- dovecot - dovecot.org

bug report: lmtp fails on root-squashed NFS filesystem
by Anne Bennett 09 Oct '23

09 Oct '23

Hi, all. I'm trying to set up Postfix with dovecot LTMP delivery on a host where the user files (/var/spool/mail as well as home directories) are on NFS filesystems, which are exported root-squashed to the mail server. I definitely don't want to give the mail server root permissions on the user files. LMTP delivery fails with this logged message (e.g.): Nov 16 17:51:36 lust dovecot: lmtp(anne)<16830><mkkzEPg1lGG+QQAAs/mAJw>: msgid=<202111162229.1AGMTfAO024765(a)vindemiatrix.encs.concordia.ca>: save failed to INBOX: Read-only mbox I found this posting where someone else had a similar problem and traced it in some detail back in 2019: https://dovecot.org/list/dovecot/2019-February/114611.html but apparently no one answered the fellow. In order to check that this is indeed the same problem, I temporarily changed the INBOX definition to make it write into /var/tmp/ (on a local filesystem), and delivery worked. I then temporarily changed the INBOX definition to make it write into an NFS filesystem with root NOT squashed, and again it worked (after I chmodded the directory to 1777 to allow any user to create a file). I believe that the person who wrote the above posting is correct: at some point, file access is (incorrectly) checked as root instead of as the target user. This is a bit of a showstopper for me. Any plans to address this? I attach the output of "dovecot -n", fwiw, but I don't think that this is a configuration problem... Anne. -- Ms. Anne Bennett, Senior Sysadmin, ENCS, Concordia University, Montreal H3G 1M8 anne(a)encs.concordia.ca +1 514 848-2424 x2285

2 4

Dovecot services not starting
by Jose David Bravo A 08 Oct '23

08 Oct '23

Hi, I'm running dovecot 2.3.16 on Ubuntu 22.04.2. But when I start dovecot, I can only see that the services are failing to start. It don't show any additional error about why it's failing, may be because the log service is not running? Oct 06 15:19:00 master: Error: service(log): command startup failed, throttling for 2.000 secs Oct 06 15:19:45 master: Error: service(imap-login): command startup failed, throttling for 2.000 secs Oct 06 15:19:53 master: Error: service(pop3-login): command startup failed, throttling for 2.000 secs Oct 06 15:21:45 master: Error: service(imap-login): command startup failed, throttling for 4.000 secs Oct 06 15:21:53 master: Error: service(pop3-login): command startup failed, throttling for 4.000 secs Oct 06 15:23:45 master: Error: service(imap-login): command startup failed, throttling for 8.000 secs Oct 06 15:23:53 master: Error: service(pop3-login): command startup failed, throttling for 8.000 secs Oct 06 15:25:45 master: Error: service(imap-login): command startup failed, throttling for 16.000 secs Oct 06 15:25:53 master: Error: service(pop3-login): command startup failed, throttling for 16.000 secs Oct 06 15:27:45 master: Error: service(imap-login): command startup failed, throttling for 32.000 secs Oct 06 15:27:53 master: Error: service(pop3-login): command startup failed, throttling for 32.000 secs Oct 06 15:28:23 master: Error: service(stats): command startup failed, throttling for 2.000 secs Oct 06 15:28:25 master: Error: service(stats): command startup failed, throttling for 4.000 secs Oct 06 15:29:44 master: Error: service(imap-login): command startup failed, throttling for 60.000 secs Oct 06 15:29:53 master: Error: service(pop3-login): command startup failed, throttling for 60.000 secs Is there any option that I can run those services manually so I can see what's going on and why those are not stating? or any other option to debug it? This is my current config: # 2.3.16 (7e2e900c1a): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.16 (09c29328) # OS: Linux 5.14.0-284.11.1.el9_2.x86_64 x86_64 Ubuntu 22.04.2 LTS # Hostname: xxxxxx auth_debug = yes auth_debug_passwords = yes auth_master_user_separator = * auth_mechanisms = PLAIN LOGIN auth_verbose = yes base_dir = /var/run/dovecot default_client_limit = 4096 default_process_limit = 500 default_vsz_limit = 640 B deliver_log_format = from=%{from}, envelope_sender=%{from_envelope}, subject=%{subject}, msgid=%m, size=%{size}, delivery_time=%{delivery_time}ms, %$ dict { acl = mysql:/etc/dovecot/dovecot-share-folder.conf lastlogin = mysql:/etc/dovecot/dovecot-last-login.conf quotadict = mysql:/etc/dovecot/dovecot-used-quota.conf } first_valid_uid = 2000 imap_hibernate_timeout = 30 secs imap_max_line_length = 2 M last_valid_uid = 2000 listen = * login_log_format_elements = user=<%u> method=%m rip=%r lip=%l %c %k mail_attribute_dict = file:%Lh/dovecot-attributes mail_debug = yes mail_gid = 2000 mail_location = maildir:%Lh/Maildir/:INDEX=%Lh/Maildir/ mail_plugins = acl mail_log mailbox_alias notify quota mail_uid = 2000 mailbox_list_index_very_dirty_syncs = yes managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext imapsieve vnd.dovecot.imapsieve namespace { inbox = yes location = mailbox Archive { auto = no special_use = \Archive } mailbox Archives { auto = no special_use = \Archive } mailbox "Deleted Messages" { auto = no autoexpunge = 60 days special_use = \Trash } mailbox Drafts { auto = subscribe special_use = \Drafts } mailbox Junk { auto = subscribe autoexpunge = 60 days special_use = \Junk } mailbox "Junk E-mail" { auto = no autoexpunge = 60 days special_use = \Junk } mailbox Sent { auto = subscribe special_use = \Sent } mailbox "Sent Items" { auto = no special_use = \Sent } mailbox "Sent Messages" { auto = no special_use = \Sent } mailbox Spam { auto = no autoexpunge = 60 days special_use = \Junk } mailbox Trash { auto = subscribe autoexpunge = 60 days special_use = \Trash } prefix = separator = / type = private } namespace { list = children location = maildir:%%Lh/Maildir/:INDEX=%%Lh/Maildir/Shared/%%Ld/%%Ln prefix = Shared/%%u/ separator = / subscriptions = yes type = shared } passdb { args = /etc/dovecot/dovecot-master-users driver = passwd-file master = yes } passdb { args = /opt/iredmail/custom/dovecot/master-users driver = passwd-file master = yes } passdb { args = /etc/dovecot/dovecot-mysql.conf driver = sql } plugin { acl = vfile acl_shared_dict = proxy::acl imapsieve_mailbox1_before = file:/opt/iredmail/bin/dovecot/sieve/report_spam.sieve imapsieve_mailbox1_causes = COPY APPEND imapsieve_mailbox1_name = Junk imapsieve_mailbox2_before = file:/opt/iredmail/bin/dovecot/sieve/report_ham.sieve imapsieve_mailbox2_causes = COPY imapsieve_mailbox2_from = Junk imapsieve_mailbox2_name = * imapsieve_url = sieve://127.0.0.1:4190 last_login_dict = proxy::lastlogin last_login_key = # hidden, use -P to show it mail_log_events = delete undelete expunge copy save mailbox_create mailbox_delete mailbox_rename mail_log_fields = uid box msgid size from subject flags mailbox_alias_new = Sent Messages mailbox_alias_new2 = Sent Items mailbox_alias_old = Sent mailbox_alias_old2 = Sent quota = dict:user::proxy::quotadict quota_grace = 50M quota_rule = *:storage=1G quota_status_nouser = DUNNO quota_status_overquota = 552 5.2.2 Mailbox is full quota_status_success = DUNNO quota_warning = storage=100%% quota-warning 100 %u quota_warning2 = storage=95%% quota-warning 95 %u quota_warning3 = storage=90%% quota-warning 90 %u quota_warning4 = storage=85%% quota-warning 85 %u sieve = ~/sieve/dovecot.sieve sieve_before = /var/vmail/sieve/dovecot.sieve sieve_dir = ~/sieve sieve_global_dir = /var/vmail/sieve sieve_global_extensions = +vnd.dovecot.pipe +vnd.dovecot.environment sieve_max_redirects = 30 sieve_pipe_bin_dir = /opt/iredmail/bin/dovecot/sieve sieve_plugins = sieve_imapsieve sieve_extprograms sieve_redirect_envelope_from = recipient sieve_vacation_send_from_recipient = yes } protocols = pop3 imap sieve lmtp service anvil { process_limit = 1 unix_listener anvil-auth-penalty { group = vmail mode = 0660 user = vmail } } service auth { client_limit = 4096 inet_listener { port = 12346 } process_limit = 1 unix_listener /var/spool/postfix/private/dovecot-auth { group = vmail mode = 0666 user = vmail } unix_listener auth-master { group = vmail mode = 0666 user = vmail } unix_listener auth-userdb { group = vmail mode = 0660 user = vmail } } service dict { unix_listener dict { group = vmail mode = 0660 user = vmail } } service imap-hibernate { unix_listener imap-hibernate { group = vmail user = vmail } } service imap-login { client_limit = 0 inet_listener imap { port = 143 } inet_listener imaps { port = 993 ssl = yes } process_limit = 0 service_count = 0 } service imap { process_limit = 4096 unix_listener imap-master { group = vmail mode = 0666 user = vmail } } service lmtp { executable = lmtp -L inet_listener lmtp { port = 24 } process_min_avail = 5 user = vmail } service managesieve-login { inet_listener sieve { port = 4190 } } service pop3-login { client_limit = 0 inet_listener pop3 { port = 110 } inet_listener pop3s { port = 995 ssl = yes } process_limit = 0 service_count = 0 } service pop3 { process_limit = 4096 } service quota-status { client_limit = 1000 executable = quota-status -p postfix inet_listener { port = 12340 } } service quota-warning { executable = script /opt/iredmail/bin/dovecot/quota_warning.sh unix_listener quota-warning { group = vmail mode = 0660 user = vmail } } service stats { inet_listener stats { address = 0.0.0.0 port = 24242 } unix_listener stats-writer { group = vmail mode = 0660 user = vmail } } ssl = required ssl_cert = </opt/iredmail/ssl/cert.pem ssl_cipher_list = EECDH+CHACHA20:EECDH+AESGCM:EDH+AESGCM:AES256+EECDH ssl_dh = # hidden, use -P to show it ssl_key = # hidden, use -P to show it ssl_prefer_server_ciphers = yes syslog_facility = local5 userdb { args = /etc/dovecot/dovecot-mysql.conf driver = sql } protocol imap { imap_client_workarounds = tb-extra-mailbox-sep imap_metadata = yes mail_max_userip_connections = 30 mail_plugins = acl mail_log mailbox_alias notify quota imap_quota imap_acl imap_sieve last_login zlib } protocol pop3 { mail_max_userip_connections = 30 mail_plugins = acl mail_log mailbox_alias notify quota last_login zlib pop3_client_workarounds = outlook-no-nuls oe-ns-eoh pop3_uidl_format = %08Xu%08Xv } protocol lda { lda_mailbox_autocreate = yes lda_mailbox_autosubscribe = yes mail_plugins = acl mail_log mailbox_alias notify quota sieve last_login } protocol lmtp { lmtp_save_to_detail_mailbox = yes mail_plugins = acl mail_log mailbox_alias notify quota sieve last_login recipient_delimiter = + } Thank you! [ http://www.colombiahosting.com/ ] Jose Bravo

4 4

sieve processing - enable/disable per user?
by Arkadiusz Miśkiewicz 07 Oct '23

07 Oct '23

Hi. I keep users in database and would like to enable/disable sieve for them per user. What's the approach for that? I'm looking at the sieve options and user_query setting but don't see anything that would make this possible. -- Arkadiusz Miśkiewicz, arekm / ( maven.pl | pld-linux.org )

3 5

Shared mailboxes and indexes
by Francis Augusto Medeiros-Logeay 06 Oct '23

06 Oct '23

Hi, I googled a bit to see if I understand it, but no, I haven’t got anything that explains this: What’s exactly the difference between INDEX and INDEXPVT for shared mailboxes? Why are they pointing to the same folder on Dovecot example (https://doc.dovecot.org/configuration_manual/shared_mailboxes/shared_mailbo… Best, Francis

1 0

Pay Someone to Take My Online Course?1
by xotawa2329＠hapincy.com 06 Oct '23

06 Oct '23

[b]Pay Someone to Take My Online Course?[/b] Different understudies who battle with reworking school, work, and family obligations select online class tutors to assist them with finishing their tests and complete their coursework. In any case, some solicitation the ethicality of this planning. While [url=https://onlineclassservices.com/nurs-fpx-4040-assessment-4-attempt-1-in… FPX 4040 Assessment 4[/url] has every one of the reserves of being enticing, it goes with two or three serious dangers. This article will examine a piece of the things you ought to remember going before enlisting an online class help association. It's clearly a fact that online classes can be truly troublesome, particularly for working professionals who have a clamoring plan. Oftentimes they are searching for someone to take a whole course or individual tasks for them, to assist with managing their grades and moderate their strain. Nonetheless, be wary of affiliations that guarantee too wonderful to be authentic. They could charge you enormous totals for their associations and end up not conveying. The best technique for guaranteeing that you are getting anything that would be fair is to use an online class tutor who offers an inadequate responsibility. Additionally, review that different schools consider paying someone to take an online class to swindle. Therefore, whenever got, you could go facing silly outcomes like besieging the course, scholarly suspension or even send off. To this end picking a fair relationship with a showed history is crucial. The association is clear: present your mentioning and survey offers from qualified educated authorities. Then enlist the one that is reasonable for yourself and store maintains in [url=https://onlineclassservices.com/nurs-fpx-4050-assessment-1-attempt-3-pr… FPX 4050 Assessment 1[/url] scrow until your assignment is finished. Online classes are eminent among understudies who need to save time on education and spotlight more on work or other private issues. These merge understudies who are taking courses while working and attempting to change family and profession responsibilities, military understudies on sending, and understudies with genuine inadequacies or sickness that make it pursuing for them to go to classes. Unfortunately, there are many tricks that confirmation to take online courses for you. These affiliations charge ridiculous totals and don't complete their obligations. They may also hand you over to your school. Tolerating that they do, you could be killed from your underwriting project or even suspended or removed from school. This isn't the very thing that you truly need for your business and future. Therefore, you genuinely need to track down serious areas of strength for a that offers a fair cost and mind blowing results. To this end you ought to search for a [url=https://onlineclassservices.com/nurs-fpx-4050-assessment-2-attempt-1-et… FPX 4050 Assessment 2[/url] affiliation that has an inadequate responsibility and splendid customer association. Various individuals decide to use a professional to take their online class since they need the opportunity to go to it very close. They could be working the whole day, supervising family issues, or fighting disease and disappointments that log jam their review tendencies. These professionals can assist you with fulfilling time necessities, stay away from imaginative theft, and set free your nights to zero in on work or other unwinding works out. They may comparatively have the decision to help you with beating any learning handicaps you have. Copyright infringement suggests utilizing someone else's words and thoughts without their endorsement. It is viewed as a kind of cheating and can accomplish a delicate grade or even send off from school. It is difficult to ensure that a used professional won't phony. This is on the grounds that educational foundations don't have [url=https://onlineclassservices.com/nurs-fpx-4900-assessment-1-assessing-th… FPX 4900 Assessment 1 Assessing the Problem[/url] assets for check whether understudies are authentic or not. This truly expects that tolerant you are gotten, you will probably lose the cash you paid to have someone take your class. There's no veritable strategy for remaining caution assuming the solitary you enroll to take your online course will tell the truth and dependable. They probably won't be in a tantamount state as you. Moreover, they apparently won't be as dedicated to finishing the class for you as you are. They may very well be doing the base extent of work expected to get reviewed and a brief time frame later vanish. MORE [url=https://dev.gajim.org/gajim/website/-/issues/35#note_211778]Facebook is a powerful tool for business[/url] [url=https://xtremepape.rs/members/horridhenry7860.397211/about]Mobile Application Development Services[/url] [url=https://xtremepape.rs/members/samfarrid4563.397213/about]best digital marketing agencies[/url]

5 5

Is XOAUTH2 support broken in 2.3.21?
by Christian Rößner 05 Oct '23

05 Oct '23

Hi, I use Roundcube with OIDC. Everything works fine in Dovecot 2.3.20, but broke in 2.3.21. Downgrading to 2.3.20 makes it work again, so it is introduced in the newer release. Error (2.3.21): ``` Oct 4 11:03:57 mx dovecot[558531]: imap-login: Disconnected: Connection closed (client didn't finish SASL auth, waited 1 secs): user=<christian(a)roessner.email>, orig_user=<christian(a)roessner.email>, method=XOAUTH2, rip=192.168.0.4, lip=192.168.0.2, TLS, TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) ``` Here is an example with 2.3.20: Success (2.3.20): ``` Oct 4 11:17:21 mx dovecot[889914]: imap-login: Login: user=<christian(a)roessner.email>, orig_user=<christian(a)roessner.email>, method=XOAUTH2, rip=192.168.0.4, lip=192.168.0.2, mpid=891874, TLS, TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) ``` Kind regards Christian Rößner -- Rößner-Network-Solutions Zertifizierter ITSiBe / CISO Karl-Bröger-Str. 10, 36304 Alsfeld Fax: +49 6631 78823409, Mobil: +49 171 9905345 USt-IdNr.: DE225643613, https://roessner.website PGP fingerprint: 658D 1342 B762 F484 2DDF 1E88 38A5 4346 D727 94E5

3 12

Re: How to reduce the number of UNIX sockets?
by Joseph Tam 05 Oct '23

05 Oct '23

From: Steve Litt <slitt(a)troubleshooters.com> > Recently I've been getting the dreaded X error "Maximum number of > clients exceeded", so I performed an lsof -U to find who was using > UNIX sockets. This uncovered a buggy looping program I wrote using up > gobs of UNIX sockets, along with some browsers, dbus-daemon, electron > (used by vscode), smbd, and Dovecot, which uses 36 UNIX sockets. Only 36? The number of sockets seems to scale proportionally with the number of users. The login process of my service easily consumes several hundred sockets and could on occasions run into the thousands. (See also my previous posts on socket starvation.) Each client connection will consume a few sockets -- it uses maybe a few more than some applications do as they separate privileged daemons from worker daemons, and pass data around via sockets, but socket use if within reason. > I can kill dbus-daemon and the buggy program I wrote, minimize use of > browsers, disable smbd except when I (rarely) need it, but can you > think of things I can do to reduce the number of UNIX sockets used by > Dovecot on my machine? You can limit the number of clients per IP (e.g. mail_max_userip_connections) to lower the number of concurrent mailboxes that are open. Or use the idle process facility to park inactive connections (not sure if that frees sockets). Or cap the number of clients (process_limit, service_count, etc.), but if you're bumping up against those limits, you've either underprovisioned your service or you have something misconfigured. (Again, see my previous post on service_limit.) Maybe you need to *increase* those limits if you're hitting some client limit in regular use. From what you describe, you resolved the cause of your socket starvation whose cause was not dovecot. I'm not sure what you hope to gain by saving a few sockets that dovecot uses just to make headroom for a buggy script. Joseph Tam <jtam.home(a)gmail.com>

1 0

How to reduce the number of UNIX sockets?
by Steve Litt 04 Oct '23

04 Oct '23

Hi all, I'm using Dovecot version 2.3.21 on an up to date Void Linux on a 6 core 12 thread Ryzen with 48GB RAM, 1TB NVMe, and 12TB of 7200 RPM spinning rust hard drives. Recently I've been getting the dreaded X error "Maximum number of clients exceeded", so I performed an lsof -U to find who was using UNIX sockets. This uncovered a buggy looping program I wrote using up gobs of UNIX sockets, along with some browsers, dbus-daemon, electron (used by vscode), smbd, and Dovecot, which uses 36 UNIX sockets. I can kill dbus-daemon and the buggy program I wrote, minimize use of browsers, disable smbd except when I (rarely) need it, but can you think of things I can do to reduce the number of UNIX sockets used by Dovecot on my machine? Thanks, SteveT Steve Litt Autumn 2023 featured book: Rapid Learning for the 21st Century http://www.troubleshooters.com/rl21

1 0

Plugin to cleanup/remove unused user defined keywords(IMAP PERMANENTFLAGS) possible ?
by sergey＠srgdev.com 03 Oct '23

03 Oct '23

I found a reference to a similar issues here: https://www.dovecot.org/list/dovecot/2010-March/047925.html I know IMAP rfc say nothing about removing the keywords/PERMANENTFLAGS (they can only be added https://www.rfc-editor.org/rfc/rfc3501.html#page-64) , therefore I wonder if it is possible to create a Dovecot plugin to accomplish this task ? Technically it is possible to do now via the following steps: 1. Ensure the "unwanted" user defined keyword/flag is remove from all messages in a folder (Folder A) 2. Create a temporary folder (Folder A_temp) 3. Move all messages from Folder A -> Folder A_temp 4. Delete Folder A 5. Rename Folder A_temp -> Folder A As you can see this highly inefficient and awkward and even if the unwanted keyword does NOT appear in Folder A anymore , it still can be found in '~/Maildir/dovecot-keywords' file Alternatively, if it is hard to create a plugin that would remove the keyword for good, would something like this be easier: 1. Define a list of "allowed" user defined keywords 1a. Perhaps this list can be defined via METADATA extension on per folder basis 2. Reject(or discard) "not allowed" keyword sent via the +FLAGS / +FLAGS.SILENT commands Any helpful plugin example or code references would be greatly appreciated. Thank you very much, Sergey Mosin

1 0

Dovecot List server
by Paul Enlund 03 Oct '23

03 Oct '23

Hi Is there a contact address for operation of this list server. I have some observations regarding ARC signing to share. Regards Paul

2 1

Ping
by Paul Enlund 03 Oct '23

03 Oct '23

just a test sorry for noise _______________________________________________ dovecot mailing list -- dovecot(a)dovecot.org To unsubscribe send an email to dovecot-leave(a)dovecot.org

1 0

Compression: all or nothing?
by Alex King 03 Oct '23

03 Oct '23

Using 2.3.13 (89f716dc2) (debian package), with mdbox storage. I considering adding the zlib plugin. I understand that reading mail can cope with either compressed or uncompressed mailboxes. I'm wondering if I can leave the main storage uncompressed, while having the alternate storage compressed. There does not seem to be a way to configure this, from https://doc.dovecot.org/settings/plugin/zlib-plugin/ it seems compression (on saving emails) is an all-or-nothing option? Can I leave zlib_save unset in my main configuration, and have doveadm use some alternate configuration with zlib_save set? It doesn't look hopeful because I don't see the ability to use a different config at https://wiki.dovecot.org/Tools/Doveadm/Altmove. Perhaps I would need multiple copies of the daemon running? Or is it better just to compress everything? I plan to store older mails (perhaps 3months+) in the alternative storage, and was thinking it would be nice to have those compressed, while I don't need to compress the main store. Any feedback welcome. Thanks, Alex

2 2

Ping
by Paul Enlund 02 Oct '23

02 Oct '23

just a test sorry for noise

1 0

Re: Changed separator, sub folders not showing new e-mail
by Francis Augusto Medeiros-Logeay 02 Oct '23

02 Oct '23

I found the answer here: https://apple.stackexchange.com/questions/441313/no-mailbox-doesnt-exist-se… Apparently on Mac one needs to update the separator on a file, since it doesn’t seem that the Mail.app does it for itself. On the iPhone it happened automatically. Best, Francis

1 0

Changed separator, sub folders not showing new e-mail
by Francis Augusto Medeiros-Logeay 02 Oct '23

02 Oct '23

Hi, I recently changed the mailbox separator from '.' to '/' so that I could have shared mailboxes working. However, while the mailboxes show fine on Roundcube and on other web-based e-mail clients, on the Mail.app on my Mac I don't get newer messages on those sub folders. For example, I have a subfolder Test. Mails filtered to be dropped there, show fine. But I have one called Lists, with a sub folder called "Dovecot". I can't read mails that are under "Lists/Dovecot". Can anyone help? Best, Francis -- Francis Augusto Medeiros-Logeay Oslo, Norway

1 0

Separators and shared namespaces
by Francis Augusto Medeiros-Logeay 28 Sep '23

28 Sep '23

Hi Martin, I had a similar problem: https://dovecot.org/mailman3/archives/list/dovecot@dovecot.org/thread/DNHM3… It seemed to me that using ‘.’ truncated the domain name when that was used in the paths, such as when using %d. Best, Francis

2 1

How to use http api doveadm to manage acl permissions
by cyril.leclerc＠mantiq.com 28 Sep '23

28 Sep '23

I started the http api on dovecot configuration but following the documentation available here : https://doc.dovecot.org/admin_manual/doveadm_http_api/ I dont see anything regarding the acl permissions ? do we have to use a specific command ? how to manage a user acl permissions ( change the content of dovecot-acl file ?

