- dovecot - dovecot.org

Re: dovecot on wheezy, best ssl configuration ?
by Joseph Tam 09 Jan '15

09 Jan '15

ml(a)ruggedinbox.com writes: > Our smtp server is postfix, can you please suggest a better > 'ssl_protocols' and 'ssl_cipher_list' configuration ? > We are running Debian 7 Wheezy A useful command to know is "openssl ciphers" run on the server that will tell you the ciphers available given a protocol and cipher list spec. If it comes out to empty, your client won't be able to negotiate any SSL sessions, and you'll have include more ciphers. For example, TLSv1 protocol minus any low-grade encryption or SSLv2 ciphers: $ openssl ciphers -tlsv1 'ALL:\!LOW:\!SSLv2' ADH-AES256-SHA:DHE-RSA-AES256-SHA:DHE-DSS-AES256-SHA:AES256-SHA:ADH-AES128-SHA:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA:AES128-SHA:ADH-DES-CBC3-SHA:EXP-ADH-DES-CBC-SHA:ADH-RC4-MD5:EXP-ADH-RC4-MD5:EDH-RSA-DES-CBC3-SHA:EXP-EDH-RSA-DES-CBC-SHA:EDH-DSS-DES-CBC3-SHA:EXP-EDH-DSS-DES-CBC-SHA:DES-CBC3-SHA:EXP-DES-CBC-SHA:IDEA-CBC-SHA:EXP-RC2-CBC-MD5:RC4-SHA:RC4-MD5:EXP-RC4-MD5 Joseph Tam <jtam.home(a)gmail.com>

1 0

dovecot on wheezy, best ssl configuration ?
by ml＠ruggedinbox.com 09 Jan '15

09 Jan '15

Hi all, when hardening dovecot against the POODLE vulnerability, we followed the advise to disable SSL2 and SSL3 but this is giving problems with some email clients (claws-mail). ssl_protocols = !SSLv2 !SSLv3 results in the following error: dovecot: pop3-login: Disconnected (no auth attempts in 1 secs): user=<>, rip=XXX, lip=XXX, TLS handshaking: SSL_accept() failed: error:1408A0C1:SSL routines:SSL3_GET_CLIENT_HELLO:no shared cipher, session=<2C8jBjIMmQBVGNd1> Our smtp server is postfix, can you please suggest a better 'ssl_protocols' and 'ssl_cipher_list' configuration ? We are running Debian 7 Wheezy Thank you, RuggedInbox team

4 8

auth-deny : from file to LDAP
by hummel＠pasteur.fr 09 Jan '15

09 Jan '15

Hello Timo, I want to deny access to some users. For now I'm doing it using 2 passdb's and listing users in a text file. !include auth-deny.conf.ext -> passwd-file driver !include auth-ldap.conf.ext -> ldap driver I want to do the same using only LDAP. I'm not quite sure how to do it : a) should I . change the driver of the first passdb from passwd-file to ldap . for user to be rejected, add an LDAP attribute named "foo" with a value of "yes" and map it with something like this : pass_attrs = ....,foo=deny in dovecot-ldap.conf.ext ? b) or could I use only one ldap passdb by changing the pass_filter from pass_filter = (&(objectClass=posixAccount)(uid=%u)) to something like pass_filter = (&(objectClass=posixAccount)(uid=%u)(!foo=yes)) ? Thanks -- Thomas Hummel | Institut Pasteur <hummel(a)pasteur.fr> | Groupe Exploitation et Infrastructure

