May 2023 - dovecot - dovecot.org

Many IDLE imap processes but very few connections moved to imap-hibernate
by pierre.alletru＠gmail.com 17 Jul '23

17 Jul '23

Hi Dovecot community! I have a strange issue with imap-hibernate. Or more likely it behaves as it's supposed to and it's just that I don't really understand it. I have enabled it, and it works, but for some reason hibernation happens only to a tiny amount of connections, whereas I have a lot of IDLE imap processes. And I can't find any relevant errors in the logs. ## config ## mail_debug = yes verbose_proctitle = yes $ doveconf imap_hibernate_timeout imap_hibernate_timeout = 5 secs $ doveconf -a | grep -A 21 'service imap-hibernate' service imap-hibernate { chroot = client_limit = 0 drop_priv_before_exec = no executable = imap-hibernate extra_groups = group = idle_kill = 0 privileged_group = process_limit = 0 process_min_avail = 0 protocol = imap service_count = 0 type = unix_listener imap-hibernate { group = $default_internal_group mode = 0660 user = } user = $default_internal_user vsz_limit = 18446744073709551615 B } ## imap processes ## $ ps aux | grep "dovecot/imap" | wc -l 2214 ps aux | grep "dovecot/imap" | grep IDLE | wc -l 1258 $ ps aux | grep "imap-hibernate" syslog 1571453 0.0 0.0 4748 3156 ? S 15:44 0:00 dovecot/imap-hibernate [18 connections] As you can see here I have 1258 IDLE imap processes (out of 2214 in total), and only 18 connections in imap-hibernate. I'd like to have all IDLE processes to be moved to imap-hibernate in order to save up memory. Any idea why these 1k+ IDLE imap processes are not moved into imap-hibernate? Thank you!

2 1

Warning sqlpool(mysql): Query failed
by Alessio Cecchi 27 Jun '23

27 Jun '23

Hi, with the last dovecot version (2.3.13) I see many of this warnings via "doveadm log errors": Feb 17 03:26:28 Warning: dict(31513): conn unix:dict (pid=31330,uid=95): dict(mysql)<email1(a)company1.com>: sqlpool(mysql): Query failed, retrying: MySQL server has gone away (idled for 679 secs) Feb 17 03:48:53 Warning: dict(31013): conn unix:dict (pid=31805,uid=95): dict(mysql)<email2(a)company2.com>: sqlpool(mysql): Query failed, retrying: MySQL server has gone away (idled for 685 secs) Feb 17 03:54:12 Warning: dict(32529): conn unix:dict (pid=3147,uid=95): dict(mysql)<email3(a)company3.com>: sqlpool(mysql): Query failed, retrying: MySQL server has gone away (idled for 670 secs) What do they mean? I thinks are related to inactivity timeout on mysql server (where I have a wait_timeout=600), but these warnings could be problems or can be fixed with some setting in dovecot? My dovecot configuration about dict: dict { acl = mysql:/etc/dovecot/dovecot-dict-sql.conf.ext expire = mysql:/etc/dovecot/dovecot-dict-sql.conf.ext sieve = mysql:/etc/dovecot/dovecot-dict-sieve-sql.conf.ext sqlquota = mysql:/etc/dovecot/dovecot-dict-sql.conf.ext } plugin { [...] acl_shared_dict = proxy::acl expire_dict = proxy::expire quota2 = dict:Quota Usage::noenforcing:proxy::sqlquota sieve = file:~/sieve;active=~/.dovecot.sieve sieve_before = dict:proxy::sieve;name=activesql [...] } service dict { process_limit = 500 unix_listener dict { group = vmail mode = 0660 user = vmail } } Thanks -- Alessio Cecchi Postmaster @ http://www.qboxmail.it https://www.linkedin.com/in/alessice

