovecot on the same host (or running multiple docker container), it is hard to distinguish logs from different processes: the syslog entries are all prefixed with the same identifier "dovecot" It is hardcoded here: https://github.com/dovecot/core/blob/master/src/lib-master/master-service.c… Would it make sense to use the already implemented instance-name as syslog ident? How do others solve that problem? Andreas

5 8

Race condition when setting flags (\Deleted) + expunge quickly, leaving mails not deleted
by Tomas Forsman 12 Jun '18

12 Jun '18

Hello. I seem to have found a race condition, when setting flags on multiple emails rapidly. 5 commands including login to reproduce. Problem found using mutt in real world usage. Seems to happen both with UID STORE 1:3 and UID STORE 1,2,3 .. I have tried with the following packages, with a minimized config in a throwaway vm: https://packages.debian.org/stretch/dovecot-core Package: dovecot-core (1:2.2.27-3+deb9u2) https://packages.debian.org/stretch-backports/dovecot-core Package: dovecot-core (1:2.2.34-2~bpo9+1) Also tested pristine: https://dovecot.org/releases/2.3/dovecot-2.3.0.1.tar.gz https://dovecot.org/releases/2.2/dovecot-2.2.34.tar.gz https://dovecot.org/releases/2.2/dovecot-2.2.35.tar.gz .. built on Debian9 with: # apt-get build-dep dovecot-core # bash configure --prefix=/scratch/dovecot-test Tried with both mailbox over NFS (backed by ext4), and also mailbox on ext4. On my test systems, I am only able to reproduce it with mbox_lazy_writes=no, but with production settings on a Ubuntu 14.04 with 1:2.2.9-1ubuntu2.4 that has mbox_lazy_writes=yes it is still reproducable with mutt. I have found two different ways to reproduce it with netcat + cut'n'paste, below is done with 2.2.34/35. All servers are VMs in Ganeti/kvm clusters (Debian hosts in one cluster&organization, Ubuntu host in another cluster&organization). Debian minimized config: > doveconf -n # 2.2.34 (874deae): /etc/dovecot/dovecot.conf # Pigeonhole version 0.4.22 (22940fb7) # OS: Linux 4.9.0-6-amd64 x86_64 Debian 9.4 # Hostname: mail2-vm.cs.umu.se auth_mechanisms = plain login auth_verbose = yes debug_log_path = syslog info_log_path = syslog mail_location = mbox:~/Mail:INBOX=/var/mail/%u mail_privileged_group = mail mbox_lazy_writes = no namespace inbox { inbox = yes location = prefix = } passdb { driver = pam } protocols = imap service auth { client_limit = 2500 unix_listener auth-client { group = postfix mode = 0660 } } service imap-login { inet_listener imap { port = 143 } } service imap { executable = imap } ssl = no syslog_facility = local1 userdb { driver = passwd } Attached is a mailbox that can be used to reproduce the problem, called "error-box", anonymized with mbox-anonymize.pl. It was created by sending test messages with mutt 1.7.2 through Dovecot/Postfix/Amavis. **** Method 