August 2020 - dovecot

syslog logging + 2.3.10 + centos 7
by Matt Bryant 04 Sep '20

04 Sep '20

All, Running dovecot 2.3.10 on a CentOS 7.x and logging via syslog seems to stop when i restart rsyslog process. Reload doesnt get it working again only a dovecot restart. Tested this with dovecot 2.2.36 and this did not exhibit the same behaviour. systemctl restart dovecot rsyslog ----- this gets a working state systemctl restart rsyslog ------------- this restarts syslog other processes like exim continue to log but dovecot stops systemctl reload dovecot -------------- this has no impact logging still does not work systemctl restart dovecot ------------- this fixes the issue. Are there any changes to the log process between 2.2 and 2.3 that might explain this ? rgds Matt

1 1

How to backup maildir
by Robert Moskowitz 04 Sep '20

04 Sep '20

I have been thinking, and reading, on how to back up my mailserver. I have not found any approach that seems ready to use. I have run years without any backup, but would really like to have something in place. I figure I can attach a USB drive and backup to that, then from there rsync to something elsewhere. Further if that USB drive is a full mailserver image, I actually have a 'hot backup' where I only have to put the backup drive into a system and boot up at the last backup. But this means properly copying all of /home/vmail and probably /home/sieve plus the /var/lib/mysql Are there good tools that nicely does this? Or do I choose a time late at night (only I am sometimes in non-US timezones) to shut down all services and just use rsync? And stopping services itself is thought provoking. What if Dovecot, amavis, mysql, or whatelse is in the middle of writing out a mail file what happens to that file and restart. Just scary stuff and, in part, why I have never tackled this in the past. thanks for all feedback

4 6

Sieve: deleteheader now working with duplicate filter for implicit keep
by Alec Moskvin 04 Sep '20

04 Sep '20

Hello, I have a rule to always delete a header. If the message gets fileinto'd, the header is gone, but if it's delivered into the INBOX through implicit keep, the header does not get deleted. Interestingly, if I remove the "if duplicate" filter, the header does get deleted as expected. I'm using the latest Dovecot 2.3.11.3 / Pigeonhole 0.5.11. Any idea why this is happening? Thanks, Alec === Sieve filter require ["fileinto", "editheader", "duplicate", "mailbox"]; deleteheader "X-Bad-Header"; if duplicate { fileinto :create "Trash"; stop; } if header :matches "subject" "*filter*" { fileinto :create "Filtered"; } === Example (note ${RANDOM} to bypass duplicate filter) $ /usr/libexec/dovecot/deliver << -end- To: me(a)example.com From: someone(a)example.com Subject: Test Message Message-Id: <${RANDOM}(a)example.net> Date: Thu, 20 Aug 2020 00:21:24 +0000 (UTC) X-Bad-Header: DELETE ME Hello world -end-

2 4

Submission proxy warning connecting to Exim
by Alec Moskvin 03 Sep '20

03 Sep '20

Hello, When connecting to Exim 4.94, dovecot submission logs this warning: dovecot[25235]: submission(alec)<25347><QNydV8+t+oMKAgAF>: Warning: smtp-client: conn localhost:25 ([::1]:25) [1]: Received invalid EHLO response line: Unexpected character in EHLO keyword Looks like it doesn't like the underscore in "X_PIPE_CONNECT", since it's neither "isalnum" nor a dash [1]: 1598480923.401085 220 myhostname ESMTP Exim 4.94 Wed, 26 Aug 2020 18:28:43 -0400 1598480923.401906 250-myhostname Hello localhost [::1] 1598480923.401906 250-SIZE 52428800 1598480923.401906 250-8BITMIME 1598480923.401906 250-PIPELINING 1598480923.401906 250-X_PIPE_CONNECT 1598480923.401906 250-CHUNKING 1598480923.401906 250-STARTTLS 1598480923.401906 250 HELP 1598480923.409242 250 OK 1598480923.434743 250 Accepted 1598480923.578335 250- 511 byte chunk, total 511 1598480923.578335 250 OK id=1kB3uN-0006ar-HU Adding the line "pipelining_connect_advertise_hosts =" to Exim's config fixes the issue by disabling X_PIPE_CONNECT. Is this a bug in Exim or is Dovecot being too strict? Thanks, Alec [1] https://github.com/dovecot/core/blob/2.3.11.3/src/lib-smtp/smtp-syntax.c#L2…

