February 2021 - dovecot

IMAP session hangs on 8k-long commands if COMPRESS=DEFLATE is enabled
by Guilhem Moulin 21 Apr '21

21 Apr '21

Hi there, Dovecot 2.3.7 appears to hang when the client sends a long command after enabling the IMAP COMPRESS extension [RFC 4978]. PoC script attached along with the doveconf(1) output. Without COMPRESS=DEFLATE, and with the default ‘imap_max_line_length’ value (64k) I'm able send commands up to 65539 bytes long (that's 3 bytes more than 2¹⁶, so maybe the leading tag and the trailing CRLF aren't counted), after which Dovecot rightfully replies with tagged BAD responses. $ COMPRESS=n /tmp/many-fetch.pl 65539 […] C: x UID FETCH 1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,… [65539 bytes] S: x OK Fetch completed (0.005 + 0.001 + 0.004 secs). C: x UID FETCH 1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,… [65540 bytes] S: x BAD Error in IMAP command UID FETCH: IMAP command line too large (0.001 + 0.001 secs). C: x UID FETCH 1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,… [65541 bytes] S: x BAD Error in IMAP command UID FETCH: IMAP command line too large (0.001 + 0.001 secs). With COMPRESS=DEFLATE however, the server never sends anything back when the command size exceeds 8192 bytes: $ COMPRESS=y /tmp/many-fetch.pl 8192 […] S: x OK [READ-ONLY] Examine completed (0.001 + 0.000 secs). C: x UID FETCH 1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,… [8191 bytes] S: x OK Fetch completed (0.001 + 0.000 secs). C: x UID FETCH 1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,… [8192 bytes] S: x OK Fetch completed (0.001 + 0.000 secs). C: x UID FETCH 1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,… [8193 bytes] [ _hangs until the server terminates the session for inactivity_ ] S: * BYE Disconnected for inactivity. strace(1) show that Dovecot didn't send the response, even though the server log indicates that it's able to fully read the command. Interestingly, when setting ‘imap_max_line_length’ to 4096, the server also hangs after receiving a command of size >4096 bytes (instead of replying with a tagged BAD response). $ COMPRESS=y /tmp/many-fetch.pl 4096 C: x UID FETCH 1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,… [4095 bytes] S: x OK Fetch completed (0.001 + 0.000 secs). C: x UID FETCH 1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,… [4096 bytes] S: x OK Fetch completed (0.001 + 0.000 secs). C: x UID FETCH 1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,… [4097 bytes] [ _hangs until the server terminates the session for inactivity_ ] I'm also able to reproduce the buggy behavior against Dovecot versions found in other Debian releases. It's identical with 2.3.4 (Buster), the server also hang past 8192 bytes. 2.2.27 (Stretch) and 2.2.13 (Jessie) are able to send replies to 8k-long commands, but hang past 65536 bytes. For all 3 releases, without COMPRESS=DEFLATE Dovecot doesn't hang and rightfully sends tagged BAD responses to commands of size >65539 bytes. So while the hanging behavior appears to be a long-standing bug, the fact that's it's now hit at min($imap_max_line_length, 8192) instead of $imap_max_line_length seems to be a regression from somewhere between 2.2.27 and 2.3.4. Cheers, -- Guilhem.

3 2

last login plugins
by Henry 05 Mar '21

05 Mar '21

Anyone kwon the last-login plugins can using Authentication variables such as %m mechanism, %a local_port . we want to record this in DB, thanks

3 21

dsync and sieve again
by Edgaras Lukoševičius 01 Mar '21

01 Mar '21

Hi, I'm starting to wonder if dsync is supposed to sync sieve scripts at all? Or should it work only as a part of replicator? Because I was not able to get it working on multiple Dovecot and Pigeon versions, and I see lots of replication/dsync and sieve related questions in the mailing list. I'm trying to get it to work using latest versions on http://repo.dovecot.org/ce-2.3-latest repo. The versions I am testing at the moment are: - Dovecot 2.3.13 (89f716dc2) - Pigeonhole 0.5.13 (cdd19fe3) It's a straightforward setup, nothing fancy. So the question is - is it supposed to work at all without replicator?