1, with IDLE: Setup a local account, MY-USER / MY-PASSWORD (replace below). > mkdir Mail > cp error-box Mail/error1 > nc -v localhost 143 Paste the following 3 lines in a go: a0000 LOGIN "MY-USER" "MY-PASSWORD" a0010 SELECT "error1" a0020 IDLE then wait a second.. then paste the following 3 in a go: DONE a0030 UID STORE 1:3 +FLAGS (\Deleted) a0040 EXPUNGE Notice that the results from UID STORE + EXPUNGE gives: * 2 FETCH (UID 2 FLAGS (\Recent)) * 3 FETCH (UID 3 FLAGS (\Recent)) * 1 EXPUNGE * 3 RECENT a0030 OK Store completed (0.004 + 0.000 + 0.003 secs). a0040 OK Expunge completed (0.004 + 0.000 + 0.003 secs). Verify what's left in the mailbox with: a0050 UID FETCH 1:4 FLAGS * 1 FETCH (UID 2 FLAGS (\Recent)) * 2 FETCH (UID 3 FLAGS (\Recent)) * 3 FETCH (UID 4 FLAGS (\Recent)) a0050 OK Fetch completed (0.001 + 0.000 secs). Since 1 to 3 should be \Deleted and then EXPUNGEd, we should only have UID 4 left, not uid 2-4 without Deleted flag. Try same again, but with 1 inserted delay (use a new mailbox name for every test, otherwise UID numbering will vary, indexes etc): > cp error-box Mail/error2 > nc -v localhost 143 Paste the following 3 lines in a go: a0000 LOGIN "MY-USER" "MY-PASSWORD" a0010 SELECT "error2" a0020 IDLE then wait a second.. then paste 1 line: DONE then [newly introduced] wait a second.. then paste 2 lines: a0030 UID STORE 1:3 +FLAGS (\Deleted) a0040 EXPUNGE Notice that the results from UID STORE + EXPUNGE gives: * 1 FETCH (UID 1 FLAGS (\Deleted \Recent)) * 2 FETCH (UID 2 FLAGS (\Deleted \Recent)) * 3 FETCH (UID 3 FLAGS (\Deleted \Recent)) a0030 OK Store completed (0.003 + 0.000 + 0.002 secs). * 3 EXPUNGE * 2 EXPUNGE * 1 EXPUNGE * 1 RECENT a0040 OK Expunge completed (0.003 + 0.000 + 0.002 secs). Verify what's left in the mailbox with: a0050 UID FETCH 1:4 FLAGS * 1 FETCH (UID 4 FLAGS (\Recent)) a0050 OK Fetch completed (0.001 + 0.000 secs). So if I wait some between DONE and UID STORE, it seems to be ok. If I, in the problem-triggering method, change a0030 UID STORE 1:3 +FLAGS (\Deleted) a0040 EXPUNGE to a0030 UID STORE 1:3 +FLAGS (\Deleted) a0035 UID FETCH 1:4 FLAGS a0040 EXPUNGE The untagged responses become: * 1 FETCH (UID 1 FLAGS (\Deleted \Recent)) * 2 FETCH (UID 2 FLAGS (\Deleted \Recent)) * 3 FETCH (UID 3 FLAGS (\Deleted \Recent)) * 4 FETCH (UID 4 FLAGS (\Recent)) * 2 FETCH (UID 2 FLAGS (\Recent)) * 3 FETCH (UID 3 FLAGS (\Recent)) * 1 EXPUNGE * 3 RECENT Full transcript (in&out from screen) from first, failing, run: localhost [127.0.0.1] 143 (imap2) open * OK [CAPABILITY IMAP4rev1 LITERAL+ SASL-IR LOGIN-REFERRALS ID ENABLE IDLE AUTH=PLAIN AUTH=LOGIN] Dovecot (Debian) ready. a0000 LOGIN "MY-USERNAME" "MY-PASSWORD" a0010 SELECT "error1" a0020 IDLE a0000 OK [CAPABILITY IMAP4rev1 LITERAL+ SASL-IR LOGIN-REFERRALS ID ENABLE IDLE SORT SORT=DISPLAY THREAD=REFERENCES