December 2023 - dovecot

Forcing imap authentication failure for certain IP addresses
by Hippo Man 20 Jan '24

20 Jan '24

I'm running dovecot 2.3.18 under Debian 11. I want to do something that's a bit unusual: when IMAP connections are attempted from a few specific IP addresses, I want to force an IMAP authentication failure from those connections, no matter what user ID and password are specified. I know that I can use iptables to completely block imap access from those IP addresses to the IMAP ports. However, in these specific cases, I'd prefer that the connection goes through to dovecot, but for dovecot then to always generate authentication failures for those specific connections ... even if a valid user ID and password happen to be specified. Is there a way to do this in dovecot? Thank you very much in advance. -- hippoman(a)gmail.com Take a hippopotamus to lunch today. .---------, 0__0 / ( oo'---, / oo\ ,\ | | \ ,=__/ \ / / /------| /| |__|-' |__|'

2 1

ARM support
by Brad Koehn 15 Jan '24

15 Jan '24

Hey there, I was wondering if you’re planning to support ARM in your packages and/or Docker images. Right now I’m stuck on whatever ships with Debian for ARM64 architectures. Otherwise, suggestions how would I go about building them myself? In a modern build world, it’s fairly straightforward, especially with Docker to handle all the emulation. Thanks for such a great product! I’ve used Dovecot on my little server for over twenty years. — Brad Koehn Hey there, I was wondering if you’re planning to support ARM in your packages and/or Docker images. Right now I’m stuck on whatever ships with Debian for ARM64 architectures. Otherwise, suggestions how would I go about building them myself? In a modern build world, it’s fairly straightforward, especially with Docker to handle all the emulation. Thanks for such a great product! I’ve used Dovecot on my little server for over twenty years. — Brad Koehn

8 15

Panic: file index-search-result.c: line 132 (index_search_result_update_flags): assertion failed: (result->search_args->args == &search_arg)
by Markus Doits 14 Jan '24