2 3

sieve_after seems to not bring any effect to life in dovecot 2.3.13 dovecot-pigeonhole-0.5.13
by Bug Report 26 Feb '21

26 Feb '21

dovecot 2.3.13 (89f716dc2) dovecot-pigeonhole-0.5.13 OS: FreeBSD amd64 12.2-RELEASE After following code ------ require ["copy"]; # rule:[redirect] if true { redirect :copy "mail(a)mail.com"; keep; } ------ (both with keep and without keep) is executed sieve_after seems to not execute at all. Same code together with sieve_after was working as supposed in earlier versions.

3 7

doveadm user '*' vs sssd: enumeration works only once
by Heiko Schlittermann 25 Feb '21

25 Feb '21

Hi, I've a quite simple setup using sssd (id_provider, auth_provider: AD), and dovecot. doveadm user * returns the full user list only once. A 2nd invocation of the same command within a small timeframe returns a subset of the local users only (the users I've in /etc/passwd with uid >= first_valid_uid). If I wait until the dovecot/auth worker processes are gone (or if I kill them), I get the full list again. Calling getent passwd repeateadly always returns the full list of users. Question: - [ ] unfortunate configuration (see attachment) - [ ] misbehaviour of sssd (more specifically its nss module) - [ ] misbehaviour of dovecot/auth processes? Dovecot: 2.3.4.1 (f79e8e7e4) Operating System: Debian GNU/Linux 10 (buster) Sssd: 1.16.30 Best regards from Dresden/Germany Viele Grüße aus Dresden Heiko Schlittermann -- SCHLITTERMANN.de ---------------------------- internet & unix support - Heiko Schlittermann, Dipl.-Ing. (TU) - {fon,fax}: +49.351.802998{1,3} - gnupg encrypted messages are welcome --------------- key ID: F69376CE -

2 8

doveadm copy not respecting quotas?
by MAREN ZUBIZARRETA 24 Feb '21

24 Feb '21

Hello: I have a problema with the quotas at my system with dovecot 2.3.9.2, y use: quota_rule5 = RECUPERADOS_VGTIC:ignore I want to be free of quota limits at that mailbox RECUPERADOS_VGTIC when copying messages from "lazy_expunge" folder To recover from backup I use doveadm copy: doveadm copy -u nppgiibi RECUPERADOS_VGTIC mailbox .BORRADOS_VGTIC/sent-mail ALL But when I do so, quota for this mailbox RECUPERADOS_VGTIC is not ignored, and it grows to 200% Is this a bug? Or there is something that I'm doing wrongly? Thanks for your help. Maren PD: My config file for quotas follows below: /etc/dovecot/conf.d/90-quota.conf # Quota mail_vsize_bg_after_count = 100 # Limits plugin { quota = count:User quota quota_rule = *:storage=10G #for backups and lazy expunge quota_rule3 = .BORRADOS:ignore quota_rule4 = Recuperados_VGTIC:ignore quota_rule5 = RECUPERADOS_VGTIC:ignore quota_rule6 = BORRADOS_VGTIC:ignore quota_rule7 = .BORRADOS_VGTIC:ignore # This is required quota_vsizes = yes } -----Mensaje original----- De: dovecot <dovecot-bounces(a)dovecot.org> En nombre de Aki Tuomi Enviado el: miércoles, 24 de febrero de 2021 8:37 Para: Mark Constable <markc(a)renta.net>; dovecot(a)dovecot.org Asunto: Re: LMDB support? > On 24/02/2021 08:15 Mark Constable <markc(a)renta.net> wrote: > > > Hi all, is there any way I could use LMDB for userdb and passdb lookups? You can use Lua userdb/passdb. See https://doc.dovecot.org/configuration_manual/authentication/lua_based_authe… Aki

1 0

LMDB support?
by Mark Constable 24 Feb '21

24 Feb '21

Hi all, is there any way I could use LMDB for userdb and passdb lookups?

