May 2021 - dovecot - dovecot.org

Error and Panic (with coredump)
by Thomas Knaute 03 May '21

03 May '21

Hi there, i'm pretty new to this stuff, just tell me if you need more information. Apr 26 17:15:43 dilia dovecot: imap(user(a)domain.de)<78561><rtYxnuHAZoPAqBSC>: Error: i_stream_seekable_write_failed: close((&sstream->fd)) @ istream-seekable.c:246 failed (fd=21): Bad fi le descriptor Apr 26 17:15:43 dilia dovecot: imap(user(a)domain.de)<78561><rtYxnuHAZoPAqBSC>: Panic: file istream-seekable.c: line 226 (read_from_buffer): assertion failed: (*ret_r >0) Apr 26 17:15:43 dilia dovecot: imap(user(a)domain.de)<78561><rtYxnuHAZoPAqBSC>: Error: Raw backtrace: /usr/lib/dovecot/libdovecot.so.0(+0xdb73b) [0x7f13aead973b] -> /usr/lib/dovecot/libdov ecot.so.0(+0xdb7d1) [0x7f13aead97d1] -> /usr/lib/dovecot/libdovecot.so.0(+0x4a199) [0x7f13aea48199] -> /usr/lib/dovecot/libdovecot.so.0(+0x4c7cf) [0x7f13aea4a7cf] -> /usr/lib/dovecot/libdove cot.so.0(+0xee6e2) [0x7f13aeaec6e2] -> /usr/lib/dovecot/libdovecot.so.0(+0xeeb46) [0x7f13aeaecb46] -> /usr/lib/dovecot/libdovecot.so.0(+0xe6cd9) [0x7f13aeae4cd9] -> /usr/lib/dovecot/libdovec ot.so.0(i_stream_get_size+0x2a) [0x7f13aeae5baa] -> /usr/lib/dovecot/modules/lib20_zlib_plugin.so(+0x417c) [0x7f13ae80817c] -> /usr/lib/dovecot/libdovecot-storage.so.0(index_mail_set_seq+0x2 5) [0x7f13aec57eb5] -> /usr/lib/dovecot/libdovecot-storage.so.0(+0xd19ce) [0x7f13aec5e9ce] -> /usr/lib/dovecot/libdovecot-storage.so.0(index_storage_search_next_nonblock+0x61) [0x7f13aec5f0e 1] -> /usr/lib/dovecot/libdovecot-storage.so.0(mailbox_search_next_nonblock+0x28) [0x7f13aebe7e58] -> dovecot/imap [user(a)domain.de 192.168.xxx.xxx UID SORT](+0x2695f) [0x55740be9495f] -> dovecot/imap [user(a)domain.de 192.168.xxx.xxx UID SORT](imap_search_start+0xdc) [0x55740be9528c] -> dovecot/imap [user(a)domain.de 192.168.xxx.xxx UID SORT](cmd_sort+0x271) [0x55740be87b7 1] -> dovecot/imap [user(a)domain.de 192.168.xxx.xxx UID SORT](command_exec+0x70) [0x55740be8ddc0] -> dovecot/imap [user(a)domain.de 192.168.xxx.xxx UID SORT](+0x1e3f2) [0x55740be8c3f2] -> dovecot/imap [user(a)domain.de 192.168.xxx.xxx UID SORT](+0x1e494) [0x55740be8c494] -> dovecot/imap [user(a)domain.de 192.168.xxx.xxx UID SORT](client_handle_input+0x1b5) [0x55740be8c845] -> dovecot/imap [user(a)domain.de 192.168.xxx.xxx UID SORT](client_input+0x7e) [0x55740be8cd6e] -> /usr/lib/dovecot/libdovecot.so.0(io_loop_call_io+0x6f) [0x7f13aeaefbef] -> /usr/lib/dovec ot/libdovecot.so.0(io_loop_handler_run_internal+0x136) [0x7f13aeaf11e6] -> /usr/lib/dovecot/libdovecot.so.0(io_loop_handler_run+0x4c) [0x7f13aeaefc8c] -> /usr/lib/dovecot/libdovecot.so.0(io_ loop_run+0x40) [0x7f13aeaefdf0] -> /usr/lib/dovecot/libdovecot.so.0(master_service_run+0x13) [0x7f13aea70123] -> dovecot/imap [user(a)domain.de 192.168.xxx.xxx UID SORT](main+0x325) [0x5574 