January 2022 - dovecot

Re: dovecot Digest, Vol 225, Issue 71
by David Matthews 28 Jan '22

28 Jan '22

hi Christian >Did the password hash algorithm change between devuan 3 and 4? >You can check that in your /etc/shadow file. As I understand, devuan is pretty much debian without systemd? And that if you were prepared to do a fair bit of work you could start with debian installed, hack it about and end up with something like devuan? I doubt devuan has done anything to deviate from debian at this level and both machines were recently dist-upgraded. Dovecot needed no tinkering with at all on the debian machine. >The start of the password field should be the same something like $6$... > Yes it is on devuan 4. I no longer have anything with devuan 3 to check that, but it shouldn't have changed in a dist-upgrade? Interestingly, although it's the same user and password on both machines, I notice that the hashes in /etc/shadow are not identical after the commencing $6$. But then I don't know how these hashes are derived, so maybe that is not unexpected? -- David Matthews mail(a)dmatthews.org

2 1

Errors: Failed to map transaction log, Corrupted transaction log, imeout (180s) while waiting for lock for transaction log
by absolutely_free＠libero.it 28 Jan '22

28 Jan '22

Hi, no, it is a single mail server, no replication at all. Thank you > Hello > > We only saw such errors with replication between two machines, when new > emails where errornously deliverd to both of them or clients connected > to both simultaniously. > > Do you have such a setup? > Kind regards, > Christian Mack

1 0

doveadm backup : Warning: Deleting mailbox GUID= is missing locally
by Laura Smith 28 Jan '22

28 Jan '22

Hi, As per the docs (https://wiki.dovecot.org/Tools/Doveadm/Sync) I'm presently running doveadm backup multiple times with a view to eventual server migration. I am seeing messages such as this: Warning: Deleting mailbox 'Junk': UID=1826 GUID= is missing locally Is it anything to worry about ? If so, how should I be dealing with it. I also have a further question. It is not clear from the docs what the role of the "-R" flag is in relation to "doveadm backup" ? Surely by definition backup = remote -> local ? Thanks ! Laura

2 3

Question regarding delivery from Postfix via LMTP proxy
by Vlad Sedov 28 Jan '22

28 Jan '22

Hello, I'm using Postfix with Dovecot 2.3.13, and trying to get LMTP proxy to work for authentication and delivery in the following scenario: Incoming Mail -> Postfix (server A) -> LMTP to Dovecot (server A) -> LMTP to Dovecot (server B) I'm using MySQL for authentication. I've created a user on both server A and server B, test(a)domain.tld On server A, host parameter in password_query for test(a)domain.tld is set to server B's address, and proxy_maybe is enabled. Delivery and authentication to Server A works fine. Authentication and IMAP proxy to server B works fine as well. I can connect to IMAP on server A with credentials for test(a)domain.tld and access the maildir on server B. This works surprisingly well, and is about half the battle for me.. What I can't figure out, is how can I get Postfix to deliver mail using LMTP via server A to server B.. Currently, mail still gets delivered to the user's maildir on server A. Is this possible with Dovecot alone, or do I need to use another method to get messages to hop to server B via server A? Any help would be appreciated.. cheers, Vlad