2 1

Problem with fs:User quota: Postfix quota-status returns always DUNNO
by Niccolo Rigacci 23 Feb '21

23 Feb '21

I installed a mail server on a Debian GNU/Linux 10 Buster, which provide Dovecot 2.3.4.1. It works almost everything, but I'm unable to make the Postfix quota service to work as expected. First of all I verify that the Dovecot idea of quota is OK: doveadm quota get -u username(a)example.org Quota name Type Value Limit % User quota STORAGE 2752 3500 78 Then I ask the Postfix quota-status service: printf "recipient=username(a)example.org\nsize=3000000\n\n" \ | nc localhost 12340 action=DUNNO But a size of 3 Mb should trigger the "action=554 5.2.2 Quota exceeded" message. I find a workaround for this problem: just adding the following section will "fix" the problem: plugin { quota_over_flag_value = FALSE quota_over_script = quota-warning mismatch %u } How the quota_over_flag_value is related to the quota over filesystem? Why should I add both the quota_over_flag_value AND the quota_over_script options? The script is executed always for each SMTP check (regardless of the quota_over_flag_value is FALSE or TRUE), obviously I provided a "do nothing" quota-warning script. Here the relevant parts of "dovecot -n" output: plugin { quota = fs:User quota:user quota_grace = 5%% quota_over_flag_value = FALSE quota_over_script = quota-warning mismatch %u quota_status_nouser = DUNNO quota_status_overquota = 554 5.2.2 Quota exceeded quota_status_success = DUNNO quota_warning = storage=90%% quota-warning 90 %u quota_warning2 = storage=80%% quota-warning 80 %u sieve = file:~/sieve;active=~/.dovecot.sieve sieve_before = ~/sieve_before.d/ sieve_extensions = +vnd.dovecot.filter sieve_filter_bin_dir = /usr/local/lib/dovecot/sieve-filter sieve_filter_socket_dir = sieve-filter sieve_plugins = sieve_extprograms } service quota-status { client_limit = 1 executable = quota-status -p postfix inet_listener { port = 12340 } } service quota-warning { executable = script /usr/local/bin/quota-warning.sh unix_listener quota-warning { group = dovecot mode = 0666 user = dovecot } user = root } -- Niccolo Rigacci - http://www.rigacci.net/ Firenze/Prato - Italy Tel. Mobile: +39-327-5619352

