November 2020 - dovecot

[Dovecot] auth: Error: net_connect_unix(anvil-auth-penalty) failed: Permission denied
by mailing＠securitylabs.it 03 Apr '25

03 Apr '25

Hello, just upgraded one of my testing machine from dovecot 1.2.15 to 2.0.7. After some trouble with permissions now all seems working, but when I stop dovecot I have these errors in log: Nov 9 17:08:07 in dovecot: master: Warning: Killed with signal 15 (by pid=20362 uid=0 code=kill) Nov 9 17:08:07 in dovecot: pop3-login: Error: read(anvil) failed: EOF Nov 9 17:08:07 in dovecot: imap-login: Error: read(anvil) failed: EOF Nov 9 17:08:07 in dovecot: imap(mailing(a)securitylabs.it): Server shutting down. bytes=410/59361 Nov 9 17:08:07 in dovecot: imap(mailing(a)securitylabs.it): Server shutting down. bytes=79/26605 Nov 9 17:08:07 in dovecot: imap(mailing(a)securitylabs.it): Server shutting down. bytes=802/55708 Nov 9 17:08:07 in dovecot: imap(mailing(a)securitylabs.it): Server shutting down. bytes=258/1242 Nov 9 17:08:07 in dovecot: auth: Error: read(anvil-auth-penalty) failed: EOF Nov 9 17:08:07 in dovecot: auth: Error: net_connect_unix(anvil-auth-penalty) failed: Permission denied dovecot -n: # 2.0.7: /usr/local/etc/dovecot/dovecot.conf # OS: Linux 2.6.32-5-xen-686 i686 Debian squeeze/sid auth_cache_negative_ttl = 2 mins auth_cache_size = 1000 M auth_cache_ttl = 2 mins auth_master_user_separator = * auth_username_chars = abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ01234567890.-_@& disable_plaintext_auth = no dotlock_use_excl = yes first_valid_uid = 100 last_valid_uid = 105 lock_method = dotlock log_timestamp = "%Y-%m-%d %H:%M:%S " login_greeting = Server ready. mail_fsync = never mail_gid = Debian-exim mail_location = maildir:~/Maildir:INDEX=/var/indexes/%d/%n mail_privileged_group = Debian-exim mail_uid = Debian-exim managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date namespace { inbox = yes location = prefix = separator = / type = private } namespace { location = maildir:~/Maildir/expunged prefix = EXPUNGED/ separator = / type = private } namespace { location = maildir:~/Maildir/deleted prefix = DELETED/ separator = / type = private } namespace { location = maildir:~/Maildir/deleted/expunged prefix = DELETED/EXPUNGED/ separator = / type = private } passdb { args = /usr/local/etc/dovecot-sql.conf driver = sql } passdb { args = /usr/local/etc/passwd.masterusers driver = passwd-file master = yes pass = yes } plugin { lazy_expunge = EXPUNGED/ DELETED/ DELETED/EXPUNGED/ mail_log_events = delete expunge mail_log_group_events = quota = maildir quota_warning = storage=80%% /usr/local/bin/dovecot-quota-warning.sh 80 quota_warning2 = storage=90%% /usr/local/bin/dovecot-quota-warning.sh 90 sieve = ~/.dovecot.sieve } pop3_no_flag_updates = yes protocols = imap pop3 service auth { unix_listener auth-userdb { group = Debian-exim mode = 0600 user = Debian-exim } } service imap-login { client_limit = 256 process_limit = 128 process_min_avail = 3 service_count = 1 } service imap { drop_priv_before_exec = yes process_limit = 256 vsz_limit = 256 B } service pop3-login { client_limit = 256 process_limit = 128 process_min_avail = 3 service_count = 1 } service pop3 { drop_priv_before_exec = yes process_limit = 256 vsz_limit = 256 B } ssl_cert = </usr/local/etc/dovecot.crt ssl_key = </usr/local/etc/dovecot.key userdb { args = /usr/local/etc/dovecot-sql.conf driver = sql } protocol imap { mail_max_userip_connections = 10 mail_plugins = " notify quota imap_quota mail_log lazy_expunge" } protocol pop3 { mail_max_userip_connections = 3 mail_plugins = " notify quota mail_log" pop3_uidl_format = %08Xu%08Xv } protocol lda { mail_plugins = quota sieve postmaster_address = postmaster(a)securitylabs.it } My /usr/local/var/run/dovecot directory: 4 drwxr-sr-x 4 root staff 4096 Nov 9 17:08 . 4 drwxrwsrwx 3 root staff 4096 Nov 9 17:05 .. 0 srw------- 1 root staff 0 Nov 9 17:05 anvil 0 srw------- 1 root staff 0 Nov 9 17:05 anvil-auth-penalty 0 srw------- 1 root staff 0 Nov 9 17:05 auth-client 0 srw------- 1 dovecot staff 0 Nov 9 17:05 auth-login 0 srw------- 1 root staff 0 Nov 9 17:05 auth-master 0 srw------- 1 Debian-exim Debian-exim 0 Nov 9 17:05 auth-userdb 0 srw------- 1 dovecot staff 0 Nov 9 17:05 auth-worker 0 srw------- 1 root staff 0 Nov 9 17:05 config 0 srw------- 1 root staff 0 Nov 9 17:05 dict 0 srw------- 1 root staff 0 Nov 9 17:05 director-admin 0 srw-rw-rw- 1 root staff 0 Nov 9 17:05 dns-client 0 srw------- 1 root staff 0 Nov 9 17:05 doveadm-server 0 lrwxrwxrwx 1 root staff 35 Nov 9 17:05 dovecot.conf -> /usr/local/etc/dovecot/dovecot.conf 4 drwxr-xr-x 2 root root 4096 Nov 9 17:05 empty 4 drwxr-x--- 2 root dovenull 4096 Nov 9 17:05 login My emails are delivered as user Debian-exim and users are virtual in a MySQL DB. This system is behind a proxy (so the master user)

