March 2020 - dovecot - dovecot.org

Problem with mail_uid
by ratatouille 23 Mar '20

23 Mar '20

Hello! I have problems fetching mail for a system user. In use is a passwd-file. If I set (for virtual users) mail_uid = vmail mail_gid = vmail in 10-mail.conf, I get permission denied. 2020-03-23 18:39:23 imap(andreas(a)dualbit.de): Error: chdir(/home/andreas/Maildir/) failed: Permission denied (euid=5000(vmail) egid=5000(vmail) missing +x perm: /home/andreas/Maildir, dir owned by 5006:5006 mode=0700) The mailbox has permissions drwx------. 9 andreas susers If I don't set mail_uid I get an error because of missing mail_uid. I can only access the users mailbox if I set mail_uid = 5006 in 10-mail.conf On another system I don't haver this problem. I made diffs, read alot of stuff and can't find a solution. What is the way to go, please? I would like to know why this does not work. Below my doveconf -n # 2.2.36 (1f10bfa63): /etc/dovecot/dovecot.conf # Pigeonhole version 0.4.24 (124e06aa) # OS: Linux 3.10.0-1062.9.1.el7.x86_64 x86_64 CentOS Linux release 7.7.1908 (Core) # Hostname: dualbit1.dualbit.de auth_debug = yes auth_debug_passwords = yes auth_mechanisms = plain cram-md5 auth_verbose = yes auth_verbose_passwords = yes debug_log_path = /var/log/dovecot-debug disable_plaintext_auth = no first_valid_uid = 1000 listen = *,[::] log_path = /var/log/dovecot log_timestamp = "%Y-%m-%d %H:%M:%S " mail_gid = vmail mail_home = /home/%n/Maildir mail_location = maildir:~/ mail_plugins = " quota" mail_privileged_group = vmail mail_uid = 5006 managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4fl ags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext mbox_write_locks = fcntl namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = separator = / } passdb { args = /etc/dovecot-sql.conf driver = sql } passdb { args = scheme=CRYPT username_format=%u /etc/dovecot/users driver = passwd-file } plugin { quota = dict:user::file:/var/vmail/%d/%n/.quotausage sieve = file:~/sieve;active=~/.dovecot.sieve } protocols = imap pop3 service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0660 user = postfix } unix_listener auth-userdb { group = vmail mode = 0666 user = vmail } user = root } service imap-login { client_limit = 1000 process_limit = 500 } service lmtp { unix_listener /var/spool/postfix/private/dovecot-lmtp { group = postfix mode = 0600 user = postfix } } ssl = required ssl_cert = </etc/pki/dovecot/certs/dovecot.pem ssl_key = # hidden, use -P to show it ssl_protocols = !SSLv3 userdb { driver = prefetch } userdb { args = /etc/dovecot-sql.conf driver = sql } userdb { args = username_format=%u /etc/dovecot/users driver = passwd-file } protocol imap { mail_plugins = quota imap_quota } protocol pop3 { mail_plugins = quota pop3_uidl_format = %08Xu%08Xv } protocol lda { mail_plugins = sieve quota postmaster_address = root@localhost } protocol lmtp { mail_plugins = quota sieve } Any help appreciated. Andreas

2 3

imapc master login for shared mailboxes
by Mark Zealey 21 Mar '20

21 Mar '20

Hi there, I'm trying to set up shared mailboxes such that any access to the shared namespace like INBOX/shared/<sub-email-address> will take <current-user> and use imapc to log in with <sub-email-address>*<current-user> (ie the current user is the master account for imapc). I've set up like https://wiki2.dovecot.org/SharedMailboxes/ClusterSetup on centos8 latest dovecot build (a late 2.2 series version I believe. However I'm running in to a couple of issues: 1) setting imapc_master_user = %u has %u as <sub-email-address> rather than <current-user>. I can't find any sort of variable substitution that will allow me to access the details of <current-user>. From looking at the logs it seems to do a userdb lookup for<sub-email-address> to check it exists but then the substitutions appear to be using these rather than the current user's details 2) In a similar vein, I believe imapc_password = %w (ie trying to just get current user logging in with the password that was specified when they initially logged in, but as a master user) is also not substituting correctly and is just a blank string Is there any way around this so I don't have to worry about trying to do sharing based on the filesystem and the same process but rather just allow the main user to log in to any other account (in this case domain owner logging in to any accounts under their domain) ? Thanks Mark