2 1

configuring Dovecot submission service
by Computerisms Corporation 23 Jun '23

23 Jun '23

Hi Dovecot Gurus, I have been playing around with the submission service. I have managed to get all the things working that I want working with two exceptions. I have not found (or possibly I have overlooked) solutions in the documentation or discussions on the 'net. First; I would like to be able to authenticate against my backend MTA using the user-supplied credentials. I have tried setting submission_relay_user as %u and submission_relay_password as %w, but these seem to be passed through as literal strings, and of course my backend MTA has no idea who %u is. I found a post from 2019 that indicates passing the submission_relay_user/password to the backend is not a supported function, but hoping that maybe that is outdated info. I also found: https://doc.dovecot.org/3.0/configuration_manual/authentication/proxies/ Which seems to indicate it could pass credentials to a non-Dovecot MTA backend, but I am not really clear from the docs on how to set that up, and I did not find any relevant examples to work from. Seems like it would be setting up a Director service, maybe? I have done that before and I do manage multiple email servers, but none of them is clustered or configured to be interoperable, so not sure if this is a viable approach. Second; I am wondering about the possibility of having multiple submission_relay_host entries. For example if I have dovecot submission services running on my standard port 587 and 465 connect to a relay on the same box through localhost, but could I have another submission service running on another port, say 5587, and relay all traffic received on that port through a completely different host? I am thinking I could set that up by running a separate instance of dovecot for just that service, but maybe there is a more suitable way? I don't have a solid use-case for this in mind at the moment, but given that I do manage multiple email servers, I am thinking that if this is possible it might provide some useful corner-case configurations down the road. Thank you for reading my post, any thoughts, information, or pointers to relevant documentation would be most appreciated. -- Bob Miller 867-334-7117 www.computerisms.ca

2 3

Multiple backends with NFSv4.1 (supports file locking): should work without Director, right?
by pierre.alletru＠gmail.com 05 Jun '23

05 Jun '23

Hi Dovecot community, We're looking at running multiple Dovecot backend servers in parallel, all using the same shared NFSv4.1 mount to store mailboxes in the maildir format. We've read in multiple places that running multiple backends with a shared NFS can result in issues like index files corruption. The standard solution seems to use the Director feature, or some kind of IP based proxy/load balancer. But: 1 - The Director feature will be removed in future free versions of Dovecot (https://dovecot.org/mailman3/archives/list/dovecot@dovecot.org/thread/ILA3C…) 2 - NFSv4 and above support file locking (flock and fcntl, flock being emulated using fcntl). 3 - It looks like Dovecot does use file locking, though we're unsure if it does on everything and in particular on index files. Thus, we are wondering if the need for Director is still relevant with NFSv4? Shouldn't it work without Director thanks to file locking? Has anyone tried it? We're thinking that the documentation and various threads on the subject may be outdated, based on NFSv3 and lower (no file locking). If it doesn't work, anybody knows why? Isn't file locking there precisely to handle concurrency? Thanks!

10 17

Share
by liecj3＠bfh.ch 01 Jun '23

01 Jun '23

Hello dear Dovecot users I have a somewhat special request: I have a single file in mbox format which I want to make accessible via IMAP to anonymous logins. The mbox file is being updated outside of Dovecot and should not be changeable by Dovecot. So far I created a Docker container based on the official image (https://hub.docker.com/r/dovecot/dovecot) and configured the Dovecot according to https://doc.dovecot.org/configuration_manual/shared_mailboxes/public_shared/. The volume with the mbox file is mounted in the running container under /var/mail. Each time a client tries to access this public mailbox the following error is logged and no content is returned: May 26 21:57:06 imap(mutt)<16><Rkpg0Z/8pLfAqDAB>: Error: Mailbox Public/archive: open() failed with mbox: Read-only file system. Note that I don't need the file to be a shared mailbox. Instead I would also be happy to have all (anonymous) users mapped to the read-only mbox somewhere in the filesystem. Dockerfile: FROM dovecot/dovecot RUN mkdir -p /var/indexes/public RUN chown 1000:1000 /var/indexes/public ADD dovecot.conf /etc/dovecot/dovecot.conf /etc/dovecot/dovecot.conf: ## You should mount /etc/dovecot if you want to ## manage this file mail_home=/srv/mail/%Lu mail_location=sdbox:~/Mail mail_uid=1000 mail_gid=1000 #protocols = imap pop3 submission sieve lmtp protocols = imap first_valid_uid = 1000 last_valid_uid = 1000 passdb { driver = static args = password=pass } ssl=yes ssl_cert=<cert.pem ssl_key=<key.pem namespace { type = private inbox = yes separator = / } namespace { type = public prefix = Public/ location = mbox:/var/mail/:INDEX=/var/indexes/public subscriptions = no } listen = * log_path=/dev/stdout info_log_path=/dev/stdout debug_log_path=/dev/stdout