3 2

Re: Dovecot authentication hangs when ldap_start_tls_s() fails for invalid certificate
by Aki Tuomi 04 Sep '24

04 Sep '24

> On 19/11/2020 12:55 sebastiano degan <sebastiano.degan(a)frigoveneta.it> wrote: > > > On a Debian10 I've installed postfix 3.4.14 and dovecot 2.3.4.1. > I've configured multiple passdb sources and I expect that if one fails > the other ones are tested. > This is usually the case, except when the failure is due to an invalid > certificate from the ldap server. > In that case all authentication attempts from that moment on will fail. Hi! Can you try with latest CE release from https://repo.dovecot.org/ Regards, Aki

2 1

dovecot-2.3.2.1 and dovecot-pigeonhole-0.5.2 bug?
by Jan Nowak 16 Aug '24

16 Aug '24

Hello, we have a problem after updating the software with the operation of sieve scripts sending a copy of the e-mails, e-mails are not transferred. Configuration: dovecot-2.3.2.1 + dovecot-pigeonhole-0.5.2 + FreeBSD 11.2 log: Sep 06 13:28:17 lda(XXX@XXX)<38615><XXX+XXX>: Info: sieve: msgid=<XXX-XXX-XXX-7788-XXX@XXXXnet>: stored mail into mailbox 'INBOX' Sep 06 13:28:17 lda(XXX@XXX)<38615><XXX+XXX>: Info: sieve: Execution of script /usr/home/XXX/mail/XXX(a)XXX/.dovecot.sieve failed, but implicit keep was successful (user logfile /usr/home/XXX/mail/XXX(a)XXX/.dovecot.sieve.log may reveal additional details) .dovecot.sieve.log: error: msgid=<XXX-XXX-XXX-7788-XXX@XXXXnet>: failed to redirect message to <XXXXX(a)XXXXXX.com>: smtp(127.0.0.1:25): DATA failed: 552 Message header not CRLF terminated (permanent failure). On old configuration: dovecot 2.2 + dovecot-pigeonhole- 0.4 + FreeBSD 11.2 we don't have problem. Has anyone had a similar problem, knows the solution?

5 12

Bug report: invalid \HasNoChildren in response when asterisk is used in the name
by Merijn Schering 18 Apr '24

18 Apr '24

Hi, I'm using dovecot 2.3.4.1 (f79e8e7e4). I have created a folder called "Test with *". Now when I do a command: A3 LIST "" "%" RETURN (CHILDREN STATUS (MESSAGES UNSEEN)) It responds: * STATUS Test with * ( MESSAGES 0 UNSEEN 0 ) * LIST ( \HasNoChildren \UnMarked ) / Spam But it actually has children! This only happens when I use a * character in the name. I hope you can fix this some day. Thanks! Best regards, Merijn Schering Intermesh https://www.group-office.com https://twitter.com/GroupOffice

2 4

[Dovecot] doveadm delete folders ?
by Robert Schetterer 19 Feb '24

19 Feb '24

Hi , is there a feature like doveadm expunge savedbefore ... for imap folder delete ? -- Best Regards MfG Robert Schetterer Germany/Munich/Bavaria

5 10

decrypt.rb
by Dave 11 Apr '23

11 Apr '23

Per the Dovecot site here: https://wiki.dovecot.org/Plugins/MailCrypt ... the "decrypt.rb" ruby script can be used to decrypt a Dovecot-encrypted message file from the command line. The script sort of runs successfully for me, in the sense that it doesn't error out, but it doesn't show the decrypted message. I've called it like so: decrypt.rb -k <PATH_TO_DOVECOT_KEYFILE> -f ./encrypted_message But when I do it just displays the info below and exits (I've subbed <DATA> tags for the actual data): ------------------[OUTPUT]----------------------- Key(s) (total: 1) - Key type : EC - Key digest: <DATA1> - Peer key : <DATA2> - Encrypted : <DATA3> - Kd hash : <DATA4> ------------------------------------------------------- I've tried specifying an output file as well, per the script's command line options, but the output file is 0 bytes. Does anyone have any suggestions? I *think* I'm using it the way it's intended to be used, but maybe I'm not?! -Dave

5 14

FTS solr or xapian and Public Folders
by David Williams 13 May '22

13 May '22

Hi all I hope someone can help with this. I'm looking at setting up FTS on a Dovecot server which has some quite big pubic folders (100,000+ emails each) and would appreciate some info about how fts both Xapian and Solr works with public folders. As background of the folders can receive emails and I use a dummy user and an alias file to deliver them for example testfolder: dummy+Public/MYTESTFOLDER(a)example.com delivers email addressed to testfolder(a)example.com to MYTESTFOLDER in the namespace Public. Has anyone successfully setup FTS with public folders using either Xapian or Solr and what happens when one user changes a folder, does that change show up for other users? E.G.: When an email is delivered by dummy and indexed will that email be indexed for other users as well? Similarly what happens that when an email is moved between, deleted from or copied to public folders by one user will that change then show up for the other users or not? I guess the basic question is: Are public folders indexed once and then the indexes are made available to each user with access or are they indexed for each user? Any info or experience that anyone has will be appreciated. Many thanks David