1 0

Re: dovecot Digest, Vol 225, Issue 70
by David Matthews 27 Jan '22

27 Jan '22

hi Christian Same user and password on both machines, users with shell accounts; exactly the same; in fact I'm struggling to see anything different that might be relevant. On one machine dovecot just works on the other, it stopped working after a dist-upgrade. One machine (where it works) is a debian 11 VPS, the other is real PC hardware running devuan 4, but their dovecot is a debian package. I can't see why either of that should matter and dovecot also just worked on the PC with devuan 3. I've tried purging dovecot-core and dovecot-imapd and reinstalling to no effect. > > 1. Re: can't authenticate (Christian Mack) > > >---------------------------------------------------------------------- > >Message: 1 >Date: Thu, 27 Jan 2022 11:42:22 +0100 >From: Christian Mack >christian.mack(a)uni-konstanz.de> >To: dovecot(a)dovecot.org >Subject: Re: can't authenticate >Message-ID: >a2fbca25-75c7-4e19-a084-5e8d4d8cc645(a)uni-konstanz.de> >Content-Type: text/plain; charset="utf-8" > >Hello > >> passdb { >> driver = pam >> } > >Is user fred defined on your development machine? >Does the password match the one from the production machine? > > >Kind regards, >Christian Mack > >On 26.01.22 21:14, David Matthews wrote: >> My live mail exchanger and development machines have identical dovecot setups, yet I cannot login on the development machine:- >> >> dovecot --version >> 2.3.13 (89f716dc2) >> >>> telnet localhost 143 >> Trying 127.0.0.1... >> Connected to bulawayo. >> Escape character is '^]'. >> * OK [CAPABILITY IMAP4rev1 SASL-IR LOGIN-REFERRALS ID ENABLE IDLE LITERAL+ STARTTLS AUTH=PLAIN] Dovecot (Debian) ready. >> a login fred xxxxxxxxxxx >> a NO [UNAVAILABLE] Temporary authentication failure. [bulawayo:2022-01-26 20:02:14] >> >> same if I try openssl s_client to 993 >> >>> tail /var/log/mail.log >> Jan 26 20:03:28 bulawayo dovecot: imap-login: Disconnected (auth service reported temporary failure): user=>fred>, method=PLAIN, rip=127.0.0.1, lip=127.0.0.1, secured, session=>1MRorYHWwOp/AAAB> >> >> doveconf -n >> # 2.3.13 (89f716dc2): /etc/dovecot/dovecot.conf >> # Pigeonhole version 0.5.13 (cdd19fe3) >> # OS: Linux 5.10.0-10-amd64 x86_64 Debian 11.1 >> # Hostname: bulawayo >> mail_location = mbox:~/mail:INBOX=/var/mail/%u >> mail_privileged_group = mail >> namespace inbox { >> inbox = yes >> location = >> mailbox Drafts { >> special_use = \Drafts >> } >> mailbox Junk { >> special_use = \Junk >> } >> mailbox Sent { >> special_use = \Sent >> } >> mailbox "Sent Messages" { >> special_use = \Sent >> } >> mailbox Trash { >> special_use = \Trash >> } >> prefix = >> } >> passdb { >> driver = pam >> } >> protocols = " imap" >> service imap-login { >> inet_listener imap { >> port = 143 >> } >> inet_listener imaps { >> port = 993 >> ssl = yes >> } >> } >> ssl_cert = >/etc/dovecot/private/dovecot.pem >> ssl_client_ca_dir = /etc/ssl/certs >> ssl_dh = # hidden, use -P to show it >> ssl_key = # hidden, use -P to show it >> userdb { >> driver = passwd >> } >> >> -- >> David Matthews >> mail(a)dmatthews.org >> > > >-- >Christian Mack >Universit?t Konstanz >Kommunikations-, Informations-, Medienzentrum (KIM) >Abteilung IT-Dienste Forschung und Lehre >78457 Konstanz >+49 7531 88-4416 > >

