- dovecot - dovecot.org

Re: Autoexpunge and special user namespace
by Joseph Tam 10 Dec '15

10 Dec '15

On Wed, 9 Dec 2015, Timo Siraine wrote: >> I'm interested in replacing my cron script that expunges old >> deleted mail with the new feature announced in 2.2.20 >> >>> + Added mailbox { autoexpunge=<time> } setting. See >>> http://wiki2.dovecot.org/MailboxSettings for details. >> >> To use it, I need to specify which mailbox needs them using >> the namespace configuration. For example >> >> namespace inbox { >> mailbox Trash { >> auto = no >> special_use = \Trash >> autoexpunge = 7d >> mailbox_list_index = yes >> } >> ... > > mailbox_list_index=yes is a global setting. You can't have it here. Oh, yes. Thanks for pointing that out. By the way, what does it do? The wiki states mailbox_list_index=yes can help a lot by replying to IMAP STATUS (and similar) lookups from a single index without having to open each mailbox index separately. So it create an uber-index that combines information from individual indices? Are there any drawback to using this? > > 1) Do I need the special_user configuration at all? Will some > > clients start using different mailboxes to store deleted mail > > if I keep the special_use lines? > > special_use is independent of the autoexpunge. I guess it wouldn't > necessarily hurt.. but it's also somewhat better to have only a single > \Trash mailbox so clients don't become confused when more than one of > those mailboxes exist. Got it. Thanks, Timo. Joseph Tam <jtam.home(a)gmail.com>

2 1

Re: EVP_PKEY_get1_EC_KEY:expecting a ec key
by Oliver Riesen-Mallmann 09 Dec '15

09 Dec '15

Hi Teemu, > Could you post your doveconf -n output? # 2.2.20.rc1 (ed41702f14c2): /etc/dovecot/dovecot.conf # Pigeonhole version 0.4.10.rc1 # OS: Linux 3.2.0-4-amd64 x86_64 Debian 7.9 auth_mechanisms = plain login log_timestamp = "%Y-%m-%d %H:%M:%S " login_greeting = Ready. login_log_format_elements = user=<%u> method=%m rip=%r lip=%l mpid=%e %c %k mail_location = maildir:%h/mails mail_plugins = zlib mail_privileged_group = mail managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart namespace inbox { inbox = yes list = yes location = maildir:%h/mails mailbox Archiv { auto = subscribe special_use = \Archive } mailbox Archives { auto = no special_use = \Archive } mailbox Drafts { auto = create special_use = \Drafts } mailbox "Gelöschte Elemente" { auto = no special_use = \Trash } mailbox Gesendete { auto = no special_use = \Sent } mailbox "Gesendete Elemente" { auto = no special_use = \Sent } mailbox Junk-E-Mail { auto = no special_use = \Junk } mailbox Junk { auto = subscribe special_use = \Junk } mailbox Sent { auto = subscribe special_use = \Sent } mailbox "Sent Messages" { auto = no special_use = \Sent } mailbox Trash { auto = create special_use = \Trash } prefix = type = private } passdb { driver = shadow } plugin { sieve = file:~/sieve;active=~/.dovecot.sieve zlib_save = gz zlib_save_level = 6 } postmaster_address = postmaster(a)langzeittest.de protocols = imap service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0660 user = postfix } user = root } ssl_cert = </etc/dovecot/ssl-cert-langzeittest-plus-cacert.crt ssl_cipher_list = ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA ssl_dh_parameters_length = 2048 ssl_key = </etc/dovecot/ssl-cert-langzeittest.key ssl_prefer_server_ciphers = yes ssl_protocols = !SSLv2 !SSLv3 userdb { driver = passwd } protocol lda { mail_plugins = zlib sieve } protocol imap { mail_max_userip_connections = 20 mail_plugins = zlib imap_zlib } protocol pop3 { pop3_uidl_format = %08Xu%08Xv } Regards Oliver