3 2

Sumbission crashes when relaying over TLS
by Alec Moskvin 03 Sep '20

03 Sep '20

Hello, I'm trying to set up the submission proxy, but if I set submission_relay_ssl = starttls, it crashes. Without it, it works. Please find the details below. Thanks, Alec dovecot[256855]: submission-login: Login: user=<alec>, method=PLAIN, rip=::1, lip=::1, mpid=257033, secured, session=<kMd1B9uthLUAAAAAAAAAAAAAAAAAAAAB> dovecot[256855]: submission(alec)<257033><kMd1B9uthLUAAAAAAAAAAAAAAAAAAAAB>: Panic: file smtp-client-connection.c: line 290 (smtp_client_connection_fail): assertion failed: (conn->to_connect == NULL) dovecot[256855]: submission(alec)<257033><kMd1B9uthLUAAAAAAAAAAAAAAAAAAAAB>: Error: Raw backtrace: /usr/lib64/dovecot/libdovecot.so.0(backtrace_append+0x42) [0x7fbbfb2bcaf2] -> /usr/lib64/dovecot/libdovecot.so.0(backtrace_get+0x1e) [0x7fbbfb2bcc0e] -> /usr/lib64/dovecot/libdovecot.so.0(+0xf5f09) [0x7fbbfb2c5f09] -> /usr/lib64/dovecot/libdovecot.so.0(+0xf5fa1) [0x7fbbfb2c5fa1] -> /usr/lib64/dovecot/libdovecot.so.0(+0x51eec) [0x7fbbfb221eec] -> /usr/lib64/dovecot/libdovecot.so.0(+0x44d5e) [0x7fbbfb214d5e] -> /usr/lib64/dovecot/libdovecot.so.0(+0x6c431) [0x7fbbfb23c431] -> /usr/lib64/dovecot/libdovecot.so.0(smtp_client_command_input_reply+0x201) [0x7fbbfb235261] -> /usr/lib64/dovecot/libdovecot.so.0(+0x6ccfd) [0x7fbbfb23ccfd] -> /usr/lib64/dovecot/libdovecot.so.0(io_loop_call_io+0x68) [0x7fbbfb2dc048] -> /usr/lib64/dovecot/libdovecot.so.0(io_loop_handler_run_internal+0x132) [0x7fbbfb2dd662] -> /usr/lib64/dovecot/libdovecot.so.0(io_loop_handler_run+0x51) [0x7fbbfb2dc0f1] -> /usr/lib64/dovecot/libdovecot.so.0(io_loop_run+0x40) [0x7fbbfb2dc2b0] -> /usr/lib64/dovecot/libdovecot.so.0(master_service_run+0x13) [0x7fbbfb255ee3] -> dovecot/submission(main+0x4df) [0x561d486b3daf] -> /lib64/libc.so.6(__libc_start_main+0xea) [0x7fbbfb054b8a] -> dovecot/submission(_start+0x2a) [0x561d486b3e3a] dovecot[256855]: submission(alec)<257033><kMd1B9uthLUAAAAAAAAAAAAAAAAAAAAB>: Fatal: master: service(submission): child 257033 killed with signal 6 (core dumped) (gdb) bt #0 0x00007fbbfb069a31 in raise () from /lib64/libc.so.6 #1 0x00007fbbfb0532b6 in abort () from /lib64/libc.so.6 #2 0x00007fbbfb22223c in default_fatal_finish (status=0, type=LOG_TYPE_PANIC) at failures.c:459 #3 fatal_handler_real (ctx=<optimized out>, format=<optimized out>, args=<optimized out>) at failures.c:471 #4 0x00007fbbfb2c5fa1 in i_internal_fatal_handler (ctx=<optimized out>, format=<optimized out>, args=<optimized out>) at failures.c:848 #5 0x00007fbbfb221eec in i_panic (format=format@entry=0x7fbbfb30fd08 "file %s: line %d (%s): assertion failed: (%s)") at failures.c:523 #6 0x00007fbbfb214d5e in smtp_client_connection_fail (status=9002, error=<optimized out>, conn=0x561d491296a8) at smtp-client-connection.c:290 #7 smtp_client_connection_fail (conn=0x561d491296a8, status=<optimized out>, error=<optimized out>) at smtp-client-connection.c:282 #8 0x00007fbbfb23c431 in smtp_client_connection_starttls_cb (reply=0x561d4912d048, conn=0x561d491296a8) at smtp-client-connection.c:788 #9 0x00007fbbfb235261 in smtp_client_command_input_reply (cmd=<optimized out>, reply=reply@entry=0x561d4912d048) at smtp-client-command.c:971 #10 0x00007fbbfb23ccfd in smtp_client_connection_input_reply (reply=0x561d4912d048, conn=0x561d491296a8) at smtp-client-connection.c:1045 #11 smtp_client_connection_input (_conn=<optimized out>) at smtp-client-connection.c:1116 #12 0x00007fbbfb2dc048 in io_loop_call_io (io=0x561d49109cb0) at ioloop.c:713 #13 0x00007fbbfb2dd662 in io_loop_handler_run_internal (ioloop=ioloop@entry=0x561d490fd050) at ioloop-epoll.c:222 #14 0x00007fbbfb2dc0f1 in io_loop_handler_run (ioloop=0x561d490fd050) at ioloop.c:765 #15 0x00007fbbfb2dc2b0 in io_loop_run (ioloop=0x561d490fd050) at ioloop.c:738 #16 0x00007fbbfb255ee3 in master_service_run (service=0x561d490fceb0, callback=<optimized out>) at master-service.c:851 #17 0x0000561d486b3daf in main (argc=<optimized out>, argv=<optimized out>) at main.c:396 $ openssl version OpenSSL 1.1.1g 21 Apr 2020 # doveconf -n # 2.3.11.3 (502c39af9): /etc/dovecot/dovecot.conf # OS: Linux 5.8.4 x86_64 Gentoo Base System release 2.7 # Hostname: haswell listen = localhost mail_location = maildir:~/.maildir namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } passdb { args = scheme=CRYPT username_format=%u /etc/dovecot/users driver = passwd-file } protocols = submission ssl_cert = </etc/ssl/dovecot/server.pem ssl_client_ca_file = </etc/dovecot/ca.crt ssl_key = # hidden, use -P to show it submission_relay_host = localhost submission_relay_port = 2525 submission_relay_rawlog_dir = %h/rawlog submission_relay_ssl = starttls userdb { args = username_format=%u /etc/dovecot/users driver = passwd-file } protocol submission { rawlog_dir = %h/rawlog }

