January 2020 - dovecot

dovecot cannot drop privileges inside singularity container
by cesco 15 Jan '20

15 Jan '20

Hi all I'm facing an issue while running dovecot inside a singularity (https://sylabs.io/singularity/) container dovecot version is 2.3.4.1 (configuration below) running on debian buster, inside a container made with singularity version 3.4.2 unfortunately, when I try to start dovecot, it gives: Singularity test.sif:~> cat /var/log/mail.log Dec 30 17:23:38 testnode dovecot: master: Dovecot v2.3.4.1 (f79e8e7e4) starting up for imap, lmtp, sieve, pop3, submission (core dumps disabled) Dec 30 17:23:38 testnode dovecot: anvil: Fatal: We couldn't drop root privileges Dec 30 17:23:38 testnode dovecot: master: Error: service(anvil): command startup failed, throttling for 2 secs the same happens on singularity containers based on debian bullseye or alpine linux 3.9.2 many thanks! nzasch Singularity test.sif:~> doveconf -n # 2.3.4.1 (f79e8e7e4): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.4 () # OS: Linux 4.19.0-6-amd64 x86_64 Debian 10.2 # Hostname: testnode.example.net mail_location = mbox:~/mail:INBOX=/var/mail/%u mail_privileged_group = mail managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } passdb { driver = pam } plugin { sieve = file:~/sieve;active=~/.dovecot.sieve } protocols = " imap lmtp sieve pop3 submission" ssl_cert = </etc/dovecot/private/dovecot.pem ssl_client_ca_dir = /etc/ssl/certs ssl_dh = # hidden, use -P to show it ssl_key = # hidden, use -P to show it userdb { driver = passwd }

2 2

Upgrade 2.2.27 to 2.3.9.2: master(imap): net_connect_unix(imap) failed: Resource temporarily unavailable
by Eirik Rye 15 Jan '20

15 Jan '20

Hi, After upgrading Dovecot from version 2.2.27 to 2.3.9.2, we are sporadically seeing lots of these errors in the error log on many of our servers: imap-login: Error: master(imap): net_connect_unix(imap) failed: Resource temporarily unavailable - http://wiki2.dovecot.org/SocketUnavailable The issue is causing significant delays and/or timeouts on login. From what I can tell, this happens because the imap-login service is unable to connect to the imap service socket, however I am unable to identify the root cause of the issue. We have increased the client_limit for the stats service, as described in the upgrade document at (https://wiki2.dovecot.org/Upgrading/2.3). It is set to the same value as the process_limit for imap service. System CPU usage does not appear to be saturated. The CPU usage sits at around 50% when these errors appear. We have doubled the number of file descriptors after upgrading from 2.2.27. It was previously set to 16392 (which worked fine): ~# cat /proc/`pidof dovecot`/limits | grep "open files" Max open files 30000 30000 files We have tried increasing default_process_limit and default_client_limit from the default 1000 to 3000, but this has no effect. Current configuration (with irrelevant parts removed): ~# doveconf -n default_client_limit = 3000 # these were raised after upgrading in attempt to remedy default_process_limit = 3000 default_vsz_limit = 512 M [...] service imap-login { client_limit = 1250 inet_listener imap { port = 143 } inet_listener imaps { port = 993 ssl = yes } process_limit = 16 process_min_avail = 16 service_count = 0 vsz_limit = 512 M } service imap { client_limit = 1 process_limit = 20000 } service stats { client_limit = 20000 } [...] We appear to be nowhere near the 20000 process_limit set for the imap service. We are also not seeing any warnings being logged with regards to the process_limit. ~# doveadm who -1 | wc -l 8765 ~# doveadm process status | grep "^imap " | wc -l 7583 ~# ps aux | grep "dovecot/imap" | wc -l 7449 ~# doveadm process status | grep -v "^imap " name pid available_count total_count idle_start last_status_update last_kill_sent stats 19875 12384 582387 0 1578305489 0 pop3-login 19868 1000 0 0 1578061504 0 pop3-login 19867 1000 0 0 1578061503 0 pop3-login 19866 1000 0 0 1578061502 0 pop3-login 19865 1000 0 0 1578061503 0 pop3-login 19864 1000 0 0 1578061503 0 pop3-login 19853 1000 0 0 1578061504 0 pop3-login 19852 1000 0 0 1578061504 0 pop3-login 19851 1000 0 0 1578061504 0 pop3-login 19849 1000 0 0 1578061503 0 pop3-login 19847 1000 0 0 1578061503 0 pop3-login 19846 1000 0 0 1578061503 0 pop3-login 19845 1000 0 0 1578061503 0 pop3-login 19844 1000 0 0 1578061503 0 pop3-login 19843 1000 0 0 1578061503 0 pop3-login 19842 1000 0 0 1578061503 0 pop3-login 19839 1000 0 0 1578061502 0 log 19841 2973 27 0 1578061502 0 imap-login 19873 666 14942 0 1578305488 0 imap-login 19872 523 32792 0 1578305489 0 imap-login 19871 316 62876 0 1578305489 0 imap-login 19870 167 78332 0 1578305489 0 imap-login 19869 118 97989 0 1578305489 0 imap-login 19863 0 184726 0 1578305489 0 imap-login 19862 0 193094 0 1578305489 0 imap-login 19861 0 186800 0 1578305487 0 imap-login 19860 675 17806 0 1578305487 0 imap-login 19859 0 169446 0 1578305489 0 imap-login 19858 0 143517 0 1578305489 0 imap-login 19857 0 119215 0 1578305488 0 imap-login 19856 0 151958 0 1578305489 0 imap-login 19855 483 47036 0 1578305488 0 imap-login 19854 1 185240 0 1578305489 0 imap-login 19840 567 23859 0 1578305485 0 config 19874 2967 124482 0 1578305489 0 auth 19885 2967 124185 0 1578305489 0 anvil 10017 967 7567 0 1578305463 0 -- Eirik

