November 2021 - dovecot

Shared mailboxes, users with dots and a bug in subscriptions
by Tobias Stein 17 May '22

17 May '22

Hi, i'm running Dovecot 2.3.14.alpha0 with shared namespaces and stumbled across some errors messages logged, when the list of subscribed mailboxes is queried by a client. For every distinct account of in the list of subscriptions two corresponding lines are logged: Jan 28 11:42:34 mx1 dovecot: auth: missing passwd file: /etc/dovecot/private/example/users Jan 28 11:42:34 mx1 dovecot: auth: missing passwd file: /etc/dovecot/private/example/users Jan 28 11:42:34 mx1 dovecot: auth: missing passwd file: /etc/dovecot/private/example/users Jan 28 11:42:36 mx1 dovecot: imap(example_user(a)example.com)<3638><xl6li/O5VsVfWxyn>: Error: mkdir(/var/run/dovecot/user-not-found/noc@example) failed: Permission denied (euid=109(vmail) egid=118(vmail) missing +w perm: /var/run/dovecot, dir owned by 0:0 mode=0755) Jan 28 11:42:36 mx1 dovecot: imap(example_user(a)example.com)<3638><xl6li/O5VsVfWxyn>: Error: mkdir(/var/run/dovecot/user-not-found/info@example) failed: Permission denied (euid=109(vmail) egid=118(vmail) missing +w perm: /var/run/dovecot, dir owned by 0:0 mode=0755) Jan 28 11:42:36 mx1 dovecot: imap(example_user(a)example.com)<3638><xl6li/O5VsVfWxyn>: Error: mkdir(/var/run/dovecot/user-not-found/root@example) failed: Permission denied (euid=109(vmail) egid=118(vmail) missing +w perm: /var/run/dovecot, dir owned by 0:0 mode=0755) Similar messages are logged, when invalid entries are listed in '/var/lib/dovecot/db/shared-mailboxes', which i already pruned and haven't received them anymore since. I think these errors are caused by an unintended behaviour when writing "~/Maildir/subscriptions", which looks (shortened) like this. V 2 INBOX/INBOX shared/noc@example com/INBOX shared/info@example com/INBOX shared/root@example com/test shared/root@example com/test test_sub The subscription-file.c explodes the name on every hierarchy separator ('.','\0') and inserts a TAB character. Unfortunately it also explodes on the DNS label delimiter „.‟. This should probably be fixed by passing a structure containing the required information to the formatter to distinguish mailboxes from domain-names. Subscription in combination with multiple domains and shared mailboxes seems broken to me. Actually i can't even explain to me, why it is working in face of the errors. :-) Unfortunately in Maildir++ the separator dot is hard-coded. There is a very old thread on this mailing list, that suggests using „auth_username_translation‟ to replace dots with a different character, but this idea is getting worse the longer i think about it. I absolutely dislike the idea to set LAYOUT=fs, namespace/separator = § to change the separators to split on, because this would mean to restructure the physical layout of all mailboxes (hierarchically) and mess around with lots of files. I attached a dovecot-sysreport to reproduce the behaviour. /etc/dovecot/private/example.com/users looks like this: ### user:password:uid:gid:(gecos):home:(shell):extra_fields noc:{SSHA512}_hash_:::::: info:{SSHA512}_hash_:::::: root:{SSHA512}_hash_:::::: Please correct me if i'm wrong or point me to a workaround, but i think the layout code needs some love. :-) Best regards Tobias

2 4

FTS solr or xapian and Public Folders
by David Williams 13 May '22

13 May '22

Hi all I hope someone can help with this. I'm looking at setting up FTS on a Dovecot server which has some quite big pubic folders (100,000+ emails each) and would appreciate some info about how fts both Xapian and Solr works with public folders. As background of the folders can receive emails and I use a dummy user and an alias file to deliver them for example testfolder: dummy+Public/MYTESTFOLDER(a)example.com delivers email addressed to testfolder(a)example.com to MYTESTFOLDER in the namespace Public. Has anyone successfully setup FTS with public folders using either Xapian or Solr and what happens when one user changes a folder, does that change show up for other users? E.G.: When an email is delivered by dummy and indexed will that email be indexed for other users as well? Similarly what happens that when an email is moved between, deleted from or copied to public folders by one user will that change then show up for the other users or not? I guess the basic question is: Are public folders indexed once and then the indexes are made available to each user with access or are they indexed for each user? Any info or experience that anyone has will be appreciated. Many thanks David

