May 2020 - dovecot - dovecot.org

A small mistake in a Dovecot error message.
by Bill Shirley 24 May '20

24 May '20

I'm setting up a new mail server and got this message: May 21 11:55:09 vader dovecot[4090]: imap-login: Error: Diffie-Hellman key exchange requested, but no DH parameters provided. Set ssh_dh=</path/to/dh.pem The Dovecot parameter is actually: ss*l*_dh<=/path/to/dh.pem not ssh... Fedora release 32 (Thirty Two) dovecot-2.3.9.3-1.fc32.x86_64 Many thanks for such useful software. Bill

2 1

Dovecot passdb and postfix login
by Laura Smith 24 May '20

24 May '20

Hi, Long story short I've got a fully functional Dovecot IMAP instance and I am now looking to upgrade some perimiter authenticated SMTP relays to authenticate against the Dovecot instance. Trouble is that I am seeing errors such as "auth: Warning: sql: Ignoring changed user_query in /etc/dovecot/local_sql_users.conf, because userdb sql not used." in my Postfix server logs and not able to successfully authenticate via AUTH LOGIN on the Postfi instance. Perhaps I'm missing something obvious from my config ? Here is the doveconf -n from the Postfix server in question: # 2.3.10.1 (a3d0e1171): /etc/dovecot/dovecot.conf # OS: Linux 4.19.0-9-amd64 x86_64 Debian 10.4 # Hostname: foobar.example.com auth_mechanisms = plain login auth_verbose = yes auth_verbose_passwords = sha1:7 disable_plaintext_auth = no mail_location = mbox:~/mail:INBOX=/var/mail/%u namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } passdb { args = /etc/dovecot/local_sql_users.conf driver = sql } service auth { inet_listener { address = 127.0.0.1 port = 7425 } inet_listener { address = ::1 port = 7425 } unix_listener /var/spool/postfix-authrelay/private/dovecot-auth { group = postfix mode = 0660 user = postfix } } ssl = no The local_sql_users.conf is the same one that's used on the functioning IMAP servers, just copied accross to the authenticated relay server: $ sudo cat /etc/dovecot/local_sql_users.conf driver = pgsql connect = host=foo dbname=bar user=secret password=squirrel default_pass_scheme = ARGON2ID password_query = select dovecot_username as user,password from get_user('%u') user_query = select 'vmail' as uid, 'vmail' as gid iterate_query = select dovecot_username as user from get_users()

2 1

Re: fail2ban setup centos 7 not picking auth fail?
by Voytek Eymont 23 May '20

23 May '20

On Fri, May 22, 2020 2:05 pm, Adi Pircalabu wrote: > On 22-05-2020 10:38, Voytek Eymont wrote: > > Hardly a Dovecot issue. Can you please post the output of this command? > /usr/bin/fail2ban-regex /var/log/dovecot.log > /etc/fail2ban/filter.d/dovecot.conf Adi, thanks, what I get is: # /usr/bin/fail2ban-regex /var/log/dovecot.log /etc/fail2ban/filter.d/dovecot.conf Running tests ============= Use failregex filter file : dovecot, basedir: /etc/fail2ban Use datepattern : Default Detectors Use log file : /var/log/dovecot.log Use encoding : UTF-8 Results ======= Failregex: 5149 total |- #) [# of hits] regular expression | 2) [5149] ^(?:\[\])?\s*(?:<[^.]+\.[^.]+>\s+)?(?:\S+\s+)?(?:kernel:\s?\[ *\d+\.\d+\]:?\s+)?(?:@vserver_\S+\s+)?(?:(?:(?:\[\d+\])?:\s+[\[$]?\S*(?:\(\S+$)?[\]\)]?:?|[\[$]?\S*(?:\(\S+$)?[\]\)]?:?(?:\[\d+\])?:?)\s+)?(?:\[ID \d+ \S+\]\s+)?(?:pop3|imap)-login: (?:Info: )?(?:Aborted login|Disconnected)(?::(?: [^ $]+)+)? \((?:auth failed, \d+ attempts( in \d+ secs)?|tried to use (disabled|disallowed) \S+ auth)$:( user=<[^>]+>,)?( method=\S+,)? rip=<HOST>(?:, lip=\S+)?(?:, TLS(?: handshaking(?:: SSL_accept failed: error:[\dA-F]+:SSL routines:[TLS\d]+_GET_CLIENT_HELLO:unknown protocol)?)?(: Disconnected)?)?(, session=<\S+>)?\s*$ `- Ignoreregex: 0 total Date template hits: |- [# of hits] date format | [338975] {^LN-BEG}(?:DAY )?MON Day %k:Minute:Second(?:\.Microseconds)?(?: ExYear)? `- Lines: 338975 lines, 0 ignored, 5149 matched, 333826 missed [processed in 87.44 sec] Missed line(s): too many to print. Use --print-all-missed to print all 333826 lines

