September 2018 - dovecot

Dsync deleting mailboxes due to duplicate UIDs
by Andreas Thienemann 16 Sep '18

16 Sep '18

Hi, I am attempting to migrate a mailspool from a cyrus server to a dovecot server using the dsync backup approach as described in the wiki at <https://wiki.dovecot.org/Migration/Dsync>. The first attempt works great. Everything copies over and a quick glance over the spool looks good. Running doveadm backup again though results in the following error: dsync(eggs): Warning: Deleting mailbox 'INBOX.MailRestore': UID=39 already exists locally for a different mail: Headers hashes don't match (18d567fc7e258a67e47b629c8bb16500 vs 230354b2d5cad21ebbb4a7440b977adb) As promised, the folder MailRestore is gone after dsync finishes. Running doveadm backup again for the third time copies the folder again. Running it a fourth time gives the same error and the folder is gone. Trying to figure this out I initially had a few mails where the header hashes were 68b329da9893e34099c7d8ad5cb9c940, the md5sum of an empty string. Turns out that the source mailspool had a few broken emails and cleaning these out fixed most my issues. But in this case, I am stumped. UID 39 on the server is a valid mail with correct headers and everything. Is there a good way of identifying the two mails that seem to clash? I had a quick look at the dovecot code but did not see how the header_stream gets hashed into the hdr_hash used for comparing mails. Thanks, Andreas

3 5

dovecot_deleted_to_trash no longer compiles with dovecot 2.3.2.1
by Robert S 16 Sep '18

16 Sep '18

I have just upgraded to the latest version of dovecot (Gentoo amd64). When I try to compile the dovecot_deleted_to_trash plugin it won't compile. Is this plugin going to be updated (from https://github.com/lexbrugman/dovecot_deleted_to_trash - same error from https://github.com/NethServer/dovecot-deleted-to-trash)? # make cc \ -fPIC -shared -Wall \ -I/usr/include/dovecot \ -I/usr/include/dovecot/src \ -I/usr/include/dovecot/src/lib \ -I/usr/include/dovecot/src/lib-storage \ -I/usr/include/dovecot/src/lib-mail \ -I/usr/include/dovecot/src/lib-imap \ -I/usr/include/dovecot/src/lib-index \ -DHAVE_CONFIG_H \ src/deleted-to-trash-plugin.c -o lib_deleted_to_trash_plugin.so src/deleted-to-trash-plugin.c: In function ‘copy_deleted_mail_to_trash’: src/deleted-to-trash-plugin.c:117:16: error: too few arguments to function ‘mail box_transaction_begin’ dest_trans = mailbox_transaction_begin(trash_box, MAILBOX_TRANSACTION_FLAG_EX TERNAL); ^~~~~~~~~~~~~~~~~~~~~~~~~ In file included from /usr/include/dovecot/mail-storage-private.h:7:0, from src/deleted-to-trash-plugin.h:5, from src/deleted-to-trash-plugin.c:4: /usr/include/dovecot/mail-storage.h:656:1: note: declared here mailbox_transaction_begin(struct mailbox *box, ^~~~~~~~~~~~~~~~~~~~~~~~~ make: *** [Makefile:32: lib_deleted_to_trash_plugin.so] Error 1 Some further info: # dovecot -n # 2.3.2.1 (0719df592): /etc/dovecot/dovecot.conf # OS: Linux 4.14.8-gentoo-r1 x86_64 Gentoo Base System release 2.4.1 # Hostname: basement-vm.schmidli.com.au doveconf: Warning: please set ssl_dh=</etc/dovecot/dh.pem doveconf: Warning: You can generate it with: dd if=/var/lib/dovecot/ssl-parameters.dat bs=1 skip=88 | openssl dhparam -inform der > /etc/dovecot/dh.pem dict { expire = db:/var/lib/dovecot/expire.db } disable_plaintext_auth = no listen = * mail_location = maildir:~/.maildir mail_plugins = deleted_to_trash mailbox_alias namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } passdb { args = * driver = pam } plugin { deleted_to_trash_folder = Trash expire = Trash 7 Spam 30 expire_dict = proxy::expire