3 13

autoupdate broke
by Steve Egbert 14 Jan '20

14 Jan '20

When attempting to perform autoupdate after my 'autogen.sh' broke, it says that there is missing a file called: dovecot/core/doc/wiki/Makefile.am But in the Github repository, there is a misnamed file named "Makefile.am.in". I think this file is misnamed and should be renamed to "Makefile.am". https://github.com/dovecot/core/tree/master/doc/wiki

3 2

Separate TLS certificate for listener
by Peter Mogensen 13 Jan '20

13 Jan '20

Hi, I've read the howto on overriding the global ssl_cert config by using filters like "local", "remote", "protocol", "local-name". However... is it possible to have a speciel certificate just for a listener where only the port is different? /Peter

2 1

Dovecot HA/Resilience
by Kishore Potnuru 13 Jan '20

13 Jan '20

Hi Dovecot team, I need help in configuring HA/resilence for my dovecot (POP3/IMAP) server. I have one RHEL Linux POP3/IMAP server with Dovecot version 2.2.10. I also installed the postfix(version: 2.6.6) in it. At present it have around 10 domains and each domain is having around 20 email boxes. It has very simple configuration. User's reading the email via some internal applications/Outlook. I would like to create resilience/HA for this environment. Could you please suggest me, what is the easiest way to achieve this? If any one can suggest step by step that will be more helpful to me. Thanks, Kishore

8 16

saving sent mail in sent folder
by soumitri＠iitk.ac.in 13 Jan '20

13 Jan '20

Hello, I am getting following error in info log of dovecot. imap(someshb): Info: Connection closed (No commands sent) in=0 out=374 This error is for some users (not all) while sending email via Thunderbird. The email is sent but not saved int the Sent folder. I tried to debug the issue and getting nothing except following Debug: Effective uid=2121, gid=4619, home=/users02/home/ppd_doaa imap(ppd_doaa): Debug: Namespace inbox: type=private, prefix=INBOX., sep=., inbox=yes, hidden=no, list=yes, subscriptions=yes location=maildir:~/Maildir:INDEX=/xx/index:CONTROL=/xx/index imap(ppd_doaa): Debug: maildir++: root=/xx/Maildir, index=/xx/index, indexpvt=, control=/xx/index, inbox=/xx/Maildir, alt= imap(ppd_doaa): Debug: Namespace : type=private, prefix=, sep=, inbox=no, hidden=yes, list=no, subscriptions=no location=fail::LAYOUT=none imap(ppd_doaa): Debug: none: root=, index=, indexpvt=, control=, inbox=, alt= namespace has following namespace inbox { hidden = no inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = INBOX. separator = . type = private } i am using dovecot-2.2.36-10.el8.x86_64 Thanks for any help. -- Sincerely, Soumitri

1 0

Replication question
by John 13 Jan '20

13 Jan '20

Hi I'm currently debugging some replication issues between two dovecot 2.3.9.2 servers, where one is live and the other is just a copy used for backup with no imap user access. After initial alignment (with various error messages such as the stalled io messages a fnctl lock messages) I am seeing replication miss messages or stop altogether on mailboxes, even with no further error messages. doveadm: Error: dsync(REMOTE_HOSTNAME): I/O has stalled, no activity for 600 seconds (last sent=mail_change (EOL), last recv=mailbox) doveadm: Error: Couldn't lock /var/vmail/DOMAIN/USER//.dovecot-sync.lock: fcntl(/var/vmail/DOMAIN/USER//.dovecot-sync.lock, write-lock, F_SETLKW) locking failed: Timed out after 30 seconds (WRITE lock held by pid 30307) I was surprised by this because although I know there were replication issues in 2.3.8 I understood these were resolved in 2.3.9 when both servers had 2.3.9. I am still investigating and will post further if I get any useful insights. However, I have a question, which despite using dovecot for many years in this configuration has never occurred to me before. I configured dovecot using the wiki https://wiki.dovecot.org/Replication using tcp and ssl. Both servers have an identical dovecot configuration except for: 1. different hostnames 2. on the backup server I have removed expire and quota plugins in the global mail_plugins 3. in the configuration of mail_replica tcps://hostname:port each server points to the other server's hostname What I just realized is that nowhere in the wiki does it state that both servers should be set up for replication. I had always assumed that was the logical thing to do. So the question is, for successful replication is it sufficient to setup one master configuration and just have a replication process listening on the other master, or should both servers be set up for replication in an almost identical way (with the 3 exceptions above)? thanks for any insights. John