2 1

imap_metadata plugin panic
by Elisamuel Resto 23 Mar '22

23 Mar '22

Hello, This may be covered somewhere but recently I enabled the metadata plugin to work with sieve as part of some updates I did a while back and I hadn't checked my logs for any issues with it and so far they're not completely taking my system down. Right now, upon trying to delete a folder I noticed the following in my logs... what am I missing? I see the broken SQL query, but I don't know enough about the dict system or the metadata plugin to know how to add the missing information or fix it otherwise. Regards, Elisamuel Resto Nov 15 12:19:19 wyvern dovecot[461]: dict(51438): Panic: lib-sql: Too many bind args (2) for statement: SELECT meta_key FROM metadata WHERE meta_key LIKE AND username = ? Nov 15 12:19:19 wyvern dovecot[461]: dict(51438): Error: Raw backtrace: /usr/lib/dovecot/libdovecot.so.0(backtrace_append+0x43) [0x7f449789d073] -> /usr/lib/dovecot/libdovecot.so.0(backtrace_get+0x20) [0x7f449789d190] -> /usr/lib/dovecot/libdovecot.so.0(+0xfaf1f) [0x7f44978a9f1f] -> /usr/lib/dovecot/libdovecot.so.0(+0xfafb1) [0x7f44978a9fb1] -> /usr/lib/dovecot/libdovecot.so.0(+0x4cd20) [0x7f44977fbd20] -> dovecot/dict [0 clients, 0 lookups:0/0/0/0, 0 iters:0/0/0/0, 0 commits:0/0/0/0](+0x875a) [0x555e60d7775a] -> dovecot/dict [0 clients, 0 lookups:0/0/0/0, 0 iters:0/0/0/0, 0 commits:0/0/0/0](sql_statement_query+0x42) [0x555e60d7f262] -> dovecot/dict [0 clients, 0 lookups:0/0/0/0, 0 iters:0/0/0/0, 0 commits:0/0/0/0](+0xd97f) [0x555e60d7c97f] -> /usr/lib/dovecot/libdovecot.so.0(dict_iterate_values+0x25) [0x7f4497868615] -> dovecot/dict [0 clients, 0 lookups:0/0/0/0, 0 iters:0/0/0/0, 0 commits:0/0/0/0](+0xa929) [0x555e60d79929] -> dovecot/dict [0 clients, 0 lookups:0/0/0/0, 0 iters:0/0/0/0, 0 commits:0/0/0/0](+0xb224) [0x555e60d7a224] -> dovecot/dict [0 clients, 0 lookups:0/0/0/0, 0 iters:0/0/0/0, 0 commits:0/0/0/0](+0xb381) [0x555e60d7a381] -> dovecot/dict [0 clients, 0 lookups:0/0/0/0, 0 iters:0/0/0/0, 0 commits:0/0/0/0](dict_command_input+0xd9) [0x555e60d7a579] -> dovecot/dict [0 clients, 0 lookups:0/0/0/0, 0 iters:0/0/0/0, 0 commits:0/0/0/0](+0x95b8) [0x555e60d785b8] -> /usr/lib/dovecot/libdovecot.so.0(connection_input_default+0x15e) [0x7f44978a16ce] -> /usr/lib/dovecot/libdovecot.so.0(io_loop_call_io+0x6b) [0x7f44978bfebb] -> /usr/lib/dovecot/libdovecot.so.0(io_loop_handler_run_internal+0x13b) [0x7f44978c15cb] -> /usr/lib/dovecot/libdovecot.so.0(io_loop_handler_run+0x51) [0x7f44978bff61] -> /usr/lib/dovecot/libdovecot.so.0(io_loop_run+0x41) [0x7f44978c0131] -> /usr/lib/dovecot/libdovecot.so.0(master_service_run+0x14) [0x7f4497831f74] -> dovecot/dict [0 clients, 0 lookups:0/0/0/0, 0 iters:0/0/0/0, 0 commits:0/0/0/0](main+0x189) [0x555e60d78139] -> /usr/lib/libc.so.6(__libc_start_main+0xd5) [0x7f44972cfb25] -> dovecot/dict [0 clients, 0 lookups:0/0/0/0, 0 iters:0/0/0/0, 0 commits:0/0/0/0](_start+0x2e) [0x555e60d7819e] Nov 15 12:19:19 wyvern dovecot[461]: imap(sam(a)samresto.dev)<51449><+BGq2NfQM/7Pisr9>: Error: Mailbox Trash/Processed: dict_iterate(priv/c841ad0291c27461ac670100a07d9965/) failed: Connection closed (reply took 0.204 secs (0.204 in dict wait, 0.000 in other ioloops, 0.000 in locks)) Nov 15 12:19:19 wyvern dovecot[461]: dict(51438): Fatal: master: service(dict): child 51438 killed with signal 6 (core dumped)

