October 2020 - dovecot

Looking for a guide to collect all e-mail from the ISP mail server
by R. Diez 28 Oct '20

28 Oct '20

Hi all: I am evaluating mail server solutions for a small business. The trouble is, I am only a part-time admin and a newbie to mail servers. Most guides I have seen are rather unrealistic: they encourage you to expose your e-mail server to the Internet, and hope that you have the resources to keep it patched up. I would rather have an internal mail server that collects e-mails from a standard ISP mail server. It is like the old "POP3 Connector" that came with Microsoft Exchange. Sometimes, there is a mailbox per user on the ISP, and a corresponding one on the local server. Other times, there is a single "catch all" or "multidrop" mailbox on the ISP. Users can still access their internal mailboxes from outside through an OpenVPN connection. The goal is that only VPN, and perhaps SSH, are accessible from the outside. We do not need to arrange any special SMTP configuration with the ISP either. This kind of mail server setup is rather different to the standard configuration. You do not normally need you own antivirus and spam filter, and you do not need to configure SSL certificates, MX or SPF DNS records. Most ISP handle that correctly and economically. Internal e-mail does not leave your LAN, and your internal SMTP server is just a relay for the external ISP SMTP server. Furthermore, most guides do not explain how to setup an autoresponder ("I am on holiday until xxx") so that users can enable theirs with the mouse. Editing configuration files over SSH is not really an option for normal users. This detail is important because it could be the only thing I need above standard e-mail. Further groupware features can be seen as nice but ultimately unnecessary luxury, and a basic shared calendar can be accomplished with a separate server like https://radicale.org/ and a calendar client like one built into Thunderbird. Hopefully, that is all I would need for a small business. Can anyone point me to the kind of guide I need? Failing that, I would need information or examples about using fetchmail, getmail or similar software with Dovecot. Good or bad experiences from you guys would also help. Each of those tools has a detailed man page, but there are many options and ways with different advantages and disadvantages. I would need a simpler guide to get started. I am aware that there are pre-packaged mail server solutions that would perhaps bring an easy-to-use autoresponder, but I haven't seen one yet that where you could tick a box like "this server is only internal and collects mail from the ISP server" during installation. Nor have I seen instructions about reconfiguring the mail server for my ISP mail scenario. I am prepared to learn more and write my own Perl scripts and/or installation guide, but it would be stupid to waste time if something easy already exists. After all, the setup I am describing (external ISP mail server + internal mail server) is not so weird. Thanks in advance, rdiez

21 82

doveadm SSL problem with recent update
by Trever L. Adams 27 Oct '20

27 Oct '20

With a recent update, I started seeing this: doveconf: Fatal: Error in configuration file /etc/dovecot/conf.d/10-ssl.conf line 14: ssl_cert: Can't open file /etc/letsencrypt/live/SERVER/fullchain.pem: Permission denied 1 4 * * * vmail /usr/bin/doveadm expunge -A mailbox MAILBOXINQUESTION savedbefore 1w is one of the crontab entries I am seeing this for. Is there an option to keep doveadm from trying to use the ssl cert from that configuration file? I do not want to have the vmail user having access to the pem cert. Thank you. Trever