2 2

submission message quota
by Gerry 03 Sep '20

03 Sep '20

Hello, I am trying to come up with a way to have individual quotas per user for the submission service. Similar to what I could achieve with Postfix and policyd. More specifically, the quota I am most interested in, is limiting the number of messages a single account can send within a given timeframe. Ideally, I'd also like to limit the number of total recipients within a given timeframe, to mitigate the loophole of adding multiple recipients to a single message. Example: account Y is allowed to send 500 messages per 60 minutes, with a maximum of 2000 recipients overall. What would be the best path to take? Thanks! Gerry

4 5

Metric label values truncated when using OpenMetrics endpoint
by Daan van Gorkum 02 Sep '20

02 Sep '20

Hi, Recently we upgraded to Dovecot 2.3.11.3 and configured an example metric like this: metric imap_command { event_name = imap_command_finished group_by = cmd_name tagged_reply_state user remote_ip } And enabled the OpenMetrics listener like this: service stats { inet_listener http { port = 5000 } } While the result is great, I noticed that some metrics are being truncated (three dots at the end of the label value): dovecot_imap_command_duration_usecs_sum{cmd_name="FETCH",tagged_reply_state="OK",user="xxxxxxxxxxx.inbox@xxxxxxxxxxxxx…",remote_ip="XXXX:XXXX:XXXX:XXXX:cc6b:cc7a:d…"} 2346 1598055662473 I couldn't find this information in the documentation so I'm wondering if this is a bug. Thank you for your time. Regards, Daan