1 0

Bug renaming folder hierarchies
by Klaus Steinberger 23 Feb '21

23 Feb '21

Hi, we discovered a major problem with renaming folders with subfolders testszenario: folders: test1 test1/test1-1 test1/test1-2 all 3 folders contain a test message after renaming the top level folder test1 to test2 following folders exist: test2 test2/test1-1 test2/test1-2 the subfolders test1-1 and test1-2 are empty, the top level folder contains the correct message. Now renmaing test2 back to test1: Alle folders again contain their messages. So this looks like during renaming the top level folder just the message references for the subfolders got lost, and with renaming back they are there again. I can reproduce this behavior both with thunderbird and Horde Webmail as a client, also it happens with a second different dovecot setup Here is the dovecot config: root@dmz-sv-dovecot ~]# dovecot -n # 2.3.13 (89f716dc2): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.13 (cdd19fe3) # OS: Linux 3.10.0-1160.15.2.el7.x86_64 x86_64 Scientific Linux release 7.9 (Nitrogen) nfs4 # Hostname: dmz-sv-dovecot.physik.uni-muenchen.de auth_cache_negative_ttl = 5 mins auth_cache_size = 10 M auth_cache_ttl = 5 mins auth_socket_path = /var/run/dovecot/auth-userdb auth_username_format = %Ln auth_verbose = yes default_client_limit = 32768 default_process_limit = 8192 dict { acl = mysql:/etc/dovecot/dovecot-dict-sql.conf.ext quota = mysql:/etc/dovecot/dovecot-dict-sql.conf.ext } first_valid_uid = 8 imap_capability = +SPECIAL-USE imap_hibernate_timeout = 1 mins imapc_features = rfc822.size imapc_host = zarafa.physik.uni-muenchen.de imapc_user = %u lda_original_recipient_header = X-Original-To mail_fsync = always mail_location = mdbox:/var/vmail/%Lu:FULLDIRNAME=DbOx-mAiLs:UTF-8:VOLATILEDIR=/var/dovecot-volatile/%Lu:INDEX=/var/vmail/%Lu/indexes mail_nfs_index = yes mail_plugins = quota acl lazy_expunge fts fts_lucene mail_prefetch_count = 20 mail_server_admin = mailto:helpdesk@physik.uni-muenchen.de mail_server_comment = IMAP Server Fakultätfür Physik LMU München mailbox_list_index_very_dirty_syncs = yes managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext mbox_write_locks = fcntl metric imap_command { filter = event=imap_command_finished AND tagged_reply_state=OK group_by = cmd_name } metric imap_select_no { filter = event=imap_command_finished AND cmd_name=SELECT AND tagged_reply_state=NO } metric imap_select_no_notfound { filter = event=imap_command_finished AND cmd_name=SELECT AND tagged_reply="NO*Mailbox doesn't exist:*" } metric push_notifications { filter = event=push_notification_finished } metric storage_http_gets { filter = event=http_request_finished AND category=storage AND method=get } mmap_disable = yes namespace { list = children location = mdbox:/var/vmail/%%Lu:FULLDIRNAME=DbOx-mAiLs:INDEX=/var/vmail/%%Lu/indexes:INDEXPVT=/var/vmail/%%Lu/indexes.pvt:UTF-8 prefix = shared/%%n/ separator = / subscriptions = no type = shared } namespace { hidden = yes list = children location = mdbox:/var/vmail/%Lu/expunged:FULLDIRNAME=DbOx-mAiLs:UTF-8 prefix = .EXPUNGED/ separator = / subscriptions = no type = private } namespace inbox { inbox = yes location = mailbox Drafts { auto = subscribe special_use = \Drafts } mailbox Junk { auto = subscribe special_use = \Junk } mailbox Sent { auto = subscribe special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { auto = subscribe special_use = \Trash } prefix = separator = / subscriptions = yes type = private } passdb { args = /etc/dovecot/dovecot-ldap.conf.ext driver = ldap } plugin { acl = vfile:/etc/dovecot/dovecot.acl acl_shared_dict = file:/var/vmail/dovecot-dicts/shared-mailboxes fts = lucene fts_lucene = whitespace_chars=@. lazy_expunge = .EXPUNGED/ lazy_expunge_only_last_instance = yes quota = dict:User quota::proxy::quota quota_grace = 10%% quota_rule = *:storage=1G quota_rule2 = Trash:storage=+100M quota_rule3 = Spam:storage=+100M quota_rule4 = .EXPUNGED:ignore recipient_delimiter = + sieve = file:/var/vmail/%Lu/sieve;active=/var/vmail/%Lu/dovecot.sieve sieve_vacation_use_original_recipient = yes } postmaster_address = postmaster(a)physik.uni-muenchen.de protocols = imap lmtp sieve sieve quota_full_tempfail = yes service auth { unix_listener auth-userdb { group = daemon mode = 0666 user = mail } } service dict { unix_listener dict { group = daemon mode = 0600 user = vmail } } service imap-hibernate { client_limit = 8192 unix_listener imap-hibernate { user = vmail } } service imap-login { process_min_avail = 6 service_count = 0 vsz_limit = 1 G } service imap-postlogin { executable = script-login -d /etc/dovecot/acl_groups.py user = $default_internal_user } service imap { executable = imap imap-postlogin process_limit = 8192 unix_listener imap-master { user = dovecot } } service managesieve-login { inet_listener sieve { port = 4190 } process_min_avail = 0 service_count = 1 vsz_limit = 64 M } service managesieve { process_limit = 1024 } service stats { unix_listener stats-reader { group = dovecot mode = 0660 user = vmail } unix_listener stats-writer { group = dovecot mode = 0660 user = vmail } } ssl = required ssl_cert = </etc/pki/tls/certs/dmz-sv-dovecot-with-chain.crt.pem ssl_client_ca_file = /etc/ssl/certs/ca-bundle.crt ssl_dh = # hidden, use -P to show it ssl_key = # hidden, use -P to show it userdb { args = /etc/dovecot/dovecot-ldap.conf.ext driver = ldap } verbose_proctitle = yes protocol lmtp { mail_plugins = quota acl lazy_expunge fts fts_lucene sieve } protocol lda { mail_plugins = quota acl lazy_expunge fts fts_lucene sieve syslog_facility = mail } protocol imap { mail_max_userip_connections = 20 mail_plugins = quota acl lazy_expunge fts fts_lucene imap_quota imap_acl lazy_expunge } protocol sieve { mail_max_userip_connections = 10 managesieve_implementation_string = Dovecot Pigeonhole managesieve_logout_format = bytes=%i/%o managesieve_max_compile_errors = 5 managesieve_max_line_length = 64 k