1 0

Re: auth_policy in a non-authenticating proxy chain
by Peter Mogensen 15 Sep '18

15 Sep '18

On 09/15/2018 10:41 AM, Aki Tuomi wrote: > Point of sending the success ones is to maintain whitelist as well as > blacklist so you know which ones you should not tarpit anymore. We > know it does scale as we have very large deployments using the whole > three request per login model. > > "Success" in a proxy which is not it self authenticating is only whether it know where to proxy the requested username to. I'm not sure whether this would be input to a whitelist. I'm not doubting that 3 req/login scales. /Peter

2 1

auth_policy in a non-authenticating proxy chain
by Peter Mogensen 15 Sep '18

15 Sep '18

Hi, I was looking into the new Authentication Policy feature: https://wiki2.dovecot.org/Authentication/Policy I had kinda hoped that I would be able to enfore this in a proxy running in front of several backends. This proxy does not authenticate. It use "nopassword". But I realize that the "succes" reported in the final authpolicy req. (command=report) is not what is actaully happening on the IMAP protocol level, but rather the result of the passdb chain in the proxy. (I should probably have predicted this, it's kinda reasonable). However... since the proxy use "nopassword", ALL passdb lookups result in "success", so the proxy will never report an authentication failure to the authpolicy server. This, of course, forces me to do the authpolicy check on the backend with a shared state, but It would still have been nice to have the proxy being able to do the first "command=allow" req. and reject attemps already there even though the backend does "command=report". /Peter

3 4

encryption issue in outlook 2016
by ChandranManikandan 14 Sep '18

14 Sep '18

Hi Friends, Am facing the serious issue in outlook 2016. When i tried to configure the email in outlook 2016 it's asking encrypted connection and checked automatically and if not available then it showing unencrypted. but finally unable to configure the email account in outlook 2016 and not permitted. Do i need to update any in the server. Am using COS 6 32 and 64 bit servers with qmailtoaster + dovecot 2.2.7. Currently configured in outlook 2010 it's working without any issue. And always showing in outlook 2010 when i open the account. Do you want to continue yes or no for the certification. Because i have configured in advanced selected Auto in outlook 2010. If i select none it was not working the email. Anyone facing the same issue. How do i rectify it in outlook 2016 and how can i stop the certificate warning message in outlook. If possible to use without encryption and what's the configuration. Please advice and let me know the process. Am seriously cannot access the email from outlook. I have attached the message while open outlook. If i click yes then it will open Is the certificate expired. How do renew it or reload it with the fresh certificate. -- *Thanks & Best Regards,Manikandan.C*

4 4

Occasional crash in db-auth.c (Valgrind: Invalid read of size 4 et al.), Dovecot 2.2.27+
by Jonas Wielicki 14 Sep '18