2 5

Incremental purge?
by Jesus Cea 02 Sep '20

02 Sep '20

I am using mdbox storage format. As far as I know, “doveadm purge” does a complete purge. The time and disk activity would be proportional to the number mdbox files on the storage. The purge time could be huge. I wonder if there is some way of doing a kind of incremental purge, stopping/restarting purging, etc. Purging by file range would be nice too. Advice? Thanks Enviado desde mi iPhone

5 7

Dovecot Proxy
by Thoralf Rickert-Wendt 02 Sep '20

02 Sep '20

Hello everyone, it's my first post here on this mailing list and I hope, I make it right. I posted a question on https://serverfault.com/questions/1031441/dovecot-as-proxy-with-submission and nobody was able to answer it. So I decided to push that question here (I'm talking about any new dovecot version and I've tested it with 2.3.4.1 (f79e8e7e4)). I try to run a dovecot proxy in front of a big number of mail servers (serving SMTP-in, submission, IMAP, POP3, Sieve). I need that proxy, because I run out of IPv4 addresses. Of course I use IPv6 too, but many customers still have problems with there providers and they really don't want to share their mails on a "shared-mailserver". I planed to use Dovecot for IMAPS, POP3S, SMTP-submission(465) and postfix for the rest. If I find a solution for sieve, I would try that too, but that is very optional. With the documentation https://wiki1.dovecot.org/HowTo/ImapProxy (which is really old and should be updated) and some other ascii docs (from an Apple mirror somewhere deep in the web) I was able to build a IMAP/POP3 proxy that forwards requests from outside to a specific backend using SSL (993,995). That works - I think.You can find the config on the serverfault page. In general - all known domains in backend are using SSL and the passdb forwards all requests to the backend via SSL. So - I understand:|| |password_query = SELECT NULL AS password, NULL AS destuser, host, 'Y' AS nologin, 'Y' AS nodelay, 'Y' AS nopassword, 'Y' AS proxy, 'any-cert' AS `ssl` FROM proxy_domain WHERE domain = '%d' | But that is only 50% of the show. The rest ist submission (and maybe sieve). Practically the submission implementation in dovecot works too. But because dovecot by default only opens port 587 (starttls), my passdb setting has a problem. When I try to use that port Dovecot tries to use SSL on the backend/587 too - but that is wrong (it should either use 465 or should try to use starttls). So, I have the following options. - find a way to configure dovecot-proxy to listen on 465 with SSL for submission service and hope that it uses the same port - but I didn't find any documentation for that and need help - find a way to configure dovecot-proxy/passdb to return starttls=y when dovecot-submission is used (use a different passdb) - but I didn't find any documentation for that and I'm not sure, if this worls on service/protocol level - find a way to configure the passdb answer based on the used port/protocol. But I only know the parameter %u, %d and %p. - so it would be nice to find a way to also select the protocol (if already developed) - find a way to make a patch in dovecot (which isn't easy for me, because I don't really know the code) Has somebody an idea, how I can configure the dovecot-proxy in that way. bye Thoralf

3 4

Bug: Dovecot appending "MISSING_DOMAIN" to fetch envelope responses
by Michael Gratton 02 Sep '20

