- dovecot - dovecot.org

Best practice for Dovecot with LDAP and Postfix
by Moritz Pflanzer 09 May '23

09 May '23

Hi all, so far I had a setup where Dovecot was using a passwd file as userdb and passdb. Postfix was then authenticating with Dovecot via SASL to validate user accounts. Now I added an LDAP backend and would like to use that for Dovecot and Postfix. My first approach was to change the passdb to use the LDAP driver with the following settings: hosts = openldap:1389 base = ou=users,dc=example,dc=com auth_bind = yes auth_bind_userdn = uid=%n,ou=users,dc=example,dc=com And I changed the userdb driver to static since anyway there is just the vmail system account for all virtual user mailboxes. This is working as expected for the IMAP connections. But postfix authentication fails as it is apparently using a wrong user_filter. This is what I see in the logs from OpenLDAP: docker-openldap-1 | 645908ae.1d975b70 0x7fe379297700 conn=1347 fd=12 ACCEPT from IP=172.19.0.7:52144 (IP=0.0.0.0:1389) docker-openldap-1 | 645908ae.1d98571f 0x7fe379a98700 conn=1347 op=0 BIND dn="" method=128 docker-openldap-1 | 645908ae.1d993bd7 0x7fe379a98700 conn=1347 op=0 RESULT tag=97 err=0 qtime=0.000009 etime=0.000072 text= docker-postfix-1 | May 08 14:35:26 nest postfix/smtpd[12455]: 8A9FC1E03C5: client=mo4-p01-ob.smtp.rzone.de[85.215.255.51] docker-postfix-1 | May 08 14:35:26 nest postfix/cleanup[12461]: 8A9FC1E03C5: message-id=<713569303.508224.1683556526256(a)webmail.strato.de> docker-postfix-1 | May 08 14:35:26 nest postfix/qmgr[951]: 8A9FC1E03C5: from=<moritz(a)pflanzer.eu>, size=3340, nrcpt=1 (queue active) docker-postfix-1 | May 08 14:35:26 nest postfix/smtpd[12455]: disconnect from mo4-p01-ob.smtp.rzone.de[85.215.255.51] ehlo=2 starttls=1 mail=1 rcpt=1 data=1 quit=1 commands=7 docker-openldap-1 | 645908ae.2616b031 0x7fe379297700 conn=1347 op=1 SRCH base="ou=users,dc=example,dc=com" scope=2 deref=0 filter="(&(objectClass=posixAccount)(uid=moritz(a)example.com))" docker-openldap-1 | 645908ae.26179272 0x7fe379297700 conn=1347 op=1 SRCH attr=uid docker-openldap-1 | 645908ae.2619389b 0x7fe379297700 conn=1347 op=1 SEARCH RESULT tag=101 err=32 qtime=0.000017 etime=0.000221 nentries=0 text= I tried setting the user_filter manually to "user_filter = (mail=%u)" but that doesn't have any effect. Is this the expected behavior from Dovecot? I guess I can get it working by using the ldap driver for the userdb as well. But is that the best approach since I technically don't need it for dovecot itself. Or should I now change the postfix config as well to directly authenticate against the LDAP server instead of using SASL with Dovecot? Looking forward to recommendations, Moritz

7 16

Re: dmarc user can't receive email because of encrypted storage
by Aki Tuomi 09 May '23

09 May '23

> On 04/05/2023 21:08 EEST efeizbudak(a)disroot.org wrote: > > > On 2023-05-04 20:53, Aki Tuomi via dovecot wrote: > >> On 04/05/2023 20:11 EEST efeizbudak--- via dovecot > >> <dovecot(a)dovecot.org> wrote: > >> > >> > >> Hi all, > >> > >> So recently google has been trying to send email to dmarc(a)domain.com > >> on > >> my server but I'm using encrypted storage and since the dmarc user has > >> no password the email is being rejected with the error: > >> > >> May 4 16:51:50 domain dovecot: > >> lda(dmarc)<3326><l0J9NabiU2T+DAAA1iAyAg>: Error: sieve: > >> msgid=<10341808348719730099(a)google.com>: failed to store into mailbox > >> 'INBOX': generate_keypair(INBOX) failed: > >> mail_crypt_require_encrypted_user_key set, cannot generate user > >> keypair > >> without password or key > >> > >> How can I fix this, or at least read what the mail says? Would it be > >> safe to just give dmarc user a strong password? > > > > You can run > > > > doveadm mailbox cryptokey generate -U dmarc -N > > > > so the user will have a keypair generated. Then it should work. > > > > Aki > > I'm getting > > generate: invalid option -- 'N' > > should I just run it without -N ? > > Thank you! Please keep responses on the list. Try -n password? I have a faint recall of a buggy version like this. Aki