2 1

Dsync replication - delayed replication (Sync lock)
by Daniel Botting 31 Jan '22

31 Jan '22

Hi, *Our setup:* Two Debian 10 machines that are setup to replicate mail between them, we have round robin DNS setup so a user can connect to either server. *What should happen:* Mail is delivered to either server and replicated across straight away to their mailbox on the other server so it does not matter which one they are connected to they will receive it fairly soon after delivery. *What actually happens:* In some instances the user will experience a delayed receipt of messages if they are not connected to the server that the message is initially delivered to, sometimes the delay is 5/10 minutes, we had a recent support ticket submitted where it was over an hour. Error message seen in mail.err: Sep 1 10:16:15 <host name> dovecot: dsync-local(<username>)<WELSGEERTl8FEAAAZJ7A9A>: Error: Couldn't lock /path/to/mailbox/.dovecot-sync.lock: fcntl(/path/to/mailbox/.dovecot-sync.lock, write-lock, F_SETLKW) locking failed: Timed out after 30 seconds (WRITE lock held by pid 3697) Process 3697 is dovecot/doveadm-server. *Doveconf -n output:* # 2.3.10.1 (a3d0e1171): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.10 (67bf5bd7) # OS: Linux 4.19.0-10-amd64 x86_64 Debian 10.5 # Hostname: <server hostname> auth_verbose = yes default_vsz_limit = 0 doveadm_password = # hidden, use -P to show it first_valid_gid = 8 first_valid_uid = 8 last_valid_gid = 8 last_valid_uid = 8 lda_mailbox_autocreate = yes lda_mailbox_autosubscribe = yes mail_gid = 8 mail_location = maildir:~/Maildir mail_plugins = " notify replication" mail_uid = 8 managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex im ap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext editheader imapfla gs namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } passdb { args = /etc/dovecot/dovecot-ldap.conf.ext driver = ldap } plugin { mail_replica = tcps:<server being replicated to>:<port being used> sieve = ~/.dovecot.sieve sieve_dir = ~/sieve sieve_extensions = +editheader +imapflags } postmaster_address = postmaster@<domain address> protocols = " imap sieve pop3" replication_max_conns = 12 service aggregator { fifo_listener replication-notify-fifo { user = mail } unix_listener replication-notify { user = mail } } service auth { unix_listener /var/run/dovecot-exim-bridge { mode = 0660 user = Debian-exim } } service doveadm { inet_listener { port = <port being used for replication> ssl = yes } } service imap-login { inet_listener imap { port = 143 } } inet_listener imaps { port = 993 ssl = yes } process_limit = 512 process_min_avail = 4 service_count = 1 } service imap { process_limit = 1024 } service managesieve-login { inet_listener sieve { port = <sieve port> } process_min_avail = 1 service_count = 8 vsz_limit = 256 M } service managesieve { process_limit = 1024 } service replicator { process_min_avail = 1 unix_listener replicator-doveadm { mode = 0666 } } ssl = required ssl_cert = </path/to/ssl/cert/fullchain.pem ssl_cipher_list = ALL:!LOW:!SSLv2:!EXP:!aNULL ssl_client_ca_dir = /etc/ssl/certs ssl_key = # hidden, use -P to show it ssl_min_protocol = TLSv1.2 userdb { args = /etc/dovecot/dovecot-ldap.conf.ext driver = ldap override_fields = home=/var/mail/%u uid=mail gid=mail } protocol lda { mail_plugins = " notify replication sieve" } protocol imap { mail_max_userip_connections = 32 mail_plugins = " notify replication" } protocol sieve { mail_max_userip_connections = 10 managesieve_logout_format = bytes=%i/%o managesieve_max_line_length = 65536 } Kind regards Daniel

3 3

sieve - segmentation fault
by kjonca＠o2.pl 01 Dec '21

01 Dec '21

I tried to experiment with "index" extension and I found that, in case "0" sieve-filter segfaults. example code was: --8<---------------cut here---------------start------------->8--- if header :index 0 :last :regex "received" "some regex here" { fileinto "dedicated mailbox" ; } --8<---------------cut here---------------end--------------->8--- KJ -- http://stopstopnop.pl/stop_stopnop.pl_o_nas.html I dote on his very absence. -- William Shakespeare, "The Merchant of Venice"

2 2

maildirfolder file created in maildir root during auto-creation with 2.3.4.1 but not 2.2.27
by Christian Balzer 02 Sep '21

02 Sep '21

Hello, as the tin says. I have several servers running 2.2.27 (Debian stretch) and am adding new ones with 2.3.4.1 (Debian buster). The configs were upgraded where needed but neither 10-mail.conf nor 15-mailboxes.conf were changed. 15-mailboxes is all commented out (I guess the default is auto-create, which isn't documented anywhere I could find) and the only non-comments in 10-mail.conf are --- mail_location = maildir:%h mail_privileged_group = mail --- So yes, no namespaces are explicitly defined/declared. The 2.3.4.1 version wrongly creates a maildirfolder file in the home directory (maildir root), preventing exim from correctly creating/using maildirsize. a) Is this expected behavior and can it be changed? b) How can I disable inbox auto-creation if a) doesn't pan out? Thanks, Christian -- Christian Balzer Network/Systems Engineer chibi(a)gol.com Rakuten Mobile Inc.