3 4

Corrupted index cache after migrating from maildir to mdbox
by Tim 09 Jan '15

09 Jan '15

Hi guys, I'm running dovecot/postfix on my Debian Jessie maschine: # dovecot --version 2.2.13 doveconf -n output: http://p.bastelfreak.de/HsVwS/ today I migrated from maildir(located at /var/vmail) to mdbox with these commands: rsync -av -f"+ */" -f"- *" /var/vmail/ /home/vmail/ rm /home/vmail/*/*/Maildir -rf for i in $(doveadm user \*); do u=$(echo $i | cut -d@ -f1); d=$(echo $i |cut -d@ -f2); dsync -v -u $i mirror mdbox:/home/vmail/$d/$u/mdbox; done Then I changed the mail_location to mdbox:/home/vmail/%d/%n/mdbox and did the following commands: service dovecot restart for i in $(doveadm user \*); do u=$(echo $i | cut -d@ -f1); d=$(echo $i |cut -d@ -f2); dsync -v -u $i mirror maildir:/var/vmail/$d/$u/Mail; done doveadm index -A all INBOX for i in $(doveadm user \*); do doveadm -Dv fts rescan -u $i;done unfortunately I'm getting the following two kinds of error messages for all mail boxes in my mail.log: Error: Corrupted index cache file /home/vmail/%domain/%user/mdbox/mailboxes/%maildir/dbox-Mails/dovecot.index.cache: Broken virtual size for mail UID 2564 and: Error: read(/home/vmail/%domain/%user/mdbox/storage/m.108 ): FETCH BODY[] for mailbox %maildir UID 2564 got too little data: 2417 vs 6319 please let me know if you have any suggestions for fixing this issue or if you need more information. kind regards, Tim

6 19

Quota, doveadm, postfixadmin
by Ricardo 09 Jan '15

09 Jan '15

Hello all and happy holidays. I have Postfix+Dovecot+MySQL+Postfixadmin with CentOS 6.6, a virtual machines for testing, and then pass it to servers in production, my problem is the next: I add 30 MB for domain.local, then cast 10 MB for test1(a)domain.local and 20 MB for test2(a)domain.local, so far so good. Sending an attachment from one account to another, the example of test1(a)domain.local to test2(a)domain.local, test2(a)domain.local receive the email with the attachment. If I write in the shell doveadm quota get -u test2(a)domain.local I get the following: Quota name Type Value Limit % user STORAGE 3391 20000 16 user MESSAGE 3 10000 0 Informs me that I this consuming 16% of the 20 MB assigned to this account, but if I delete the file and again write doveadm quota get -u test2(a)domain.local I release this: Quota name Type Value Limit % user STORAGE 6782 20000 33 user MESSAGE 4 10000 0 Normal serious you continue using 16%, not 33%, when you go into the trash, because that happens from one place to another, right? These statistics the Postfixadmin Dame them so much as writing in the shell doveadm quota get -u test2(a)domain.local. I delete the file in the trash and to again write doveadm quota get -u test2(a)domain.local still see me. Quota name Type Value Limit % user STORAGE 6782 20000 33 user MESSAGE 4 10000 0 But I realize that so that it resets to 0%, I have to close the mail client, if not would follow using 33% and is when is 0% as shown here. Quota name Type Value Limit % user STORAGE 1 20000 0 user MESSAGE 2 10000 0 Is this normal? The client to send emails and exceed quota will having to always close the mail client, so you reset and stays at 0%? Can anyone help me? I have looked online but I can't find information about this. Has happened to someone? Thanks so much. Best regards.

2 1

Dovecot replication - notify not working
by Jonas Plitt 08 Jan '15

08 Jan '15

Dear Dovecot-Admins, I've set up a pair of Dovecot Servers, please find config of server one attached. They are configured to replicate changes over a tcp connection using port 12345, set up as described in http://wiki2.dovecot.org/Replication article page. Adding the user postboxes to replication using "doveadm replicator add '*' " syncs the mailboxes as expected. Unfortunately both of the servers does not propagate any changes, e.G. new mail in Sent folder. Removing and adding the mailboxes again syncs them again. Can anybody help me to get the notify working, please? many thanks in advance, Jonas

