- dovecot - dovecot.org

Dovecot v2.4.0 released
by Aki Tuomi 16 Feb '25

16 Feb '25

Hi all, after a very long wait we are finally happy to release Dovecot v2.4.0! Some IMPORTANT things to notice: - We have changed the signing key for 2.4 going forward, releases are signed with EF0882079FD4ED32BF8B23B2A1B09EF84EDC5219, which can be found at https://repo.dovecot.org/DOVECOT-REPO-GPG-2.4 and is signed with the previous key. The old key has been renamed to https://repo.dovecot.org/DOVECOT-REPO-GPG-2.3. - New 2.4 packages **are not** compatible with old 2.3 configuration, please carefully review https://doc.dovecot.org/2.4.0/installation/upgrade/2.3-to-2.4.html before installing the new packages. - We are happy to provide experimental arm64 support in the form of a Docker image. - Docker images are now ran rootless, with UID 1000 as vmail using built sources. Please take this into consideration when upgrading. Latest 2.3 image can be used with tag 2.3-latest, if you are not ready for this change. We won't be sending separate mail about Pigeonhole anymore as we will release one anyways when we release Dovecot, and Pigeonhole versioning has been changed to match Dovecot versioning. Source codes available at - https://www.dovecot.org/releases/2.4/dovecot-2.4.0.tar.gz - https://www.dovecot.org/releases/2.4/dovecot-2.4.0.tar.gz.sig - https://pigeonhole.dovecot.org/releases/2.4/dovecot-pigeonhole-2.4.0.tar.gz - https://pigeonhole.dovecot.org/releases/2.4/dovecot-pigeonhole-2.4.0.tar.gz… Binary packages in https://repo.dovecot.org/ Docker images in https://hub.docker.com/r/dovecot/dovecot Kind regards, Aki Tuomi Open-Xchange oy --- Dovecot Core NEWS ----------------- * config: dovecot_config_version must be the first non-comment line in configuration file. * config: dovecot_storage_version must be in the configuration file. * config: Many configuration options have changed so old configuration files do not work without rewrite. See https://doc.dovecot.org/main/installation/upgrade/2.3-to-2.4.html * config: New variable expansion syntax has been introduced, see https://doc.dovecot.org/main/core/settings/variables.html * config: Some default settings have changed. * config: plugin {} section has been removed. * *-login: With ssl=required, connections from login_trusted_networks are now also required to be SSL/TLS encrypted. * acl: Use ACL settings instead of Global ACL Directories. * auth-worker: auth_worker_max_count is replaced with service auth-worker { process_limit }. * auth: Weak password schemes are disabled by default, use auth_allow_weak_schemes to enable them. * auth_debug, mail_debug: Use log_debug filter instead. * config: All sections require a name, for example passdb/userdb: passdb static { password=secret } * db2: Remove Berkeley DB support. * dict-memcached: This is removed, use Redis instead. * director: Feature has been removed. See potential replacement at https://github.com/dovecot/tools/blob/main/director.lua * doveadm: USER environment variable is only supported with --no-userdb-lookup. One of -u, -F or -A must be used otherwise. * doveconf: Option -n is now default when running doveconf. * dsync: Use doveadm sync instead, legacy symlink has been removed. * fs-sis: Feature is now deprecated and has been made read-only. It will be removed in future release. * fts-lucene, fts-squat: These have been removed, use fts-flatcurve or fts-solr instead. * imap-login: IMAP compression is now handled in proxies. * imap_quota: SETQUOTA / quota_set has been removed. * imap_zlib: This plugin is no longer needed, it's always enabled. * imapc: All features are enabled by default, imapc_features can be used to explicitly disable features that are not wanted. * lib-storage: mbox driver is now frozen. * mail_compress: XZ and LZMA algorithm support has been removed. * mailbox-alias: Plugin has been removed. * old_stats, auth_stats: These have been removed. * openssl: Minimum supported version of OpenSSL is now 1.1.1. * openssl: Add support for OpenSSL 3.x * quota-dict, quota-dirsize: These have been removed, use quota-count instead. You can use quota_clone to copy quota usage to some database. * replicator: Feature has been removed. Use NFS or some other shared filesystem instead, or run doveadm sync in crontab. * stats: The bytes_in and bytes_out field in several events have been renamed as net_in_bytes and net_out_bytes. * zlib: Renamed to mail_compress plugin. + Experimental SMTPUTF8 and IMAP UTF8=ACCEPT support has been added. Needs --enable-experimental-mail-utf8 configure option and mail_utf8_extensions=yes setting. + Long running mail commands can be aborted with Ctrl-C / doveadm kick. + auth: LDAP driver now supports multi-value attributes. + auth: Add support for SCRAM-SHA-1-PLUS and SCRAM-SHA-256-PLUS. + auth: Add support for TLS channel binding. + auth: Support sending JA3 hash to policy server. + configure: Detect latest Lua version. + *-login: Support for TLS Server Name has been improved to allow pre-login settings. For example capabilities to be changed based on TLS Server Name. + *-login: Support for TLS ALPN has been added, connections with mismatching application are now refused. Missing ALPN is accepted. + fts-flatcurve: New Xapian based FTS plugin has been added. + imap: Support for INPROGRESS untagged messages as per RFC 9585. + lib-lua: Expose Dovecot DNS client. + lib-lua: Expose Dovecot HTTP client. + lib-sasl: Support SCRAM-SHA mechanisms. + lmtp: SNI support has been added which allows settings to be applied based on TLS Server Name. + sqlite: Support WAL mode. + stats: Submetric name size has been increased. + submission: Add submission_add_received_header setting to protect sender identity by suppressing the Received: header. - Many bugs have been fixed. Pigeonhole NEWS --------------- * Change configuration syntax to match new Dovecot configuration syntax. * vacation: Reduce default days to 60 from infinity * vacation: vacation_max_period=0 is now an error. * Version has been changed to match Dovecot version. + Added i;unicode-casecmp comparator. - Lots of bugs have been fixed.