4 12

test-file-cache.c needs #ifdef HAVE_RLIMIT_AS
by Rupert Gallagher 07 Feb '22

07 Feb '22

test-file-cache.c:259:24: error: use of undeclared identifier 'RLIMIT_AS' test_assert(getrlimit(RLIMIT_AS, &rl_cur) == 0); ^ test-file-cache.c:267:24: error: use of undeclared identifier 'RLIMIT_AS' test_assert(setrlimit(RLIMIT_AS, &rl_new) == 0); ^ test-file-cache.c:270:24: error: use of undeclared identifier 'RLIMIT_AS' test_assert(setrlimit(RLIMIT_AS, &rl_cur) == 0); ^ test-file-cache.c:276:24: error: use of undeclared identifier 'RLIMIT_AS' test_assert(setrlimit(RLIMIT_AS, &rl_new) == 0); ^ test-file-cache.c:279:24: error: use of undeclared identifier 'RLIMIT_AS' test_assert(setrlimit(RLIMIT_AS, &rl_cur) == 0); ^

3 9

Dsync replication - delayed replication (Sync lock)
by Daniel Botting 31 Jan '22

31 Jan '22

Hi, *Our setup:* Two Debian 10 machines that are setup to replicate mail between them, we have round robin DNS setup so a user can connect to either server. *What should happen:* Mail is delivered to either server and replicated across straight away to their mailbox on the other server so it does not matter which one they are connected to they will receive it fairly soon after delivery. *What actually happens:* In some instances the user will experience a delayed receipt of messages if they are not connected to the server that the message is initially delivered to, sometimes the delay is 5/10 minutes, we had a recent support ticket submitted where it was over an hour. Error message seen in mail.err: Sep 1 10:16:15 <host name> dovecot: dsync-local(<username>)<WELSGEERTl8FEAAAZJ7A9A>: Error: Couldn't lock /path/to/mailbox/.dovecot-sync.lock: fcntl(/path/to/mailbox/.dovecot-sync.lock, write-lock, F_SETLKW) locking failed: Timed out after 30 seconds (WRITE lock held by pid 3697) Process 3697 is dovecot/doveadm-server. *Doveconf -n output:* # 2.3.10.1 (a3d0e1171): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.10 (67bf5bd7) # OS: Linux 4.19.0-10-amd64 x86_64 Debian 10.5 # Hostname: <server hostname> auth_verbose = yes default_vsz_limit = 0 doveadm_password = # hidden, use -P to show it first_valid_gid = 8 first_valid_uid = 8 last_valid_gid = 8 last_valid_uid = 8 lda_mailbox_autocreate = yes lda_mailbox_autosubscribe = yes mail_gid = 8 mail_location = maildir:~/Maildir mail_plugins = " notify replication" mail_uid = 8 managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex im ap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext editheader imapfla gs namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } passdb { args = /etc/dovecot/dovecot-ldap.conf.ext driver = ldap } plugin { mail_replica = tcps:<server being replicated to>:<port being used> sieve = ~/.dovecot.sieve sieve_dir = ~/sieve sieve_extensions = +editheader +imapflags } postmaster_address = postmaster@<domain address> protocols = " imap sieve pop3" replication_max_conns = 12 service aggregator { fifo_listener replication-notify-fifo { user = mail } unix_listener replication-notify { user = mail } } service auth { unix_listener /var/run/dovecot-exim-bridge { mode = 0660 user = Debian-exim } } service doveadm { inet_listener { port = <port being used for replication> ssl = yes } } service imap-login { inet_listener imap { port = 143 } } inet_listener imaps { port = 993 ssl = yes } process_limit = 512 process_min_avail = 4 service_count = 1 } service imap { process_limit = 1024 } service managesieve-login { inet_listener sieve { port = <sieve port> } process_min_avail = 1 service_count = 8 vsz_limit = 256 M } service managesieve { process_limit = 1024 } service replicator { process_min_avail = 1 unix_listener replicator-doveadm { mode = 0666 } } ssl = required ssl_cert = </path/to/ssl/cert/fullchain.pem ssl_cipher_list = ALL:!LOW:!SSLv2:!EXP:!aNULL ssl_client_ca_dir = /etc/ssl/certs ssl_key = # hidden, use -P to show it ssl_min_protocol = TLSv1.2 userdb { args = /etc/dovecot/dovecot-ldap.conf.ext driver = ldap override_fields = home=/var/mail/%u uid=mail gid=mail } protocol lda { mail_plugins = " notify replication sieve" } protocol imap { mail_max_userip_connections = 32 mail_plugins = " notify replication" } protocol sieve { mail_max_userip_connections = 10 managesieve_logout_format = bytes=%i/%o managesieve_max_line_length = 65536 } Kind regards Daniel

