- dovecot - dovecot.org

with GlusterFS - permissions for vmail ?
by lejeczek 05 Nov '23

05 Nov '23

Hi guys. I must be missing, having something misconfigured. I have: -> $ gluster volume info VMAIL Volume Name: VMAIL Type: Distributed-Replicate Volume ID: 462a1850-a31a-4a17-934d-26f3996dc9b8 Status: Started Snapshot Count: 0 Number of Bricks: 1 x 2 = 2 Transport-type: tcp Bricks: Brick1: 10.1.1.100:/devs/00.GLUSTERs/VMAIL Brick2: 10.1.1.101:/devs/00.GLUSTERs/VMAIL Options Reconfigured: storage.owner-gid: 2000 storage.owner-uid: 2000 cluster.granular-entry-heal: on storage.fips-mode-rchecksum: on transport.address-family: inet nfs.disable: on performance.client-io-threads: off and my _dovecot_ errors out with: ... imap(ja_discourse(a)test.web)<92447><w3ygwWUJUNddviSg>: Error: mkdir(/VMAIL/test.web/ja_discourse) failed: Permission denied (euid=2000(vmail) egid=2000(vmail) missing +w perm: /VMAIL, UNIX perms appear ok (ACL/MAC wrong?)) imap(ja_discourse(a)test.web)<92447><w3ygwWUJUNddviSg>: Error: mkdir(/VMAIL/test.web/ja_discourse) failed: Permission denied (euid=2000(vmail) egid=2000(vmail) missing +w perm: /VMAIL, UNIX perms appear ok (ACL/MAC wrong?)) imap(ja_discourse(a)test.web)<92447><w3ygwWUJUNddviSg>: Error: Mailbox INBOX: Failed to autocreate mailbox: Internal error occurred. Refer to server log for more information. [2023-11-05 12:08:25] ... What might I have incorrect or wrong? many thanks, L Hi guys. I must be missing, having something misconfigured. I have: -> $ gluster volume info VMAIL Volume Name: VMAIL Type: Distributed-Replicate Volume ID: 462a1850-a31a-4a17-934d-26f3996dc9b8 Status: Started Snapshot Count: 0 Number of Bricks: 1 x 2 = 2 Transport-type: tcp Bricks: Brick1: 10.1.1.100:/devs/00.GLUSTERs/VMAIL Brick2: 10.1.1.101:/devs/00.GLUSTERs/VMAIL Options Reconfigured: storage.owner-gid: 2000 storage.owner-uid: 2000 cluster.granular-entry-heal: on storage.fips-mode-rchecksum: on transport.address-family: inet nfs.disable: on performance.client-io-threads: off and my _dovecot_ errors out with: ... imap(ja_discourse(a)test.web)<92447><w3ygwWUJUNddviSg>: Error: mkdir(/VMAIL/ test.web/ja_discourse) failed: Permission denied (euid=2000(vmail) egid=2000 (vmail) missing +w perm: /VMAIL, UNIX perms appear ok (ACL/MAC wrong?)) imap(ja_discourse(a)test.web)<92447><w3ygwWUJUNddviSg>: Error: mkdir(/VMAIL/ test.web/ja_discourse) failed: Permission denied (euid=2000(vmail) egid=2000 (vmail) missing +w perm: /VMAIL, UNIX perms appear ok (ACL/MAC wrong?)) imap(ja_discourse(a)test.web)<92447><w3ygwWUJUNddviSg>: Error: Mailbox INBOX: Failed to autocreate mailbox: Internal error occurred. Refer to server log for more information. [2023-11-05 12:08:25] ... What might I have incorrect or wrong? many thanks, L

2 3

install/compile dovecot-pigeonhole
by joe a 03 Nov '23

03 Nov '23

Working dovecot 2.3, wish to be able to implement "server side" filtering. My understanding is that is done with "sieve". My further understanding is that "dovecot-pigeonhole" and be used to manage "sieve" in some fashion. Attempting to compile dovecot-2.3-pigeonhole-0.5.21 proves problematic due to its inability to find dovecot-config. Which is not astonishing as, on my system dovecot-config does not exist, dovecot having been installed as a vendor configure package. Sadly, no vendor package or binary is provided for dovecot-pigeonhole. At least that I am aware of. OS is opensuse LEAP 15.5. Any helpful commentary is welcome. Honest.