2 11

Documentation issue: incorrect link
by Tom Hendrikx 06 May '23

06 May '23

Hello, In the second paragraph at https://doc.dovecot.org/configuration_manual/sieve/extensions/duplicate/, a link is included to RFC7353, but this RFC is not related to sieve at all. I think the correct RFC to link is RFC7352, like in the first paragraph. Kind regards, Tom

1 0

amount of users
by Thomas Schäfer 05 May '23

05 May '23

Hi, is somewhere a table/matrix/function based on experience how many users require which values for mail_max_userip_connections default_client_limit default_process_limit ...? I run into problems with a small group of users, since the defaults seem to be only for single man shows. The second assumption is: User are permanently online (connected to imap) and using two devices in average (one or two desktops, + one mobile device) Regards, Thomas -- There’s no place like ::1 Thomas Schäfer (Systemverwaltung) Ludwig-Maximilians-Universität Centrum für Informations- und Sprachverarbeitung Oettingenstraße 67 Raum C109 80538 München ☎ +49/89/2180-9706 ℻ +49/89/2180-9701

1 0

dmarc user can't receive email because of encrypted storage
by efeizbudak＠disroot.org 04 May '23

04 May '23

Hi all, So recently google has been trying to send email to dmarc(a)domain.com on my server but I'm using encrypted storage and since the dmarc user has no password the email is being rejected with the error: May 4 16:51:50 domain dovecot: lda(dmarc)<3326><l0J9NabiU2T+DAAA1iAyAg>: Error: sieve: msgid=<10341808348719730099(a)google.com>: failed to store into mailbox 'INBOX': generate_keypair(INBOX) failed: mail_crypt_require_encrypted_user_key set, cannot generate user keypair without password or key How can I fix this, or at least read what the mail says? Would it be safe to just give dmarc user a strong password?

2 1

Error: read() failed for file :: No buffer space available
by rudolf＠padaru.de 04 May '23

