September 2023 - dovecot

Can Dovecot Use Wildcard TLS Certificates?
by duluxoz 07 Nov '23

07 Nov '23

Hi All, Quick Q: Can dovecot use wildcard TLS Certificates? I'm having issues with a new dovecot/postfix stack set-up and I can't get mutt on the local box to connect via imap - its coming back with an SSL error, and as I'm using a wildcard cert for the domain I was wondering if that was my issue. If dovecot can use wildcard certs then I'll look elsewhere in my troubleshooting. Thanks in advance Cheers Dulux-Oz

8 7

{ldap:objectGUID} returns binary data when used for user_attrs
by Andreas Haerter 26 Oct '23

26 Oct '23

Hi, there is an environment in which I have to use MS Active Directory for authentication and mail server user database, and I've run into a problem. I. The problem I want to retrieve the objectGUID attribute for the homedir path of the users. This attribute does never change, even when the username does or the account gets moved to another AD domain. However, the objectGUID is returned as binary gibberish when using the following setting: > user_attrs = \ > =home=/var/vmail/example.com/%LT{ldap:objectGUID}, \ It results in > # doveadm user uTesting > field value > user utesting > home /var/vmail/example.com/d ��n�aa_ o�� > mail maildir:~/mail Can someone reproduce this or offer a workaround? The only idea I had was hashing the value using =%M{ldap:objectGUID}. However, this approach would become problematic if the behavior changes and a proper string representation is returned, as expected, instead of the binary data. Therefore, I'm hesitant to use this method for now. A better approach would be encoding it as Base64, but I was unsuccessful to identify a fitting modifier at <https://doc.dovecot.org/configuration_manual/config_file/config_variables/#…>. Any ideas? II. Additional info Using other attributes for LDAP/Active Directory works as expected. E.g. > =home=/var/vmail/example.com/%LT{ldap:sAMAccountName} results in > # doveadm user uTesting > field value > user utesting > home /var/vmail/example.com/utesting > mail maildir:~/mail The objectGUID is indeed binary data, but IHMO, it should be handled differently when returned. E.g. there is a defined string representation, [MS-DTYP] section 2.3.4.3: <https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-dtyp/222af…> which links to: > curly braced GUID string: The string representation of a 128-bit > globally unique identifier (GUID) using the form > {XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX}, where X denotes a hexadecimal > digit. The string representation between the enclosing braces is the > standard representation of a GUID as described in [RFC4122] section 3. > Unlike a GUIDString, a curly braced GUID string includes enclosing braces. Some libs simply decide to return the data Base64 encoded (which would be OK, too). E.g. openldap-clients / ldapsearch does so with objectGUID and objectSid: > $ ldapsearch [...] > [...] > # uTesting, common, user, managed, example.com > dn: CN=uTesting,OU=common,OU=user,OU=managed,DC=example,DC=com > [...] > name: uTesting > objectGUID:: RCDirQPvGU6KQUFfIE/i2Q== > [...] > objectSid:: AQUAAAAAAAUVAAAALenCqsullBUfFoubWQQAAA== > [...] > sAMAccountName: uTesting > [...] Other software had comparable bugs or behavior , e.g. sssd ("Properly handle AD's binary objectGUID"): <https://bugzilla.redhat.com/show_bug.cgi?id=1205382> <https://github.com/SSSD/sssd/issues/3629> owncloud ("ensure that objectguid or guid really return binary data before converting it"): <https://github.com/owncloud/core/issues/8317> III. Software versions, config I can reproduce the issue on Fedora Server 38 > # cat /etc/redhat-release > Fedora release 38 (Thirty Eight) > # uname -r > 6.4.15-200.fc38.x86_64 > # dovecot --version > 2.3.20 (80a5ac675d) and CentOS 9 Stream: > # cat /etc/redhat-release > CentOS Stream release 9 > # uname -r > 5.14.0-364.el9.x86_64 > # dovecot --version > 2.3.16 (7e2e900c1a) I did not try a Debian-based distro yet. The config itself works fine, relevant settings just for reference (as there are not many examples on the internet, maybe useful for somebody): > auth_username_format = %Lu > > passdb { > driver = ldap > args = /etc/dovecot/dovecot-ldap.conf.ext > } > userdb { > driver = ldap > args = /etc/dovecot/dovecot-ldap-userdb.conf.ext > } with the following options to exclude inactive accounts, search smtp proxy addresses and having a mandatory group membership in SERVICE_EmailUsers: > base = OU=common,OU=user,OU=managed,DC=example,DC=com > scope = subtree > > user_filter = \ > (& \ > (objectClass=user) \ > (objectCategory=Person) \ > (|(sAMAccountName=%{username})(mail=%{username})(proxyAddresses=smtp:%{username}@%{domain})) \ > (!(userAccountControl:1.2.840.113556.1.4.803:=2)) \ > (memberOf:1.2.840.113556.1.4.1941:=SERVICE_EmailUsers) \ > ) > pass_filter = \ > (& \ > (objectClass=user) \ > (objectCategory=Person) \ > (|(sAMAccountName=%{username})(mail=%{username})(proxyAddresses=smtp:%{username}@%{domain})) \ > (!(userAccountControl:1.2.840.113556.1.4.803:=2)) \ > (memberOf:1.2.840.113556.1.4.1941:=SERVICE_EmailUsers) \ > ) I will blog about the config in more detail at https://foundata.com/en/blog/ soon, especially when the objectGUID is solved (maybe hashing it really the way to go). :-) Regards, Andreas -- foundata GmbH Steinhäuserstr. 20 76135 Karlsruhe Sitz der Gesellschaft: Karlsruhe Registergericht: Amtsgericht Mannheim, HRB 714807 Geschäftsführer: Andreas Haerter USt-IdNr.: DE284122682