21 49

Doveadm backup and sieves
by Doug Hardie 15 Feb '25

15 Feb '25

I am using doveadm backup to backup mailfiles to a second drive. That works just fine. However, the sieve files are not backed up. I couldn't find anything in the backup documentation that addresses sieves. Is there a way to back those up also? -- Doug

1 0

Segfault Errors
by Asai 15 Feb '25

15 Feb '25

Greetings, I just migrated over to Dovecot 2.4.0-2 on a new VM running Alma 9. Everything seems to be working fine but I'm noticing these errors on the VM console every couple of hours. Is this something that I can fix with system settings, or something that I can ignore? Were running the mailstore on NFS, if that's anything. Thanks for your assistance. Here's an example: [224035.047834] imap[119919]: segfault at 160 ip 00007f430f850d3b sp 00007ffff874fcf0 error 4 in libdovecot.so.0.0.0[7f430f4a0a80+138000] likely on CPU 0 (core 0, socket 0) [224035.048074] Code: ff 48 c7 c5 48 b6 0c 80 00 00 48 89 d5 3c b6 0c 80 00 48 83 c4 08 5b 41 5c c3 0f 1f 80 f3 0f 1e fa 4 55 48 89 e5 53 <48> 8b bf 60 01 80 48 05 ff 74 51 48 89 f3 31 f6 e8 ef d7 ef ff [224058.098121] imap[119971]: segfault at 160 ip 00007f395e15d3b sp 00007ffff6e43b60 error 4 in libdovecot.so.0.0.0[7f395e0fa0a0+138000] likely on CPU 0 (core 0, socket 0) [224059.896511] Code: ff 48 c7 c5 48 b6 0c 80 00 00 48 89 d5 3c b6 0c 80 00 48 83 c4 08 5b 41 5c c3 0f 1f 80 f3 0f 1e fa 4 55 48 89 e5 53 <48> 8b bf 60 01 80 48 05 ff 74 51 48 89 f3 31 f6 e8 ef d7 ef ff [224268.735121] imap[119917]: segfault at 160 ip 00007f9e4335d3b sp 00007ffff6d12ab0 error 4 in libdovecot.so.0.0.0[7f9e4324a0b0+138000] likely on CPU 0 (core 0, socket 0) [224268.736464] Code: ff 48 c7 c5 48 b6 0c 80 00 00 48 89 d5 3c b6 0c 80 00 48 83 c4 08 5b 41 5c c3 0f 1f 80 f3 0f 1e fa 4 55 48 89 e5 53 <48> 8b bf 60 01 80 48 05 ff 74 51 48 89 f3 31 f6 e8 ef d7 ef ff Asai

