October 2022 - dovecot

Unseen field reported by imap status command returns wrong count for shared mailboxes on dovecot cluster
by Nikolaos Pyrgiotis 19 Oct '22

19 Oct '22

Hello, We recently migrated our mail server to a dovecot cluster of 5nodes, a dovecot proxy, 2directors and 2dovecot backends. All dovecot nodes run version 2.19.1. We use a glusterfs mounted volume on the backends forthe mail storage. We noticed that when issuing the IMAP command to check forUNSEEN messages formails on the shared namespace instead of seeing the value of the unseen messages of the user that the mailbox has been shared to, the value of the unseen messages of the owner of the mailbox is returned. This behavior causes thunderbird when getting new messages forshared mailboxes, to show briefly all messages of the mailbox as unseen forthe user before showing the correct unseen count forthe shared mailbox. The mail location of the shared mailboxes is defined with imapc storage type as described inthe documentation. Is this a dovecot bug? Can we configure a different dovecot configuration setting so that imap status command reports the correct unseen field count when mail location is an imapc storage location? An examples is given below when running doveadm command from one the 2 dovecot directors: When issuing the status command we see that the unseen count is 2: root@doved0-rmt0-cn1:/etc/cron.d# doveadm mailbox status -u npyrgiotis all shared.sysadmins doveadm(npyrgiotis): Info: remote(10.101.0.71:8080): doveadm(npyrgiotis(a)domie02.com)<19078><9l8IJTb+GWOGSgAAEU9A+w>: imapc(10.101.0.75:143): Connected to 10.101.0.75:143 (local 10.101.0.71:33476) shared.sysadmins messages=2 recent=0 uidnext=3 uidvalidity=1662640492 unseen=2 highestmodseq=3 vsize=3950 guid=c92f64f79f0d1ed01e6d5b314f04886c firstsaved=1662643853 shared.sysadmins messages=2recent=0uidnext=3uidvalidity=1662640492unseen=2highestmodseq=3vsize=3950guid=c92f64f79f0d1ed01e6d5b314f04886c firstsaved=1662643853 But when fetching the emails of the mailboxes we can see that the \Seen flag is set for both emails root@doved0-rmt0-cn1:/etc/cron.d# doveadm fetch -u npyrgiotis flags mailbox shared.sysadmins ALL doveadm(npyrgiotis): Info: remote(10.101.0.71:8080): doveadm(npyrgiotis(a)domie02.com)<19074><e7rWDgj+GWOCSgAAEU9A+w>: imapc(10.101.0.75:143): Connected to 10.101.0.75:143 (local 10.101.0.71:38750) flags: \Seen flags: \Seen Below i post the dovecot configuration of one of the two dovecot backends: # 2.3.19.1 (9b53102964): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.19 (4eae2f79) # OS: Linux 5.10.0-17-amd64 x86_64 Debian 11.4 # Hostname: doveb0-rmt0-cn1 auth_cache_negative_ttl = 5mins auth_cache_size = 50M auth_debug = yes auth_default_realm = example.com auth_master_user_separator = * auth_mechanisms = plain login auth_verbose = yes auth_worker_max_count = 16 disable_plaintext_auth = no first_valid_uid = 499 hostname = smtp.example.com imapc_features = fetch-bodystructure fetch-headers rfc822.size search modseq acl delay-login imapc_host = 10.101.0.75 imapc_password = # hidden, use -P to show it imapc_sasl_mechanisms = plain login imapc_ssl = starttls imapc_ssl_verify = no last_valid_uid = 499 lda_mailbox_autocreate = yes lda_mailbox_autosubscribe = yes login_greeting = You have successfully logged into example.com IMAP server login_trusted_networks = 10.101.0.73 10.101.0.74 mail_always_cache_fields = flags hdr.* date.received date.sent mail_cache_fields = flags date.received guid size.physical size.virtual imap.bodystructure body.snippet mail_debug = yes mail_fsync = always mail_plugins = " notify mail_log zlib acl" mail_privileged_group = mail managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext mdbox_rotate_size = 200M mmap_disable = yes namespace example { list = children location = imapc:~/shared/%%n:INDEXPVT=~/shared-pvt/%%n prefix = shared.