2 5

Mailbox problem on centos O/S after some "fiddling"
by John Richards 28 May '21

28 May '21

Good day from Somerset, England Version 2.2.10 Problem after a huge centos update Data:- Server has 8 mailboxes under /var/mail/"user name" history:- After update, mail to ONE user was going into mqueue as undeliverable Had to delete and recreate the user. somewhere along the line (ME!) /var/mail/;imap var/mail/new were deleted After new user and reboot server no one could access mailboxes with password error except ONE user randomly....This created the /var/mail/.mbox folder and sub folders but with the owner as the user name. Then any mail for other users was put in the /var/new folder and just sat there. only the "owner" of this folder could get mail, everyone else was prohibited with password error. chown the folder (owner:group) to root did nothing BUT When .mbox was give PUBLIC execute permissions (771) suddenly everything works fine! I do not understand why dovecot creates this folder as we ONLY ever use pop3 (currently with plain text auth but going to secure when this sorted) for mail and also why when it writes the blank folder it "owns" it with the user accessing it (also the /var/mail/new folder takes the same owner) I have trolled everywhere and spent a whole day on this so any clues would be very gratefully accepted as do not like to leave this folder as 771 (note the folder INBOX within it is only 770 and the log file in that is 660) Is this INBOX needed at all for pop3 ? rgds John Richards UK ================= dovecot -n # 2.2.10: /etc/dovecot/dovecot.conf # OS: Linux 3.10.0-514.2.2.el7.x86_64 x86_64 CentOS Linux release 7.3.1611 (Core ) ext4 auth_mechanisms = plain login disable_plaintext_auth = no mail_location = mbox:/var/mail/:INBOX=/var/mail/%u mbox_write_locks = fcntl namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } passdb { driver = shadow } protocols = pop3 service imap-login { inet_listener imap { port = 143 } inet_listener imaps { port = 993 ssl = yes } } ssl_cert = </etc/pki/tls/certs/watchetwebdesign.co.uk.crt ssl_key = </etc/pki/tls/private/watchetwebdesign.co.uk.key userdb { driver = passwd }

2 1

[Dovecot] Doveadm sometimes failed "to iterate through some users" after upgrade to 2.2
by Alessio Cecchi 04 May '21

04 May '21

Hi, I'm running every week in cron "doveadm expunge -A mailbox Spam before 30d" and monthly "doveadm quota recalc -A". After the upgrade to dovecot 2.2.12 (from 2.1.17), "doveadm -A" sometimes exit with this error: doveadm(user(a)domain.com): Error: User listing returned failure doveadm: Error: Failed to iterate through some users # echo $? 75 If I re-run the same command the user where doveadm stops changeing (always in alphabetical order): info@ mario@ pippo@ zazza@ and finally, after 3 or 4 run, ends with success. I have enable debug (via doveadm -D and auth/mail debub in 10-logging.con) but there are no errors or difference in the log when doveadm exit with the error (error code is 75). If I run # doveadm expunge -A mailbox Spam savedbefore 30d doveadm works fine Can somebody help me? Here is my configuration: # dovecot -n # 2.2.12: /etc/dovecot/dovecot.conf # OS: Linux 2.6.32-5-amd64 x86_64 Debian 6.0.9 auth_debug = yes auth_master_user_separator = * auth_verbose = yes deliver_log_format = msgid=%m, from=%f, subject="%s": %$ dict { expire = mysql:/etc/dovecot/dovecot-dict-sql.conf.ext sqlquota = mysql:/etc/dovecot/dovecot-dict-sql.conf.ext } disable_plaintext_auth = no dotlock_use_excl = no first_valid_gid = 89 first_valid_uid = 89 imap_client_workarounds = delay-newmail tb-extra-mailbox-sep tb-lsub-flags imap_idle_notify_interval = 29 mins imap_logout_format = in=%i out=%o session=<%{session}> last_valid_gid = 89 last_valid_uid = 89 lda_mailbox_autocreate = yes lda_mailbox_autosubscribe = yes listen = * mail_debug = yes mail_fsync = always mail_location = maildir:~/Maildir mail_nfs_index = yes mail_nfs_storage = yes mail_plugins = quota expire maildir_very_dirty_syncs = yes managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date ihave vnd.dovecot.duplicate mmap_disable = yes namespace { list = children location = maildir:%%h/Maildir:INDEX=~/Maildir/shared/%%u prefix = shared/%%n/ separator = / subscriptions = no type = shared } namespace inbox { inbox = yes location = mailbox Drafts { auto = subscribe special_use = \Drafts } mailbox Sent { auto = subscribe special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Spam { auto = subscribe special_use = \Junk } mailbox Trash { auto = subscribe special_use = \Trash } prefix = separator = / } passdb { args = username_format=%Ld /etc/dovecot/extra/alias-domains-denylogin.txt deny = yes driver = passwd-file } passdb { args = /etc/dovecot/extra/master-users driver = passwd-file master = yes pass = yes } passdb { args = /etc/dovecot/dovecot-sql.conf.ext driver = sql } plugin { expire = Trash expire2 = Spam expire_dict = proxy::expire quota = maildir:UserQuota quota2 = dict:Quota Usage::noenforcing:proxy::sqlquota quota_grace = 10M quota_rule2 = Trash:storage=+100M quota_warning = storage=95%% quota-warning 95 %u quota_warning2 = storage=80%% quota-warning 80 %u sieve = ~/.dovecot.sieve sieve_before = /etc/dovecot/sieve/before.sieve sieve_dir = ~/sieve sieve_extensions = +vnd.dovecot.duplicate -vacation } pop3_client_workarounds = outlook-no-nuls oe-ns-eoh pop3_logout_format = top=%t/%p, retr=%r/%b, del=%d/%m, size=%s, bytes=%i/%o, session=<%{session}> protocols = imap pop3 sieve service auth-worker { process_limit = 1000 } service auth { client_limit = 5500 unix_listener auth-userdb { group = vchkpw mode = 0660 user = vpopmail } } service dict { process_limit = 300 unix_listener dict { group = vchkpw mode = 0660 user = vpopmail } } service imap-login { process_min_avail = 4 service_count = 0 } service imap { process_limit = 4000 service_count = 100 } service managesieve-login { inet_listener sieve { port = 4190 } } service pop3-login { service_count = 0 } service pop3 { process_limit = 1023 service_count = 100 } service quota-warning { executable = script /etc/dovecot/scripts/quota-warning.sh unix_listener quota-warning { user = vpopmail } user = vpopmail } ssl_cert = </etc/dovecot/ssl/wildcard-myemail.net.pem ssl_key = </etc/dovecot/ssl/wildcard-myemail.net.key submission_host = localhost userdb { args = /etc/dovecot/dovecot-sql.conf.ext driver = sql } protocol lda { mail_location = maildir:~/Maildir:INDEX=MEMORY mail_plugins = quota expire sieve } protocol imap { mail_max_userip_connections = 15 mail_plugins = quota expire imap_quota } protocol sieve { mail_max_userip_connections = 2 } protocol pop3 { mail_max_userip_connections = 5 } -- Alessio Cecchi is: @ ILS -> http://www.linux.it/~alessice/ on LinkedIn -> http://www.linkedin.com/in/alessice Assistenza Sistemi GNU/Linux -> http://www.cecchi.biz Cloud Email Hosting -> http://www.qboxmail.com @ PLUG -> ex-Presidente, adesso senatore a vita, http://www.prato.linux.it