2 1

RE: Unable to authenticate on Dovecot - auth-userdb issue?
by Mark ADAMS 11 Jan '20

11 Jan '20

Uncommented the section on userdb that was commented because it was throwing errors. It’s still throwing an error. Specifically this one: Jan 10 15:42:37 shuttle postfix/smtpd[21046]: connect from pvr[192.168.1.103] Jan 10 15:42:47 shuttle postfix/smtpd[21046]: fatal: no SASL authentication mechanisms Jan 10 15:42:48 shuttle postfix/master[18850]: warning: process /usr/libexec/postfix/smtpd pid 21046 exit status 1 Jan 10 15:42:48 shuttle postfix/master[18850]: warning: /usr/libexec/postfix/smtpd: bad command startup -- throttling I’ve combed Google for information on “no SASL authentication mechanism” with no solution. I appear to have things configured correctly (unless IM missing something, which is entirely possible given that I’m really struggling with this). Saslauthd is running: # systemctl status saslauthd ● saslauthd.service - SASL authentication daemon. Loaded: loaded (/usr/lib/systemd/system/saslauthd.service; enabled; vendor preset: disabled) Active: active (running) since Mon 2020-01-06 19:13:37 MST; 3 days ago Main PID: 29506 (saslauthd) Memory: 1.5M CGroup: /system.slice/saslauthd.service ├─29506 /usr/sbin/saslauthd -m /run/saslauthd -a pam ├─29507 /usr/sbin/saslauthd -m /run/saslauthd -a pam ├─29508 /usr/sbin/saslauthd -m /run/saslauthd -a pam ├─29509 /usr/sbin/saslauthd -m /run/saslauthd -a pam └─29510 /usr/sbin/saslauthd -m /run/saslauthd -a pam Jan 06 19:13:37 shuttle systemd[1]: Starting SASL authentication daemon.... Jan 06 19:13:37 shuttle saslauthd[29506]: : master pid is: 29506 Jan 06 19:13:37 shuttle systemd[1]: Started SASL authentication daemon.. Jan 06 19:13:37 shuttle saslauthd[29506]: : listening on socket: /run/saslauthd/mux Dovecot and Postfix are running starting and running okay. /var/spool/postfix/private/auth is present and seems to be correct. Here are my current configs on those items: # postconf -n command_directory = /usr/sbin compatibility_level = 2 daemon_directory = /usr/libexec/postfix data_directory = /var/lib/postfix html_directory = /usr/share/doc/postfix/html inet_interfaces = shuttle inet_protocols = all lmtp-filter_destination_concurrency_limit = 2 lmtp_sasl_mechanism_filter = plain mail_owner = postfix mailbox_transport = dovecot:shuttle:lmtp mailq_path = /usr/bin/mailq manpage_directory = /usr/share/man meta_directory = /etc/postfix mydestination = mynetworks myhostname = shuttle mynetworks = 192.168.1.0/24, 127.0.0.0/8 mynetworks_style = subnet myorigin = shuttle newaliases_path = /usr/bin/newaliases queue_directory = /var/spool/postfix readme_directory = /usr/share/doc/postfix/README_FILES sendmail_path = /usr/sbin/sendmail.postfix setgid_group = postdrop shlib_directory = /usr/lib64 smtp-filter_destination_concurrency_limit = 2 smtp_bind_address = 192.168.1.105 smtp_tls_CAfile = /etc/pki/tls/certs/ca-bundle.crt smtp_tls_security_level = may smtpd_banner = $myhostname ESMTP $mail_name ($mail_version) (Mageia Linux) smtpd_recipient_restrictions = permit_sasl_authenticated,permit_mynetworks,reject_unauth_destination smtpd_sasl_auth_enable = yes smtpd_sasl_authenticated_header = yes smtpd_sasl_local_domain = $myhostname smtpd_sasl_path = private/auth smtpd_sasl_type = dovecot smtpd_tls_CAfile = /etc/pki/tls/certs/ca-bundle.crt smtpd_tls_cert_file = /etc/pki/tls/certs/adams-lan.mail.pem smtpd_tls_key_file = /etc/pki/tls/private/adams-lan.mail.key smtpd_use_tls = yes unknown_local_recipient_reject_code = 450 virtual_alias_maps = mysql:/etc/postfix/mysql-virtual-alias-maps.cf virtual_mailbox_base = /var/spool/mail/vhosts virtual_mailbox_domains = mysql:/etc/postfix/mysql-virtual-mailbox-domains.cf virtual_mailbox_maps = mysql:/etc/postfix/mysql-virtual-mailbox-maps.cf virtual_transport = dovecot postconf: warning: /etc/postfix/master.cf: unused parameter: flags= # dovecot -n # 2.3.7.2 (3c910f64b): /etc/dovecot/dovecot.conf # OS: Linux 5.4.6-desktop-2.mga7 x86_64 Mageia 7 # Hostname: shuttle auth_debug_passwords = yes auth_mechanisms = plain login cram-md5 auth_username_format = %Ln disable_plaintext_auth = no first_valid_uid = 0 last_valid_uid = 10001 mail_gid = 10001 mail_location = mbox:~/mail:INBOX=/var/mail/%u mail_privileged_group = mail mail_uid = 10001 namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } passdb { driver = sql } passdb { args = %s driver = pam } plugin { sieve = file:~/sieve;active=~/.dovecot.sieve } service anvil { unix_listener anvil { group = mail mode = 0666 } } service auth-worker { user = vmail } service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0666 user = postfix } unix_listener auth-userdb { group = mode = 0666 user = $default_internal_user } user = dovecot } service imap-login { inet_listener imap { port = 143 } } service lmtp { unix_listener /var/spool/postfix/private/dovecot-lmtp { group = postfix mode = 0600 user = postfix } } service pop3-login { inet_listener pop3s { port = 995 ssl = yes } } service stats { unix_listener stats-reader { group = mail mode = 0666 } unix_listener stats-writer { group = mail mode = 0666 } } ssl = required ssl_cert = </etc/pki/tls/certs/fullchain.cer ssl_dh = # hidden, use -P to show it ssl_key = # hidden, use -P to show it userdb { driver = passwd } protocol lmtp { hostname = shuttle postmaster_address = postmaster@shuttle I just need this stuff to move mail on my LAN as it did for years prior to this upgrade. I’m perfectly willing to blow this config away and reinstall from scratch, which I’ve done twice already. I’ve been through at least 4 tutorials on the web and nothing has led to my getting this thing working. Despite all that I’ve learned about Postfix + Dovecot + Mysql, I am still not smart enough to figure this out. I’m still looking for help and/or options. I’m also wondering if it might not be a good idea to ditch the configs in /etc/dovecot/conf.d (by commenting out “!include conf.d/*.conf” in dovecot.conf). I’m just looking to move mail on my LAN. This should be simple, no? Thanks again. Mark From: Alexander Dalloz<mailto:ad+lists@uni-x.org> Sent: Friday, January 10, 2020 11:34 AM To: Mark ADAMS<mailto:madams9@msn.com> Subject: Re: Unable to authenticate on Dovecot - auth-userdb issue? Mark, first of all: please take care to whom you reply. Do not communicate directly with my list mail address. Please keep the discussion on the dovecot list. Thanks. Am 09.01.2020 um 18:29 schrieb Mark ADAMS: > At this point, passdb does not support lookups according to the log. Is there something else I should be looking at? > > I’ve worked on this and seem to be making little progress. A sample transaction log looks like this: > > > Jan 09 10:22:32 shuttle dovecot[26851]: master: Warning: SIGHUP received - reloading configuration > Jan 09 10:23:04 shuttle postfix/smtpd[5448]: connect from pvr[192.168.1.103] > Jan 09 10:23:04 shuttle dovecot[5432]: auth: Debug: Loading modules from directory: /usr/lib64/dovecot/modules/auth > Jan 09 10:23:04 shuttle dovecot[5432]: auth: Debug: Module loaded: /usr/lib64/dovecot/modules/auth/lib20_auth_var_expand_crypt.so > Jan 09 10:23:04 shuttle dovecot[5432]: auth: Debug: Read auth token secret from /run/dovecot/auth-token-secret.dat > Jan 09 10:23:04 shuttle dovecot[5432]: auth: Debug: auth client connected (pid=0) > Jan 09 10:23:20 shuttle postfix/smtpd[5448]: 0C6BF4A6302: client=pvr[192.168.1.103] > Jan 09 10:23:30 shuttle postfix/cleanup[5459]: 0C6BF4A6302: message-id=<> > Jan 09 10:23:30 shuttle postfix/qmgr[1385]: 0C6BF4A6302: from=<madams@pvr>, size=180, nrcpt=1 (queue active) > Jan 09 10:23:30 shuttle dovecot[5432]: auth: Debug: master in: USER 1 root@shuttle service=lda > Jan 09 10:23:30 shuttle dovecot[5432]: auth: Debug: static(root): Performing userdb lookup > Jan 09 10:23:30 shuttle dovecot[5432]: auth: Debug: pam(root): Performing passdb lookup > Jan 09 10:23:30 shuttle dovecot[5432]: auth: Debug: pam(root): passdb doesn't support credential lookups > Jan 09 10:23:30 shuttle dovecot[5432]: auth: Debug: pam(root): Finished passdb lookup > Jan 09 10:23:30 shuttle dovecot[5432]: auth: Error: static(root): passdb doesn't support lookups, can't verify user's existence > Jan 09 10:23:30 shuttle dovecot[5432]: auth: Debug: static(root): Finished userdb lookup > Jan 09 10:23:30 shuttle dovecot[5432]: auth: Debug: userdb out: FAIL 1 > Jan 09 10:23:30 shuttle dovecot[5466]: lda(root@shuttle)<5466><>: Error: auth-master: userdb lookup(root@shuttle): Auth USER lookup failed > Jan 09 10:23:30 shuttle dovecot[5466]: lda: Fatal: Internal error occurred. Refer to server log for more information. > Jan 09 10:23:30 shuttle postfix/pipe[5465]: 0C6BF4A6302: to=<root@shuttle>, relay=dovecot, delay=17, delays=17/0.01/0/0.06, dsn=4.3.0, status=deferred (tempora> > Jan 09 10:23:31 shuttle sshd[5468]: Connection closed by 192.168.1.100 port 48324 [preauth] > Jan 09 10:23:31 shuttle postfix/smtpd[5448]: disconnect from pvr[192.168.1.103] ehlo=1 mail=1 rcpt=1 data=1 quit=1 commands=5 > > > My current dovecot configuration looks like this: > > # 2.3.7.2 (3c910f64b): /etc/dovecot/dovecot.conf > # OS: Linux 5.4.6-desktop-2.mga7 