- dovecot - dovecot.org

Segfault report
by Daniel Miller 27 Dec '18

27 Dec '18

Ubuntu 18.04, AMD Opteron, Dovecot Version 2.3.3, local file storage. I believe it's one of my users checking mail remotely via mobile - don't remember if it's an iPhone or Android. gdb backtrace: Reading symbols from /usr/local/libexec/dovecot/imap...done. [New LWP 13852] [Thread debugging using libthread_db enabled] Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1". Core was generated by `dovecot/imap [kkhany(a)amfes.c'. Program terminated with signal SIGSEGV, Segmentation fault. #0 event_want_debug_log (event=event@entry=0x0, source_filename=source_filename@entry=0x7efd84178aa3 "mail-storage.c", source_linenum=source_linenum@entry=1261) at event-log.c:120 120 if (event->forced_debug) (gdb) bt full #0 event_want_debug_log (event=event@entry=0x0, source_filename=source_filename@entry=0x7efd84178aa3 "mail-storage.c", source_linenum=source_linenum@entry=1261) at event-log.c:120 ctx = {type = LOG_TYPE_DEBUG, exit_status = 0, timestamp = 0x0, timestamp_usecs = 0, log_prefix = 0x0, log_prefix_type_pos = 0} #1 0x00007efd83dc0986 in event_want_debug (event=event@entry=0x0, source_filename=source_filename@entry=0x7efd84178aa3 "mail-storage.c", source_linenum=source_linenum@entry=1261) at event-log.c:140 No locals. #2 0x00007efd840bf270 in mailbox_open_full (box=box@entry=0x55704dc81058, input=input@entry=0x0) at mail-storage.c:1259 _tmp_event = 0x0 ret = <optimized out> #3 0x00007efd840bf57a in mailbox_open_full (input=0x0, box=0x55704dc81058) at mail-storage.c:1368 ret = <optimized out> ret = <optimized out> _tmp_event = <optimized out> _data_stack_cur_id = <optimized out> _data_stack_cur_id = <optimized out> #4 mailbox_open (box=0x55704dc81058) at mail-storage.c:1349 No locals. #5 0x000055704c36a31b in select_open (readonly=false, mailbox=<optimized out>, ctx=0x55704dc13bc8) at cmd-select.c:288 client = 0x55704dc11de8 status = {messages = 1830951344, recent = 32766, unseen = 2391910144, uidvalidity = 1475818629, uidnext = 1830951424, first_unseen_seq = 32766, first_recent_uid = 1832402502, last_cached_seq = 32766, highest_modseq = 0, highest_pvt_modseq = 4294967296, keywords = 0x55704dbf1380, permanent_flags = 1280910144, flags = 21872, permanent_keywords = false, allow_new_keywords = false, nonpermanent_modseqs = false, no_modseq_tracking = false, have_guids = false, have_save_guids = true, have_only_guid128 = false} flags = <optimized out> ---Type <return> to continue, or q <return> to quit--- ret = 0 client = <optimized out> status = <optimized out> flags = <optimized out> ret = <optimized out> #6 cmd_select_full (cmd=<optimized out>, readonly=<optimized out>) at cmd-select.c:417 client = 0x55704dc11de8 ctx = <optimized out> args = 0x55704dbef690 list_args = 0x5d0000006e mailbox = 0x55704dbe1540 "shared" error = 0x55704dc11de8 "" ret = <optimized out> __func__ = "cmd_select_full" #7 0x000055704c371e30 in command_exec (cmd=cmd@entry=0x55704dc13a38) at imap-commands.c:201 hook = 0x55704dbeb0f0 finished = <optimized out> __func__ = "command_exec" #8 0x000055704c3701d2 in client_command_input (cmd=<optimized out>, cmd@entry=0x55704dc13a38) at imap-client.c:1152 client = 0x55704dc11de8 command = <optimized out> __func__ = "client_command_input" #9 0x000055704c370274 in client_command_input (cmd=<optimized out>) at imap-client.c:1215 client = 0x55704dc11de8 command = <optimized out> __func__ = "client_command_input" #10 0x000055704c370675 in client_handle_next_command (remove_io_r=<synthetic pointer>, client=0x55704dc11de8) at imap-client.c:1257 ---Type <return> to continue, or q <return> to quit--- No locals. #11 client_handle_input (client=0x55704dc11de8) at imap-client.c:1271 _data_stack_cur_id = 3 ret = <optimized out> remove_io = false ret = <optimized out> remove_io = <optimized out> client = 0x55704dc11de8 handled_commands = <optimized out> _data_stack_cur_id = <optimized out> ret = <optimized out> remove_io = <optimized out> _data_stack_cur_id = <optimized out> #12 0x000055704c370ccc in client_input (client=0x55704dc11de8) at imap-client.c:1317 cmd = 0x55704dc0bcb0 output = 0x55704dc2d150 bytes = 17 __func__ = "client_input" #13 0x00007efd83ddae0f in io_loop_call_io (io=0x55704dc13910) at ioloop.c:698 ioloop = 0x55704dbe9ee0 t_id = 2 __func__ = "io_loop_call_io" #14 0x00007efd83ddc7c6 in io_loop_handler_run_internal (ioloop=ioloop@entry=0x55704dbe9ee0) at ioloop-epoll.c:221 ctx = 0x55704dbedc00 events = <optimized out> event = <optimized out> list = 0x55704dc13970 ---Type <return> to continue, or q <return> to quit--- io = <optimized out> tv = {tv_sec = 1799, tv_usec = 999365} events_count = <optimized out> msecs = <optimized out> ret = <optimized out> i = 0 j = <optimized out> call = <optimized out> __func__ = "io_loop_handler_run_internal" #15 0x00007efd83ddaf1c in io_loop_handler_run (ioloop=<optimized out>) at ioloop.c:750 No locals. #16 0x00007efd83ddb138 in io_loop_run (ioloop=0x55704dbe9ee0) at ioloop.c:723 __func__ = "io_loop_run" #17 0x00007efd83d50873 in master_service_run (service=0x55704dbe9d70, callback=<optimized out>) at master-service.c:775 No locals. #18 0x000055704c362611 in main (argc=<optimized out>, argv=<optimized out>) at main.c:521 set_roots = {0x55704c5909a0 <smtp_submit_setting_parser_info>, 0x55704c5906c0 <imap_setting_parser_info>, 0x0} login_set = {auth_socket_path = 0x55704dbe12a8 "\340\022\276MpU", postlogin_socket_path = 0x55704dbe12f0 "m 174.237.3.103 SELECT]", postlogin_timeout_secs = 60, callback = 0x55704c37ed60 <login_client_connected>, failure_callback = 0x55704c37e530 <login_client_failed>, request_auth_token = true} service_flags = <optimized out> storage_service_flags = <optimized out> username = 0x0 auth_socket_path = <optimized out> c = <optimized out> error = 0x0 doveconf -n: # 2.3.3 (dcead646b): /usr/local/etc/dovecot/dovecot.conf # Pigeonhole version 0.5.3 (f018bbab) # OS: Linux 4.15.0-43-generic x86_64 Ubuntu 18.04.1 LTS # Hostname: bubba.amfes.lan auth_cache_size = 4 k auth_master_user_separator = * auth_mechanisms = plain login default_login_user = nobody default_vsz_limit = 1 G dict { acl = mysql:/usr/local/etc/dovecot/dovecot-dict-sql.conf.ext } disable_plaintext_auth = no imap_client_workarounds = tb-extra-mailbox-sep imap_idle_notify_interval = 29 mins listen = * mail_attachment_hash = %{sha512} mail_plugins = fts fts_solr acl zlib virtual mail_prefetch_count = 10 mail_shared_explicit_inbox = yes managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext namespace inbox { hidden = no inbox = yes list = yes location = mailbox "Deleted Messages" { auto = no autoexpunge = 30 days special_use = \Trash } mailbox Drafts { auto = subscribe special_use = \Drafts } mailbox INBOX/Archives { auto = no special_use = \Archive } mailbox Sent { auto = subscribe special_use = \Sent } mailbox "Sent Items" { auto = no special_use = \Sent } mailbox "Sent Messages" { auto = no special_use = \Sent } mailbox Trash { auto = subscribe autoexpunge = 30 days special_use = \Trash } mailbox virtual/Flagged { comment = All my flagged messages special_use = \Flagged } prefix = separator = / subscriptions = yes type = private } namespace usershares { list = children location = sdbox:/var/mail/%%d/%%n/sdbox prefix = shared/%%n/ separator = / subscriptions = no type = shared } namespace virtual { list = children location = virtual:/var/mail/%d/%n/virtual prefix = virtual/ separator = / subscriptions = no } passdb { args = /usr/local/etc/dovecot/master-users driver = passwd-file master = yes } passdb { args = /usr/local/etc/dovecot/dovecot-ldap.conf.ext driver = ldap } plugin { acl = vfile:/usr/local/etc/dovecot/global-acls:cache_secs=300 acl_shared_dict = proxy::acl fts = solr fts_autoindex = yes fts_solr = break-imap-search url=http://127.0.0.1:8983/solr/dovecot/ mailbox_alias_new = Sent Messages mailbox_alias_new2 = Sent Items mailbox_alias_new3 = Deleted Messages mailbox_alias_old = Sent mailbox_alias_old2 = Sent mailbox_alias_old3 = Trash sieve = file:~/sieve;active=~/.dovecot.sieve } protocols = imap lmtp sieve service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0660 user = postfix } unix_listener auth-userdb { group = mail mode = 0600 user = vmail } } service dict { unix_listener dict { group = mail mode = 0660 user = vmail } } service imap-login { process_min_avail = 10 service_count = 1 } service imap-postlogin { executable = script-login /usr/local/etc/dovecot/post-login.sh user = $default_internal_user } service imap { executable = imap imap-postlogin } service lmtp { process_min_avail = 5 unix_listener /var/spool/postfix/private/dovecot-lmtp { group = mail mode = 0666 user = vmail } } service managesieve-login { inet_listener sieve { port = 4190 } inet_listener sieve_deprecated { port = 2000 } process_min_avail = 0 service_count = 1 } ssl_cert = </etc/letsencrypt/live/mail.amfes.com/fullchain.pem ssl_dh = # hidden, use -P to show it ssl_key = # hidden, use -P to show it userdb { driver = prefetch } userdb { args = /usr/local/etc/dovecot/dovecot-ldap.conf.ext driver = ldap } verbose_proctitle = yes protocol lmtp { mail_plugins = fts fts_solr acl zlib virtual sieve postmaster_address = postmaster(a)amfes.com } protocol lda { mail_plugins = fts fts_solr acl zlib virtual sieve } protocol imap { mail_max_userip_connections = 50 mail_plugins = fts fts_solr acl zlib virtual imap_acl imap_zlib mailbox_alias } local 192.168.0.2 { protocol imap { ssl_cert = </etc/letsencrypt/live/mail.amfes.com/fullchain.pem ssl_key = # hidden, use -P to show it } } -- Daniel