1 1

Debian package for bookworm
by Claudio Corvino 14 Oct '23

14 Oct '23

Hi guys, I updated to Debian 12 but I can't find repo for bookworm on https://repo.dovecot.org/. When it will be released? Thanks! -- Claudio

8 10

bug report: lmtp fails on root-squashed NFS filesystem
by Anne Bennett 09 Oct '23

09 Oct '23

Hi, all. I'm trying to set up Postfix with dovecot LTMP delivery on a host where the user files (/var/spool/mail as well as home directories) are on NFS filesystems, which are exported root-squashed to the mail server. I definitely don't want to give the mail server root permissions on the user files. LMTP delivery fails with this logged message (e.g.): Nov 16 17:51:36 lust dovecot: lmtp(anne)<16830><mkkzEPg1lGG+QQAAs/mAJw>: msgid=<202111162229.1AGMTfAO024765(a)vindemiatrix.encs.concordia.ca>: save failed to INBOX: Read-only mbox I found this posting where someone else had a similar problem and traced it in some detail back in 2019: https://dovecot.org/list/dovecot/2019-February/114611.html but apparently no one answered the fellow. In order to check that this is indeed the same problem, I temporarily changed the INBOX definition to make it write into /var/tmp/ (on a local filesystem), and delivery worked. I then temporarily changed the INBOX definition to make it write into an NFS filesystem with root NOT squashed, and again it worked (after I chmodded the directory to 1777 to allow any user to create a file). I believe that the person who wrote the above posting is correct: at some point, file access is (incorrectly) checked as root instead of as the target user. This is a bit of a showstopper for me. Any plans to address this? I attach the output of "dovecot -n", fwiw, but I don't think that this is a configuration problem... Anne. -- Ms. Anne Bennett, Senior Sysadmin, ENCS, Concordia University, Montreal H3G 1M8 anne(a)encs.concordia.ca +1 514 848-2424 x2285