3 10

Re: Dovecot lda-dupes
by Francis Augusto Medeiros-Logeay 28 Sep '23

28 Sep '23

Hi, I have read elsewhere that the Maildir shouldn’t be at the home. But that’s how it worked for me since the start. I wonder if I could either change the location of these .dovecot.lda-dupes, or if I could change home without having to move the mailboxes of all the users. Today I have this: On my dovecot-sql.conf.ext: iterate_query = SELECT username AS user FROM mailbox user_query = SELECT CONCAT('/var/mail/vmail/',maildir) AS home, \ CONCAT('maildir:/var/mail/vmail/',maildir,':INDEX=/var/vmail-index/index/%d/%n:CONTROL=/var/vmail-index/control/%d/%n') AS mail, \ 5000 AS uid, 5000 AS gid, CONCAT('*:bytes=',quota) AS quota_rule \ FROM mailbox WHERE username = '%u' AND active = 1 password_query = SELECT username AS user,password FROM mailbox \ WHERE username = '%u' AND active=‘1' On my 10-mail.conf mail_location = maildir:/var/mail/vmail/%d/%n:INDEX=/var/vmail-index/index/%d/%n:CONTROL=/var/vmail-index/control/%d/%n If I add `Maildir` to the mail_location and to the mail user_query, will I have to move mailboxes, or the only thing I have to do is to add “Maildir” when I use %h/%%h? Best, Francis

1 0

Re: Dovecot lda-dupes
by Francis Augusto Medeiros-Logeay 28 Sep '23

28 Sep '23

Never mind, I found it. I had to add `replication_dsync_parameters`, with the default values, but with `-x shared` to exclude the namespace. Best, Francis

1 0

Dovecot lda-dupes
by Francis Augusto Medeiros-Logeay 27 Sep '23

27 Sep '23

Hi, Since I enabled shared mailboxes I'm having these errors: Sep 27 21:22:41 doveadm(francis(a)med-lo.eu): Error: Failed to access mailbox dovecot/lda-dupes: stat(/var/mail/vmail/med-lo.eu/francis/.dovecot.lda-dupes/tmp) failed: Not a directory And replication stopped. How can I fix this? Best, Francis

1 0

Separators and shared namespaces
by martin f krafft 27 Sep '23

27 Sep '23

Hello, I am running Dovcecot 2.3.19 on Debian, and I am trying to get shared to work. It's working if I do this: ``` namespace { type = shared separator = / prefix = Team/%%u/ location = maildir:%%h/Maildir:INDEX=%h/Maildir/Team/%%u:INDEXPVT=%h/Maildir/Team/%%u subscriptions = no list = children } ``` After setting some ACLs, I now have the following in `LIST` output: ``` … . LIST "" * * LIST (\HasNoChildren) "/" INBOX […] * LIST (\Noselect \HasChildren) "/" Team/rechnungseingang(a)example.org * LIST (\HasNoChildren) "/" "Team/rechnungseingang(a)example.org/Archiv bearbeitete Rechnungen" . OK List completed (0.003 + 0.000 + 0.007 secs). ``` However, since I am using Maildir, the default separator is `.`, and so I have to change the separator for the `inbox` namespace, which makes me feel uneasy. The system still uses `.dotted.notation` on the filesystem despite the namespace change, and subfolders and all still work, but it still rubs me the wrong way to do this. And yet, when I try to use `.` like this: ``` separator = . prefix = Team.%%u. location = maildir:%%h/Maildir:INDEX=%h/Maildir/.Team,%%u:INDEXPVT=%h/Maildir/.Team.%%u ``` then nothing shows up in `LIST` output. Any idea why this might be? Thanks, -- martin krafft | https://matrix.to/#/#madduck:madduck.net "den stil verbessern, das heißt den gedanken verbessern." - friedrich nietzsche {: .blockquote } spamtraps: madduck.bogus(a)madduck.net {: .hidden }

2 2

Re: Separators and shared namespaces
by Francis Augusto Medeiros-Logeay 27 Sep '23

27 Sep '23

Hi, When I used a ‘.’ as a separator, it seemed to truncate paths with the domain name, such as those with %%d. That happened only to shared namespaces. Best, Francis

1 0

Exclude shared mailboxes from replication
by Francis Augusto Medeiros-Logeay 27 Sep '23

27 Sep '23

Hi, I was wondering if it is possible to exclude shared mailboxes from replication. I have userb(a)mydomain.com sharing mailboxes to usera(a)mydomain.com. However, since both mailboxes already replicate to a backup server, I wonder if it is possible to exclude the replicated mailboxes from syncing. Best, Francis

1 0

is dovecot 2.3.20 compatible with YESCRYPT?
by Andrew Hoff 26 Sep '23

26 Sep '23

To Whom It May Concern, Fedora 38 uses YESCRYPT by default to create the passwords stored in "shadow". The prefix is "$y$". Ref: https://doc.dovecot.org/configuration_manual/authentication/password_scheme… The nearest supported password scheme is blowfish. Can dovecot 2.3.20 read passwords created with YESCRYPT? Regards, -- Andrew Hoff 6/10 Middle Road Maribyrnong 3032 Victoria Australia Tel: 0393185581 (unreachable outside of Australia) Mob: 0400966178 Email: andrew.hoff(a)bigpond.com

2 2

Re: expunge & sh error
by Joseph Tam 26 Sep '23

26 Sep '23

From: "Данила Колесников" <d1kolesnikov(a)gmail.com> > I would like to expunge Inbox mailbox every 60 days > This mailbox is not in the config any I try to use "doveadm expunge". > But my sh configs doesn't works: Fatal: Invalid search date parameter: 60d > If I enter the contents of the config directly into the console - > everything works correctly > the same code in sh - ends with an error. This sounds like a shell parsing error rather than a dovecot bug. What is the exact command you are using? Are you trying to empty your INBOX every 60d, or rather, remove messages older than 60days? If the former, you can probably just delete the entire INBOX folder or mailbox via filesystem commands as an alternative. Joseph Tam <jtam.home(a)gmail.com>

1 0

Re: All list=yes namespaces must use the same separator - don't they?
by Francis Augusto Medeiros-Logeay 25 Sep '23

25 Sep '23

It works everywhere now. I guess it just needed its sweet time.

1 0

Re: All list=yes namespaces must use the same separator - don't they?
by Francis Augusto Medeiros-Logeay 25 Sep '23

25 Sep '23

I found what the problem was. It seems that using ‘.’ as a separator worked. But somehow folders and domain names with dots got messed up: maildir++: root=/var/mail/vmail/francisaugusto/francis, index=/var/mail/vmail/med-lo.eu/francis/shared/index/francis@francisaugusto, indexpvt=/var/mail/vmail/med-lo.eu/francis/shared/francis@francisaugusto, control=, inbox=/var/mail/vmail/francisaugusto/francis, alt= Sep 25 19:10:57 imap(francis(a)med-lo.eu)<58061><skunigB>: Debug: Namespace shared.francis@francisaugusto.: Creating storage despite: Root mail directory doesn't exist: /var/mail/vmail/francisaugusto/francis You see, my domain is francisaugusto.com <http://francisaugusto.com/>, but it got truncated. I changed the separator to ‘/‘ on the Inbox namespace and on the shared one, and voila, it worked. I can see my shared mailboxes everywhere. But on Apple Mail (both on the Mac and on the iPhone), the shared mailboxes show no message. Any clue why?

1 0

Sieve vacation function sends auto-reply with generic From: Address
by Thomas Boroske 25 Sep '23

25 Sep '23

Good day to you all. I have a question regarding the dovecot sieve vacation function that I am unable to answer myself by reading the documentation. A while ago we moved our dovecot server to a newer system (and newer dovecot version 2.3.16 ). This worked mostly fine, except there is now an issue with the auto-reply emails send from sieve vacation scripts. While the sending of the auto reply generally works fine, the emails always appear to come from the "sysgroup(a)ida.ing.tu-bs.de" address rather than the original recipient of the message. This is bad since the recipient of the auto reply then has no idea who the person on vacation actually is (unless there is a name in the message body). The sieve scripts are managed by roundcube webmail, an example entry for a vacation rule looks like this: require ["vacation"]; # rule:[Vacation] if true { vacation :days 7 :subject "Nicht im Büro" :from "tbtest(a)ida.ing.tu-bs.de" "Ich bin nicht da!"; } This looks ok to me. The problem is that the "tbtest" address is not used in the generated reply, instead sysgroup(a)ida.ing.tu-bs.de is used as a from address for all recipients. Note that the sysgroup@ address appears nowhere in the dovecot config, but it does in /etc/postfix/sender-canonical like that: root(a)ida.ing.tu-bs.de sysgroup(a)ida.ing.tu-bs.de @ida.ing.tu-bs.de sysgroup(a)ida.ing.tu-bs.de @net.ida sysgroup(a)ida.ing.tu.bs.de The /etc/dovecot/conf.d/90-sieve.conf is mostly on default values, the remaining config settings are these: plugin { sieve = file:~/Maildir/sieve;active=~/Maildir/.dovecot.sieve sieve_extensions = +editheader #Send vacation auto responder with correct Address sieve_vacation_send_from_recipient = yes sieve_vacation_use_original_recipient = no } I have attached the output of "dovecot -n" below. Many thanks for any ideas on what could be the issue! Kind regards, Thomas -- Dipl. Inf. Thomas Boroske Institute of Computer and Network Engineering TU Braunschweig Hans-Sommer-Str. 66, D-38106 Braunschweig, Germany www.ida.ing.tu-bs.de

2 2

All list=yes namespaces must use the same separator - don't they?
by Francis Augusto Medeiros-Logeay 25 Sep '23

25 Sep '23

Hi, I am trying to configure shared mailboxes, so I enabled the acl and the imap_acl plugins. But I got the "All list=yes namespaces must use the same separator" error when I added this: namespace { type = shared #separator = # Mailboxes are visible under "shared/user@domain/" # %%n, %%d and %%u are expanded to the destination user. prefix = shared/%%u/ # Mail location for other users' mailboxes. Note that %variables and ~/ # expands to the logged in user's data. %%n, %%d, %%u and %%h expand to the # destination user's data. location = maildir:/var/mail/vmail/%%d/%%n:INDEX=/var/mail/vmail-index/index/%%d/%%n:INDEXPVT=/var/mail/vmail-index/index/%%d/%%n # Use the default namespace for saving subscriptions. subscriptions = no # List the shared/ namespace only if there are visible shared mailboxes. list = children } I don't have any separator configured explicitly, and when I see the config, the value is empty. So I don't really know what is the problem here. Any hints? Best, Francis -- Francis Augusto Medeiros-Logeay Oslo, Norway

1 0

expunge & sh error
by Данила Колесников 24 Sep '23

24 Sep '23

Hello! I would like to expunge Inbox mailbox every 60 days This mailbox is not in the config any I try to use "doveadm expunge". But my sh configs doesn't works: Fatal: Invalid search date parameter: 60d If I enter the contents of the config directly into the console - everything works correctly the same code in sh - ends with an error. It is bug or I do mistake? root@mail:~# doveconf -n # 2.3.16 (7e2e900c1a): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.16 (09c29328) # OS: Linux 5.15.0-84-generic x86_64 Ubuntu 22.04.2 LTS # Hostname: mail.onelec.ru auth_mechanisms = plain login auth_verbose = yes base_dir = /run/dovecot/ disable_plaintext_auth = no log_path = /var/log/dovecot.log login_greeting = Mail Delivery Agent mail_access_groups = mail mail_location = maildir:%h/mail/%d/%n mail_privileged_group = mail namespace { inbox = yes list = yes location = mailbox Archive { auto = subscribe autoexpunge = 30 days special_use = \Archive } mailbox "Deleted Messages" { auto = no autoexpunge = 1 weeks special_use = \Trash } mailbox Drafts { auto = subscribe autoexpunge = 1 weeks special_use = \Drafts } mailbox Junk { auto = no autoexpunge = 1 weeks special_use = \Junk } mailbox Sent { auto = subscribe autoexpunge = 90 days special_use = \Sent } mailbox "Sent Mail" { auto = no autoexpunge = 90 days special_use = \Sent } mailbox "Sent Messages" { auto = no autoexpunge = 90 days special_use = \Sent } mailbox Spam { auto = subscribe autoexpunge = 1 weeks special_use = \Junk } mailbox Trash { auto = subscribe autoexpunge = 1 weeks special_use = \Trash } prefix = separator = / type = private } passdb { args = scheme=MD5-CRYPT username_format=%n /etc/exim4/domains/%d/passwd driver = passwd-file } plugin { quota = maildir:User quota } protocols = imap pop3 service auth { extra_groups = mail unix_listener auth-client { group = mail mode = 0660 user = dovecot } user = dovecot } service stats { unix_listener stats-writer { group = mail mode = 0660 user = dovecot } } ssl_cert = </usr/local/hestia/ssl/certificate.crt ssl_cipher_list = ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:DHE-RSA-AES256-SHA256 ssl_dh = # hidden, use -P to show it ssl_key = # hidden, use -P to show it ssl_prefer_server_ciphers = yes userdb { args = username_format=%n /etc/exim4/domains/%d/passwd driver = passwd-file } protocol imap { mail_plugins = quota imap_quota } protocol pop3 { mail_plugins = quota } local_name mail.bearlion.ru { ssl_cert = </home/bearlion/conf/mail/bearlion.ru/ssl/bearlion.ru.pem ssl_key = # hidden, use -P to show it } local_name mail.onelec.ru { ssl_cert = </home/onelec/conf/mail/onelec.ru/ssl/onelec.ru.pem ssl_key = # hidden, use -P to show it } local_name mail.radiokey.ru { ssl_cert = </home/radiokey/conf/mail/radiokey.ru/ssl/radiokey.ru.pem ssl_key = # hidden, use -P to show it }

2 1

possible doveadm expunge bug
by Noel Butler 24 Sep '23

24 Sep '23

In my boredom, I was cleaning up my own public mailbox, do I really need lists/newsletters/forums posts from the 90's .. I think not, but lets still keep 5 years and expunge the rest... or try to... but expunge doesnt want too... This error or lack of action, occurs on any mailbox, as an example doveadm expunge -u my@email mailbox Lists.FreeRadius SAVEDBEFORE $ now for $, pick your value 5 y/Y for years doesn't appear to exist, so converting it into 30 odd weeks, 30w or 30W did nothing, but rough convert it down to days 1800D appears to do something - showing a delay before returning to command line, but in reality it does nothing, 1800, 1500, 1200, nothing, only when I drop it to 1000D does it actually work, which is not suitable, since I'd like to keep 5 years worth. Running doveadm -Dv exp... shows no errors just usual debug output about the base modules, quota stuff, and opening mailbox message followed then by user session closed, nothing at all anywhere that points to an error for executing this task, I did deliberately break it by altering the mailbox name to test and it rightfully did report the error the mailbox doesn't exist. I thought it might be size related, freeradius one of the smaller lists having about 150k to nanog the biggest with over 400k message, but I have others, like monthly newsletters with over 20yrs worth, but only 250 to 300 messages in their mailboxes that also fail, so it can't be barfing out at the size. Aki, any ideas? Or have I have hit a ridiculously low 1000D hard coded limit? ...and I know some troll will comment, so let me say yes I know I can and will likely have to use nix's "find" to actually cull them, but if doveadm has an expunge option, it should do what it is asked of it :) # doveconf -a # 2.3.20 (80a5ac675d): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.20 (149edcf2) # OS: Linux 5.15.117 x86_64 Slackware 15.0 ext4 - Yes I know 2.3.21 was released 2 days ago, but I'm not seeing anything in changelog/NEWS that's related -- Regards, Noel Butler This Email, including attachments, may contain legally privileged information, therefore at all times remains confidential and subject to copyright protected under international law. You may not disseminate this message without the authors express written authority to do so. If you are not the intended recipient, please notify the sender then delete all copies of this message including attachments immediately. Confidentiality, copyright, and legal privilege are not waived or lost by reason of the mistaken delivery of this message.

2 2

Dovecot OIDC question
by dovecot＠deeztek.net 23 Sep '23

23 Sep '23

Exploring the possible use of SSO using OIDC with Dovecot. Trying to understand the functionality of OIDC as it pertains to e-mail clients like Thunderbird, Outlook etc... My OIDC provider will authenticate a user by intercepting the connection attempt to the resource, present a login screen and after success it will redirect to the resource. When it comes to e-mail clients, how would that process work if at all? Thanks

1 0

2.3.21 broke XOAUTH authentication against Keycloak
by tj＠interseclab.org 23 Sep '23

23 Sep '23

I have Roundcube and Dovecot2 setup to authenticate against Keycloak using the XOAUTH2 method, as follows: introspection_url = https://[...]/realms/[...]/protocol/openid-connect/token/introspect introspection_mode = post username_attribute = email client_id = [...] client_secret = [...] tls_ca_cert_file = /etc/ssl/certs/ca-certificates.crt Since upgrading to 2.3.21 XOAUTH2 fails to authenticate with: dovecot: auth: Error: oauth2([...],[...],<[...]>): oauth2 failed: Introspection failed: No username returned WARN [org.keycloak.events] (executor-thread-45) type=INTROSPECT_TOKEN_ERROR, realmId=[...], clientId=null, userId=null, ipAddress=[...], error=client_not_found WARN [org.keycloak.events] (executor-thread-45) type=INTROSPECT_TOKEN_ERROR, realmId=[...], clientId=null, userId=null, ipAddress=[...], error=invalid_request, detail='Authentication failed.' Downgrading to 2.3.20 fixes the issue. I believe this change is to blame: lib-oauth2: Dovecot would send client_id and client_secret as POST parameters to the introspection server. These need to be optionally in Basic auth instead. Is there anything I should change in my Keycloak/Dovecot config or is this a bug?

2 1

Change location where .dovecot.lda-dupes* file/dir are created
by sahsanu 22 Sep '23

22 Sep '23

Hello, I'm using Dovecot 2.3.19.1 and Pigeonhole 0.5.19 on Debian 12.1 and I'm trying to use sieve extensions vacation and redirect but I'm having issues because of the creation of file /home/USER/.dovecot.lda-dupes and dir /home/USER/.dovecot.lda-dupes.locks The error in logs is pretty clear, lda doesn't have perms to create any of them because /home/USER/ is owned by root # namei -mo /home/user2/ f: /home/user2/ drwxr-xr-x root root / drwxr-xr-x root root home drwxr-xr-x root root user2 I'm using Hestia Control Panel and it chroot the users and that is the reason the user's home is owned by root. Mail users are virtual and the maildir home is /home/user2/mail/domain2.tld/postmaster (%h/mail/%d/%n) but the .dovecot.lda-dupes* file and dir are trying to use /home/user2/ instead of /home/user2/mail/domain2.tld/postmaster/ where they have perms and that should solve the issue. So, the question, is there any way to create .dovecot.lda-dupes* file/dir in virtual user's home %h/mail/%d/%n instead of user's home %h? or, is there any other solution/workaround where I don't need to change /home/USER/ owner/perms? If you want to check them, below are the logs and my dovecot conf. Appreciate your support. Best regards, sahsanu This is the sieve log using vacation extension: sieve: info: started log at 2023-09-21 13:17:06 +0200. error: msgid=<102288b1348f270d83363f71bb7bcc81(a)example.com>: vacation action: failed to check for duplicate vacation response: internal error occurred: refer to server log for more information. [2023-09-21 13:17:06]. This is the dovecot log using sieve vacation extension: Sep 21 13:17:06 lda(postmaster(a)domain2.tld)<2711250><SHdgDzImDGXSXikAElSLcQ>: Error: duplicate db: transaction: file_dotlock_open(/home/user2/.dovecot.lda-dupes) failed: Permission denied Sep 21 13:17:06 lda(postmaster(a)domain2.tld)<2711250><SHdgDzImDGXSXikAElSLcQ>: Error: duplicate db: transaction: Failed to lock /home/user2/.dovecot.lda-dupes.locks/duplicate.lock.ea887f77f1f61464f902ada5e7bfb022: mkdir_parents(/home/user2/.dovecot.lda-dupes.locks) failed: Permission denied This is the sieve log using redirect extension: sieve: info: started log at 2023-09-21 16:51:46 +0200. error: msgid=<8f1cdb9c-0997-4e32-a28f-65e5f3f8dca6.maildroid@localhost>: redirect action: failed to check for duplicate forward: internal error occurred: refer to server log for more information. [2023-09-21 16:51:46]. This is the dovecot log using sieve redirect extension: Sep 21 16:51:46 lda(postmaster(a)domain2.tld)<2785960><03j9DoJYDGWogioAElSLcQ>: Error: duplicate db: transaction: file_dotlock_open(/home/user2/.dovecot.lda-dupes) failed: Permission denied Sep 21 16:51:46 lda(postmaster(a)domain2.tld)<2785960><03j9DoJYDGWogioAElSLcQ>: Error: duplicate db: transaction: Failed to lock /home/user2/.dovecot.lda-dupes.locks/duplicate.lock.291440db1d5e4457ecf50cd02882634b: mkdir_parents(/home/user2/.dovecot.lda-dupes.locks) failed: Permission denied Dovecot conf: # 2.3.19.1 (9b53102964): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.19 (4eae2f79) # OS: Linux 6.1.0-12-amd64 x86_64 Debian 12.1 # Hostname: server.domain1.tld auth_mechanisms = plain login auth_verbose = yes base_dir = /run/dovecot/ log_path = /var/log/dovecot.log login_greeting = Mail Delivery Agent mail_access_groups = mail mail_attribute_dict = file:%h/mail/%d/%n/dovecot-attributes mail_location = maildir:%h/mail/%d/%n mail_privileged_group = mail managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext imapflags notify imapsieve vnd.dovecot.imapsieve namespace { inbox = yes list = yes location = mailbox Archive { auto = subscribe special_use = \Archive } mailbox "Deleted Messages" { auto = no special_use = \Trash } mailbox Drafts { auto = subscribe special_use = \Drafts } mailbox Junk { auto = no special_use = \Junk } mailbox Sent { auto = subscribe special_use = \Sent } mailbox "Sent Mail" { auto = no special_use = \Sent } mailbox "Sent Messages" { auto = no special_use = \Sent } mailbox Spam { auto = subscribe special_use = \Junk } mailbox Trash { auto = subscribe special_use = \Trash } prefix = separator = / type = private } passdb { args = scheme=MD5-CRYPT username_format=%n /etc/exim4/domains/%d/passwd driver = passwd-file } plugin { imapsieve_mailbox1_before = file:/var/mail/sieve/report_spam.sieve imapsieve_mailbox1_causes = COPY APPEND imapsieve_mailbox1_name = Spam imapsieve_mailbox2_before = file:/var/mail/sieve/report_ham.sieve imapsieve_mailbox2_causes = COPY imapsieve_mailbox2_from = Spam imapsieve_mailbox2_name = * imapsieve_url = sieve://127.0.0.1:4190 quota = maildir:User quota sieve = file:~/mail/%d/%n/sieve;active=~/mail/%d/%n/dovecot.sieve sieve_extensions = +notify +imapflags sieve_global_extensions = +vnd.dovecot.pipe +vnd.dovecot.environment sieve_pipe_bin_dir = /etc/dovecot/sieve sieve_plugins = sieve_imapsieve sieve_extprograms sieve_vacation_send_from_recipient = yes } protocols = imap sieve service auth { extra_groups = mail unix_listener auth-client { group = mail mode = 0660 user = dovecot } unix_listener auth-master { group = mail mode = 0660 user = dovecot } user = dovecot } service managesieve-login { inet_listener sieve { port = 4190 } } service stats { unix_listener stats-writer { group = mail mode = 0660 user = dovecot } } ssl_cert = </usr/local/hestia/ssl/certificate.crt ssl_cipher_list = ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:DHE-RSA-AES256-SHA256 ssl_dh = # hidden, use -P to show it ssl_key = # hidden, use -P to show it ssl_prefer_server_ciphers = yes userdb { args = username_format=%n /etc/exim4/domains/%d/passwd driver = passwd-file } protocol lda { auth_socket_path = /var/run/dovecot/auth-master mail_plugins = " quota sieve" } protocol imap { mail_plugins = quota imap_quota imap_sieve } protocol sieve { managesieve_implementation_string = Dovecot Pigeonhole managesieve_max_line_length = 64 k } protocol pop3 { mail_plugins = quota } local_name domain1.tld { ssl_cert = </home/user1/conf/mail/domain1.tld/ssl/domain1.tld.pem ssl_key = # hidden, use -P to show it } local_name mail.domain1.tld { ssl_cert = </home/user1/conf/mail/domain1.tld/ssl/domain1.tld.pem ssl_key = # hidden, use -P to show it } local_name domain2.tld { ssl_cert = </home/user2/conf/mail/domain2.tld/ssl/domain2.tld.pem ssl_key = # hidden, use -P to show it } local_name mail.domain2.tld { ssl_cert = </home/user2/conf/mail/domain2.tld/ssl/domain2.tld.pem ssl_key = # hidden, use -P to show it }