2 1

can't authenticate
by David Matthews 27 Jan '22

27 Jan '22

My live mail exchanger and development machines have identical dovecot setups, yet I cannot login on the development machine:- dovecot --version 2.3.13 (89f716dc2) >telnet localhost 143 Trying 127.0.0.1... Connected to bulawayo. Escape character is '^]'. * OK [CAPABILITY IMAP4rev1 SASL-IR LOGIN-REFERRALS ID ENABLE IDLE LITERAL+ STARTTLS AUTH=PLAIN] Dovecot (Debian) ready. a login fred xxxxxxxxxxx a NO [UNAVAILABLE] Temporary authentication failure. [bulawayo:2022-01-26 20:02:14] same if I try openssl s_client to 993 >tail /var/log/mail.log Jan 26 20:03:28 bulawayo dovecot: imap-login: Disconnected (auth service reported temporary failure): user=<fred>, method=PLAIN, rip=127.0.0.1, lip=127.0.0.1, secured, session=<1MRorYHWwOp/AAAB> doveconf -n # 2.3.13 (89f716dc2): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.13 (cdd19fe3) # OS: Linux 5.10.0-10-amd64 x86_64 Debian 11.1 # Hostname: bulawayo mail_location = mbox:~/mail:INBOX=/var/mail/%u mail_privileged_group = mail namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } passdb { driver = pam } protocols = " imap" service imap-login { inet_listener imap { port = 143 } inet_listener imaps { port = 993 ssl = yes } } ssl_cert = </etc/dovecot/private/dovecot.pem ssl_client_ca_dir = /etc/ssl/certs ssl_dh = # hidden, use -P to show it ssl_key = # hidden, use -P to show it userdb { driver = passwd } -- David Matthews mail(a)dmatthews.org

2 1

Errors: Failed to map transaction log, Corrupted transaction log, imeout (180s) while waiting for lock for transaction log
by absolutely_free＠libero.it 27 Jan '22

27 Jan '22

Hi all, I am using dovecot-2.3.17_1 on FreeBSD system. This server offers webmail, pop3 and imap access for users. Today I am receiving several complaints from users about slowness and/or access issues. I checked on my /var/log/maillog and I see lots of: Error: Timeout (180s) while waiting for lock for transaction log file /var/domains/domain.it/username/Maildir/dovecot.list.index.log (WRITE lock held by pid 84939) Error: Corrupted transaction log file /var/domains/domain.it/otherusername/Maildir/dovecot.list.index.log seq 2: indexid changed: 1643184505 -> 1643205059 (sync_offset=0) Error: Transaction log file /var/domains/otherdomain.net/otheruser/Maildir/dovecot.list.index.log: marked corrupted Not all users seem affected. My mailbox, for example, is working fine. I checked on my disks (this is a ZFS volume) and I didn't find errors/warnings. Any suggestion? This is my dovecot configuration: # dovecot -n # 2.3.17 (e2aa53df5b): /usr/local/etc/dovecot/dovecot.conf # OS: FreeBSD 13.0-RELEASE-p6 amd64 zfs # Hostname: mailserver.domain.it auth_debug = yes auth_mechanisms = plain login auth_verbose = yes default_client_limit = 2000 default_process_limit = 500 default_vsz_limit = 512 M disable_plaintext_auth = no first_valid_gid = 125 first_valid_uid = 125 imap_id_log = * mail_gid = 1003 mail_location = maildir:/mail/domains mail_privileged_group = postfix mail_uid = 1003 namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } passdb { args = /usr/local/etc/dovecot/dovecot-sql-crypt.conf.ext driver = sql } service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0666 user = postfix } unix_listener auth-userdb { group = postfix mode = 0600 user = postfix } } service imap { process_limit = 1536 } service lmtp { unix_listener /var/spool/postfix/private/dovecot-lmtp { group = postfix mode = 0600 user = postfix } } ssl_cert = </etc/ssl/wildcard.domain.net_bundle.crt ssl_key = # hidden, use -P to show it userdb { args = /usr/local/etc/dovecot/dovecot-sql-crypt.conf.ext driver = sql } protocol imap { mail_max_userip_connections = 100 } Thank you very much

2 1

sieve-filter ignores -u argument
by Андрей Куницын 27 Jan '22

27 Jan '22

Hello I try to test my sieve script, but found out that it is impossible to use a sieve-filter tool with virtual mail users. It always uses a real user name instead of passed via -u argument. # sieve-filter -v -u postmaster(a)domain.tld ~/sieve/managesieve.sieve INBOX sieve-filter(root): Fatal: Unknown user sudo -u vmail sieve-filter -u postmaster(a)domain.tld ~/sieve/managesieve.sieve INBOX sieve-filter(vmail): Fatal: Unknown user Also there is the same question on serverfault, but without an answer. https://serverfault.com/questions/1055407/how-to-make-sieve-filter-use-virt… My environment is Ubuntu 20.04 dovecot --version 2.3.7.2 (3c910f64b) -- Sincerely, Andrey Kunitsyn