%%n. separator = . subscriptions = no type = shared } namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Spam.Virus { auto = subscribe } mailbox Spam { auto = subscribe } mailbox Trash { special_use = \Trash } prefix = separator = . subscriptions = yes type = private } passdb { args = password=#hidden_use-P_to_show# driver = static master = yes override_fields = allow_real_nets=127.0.0.0/8,local,10.101.0.73,10.101.0.74 userdb_acl_user=%{auth_user} userdb_namespace/example/disabled=yes result_success = continue } passdb { args = password=#hidden_use-P_to_show# driver = static override_fields = allow_real_nets=127.0.0.0/8,local,10.101.0.73,10.101.0.74 result_success = continue } passdb { args = /etc/dovecot/dovecot-ldap-users.conf.ext driver = ldap } passdb { args = /etc/dovecot/dovecot-ldap-groups.conf.ext driver = ldap } plugin { acl = vfile:/etc/dovecot/global-acls/%d/master-dovecot-acl:cache_secs=300 acl_defaults_from_inbox = yes acl_globals_only = no acl_shared_dict = file:/var/dovecot-acl/%d/shared-mailboxes.db imap_compress_deflate_level = 6 mail_log_events = flag_change mail_log_fields = uid box flags sieve = file:~/sieve;active=~/sieve/%n.sieve sieve_before = /var/vmail/global-sieve/global.sieve sieve_env_email_address = %u sieve_env_mailbox_prefix = %{userdb:mailbox_prefix} sieve_global = /var/vmail/sieve sieve_global_extensions = +editheader +vnd.dovecot.environment zlib_save = zstd zlib_save_level = 5 } protocols = " imap lmtp sieve submission" service auth-worker { user = dovecot } service auth { unix_listener auth-userdb { group = mail mode = 0666 user = vmail } } service doveadm { inet_listener dovadm-dom-mgmt { address = 10.100.1.71 port = 8080 ssl = no } inet_listener dovadm-dom { address = 10.101.0.71 port = 8080 ssl = no } vsz_limit = 256M } service imap-login { inet_listener imap-dom { address = 10.101.0.71 port = 143 ssl = no } inet_listener imap { port = 0 } inet_listener imaps-dom { address = 10.101.0.71 port = 993 ssl = yes } inet_listener imaps { port = 0 } process_limit = 400 process_min_avail = 2 service_count = 20 vsz_limit = 512M } service imap { process_limit = 2048 process_min_avail = 0 service_count = 1 vsz_limit = 4G } service lmtp { inet_listener lmtp-dom { address = 10.101.0.71 port = 24 ssl = no } process_limit = 0 process_min_avail = 0 service_count = 0 unix_listener lmtp { mode = 0666 } vsz_limit = 256M } service managesieve-login { inet_listener sieve-dom { address = 10.101.0.71 port = 4190 ssl = no } inet_listener sieve { port = 0 } process_limit = 0 process_min_avail = 0 service_count = 0 vsz_limit = 64M } service managesieve { process_limit = 1024 process_min_avail = 0 service_count = 1 vsz_limit = 256M } service submission-login { inet_listener submission-dom { address = 10.101.0.71 port = 587 ssl = no } inet_listener submission { port = 0 } inet_listener submissions-dom { address = 10.101.0.71 port = 465 ssl = yes } process_limit = 250 process_min_avail = 2 service_count = 1 vsz_limit = 256M } service submission { process_limit = 1024 process_min_avail = 0 service_count = 1 vsz_limit = 256M } ssl = required ssl_cert = </etc/ssl/certs/doveb0-rmt0-cn1.mail.rmt.example.com.pem ssl_client_ca_dir = /etc/ssl/certs ssl_key = # hidden, use -P to show it submission_max_mail_size = 30000k submission_relay_host = 10.101.0.7 submission_relay_port = 587 submission_relay_ssl = starttls submission_relay_ssl_verify = no submission_relay_trusted = yes userdb { driver = prefetch } userdb { args = /etc/dovecot/dovecot-ldap-users.conf.ext driver = ldap } userdb { args = /etc/dovecot/dovecot-ldap-groups.conf.ext driver = ldap } protocol lmtp { mail_plugins = " notify mail_log zlib acl sieve acl" } protocol lda { mail_plugins = " notify mail_log zlib acl sieve acl" } protocol imap { mail_max_userip_connections = 100 mail_plugins = " notify mail_log zlib acl" } protocol sieve { mail_max_userip_connections = 40 } protocol submission { mail_max_userip_connections = 70 } local10.101.0.71 { doveadm_allowed_commands = doveadm_password = # hidden, use -P to show it } local10.100.1.71 { doveadm_allowed_commands = doveadm_password = # hidden, use -P to show it } Thank you, Nikolaos Pyrgiotis