THREAD=REFS THREAD=ORDEREDSUBJECT MULTIAPPEND URL-PARTIAL CATENATE UNSELECT CHILDREN NAMESPACE UIDPLUS LIST-EXTENDED I18NLEVEL=1 CONDSTORE QRESYNC ESEARCH ESORT SEARCHRES WITHIN CONTEXT=SEARCH LIST-STATUS BINARY MOVE SNIPPET=FUZZY] Logged in * FLAGS (\Answered \Flagged \Deleted \Seen \Draft) * OK [PERMANENTFLAGS (\Answered \Flagged \Deleted \Seen \Draft \*)] Flags permitted. * 4 EXISTS * 4 RECENT * OK [UNSEEN 1] First unseen. * OK [UIDVALIDITY 1520944853] UIDs valid * OK [UIDNEXT 5] Predicted next UID a0010 OK [READ-WRITE] Select completed (0.003 + 0.000 + 0.004 secs). + idling DONE a0030 UID STORE 1:3 +FLAGS (\Deleted) a0040 EXPUNGE a0020 OK Idle completed (7.805 + 7.804 + 7.804 secs). * 2 FETCH (UID 2 FLAGS (\Recent)) * 3 FETCH (UID 3 FLAGS (\Recent)) * 1 EXPUNGE * 3 RECENT a0030 OK Store completed (0.004 + 0.000 + 0.003 secs). a0040 OK Expunge completed (0.004 + 0.000 + 0.003 secs). a0050 UID FETCH 1:4 FLAGS * 1 FETCH (UID 2 FLAGS (\Recent)) * 2 FETCH (UID 3 FLAGS (\Recent)) * 3 FETCH (UID 4 FLAGS (\Recent)) a0050 OK Fetch completed (0.001 + 0.000 secs). Full transcript (in&out from screen) from the second, slower, run: localhost [127.0.0.1] 143 (imap2) open * OK [CAPABILITY IMAP4rev1 LITERAL+ SASL-IR LOGIN-REFERRALS ID ENABLE IDLE AUTH=PLAIN AUTH=LOGIN] Dovecot (Debian) ready. a0000 LOGIN "MY-USERNAME" "MY-PASSWORD" a0010 SELECT "error2" a0020 IDLE a0000 OK [CAPABILITY IMAP4rev1 LITERAL+ SASL-IR LOGIN-REFERRALS ID ENABLE IDLE SORT SORT=DISPLAY THREAD=REFERENCES THREAD=REFS THREAD=ORDEREDSUBJECT MULTIAPPEND URL-PARTIAL CATENATE UNSELECT CHILDREN NAMESPACE UIDPLUS LIST-EXTENDED I18NLEVEL=1 CONDSTORE QRESYNC ESEARCH ESORT SEARCHRES WITHIN CONTEXT=SEARCH LIST-STATUS BINARY MOVE SNIPPET=FUZZY] Logged in * FLAGS (\Answered \Flagged \Deleted \Seen \Draft) * OK [PERMANENTFLAGS (\Answered \Flagged \Deleted \Seen \Draft \*)] Flags permitted. * 4 EXISTS * 4 RECENT * OK [UNSEEN 1] First unseen. * OK [UIDVALIDITY 1520944957] UIDs valid * OK [UIDNEXT 5] Predicted next UID a0010 OK [READ-WRITE] Select completed (0.003 + 0.000 + 0.004 secs). + idling DONE a0020 OK Idle completed (2.830 + 2.829 + 2.829 secs). a0030 UID STORE 1:3 +FLAGS (\Deleted) a0040 EXPUNGE * 1 FETCH (UID 1 FLAGS (\Deleted \Recent)) * 2 FETCH (UID 2 FLAGS (\Deleted \Recent)) * 3 FETCH (UID 3 FLAGS (\Deleted \Recent)) a0030 OK Store completed (0.003 + 0.000 + 0.002 secs). * 3 EXPUNGE * 2 EXPUNGE * 1 EXPUNGE * 1 RECENT a0040 OK Expunge completed (0.003 + 0.000 + 0.002 secs). a0050 UID FETCH 1:4 FLAGS * 1 FETCH (UID 4 FLAGS (\Recent)) a0050 OK Fetch completed (0.001 + 0.000 secs). Transcript from .muttdebug0 when using mutt 1.7.2 against the production server with NFS backed storage, marking message 1-3 for deletion and hitting $ for sync. This is how the problem was first found. [2018-03-12 13:46:28] 5> a0020 IDLE^M [2018-03-12 