14 Sep '18

Dear list, We are encountering troubles with dovecot using LDAP userdbs on Debian stretch (but if I’m reading valgrind correctly, we can reproduce this with vanilla dovecot master). Minimal reproducer below. While testing an upgrade to Debian stretch (dovecot-core=1:2.2.27-3+deb9u1), auth-worker has stopped working. We are using two LDAP user databases; one which is iterable, and one which is not (for reasons; I think this is not relevant; if it is, we’re happy to elaborate). The issue seems to be present in any LDAP userdb iteration handling, but it only seems to cause a crash in certain conditions which seem to be reproducibly caused by our setup for some reason. We’re seeing one of two errors. Variant A: Jan 27 13:40:05 up2 dovecot: auth-worker: Error: *** Error in `dovecot/auth': free(): corrupted unsorted chunks: 0x000056553f0fcfa0 *** Jan 27 13:40:05 up2 dovecot: auth-worker: Error: ======= Backtrace: ========= Jan 27 13:40:05 up2 dovecot: auth-worker: Error: /lib/x86_64-linux-gnu/ libc.so.6(+0x70bcb)[0x7f78426adbcb] Jan 27 13:40:05 up2 dovecot: auth-worker: Error: /lib/x86_64-linux-gnu/ libc.so.6(+0x76f96)[0x7f78426b3f96] Jan 27 13:40:05 up2 dovecot: auth-worker: Error: /lib/x86_64-linux-gnu/ libc.so.6(+0x777de)[0x7f78426b47de] Jan 27 13:40:05 up2 dovecot: auth-worker: Error: /usr/lib/dovecot/modules/ auth/libauthdb_ldap.so(+0x5bde)[0x7f7842008bde] Jan 27 13:40:05 up2 dovecot: auth-worker: Error: /usr/lib/dovecot/ libdovecot.so.0(io_loop_call_io+0x52)[0x7f78430cfdd2] Jan 27 13:40:05 up2 dovecot: auth-worker: Error: /usr/lib/dovecot/ libdovecot.so.0(io_loop_handler_run_internal+0x109)[0x7f78430d1409] Jan 27 13:40:05 up2 dovecot: auth-worker: Error: /usr/lib/dovecot/ libdovecot.so.0(io_loop_handler_run+0x3c)[0x7f78430cfe6c] Jan 27 13:40:05 up2 dovecot: auth-worker: Error: /usr/lib/dovecot/ libdovecot.so.0(io_loop_run+0x38)[0x7f78430d0018] Jan 27 13:40:05 up2 dovecot: auth-worker: Error: /usr/lib/dovecot/ libdovecot.so.0(master_service_run+0x13)[0x7f7843057e93] Jan 27 13:40:05 up2 dovecot: auth-worker: Error: dovecot/auth(main+0x398) [0x56553da45f98] Jan 27 13:40:05 up2 dovecot: auth-worker: Error: /lib/x86_64-linux-gnu/ libc.so.6(__libc_start_main+0xf1)[0x7f784265d2b1] Jan 27 13:40:05 up2 dovecot: auth-worker: Error: dovecot/auth(_start+0x2a) [0x56553da461aa] Variant B: Jan 27 13:06:56 up2 dovecot: auth-worker(27495): Panic: file db-ldap.c: line 840 (db_ldap_result_unref): assertion failed: (res->refcount > 0) Jan 27 13:06:56 up2 dovecot: auth-worker(27495): Error: Raw backtrace: /usr/ lib/dovecot/libdovecot.so.0(+0x95272) [0x7f027a4fc272] -> /usr/lib/dovecot/ libdovecot.so.0(+0x9536d) [0x7f027a4fc36d] -> /usr/lib/dovecot/libdovecot.so. 0(i_fatal+0) [0x7f027a492951] -> /usr/lib/dovecot/modules/auth/ libauthdb_ldap.so(+0x3868) [0x7f0279447868] -> /usr/lib/dovecot/modules/auth/ libauthdb_ldap.so(+0x5d7c) [0x7f0279449d7c] -> /usr/lib/dovecot/libdovecot.so. 0(io_loop_call_io+0x52) [0x7f027a510dd2] -> /usr/lib/dovecot/libdovecot.so. 0(io_loop_handler_run_internal+0x109) [0x7f027a512409] -> /usr/lib/dovecot/ libdovecot.so.0(io_loop_handler_run+0x3c) [0x7f027a510e6c] -> /usr/lib/ dovecot/libdovecot.so.0(io_loop_run+0x38) [0x7f027a511018] -> /usr/lib/ dovecot/libdovecot.so.0(master_service_run+0x13) [0x7f027a498e93] -> dovecot/ auth(main+0x398) [0x55b981cd2f98] -> /lib/x86_64-linux-gnu/libc.so. 6(__libc_start_main+0xf1) [0x7f0279a9e2b1] -> dovecot/auth(_start+0x2a) [0x55b981cd31aa] When running auth-worker within valgrind, we get more information (valgrind extract from mail.log attached for two versions of dovecot). We have attached mail.log contents for the respective valgrind runs. This seems to affect at least 2.2.27 onwards. We can reproduce the crash with our production data 100% of the time. The valgrind error is present even with very minimal setups (see below). Unfortunately, I haven’t been able so far to create an LDAP database which produces the crash as reliable as our production database does (which we cannot share for obvious reasons). Minimal Reproducer of Valgrind error: - Install dovecot 2.2.27 from debian stretch, or compile from master. - Install valgrind - In conf.d/10-auth.conf, disable auth-system.conf.ext - In conf.d/10-auth.conf, enable auth-ldap.conf.ext - Set contents of dovecot-ldap.conf.ext to: hosts = localhost base = dc=nodomain - In conf.d/10-master.conf, in section "service auth-worker", set executable = /usr/bin/valgrind /usr/lib/dovecot/auth -w (path may differ on your system) - Install an LDAP server with a database for dc=nodomain; this is trivial to do with debian: Simply install slapd and systemctl start slapd. - Start dovecot - Run doveadm user '*' - You should find the error in the mail.log. I hope this is somehow useful to fix our crash issue. We’ll be happy to provide more information as needed. kind regards, Jonas