2 3

is it possible to add a custom special use mailbox
by Marc 18 Oct '22

18 Oct '22

Currently I am using this to try and catch everything in Sent. mailbox Sent { special_use = \Sent auto = create } mailbox "Sent Items" { special_use = \Sent auto = no } mailbox "Sent Messages" { special_use = \Sent auto = no } I would like to have something mailbox Test { special_use = \Test auto = create } mailbox "Test Items" { special_use = \Test auto = no } mailbox "testing" { special_use = \Test auto = no }

1 1

Dovecot mail-crypt webmail can't read encrypted messages
by Serveria Support 18 Oct '22

18 Oct '22

I'm trying to setup Dovecot with mail-crypt plugin with per-user encryption. I have configured mail-crypt plugin as per official guide here: https://doc.dovecot.org/configuration_manual/mail_crypt_plugin/ After that I created a user and an encrypted key by running this command: doveadm -o \plugin/mail_crypt_private_password=12345 mailbox cryptokey generate -u mail(a)example.org -URf (replacing dummy data ofc) I can log in to webmail (and Dovecot) just fine, emails are getting sent and delivered. I have also checked the storage and the messages seem to be stored encrypted. However, I can't read the emails in webmail (just headers can be seen) and in Dovecot logs I can see the following error: failed: Private key not available: Cannot decrypt key ### Cannot decrypt key ### <8632: Password not available (FETCH RFC822.HEADER) There seems to be an issue with mySQL query. The query I'm using (Select username as "user", password,"%w" as userdb_mail_crypt_private_password from mailbox;) seems to work just fine, when run from mysql prompt it outputs the usernames and passwords, but the error is still there (Cannot decrypt key ### Password not available). Any ideas? What am I missing?

16 70

sieve script not modifying header
by Marc 17 Oct '22

17 Oct '22

From the command line the sieve script is modifying the header like this: su testuser -s '/bin/bash' -c 'cat test.msg | /usr/lib64/dovecot/sieve-execute/sieve-test' However when executing via dovecot, the header stays unchanged require ["copy","fileinto","vacation","vnd.dovecot.execute","editheader"]; # rule:[testing2] if not execute :pipe "sieve-test" { } Any idea what I am forgetting to configure/allow?

1 1

adding caldav/carddav next to dovecot
by Marc 16 Oct '22

16 Oct '22

I hope it is ok to post this off-topic question here. I was wondering if there are here environments running that offer next to dovecot also calendar and contacts services. In the past I was testing a bit with the one from Apple, but I think it is being discontinued because of converting the python 2 code. I am looking for some experience with a setup provisioning >10k users. Not that I have such requirement, but I want to know if the solution is stable, efficient and optionally can scale. I need something efficient, because I do not have to many resources and high iops available. I also do not want any other other 'crap' just the cal (and card) dav solution. https://github.com/1and1/cosmo This looks interesting (used 1und1 in Germany?) but not big community https://sabre.io/dav/install/ This is in php ...

13 21

Re: ot: how to t/s TBird problems ?
by Joseph Tam 16 Oct '22

16 Oct '22

> I recently upgraded my Thunderbird email client and have experienced > problems since. > It appears that when Tbird polls for new messages it gets held up > waiting for a response from the server > I'm using POP port 995. > Any ideas as to why I'm having a problem ? > ------------------- > > how to investigate such issue ? I suspect you'll need to do session logging e.g. protocol pop3 { ... rawlog_dir = /writable/logdir/%u } then mkdir /writable/logdir/user chmod 0777 /writable/logdir/user to obtain session transcripts of what server/client are doing. I don't see any obvious errors from the logs that indicate any failure. I do see the INBOX is rather large so maybe a timeout is involved. Joseph Tam <jtam.home(a)gmail.com>

2 1

Multidomain ssl config ?
by Maurizio Caloro 16 Oct '22

16 Oct '22

on postfix now this seems to run, and with dovecot i need also handle this two domains, but appairing this error messages. like: Jun 29 20:49:28 Dovecot/imap-login: Info: Disconnected (no auth attempts in 0 secs): user=<>, rip=a.b.c.d, lip=37.120.190.188, TLS handshaking: SSL_accept() failed: error:14094416:SSL routines: ssl3_read_bytes:sslv3 alert certificate unknown: SSL alert number 46, session=<FdklDjkdfrkfi> Running with Debian Buster # dovecot --version 2.3.4.1 (f79e8e7e4) # nmail.caloro.ch local_name nmail.caloro.ch { ssl_cert = </etc/letsencrypt/live/nmail.caloro.ch/privkey.pem ssl_key = </etc/letsencrypt/live/nmail.caloro.ch/fullchain.pem } # nmail.calm-ness.ch local_name nmail.calm-ness.ch { ssl_cert = </etc/letsencrypt/live/nmail.calm-ness.ch/privkey.pem ssl_key = </etc/letsencrypt/live/nmail.calm-ness.ch/fullchain.pem } thanks for possible help