2 4

State of wiki.dovecot.org?
by Sebastian Philipp 20 Sep '23

20 Sep '23

Hi all I just noticed that wiki.dovecot.org is no longer available, and instead redirects to a message stating that the documentation can now be found at doc.dovecot.org. However, there's was quite a lot of information on wiki.dovecot.org that is not available on doc.dovecot.org. One such example is the setup guide for a Dovecot Director cluster [1]. The "corresponding" page on doc.dovecot.org [2] even starts with the following sentence: > See http://wiki.dovecot.org/Director for more details. Are there plans to migrate such pages to doc.dovecot.org as well? If not, could the Wiki be restored? Of course it's possible to access the Wiki contents via web.archive.org, but that's rather cumbersome and slow. Thanks and regards Sebastian [1]: http://web.archive.org/web/20230212020603/https://wiki2.dovecot.org/Director [2]: https://doc.dovecot.org/configuration_manual/director_settings -- Adfinis AG Sebastian Philipp, Systems Engineer GPG Key ID: 0x8C920482C5CDA5FB Güterstrasse 86 | CH-4053 Basel Office: 061 500 31 31 www.adfinis.com

2 1

New Dovecot release?
by Taavi Ansper 20 Sep '23

20 Sep '23

Hi When will there be a new dovecot release. The 2.3.21 version borked our users with large amount of folders (i think over 255 folders) doveadm(REDACTED_USER): Error: /proc/self/status is larger than expected I can't find the debian bug report (or was it mentioned in this same mailing list), but somebody else has mentioned the same issue. I hope this gets fixed in the next version. -- Taavi Ansper taavi.ansper(a)cyber.ee

3 6

dovecot username with domain
by Michael Grant 20 Sep '23

20 Sep '23

I've been using dovecot using system usernames (my unix uname as my IMAP username). But today I tried New Outlook which requires the imap username match my email address. Is there some way to tell dovecot that username@host is the same as uname? (where username@host is an email address and uname is a unix login which might be completely different). Michael Grant

5 7

Logging for doveadm index?
by Shawn Heisey 15 Sep '23

15 Sep '23

I have dovecot using Solr for FTS. Dovecot version is 2:2.3.20-3+ubuntu20.04 pulled from the official APT repo. This is my reindex script: https://paste.elyograg.org/view/74accd23 The reindex script kicks off the indexing process in the background. Dovecot logs to syslog, and those logs ultimately end up in mail.log. I have not seen any logging for the FTS reindexing. Specifically I would like to see how long the process took. Getting that info from the solr logs is a manual process and I can't think of a way to properly automate it. Is this something I can easily have dovecot log? Or is there a way to have 'doveadm index' run in the foreground instead of the background so the time can be calculated by my script? Thanks, Shawn

1 0

Pigeonhole v0.5.21 released
by Aki Tuomi 15 Sep '23

15 Sep '23

Hi all! We are pleased to release v0.5.21 of Pigeonhole. https://pigeonhole.dovecot.org/releases/2.3/dovecot-2.3-pigeonhole-0.5.21.t… https://pigeonhole.dovecot.org/releases/2.3/dovecot-2.3-pigeonhole-0.5.21.t… Binary packages in https://repo.dovecot.org/ Docker images in https://hub.docker.com/r/dovecot/dovecot Regards, Aki Tuomi Open-Xchange oy --- - sieve: Using the deleteheader action on a message with a broken/invalid header can cause the Sieve interpreter to crash with an assert panic. This can happen e.g. when the message is missing the empty EOH line between the headers and the body of the message. Fixes: Panic: file edit-mail.c: line 820 (edit_mail_headers_parse): assertion failed: (body_offset > 0). - sieve: Pigeonhole added an extra Message-ID header during mail forwarding when the existing one was invalid. Now it adds the Message-ID only if it is entirely missing. Existing Message-ID(s) are left unchanged.

1 0

Dovecot v2.3.21 released
by Aki Tuomi 15 Sep '23

15 Sep '23

Hi all! We are pleased to release v2.3.21 of Dovecot. https://dovecot.org/releases/2.3/dovecot-2.3.21.tar.gz https://dovecot.org/releases/2.3/dovecot-2.3.21.tar.gz.sig Binary packages in https://repo.dovecot.org/ Docker images in https://hub.docker.com/r/dovecot/dovecot Regards, Aki Tuomi Open-Xchange oy --- * lib-oauth2: Allow JWT tokens to be validated with missing typ field. The typ field is left out by some key issuers to conserve space, notably kubernetes. Now missing typ is tolerated, but if present, it still must be "jwt". + auth: Auth passdb and userdb reply can contain "event_<name>=value" which will be added to login event and mail user event respectively. + lib-master: Set process title during various initialization stages to clearly describe what the process is waiting on. + lib-storage: The mail_temp_scan_interval is now fuzzed incrementing it by 0..30% based on username's hash to reduce the chance of load spikes . + lib-storage: The temp file scan has been moved from the open of the mailbox to the close, to reduce the latency perceived by users. + stats: If metric has fields specified, all these fields are exported as counters to prometheus exposition. See https://doc.dovecot.org/configuration_manual/stats/openmetrics/. - *-login: Processes might have crashed when a SSL connection disconnect s uncleanly. - acl: When plugin was loaded \HasChildren and \HasNoChildren flags were calculated incorrectly for mailboxes containing '*' and '%' in their names. - auth: Crash occured if a connection to PostgreSQL database server failed during startup. - auth: Logins with invalid passwords (e.g. unknown scheme) in passdb were failing with "password mismatch" instead of "internal error". - auth: XOAUTH2 and OAUTHBEARER mechanisms were not giving out protocol specific error message on all errors. This especially broke OIDC discovery. - dbox: When last_temp_file_scan header wasn't set (especially after dsync migration), the next mailbox open always triggers the temp file scan. This could have caused a load spike after migrations. Fixed by using the mailbox directory's atime when the header isn't set, which usually moves the scan time into the future. - dict-redis: A crash would occur on transaction rollback. - dsync: Infinite loop causing out of memory would occur when handling mailbox deletion from remote end and hierarchy separators would differ. - dsync: Incremental dsync failed for folder names ending with '%', unless BROKENCHAR was set. Also folder names with '%' elsewhere in them caused each incremental dsync to unnecessarily rename the folder to a temporary name and back. v2.3.19 regression. - imap-hibernate: If an IMAP client unhibernation timed out with "(version received)", the unhibernation could still have successfully finished later on and continued working normally. This was rather confusing, because imap-hibernate already logged that the client got disconnected. Avoid this by forcing the connection to shutdown on unhibernation timeout. - imapc: Crashed when a folder mapped through the virtual plugin disappears from the storage. - imapc: EXPUNGE, EXISTS or FETCH replies from a server for a previously selected mailbox could have been processed as if they belonged to the new mailbox currently being selected. This could have caused warnings. - lib-http: Dovecot HTTP server (doveadm, stats/openmetrics) may have disconnected HTTP clients before the response is fully sent. This happened only on busy servers where kernel's socket buffers were rather full. - lib-http: Fixed a potential crash on http-server if a client disconnected early. v2.3.18 regression. - lib-index: Index file corruption could have caused a crash. Fixes: Panic: file mail-transaction-log-view.c: line 165 (mail_transaction_log_view_set): assertion failed: (min_file_seq <= max_file_seq). - lib-index: Purging an existing >1GB cache file can crash. Now cache files still above 1GB after purging are removed. Fixes: Panic: file mail-index-util.c: line 10 (mail_index_uint32_to_offset): assertion failed: (offset < 0x40000000) - lib-lua: A HTTP client could not resolve DNS names in mail processes, because it expected "the dns-client" socket to exist in the current directory. - lib-oauth2: Dovecot would send client_id and client_secret as POST parameters to the introspection server. These need to be optionally in Basic auth instead. - lib-oauth2: JWT aud validation was not performed if aud was missing from a token, but was configured on Dovecot. - lib-oauth2: JWT key type check was too strict. - lib-oauth2: JWT token audience was not validated against client_id as required by the specification. - lib-ssl-iostream: Using the ssl_require_crl=yes setting may have caused CRL check failures for outgoing SSL/TLS connections, although it was supposed to affect checking CRLs only for client-side SSL certificates. v2.3.17 regression. - lib-sql: MySQL driver leaked memory when connection failed. - lib-storage: Various fixes when running into out of disk space. - master: Service idle_kill setting didn't work properly on busy servers. It was very unlikely that any process was idling long enough to become killed. Also the idle_kill handling code was using quite a lot of CPU on the master process when there were a lot of processes (e.g. imap). The new behavior is to track the lowest number of idling processes every idle_kill time interval and then kill that many idling processes. - mdbox: Temp file scan was done for always empty directories. - mdbox: The fdatasync() call was done in wrong parent directory when writing mails. Also on a failure it crashed instead of logging an error. - notify_status: The plugin crashes if any user initialization fails. - pop3: Sending command with the ':' character caused an assert-crash. v2.3.18 regression. Fixes: Panic: event_reason_code_prefix(): name has ':' - stats: Fix panic when a nonexistent event exporter was referenced while adding a new metric dynamically via doveadm stats add. This produces a proper error now. - stats: If process exported a lot of events and then exited, some of the last events may have become lost. - stats: Invalid Prometheus label names were created with specific histogram group_by configurations. Prometheus rejected these labels. - welcome: The plugin didn't execute in some situations that created INBOX but didn't open it, e.g. if GETMETADATA was used before the INBOX was opened.

1 0

config: Error: Conflict in setting ssl_cert found from filter
by Ján Ondrušek 15 Sep '23

15 Sep '23

Hi! I see this intermittent error with my dovecot setup. The most puzzling part is that it sometimes works and sometimes rejects connections, spitting out the log I attached in systeport (DNS). I am binding both ipv4 (TLS+SNI) and ipv6 (dedicated addresses). TLS certificates for corresponding DNS are shared across ipv4 / ipv6. Thank you, Best regards, Jan

2 3

ACL management from SQL
by cyril.leclerc＠mantiq.com 14 Sep '23

14 Sep '23

Hello, we are facing issue, we manage the shared folder from SQL table, but it was never working as we have to manage acl permission from the server itself, we want to manage permissions (read or write) from the same application we can share user mailbox but it is written in dovecot documentation that is not supported now, we tried to find a mail client that could manage it at least, but only thunderbird was able to do it (but in version 60) and not more today. We saw that roundcube could handle it but we use rainloop. 1. It is really not possible at all to manage acl permissions fron SQL like the shared box itself ? 2. I tried to set acl permissions from old version of thunderbird, when i made modification it tried to update the sharedbox table, i did not see the query executed but as we were working on a view, the update failed. Do you know what it tried to do ?

3 8

Shared mailbox listing not working
by exactoph 14 Sep '23

14 Sep '23

Hi there, Having trouble with shared mailboxes. Followed the documentation, but the IMAP LIST doesn't work for mailboxes besides "INBOX" etc. In the meantime I've switched from file based acl_shared_dict to DB based as some people had problems with it. However still no success. I can see entries in the DB, doveadm acl get ... returns that the mailbox is shared, but it is not listed in doveadm mailbox list ... My configuration: https://pastebin.com/aWnMXJ4J Help would be very appreciated!

3 2

Roundcube
by joe a 13 Sep '23

13 Sep '23

Any known issues with installing/running roundcube and dovecot on the same server?

11 22

Trouble with SMTP, TLS and dovecot.org.
by Ralph Seichter 07 Sep '23

07 Sep '23

Hello, I cannot seem to send STARTTLS protected mail to talvi.dovecot.org, and I was wondering if anybody else sees similar problems: Sep 6 22:29:10 ra postfix/smtp[15748]: SSL_connect error to talvi.dovecot.org[94.237.105.223]:25: -1 Sep 6 22:29:10 ra postfix/smtp[15748]: warning: TLS library problem: error:0A000417:SSL routines::sslv3 alert illegal parameter:../openssl-3.0.9/ssl/record/rec_layer_s3.c:1586:SSL alert number 47: Sep 6 22:29:10 ra postfix/smtp[15748]: 1AAE4BE0031: Cannot start TLS: handshake failure Sep 6 22:29:10 ra postfix/smtp[15748]: SSL_connect error to talvi.dovecot.org[2a04:3545:1000:720:acc1:5bff:fe5e:459]:25: -1 Sep 6 22:29:10 ra postfix/smtp[15748]: warning: TLS library problem: error:0A000417:SSL routines::sslv3 alert illegal parameter:../openssl-3.0.9/ssl/record/rec_layer_s3.c:1586:SSL alert number 47: Sep 6 22:29:10 ra postfix/smtp[15748]: 1AAE4BE0031: to=<dovecot(a)dovecot.org>, relay=talvi.dovecot.org[2a04:3545:1000:720:acc1:5bff:fe5e:459]:25, delay=1.6, delays=0.02/0.01/1.6/0, dsn=4.7.5, status=deferred (Cannot start TLS: handshake failure) Sep 6 22:30:05 ra postfix/smtpd[15616]: timeout after END-OF-MESSAGE from localhost[127.0.0.1] Sep 6 22:30:05 ra postfix/smtpd[15616]: disconnect from localhost[127.0.0.1] ehlo=1 xforward=1 mail=1 rcpt=1 data=1 commands=5 The originating server uses Postfix 3.8.2 and OpenSSL library 3.0.9. To be able to send messages to dovecot.org at all, I had to use Postfix's "smtp_tls_policy_maps" setting to explicitly disable TLS for this destination domain. -Ralph

3 5

Fwd: DOvecot requires both IPv4 and IPV6 to start
by Stephen Satchell 06 Sep '23

06 Sep '23

Damn. Forgot to hit "reply all" -- my bad -------- Forwarded Message -------- Subject: Re: DOvecot requires both IPv4 and IPV6 to start Date: Mon, 4 Sep 2023 15:35:51 -0700 From: Stephen Satchell <list(a)satchell.net> Reply-To: list(a)satchell.net To: Arjen de Korte <build+dovecot(a)de-korte.org> On 9/4/23 2:40 PM, Arjen de Korte wrote: > This document was written something like two decades ago and pretty much > all arguments against IPv6 are no longer relevant anymore. In most cases > nowadays, the user experience for IPv6 will be far superior over CGNAT > connections which unfortunately become the standard due to the > increasing cost of IPv4 addresses. Running services over IPv6 may have > been experimental and prone with not so fun problems to diagnose in > 2013, but today this is no longer the case. Running a business? Subscribing to business Internet? Are IPv6 address blocks available? Does IPv6 routing work properly? OK, even though the service desk doesn't know how to answer the above questions about IPv6 correctly, the information *is* available if you dig hard enough. And it seems to work. Can you get a PTR6 record for your mail server? No. At least, not from my upstream. Begins with "A" and ends with "T". Don't even ask about reverse delegations, the blank stare will scare you. (I apologize to everyone on this list. The above diatribe more correctly lives on mailing lists for Sendmail, Postfix, Exim, and other packages that actually originate mail exchanges.)

2 1

DOvecot requires both IPv4 and IPV6 to start
by TWHG Technical 06 Sep '23

06 Sep '23

I think we are off topic. We have a network policy that until such time as we have fully implemented the same security we have on our IPV4 network we simply do not allow IPV6 as it is another attack vector we are not fully upto speed on. So we block all IPV6 at the perimeter and on all switches, firewalls and routers. So if you connect to our network with a device no IP6 is configured and only IPV4 is allowed. We will get there! But that is not this issue. The issue is that dovecot is assuming that IPV6 is there and crashes out if it's not. Hacking the config to only listen on IP4 solves the problem but not while installing from standard repos to install the currently supported version. Cheers Spart

9 13

Dovecot with Postfix "no SASL authentication mechanisms"
by mangawilly＠gmail.com 05 Sep '23

05 Sep '23

Hi. Can someone help me please check what is wrong with my config? postfix is saying "no SASL authentication mechanisms" and I'm using dovecot. From what I read so far, it is related to my dovecot settings. Here are the details of my config http://paste.debian.net/1290864/