1 1

Too many auth errors
by DeJa Wu 03 Nov '23

03 Nov '23

I've got too many errors on my mail server like this: Nov 3 12:03:13 mail01 dovecot[5562]: imap-login: Error: auth-client: conn unix:login (pid=5553,uid=0): Authentication server sent unknown id 2965 Nov 3 12:03:13 mail01 dovecot[5562]: imap-login: Error: auth-client: conn unix:login (pid=5553,uid=0): Authentication server sent unknown id 2966 Nov 3 12:03:13 mail01 dovecot[5562]: imap-login: Error: auth-client: conn unix:login (pid=5553,uid=0): Authentication server sent unknown id 2967 Nov 3 12:03:13 mail01 dovecot[5562]: imap-login: Error: auth-client: conn unix:login (pid=5553,uid=0): Authentication server sent unknown id 2084 Nov 3 12:03:13 mail01 dovecot[5562]: imap-login: Error: auth-client: conn unix:login (pid=5553,uid=0): Authentication server sent unknown id 1972 And my users say that login to the mail server is too long. In some cases I've got an error connection problem. How do I fix this? BR, DeJa I've got too many errors on my mail server like this: Nov 3 12:03:13 mail01 dovecot[5562]: imap-login: Error: auth-client: conn unix:login (pid=5553,uid=0): Authentication server sent unknown id 2965 Nov 3 12:03:13 mail01 dovecot[5562]: imap-login: Error: auth-client: conn unix:login (pid=5553,uid=0): Authentication server sent unknown id 2966 Nov 3 12:03:13 mail01 dovecot[5562]: imap-login: Error: auth-client: conn unix:login (pid=5553,uid=0): Authentication server sent unknown id 2967 Nov 3 12:03:13 mail01 dovecot[5562]: imap-login: Error: auth-client: conn unix:login (pid=5553,uid=0): Authentication server sent unknown id 2084 Nov 3 12:03:13 mail01 dovecot[5562]: imap-login: Error: auth-client: conn unix:login (pid=5553,uid=0): Authentication server sent unknown id 1972 And my users say that login to the mail server is too long. In some cases I've got an error connection problem. How do I fix this? BR, DeJa

1 0

Sieve/Pigeonhole
by joe a 01 Nov '23

01 Nov '23

For dovecot, I see there is a "sieve" download at dovecot downloads and separately there is a pigeonhole download. Are these parallel projects, distinct and separate?

1 1

Setting up a new server
by James Cloos 30 Oct '23

30 Oct '23

I'm in the process of switching to dovecot for my lan imap and have a couple of questions. I want to keep the folder names unchanged. For mailing lists I use the posting address (eg foo(a)bar.co) for others I use / as the separator. If I use mdbox, will those choices cause any issues? My impression is not, but I'd like to be sure. Also I'd like to use imap-specific passwds for each user. My tests so far have used the login passwds for each user. Not necessarily virtual users, just imap-specific passwds. There is already a pgsql server handy; I take it that would be the way to go for passdb and userdb lookups, yes? Thanks, -JimC -- James Cloos <cloos(a)jhcloos.com> OpenPGP: 0x997A9F17ED7DAEA6

2 1

Two-way TLS and other security for LMTP over the internet?
by forum＠ageofdream.com 29 Oct '23

29 Oct '23

Dovecot version 2.3.19.1 (9b53102964) Postfix version 3.5.18 We have a Postfix server that runs on a VPS with a hosting company and a Dovecot IMAP server that runs at the office. We want Postfix to push the mail it receives to the Dovecot IMAP server, using the least amount of intermediate software. This transfer occurs over the open internet. LMTP over TCP seems like a great solution, *if* it can be secured. But I'm not finding documentation on how to actually setup something like two-way TLS over LMTP. 1. Is there any setting in Dovecot where I can set a remote IP address (or hostname) that will be the only address that Dovecot's LMTP accepts connections from? 2. My current configuration options for LMTP in Dovecot look like: protocol lmtp { ssl_cert = </etc/ssl/imap/imap.crt ssl_key = </etc/ssl/imap/imap.key ssl_ca = </etc/ssl/imap/authority.crt ssl_verify_client_cert = yes auth_ssl_require_client_cert = yes } service lmtp { user = vmail inet_listener lmtp { address = * :: port = 24 } } With these settings, I can telnet from the Postfix server to the Dovecot server with LMTP, and I'm not convinced there is any encryption actually enabled or any TLS verification going on. Is there any reasonable security that can be setup to make this safe (within Dovecot and Postfix settings, not using VPNs and SSH tunnels)? If so, how?