04 May '23

Hey there, ive got a situation with one of mine mailusers he cant access his mailbox and i cant resync the mailuser or access the mails with doveadm too: In maillog we got a lot of these errors, ist only m.73 that makes problems: Error: Syncing mailbox INBOX failed: read() /mdbox/storage/m.73: No buffer space available I dont really understand whats the problem here, the partition has ~500gb free space and all other mailboxes work fine on this server. Is there somebody who can give me a hint to solve this? First i thought the mdbox file is to obig, so i increased the mdbox_rotate_size limit without success. To restart the dovecot changes nothing too. In the dovecot journal i cant find other problems wo cause in this one, same in syslog, nothing special to see, like segfaults or so. My doveconf -n: # 2.3.19.1 (9b53102964): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.19 (4eae2f79) # OS: Linux 5.4.0-146-generic x86_64 Ubuntu 20.04.6 LTS auth_mechanisms = plain login auth_username_chars = abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ01234567890.-_@üÜöÖäÄ auth_worker_max_count = 60 default_vsz_limit = 1000 M disable_plaintext_auth = no imap_capability = +XLIST imap_logout_format = in=%i out=%o del=%{deleted} fetched_mails=%{fetch_hdr_count} lda_mailbox_autocreate = yes lda_mailbox_autosubscribe = yes lock_method = flock login_log_format_elements = user=<%u> method=%m rip=%r lip=%l %c mail_always_cache_fields = date.received date.sent imap.envelope hdr.x-spam hdr.x-virus-status hdr.return-path hdr.received flags mail_cache_min_mail_count = 30 mail_location = auto: mail_max_userip_connections = 30 mail_never_cache_fields = mail_plugins = " zlib" managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext editheader imapflags notify vnd.dovecot.pipe vnd.dovecot.filter vnd.dovecot.execute mbox_read_locks = dotlock mbox_very_dirty_syncs = yes mdbox_rotate_size = 250 M namespace inbox { inbox = yes location = mailbox Archiv { auto = no special_use = } mailbox Drafts { auto = no special_use = } mailbox Junk { auto = no special_use = } mailbox Sent { auto = no special_use = } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { auto = no special_use = } prefix = } passdb { args = /etc/dovecot/conf.d/zDovecot-sql.conf.ext driver = sql } plugin { sieve = ~/sieve/.dovecot.sieve sieve_after = ~/sieve_after/.dovecot_after.sieve sieve_before = ~/sieve_before/.dovecot_before.sieve sieve_dir = ~/sieve sieve_execute_bin_dir = /usr/local/bin/ sieve_execute_input_eol = lf sieve_extensions = +notify +imapflags +vnd.dovecot.pipe +vnd.dovecot.filter +vnd.dovecot.execute +editheader -reject sieve_filter_bin_dir = /usr/local/bin/ sieve_filter_input_eol = lf sieve_global_dir = /etc/dovecot/sieve/ sieve_max_redirects = 25 sieve_pipe_bin_dir = /usr/local/bin/ sieve_pipe_input_eol = lf sieve_plugins = sieve_extprograms sieve_redirect_envelope_from = recipient zlib_save = gz zlib_save_level = 6 } protocols = imap pop3 sieve service auth-worker { idle_kill = 1 mins } service auth { idle_kill = 1 mins unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0660 user = postfix } user = root } service imap-login { executable = /usr/lib/dovecot/imap-login process_min_avail = 4 service_count = 0 user = dovecot } service imap { process_limit = 1024 } service managesieve-login { inet_listener sieve { port = 4190 } service_count = 0 user = dovecot } service managesieve { process_limit = 1024 user = dovecot } service pop3-login { executable = /usr/lib/dovecot/pop3-login process_min_avail = 4 service_count = 0 user = dovecot } service pop3 { executable = /usr/lib/dovecot/pop3 process_limit = 1024 } service stats { unix_listener stats-reader { group = dovecot mode = 0666 } unix_listener stats-writer { group = dovecot mode = 0666 } } shutdown_clients = no ssl_cert = </etc/certs/ourCert.com.pem ssl_cipher_list = EECDH+ECDSA+AESGCM:EECDH+aRSA+AESGCM:EECDH+ECDSA+SHA384:EECDH+ECDSA+SHA256:E ECDH+aRSA+SHA384:EECDH+aRSA+SHA256:EECDH+aRSA+RC4:EECDH:EDH+aRSA:!aNULL:!eNU LL:!LOW:!3DES:!MD5:!EXP:!PSK:!SRP:!DSS:!RC4 ssl_dh = # hidden, use -P to show it ssl_key = # hidden, use -P to show it ssl_prefer_server_ciphers = yes userdb { args = /etc/dovecot/conf.d/zDovecot-sql.conf.ext driver = sql } verbose_proctitle = yes protocol lda { mail_plugins = " zlib sieve zlib" rejection_reason = Your message to <%t> was automatically discarded:%n%r } protocol imap { imap_client_workarounds = delay-newmail mail_plugins = " zlib mail_log notify zlib" ssl = yes } protocol pop3 { mail_plugins = zlib pop3_client_workarounds = oe-ns-eoh outlook-no-nuls pop3_no_flag_updates = no pop3_uidl_format = %08Xu%08Xv ssl = yes } Size oft he mdbox-file: du -b m.73 262143997 m.73 Mit freundlichen Grüßen Yours sincerely <https://padaru.de/> Pascal Rudolf | Geschäftsführer PADARU-IT | Bielebohstraße 10 | 02736 Beiersdorf @: rudolf(a)padaru.de | www: <http://padaru.de/> padaru.de mobil: +49 (0) 17 772 595 32

1 0

Help - Permissions issue with new mail
by michele.clark＠us.kbr.com 03 May '23

03 May '23

Hi all. We have an install of Dovecot running with Postfix and Roundcube using virtual mail to allow us to connect to our AD domain which got messed up after a power issue. I can log into our Roundcube and see all my old emails, however new emails keep getting stuck in the CUR files with permissions of -rw------- If I chmod the email it will deliver to the inbox in Roundcube. Can anyone advise on how I can adjust this so all new emails will come thru with the correct permissions? - Thanks in advance

5 4

managesieve problem
by Soeren Malchow 25 Apr '23

25 Apr '23

Hi, i am struggeling with a managesieve problem, we are using docker mailserver and managesieve login does not work, if i understand correctly, then dovecot should offer something like this "SASL" "PLAIN" on our server it is simply empty "SASL" "" i was trying to authenticate in a telnet connection AUTHENTICATE "PLAIN" "LOGINSTRING_HERE" And i get this NO "Error in MANAGESIEVE command received by server." first of all i would like to ask where the SASL capabilites come from, how can i get it to offer "PLAIN" or "AUTH" everything else (e.g. sieve itself) just works find Cheers Soeren