1 0

Some questions about mail_crypt setups
by deano-dovecot＠areyes.com 22 Feb '21

22 Feb '21

Some questions about mail_crypt setups I have global mail enecryption working nicely, and replication works nicely between two systems. The main problem is that the private and public keys are *right there* on the server in /etc/dovecot/private ... Fine for a completely controlled system, but not so fine when on a rented VPS etc. When are the keys read in by dovecot ? Are they ever read in again while dovecot is running, or does it cache them in ram until dovecot is restarted ? Would it be possible for dovecot to read the keys as output from a script ? I'm thinking of a small script that would reach out to an authentication service like Authy or Okta or similar. Admin gets an alert on their phone, taps OK, UNLOCK and the two keys are returned to the script, which then hands them back to dovecot and away it goes. The mail_crypt config normally contains > mail_crypt_global_private_key = </etc/dovecot/private/dovecot_crypt_privkey > mail_crypt_global_public_key = </etc/dovecot/private/dovecot_crypt_pubkey Perhaps add another variable like > mail_crypt_global_script = </etc/dovecot/private/dovecot_crypt_script That script would run and feed the two keys back into dovecot (no matter how it got to them). So I started looking into per-user/per-folder encryption to see how that would work, and I have that setup nicely too. The config looks like this > # /etc/dovecot/conf.d/99-mailcrypt.conf > #-------------------------------------- > mail_attribute_dict = file:%h/Maildir/dovecot-attributes > plugin { > mail_crypt_require_encrypted_user_key = yes > mail_crypt_save_version = 2 > mail_crypt_curve = secp521r1 > } > > # /etc/dovecot/dovecot-sql.conf.ext > #---------------------------------- > # CREATE TABLE IF NOT EXISTS `users` ( > # `username` varchar(64) character set utf8 collate utf8_bin NOT NULL COMMENT 'localpart of email-address', > # `domain` varchar(64) character set utf8 collate utf8_bin NOT NULL COMMENT 'domain-part of email-address', > # `name` varchar(64) character set utf8 collate utf8_bin NOT NULL COMMENT 'Full name of user', > # `password` varchar(128) character set utf8 collate utf8_bin NOT NULL COMMENT 'base64-encoded SHA512 hash of password', > # PRIMARY KEY (`username`,`domain`) > # ) ENGINE=InnoDB DEFAULT CHARSET=utf8 COMMENT='users'; > > driver = mysql > connect = host=/var/run/mysqld/mysqld.sock dbname=emailers user=dovecot password=RandomPassword > default_pass_scheme = SHA512-CRYPT > > password_query = SELECT username, password, '%w' AS userdb_mail_crypt_private_password, '/var/mail/%d/%n' AS userdb_home, 'vmail' AS userdb_uid, 'vmail' AS userdb_gid FROM users WHERE username = '%n' AND domain = '%d' > > # For LDA: > user_query = SELECT '/var/mail/%d/%n' AS home, 'vmail' AS uid, 'vmail' AS gid FROM users WHERE username = '%n' AND domain = '%d' > > # For using doveadm -A: > iterate_query = SELECT username, domain FROM users Except that replication doesn't work due to the user password not being available. Actually, indexing