- dovecot - dovecot.org

auth_policy_server vs client_id and x-originating-ip
by Zdeněk Zámečník 01 Jun '20

01 Jun '20

I run into troubles when trying to set up auth_policy_server in Dovecot 2.3.10.1. It works almost as expected but I cannot get client ID in this process. By setting up "imap_id_log=*" I see in log that Dovecot gets details about mail client like name and version: May 31 14:20:58 mail dovecot: imap(xxx(a)example.xxx)<24796><ft7ytfCmjdZWMSZQ>: ID sent: name=Thunderbird, version=68.8.1 But the auth_policy_server is getting all details except this ID, it's empty: May 31 14:20:58 mail auth-policy[10357]: { May 31 14:20:58 mail auth-policy[10357]: device_id: '', May 31 14:20:58 mail auth-policy[10357]: login: 'xxx(a)example.xxx', May 31 14:20:58 mail auth-policy[10357]: protocol: 'imap', May 31 14:20:58 mail auth-policy[10357]: pwhash: '097a', May 31 14:20:58 mail auth-policy[10357]: remote: '1.2.3.4', May 31 14:20:58 mail auth-policy[10357]: tls: true May 31 14:20:58 mail auth-policy[10357]: } However in some cases I see that client_id is passed to auth_policy_server: May 31 14:27:41 mail auth-policy[10357]: { May 31 14:27:41 mail auth-policy[10357]: device_id: '"name" "Outlook-iOS-Android" "version" "2.0"', May 31 14:27:41 mail auth-policy[10357]: login: 'yyy(a)example.xxx', May 31 14:27:41 mail auth-policy[10357]: protocol: 'imap', May 31 14:27:41 mail auth-policy[10357]: pwhash: '0b63', May 31 14:27:41 mail auth-policy[10357]: remote: '3.4.5.6', May 31 14:27:41 mail auth-policy[10357]: tls: true May 31 14:27:41 mail auth-policy[10357]: } I think I am missing some important point. Maybe IMAP command ID and client_id are totally different. Can you please advise? Is it possible to pass details about mail client to auth_policy_server? Second question is: how I can get "x-originating-ip" from ID command to auth_policy_server? Below is my config file: # 2.3.10.1 (a3d0e1171): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.10 (67bf5bd7) # OS: Linux 5.3.18-2-pve x86_64 Debian 10.4 # Hostname: mail.z-technics.com auth_cache_size = 2 M auth_cache_ttl = 5 mins auth_master_user_separator = * auth_mechanisms = plain login auth_policy_check_before_auth = no auth_policy_hash_nonce = # hidden, use -P to show it auth_policy_report_after_auth = no auth_policy_server_timeout_msecs = 1500 auth_policy_server_url = http://127.0.0.1:8090/ dict { acl = pgsql:/etc/dovecot/dovecot-dict-sql.conf.ext quota = pgsql:/etc/dovecot/dovecot-dict-sql.conf.ext } disable_plaintext_auth = no imap_client_workarounds = delay-newmail imap_hibernate_timeout = 5 secs imap_id_log = * imap_id_retain = yes login_trusted_networks = 127.0.0.1 mail_gid = 2000 mail_home = /var/vmail/%d/%n mail_location = mdbox:~/mdbox:ALT=/var/vmail-archive/%d/%n/mdbox mail_max_userip_connections = 60 mail_plugins = acl zlib fts quota mail_uid = 2000 managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext vacation-seconds editheader imapsieve vnd.dovecot.imapsieve mdbox_rotate_interval = 1 days mdbox_rotate_size = 16 M passdb { args = /etc/dovecot/dovecot-ldap.conf driver = ldap } passdb { args = /etc/dovecot/masters.db driver = passwd-file master = yes pass = yes } plugin { acl = vfile acl_shared_dict = proxy::acl imapsieve_mailbox1_before = file:/var/vmail/sieve/report-spam.sieve imapsieve_mailbox1_causes = COPY imapsieve_mailbox1_name = Spam imapsieve_mailbox2_before = file:/var/vmail/sieve/report-ham.sieve imapsieve_mailbox2_causes = COPY imapsieve_mailbox2_from = Spam imapsieve_mailbox2_name = * imapsieve_mailbox3_before = file:/var/vmail/sieve/report-spam.sieve imapsieve_mailbox3_causes = COPY imapsieve_mailbox3_name = Junk imapsieve_mailbox4_before = file:/var/vmail/sieve/report-ham.sieve imapsieve_mailbox4_causes = COPY imapsieve_mailbox4_from = Junk imapsieve_mailbox4_name = * mailbox_alias_new = Sent Messages mailbox_alias_new2 = Sent Items mailbox_alias_new3 = Deleted Items mailbox_alias_old = Sent mailbox_alias_old2 = Sent mailbox_alias_old3 = Trash quota = dict:User quota::proxy::quota quota_grace = 10%% quota_rule2 = Trash:ignore quota_rule3 = Junk:ignore quota_warning = storage=80%% quota-warning 90 %u quota_warning2 = storage=85%% quota-warning 95 %u quota_warning3 = storage=95%% quota-warning 105 %u sieve = /var/vmail/%d/%n/sieve/.sieve sieve_after = /var/vmail/%d/%n/sieve/autoreply.sieve sieve_before = /var/vmail/sieve/global.sieve sieve_dir = /var/vmail/%d/%n/sieve sieve_extensions = +editheader +vacation-seconds sieve_global_dir = /var/vmail/sieve/ sieve_global_extensions = +vnd.dovecot.pipe +vnd.dovecot.environment sieve_max_redirects = 20 sieve_pipe_bin_dir = /usr/lib/dovecot sieve_plugins = sieve_imapsieve sieve_extprograms sieve_vacation_send_from_recipient = yes } protocols = imap sieve lmtp pop3 service auth-worker { unix_listener auth-worker { user = vmail } user = $default_internal_user } service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0660 user = postfix } unix_listener auth-userdb { mode = 0600 user = vmail } user = vmail } service dict { unix_listener dict { mode = 0600 user = vmail } } service imap-hibernate { unix_listener imap-hibernate { group = $default_internal_group mode = 0660 } } service imap-login { process_min_avail = 10 service_count = 0 vsz_limit = 512 M } service imap { executable = imap process_limit = 3500 unix_listener imap-master { user = $default_internal_user } vsz_limit = 2 G } service lmtp { unix_listener /var/spool/postfix/private/dovecot-lmtp { group = postfix mode = 0600 user = postfix } } service managesieve-login { inet_listener sieve { port = 4190 } process_min_avail = 0 service_count = 1 vsz_limit = 64 M } service managesieve { process_limit = 400 } service pop3-login { process_min_avail = 3 service_count = 0 vsz_limit = 320 M } service pop3 { process_limit = 200 vsz_limit = 320 M } service quota-warning { executable = script /etc/dovecot/quota_warning.sh unix_listener quota-warning { mode = 0666 user = vmail } user = vmail } ssl_cert = </etc/ssl/private/multi.z-technics.cz.dovecot.pem ssl_dh = # hidden, use -P to show it ssl_key = # hidden, use -P to show it stats_writer_socket_path = userdb { args = /etc/dovecot/dovecot-ldap.conf driver = ldap } protocol sieve { managesieve_implementation_string = Dovecot Pigeonhole managesieve_max_compile_errors = 5 } protocol imap { mail_plugins = quota imap_quota fts mailbox_alias imap_acl acl imap_zlib imap_sieve } protocol lda { mail_fsync = optimized } protocol lmtp { mail_fsync = optimized mail_plugins = quota sieve acl }