14 Jan '24

Hello dovecot community, I hope you can help me with the following panic: --- Panic: file index-search-result.c: line 132 (index_search_result_update_flags): assertion failed: (result->search_args->args == &search_arg) Error: Raw backtrace: /usr/lib/dovecot/libdovecot.so.0(backtrace_append+0x46) [0x7f839a045846] -> /usr/lib/dovecot/libdovecot.so.0(backtrace_get+0x22) [0x7f839a045962] -> /usr/lib/dovecot/libdovecot.so.0(+0x10d81b) [0x7f839a05281b] -> /usr/lib/dovecot/libdovecot.so.0(+0x10d8b7) [0x7f839a0528b7] -> /usr/lib/dovecot/libdovecot.so.0(+0x5e2e2) [0x7f8399fa32e2] -> /usr/lib/dovecot/libdovecot-storage.so.0(+0x518a4) [0x7f839a1768a4] -> /usr/lib/dovecot/modules/lib20_virtual_plugin.so(virtual_storage_sync_init+0x274e) [0x7f8399ea4a9e] -> /usr/lib/dovecot/libdovecot-storage.so.0(mailbox_sync_init+0x5c) [0x7f839a192f9c] -> /usr/lib/dovecot/libdovecot-storage.so.0(mailbox_sync+0x39) [0x7f839a193039] -> /usr/lib/dovecot/libdovecot-storage.so.0(index_storage_get_status+0x37) [0x7f839a210467] -> /usr/lib/dovecot/modules/lib20_virtual_plugin.so(+0xc6c5) [0x7f8399e9f6c5] -> /usr/lib/dovecot/modules/lib20_fts_plugin.so(+0x145e2) [0x7f8399ee65e2] -> /usr/lib/dovecot/modules/lib01_acl_plugin.so(+0x10cb9) [0x7f8399f31cb9] -> /usr/lib/dovecot/libdovecot-storage.so.0(mailbox_get_status+0x64) [0x7f839a1935a4] -> dovecot/imap(imap_status_get+0x98) [0x55c63c180748] -> dovecot/imap(cmd_status+0x19e) [0x55c63c170a7e] -> dovecot/imap(command_exec+0xa4) [0x55c63c177444] -> dovecot/imap(+0x22392) [0x55c63c175392] -> dovecot/imap(+0x22444) [0x55c63c175444] -> dovecot/imap(client_handle_input+0x1bd) [0x55c63c17589d] -> dovecot/imap(client_input+0x74) [0x55c63c175e64] -> /usr/lib/dovecot/libdovecot.so.0(io_loop_call_io+0x6d) [0x7f839a06903d] -> /usr/lib/dovecot/libdovecot.so.0(io_loop_handler_run_internal+0x13a) [0x7f839a06a7aa] -> /usr/lib/dovecot/libdovecot.so.0(io_loop_handler_run+0x54) [0x7f839a0690e4] -> /usr/lib/dovecot/libdovecot.so.0(io_loop_run+0x40) [0x7f839a0692a0] -> /usr/lib/dovecot/libdovecot.so.0(master_service_run+0x17) [0x7f8399fd9ad7] -> dovecot/imap(main+0x570) [0x55c63c166d20] -> /lib/x86_64-linux-gnu/libc.so.6(+0x29d90) [0x7f8399c29d90] -> /lib/x86_64-linux-gnu/libc.so.6(__libc_start_main+0x80) [0x7f8399c29e40] -> dovecot/imap(_start+0x25) [0x55c63c166de5] Fatal: master: service(imap): child 793983 killed with signal 6 (core dumped) --- Happening on ubuntu 22.04, dovecot 2.3.21 from [this ubuntu ppa](https://launchpad.net/~patrickdk/+archive/ubuntu/production/+packages?… dovecot-core:amd64 1:2.3.21-0a~jammy dovecot-dev:amd64 1:2.3.21-0a~jammy dovecot-imapd:amd64 1:2.3.21-0a~jammy dovecot-ldap:amd64 1:2.3.21-0a~jammy dovecot-lmtpd:amd64 1:2.3.21-0a~jammy dovecot-sieve:amd64 1:2.3.21-0a~jammy dovecot-solr:amd64 1:2.3.21-0a~jammy --- I have this virtual mailbox configured: namespace { prefix = _/ separator = / location = virtual:~/Maildir/virtual:LAYOUT=maildir++:INDEX=~/Maildir/virtual } When I remove this mailbox, the error goes away - so it seems to be something with the virtual mailbox. As the fts provider I use [fts_flatcurve](https://slusarz.github.io/dovecot-fts-flatcurve), maybe this has something to do with it? Any help appreciated how to debug this further and maybe fix it. Thanks!

3 3

Unconfigurable 500 ms debounce on IMAP IDLE notifications
by Alex 14 Jan '24

14 Jan '24

Hello all, I have been investigating the reason for high end-to-end email delivery delay (>1 second to send a message to echo bot and receive a reply back) on a Postfix+Dovecot email server setup used to run the tests for Delta Chat core [1]. It appeared that most of the time was spent between the submission SMTP service accepting the mail for delivery and receiving an IDLE wakeup on the other side. Looking into the Dovecot source code, I found that all notifications from the storage to callbacks set up by IDLE are delayed by a debounce constant NOTIFY_DELAY_MSECS [2]. It appears to have been added in 2009 [3], but even before that Dovecot was only delivering notifications when a second-resolution timer is changed by at least 1, so IDLE notifications probably were delayed by half a second on average even before that. Commit message says "If the notification is done immediately, IDLE may not notice the change because it's not finished yet." This sounds like a workaround for some internal Dovecot bug. I have nevertheless tried to compile Dovecot with this constant reduced from 500 ms to 1 ms [4] and it resulted in exceptionally fast delivery without any problems caused to the Delta Chat core online test suite which is using this Postfix+Dovecot server accounts. We are running all the tests against this server and it appears to work fine. Round trip time for sending a message to an echo bot and receiving a reply back is reduced from 1.1 s to 0.2 s, which is easily visible in a chat app [5]. I wonder if this debounce delay was added as a workaround for an internal Dovecot bug or a client bug and is not necessary anymore. It does not seem to be useful for well-behaving clients because if necessary the client may debounce notifications on its side and postpone interrupting IDLE with "DONE". I would actually like to disable this delay completely on our server setup [6], as for chat it is common to receive multiple messages in a short period of time, e.g. when sending a message to a group and receiving multiple read receipts from currently active users. [1] https://github.com/deltachat/deltachat-core-rust/ [2] https://github.com/dovecot/core/blob/93a53a9d590f0220de28600f36a969cc38c314… [3] https://github.com/dovecot/core/commit/56fb5d09955b6097f77b341717fd9b70e9f1… [4] https://github.com/deltachat/chatmail/issues/72#issuecomment-1806645153 [5] https://delta.chat/assets/blog/nine-echo.mp4 [6] https://github.com/deltachat/chatmail Best regards, Alex