2 2

dovecot sasl with postfix, smtp auth not available
by Badli Al Rashid 24 Apr '23

24 Apr '23

Hi All, I have set up dovecot sasl with postfix. When I check the smtp with ehlo there is no auth advertise. Connected to www.zystro.xyz. Escape character is '^]'. 220 www.zystro.xyz ehlo x.zystro.xyz 250-www.zystro.xyz 250-PIPELINING 250-SIZE 10485760 250-ETRN 250-STARTTLS 250-ENHANCEDSTATUSCODES 250-8BITMIME 250-DSN 250-SMTPUTF8 250 CHUNKING I did a number of installations the auth was not shown. I have use debian distributed and also dovecot packages. Sasl. root@www:~# postconf -a cyrus dovecot root@www:~# postconf -A cyrus Dovecot version. root@www:~# dovecot --version 2.3.20 (80a5ac675d) Dovecot configuration. root@www:~# dovecot -n # 2.3.20 (80a5ac675d): /etc/dovecot/dovecot.conf # OS: Linux 5.10.0-21-amd64 x86_64 Debian 11.6 # Hostname: www.zystro.xyz auth_mechanisms = plain login debug_log_path = /var/log/dovecot-debug.log info_log_path = /var/log/dovecot-info.log log_path = /var/log/dovecot.log mail_location = mbox:~/Mailbox namespace { inbox = yes location = prefix = separator = / } passdb { driver = pam } postmaster_address = postmaster(a)zystro.xyz protocols = imap service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0660 user = postfix } } service imap-login { inet_listener imap { address = 127.0.0.1,::1 port = 143 } inet_listener imaps { address = * port = 993 ssl = yes } } ssl_cert = </etc/letsencrypt/live/www.zystro.xyz/fu llchain.pem ssl_key = # hidden, use -P to show it userdb { args = blocking=no driver = passwd } I have followed the guide at postfix and dovecot but still the auth did not appear. https://doc.dovecot.org/configuration_manual/howto/postfix_and_dovecot_sasl/ https://www.postfix.org/SASL_README.html Anybody got any ideas ? Regards, -badli

6 12

dovecot-fts-solr Solr9 support
by PGNet Dev 24 Apr '23

24 Apr '23

I run dovecot-2.3.18 , & am deploying Solr search with 'dovecot-fts-solr' I run Solr standalone. When creating a dedicated 'dovecot' core, cp'ing from Dovecot's included solr schemas ls -al /usr/share/doc/dovecot/solr-* -rw-r--r-- 1 root root 12K Dec 3 06:48 /usr/share/doc/dovecot/solr-config-7.7.0.xml -rw-r--r-- 1 root root 2.7K Dec 3 06:48 /usr/share/doc/dovecot/solr-schema-7.7.0.xml -rw-r--r-- 1 root root 2.9K Dec 3 06:48 /usr/share/doc/dovecot/solr-schema.xml is tested only for Solr 7.7.0 https://doc.dovecot.org/configuration_manual/fts/solr/ "The steps described in this page are tested for Solr 7.7.0. For other versions, this these steps may need to be adjusted." which, per solr docs https://solr.apache.org/downloads.html About versions and support Version Description 9.x Current major version for feature releases (STABLE) 8.11.x Previous major version may sometimes receive critical bugfix releases 10 Next major version, yet to be released (UNSTABLE) <8.11 All older versions are End Of Life (EOL) is EOL'd and unsupported. In the dovecot 7.7.0 schema, FastLRUCache/LRUCache are used as the caching class(es), grep class=.*LRU /usr/share/doc/dovecot/solr-config-7.7.0.xml <filterCache class="solr.FastLRUCache" <queryResultCache class="solr.LRUCache" <documentCache class="solr.LRUCache" class="solr.search.LRUCache" For Solr 9, cat CHANGES.txt Upgrade Notes --------------------- ... * SOLR-13817: Deprecate legacy SolrCache implementations. Users are encouraged to transition their configurations to use org.apache.solr.search.CaffeineCache instead. (ab) running solr9 + dovecot-fts-solr search, based on the 7.7.0 schemas, results in errors, failed scan & search. Modifying the config to use CaffeineCache cp solr-config-7.7.0.xml solr-config-9.0.0.xml perl -pi -e '\ s|solr.FastLRUCache|solr.CaffeineCache|g; \ s|solr.LRUCache|solr.CaffeineCache|g; \ s|solr.search.LRUCache|solr.search.CaffeineCache|g;' \ solr-config-9.0.0.xml appears to do the trick. Atm, indexing & search -- both manually triggered, and on delivery receipt to Dovecot store -- is working with no errors (yet). I've not tested exhaustively yet, & don't know if this Cache class change in the schema is both necessary & sufficient for dovecot-fts-solr search use with solr 9.0.0 Given that for Solr "<8.11 All older versions are End Of Life (EOL)" it'd be useful for Dovecot to 'retest' for current, not-EOL'd Solr, and publish/package compatible schemas accordingly.

5 8