2 1

GSSAPI auth Line too long
by Thomas Lemarchand 31 May '23

31 May '23

Hello, On version 2.3.20 (80a5ac675d), I have a problem with submission-login when using GSSAPI auth : it's not working, probably due to AUTH line being too long. It appeared after I activated PAC on my Kerberos infrastructure. Now the Kerberos tickets contains MS-PAC data and are bigger. It's part of the RFC and is a valid use case : https://datatracker.ietf.org/doc/html/rfc4120#section-5.2.6 Logs : May 30 17:13:00 auth: Debug: auth client connected (pid=378) May 30 17:13:00 submission-login: Debug: smtp-server: conn 10.200.114.128:13587 [1]: Sent: 220 mail.int.k8s.lemarchand.io Dovecot ready. May 30 17:13:00 submission-login: Debug: smtp-server: conn 10.200.114.128:13587 [1]: Received new command: EHLO [192.168.202.16] May 30 17:13:00 submission-login: Debug: smtp-server: conn 10.200.114.128:13587 [1]: command EHLO: New command May 30 17:13:00 submission-login: Debug: smtp-server: conn 10.200.114.128:13587 [1]: command EHLO: Execute command May 30 17:13:00 submission-login: Debug: smtp-server: conn 10.200.114.128:13587 [1]: command EHLO: Pipeline blocked May 30 17:13:00 submission-login: Debug: smtp-server: conn 10.200.114.128:13587 [1]: command EHLO: 250 reply: Submitted May 30 17:13:00 submission-login: Debug: smtp-server: conn 10.200.114.128:13587 [1]: command EHLO: Replied May 30 17:13:00 submission-login: Debug: smtp-server: conn 10.200.114.128:13587 [1]: command EHLO: Ready to reply May 30 17:13:00 submission-login: Debug: smtp-server: conn 10.200.114.128:13587 [1]: Trigger output May 30 17:13:00 submission-login: Debug: smtp-server: conn 10.200.114.128:13587 [1]: command EHLO: Next to reply May 30 17:13:00 submission-login: Debug: smtp-server: conn 10.200.114.128:13587 [1]: Sending replies May 30 17:13:00 submission-login: Debug: smtp-server: conn 10.200.114.128:13587 [1]: command EHLO: Next to reply May 30 17:13:00 submission-login: Debug: smtp-server: conn 10.200.114.128:13587 [1]: command EHLO: Completed May 30 17:13:00 submission-login: Debug: smtp-server: conn 10.200.114.128:13587 [1]: command EHLO: Pipeline unblocked May 30 17:13:00 submission-login: Debug: smtp-server: conn 10.200.114.128:13587 [1]: Connection state reset May 30 17:13:00 submission-login: Debug: smtp-server: conn 10.200.114.128:13587 [1]: command EHLO: 250 reply: Sent: 250-mail.int.k8s.lemarchand.io 8BITMIME AUTH GSSAPI PLAIN LOGIN BURL imap CHUNKING ENHANCEDSTATUSCODES SIZE P IPELINING May 30 17:13:00 submission-login: Debug: smtp-server: conn 10.200.114.128:13587 [1]: command EHLO: Finished May 30 17:13:00 submission-login: Debug: smtp-server: conn 10.200.114.128:13587 [1]: command EHLO: Destroy May 30 17:13:00 submission-login: Debug: smtp-server: conn 10.200.114.128:13587 [1]: command EHLO: 250 reply: Destroy May 30 17:13:00 submission-login: Debug: smtp-server: conn 10.200.114.128:13587 [1]: Trigger output May 30 17:13:00 submission-login: Debug: smtp-server: conn 10.200.114.128:13587 [1]: No more commands pending May 30 17:13:00 submission-login: Debug: smtp-server: conn 10.200.114.128:13587 [1]: Sending replies May 30 17:13:00 submission-login: Debug: smtp-server: conn 10.200.114.128:13587 [1]: No more commands pending May 30 17:13:00 submission-login: Debug: smtp-server: conn 10.200.114.128:13587 [1]: Client sent invalid command: Command line is too long May 30 17:13:00 submission-login: Debug: smtp-server: conn 10.200.114.128:13587 [1]: command [unknown]: Invalid command May 30 17:13:00 submission-login: Debug: smtp-server: conn 10.200.114.128:13587 [1]: command [unknown]: 500 reply: Submitted May 30 17:13:00 submission-login: Debug: smtp-server: conn 10.200.114.128:13587 [1]: command [unknown]: Replied May 30 17:13:00 submission-login: Debug: smtp-server: conn 10.200.114.128:13587 [1]: command [unknown]: Ready to reply May 30 17:13:00 submission-login: Debug: smtp-server: conn 10.200.114.128:13587 [1]: Trigger output May 30 17:13:00 submission-login: Debug: smtp-server: conn 10.200.114.128:13587 [1]: Sending replies May 30 17:13:00 submission-login: Debug: smtp-server: conn 10.200.114.128:13587 [1]: command [unknown]: Next to reply May 30 17:13:00 submission-login: Debug: smtp-server: conn 10.200.114.128:13587 [1]: command [unknown]: Completed May 30 17:13:00 submission-login: Debug: smtp-server: conn 10.200.114.128:13587 [1]: command [unknown]: 500 reply: Sent: 500 5.5.2 Line too long May 30 17:13:00 submission-login: Debug: smtp-server: conn 10.200.114.128:13587 [1]: command [unknown]: Finished May 30 17:13:00 submission-login: Debug: smtp-server: conn 10.200.114.128:13587 [1]: command [unknown]: Destroy May 30 17:13:00 submission-login: Debug: smtp-server: conn 10.200.114.128:13587 [1]: command [unknown]: 500 reply: Destroy May 30 17:13:00 submission-login: Debug: smtp-server: conn 10.200.114.128:13587 [1]: Trigger output May 30 17:13:00 submission-login: Debug: smtp-server: conn 10.200.114.128:13587 [1]: No more commands pending May 30 17:13:00 submission-login: Debug: smtp-server: conn 10.200.114.128:13587 [1]: Sending replies May 30 17:13:00 submission-login: Debug: smtp-server: conn 10.200.114.128:13587 [1]: No more commands pending May 30 17:13:00 submission-login: Debug: smtp-server: conn 10.200.114.128:13587 [1]: Remote closed connection: Connection closed May 30 17:13:00 submission-login: Debug: smtp-server: conn 10.200.114.128:13587 [1]: Disconnected: Connection closed May 30 17:13:00 submission-login: Debug: smtp-server: conn 10.200.114.128:13587 [1]: Connection state reset My guess is that it's due to https://github.com/dovecot/core/blob/main/src/lib-smtp/smtp-common.h#L10 being too low (is it configurable ?), but I didn't read the code thoroughly. Red Hat IDM now activates MS-PAC by default, so any installation based on IDM (or FreeIPA) may have the same problem. What's your opinion ? Bug ? Mail sent using password auth :'( -- Thomas Lemarchand