2 2

Newbie question about replication
by Piotr Auksztulewicz 27 Oct '20

27 Oct '20

Hi, I am a long-time dovecot user/admin for my family mail server, but I had ventured into configuring replication only recently and I am not sure about how it should work and what are the good practices. My intent for replication was to have another instance to switch to in a short time if something fails. I have daily backups, but it will take much more time to rebuild and restore than just to switch to a good instance while taking time to restore the bad one. The setup seems to work just fine from IMAP client point of view (minus sieve scripts - but I have worked it around as I am not yet ready to upgrade dovecot beyond what's in stable Debian at the moment). I have my clients configured to access instance A exclusively; instance B is just sitting around with no clients routinely connected. Also only instance A is receiving deliveries from both my primary and secondary MTAs. I have some doubt however if this is the right thing to do and if it is correct from the dovecot server point of view. I have observed my mail storage directories on both instances and have noticed that they diverge a little over time - the instance B not having all the updates. However the moment I connect another client to instance B and log in as a particular user, the state on instance B springs to the correct state and I see the same content on both clients, and the storage directories become identical as well. I am afraid that, if instance A fails, I would not have the current state on instance B. Is there anything I should have done differently? Here is dovecot -n output of instance A. Instance B config is symmetrical with imap1/2 hostnames switched. FYI: actual domain is substituted for privacy. mail.mydomain.net is an internal subdomain with private IP addresses. Instances of dovecot are containerized with access to internal virtual bridge on which MTAs and supporting processes are present as well. The access from outside is provided by port forwarding/NAT, only for imaps and pop3s ports. Other ports are only internally accessible for local clients (postfix, mutt, doveadm command line tool etc.) or debug purposes. # 2.3.4.1 (f79e8e7e4): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.4 () # OS: Linux 4.19.0-9-cloud-amd64 x86_64 # Hostname: imap1.mail.mydomain.net auth_failure_delay = 3 secs auth_verbose = yes auth_worker_max_count = 5 deliver_log_format = msgid=%m; from=%f: %$ disable_plaintext_auth = no doveadm_password = # hidden, use -P to show it doveadm_port = 4551 first_valid_uid = 100 login_greeting = # <redacted> mail_attribute_dict = file:mail/dovecot-attributes mail_gid = 122 mail_home = /var/vmail/%u mail_location = maildir:~/mail:LAYOUT=fs:DIRNAME=.MailDir:UTF-8 mail_plugins = " notify replication" mail_privileged_group = vmail mail_uid = 113 managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext editheader vnd.dovecot.debug namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } passdb { args = /etc/dovecot/dovecot-sql.conf.ext.local driver = sql } plugin { mail_replica = tcp:imap2.mail.mydomain.net sieve = ~/.sieve sieve_dir = ~/sieve sieve_extensions = +vnd.dovecot.debug +editheader sieve_user_log = ~/log/sieve.log } pop3_fast_size_lookups = yes pop3_lock_session = yes pop3_no_flag_updates = yes pop3_save_uidl = yes protocols = " imap lmtp sieve pop3" replication_max_conns = 5 service aggregator { fifo_listener replication-notify-fifo { group = root mode = 0660 user = vmail } unix_listener replication-notify { group = root mode = 0660 user = vmail } } service auth-worker { chroot = /etc/dovecot/db process_limit = 10 unix_listener auth-worker { mode = 0600 user = doveauth } user = doveauth } service auth { client_limit = 64 inet_listener sasl { address = imap1.mail.mydomain.net port = 9192 } unix_listener auth-userdb { group = vmail mode = 0660 user = doveauth } user = doveauth } service dict-async { protocol = none } service dict { protocol = none } service director { protocol = none } service doveadm { inet_listener doveadm { address = imap1.mail.mydomain.net port = 4551 } } service imap-hibernate { protocol = none } service imap-login { inet_listener imap { address = imap1.mail.mydomain.net port = 143 } process_limit = 30 service_count = 1 } service imap-urlauth-login { protocol = none } service imap-urlauth-worker { protocol = none } service imap-urlauth { protocol = none } service imap { chroot = /var/vmail client_limit = 15 process_limit = 30 service_count = 32 user = vmail } service indexer-worker { process_limit = 3 user = vmail } service indexer { chroot = $base_dir } service lmtp { client_limit = 1 extra_groups = group = vmail inet_listener lmtp { address = imap1.mail.mydomain.net port = 2306 } process_limit = 6 user = vmail } service log { user = $default_internal_user } service managesieve-login { inet_listener sieve { address = imap1.mail.mydomain.net port = 4190 } process_limit = 3 service_count = 1 } service managesieve { chroot = /var/vmail process_limit = 3 service_count = 1 user = vmail } service pop3-login { inet_listener pop3 { port = 0 } process_limit = 4 service_count = 1 } service pop3 { chroot = /var/vmail process_limit = 4 service_count = 1 user = vmail } service replicator { unix_listener replicator-doveadm { group = root mode = 0600 user = vmail } } service submission-login { protocol = none } service tcpwrap { protocol = none } ssl_cert = </etc/dovecot/private/dovecot.pem ssl_client_ca_dir = /etc/ssl/certs ssl_dh = # hidden, use -P to show it ssl_key = # hidden, use -P to show it userdb { args = /etc/dovecot/dovecot-sql.conf.ext.local driver = sql } valid_chroot_dirs = /var/vmail /etc/dovecot/db verbose_proctitle = yes protocol lmtp { mail_plugins = " notify replication sieve" } protocol imap { imap_metadata = yes } -- Piotr "Malgond" Auksztulewicz firstname(a)lastname.net

