- dovecot - dovecot.org

Dovecot director and backend on same server
by Michael Cassaniti 29 Aug '23

29 Aug '23

Hi, I'm attempting to run both the director and the backend under the same configuration on the same server. When I run doveadm director map I don't get any output. I have a shared file system between servers and clients can access any server. I was running without a director in front and seeing index corruption so I'm now attempting to use a director. I enabled additional logging for now but that didn't explain much. Dovecot version: 2.3.20 (80a5ac675d) on Alpine Linux v3.18.2 Dovecot configuration (doveconf -n) with some bits removed. # Pigeonhole version 0.5.19 (4eae2f79) # OS: Linux 6.1.43-0-lts x86_64 # Hostname: <REDACTED> auth_debug = yes auth_socket_path = director-userdb director_mail_servers = 192.168.252.2 192.168.252.3 192.168.252.4 192.168.252.5 192.168.252.20 director_servers = 192.168.252.2 192.168.252.3 192.168.252.4 192.168.252.5 192.168.252.20 imap_hibernate_timeout = 5 secs log_debug = events=* login_trusted_networks = 192.168.252.0/24 mail_debug = yes mail_fsync = always mail_gid = vmail mail_location = maildir:~/Maildir:LAYOUT=fs mail_nfs_index = yes mail_nfs_storage = yes mail_plugins = acl quota mail_uid = vmail managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext imapsieve vnd.dovecot.imapsieve mmap_disable = yes namespace inbox { inbox = yes location = mailbox Bin { auto = subscribe autoexpunge = 30 days special_use = \Trash } mailbox Drafts { auto = subscribe special_use = \Drafts } mailbox Sent { auto = subscribe special_use = \Sent } mailbox Spam { auto = subscribe autoexpunge = 30 days special_use = \Junk } prefix = } passdb { args = /etc/dovecot/dovecot-sql.conf.ext driver = sql } plugin { acl = vfile quota = maildir:quota quota_rule = *:storage=5G quota_rule2 = Bin:ignore quota_rule3 = Spam:ignore sieve = file: ~/sieve;active=~/dovecot.sieve sieve_plugins = sieve_imapsieve } protocols = imap lmtp sieve service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0660 user = postfix } } service director { fifo_listener login/proxy-notify { mode = 0600 user = $default_login_user } inet_listener { port = 9090 } unix_listener director-admin { mode = 0600 } unix_listener director-userdb { mode = 0600 } unix_listener login/director { mode = 0666 } } service imap-login { executable = imap-login director } service imap { user = vmail } service ipc { unix_listener ipc { user = dovecot } } service lmtp { unix_listener /var/spool/postfix/private/dovecot-lmtp { group = postfix mode = 0600 user = postfix } user = vmail } service managesieve-login { executable = managesieve-login director inet_listener sieve { port = 4190 } } ssl = required ssl_cert = </etc/letsencrypt/live/<REDACTED>/fullchain.pem ssl_cipher_list = HIGH:!SSLv3:!aNULL ssl_key = # hidden, use -P to show it userdb { args = /etc/dovecot/dovecot-sql.conf.ext driver = sql } protocol lmtp { mail_plugins = acl quota sieve } protocol imap { mail_plugins = acl quota imap_acl imap_quota imap_sieve imap_zlib } Regards, Michael Cassaniti

1 0

[bug] dovecot passes zero byte input stream when passing email with .eml attachment to apache tika parser, causes 'SEVERE' error
by pgnd 29 Aug '23