4 7

Inconsistent listing of shared subfolders
by mschering＠intermesh.nl 30 May '23

30 May '23

Hi all, I have a problem with listing shared folders. In my web application I don't get the whole folder tree at once but get them level by level with: LIST "" "subfolder/%" RETURN (CHILDREN) Now I have an issue with shared folders. If I share folder test/sub with another user it returns it's (not shared) parent folder with this command: LIST "" "shared/someuser/%" RETURN (CHILDREN) But if I do the same with INBOX/sub it will not return the "INBOX" folder with the above command. Is that a bug or does anybody know why it behaves differently? Also, If I do: LIST "" "shared/someuser/*" RETURN (CHILDREN) it will return both the subfolder of test and inbox. My shared namespace is setup like this: namespace { type = shared separator = / prefix = shared/%%u/ # a) Per-user seen flags. Maildir indexes are shared. (INDEXPVT requires v2.2+) location = maildir:%%h/Maildir:INDEXPVT=~/Maildir/shared/%%u # b) Per-user seen flags. Maildir indexes are not shared. If users have direct filesystem level access to their mails, this is a safer option: #location = maildir:%%h/Maildir:INDEX=~/Maildir/shared/%%u:INDEXPVT=~/Maildir/shared/%%u subscriptions = no list = children } Thanks for any help! Best regards, Merijn

1 0

Outlook Duplicate emails
by Nick Lekkas 29 May '23

29 May '23

Hello there to all ! I have 2 postfix/dovecot mailservers. Those mailservers are synced using replicator enabled. The dovecot versions I use is 2.3.16 on Rocky Linux 9 .The configuration issued from CentOS 7 mailservers with replicator enabled using 2.2.36. The config is the same in both 2 couple servers. I have issue with pop3 and outlook that receives duplicate email in many cases and in some accounts. Have anyone faced any similar issue.? Any help appreciated... Best Regards Nick __________ ESET Endpoint Antivirus __________ This email was scanned, no threats were found. email from: to: with subject Outlook Duplicate emails dated 29/05/2023 - is OK Detection engine version: 27314 (20230529) https://www.eset.com

2 1

RE: LDAP olcAccess for auth_bind
by Marc 29 May '23

29 May '23

> >> > >> I really got your point, but how you will implement aliases > > has nothing to do with dovecot, sendmail can get those from ldap. > > > >> or domain > > sendmail gets these from ldap (but requires a restart) > > > >> query or maybe quota? You still need to access ldap directly for > other > >> info's. > > quotas can be/are distributed to the os by ldap. But it depends a bit > on your setup, and if you have multiple file systems. > > > >> I mean, dovecot can probably use linux login but i'm not sure about > the > >> MTA. Unless you have a fixed list of domains added manually. > >> > > I have on different servers cron jobs running, getting every 5?min > modified/created records and then do a restart or something else. All > these processes have own entity in ldap with own acls. > > sendmail can get anything you want from ldap. For outgoing mail auth, > I have sendmail use os users (which come from ldap) > > > So in the end you still access ldap from another program but not from > dovecot :) I don't get your point. The goal for using ldap is having a centralized database that distributes information. How you choose to implement this, is depending on your requirements. > You avoid to authenticate users directly only to send the credentials of > some privilleged user from postfix/sendmail/whatever script... > Not to avoid. Other applications have different needs and thus different acl's. Dovecot does not need to know a users email address or alias. Only the MTA needs to know. The relaying MTA does not need to know the user etc.