3 3

IMAP session hangs on 8k-long commands if COMPRESS=DEFLATE is enabled
by Guilhem Moulin 21 Apr '21

21 Apr '21

Hi there, Dovecot 2.3.7 appears to hang when the client sends a long command after enabling the IMAP COMPRESS extension [RFC 4978]. PoC script attached along with the doveconf(1) output. Without COMPRESS=DEFLATE, and with the default ‘imap_max_line_length’ value (64k) I'm able send commands up to 65539 bytes long (that's 3 bytes more than 2¹⁶, so maybe the leading tag and the trailing CRLF aren't counted), after which Dovecot rightfully replies with tagged BAD responses. $ COMPRESS=n /tmp/many-fetch.pl 65539 […] C: x UID FETCH 1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,… [65539 bytes] S: x OK Fetch completed (0.005 + 0.001 + 0.004 secs). C: x UID FETCH 1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,… [65540 bytes] S: x BAD Error in IMAP command UID FETCH: IMAP command line too large (0.001 + 0.001 secs). C: x UID FETCH 1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,… [65541 bytes] S: x BAD Error in IMAP command UID FETCH: IMAP command line too large (0.001 + 0.001 secs). With COMPRESS=DEFLATE however, the server never sends anything back when the command size exceeds 8192 bytes: $ COMPRESS=y /tmp/many-fetch.pl 8192 […] S: x OK [READ-ONLY] Examine completed (0.001 + 0.000 secs). C: x UID FETCH 1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,… [8191 bytes] S: x OK Fetch completed (0.001 + 0.000 secs). C: x UID FETCH 1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,… [8192 bytes] S: x OK Fetch completed (0.001 + 0.000 secs). C: x UID FETCH 1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,… [8193 bytes] [ _hangs until the server terminates the session for inactivity_ ] S: * BYE Disconnected for inactivity. strace(1) show that Dovecot didn't send the response, even though the server log indicates that it's able to fully read the command. Interestingly, when setting ‘imap_max_line_length’ to 4096, the server also hangs after receiving a command of size >4096 bytes (instead of replying with a tagged BAD response). $ COMPRESS=y /tmp/many-fetch.pl 4096 C: x UID FETCH 1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,… [4095 bytes] S: x OK Fetch completed (0.001 + 0.000 secs). C: x UID FETCH 1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,… [4096 bytes] S: x OK Fetch completed (0.001 + 0.000 secs). C: x UID FETCH 1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,… [4097 bytes] [ _hangs until the server terminates the session for inactivity_ ] I'm also able to reproduce the buggy behavior against Dovecot versions found in other Debian releases. It's identical with 2.3.4 (Buster), the server also hang past 8192 bytes. 2.2.27 (Stretch) and 2.2.13 (Jessie) are able to send replies to 8k-long commands, but hang past 65536 bytes. For all 3 releases, without COMPRESS=DEFLATE Dovecot doesn't hang and rightfully sends tagged BAD responses to commands of size >65539 bytes. So while the hanging behavior appears to be a long-standing bug, the fact that's it's now hit at min($imap_max_line_length, 8192) instead of $imap_max_line_length seems to be a regression from somewhere between 2.2.27 and 2.3.4. Cheers, -- Guilhem.