2 3

Sieve script replication glitches
by Apollon Oikonomopoulos 09 Dec '15

09 Dec '15

Hi, I'm running a replicated setup on Debian with Dovecot 2.2.18 and Pigeonhole 0.4.8 and run into some glitches with sieve script syncing. Replication is implemented via DSync/doveadm over SSL. While e-mail replication works as expected, sieve script replication is not always successful. In general I have observed the following behaviour re. sieve script replication: - Sometimes sieve scripts are replicated but have an mtime of 0 (Jan 1 1970) on the destination. - Subsequent updates to these "bad" scripts are not replicated at all. - Sometimes after creating *another* sieve script (which may or may not get the correct timestamp), the "bad" script's timestamp/contents are corrected on the receiving side. The following is a minimal real-world example of what happens (including transaction log entries): 1. On the master create a new sieve script: cat test.sieve | doveadm sieve put -u user(a)example.com test1 Sieve storage on the master: -rw------- 1 vmail vmail 2001 Dec 9 15:53 test1.sieve Transaction log on the master: record: offset=44756, type=attribute-update (ext), size=72, modseq=514 - add: private/vendor/vendor.dovecot/pvt/server/sieve/files/test1 : timestamp=2015-12-09 15:53:28 value_len=0 record: offset=44828, type=modseq-update (ext), size=20 - uid=0 modseq=723 Sieve storage on the slave: -rw------- 1 vmail vmail 2001 Jan 1 1970 test1.sieve Transaction log on the slave: record: offset=55356, type=attribute-update (ext), size=72, modseq=597 - add: private/vendor/vendor.dovecot/pvt/server/sieve/files/test1 : timestamp=2015-12-09 15:53:29 value_len=0 record: offset=55428, type=attribute-update (sync), size=72, modseq=598 - add: private/vendor/vendor.dovecot/pvt/server/sieve/files/test1 : timestamp=2015-12-09 15:53:29 value_len=0 2. Create a new script on the master: cat test.sieve | doveadm sieve put -u user(a)example.com test2 Sieve storage on the master: -rw------- 1 vmail vmail 2001 Dec 9 15:53 test1.sieve -rw------- 1 vmail vmail 2001 Dec 9 15:57 test2.sieve Transaction log on the master: record: offset=44848, type=attribute-update (ext), size=72, modseq=515 - add: private/vendor/vendor.dovecot/pvt/server/sieve/files/test2 : timestamp=2015-12-09 15:57:14 value_len=0 record: offset=44920, type=modseq-update (ext), size=20 - uid=0 modseq=725 record: offset=44940, type=modseq-update (ext), size=20 - uid=0 modseq=728 Sieve storage on the slave: -rw------- 1 vmail vmail 2001 Dec 9 15:53 test1.sieve -rw------- 1 vmail vmail 2001 Dec 9 15:57 test2.sieve Transaction log on the slave: record: offset=55500, type=attribute-update (ext), size=72, modseq=599 - add: private/vendor/vendor.dovecot/pvt/server/sieve/files/test2 : timestamp=2015-12-09 15:57:14 value_len=0 record: offset=55572, type=attribute-update (sync), size=72, modseq=600 - add: private/vendor/vendor.dovecot/pvt/server/sieve/files/test2 : timestamp=2015-12-09 15:57:14 value_len=0 record: offset=55644, type=attribute-update (ext), size=72, modseq=601 - add: private/vendor/vendor.dovecot/pvt/server/sieve/files/test1 : timestamp=2015-12-09 15:57:14 value_len=0 record: offset=55716, type=attribute-update (ext), size=72, modseq=602 - add: private/vendor/vendor.dovecot/pvt/server/sieve/files/test2 : timestamp=2015-12-09 15:57:14 value_len=0 record: offset=55788, type=attribute-update (sync), size=132, modseq=603 - add: private/vendor/vendor.dovecot/pvt/server/sieve/files/test1 : timestamp=2015-12-09 15:53:28 value_len=0 - add: private/vendor/vendor.dovecot/pvt/server/sieve/files/test2 : timestamp=2015-12-09 15:57:14 value_len=0 Apparently something gets messed up on the receiving side and strange things appear in the transaction log (e.g. test1 with a timestamp of 15:57:14 which it never had). The fact that it happens sometimes (around 30-40% of the time) likely indicates a race condition somewhere. Also I'm not at all sure sieve transactions should appear twice on the receiving side (ext and then sync); I see other entries (e.g. ext-intro) as a single "(ext) (sync)" record. Any ideas? Thanks, Apollon doveconf -n output follows: # 2.2.18: /etc/dovecot/dovecot.conf # Pigeonhole version 0.4.8 (0c4ae064f307+) # OS: Linux 3.16.0-4-amd64 x86_64 Debian 8.2 auth_mechanisms = plain login default_vsz_limit = 320 M mail_location = mdbox:~/mdbox:ALT=/srv/mail/alt/%d/%n mail_plugins = " acl notify replication acl" managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate namespace { location = maildir:/home/vmail/example.com/staging/Maildir:INDEX=/home/vmail/%d/%n/sta… prefix = Staging. subscriptions = no type = public } namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = separator = . type = private } passdb { args = /etc/dovecot/dovecot-sql.conf driver = sql } plugin { acl = vfile sieve = ~/.dovecot.sieve sieve_before = /home/vmail/global.sieve sieve_default = /home/vmail/global.sieve sieve_dir = ~/sieve } protocols = " imap sieve" service aggregator { fifo_listener replication-notify-fifo { user = vmail } unix_listener replication-notify { user = vmail } } service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0660 user = postfix } unix_listener auth-userdb { group = vmail mode = 0777 } } service doveadm { inet_listener { port = 12345 ssl = yes } vsz_limit = 1 G } service imap-login { process_limit = 500 process_min_avail = 5 } service imap-postlogin { executable = script-login /usr/local/sbin/ldap-postlogin user = $default_internal_user } service imap { executable = imap imap-postlogin process_limit = 1024 } service replicator { process_min_avail = 1 unix_listener replicator-doveadm { mode = 0600 user = vmail } } ssl_cert = </etc/ssl/certs/dovecot.crt ssl_client_ca_dir = /etc/ssl/certs ssl_key = </etc/ssl/private/dovecot.key userdb { args = /etc/dovecot/dovecot-sql.conf driver = sql } protocol lda { log_path = /var/log/dovecot/deliver.log mail_plugins = sieve replication notify } protocol imap { mail_max_userip_connections = 500 }