9 16

auth: Panic: file oauth2-request.c assertion failed
by Urban Loesch 05 Sep '23

05 Sep '23

Hi, I'm running a postfix smtp relay server on which users are getting authenticated trough sasl via the dovecot authentication service. This works without problems. Recently I extended my configuration to authenticate users with the PLAIN mechanism against Azure AD B2C with oauth2 in the future. Important to mention is that currently no users are stored in Azure B2C. I only prepared the hole configuration and authentiucation falls back to mysql database. Now sometimes I get the error below in my logs (not permanently): ... Dec 7 11:36:49 relay-out1 dovecot: auth: Panic: file oauth2-request.c: line 201 (oauth2_request_start): assertion failed: (oauth2_valid_token(input->token)) Dec 7 11:36:49 relay-out1 dovecot: auth: Error: Raw backtrace: /usr/lib/dovecot/libdovecot.so.0(backtrace_append+0x3d) [0x7f399402e62d] -> /usr/lib/dovecot/libdovecot.so.0(backtrace_get+0x1e) [0x7f399402e74e] -> /usr/lib/dovecot/libdovecot.so.0(+0x1006eb) [0x7f399403b6eb] -> /usr/lib/dovecot/libdovecot.so.0(+0x100781) [0x7f399403b781] -> /usr/lib/dovecot/libdovecot.so.0(+0x54b7c) [0x7f3993f8fb7c] -> /usr/lib/dovecot/libdovecot.so.0(+0x4605a) [0x7f3993f8105a] -> /usr/lib/dovecot/libdovecot.so.0(oauth2_passwd_grant_start+0xfa) [0x7f3993f9870a] -> dovecot/auth(db_oauth2_lookup+0x2ca) [0x560d0804368a] -> dovecot/auth(auth_request_default_verify_plain_continue+0x2d6) [0x560d08026436] -> dovecot/auth(auth_policy_check+0x2b) [0x560d0802071b] -> dovecot/auth(+0x29f72) [0x560d0802ff72] -> dovecot/auth(auth_request_handler_auth_continue+0xf7) [0x560d0802a197] -> dovecot/auth(+0x16c62) [0x560d0801cc62] -> /usr/lib/dovecot/libdovecot.so.0(io_loop_call_io+0x69) [0x7f3994051c29] -> /usr/lib/dovecot/libdovecot.so.0(io_loop_handler_run_internal+0x131) [0x7f3994053251] -> /usr/lib/dovecot/libdovecot.so.0(io_loop_handler_run+0x4c) [0x7f3994051ccc] -> /usr/lib/dovecot/libdovecot.so.0(io_loop_run+0x40) [0x7f3994051e50] -> /usr/lib/dovecot/libdovecot.so.0(master_service_run+0x13) [0x7f3993fc4df3] -> dovecot/auth(main+0x415) [0x560d0801abf5] -> /lib/x86_64-linux-gnu/libc.so.6(__libc_start_main+0xeb) [0x7f3993cee09b] -> dovecot/auth(_start+0x2a) [0x560d0801ad8a] ... After the error above postfix says the connection to the authentication server was lost: ... Dec 7 11:36:49 relay-out1 rolrelayout1/smtpd[1655601]: warning: domain.com[12.12.12.12]: SASL LOGIN authentication failed: Connection lost to authentication server ... I was able to make a core dump. ... # gdb /usr/lib/dovecot/auth core.auth.1654357.1670409409 GNU gdb (Debian 8.2.1-2+b3) 8.2.1 ... For help, type "help". Type "apropos word" to search for commands related to "word"... Reading symbols from /usr/lib/dovecot/auth...Reading symbols from /usr/lib/debug/.build-id/bc/f14ed9cc2dda3ee9565fbd7ccd835460008438.debug...done. done. [New LWP 1654357] [Thread debugging using libthread_db enabled] Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1". Core was generated by `dovecot/auth'. Program terminated with signal SIGABRT, Aborted. #0 __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:50 50 ../sysdeps/unix/sysv/linux/raise.c: Datei oder Verzeichnis nicht gefunden. (gdb) bt full #0 __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:50 set = {__val = {0, 1415, 1416, 94613970086496, 10, 139885273538955, 155, 139885273347109, 140724590457408, 118, 206158430224, 140724590457744, 140724590457536, 16888407779496842752, 94613970086472, 139885273131758}} pid = <optimized out> tid = <optimized out> ret = <optimized out> #1 0x00007f3993cec535 in __GI_abort () at abort.c:79 save_stage = 1 act = {__sigaction_handler = {sa_handler = 0x73f, sa_sigaction = 0x73f}, sa_mask = {__val = {1024, 18446744073709551615, 94613971926672, 94613971631792, 139885273108347, 94613970084312, 139885273090236, 94613970084312, 16888407779496842752, 94613970084288, 139885273346402, 140724590457744, 94613970084312, 140724590457744, 139885273346761, 94613970084312}}, sa_flags = -1811749030, sa_restorer = 0x5} sigs = {__val = {32, 0 <repeats 15 times>}} #2 0x00007f3993f8feaf in default_fatal_finish (status=0, type=LOG_TYPE_PANIC) at failures.c:465 backtrace = 0x560d0813e220 "/usr/lib/dovecot/libdovecot.so.0(backtrace_append+0x3d) [0x7f399402e62d] -> /usr/lib/dovecot/libdovecot.so.0(backtrace_get+0x1e) [0x7f399402e74e] -> /usr/lib/dovecot/libdovecot.so.0(+0x1006eb) [0x7f39"... backtrace = <optimized out> recursed = 0 #3 fatal_handler_real (ctx=<optimized out>, format=<optimized out>, args=<optimized out>) at failures.c:477 status = 0 #4 0x00007f399403b781 in i_internal_fatal_handler (ctx=<optimized out>, format=<optimized out>, args=<optimized out>) at failures.c:879 No locals. #5 0x00007f3993f8fb7c in i_panic (format=format@entry=0x7f399407a0e8 "file %s: line %d (%s): assertion failed: (%s)") at failures.c:530 ctx = {type = LOG_TYPE_PANIC, exit_status = 0, timestamp = 0x0, timestamp_usecs = 0, log_prefix = 0x0, log_prefix_type_pos = 0} args = {{gp_offset = 40, fp_offset = 48, overflow_arg_area = 0x7ffcff39b4e0, reg_save_area = 0x7ffcff39b420}} #6 0x00007f3993f8105a in oauth2_request_start (set=0x560d08176150, input=0x7ffcff39b5d0, callback=0x560d08042b50 <db_oauth2_lookup_passwd_grant>, context=0x560d082ffe90, p=0x560d082b7eb0, method=0x7f399407a2c6 "POST", url=0x560d08178480 "https://xxx.b2clogin.com/xxx.onmicrosoft.com/B2C_1_ropc/oauth2/v2.0/token?s…", payload=0x560d082b7ed8, add_auth_bearer=false) at oauth2-request.c:201 __func__ = "oauth2_request_start" pool = <optimized out> req = <optimized out> #7 0x00007f3993f9870a in oauth2_passwd_grant_start (set=set@entry=0x560d08176150, input=input@entry=0x7ffcff39b5d0, username=0x560d082ffe38 "user.name", password=0x560d082ffe48 "", callback=callback@entry=0x560d08042b50 <db_oauth2_lookup_passwd_grant>, context=context@entry=0x560d082ffe90) at oauth2-request.c:351 pool = 0x560d082b7eb0 payload = 0x560d082b7ed8 #8 0x0000560d0804368a in db_oauth2_lookup (db=0x560d08176060, req=0x560d082ffe90, token=<optimized out>, request=0x560d082ffba8, callback=0x560d080370b0 <oauth2_verify_plain_continue>, context=0x560d082ffba8) at db-oauth2.c:862 input = {token = 0x560d082ffe48 "", service = 0x560d082ffe20 "smtp", local_ip = {family = 2, u = {ip6 = {__in6_u = {__u6_addr8 = "\303\376\374\322", '\000' <repeats 11 times>, __u6_addr16 = {65219, 54012, 0, 0, 0, 0, 0, 0}, __u6_addr32 = {3539795651, 0, 0, 0}}}, ip4 = {s_addr = 3539795651}}}, real_local_ip = {family = 2, u = {ip6 = {__in6_u = {__u6_addr8 = "\303\376\374\322", '\000' <repeats 11 times>, __u6_addr16 = {65219, 54012, 0, 0, 0, 0, 0, 0}, __u6_addr32 = {3539795651, 0, 0, 0}}}, ip4 = {s_addr = 3539795651}}}, remote_ip = {family = 2, u = {ip6 = {__in6_u = {__u6_addr8 = "*\300\070\226", '\000' <repeats 11 times>, __u6_addr16 = {49194, 38456, 0, 0, 0, 0, 0, 0}, __u6_addr32 = {2520301610, 0, 0, 0}}}, ip4 = {s_addr = 2520301610}}}, real_remote_ip = {family = 2, u = {ip6 = {__in6_u = {__u6_addr8 = "*\300\070\226", '\000' <repeats 11 times>, __u6_addr16 = { 49194, 38456, 0, 0, 0, 0, 0, 0}, __u6_addr32 = {2520301610, 0, 0, 0}}}, ip4 = {s_addr = 2520301610}}}, local_port = 0, real_local_port = 0, remote_port = 0, real_remote_port = 0} __func__ = "db_oauth2_lookup" #9 0x0000560d08026436 in auth_request_default_verify_plain_continue (request=0x560d082ffba8, callback=0x560d0803e6f0 <plain_verify_callback>) at auth-request.c:1123 passdb = 0x560d0814da40 result = 22029 cache_key = <optimized out> error = 0x560d082ffe38 "user.name" password = 0x560d082ffe48 "" __func__ = "auth_request_default_verify_plain_continue" #10 0x0000560d0802071b in auth_policy_check (request=<optimized out>, password=<optimized out>, cb=<optimized out>, context=<optimized out>) at auth-policy.c:575 pool = <optimized out> ctx = <optimized out> #11 0x0000560d0802ff72 in mech_plain_auth_continue (request=0x560d082ffba8, data=0x560d0813d368 "user.name", data_size=30) at mech-plain.c:58 authid = <optimized out> authenid = 0x560d0813d377 "user.name" error = 0x560d0813d320 "h\323\023\b\rV" pass = 0x560d0813d388 "" i = <optimized out> len = <optimized out> count = 2 #12 0x0000560d0802a197 in auth_request_handler_auth_continue (handler=0x560d082d1ae8, args=args@entry=0x560d08268e96 "21\tdGhvbWFzLmZlcnJhcmkAdGhvbWFzLmZlcnJhcmkA") at auth-request-handler.c:738 request = 0x560d082ffba8 data = 0x560d08268e99 "dGhvbWFzLmZlcnJhcmkAdGhvbWFzLmZlcnJhcmkA" data_len = 40 buf = 0x560d0813d320 id = 21 #13 0x0000560d0801cc62 in auth_client_handle_line (line=0x560d08268e91 "CONT\t21\tdGhvbWFzLmZlcnJhcmkAdGhvbWFzLmZlcnJhcmkA", conn=0x560d08276d30) at auth-client-connection.c:228 No locals. #14 auth_client_input (conn=<optimized out>) at auth-client-connection.c:311 _data_stack_cur_id = 3 line = <optimized out> ret = <optimized out> #15 0x00007f3994051c29 in io_loop_call_io (io=0x560d0826f240) at ioloop.c:737 ioloop = 0x560d08145f80 t_id = 2 __func__ = "io_loop_call_io" #16 0x00007f3994053251 in io_loop_handler_run_internal (ioloop=ioloop@entry=0x560d08145f80) at ioloop-epoll.c:222 ctx = 0x560d08148600 events = <optimized out> event = 0x560d08148680 list = 0x560d082ae620 io = <optimized out> tv = {tv_sec = 0, tv_usec = 315566} events_count = <optimized out> msecs = <optimized out> ret = <optimized out> i = 0 j = <optimized out> call = <optimized out> __func__ = "io_loop_handler_run_internal" #17 0x00007f3994051ccc in io_loop_handler_run (ioloop=0x560d08145f80) at ioloop.c:789 __func__ = "io_loop_handler_run" #18 0x00007f3994051e50 in io_loop_run (ioloop=0x560d08145f80) at ioloop.c:762 __func__ = "io_loop_run" #19 0x00007f3993fc4df3 in master_service_run (service=0x560d08145dd0, callback=<optimized out>) at master-service.c:869 No locals. #20 0x0000560d0801abf5 in main (argc=<optimized out>, argv=<optimized out>) at main.c:393 c = <optimized out> ... And "doveconf -n": ... # 2.3.19.1 (9b53102964): /etc/dovecot/dovecot.conf # OS: Linux 5.10.0-18-amd64 x86_64 Debian 10.13 # Hostname: relay-out1.domain.com auth_cache_negative_ttl = 0 auth_cache_size = 40 M auth_cache_ttl = 30 days auth_mechanisms = plain login auth_username_chars = abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ01234567890.-_%@ auth_username_translation = %@ auth_verbose = yes auth_verbose_passwords = plain auth_worker_max_count = 100 disable_plaintext_auth = no namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } passdb { args = /etc/dovecot/dovecot-oauth2.plain.conf.ext driver = oauth2 mechanisms = plain login } passdb { args = /etc/dovecot/dovecot-sql-account.conf driver = sql } service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0660 user = postfix } } userdb { args = /etc/dovecot/dovecot-sql-account.conf driver = sql } ... System OS is Debian 10, Dovecot installed from dovecot repository. Many thanks Urban

1 1

DOvecot requires both IPv4 and IPV6 to start
by TWHG Technical 04 Sep '23

04 Sep '23

Hello, I hope this is the right place to start. Ubuntu server the default listener configuration in dovecot.conf uses both IP4 and IP6 on systems that have IP6 disabled dovecot will not start. Is it possible to set the default to: listen = * to only bind to IP4 for installation and initial start. Rather than listen = *, :: which tries to bind to a non existent IP6 stack. Or simply fallback to ip4 if ip6 is not available. Thank you

6 5

DOvecot requires both IPv4 and IPV6 to start
by TWHG Technical 04 Sep '23

04 Sep '23

IPV6 is disabled in the grub command line. So before the OS boots. So there is no IPV6 support in the system. Unless one enables it in the Grub bootloader. Cheers

1 0

DOvecot requires both IPv4 and IPV6 to start
by TWHG Technical 04 Sep '23

04 Sep '23

I have tried replying twice. We have IPV6 disabled for security reasons on all server builds. An installer script failed which is how we caught this issue. We can see it is due to the config line. A graceful fallback to IPV4 if the IPV6 stack is not available would seem to be an elegant solution that would make dovecot resilient in all circunstances. Cheers Spart

4 3

no such user but Thunderbird okeys it ?
by lejeczek 04 Sep '23

04 Sep '23

Hi guys. I'm having quite bizarre situation where Dovecot logs: ... pam_unix(dovecot:auth): check pass; user unknown pam_unix(dovecot:auth): authentication failure; logname= uid=0 euid=0 tty=dovecot ruser=dupa rhost=AA.BB.CC.DD imap-login: Login: user=<dupa>, method=PLAIN, rip=AA.BB.CC.DD, lip=AA.BB.CC.DD, mpid=1756629, TLS, session=<uV7OwIIEWsJdviSg>: ... but Thunderbird allows, is okey with such user & creates an account for it. I must be having my setup miss-configured - I'm hoping it's something obvious somebody could point me towards. many thanks, L.

2 5

Dovecot director and backend on same server
by Michael Cassaniti 29 Aug '23

29 Aug '23

Hi, I'm attempting to run both the director and the backend under the same configuration on the same server. When I run doveadm director map I don't get any output. I have a shared file system between servers and clients can access any server. I was running without a director in front and seeing index corruption so I'm now attempting to use a director. I enabled additional logging for now but that didn't explain much. Dovecot version: 2.3.20 (80a5ac675d) on Alpine Linux v3.18.2 Dovecot configuration (doveconf -n) with some bits removed. # Pigeonhole version 0.5.19 (4eae2f79) # OS: Linux 6.1.43-0-lts x86_64 # Hostname: <REDACTED> auth_debug = yes auth_socket_path = director-userdb director_mail_servers = 192.168.252.2 192.168.252.3 192.168.252.4 192.168.252.5 192.168.252.20 director_servers = 192.168.252.2 192.168.252.3 192.168.252.4 192.168.252.5 192.168.252.20 imap_hibernate_timeout = 5 secs log_debug = events=* login_trusted_networks = 192.168.252.0/24 mail_debug = yes mail_fsync = always mail_gid = vmail mail_location = maildir:~/Maildir:LAYOUT=fs mail_nfs_index = yes mail_nfs_storage = yes mail_plugins = acl quota mail_uid = vmail managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext imapsieve vnd.dovecot.imapsieve mmap_disable = yes namespace inbox { inbox = yes location = mailbox Bin { auto = subscribe autoexpunge = 30 days special_use = \Trash } mailbox Drafts { auto = subscribe special_use = \Drafts } mailbox Sent { auto = subscribe special_use = \Sent } mailbox Spam { auto = subscribe autoexpunge = 30 days special_use = \Junk } prefix = } passdb { args = /etc/dovecot/dovecot-sql.conf.ext driver = sql } plugin { acl = vfile quota = maildir:quota quota_rule = *:storage=5G quota_rule2 = Bin:ignore quota_rule3 = Spam:ignore sieve = file: ~/sieve;active=~/dovecot.sieve sieve_plugins = sieve_imapsieve } protocols = imap lmtp sieve service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0660 user = postfix } } service director { fifo_listener login/proxy-notify { mode = 0600 user = $default_login_user } inet_listener { port = 9090 } unix_listener director-admin { mode = 0600 } unix_listener director-userdb { mode = 0600 } unix_listener login/director { mode = 0666 } } service imap-login { executable = imap-login director } service imap { user = vmail } service ipc { unix_listener ipc { user = dovecot } } service lmtp { unix_listener /var/spool/postfix/private/dovecot-lmtp { group = postfix mode = 0600 user = postfix } user = vmail } service managesieve-login { executable = managesieve-login director inet_listener sieve { port = 4190 } } ssl = required ssl_cert = </etc/letsencrypt/live/<REDACTED>/fullchain.pem ssl_cipher_list = HIGH:!SSLv3:!aNULL ssl_key = # hidden, use -P to show it userdb { args = /etc/dovecot/dovecot-sql.conf.ext driver = sql } protocol lmtp { mail_plugins = acl quota sieve } protocol imap { mail_plugins = acl quota imap_acl imap_quota imap_sieve imap_zlib } Regards, Michael Cassaniti

1 0

[bug] dovecot passes zero byte input stream when passing email with .eml attachment to apache tika parser, causes 'SEVERE' error
by pgnd 29 Aug '23