4 5

Dovecot installation problem (libssl_iostream_openssl.so is not portable!)
by Dimitri 27 Jan '22

27 Jan '22

Hi there, i try to install dovecot from source with the following configuration: > ./configure --prefix=/test/core/dovecot --with-ssldir=/test/core/dovecot/tls the configuration runs fine with the following output at the end: > Install prefix . : /test/core/dovecot > File offsets ... : 64bit > I/O polling .... : epoll > I/O notifys .... : inotify > SSL ............ : yes (OpenSSL) > GSSAPI ......... : no > passdbs ........ : static passwd passwd-file shadow checkpassword > : -pam -bsdauth -ldap -sql > userdbs ........ : static prefetch passwd passwd-file checkpassword > : -ldap -sql > CFLAGS ......... : -std=gnu99 -g -O2 -fstack-protector-strong -U_FORTIFY_SOURCE -D_FORTIFY_SOURCE=2 -mfunction-return=keep -mindirect-branch=keep -Wall -W -Wmissing-prototypes -Wmissing-declarations -Wpointer-arith -Wchar-subscripts -Wformat=2 -Wbad-function-cast -fno-builtin-strftime -Wstrict-aliasing=2 -I/test/dep/openssl/include > SYSTEMD ........ : notify - /lib/systemd/system/dovecot.service > SQL drivers .... : > : -pgsql -mysql -sqlite -cassandra > Full text search : squat > : -lucene -solr But when i start to build (make) after a while i get the following error: > *** Warning: Linking the executable test-iostream-ssl against the loadable module > *** libssl_iostream_openssl.so is not portable! > libtool: link: gcc -std=gnu99 -g -O2 -fstack-protector-strong -U_FORTIFY_SOURCE -D_FORTIFY_SOURCE=2 -mfunction-return=keep -mindirect-branch=keep -Wall -W -Wmissing-prototypes -Wmissing-declarations -Wpointer-arith -Wchar-subscripts -Wformat=2 -Wbad-function-cast -fno-builtin-strftime -Wstrict-aliasing=2 -I/test/dep/openssl/include -o .libs/test-iostream-ssl test-iostream-ssl.o ./.libs/libssl_iostream_openssl.so ./.libs/libssl_iostream.a ../lib-test/.libs/libtest.a ../lib/.libs/liblib.a -L/test/dep/openssl/lib64 -lssl -lcrypto -ldl -Wl,-rpath -Wl,/test/core/dovecot/lib/dovecot > /usr/bin/ld: ./.libs/libssl_iostream_openssl.so: undefined reference to `ERR_free_strings' > /usr/bin/ld: ./.libs/libssl_iostream_openssl.so: undefined reference to `ENGINE_cleanup' > /usr/bin/ld: ./.libs/libssl_iostream_openssl.so: undefined reference to `SSL_library_init' > /usr/bin/ld: ./.libs/libssl_iostream_openssl.so: undefined reference to `OBJ_cleanup' > /usr/bin/ld: ./.libs/libssl_iostream_openssl.so: undefined reference to `CRYPTO_cleanup_all_ex_data' > /usr/bin/ld: ./.libs/libssl_iostream_openssl.so: undefined reference to `OpenSSL_add_all_algorithms' > /usr/bin/ld: ./.libs/libssl_iostream_openssl.so: undefined reference to `SSL_CTX_set_tmp_rsa_callback' > /usr/bin/ld: ./.libs/libssl_iostream_openssl.so: undefined reference to `EVP_cleanup' > /usr/bin/ld: ./.libs/libssl_iostream_openssl.so: undefined reference to `SSL_load_error_strings' > /usr/bin/ld: ./.libs/libssl_iostream_openssl.so: undefined reference to `SSL_CTX_need_tmp_RSA' > collect2: error: ld returned 1 exit status > make[3]: *** [Makefile:655: test-iostream-ssl] Error 1 > make[3]: Leaving directory '/test/tmp/dovecot-2.3.17.1/src/lib-ssl-iostream' > make[2]: *** [Makefile:573: all-recursive] Error 1 > make[2]: Leaving directory '/test/tmp/dovecot-2.3.17.1/src' > make[1]: *** [Makefile:702: all-recursive] Error 1 > make[1]: Leaving directory '/test/tmp/dovecot-2.3.17.1' > make: *** [Makefile:546: all] Error 2 I've searched for the error and find some posts about set explicitly CPPFLAGS and LDFLAGS and something about missing shared libraries of openssl. My openssl have shared libraries (libcrypto.so libssl.so ...) and the explicit use of CPPFLAGS and LDFLAGS to my openssl hasn't changed anything I use Openssl 3.0 but i've tested also 1.1.1m and 1.1.1g for example, same error! Dovecot is the latest 2.3.17.1 Can anyone help me with this please? Thanks!