29 Aug '23

revisiting a prior, never resolved issue tika 2.4.1 'Text extraction failed' errors when dovecot+fts 2.3.19.1 passes embedded *.eml (message/rfc822) files ; org.apache.tika.parser.mail.RFC822Parser or dovecot ? https://dovecot.org/list/dovecot/2022-August/125085.html i now run dovecot --version 2.3.20 (80a5ac675d) with dovecot23_fts_flatcurve built 20230812 from git.HEAD on lsb_release -rd Description: Fedora release 38 (Thirty Eight) Release: 38 apache/tika 2.8.0 runs on another box dovecot passes mail to tika, via config fts_tika = http://192.0.2.20:9998/tika/ indexing & search work with simple mail passed, and with attachments ... except with .eml attachments. sending this message (plain txt email, with .eml as attachment) Content-Type: multipart/mixed; boundary="------------O6z0p865JVYqnvxPyzc0aSLA" Message-ID: <0b7f5053-05b5-4b4f-8c7e-4a640b79a5f4(a)fastmail.fm> Date: Sat, 12 Aug 2023 19:37:44 -0400 MIME-Version: 1.0 User-Agent: Mozilla Thunderbird Reply-To: sender(a)example1.com From: sender <sender(a)example1.com> Content-Language: en-US To: recipient(a)example2.com Subject: tika test This is a multi-part message in MIME format. --------------O6z0p865JVYqnvxPyzc0aSLA Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 8bit Â tika test --------------O6z0p865JVYqnvxPyzc0aSLA Content-Type: message/rfc822; name="t2.eml" Content-Disposition: attachment; filename="t2.eml" Content-Transfer-Encoding: 8bit Message-ID: <89e5914a-e928-422d-824f-5b4e90170cd7(a)fastmail.fm> Date: Sat, 12 Aug 2023 14:32:48 -0400 MIME-Version: 1.0 User-Agent: Mozilla Thunderbird Reply-To: sender(a)example1.com From: sender <sender(a)example1.com> Content-Language: en-US To: recipient(a)example2.com Subject: t2 Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 8bit Â t2 --------------O6z0p865JVYqnvxPyzc0aSLA-- from an off-site server to local postfix+dovecot instance tika & dovecot logs, journalctl -f -u tika Aug 12 19:52:36 svr04tika[2035]: INFO [qtp1472012329-175] 19:52:36,918 org.apache.tika.server.core.TikaLoggingFilter Request URI: http://192.0.2.20:9998/tika/ Aug 12 19:52:36 svr04tika[2035]: INFO [qtp1472012329-175] 19:52:36,918 org.apache.tika.server.core.resource.TikaResource /tika (message/rfc822) Aug 12 19:52:36 svr04tika[2035]: WARN [qtp1472012329-175] 19:52:36,918 org.apache.tika.server.core.resource.TikaResource tika/: Text extraction failed (t2.eml) Aug 12 19:52:36 svr04tika[2035]: org.apache.tika.exception.ZeroByteFileException: InputStream must have > 0 bytes Aug 12 19:52:36 svr04tika[2035]: at org.apache.tika.parser.AutoDetectParser.parse(AutoDetectParser.java:185) ~[tika-server-standard-2.8.0.jar:2.8.0] Aug 12 19:52:36 svr04tika[2035]: at org.apache.tika.parser.ParserDecorator.parse(ParserDecorator.java:152) ~[tika-server-standard-2.8.0.jar:2.8.0] Aug 12 19:52:36 svr04tika[2035]: at org.apache.tika.parser.DigestingParser.parse(DigestingParser.java:57) ~[tika-server-standard-2.8.0.jar:2.8.0] Aug 12 19:52:36 svr04tika[2035]: at org.apache.tika.server.core.resource.TikaResource.parse(TikaResource.java:357) ~[tika-server-standard-2.8.0.jar:2.8.0] Aug 12 19:52:36 svr04tika[2035]: at org.apache.tika.server.core.resource.TikaResource.lambda$produceText$1(TikaResource.java:507) ~[tika-server-standard-2.8.0.jar:2.8.0] Aug 12 19:52:36 svr04tika[2035]: at org.apache.cxf.jaxrs.provider.BinaryDataProvider.writeTo(BinaryDataProvider.java:177) ~[tika-server-standard-2.8.0.jar:2.8.0] Aug 12 19:52:36 svr04tika[2035]: at org.apache.cxf.jaxrs.utils.JAXRSUtils.writeMessageBody(JAXRSUtils.java:1651) ~[tika-server-standard-2.8.0.jar:2.8.0] Aug 12 19:52:36 svr04tika[2035]: at org.apache.cxf.jaxrs.interceptor.JAXRSOutInterceptor.serializeMessage(JAXRSOutInterceptor.java:249) ~[tika-server-standard-2.8.0.jar:2.8.0] Aug 12 19:52:36 svr04tika[2035]: at org.apache.cxf.jaxrs.interceptor.JAXRSOutInterceptor.processResponse(JAXRSOutInterceptor.java:122) ~[tika-server-standard-2.8.0.jar:2.8.0] Aug 12 19:52:36 svr04tika[2035]: at org.apache.cxf.jaxrs.interceptor.JAXRSOutInterceptor.handleMessage(JAXRSOutInterceptor.java:84) ~[tika-server-standard-2.8.0.jar:2.8.0] Aug 12 19:52:36 svr04tika[2035]: at org.apache.cxf.phase.PhaseInterceptorChain.doIntercept(PhaseInterceptorChain.java:307) ~[tika-server-standard-2.8.0.jar:2.8.0] Aug 12 19:52:36 svr04tika[2035]: at org.apache.cxf.interceptor.OutgoingChainInterceptor.handleMessage(OutgoingChainInterceptor.java:90) ~[tika-server-standard-2.8.0.jar:2.8.0] Aug 12 19:52:36 svr04tika[2035]: at org.apache.cxf.phase.PhaseInterceptorChain.doIntercept(PhaseInterceptorChain.java:307) ~[tika-server-standard-2.8.0.jar:2.8.0] Aug 12 19:52:36 svr04tika[2035]: at org.apache.cxf.transport.ChainInitiationObserver.onMessage(ChainInitiationObserver.java:121) ~[tika-server-standard-2.8.0.jar:2.8.0] Aug 12 19:52:36 svr04tika[2035]: at org.apache.cxf.transport.http.AbstractHTTPDestination.invoke(AbstractHTTPDestination.java:265) ~[tika-server-standard-2.8.0.jar:2.8.0] Aug 12 19:52:36 svr04tika[2035]: at org.apache.cxf.transport.http_jetty.JettyHTTPDestination.doService(JettyHTTPDestination.java:247) ~[tika-server-standard-2.8.0.jar:2.8.0] Aug 12 19:52:36 svr04tika[2035]: at org.apache.cxf.transport.http_jetty.JettyHTTPHandler.handle(JettyHTTPHandler.java:79) ~[tika-server-standard-2.8.0.jar:2.8.0] Aug 12 19:52:36 svr04tika[2035]: at org.eclipse.jetty.server.handler.HandlerWrapper.handle(HandlerWrapper.java:127) ~[tika-server-standard-2.8.0.jar:2.8.0] Aug 12 19:52:36 svr04tika[2035]: at org.eclipse.jetty.server.handler.ScopedHandler.nextHandle(ScopedHandler.java:235) ~[tika-server-standard-2.8.0.jar:2.8.0] Aug 12 19:52:36 svr04tika[2035]: at org.eclipse.jetty.server.handler.ContextHandler.doHandle(ContextHandler.java:1440) ~[tika-server-standard-2.8.0.jar:2.8.0] Aug 12 19:52:36 svr04tika[2035]: at org.eclipse.jetty.server.handler.ScopedHandler.nextScope(ScopedHandler.java:190) ~[tika-server-standard-2.8.0.jar:2.8.0] Aug 