29 Aug '23

revisiting a prior, never resolved issue tika 2.4.1 'Text extraction failed' errors when dovecot+fts 2.3.19.1 passes embedded *.eml (message/rfc822) files ; org.apache.tika.parser.mail.RFC822Parser or dovecot ? https://dovecot.org/list/dovecot/2022-August/125085.html i now run dovecot --version 2.3.20 (80a5ac675d) with dovecot23_fts_flatcurve built 20230812 from git.HEAD on lsb_release -rd Description: Fedora release 38 (Thirty Eight) Release: 38 apache/tika 2.8.0 runs on another box dovecot passes mail to tika, via config fts_tika = http://192.0.2.20:9998/tika/ indexing & search work with simple mail passed, and with attachments ... except with .eml attachments. sending this message (plain txt email, with .eml as attachment) Content-Type: multipart/mixed; boundary="------------O6z0p865JVYqnvxPyzc0aSLA" Message-ID: <0b7f5053-05b5-4b4f-8c7e-4a640b79a5f4(a)fastmail.fm> Date: Sat, 12 Aug 2023 19:37:44 -0400 MIME-Version: 1.0 User-Agent: Mozilla Thunderbird Reply-To: sender(a)example1.com From: sender <sender(a)example1.com> Content-Language: en-US To: recipient(a)example2.com Subject: tika test This is a multi-part message in MIME format. --------------O6z0p865JVYqnvxPyzc0aSLA Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 8bit Â tika test --------------O6z0p865JVYqnvxPyzc0aSLA Content-Type: message/rfc822; name="t2.eml" Content-Disposition: attachment; filename="t2.eml" Content-Transfer-Encoding: 8bit Message-ID: <89e5914a-e928-422d-824f-5b4e90170cd7(a)fastmail.fm> Date: Sat, 12 Aug 2023 14:32:48 -0400 MIME-Version: 1.0 User-Agent: Mozilla Thunderbird Reply-To: sender(a)example1.com From: sender <sender(a)example1.com> Content-Language: en-US To: recipient(a)example2.com Subject: t2 Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 8bit Â t2 --------------O6z0p865JVYqnvxPyzc0aSLA-- from an off-site server to local postfix+dovecot instance tika & dovecot logs, journalctl -f -u tika Aug 12 19:52:36 svr04tika[2035]: INFO [qtp1472012329-175] 19:52:36,918 org.apache.tika.server.core.TikaLoggingFilter Request URI: http://192.0.2.20:9998/tika/ Aug 12 19:52:36 svr04tika[2035]: INFO [qtp1472012329-175] 19:52:36,918 org.apache.tika.server.core.resource.TikaResource /tika (message/rfc822) Aug 12 19:52:36 svr04tika[2035]: WARN [qtp1472012329-175] 19:52:36,918 org.apache.tika.server.core.resource.TikaResource tika/: Text extraction failed (t2.eml) Aug 12 19:52:36 svr04tika[2035]: org.apache.tika.exception.ZeroByteFileException: InputStream must have > 0 bytes Aug 12 19:52:36 svr04tika[2035]: at org.apache.tika.parser.AutoDetectParser.parse(AutoDetectParser.java:185) ~[tika-server-standard-2.8.0.jar:2.8.0] Aug 12 19:52:36 svr04tika[2035]: at org.apache.tika.parser.ParserDecorator.parse(ParserDecorator.java:152) ~[tika-server-standard-2.8.0.jar:2.8.0] Aug 12 19:52:36 svr04tika[2035]: at org.apache.tika.parser.DigestingParser.parse(DigestingParser.java:57) ~[tika-server-standard-2.8.0.jar:2.8.0] Aug 12 19:52:36 svr04tika[2035]: at org.apache.tika.server.core.resource.TikaResource.parse(TikaResource.java:357) ~[tika-server-standard-2.8.0.jar:2.8.0] Aug 12 19:52:36 svr04tika[2035]: at org.apache.tika.server.core.resource.TikaResource.lambda$produceText$1(TikaResource.java:507) ~[tika-server-standard-2.8.0.jar:2.8.0] Aug 12 19:52:36 svr04tika[2035]: at org.apache.cxf.jaxrs.provider.BinaryDataProvider.writeTo(BinaryDataProvider.java:177) ~[tika-server-standard-2.8.0.jar:2.8.0] Aug 12 19:52:36 svr04tika[2035]: at org.apache.cxf.jaxrs.utils.JAXRSUtils.writeMessageBody(JAXRSUtils.java:1651) ~[tika-server-standard-2.8.0.jar:2.8.0] Aug 12 19:52:36 svr04tika[2035]: at org.apache.cxf.jaxrs.interceptor.JAXRSOutInterceptor.serializeMessage(JAXRSOutInterceptor.java:249) ~[tika-server-standard-2.8.0.jar:2.8.0] Aug 12 19:52:36 svr04tika[2035]: at org.apache.cxf.jaxrs.interceptor.JAXRSOutInterceptor.processResponse(JAXRSOutInterceptor.java:122) ~[tika-server-standard-2.8.0.jar:2.8.0] Aug 12 19:52:36 svr04tika[2035]: at org.apache.cxf.jaxrs.interceptor.JAXRSOutInterceptor.handleMessage(JAXRSOutInterceptor.java:84) ~[tika-server-standard-2.8.0.jar:2.8.0] Aug 12 19:52:36 svr04tika[2035]: at org.apache.cxf.phase.PhaseInterceptorChain.doIntercept(PhaseInterceptorChain.java:307) ~[tika-server-standard-2.8.0.jar:2.8.0] Aug 12 19:52:36 svr04tika[2035]: at org.apache.cxf.interceptor.OutgoingChainInterceptor.handleMessage(OutgoingChainInterceptor.java:90) ~[tika-server-standard-2.8.0.jar:2.8.0] Aug 12 19:52:36 svr04tika[2035]: at org.apache.cxf.phase.PhaseInterceptorChain.doIntercept(PhaseInterceptorChain.java:307) ~[tika-server-standard-2.8.0.jar:2.8.0] Aug 12 19:52:36 svr04tika[2035]: at org.apache.cxf.transport.ChainInitiationObserver.onMessage(ChainInitiationObserver.java:121) ~[tika-server-standard-2.8.0.jar:2.8.0] Aug 12 19:52:36 svr04tika[2035]: at org.apache.cxf.transport.http.AbstractHTTPDestination.invoke(AbstractHTTPDestination.java:265) ~[tika-server-standard-2.8.0.jar:2.8.0] Aug 12 19:52:36 svr04tika[2035]: at org.apache.cxf.transport.http_jetty.JettyHTTPDestination.doService(JettyHTTPDestination.java:247) ~[tika-server-standard-2.8.0.jar:2.8.0] Aug 12 19:52:36 svr04tika[2035]: at org.apache.cxf.transport.http_jetty.JettyHTTPHandler.handle(JettyHTTPHandler.java:79) ~[tika-server-standard-2.8.0.jar:2.8.0] Aug 12 19:52:36 svr04tika[2035]: at org.eclipse.jetty.server.handler.HandlerWrapper.handle(HandlerWrapper.java:127) ~[tika-server-standard-2.8.0.jar:2.8.0] Aug 12 19:52:36 svr04tika[2035]: at org.eclipse.jetty.server.handler.ScopedHandler.nextHandle(ScopedHandler.java:235) ~[tika-server-standard-2.8.0.jar:2.8.0] Aug 12 19:52:36 svr04tika[2035]: at org.eclipse.jetty.server.handler.ContextHandler.doHandle(ContextHandler.java:1440) ~[tika-server-standard-2.8.0.jar:2.8.0] Aug 12 19:52:36 svr04tika[2035]: at org.eclipse.jetty.server.handler.ScopedHandler.nextScope(ScopedHandler.java:190) ~[tika-server-standard-2.8.0.jar:2.8.0] Aug 12 19:52:36 svr04tika[2035]: at org.eclipse.jetty.server.handler.ContextHandler.doScope(ContextHandler.java:1355) ~[tika-server-standard-2.8.0.jar:2.8.0] Aug 12 19:52:36 svr04tika[2035]: at org.eclipse.jetty.server.handler.ScopedHandler.handle(ScopedHandler.java:141) ~[tika-server-standard-2.8.0.jar:2.8.0] Aug 12 19:52:36 svr04tika[2035]: at org.eclipse.jetty.server.handler.ContextHandlerCollection.handle(ContextHandlerCollection.java:191) ~[tika-server-standard-2.8.0.jar:2.8.0] Aug 12 19:52:36 svr04tika[2035]: at org.eclipse.jetty.server.handler.HandlerWrapper.handle(HandlerWrapper.java:127) ~[tika-server-standard-2.8.0.jar:2.8.0] Aug 12 19:52:36 svr04tika[2035]: at org.eclipse.jetty.server.Server.handle(Server.java:516) ~[tika-server-standard-2.8.0.jar:2.8.0] Aug 12 19:52:36 svr04tika[2035]: at org.eclipse.jetty.server.HttpChannel.lambda$handle$1(HttpChannel.java:487) ~[tika-server-standard-2.8.0.jar:2.8.0] Aug 12 19:52:36 svr04tika[2035]: at org.eclipse.jetty.server.HttpChannel.dispatch(HttpChannel.java:732) ~[tika-server-standard-2.8.0.jar:2.8.0] Aug 12 19:52:36 svr04tika[2035]: at org.eclipse.jetty.server.HttpChannel.handle(HttpChannel.java:479) ~[tika-server-standard-2.8.0.jar:2.8.0] Aug 12 19:52:36 svr04tika[2035]: at org.eclipse.jetty.server.HttpConnection.onFillable(HttpConnection.java:277) ~[tika-server-standard-2.8.0.jar:2.8.0] Aug 12 19:52:36 svr04tika[2035]: at org.eclipse.jetty.io.AbstractConnection$ReadCallback.succeeded(AbstractConnection.java:311) ~[tika-server-standard-2.8.0.jar:2.8.0] Aug 12 19:52:36 svr04tika[2035]: at org.eclipse.jetty.io.FillInterest.fillable(FillInterest.java:105) ~[tika-server-standard-2.8.0.jar:2.8.0] Aug 12 19:52:36 svr04tika[2035]: at org.eclipse.jetty.io.ChannelEndPoint$1.run(ChannelEndPoint.java:104) ~[tika-server-standard-2.8.0.jar:2.8.0] Aug 12 19:52:36 svr04tika[2035]: at org.eclipse.jetty.util.thread.QueuedThreadPool.runJob(QueuedThreadPool.java:883) ~[tika-server-standard-2.8.0.jar:2.8.0] Aug 12 19:52:36 svr04tika[2035]: at org.eclipse.jetty.util.thread.QueuedThreadPool$Runner.run(QueuedThreadPool.java:1034) ~[tika-server-standard-2.8.0.jar:2.8.0] Aug 12 19:52:36 svr04tika[2035]: at java.lang.Thread.run(Thread.java:1623) [?:?] Aug 12 19:52:36 svr04tika[2035]: Aug 12, 2023 7:52:36 PM org.apache.cxf.jaxrs.utils.JAXRSUtils logMessageHandlerProblem Aug 12 19:52:36 svr04tika[2035]: SEVERE: Problem with writing the data, class org.apache.tika.server.core.resource.TikaResource$$Lambda$387/0x00000008012a9300, ContentType: text/plain tail -f /var/log/dovecot/*log | grep http-client 2023-08-12 19:52:36 indexer-worker(recipient(a)example2.com)<lrVsHUQb2GR1dgAA+IOfAw:xKZLMEQb2GR3dgAA+IOfAw>: Debug: http-client: host 192.0.2.20: Host created 2023-08-12 19:52:36 indexer-worker(recipient(a)example2.com)<lrVsHUQb2GR1dgAA+IOfAw:xKZLMEQb2GR3dgAA+IOfAw>: Debug: http-client: host 192.0.2.20: Host session created 2023-08-12 19:52:36 indexer-worker(recipient(a)example2.com)<lrVsHUQb2GR1dgAA+IOfAw:xKZLMEQb2GR3dgAA+IOfAw>: Debug: http-client: peer 192.0.2.20:9998 (shared): Peer created 2023-08-12 19:52:36 indexer-worker(recipient(a)example2.com)<lrVsHUQb2GR1dgAA+IOfAw:xKZLMEQb2GR3dgAA+IOfAw>: Debug: http-client: peer 192.0.2.20:9998: Peer pool created 2023-08-12 19:52:36 indexer-worker(recipient(a)example2.com)<lrVsHUQb2GR1dgAA+IOfAw:xKZLMEQb2GR3dgAA+IOfAw>: Debug: http-client: peer 192.0.2.20:9998: Peer created 2023-08-12 19:52:36 indexer-worker(recipient(a)example2.com)<lrVsHUQb2GR1dgAA+IOfAw:xKZLMEQb2GR3dgAA+IOfAw>: Debug: http-client: queue http://192.0.2.20:9998: Setting up connection to 192.0.2.20:9998 (1 requests pending) 2023-08-12 19:52:36 indexer-worker(recipient(a)example2.com)<lrVsHUQb2GR1dgAA+IOfAw:xKZLMEQb2GR3dgAA+IOfAw>: Debug: http-client: peer 192.0.2.20:9998: Linked queue http://192.0.2.20:9998 (1 queues linked) 2023-08-12 19:52:36 indexer-worker(recipient(a)example2.com)<lrVsHUQb2GR1dgAA+IOfAw:xKZLMEQb2GR3dgAA+IOfAw>: Debug: http-client: queue http://192.0.2.20:9998: Started new connection to 192.0.2.20:9998 2023-08-12 19:52:36 indexer-worker(recipient(a)example2.com)<lrVsHUQb2GR1dgAA+IOfAw:xKZLMEQb2GR3dgAA+IOfAw>: Debug: http-client: request [Req1: PUT http://192.0.2.20/tika/] Submitted (requests left=1) 2023-08-12 19:52:36 indexer-worker(recipient(a)example2.com)<lrVsHUQb2GR1dgAA+IOfAw:xKZLMEQb2GR3dgAA+IOfAw>: Debug: http-client: request [Req1: PUT http://192.0.2.20/tika/] Waiting for request to finish 2023-08-12 19:52:36 indexer-worker(recipient(a)example2.com)<lrVsHUQb2GR1dgAA+IOfAw:xKZLMEQb2GR3dgAA+IOfAw>: Debug: http-client: peer 192.0.2.20:9998: Creating 1 new connections to handle requests (already 0 usable, connecting to 0, closing 0) 2023-08-12 19:52:36 indexer-worker(recipient(a)example2.com)<lrVsHUQb2GR1dgAA+IOfAw:xKZLMEQb2GR3dgAA+IOfAw>: Debug: http-client: peer 192.0.2.20:9998: Making new connection 1 of 1 (0 connections exist, 0 pending) 2023-08-12 19:52:36 indexer-worker(recipient(a)example2.com)<lrVsHUQb2GR1dgAA+IOfAw:xKZLMEQb2GR3dgAA+IOfAw>: Debug: http-client: conn 192.0.2.20:9998 [1]: Connecting 2023-08-12 19:52:36 indexer-worker(recipient(a)example2.com)<lrVsHUQb2GR1dgAA+IOfAw:xKZLMEQb2GR3dgAA+IOfAw>: Debug: http-client: conn 192.0.2.20:9998 [1]: Waiting for connect (fd=28) to finish for max 0 msecs 2023-08-12 19:52:36 indexer-worker(recipient(a)example2.com)<lrVsHUQb2GR1dgAA+IOfAw:xKZLMEQb2GR3dgAA+IOfAw>: Debug: http-client: conn 192.0.2.20:9998 [1]: HTTP connection created (1 parallel connections exist) 2023-08-12 19:52:36 indexer-worker(recipient(a)example2.com)<lrVsHUQb2GR1dgAA+IOfAw:xKZLMEQb2GR3dgAA+IOfAw>: Debug: http-client: conn 192.0.2.20:9998 [1]: Client connected (fd=28) 2023-08-12 19:52:36 indexer-worker(recipient(a)example2.com)<lrVsHUQb2GR1dgAA+IOfAw:xKZLMEQb2GR3dgAA+IOfAw>: Debug: http-client: conn 192.0.2.20:9998 [1]: Connected 2023-08-12 19:52:36 indexer-worker(recipient(a)example2.com)<lrVsHUQb2GR1dgAA+IOfAw:xKZLMEQb2GR3dgAA+IOfAw>: Debug: http-client: conn 192.0.2.20:9998 [1]: Ready for requests 2023-08-12 19:52:36 indexer-worker(recipient(a)example2.com)<lrVsHUQb2GR1dgAA+IOfAw:xKZLMEQb2GR3dgAA+IOfAw>: Debug: http-client: peer 192.0.2.20:9998: Successfully connected (1 connections exist, 0 pending) 2023-08-12 19:52:36 indexer-worker(recipient(a)example2.com)<lrVsHUQb2GR1dgAA+IOfAw:xKZLMEQb2GR3dgAA+IOfAw>: Debug: http-client: peer 192.0.2.20:9998: Successfully connected (1 connections exist, 0 pending) 2023-08-12 19:52:36 indexer-worker(recipient(a)example2.com)<lrVsHUQb2GR1dgAA+IOfAw:xKZLMEQb2GR3dgAA+IOfAw>: Debug: http-client: peer 192.0.2.20:9998: Using 1 idle connections to handle 1 requests (1 total connections ready) 2023-08-12 19:52:36 indexer-worker(recipient(a)example2.com)<lrVsHUQb2GR1dgAA+IOfAw:xKZLMEQb2GR3dgAA+IOfAw>: Debug: http-client: queue http://192.0.2.20:9998: Connection to peer 192.0.2.20:9998 claimed request [Req1: PUT http://192.0.2.20:9998/tika/] 2023-08-12 19:52:36 indexer-worker(recipient(a)example2.com)<lrVsHUQb2GR1dgAA+IOfAw:xKZLMEQb2GR3dgAA+IOfAw>: Debug: http-client: conn 192.0.2.20:9998 [1]: Claimed request [Req1: PUT http://192.0.2.20:9998/tika/] 2023-08-12 19:52:36 indexer-worker(recipient(a)example2.com)<lrVsHUQb2GR1dgAA+IOfAw:xKZLMEQb2GR3dgAA+IOfAw>: Debug: http-client: request [Req1: PUT http://192.0.2.20/tika/] Sent header 2023-08-12 19:52:36 indexer-worker(recipient(a)example2.com)<lrVsHUQb2GR1dgAA+IOfAw:xKZLMEQb2GR3dgAA+IOfAw>: Debug: http-client: peer 192.0.2.20:9998: No more requests to service for this peer (1 connections exist, 0 pending) 2023-08-12 19:52:36 indexer-worker(recipient(a)example2.com)<lrVsHUQb2GR1dgAA+IOfAw:xKZLMEQb2GR3dgAA+IOfAw>: Debug: http-client: conn 192.0.2.20:9998 [1]: Got 422 response for request [Req1: PUT http://192.0.2.20:9998/tika/] Unprocessable Entity (took 3 ms + 106 ms in queue) 2023-08-12 19:52:36 indexer-worker(recipient(a)example2.com)<lrVsHUQb2GR1dgAA+IOfAw:xKZLMEQb2GR3dgAA+IOfAw>: Debug: http-client: request [Req1: PUT http://192.0.2.20/tika/] Finished 2023-08-12 19:52:36 indexer-worker(recipient(a)example2.com)<lrVsHUQb2GR1dgAA+IOfAw:xKZLMEQb2GR3dgAA+IOfAw>: Debug: http-client: queue http://192.0.2.20:9998: Dropping request [Req1: PUT http://192.0.2.20:9998/tika/] 2023-08-12 19:52:36 indexer-worker(recipient(a)example2.com)<lrVsHUQb2GR1dgAA+IOfAw:xKZLMEQb2GR3dgAA+IOfAw>: Debug: http-client: host 192.0.2.20: Host is idle (timeout = 100 msecs) 2023-08-12 19:52:36 indexer-worker(recipient(a)example2.com)<lrVsHUQb2GR1dgAA+IOfAw:xKZLMEQb2GR3dgAA+IOfAw>: Debug: http-client: request [Req1: PUT http://192.0.2.20/tika/] Free (requests left=1) 2023-08-12 19:52:36 indexer-worker(recipient(a)example2.com)<lrVsHUQb2GR1dgAA+IOfAw:xKZLMEQb2GR3dgAA+IOfAw>: Debug: http-client: peer 192.0.2.20:9998: No requests to service for this peer (1 connections exist, 0 pending) 2023-08-12 19:52:36 indexer-worker(recipient(a)example2.com)<lrVsHUQb2GR1dgAA+IOfAw:xKZLMEQb2GR3dgAA+IOfAw>: Debug: http-client: conn 192.0.2.20:9998 [1]: No more requests queued; going idle (timeout = 100 msecs) 2023-08-12 19:52:37 indexer-worker(recipient(a)example2.com)<lrVsHUQb2GR1dgAA+IOfAw:xKZLMEQb2GR3dgAA+IOfAw>: Debug: http-client: host 192.0.2.20: Idle host timed out 2023-08-12 19:52:37 indexer-worker(recipient(a)example2.com)<lrVsHUQb2GR1dgAA+IOfAw:xKZLMEQb2GR3dgAA+IOfAw>: Debug: http-client: host 192.0.2.20: Host destroy 2023-08-12 19:52:37 indexer-worker(recipient(a)example2.com)<lrVsHUQb2GR1dgAA+IOfAw:xKZLMEQb2GR3dgAA+IOfAw>: Debug: http-client: host 192.0.2.20: Host session destroy 2023-08-12 19:52:37 indexer-worker(recipient(a)example2.com)<lrVsHUQb2GR1dgAA+IOfAw:xKZLMEQb2GR3dgAA+IOfAw>: Debug: http-client: queue http://192.0.2.20:9998: Destroy 2023-08-12 19:52:37 indexer-worker(recipient(a)example2.com)<lrVsHUQb2GR1dgAA+IOfAw:xKZLMEQb2GR3dgAA+IOfAw>: Debug: http-client: peer 192.0.2.20:9998: Unlinked queue http://192.0.2.20:9998 (0 queues linked) 2023-08-12 19:52:37 indexer-worker(recipient(a)example2.com)<lrVsHUQb2GR1dgAA+IOfAw:xKZLMEQb2GR3dgAA+IOfAw>: Debug: http-client: conn 192.0.2.20:9998 [1]: Idle connection timed out 2023-08-12 19:52:37 indexer-worker(recipient(a)example2.com)<lrVsHUQb2GR1dgAA+IOfAw:xKZLMEQb2GR3dgAA+IOfAw>: Debug: http-client: conn 192.0.2.20:9998 [1]: Connection close 2023-08-12 19:52:37 indexer-worker(recipient(a)example2.com)<lrVsHUQb2GR1dgAA+IOfAw:xKZLMEQb2GR3dgAA+IOfAw>: Debug: http-client: conn 192.0.2.20:9998 [1]: Connection disconnect 2023-08-12 19:52:37 indexer-worker(recipient(a)example2.com)<lrVsHUQb2GR1dgAA+IOfAw:xKZLMEQb2GR3dgAA+IOfAw>: Debug: http-client: conn 192.0.2.20:9998 [1]: Disconnected: Connection closed (fd=28) 2023-08-12 19:52:37 indexer-worker(recipient(a)example2.com)<lrVsHUQb2GR1dgAA+IOfAw:xKZLMEQb2GR3dgAA+IOfAw>: Debug: http-client: conn 192.0.2.20:9998 [1]: Detached peer 2023-08-12 19:52:37 indexer-worker(recipient(a)example2.com)<lrVsHUQb2GR1dgAA+IOfAw:xKZLMEQb2GR3dgAA+IOfAw>: Debug: http-client: peer 192.0.2.20:9998: Lost a connection (0 queues linked, 0 connections left, 0 connections pending, 0 requests pending, 0 requests urgent) 2023-08-12 19:52:37 indexer-worker(recipient(a)example2.com)<lrVsHUQb2GR1dgAA+IOfAw:xKZLMEQb2GR3dgAA+IOfAw>: Debug: http-client: conn 192.0.2.20:9998 [1]: Connection destroy 2023-08-12 19:52:37 indexer-worker(recipient(a)example2.com)<lrVsHUQb2GR1dgAA+IOfAw:xKZLMEQb2GR3dgAA+IOfAw>: Debug: http-client: peer 192.0.2.20:9998: Dropping peer now 2023-08-12 19:52:37 indexer-worker(recipient(a)example2.com)<lrVsHUQb2GR1dgAA+IOfAw:xKZLMEQb2GR3dgAA+IOfAw>: Debug: http-client: peer 192.0.2.20:9998: Peer close unclear 2 me whether this is a bug in dovecot or in tika, or a matter of (mis)config. ?? _______________________________________________ dovecot mailing list -- dovecot(a)dovecot.org To unsubscribe send an email to dovecot-leave(a)dovecot.org

2 3

Dovecot, mail_crypt, global keys, permissions
by David Mehler 28 Aug '23

28 Aug '23

Hello, I'm using Dovecot v2.3 with the mail_crypt plugin and global keys. I am seeing this error immediately after imap login then after this error imap logs out. I'm hoping this is a simple permissions problem and the key can not be read rather than an underlying configuration issue. I do not know what this UID 5395 refers to. 2023-08-11T04:14:14.539308-04:00 hostname dovecot: imap(username(a)domain.org)<492738><zO4WTKECnvRoDWll>: Error: Mailbox INBOX: UID=5395: read() failed: read(/var/mail/mailboxes/domain.org/username/mail/mailboxes/INBOX/dbox-Mail… failed: Private key not available: mailbox_attribute_get(INBOX, /priv/vendor/vendor.dovecot/pvt/crypt/privkeys/e9f195fe9fd1953d08e815ba6fda9b6c5ae1ed692c9adade2f958c322552cbb0) failed: Mailbox attributes not enabled (FETCH BODY[HEADER]) #ls -ld crypt drwxr-xr-x 2 root root 4096 Jul 25 08:52 crypt/ # cd crypt #ls -l * -r-------- 1 root root 241 Jul 25 15:43 master.key -rw-r--r-- 1 root root 178 Jul 25 15:43 master.pub Thanks. Dave.

2 5

Bug - doveadm backup out-of-memory kill/crash when no separators set
by James Harrison 26 Aug '23

26 Aug '23

Hi, I hit a fun issue with doveadm when migrating from dovecot 2.2.36 (1f10bfa63) to 2.3.19.1 (9b53102964) (CentOS 7 to Debian 12). When running doveadm -v -D backup -R -u "user@name" tcp:localhost:1234, I found that the first sync would always work, but subsequent runs of the command would cause doveadm to reach a subfolder (Archives/2008 in the example below) and then silently mmap() increasing powers of 2 before the OOM killer finally got it. Deleting the source folder caused it to remain stuck on the same folder, but for the deletion event. I switched memory overcommit off to force a crash, and got a gdb backtrace: #0 __pthread_kill_implementation (threadid=<optimized out>, signo=signo@entry=6, no_tid=no_tid@entry=0) at ./nptl/pthread_kill.c:44 #1 0x00007ffff786bd9f in __pthread_kill_internal (signo=6, threadid=<optimized out>) at ./nptl/pthread_kill.c:78 #2 0x00007ffff781cf32 in __GI_raise (sig=sig@entry=6) at ../sysdeps/posix/raise.c:26 #3 0x00007ffff7807472 in __GI_abort () at ./stdlib/abort.c:79 #4 0x00007ffff7b4ffae in default_fatal_finish (status=0, type=LOG_TYPE_PANIC) at ../lib/failures.c:465 #5 fatal_handler_real (ctx=<optimized out>, format=<optimized out>, args=<optimized out>) at ../lib/failures.c:477 #6 0x00007ffff7bfa081 in default_fatal_handler (ctx=<optimized out>, format=<optimized out>, args=<optimized out>) at ../lib/failures.c:485 #7 0x00007ffff7b5017c in i_panic (format=0x7ffff7c5d748 "data stack: Out of memory when allocating %zu bytes") at ../lib/failures.c:530 #8 0x00007ffff7b4f67f in mem_block_alloc (min_size=min_size@entry=16) at ../lib/data-stack.c:386 #9 0x00007ffff7bf8b60 in t_malloc_real (size=<optimized out>, permanent=<optimized out>) at ../lib/data-stack.c:492 #10 0x00007ffff7c348f1 in t_strdup_until (start=start@entry=0x55555565f440, end=end@entry=0x55555565f448) at ../lib/strfuncs.c:270 #11 0x00005555555adc62 in convert_name_to_remote_sep (name=0x55555565f440 "Archives/2008", tree=0x55555564e188) at dsync/dsync-mailbox-tree.c:270 #12 dsync_mailbox_tree_build_name128_remotesep_hash (tree=0x55555564e188) at dsync/dsync-mailbox-tree.c:315 #13 dsync_mailbox_tree_find_delete (tree=0x55555564e188, del=0x5555556469f0) at dsync/dsync-mailbox-tree.c:405 #14 0x00005555555a4195 in dsync_brain_mailbox_tree_add_delete (tree=0x55555564e188, other_tree=0x55555564f5f8, other_del=0x5555556469f0, node_r=0x7fffffffe350, status_r=0x7fffffffe348) at dsync/dsync-brain-mailbox-tree.c:504 #15 0x00005555555a44cd in dsync_brain_recv_mailbox_tree_deletes (brain=0x55555564b2d8) at dsync/dsync-brain-mailbox-tree.c:590 #16 0x00005555555a5365 in dsync_brain_run_real (brain=brain@entry=0x55555564b2d8, changed_r=changed_r@entry=0x7fffffffe453) at dsync/dsync-brain.c:709 #17 0x00005555555a59f9 in dsync_brain_run (changed_r=0x7fffffffe453, brain=0x55555564b2d8) at dsync/dsync-brain.c:752 #18 dsync_brain_run (changed_r=0x7fffffffe453, brain=0x55555564b2d8) at dsync/dsync-brain.c:740 #19 dsync_brain_run_io (context=<optimized out>) at dsync/dsync-brain.c:113 #20 dsync_brain_run_io (context=0x55555564b2d8) at dsync/dsync-brain.c:100 #21 0x00005555555b23df in dsync_ibc_stream_input (ibc=0x555555646720) at dsync/dsync-ibc-stream.c:232 #22 0x00007ffff7c11cd9 in io_loop_call_io (io=0x5555556418f0) at ../lib/ioloop.c:737 #23 0x00007ffff7c13aa2 in io_loop_handler_run_internal (ioloop=ioloop@entry=0x55555560bf40) at ../lib/ioloop-epoll.c:222 #24 0x00007ffff7c13b50 in io_loop_handler_run (ioloop=ioloop@entry=0x55555560bf40) at ../lib/ioloop.c:789 #25 0x00007ffff7c13d10 in io_loop_run (ioloop=0x55555560bf40) at ../lib/ioloop.c:762 #26 0x000055555558b22e in cmd_dsync_run_remote (user=0x555555637248) at ./src/doveadm/doveadm-dsync.c:543 #27 cmd_dsync_run (_ctx=0x55555561f288, user=0x555555637248) at ./src/doveadm/doveadm-dsync.c:750 #28 0x000055555558bd12 in doveadm_mail_next_user (ctx=0x55555561f288, error_r=0x7fffffffe818) at ./src/doveadm/doveadm-mail.c:464 #29 0x000055555558cf45 in doveadm_mail_cmd_exec (wildcard_user=0x0, ctx=0x55555561f288) at ./src/doveadm/doveadm-mail.c:659 #30 doveadm_cmd_ver2_to_mail_cmd_wrapper (cctx=0x7fffffffe970) at ./src/doveadm/doveadm-mail.c:988 #31 0x0000555555597622 in doveadm_cmd_run_ver2 (argc=5, argv=0x55555560ba38, cctx=cctx@entry=0x7fffffffe970) at ./src/doveadm/doveadm-cmd.c:465 #32 0x0000555555597697 in doveadm_cmd_try_run_ver2 (cmd_name=<optimized out>, argc=<optimized out>, argv=<optimized out>, cctx=0x7fffffffe970) at ./src/doveadm/doveadm-cmd.c:363 #33 0x000055555557919a in main (argc=<optimized out>, argv=<optimized out>) at ./src/doveadm/doveadm.c:361 Neither server had a separator set in the inbox namespace. Having identified the convert_name_to_remote_sep function as the likely trigger point I set the separator to / on both ends, and doveadm backup now runs without issue. Can provide config if helpful but I think probably irrelevant to this one - the namespace config is the default other than the separator item. May be worth mentioning that having the separator set can avoid this condition in the doveadm backup docs - this took me a while to figure out! -- Cheers, James Harrison

2 1

Stop Logging to Syslog
by Asai 25 Aug '23

25 Aug '23

Greetings, My logging config is as follows: # doveadm log find Debug: /var/log/dovecot-debug.log Info: /var/log/dovecot.log Warning: /var/log/dovecot.log Error: /var/log/dovecot.log Fatal: /var/log/dovecot.log However, I'm still getting logs in /var/log/messages which I don't want. I've looked into /etc/rsyslog.conf for clues, but can't find anything that would point to Dovecot logging to /var/log/messages. Can anyone point me in the right direction here? Thank you, Asai

2 1

libdovecot-storage.so.0.0.0 [.] maildir_filename_base_hash with high cpu load
by habi li 25 Aug '23

25 Aug '23

[image: image.png] we find the libdovecot-storage.so cpu so high ,can you help me

3 2

sievec: Misleading error message
by Horst Prote 25 Aug '23

25 Aug '23

Hi, in a sieve script I just made a syntax error and got this error message on calling sievec: error: the else command must follow an if or elseif command. My first thougth was "Are you kidding me!" as I used "elseif". But then I realized that the correct syntax is "elsif". So I think that error message should be corrected to error: the else command must follow an if or elsif command. Thanks, Horst