2 4

Compression: all or nothing?
by Alex King 02 Oct '23

02 Oct '23

Using 2.3.13 (89f716dc2) (debian package), with mdbox storage. I considering adding the zlib plugin. I understand that reading mail can cope with either compressed or uncompressed mailboxes. I'm wondering if I can leave the main storage uncompressed, while having the alternate storage compressed. There does not seem to be a way to configure this, from https://doc.dovecot.org/settings/plugin/zlib-plugin/ it seems compression (on saving emails) is an all-or-nothing option? Can I leave zlib_save unset in my main configuration, and have doveadm use some alternate configuration with zlib_save set? It doesn't look hopeful because I don't see the ability to use a different config at https://wiki.dovecot.org/Tools/Doveadm/Altmove. Perhaps I would need multiple copies of the daemon running? Or is it better just to compress everything? I plan to store older mails (perhaps 3months+) in the alternative storage, and was thinking it would be nice to have those compressed, while I don't need to compress the main store. Any feedback welcome. Thanks, Alex

2 2

Separators and shared namespaces
by Francis Augusto Medeiros-Logeay 28 Sep '23

28 Sep '23

Hi Martin, I had a similar problem: https://dovecot.org/mailman3/archives/list/dovecot@dovecot.org/thread/DNHM3… It seemed to me that using ‘.’ truncated the domain name when that was used in the paths, such as when using %d. Best, Francis

2 1

How to use http api doveadm to manage acl permissions
by cyril.leclerc＠mantiq.com 28 Sep '23

28 Sep '23

I started the http api on dovecot configuration but following the documentation available here : https://doc.dovecot.org/admin_manual/doveadm_http_api/ I dont see anything regarding the acl permissions ? do we have to use a specific command ? how to manage a user acl permissions ( change the content of dovecot-acl file ?

3 10

Re: Dovecot lda-dupes
by Francis Augusto Medeiros-Logeay 28 Sep '23

28 Sep '23

Hi, I have read elsewhere that the Maildir shouldn’t be at the home. But that’s how it worked for me since the start. I wonder if I could either change the location of these .dovecot.lda-dupes, or if I could change home without having to move the mailboxes of all the users. Today I have this: On my dovecot-sql.conf.ext: iterate_query = SELECT username AS user FROM mailbox user_query = SELECT CONCAT('/var/mail/vmail/',maildir) AS home, \ CONCAT('maildir:/var/mail/vmail/',maildir,':INDEX=/var/vmail-index/index/%d/%n:CONTROL=/var/vmail-index/control/%d/%n') AS mail, \ 5000 AS uid, 5000 AS gid, CONCAT('*:bytes=',quota) AS quota_rule \ FROM mailbox WHERE username = '%u' AND active = 1 password_query = SELECT username AS user,password FROM mailbox \ WHERE username = '%u' AND active=‘1' On my 10-mail.conf mail_location = maildir:/var/mail/vmail/%d/%n:INDEX=/var/vmail-index/index/%d/%n:CONTROL=/var/vmail-index/control/%d/%n If I add `Maildir` to the mail_location and to the mail user_query, will I have to move mailboxes, or the only thing I have to do is to add “Maildir” when I use %h/%%h? Best, Francis

1 0

Re: Dovecot lda-dupes
by Francis Augusto Medeiros-Logeay 28 Sep '23

28 Sep '23

Never mind, I found it. I had to add `replication_dsync_parameters`, with the default values, but with `-x shared` to exclude the namespace. Best, Francis

1 0

Dovecot lda-dupes
by Francis Augusto Medeiros-Logeay 27 Sep '23

27 Sep '23

Hi, Since I enabled shared mailboxes I'm having these errors: Sep 27 21:22:41 doveadm(francis(a)med-lo.eu): Error: Failed to access mailbox dovecot/lda-dupes: stat(/var/mail/vmail/med-lo.eu/francis/.dovecot.lda-dupes/tmp) failed: Not a directory And replication stopped. How can I fix this? Best, Francis

1 0