fails too for the same reason. > Feb 21 14:02:13 indexer-worker(testuser(a)example.com)<120846><l8W9BzWuMmAK2AEAqNyxgw:MyoJDDWuMmAO2AEAqNyxgw>: Error: Mailbox INBOX: UID=1: read() failed: read(/var/mail/example.com/testuser/Maildir/INBOX/new/1613934133.M132059P12… failed: Private key not available: Cannot decrypt key f64e7c12a60b3df12ebf865a70bec57fedd3e9b4fd98df93205f1096db14fda7: Cannot decrypt key eca099273f525ca46b2f5640253770ad19e0578543244d8cd34bde183e996bd5: Password not available (read reason=fts indexing) > > Feb 21 14:02:13 indexer-worker(testuser(a)example.com)<120846><l8W9BzWuMmAK2AEAqNyxgw:MyoJDDWuMmAO2AEAqNyxgw>: Error: Failed to read mailbox INBOX mail UID=1 stream: Mailbox INBOX: UID=1: read() failed: read(/var/mail/example.com/testuser/Maildir/INBOX/new/1613934133.M132059P12… failed: Private key not available: Cannot decrypt key f64e7c12a60b3df12ebf865a70bec57fedd3e9b4fd98df93205f1096db14fda7: Cannot decrypt key eca099273f525ca46b2f5640253770ad19e0578543244d8cd34bde183e996bd5: Password not available (read reason=fts indexing) > > Feb 21 14:02:13 indexer-worker(testuser(a)example.com)<120846><l8W9BzWuMmAK2AEAqNyxgw:MyoJDDWuMmAO2AEAqNyxgw>: Error: Mailbox INBOX: Mail search failed: Internal error occurred. Refer to server log for more information. [2021-02-21 14:02:13] > > Feb 21 14:02:13 indexer-worker(testuser(a)example.com)<120846><l8W9BzWuMmAK2AEAqNyxgw:MyoJDDWuMmAO2AEAqNyxgw>: Error: Mailbox INBOX: Transaction commit failed: FTS transaction commit failed: transaction context (attempted to index 1 messages (UIDs 1..1)) > > Feb 21 14:02:13 dsync-local(testuser(a)example.com)<TGxiDTWuMmAN2AEAqNyxgw>: Error: Mailbox INBOX: UID=1: read() failed: read(/var/mail/example.com/testuser/Maildir/INBOX/new/1613934133.M132059P12… failed: Private key not available: Cannot decrypt key f64e7c12a60b3df12ebf865a70bec57fedd3e9b4fd98df93205f1096db14fda7: Cannot decrypt key eca099273f525ca46b2f5640253770ad19e0578543244d8cd34bde183e996bd5: Password not available (read reason=prefetch) What are the options here for providing the decryption password or key ? The user password is already stored in the mysql database as a SHA512-CRYPT so we don't want to store it unencrypted ... I saw the mail_crypt docs (https://doc.dovecot.org/configuration_manual/mail_crypt_plugin/) mention > mail_crypt_private_key - Private key to decrypt user's master key, can be base64 encoded I'm assuming that can just be a key generated with > openssl ecparam -name secp521r1 -genkey | openssl pkey but that leaves the situation almost the same as with a global key - they key is local on the system, though a bit better in that it's not just visible there as a simple file, it can be buried in the database. One could retrieve it with > password_query = SELECT username, password, privkey AS userdb_mail_crypt_private_key, '/var/mail/%d/%n' AS userdb_home, 'vmail' AS userdb_uid, 'vmail' AS userdb_gid FROM users WHERE username = '%n' AND domain = '%d' How are other people handling mail store encryption ? -- Dean Carpenter deano is at areyes dot com 203 six oh four 6644

4 3