3 2

{ldap:objectGUID} returns binary data when used for user_attrs
by Andreas Haerter 26 Oct '23

26 Oct '23

Hi, there is an environment in which I have to use MS Active Directory for authentication and mail server user database, and I've run into a problem. I. The problem I want to retrieve the objectGUID attribute for the homedir path of the users. This attribute does never change, even when the username does or the account gets moved to another AD domain. However, the objectGUID is returned as binary gibberish when using the following setting: > user_attrs = \ > =home=/var/vmail/example.com/%LT{ldap:objectGUID}, \ It results in > # doveadm user uTesting > field value > user utesting > home /var/vmail/example.com/d ��n�aa_ o�� > mail maildir:~/mail Can someone reproduce this or offer a workaround? The only idea I had was hashing the value using =%M{ldap:objectGUID}. However, this approach would become problematic if the behavior changes and a proper string representation is returned, as expected, instead of the binary data. Therefore, I'm hesitant to use this method for now. A better approach would be encoding it as Base64, but I was unsuccessful to identify a fitting modifier at <https://doc.dovecot.org/configuration_manual/config_file/config_variables/#…>. Any ideas? II. Additional info Using other attributes for LDAP/Active Directory works as expected. E.g. > =home=/var/vmail/example.com/%LT{ldap:sAMAccountName} results in > # doveadm user uTesting > field value > user utesting > home /var/vmail/example.com/utesting > mail maildir:~/mail The objectGUID is indeed binary data, but IHMO, it should be handled differently when returned. E.g. there is a defined string representation, [MS-DTYP] section 2.3.4.3: <https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-dtyp/222af…> which links to: > curly braced GUID string: The string representation of a 128-bit > globally unique identifier (GUID) using the form > {XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX}, where X denotes a hexadecimal > digit. The string representation between the enclosing braces is the > standard representation of a GUID as described in [RFC4122] section 3. > Unlike a GUIDString, a curly braced GUID string includes enclosing braces. Some libs simply decide to return the data Base64 encoded (which would be OK, too). E.g. openldap-clients / ldapsearch does so with objectGUID and objectSid: > $ ldapsearch [...] > [...] > # uTesting, common, user, managed, example.com > dn: CN=uTesting,OU=common,OU=user,OU=managed,DC=example,DC=com > [...] > name: uTesting > objectGUID:: RCDirQPvGU6KQUFfIE/i2Q== > [...] > objectSid:: AQUAAAAAAAUVAAAALenCqsullBUfFoubWQQAAA== > [...] > sAMAccountName: uTesting > [...] Other software had comparable bugs or behavior , e.g. sssd ("Properly handle AD's binary objectGUID"): <https://bugzilla.redhat.com/show_bug.cgi?id=1205382> <https://github.com/SSSD/sssd/issues/3629> owncloud ("ensure that objectguid or guid really return binary data before converting it"): <https://github.com/owncloud/core/issues/8317> III. Software versions, config I can reproduce the issue on Fedora Server 38 > # cat /etc/redhat-release > Fedora release 38 (Thirty Eight) > # uname -r > 6.4.15-200.fc38.x86_64 > # dovecot --version > 2.3.20 (80a5ac675d) and CentOS 9 Stream: > # cat /etc/redhat-release > CentOS Stream release 9 > # uname -r > 5.14.0-364.el9.x86_64 > # dovecot --version > 2.3.16 (7e2e900c1a) I did not try a Debian-based distro yet. The config itself works fine, relevant settings just for reference (as there are not many examples on the internet, maybe useful for somebody): > auth_username_format = %Lu > > passdb { > driver = ldap > args = /etc/dovecot/dovecot-ldap.conf.ext > } > userdb { > driver = ldap > args = /etc/dovecot/dovecot-ldap-userdb.conf.ext > } with the following options to exclude inactive accounts, search smtp proxy addresses and having a mandatory group membership in SERVICE_EmailUsers: > base = OU=common,OU=user,OU=managed,DC=example,DC=com > scope = subtree > > user_filter = \ > (& \ > (objectClass=user) \ > (objectCategory=Person) \ > (|(sAMAccountName=%{username})(mail=%{username})(proxyAddresses=smtp:%{username}@%{domain})) \ > (!(userAccountControl:1.2.840.113556.1.4.803:=2)) \ > (memberOf:1.2.840.113556.1.4.1941:=SERVICE_EmailUsers) \ > ) > pass_filter = \ > (& \ > (objectClass=user) \ > (objectCategory=Person) \ > (|(sAMAccountName=%{username})(mail=%{username})(proxyAddresses=smtp:%{username}@%{domain})) \ > (!(userAccountControl:1.2.840.113556.1.4.803:=2)) \ > (memberOf:1.2.840.113556.1.4.1941:=SERVICE_EmailUsers) \ > ) I will blog about the config in more detail at https://foundata.com/en/blog/ soon, especially when the objectGUID is solved (maybe hashing it really the way to go). :-) Regards, Andreas -- foundata GmbH Steinhäuserstr. 20 76135 Karlsruhe Sitz der Gesellschaft: Karlsruhe Registergericht: Amtsgericht Mannheim, HRB 714807 Geschäftsführer: Andreas Haerter USt-IdNr.: DE284122682