2 1

lmtp "Saved" but no maildir file
by MRob 15 Feb '25

15 Feb '25

Hello I have accounts with Maildir (mail_location is empty/default) and postfix using lmtp for delivery. Some account create new file in Maildir/new after each deliver. However a couple account I see lmtp successful delivery but no new file anywhere in the Maildir: lmtp(21379): Connect from local lmtp(me)<21379><Mbc+GgTmrofPHw4vAMIs8i>: msgid=<...trimmed...>: saved mail to INBOX 370A131BE: to=<me(a)example.com>, relay=email.example.com[private/dovecot-lmtp], delay=0.3, delays=0.22/0.01/0.02/0.01, dsn=2.0.0, status=sent (250 2.0.0 <me(a)example.com> Mbc+GgTmrofPHw4vAMIs8i Saved) lmtp(21379): Disconnect from local: Logged out (state=READY) /home/me/Maildir/new is empty and also try "find /home/me/Maildir -type f | wc -l" but no different before/after Very interesting I can see trace of message in dovecot cache! "grep -r 'domain.from.message.id' /home/" (search all accounts) says: grep: /home/me/Maildir/dovecot.index.cache: binary file matches So dovecot put traces of message into Maildir but no message file after successful "Saved" in logs. What can I do?

2 2

dovecot with libsodium on macos 10.13
by Jan Henk Koning 14 Feb '25

14 Feb '25

L.S. My name is Jan Henk Koning I am from the Netherlands and i would like youre help on the following subject. I saw a lot of reactions of you online in regards to questions about getting ARGON2I password hashing scheme available in dovecot. I tried a lot of suggestions and even installed / compiled your dovecot-libsodium-plugin-master which needed a lot of debugging on my system. Unfortunately I can not get it to work. I have dovecot 2.3.21.1 (d492236fa0) installed via macports. I also have mysql8 and php83 all via macports. I understood that I needed to have libsodium installed, so I also installed that via Macports. The problem is that I can not find the way to tell dovecot to use the libsodium plugin. I tried "!include sodium.h" in my 10-auth.conf file, but that does not work. I also edited the portfile of dovecot with the line "--with sodium" no succes. sudo doveadm pw -l gives me: SHA1 SSHA512 SCRAM-SHA-256 BLF-CRYPT PLAIN HMAC-MD5 OTP SHA512 SHA DES-CRYPT CRYPT SSHA MD5-CRYPT PLAIN-MD4 PLAIN-MD5 SCRAM-SHA-1 CLEAR CLEARTEXT SSHA256 MD5 PBKDF2 SHA256 CRAM-MD5 PLAIN-TRUNC SMD5 DIGEST-MD5 LDAP-MD5 I can not find specific instructions for dovecot and sodium installed via Macports on macos. Can you maybe help me in the right direction ? Many thanks in advance, Best regards, Jan Henk Koning

