October 2022 - dovecot

Dovecot mail-crypt webmail can't read encrypted messages
by Serveria Support 17 Oct '22

17 Oct '22

I'm trying to setup Dovecot with mail-crypt plugin with per-user encryption. I have configured mail-crypt plugin as per official guide here: https://doc.dovecot.org/configuration_manual/mail_crypt_plugin/ After that I created a user and an encrypted key by running this command: doveadm -o \plugin/mail_crypt_private_password=12345 mailbox cryptokey generate -u mail(a)example.org -URf (replacing dummy data ofc) I can log in to webmail (and Dovecot) just fine, emails are getting sent and delivered. I have also checked the storage and the messages seem to be stored encrypted. However, I can't read the emails in webmail (just headers can be seen) and in Dovecot logs I can see the following error: failed: Private key not available: Cannot decrypt key ### Cannot decrypt key ### <8632: Password not available (FETCH RFC822.HEADER) There seems to be an issue with mySQL query. The query I'm using (Select username as "user", password,"%w" as userdb_mail_crypt_private_password from mailbox;) seems to work just fine, when run from mysql prompt it outputs the usernames and passwords, but the error is still there (Cannot decrypt key ### Password not available). Any ideas? What am I missing?

16 70

sieve script not modifying header
by Marc 17 Oct '22

17 Oct '22

From the command line the sieve script is modifying the header like this: su testuser -s '/bin/bash' -c 'cat test.msg | /usr/lib64/dovecot/sieve-execute/sieve-test' However when executing via dovecot, the header stays unchanged require ["copy","fileinto","vacation","vnd.dovecot.execute","editheader"]; # rule:[testing2] if not execute :pipe "sieve-test" { } Any idea what I am forgetting to configure/allow?

1 1

adding caldav/carddav next to dovecot
by Marc 16 Oct '22

16 Oct '22

I hope it is ok to post this off-topic question here. I was wondering if there are here environments running that offer next to dovecot also calendar and contacts services. In the past I was testing a bit with the one from Apple, but I think it is being discontinued because of converting the python 2 code. I am looking for some experience with a setup provisioning >10k users. Not that I have such requirement, but I want to know if the solution is stable, efficient and optionally can scale. I need something efficient, because I do not have to many resources and high iops available. I also do not want any other other 'crap' just the cal (and card) dav solution. https://github.com/1and1/cosmo This looks interesting (used 1und1 in Germany?) but not big community https://sabre.io/dav/install/ This is in php ...

13 21

Re: ot: how to t/s TBird problems ?
by Joseph Tam 16 Oct '22

16 Oct '22

> I recently upgraded my Thunderbird email client and have experienced > problems since. > It appears that when Tbird polls for new messages it gets held up > waiting for a response from the server > I'm using POP port 995. > Any ideas as to why I'm having a problem ? > ------------------- > > how to investigate such issue ? I suspect you'll need to do session logging e.g. protocol pop3 { ... rawlog_dir = /writable/logdir/%u } then mkdir /writable/logdir/user chmod 0777 /writable/logdir/user to obtain session transcripts of what server/client are doing. I don't see any obvious errors from the logs that indicate any failure. I do see the INBOX is rather large so maybe a timeout is involved. Joseph Tam <jtam.home(a)gmail.com>

2 1

Multidomain ssl config ?
by Maurizio Caloro 16 Oct '22

16 Oct '22

on postfix now this seems to run, and with dovecot i need also handle this two domains, but appairing this error messages. like: Jun 29 20:49:28 Dovecot/imap-login: Info: Disconnected (no auth attempts in 0 secs): user=<>, rip=a.b.c.d, lip=37.120.190.188, TLS handshaking: SSL_accept() failed: error:14094416:SSL routines: ssl3_read_bytes:sslv3 alert certificate unknown: SSL alert number 46, session=<FdklDjkdfrkfi> Running with Debian Buster # dovecot --version 2.3.4.1 (f79e8e7e4) # nmail.caloro.ch local_name nmail.caloro.ch { ssl_cert = </etc/letsencrypt/live/nmail.caloro.ch/privkey.pem ssl_key = </etc/letsencrypt/live/nmail.caloro.ch/fullchain.pem } # nmail.calm-ness.ch local_name nmail.calm-ness.ch { ssl_cert = </etc/letsencrypt/live/nmail.calm-ness.ch/privkey.pem ssl_key = </etc/letsencrypt/live/nmail.calm-ness.ch/fullchain.pem } thanks for possible help