1 0

LDAP olcAccess for auth_bind
by Andrzej Milewski 28 May '23

28 May '23

Hi, I'm trying to set up a production mail server. I have installed Dovecot on Debian from the package. For authentication, I have another machine running OpenLDAP, also installed on Debian. I would like the end mail client to authenticate with Dovecot using the login and password set in LDAP. In the LDAP-related configuration, I have: auth_bind=yes base = ou=Users,dc=example,dc=com user_attrs = mail=couriermaildir:~/Maildir,homeDirectory=/home/%d/%uid/,uidNumber=uid,gidNumber=gid user_filter = (&(objectClass=posixAccount)(uid=%u)) pass_attrs = uid=user,userPassword=password,\ pass_filter = (&(objectClass=posixAccount)(uid=%u)) The LDAP user is entered as uid=user(a)example.com. With the default olcAccess permissions, it works and logs in correctly. Here are my default olcAccess settings after installation: # {1}mdb, config dn: olcDatabase={1}mdb,cn=config objectClass: olcDatabaseConfig objectClass: olcMdbConfig olcDatabase: {1}mdb olcDbDirectory: /var/lib/ldap olcSuffix: dc=example,dc=com olcAccess: {0}to dn.children="ou=Idmaps,dc=example,dc=com" attrs=userPassword, shadowLastChange,SambaLMPassword,SambaNTPassword by self write by anonymous a uth by dn="cn=samba,dc=example,dc=com" write by dn="cn=admin,dc=laktopol,dc=p l" write by * none olcAccess: {1}to dn.subtree="ou=Idmaps,dc=example,dc=com" by self write by dn= "cn=samba,dc=example,dc=com" write by dn="cn=admin,dc=example,dc=com" write b y * read olcAccess: {2}to dn.children="ou=Hosts,dc=example,dc=com" attrs=userPassword,s hadowLastChange,SambaLMPassword,SambaNTPassword by self write by anonymous au th by dn="cn=samba,dc=example,dc=com" write by dn="cn=admin,dc=example,dc=com " write by * none olcAccess: {3}to dn.subtree="ou=Hosts,dc=example,dc=com" by self write by dn=" cn=samba,dc=example,dc=com" write by dn="cn=admin,dc=example,dc=com" write by * read olcAccess: {4}to dn.children="ou=Users,dc=example,dc=com" attrs=userPassword,s hadowLastChange,SambaLMPassword,SambaNTPassword by self write by anonymous au th by dn="cn=samba,dc=example,dc=com" write by dn="cn=nsspam,dc=laktopol,dc=p l" write by dn="cn=admin,dc=example,dc=com" write by * none olcAccess: {5}to dn.children="ou=Users,dc=example,dc=com" by self write by dn= "cn=samba,dc=example,dc=com" write by dn="cn=nsspam,dc=example,dc=com" write by dn="cn=admin,dc=example,dc=com" write by * read olcAccess: {6}to filter=(objectClass=sambaDomain) by dn="cn=samba,dc=laktopol, dc=pl" write by dn="cn=admin,dc=example,dc=com" write by * read olcAccess: {7}to dn.base="dc=example,dc=com" attrs=children by dn="cn=samba,dc =laktopol,dc=pl" write by dn="cn=admin,dc=example,dc=com" write by * read olcAccess: {8}to attrs=userPassword,shadowLastChange,SambaLMPassword,SambaNTPa ssword by self write by anonymous auth by dn="cn=nsspam,dc=example,dc=com" wr ite by dn="cn=admin,dc=example,dc=com" write by * none olcAccess: {9}to attrs=shadowLastChange by self write by * read olcAccess: {10} to * by * read However, I am not satisfied with these settings because using the anonymous user, anyone can browse the entire LDAP tree. While passwords are not visible with anonymous login, user data in the LDAP domain is exposed. If I change the last olcAccess entry from "olcAccess: {10} to * by * read" to "olcAccess: {10} to * by anonymous auth," the anonymous user cannot browse LDAP, but the mail client user also cannot log in. What should be the correct configuration? -- Andrzej

4 12