3 2

BUG report: dbox movealt doesn't move reverse (to default location)
by Vitalii 05 Feb '21

05 Feb '21

Hi, Here is the problem that occured: #sudo doveadm -D altmove -u vv(a)vito.pp.ua all works properly and moves all storage to alt dir. However, to move it back to default storage I add '-r' by manual: #sudo doveadm -D altmove -u vv(a)vito.pp.ua -r all That seems behave like the original command ignoring '-r'. my dovecot conf: # 2.3.4.1 (f79e8e7e4): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.4 () # OS: Linux 4.19.0-9-amd64 x86_64 Debian 10.4 # Hostname: qemu7.internetguru.ca auth_mechanisms = plain login disable_plaintext_auth = no imapc_features = rfc822.size fetch-headers imapc_host = imap.gmail.com imapc_port = 993 imapc_ssl = imaps imapc_user = %u listen = *,[::] log_timestamp = "%Y-%m-%d %H:%M:%S " mail_attachment_dir = /wd640/mdbox-att/%d/%n mail_max_userip_connections = 100 mail_prefetch_count = 20 mail_privileged_group = vmail passdb { args = /etc/dovecot/dovecot-sql.conf driver = sql } plugin { quota = dict:user::file:/var/vmail/%d/%n/.quotausage sieve = /var/vmail/%d/%n/.sieve sieve_max_redirects = 25 } protocols = imap pop3 service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0660 user = postfix } unix_listener auth-userdb { group = vmail mode = 0600 user = vmail } user = root } service imap-login { client_limit = 1000 process_limit = 512 } service lmtp { unix_listener /var/spool/postfix/private/dovecot-lmtp { group = postfix mode = 0600 user = postfix } } service stats { unix_listener stats-reader { group = vmail mode = 0660 user = vmail } unix_listener stats-writer { group = vmail mode = 0660 user = vmail } } ssl_cert = </etc/postfix/smtpd.cert ssl_client_ca_dir = /etc/ssl/certs ssl_dh = # hidden, use -P to show it ssl_key = # hidden, use -P to show it userdb { driver = prefetch } userdb { args = /etc/dovecot/dovecot-sql.conf driver = sql } protocol imap { mail_plugins = quota imap_quota } protocol pop3 { mail_plugins = quota pop3_uidl_format = %08Xu%08Xv } protocol lda { mail_plugins = sieve quota postmaster_address = postmaster(a)some.ca } protocol lmtp { mail_plugins = quota sieve postmaster_address = postmaster(a)some.ca } I am using debian 10. P.S. I have not found much information about dbox attachments commands. Seems none needs them.

3 3

Antispam plugin
by Maciej Milaszewski 17 Jan '21

17 Jan '21

Hi System centos8 + dovecot-2.3.8 from repo # 2.3.8 (9df20d2db): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.8 (b7b03ba2) # OS: Linux 4.18.0-193.19.1.el8_2.x86_64 x86_64 CentOS Linux release 8.2.2004 (Core) I need "Antispam plugin". What antispam-plugin I must use ? In older version dovecot-2.2.36.4 i use "dovecot-antispam-plugin" but in centos I had a problem with configure - probably toold wersion "./configure: line 3193: DC_DOVECOT: command not found" In wiki dovect is "antispam-plugin" I try this http://hg.dovecot.org/dovecot-antispam-plugin but get 404 Backand spamassassin

4 3

Dovecot Replication Errors (only) when using tcps: as the mail_replica Protocol
by Reuben Farrelly 18 Dec '20

18 Dec '20

Hi, I've been seeing errors logged for some time with replication processes, whereby replication sessions seem to be timing out periodically. This is with dovecot version 2.3.10.1 (a3d0e1171) and both are Gentoo x86_64. After some investigation I've determined that these timeouts are only ever occurring with tcps as the replication connection type. These errors never occur if non-encrypted tcp is configured. I've been able to validate this by changing only the replica_type on both ends of the replication configuration to tcp, and with no other changes and after a few days of operation there is not a single error logged. mail_replica = tcps:lightning.reub.net:4813 <<< periodic timeouts mail_replica = tcp:lightning.reub.net:4814 <<< works perfectly Example of the error: Jun 12 15:45:44 thunderstorm.reub.net dovecot[21149]: dsync-local(kaylene)<zx+WKTAU416UMwAAzkCIew>: Error: dsync(lightning.reub.net): I/O has stalled, no activity for 600 seconds (last sent=mailbox_delete, last recv=handshake) Jun 12 15:45:44 thunderstorm.reub.net dovecot[21149]: dsync-local(kaylene)<zx+WKTAU416UMwAAzkCIew>: Error: Timeout during state=recv_mailbox_tree doveadm: Error: Timeout during state=slave_recv_mailbox: 6 Time(s) doveadm: Error: Timeout during state=sync_mails (send=mail_requests recv=attributes): 31 Time(s) doveadm: Error: dsync(thunderstorm.reub.net): I/O has stalled, no activity for 600 seconds (last sent=mail_change (EOL), last recv=mailbox): 31 Time(s) doveadm: Error: dsync(thunderstorm.reub.net): I/O has stalled, no activity for 600 seconds (last sent=mailbox_delete, last recv=mailbox_delete): 6 Time(s) It is seen on both sides of the replication setup. The replica is offsite but only a few ms of latency away and there is no packet loss. The replication is happening over IPv6, and the local firewall is logging that sessions are always permitted, and only ever finishing due to tcp-fin or tcp-rst-from-client . SSL appears to be correctly configured, and it seems that the replication itself is for the most part working. Clients are able to use imaps just fine so I don't think there's anything much wrong from an SSL perspective else I'd be seeing complete replication failure and/or client devices unable to connect. Can anyone suggest how we can further debug this problem? Thanks, Reuben

4 3

Migrate mailbox from NFS folder to new NFS folder
by Claudio Corvino 14 Dec '20

14 Dec '20

Hi everyone, I need to migrate many user mailboxes from an NFS folder to a new NFS folder, both mounted on the same Dovecot server (2.2.27). Once migrated, users will connect to a new Dovecot server (2.3.4.1). I would like to know how to use /doveadm backup/ (or sync?) instead of /rsync/ as I noted that after migration with rsync I have duplicates and some e-mails marked as unread. What is the correct way to achieve this? Thanks Cheers

