January 2022 - dovecot

Patch: safeguard against too large value for uid being sent to solr for single mailbox searches
by John Fawcett 09 Jan '22

09 Jan '22

Hi I'm reposting a patch for solr integration which I have been applying locally. It applies against 2.3.17.1. Dovecot already has a mechanism when doing solr fts searches on multiple mailboxes that prevents a too large value for maximum rows being sent to solr. #define SOLR_MAX_MULTI_ROWS 100000 (defined and used in plugins/fts-solr/fts-backend-solr.c) However on single mailbox searches Dovecot uses the last uid of the mailbox, which can be too large for solr. My suggested patch is to also limit maximum rows to return on single mailbox searches. Here is the patch: diff -ur dovecot-2.3.17.1-orig/src/plugins/fts-solr/fts-backend-solr.c dovecot-2.3.17.1-new/src/plugins/fts-solr/fts-backend-solr.c --- dovecot-2.3.17.1-orig/src/plugins/fts-solr/fts-backend-solr.c 2021-12-03 12:48:47.000000000 +0100 +++ dovecot-2.3.17.1-new/src/plugins/fts-solr/fts-backend-solr.c 2022-01-09 01:33:23.401341959 +0100 @@ -837,7 +837,7 @@ str = t_str_new(256); str_printfa(str, "wt=xml&fl=uid,score&rows=%u&sort=uid+asc&q=%%7b!lucene+q.op%%3dAND%%7d", - status.uidnext); + I_MIN(status.uidnext,SOLR_MAX_MULTI_ROWS)); prefix_len = str_len(str); if (solr_add_definite_query_args(str, args, and_args)) { John

1 0

Can't log in from Evolution or Roundcube
by Ken Wright 08 Jan '22

08 Jan '22

When I try to log in to my mail server (ubuntu 20.04, Postfix 3.4.13, Dovecot 2.3.7.2) I get a response saying "Source stream returned no data”. At least to me, that's not particularly informative. Is it any more informative to anyone else? Ken

3 10

Sv: banning
by Sebastian Nielsen 08 Jan '22

08 Jan '22

I would say, lock accounts to for example IP address, ASN or GeoIP. This can be accomplished simply by a custom login handler, which also checks IP against database. And first time users, and those who change country/ISP/IP have to simply logon to a web interface (where 2FA can be required and also Captcha) and add their IPs/ASNs/Geo's. For a larger user base, I would recommend GeoIP and no web interface, save country of first login to database, and subsequent logins must originate from same country. Users that want to reset have to contact support. If you are a web hotel who only sell service to a specific country at all, lock the ports in firewall to that GeoIP. For smaller user base, like 50-100 users, I would recommend locking to ASN and providing a web interface where multiple ASN can be added. So people syncing from mobile and home can succeed. For very small user base, like 10's of users, just plan lock to IP. By connecting IP to accounts, you greatly reduce the attack surface.

1 0

TLS connection closed unexpectedly
by Ken Wright 08 Jan '22

08 Jan '22

I reinstalled Dovecot this evening, because I haven't been able to receive emails recently. After configuring and adjusting for the use of PostfixAdmin, I get the following error message in Evolution:; Failed to open folder. The reported error was "Failed to authenticate: TLS connection closed unexpectedly". Does anyone recognize this error? Ken

6 8

Update from 2.3.16 to 2.3.17 Received invalid SSL certificate: unable to get certificate CRL
by Salatiel Filho 08 Jan '22

08 Jan '22

Hi, after updating from dovecot.x86_64 2:2.3.16-2 to 2:2.3.17.1-1 on AlmaLinux 8 my dovecot replication stopped working. Log is full of Error: doveadm server disconnected before handshake: Received invalid SSL certificate: unable to get certificate CRL: /CN=my.domain.redacted (check ssl_client_ca_* settings?) No configuration has changed on my side. My certificate is a wildcard certificate ( not sure if related ). I am also replicating over tcps. Anyone else facing this issue? Atenciosamente/Kind regards, Salatiel