x86_64 Mageia 7 > # Hostname: shuttle > auth_debug_passwords = yes > auth_username_format = %Ln > disable_plaintext_auth = no > first_valid_uid = 0 > last_valid_uid = 10001 > mail_gid = 10001 > mail_location = mbox:~/mail:INBOX=/var/mail/%u > mail_privileged_group = mail > mail_uid = 10001 > namespace inbox { > inbox = yes > location = > mailbox Drafts { > special_use = \Drafts > } > mailbox Junk { > special_use = \Junk > } > mailbox Sent { > special_use = \Sent > } > mailbox "Sent Messages" { > special_use = \Sent > } > mailbox Trash { > special_use = \Trash > } > prefix = > } > passdb { > args = %s > driver = pam > } > plugin { > sieve = file:~/sieve;active=~/.dovecot.sieve > } > service anvil { > unix_listener anvil { > group = mail > mode = 0666 > } > } > service auth-worker { > user = vmail > } > service auth { > unix_listener /var/spool/postfix/private/auth { > group = postfix > mode = 0666 > user = postfix > } > unix_listener auth-userdb { > group = > mode = 0666 > user = $default_internal_user > } > user = dovecot > } > service imap-login { > inet_listener imap { > port = 143 > } > } > service lmtp { > unix_listener /var/spool/postfix/private/dovecot-lmtp { > group = postfix > mode = 0600 > user = postfix > } > } > service pop3-login { > inet_listener pop3s { > port = 995 > ssl = yes > } > } > service stats { > unix_listener stats-reader { > group = mail > mode = 0666 > } > unix_listener stats-writer { > group = mail > mode = 0666 > } > } > ssl = required > ssl_cert = </etc/pki/tls/certs/fullchain.cer > ssl_dh = # hidden, use -P to show it > ssl_key = # hidden, use -P to show it > protocol lmtp { > hostname = shuttle > postmaster_address = postmaster@shuttle > } > > > As always I appreciate the help and any assistance is appreciated. > > Mark According to your "doveconf -n" output you have no userdb defined. Just do that. https://doc.dovecot.org/configuration_manual/authentication/user_databases_… Maybe this one fits your current system setup https://doc.dovecot.org/configuration_manual/authentication/passwd/#authent… Alexander > From: Alexander Dalloz<mailto:ad+lists@uni-x.org> > Sent: Friday, January 3, 2020 5:26 AM > To: dovecot(a)dovecot.org<mailto:dovecot@dovecot.org> > Subject: Re: Unable to authenticate on Dovecot - auth-userdb issue? > > Am 03.01.2020 um 03:27 schrieb Mark ADAMS: >> Jan 02 18:47:37 shuttle dovecot[6744]: lda(root@shuttle)<6744><>: Error: auth-master: userdb lookup(root@shuttle): connect(/run/dovecot/auth-userdb) failed: Permission denied (euid=8(mail) egid=12(mail) missing +r perm: /run/dovecot/auth-userdb, dir owned by 0:0 mode=0755) > > Run "namei -lv /run/dovecot/auth-userdb" to check the permissions of the > complete path. The auth-userdb socket actually is owned mail:mail > according to your error logging. Is dovecot member of the mail group? > > Actually it does not match the config details you have pasted: > > unix_listener auth-userdb { > group = dovecot > mode = 0600 > user = vmail > } > > On my side it looks like this and I have not custom configured that > part. The defaults are: > > unix_listener auth-userdb { > group = > mode = 0666 > user = $default_internal_user > } > > So on my system the permissions look like this: > > # namei -lv /var/run/dovecot/auth-userdb > f: /var/run/dovecot/auth-userdb > dr-xr-xr-x root root / > drwxr-xr-x root root var > drwxr-xr-x root root run > drwxr-xr-x root dovecot dovecot > srw-rw-rw- dovecot root auth-userdb > >> Jan 02 18:47:37 shuttle dovecot[6744]: lda: Fatal: Internal error occurred. Refer to server log for more information. >> Jan 02 18:47:37 shuttle postfix/pipe[6743]: 6345D4A4A97: to=<root@shuttle>, relay=dovecot, delay=1.1, delays=1.1/0.01/0/0.06, dsn=4.3.0, status=deferred (temporary failure. Command output: lda(root@shuttle): Error: net_connect_unix(/run/dovecot/stats-writer) failed: Permission denied ) >> ^C >> >> >> >> Note: this error references "/run/dovecot/auth-userdb". That isn't even supposed to be the location of that file. I have no idea why that location shows up. The correct location should be "/etc/dovecot/auth-userdb". The file does exist at that location. > > Mark, > > I have no idea why you expect the dovecot sockets to be located inside > /etc/dovecot/. /etc is the FHS location for configurations. /run or > /var/run (typically a symlink on modern linux distributions) is the > right location for runtime files like service sockets. > > You say /etc/dovecot/auth-userdb exists. Am I correct to guess that you > have created that manually with whatever content? > > Alexander > >