2 1

Migrating from 2.3 to 2.4 Maildir Config Problems
by Asai 13 Feb '25

13 Feb '25

Greetings, We've been using Dovecot since 2007, and I'm migrating yet again to a new version of Dovecot. Going from 2.3 to 2.4 and a lot of things have changed. I've been able to manage many of them, but I'm stuck on Maildir configuration, and I'm unable to understand the documentation as relates to this. Hopefully someone can clarify. Error: Initializing mail storage from mail_driver=maildir setting failed: maildir: maildir settings: Failed to parse configuration: Failed to override configuration from userdb: Invalid maildir=gcmm.net/test/: Setting is a named filter, use 'maildir {' Here's my doveconf as it has been migrated from 2.3 to 2.4 thus far. I realize that there are probably better ways to do things and I'm open to suggestions, but keep in mind that this is a production set up with hundreds of users and I've tried to maintain backwards compatibility through the years. Thanks for your assistance, Asai # 2.4.0 (daeb6bc59c): /etc/dovecot/dovecot.conf # Pigeonhole version 2.4.0 (1b2d5bb9) # OS: Linux 5.14.0-503.23.1.el9_5.x86_64 x86_64 AlmaLinux release 9.5 (Teal Serval) xfs # Hostname: xxxxx dovecot_config_version = 2.4.0 auth_allow_weak_schemes = yes auth_mechanisms = auth_mechanisms { plain = yes login = yes } auth_verbose_passwords = plain debug_log_path = /var/log/dovecot-debug.log default_vsz_limit = 512M deliver_log_format = msgid=%{msgid}: from=%{from}: %{deliver_log_format_extras} dovecot_storage_version = 2.4.0 hostname = xx.xxxx.xxxx log_path = /var/log/dovecot.log mail_driver = maildir mail_fsync = always #mail_home = /vmail/%{user | domain }/%{user | username }/home mail_log_events { delete = yes undelete = yes expunge = yes copy = yes mailbox_delete = yes mailbox_rename = yes flag_change = yes append = yes } mail_log_fields { uid = yes box = yes msgid = yes from = yes flags = yes } #mail_path = /vmail/%{user | domain }/%{user | username } mmap_disable = yes protocols { imap = yes lmtp = yes sieve = yes } sql_driver = mysql submission_relay_host = xxxx.xxxx.xxxxx submission_relay_port = 587 submission_relay_ssl = starttls submission_relay_trusted = yes syslog_facility = local5 mysql localhost { dbname = xxxx password = xxxxx user = postfix } passdb sql { default_password_scheme = PLAIN-MD5 query = SELECT password FROM mailbox WHERE username = '%{user}' } userdb sql { iterate_query = select username from mailbox; query = SELECT maildir, concat('/vmail/',maildir,'home') as home, 1001 AS uid, 1001 AS gid FROM mailbox WHERE username = '%{user}' and active = 1 } #namespace inbox { # inbox = yes # prefix = # separator = / # type = private #mailbox Drafts { # auto = subscribe # special_use { # "\\Drafts" = yes # } #} #mailbox Junk { # auto = subscribe # special_use { # "\\Junk" = yes # } #} #mailbox Spam { # special_use { # "\\Junk" = yes # } #} #mailbox Trash { # auto = subscribe # special_use { # "\\Trash" = yes # } #} #mailbox Sent { # auto = subscribe # special_use { # "\\Sent" = yes # } #} #mailbox "Sent Messages" { # special_use { # "\\Sent" = yes # } #} #mailbox "Sent Items" { # special_use { # "\\Sent" = yes # } #} #} #namespace empty { # prefix = # separator = / # alias_for = inbox # subscriptions = yes # mailbox_list_index_prefix = #} maildir { broken_filename_sizes = yes mail_path = /vmail/%{user | domain }/%{user | username } mail_home = /vmail/%{user | domain }/%{user | username }/home } service imap-login { restart_request_count = unlimited inet_listener imap { port = 143 } inet_listener imaps { port = 993 ssl = yes } } service lmtp { vsz_limit = 512M unix_listener /var/spool/postfix/private/dovecot-lmtp { group = postfix mode = 0660 user = postfix } } service imap { process_limit = 4096 vsz_limit = 1024 MB } service auth { user = root unix_listener auth-master { group = vmail mode = 0660 user = vmail } unix_listener auth-userdb { group = vmail mode = 0666 user = vmail } unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0660 user = postfix } } service auth-worker { } service dict { unix_listener dict { } } ssl_server { cert_file = /etc/postfix/ssl/server.pem dh_file = /etc/dovecot/dh.pem key_file = /etc/postfix/ssl/server.key } service stats { unix_listener stats-reader { group = vmail mode = 0660 user = vmail } unix_listener stats-writer { group = vmail mode = 0660 user = vmail } } protocol lda { } protocol imap { mail_max_userip_connections = 20 mail_plugins { mail_log = yes notify = yes } } protocol lmtp { mail_plugins { sieve = yes } } service managesieve-login { process_min_avail = 0 restart_request_count = 1 vsz_limit = 64M inet_listener sieve { port = 4190 } } service managesieve { process_limit = 1024 } sieve_script personal { active_path = /vmail/%{user | domain }/%{user | username }/home/.dovecot.sieve driver = file path = /vmail/%{user | domain }/%{user | username }/home/sieve } sieve_script before { path = /vmail/sieve/junk-spam.sieve type = before } sieve_script after { path = /vmail/sieve/junk-spam.sieve type = after } mail_debug = yes auth_verbose = yes auth_debug = yes auth_debug_passwords = yes log_debug = category=mail