1 0

v2.2.20 released
by Timo Sirainen 09 Dec '15

09 Dec '15

http://dovecot.org/releases/2.2/dovecot-2.2.20.tar.gz http://dovecot.org/releases/2.2/dovecot-2.2.20.tar.gz.sig This could be (one of) the last v2.2.x release. We're starting v2.3 development soon. + Added mailbox { autoexpunge=<time> } setting. See http://wiki2.dovecot.org/MailboxSettings for details. + ssl_options: Added support for no_ticket + imap/pop3/managesieve-login: Added postlogin_socket=path passdb extra field. This allows replacing the default service imap/pop3/managesieve {} settings for specific users (e.g. running their imap process via valgrind or strace). + doveadm fetch: Added date.sent/received/saved.unixtime + fs-posix: Added mode=auto parameter to set the created files' and directories' mode based on the parent dir if it has setgid-bit. + director: Support backends having hostnames, which makes it possible to verify their SSL certificates. - director: Directors' state became desynchronized if doveadm director commands were used to modify the same backend in multiple directors at the same time with conflicting changes. This fix includes some extra checks, which makes sure that if such a conflict still happens it's automatically fixed. In some situations such an automatic fix may now be unnecessarily triggered and an error logged. - director: Backend tags weren't working correctly. - ldap: tls_* settings weren't used for ldaps URIs. - ldap, mysql: Fixed setting connect timeout. - auth: userdb lookups via auth-worker couldn't change username - dsync: Fixed handling deleted directories. Make sure we don't go to infinite mailbox renaming loop. - imap: Fixed crash in NOTIFY when there were watched namespaces that didn't support NOTIFY. - imap: After SETMETADATA was used, various commands (especially FETCH) could have started hanging when their output was large. - stats: Idle sessions weren't refreshed often enough, causing stats process to forget them and log errors about unknown sessions when they were updated later. - stats: Fixed "Duplicate session ID" errors when LMTP delivered to multiple recipients and fts_autoindex=yes. - zlib plugin: Fixed copying causing cache corruption when zlib_save wasn't set, but the source message was compressed. - fts-solr: Fixed escaping Solr query parameters. - lmtp: quota_full_tempfail=yes was ignored with lmtp_rcpt_check_quota=yes

9 12

core-dump in imap (Dovecot 2.2.19)
by Peter Eriksson 09 Dec '15

09 Dec '15

Just found a coredump from the imap process for one of our users on dovecot 2.2.19 on a Solaris 10/x86 system: > Dec 8 14:33:17 mail dovecot: [ID 583609 mail.crit] imap(leijo): Fatal: master: service(imap): child 14465 killed with signal 11 (core dumped) Please find attached dovecot -n output and some gdb backtrace. It seems that cmd->client was NULL when dereferencing it at line 178 in imap-commands.c (in the function command_exec): > 178 cmd->bytes_in += i_stream_get_absolute_offset(cmd->client->input) - > 179 cmd_start_bytes_in; Please let me know if you need more information. I don't know what the users was doing at that specific time. --- [Ll.U] Peter Eriksson KITVS-IFM & ITI-NET IT.LiU.SE +46-70 518 2786