1 0

Panic: file mail-index-util.c: line 10 (mail_index_uint32_to_offset): assertion failed: (offset < 0x40000000)
by Ralf Hildebrandt 10 Jan '20

10 Jan '20

I'm trying this: doveadm import -u restore(a)backup.invalid mdbox:/home/copymail2/mdbox "" \ mailbox INBOX header X-Spam Yes nd I'm getting: doveadm(restore(a)backup.invalid): Panic: file mail-index-util.c: line 10 (mail_index_uint32_to_offset): assertion failed: (offset < 0x40000000) doveadm(restore(a)backup.invalid): Error: Raw backtrace: /usr/lib/dovecot/libdovecot.so.0(backtrace_append+0x42) [0x7f598de6cac2] -> /usr/lib/dovecot/libdovecot.so.0(backtrace_get+0x1e) [0x7f598de6cbde] -> /usr/lib/dovecot/libdovecot.so.0(+0xe989e) [0x7f598de7789e] -> /usr/lib/dovecot/libdovecot.so.0(+0xe98e1) [0x7f598de778e1] -> /usr/lib/dovecot/libdovecot.so.0(i_fatal+0) [0x7f598ddced04] -> /usr/lib/dovecot/libdovecot-storage.so.0(mail_index_uint32_to_offset+0x78) [0x7f598e227de8] -> /usr/lib/dovecot/libdovecot-storage.so.0(mail_cache_add+0x83b) [0x7f598e2103ab] -> /usr/lib/dovecot/libdovecot-storage.so.0(index_mail_parse_header+0x449) [0x7f598e1f2139] -> /usr/lib/dovecot/libdovecot.so.0(+0xc10a9) [0x7f598de4f0a9] -> /usr/lib/dovecot/libdovecot.so.0(i_stream_read_memarea+0x7a) [0x7f598de852ea] -> /usr/lib/dovecot/libdovecot.so.0(i_stream_read+0x2f) [0x7f598de8562f] -> /usr/lib/dovecot/libdovecot.so.0(i_stream_read_data+0x3d) [0x7f598de8600d] -> /usr/lib/dovecot/libdovecot.so.0(message_parse_header_next+0x68) [0x7f598de55a58] -> /usr/lib/dovecot/libdovecot.so.0(message_parse_header+0x52) [0x7f598de56432] -> /usr/lib/dovecot/libdovecot-storage.so.0(+0xcc561) [0x7f598e1fc561] -> /usr/lib/dovecot/libdovecot-storage.so.0(+0xcd85c) [0x7f598e1fd85c] -> /usr/lib/dovecot/libdovecot-storage.so.0(index_storage_search_next_nonblock+0x11d) [0x7f598e1fe04d] -> /usr/lib/dovecot/libdovecot-storage.so.0(mailbox_search_next_nonblock+0x28) [0x7f598e17df38] -> /usr/lib/dovecot/libdovecot-storage.so.0(mailbox_search_next+0x3d) [0x7f598e17df9d] -> doveadm(+0x31b13) [0x557f5d487b13] -> doveadm(+0x2c441) [0x557f5d482441] -> doveadm(+0x2d1c9) [0x557f5d4831c9] -> doveadm(doveadm_cmd_ver2_to_mail_cmd_wrapper+0x20e) [0x557f5d48409e] -> doveadm(doveadm_cmd_run_ver2+0x55e) [0x557f5d4953ee] -> doveadm(doveadm_cmd_try_run_ver2+0x37) [0x557f5d495447] -> doveadm(main+0x1d1) [0x557f5d472211] -> /lib/x86_64-linux-gnu/libc.so.6(__libc_start_main+0xe7) [0x7f598d3cfb97] -> doveadm(_start+0x2a) [0x557f5d47272a] Aborted (core dumped) I'm using ii dovecot-core 2:2.3.9.2-1+ubuntu18.04 amd64 secure POP3/IMAP server - core files ii dovecot-dbg 2:2.3.9.2-1+ubuntu18.04 amd64 secure POP3/IMAP server - debug symbols ii dovecot-imapd 2:2.3.9.2-1+ubuntu18.04 amd64 secure POP3/IMAP server - IMAP daemon ii dovecot-lmtpd 2:2.3.9.2-1+ubuntu18.04 amd64 secure POP3/IMAP server - LMTP server ii dovecot-lucene 2:2.3.9.2-1+ubuntu18.04 amd64 secure POP3/IMAP server - Lucene support Running in gdb results in this backtrace: Program received signal SIGABRT, Aborted. __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:51 51../sysdeps/unix/sysv/linux/raise.c: No such file or directory. (gdb) bt #0 __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:51 #1 0x00007ffff68e4801 in __GI_abort () at abort.c:79 #2 0x00007ffff736d851 in default_fatal_finish (status=0, type=LOG_TYPE_PANIC) at failures.c:459 #3 fatal_handler_real (ctx=<optimized out>, format=<optimized out>, args=<optimized out>) at failures.c:471 #4 0x00007ffff736d8e1 in default_fatal_handler (ctx=<optimized out>, format=<optimized out>, args=<optimized out>) at failures.c:479 #5 0x00007ffff72c4d04 in i_panic (format=format@entry=0x7ffff772dd00 "file %s: line %d (%s): assertion failed: (%s)") at failures.c:523 #6 0x00007ffff771dde8 in mail_index_uint32_to_offset (offset=<optimized out>) at mail-index-util.c:10 #7 0x00007ffff77063ab in mail_cache_header_fields_write (ctx=0x555555855330, buffer=<optimized out>, buffer=<optimized out>) at mail-cache-transaction.c:609 #8 mail_cache_header_add_field (field_idx=15, ctx=0x555555855330) at mail-cache-transaction.c:690 #9 mail_cache_add (ctx=0x555555855330, seq=1, field_idx=field_idx@entry=15, data=0x7ffff773b6d6, data_size=0) at