3 3

dovecot-2.3.17: "Panic: file ioloop.c: line 865"
by Piper Andreas 14 Dec '21

14 Dec '21

Hello, since the upgrade from dovecot-2.3.16 to 2.3.17 I get 'Panic'-errors in the system-log of my replicator hosts. See below for log messages, doveconf-output and gdb-backtrace. Storage filesystem is ZFS. The error seems to be correlated with exactly one user-mailbox, this user is repeatedly noted as 'failed' in replication status, although replication of this mailbox seems to work, as the mailbox status shows always the identical size on both replicators. The error can be produced by forcing replication of this individual mailbox. Is there anything I can do to repair this mailbox? Thanks for any hints, Andreas Example log-messages: Nov 11 07:17:50 vhrz311 dovecot: doveadm(119455): Error: write(<local>) failed: Timed out after 60 seconds Nov 11 07:17:50 vhrz311 dovecot: doveadm(119455): Panic: file ioloop.c: line 865 (io_loop_destroy): assertion failed: (ioloop == cur rent_ioloop) Nov 11 07:17:50 vhrz311 dovecot: doveadm(119455): Error: Raw backtrace: /usr/lib/dovecot/libdovecot.so.0(backtrace_append+0x42) [0x7 f4e59419182] -> /usr/lib/dovecot/libdovecot.so.0(backtrace_get+0x1e) [0x7f4e5941929e] -> /usr/lib/dovecot/libdovecot.so.0(+0xf8a5e) [0x7f4e59427a5e] -> /usr/lib/dovecot/libdovecot.so.0(+0xf8b01) [0x7f4e59427b01] -> /usr/lib/dovecot/libdovecot.so.0(i_fatal+0) [0x7f 4e593744a7] -> /usr/lib/dovecot/libdovecot.so.0(io_loop_destroy+0x2dc) [0x7f4e5944121c] -> dovecot/doveadm-server(+0x46fb6) [0x563d0 150ffb6] -> dovecot/doveadm-server(doveadm_print+0x27) [0x563d01508fb7] -> dovecot/doveadm-server(+0x2b427) [0x563d014f4427] -> dove cot/doveadm-server(+0x2da44) [0x563d014f6a44] -> dovecot/doveadm-server(doveadm_cmd_ver2_to_mail_cmd_wrapper+0x2cf) [0x563d014f7c6f] -> dovecot/doveadm-server(doveadm_cmd_run_ver2+0x43b) [0x563d01508c1b] -> dovecot/doveadm-server(+0x44612) [0x563d0150d612] -> /usr /lib/dovecot/libdovecot.so.0(io_loop_call_io+0x69) [0x7f4e594406d9] -> /usr/lib/dovecot/libdovecot.so.0(io_loop_handler_run_internal +0x134) [0x7f4e59442034] -> /usr/lib/dovecot/libdovecot.so.0(io_loop_handler_run+0x50) [0x7f4e594407e0] -> /usr/lib/dovecot/libdovec ot.so.0(io_loop_run+0x38) [0x7f4e59440a18] -> /usr/lib/dovecot/libdovecot.so.0(master_service_run+0x13) [0x7f4e593a6a23] -> dovecot/ doveadm-server(main+0x102) [0x563d014e6922] -> /lib/x86_64-linux-gnu/libc.so.6(__libc_start_main+0xe7) [0x7f4e58bc1bf7] -> dovecot/d oveadm-server(_start+0x2a) [0x563d014e69aa] Nov 11 07:17:50 vhrz311 dovecot: doveadm(119455): Fatal: master: service(doveadm): child 119455 killed with signal 6 (core dumped) 'doveconf -n': # 2.3.17 (e2aa53df5b): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.17 (054dddfa) # OS: Linux 4.15.0-162-generic x86_64 Ubuntu 18.04.6 LTS # Hostname: vhrz311.HRZ.Uni-Marburg.DE auth_cache_negative_ttl = 0 auth_cache_size = 10 M auth_master_user_separator = * auth_worker_max_count = 1024 base_dir = /var/run/dovecot/ default_client_limit = 10000 default_vsz_limit = 6 G doveadm_password = # hidden, use -P to show it doveadm_port = 12345 first_valid_gid = 10000 first_valid_uid = 10000 imap_max_line_length = 640 k last_valid_gid = 10000 last_valid_uid = 10000 mail_attribute_dict = file:%h/mdbox/dovecot-attributes mail_gid = 10000 mail_location = mdbox:%h/mdbox mail_plugins = " mail_log notify zlib notify replication" mail_privileged_group = mail mail_uid = 10000 managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext namespace inbox { hidden = no inbox = yes list = yes location = prefix = separator = / subscriptions = yes type = private } passdb { args = /etc/dovecot.deny deny = yes driver = passwd-file } passdb { args = /etc/dovecot/private/passwd.masterusers driver = passwd-file master = yes } passdb { args = /etc/dovecot/dovecot-ldap.hrz.conf.ext driver = ldap name = passdb_ldap_hrz } passdb { args = /etc/dovecot/dovecot-ldap.staff.conf.ext driver = ldap name = passdb_ldap_staff } passdb { args = /etc/dovecot/dovecot-ldap.students.conf.ext driver = ldap name = passdb_ldap_students } plugin { mail_replica = tcp:172.25.1.95 sieve = file:~/sieve;active=~/.dovecot.sieve sieve_default = /var/lib/dovecot/default.sieve sieve_max_actions = 55 sieve_max_redirects = 50 } pop3_uidl_format = %08Xv%08Xu postmaster_address = postmaster(a)hrz.uni-marburg.de protocols = imap pop3 lmtp sieve replication_dsync_parameters = -d -n INBOX -l 30 -U replication_max_conns = 20 service aggregator { fifo_listener replication-notify-fifo { user = vmail } unix_listener replication-notify { user = vmail } } service auth-worker { user = $default_internal_user } service auth { client_limit = 10000 } service config { process_min_avail = 8 } service doveadm { inet_listener { port = 12345 } vsz_limit = 6 G } service imap-login { process_min_avail = 64 service_count = 0 } service imap { process_limit = 8192 } service lmtp { inet_listener lmtp { port = 24 } } service managesieve-login { inet_listener sieve { port = 4190 } process_min_avail = 8 service_count = 0 } service pop3-login { process_min_avail = 8 service_count = 0 } service replicator { process_min_avail = 1 unix_listener replicator-doveadm { mode = 0600 user = vmail } } service submission-login { service_count = 0 } ssl = required ssl_ca = </etc/ssl/certs/umr-chain.pem ssl_cert = </etc/ssl/certs/vhrz311.hrz.uni-marburg.de.pem ssl_client_ca_dir = /etc/ssl/certs ssl_dh = # hidden, use -P to show it ssl_key = # hidden, use -P to