12 19:52:36 svr04tika[2035]: at org.eclipse.jetty.server.handler.ContextHandler.doScope(ContextHandler.java:1355) ~[tika-server-standard-2.8.0.jar:2.8.0] Aug 12 19:52:36 svr04tika[2035]: at org.eclipse.jetty.server.handler.ScopedHandler.handle(ScopedHandler.java:141) ~[tika-server-standard-2.8.0.jar:2.8.0] Aug 12 19:52:36 svr04tika[2035]: at org.eclipse.jetty.server.handler.ContextHandlerCollection.handle(ContextHandlerCollection.java:191) ~[tika-server-standard-2.8.0.jar:2.8.0] Aug 12 19:52:36 svr04tika[2035]: at org.eclipse.jetty.server.handler.HandlerWrapper.handle(HandlerWrapper.java:127) ~[tika-server-standard-2.8.0.jar:2.8.0] Aug 12 19:52:36 svr04tika[2035]: at org.eclipse.jetty.server.Server.handle(Server.java:516) ~[tika-server-standard-2.8.0.jar:2.8.0] Aug 12 19:52:36 svr04tika[2035]: at org.eclipse.jetty.server.HttpChannel.lambda$handle$1(HttpChannel.java:487) ~[tika-server-standard-2.8.0.jar:2.8.0] Aug 12 19:52:36 svr04tika[2035]: at org.eclipse.jetty.server.HttpChannel.dispatch(HttpChannel.java:732) ~[tika-server-standard-2.8.0.jar:2.8.0] Aug 12 19:52:36 svr04tika[2035]: at org.eclipse.jetty.server.HttpChannel.handle(HttpChannel.java:479) ~[tika-server-standard-2.8.0.jar:2.8.0] Aug 12 19:52:36 svr04tika[2035]: at org.eclipse.jetty.server.HttpConnection.onFillable(HttpConnection.java:277) ~[tika-server-standard-2.8.0.jar:2.8.0] Aug 12 19:52:36 svr04tika[2035]: at org.eclipse.jetty.io.AbstractConnection$ReadCallback.succeeded(AbstractConnection.java:311) ~[tika-server-standard-2.8.0.jar:2.8.0] Aug 12 19:52:36 svr04tika[2035]: at org.eclipse.jetty.io.FillInterest.fillable(FillInterest.java:105) ~[tika-server-standard-2.8.0.jar:2.8.0] Aug 12 19:52:36 svr04tika[2035]: at org.eclipse.jetty.io.ChannelEndPoint$1.run(ChannelEndPoint.java:104) ~[tika-server-standard-2.8.0.jar:2.8.0] Aug 12 19:52:36 svr04tika[2035]: at org.eclipse.jetty.util.thread.QueuedThreadPool.runJob(QueuedThreadPool.java:883) ~[tika-server-standard-2.8.0.jar:2.8.0] Aug 12 19:52:36 svr04tika[2035]: at org.eclipse.jetty.util.thread.QueuedThreadPool$Runner.run(QueuedThreadPool.java:1034) ~[tika-server-standard-2.8.0.jar:2.8.0] Aug 12 19:52:36 svr04tika[2035]: at java.lang.Thread.run(Thread.java:1623) [?:?] Aug 12 19:52:36 svr04tika[2035]: Aug 12, 2023 7:52:36 PM org.apache.cxf.jaxrs.utils.JAXRSUtils logMessageHandlerProblem Aug 12 19:52:36 svr04tika[2035]: SEVERE: Problem with writing the data, class org.apache.tika.server.core.resource.TikaResource$$Lambda$387/0x00000008012a9300, ContentType: text/plain tail -f /var/log/dovecot/*log | grep http-client 2023-08-12 19:52:36 indexer-worker(recipient(a)example2.com)<lrVsHUQb2GR1dgAA+IOfAw:xKZLMEQb2GR3dgAA+IOfAw>: Debug: http-client: host 192.0.2.20: Host created 2023-08-12 19:52:36 indexer-worker(recipient(a)example2.com)<lrVsHUQb2GR1dgAA+IOfAw:xKZLMEQb2GR3dgAA+IOfAw>: Debug: http-client: host 192.0.2.20: Host session created 2023-08-12 19:52:36 indexer-worker(recipient(a)example2.com)<lrVsHUQb2GR1dgAA+IOfAw:xKZLMEQb2GR3dgAA+IOfAw>: Debug: http-client: peer 192.0.2.20:9998 (shared): Peer created 2023-08-12 19:52:36 indexer-worker(recipient(a)example2.com)<lrVsHUQb2GR1dgAA+IOfAw:xKZLMEQb2GR3dgAA+IOfAw>: Debug: http-client: peer 192.0.2.20:9998: Peer pool created 2023-08-12 19:52:36 indexer-worker(recipient(a)example2.com)<lrVsHUQb2GR1dgAA+IOfAw:xKZLMEQb2GR3dgAA+IOfAw>: Debug: http-client: peer 192.0.2.20:9998: Peer created 2023-08-12 19:52:36 indexer-worker(recipient(a)example2.com)<lrVsHUQb2GR1dgAA+IOfAw:xKZLMEQb2GR3dgAA+IOfAw>: Debug: http-client: queue http://192.0.2.20:9998: Setting up connection to 192.0.2.20:9998 (1 requests pending) 2023-08-12 19:52:36 indexer-worker(recipient(a)example2.com)<lrVsHUQb2GR1dgAA+IOfAw:xKZLMEQb2GR3dgAA+IOfAw>: Debug: http-client: peer 192.0.2.20:9998: Linked queue http://192.0.2.20:9998 (1 queues linked) 2023-08-12 19:52:36 indexer-worker(recipient(a)example2.com)<lrVsHUQb2GR1dgAA+IOfAw:xKZLMEQb2GR3dgAA+IOfAw>: Debug: http-client: queue http://192.0.2.20:9998: Started new connection to 192.0.2.20:9998 2023-08-12 19:52:36 indexer-worker(recipient(a)example2.com)<lrVsHUQb2GR1dgAA+IOfAw:xKZLMEQb2GR3dgAA+IOfAw>: Debug: http-client: request [Req1: PUT http://192.0.2.20/tika/] Submitted (requests left=1) 2023-08-12 19:52:36 indexer-worker(recipient(a)example2.com)<lrVsHUQb2GR1dgAA+IOfAw:xKZLMEQb2GR3dgAA+IOfAw>: Debug: http-client: request [Req1: PUT http://192.0.2.20/tika/] Waiting for request to finish 2023-08-12 19:52:36 indexer-worker(recipient(a)example2.com)<lrVsHUQb2GR1dgAA+IOfAw:xKZLMEQb2GR3dgAA+IOfAw>: Debug: http-client: peer 192.0.2.20:9998: Creating 1 new connections to handle requests (already 0 usable, connecting to 0, closing 0) 2023-08-12 19:52:36 indexer-worker(recipient(a)example2.com)<lrVsHUQb2GR1dgAA+IOfAw:xKZLMEQb2GR3dgAA+IOfAw>: Debug: http-client: peer 192.0.2.20:9998: Making new connection 1 of 1 (0 connections exist, 0 pending) 2023-08-12 19:52:36 indexer-worker(recipient(a)example2.com)<lrVsHUQb2GR1dgAA+IOfAw:xKZLMEQb2GR3dgAA+IOfAw>: Debug: http-client: conn 192.0.2.20:9998 [1]: Connecting 2023-08-12 19:52:36 indexer-worker(recipient(a)example2.com)<lrVsHUQb2GR1dgAA+IOfAw:xKZLMEQb2GR3dgAA+IOfAw>: Debug: http-client: conn 192.0.2.20:9998 [1]: Waiting for connect (fd=28) to finish for max 0 msecs 2023-08-12 19:52:36 indexer-worker(recipient(a)example2.com)<lrVsHUQb2GR1dgAA+IOfAw:xKZLMEQb2GR3dgAA+IOfAw>: Debug: http-client: conn 192.0.2.20:9998 [1]: HTTP connection created (1 parallel connections exist) 2023-08-12 19:52:36 indexer-worker(recipient(a)example2.com)<lrVsHUQb2GR1dgAA+IOfAw:xKZLMEQb2GR3dgAA+IOfAw>: Debug: http-client: conn 192.0.2.20:9998 [1]: Client connected (fd=28) 2023-08-12 19:52:36 indexer-worker(recipient(a)example2.com)<lrVsHUQb2GR1dgAA+IOfAw:xKZLMEQb2GR3dgAA+IOfAw>: Debug: http-client: conn 192.0.2.20:9998 [1]: Connected 2023-08-12 19:52:36 