2 3

Migration to 2.3.36 using replication
by Thomas Durand 27 Dec '18

27 Dec '18

Hello, I have to migrate my dovecot box to a new one. I would like to know if it’s possible to do this migration with the replication process. My plan is to activate replication between 2.2.10 server and the 2.3.4 new server. Then I will update the DNS to redirect the name to new box. Users will then connect either on the new or the old box depending on the dns upgrade. Does anyone have already experienced such process ? Is there any incompatibility issue ? Thanks. Thomas

1 0

Heads-up regarding non-replication of Sieve scripts?
by Markus Ueberall 25 Dec '18

25 Dec '18

Dear all, A couple of months ago, it has been mentioned that multiple users experienced a problem regarding the synchronisation of Sieve scripts by means of "dsync" (whereas e-mails were replicated just fine between servers) [1][2] for Dovecot v2.3.x; the same problem apparently occurred with early versions from the v2.2 branch some three years ago but has been marked/confirmed as fixed back then [3]. Since I'm currently using the 2.2.33.2[-1ubuntu3] packages from the Dovecot community software repository and would like to upgrade to v2.3.x at one point, I'm very interested in hearing whether the above problems have been fixed (if so, how?) since I do not want to semi-manually synchronise the Sieve scripts between two mail servers in active/active mode on my own. Thanks in advance for a heads-up / Kind regards, Markus [1] https://www.dovecot.org/pipermail/dovecot/2018-October/113244.html [2] https://www.dovecot.org/pipermail/dovecot/2018-August/112548.html [3] https://www.dovecot.org/pipermail/dovecot/2015-February/099658.html