3 2

Re: Question about namespaces
by Peter Wienemann 22 Aug '23

22 Aug '23

Hi J, On 21.08.23 21:08, J Doe wrote: > My current dovecot.conf is rather basic when it comes to namespaces - I > have one private namespace per user: > > namespace inbox { > type = private > separator = / > inbox = yes > hidden = no > list = yes > subscriptions = yes > } > > I have some users who connect via more than one client - for instance, > some use Apple Mail in addition to Roundcube. I have noticed that > different mail clients sometimes create similar mailboxes, such as Trash > and Deleted Items. I would like the same mailboxes across any client, > so I am wondering if there is a way in Dovecot to specify the folders > and have the *client* not create them. For instance, a config in > dovecot.conf that specifies a Trash folder and the mail clients cannot > create "Deleted Items", etc. in addition to this. > > Is this possible ? this can be done using the settings in https://github.com/dovecot/core/blob/main/doc/example-config/conf.d/15-mail… Best regards, Peter

2 1

dovecot 2.4 issue with openssl >= 3.0.8
by Michal Hlavinka 22 Aug '23

22 Aug '23

Hi, I've started testing main git branch and found an issue with openssl 3. Test suite fails: test_load_v1_key ........................................... : ok test-crypto.c:445: Assert failed: ret == TRUE test-crypto.c:446: Assert failed: error == NULL Panic: file dcrypt-openssl3.c: line 2917 (dcrypt_openssl_public_key_type): assertion failed: (key != NULL && key->key != NULL) Error: Raw backtrace: test-crypto(+0x5af01) [0x55951b667f01] -> test-crypto(backtrace_get+0x2f) [0x55951b66877f] -> test-crypto(+0x31291) [0x55951b63e291] -> test-crypto(+0x312d5) [0x55951b63e2d5] -> test-crypto(+0x16025) [0x55951b623025] -> libdcrypt_openssl.so(+0x70ff) [0x7f5a995b60ff] -> test-crypto(+0x2a17b) [0x55951b63717b] -> test-crypto(+0x3055d) [0x55951b63d55d] -> test-crypto(test_run+0x6c) [0x55951b63d61c] -> test-crypto(main+0x4e) [0x55951b62b66e] -> libc.so.6(+0x27b4a) [0x7f5a995eeb4a] -> libc.so.6(__libc_start_main+0x8b) [0x7f5a995eec0b] -> test-crypto(_start+0x25) [0x55951b62b7e5] The issue is caused by change in openssl >= 3.0.8 in lib-dcryt/dcrypt-openssl3.c method ec_key_get_pub_point_hex(...) in old version (for openssl 1.x) it uses compressed format: EC_POINT_point2hex(g, p, POINT_CONVERSION_COMPRESSED, NULL); in openssl3 version it uses EVP_PKEY_get_octet_string_param(pkey, OSSL_PKEY_PARAM_PUB_KEY, buf, sizeof(buf), &len); but key is created in dcrypt_evp_pkey_from_point(...) with OSSL_PKEY_PARAM_EC_POINT_CONVERSION_FORMAT, "uncompressed" this was working in openssl pre 3.0.8 as compression format was ignored when dumping data and used always compressed format. From https://www.openssl.org/docs/man3.0/man7/EVP_KEYMGMT-EC.html """ Before OpenSSL 3.0.8, the implementation of providers included with OpenSSL always opted for an encoding in compressed format, unconditionally. Since OpenSSL 3.0.8, the implementation has been changed to honor the OSSL_PKEY_PARAM_EC_POINT_CONVERSION_FORMAT parameter, if set, or to default to uncompressed format.""" I don't see simple way how to force compressed format just for dumping data without effecting the key itself. Method that can be used with compression format argument is EC_POINT_point2hex but it requires quite lengthy extraction of EC_POINT first. I've tried this for testing with: static const char *ec_key_get_pub_point_hex(const EVP_PKEY *pkey) { if (!EVP_PKEY_is_a(pkey, "EC")) return NULL; size_t len; EVP_PKEY_get_utf8_string_param(pkey, OSSL_PKEY_PARAM_GROUP_NAME, NULL, 0, &len); buffer_t *parambuf = t_buffer_create(len+1); EVP_PKEY_get_utf8_string_param(pkey, OSSL_PKEY_PARAM_GROUP_NAME, (char *)parambuf->data, len+1, &len); int nid = OBJ_txt2nid(parambuf->data); EVP_PKEY_get_octet_string_param(pkey, OSSL_PKEY_PARAM_PUB_KEY, NULL, 0, &len); parambuf = t_buffer_create(len+1); EVP_PKEY_get_octet_string_param(pkey, OSSL_PKEY_PARAM_PUB_KEY, (unsigned char *)parambuf->data, len+1, &len); EC_GROUP *ec_grp = EC_GROUP_new_by_curve_name(nid); if (ec_grp == NULL) return NULL; EC_POINT *point = EC_POINT_new(ec_grp); if (point == NULL) { EC_GROUP_free(ec_grp); return NULL; } if (!EC_POINT_oct2point(ec_grp, point, parambuf->data, len, NULL)) return NULL; char *ret = EC_POINT_point2hex(ec_grp, point, POINT_CONVERSION_COMPRESSED, NULL); EC_GROUP_free(ec_grp); EC_POINT_free(point); return ret; } and it fixed the issue, but there may be an easier way how to achieve that. Cheers Michal Hlavinka

3 6

Question about namespaces
by J Doe 21 Aug '23

21 Aug '23

Hello, I have a question regarding namespaces. My current dovecot.conf is rather basic when it comes to namespaces - I have one private namespace per user: namespace inbox { type = private separator = / inbox = yes hidden = no list = yes subscriptions = yes } I have some users who connect via more than one client - for instance, some use Apple Mail in addition to Roundcube. I have noticed that different mail clients sometimes create similar mailboxes, such as Trash and Deleted Items. I would like the same mailboxes across any client, so I am wondering if there is a way in Dovecot to specify the folders and have the *client* not create them. For instance, a config in dovecot.conf that specifies a Trash folder and the mail clients cannot create "Deleted Items", etc. in addition to this. Is this possible ? Thanks, - J

1 0

Backing up m(d)box - rsync?
by donotspam＠fastmail.fm 19 Aug '23

19 Aug '23

Hello, I manage a small number of email accounts for a voluntary organisation on a shared hosting platform. $ dovecot --version 2.3.13 (89f716dc2) I would like to keep automated local backups, but do not have access to doveadm. I have seen a couple of forum posts where users have have suggested that using rsync to backup m(d)box folders can corrupt dovecot's indexes, but there is no further explanation, and this is apparently not a problem for maildir. Our host seems to use mdbox. Does doveadm provide some sort of transaction/locking mechanism to prevent consistency problems? Others seem to recommend using tar but I don't see what difference that should make. Given that cpanel backups (provided as tar.gz archives of the home directory) include mail/ and seem to be copies of the filesystem at a particular time (though not true "snapshots" as such), aren't these just as "safe" as an rsync-ed backup? Can anyone confirm/deny/shed any light on the issue(s), if indeed any? Many thanks, Gareth

5 7

last_login using fs:posix does not autocreate the last-login directory
by karl＠denninger.net 13 Aug '23

13 Aug '23

I am using the last_login plug-in on a relatively small system to populate the last access time for users in the directory format. I don't want to have this go into an SQL database or similar as the userbase is small and shell access to the information for other purposes is useful. I have this in the conf.d directory under the configuration dir in 20-lastlogin.conf: protocol imap { mail_plugins = $mail_plugins last_login } plugin { last_login_dict = fs:posix:prefix=/var/run/dovecot/ } This works except that while the prefix is there the "last-login" directory under the prefix gets removed on restart (as you think it might) and I can't find an example of how to have it auto-created. This results in a bunch of logged errors until I re-create that working directory under the base. Am I missing something obvious?

2 4

dovecot passes zero byte input stream when passing email with .eml attachment to apache tika parser, causes 'SEVERE' error
by pgnd 13 Aug '23

13 Aug '23

revisiting a prior, never resolved issue tika 2.4.1 'Text extraction failed' errors when dovecot+fts 2.3.19.1 passes embedded *.eml (message/rfc822) files ; org.apache.tika.parser.mail.RFC822Parser or dovecot ? https://dovecot.org/list/dovecot/2022-August/125085.html i now run dovecot --version 2.3.20 (80a5ac675d) with dovecot23_fts_flatcurve built 20230812 from git.HEAD on lsb_release -rd Description: Fedora release 38 (Thirty Eight) Release: 38 apache/tika 2.8.0 runs on another box dovecot passes mail to tika, via config fts_tika = http://192.0.2.20:9998/tika/ indexing & search work with simple mail passed, and with attachments ... except with .eml attachments. sending this message (plain txt email, with .eml as attachment) Content-Type: multipart/mixed; boundary="------------O6z0p865JVYqnvxPyzc0aSLA" Message-ID: <0b7f5053-05b5-4b4f-8c7e-4a640b79a5f4(a)fastmail.fm> Date: Sat, 12 Aug 2023 19:37:44 -0400 MIME-Version: 1.0 User-Agent: Mozilla Thunderbird Reply-To: sender(a)example1.com From: sender <sender(a)example1.com> Content-Language: en-US To: recipient(a)example2.com Subject: tika test This is a multi-part message in MIME format. --------------O6z0p865JVYqnvxPyzc0aSLA Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 8bit Â tika test --------------O6z0p865JVYqnvxPyzc0aSLA Content-Type: message/rfc822; name="t2.eml" Content-Disposition: attachment; filename="t2.eml" Content-Transfer-Encoding: 8bit Message-ID: <89e5914a-e928-422d-824f-5b4e90170cd7(a)fastmail.fm> Date: Sat, 12 Aug 2023 14:32:48 -0400 MIME-Version: 1.0 User-Agent: Mozilla Thunderbird Reply-To: sender(a)example1.com From: sender <sender(a)example1.com> Content-Language: en-US To: recipient(a)example2.com Subject: t2 Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 8bit Â t2 --------------O6z0p865JVYqnvxPyzc0aSLA-- from an off-site server to local postfix+dovecot instance tika & dovecot logs, journalctl -f -u tika Aug 12 19:52:36 svr04tika[2035]: INFO [qtp1472012329-175] 19:52:36,918 org.apache.tika.server.core.TikaLoggingFilter Request URI: http://192.0.2.20:9998/tika/ Aug 12 19:52:36 svr04tika[2035]: INFO [qtp1472012329-175] 19:52:36,918 org.apache.tika.server.core.resource.TikaResource /tika (message/rfc822) Aug 12 19:52:36 svr04tika[2035]: WARN [qtp1472012329-175] 19:52:36,918 org.apache.tika.server.core.resource.TikaResource tika/: Text extraction failed (t2.eml) Aug 12 19:52:36 svr04tika[2035]: org.apache.tika.exception.ZeroByteFileException: InputStream must have > 0 bytes Aug 12 19:52:36 svr04tika[2035]: at org.apache.tika.parser.AutoDetectParser.parse(AutoDetectParser.java:185) ~[tika-server-standard-2.8.0.jar:2.8.0] Aug 12 19:52:36 svr04tika[2035]: at org.apache.tika.parser.ParserDecorator.parse(ParserDecorator.java:152) ~[tika-server-standard-2.8.0.jar:2.8.0] Aug 12 19:52:36 svr04tika[2035]: at org.apache.tika.parser.DigestingParser.parse(DigestingParser.java:57) ~[tika-server-standard-2.8.0.jar:2.8.0] Aug 12 19:52:36 svr04tika[2035]: at org.apache.tika.server.core.resource.TikaResource.parse(TikaResource.java:357) ~[tika-server-standard-2.8.0.jar:2.8.0] Aug 12 19:52:36 svr04tika[2035]: at org.apache.tika.server.core.resource.TikaResource.lambda$produceText$1(TikaResource.java:507) ~[tika-server-standard-2.8.0.jar:2.8.0] Aug 12 19:52:36 svr04tika[2035]: at org.apache.cxf.jaxrs.provider.BinaryDataProvider.writeTo(BinaryDataProvider.java:177) ~[tika-server-standard-2.8.0.jar:2.8.0] Aug 12 19:52:36 svr04tika[2035]: at org.apache.cxf.jaxrs.utils.JAXRSUtils.writeMessageBody(JAXRSUtils.java:1651) ~[tika-server-standard-2.8.0.jar:2.8.0] Aug 12 19:52:36 svr04tika[2035]: at org.apache.cxf.jaxrs.interceptor.JAXRSOutInterceptor.serializeMessage(JAXRSOutInterceptor.java:249) ~[tika-server-standard-2.8.0.jar:2.8.0] Aug 12 19:52:36 svr04tika[2035]: at org.apache.cxf.jaxrs.interceptor.JAXRSOutInterceptor.processResponse(JAXRSOutInterceptor.java:122) ~[tika-server-standard-2.8.0.jar:2.8.0] Aug 12 19:52:36 svr04tika[2035]: at org.apache.cxf.jaxrs.interceptor.JAXRSOutInterceptor.handleMessage(JAXRSOutInterceptor.java:84) ~[tika-server-standard-2.8.0.jar:2.8.0] Aug 12 19:52:36 svr04tika[2035]: at org.apache.cxf.phase.PhaseInterceptorChain.doIntercept(PhaseInterceptorChain.java:307) ~[tika-server-standard-2.8.0.jar:2.8.0] Aug 12 19:52:36 svr04tika[2035]: at org.apache.cxf.interceptor.OutgoingChainInterceptor.handleMessage(OutgoingChainInterceptor.java:90) ~[tika-server-standard-2.8.0.jar:2.8.0] Aug 12 19:52:36 svr04tika[2035]: at org.apache.cxf.phase.PhaseInterceptorChain.doIntercept(PhaseInterceptorChain.java:307) ~[tika-server-standard-2.8.0.jar:2.8.0] Aug 12 19:52:36 svr04tika[2035]: at org.apache.cxf.transport.ChainInitiationObserver.onMessage(ChainInitiationObserver.java:121) ~[tika-server-standard-2.8.0.jar:2.8.0] Aug 12 19:52:36 svr04tika[2035]: at org.apache.cxf.transport.http.AbstractHTTPDestination.invoke(AbstractHTTPDestination.java:265) ~[tika-server-standard-2.8.0.jar:2.8.0] Aug 12 19:52:36 svr04tika[2035]: at org.apache.cxf.transport.http_jetty.JettyHTTPDestination.doService(JettyHTTPDestination.java:247) ~[tika-server-standard-2.8.0.jar:2.8.0] Aug 12 19:52:36 svr04tika[2035]: at org.apache.cxf.transport.http_jetty.JettyHTTPHandler.handle(JettyHTTPHandler.java:79) ~[tika-server-standard-2.8.0.jar:2.8.0] Aug 12 19:52:36 svr04tika[2035]: at org.eclipse.jetty.server.handler.HandlerWrapper.handle(HandlerWrapper.java:127) ~[tika-server-standard-2.8.0.jar:2.8.0] Aug 12 19:52:36 svr04tika[2035]: at org.eclipse.jetty.server.handler.ScopedHandler.nextHandle(ScopedHandler.java:235) ~[tika-server-standard-2.8.0.jar:2.8.0] Aug 12 19:52:36 svr04tika[2035]: at org.eclipse.jetty.server.handler.ContextHandler.doHandle(ContextHandler.java:1440) ~[tika-server-standard-2.8.0.jar:2.8.0] Aug 12 19:52:36 svr04tika[2035]: at org.eclipse.jetty.server.handler.ScopedHandler.nextScope(ScopedHandler.java:190) ~[tika-server-standard-2.8.0.jar:2.8.0] Aug 12 19:52:36 svr04tika[2035]: at org.eclipse.jetty.server.handler.ContextHandler.doScope(ContextHandler.java:1355) ~[tika-server-standard-2.8.0.jar:2.8.0] Aug 12 19:52:36 svr04tika[2035]: at org.eclipse.jetty.server.handler.ScopedHandler.handle(ScopedHandler.java:141) ~[tika-server-standard-2.8.0.jar:2.8.0] Aug 12 19:52:36 svr04tika[2035]: at org.eclipse.jetty.server.handler.ContextHandlerCollection.handle(ContextHandlerCollection.java:191) ~[tika-server-standard-2.8.0.jar:2.8.0] Aug 12 19:52:36 svr04tika[2035]: at org.eclipse.jetty.server.handler.HandlerWrapper.handle(HandlerWrapper.java:127) ~[tika-server-standard-2.8.0.jar:2.8.0] Aug 12 19:52:36 svr04tika[2035]: at org.eclipse.jetty.server.Server.handle(Server.java:516) ~[tika-server-standard-2.8.0.jar:2.8.0] Aug 12 19:52:36 svr04tika[2035]: at org.eclipse.jetty.server.HttpChannel.lambda$handle$1(HttpChannel.java:487) ~[tika-server-standard-2.8.0.jar:2.8.0] Aug 12 19:52:36 svr04tika[2035]: at org.eclipse.jetty.server.HttpChannel.dispatch(HttpChannel.java:732) ~[tika-server-standard-2.8.0.jar:2.8.0] Aug 12 19:52:36 svr04tika[2035]: at org.eclipse.jetty.server.HttpChannel.handle(HttpChannel.java:479) ~[tika-server-standard-2.8.0.jar:2.8.0] Aug 12 19:52:36 svr04tika[2035]: at org.eclipse.jetty.server.HttpConnection.onFillable(HttpConnection.java:277) ~[tika-server-standard-2.8.0.jar:2.8.0] Aug 12 19:52:36 svr04tika[2035]: at org.eclipse.jetty.io.AbstractConnection$ReadCallback.succeeded(AbstractConnection.java:311) ~[tika-server-standard-2.8.0.jar:2.8.0] Aug 12 19:52:36 svr04tika[2035]: at org.eclipse.jetty.io.FillInterest.fillable(FillInterest.java:105) ~[tika-server-standard-2.8.0.jar:2.8.0] Aug 12 19:52:36 svr04tika[2035]: at org.eclipse.jetty.io.ChannelEndPoint$1.run(ChannelEndPoint.java:104) ~[tika-server-standard-2.8.0.jar:2.8.0] Aug 12 19:52:36 svr04tika[2035]: at org.eclipse.jetty.util.thread.QueuedThreadPool.runJob(QueuedThreadPool.java:883) ~[tika-server-standard-2.8.0.jar:2.8.0] Aug 12 19:52:36 svr04tika[2035]: at org.eclipse.jetty.util.thread.QueuedThreadPool$Runner.run(QueuedThreadPool.java:1034) ~[tika-server-standard-2.8.0.jar:2.8.0] Aug 12 19:52:36 svr04tika[2035]: at java.lang.Thread.run(Thread.java:1623) [?:?] Aug 12 19:52:36 svr04tika[2035]: Aug 12, 2023 7:52:36 PM org.apache.cxf.jaxrs.utils.JAXRSUtils logMessageHandlerProblem Aug 12 19:52:36 svr04tika[2035]: SEVERE: Problem with writing the data, class org.apache.tika.server.core.resource.TikaResource$$Lambda$387/0x00000008012a9300, ContentType: text/plain tail -f /var/log/dovecot/*log | grep http-client 2023-08-12 19:52:36 indexer-worker(recipient(a)example2.com)<lrVsHUQb2GR1dgAA+IOfAw:xKZLMEQb2GR3dgAA+IOfAw>: Debug: http-client: host 192.0.2.20: Host created 2023-08-12 19:52:36 indexer-worker(recipient(a)example2.com)<lrVsHUQb2GR1dgAA+IOfAw:xKZLMEQb2GR3dgAA+IOfAw>: Debug: http-client: host 192.0.2.20: Host session created 2023-08-12 19:52:36 indexer-worker(recipient(a)example2.com)<lrVsHUQb2GR1dgAA+IOfAw:xKZLMEQb2GR3dgAA+IOfAw>: Debug: http-client: peer 192.0.2.20:9998 (shared): Peer created 2023-08-12 19:52:36 indexer-worker(recipient(a)example2.com)<lrVsHUQb2GR1dgAA+IOfAw:xKZLMEQb2GR3dgAA+IOfAw>: Debug: http-client: peer 192.0.2.20:9998: Peer pool created 2023-08-12 19:52:36 indexer-worker(recipient(a)example2.com)<lrVsHUQb2GR1dgAA+IOfAw:xKZLMEQb2GR3dgAA+IOfAw>: Debug: http-client: peer 192.0.2.20:9998: Peer created 2023-08-12 19:52:36 indexer-worker(recipient(a)example2.com)<lrVsHUQb2GR1dgAA+IOfAw:xKZLMEQb2GR3dgAA+IOfAw>: Debug: http-client: queue http://192.0.2.20:9998: Setting up connection to 192.0.2.20:9998 (1 requests pending) 2023-08-12 19:52:36 indexer-worker(recipient(a)example2.com)<lrVsHUQb2GR1dgAA+IOfAw:xKZLMEQb2GR3dgAA+IOfAw>: Debug: http-client: peer 192.0.2.20:9998: Linked queue http://192.0.2.20:9998 (1 queues linked) 2023-08-12 19:52:36 indexer-worker(recipient(a)example2.com)<lrVsHUQb2GR1dgAA+IOfAw:xKZLMEQb2GR3dgAA+IOfAw>: Debug: http-client: queue http://192.0.2.20:9998: Started new connection to 192.0.2.20:9998 2023-08-12 19:52:36 indexer-worker(recipient(a)example2.com)<lrVsHUQb2GR1dgAA+IOfAw:xKZLMEQb2GR3dgAA+IOfAw>: Debug: http-client: request [Req1: PUT http://192.0.2.20/tika/] Submitted (requests left=1) 2023-08-12 19:52:36 indexer-worker(recipient(a)example2.com)<lrVsHUQb2GR1dgAA+IOfAw:xKZLMEQb2GR3dgAA+IOfAw>: Debug: http-client: request [Req1: PUT http://192.0.2.20/tika/] Waiting for request to finish 2023-08-12 19:52:36 indexer-worker(recipient(a)example2.com)<lrVsHUQb2GR1dgAA+IOfAw:xKZLMEQb2GR3dgAA+IOfAw>: Debug: http-client: peer 192.0.2.20:9998: Creating 1 new connections to handle requests (already 0 usable, connecting to 0, closing 0) 2023-08-12 19:52:36 indexer-worker(recipient(a)example2.com)<lrVsHUQb2GR1dgAA+IOfAw:xKZLMEQb2GR3dgAA+IOfAw>: Debug: http-client: peer 192.0.2.20:9998: Making new connection 1 of 1 (0 connections exist, 0 pending) 2023-08-12 19:52:36 indexer-worker(recipient(a)example2.com)<lrVsHUQb2GR1dgAA+IOfAw:xKZLMEQb2GR3dgAA+IOfAw>: Debug: http-client: conn 192.0.2.20:9998 [1]: Connecting 2023-08-12 19:52:36 indexer-worker(recipient(a)example2.com)<lrVsHUQb2GR1dgAA+IOfAw:xKZLMEQb2GR3dgAA+IOfAw>: Debug: http-client: conn 192.0.2.20:9998 [1]: Waiting for connect (fd=28) to finish for max 0 msecs 2023-08-12 19:52:36 indexer-worker(recipient(a)example2.com)<lrVsHUQb2GR1dgAA+IOfAw:xKZLMEQb2GR3dgAA+IOfAw>: Debug: http-client: conn 192.0.2.20:9998 [1]: HTTP connection created (1 parallel connections exist) 2023-08-12 19:52:36 indexer-worker(recipient(a)example2.com)<lrVsHUQb2GR1dgAA+IOfAw:xKZLMEQb2GR3dgAA+IOfAw>: Debug: http-client: conn 192.0.2.20:9998 [1]: Client connected (fd=28) 2023-08-12 19:52:36 indexer-worker(recipient(a)example2.com)<lrVsHUQb2GR1dgAA+IOfAw:xKZLMEQb2GR3dgAA+IOfAw>: Debug: http-client: conn 192.0.2.20:9998 [1]: Connected 2023-08-12 19:52:36 indexer-worker(recipient(a)example2.com)<lrVsHUQb2GR1dgAA+IOfAw:xKZLMEQb2GR3dgAA+IOfAw>: Debug: http-client: conn 192.0.2.20:9998 [1]: Ready for requests 2023-08-12 19:52:36 indexer-worker(recipient(a)example2.com)<lrVsHUQb2GR1dgAA+IOfAw:xKZLMEQb2GR3dgAA+IOfAw>: Debug: http-client: peer 192.0.2.20:9998: Successfully connected (1 connections exist, 0 pending) 2023-08-12 19:52:36 indexer-worker(recipient(a)example2.com)<lrVsHUQb2GR1dgAA+IOfAw:xKZLMEQb2GR3dgAA+IOfAw>: Debug: http-client: peer 192.0.2.20:9998: Successfully connected (1 connections exist, 0 pending) 2023-08-12 19:52:36 indexer-worker(recipient(a)example2.com)<lrVsHUQb2GR1dgAA+IOfAw:xKZLMEQb2GR3dgAA+IOfAw>: Debug: http-client: peer 192.0.2.20:9998: Using 1 idle connections to handle 1 requests (1 total connections ready) 2023-08-12 19:52:36 indexer-worker(recipient(a)example2.com)<lrVsHUQb2GR1dgAA+IOfAw:xKZLMEQb2GR3dgAA+IOfAw>: Debug: http-client: queue http://192.0.2.20:9998: Connection to peer 192.0.2.20:9998 claimed request [Req1: PUT http://192.0.2.20:9998/tika/] 2023-08-12 19:52:36 indexer-worker(recipient(a)example2.com)<lrVsHUQb2GR1dgAA+IOfAw:xKZLMEQb2GR3dgAA+IOfAw>: Debug: http-client: conn 192.0.2.20:9998 [1]: Claimed request [Req1: PUT http://192.0.2.20:9998/tika/] 2023-08-12 19:52:36 indexer-worker(recipient(a)example2.com)<lrVsHUQb2GR1dgAA+IOfAw:xKZLMEQb2GR3dgAA+IOfAw>: Debug: http-client: request [Req1: PUT http://192.0.2.20/tika/] Sent header 2023-08-12 19:52:36 indexer-worker(recipient(a)example2.com)<lrVsHUQb2GR1dgAA+IOfAw:xKZLMEQb2GR3dgAA+IOfAw>: Debug: http-client: peer 192.0.2.20:9998: No more requests to service for this peer (1 connections exist, 0 pending) 2023-08-12 19:52:36 indexer-worker(recipient(a)example2.com)<lrVsHUQb2GR1dgAA+IOfAw:xKZLMEQb2GR3dgAA+IOfAw>: Debug: http-client: conn 192.0.2.20:9998 [1]: Got 422 response for request [Req1: PUT http://192.0.2.20:9998/tika/] Unprocessable Entity (took 3 ms + 106 ms in queue) 2023-08-12 19:52:36 indexer-worker(recipient(a)example2.com)<lrVsHUQb2GR1dgAA+IOfAw:xKZLMEQb2GR3dgAA+IOfAw>: Debug: http-client: request [Req1: PUT http://192.0.2.20/tika/] Finished 2023-08-12 19:52:36 indexer-worker(recipient(a)example2.com)<lrVsHUQb2GR1dgAA+IOfAw:xKZLMEQb2GR3dgAA+IOfAw>: Debug: http-client: queue http://192.0.2.20:9998: Dropping request [Req1: PUT http://192.0.2.20:9998/tika/] 2023-08-12 19:52:36 indexer-worker(recipient(a)example2.com)<lrVsHUQb2GR1dgAA+IOfAw:xKZLMEQb2GR3dgAA+IOfAw>: Debug: http-client: host 192.0.2.20: Host is idle (timeout = 100 msecs) 2023-08-12 19:52:36 indexer-worker(recipient(a)example2.com)<lrVsHUQb2GR1dgAA+IOfAw:xKZLMEQb2GR3dgAA+IOfAw>: Debug: http-client: request [Req1: PUT http://192.0.2.20/tika/] Free (requests left=1) 2023-08-12 19:52:36 indexer-worker(recipient(a)example2.com)<lrVsHUQb2GR1dgAA+IOfAw:xKZLMEQb2GR3dgAA+IOfAw>: Debug: http-client: peer 192.0.2.20:9998: No requests to service for this peer (1 connections exist, 0 pending) 2023-08-12 19:52:36 indexer-worker(recipient(a)example2.com)<lrVsHUQb2GR1dgAA+IOfAw:xKZLMEQb2GR3dgAA+IOfAw>: Debug: http-client: conn 192.0.2.20:9998 [1]: No more requests queued; going idle (timeout = 100 msecs) 2023-08-12 19:52:37 indexer-worker(recipient(a)example2.com)<lrVsHUQb2GR1dgAA+IOfAw:xKZLMEQb2GR3dgAA+IOfAw>: Debug: http-client: host 192.0.2.20: Idle host timed out 2023-08-12 19:52:37 indexer-worker(recipient(a)example2.com)<lrVsHUQb2GR1dgAA+IOfAw:xKZLMEQb2GR3dgAA+IOfAw>: Debug: http-client: host 192.0.2.20: Host destroy 2023-08-12 19:52:37 indexer-worker(recipient(a)example2.com)<lrVsHUQb2GR1dgAA+IOfAw:xKZLMEQb2GR3dgAA+IOfAw>: Debug: http-client: host 192.0.2.20: Host session destroy 2023-08-12 19:52:37 indexer-worker(recipient(a)example2.com)<lrVsHUQb2GR1dgAA+IOfAw:xKZLMEQb2GR3dgAA+IOfAw>: Debug: http-client: queue http://192.0.2.20:9998: Destroy 2023-08-12 19:52:37 indexer-worker(recipient(a)example2.com)<lrVsHUQb2GR1dgAA+IOfAw:xKZLMEQb2GR3dgAA+IOfAw>: Debug: http-client: peer 192.0.2.20:9998: Unlinked queue http://192.0.2.20:9998 (0 queues linked) 2023-08-12 19:52:37 indexer-worker(recipient(a)example2.com)<lrVsHUQb2GR1dgAA+IOfAw:xKZLMEQb2GR3dgAA+IOfAw>: Debug: http-client: conn 192.0.2.20:9998 [1]: Idle connection timed out 2023-08-12 19:52:37 indexer-worker(recipient(a)example2.com)<lrVsHUQb2GR1dgAA+IOfAw:xKZLMEQb2GR3dgAA+IOfAw>: Debug: http-client: conn 192.0.2.20:9998 [1]: Connection close 2023-08-12 19:52:37 indexer-worker(recipient(a)example2.com)<lrVsHUQb2GR1dgAA+IOfAw:xKZLMEQb2GR3dgAA+IOfAw>: Debug: http-client: conn 192.0.2.20:9998 [1]: Connection disconnect 2023-08-12 19:52:37 indexer-worker(recipient(a)example2.com)<lrVsHUQb2GR1dgAA+IOfAw:xKZLMEQb2GR3dgAA+IOfAw>: Debug: http-client: conn 192.0.2.20:9998 [1]: Disconnected: Connection closed (fd=28) 2023-08-12 19:52:37 indexer-worker(recipient(a)example2.com)<lrVsHUQb2GR1dgAA+IOfAw:xKZLMEQb2GR3dgAA+IOfAw>: Debug: http-client: conn 192.0.2.20:9998 [1]: Detached peer 2023-08-12 19:52:37 indexer-worker(recipient(a)example2.com)<lrVsHUQb2GR1dgAA+IOfAw:xKZLMEQb2GR3dgAA+IOfAw>: Debug: http-client: peer 192.0.2.20:9998: Lost a connection (0 queues linked, 0 connections left, 0 connections pending, 0 requests pending, 0 requests urgent) 2023-08-12 19:52:37 indexer-worker(recipient(a)example2.com)<lrVsHUQb2GR1dgAA+IOfAw:xKZLMEQb2GR3dgAA+IOfAw>: Debug: http-client: conn 192.0.2.20:9998 [1]: Connection destroy 2023-08-12 19:52:37 indexer-worker(recipient(a)example2.com)<lrVsHUQb2GR1dgAA+IOfAw:xKZLMEQb2GR3dgAA+IOfAw>: Debug: http-client: peer 192.0.2.20:9998: Dropping peer now 2023-08-12 19:52:37 indexer-worker(recipient(a)example2.com)<lrVsHUQb2GR1dgAA+IOfAw:xKZLMEQb2GR3dgAA+IOfAw>: Debug: http-client: peer 192.0.2.20:9998: Peer close unclear 2 me whether this is a bug in dovecot or in tika, or a matter of (mis)config. ??