show it ssl_require_crl = no userdb { args = /etc/dovecot/dovecot-ldap-userdb.conf.ext driver = ldap name = userdb_ldap } protocol imap { imap_metadata = yes mail_max_userip_connections = 25 mail_plugins = " mail_log notify zlib notify replication imap_zlib" } protocol lmtp { mail_plugins = " mail_log notify zlib notify replication sieve" } gdb: gdb /usr/lib/dovecot/doveadm-server /var/vmail/system-cores/core GNU gdb (Ubuntu 8.1.1-0ubuntu1) 8.1.1 Copyright (C) 2018 Free Software Foundation, Inc. License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html> This is free software: you are free to change and redistribute it. There is NO WARRANTY, to the extent permitted by law. Type "show copying" and "show warranty" for details. This GDB was configured as "x86_64-linux-gnu". Type "show configuration" for configuration details. For bug reporting instructions, please see: <http://www.gnu.org/software/gdb/bugs/>. Find the GDB manual and other documentation resources online at: <http://www.gnu.org/software/gdb/documentation/>. For help, type "help". Type "apropos word" to search for commands related to "word"... Reading symbols from /usr/lib/dovecot/doveadm-server...(no debugging symbols found)...done. [New LWP 119455] [Thread debugging using libthread_db enabled] Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1". Core was generated by `dovecot/doveadm-server'. Program terminated with signal SIGABRT, Aborted. #0 __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:51 51 ../sysdeps/unix/sysv/linux/raise.c: No such file or directory. (gdb) bt #0 __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:51 #1 0x00007f4e58be0921 in __GI_abort () at abort.c:79 #2 0x00007f4e59427a11 in ?? () from /usr/lib/dovecot/libdovecot.so.0 #3 0x00007f4e59427b01 in ?? () from /usr/lib/dovecot/libdovecot.so.0 #4 0x00007f4e593744a7 in i_panic () from /usr/lib/dovecot/libdovecot.so.0 #5 0x00007f4e5944121c in io_loop_destroy () from /usr/lib/dovecot/libdovecot.so.0 #6 0x0000563d0150ffb6 in ?? () #7 0x0000563d01508fb7 in doveadm_print () #8 0x0000563d014f4427 in ?? () #9 0x0000563d014f6a44 in ?? () #10 0x0000563d014f7c6f in doveadm_cmd_ver2_to_mail_cmd_wrapper () #11 0x0000563d01508c1b in doveadm_cmd_run_ver2 () #12 0x0000563d0150d612 in ?? () #13 0x00007f4e594406d9 in io_loop_call_io () from /usr/lib/dovecot/libdovecot.so.0 #14 0x00007f4e59442034 in io_loop_handler_run_internal () from /usr/lib/dovecot/libdovecot.so.0 #15 0x00007f4e594407e0 in io_loop_handler_run () from /usr/lib/dovecot/libdovecot.so.0 #16 0x00007f4e59440a18 in io_loop_run () from /usr/lib/dovecot/libdovecot.so.0 #17 0x00007f4e593a6a23 in master_service_run () from /usr/lib/dovecot/libdovecot.so.0 #18 0x0000563d014e6922 in main ()