1 1

Correct sizing of CPU and RAM
by DeJa Wu 26 Oct '23

26 Oct '23

How to correctly calculate the number of CPUs and memory required for 1000 client mailboxes and beyond? Given that 30-50% of users will be constantly connected via IMAP. I looked for information and did not find any sizing in the documentation anywhere. Is there a way to calculate my required resources? BR, DeJa How to correctly calculate the number of CPUs and memory required for 1000 client mailboxes and beyond? Given that 30-50% of users will be constantly connected via IMAP. I looked for information and did not find any sizing in the documentation anywhere. Is there a way to calculate my required resources? BR, DeJa

2 1

OAUTH2 tokeninfo is doing a GET instead of a POST request
by Alexander Leidinger 26 Oct '23

26 Oct '23

Hi, I try to setup oauth2 authentication with dovecot 2.3.21. The debug log of dovecot shows that it tries to do a HTTP GET request to the tokeninfo url with the token appended to the end of the URL. This gives a 404 error. The openidconnect server I use (keycloak) tells that this API endpoint conforms to https://openid.net/specs/openid-connect-core-1_0.html#TokenEndpoint which specifies that the request has to be a HTTP POST request. So dovecot is trying do to something (GET request) which the OIDC specification does not agree with (shall be POST request). Here is the dovecot debug log of it: ---snip--- Oct 17 12:11:19 imap dovecot[81589]: auth: Debug: http-client[1]: request [Req1: GET https://oauth2.domain.tld/realms/MyRealm/protocol/openid-connect/tokeneyJhb…<rest_omitted>...: Submitted (requests left=1) [...] Oct 17 12:11:19 imap dovecot[81589]: auth: Debug: oauth2.domain.tld: SSL: where=0x1001, ret=1: SSLv3/TLS read server session ticket Oct 17 12:11:19 imap dovecot[81589]: auth: Debug: oauth2.domain.tld: where=0x1002, ret=1: SSL negotiation finished successfully Oct 17 12:11:19 imap dovecot[81589]: auth: Debug: oauth2.domain.tld: SSL: where=0x1001, ret=1: SSL negotiation finished successfully Oct 17 12:11:19 imap syslogd: last message repeated 1 times Oct 17 12:11:19 imap dovecot[81589]: auth: Debug: oauth2.domain.tld: SSL: where=0x1001, ret=1: SSLv3/TLS read server session ticket Oct 17 12:11:19 imap dovecot[81589]: auth: Debug: oauth2.domain.tld: SSL: where=0x1002, ret=1: SSL negotiation finished successfully Oct 17 12:11:19 imap dovecot[81589]: auth: Debug: http-client: conn <IP>:443 [1]: Got 404 response for request [Req1: GET https://oauth2.domain.tld/realms/MyRealm/protocol/openid-connect/tokeneyJhb…<rest_omitted> ---snip--- My passdb config (only showing the oauth part): ---snip--- passdb { driver = oauth2 mechanisms = oauthbearer xoauth2 args = /usr/local/etc/dovecot/auth-oauth2.token.conf.ext } passdb { driver = oauth2 mechanisms = plain args = /usr/local/etc/dovecot/auth-oauth2.plain.conf.ext } ---snip--- auth-oauth2.token.conf.ext: ---snip--- openid_configuration_url = https://oauth2.domain.tld/realms/MyRealm/.well-known/openid-configuration tokeninfo_url = https://oauth2.domain.tld/realms/MyRealm/protocol/openid-connect/token introspection_url = https://oauth2.domain.tld/realms/MyRealm/protocol/openid-connect/token/intr… introspection_mode = post active_attribute = active active_value = true client_id = myid client_secret = mysecret use_grant_password = no debug = yes username_attribute = email pass_attrs = pass=%{oauth2:access_token} ---snip--- auth-oauth2.plain.conf.ext: ---snip--- openid_configuration_url = https://oauth2.domain.tld/realms/MyRealm/.well-known/openid-configuration #tokeninfo_url = https://oauth2.domain.tld/realms/MyRealm/protocol/openid-connect/token introspection_url = https://oauth2.domain.tld/realms/MyRealm/protocol/openid-connect/token/intr… introspection_mode = post active_attribute = active active_value = true client_id = myid client_secret = mysecret use_grant_password = yes debug = yes username_attribute = email pass_attrs = host=<IP of webmail> proxy=y proxy_mech=xoauth2 pass=%{oauth2:access_token} ---snip--- On https://doc.dovecot.org/configuration_manual/authentication/oauth2/ I can not find any way to tell that the tokeninfo url shall do a POST request instead of a GET request. I found something on reddit how to make it work with keycloak, but this seems to be a workaround, and not a proper fix... The first comment at https://www.reddit.com/r/selfhosted/comments/omwb2j/any_one_get_dovecot_key… makes this work for me. The working but not really up to the OIDC spec dovecot config is: auth-oauth2.token.conf.ext: ---snip--- openid_configuration_url = https://oauth2.domain.tld/realms/MyRealm/.well-known/openid-configuration #tokeninfo_url = https://oauth2.domain.tld/realms/MyRealm/Leidinger/protocol/openid-connect/… tokeninfo_url = https://oauth2.domain.tld/realms/MyRealm/protocol/openid-connect/userinfo?t… introspection_url = https://oauth2.domain.tld/realms/MyRealm/protocol/openid-connect/token/intr… introspection_mode = auth #active_attribute = active #active_value = true client_id = myid client_secret = mysecret use_grant_password = no #debug = yes username_attribute = email pass_attrs = pass=%{oauth2:access_token} ---snip--- auth-oauth2.plain.conf.ext: ---snip--- openid_configuration_url = https://oauth2.domain.tld/realms/MyRealm/.well-known/openid-configuration #tokeninfo_url = https://oauth2.domain.tld/realms/MyRealm/protocol/openid-connect/token tokeninfo_url = https://oauth2.domain.tld/realms/MyRealm/protocol/openid-connect/userinfo?t… introspection_url = https://oauth2.domain.tld/realms/MyRealm/protocol/openid-connect/token/intr… introspection_mode = auth #active_attribute = active #active_value = true client_id = myid client_secret = mysecret use_grant_password = yes #debug = yes username_attribute = email pass_attrs = host=<IP of webmail> proxy=y proxy_mech=xoauth2 pass=%{oauth2:access_token} ---snip--- Bye, Alexander. -- http://www.Leidinger.net Alexander(a)Leidinger.net: PGP 0x8F31830F9F2772BF http://www.FreeBSD.org netchild(a)FreeBSD.org : PGP 0x8F31830F9F2772BF

2 8

Is it possible to show different mechanism according to client IP ?
by Philippe MARASSE 26 Oct '23

26 Oct '23

Hello, Say I'm wondering if it's possible to show 3 mechanisms for clients in private network (XOAUTH2 / PLAIN / EXTERNAL) and only 2 to others (only OAUTH / EXTERNAL) ? I've seen allow_nets extra field for args, but it seems that's not working with ldap passdb. Regards. -- Philippe MARASSE Responsable pôle Infrastructures - DSIO Centre Hospitalier Henri Laborit CS 10587 - 370 avenue Jacques Cœur 86021 Poitiers Cedex Tel : 05.49.44.57.19 Hello, Say I'm wondering if it's possible to show 3 mechanisms for clients in private network (XOAUTH2 / PLAIN / EXTERNAL) and only 2 to others (only OAUTH / EXTERNAL) ? I've seen allow_nets extra field for args, but it seems that's not working with ldap passdb. Regards. -- Philippe MARASSE Responsable pôle Infrastructures - DSIO Centre Hospitalier Henri Laborit CS 10587 - 370 avenue Jacques Cœur 86021 Poitiers Cedex Tel : 05.49.44.57.19

2 1