0be7ebf5] -> /lib/x86_64-linux-gnu/libc.so.6(__libc_start_main+0xeb) [0x7f13ae85709b] Apr 26 17:15:44 dilia dovecot: imap(user(a)domain.de)<78561><rtYxnuHAZoPAqBSC>: Fatal: master: service(imap): child 78561 killed with signal 6 (core dumped) # 2.3.4.1 (f79e8e7e4): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.4 () # OS: Linux 4.19.0-9-amd64 x86_64 Debian 10.9 # Hostname: dilia.intern.domain.de auth_cache_size = 10 M auth_default_realm = domain.de auth_mechanisms = plain login default_vsz_limit = 1 G disable_plaintext_auth = no imapc_features = " fetch-headers" imapc_host = mail.intern.domain.de imapc_user = %u mail_location = maildir:~/Maildir mail_plugins = zlib acl mail_prefetch_count = 20 managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify envir onment mailbox date index ihave duplicate mime foreverypart extracttext namespace { hidden = no ignore_on_failure = no inbox = no list = children location = maildir:%%h/Maildir:INDEX=%h/shared/%%u:CONTROL=%h/shared/%%u prefix = shared/%%u/ separator = / subscriptions = yes type = shared } namespace inbox { hidden = no inbox = yes list = yes location = mailbox Drafts { auto = subscribe special_use = \Drafts } mailbox Junk { auto = subscribe special_use = \Junk } mailbox Sent { auto = subscribe special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { auto = subscribe special_use = \Trash } prefix = INBOX/ separator = / subscriptions = yes type = private } passdb { args = /etc/dovecot/dovecot-ldap.conf.ext driver = ldap } plugin { acl = vfile acl_shared_dict = file:/var/lib/dovecot/db/shared-mailboxes.db mail_log_events = delete undelete expunge copy mailbox_delete mailbox_rename mail_log_fields = uid box msgid size sieve = file:~/sieve;active=~/.dovecot.sieve zlib_save = gz zlib_save_level = 6 } protocols = " imap lmtp sieve" service auth { unix_listener /var/spool/postfix/private/auth { mode = 0666 } unix_listener auth-userdb { group = vmail user = vmail } } service imap-login { process_min_avail = 12 service_count = 0 } service imap { process_limit = 8192 } service lmtp { inet_listener lmtp { address = 127.0.0.1 port = 24 } } service managesieve-login { inet_listener sieve { port = 4190 } inet_listener sieve_deprecated { port = 2000 } } ssl_cert = </etc/ssl/certs/mail.intern.combined.cer ssl_cipher_list = ALL:!kRSA:!SRP:!kDHd:!DSS:!aNULL:!eNULL:!EXPORT:!DES:!3DES:!MD5:!PSK:!RC4:!ADH:!LOW:!DH@STRENGTH ssl_dh = # hidden, use -P to show it ssl_key = # hidden, use -P to show it ssl_min_protocol = TLSv1.2 ssl_prefer_server_ciphers = yes userdb { driver = prefetch } userdb { args = /etc/dovecot/dovecot-ldap.conf.ext driver = ldap } verbose_proctitle = yes protocol lmtp { mail_plugins = zlib acl sieve } protocol imap { mail_max_userip_connections = 20 mail_plugins = zlib acl imap_zlib imap_acl } Regards, Thomas