13:46:28] 5< + idling ... [2018-03-12 13:46:29] Marking 3 messages deleted... [2018-03-12 13:46:29] Expunging messages from server... [2018-03-12 13:46:29] 5> DONE^M a0021 UID STORE 1:3 +FLAGS.SILENT (\Deleted)^M a0022 EXPUNGE^M [2018-03-12 13:46:29] 5< a0020 OK Idle completed (0.001 + 1.634 + 1.633 secs). [2018-03-12 13:46:29] 5< * 2 FETCH (FLAGS (\Recent)) [2018-03-12 13:46:29] Handling FETCH [2018-03-12 13:46:29] FETCH response ignored for this message [2018-03-12 13:46:29] 5< * 3 FETCH (FLAGS (\Recent)) [2018-03-12 13:46:29] Handling FETCH [2018-03-12 13:46:29] FETCH response ignored for this message [2018-03-12 13:46:29] 5< * 1 EXPUNGE [2018-03-12 13:46:29] Handling EXPUNGE [2018-03-12 13:46:29] 5< * 3 RECENT [2018-03-12 13:46:29] 5< a0021 OK Store completed (0.001 + 0.000 + 0.001 secs). [2018-03-12 13:46:29] 5< a0022 OK Expunge completed (0.001 + 0.000 secs). [2018-03-12 13:46:29] IMAP queue drained [2018-03-12 13:46:29] imap_cmd_finish: Expunging mailbox *** Method 2, without IDLE (seems to require that I fetch flags before the wait/store) Copy'n'paste the following: a0000 LOGIN "MY-USER" "MY-PASSWORD" a0010 SELECT "error20" a0015 FETCH 1:4 (UID FLAGS) <wait a second, then paste the next two in one go> a0020 UID STORE 1:3 +FLAGS (\Deleted) a0025 EXPUNGE Gives the following transcript: mail3-vm:~/Mail> nc -v localhost 143 localhost [127.0.0.1] 143 (imap2) open * OK [CAPABILITY IMAP4rev1 LITERAL+ SASL-IR LOGIN-REFERRALS ID ENABLE IDLE AUTH=PLAIN AUTH=LOGIN] Dovecot ready. a0000 LOGIN "MY-USER" "MY-PASSWORD" a0010 SELECT "error20" a0015 FETCH 1:4 (UID FLAGS) a0000 OK [CAPABILITY IMAP4rev1 LITERAL+ SASL-IR LOGIN-REFERRALS ID ENABLE IDLE SORT SORT=DISPLAY THREAD=REFERENCES THREAD=REFS THREAD=ORDEREDSUBJECT MULTIAPPEND URL-PARTIAL CATENATE UNSELECT CHILDREN NAMESPACE UIDPLUS LIST-EXTENDED I18NLEVEL=1 CONDSTORE QRESYNC ESEARCH ESORT SEARCHRES WITHIN CONTEXT=SEARCH LIST-STATUS BINARY MOVE SNIPPET=FUZZY] Logged in * FLAGS (\Answered \Flagged \Deleted \Seen \Draft) * OK [PERMANENTFLAGS (\Answered \Flagged \Deleted \Seen \Draft \*)] Flags permitted. * 4 EXISTS * 4 RECENT * OK [UNSEEN 1] First unseen. * OK [UIDVALIDITY 1521552107] UIDs valid * OK [UIDNEXT 5] Predicted next UID a0010 OK [READ-WRITE] Select completed (0.001 + 0.000 + 0.001 secs). * 1 FETCH (UID 1 FLAGS (\Recent)) * 2 FETCH (UID 2 FLAGS (\Recent)) * 3 FETCH (UID 3 FLAGS (\Recent)) * 4 FETCH (UID 4 FLAGS (\Recent)) a0015 OK Fetch completed (0.001 + 0.000 secs). a0020 UID STORE 1:3 +FLAGS (\Deleted) a0025 EXPUNGE * 2 FETCH (UID 2 FLAGS (\Recent)) * 3 FETCH (UID 3 FLAGS (\Recent)) * 1 EXPUNGE * 3 RECENT a0020 OK Store completed (0.001 + 0.000 secs). a0025 OK Expunge completed (0.001 + 0.000 secs). /Tomas -- Tomas Forsman, stric(a)cs.umu.se, http://people.cs.umu.se/stric/ `- SysAdmin at Computing Science, University of Umeå