1 0

sso / sharing authenticated sessions how does it work
by Marc 12 Aug '23

12 Aug '23

I am totally not experienced with setting up sso etc. I was wondering if/how it is possible to share an authenticated session between dovecot and the mail client with the webmail so a user does not need to login again.

1 0

Dovecot submission panics on SMTP RCPT error
by IB Development Team 10 Aug '23

10 Aug '23

Hi, If SMTP server rejects RCPT with message aaa bbbbbbbbbb ccccccc dd eeeeeeeeeeee ffffffffffff gggggggggg hh iiiiii jj kk llll mmmmmmmmmm nnn o ppppppppppppppp rrrrrr ssssss t uuuu w xxxxxxx yyyyyy zzzzzzzz aa bbbbbbbbbbb cccccccc dd eeeeee fff gggggg hhhhhhh iiiiiiii jj kkkkkk ll mm nnnn ooooo ppppppp qqqq r ssss tttttt uuuuuuuuuuuuu www xxx yyyyyyy zzzzz aaaaa bbbbbbbbb ccc ddddddd when submitting message via dovecot submisstion server, dovecot panics: 2023-08-10 17:10:04 myhost exim[...] rejected RCPT <[...]>: aa bbbbbbbbbb ccccccc dd eeeeeeeeeeee ffffffffffff gggggggggg hh iiiiii jj kk llll mmmmmmmmmm nnn o ppppppppppppppp rrrrrr ssssss t uuuu w xxxxxxx yyyyyy zzzzzzzz aa bbbbbbbbbbb cccccccc dd eeeeee fff gggggg hhhhhhh iiiiiiii jj kkkkkk ll mm nnnn ooooo ppppppp qqqq r ssss tttttt uuuuuuuuuuuuu www xxx yyyyyyy zzzzz aaaaa bbbbbbbbb ccc ddddddd 2023-08-10 17:10:04 myhost dovecot: submission(test)<7274><bAOu/ZICuuDAqHoB>: Panic: file smtp-server-reply.c: line 625 (smtp_server_reply_send_real): assertion failed: (text[0] == '-') 2023-08-10 17:10:04 myhost dovecot: submission(test)<7274><bAOu/ZICuuDAqHoB>: Error: Raw backtrace: /usr/lib/dovecot/libdovecot.so.0(backtrace_append+0x42) [0x7f64c8e484e2] -> /usr/lib/dovecot/libdovecot.so.0(backtrace_get+0x1e) [0x7f64c8e485fe] -> /usr/lib/dovecot/libdovecot.so.0(+0xfc49b) [0x7f64c8e5449b] -> /usr/lib/dovecot/libdovecot.so.0(+0xfc531) [0x7f64c8e54531] -> /usr/lib/dovecot/libdovecot.so.0(+0x53aee) [0x7f64c8dabaee] -> /usr/lib/dovecot/libdovecot.so.0(+0x4751c) [0x7f64c8d9f51c] -> /usr/lib/dovecot/libdovecot.so.0(+0x7b605) [0x7f64c8dd3605] -> /usr/lib/dovecot/libdovecot.so.0(+0x122171) [0x7f64c8e7a171] -> /usr/lib/dovecot/libdovecot.so.0(io_loop_call_io+0x69) [0x7f64c8e69f59] -> /usr/lib/dovecot/libdovecot.so.0(io_loop_handler_run_internal+0x132) [0x7f64c8e6b592] -> /usr/lib/dovecot/libdovecot.so.0(io_loop_handler_run+0x50) [0x7f64c8e6a000] -> /usr/lib/dovecot/libdovecot.so.0(io_loop_run+0x40) [0x7f64c8e6a1c0] -> /usr/lib/dovecot/libdovecot.so.0(master_service_run+0x13) [0x7f64c8de04e3] -> dovecot/submission(main+0x4df) [0x562f3ac7c11f] -> /lib/x86_64-linux-gnu/libc.so.6(__libc_start_main+0xea) [0x7f64c8ba4d0a] -> dovecot/submission(_start+0x2a) [0x562f3ac7c1aa] Error message is configured in exim4.conf with begin routers mytestrouter: [...] cannot_route_message = aa bbbbbbbbbb ccccccc dd eeeeeeeeeeee ffffffffffff gggggggggg hh iiiiii jj kk llll mmmmmmmmmm nnn o ppppppppppppppp rrrrrr ssssss t uuuu w xxxxxxx yyyyyy zzzzzzzz aa bbbbbbbbbbb cccccccc dd eeeeee fff gggggg hhhhhhh iiiiiiii jj kkkkkk ll mm nnnn ooooo ppppppp qqqq r ssss tttttt uuuuuuuuuuuuu www xxx yyyyyyy zzzzz aaaaa bbbbbbbbb ccc ddddddd Dovecot installed from up-to-date Debian 11 package: # dpkg -s dovecot-core | grep Version Version: 1:2.3.13+dfsg1-2+deb11u1 -- Regards, Paweł Bogusławski IB Development Team E: dev(a)ib.pl

2 2

Dovecot and Thunderbird 15
by Elise 10 Aug '23

10 Aug '23

Hi, I recently had some issues with Thunderbird 15 when removing e-mail. With my other mailclient Outlook I could without any issue. As I don't grand POP3 mail pickup, I disabled that in dovecot.conf #service pop3-login { # inet_listener pop3 { # address = 10.10.10.52 # } # inet_listener pop3s { # address = 10.10.10.52 # } #} Enabling the above and restarting Dovecot solved the issue. Is it TB related or do I overlook a config parameter? E.

2 3

Question about custom flags
by d.meister-braeuer＠heinlein-support.de 09 Aug '23

09 Aug '23

Hello all, RFC3501 describes among other things that custom flags can be set for mails. These can be allowed or forbidden in the server: "Servers MAY permit the client to define new keywords in the mailbox". When I am on our server, it also looks like dovecot basically allows this: a select INBOX FLAGS (\Answered \Flagged \Deleted \Seen \Draft $Forwarded Old $ITipAnalyzed $ITipProcessed Forwarded NonJunk $cl_1 $cl_2 $cl_3) OK [PERMANENTFLAGS (\Answered \Flagged \Deleted \Seen \Draft $Forwarded Old $ITipAnalyzed $ITipProcessed Forwarded NonJunk $cl_1 $cl_2 $cl_3 \*)] Flags permitted. The only option that goes in this direction is this one: mail_max_keyword_length But basically describes something else as well, if I see it correctly. Is there a way to prevent dovecot from giving custom flags, or what is the name of the parameter where you can set this? Best

1 0

Outlook not showing all email in inbox at random
by David Koski 09 Aug '23

09 Aug '23

I manage IT for a small office with about 10 workstations. Dovecot has been installed for years and is now at 2.3.4.1-5 (Debian). I just discovered that the user cannot see many emails in the inbox. I was alerted when email was not appearing to be coming in for many hours. Other users observed the same thing. On investigation, I noticed many inbox emails missing in the Outlook GUI from times past that were on the server. It appears to be a broken client (Outlook 2019) to me but troubleshooting has yielded no solid leads. The profile and OST files have been re-created many times with no change in outcome. Each time, the inbox does not synchronize about 40 most recent emails but does for the last one for the day before and many before that. It may well be an Outlook issue so I'm looking for information to work around an Outlook bug if necessary. Thunderbird works perfectly. Also, interestingly, I can copy email from Thunderbird (or move emails on the server) to a temporary directory form the inbox, then move them back and they will appear if I don't move too many at a time. Regards, David Koski dkoski(a)sutinen.com

4 7

Application to automate mail-crypt plugin with user keys
by Benedikt Zumtobel 08 Aug '23

08 Aug '23

Hi everyone, I run a very small (about 10 users) mailserver setup with the mail-crypt plugin activated and wanted to transition from a global key setup to user keys. Since I couldn't find a satisfying solution to reencrypt mailboxes when users change their password I started writing a script that ended up being a small webservice giving users a simple selfservice portal to change their password. I consider it pretty much done by now and it's public on github. Maybe it's useful for somebody else. However its use case is very narrow since I initially wrote this just for myself. It does only support a Postgres user store for instance. The main reason, however, for this post is me wondering if anybody would bother to give me some feedback. Especially for the following aspects: I execute doveadm from within my application. The advantage is that I can keep the code very light (~650 lines of code) while at the same time don't have to care about the crypto stuff which I wouldn't dare trying anyways. The disadvantage of this approach is that I had to write a doveadm wrapper that needs the setuid bit to execute doveadm mailbox commands. I consider this a bit hacky but a better solution didn't come to my mind. Another aspect is the password that is being used to encrypt the private key. When creating a new user in the database I generate a unique salt. This salt is prefixed to the user's clear text password and the resulting string is run trough the sha3-512 hash function. The output is the mail_crypt_private_password. You find the project here: https://github.com/nonce9/pwch Criticism is welcome. Benedikt

4 3

Dovecot bug submit - Dovecot stats
by Brent Clark 07 Aug '23

07 Aug '23

Good day Guys Just a brief background, Im looking to enable and run doveadm stats, as per https://doc.dovecot.org/configuration_manual/stats/ When I run the command: doveadm stats add --description "IMAP SELECT commands" --exporter log-exporter --exporter-include "name timestamps" --fields "bytes_in bytes_out" --group-by "cmd_name tagged_reply_state" imap_cmd_select "event=imap_command_finished AND name=SELECT" I get: ==> /var/log/mail.info <== Aug 3 05:52:36 bullseye dovecot: stats: Error: Raw backtrace: /usr/lib/dovecot/libdovecot.so.0(backtrace_append+0x42) [0x7f08c7097582] -> /usr/lib/dovecot/libdovecot.so.0(backtrace_get+0x1e) [0x7f08c709769e] -> /usr/lib/dovecot/libdovecot.so.0(+0x1022fb) [0x7f08c70a42fb] -> /usr/lib/dovecot/libdovecot.so.0(+0x102391) [0x7f08c70a4391] -> /usr/lib/dovecot/libdovecot.so.0(+0x55589) [0x7f08c6ff7589] -> dovecot/stats(+0x5aa5) [0x561765217aa5] -> dovecot/stats(stats_metrics_add_dynamic+0x11f) [0x56176521a80f] -> dovecot/stats(+0x6724) [0x561765218724] -> /usr/lib/dovecot/libdovecot.so.0(connection_input_default+0x155) [0x7f08c709bd05] -> /usr/lib/dovecot/libdovecot.so.0(io_loop_call_io+0x69) [0x7f08c70ba529] -> /usr/lib/dovecot/libdovecot.so.0(io_loop_handler_run_internal+0x132) [0x7f08c70bbc12] -> /usr/lib/dovecot/libdovecot.so.0(io_loop_handler_run+0x50) [0x7f08c70ba5d0] -> /usr/lib/dovecot/libdovecot.so.0(io_loop_run+0x40) [0x7f08c70ba790] -> /usr/lib/dovecot/libdovecot.so.0(master_service_run+0x13) [0x7f08c702d353] -> dovecot/stats(main+0x128) [0x561765217e38] -> /lib/x86_64-linux-gnu/libc.so.6(__libc_start_main+0xea) [0x7f08c6ca8d0a] -> dovecot/stats(_start+0x2a) [0x561765217eba] ==> /var/log/mail.warn <== Aug 3 06:23:51 bullseye dovecot: stats: Fatal: master: service(stats): child 38121 killed with signal 6 (core dumped) I installed and run systemd-coredump, dovecot-sysreport Please will you take a look at the various attached files (coredumps etc) Many thanks. Kind Regards Brent Clark

2 1

doveadm fts lookup: Is "search query" documented anywhere?
by Graham Leggett 07 Aug '23

07 Aug '23

Hi all, According to the —help option for doveadm fts, there is a “lookup” option as follows: [root@aurora ~]# doveadm fts --help usage: doveadm [-Dv] [-f <formatter>] fts <command> [<args>] expand [-u <user>|-A] [-S <socket_path>] <search query> lookup [-u <user>|-A] [-S <socket_path>] <search query> optimize [-u <user>|-A] [-S <socket_path>] [<namespace>] rescan [-u <user>|-A] [-S <socket_path>] [<namespace>] tokenize [-u <user>|-A] [-S <socket_path>] <text> The option does not appear to be documented anywhere (eg https://doc.dovecot.org/3.0/man/doveadm-fts.1/) and “search query” doesn’t appear to be defined. Guessing that it might be just plain text, I tried searching for a known word, but this failed as follows: [root@aurora ~]# doveadm fts lookup -u test(a)example.com sweet Fatal: Unknown argument SWEET Anyone know? Regards, Graham —

2 2

Trash deleted date?
by joe a 07 Aug '23

07 Aug '23

Using Thunderbird client. Cannot sort "Trash" Folder by time/date deleted. I can display both "Received" and "Date" columns, but they show identical data. Does dovecot create a "deleted" time stamp? dovecote 2.3.20 (80a5ac675d) TB 102.14.0 64 bit

1 0

passwdb deny.ip
by mauric＠gmx.ch 06 Aug '23

06 Aug '23

Hello i understod in the last discussion thread <Forcing imap authentication failure for certain IP addresses> that also IP can be filter, ok the ip are available in deny.ip. Please why this are not blocked? # dovecot version 2.3.4.1 (f79e8e7e4) passdb { args = /etc/dovecot/deny.ip args = /etc/dovecot/dovecot-sql.conf.ext driver = sql } cat mail.log | grep 'sql(name,' Aug 06 01:29:11 Dovecot/auth-worker(7927): Info: sql(Name,A.B.232.146): unknown user # cat deny.ip | grep A.B.232.146 A.B.232.146 meny thanks

3 3

mail-crypt long-term support? How to backup?
by eaerhaerhaehae aehraerhaeha 05 Aug '23

05 Aug '23

3 6

Dovecot shared folders - examples of the "doveadm acl" command?
by Graham Leggett 05 Aug '23

05 Aug '23

Hi all, The old wiki has been taken down, and all the links I can find through google are now broken. Does anyone have a concrete example of “doveadm acl” to grant someone access to a shared folder? Regards, Graham —

2 2

fail2ban / ldap login failure
by micha＠micha.waw.pl 05 Aug '23

05 Aug '23

[Debian Bookworm + Dovecot 2] I have user database in ldap (samba). I want to use fail2ban to restrict unsuccessful login attempts, but... I cannot see "Authentication failure" message in ANY log. (/var/log/mail.log shows successful logins as well as disconnects.) How should I proceed?