2 6

Solr/Tika patches for dovecot 2.3.21
by John Fawcett 03 Jan '24

03 Jan '24

Hi I've just made updated versions of 3 patches against the latest release 2.3.21 in case they are useful to someone or might get considered for official inclusion. John *dovecot-2.3.21-tika-http-auth.patch* Allows specification of username and password in the fts_tika setting for basic auth against tika server. For example fts_tika = https://user:password@tika_server:443/tika *dovecot-2.3.21-solr-max-size.patch * This is a simplified version of my previous patch. Sets a size limit (configuration fts_max_size) on message bodies that are to be indexed. Message bodies for messages larger than fts_max_size are not sent to solr. Defaults to zero which means no limit. For example fts_max_size = 10M *dovecot-2.3.21-solr-max-rows.patch * When dovecot sends a search to solr it uses the rows parameter. For multiple mailbox search the value used is SOLR_MAX_MULTI_ROWS , hardcoded to 100000. For single mailbox search the value is uidnext. This patch introduces an upper limit for single mailbox search using the same value as SOLR_MAX_MULTI_ROWS, while leaving the existing functionality of sending the uidnext value if it is smaller. This is just to place a more reasonable upper bound since uidnext can get much larger. Hi I've just made updated versions of 3 patches against the latest release 2.3.21 in case they are useful to someone or might get considered for official inclusion. John dovecot-2.3.21-tika-http-auth.patch Allows specification of username and password in the fts_tika setting for basic auth against tika server. For example fts_tika = https://user:password@tika_server:443/tika dovecot-2.3.21-solr-max-size.patch This is a simplified version of my previous patch. Sets a size limit (configuration fts_max_size) on message bodies that are to be indexed. Message bodies for messages larger than fts_max_size are not sent to solr. Defaults to zero which means no limit. For example fts_max_size = 10M dovecot-2.3.21-solr-max-rows.patch When dovecot sends a search to solr it uses the rows parameter. For multiple mailbox search the value used is SOLR_MAX_MULTI_ROWS , hardcoded to 100000. For single mailbox search the value is uidnext. This patch introduces an upper limit for single mailbox search using the same value as SOLR_MAX_MULTI_ROWS, while leaving the existing functionality of sending the uidnext value if it is smaller. This is just to place a more reasonable upper bound since uidnext can get much larger.

2 2

how to take mdbox extract of time interval and restore that again?
by lutz.niederer＠gmx.net 03 Jan '24

03 Jan '24

Hi! Due to a fatal hardware error we have to extract data of all existing imap accounts and all their boxes/folders etc. from an mdbox store starting with the 5th of december until today. Then we have to restore the old system and import the data back into it. Mail before 5th will come from the system backup, newer mail from that export. After that it may be possible that some/few mails may exist twice in the boxes, but that's ok. 1. What would be the command line for doveadm to extract everything starting the 5th? I find that the command line for doveadm is pretty complicated. I tried but I am not sure if I really got all mails exported. So I would like to ask if someone with much more experience can give me a command line that surely does what we want. The command will be run from a remote machine. 2. And what would be the command line to restore all the mails that we have exported back into the system? (The folder and account structure is the same.) 3. After that some of the mails may exist twice. Is that a problem, maybe because of internal IDs? 4. Are there any other things we need to be aware of when doing that? I thank you very much for your help! Cheers! -lutzn