7 8

Sieve regexp matches wrong
by kverizhnikov 23 May '20

23 May '20

Hello! Recently I've faced with strange issue. So, I want to filter some mails which do not contain cyrillic symbols. I would not like receive email on foreign language except russian and I'm using rule below, but it does not work when text of mail has unicode symbol u2019 or ’ - right single quotation mark. |require ["body","regex"];| |# rule:[Regexp test]| |if not body :text :regex ".*[аАбБвВгГдДеЕёЁжЖзЗиИйЙкКлЛмМнНоОпПрРсСтТуУфФхХцЦчЧшШщЩъЪыЫьЬэЭюЮяЯ].*"| |{| | discard;| | stop;| |}| I checked this behavior on different versions of dovecot and pigeonhole, and it was the same in all cases. If I change u2019 to, for instance to apostrophe, it begins work as I expect - the mail discarded. Below some information which was got from sieve-test utility. The text consist of only one phrase *Test’test*. Check string *Test’test *- without u2019, using apostrophe root@a4e4b17d33a1:/srv/mail# tail -2 1586937347.M574837P24389.vps.kveri.ru\,S\=1904\,W\=1944\:2\,S Test'test sieve-test output * Script metadata (block: 0): class = file class.version = 0 location = /srv/mail/roundcube.sieve * Required extensions (block: 1): 0: body (id: 18) 1: regex (id: 13) * Main program (block: 2): Address Line Code 00000000: DEBUG BLOCK: 3 00000001: EXTENSIONS [2]: 00000002: body 00000004: regex 00000006: 3: BODY 00000007: BODY-TRANSFORM: TEXT 0000000b: match type: regex 0000000d: key list: STR[138] ".*[аАбБвВгГдДеЕёЁжЖзЗиИйЙкКлЛмМнНоОпПрРс... 0000009b: 3: JMPTRUE 6 [000000a2] 000000a0: 5: DISCARD 000000a1: 6: STOP 000000a2: 6: [End of code] Performed actions: * discard Implicit keep: (none) In this case the rule works as I expect The second test *Test’test* with ’ instead of apostrophe root@a4e4b17d33a1:/srv/mail# tail -2 1586937347.M574837P24389.vps.kveri.ru\,S\=1904\,W\=1944\:2\,S Test’test sieve-test output * Script metadata (block: 0): class = file class.version = 0 location = /srv/mail/roundcube.sieve * Required extensions (block: 1): 0: body (id: 18) 1: regex (id: 13) * Main program (block: 2): Address Line Code 00000000: DEBUG BLOCK: 3 00000001: EXTENSIONS [2]: 00000002: body 00000004: regex 00000006: 3: BODY 00000007: BODY-TRANSFORM: TEXT 0000000b: match type: regex 0000000d: key list: STR[138] ".*[аАбБвВгГдДеЕёЁжЖзЗиИйЙкКлЛмМнНоОпПрРс... 0000009b: 3: JMPTRUE 6 [000000a2] 000000a0: 5: DISCARD 000000a1: 6: STOP 000000a2: 6: [End of code] Performed actions: (none) Implicit keep: * store message in folder: INBOX In this case email "was located" into INBOX, but I expected it should be discarded. As I said this behavior does not depend on dovecot and pigeonhole version - I've tried dovecot 2.3.7, 2.2.30.x, 2.3.9.3 and 2.3.10, pigeonhole 0.5.7.2, 0.5.9 and 0.5.10, fresh install and working in docker container. The dovecot-sysreport was taken from the last one. What am I doing wrong? Is it pigeonhole bug or smth like that?