6 5

Re: LDAP just for passdb
by Francis Augusto Medeiros-Logeay 14 Oct '22

14 Oct '22

Again, a bit more reading got me to adding this to my passdb config: username_filter = *(a)domain-a.com This way, I can control which domains get to authenticate via my ldap backend, which gives me time to design a good way of saving other attributes there. If anyone have other ways of doing this, ie., having multiple domains on ldap/freeipa and getting an elegant integration with Dovecot, I’d be glad to hear. Best, Francis > On 14 Oct 2022, at 21:58, dovecot-request(a)dovecot.org wrote: > > I actually saw that it was possible, and it works, but I came across another problem and I wonder if you have any tips about it: > > On my current dovecot setup, I use SQL as the backend. So I have the following users: > > francis(a)domain-a.com <mailto:francis@domain-a.com> <mailto:francis@domaina.com> > francis(a)domain-b.com <mailto:francis@domain-b.com> <mailto:francis@domain-b.com> > > Those are separate users which their own mailboxes. > > However, I have a freeipa that is configured for the `domain-a.com <http://domain-a.com/> <http://domain-a.com/>` realm. However, since I am using `%n` for the uid search: > > auth_bind_userdn = uid=%n,cn=users,cn=accounts,dc=domain-a,dc=com > And > pass_filter = (&(objectClass=posixAccount)(uid=%n)) > > It of course leads up to both users above being able to authenticate with the same password. > > Is there a way to limit ldap authentication to just one domain, or perform a search where both username and domain are checked? I could use the `mail``attribute to filter users, but I imagine that if two users have the same mail configured, I?d run into trouble?. > > Best, > > Francis > >> On 14 Oct 2022, at 20:08, dovecot-request(a)dovecot.org <mailto:dovecot-request@dovecot.org> wrote: >> >> Hi, >> >> I couldn't find it in the documentation, so I was wondering - is it >> possible to configure Dovecot to use LDAP for passdb and keep using SQL >> for userdb? >> >> I would like to do that before I come up with a good strategy to expand >> my ldap schema to support other mail attributes for virtual domains, >> aliases, etc. >> >> I am currently using FreeIPA. >> >> Best, >> >> Francis >

1 0

Re: LDAP just for passdb
by Francis Augusto Medeiros-Logeay 14 Oct '22

14 Oct '22

I actually saw that it was possible, and it works, but I came across another problem and I wonder if you have any tips about it: On my current dovecot setup, I use SQL as the backend. So I have the following users: francis(a)domain-a.com <mailto:francis@domaina.com> francis(a)domain-b.com <mailto:francis@domain-b.com> Those are separate users which their own mailboxes. However, I have a freeipa that is configured for the `domain-a.com <http://domain-a.com/>` realm. However, since I am using `%n` for the uid search: auth_bind_userdn = uid=%n,cn=users,cn=accounts,dc=domain-a,dc=com And pass_filter = (&(objectClass=posixAccount)(uid=%n)) It of course leads up to both users above being able to authenticate with the same password. Is there a way to limit ldap authentication to just one domain, or perform a search where both username and domain are checked? I could use the `mail``attribute to filter users, but I imagine that if two users have the same mail configured, I’d run into trouble…. Best, Francis > On 14 Oct 2022, at 20:08, dovecot-request(a)dovecot.org wrote: > > Hi, > > I couldn't find it in the documentation, so I was wondering - is it > possible to configure Dovecot to use LDAP for passdb and keep using SQL > for userdb? > > I would like to do that before I come up with a good strategy to expand > my ldap schema to support other mail attributes for virtual domains, > aliases, etc. > > I am currently using FreeIPA. > > Best, > > Francis

1 0

LDAP just for passdb
by Francis Augusto Medeiros-Logeay 14 Oct '22

14 Oct '22

Hi, I couldn't find it in the documentation, so I was wondering - is it possible to configure Dovecot to use LDAP for passdb and keep using SQL for userdb? I would like to do that before I come up with a good strategy to expand my ldap schema to support other mail attributes for virtual domains, aliases, etc. I am currently using FreeIPA. Best, Francis

1 0