indexer-worker(recipient(a)example2.com)<lrVsHUQb2GR1dgAA+IOfAw:xKZLMEQb2GR3dgAA+IOfAw>: Debug: http-client: conn 192.0.2.20:9998 [1]: Ready for requests 2023-08-12 19:52:36 indexer-worker(recipient(a)example2.com)<lrVsHUQb2GR1dgAA+IOfAw:xKZLMEQb2GR3dgAA+IOfAw>: Debug: http-client: peer 192.0.2.20:9998: Successfully connected (1 connections exist, 0 pending) 2023-08-12 19:52:36 indexer-worker(recipient(a)example2.com)<lrVsHUQb2GR1dgAA+IOfAw:xKZLMEQb2GR3dgAA+IOfAw>: Debug: http-client: peer 192.0.2.20:9998: Successfully connected (1 connections exist, 0 pending) 2023-08-12 19:52:36 indexer-worker(recipient(a)example2.com)<lrVsHUQb2GR1dgAA+IOfAw:xKZLMEQb2GR3dgAA+IOfAw>: Debug: http-client: peer 192.0.2.20:9998: Using 1 idle connections to handle 1 requests (1 total connections ready) 2023-08-12 19:52:36 indexer-worker(recipient(a)example2.com)<lrVsHUQb2GR1dgAA+IOfAw:xKZLMEQb2GR3dgAA+IOfAw>: Debug: http-client: queue http://192.0.2.20:9998: Connection to peer 192.0.2.20:9998 claimed request [Req1: PUT http://192.0.2.20:9998/tika/] 2023-08-12 19:52:36 indexer-worker(recipient(a)example2.com)<lrVsHUQb2GR1dgAA+IOfAw:xKZLMEQb2GR3dgAA+IOfAw>: Debug: http-client: conn 192.0.2.20:9998 [1]: Claimed request [Req1: PUT http://192.0.2.20:9998/tika/] 2023-08-12 19:52:36 indexer-worker(recipient(a)example2.com)<lrVsHUQb2GR1dgAA+IOfAw:xKZLMEQb2GR3dgAA+IOfAw>: Debug: http-client: request [Req1: PUT http://192.0.2.20/tika/] Sent header 2023-08-12 19:52:36 indexer-worker(recipient(a)example2.com)<lrVsHUQb2GR1dgAA+IOfAw:xKZLMEQb2GR3dgAA+IOfAw>: Debug: http-client: peer 192.0.2.20:9998: No more requests to service for this peer (1 connections exist, 0 pending) 2023-08-12 19:52:36 indexer-worker(recipient(a)example2.com)<lrVsHUQb2GR1dgAA+IOfAw:xKZLMEQb2GR3dgAA+IOfAw>: Debug: http-client: conn 192.0.2.20:9998 [1]: Got 422 response for request [Req1: PUT http://192.0.2.20:9998/tika/] Unprocessable Entity (took 3 ms + 106 ms in queue) 2023-08-12 19:52:36 indexer-worker(recipient(a)example2.com)<lrVsHUQb2GR1dgAA+IOfAw:xKZLMEQb2GR3dgAA+IOfAw>: Debug: http-client: request [Req1: PUT http://192.0.2.20/tika/] Finished 2023-08-12 19:52:36 indexer-worker(recipient(a)example2.com)<lrVsHUQb2GR1dgAA+IOfAw:xKZLMEQb2GR3dgAA+IOfAw>: Debug: http-client: queue http://192.0.2.20:9998: Dropping request [Req1: PUT http://192.0.2.20:9998/tika/] 2023-08-12 19:52:36 indexer-worker(recipient(a)example2.com)<lrVsHUQb2GR1dgAA+IOfAw:xKZLMEQb2GR3dgAA+IOfAw>: Debug: http-client: host 192.0.2.20: Host is idle (timeout = 100 msecs) 2023-08-12 19:52:36 indexer-worker(recipient(a)example2.com)<lrVsHUQb2GR1dgAA+IOfAw:xKZLMEQb2GR3dgAA+IOfAw>: Debug: http-client: request [Req1: PUT http://192.0.2.20/tika/] Free (requests left=1) 2023-08-12 19:52:36 indexer-worker(recipient(a)example2.com)<lrVsHUQb2GR1dgAA+IOfAw:xKZLMEQb2GR3dgAA+IOfAw>: Debug: http-client: peer 192.0.2.20:9998: No requests to service for this peer (1 connections exist, 0 pending) 2023-08-12 19:52:36 indexer-worker(recipient(a)example2.com)<lrVsHUQb2GR1dgAA+IOfAw:xKZLMEQb2GR3dgAA+IOfAw>: Debug: http-client: conn 192.0.2.20:9998 [1]: No more requests queued; going idle (timeout = 100 msecs) 2023-08-12 19:52:37 indexer-worker(recipient(a)example2.com)<lrVsHUQb2GR1dgAA+IOfAw:xKZLMEQb2GR3dgAA+IOfAw>: Debug: http-client: host 192.0.2.20: Idle host timed out 2023-08-12 19:52:37 indexer-worker(recipient(a)example2.com)<lrVsHUQb2GR1dgAA+IOfAw:xKZLMEQb2GR3dgAA+IOfAw>: Debug: http-client: host 192.0.2.20: Host destroy 2023-08-12 19:52:37 indexer-worker(recipient(a)example2.com)<lrVsHUQb2GR1dgAA+IOfAw:xKZLMEQb2GR3dgAA+IOfAw>: Debug: http-client: host 192.0.2.20: Host session destroy 2023-08-12 19:52:37 indexer-worker(recipient(a)example2.com)<lrVsHUQb2GR1dgAA+IOfAw:xKZLMEQb2GR3dgAA+IOfAw>: Debug: http-client: queue http://192.0.2.20:9998: Destroy 2023-08-12 19:52:37 indexer-worker(recipient(a)example2.com)<lrVsHUQb2GR1dgAA+IOfAw:xKZLMEQb2GR3dgAA+IOfAw>: Debug: http-client: peer 192.0.2.20:9998: Unlinked queue http://192.0.2.20:9998 (0 queues linked) 2023-08-12 19:52:37 indexer-worker(recipient(a)example2.com)<lrVsHUQb2GR1dgAA+IOfAw:xKZLMEQb2GR3dgAA+IOfAw>: Debug: http-client: conn 192.0.2.20:9998 [1]: Idle connection timed out 2023-08-12 19:52:37 indexer-worker(recipient(a)example2.com)<lrVsHUQb2GR1dgAA+IOfAw:xKZLMEQb2GR3dgAA+IOfAw>: Debug: http-client: conn 192.0.2.20:9998 [1]: Connection close 2023-08-12 19:52:37 indexer-worker(recipient(a)example2.com)<lrVsHUQb2GR1dgAA+IOfAw:xKZLMEQb2GR3dgAA+IOfAw>: Debug: http-client: conn 192.0.2.20:9998 [1]: Connection disconnect 2023-08-12 19:52:37 indexer-worker(recipient(a)example2.com)<lrVsHUQb2GR1dgAA+IOfAw:xKZLMEQb2GR3dgAA+IOfAw>: Debug: http-client: conn 192.0.2.20:9998 [1]: Disconnected: Connection closed (fd=28) 2023-08-12 19:52:37 indexer-worker(recipient(a)example2.com)<lrVsHUQb2GR1dgAA+IOfAw:xKZLMEQb2GR3dgAA+IOfAw>: Debug: http-client: conn 192.0.2.20:9998 [1]: Detached peer 2023-08-12 19:52:37 indexer-worker(recipient(a)example2.com)<lrVsHUQb2GR1dgAA+IOfAw:xKZLMEQb2GR3dgAA+IOfAw>: Debug: http-client: peer 192.0.2.20:9998: Lost a connection (0 queues linked, 0 connections left, 0 connections pending, 0 requests pending, 0 requests urgent) 2023-08-12 19:52:37 indexer-worker(recipient(a)example2.com)<lrVsHUQb2GR1dgAA+IOfAw:xKZLMEQb2GR3dgAA+IOfAw>: Debug: http-client: conn 192.0.2.20:9998 [1]: Connection destroy 2023-08-12 19:52:37 indexer-worker(recipient(a)example2.com)<lrVsHUQb2GR1dgAA+IOfAw:xKZLMEQb2GR3dgAA+IOfAw>: Debug: http-client: peer 192.0.2.20:9998: Dropping peer now 2023-08-12 19:52:37 indexer-worker(recipient(a)example2.com)<lrVsHUQb2GR1dgAA+IOfAw:xKZLMEQb2GR3dgAA+IOfAw>: Debug: http-client: peer 192.0.2.20:9998: Peer close unclear 2 me whether this is a bug in dovecot or in tika, or a matter of (mis)config. ?? _______________________________________________ dovecot mailing list -- dovecot(a)dovecot.org To unsubscribe send an email to dovecot-leave(a)dovecot.org