2 5

Sieve Auth failing (ignore previous message please)
by Dan Egli 02 May '21

02 May '21

Hi folks. I'm VERY new to Dovecot and Sieve. But I'm having an issue that I need help with. For some reason my sieve daemon won't allow people to log on. I have dovecot set to read information from a MySQL table, and that works fine. I can login to dovecot's imap server just fine. But I have SOGo for the webmail and it won't login to the sieve daemon. Here's what I see in the log files when I, for example, try to save my preferences in SOGo: ==> info.log <== Apr 28 00:33:14 lmtp(5938): Info: Connect from 127.0.0.1 ==> /var/log/sogo/sogod.log <== Apr 28 00:33:14 sogod [24168]: <0x0x557cfa9083c0[SOGoSieveManager]> failure. Attempting with a renewed password (no authname supported) Apr 28 00:33:14 sogod [24168]: <0x0x557cfa9083c0[SOGoSieveManager]> Could not login 'dan(a)newideatest.site' on Sieve server: <0x0x557cfaa03a70[NGSieveClient]: socket=<NGActiveSocket[0x0x557cfa89d540]: mode=rw address=<0x0x557cfa89d5d0[NGInternetSocketAddress]: host=localhost port=45456> connectedTo=<0x0x557cfa837c00[NGInternetSocketAddress]: host=127.0.0.1 port=4190>>>: {RawResponse = "{}"; result = 0; } ==> info.log <== Apr 28 00:33:14 lmtp(5938): Info: Disconnect from 127.0.0.1: Remote closed connection unexpectedly (state=READY) ==> /var/log/sogo/sogod.log <== Apr 28 00:33:14 sogod [24168]: 2600:387:8:7::70 "POST /SOGo/so/dan(a)newideatest.site/Preferences/save HTTP/1.1" 503 46/3676 0.024 - - 0 - 17 I've read a lot of pages about getting sieve running, but they show things I don't get. For example, from https://rtcamp.com/tutorials/mail/server/sieve-filtering/ I see that telnet localhost 4190 should give this: Escape character is '^]'. *"IMPLEMENTATION" "Dovecot Pigeonhole" "SIEVE" "fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date ihave" *"NOTIFY" "mailto" "SASL" "PLAIN LOGIN" "STARTTLS" "VERSION" "1.0" OK "Dovecot ready." But I don't see any of that. Escape character is '^]'. 220 jupiter.newideatest.site Dovecot ready. I've gotten to the point where I'm pulling my hair out. I don't understand dovecot well enough to even begin to guess what's going on. So I could REALLY use some pointers. Thanks all! Oh, ignore the first message. For some reason my MUA will occasionally send a draft to the smtp server. I still haven't figured that one out yet. -- Dan Egli From my Test Server

3 3

Ability to reject invalid client certificate at TLS handshake time
by Gert van Dijk 01 May '21