6 5

Re: LDAP just for passdb
by Francis Augusto Medeiros-Logeay 14 Oct '22

14 Oct '22

Again, a bit more reading got me to adding this to my passdb config: username_filter = *(a)domain-a.com This way, I can control which domains get to authenticate via my ldap backend, which gives me time to design a good way of saving other attributes there. If anyone have other ways of doing this, ie., having multiple domains on ldap/freeipa and getting an elegant integration with Dovecot, I’d be glad to hear. Best, Francis > On 14 Oct 2022, at 21:58, dovecot-request(a)dovecot.org wrote: > > I actually saw that it was possible, and it works, but I came across another problem and I wonder if you have any tips about it: > > On my current dovecot setup, I use SQL as the backend. So I have the following users: > > francis(a)domain-a.com <mailto:francis@domain-a.com> <mailto:francis@domaina.com> > francis(a)domain-b.com <mailto:francis@domain-b.com> <mailto:francis@domain-b.com> > > Those are separate users which their own mailboxes. > > However, I have a freeipa that is configured for the `domain-a.com <http://domain-a.com/> <http://domain-a.com/>` realm. However, since I am using `%n` for the uid search: > > auth_bind_userdn = uid=%n,cn=users,cn=accounts,dc=domain-a,dc=com > And > pass_filter = (&(objectClass=posixAccount)(uid=%n)) > > It of course leads up to both users above being able to authenticate with the same password. > > Is there a way to limit ldap authentication to just one domain, or perform a search where both username and domain are checked? I could use the `mail``attribute to filter users, but I imagine that if two users have the same mail configured, I?d run into trouble?. > > Best, > > Francis > >> On 14 Oct 2022, at 20:08, dovecot-request(a)dovecot.org <mailto:dovecot-request@dovecot.org> wrote: >> >> Hi, >> >> I couldn't find it in the documentation, so I was wondering - is it >> possible to configure Dovecot to use LDAP for passdb and keep using SQL >> for userdb? >> >> I would like to do that before I come up with a good strategy to expand >> my ldap schema to support other mail attributes for virtual domains, >> aliases, etc. >> >> I am currently using FreeIPA. >> >> Best, >> >> Francis >

1 0

Re: LDAP just for passdb
by Francis Augusto Medeiros-Logeay 14 Oct '22

14 Oct '22

I actually saw that it was possible, and it works, but I came across another problem and I wonder if you have any tips about it: On my current dovecot setup, I use SQL as the backend. So I have the following users: francis(a)domain-a.com <mailto:francis@domaina.com> francis(a)domain-b.com <mailto:francis@domain-b.com> Those are separate users which their own mailboxes. However, I have a freeipa that is configured for the `domain-a.com <http://domain-a.com/>` realm. However, since I am using `%n` for the uid search: auth_bind_userdn = uid=%n,cn=users,cn=accounts,dc=domain-a,dc=com And pass_filter = (&(objectClass=posixAccount)(uid=%n)) It of course leads up to both users above being able to authenticate with the same password. Is there a way to limit ldap authentication to just one domain, or perform a search where both username and domain are checked? I could use the `mail``attribute to filter users, but I imagine that if two users have the same mail configured, I’d run into trouble…. Best, Francis > On 14 Oct 2022, at 20:08, dovecot-request(a)dovecot.org wrote: > > Hi, > > I couldn't find it in the documentation, so I was wondering - is it > possible to configure Dovecot to use LDAP for passdb and keep using SQL > for userdb? > > I would like to do that before I come up with a good strategy to expand > my ldap schema to support other mail attributes for virtual domains, > aliases, etc. > > I am currently using FreeIPA. > > Best, > > Francis

1 0

LDAP just for passdb
by Francis Augusto Medeiros-Logeay 14 Oct '22

14 Oct '22

Hi, I couldn't find it in the documentation, so I was wondering - is it possible to configure Dovecot to use LDAP for passdb and keep using SQL for userdb? I would like to do that before I come up with a good strategy to expand my ldap schema to support other mail attributes for virtual domains, aliases, etc. I am currently using FreeIPA. Best, Francis

1 0

"make check" fail at test_program_refused
by A. Schulze 14 Oct '22

14 Oct '22

Hello, I moved my buildsystem to an other platform (I do not fully control) and now receive this error on "make check" Error: program tcp:127.0.0.2:42027: connect(::1) failed: Connection refused test_program_refused ................................................. : FAILED The build run on jenkins buildnodex spawn up on a kubernetes cluster. What I noticed so far: the buildnode opereate ipv4 only but has an entry in /etc/hosts: 127.0.0.1 c4a84c76f0d6 ::1 c4a84c76f0d6 Maybe that's the glitch ... I tried dovecot-2.3.15 and 2.3.19.1. Both fail (only the portnumber differ) Is there an option to disable only one specific test? I dislike to skip "make check" at all. Andreas

1 1

what are the options to 'interact' with a dovecot imap user
by Marc 14 Oct '22

14 Oct '22

I am looking for a user friendly way to have a user to tell the 'server' to either store or remove an email address. a. My first thought was to use imapsieve for this and have an imap sieve plugin store/remove the email address of the message that is being dragged into a predefined monitored folder. This would work with any imap client b. I was thinking about the message Flagged[1]. I am curious how would I be able to detect this (in sieve)? This does not seem to be stored in the source of the message. Although every client seems to support it, it would probably conflict with every day use cases. c. Then you have these colours and/or categories. But these do not seem to propagate across clients. Where are these even stored? Any ideas on how this can be done? [1] https://www.rfc-editor.org/rfc/rfc3501#section-2.3.2

1 0