2 5

Re: Dovecot replication not picking up new mail in maildir
by Justin Ridge 27 Oct '20

27 Oct '20

On 26/10/2020 19:25, John Fawcett wrote: > On 25/10/2020 17:19, jayare~dcml at videocoding.org wrote: >> I've got a basic dovecot master-master replication setup between two >> servers (imap1 and imap2). Actions such as deleting messages or moving >> them between folders are replicated correctly and quickly. >> >> However, when new mail is delivered by postfix, replication does not >> occur until something else triggers it, such as one of the delete/move >> actions mentioned earlier. A search suggested this may be due to the >> notify plugin, but I don't see any issue with the settings. Output of >> doveconf -n: > > Hi > > is there any error in the log? > > Can you show some evidence or an example? ie some email delivery in the > master but not on the slave? > > Can you be sure to check both new and cur subdirectories on master and > slave? > > John There's precisely nothing in the log. The new mail arrives on the master, and it is as though dovecot completely ignores it for the purposes of replication. However, I think I have solved the problem by enabling LMTP and forcing postfix to go through that rather than writing to the maildir directly. Perhaps LMTP is required for replication and I just didn't realize it. End result is (I think) it is working properly. J

3 3

imapsieve: setting imapsieve_url disables admin scripts
by Gedalya 27 Oct '20

27 Oct '20

Hello, The documentation says imapsieve_url "has no effect on the administrator-controlled Sieve scripts". However, when setting this item, I get lines such as: Error: imapsieve: mailbox INBOX: Failed to read /shared/imapsieve/script mailbox attribute: Mailbox attributes not enabled and that's it. imapsieve_mailboxXXX_* settings are completely ignored. Unsetting imapsieve_url makes it all work again. # 2.3.11.3 (502c39af9): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.11 (6c69c917) # OS: Linux 4.19.0-5-amd64 x86_64 Debian bullseye/sid xfs # Hostname: ------ auth_master_user_separator = * auth_mechanisms = plain login auth_verbose = yes imapc_features = rfc822.size fetch-headers imapc_host = imap.gmail.com imapc_port = 993 imapc_ssl = imaps log_timestamp = "%Y-%m-%d %H:%M:%S " mail_gid = vmail mail_home = /srv/mail/domains/%d/%n mail_location = mdbox:/srv/mail/domains/%d/%n/mdbox mail_plugins = quota fts fts_solr mail_prefetch_count = 20 mail_privileged_group = mail mail_uid = vmail managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext imapsieve vnd.dovecot.imapsieve mdbox_preallocate_space = yes namespace inbox { inbox = yes location = mailbox Drafts { auto = subscribe special_use = \Drafts } mailbox Junk { auto = subscribe autoexpunge = 30 days special_use = \Junk } mailbox Sent { auto = subscribe special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { auto = subscribe autoexpunge = 30 days special_use = \Trash } prefix = separator = / } passdb { args = /etc/dovecot/master-users driver = passwd-file master = yes pass = yes } passdb { args = /etc/dovecot/dovecot-sql.conf.ext driver = sql } plugin { fts = solr fts_autoindex = yes fts_solr = url=http://127.0.0.1:8983/solr/dovecot/ fts_tika = http://127.0.0.1:9998/tika/ imapsieve_mailbox1_before = file:/usr/local/lib/imapsieve/report-spam.sieve imapsieve_mailbox1_causes = COPY imapsieve_mailbox1_name = Junk imapsieve_mailbox2_before = file:/usr/local/lib/imapsieve/report-ham.sieve imapsieve_mailbox2_causes = COPY imapsieve_mailbox2_from = Junk imapsieve_mailbox2_name = * imapsieve_mailbox3_before = file:/usr/local/lib/imapsieve/report-spam.sieve imapsieve_mailbox3_causes = COPY imapsieve_mailbox3_name = Junk2 imapsieve_mailbox4_before = file:~/sieve/IMAP-Sent.sieve