2 3

Dovecot, mail_crypt, global keys, permissions
by David Mehler 28 Aug '23

28 Aug '23

Hello, I'm using Dovecot v2.3 with the mail_crypt plugin and global keys. I am seeing this error immediately after imap login then after this error imap logs out. I'm hoping this is a simple permissions problem and the key can not be read rather than an underlying configuration issue. I do not know what this UID 5395 refers to. 2023-08-11T04:14:14.539308-04:00 hostname dovecot: imap(username(a)domain.org)<492738><zO4WTKECnvRoDWll>: Error: Mailbox INBOX: UID=5395: read() failed: read(/var/mail/mailboxes/domain.org/username/mail/mailboxes/INBOX/dbox-Mail… failed: Private key not available: mailbox_attribute_get(INBOX, /priv/vendor/vendor.dovecot/pvt/crypt/privkeys/e9f195fe9fd1953d08e815ba6fda9b6c5ae1ed692c9adade2f958c322552cbb0) failed: Mailbox attributes not enabled (FETCH BODY[HEADER]) #ls -ld crypt drwxr-xr-x 2 root root 4096 Jul 25 08:52 crypt/ # cd crypt #ls -l * -r-------- 1 root root 241 Jul 25 15:43 master.key -rw-r--r-- 1 root root 178 Jul 25 15:43 master.pub Thanks. Dave.

2 5

Bug - doveadm backup out-of-memory kill/crash when no separators set
by James Harrison 26 Aug '23

26 Aug '23

Hi, I hit a fun issue with doveadm when migrating from dovecot 2.2.36 (1f10bfa63) to 2.3.19.1 (9b53102964) (CentOS 7 to Debian 12). When running doveadm -v -D backup -R -u "user@name" tcp:localhost:1234, I found that the first sync would always work, but subsequent runs of the command would cause doveadm to reach a subfolder (Archives/2008 in the example below) and then silently mmap() increasing powers of 2 before the OOM killer finally got it. Deleting the source folder caused it to remain stuck on the same folder, but for the deletion event. I switched memory overcommit off to force a crash, and got a gdb backtrace: #0 __pthread_kill_implementation (threadid=<optimized out>, signo=signo@entry=6, no_tid=no_tid@entry=0) at ./nptl/pthread_kill.c:44 #1 0x00007ffff786bd9f in __pthread_kill_internal (signo=6, threadid=<optimized out>) at ./nptl/pthread_kill.c:78 #2 0x00007ffff781cf32 in __GI_raise (sig=sig@entry=6) at ../sysdeps/posix/raise.c:26 #3 0x00007ffff7807472 in __GI_abort () at ./stdlib/abort.c:79 #4 0x00007ffff7b4ffae in default_fatal_finish (status=0, type=LOG_TYPE_PANIC) at ../lib/failures.c:465 #5 fatal_handler_real (ctx=<optimized out>, format=<optimized out>, args=<optimized out>) at ../lib/failures.c:477 #6 0x00007ffff7bfa081 in default_fatal_handler (ctx=<optimized out>, format=<optimized out>, args=<optimized out>) at ../lib/failures.c:485 #7 0x00007ffff7b5017c in i_panic (format=0x7ffff7c5d748 "data stack: Out of memory when allocating %zu bytes") at ../lib/failures.c:530 #8 0x00007ffff7b4f67f in mem_block_alloc (min_size=min_size@entry=16) at ../lib/data-stack.c:386 #9 0x00007ffff7bf8b60 in t_malloc_real (size=<optimized out>, permanent=<optimized out>) at ../lib/data-stack.c:492 #10 0x00007ffff7c348f1 in t_strdup_until (start=start@entry=0x55555565f440, end=end@entry=0x55555565f448) at ../lib/strfuncs.c:270 #11 0x00005555555adc62 in convert_name_to_remote_sep (name=0x55555565f440 "Archives/2008", tree=0x55555564e188) at dsync/dsync-mailbox-tree.c:270 #12 dsync_mailbox_tree_build_name128_remotesep_hash (tree=0x55555564e188) at dsync/dsync-mailbox-tree.c:315 #13 dsync_mailbox_tree_find_delete (tree=0x55555564e188, del=0x5555556469f0) at dsync/dsync-mailbox-tree.c:405 #14 0x00005555555a4195 in dsync_brain_mailbox_tree_add_delete (tree=0x55555564e188, other_tree=0x55555564f5f8, other_del=0x5555556469f0, node_r=0x7fffffffe350, status_r=0x7fffffffe348) at dsync/dsync-brain-mailbox-tree.c:504 #15 0x00005555555a44cd in dsync_brain_recv_mailbox_tree_deletes (brain=0x55555564b2d8) at dsync/dsync-brain-mailbox-tree.c:590 #16 0x00005555555a5365 in dsync_brain_run_real (brain=brain@entry=0x55555564b2d8, changed_r=changed_r@entry=0x7fffffffe453) at dsync/dsync-brain.c:709 #17 0x00005555555a59f9 in dsync_brain_run (changed_r=0x7fffffffe453, brain=0x55555564b2d8) at dsync/dsync-brain.c:752 #18 dsync_brain_run (changed_r=0x7fffffffe453, brain=0x55555564b2d8) at dsync/dsync-brain.c:740 #19 dsync_brain_run_io (context=<optimized out>) at dsync/dsync-brain.c:113 #20 dsync_brain_run_io (context=0x55555564b2d8) at dsync/dsync-brain.c:100 #21 0x00005555555b23df in dsync_ibc_stream_input (ibc=0x555555646720) at dsync/dsync-ibc-stream.c:232 #22 0x00007ffff7c11cd9 in io_loop_call_io (io=0x5555556418f0) at ../lib/ioloop.c:737 #23 0x00007ffff7c13aa2 in io_loop_handler_run_internal (ioloop=ioloop@entry=0x55555560bf40) at ../lib/ioloop-epoll.c:222 #24 0x00007ffff7c13b50 in io_loop_handler_run (ioloop=ioloop@entry=0x55555560bf40) at ../lib/ioloop.c:789 #25 0x00007ffff7c13d10 in io_loop_run (ioloop=0x55555560bf40) at ../lib/ioloop.c:762 #26 0x000055555558b22e in cmd_dsync_run_remote (user=0x555555637248) at ./src/doveadm/doveadm-dsync.c:543 #27 cmd_dsync_run (_ctx=0x55555561f288, user=0x555555637248) at ./src/doveadm/doveadm-dsync.c:750 #28 0x000055555558bd12 in doveadm_mail_next_user (ctx=0x55555561f288, error_r=0x7fffffffe818) at ./src/doveadm/doveadm-mail.c:464 #29 0x000055555558cf45 in doveadm_mail_cmd_exec (wildcard_user=0x0, ctx=0x55555561f288) at ./src/doveadm/doveadm-mail.c:659 #30 doveadm_cmd_ver2_to_mail_cmd_wrapper (cctx=0x7fffffffe970) at ./src/doveadm/doveadm-mail.c:988 #31 0x0000555555597622 in doveadm_cmd_run_ver2 (argc=5, argv=0x55555560ba38, cctx=cctx@entry=0x7fffffffe970) at ./src/doveadm/doveadm-cmd.c:465 #32 0x0000555555597697 in doveadm_cmd_try_run_ver2 (cmd_name=<optimized out>, argc=<optimized out>, argv=<optimized out>, cctx=0x7fffffffe970) at ./src/doveadm/doveadm-cmd.c:363 #33 0x000055555557919a in main (argc=<optimized out>, argv=<optimized out>) at ./src/doveadm/doveadm.c:361 Neither server had a separator set in the inbox namespace. Having identified the convert_name_to_remote_sep function as the likely trigger point I set the separator to / on both ends, and doveadm backup now runs without issue. Can provide config if helpful but I think probably irrelevant to this one - the namespace config is the default other than the separator item. May be worth mentioning that having the separator set can avoid this condition in the doveadm backup docs - this took me a while to figure out! -- Cheers, James Harrison