4 4

Status of SMTPUTF8?
by Noah Tilton 14 Sep '18

14 Sep '18

I was wondering whether there is a roadmap for adding SMTPUTF8 support to Dovecot? My delivery pattern is Postfix -> Dovecot LMTP and it is choking on utf8 messages. I might be able to volunteer some of my time as a developer. Another thread about this seemed to go unanswered: http://dovecot.org/list/dovecot/2016-September/105474.html http://unix.stackexchange.com/questions/320091/configure-postfix-and-doveco… -Noah

4 3

LMTP tcp listener with auth?
by Andreas Thienemann 14 Sep '18

14 Sep '18

I am wondering if it's possible to have a tcp listener for LMTP do authentication and not accept any unauthenticated mail. My configuration looks like the following: service lmtp { inet_listener lmtp { address = 192.168.0.1 127.0.0.1 port = 24 } } This gives me a network reachable lmtp socket, but of course no autentication. When reading the docs, it seems though that only userdb lookup and no actual authentication is supported? Is that understanding correct? cheers, Andreas

4 3

Server certificate verification error with Dovecot 2.3.2.1
by Robert Gill 13 Sep '18

13 Sep '18

I'm attempting to upgrade my Dovecot installation to 2.3.2.1. My SSL certificate authority provides a bundle containing their CA, plus intermediate CAs, which I configure using the 'ssl_ca' option. The comments in the configuration file say to only set this when you're requiring client certificates, which I'm not, but fetchmail complains with a "Server certificate verification error, Broken certificate chain" error if that setting is not set. This works fine with Dovecot 2.2.34. After upgrading to 2.3.2.1, fetchmail throws that error whether 'ssl_ca' is set or not. Dovecot 2.3.2.1 reports the error SSL routines:ssl3_read_bytes:tlsv1 alert unknown ca: SSL alert number 48 in the logs when attempting the TLS handshake. The permissions on the CA bundle haven't changed and should still be readable by Dovecot. I'm running Gentoo Linux on x86_64 and mail is stored on an ext4 file system. I'm attaching my config files for both Dovecot 2.2.34 and Dovecot 2.3.2.1.