1 0

Sieve scripts igniored
by Sam R 07 Jan '22

07 Jan '22

Hello, I have an issue with Sieve plugin, I can drive rules remotely with sieve:// myserver.fr:4190/?tls=YES, the rules are well created under /home/vmail/name.firstname, but these are never executed. I have also read https://doc.dovecot.org/configuration_manual/sieve/troubleshooting/, but I don't see any evident mistake. here is my dovecot -n : # 2.3.13 (89f716dc2): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.13 (cdd19fe3) # OS: Linux 5.10.0-8-amd64 x86_64 Debian 11.0 ext4 # Hostname: mail.xxx.fr auth_debug = yes auth_gssapi_hostname = $ALL auth_krb5_keytab = /etc/dovecot/dovecot.keytab auth_mechanisms = login plain gssapi mail_location = maildir:/home/vmail/%n/Maildir/ mail_privileged_group = mail managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relationa l regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttex t namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } passdb { driver = pam } passdb { driver = pam } plugin { sieve = file:~/sieve;active=~/.dovecot.sieve } protocols = " imap lmtp sieve pop3" service lmtp { executable = lmtp -L unix_listener /var/spool/postfix/private/dovecot-lmtp { group = postfix mode = 0666 user = postfix } } service managesieve-login { inet_listener sieve { port = 4190 } } ssl = required ssl_cert = </etc/letsencrypt/live/mail.xxx.fr/fullchain.pem ssl_client_ca_dir = /etc/ssl/certs ssl_client_ca_file = /etc/letsencrypt/live/mail.xxx.fr/chain.pem ssl_dh = # hidden, use -P to show it ssl_key = # hidden, use -P to show it userdb { driver = passwd } userdb { args = uid=vmail gid=vmail home=/home/vmail/%u allow_all_users=yes driver = static } userdb { driver = passwd } protocol lmtp { mail_plugins = " sieve" } protocol lda { mail_plugins = " sieve" } Thanks for helping. kind regards. Samuel

3 3

feature-request: make received-header on submission optional or at least drop the ip in it
by dc-ml＠dvl.werbittewas.de 07 Jan '22

07 Jan '22

hi. we're just trying to re-structure a system and want to use dovcots submission-ability. because the github-repository have no entry for any issues at all, we're sending this feature-fequest to this ML. unfortunately there doesn't seem to be any option to drop the received-header at all or at least hide the IP of the user. because the client-ip is covered by GDPR as personal data and so it should never shown to others without a certain reason, we want to hide it, but there's no "submission_add_received_header"-option like for lmtp and it doesn't seem to be any other option to hide this information. maybe this is possible to implement in near future? thanks a lot. best regards d.

8 18

Dovecot fixing maildir message size?
by Grant Keller 07 Jan '22

07 Jan '22

We recently updated dovecot from 2.1.17 to 2.3.10. It used to be when we encountered the following error: Jan 6 15:29:20 d.imapd.sonic.net dovecot: imap(momomo): session=aBd2O/LULMu4F6ia Error: Mailbox INBOX: UID=1: read(/var/spool/mail/07/00/momomo/cur/1510707300.12345_0.a.spam,S=1234:2,) failed: Cached message size larger than expected (1234 > 704, box=INBOX, UID=1) (read reason=) Dovecot would fix the size by renaming the file. Now this doesn't appear to be the case. Was there a change in behaviour, or is there an option I need to enable now to have dovecot auto fix this?

1 0

Re: Error: fts_solr: received invalid uid
by oliver.krone＠snoog.ch 06 Jan '22

06 Jan '22

Hello, I made serveral tests, never had a problemm woth dovecot version 2.3.4 with 2.3.13 things get worse and dovecot crashes. I might have read someting in the release notes of dovecot 2.3.13. that there is a problem. Regards Oliver > On 1/2/22 3:08 PM, John Fawcett wrote: >> unless I'm missing something that doesn't look like the type of query >> dovecot launches - dovecot sends various parameters including the >> request for xml results. The thing that looks odd to me is that the >> results fields should be single values not arrays enclosed in [], ie I >> would have expected >> "uid":21, >> >> instead of >> >> "uid":[21], >> >> I'd be interested to see the equivalent xml output produced by running >> a query that dovecot sends. >> > > This Solr instance is not configured properly for dovecot.? Most of the > fields are configured as multiValued (which is why you see an array > rather than a single value), and the response is JSON.? A Solr instance > that is properly configured for dovecot would return XML, not JSON. > > You're going to want to provide a proper solrconfig.xml and > managed-schema file, restart Solr or reload the core for dovecot, and > do > a full reindex.? At the following URL, you can find the shell script > that I use to do a full reindex: > > https://apaste.info/tK1B > > At the following URL are links to the solrconfig.xml and schema that > are > appropriate for dovecot.? These instructions say to name the schema > file > "schema.xml" ... this will work, as long as Solr has read-write access > to the conf directory so it can rename the file to "managed-schema".? > If > it doesn't, then you should name the file "managed-schema" yourself. > > https://doc.dovecot.org/configuration_manual/fts/solr/ > > Thanks, > Shawn

2 2

Doveadm auth test fails
by Ken Wright 06 Jan '22

06 Jan '22

I've been having trouble logging into my email server (postfix 3.4.13, dovecot 2.3.7.2, postfixadmin 3.3.8). I decided to try the doveadm auth test, and got the following result: kwright@grace:~$ sudo doveadm auth test me(a)mydomain.com Password: passdb: me(a)mydomain.com auth failed extra fields: user=me(a)mydomain.com I logged in to PostfixAdmin and made sure I was using the correct password, but got exactly the same result afterward. Should I have restarted Dovecot after changing the password? I'm totally confused by this problem; any and all suggestions will be gratefully received! Ken

3 6