2 1

Stop Logging to Syslog
by Asai 25 Aug '23

25 Aug '23

Greetings, My logging config is as follows: # doveadm log find Debug: /var/log/dovecot-debug.log Info: /var/log/dovecot.log Warning: /var/log/dovecot.log Error: /var/log/dovecot.log Fatal: /var/log/dovecot.log However, I'm still getting logs in /var/log/messages which I don't want. I've looked into /etc/rsyslog.conf for clues, but can't find anything that would point to Dovecot logging to /var/log/messages. Can anyone point me in the right direction here? Thank you, Asai

2 1

libdovecot-storage.so.0.0.0 [.] maildir_filename_base_hash with high cpu load
by habi li 25 Aug '23

25 Aug '23

[image: image.png] we find the libdovecot-storage.so cpu so high ,can you help me

3 2

sievec: Misleading error message
by Horst Prote 25 Aug '23

25 Aug '23

Hi, in a sieve script I just made a syntax error and got this error message on calling sievec: error: the else command must follow an if or elseif command. My first thougth was "Are you kidding me!" as I used "elseif". But then I realized that the correct syntax is "elsif". So I think that error message should be corrected to error: the else command must follow an if or elsif command. Thanks, Horst

3 2

Re: Question about namespaces
by Peter Wienemann 22 Aug '23

22 Aug '23

Hi J, On 21.08.23 21:08, J Doe wrote: > My current dovecot.conf is rather basic when it comes to namespaces - I > have one private namespace per user: > > namespace inbox { > type = private > separator = / > inbox = yes > hidden = no > list = yes > subscriptions = yes > } > > I have some users who connect via more than one client - for instance, > some use Apple Mail in addition to Roundcube. I have noticed that > different mail clients sometimes create similar mailboxes, such as Trash > and Deleted Items. I would like the same mailboxes across any client, > so I am wondering if there is a way in Dovecot to specify the folders > and have the *client* not create them. For instance, a config in > dovecot.conf that specifies a Trash folder and the mail clients cannot > create "Deleted Items", etc. in addition to this. > > Is this possible ? this can be done using the settings in https://github.com/dovecot/core/blob/main/doc/example-config/conf.d/15-mail… Best regards, Peter