2 1

Convert standalone mbox to standalone Maildir with Dsync - hierarchy separator error
by Sam Kuper 23 May '20

23 May '20

Dear Dovecot users/devs, I have the following mbox file: /tmp/dsync_test/mbox/2002-September I would like to convert it to a Maildir: /tmp/dsync_test/maildir (Currently, the latter is just an empty directory.) I am attempting this on an old PC running Debian 9 ("Stretch"). I installed the dovecot-core package in order to make the `dsync` tool available on that PC. I have not otherwise done anything with Dovecot on that PC; for instance, I have not created or edited any Dovecot config files. `man dsync` gives the Dovecot version as 2.2. Inspired by the man page and the Dovecot wiki, here was my first attempt to perform the conversion. (I have added newlines between each line of the output, for readability.) $ dsync -Dv -o 'mail_location=maildir:/tmp/dsync_test/maildir' \ backup \ mbox:/tmp/dsync_test/mbox/:INBOX=/tmp/dsync_test/mbox/2002-September Debug: Loading modules from directory: /usr/lib/dovecot/modules/doveadm Debug: Skipping module doveadm_acl_plugin, because dlopen() failed: /usr/lib/dovecot/modules/doveadm/lib10_doveadm_acl_plugin.so: undefined symbol: acl_lookup_dict_iterate_visible_next (this is usually intentional, so just ignore this message) Debug: Skipping module doveadm_expire_plugin, because dlopen() failed: /usr/lib/dovecot/modules/doveadm/lib10_doveadm_expire_plugin.so: undefined symbol: expire_set_deinit (this is usually intentional, so just ignore this message) Debug: Skipping module doveadm_quota_plugin, because dlopen() failed: /usr/lib/dovecot/modules/doveadm/lib10_doveadm_quota_plugin.so: undefined symbol: quota_user_module (this is usually intentional, so just ignore this message) Debug: Skipping module doveadm_fts_lucene_plugin, because dlopen() failed: /usr/lib/dovecot/modules/doveadm/lib20_doveadm_fts_lucene_plugin.so: undefined symbol: lucene_index_iter_deinit (this is usually intentional, so just ignore this message) Debug: Skipping module doveadm_fts_plugin, because dlopen() failed: /usr/lib/dovecot/modules/doveadm/lib20_doveadm_fts_plugin.so: undefined symbol: fts_user_get_language_list (this is usually intentional, so just ignore this message) Debug: Skipping module doveadm_mail_crypt_plugin, because dlopen() failed: /usr/lib/dovecot/modules/doveadm/libdoveadm_mail_crypt_plugin.so: undefined symbol: mail_crypt_box_get_pvt_digests (this is usually intentional, so just ignore this message) doveadm(sampablokuper): Debug: Effective uid=1000, gid=1000, home=/home/sampablokuper doveadm(sampablokuper): Debug: Namespace inbox: type=private, prefix=, sep=, inbox=yes, hidden=no, list=yes, subscriptions=yes location=maildir:/tmp/dsync_test/maildir doveadm(sampablokuper): Debug: maildir++: root=/tmp/dsync_test/maildir, index=, indexpvt=, control=, inbox=/tmp/dsync_test/maildir, alt= doveadm(sampablokuper): Debug: Namespace : Using permissions from /tmp/dsync_test/maildir: mode=0755 gid=default dsync(sampablokuper): Debug: Effective uid=1000, gid=1000, home=/home/sampablokuper dsync(sampablokuper): Debug: Namespace inbox: type=private, prefix=, sep=, inbox=yes, hidden=no, list=yes, subscriptions=yes location=mbox:/tmp/dsync_test/mbox/:INBOX=/tmp/dsync_test/mbox/2002-September dsync(sampablokuper): Debug: fs: root=/tmp/dsync_test/mbox, index=, indexpvt=, control=, inbox=/tmp/dsync_test/mbox/2002-September, alt= dsync(sampablokuper): Error: Mail locations must use the same virtual mailbox hierarchy separator (specify separator