1 0

systemuser login
by ratatouille 20 Mar '20

20 Mar '20

Hello! I have one systemuser on my testsystem running CentOS. All other users live in a mysql- database. I created a /etc/dovecot/users file and use auth-passwdfile.conf.ext. andreas@dualbit.de:{CRAM-MD5}334bb91aad4fb976870535bbbd9f07db512fce13bc8f7b58f9dedca404a421aa:5006:5006::/var/spool/mail/andreas::userdb_mail=mbo x:/var/mail/andreas:INBOX=/var/mail/%u When I try to login via telnet I see in the logifle: 2020-03-20 14:40:01 auth: Debug: prefetch(andreas@dualbit.de,::1,<+9T4a0mhKO0AAAAAAAAAAAAAAAAAAAAB>): success 2020-03-20 14:40:01 auth: Debug: master userdb out: USER 734789633 andreas(a)dualbit.de mail=mbox:/var/mail/andreas:INBOX=/var/ma il/andreas(a)dualbit.de auth_token=dc1f852724345081ff3a18958f05fc61b2544ab4 The domainpart is added to the username when I use %u. I assume this is why the login fails. How do I correct this, please? Kind regards Andreas

3 5

Director with dovecot 2.3 and Panic/Fatal error
by Alessio Cecchi 19 Mar '20

19 Mar '20

Hi, after the upgrade to Dovecot 2.3 for our director ring we found some times in the log errors like this: Mar 18 14:22:51 Panic: imap-login: file iostream-openssl.c: line 599 (openssl_iostream_handle_error): assertion failed: (errno != 0) Mar 18 14:22:51 Fatal: imap-login: master: service(imap-login): child 1726 killed with signal 6 (core dumps disabled - https://dovecot.org/bugreport.html#coredumps) Backend is still Dovecot 2.2.36 and Director is 2.3.10. I hope it can be fixed. Thanks -- Alessio Cecchi Postmaster @ http://www.qboxmail.it https://www.linkedin.com/in/alessice

2 1

.dovecot.sieve.log/tmp failed: Not a directory
by mabi 19 Mar '20

19 Mar '20

Hello I am running Dovecot 2.3.9 for IMAP access with RainLoop webmail and have noticed for an account where I have some filters setup that I get the following error messages in the dovecot log file: Mar 17 19:02:50 mbox dovecot: imap(mail(a)domain.tld)<10511><ubAzvhCh1N2yxeu/>: Error: stat(/var/vmail/domain.tld/mail/.dovecot.sieve/tmp) failed: Not a directory Mar 17 19:02:50 mbox dovecot: imap(mail(a)domain.tld)<10511><ubAzvhCh1N2yxeu/>: Error: stat(/var/vmail/domain.tld/mail/.dovecot.sieve.log/tmp) failed: Not a directory This happens when I access the Dovecot mailbox server using an iphone. Also on the iphone I see these "mail" folders but they are not really mail folders... With Thunderbird as mail client it looks all good and I don't get this error. Is this normal? if not, how can I prevent this issue? Regards, Mabi