1 0

replication hangs
by Laszlo Toth 08 Jan '15

08 Jan '15

Hi, I have 2 Dovecot servers (2.2.10) which are replicating each other. Replication works fine except for one user. [root@dovecot2 ~]# doveadm -D sync -u username dovecot1 doveadm(root): Debug: Loading modules from directory: /usr/lib64/dovecot doveadm(root): Debug: Module loaded: /usr/lib64/dovecot/lib15_notify_plugin.so doveadm(root): Debug: Module loaded: /usr/lib64/dovecot/lib20_replication_plugin.so doveadm(root): Debug: Loading modules from directory: /usr/lib64/dovecot/doveadm doveadm(root): Debug: Skipping module doveadm_acl_plugin, because dlopen() failed: /usr/lib64/dovecot/doveadm/lib10_doveadm_acl_plugin.so: undefined symbol: acl_user_module (this is usually intentional, so just ignore this message) doveadm(root): Debug: Skipping module doveadm_expire_plugin, because dlopen() failed: /usr/lib64/dovecot/doveadm/lib10_doveadm_expire_plugin.so: undefined symbol: expire_set_lookup (this is usually intentional, so just ignore this message) doveadm(root): Debug: Skipping module doveadm_quota_plugin, because dlopen() failed: /usr/lib64/dovecot/doveadm/lib10_doveadm_quota_plugin.so: undefined symbol: quota_user_module (this is usually intentional, so just ignore this message) doveadm(root): Debug: Module loaded: /usr/lib64/dovecot/doveadm/lib10_doveadm_sieve_plugin.so doveadm(root): Debug: Skipping module doveadm_fts_plugin, because dlopen() failed: /usr/lib64/dovecot/doveadm/lib20_doveadm_fts_plugin.so: undefined symbol: fts_list_backend (this is usually intentional, so just ignore this message) doveadm(username): Debug: Effective uid=489, gid=489, home=/data/mail/username doveadm(username): Debug: fs: root=/data/mail/username, index=, indexpvt=, control=, inbox=, alt= doveadm(username): Debug: Namespace : Using permissions from /data/mail/username: mode=0700 gid=default dsync-local(username): Debug: brain M: in state=master_recv_handshake dsync-local(username): Debug: brain M: out state=send_mailbox_tree changed=1 dsync-local(username): Debug: brain M: in state=send_mailbox_tree dsync-local(username): Debug: brain M: out state=send_mailbox_tree_deletes changed=1 dsync-local(username): Debug: brain M: in state=send_mailbox_tree_deletes dsync-local(username): Debug: brain M: out state=recv_mailbox_tree changed=1 dsync-local(username): Debug: brain M: in state=recv_mailbox_tree dsync-local(username): Debug: brain M: out state=recv_mailbox_tree changed=0 dsync-local(username): Debug: brain M: in state=recv_mailbox_tree dsync-local(username): Debug: brain M: out state=recv_mailbox_tree changed=0 dsync-local(username): Debug: brain M: in state=recv_mailbox_tree dsync-local(username): Debug: brain M: out state=recv_mailbox_tree changed=0 dsync-local(username): Debug: brain M: in state=recv_mailbox_tree dsync-local(username): Debug: brain M: out state=recv_mailbox_tree changed=0 dsync-local(username): Debug: brain M: in state=recv_mailbox_tree dsync-local(username): Debug: brain M: out state=recv_mailbox_tree changed=0 dsync-local(username): Debug: brain M: in state=recv_mailbox_tree dsync-local(username): Debug: brain M: out state=recv_mailbox_tree changed=0 dsync-local(username): Debug: brain M: in state=recv_mailbox_tree dsync-local(username): Debug: brain M: out state=recv_mailbox_tree changed=0 dsync-local(username): Debug: brain M: in state=recv_mailbox_tree dsync-local(username): Debug: brain M: out state=recv_mailbox_tree changed=0 dsync-local(username): Debug: brain M: in state=recv_mailbox_tree dsync-local(username): Debug: brain M: out state=recv_mailbox_tree_deletes changed=1 dsync-local(username): Debug: brain M: in state=recv_mailbox_tree_deletes dsync-local(username): Debug: brain M: out state=recv_mailbox_tree_deletes changed=0 dsync-local(username): Debug: brain M: in state=recv_mailbox_tree_deletes dsync-local(username): Debug: brain M: out state=recv_mailbox_tree_deletes changed=0 dsync-local(username): Debug: brain M: in state=recv_mailbox_tree_deletes ...and it hangs. Both servers are CentOS 6.6 x64. Replication status for the problematic user: [root@deoveadm2 ~]# doveadm replicator status username username priority fast sync full sync failed username low 42:10:59 42:10:59 y I tried to reindex the problematic mailbox, tried to restart both mail servers but the issue still here. I found no error messages in /var/log/maillog. What should I try next? Thanks, Laszlo