2 1

Authentication failure due to address space limit
by Max Nikulin 26 Dec '23

26 Dec '23

Hi, I faced an error that appeared rather obscure at first, so I am trying to figure out if something can be improved. I have managed to solve the issue. I am running a Dovecot IMAP server to keep my personal mail archive. This server does not receive or send mail, just IMAP access. There was no reason to tune its performance, so its configuration is close to what Debian package has out of the box (actually doc/example-config). At certain moment I started to get authentication failures: dovecot[72165]: auth-worker: Error: fatal error: failed to reserve page summary memory dovecot[72165]: auth-worker: Error: dovecot[72165]: auth-worker: Error: runtime stack: dovecot[72165]: auth-worker: Error: runtime.throw({0x7f552c418194?, 0x7f552c1feb10?}) dovecot[72165]: auth-worker: Error: runtime/panic.go:1047 +0x5f fp=0x7f552c1feac0 sp=0x7f552c1fea90 pc=0x7f552c28a53f dovecot[72165]: auth-worker: Error: runtime.(*pageAlloc).sysInit(0x7f552c5f6fd0) dovecot[72165]: auth-worker: Error: runtime/mpagealloc_64bit.go:82 +0x195 fp=0x7f552c1feb48 sp=0x7f552c1feac0 pc=0x7f552c280ef5 dovecot[72165]: auth-worker: Error: runtime.(*pageAlloc).init(0x7f552c5f6fd0, 0x7f552c5f6fc0, 0x0?) dovecot[72165]: auth-worker: Error: runtime/mpagealloc.go:324 +0x70 fp=0x7f552c1feb70 sp=0x7f552c1feb48 pc=0x7f552c27eb50 dovecot[72165]: auth-worker: Error: runtime.(*mheap).init(0x7f552c5f6fc0) dovecot[72165]: auth-worker: Error: runtime/mheap.go:729 +0x13f fp=0x7f552c1feba8 sp=0x7f552c1feb70 pc=0x7f552c27bf5f dovecot[72165]: auth-worker: Error: runtime.mallocinit() dovecot[72165]: auth-worker: Error: runtime/malloc.go:407 +0xb2 fp=0x7f552c1febd0 sp=0x7f552c1feba8 pc=0x7f552c260e72 dovecot[72165]: auth-worker: Error: runtime.schedinit() dovecot[72165]: auth-worker: Error: runtime/proc.go:693 +0xab fp=0x7f552c1fec30 sp=0x7f552c1febd0 pc=0x7f552c28df0b dovecot[72165]: auth-worker: Error: runtime.rt0_go() dovecot[72165]: auth-worker: Error: runtime/asm_amd64.s:345 +0x120 fp=0x7f552c1fec38 sp=0x7f552c1fec30 pc=0x7f552c2b7c20 dovecot[72165]: auth: Error: auth-worker: Aborted PASSV request for mailuser: Worker process died unexpectedly dovecot[72165]: auth-worker: Fatal: master: service(auth-worker): child 72211 returned error 2 Such errors happen even for invalid users curl -v 'imap://bad:bad@localhost/' I have realized that it may be related to the pam_fscrypt plugin I had installed before. It is intended for another system user, so I did not expect any negative consequence on Dovecot. Disabling the module confirmed my guess. This PAM module is written in Go and language runtime requires almost 1G of address space (RLIMIT_AS) even when actual memory allocation is several times lower (the user has no configured login protector). https://github.com/golang/go/issues/38010 "runtime: high startup address space usage (RLIMIT_AS) on Linux AMD64" The code of the fscrypt PAM module has Go panic handlers, but this case error happens early during runtime initialization, so error handlers have not set yet and can not provide a more instructive error. I do not like that Go has no knobs like compile or link flags to prevent early allocation of rather large address space. At the same time I admit that doing garbage collection efficiently is tricky and unreasonable efforts may be required to allow modest address space at startup. Default Dovecot configuration has vsz_limit = $default_vsz_limit = 256M The following configuration snippet solves the issue: service auth-worker { # still crash, but later # vsz_limit = 800M vsz_limit = 1024M } I am realizing that my use case is rather specific. Mail and encrypted home directories are hardly compatible. However some other PAM modules may cause similar issues. Cgroup Linux kernel feature should allow to limit real memory usage and it should be better than per-process limits imposed on address space size. However assigning proper control groups for Dovecot processes may be not so trivial. I am unsure if auth-worker vsz_limit or default_vsz_limit should be raised in the example configuration. Do you think it is reasonable to add warnings concerning PAM plugins and vsz_limit to docs? I mean - https://doc.dovecot.org/configuration_manual/authentication/pam/ - https://doc.dovecot.org/configuration_manual/service_configuration/#auth-wo… in a similar way as it is done for Argon2 in https://doc.dovecot.org/configuration_manual/authentication/password_scheme… P.S. Debian 12 bookworm, Dovecot 1:2.3.19.1+dfsg1-2.1