for the default namespace) As you can see, it ends with "Error: Mail locations must use the same virtual mailbox hierarchy separator (specify separator for the default namespace)". So, I tried specifying a hierarchy separator, but this failed too: $ dsync -Dv \ -o 'separator=.' \ -o 'mail_location=maildir:/tmp/dsync_test/maildir' \ backup \ mbox:/tmp/dsync_test/mbox/:INBOX=/tmp/dsync_test/mbox/2002-September Debug: Loading modules from directory: /usr/lib/dovecot/modules/doveadm Debug: Skipping module doveadm_acl_plugin, because dlopen() failed: /usr/lib/dovecot/modules/doveadm/lib10_doveadm_acl_plugin.so: undefined symbol: acl_lookup_dict_iterate_visible_next (this is usually intentional, so just ignore this message) Debug: Skipping module doveadm_expire_plugin, because dlopen() failed: /usr/lib/dovecot/modules/doveadm/lib10_doveadm_expire_plugin.so: undefined symbol: expire_set_deinit (this is usually intentional, so just ignore this message) Debug: Skipping module doveadm_quota_plugin, because dlopen() failed: /usr/lib/dovecot/modules/doveadm/lib10_doveadm_quota_plugin.so: undefined symbol: quota_user_module (this is usually intentional, so just ignore this message) Debug: Skipping module doveadm_fts_lucene_plugin, because dlopen() failed: /usr/lib/dovecot/modules/doveadm/lib20_doveadm_fts_lucene_plugin.so: undefined symbol: lucene_index_iter_deinit (this is usually intentional, so just ignore this message) Debug: Skipping module doveadm_fts_plugin, because dlopen() failed: /usr/lib/dovecot/modules/doveadm/lib20_doveadm_fts_plugin.so: undefined symbol: fts_user_get_language_list (this is usually intentional, so just ignore this message) Debug: Skipping module doveadm_mail_crypt_plugin, because dlopen() failed: /usr/lib/dovecot/modules/doveadm/libdoveadm_mail_crypt_plugin.so: undefined symbol: mail_crypt_box_get_pvt_digests (this is usually intentional, so just ignore this message) doveadm(sampablokuper): Debug: Effective uid=1000, gid=1000, home=/home/sampablokuper doveadm(sampablokuper): Debug: Namespace inbox: type=private, prefix=, sep=, inbox=yes, hidden=no, list=yes, subscriptions=yes location=maildir:/tmp/dsync_test/maildir doveadm(sampablokuper): Debug: maildir++: root=/tmp/dsync_test/maildir, index=, indexpvt=, control=, inbox=/tmp/dsync_test/maildir, alt= doveadm(sampablokuper): Debug: Namespace : Using permissions from /tmp/dsync_test/maildir: mode=0755 gid=default dsync(sampablokuper): Debug: Effective uid=1000, gid=1000, home=/home/sampablokuper dsync(sampablokuper): Debug: Namespace inbox: type=private, prefix=, sep=, inbox=yes, hidden=no, list=yes, subscriptions=yes location=mbox:/tmp/dsync_test/mbox/:INBOX=/tmp/dsync_test/mbox/2002-September dsync(sampablokuper): Debug: fs: root=/tmp/dsync_test/mbox, index=, indexpvt=, control=, inbox=/tmp/dsync_test/mbox/2002-September, alt= dsync(sampablokuper): Error: Mail locations must use the same virtual mailbox hierarchy separator (specify separator for the default namespace) I got the same error again when I tried the command above with "/" instead of "." as the hierarchy separator. Forgive me for my ignorance, but how should I correct the invocation I used above? In other words: using dsync, how can I extract/copy the emails from the mbox to the new Maildir? Thank you! -- A: When it messes up the order in which people normally read text. Q: When is top-posting a bad thing? () ASCII ribbon campaign. Please avoid HTML emails & proprietary /\ file formats. (Why? See e.g. https://v.gd/jrmGbS ). Thank you.