2 1

Files in tmp directory
by David Morsberger 05 Dec '20

05 Dec '20

I had to restore many thousands of dovecot emails from a crashed Mac Server to a new Ubuntu server. After completing I am noticing a few things that may be okay or may need to be fixed. 1) a couple of mailboxes have a lot (one has 102462) emails in the tmp directory. The files do not have the standard Mairdir++ filename format. An example: 1581262582.M397740P72267.mini.mmpcrofton.com <http://1581262582.m397740p72267.mini.mmpcrofton.com/> (missing the stuff at the end, ,S=,W=:2,S) 2) I see files in the cur directory that do not have the Maildir++ format. An example: 1601287326.V810Ie80087M240104.mmp-mail.mmpcrofton.com:2,S. (do not have the ,S=,W= values and the second value, V810Ie80087M240104, is longer that the other file names) How do I get the emails in (1) out of tmp? Do I need to convert the emails in (2)? David

2 3

Error: Mailbox INBOX: Sync failed
by Jos Chrispijn 02 Dec '20

02 Dec '20

Just saw in my logfile this line appeared: imap(xxxxxx)<56614><CMMJw9i0aoBSsH9H>: Error: Mailbox INBOX: Sync failed for mbox: Expunged message reappeared to mailbox (UID 174550 < 174552, seq=11, idx_msgs=9) Looks like messages' UIDs are mixed up? I thought that if Dovecot sees broken X-UID headers for "new" messages, they're silently fixed? Can you tell how I can correct this error/warning? Thanks! BR, Jos

1 1

Dovecot+Solr+Tika segmentation fault
by Manuel Josupeit-Walter 02 Dec '20

02 Dec '20

3 2

director_username_hash = %d and doveadm director map
by Ralf Becker 30 Nov '20

30 Nov '20

Our directors hash by domain (director_username_hash = %d), as some of our users share folders with other users of the same domain. We now started using director tags to map domains to their backends. Unfortunately doveadm director map seems no to work with director_username_hash = %d user hash mail server ip expire time <unknown> 432784257 10.44.88.1 2020-11-23 13:10:55 <unknown> 4244233328 10.44.88.1 2020-11-23 13:13:55 <unknown> 1913982503 10.44.88.1 2020-11-23 13:15:40 How can I check to which backend / IP a domain is maped, aka how is that hash calculated? doveadm director move seems also not to do anything meaningful for %d, or at least I have not found out how to use it to move a domain to a different backend. Hoping for some insight :) Ralf -- Ralf Becker EGroupware GmbH [www.egroupware.org] Handelsregister HRB Kaiserslautern 3587 Geschäftsführer Birgit und Ralf Becker Leibnizstr. 17, 67663 Kaiserslautern, Germany Telefon +49 631 31657-0

3 5

Dovecot cannot access mailcrypt decryption key
by Daniel Niewerth 30 Nov '20

30 Nov '20

2 1

A probably dumb question, but I'm stumped
by Christy S 30 Nov '20

30 Nov '20

Hi folks, I'm stumped on an error we're getting in dovecot after upgrading ubuntu. I will say up front that I'm far from a linux expert. I'm helping my husband by managing a virtual private server to handle his domain, including its email. We set this up two years ago and once I finally got the mail working, it's been humming along just fine since, until two days ago when I performed the ubuntu upgrade. Now, when we try to send mail through his domain thunderbird gives this error: Your message was sent but a copy was not placed in your sent folder (Sent) due to network or file access errors. Note that it says this, but the mail isn't actually sent at all. We are using SSL and have been since the beginning which might be part of our problem, but I'm not positive. A google search suggested adding two lines to the 10-ssl.conf file. ssl_dh = </usr/share/dovecot/dh.pem ssl_cipher_list = HIGH:!DH:!aNULL I did both of these things and restarted the server completely, but no luck. looking in /var/log/mail.err I see this. Nov 29 14:08:56 kylesmith-music dovecot: imap-login: Error: Failed to initialize SSL server context: Can't load SSL cert ificate: error:140AB18F:SSL routines:SSL_CTX_use_certificate:ee key too small: user=<>, rip=xxx.xxx.xxx.xxx, lip=xxx.xxx.xxx.xxx, session=<t4qrdkS1kPNLFhL4> What's interesting is that last line only showed up after I added the two lines to the config file. My guess is I need to do something with SSL, update it maybe? But I don't want to go fiddling around purely on a guess and potentially break things even more. So, any of you much more linux familiar types want to point me in the right direction? Thanks! Christy

4 3

Repo for ubuntu focal 20.04 LTS
by Sébastien Riccio 27 Nov '20

27 Nov '20

Hello Dovecot, As the new ubuntu LTS 20.04 seems to be out, I would like to ask if there are any plans to add a repo like it already exists for 18.04 LTS. We planned to upgrade our 18.04 LTS boxes to 20.04. It has it’s own dovecot packages (2.3.7 at the time of writing this), but I would prefer we use your repositories like we do with 18.04. Kind regards, Sébastien