01 May '21

Hi, After a bit of struggling I've been able to set up TLS client certificate authentication with Dovecot for both IMAP and Submission. Users are required to present a valid certificate, cool so far! What I noticed however on non-StartTLS listeners IMAPS (993) and SMTPS (465), is that during the TLS handhake presenting a valid client certificate is seemingly optional and is only checked later at time of protocol-level login (external auth in my case). I'd like to change that for security purposes and also a bit of obscurity. Not having the ability to interact with Dovecot on protocol level lowers the attack vector as well as the ease of checking my network security. Also, it would prevent (anonymous) network scanners to easily detect what kind of service is running on the port as they can see the IMAP/SMTP banner without presenting a valid TLS client certificate currently. Is it possible in any version of Dovecot to configure it to set up a TLS server listening context that requires a handshake with a valid client certificate? I'm using Dovecot 2.3.4.1 (actual Debian Buster version 2.3.4.1-5+deb10u6), but willing to upgrade to any newer version when this is offered. Going through some newer revisions changelog this seems not the case, so I didn't spend time on upgrading yet. Relevant config snippets for IMAP authenticating proxy that I use (something similar for Submission): # Opens 143 on StartTLS and 993 in wrapped TLS-only mode. # Only 993 is exposed to the internet. protocols = imap passdb { driver = static args = proxy=y host=10.1.2.3 port=1143 pass=masterpass nopassword=y } auth_username_format = %n ssl = required ssl_cert = </etc/dovecot-ssl/cert.crt ssl_key = </etc/dovecot-ssl/key.pem ssl_prefer_server_ciphers = yes ssl_min_protocol = TLSv1.2 ssl_cipher_list = [omitted for brevity] ssl_ca = </etc/dovecot-ssl/client-ca.crt ssl_verify_client_cert = yes # Required to set this to 'no' if no CRL is set up yet ssl_require_crl = no auth_ssl_require_client_cert = yes # Take the username from the client certificate (CN) auth_mechanisms = external auth_ssl_username_from_cert = yes ssl_cert_username_field = commonName Current behaviour from a client when deliberately not presenting a client certificate shows the IMAP banner: $ openssl s_client -connect myserver:993 CONNECTED(00000003) --- Certificate chain 0 [...] --- Server certificate -----BEGIN CERTIFICATE----- [...] --- Acceptable client certificate CA names C = NL, O = Gert van Dijk, [...] --- SSL handshake has read 1096 bytes and written 413 bytes Verification: OK --- New, TLSv1.3, Cipher is TLS_AES_256_GCM_SHA384 Server public key is 384 bit Secure Renegotiation IS NOT supported Compression: NONE Expansion: NONE No ALPN negotiated Early data was not sent Verify return code: 0 (ok) --- * OK [CAPABILITY IMAP4rev1 SASL-IR LOGIN-REFERRALS ID ENABLE IDLE LITERAL+ LOGINDISABLED AUTH=EXTERNAL] Dovecot (Debian) ready. Expected: TLS alert during handshake, e.g. on my Apache TLS client certificate required configured instance: $ openssl s_client -connect myserver:443 139676785239360:error:14094410:SSL routines:ssl3_read_bytes:sslv3 alert handshake failure:../ssl/record/rec_layer_s3.c:1543:SSL alert number 40 IOW, I was hoping for something like this to exist: ssl_verify_client_cert = required OR service imap-login { inet_listener imaps { port = 993 ssl = client-cert-required } } Thanks, Gert

2 2

Re: Sieve daemon errors? (Part 1 of 2, Pt 2 to follow when Pt 1 resolved)
by Dan Egli 01 May '21