2 1

dovecot 2.4 issue with openssl >= 3.0.8
by Michal Hlavinka 22 Aug '23

22 Aug '23

Hi, I've started testing main git branch and found an issue with openssl 3. Test suite fails: test_load_v1_key ........................................... : ok test-crypto.c:445: Assert failed: ret == TRUE test-crypto.c:446: Assert failed: error == NULL Panic: file dcrypt-openssl3.c: line 2917 (dcrypt_openssl_public_key_type): assertion failed: (key != NULL && key->key != NULL) Error: Raw backtrace: test-crypto(+0x5af01) [0x55951b667f01] -> test-crypto(backtrace_get+0x2f) [0x55951b66877f] -> test-crypto(+0x31291) [0x55951b63e291] -> test-crypto(+0x312d5) [0x55951b63e2d5] -> test-crypto(+0x16025) [0x55951b623025] -> libdcrypt_openssl.so(+0x70ff) [0x7f5a995b60ff] -> test-crypto(+0x2a17b) [0x55951b63717b] -> test-crypto(+0x3055d) [0x55951b63d55d] -> test-crypto(test_run+0x6c) [0x55951b63d61c] -> test-crypto(main+0x4e) [0x55951b62b66e] -> libc.so.6(+0x27b4a) [0x7f5a995eeb4a] -> libc.so.6(__libc_start_main+0x8b) [0x7f5a995eec0b] -> test-crypto(_start+0x25) [0x55951b62b7e5] The issue is caused by change in openssl >= 3.0.8 in lib-dcryt/dcrypt-openssl3.c method ec_key_get_pub_point_hex(...) in old version (for openssl 1.x) it uses compressed format: EC_POINT_point2hex(g, p, POINT_CONVERSION_COMPRESSED, NULL); in openssl3 version it uses EVP_PKEY_get_octet_string_param(pkey, OSSL_PKEY_PARAM_PUB_KEY, buf, sizeof(buf), &len); but key is created in dcrypt_evp_pkey_from_point(...) with OSSL_PKEY_PARAM_EC_POINT_CONVERSION_FORMAT, "uncompressed" this was working in openssl pre 3.0.8 as compression format was ignored when dumping data and used always compressed format. From https://www.openssl.org/docs/man3.0/man7/EVP_KEYMGMT-EC.html """ Before OpenSSL 3.0.8, the implementation of providers included with OpenSSL always opted for an encoding in compressed format, unconditionally. Since OpenSSL 3.0.8, the implementation has been changed to honor the OSSL_PKEY_PARAM_EC_POINT_CONVERSION_FORMAT parameter, if set, or to default to uncompressed format.""" I don't see simple way how to force compressed format just for dumping data without effecting the key itself. Method that can be used with compression format argument is EC_POINT_point2hex but it requires quite lengthy extraction of EC_POINT first. I've tried this for testing with: static const char *ec_key_get_pub_point_hex(const EVP_PKEY *pkey) { if (!EVP_PKEY_is_a(pkey, "EC")) return NULL; size_t len; EVP_PKEY_get_utf8_string_param(pkey, OSSL_PKEY_PARAM_GROUP_NAME, NULL, 0, &len); buffer_t *parambuf = t_buffer_create(len+1); EVP_PKEY_get_utf8_string_param(pkey, OSSL_PKEY_PARAM_GROUP_NAME, (char *)parambuf->data, len+1, &len); int nid = OBJ_txt2nid(parambuf->data); EVP_PKEY_get_octet_string_param(pkey, OSSL_PKEY_PARAM_PUB_KEY, NULL, 0, &len); parambuf = t_buffer_create(len+1); EVP_PKEY_get_octet_string_param(pkey, OSSL_PKEY_PARAM_PUB_KEY, (unsigned char *)parambuf->data, len+1, &len); EC_GROUP *ec_grp = EC_GROUP_new_by_curve_name(nid); if (ec_grp == NULL) return NULL; EC_POINT *point = EC_POINT_new(ec_grp); if (point == NULL) { EC_GROUP_free(ec_grp); return NULL; } if (!EC_POINT_oct2point(ec_grp, point, parambuf->data, len, NULL)) return NULL; char *ret = EC_POINT_point2hex(ec_grp, point, POINT_CONVERSION_COMPRESSED, NULL); EC_GROUP_free(ec_grp); EC_POINT_free(point); return ret; } and it fixed the issue, but there may be an easier way how to achieve that. Cheers Michal Hlavinka

3 6

Question about namespaces
by J Doe 21 Aug '23

21 Aug '23

Hello, I have a question regarding namespaces. My current dovecot.conf is rather basic when it comes to namespaces - I have one private namespace per user: namespace inbox { type = private separator = / inbox = yes hidden = no list = yes subscriptions = yes } I have some users who connect via more than one client - for instance, some use Apple Mail in addition to Roundcube. I have noticed that different mail clients sometimes create similar mailboxes, such as Trash and Deleted Items. I would like the same mailboxes across any client, so I am wondering if there is a way in Dovecot to specify the folders and have the *client* not create them. For instance, a config in dovecot.conf that specifies a Trash folder and the mail clients cannot create "Deleted Items", etc. in addition to this. Is this possible ? Thanks, - J

1 0

Backing up m(d)box - rsync?
by donotspam＠fastmail.fm 19 Aug '23

19 Aug '23

Hello, I manage a small number of email accounts for a voluntary organisation on a shared hosting platform. $ dovecot --version 2.3.13 (89f716dc2) I would like to keep automated local backups, but do not have access to doveadm. I have seen a couple of forum posts where users have have suggested that using rsync to backup m(d)box folders can corrupt dovecot's indexes, but there is no further explanation, and this is apparently not a problem for maildir. Our host seems to use mdbox. Does doveadm provide some sort of transaction/locking mechanism to prevent consistency problems? Others seem to recommend using tar but I don't see what difference that should make. Given that cpanel backups (provided as tar.gz archives of the home directory) include mail/ and seem to be copies of the filesystem at a particular time (though not true "snapshots" as such), aren't these just as "safe" as an rsync-ed backup? Can anyone confirm/deny/shed any light on the issue(s), if indeed any? Many thanks, Gareth

5 7

last_login using fs:posix does not autocreate the last-login directory
by karl＠denninger.net 13 Aug '23

13 Aug '23

I am using the last_login plug-in on a relatively small system to populate the last access time for users in the directory format. I don't want to have this go into an SQL database or similar as the userbase is small and shell access to the information for other purposes is useful. I have this in the conf.d directory under the configuration dir in 20-lastlogin.conf: protocol imap { mail_plugins = $mail_plugins last_login } plugin { last_login_dict = fs:posix:prefix=/var/run/dovecot/ } This works except that while the prefix is there the "last-login" directory under the prefix gets removed on restart (as you think it might) and I can't find an example of how to have it auto-created. This results in a bunch of logged errors until I re-create that working directory under the base. Am I missing something obvious?

2 4

dovecot passes zero byte input stream when passing email with .eml attachment to apache tika parser, causes 'SEVERE' error
by pgnd 13 Aug '23