1 0

doveadm stateful backup
by Christian 26 Jan '22

26 Jan '22

Hi all, first: I'm using version 2.3.4.1 I manage some rather large imap mailboxes which I want to backup on a regular basis. Some of them have relatively heavy traffic and one of them is greater than 30GB in size. I studied the docs for doveadm backup (https://wiki2.dovecot.org/Tools/Doveadm/Sync) and even did some code research to better understand the process. The docs state that using stateful synchronization is the most efficient way to synchronize mailboxes, therefore I chose this approach. Highlevel overview: - store a copy of the whole maildir in a separate directory (/var/vmail/backup) - backup to this directory once a minute (trying to make most use of transaction logs) using the last state stored within a file - create a backup once a day using tar (full, differential and incremental ones) blocking the backup process of the before mentioned step I quite often receive notifications that doveadm backup returned an exit code of 2, which should be quite normal. These notifications look like that: dsync(another_address(a)my.domain): Warning: Failed to do incremental sync for mailbox INBOX, retry with a full sync (Modseq 171631 no longer in transaction log (highest=177818, last_common_uid=177308, nextuid=177309)) dsync(another_address(a)my.domain): Warning: Mailbox changes caused a desync. You may want to run dsync again: Remote lost mailbox GUID e9149d0ae4e02d532505000026ca4352 (maybe it was just deleted?) Synced another_address(a)my.domain successfully but missing some changes. Took 3 seconds. Starting retry 1... The first message seems to point out that the transaction log got rolled and no more contains the messages from the backup dir, right? I thought about setting mail_index_log_rotate_min_age to 1hour to prevent rolling transaction logs too often, but abandoned this thought and increased the backup interval to once a minute. The warnings still appear so maybe my thoughts about transactions logs are wrong. The second message seems less alarming to me. How does doeveadm backup behave in such situations? Does it directly fall back to a less efficient way of syncing mails? Does the state store the information "retry with a full sync" and the next run uses this mode? To investigate on this I simply measured runtimes an saw that the second/retry run takes a bit longer (up to about 15 seconds) to sync the dir. I'm afraid of losing messages using my approach. Is it safe to always use doveadm backup -s $state? Simply counting one maildirs files within the live directory and the backup copy shows a 100 fewer files within the backup dir although the script runs only since a few days. For reference, see my backup script below. Regards Christian #!