01 May '21

Ask and ye shall receive: # dovecot -n # 2.3.13 (89f716dc2): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.13 (cdd19fe3) # OS: Linux 5.11.16-gentoo-x86_64 x86_64 Gentoo Base System release 2.7 xfs # Hostname: jupiter.newideatest.site auth_debug = yes auth_mechanisms = plain login auth_socket_path = /run/dovecot/auth-userdb auth_verbose = yes debug_log_path = /var/log/dovecot/debug.log default_vsz_limit = 1 G disable_plaintext_auth = no first_valid_uid = 114 hostname = jupiter.newideatest.site info_log_path = /var/log/dovecot/info.log log_path = /var/log/dovecot/error.log mail_debug = yes mail_gid = exim4u mail_location = maildir:/var/mail/%d/%n/Maildir:INDEX=/var/mail/indexes/%d/%1n/% n mail_plugins = fts mail_privileged_group = mail mail_server_admin = <redacted> mail_uid = exim4u managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacati on subaddress comparator-i;ascii-numeric relational regex imap4flags copy includ e variables body enotify environment mailbox date index ihave duplicate mime for everypart extracttext imapsieve vnd.dovecot.imapsieve namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } passdb { args = /etc/dovecot/dovecot-sql.conf.ext driver = sql } passdb { args = /etc/dovecot/dovecot-ldap.conf.ext driver = ldap } plugin { fts_autoindex = yes fts_autoindex_exclude = \Junk fts_autoindex_exclude2 = \Trash fts_autoindex_exclude3 = \Drafts fts_autoindex_exclude4 = \Spam fts_enforced = yes imapsieve_mailbox1_before = file:/var/lib/dovecot/sieve/report-spam.sieve imapsieve_mailbox1_causes = COPY imapsieve_mailbox1_name = Spam imapsieve_mailbox2_before = file:/var/lib/dovecot/sieve/report-ham.sieve imapsieve_mailbox2_causes = COPY imapsieve_mailbox2_from = Spam imapsieve_mailbox2_name = * plugin = fts managesieve sieve sieve = file:%h/sieve;active=%h/.dovecot.sieve sieve_Dir = ~/sieve sieve_execute_bin_dir = /usr/lib/dovecot/sieve-execute sieve_filter_bin_dir = /usr/lib/dovecot/sieve-filter sieve_global_dir = /var/lib/dovecot/sieve/ sieve_global_extensions = +vnd.dovecot.pipe +vnd.dovecot.environment sieve_global_path = /var/lib/dovecot/sieve/default.sieve sieve_pipe_bin_dir = /var/lib/dovecot/sieve sieve_plugins = sieve_imapsieve sieve_extprograms } postmaster_address = postmaster(a)newideatest.site service auth { unix_listener auth-client { mode = 0600 user = exim4u } unix_listener auth-userdb { group = exim4u mode = 0777 user = exim4u } } service lmtp { inet_listener lmtp { address = 127.0.0.1 port = 4190 } } service managesieve-login { inet_listener sieve { port = 4190 } process_min_avail = 0 service_count = 1 vsz_limit = 64 M } service managesieve { process_limit = 1024 } service stats { unix_listener stats-reader { mode = 0777 user = exim4u } unix_listener stats-writer { mode = 0777 user = exim4u } } service submission-login { inet_listener submission { port = 2587 } } ssl_cert = </etc/letsencrypt/live/newideatest.site/fullchain.pem ssl_client_ca_dir = /etc/pki/tls/exim_tls/ ssl_dh = # hidden, use -P to show it ssl_key = # hidden, use -P to show it userdb { args = /etc/dovecot/dovecot-sql.conf.ext driver = sql } userdb { args = uid=exim4u gid=exim4u home=/var/mail/%Ld/%Ln driver = static } verbose_ssl = yes protocol lmtp { info_log_path = /var/log/dovecot/lmtp.log log_path = /var/log/dovecot/lmtp-errors.log mail_plugins = fts sieve sieve postmaster_address = postmaster(a)newideatest.site } protocol lda { info_log_path = /var/log/dovecot/lda.log log_path = /var/log/dovecot/lda-errors.log mail_plugins = fts sieve sieve } protocol imap { mail_plugins = fts imap_sieve } protocol sieve { info_log_path = /var/log/dovecot/sieve.log log_path = /var/log/dovecot/sieve-errors.log managesieve_implementation_string = Dovecot managesieve_max_compile_errors = 5 managesieve_max_line_length = 64 k } j On 5/1/2021 12:44 AM, Steve Watt wrote: > > From a little bit of poking around in the source, I wonder if you > somehow have the LMTP listener running on the sieve port. > > The output of doveconf -n will help more than just the 90-sieve.conf. > Also check the dovecot log; I found it helpful (once I figured out how > to configure it) with debugging. > > [ Apologies for top post; brain-damaged MUA in use. ] > > -- > > Steve Watt KD6GGD PP-ASEL-IA factories.words.yappy > > Don't let your schooling get in the way of your education. > > *From:* dovecot <dovecot-bounces(a)dovecot.org> *On Behalf Of *Dan Egli > *Sent:* Friday, April 30, 2021 23:13 > *To:* dovecot(a)dovecot.org > *Subject:* Sieve daemon errors? (Part 1 of 2, Pt 2 to follow when Pt 1 > resolved) > > Folks, I am still trying to get help here. Let me re-state what is > going on. I have a webmail program (SOGo) that connects to the Dovecot > sieve system to handle things like mail filters and what not. That way > dovecot's lda program can move things where they belong. So I went > through the config files, and found the places where I need to enable > sieve (this is in Gentoo Linux, by the way). Now, when dovecot starts > I do see a listener on the sieve port on localhost: > > #netstat -tl | grep sieve > tcp 0 0 localhost:sieve 0.0.0.0:* LISTEN > > And when I telnet to the port, it does connect. But it doesn't say much. > > telnet localhost sieve > Trying 127.0.0.1... > Connected to localhost. > Escape character is '^]'. > 220 jupiter.newideatest.site Dovecot ready. > > Yet every example I see online is showing a HECK of a lot more than > this. So what's up? Anyone got any idea what I did wrong? I've put the > 90-sieve.conf file on my web server at > www.newideatest.site/90-sieve.conf > <http://www.newideatest.site/90-sieve.conf> for those who want to see > it. If any other config files are wanted/needed to help figure this > out, let me know what they are and I'll take care of it. Here's an > example of what other websites I've looked at say I SHOULD see: > > Trying 162.243.12.140... > Connected to test3.rtcamp.com. > Escape character is '^]'. > *"IMPLEMENTATION" "Dovecot Pigeonhole"* > *"SIEVE" "fileinto reject envelope encoded-character vacation > subaddress comparator-i;ascii-numeric relational regex imap4flags copy > include variables body enotify environment mailbox date ihave"* > "NOTIFY" "mailto" > "SASL" "PLAIN LOGIN" > "STARTTLS" > "VERSION" "1.0" > OK "Dovecot ready." > so why am I not getting all this? > -- > Dan Egli > From my Test Server -- Dan Egli From my Test Server