mail-cache-transaction.c:739 #10 0x00007ffff76ea82c in index_mail_cache_add_idx (mail=mail@entry=0x555555869f18, field_idx=field_idx@entry=15, data=data@entry=0x7ffff773b6d6, data_size=data_size@entry=0) at index-mail.c:631 #11 0x00007ffff76e8139 in index_mail_parse_header_finish (mail=<optimized out>) at index-mail-headers.c:132 #12 index_mail_parse_header (part=<optimized out>, hdr=<optimized out>, mail=<optimized out>) at index-mail-headers.c:312 #13 0x00007ffff73450a9 in read_header (mstream=0x555555874740) at istream-header-filter.c:356 #14 i_stream_header_filter_read (stream=0x555555874740) at istream-header-filter.c:446 #15 0x00007ffff737b2ea in i_stream_read_memarea (stream=stream@entry=0x5555558747c0) at istream.c:313 #16 0x00007ffff737b62f in i_stream_read (stream=stream@entry=0x5555558747c0) at istream.c:271 #17 0x00007ffff737c00d in i_stream_read_data (stream=0x5555558747c0, data_r=data_r@entry=0x7fffffffdc08, size_r=size_r@entry=0x7fffffffdc10, threshold=threshold@entry=1) at istream.c:745 #18 0x00007ffff734ba58 in i_stream_read_bytes (wanted=2, size_r=0x7fffffffdc10, data_r=0x7fffffffdc08, stream=<optimized out>) at ../../src/lib/istream.h:217 #19 message_parse_header_next (ctx=0x555555869db0, hdr_r=hdr_r@entry=0x7fffffffdc70) at message-header-parser.c:85 #20 0x00007ffff734c432 in message_parse_header (input=<optimized out>, hdr_size=hdr_size@entry=0x0, flags=flags@entry=MESSAGE_HEADER_PARSER_FLAG_CLEAN_ONELINE, callback=callback@entry=0x7ffff76f1aa0 <search_header>, context=context@entry=0x7fffffffdce0) at message-header-parser.c:392 #21 0x00007ffff76f2561 in search_arg_match_text (ctx=0x555555856fa0, args=0x5555558216d0) at index-search.c:759 #22 search_match_once (ctx=0x555555856fa0) at index-search.c:1399 #23 0x00007ffff76f385c in search_match_next (ctx=0x555555856fa0) at index-search.c:1506 #24 search_more_with_mail (mail=<optimized out>, ctx=0x555555856fa0) at index-search.c:1623 #25 search_more_with_prefetching (mail_r=<optimized out>, ctx=<optimized out>) at index-search.c:1705 #26 search_more (ctx=ctx@entry=0x555555856fa0, mail_r=mail_r@entry=0x7fffffffde10) at index-search.c:1779 #27 0x00007ffff76f404d in index_storage_search_next_nonblock (_ctx=0x555555856fa0, mail_r=0x7fffffffdee0, tryagain_r=0x7fffffffde77) at index-search.c:1807 #28 0x00007ffff7673f38 in mailbox_search_next_nonblock (ctx=0x555555856fa0, mail_r=0x7fffffffdee0, tryagain_r=<optimized out>) at mail-storage.c:2307 #29 0x00007ffff7673f9d in mailbox_search_next (ctx=0x555555856fa0, mail_r=mail_r@entry=0x7fffffffdee0) at mail-storage.c:2292 #30 0x0000555555586d52 in doveadm_mail_iter_next (iter=<optimized out>, mail_r=mail_r@entry=0x7fffffffdee0) at doveadm-mail-iter.c:160 #31 0x0000555555585b13 in cmd_import_box (search_args=<optimized out>, info=0x55555584e7b8, dest_user=<optimized out>, ctx=0x55555581fdb8) at doveadm-mail-import.c:142 #32 cmd_import_run (_ctx=0x55555581fdb8, user=0x5555558374b8) at doveadm-mail-import.c:202 #33 0x0000555555580441 in doveadm_mail_next_user (ctx=ctx@entry=0x55555581fdb8, error_r=error_r@entry=0x7fffffffe0c0) at doveadm-mail.c:462 #34 0x00005555555810db in doveadm_mail_single_user (ctx=ctx@entry=0x55555581fdb8, error_r=error_r@entry=0x7fffffffe0c0) at doveadm-mail.c:492 #35 0x00005555555811c9 in doveadm_mail_cmd_exec (ctx=ctx@entry=0x55555581fdb8, wildcard_user=wildcard_user@entry=0x0) at doveadm-mail.c:653 #36 0x000055555558209e in doveadm_cmd_ver2_to_mail_cmd_wrapper (cctx=<optimized out>) at doveadm-mail.c:1144 #37 0x00005555555933ee in doveadm_cmd_run_ver2 (argc=10, argv=0x5555557f6bb8, cctx=cctx@entry=0x7fffffffe2b0) at doveadm-cmd.c:575 #38 0x0000555555593447 in doveadm_cmd_try_run_ver2 (cmd_name=<optimized out>, argc=<optimized out>, argv=<optimized out>, cctx=0x7fffffffe2b0) at doveadm-cmd.c:497 #39 0x0000555555570211 in main (argc=<optimized out>, argv=<optimized out>) at doveadm.c:395 (gdb) -- Ralf Hildebrandt Geschäftsbereich IT | Abteilung Netzwerk Charité - Universitätsmedizin Berlin Campus Benjamin Franklin Hindenburgdamm 30 | D-12203 Berlin Tel. +49 30 450 570 155 | Fax: +49 30 450 570 962 ralf.hildebrandt(a)charite.de | https://www.charite.de