2 3

Quota plugin and director
by Simone Lazzaris 19 Mar '20

19 Mar '20

Hello dovecot! I administer a dovecot installation with 30k users. I've got 4 dovecot directors as frontend and 10 backends. The mailbox are now in maildir format, with maildir++ quota, on a shared netapp filer. Indexes are local on each backend. I'm reconfiguring the quota plugin: as a first step, I want to use the clone plugin to keep a copy of the quota on a redis database. Next, I'm going to use the "count" quota backend. I've configured without (many) issues the quota clone plugin, but now I want to force the recalculation on all the mailboxes, because I've got some (not many, but some) mailboxes that are mostly unused and are not refreshed. At first, I was going to use "doveadm quota recalc -A", but.... I want each backend to perform the recalculation ONLY for the users he it's managing. I can't perform "doveadm quota recalc -A" on the directors, because the quota plugin is enabled only on the backends. I can parse the user mapping on the directors and split the calculation, one user a time, on the backends, but I feel I'm choosing a overly complicated path. So.... which is the right way to do this? Thanks. -- *Simone Lazzaris* *Qcom S.p.A. a Socio Unico* Via Roggia Vignola, 9 | 24047 Treviglio (BG)T +39 0363 47905 | D +39 0363 1970352 simone.lazzaris(a)qcom.it[1] | www.qcom.it[2] * LinkedIn[3]* | *Facebook*[4] -------- [1] mailto:simone.lazzaris@qcom.it [2] https://www.qcom.it [3] https://www.linkedin.com/company/qcom-spa [4] http://www.facebook.com/qcomspa

3 5

lmtp(------): Debug: SSL_get_servername() failed
by chayes＠afo.net 18 Mar '20

18 Mar '20

I have a smoothly running dovecot 2.3.7.2 & sendmail IMAP with SSL combo on Fedora 30. However, I see oodles of these when ssl verbosity is turned up: lmtp(25738): Debug: SSL_get_servername() failed Should I be concerned or is there a setting that stops that?

1 0

Re: Headsup on feature removal - password
by Rupert Gallagher 18 Mar '20

18 Mar '20

> Password schemes: HMAC-MD5, RPA, SKEY, PLAIN-MD4, LANMAN, NTLM, SMD5 The web is flooded with plain text passwords and hashed passwords harvested from hacked servers. Dovecot stores passwords with the same scheme used for client authentication. Therefore, we use crammd5/hmac-md5. It does not look like much, but is better than plaintext. As md5 is about to go, and I have no intention to store passwords in plaintext, I need to split the scheme used to store passwords from the scheme used for authentication, and migrate storage from md5 to bcrypt. Since this is not possible, I think I will drop passwords entirely and use certificates.

6 7

Getting autoexpunge to work
by Philip Colmer 17 Mar '20

17 Mar '20

dovecot 2.2.33.2 (d6601f4ec) on Ubuntu 18.04 The recent announcement that expunge is going to be deprecated and that autoexpunge should be used instead reminded me that my recent switch over to autoexpunge is not working. There has been an active discussion today about getting expunge working so I thought I'd use the commands suggested there to figure out why autoexpunge might not be doing anything. "doveadm search -u local-finance-support mailbox INBOX savedbefore 12w" returns nothing even though the first email for that user is dated November 12th 2019. Using the message ID for that first email, I then tried this: doveadm search -u local-finance-support HEADER MESSAGE-ID "CAHgKB_f5ttC3kLgxgZiNzwyySvUfb-NXodqZ7K3+dkHKCOUwhg(a)mail.gmail.com" f55e9737e270c2564d1a0000e171d23e 37 then doveadm fetch -u local-finance-support "mailbox date.saved" UID 37 mailbox: INBOX date.saved: 2020-03-17 14:34:12 Why on earth is dovecot showing today's date for that message? What have I misunderstood or misconfigured? Regards Philip

2 2

doveadm expunge not expunging anymore
by mabi 17 Mar '20

17 Mar '20

Hello, I have migrated my mailbox server from Dovecot 2.1.7 (Debian 7) to Dovecot 2.3.4 (Debian 10) and have a crontab setup in root to daily delete all mails in the INBOX of a specific user which are older than 90 days like this: /usr/bin/doveadm expunge -u username\(a)domain.com mailbox INBOX savedbefore 90d Unfortunately this does not work anymore. I also tried to run the command manually as root which does not return any output or errors. Any idea why this command does not work anymore? Regards, Mabi

3 20