2 3

Re: 2.3.1 Replication is throwing scary errors
by Reuben Farrelly 08 Jun '18

08 Jun '18

Hi Andy, Funny you say that - I've been testing this very problem for some time today to narrow down the commits where I think the problem started occurring. So far I have been able to roll forward to commit from git: 74ef8506dcb946acc42722683e49fdcb964eed19 >> "doveadm: Unref header search context after use" . So far I have been running on that code for a few hours and I'm not yet seeing the problem, which indicates the issue is probably subsequent to this. I'm of the view that the problem started occurring somewhere between that commit above on 6 March and the final 2.3.1 release on 27 March. There are a lot of changes between those two dates, and testing to narrow down to one specific commit is extremely time consuming. It would be really helpful if even one of the Dovecot developers could comment on this and give us some direction (or candidate commits to investigate) or just let us know if the root cause has been found. This bug is a showstopper and has stopped me tracking master-2.3 for over 3 months now, as I can't test later builds or even upgrade to the 2.3.1 release while replication is so broken. Reuben > Message: 1 > Date: Sun, 6 May 2018 13:21:57 +1000 > From: Andy Weal <andy(a)bizemail.com.au> > To: dovecot(a)dovecot.org > Subject: 2.3.1 Replication is throwing scary errors > Message-ID: <f4274128-350b-9a74-a344-8e6caeffa112(a)bizemail.com.au> > Content-Type: text/plain; charset="utf-8"; Format="flowed" > > Hi all, > > New to the mailing lists but have joined up because of above */2.3.1 > Replication is throwing scary errors > > > /*Brief system configuration > ??? MX1 - Main > ??? ??? Freebsd 11.1-Release-p9 > ??? ??? Hosted on a Vultr VM in Sydney AU > ??? ??? MTA = Postfix 3.4-20180401 > ??? ??? Dovecot = 2.3.1 > ??? ??? File system = ufs > ??? MX2 - Backup > ??? ??? Freebsd 11.1-Release-p9 > ??? ???? Running on bare metal - no VM or jails > ??? ??? MTA = Postfix 3.4-20180401 > ??? ??? Dovecot = 2.3.1 > ??? ??? File system = ufs ( on SSD) > > */ > /*Brief sequence of events > > 1. ??? apx 10 days back upgraded both mx1 and mx2 to dovecot 2.3.1_2 > from 2.3.0 ? (service dovecot stop, portmaster upgrade, service > dovecot start) > 2. ??? both systems ran ok with no errors for 10 days. > 3. ??? Last night I shutdown mx2 and restarted it a few hours later > 4. ??? within minutes i was getting the following types of errors on mx2 > > ???????? May 06 12:56:29 doveadm: Error: Couldn't lock > /var/mail/vhosts/example.net/user1/.dovecot-sync.lock: > fcntl(/var/mail/vhosts/example.net/user1/.dovecot-sync.lock, write-lock, > F_SETLKW) locking failed: Timed out after 30 seconds (WRITE lock held by > pid 1960) > > ? Before i venture down the rabbit hole of fault finding and excess > coffee consumption I was wondering if any of you had any updates on the > problems discussed below. > > > Cheers for now, > Andy > > > > Hi, > > [Formatting is a bit rough, replying from a trimmed digest email] > >> /Message: 1 />/Date: Fri, 6 Apr 2018 15:04:35 +0200 />/From: Michael Grimm <trashcan at ellael.org > <https://dovecot.org/mailman/listinfo/dovecot>> />/To: Dovecot Mailing List <dovecot at dovecot.org > <https://dovecot.org/mailman/listinfo/dovecot>> />/Subject: Re: 2.3.1 Replication is throwing scary errors />/Message-ID: <E7E7A927-68F8-443F-BA59-E66CED8FE878 at ellael.org > <https://dovecot.org/mailman/listinfo/dovecot>> />/Content-Type: text/plain; charset=utf-8 />//>/Reuben Farrelly wrote: />>/From: Michael Grimm <trashcan at ellael.org > <https://dovecot.org/mailman/listinfo/dovecot>> />//>>>/[This is Dovecot 2.3.1 at FreeBSD STABLE-11.1 running in two jails at > distinct servers.] />>>/I did upgrade from 2.2.35 to 2.3.1 today, and I do become pounded by > error messages at server1 (and vice versa at server2) as follows: />>>/| Apr 2 17:12:18 <mail.err> server1.lan dovecot: doveadm: Error: > dsync(server2.lan): I/O has stalled, \ />>>/no activity for 600 seconds (last sent=mail_change, last > recv=mail_change (EOL)) />>>/| Apr 2 17:12:18 <mail.err> server1.lan dovecot: doveadm: Error: Timeout > during state=sync_mails \ />>>/(send=changes recv=mail_requests) />>>/[?] />>>/| Apr 2 18:59:03 <mail.err> server1.lan dovecot: doveadm: Error: > dsync(server2.lan): I/O has stalled, \ />>>/no activity for 600 seconds (last sent=mail, last recv=mail (EOL)) />>>/| Apr 2 18:59:03 <mail.err> server1.lan dovecot: doveadm: Error: Timeout > during state=sync_mails \ />>>/(send=mails recv=recv_last_common) />>>/I cannot see in my personal account any missing replications, *but* I > haven't tested this thoroughly enough. I do have customers being > serviced at these productive servers, *thus* I'm back to 2.2.35 until I > do understand or have learned what is going on. />//>/In my reply to this statement of mine I mentioned that I have seen those > timeouts quite some times during the past year. Thus, I upgraded to > 2.3.1 again, and boom: after some hours I ended up in hanging processes > [1] like (see Remko's mail in addition) ... />//>/doveadm-server: [IP4/6 <USER1> SOME/MAILBOX import:0/0] (doveadm-server) />//>/? at server2 paired with a file like ? />//>/-rw------- 1 vmail dovecot uarch 0 Apr 3 16:52 > /home/to/USER1/.dovecot-sync.lock />//>/Corresponding logfile entries at server2 are like ? />//>/Apr 3 17:10:49 <mail.err> server2.lan dovecot: doveadm: Error: Couldn't > lock /home/to/USER1/.dovecot-sync.lock: \ />/fcntl(/home/to/USER1/.dovecot-sync.lock, write-lock, F_SETLKW) locking > failed: Timed out after 30 seconds \ />/(WRITE lock held by pid 51110) />//>/[1] Even stopping dovecot will not end those processes. One has to > manually kill those before restarting dovecot. />//>/After one day of testing 2.3.1 with a couple of those episodes of > locking/timeout, and now missing mails depending with server your MUA > will connect to, I went back to 2.2.35. After two days at that version I > never had such an episode again. />//>>/It's not just you. This issue hit me recently, and it was impacting />>/replication noticeably. I am following git master-2.3 . />/[...] />>/There is also a second issue of a long standing race with replication />>/occurring somewhere whereby if a mail comes in, is written to disk, is />>/replicated and then deleted in short succession, it will reappear />>/again to the MUA. I suspect the mail is being replicated back from />>/the remote. A few people have reported it over the years but it's not />>/reliable or consistent, so it has never been fixed. />>/And lastly there has been an ongoing but seemingly minor issue />>/relating to locking timing out after 30s particularly on the remote />>/host that is being replicated to. I rarely see the problem on my />>/local disk where almost all of the mail comes in, it's almost always />>/occurring on the replicate/remote system. />//>/It might be time to describe our setups in order to possibly find co > mmon > grounds that might trigger this issue you describe and Rimko and myself > ran into as well. />//>/Servers: Cloud Instances (both identical), around 25ms latency apart. />/Intel Core Processor (Haswell, no TSX) (3092.91-MHz K8-class CPU) />/Both servers are connected via IPsec/racoon tunnels />/OS: FreeBSD 11.1-STABLE (both servers) />/Filesystem: ZFS />/MTA: postfix 3.4-20180401 (postfix delivers via dovecot's LMTP) />/IMAP: dovecot running in FreeBSD jails (issues with 2.3.1, fine with > 2.2.35) />/Replication: unsecured tcp / master-master />/MUA: mainly iOS or macOS mail.app, rarely roundcube / > For me: > > Servers: Main: VM on a VMWare ESXi local system (light > load), local SSD disks (no NFS) > Redundant: Linode VM in Singapore, around 250ms away > Also no NFS. Linode use SSDs for IO. > There is native IPv6 connectivity between both VMs. > As I am using TCPs I don't have a VPN between them - > just raw IPv6 end to end. > OS: Gentoo Linux x86_64 kept well up to date > Filesystem: EXT4 for both > MTA: Postfix 3.4-x (same as you) > IMAP: Dovecot running natively on the machine (no jail/chroot) > Replication: Secured TCP / master-master (but only one master is > actively used for SMTP and MUA access) > MUA: Thunderbird, Maildroid, MS Mail, Gmail client, > Roundcube, LG Mail client on handset etc > >> /I believe it is worthwhile to mention here that I run a poor man's > fail-over approach (round-robin DNS) as follows: />//>/DNS: mail.server.tld resolves to one IP4 and one IP6 address of each > server, thus 4 IP addresses in total / > For me I have a simple pair of servers that replicate mail to each > other. Clients connect to the main server only, which is where mail > comes in. The second one that experiences the problem with locking is > only a redundant server which is a secondary MX, that only gets > occasional SMTP deliveries from time to time. So the amount of > replication back from the "secondary" is very minimal; the vast bulk of > the replication is the primary replicating changes out. > > Reuben >