imapsieve_mailbox4_causes = APPEND COPY imapsieve_mailbox4_name = Sent quota = count:User quota:noenforcing quota_rule = *:storage=5120M quota_vsizes = yes sieve = file:~/sieve;active=~/.dovecot.sieve sieve_before = /etc/dovecot/sieve-global/fileinto-spam.sieve sieve_global_extensions = +vnd.dovecot.pipe +vnd.dovecot.environment sieve_pipe_bin_dir = /usr/local/lib/imapsieve sieve_plugins = sieve_imapsieve sieve_extprograms } pop3_fast_size_lookups = yes pop3_no_flag_updates = yes protocols = " imap lmtp sieve pop3" quota_full_tempfail = yes service auth-worker { user = $default_internal_user } service auth { unix_listener auth-client { group = Debian-exim mode = 0660 user = Debian-exim } unix_listener auth-userdb { group = vmail mode = 0660 user = vmail } user = $default_internal_user } service imap-login { inet_listener imap { port = 143 } service_count = 0 } service imap { vsz_limit = 512 M } service lmtp { inet_listener lmtp { address = ------- port = 2525 } unix_listener lmtp { group = Debian-exim mode = 0660 user = root } } service managesieve-login { inet_listener sieve { port = 4190 } service_count = 0 } service pop3-login { inet_listener pop3 { port = 110 } service_count = 0 } ssl = required ssl_cert = </etc/letsencrypt/live/--------/fullchain.pem ssl_client_ca_dir = /etc/ssl/certs ssl_dh = # hidden, use -P to show it ssl_key = # hidden, use -P to show it userdb { driver = prefetch } userdb { args = /etc/dovecot/dovecot-sql.conf.ext driver = sql } verbose_proctitle = yes protocol lmtp { mail_plugins = quota fts fts_solr sieve ssl = no } protocol !indexer-worker { mail_vsize_bg_after_count = 100 } protocol lda { mail_plugins = quota fts fts_solr sieve } protocol imap { mail_max_userip_connections = 30 mail_plugins = quota fts fts_solr imap_quota imap_sieve } protocol sieve { mail_max_userip_connections = 10 }

2 2

imapc_port not working
by David Tildesley 27 Oct '20

27 Oct '20

Hi, Dovecot v2.3.7.2 on Ubuntu 18.04LTS I have configured for imap proxy to imap.gmail.com However whilst the imapc_host setting is working, imapc_port is not - it ignores the value I set and dovecot always tries to connect to gmail on port 143 (as per error log output). I have the imapc settings in the 10-mail.conf which gets loaded by dovecoat.conf Looks like a bug. Any assistance would appreciated. Regards,David.

2 9

forwarding email with sieve of spf domains
by Marc Roos 27 Oct '20

27 Oct '20

Say someone has setup spf for his domain and sends an email to a user that has in roundcube enabled the sieve forward. If the message is forwarded without altering the message headers, this could result in a message being blocked or not relayed, because sending hosts ip, is not in the spf of the from: domain. Possible solutions are: - add option if enabled, it replaces the From: with that of the email address of the sieve user. (Maybe move the original sender to the Reply-To header? Maybe exception for 'internal' forward?) - Upon processing the message, check the spf records, if they are enforced, do the above, otherwise do nothing. https://tools.ietf.org/html/rfc5228#section-4.2

6 7

Roundcube can't receive emails
by direktor 26 Oct '20

26 Oct '20

Hello, Can someone guide me how to test the mail software? I can send emails but can't receive. I have Dovecot - telnet to 143 port says Dovecot OK. Same with port 25. I get back mail delivery problem. 550. No mail shows in Roundcube. Log files maillog shows nothing, seems empty. It's clean install. On testing Exim log I get something like this: pop3-login auth Error: passrd-file: stat (/etc/exim/domains/myserver/passwd) failed: No such file or directory So what is wrong, how to check and how to fix it? -- Sent from: http://dovecot.2317879.n4.nabble.com/