4 5

public folders, ACLs
by Stefan G. Weichinger 06 Dec '21

06 Dec '21

greetings ... I got the following request from a customer where we run dovecot-2.3.15 on a debian server: They have a public folder with all their project-related subfolders inside: namespace { location = maildir:/home/vmail/oeffentlich prefix = Oeffentlich/ separator = / subscriptions = yes type = public } So far we don't have the mail_plugin ACL enabled. They want to be able to create projectfolders that aren't move/delete/rename-able by the users, only by some admins. But the users should be allowed to move mails between different projectfolders etc As far as I understand we can do that with Dovecot ACLs (although I am still figuring out how to properly design them ...). My questions: * if I enable the mail_plugin for ACLs, does that in any way change the behavior of existing mailboxes? afai understand: no. Only if ACL-lists exist in the various mailboxes, these get applied, right? I don't want to break things, and I want to avoid additional complexity for the non-public user mailboxes etc Maybe I can enable the plugin only for that public namespace? * maybe someone has a link to a similar setup? thanks in advance, Stefan

2 8

Searching 30 GB mailbox
by Einar Bjarni Halldórsson 03 Dec '21

03 Dec '21

Hi, We're migrating our mailboxes from Zimbra to dovecot, running on FreeBSD 12.2. We're using mdbox and solr for fts. dovecot version 2.3.17. One of our mailboxes gets a bcc of every outgoing mail from our system and it currently holds ~4.5 million messages taking 30 GB. One of the ways we use the mailbox is that when outgoing mail is sent, we store the Message-ID in our database, and in our admin interface we can open the mail and it's fetched from IMAP by doing a 'SEARCH HEADER Message-ID <MSG_ID>'. In Zimbra this was reasonably fast, but after migrating the mailbox to dovecot it's 30 seconds which I think we can reduce. After turning on mail_debug I see this in our log https://pastebin.com/kP9H7gSB Looks like solr finishes searching instantly, then there's ~30 seconds of silence in the logs, and then more log lines about fetching data from mail cache. The same thing happens if I use telnet and just issue a 'SEARCH HEADER...' command. How can I find out what dovecot is doing in those 30 seconds? .einar

5 14

Strategies for protecting IMAP (e.g. MFA)
by Tyler Montney 02 Dec '21

02 Dec '21

With the world of ransomware as it is today (aka attacks seem more vicious and commonplace), anything I expose to WAN must have additional protection. I've seen a few posts to this list on it. The only thing that helped was that Dovecot supports OAuth. Through OAuth I figure I could implement MFA. However, I'd have to host my own identity server. From there, Thunderbird supports OAuth so that should work. Since this is getting increasingly complicated, I wanted to ask before going further. What do you all do? Any recommendations?

14 20

Strange errors with Dovecot replication
by Claudio Corvino 01 Dec '21

01 Dec '21

Hi, I have two IMAP/LMTP Dovecot server in replica (version 2.3.4.1) for testing purposes, both connected through an IPsec tunnel, I use LDAP/AD for /userdb, /all seems to work fine except for these errors present in logs every day: NODE A: /doveadm: Error: sieve: file storage: utime(/var/www/html/ooo/its-test) failed: Operation not permitted: 28 Time(s) dsync-local(its-test)<TxExKuQgeWHlTAAA045Smw>: Error: read(xxx) failed: Connection reset by peer (last sent=mailbox_delete, last recv=handshake): 1 Time(s) dsync-local(its-test)<fXcyHCd3eWGHXwAA045Smw>: Error: sieve: file storage: utime(/var/www/html/ooo/its-test) failed: Operation not permitted: 2 Time(s) dsync-local(its-test)<fZ2LISh3eWGOXwAA045Smw>: Error: read(xxx) failed: Connection reset by peer (last sent=mailbox_delete, last recv=handshake): 1 Time(s) dsync-local(its-test2)<PqNdGCd3eWGGXwAA045Smw>: Error: read(xxx) failed: Connection reset by peer (last sent=mailbox_delete, last recv=handshake): 1 Time(s)/ NODE B: /doveadm: Error: Couldn't lock /mnt/mail-storage-dev/its-test/.dovecot-sync.lock: fcntl(/mnt/mail-storage-dev/its-test/.dovecot-sync.lock, write-lock, F_SETLKW) locking failed: Timed out after 30 seconds: 2 Time(s) doveadm: Error: Couldn't lock /mnt/mail-storage-dev/its-test2/.dovecot-sync.lock: fcntl(/mnt/mail-storage-dev/its-test2/.dovecot-sync.lock, write-lock, F_SETLKW) locking failed: Timed out after 30 seconds: 1 Time(s) doveadm: Error: sieve: file storage: utime(/var/www/html/ooo/its-test) failed: Operation not permitted: 28 Time(s) dsync-local(its-test)<QtV8HSh3eWHFDgAA/HgeEQ>: Error: sieve: file storage: utime(/var/www/html/ooo/its-test) failed: Operation not permitted: 2 Time(s)/ What I have to do? Do I have to worry about this or I can ignore it? Thanks Regards

2 3