8 20

offtopic: Solr compatible IMAP client
by Andy Smith 04 Jun '18

04 Jun '18

Hi, not sure if I'm allowed to go this off topic on here, sorry if not! I've just installed Solr FTS for Dovecot and its great, as is Dovecot! ;) It works perfectly for fast searches using Roundcube, but can anyone suggest any Windows and/or Linux mail clients that work well with IMAP searches rather than doing their own searches on local copies of mails? I've had a look at Thunderbird and you can use IMAP search, buy you have to manually select it from an advanced search dialogue and it seems you cannot make this the default behaviour. I also tried OperaMail but it doesn't appear to work at all (only header is searchable without downloading local copies). I'm pretty sure Outlook will only use its own search engine on its local copy of data. thanks a lot, Andy. PS this guide was really helpful for setting up Solr FTS with a recent release of Solr (I'm using 6.5), might be worth including a link somewhere on the Dovecot wiki?: http://mor-pah.net/2016/08/15/dovecot-2-2-with-solr-6-or-5

4 7

Re: SSL error after upgrading to 2.31
by Aki Tuomi 01 Jun '18

01 Jun '18

You forgot to cc the list. ssl_ca is used only for validating client certificates. ---Aki TuomiDovecot oy -------- Original message --------From: Marc Perkel <marc(a)perkel.com> Date: 21/05/2018 18:25 (GMT+02:00) To: Aki Tuomi <aki.tuomi(a)dovecot.fi> Subject: Re: SSL error after upgrading to 2.31 On 05/21/2018 07:54 AM, Aki Tuomi wrote: Does ssl_cert file contain intermediates? No - but the ssl_ca does. --- Aki Tuomi Dovecot oy -------- Original message -------- From: Marc Perkel <marc(a)perkel.com> Date: 21/05/2018 16:32 (GMT+02:00) To: dovecot(a)dovecot.org Subject: SSL error after upgrading to 2.31 After upgrading to 2.31 I'm getting this error. Not sure what I'm doing wrong. No (No signatures could be verified because the chain contains only one certificate and it is not self signed.) ssl = yes ssl_cert = </etc/exim/certs/ctyme.com.crt ssl_key = </etc/exim/certs/ctyme.com.key ssl_ca = </etc/exim/certs/ca.crt local mail.ctyme.com { protocol imap { ssl_cert = </etc/exim/certs/ctyme.com.crt ssl_key = </etc/exim/certs/ctyme.com.key ssl_ca = </etc/exim/certs/ca.crt } protocol pop3 { ssl_cert = </etc/exim/certs/ctyme.com.crt ssl_key = </etc/exim/certs/ctyme.com.key ssl_ca = </etc/exim/certs/ca.crt } } local mail.junkemailfilter.com { protocol imap { ssl_cert = </etc/exim/certs/junkemailfilter.com.crt ssl_key = </etc/exim/certs/junkemailfilter.com.key ssl_ca = </etc/exim/certs/ca.crt } protocol pop3 { ssl_cert = </etc/exim/certs/junkemailfilter.com.crt ssl_key = </etc/exim/certs/junkemailfilter.com.key ssl_ca = </etc/exim/certs/ca.crt } }

3 9