2 1

2.3.10 + lazy expunge
by Matt Bryant 01 Jun '20

01 Jun '20

Hi, so currently run dovecot 2.2.x on CentOS 7 box and was looking to upgrade to 2.3.10. I use lazy expunge atm into a different namespace but saw on the new doco pages that is is depracted in 2.3.0. Have tested and still seems to work so question is more around why ? Why would this be deprecated given using a different namespace allows 2 things a) the folder where message is located is taken accross so if I want to restore and know where it went b) namespace allows me to specify an alternate location for storing the messages. Also given it does still work is there any indication as to what version the deprecation basically equates to it not working. rgds Matt ------ 8< --------- namespace Deprecated since version v2.3.0.

1 0

identify 143 vs 993 clients
by mj 01 Jun '20

01 Jun '20

Hi, I am trying to find a nice way to identify dovecot clients that are still configured to use port 143 to connect to our mailserver, from the dovecot logs. I would then ask them to move over to 993, and finally disable port 143 altogether. When looking at the dovecot logs, it seems this is not logged in any obvious way. Of course I could use netflow etc, but that would not give us usernames, but IP's, etc. So, is there a nice way to somehow indicate in the dovecot logs, if a client connected on 143 or on 993? Thanks!

13 25

Running doveadm without config file?
by Joseph Tam 31 May '20

31 May '20

It would be useful to run the "doveadm" utility on a non-dovecot server e.g. generating password hashes: # echo plaintextpass | doveadm pw -s BLF-CRYPT doveadm(user): Fatal: Error reading configuration: stat(/etc/dovecot/dovecot.conf) failed: No such file or directory Is there a way to circumvent the need for a configuration file? Joseph Tam <jtam.home(a)gmail.com>

2 4

Current thinking on backups ?
by Laura Smith 30 May '20

30 May '20

Hi, What are people doing for backups ? My current process is LVM snapshot and backup from that to NFS share. But there seems to be hints around the internet that people use/abuse "doveadm backup" for backup purposes even though it seems its original intention was for transferring mailboxes between dovecot instances. Assuming its ok to "doveadm backup" to an NFS share, is it ok to use "doveadm backup" when dovecot has replication setup (replication-notify etc.) ? Or will it interfere ? Thanks! Laura

4 4

Operation not permitted - fchown() failed for /run/dovecot/login
by Dshah 30 May '20

30 May '20

# dovecot --version 2.3.10.1 (a3d0e1171) Dovecot is unable to start, I see error " Fatal: fchown() failed for /run/dovecot/login: Operation not permitted" what could be the problem? any help please $ls -la /var/mail/ drwxr-xr-x 1 root root 4096 May 29 17:32 . drwxr-xr-x 1 root root 4096 May 28 17:08 .. drw------- 2 root root 4096 May 29 17:32 domains ====# cat /etc/dovecot/dovecot.conf===== auth_mechanisms = plain login auth_username_format = %Lu auth_verbose = yes auth_debug = yes auth_debug_passwords = no log_timestamp = "%Y-%m-%d %H:%M:%S " login_greeting = IMAP server ready disable_plaintext_auth = no protocols = imap pop3 log_timestamp = "%Y-%m-%d %H:%M:%S " mail_location = maildir:/var/mail/domains/%d/%n first_valid_gid = 105 first_valid_uid = 102 last_valid_gid = 105 last_valid_uid = 102 service anvil { client_limit = 2100 } ssl_cert = </secret/tls.crt ssl_key = </secret/tls.key ssl_ca = </secret/ca.crt namespace inbox { inbox = yes mailbox Trash { auto = create special_use = \Trash } mailbox Spam { auto = no special_use = \Junk } mailbox Ham { auto = no } mailbox Sent { auto = subscribe special_use = \Sent } } # service auth { # unix_listener auth-master { # mode = 0600 # user = vmail # } # unix_listener /var/spool/postfix/private/auth { # mode = 0666 # user = postfix # group = postfix # } # user = root # } # service auth-worker { # user = root # } # protocol lda { # log_path = /home/vmail/dovecot-deliver.log # auth_socket_path = /var/run/dovecot/auth-master # postmaster_address = postmaster(a)razalabs.com # } protocol pop3 { pop3_uidl_format = %08Xu%08Xv } userdb { driver = static args = uid=102 gid=105 home=/var/mail/domains/%d/%n allow_all_users=yes } passdb { driver = sql args = /etc/dovecot/dovecot-sql.conf.ext } =================/etc/dovecot/dovecot-sql.conf.ext=============== driver = mysql connect = host=localhost dbname=mail user=root password=pass default_pass_scheme = CRYPT password_query = SELECT email as user, password FROM users WHERE email='%u'; =================dovecot-sql.conf.ext=============== =================/etc/dovecot/dovecot-sql.conf.ext=============== driver = mysql connect = host=localhost dbname=mail user=root password=pass default_pass_scheme = CRYPT password_query = SELECT email as user, password FROM users WHERE email='%u'; =================dovecot-sql.conf.ext=============== and postfix =================/etc/postfix/main.cf=============== inet_protocols = all meta_directory = /etc/postfix shlib_directory = /usr/lib/postfix myhostname = mail.my-domain.com mynetworks = 127.0.0.0/8 message_size_limit = 30720000 virtual_alias_domains = virtual_alias_maps = proxy:mysql:/etc/postfix/mysql-virtual_forwardings.cf, mysql:/etc/postfix/mysql-virtual_email2email.cf virtual_mailbox_domains = proxy:mysql:/etc/postfix/mysql-virtual_domains.cf virtual_mailbox_maps = proxy:mysql:/etc/postfix/mysql-virtual_mailboxes.cf virtual_mailbox_base = /var/mail/domains virtual_uid_maps = static:102 virtual_gid_maps = static:105 smtpd_sasl_type = dovecot smtpd_sasl_path = /var/spool/postfix/private/auth smtpd_sasl_auth_enable = yes broken_sasl_auth_clients = yes smtpd_sasl_authenticated_header = yes smtpd_recipient_restrictions = permit_mynetworks, permit_sasl_authenticated, reject_unauth_destination smtpd_use_tls = yes smtpd_tls_cert_file = /secret/tls.crt smtpd_tls_key_file = /secret/tls.key #virtual_create_maildirsize = yes #virtual_maildir_extended = yes proxy_read_maps = $local_recipient_maps $mydestination $virtual_alias_maps $virtual_alias_domains $virtual_mailbox_maps $virtual_mailbox_domains $relay_recipient_maps $relay_domains $canonical_maps $sender_canonical_maps $recipient_canonical_maps $relocated_maps $transport_maps $mynetworks virtual_transport = dovecot dovecot_destination_recipient_limit = 1 smtpd_milters = inet:127.0.0.1:8891 milter_default_action = accept =================/etc/postfix/main.cf===============