2 3

What causes mails to get striked-over only, and not deleted?
by Sebastian Nielsen 23 May '20

23 May '20

I have tried with this sieve config: imapsieve_mailbox1_name = Sent imapsieve_mailbox1_causes = COPY APPEND imapsieve_mailbox1_after = file:/etc/dovecot/sieve/sent.sieve and this sieve file (sent.sieve): discard; This should clearly cause the mail to be deleted right? But whats happen, is that the mail is not deleted, its just marked for deletion (gets a strike-through in Microsoft Outlook). (have tried with _before too, but it wont help). What can I do to ensure the mail actually gets deleted (completely, not moved to trash) and not just flagged for deletion?

3 3

dsync “destination” argument
by Felipe Gasper 22 May '20

22 May '20

Hello, Some code that I didn’t write but am maintaining passes a local script’s path as dsync’s “destination” argument, like so: dsync -D -u john -v backup -R -1 "/code/dsync_client.pl" 127.0.0.1 john(a)mydomain.org dsync_client.pl establishes a TCP connection with a remote dsync process then acts as a proxy between the two dsync processes. “127.0.0.1” and “john(a)mydomain.xn--org-9o0a are given as arguments to dsync_client.pl. I don’t see this usage described in dsync’s man page. I just want to be sure: is this a supported use of dsync? Thank you! cheers, -Felipe Gasper