2 4

Mustiple domains
by Ken Wright 13 Feb '25

13 Feb '25

I host two email servers, example1.com and example2.net. How can I configure Dovecot 2.4 to distinguish between the two? Ken

6 13

Re: suggestion: Argon2id example in `doveadm pw` examples
by Michael Slusarz 13 Feb '25

13 Feb '25

> On 02/08/2025 10:31 PM MST Sean McBride via dovecot <dovecot(a)dovecot.org> wrote: > > It says here https://www.dovecot.org/bugreport-mail/ that bug reports should go to this list. Does that apply to suggestions too? Assuming so... Best practice these days is to file a bug report (or MR) to GitHub. https://github.com/dovecot/ shows the various Dovecot components. We are actively working on improving our various websites, so this updated recommendation will (eventually) work its way on the pages somewhere. > The docs here are very good: > > https://doc.dovecot.org/main/core/man/doveadm-pw.1.html > > but it's always nice to have examples of current best practice. As I understand it, the best password hashing algorithm these days is Argon2id, according to: > > https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet… > > So it would be nice to have an example corresponding to best practices, showing use of argon2id. > > I could attempt a PR on GitHub if you'd like. That would be the proper way to suggest. Do note: as mentioned in another message to the list I just sent, the mission of the Dovecot documentation is to document how the software works. It is not to document email server hosting best practices. Determination of which PW hashing algorithm to use seems to be in the latter category. (Documenting that Dovecot supports argon2id is in scope per the former, but it sounds like we did our job there.) michael

3 2

Dovecot's default password storage scheme is not GDPR compliant
by Rupert Gallagher 13 Feb '25

13 Feb '25

Dovecot aligns the password encryption scheme used by the imap client with the password storage scheme used by the server. Since the default is set to plain text, the client sends the password in plain text (tls tunneled), and the server local storage of passwords is a plain text file. For minimum protection, just enough to say you are not using plaintext, you can use md5, so the client sends the hashed password and the server's local storage is a plain text file containing hashed passwords. Last year a GDPR commissioner filed a hefty monetary sanction to a company because they used md5 to store passwords. Therefore, Dovecot's plain text default, and the md5 option, are both non-GDPR compliant. To avoid monetary sanctions, Dovecot ought to change how it stores passwords by default. Please do not ignore this message.

10 17

dovecot 2.4.0: Unable to build without LDAP/LUA headers/libs.
by h_y_i_e_n＠yahoo.com 13 Feb '25

13 Feb '25

I'm getting LDAP/LUA build errors with dovecot 2.4.0 even when --without-lua and --without-ldap is specified: eg. In file included from db-ldap-settings.c:9: ../../src/lib-ldap/ldap-settings-parse.h:4:10: fatal error: ldap.h: No such file or directory 4 | #include <ldap.h> | ^~~~~~~~ compilation terminated. make[3]: *** [Makefile:2134: auth-db-ldap-settings.o] Error 1

3 2