4 4

Panic: file message-parser.c
by Urban Loesch 27 Nov '20

27 Nov '20

Hi, I'm running Dovecot 2.3.11 from Dovet Repository on Debian 9.13. I get the following error when some of our users are doing searches in mailboxes. My error log: ... Nov 25 17:32:13 dcot-mydomain-1 dovecot: imap-login: ID sent: x-session-id=Dh04+PC0+O9t+MsP, x-originating-ip=109.248.203.15, x-originating-port=61432, x-connected-ip=10.10.10.10206, x-connected-port=993, x-proxy-ttl=4: user=<>, rip=109.248.203.15, lip=10.10.10.10206, secured, session=<Dh04+PC0+O9t+MsP> Nov 25 17:32:13 dcot-mydomain-1 dovecot: imap-login: Login: user=<user(a)domain.com>, method=PLAIN, rip=109.248.203.15, lip=10.10.10.10206, mpid=110860, secured, session=<Dh04+PC0+O9t+MsP> Nov 25 17:32:18 dcot-mydomain-1 dovecot: imap(user(a)domain.com pid:110860 session:<Dh04+PC0+O9t+MsP>): Panic: file message-parser.c: line 174 (message_part_finish): assertion failed: (ctx->nested_parts_count > 0) Nov 25 17:32:18 dcot-mydomain-1 dovecot: imap(user(a)domain.com pid:110860 session:<Dh04+PC0+O9t+MsP>): Error: Raw backtrace: /usr/lib/dovecot/libdovecot.so.0(backtrace_append+0x42) [0x7fd61a26c0e2] -> /usr/lib/dovecot/libdovecot.so.0(backtrace_get+0x1e) [0x7fd61a26c1ee] -> /usr/lib/dovecot/libdovecot.so.0(+0xe9c81) [0x7fd61a276c81] -> /usr/lib/dovecot/libdovecot.so.0(+0xe9d21) [0x7fd61a276d21] -> /usr/lib/dovecot/libdovecot.so.0(i_fatal+0) [0x7fd61a1cbfa4] -> /usr/lib/dovecot/libdovecot.so.0(+0xc990e) [0x7fd61a25690e] -> /usr/lib/dovecot/libdovecot.so.0(message_parser_parse_next_block+0xdc) [0x7fd61a257f8c] -> /usr/lib/dovecot/libdovecot.so.0(message_search_msg+0xa0) [0x7fd61a25a810] -> /usr/lib/dovecot/libdovecot-storage.so.0(+0xc4c5f) [0x7fd61a5fbc5f] -> /usr/lib/dovecot/libdovecot-storage.so.0(mail_search_args_foreach+0x45) [0x7fd61a577575] -> /usr/lib/dovecot/libdovecot-storage.so.0(+0xc5a5e) [0x7fd61a5fca5e] -> /usr/lib/dovecot/libdovecot-storage.so.0(+0xc6f63) [0x7fd61a5fdf63] -> /usr/lib/dovecot/libdovecot-storage.so.0(index_storage_search_next_nonblock+0x10c) [0x7fd61a5fe68c] -> /usr/lib/dovecot/libdovecot-storage.so.0(mailbox_search_next_nonblock+0x22) [0x7fd61a580fb2] -> dovecot/imap(+0x257f0) [0x55be0929f7f0] -> dovecot/imap(command_exec+0x64) [0x55be09297ff4] -> dovecot/imap(+0x24a32) [0x55be0929ea32] -> /usr/lib/dovecot/libdovecot.so.0(io_loop_handle_timeouts+0x137) [0x7fd61a28f707] -> /usr/lib/dovecot/libdovecot.so.0(io_loop_handler_run_internal+0xc1) [0x7fd61a291211] -> /usr/lib/dovecot/libdovecot.so.0(io_loop_handler_run+0x59) [0x7fd61a28fa69] -> /usr/lib/dovecot/libdovecot.so.0(io_loop_run+0x38) [0x7fd61a28fc98] -> /usr/lib/dovecot/libdovecot.so.0(master_service_run+0x13) [0x7fd61a1fd2f3] -> dovecot/imap(main+0x338) [0x55be09287f68] -> /lib/x86_64-linux-gnu/libc.so.6(__libc_start_main+0xf1) [0x7fd619e0e2e1] -> dovecot/imap(_start+0x2a) [0x55be0928816a] Nov 25 17:32:18 dcot-mydomain-1 dovecot: imap(user(a)domain.com pid:110860 session:<Dh04+PC0+O9t+MsP>): Fatal: master: service(imap): child 110860 killed with signal 6 (core dumps disabled - https://dovecot.org/bugreport.html#coredumps) ... I searched the archives and found this patch which seems to fix it: https://github.com/dovecot/core/commit/a668d767a710ca18ab6e7177d8e8be22a6b0… Have you planned to release new Debian 9 packages in dovecot repository where this patch will be applied? My current Dovecot version is: ii dovecot-core 2:2.3.11.3-3+debian9 amd64 secure POP3/IMAP server - core files ii dovecot-dbg 2:2.3.11.3-3+debian9 amd64 secure POP3/IMAP server - debug symbols ii dovecot-imapd 2:2.3.11.3-3+debian9 amd64 secure POP3/IMAP server - IMAP daemon ii dovecot-lmtpd 2:2.3.11.3-3+debian9 amd64 secure POP3/IMAP server - LMTP server ii dovecot-managesieved 2:2.3.11.3-3+debian9 amd64 secure POP3/IMAP server - ManageSieve server ii dovecot-mysql 2:2.3.11.3-3+debian9 amd64 secure POP3/IMAP server - MySQL support ii dovecot-pop3d 2:2.3.11.3-3+debian9 amd64 secure POP3/IMAP server - POP3 daemon ii dovecot-sieve 2:2.3.11.3-3+debian9 amd64 secure POP3/IMAP server - Sieve filters support ... Many thanks Urban

2 1