1 0

Dovecot replication not picking up new mail in maildir
by jayare~dcml＠videocoding.org 26 Oct '20

26 Oct '20

I've got a basic dovecot master-master replication setup between two servers (imap1 and imap2). Actions such as deleting messages or moving them between folders are replicated correctly and quickly. However, when new mail is delivered by postfix, replication does not occur until something else triggers it, such as one of the delete/move actions mentioned earlier. A search suggested this may be due to the notify plugin, but I don't see any issue with the settings. Output of doveconf -n: # 2.2.36 (1f10bfa63): /etc/dovecot/dovecot.conf # OS: Linux 4.19.118-0-vanilla x86_64 CentOS Linux release 7.8.2003 (Core) # Hostname: imap1 disable_plaintext_auth = no doveadm_password = # hidden, use -P to show it first_valid_uid = 1000 haproxy_trusted_networks = 172.16.0.0/24 mail_location = maildir:~/Mail mail_plugins = zlib notify replication mailbox_list_index = yes mailbox_list_index_include_inbox = yes maildir_empty_new = yes mbox_write_locks = fcntl namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } passdb { args = /etc/dovecot/dovecot-sql.conf.ext driver = sql } plugin { mail_replica = tcp:imap2:9943 replication_sync_timeout = 2 } protocols = imap service aggregator { fifo_listener replication-notify-fifo { mode = 0666 user = dovecot } unix_listener replication-notify { mode = 0666 user = dovecot } } service config { unix_listener config { user = dovecot } } service doveadm { inet_listener { port = 9943 } } service imap-login { inet_listener imap_hpx { haproxy = yes port = 943 } } service replicator { process_min_avail = 1 unix_listener replicator-doveadm { mode = 0666 } } ssl = no userdb { args = /etc/dovecot/dovecot-sql.conf.ext driver = sql } protocol lda { mail_plugins = zlib notify replication } protocol imap { mail_plugins = zlib notify replication imap_zlib } I specifically tried setting the following as no and yes as they can affect notifications: mailbox_list_index = yes mailbox_list_index_include_inbox = yes maildir_empty_new = yes The other server has the same settings except obviously mail_replica = tcp:imap1:9943. Any suggestions welcome, thanks!

2 1

dovecot-uidlist invalid data
by Maciej Milaszewski 26 Oct '20

26 Oct '20

Hello I have a problem with Invalid data System debian10 dovecot-2.2.36.4 # 2.2.36.4 (baf9232c1): /etc/dovecot/dovecot.conf # Pigeonhole version 0.4.24.rc1 (debaa297) # OS: Linux 4.19.0-12-amd64 x86_64 Debian 10 Oct 23 15:57:52 dovecot6 dovecot: lmtp(33973,media4_js,2KEXD2Dhkl+1hAAAe3x6RQ): Error: Broken file /vmail/me/media4_js/Maildir/dovecot-uidlist line 6875: Invalid data: In debian9 - kernel-4.9.0-13 - problem exists In debian10 - kernel-4.19.0-12 - problem exist In debian8 - kernel 3.16.0-11-amd64 - problem not exists In debian9 - kernel 3.16.0-11-amd64 - problem not exists storage mount from storage NetApp storage:/vmail on /vmail type nfs (rw,noexec,noatime,vers=3,rsize=65536,wsize=65536,namlen=255,acregmin=120,acregmax=120,acdirmin=120,acdirmax=120,hard,nocto,nordirplus,proto=tcp,timeo=600,retrans=2,sec=sys,mountaddr=10.19.19.19,mountvers=3,mountport=635,mountproto=tcp,local_lock=none,addr=10.19.19.19) cat /etc/fstab storage:/vmail /vmail nfs rw,sec=sys,noexec,noatime,tcp,hard,rsize=65536,wsize=65536,intr,nordirplus,nfsvers=3,tcp,actimeo=120,nocto 0 0 Probably somthing in kernel or mount options. Any idea ?

1 1