2 4

Elevate Your Storytelling Experience with Start Motion Media
by petersthomas383＠gmail.com 19 Dec '23

19 Dec '23

Startmotionmedia.com Media, we specialize in crafting captivating visual narratives through expert video production services. Our dedicated team focuses on delivering compelling storytelling that resonates across diverse industries, creating impactful videos that leave a lasting impression. At Start Motion Media, our mission is to bring creativity to life. From conceptualization to production, we ensure each project reflects our commitment to excellence. Our portfolio showcases the artistry and skill behind Start Motion Media's captivating visual storytelling. Experience storytelling prowess firsthand by exploring <a href="https://www.startmotionmedia.com/can-web-development-be-a-side-hustle-for-s…">startmotionmedia</a>. Immerse yourself in our gallery of projects, witnessing the transformative power of visual narratives. Start Motion Media invites you to witness how storytelling unfolds through our lens, shaping brands and captivating audiences worldwide. For businesses seeking to amplify their narratives and engage audiences effectively, Start Motion Media is the answer. Harness the storytelling expertise of Start Motion Media to elevate your brand's story and make a lasting impact in the digital sphere.

1 0

Re-Enabling TLS1.1 in dovecot 2.3.16
by Nils 14 Dec '23

14 Dec '23

Hi, I'd like to re-enable TLS1.1 (at least temporary) to see if it fixes a problem with one of my clients. When I add "ssl_min_protocol = TLSv1.1" to either dovecot.conf or conf.d/10-ssl.conf it doesn't seem to have an effect. Still the client is not working. I used testssl.sh to check the available ssl versions and it says that tls1.1 is not offered: $ ./testssl.sh --starttls imap SERVERNAME.TLD:143 ... Service set: STARTTLS via IMAP Testing protocols via sockets SSLv2 not offered (OK) SSLv3 not offered (OK) TLS 1 not offered TLS 1.1 not offered TLS 1.2 offered (OK) TLS 1.3 offered (OK): final Kind regards, Nils

2 2

dovecot submission max line length
by Kees van Vloten 13 Dec '23

13 Dec '23

Hi all, After upgrading Debian Bullseye (Dovecot 2.3.13) to Bookworm (Dovcecot 2.3.19), submission-login returns an error on Kerberos authentication: "Client sent invalid command: Command line is too long". When I initially set this up on Bullseye I have seen the same issue, but adding "imap_max_line_length = 2M" solved it. Now with 2.3.19 kerberos authentication still works (with this setting) for imap connections but it stopped working for submission. Is there a new config setting for submission-login that I missed? Or is this a bug in 2.3.19? - Kees.

3 3