02 Sep '20

Hi all, I'm seeing Dovecot include the string "MISSING_DOMAIN" in fetch envelope requests when an mailbox's `addr-spec` part does not have a `domain` part. For example: > C: a022 uid fetch 40 (envelope rfc822.header) > S: * 5 FETCH (UID 40 ENVELOPE ("Sat, 15 Aug 2020 12:53:05 +1000" > "test {{name}}" (("Michael Gratton" NIL "mike" "vee.net")) (("Michael > Gratton" NIL "mike" "vee.net")) (("Michael Gratton" NIL "mike" > "vee.net")) (("postgres" NIL "postgres" "MISSING_DOMAIN")) NIL NIL > NIL NIL) RFC822.HEADER {literal/244b}) I understand that RFC 5322 require a mailbox to have a domain part, however it is still possible for mail to contain mailboxes that do not. In these cases, Dovecot returning random string such as the above is harmful, since it not possible for IMAP clients to determine whether host name string is actually present or something that the IMAP server has made up. As a result, an IMAP client has two options: Either display the string as-is, preventing it from providing an appropriately localised explanation or visual indication of the problem in the user interface, or simply avoid ever requesting IMAP envelopes from the server and always download and parse the complete RFC822 headers itself (as I believe Thunderbird does). The former is untenable since "MISSING_DOMAIN" does not mean anything to non-English speakers, the latter is untenable since it unnecessarily inflates the of volume of data that must be transmitted over the wire to work around a server bug. In these cases, or when any other part of a required IMAP address structure is missing, Dovecot should return the empty string, e.g. "". Cheers, //Mike Dovecot details: > *REDACTED*:~$ sudo dovecot -n > # 2.3.4.1 (f79e8e7e4): /etc/dovecot/dovecot.conf > # Pigeonhole version 0.5.4 () > # OS: Linux 4.19.0-9-amd64 x86_64 Debian 10.4 ext4 > # Hostname: *REDACTED* > first_valid_uid = *REDACTED* > hostname = *REDACTED* > last_valid_uid = *REDACTED* > lda_original_recipient_header = X-Original-To > lmtp_rcpt_check_quota = yes > lmtp_save_to_detail_mailbox = yes > mail_gid = *REDACTED* > mail_home = *REDACTED* > mail_location = mdbox:*REDACTED*:UTF-8 > mail_privileged_group = mail > mail_server_admin = mailto:*REDACTED* > mail_temp_dir = *REDACTED* > mail_uid = *REDACTED* > managesieve_notify_capability = mailto > managesieve_sieve_capability = fileinto reject envelope > encoded-character vacation subaddress comparator-i;ascii-numeric > relational regex imap4flags copy include variables body enotify > environment mailbox date index ihave duplicate mime foreverypart > extracttext imapsieve vnd.dovecot.imapsieve > namespace inbox { > inbox = yes > location = > mailbox Drafts { > auto = subscribe > special_use = \Drafts > } > mailbox Junk { > auto = subscribe > autoexpunge = 30 days > special_use = \Junk > } > mailbox Sent { > auto = subscribe > special_use = \Sent > } > mailbox Trash { > auto = subscribe > autoexpunge = 30 days > special_use = \Trash > } > prefix = > separator = . > type = private > } > passdb { > args = *REDACTED* > driver = ldap > } > plugin { > imapsieve_mailbox1_before = file:*REDACTED* > imapsieve_mailbox1_causes = COPY > imapsieve_mailbox1_name = Junk > imapsieve_mailbox2_before = file:*REDACTED* > imapsieve_mailbox2_causes = COPY > imapsieve_mailbox2_from = Junk > imapsieve_mailbox2_name = * > recipient_delimiter = + > sieve = file://*REDACTED* > sieve_before = /etc/dovecot/sieve-before.d > sieve_global_extensions = +vnd.dovecot.pipe > +vnd.dovecot.environment +vnd.dovecot.report > sieve_pipe_bin_dir = /etc/dovecot/sieve-scripts > sieve_plugins = sieve_imapsieve sieve_extprograms > sieve_quota_max_storage = 50M > } > postmaster_address = *REDACTED* > protocols = " imap lmtp sieve" > service auth-worker { > user = mail > } > service auth { > unix_listener *REDACTED* { > group = postfix > mode = 0666 > user = postfix > } > } > service lmtp { > process_min_avail = 2 > unix_listener *REDACTED* { > group = postfix > mode = 0600 > user = postfix > } > user = mail > } > ssl = required > ssl_cert = <*REDACTED* > ssl_client_ca_dir = *REDACTED* > ssl_dh = # hidden, use -P to show it > ssl_key = # hidden, use -P to show it > submission_host = *REDACTED*:587 > userdb { > args = uid=8 > driver = static > } > protocol lmtp { > mail_plugins = " sieve" > } > protocol imap { > mail_plugins = " imap_sieve" > } -- Michael Gratton. <https://mjog.vee.net>

2 3