/bin/bash # * * * * * /root/bin/backup.sh --sync-only # 12 2 1-7 * * test $(date +\%u) -eq 6 && /root/bin/backup.sh --full # 12 2 8-31 * * test $(date +\%u) -eq 6 && /root/bin/backup.sh --differential # 12 2 * * * test $(date +\%u) -ne 6 && /root/bin/backup.sh synconly=0 differential=0 fullbackup=0 if [ $# -gt 0 ] ; then if [ "$1" == "--sync-only" ] ; then synconly=1 elif [ "$1" == "--differential" ] ; then differential=1 elif [ "$1" == "--full" ] ; then fullbackup=1 fi fi basedir="/var/vmail/backup" targetdir="/var/vmail/backup/done" mailaddresses="one_address(a)my.domain another_address(a)my.domain yet_another(a)my.domain" if [ ! -d "$basedir" ] ; then mkdir -p "$basedir" chown vmail:vmail "$basedir" fi if [ ! -d "$targetdir" ] ; then mkdir -p "$targetdir" chown vmail:vmail "$targetdir" fi for mailaddr in ${mailaddresses} ; do #echo "Creating backup for $mailaddr." domainpart=${mailaddr#*@} localpart=${mailaddr%%@*} lockfile="$basedir/$mailaddr.lock" statefile="$basedir/$mailaddr.state" backupdir="$domainpart/$localpart/Maildir" snapshotfile_full="$basedir/$mailaddr.full.snar" snapshotfile="$basedir/$mailaddr.snar" backup_basename="$basedir/${mailaddr}_$(date '+%Y%m%d_%H%M%S')" ( if [ $synconly -eq 1 ] ; then flock -xn 200 if [ $? -eq 1 ] ; then # failed to acquire lock. Skip mailbox silently. exit fi fi # try to acquire exclusive lock for one minute flock -xw 60 200 if [ $? -eq 1 ] ; then echo "Failed to acquire write lock within 60 seconds. Skipping $mailaddr." exit fi retries=0 retval=1 until [ $retval -eq 0 ] || [ $retries -ge 3 ] ; do let 'retries++' if [ -f "$statefile" ] ; then oldstate=$(head -1 "$statefile") else oldstate="" fi start_time=$(date +%s) ERROR=$((doveadm backup -u "$mailaddr" -s "$oldstate" "maildir:$basedir/$backupdir") 2>&1 > "$statefile") retval=$? end_time=$(date +%s) let 'duration=end_time-start_time' if [ $retval -eq 2 ] ; then #if [ $retries -gt 1 ] ; then echo "$ERROR" echo "Synced $mailaddr successfully but missing some changes. Took $duration seconds. Starting retry $retries..." #fi elif [ $retval -ne 0 ] ; then echo "$ERROR" echo "Syncing $mailaddr failed. Return code $retval. Took $duration seconds. Removing backup directory and starting retry $retries..." rm -rf "$basedir/$backupdir" rm -f "$statefile" "$snapshotfile" elif [ $retries -gt 1 ] ; then echo "Successful sync took $duration seconds." fi done # downgrade lock to shared lock flock -sn 200 [ $synconly -eq 1 ] && exit if [ $retval -ne 0 ] ; then echo "Too many retries. Aborting backup of $mailaddr." exit fi cd "$basedir" if [ $fullbackup -eq 1 ] || [ ! -f "$snapshotfile_full" ] ; then tar -cpzf "${backup_basename}_full.tar.gz" --level=0 -g "$snapshotfile_full" "$backupdir" cp -f "$snapshotfile_full" "$snapshotfile" else suffix="" if [ $differential -eq 1 ] ; then cp -f "$snapshotfile_full" "$snapshotfile" suffix="_diff" fi tar -cpzf "${backup_basename}${suffix}.tar.gz" -g "$snapshotfile" "$backupdir" fi cd - > /dev/null mv "${basedir}/"*.tar.gz "$targetdir" ) 200>"$lockfile" [ $synconly -eq 1 ] && continue # housekeeping newest_full=$(ls -1 "${targetdir}/${mailaddr}_"*_full.tar.gz 2>/dev/null | sort | tail -1) if [ -n "$newest_full" ] ; then #echo "Cleaning up files older than $newest_full..." find "$targetdir" -depth -maxdepth 1 -name "${mailaddr}_*" ! -newer "$newest_full" ! -samefile "$newest_full" -printf 'Deleting %p...\n' -delete fi done

1 1