2 1

Autoexpunge and special user namespace
by Joseph Tam 09 Dec '15

09 Dec '15

I'm interested in replacing my cron script that expunges old deleted mail with the new feature announced in 2.2.20 > + Added mailbox { autoexpunge=<time> } setting. See > http://wiki2.dovecot.org/MailboxSettings for details. To use it, I need to specify which mailbox needs them using the namespace configuration. For example namespace inbox { mailbox Trash { auto = no special_use = \Trash autoexpunge = 7d mailbox_list_index = yes } mailbox trash { auto = no special_use = \Trash autoexpunge = 7d mailbox_list_index = yes } mailbox "Deleted Messages" { auto = no special_use = \Trash autoexpunge = 7d mailbox_list_index = yes } mailbox "Deleted Items" { auto = no special_use = \Trash autoexpunge = 7d mailbox_list_index = yes } ... } Different readers use different mailboxes, so I include the common ones. Some questions: 1) Do I need the special_user configuration at all? Will some clients start using different mailboxes to store deleted mail if I keep the special_use lines? 2) I also expunge old mail in INBOX marked as deleted -- is there any way to handle this case? Create virtual mailbox? Joseph Tam <jtam.home(a)gmail.com>

2 1

v2.2.20 release candidate released
by Timo Sirainen 08 Dec '15

08 Dec '15

http://dovecot.org/releases/2.2/rc/dovecot-2.2.20.rc1.tar.gz http://dovecot.org/releases/2.2/rc/dovecot-2.2.20.rc1.tar.gz.sig v2.2.20 probably will be released tomorrow or maybe during weekend. + Added mailbox { autoexpunge=<time> } setting. See http://wiki2.dovecot.org/MailboxSettings for details. + ssl_options: Added support for no_ticket + imap/pop3/managesieve-login: Added postlogin_socket=path passdb extra field. This allows replacing the default service imap/pop3/managesieve {} settings for specific users (e.g. running their imap process via valgrind or strace). + doveadm fetch: Added date.sent/received/saved.unixtime + fs-posix: Added mode=auto parameter to set the created files' and directories' mode based on the parent dir if it has setgid-bit. + director: Support backends having hostnames, which makes it possible to verify their SSL certificates. - director: Directors' state became desynchronized if doveadm director commands were used to modify the same backend in multiple directors at the same time with conflicting changes. This fix includes some extra checks, which makes sure that if such a conflict still happens it's automatically fixed. In some situations such an automatic fix may now be unnecessarily triggered and an error logged. - director: Backend tags weren't working correctly. - ldap: tls_* settings weren't used for ldaps URIs. - ldap, mysql: Fixed setting connect timeout. - auth: userdb lookups via auth-worker couldn't change username - dsync: Fixed handling deleted directories. Make sure we don't go to infinite mailbox renaming loop. - imap: Fixed crash in NOTIFY when there were watched namespaces that didn't support NOTIFY. - imap: After SETMETADATA was used, various commands (especially FETCH) could have started hanging when their output was large. - stats: Idle sessions weren't refreshed often enough, causing stats process to forget them and log errors about unknown sessions when they were updated later. - stats: Fixed "Duplicate session ID" errors when LMTP delivered to multiple recipients and fts_autoindex=yes. - zlib plugin: Fixed copying causing cache corruption when zlib_save wasn't set, but the source message was compressed. - fts-solr: Fixed escaping Solr query parameters.

6 11

Which mail does a certain attachment belong to?
by Ralf Hildebrandt 08 Dec '15

08 Dec '15

I'm seeing this: ./17/3c/173c81da2aab91f225f8eb5e8fcc87119be4eff0-b38d990442316a54a90c00008f4649af: SecuriteInfo.com.TR.Kryptik.180736.5155.16748.22498.UNOFFICIAL FOUND ./17/3c/173c81da2aab91f225f8eb5e8fcc87119be4eff0-bc70851b03216a54483f00008f4649af: SecuriteInfo.com.TR.Kryptik.180736.5155.16748.22498.UNOFFICIAL FOUND When scanning the "attachments" directory of my mdbox. How can I find out WHICH EMAIL these two attachments belong to? mail_location = mdbox:~/mdbox mail_plugins = zlib fts fts_lucene mdbox_rotate_size = 128M mdbox_rotate_interval = 0 mail_attachment_dir = /some/path/attachments mail_attachment_min_size = 128k mail_attachment_fs = sis posix mail_attachment_hash = %{sha1} -- [*] sys4 AG http://sys4.de, +49 (89) 30 90 46 64 Franziskanerstraße 15, 81669 München Sitz der Gesellschaft: München, Amtsgericht München: HRB 199263 Vorstand: Patrick Ben Koetter, Marc Schiffbauer Aufsichtsratsvorsitzender: Florian Kirstein