2 1

Pigeonhole redirect is adding a message-id header when it already exists
by Sébastien Riccio 04 Aug '23

04 Aug '23

Hello, We are using sieve filter to redirect incoming mails to an external mailbox (gmail) an we are seeing some forwarded e-mails being rejected by gmail because of duplicate headers. I think was able to identify the probable cause of the duplicate headers: It seems that when the original message's "Message-ID" is not compliant, pigeonhole acts like if the header is not existing and adds it's own Message-ID. This result in having two "Message-ID" headers being submitted to the destination mail server. Original Message-ID: Message-ID: 1883biz_pay_after_purchase:0:0_572392900$ae7ed6e4d53b424c84aaf83b30c507e7 Pigeon hole adds his own Message-ID: Message-ID: <dovecot-sieve-1664386049-21512-0@510faa1ff2d9> Gmail answer: 550-5.7.1 [94.103.100.17] Our system has detected that this message is not RFC 550-5.7.1 5322 compliant: duplicate headers. To reduce the amount of spam sent 550-5.7.1 to Gmail, this message has been blocked. Please review 550 5.7.1 RFC 5322 specifications for more information. While I understand the original "Message-ID" seems to be all but compliant with RFCs, shouldn't a "Message-ID" be added only when "Message-ID" is really missing ? When redirecting a message, If the original "Message-ID" exists but is bogus shouldn't it still be forwarded untouched ? Also, maybe if pigeonhole is adding it's own "Message-ID", shouldn't it remove any previous "Message-ID" to avoid generating duplicate headers ? (but maybe it could break some DKIM stuff?) Any ideas how to workaround this issue ? Thanks a lot for your feedbacks! Sébastien RICCIO SYSTEM ADMINISTRATOR P +41 840 888 888 F +41 840 888 000 M sriccio(a)swisscenter.com<mailto:sriccio@swisscenter.com>

9 17

Using / in folder names
by Scott 04 Aug '23

04 Aug '23

Is this possible at all ? I am trying to import a PST file and it has a slash in the folder name. Dovecot errors out with : APPEND "Caixa de Entrada_VIDA/S1" (\Seen) NO [CANNOT] Invalid mailbox name: Name must not have '/' characters My namespace separator is the dot and I configured the listescape plugin to escape / but it still doesn't work. The listescape documentation says: The / character is disallowed on POSIX systems. This plugin allows you to use all of these characters, as long as the virtual separator (i.e. what is set by the separator setting and used as such by the IMAP protocol) is changed to something else, which means that the plugin does not make it possible to use the virtual separator in folder names. So it seems that as long as I use the dot, it should work ? Except it doesn't... How can I do this import ? Thank you!

3 9

RE: Forcing imap authentication failure for certain IP addresses
by aki.tuomi 02 Aug '23

02 Aug '23

One way is to use https://doc.dovecot.org/configuration_manual/authentication/auth_policy/or you can use passdb { driver = passwd-file deny = yes args = username_formar=%{rip} /etc/dovecot/deny.ip}or you can use https://doc.dovecot.org/configuration_manual/authentication/lua_based_authe… write this in Lua.Aki -------- Original message --------From: Hippo Man <hippoman(a)gmail.com> Date: 8/1/23 18:14 (GMT+02:00) To: dovecot(a)dovecot.org Subject: Forcing imap authentication failure for certain IP addresses I'm running dovecot 2.3.18 under Debian 11.I want to do something that's a bit unusual: when IMAP connections are attemptedfrom a few specific IP addresses, I want to force an IMAP authentication failurefrom those connections, no matter what user ID and password are specified.I know that I can use iptables to completely block imap access from those IPaddresses to the IMAP ports. However, in these specific cases, I'd prefer thatthe connection goes through to dovecot, but for dovecot then to always generateauthentication failures for those specific connections ... even if a validuser ID and password happen to be specified.Is there a way to do this in dovecot?Thank you very much in advance.-- hippoman(a)gmail.com Take a hippopotamus to lunch today. .---------, 0__0 / ( oo'---, / oo\ ,\ | | \ ,=__/ \ / / /------| /| |__|-' |__|'

3 5

sieve passing body as arguments to executed script
by Jonathan Davis 02 Aug '23

02 Aug '23

I ran into an issue when trying to wildcard match the email body where the variable was empty, which lead me to extracttext and forverypart, however I am running into an odd error. When I deliver an email with the body of 'this is the body text of email' it dies with the following error: sogo: line 236: error: specified :args item `this is the body text of email??' is invalid The sieve in question: if header :matches "Subject" "*" { set "emailsubject" "${1}"; } if header :matches "From" "*" { set "emailfrom" "${1}"; } foreverypart { if header :mime :type :is "Content-Type" "text" { extracttext :first 80 "emailbody"; break; } } execute "script.php" ["${emailfrom}", "${emailsubject}", "${emailbody}"]; I tried downloading the log to see if ?? was a character not rendering correctly in console, but local text editors show the same. I'm not sure where it is coming from or what it is. I tried :quotewildcard with set :quotewildcard "quotedbody" ${emailbody}"; And passed "${quotedbody}" as an argument, however the same error was appearing in the logs. If I'm approaching this problem incorrectly, the end result is I want to pass the entire contents of the email to the script. - Jonathan

1 0

Postlogin script ACL_GROUPS from LDAP
by Andrzej Milewski 01 Aug '23

01 Aug '23

Hello, I am testing the Dovecot mail server with the iRedMail configuration. My backend is based on LDAP. I would like to set up the "Public" folders in such a way as to grant permissions to specific groups of users. To achieve this, I created the following entry in the configuration: acl = vfile:/etc/dovecot/dovecot-acl-global:cache_secs=300 For individual users, the global permissions work correctly, and I achieve what I want. However, I am unsure how to grant permissions for a group. Specifically, I know that I should include permissions for groups in this file, for example: Public/ anyone l Public/IT_Suwalki group=grupa1 lrwstipek Public/IT_Suwalki/* group=grupa1 lrwstipekxa But I don't know how to associate users with groups. From what I managed to figure out, the user should have the "ACL_GROUPS=grupa1,grupa2" variable, and it should be passed by the postlogin script. But how can I do that? Do you have any working example of such a script? Which LDAP attributes should this script utilize? In my LDAP, there is an attribute called "memberOfGroup"; can I use it? Thank you for all the suggestions. -- Andrzej Milewski andrzej.milewski(a)gmail.com tel. 0603957324

1 0

Imaptest sigfault error
by DeJa Wu 31 Jul '23

31 Jul '23

I Tried to run the test with imaptest and got a segfault error. Debug: Reading symbols from imaptest...done. (gdb) run user="puser%d(a)am.local" users=0-100000 pass=Us123456 host=ha-rr.am.local ssl=any-cert clients=100000 port=993 - secs=300 no_pipelining Starting program: /usr/bin/imaptest user="puser%d(a)am.local" users=0-100000 pass=Us123456 host=ha-rr.am.local ssl=any-cert clients=100000 port=993 - secs=300 no_pipelining [Thread debugging using libthread_db enabled] Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1". Logi Sele Logo 100% 100% 100% 179 163 154 551/637 [0%] 245 247 250 1153/1372 [1%] 238 240 238 1725/2086 [2%] 213 215 219 2250/2725 [2%] 213 209 203 2760/3364 (263 stalled >3s) [3%] 220 226 228 3308/4024 (854 stalled >3s) [4%] 247 245 247 3870/4765 (1338 stalled >3s) [4%] 239 237 239 4414/5482 (1800 stalled >3s) [5%] 259 257 259 4998/6259 (2299 stalled >3s) [6%] 270 274 271 5599/7069 (2809 stalled >3s) [7%] 3843 46 26 ms/cmd avg Logi Sele Logo 100% 100% 100% 243 242 237 6122/7798 (3369 stalled >3s) [7%] 242 239 237 6697/8524 (3937 stalled >3s) [8%] 241 241 248 7251/9247 (4542 stalled >3s) [9%] 229 231 234 7776/9934 (5143 stalled >3s) [9%] 230 228 225 8332/10624 (5800 stalled >3s) [10%] Program received signal SIGSEGV, Segmentation fault. 0x00007ffff7f1745f in io_loop_handler_run_internal () from /usr/lib/dovecot/libdovecot.so.0 How can I fix this?

2 1

Notification "API" for external replication
by Heiko Schlittermann 31 Jul '23

31 Jul '23

Hi Aki and all the Dovecot team, thank you for your work on Dovecot. As the "built-in" replication is going to cease (I do not want to discuss the reasoning or any judgement here): Can you (the Dovecot developers) ensure that a kind of "notification socket"¹ will be there, even if you do not provide a the replicator feature? And - but that's already a feature request - could you use this (or an other socket) for notifications on sieve script changes? I can imagine using this socket as an "official" interface to external software. Actually that would implicate that the notification messages are documented and stable, but I'm sure, this would be possible (if not done already). ¹) That is how I understand the current mechanism of the replication: the replicator gets a notification via the socket and starts replicating the mailbox. Best regards from Dresden/Germany Viele Grüße aus Dresden Heiko Schlittermann -- SCHLITTERMANN.de ---------------------------- internet & unix support - Heiko Schlittermann, Dipl.-Ing. (TU) - {fon,fax}: +49.351.802998{1,3} - gnupg encrypted messages are welcome --------------- key ID: F69376CE -

2 1

Accessing SSL parameters via dovecot variables
by Graham Leggett 26 Jul '23

26 Jul '23

Hi all, Dovecot supports variables, which can be used in filters. Does the SSL code expose variables linked to the client certificate? The answer today appears to be no, and if that’s true I plan to patch it, but just need to confirm I am not missing something. Regards, Graham —

2 2

Filtering by SASL auth mechanism
by Graham Leggett 26 Jul '23

26 Jul '23

Hi all, I want dovecot to behave differently depending on what SASL mechanism was used. Most specifically, if EXTERNAL, I want auth_ssl_username_from_cert to be yes, but no otherwise. There is a filtering mechanism that supports protocol, remote, etc. https://doc.dovecot.org/configuration_manual/config_file/ Would it make sense to add a SASL mechanism filter like this: mechanism external { # … } Regards, Graha —

1 0

SASL External and LDAP - Login attempt with empty password
by Graham Leggett 26 Jul '23

26 Jul '23

Hi all, I am trying to configure dovecot to accept SASL EXTERNAL authentication with a client certificate and no password. I have tried the following configuration: passdb { driver = ldap # Path for LDAP configuration file, see example-config/dovecot-ldap.conf.ext args = /etc/dovecot/dovecot-ldap-external.conf.ext mechanisms = external default_fields = noauthenticate=y } In the logs I see dovecot correctly negotiate SASL EXTERNAL, but eventually we reach this line and we fail: https://github.com/dovecot/core/blob/34a18f5a79bf7eca58e55aff3e1fe69468292d… Which is in turn reached by following this code: https://github.com/dovecot/core/blob/34a18f5a79bf7eca58e55aff3e1fe69468292d… In theory, if I understand this correctly, what is missing is a field to say “don’t try check any password”, which field is this supposed to be? “nopassword”? “noauthenticate”? I am happy to patch this, but need some guidance as what the correct approach is. Regards, Graham —

1 0

Quota possibly overcomplicating, need sanity check?
by David Mehler 25 Jul '23

25 Jul '23

Hello, New setup and trying to get quotas going. It's a Dovecot/Postfix/Mariadb virtual user setup. In my db I have a varchar field called quota with a default value of 128. Here's what I have in dovecot configs for quota: # Plugins mail_plugins = acl mail_crypt quota service stats { fifo_listener stats-mail { user = vmail mode = 0644 } inet_listener { address = 127.0.0.1 port = 24242 } } # quota status service quota-status { executable = quota-status -p postfix unix_listener /var/spool/postfix/private/dovecot-quota { user = postfix group = postfix mode = 0660 } client_limit = 1 } # Quota warnings service quota-warning { executable = script /usr/local/bin/quota-warning.sh user = vmail unix_listener quota-warning { group = vmail mode = 0660 user = vmail } } plugin { quota = count:User quota quota2 = maildir:Shared quota:ns=public/ quota_max_mail_size = 100M # Required for 'count' quota driver quota_vsizes = yes quota_rule2 = Trash:storage=+10%% quota_rule = *:storage=1G quota_rule2 = Trash:storage=100M quota_rule3 = SPAM:ignore quota_warning = storage=100%% quota-warning +100 %u quota_warning2 = storage=95%% quota-warning +95 %u quota_warning3 = storage=80%% quota-warning +80 %u quota_warning4 = -storage=100%% quota-warning -100 %u # user is no longer over quota quota_exceeded_message = User %u has exhausted allowed storage space. quota_grace = 10%% # 10% is the default quota_status_success = DUNNO quota_status_nouser = DUNNO quota_status_overquota = "552 5.2.2 Mailbox is full" ## Stats ### how often to session statistics (must be set) stats_refresh = 30 secs ### track per-IMAP command statistics (optional) stats_track_cmds = yes } The protocol imap has the imap_quota plugin and protocol lmtp has the quota plugin. I've also got lmtp_rcpt_check_quota = yes mailbox_list_index = yes In my dovecot-sql.conf file my user query looks like this: user_query = SELECT concat('*:storage=', quota, 'M') AS quota_rule FROM accounts WHERE username = '%Ln' AND domain = '%Ld' AND sendonly = false; Postfix checks: check_policy_service unix:private/dovecot-quota Am I overcomplicating? Thanks. Dave.

1 0

mail_crypt on existing mailstore
by David Mehler 25 Jul '23

25 Jul '23

Hello, I've got a pre-existing mailstore, it's a Postfix/Dovecot/Mariadb virtual-user setup, with users and mailboxes. I'd now like to get mail_crypt going. Can I do this with this existing store or if not how would I set this up? Thanks. Dave.

1 0

subscription, dots and subscribe to shared folder.
by Julien Nadal 24 Jul '23

24 Jul '23

Hello; We were able to set up shared folders in a cluster (using dovecot as proxy on dedicated front-end servers, without using director) by following https://doc.dovecot.org/configuration_manual/shared_mailboxes/cluster_setup/. Here is our related conf on imap farms (dovecot v2.3.16 on Almalinux): namespaces: mail_location = maildir:~/Maildir namespace default { inbox = yes location = prefix = separator = / } namespace shared { list = children location = imapc:~/shared/%%u:INDEXPVT=~/shared-pvt/%%u prefix = shared/%%u/ separator = / subscriptions = no type = shared } imapc settings: imapc_features = fetch-bodystructure fetch-headers rfc822.size search modseq acl delay-login imapc_host = XXXXXX imapc_master_user = %{user} imapc_password = XXXXXX imapc_port = XXXXXX passdb { args = password=#hidden_use-P_to_show# userdb_namespace/shared/disabled=yes userdb_acl_user=%{auth_user} allow_nets=XXXXX/XX driver = static master = yes } dict { acl-mysql = mysql:/etc/dovecot/conf.d/dovecot-dict-sql.conf.ext } This way, a folder is created under ~/ : shared & shared-pvt : When user A shares a folder with B, B will find ~/shared/userA/sharedfolder I should mention that the user authentication (backend: mysql) uses the full email address as we are in a multi-tenant context. So the folder looks like ~/shared/usera(a)domain.tld/folder Since then, everything works perfectly, we can share and see the shared folders in the webmail (SOGo). Unfortunately, accessing these folders through an imap client (tested on Thunderbird and MSOutlook) is impossible because the subscription fails (the folder is listed, but the subscription doesn't seem to do anything). I could not find any relevant logs but I was able to confirm on the command line: I am able to view folder with LIST, subscribe with an "OK" output, but the folder is not listed with LSUB. So I could see that the subscribtion file in maildir shows incorrect entries: V 2 Sent Trash Drafts Junk shared/testuser1@sub domain tld/INBOX/folder The dots in the folder names are replaced by tabs. I was able to recover things by editing the file as follows: Sent Trash Drafts Junk shared/testuser1(a)sub.domain.tld/INBOX/folder This means that Maildir++ and V2 subscription can't handle dots in folders. I found a previous discussion: https://dovecot.org/pipermail/dovecot/2021-January/121233.html But the final advice can't be applied on our side: - changing LAYOUT to FS is not possible for us - we have already migrated the dot separator to slash - changing the layout only for shared namespaces does not solve the problem and totally breaks the access to shared folders. Thanks a lot for your advice Best regards Julien

3 4

Outlook and IMAP Flags
by Laura Smith 22 Jul '23

22 Jul '23

Hi I've tried searching the internet, but the only thing I can find is a post on a MIcrosoft forum where a Microsoft reps claims flags are not supported on IMAP (I thought it was an RFC3501 feature ?). Anyway, I have a user who has Outlook/Windows on desktop and iOS (iPhone/iPad) for remote. On the iOS devices, the user can happily set flags against messages with zero issues. And indeed, when they set these flags, they are shown in Outlook. However if they attempt to set the flag in Outlook, nothing happens. Outlook continues showing the message as if it was unflagged. Any ideas ? Laura

2 1

Exclude folders from fts xapian on a per-user basis
by Adam Kessel 21 Jul '23

21 Jul '23

Is there any way for a user to specify folders they want excluded from fts xapian indexing? Or can this only be done globally in /etc?

1 0

Dovecot pigeon/sieve and SELinux
by Graham Leggett 21 Jul '23

21 Jul '23

Hi all, I am in the process of migrating a dovecot installation from RHEL8 to RHEL9, this time round I am trying to get everything to work in selinux enforcing mode. First error I am stuck on is as follows: Error: sieve: file storage: Failed to stat sieve storage path: stat(/var/lib/dovecot/sieve/vacation.sieve) failed: Permission denied (euid=377(vmail) egid=376(vmail) missing +x perm: /var/lib/dovecot, we're not in group 97(dovecot), dir owned by 97:97 mode=0750) It appears that the vmail user cannot access /var/lib/dovecot, because under RHEL9 the permissions are hidden to the world. [root@seawitch dovecot]# ls -al /var/lib/dovecot total 12 drwxr-x---. 3 dovecot dovecot 36 Jul 21 17:51 . Am I correct in interpreting the error message as meaning that /var/lib/dovecot/sieve is not a correct directory for global sieve scripts, and they need to go somewhere else? If they do need to go somewhere else, in the world of enforcing selinux, where do they go? While dovecot-selinux is documented, sieve is not mentioned: https://linux.die.net/man/8/dovecot_selinux So, let’s work around the above error by adding the vmail user to the dovvecot group. Is this even a good idea? /usr/sbin/usermod -a -G dovecot vmail Now we hit the next error: Error: sieve: file storage: Failed to stat sieve storage path: stat(/var/lib/dovecot/sieve/vacation.sieve) failed: Permission denied (euid=380(vmail) egid=378(vmail) missing +w perm: /var/lib/dovecot/sieve/vacation.sieve stat(/var/lib/dovecot/sieve/vacation.sieve) failed: Permission denied, dir owned by 0:0 mode=0755) This error is weird. Dovecot is trying to open the original vacation.sieve source file for write - why? We have pre-compiled all the global sieve scripts: [root@marcopolo ~]# ls -al /var/lib/dovecot/sieve/ total 36 drwxr-xr-x. 5 root root 4096 Jul 21 17:29 . drwxr-x---. 3 dovecot dovecot 36 Jul 21 17:29 .. -rwxr-xr-x. 1 root root 284 Jul 21 08:47 junk.sieve -rw-r--r--. 1 root root 277 Jul 21 17:29 junk.svbin -rwxr-xr-x. 1 root root 316 Jul 21 08:47 report-ham.sieve -rw-r--r--. 1 root root 476 Jul 21 17:29 report-ham.svbin -rwxr-xr-x. 1 root root 201 Jul 21 08:47 report-spam.sieve -rw-r--r--. 1 root root 382 Jul 21 17:29 report-spam.svbin drwxr-xr-x. 2 root root 6 Jul 21 08:47 sieve-execute drwxr-xr-x. 2 root root 6 Jul 21 08:47 sieve-filter drwxr-xr-x. 2 root root 6 Jul 21 08:47 sieve-pipe -rwxr-xr-x. 1 root root 309 Jul 21 08:47 vacation.sieve -rw-r--r--. 1 root root 558 Jul 21 17:29 vacation.svbin Is the error perhaps inaccurate, and it’s trying to open a temp file for write, failing (correctly, it has no business opening a temp file for write at this point), and then claiming the failure on the temp file is a failure on the source file? So to sum up: - In an SELinux world of Redhat, what directory do global sieve scripts go? - What permissions and selinux context are required on the global sieve scripts directory? Regards, Graham —

1 0

IMAP account can't save any email with attachment
by Chris Thomas 20 Jul '23

20 Jul '23

Hi, I'm getting a curious problem where if I write a draft without an attachment and click save. It'll work without any issue at all. But if I do the same, then attach a file to the email, it'll sit there for a couple of minutes before timing out (I'm using thunderbird), it'll eventually give you a message saying "Your draft message was not copied to your drafts folder (Drafts) due to network or file access errors." I've got all of dovecots verbose logging turned on. I'm using dovecot as a submission server through to the postfix server to do the actual sending. All the logging is turned on there too. But I can't figure out what the problem is. Is there anything I can look for in the logs that will help me out? chris

2 3

Re: Tons of imap-login processes despite client_limit very high
by Joseph Tam 20 Jul '23

20 Jul '23

https://www.mail-archive.com/dovecot%40dovecot.org/msg85850.html From: D D <pierre.alletru(a)gmail.com> > We're seeing a ton of imap-login processes running even when using high performance mode (https://doc.dovecot.org/admin_manual/login_processes/#high-performance-mode) According to the docs: > > "process_min_avail should be set to be at least the number of CPU cores in the system, so that all of them will be used. Otherwise new processes are created only once an existing one’s connection count reaches client_limit" > > We have process_min_avail=4, client_limit=0 and default_client_limit=200000. So we'd expect seeing only 4 imap-login processes serving a ton of connections each. Yet, we see thousands of imap-login processes (more than half of all the imap processes): > ... > > Is having so many imap-login processes normal with our config? Did we misunderstand the docs or is there something wrong here? > > > default_client_limit = 1048576 > default_process_limit = 200000 > > service imap-login { > # client_limit = 0 # default is 0 > # process_limit = 0 # default is 0 > service_count = 100 This service limit might be your culprit. I wrote about the strange interaction between service_count and process_limit here: https://www.mail-archive.com/dovecot%40dovecot.org/msg85850.html This gotcha should really be documented. Joseph Tam <jtam.home(a)gmail.com>

3 4

Fatal error in http-client.c when passdb is oauth2 and userdb is sql
by Евгений Бахтин 19 Jul '23

19 Jul '23

5 5

-d ${user}@${nexthop} or -d ${recipient}?
by rixati6186＠iturchia.com 18 Jul '23

18 Jul '23

What's the differency between these two lines; 1- flags=DORhu user=vmail:vmail argv=/usr/local/libexec/dovecot/dovecot-lda -f ${sender} -r ${recipient} -d ${user}@${nexthop} 2- flags=DRhu user=vmail:vmail argv=/usr/local/libexec/dovecot/dovecot-lda -f ${sender} -d ${recipient} and which one should I use, based on a setup like; Dovecot, Postfix, Postfixadmin, ManageSieve and virtual users hosted in SQL? Thanks in advance.

1 0

dovecot: lda(info@mydomain) - vacation action: discarding vacation response to mailinglist recipient?
by rixati6186＠iturchia.com 18 Jul '23

18 Jul '23

Hello, I'm trying to set auto reply for my email account, through Roundcube and ManageSieve plugin (the plugin itself and its regular filtering works fine), however the auto-reply doesn't arrive to the sender's inbox, when I tested it with sending an email to myself/my server, from my Gmail account, my maillog has a line, stating; Jul 18 15:28:06 mailsrv dovecot: lda(info(a)mywebsite.com)<44812><uikMAlaFtmQMrwAAI6rZ/g>: sieve: msgid=<CA+GnASfyKJDPB-K2uCvxaOL-XQQ7Uv=yJt7sgJSYm-YJzYJSfQ(a)mail.gmail.com>: vacation action: discarding vacation response to mailinglist recipient <mysendermail(a)gmail.com> Any idea would be much appreciated, thank you!

1 1