3 3

dovecot + centos 7 + internal ca + hostname change
by Matt Bryant 13 Sep '18

13 Sep '18

Not sure if this is dovecot or not but can find very little ie no info around on this ... and added the pem file into /etc/pki/ca-trust/source/anchors and run udpate-ca-trust .. all works ok .. (this is on centos 7 btw) So wanted to change the hostname away from ip-x-x-x-x to something a little bit more descriptive .. but then kaboom .. doesnt work any more and the following errors are seen. Have created and internal CA for domain and added it to Sep 13 10:42:04 ip-10-0-40-230 dovecot: master: Dovecot v2.2.33.2 (d6601f4ec) starting up for imap, pop3, lmtp, sieve (core dumps disabled) Sep 13 10:42:04 ip-10-0-40-230 dovecot: auth: Error: p11-kit: 'attr->pValue != NULL' not true at attrs_build Sep 13 10:42:04 ip-10-0-40-230 dovecot: auth: Error: p11-kit: 'lexer->tok.field.name && lexer->tok.field.value' not true at p11_lexer_next Sep 13 10:42:04 ip-10-0-40-230 dovecot: auth: Error: p11-kit: 'attrs != NULL' not true at attrs_build Sep 13 10:42:04 ip-10-0-40-230 dovecot: message repeated 16 times: [ auth: Error: p11-kit: 'attrs != NULL' not true at attrs_build] Sep 13 10:42:04 ip-10-0-40-230 dovecot: auth: Error: p11-kit: 'new_memory != NULL' not true at maybe_expand_array Sep 13 10:42:04 ip-10-0-40-230 dovecot: auth: Error: p11-kit: shouldn't be reached at p11_array_push Sep 13 10:42:04 ip-10-0-40-230 dovecot: auth: Error: p11-kit: shouldn't be reached at sink_object Sep 13 10:42:04 ip-10-0-40-230 dovecot: auth: Error: p11-kit: 'attrs != NULL' not true at attrs_build Sep 13 10:42:04 ip-10-0-40-230 dovecot: auth: Error: p11-kit: 'new_memory != NULL' not true at maybe_expand_array Sep 13 10:42:04 ip-10-0-40-230 dovecot: auth: Error: p11-kit: shouldn't be reached at p11_array_push Sep 13 10:42:04 ip-10-0-40-230 dovecot: auth: Error: p11-kit: shouldn't be reached at sink_object ... ... Sep 13 10:42:04 ip-10-0-40-230 dovecot: auth: Error: p11-kit: 'new_memory != NULL' not true at maybe_expand_array Sep 13 10:42:04 ip-10-0-40-230 dovecot: auth: Error: p11-kit: shouldn't be reached at p11_array_push Sep 13 10:42:04 ip-10-0-40-230 dovecot: auth: Error: p11-kit: shouldn't be reached at sink_object Sep 13 10:42:04 ip-10-0-40-230 dovecot: auth: Error: p11-kit: 'attr->pValue != NULL' not true at attrs_build Sep 13 10:42:04 ip-10-0-40-230 dovecot: auth: Error: p11-kit: 'new_memory != NULL' not true at maybe_expand_array Sep 13 10:42:04 ip-10-0-40-230 dovecot: auth: Error: p11-kit: shouldn't be reached at p11_array_push Sep 13 10:42:04 ip-10-0-40-230 dovecot: auth: Error: p11-kit: shouldn't be reached at sink_object Sep 13 10:42:04 ip-10-0-40-230 dovecot: auth: Error: p11-kit: no CKA_CLASS attribute found Sep 13 10:42:04 ip-10-0-40-230 dovecot: auth: Error: p11-kit: couldn't load file into objects: /usr/share/pki/ca-trust-source/ca-bundle.trust.p11-kit Sep 13 10:42:05 ip-10-0-40-230 dovecot: auth-worker: Error: p11-kit: 'attrs != NULL' not true at attrs_build Sep 13 10:42:05 ip-10-0-40-230 dovecot: auth-worker: Fatal: master: service(auth-worker): child 14389 killed with signal 11 (core dumps disabled) Sep 13 10:42:05 ip-10-0-40-230 dovecot: auth-worker: Error: p11-kit: 'attrs != NULL' not true at attrs_build Sep 13 10:42:05 ip-10-0-40-230 dovecot: auth-worker: Fatal: master: service(auth-worker): child 14391 killed with signal 11 (core dumps disabled) Sep 13 10:42:05 ip-10-0-40-230 dovecot: auth-worker: Error: p11-kit: 'attrs != NULL' not true at attrs_build Sep 13 10:42:05 ip-10-0-40-230 dovecot: auth-worker: Fatal: master: service(auth-worker): child 14393 killed with signal 11 (core dumps disabled) why would a hostname change make any difference here .. the certs specified in dovecot config are all complete in their chain so not sure what its trying to do ... set hostname back to original works find .. so something is obviously tied or keyed to hostname though cant find anything specific anyone seen anything like this at all ?? rgds Matt

1 1