1 1

migrating dovecot to new server
by David Mehler 30 May '20

30 May '20

Hello, I'm needing to migrate my dovecot installation it's 2.3 on FreeBSD 12.1 to a new server. I'd ideally like to back up all the mails in the maildir location, copy that over, load in my configuration files, and bring the system back up. I doubt it's that easy, any pitfalls I should watch out for? Thanks. Dave.

4 4

director -> POP3s/IMAPs -> mailbox host
by patosec 28 May '20

28 May '20

Hello again, I did a lot of trial and error already, but I can't seem to find a way to encrypt my dovecot director to dovceot mailbox traffic. Is there a way to configure dovecot director to only use ssl/tls encrypted connections for specific tagged mailbox clusters? (or all clusters, in fact does not matter if it could be restricted to tags) Looks like there is also no documentation available for this sort of configuration. I tried setting my mailbox nodes to "ssl = require" butt after doing so I can't login through director proxy anymore. It always looks like ssl/tls termination is finally done on director side. Anyone tried this already or has a running setup doing encryption from lets say frontend to backend? Thanks, greetings Patrick

2 2

service doveadm - how to debug proxying with director
by patosec 28 May '20

28 May '20

Hello everyone, I'm on a small dovecot director -> dovecot mailbox setup and I try to get doveadm command proxying to work. Though I don't get the expected output. My directors do not forward the doveadm commands to the expected backend host. Doveadm is working as expected on the backend hosts, the director hosts just dont log anything about the proxying that should happen or anything else about the doveadm commands at all. Can someone guide me in a direction on what to try next or maybe got a working config regarding doveadm proxying? Thanks in advance! Some technical data regarding my problem: Dovecot Version: 2.3.10 (0da0eff44) Output of a 'doveadm director status' command: mail server ip tag vhosts state state changed users 10.0.0.81 tag1 100 up - 0 10.0.0.82 tag1 100 up - 1 Output of a 'doveadm director ring status' command: director ip port type last failed status ping ms input output buffered buffered peak last read last write 10.0.0.193 9090 self never ring synced 5 - - - - - - 10.0.0.194 9090 right never synced 0 2051 6400 0 757 2020-05-28 09:56:37 2020-05-28 09:56:37 10.0.0.195 9090 left never synced 0 4929 1804 0 37 2020-05-28 09:56:37 2020-05-28 09:56:37 This is my dovecot-director hosts configuration (doveadm related part): service doveadm { inet_listener { # any port you want to use for this: port = 24245 } } local 0.0.0.0 { # password to use for client authentication doveadm_password = secret # allow client to only use specified list of commands (default is all): #doveadm_allowed_commands = } # same port as doveadm's inet_listener doveadm_port = 24245 protocol doveadm { # NOTE: director-userdb socket is actually used only for passdb lookups, not userdb lookups auth_socket_path = director-userdb } And here the dovecot-backend hosts configuration (doveadm related part): ### director conf service doveadm { inet_listener { # any port you want to use for this: port = 24245 } } local 0.0.0.0 { # password to use for client authentication doveadm_password = secret # allow client to only use specified list of commands (default is all): #doveadm_allowed_commands = } A 'doveadm user -u test(a)test.com' command on the backend host: userdb: test(a)test.com user : test(a)test.com home : /var/spool/imap/test(a)test.com quota : maildir:User quota quota_rule: *:storage=1048576:messages=153000 A 'doveadm user -u test(a)test.com' command on the director host: userdb: test(a)test.com user : test(a)test.com

2 3

Determinant of umask for sieve_pipe_bin_dir scripts?
by Laura Smith 27 May '20

27 May '20

Hi, What determines the umask of sieve_pipe_bin_dir scripts ? The results from my script are always being set to 0600. My script is simple and shown below, even if I adjust the right line to add " && chmod 644", the actual resulting file still remains at 0600 ?!? #!/bin/bash # Usage: imapsieve_copy <email> <spam|ham> MSG_USER="$1" MSG_TYPE="$2" RUN_UUID=$(cat /proc/sys/kernel/random/uuid) BASE_DIR="/foo/bar" TARGET_DIR="${BASE_DIR}/${MSG_TYPE}" TARGET_FILE="${TARGET_DIR}/${RUN_UUID}" cat > "${TARGET_FILE}" < /dev/stdin && pigz -9 "${TARGET_FILE}"

2 2