3 2

Released Pigeonhole v0.4.10.rc2 for Dovecot v2.2.20
by Stephan Bosch 08 Dec '15

08 Dec '15

Hello Dovecot users, Here's the Pigeonhole RC that goes with Dovecot v2.2.20. Due to the earlier described conflict, RC1 will not compile with the new Dovecot release. I am not really in hurry to make a definitive release of Pigeonhole, since v0.4.9 still compiles fine with Dovecot v2.2.20. Still, if no big bugs emerge in the next few days, I will make a final release. So, please test this new RC and especially the new features. Changelog v0.4.10: + Implemented the Sieve mime and foreverypart extensions (RFC 5703). These are fully implemented. The interaction with the editheader extension needs some work, but this should not influence most uses; i.e., changes by the editheader extension are not always visible using foreverypart/mime. + Sieve body extension: Properly implemented the `:text' body transform. It now extracts text for HTML message parts. + Sieve enotify extension: mailto method: Implemented the sieve_notify_mailto_envelope_from setting. This allows configuring the source of the notification sender address for e-mail notifications. This is similar to what already can be configured for redirect. + Added a sieve_enabled (defaults to 'yes') setting that allows explicitly disabling Sieve processing for particular users. This used to be possible by setting `sieve=', but ever since the sieve_before, sieve_after and sieve_default settings were added, this method was not reliable anymore. - variables extension: Fixed handling of empty string by the `:length' set modifier. An empty string yielded an empty string rather than "0". - Fixed memory leak in the Sieve script byte code dumping facility. Extension contexts were never actually freed. - Fixed handling of implicit keep when the last Sieve script is a global one. In that case the implicit keep action was executed in global context, which could mean that trivial (quota) errors ended up in the system log file, rather than the user log file. - doveadm sieve plugin: Fixed crashes caused by incorrect context allocation in the sieve command implementations. The release is available as follows: http://pigeonhole.dovecot.org/releases/2.2/rc/dovecot-2.2-pigeonhole-0.4.10… http://pigeonhole.dovecot.org/releases/2.2/rc/dovecot-2.2-pigeonhole-0.4.10… Refer to http://pigeonhole.dovecot.org and the Dovecot v2.x wiki for more information. Have fun testing this release candidate and don't hesitate to notify me when there are any problems. Regards, -- Stephan Bosch stephan(a)rename-it.nl

1 0

EVP_PKEY_get1_EC_KEY:expecting a ec key
by Oliver Riesen-Mallmann 07 Dec '15

07 Dec '15

Hi, since my last update from the Dovecot Prebuilt Binary for Debian I get a lot of messages like this in mail.log: dovecot: imap-login: Error: SSL: Stacked error: error:0608308E:digital envelope routines:EVP_PKEY_get1_EC_KEY:expecting a ec key Nevertheless Dovecot seems to work normally. Email client doesn't mention any error. This was my last update: Start-Date: 2015-12-04 14:00:31 Commandline: apt-get upgrade Upgrade: dovecot-core:amd64 (2.2.19-1~auto+98, 2.2.20~rc1-1~auto+3), dovecot-managesieved:amd64 (2.2.19-1~auto+98, 2.2.20~rc1-1~auto+3), dovecot-sieve:amd64 (2.2.19-1~auto+98, 2.2.20~rc1-1~auto+3), dovecot-imapd:amd64 (2.2.19-1~auto+98, 2.2.20~rc1-1~auto+3), dovecot-pop3d:amd64 (2.2.19-1~auto+98, 2.2.20~rc1-1~auto+3), openssl:amd64 (1.0.1e-2+deb7u17, 1.0.1e-2+deb7u18), libssl1.0.0:amd64 (1.0.1e-2+deb7u17, 1.0.1e-2+deb7u18) End-Date: 2015-12-04 14:00:53 My current Dovecot version: 2.2.20.rc1 (0b81127e53da) on Linux 3.2.0-4-amd64 #1 SMP Debian 3.2.68-1+deb7u1 x86_64 Is it a bug in Dovecot or in openssl/libssl? Regards Oliver

2 1