1 0

imapc only backing up INBOX
by List 07 Jan '15

07 Jan '15

I am attempting to pull email from gmail IMAP to my local machine and with the configuration I have I only seem to get messages from the INBOX folder. Hoping I could get some assistance getting all the gmail folders to download. Here is the imapc config: imapc_host = 64.233.171.108 imapc_user = %u imapc_master_user = master imapc_password = somepass imapc_features = rfc822.size # If you have Dovecot v2.2.8+ you may get a significant performance improvement with fetch-headers: imapc_features = $imapc_features fetch-headers # Read multiple mails in parallel, improves performance mail_prefetch_count = 20 # If the old IMAP server uses INBOX. namespace prefix, set: imapc_list_prefix = Gmail # for SSL: imapc_port = 993 imapc_ssl = imaps #imapc_ssl_ca_dir = /etc/ssl imapc_ssl_verify = no And the doveadm command I am running: doveadm -D -o imapc_user=$username -o imapc_password=$escaped_password backup -R -x '\All' -x '\Flagged' -x '\Important' -u $username imapc:

1 0

Cached message size smaller than expected
by David Saez 07 Jan '15

07 Jan '15

Hi Since i upgraded to Dovecot 2.2.15 i start experiencing "Cached message size smaller than expected" errors that render a whole imap folder unusable as dovecot panics. I used Timo Sirainen maildir-size-fix.pl v1.1 script to try to fix the sizes but it does not seem to work trying to access the maildir produces this log in dovecot: Jan 07 19:34:13 imap(forumed(a)forumed.biz): Error: read(zlib(/var/spool/exim/mail/forumed.biz/forumed/.Sent/cur/1386527120.M104960P2012.mail,S=7725131:2,S)) failed: Cached message size smaller than expected (7725131 < 7729083, box=Sent, UID=2734) Jan 07 19:34:13 imap(forumed(a)forumed.biz): Error: Maildir filename has wrong S value, renamed the file from /var/spool/exim/mail/forumed.biz/forumed/.Sent/cur/1386527120.M104960P2012.mail,S=7725131:2,S to /var/spool/exim/mail/forumed.biz/forumed/.Sent/cur/1386527120.M104960P2012.mail,S=7729084:2,S Jan 07 19:34:13 imap(forumed(a)forumed.biz): Error: Corrupted index cache file /var/spool/exim/mail/forumed.biz/forumed/.Sent/dovecot.index.cache: Broken physical size for mail UID 2734 Jan 07 19:34:13 imap(forumed(a)forumed.biz): Panic: file istream.c: line 167 (i_stream_read): assertion failed: (old_size <= _stream->pos - _stream->skip) Jan 07 19:34:13 imap(forumed(a)forumed.biz): Error: Raw backtrace: /usr/local/lib/dovecot/libdovecot.so.0(+0x75e1a) [0x7feb14469e1a] -> /usr/local/lib/dovecot/libdovecot.so.0(+0x75e96) [0x7feb14469e96] -> /usr/local/lib/dovecot/libdovecot.so.0(i_error+0) [0x7feb1441b2bf] -> /usr/local/lib/dovecot/libdovecot.so.0(i_stream_read+0x214) [0x7feb144731f4] -> /usr/local/lib/dovecot/libdovecot.so.0(i_stream_read_data+0x52) [0x7feb144733b2] -> /usr/local/lib/dovecot/libdovecot.so.0(message_get_body_size+0xa9) [0x7feb1445da89] -> /usr/local/lib/dovecot/libdovecot-storage.so.0(index_mail_init_stream+0x16f) [0x7feb1473795f] -> /usr/local/lib/dovecot/libdovecot-storage.so.0(+0x2dacc) [0x7feb14701acc] -> /usr/local/lib/dovecot/libdovecot-storage.so.0(mail_get_stream+0x4d) [0x7feb1470f3ed] -> /usr/local/lib/dovecot/libdovecot-storage.so.0(+0x2e3e8) [0x7feb147023e8] -> /usr/local/lib/dovecot/libdovecot-storage.so.0(mail_get_virtual_size+0x2b) [0x7feb1470f07b] -> dovecot/imap() [0x41b2f5