1 0

2FA for Dovecot
by Kees de Jong 09 Jan '20

09 Jan '20

Hi, My goal is to protect my mail account with 2FA, which isn't a crazy idea in 2020. Therefore, I would like to know the possibilities of configuring 2FA for Dovecot. In the documentation there are some hints of e.g. OTP in Dovecot [1] and using FreeIPA with Dovecot [2], where FreeIPA has the ability to enable OTP per user [3]. But I can't really find much practical information about such a setup. The documentation of Dovecot is quite silent about the OTP authentication mechanism and the same goes for the FreeIPA and Dovecot combination with OTP. So my question is; is this even a supported setup? And if so, where is the documentation? And if not, what's the recommended method to secure your mail setup? I can imagine alternative solutions like putting the submission and IMAP port behind a VPN and have all the clients use that VPN. And for the public internet, simply use a web interface (e.g. Nextcloud with Rainloop) which supports 2FA. But I prefer having OTP for e.g. Android and Linux clients. [1] https://doc.dovecot.org/configuration_manual/authentication/authentication_… [2] https://www.freeipa.org/page/Dovecot_Integration [3] https://www.freeipa.org/page/Using_FreeIPA_and_FreeRadius_as_a_RADIUS_based… -- Met vriendelijke groet, Kees de Jong De informatie opgenomen in deze e-mail kan vertrouwelijk zijn en is uitsluitend bestemd voor de geadresseerde(n). Indien u deze e-mail onterecht ontvangt, wordt u verzocht de inhoud niet te gebruiken en de afzender direct te informeren door de e-mail te retourneren. Aan deze e-mail inclusief de bijlagen kunnen geen rechten ontleend worden, tenzij schriftelijk anders wordt overeengekomen. -- The information contained in this e-mail may be confidential and is intended to be exclusively for the addressee(s). Should you receive this e-mail unintentionally, please do not use the contents herein and notify the sender immediately by return e-mail. This e-mail including the attachments are not legally binding, unless otherwise agreed upon in writing. -- OpenPGP fingerprint: 0x0E45C98AB51428E6

6 5