3 7

What imap ssl/auth settings work best with MS Outlook?
by Steve Dondley 01 May '21

01 May '21

I repeatedly have a hell of a time getting clients' Outlook software working well with Dovecot. It's hard for me to test myself since I don't have Outlook and it would be impossible to keep up with all the different versions anyway. I've got the following settings, currently: disable_plaintext_auth = yes auth_username_format = %Ln auth_mechanisms = plain login ssl = yes service imap-login { # inet_listener imap { # port = 143 # } inet_listener imaps { port = 993 ssl = yes } } service imap { client_limit = 1 } It always seems to be hit or miss with outlook as to which encryption setting to use, which port to try, etc. With a recent client, I couldn't get them successfully logged in no matter what manual settings we tried. If someone can give me some tips on how to get most versions of Outlook cooperating well with Dovecot, I'd appreciate it.

15 30

Sieve daemon errors? (Part 1 of 2, Pt 2 to follow when Pt 1 resolved)
by Dan Egli 01 May '21

01 May '21

Folks, I am still trying to get help here. Let me re-state what is going on. I have a webmail program (SOGo) that connects to the Dovecot sieve system to handle things like mail filters and what not. That way dovecot's lda program can move things where they belong. So I went through the config files, and found the places where I need to enable sieve (this is in Gentoo Linux, by the way). Now, when dovecot starts I do see a listener on the sieve port on localhost: #netstat -tl | grep sieve tcp 0 0 localhost:sieve 0.0.0.0:* LISTEN And when I telnet to the port, it does connect. But it doesn't say much. telnet localhost sieve Trying 127.0.0.1... Connected to localhost. Escape character is '^]'. 220 jupiter.newideatest.site Dovecot ready. Yet every example I see online is showing a HECK of a lot more than this. So what's up? Anyone got any idea what I did wrong? I've put the 90-sieve.conf file on my web server at www.newideatest.site/90-sieve.conf for those who want to see it. If any other config files are wanted/needed to help figure this out, let me know what they are and I'll take care of it. Here's an example of what other websites I've looked at say I SHOULD see: Trying 162.243.12.140... Connected to test3.rtcamp.com. Escape character is '^]'. *"IMPLEMENTATION" "Dovecot Pigeonhole" "SIEVE" "fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date ihave" *"NOTIFY" "mailto" "SASL" "PLAIN LOGIN" "STARTTLS" "VERSION" "1.0" OK "Dovecot ready." so why am I not getting all this? -- Dan Egli From my Test Server

1 0