] -> dovecot/imap() [0x419d6c] -> dovecot/imap(imap_fetch_more+0x31) [0x419fa1] -> dovecot/imap() [0x40ebb0] -> dovecot/imap(command_exec+0x3d) [0x4183ad] -> dovecot/imap() [0x416a7e] -> dovecot/imap(client_output+0x10b) [0x417adb] -> /usr/local/lib/dovecot/libdovecot.so.0(+0x931d9) [0x7feb144871d9] -> /usr/local/lib/dovecot/libdovecot.so.0(io_loop_call_io+0x5b) [0x7feb1447b0db] -> /usr/local/lib/dovecot/libdovecot.so.0(io_loop_handler_run_internal+0xaf) [0x7feb1447c27f] -> /usr/local/lib/dovecot/libdovecot.so.0(io_loop_handler_run+0x9) [0x7feb1447b169] -> /usr/local/lib/dovecot/libdovecot.so.0(io_loop_run+0x38) [0x7feb1447b1f8] -> /usr/local/lib/dovecot/libdovecot.so.0(master_service_run+0x13) [0x7feb14420193] -> dovecot/imap(main+0x2b0) [0x4210d0] -> /lib/libc.so.6(__libc_start_main+0xfd) [0x7feb140b1c4d] -> dovecot/imap() [0x40bea9] Jan 07 19:34:13 imap(forumed(a)forumed.biz): Fatal: master: service(imap): child 9337 killed with signal 6 (core not dumped) 1386527120.M104960P2012.mail,S=7725131:2,S is actually a gzip compressed mail, it's compressed size (file system size) is 7725131 bytes after dovecot panic it's automatically renamed to 1386527120.M104960P2012.mail,S=7739837:2,S by dovecot dovecot -n # OS: Linux 2.6.32-5-amd64 x86_64 Debian 6.0.3 auth_cache_size = 10 M auth_cache_ttl = 1 days auth_mechanisms = plain login auth_username_chars = abcdefghijklmnopqrstuvwxyz01234567890.-_@ disable_plaintext_auth = no hostname = pop.olsns.net log_path = /usr/local/log/dovecot.log mail_fsync = never mail_gid = mail mail_plugins = " zlib" mail_uid = exim mailbox_list_index = yes maildir_very_dirty_syncs = yes namespace inbox { inbox = yes location = mailbox Drafts { auto = subscribe special_use = \Drafts } mailbox Junk { auto = subscribe special_use = \Junk } mailbox Sent { auto = subscribe special_use = \Sent } mailbox Trash { auto = subscribe special_use = \Trash } prefix = } passdb { args = /usr/local/etc/dovecot/dovecot-sql.conf driver = sql } plugin { zlib_save = gz zlib_save_level = 6 } pop3_fast_size_lookups = yes protocols = imap pop3 service auth { user = root } service imap-login { executable = /usr/local/libexec/dovecot/imap-login inet_listener imap { address = 82.98.162.142 127.0.0.1 } service_count = 100 user = dovecot } service imap { service_count = 100 } service pop3-login { executable = /usr/local/libexec/dovecot/pop3-login inet_listener pop3 { address = 82.98.162.142 } service_count = 100 user = dovecot } service pop3 { executable = /usr/local/libexec/dovecot/pop3 service_count = 100 } ssl_cert = </usr/local/etc/dovecot/dovecot.pem ssl_key = </usr/local/etc/dovecot/dovecot.key userdb { driver = prefetch } protocol pop3 { pop3_client_workarounds = outlook-no-nuls oe-ns-eoh pop3_uidl_format = %08Xu%08Xv } protocol imap { mail_plugins = " zlib imap_zlib" }

1 0

Kerberos problems with /dev/null as dovecot home
by Roland Hopferwieser 07 Jan '15

07 Jan '15

Hi, this is for documentation if someone else has the same problem. After migration from Dovecot 1 to 2.2. it was no longer able use Kerberos (Heimdal). I found out that dovecot tries to read ~/.krb5/config in the home of the dovecot user. This file doesn't need to exist, but if the home is set to /dev/null, it will not work. Maybe it would be nice to have an error message for this case. Regards, Roland

1 0