2 3

fail2ban setup centos 7 not picking auth fail?
by Voytek Eymont 22 May '20

22 May '20

I'm trying to set up fail2ban with dovecot, I have it working on 'old' server Centos 6, but, not getting anywhere with 'new' server on Centos 7 using standard filters I've copied same 'filter' to new server, still get nothing any idea how to figure this out ? on old server, it logs to syslog/messages CentOS release 6.10 (Final) dovecot 2.3.10.1 (a3d0e1171) old # fail2ban-client status dovecot Status for the jail: dovecot |- Filter | |- Currently failed: 2 | |- Total failed: 168 | `- File list: /var/log/dovecot.log `- Actions |- Currently banned: 0 |- Total banned: 32 `- Banned IP list: on new server CentOS Linux release 7.8.2003 dovecot 2.3.10.1 (a3d0e1171) nothing shows up in fail2ban log (ssh, postfix does, only no dovecot) I've copied the actual /etc/fail2ban/filter.d/dovecot.conf from old server, still nothing not sure where/how to look is there a standard/approved doveot filter..? cat jail.local ... [dovecot] enabled = true filter = dovecot logpath = /var/log/dovecot.log maxretry = 3 ignoreip = 127.0.0.1 127.0.0.0/8 ... # fail2ban-client status dovecot Status for the jail: dovecot |- Filter | |- Currently failed: 0 | |- Total failed: 0 | `- Journal matches: _SYSTEMD_UNIT=dovecot.service `- Actions |- Currently banned: 0 |- Total banned: 0 `- Banned IP list: # grep 'auth failed' /var/log/dovecot.log | wc 7669 149916 1558909 # cat dovecot.conf # Fail2Ban filter Dovecot authentication and pop3/imap server # [INCLUDES] before = common.conf [Definition] _daemon = (auth|dovecot(-auth)?|auth-worker) failregex = ^%(__prefix_line)s(?:%(__pam_auth)s(?:$dovecot:auth$)?:)?\s+authentication failure; logname=\S* uid=\S* euid=\S* tty=dovecot ruser=\S* rhost=<HOST>(?:\s+user=\S*)?\s*$ ^%(__prefix_line)s(?:pop3|imap)-login: (?:Info: )?(?:Aborted login|Disconnected)(?::(?: [^ $]+)+)? \((?:auth failed, \d+ attempts( in \d+ secs)?|tried to use (disabled|disallowed) \S+ auth)$:( user=<[^>]+>,)?( method=\S+,)? rip=<HOST>(?:, lip=\S+)?(?:, TLS(?: handshaking(?:: SSL_accept failed: error:[\dA-F]+:SSL routines:[TLS\d]+_GET_CLIENT_HELLO:unknown protocol)?)?(: Disconnected)?)?(, session=<\S+>)?\s*$ ^%(__prefix_line)s(?:Info|dovecot: auth$default$|auth-worker$\d+$): pam$\S+,<HOST>$: pam_authenticate failed: (User not known to the underlying authentication module: \d+ Time$s$|Authentication failure $password mismatch\?$)\s*$ ^%(__prefix_line)s(?:auth|auth-worker$\d+$): (?:pam|passwd-file)$\S+,<HOST>$: unknown user\s*$ ^%(__prefix_line)s(?:auth|auth-worker$\d+$): Info: ldap$\S*,<HOST>,\S*$: invalid credentials\s*$ ignoreregex = [Init] journalmatch = _SYSTEMD_UNIT=dovecot.service # DEV Notes: # * the first regex is essentially a copy of pam-generic.conf # * Probably doesn't do dovecot sql/ldap backends properly (resolved in edit 21/03/2016) # * Removed the 'no auth attempts' log lines from the matches because produces # lots of false positives on misconfigured MTAs making regexp unusable # # Author: Martin Waschbuesch # Daniel Black (rewrote with begin and end anchors) # Martin O'Neal (added LDAP authentication failure regex) # Sergey G. Brester aka sebres (reviewed, optimized, IPv6-compatibility)

2 1

pass a block of parameters to doveadm
by dovecot-user 21 May '20

21 May '20

Hello everyone. Please tell me how to override the configuration file options when using the doveadm utility with the -o switch in case I need to pass a block of parameters, for example, like this: passdb { args = scheme=PLAIN username_format=%u /path/to/file driver = passwd-file } Thanks.

2 1

v2.3.10.1 released
by Aki Tuomi 21 May '20

21 May '20

We are pleased to release v2.3.10.1 Please find it from locations below: https://dovecot.org/releases/2.3/dovecot-2.3.10.1.tar.gz https://dovecot.org/releases/2.3/dovecot-2.3.10.1.tar.gz.sig Binary packages in https://repo.dovecot.org/ Docker images in https://hub.docker.com/r/dovecot/dovecot Aki Tuomi Open-Xchange oy --- - CVE-2020-10957: lmtp/submission: A client can crash the server by sending a NOOP command with an invalid string parameter. This occurs particularly for a parameter that doesn't start with a double quote. This applies to all SMTP services, including submission-login, which makes it possible to crash the submission service without authentication. - CVE-2020-10958: lmtp/submission: Sending many invalid or unknown commands can cause the server to access freed memory, which can lead to a server crash. This happens when the server closes the connection with a "421 Too many invalid commands" error. The bad command limit depends on the service (lmtp or submission) and varies between 10 to 20 bad commands. - CVE-2020-10967: lmtp/submission: Issuing the RCPT command with an address that has the empty quoted string as local-part causes the lmtp service to crash.

3 2