1 0

Authentication Problem
by Odhiambo Washington 21 Dec '18

21 Dec '18

I am using SHA512-CRYPT scheme for passwords. In my dovecot-sql.conf.ext, I have: default_pass_scheme = CRYPT In 10-auth.conf, I have: auth_mechanisms = plain login digest-md5 M$ Outlook is refusing to authenticate, with error: Requested DIGEST-MD5 scheme, but we have only CRYPT What an I missing?? I hate it that this has taken me round in circles :-) -- Best regards, Odhiambo WASHINGTON, Nairobi,KE +254 7 3200 0004/+254 7 2274 3223 "Oh, the cruft.", grep ^[^#] :-)

4 12

Password expiration: how to trigger it?
by Cédric Jeanneret 21 Dec '18

21 Dec '18

Dear Dovecot Team, I'm in the (long) process of migrating my whole email infrastructure. Of course, dovecot is in the place, and is working just fine. Still, I have an issue: password expiration. I'm now using FreeIPA backend for the user authentication, and it includes the capacity to expire passwords. Basically, it's an LDAP with fancy things, among them a field named krbPasswordExpiration (yes, that's kerberos). In order to make things simple, I'd rather NOT force my users to set up a kerberos/gssapi/whatever on their personal computer (most of them will just have blank gaze if I start talking about that). Is there a way to make Dovecot use that field? It's apparently a simple date in %Y%M%D%H%m%sZ format, so a pretty neat thing to test. If there's some support for that in Dovecot, that is. If not, as a last resort, I can configure the freeIPA to deactivate the user if the password is expired, and this should push another field in the user description. Would that be a possibility for Dovecot, in case it can't use the datetime field as is? Thank you for your support! Cheers, C.

2 1

outlook idiocy - IMAP folders with /
by Wojciech Puchar 21 Dec '18

21 Dec '18

user attempts to create folders with / dovecot naturally cannot create it so it returns error but outlook of course "create" it and keep data in local store only. data is lost when you remove local store .pst file. The question is - can dovecot be configured so it will automatically replace slash in name with something else?

8 15

SIS feature request
by Daniel Miller 21 Dec '18

21 Dec '18

I tried SIS a couple years ago - I was very excited with the resulting decrease in storage requirements but the undiagnosed intermittent issues became too significant to ignore so I switched away. Recently I was thinking about it again. The primary issue with SIS seemed to be links would be deleted even though the source attachment files and related mails still existed. It was possible to either manually re-build the links or have a script scan the mail error log and perform such. I haven't looked at the code - but a thought for a possible "temporary" fix: 1. Whatever function in dbox code that performs the deletion of links - prior to actually deleting call a new function that will verify if any mails exist that reference it. A new function, without modifying existing code, may catch something the existing functions don't - and if it logs the fact that it was called and found something...perhaps we can find the flaw in the original algorithm. Just a thought. 2. In the mail retrieval function, if the attachment link doesn't exist - perform the relevant scan through the attachment database and if found re-create the link automatically. This should log an error but indicate the recovery. -- Daniel

1 0

Intentionally use weak server key
by Stavros Tsolakos 20 Dec '18

20 Dec '18

Hi list! For some reason I need to use a really weak server key (256 bit) with dovecot for imaps access. Is this possible? I tried but getting this error: dovecot: imap-login: Error: SSL: Stacked error: error:04075070:rsa routines:RSA_sign:digest too big for rsa key This is on an Ubuntu 14.04 on x64. Thank you! Stavros

4 7

High Load average on NFS Spool - v.2.1.15 & 2.2.13
by Albert E. Whale, CEH CHS CISA CISSP 19 Dec '18

19 Dec '18

I have two servers pointing to an NFS mounted mail spool with dovecot. Since I recently switched from using Dovecot v1.X, I have been experiencing high CPU use with the two Dovecot servers. I am not certain why they are not well behaved. Here is the configuration information. This configuration is currently running at a load average of 17. /usr/sbin/dovecot -n # 2.1.15: /etc/dovecot/dovecot.conf # OS: Linux 3.10.54-server-2.mga3 i686 Mageia 3 base_dir = /var/run/dovecot/ disable_plaintext_auth = no lock_method = dotlock login_greeting = SpamZapper Email ready. login_log_format_elements = user=<%u> method=%m rip=%r lip=%l %c mail_debug = yes mail_fsync = always mail_location = maildir:~/Maildir mail_nfs_index = yes mail_nfs_storage = yes mail_privileged_group = mail mbox_lock_timeout = 15 mins mmap_disable = yes passdb { driver = pam } protocols = imap pop3 service anvil { client_limit = 203 process_limit = 1 } service auth { user = root } service imap-login { chroot = login client_limit = 10 user = dovecot vsz_limit = 256 M } service pop3-login { chroot = login client_limit = 20 user = dovecot } ssl = no syslog_facility = local2 userdb { driver = passwd } verbose_proctitle = yes protocol pop3 { mail_max_userip_connections = 20 pop3_logout_format = top=%t/%p, retr=%r/%b, del=%d/%m, size=%s pop3_uidl_format = %08Xv%08Xu } protocol lda { postmaster_address = postmaster(a)example.com } protocol imap { mail_max_userip_connections = 10 } And the other server which is currently running with a load average of 10. dovecot -n # 2.2.13: /etc/dovecot/dovecot.conf doveconf: Warning: service anvil { client_limit=100 } is lower than required under max. load (303) # OS: Linux 4.1.15-server-2.mga5 x86_64 Mageia 4 base_dir = /var/run/dovecot/ disable_plaintext_auth = no listen = * lock_method = dotlock login_greeting = SpamZapper Email ready. login_log_format_elements = user=<%u> method=%m rip=%r lip=%l %c mail_fsync = always mail_location = maildir:~/Maildir mail_nfs_index = yes mail_nfs_storage = yes mail_privileged_group = mail mmap_disable = yes passdb { driver = pam } protocols = imap pop3 service anvil { client_limit = 100 process_limit = 1 } service auth { user = root } service imap-login { chroot = login client_limit = 48 user = dovecot vsz_limit = 256 M } service pop3-login { chroot = login client_limit = 50 user = dovecot } ssl = no syslog_facility = local2 userdb { driver = passwd } verbose_proctitle = yes protocol pop3 { mail_max_userip_connections = 50 pop3_logout_format = top=%t/%p, retr=%r/%b, del=%d/%m, size=%s pop3_uidl_format = %08Xv%08Xu } protocol lda { postmaster_address = postmaster(a)example.com } protocol imap { mail_max_userip_connections = 40 } Can you please offer a suggestion on what is happening? The timeouts to the imap server are frequent due to the load average. Thank you. -- -- -- Albert E. Whale, CEH CHS CISA CISSP *President - Chief Info Security Officer* IT Security, Inc. <http://www.IT-Security-inc.com> - A Service Disabled Veteran Owned Company - (*SDVOSB*) *HUBZone Certified* LinkedIn <https://www.linkedin.com/in/albertwhale> Profile Phone: 412-515-3010 | Email: Albert.Whale(a)IT-Security-inc.com Cell: 412-889-6870

3 5

Re: How to configure Dovecot to disable NIST's curves and still rertain EECDH?
by Kurt Fitzner 19 Dec '18

19 Dec '18

My opinion is that security by RFC is not security, it's mommy medicine. Standards have had a terrible time keeping up with security realities. NITS's curves leak side channel information all over the place. I don't have details on what implementations are set to calculate the NIST curves in constant time, and that's not an easy feat to do anyway so I don't want to depend on implementations that say they are actually doing it the right way. Frankly I can't be bothered to keep up with that. There are better curves TODAY, so yes I intend to use them if I can find a way. Otherwise, I'll just keep EECDH disabled. I have EDH now, and I've not yet run into a client that doesn't support it. I want EECDH, but I won't use it without safe curves. I'm confident that EECDH with safe curves and a second choice of EDH will support any clients that are worth using. OpenSSL supports X25519, and that is half the battle. Is there a way to change the curve selection in Dovecot? On 2018-12-19 01:49, Tributh via dovecot wrote: > Do you really plan to do this? > RFC 8446 section 9.1: > A TLS-compliant application MUST support key exchange with secp256r1 > (NIST P-256) and SHOULD support key exchange with X25519 > > I think your idea could be not future proved. > > Beside that, how many mail-clients will remain usable with this cipher > selection? > > Torsten

2 1