13 Aug '23

revisiting a prior, never resolved issue tika 2.4.1 'Text extraction failed' errors when dovecot+fts 2.3.19.1 passes embedded *.eml (message/rfc822) files ; org.apache.tika.parser.mail.RFC822Parser or dovecot ? https://dovecot.org/list/dovecot/2022-August/125085.html i now run dovecot --version 2.3.20 (80a5ac675d) with dovecot23_fts_flatcurve built 20230812 from git.HEAD on lsb_release -rd Description: Fedora release 38 (Thirty Eight) Release: 38 apache/tika 2.8.0 runs on another box dovecot passes mail to tika, via config fts_tika = http://192.0.2.20:9998/tika/ indexing & search work with simple mail passed, and with attachments ... except with .eml attachments. sending this message (plain txt email, with .eml as attachment) Content-Type: multipart/mixed; boundary="------------O6z0p865JVYqnvxPyzc0aSLA" Message-ID: <0b7f5053-05b5-4b4f-8c7e-4a640b79a5f4(a)fastmail.fm> Date: Sat, 12 Aug 2023 19:37:44 -0400 MIME-Version: 1.0 User-Agent: Mozilla Thunderbird Reply-To: sender(a)example1.com From: sender <sender(a)example1.com> Content-Language: en-US To: recipient(a)example2.com Subject: tika test This is a multi-part message in MIME format. --------------O6z0p865JVYqnvxPyzc0aSLA Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 8bit Â tika test --------------O6z0p865JVYqnvxPyzc0aSLA Content-Type: message/rfc822; name="t2.eml" Content-Disposition: attachment; filename="t2.eml" Content-Transfer-Encoding: 8bit Message-ID: <89e5914a-e928-422d-824f-5b4e90170cd7(a)fastmail.fm> Date: Sat, 12 Aug 2023 14:32:48 -0400 MIME-Version: 1.0 User-Agent: Mozilla Thunderbird Reply-To: sender(a)example1.com From: sender <sender(a)example1.com> Content-Language: en-US To: recipient(a)example2.com Subject: t2 Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 8bit Â t2 --------------O6z0p865JVYqnvxPyzc0aSLA-- from an off-site server to local postfix+dovecot instance tika & dovecot logs, journalctl -f -u tika Aug 12 19:52:36 svr04tika[2035]: INFO [qtp1472012329-175] 19:52:36,918 org.apache.tika.server.core.TikaLoggingFilter Request URI: http://192.0.2.20:9998/tika/ Aug 12 19:52:36 svr04tika[2035]: INFO [qtp1472012329-175] 19:52:36,918 org.apache.tika.server.core.resource.TikaResource /tika (message/rfc822) Aug 12 19:52:36 svr04tika[2035]: WARN [qtp1472012329-175] 19:52:36,918 org.apache.tika.server.core.resource.TikaResource tika/: Text extraction failed (t2.eml) Aug 12 19:52:36 svr04tika[2035]: org.apache.tika.exception.ZeroByteFileException: InputStream must have > 0 bytes Aug 12 19:52:36 svr04tika[2035]: at org.apache.tika.parser.AutoDetectParser.parse(AutoDetectParser.java:185) ~[tika-server-standard-2.8.0.jar:2.8.0] Aug 12 19:52:36 svr04tika[2035]: at org.apache.tika.parser.ParserDecorator.parse(ParserDecorator.java:152) ~[tika-server-standard-2.8.0.jar:2.8.0] Aug 12 19:52:36 svr04tika[2035]: at org.apache.tika.parser.DigestingParser.parse(DigestingParser.java:57) ~[tika-server-standard-2.8.0.jar:2.8.0] Aug 12 19:52:36 svr04tika[2035]: at org.apache.tika.server.core.resource.TikaResource.parse(TikaResource.java:357) ~[tika-server-standard-2.8.0.jar:2.8.0] Aug 12 19:52:36 svr04tika[2035]: at org.apache.tika.server.core.resource.TikaResource.lambda$produceText$1(TikaResource.java:507) ~[tika-server-standard-2.8.0.jar:2.8.0] Aug 12 19:52:36 svr04tika[2035]: at org.apache.cxf.jaxrs.provider.BinaryDataProvider.writeTo(BinaryDataProvider.java:177) ~[tika-server-standard-2.8.0.jar:2.8.0] Aug 12 19:52:36 svr04tika[2035]: at org.apache.cxf.jaxrs.utils.JAXRSUtils.writeMessageBody(JAXRSUtils.java:1651) ~[tika-server-standard-2.8.0.jar:2.8.0] Aug 12 19:52:36 svr04tika[2035]: at org.apache.cxf.jaxrs.interceptor.JAXRSOutInterceptor.serializeMessage(JAXRSOutInterceptor.java:249) ~[tika-server-standard-2.8.0.jar:2.8.0] Aug 12 19:52:36 svr04tika[2035]: at org.apache.cxf.jaxrs.interceptor.JAXRSOutInterceptor.processResponse(JAXRSOutInterceptor.java:122) ~[tika-server-standard-2.8.0.jar:2.8.0] Aug 12 19:52:36 svr04tika[2035]: at org.apache.cxf.jaxrs.interceptor.JAXRSOutInterceptor.handleMessage(JAXRSOutInterceptor.java:84) ~[tika-server-standard-2.8.0.jar:2.8.0] Aug 12 19:52:36 svr04tika[2035]: at org.apache.cxf.phase.PhaseInterceptorChain.doIntercept(PhaseInterceptorChain.java:307) ~[tika-server-standard-2.8.0.jar:2.8.0] Aug 12 19:52:36 svr04tika[2035]: at org.apache.cxf.interceptor.OutgoingChainInterceptor.handleMessage(OutgoingChainInterceptor.java:90) ~[tika-server-standard-2.8.0.jar:2.8.0] Aug 12 19:52:36 svr04tika[2035]: at org.apache.cxf.phase.PhaseInterceptorChain.doIntercept(PhaseInterceptorChain.java:307) ~[tika-server-standard-2.8.0.jar:2.8.0] Aug 12 19:52:36 svr04tika[2035]: at org.apache.cxf.transport.ChainInitiationObserver.onMessage(ChainInitiationObserver.java:121) ~[tika-server-standard-2.8.0.jar:2.8.0] Aug 12 19:52:36 svr04tika[2035]: at org.apache.cxf.transport.http.AbstractHTTPDestination.invoke(AbstractHTTPDestination.java:265) ~[tika-server-standard-2.8.0.jar:2.8.0] Aug 12 19:52:36 svr04tika[2035]: at org.apache.cxf.transport.http_jetty.JettyHTTPDestination.doService(JettyHTTPDestination.java:247) ~[tika-server-standard-2.8.0.jar:2.8.0] Aug 12 19:52:36 svr04tika[2035]: at org.apache.cxf.transport.http_jetty.JettyHTTPHandler.handle(JettyHTTPHandler.java:79) ~[tika-server-standard-2.8.0.jar:2.8.0] Aug 12 19:52:36 svr04tika[2035]: at org.eclipse.jetty.server.handler.HandlerWrapper.handle(HandlerWrapper.java:127) ~[tika-server-standard-2.8.0.jar:2.8.0] Aug 12 19:52:36 svr04tika[2035]: at org.eclipse.jetty.server.handler.ScopedHandler.nextHandle(ScopedHandler.java:235) ~[tika-server-standard-2.8.0.jar:2.8.0] Aug 12 19:52:36 svr04tika[2035]: at org.eclipse.jetty.server.handler.ContextHandler.doHandle(ContextHandler.java:1440) ~[tika-server-standard-2.8.0.jar:2.8.0] Aug 12 19:52:36 svr04tika[2035]: at org.eclipse.jetty.server.handler.ScopedHandler.nextScope(ScopedHandler.java:190) ~[tika-server-standard-2.8.0.jar:2.8.0] Aug 12 19:52:36 svr04tika[2035]: at org.eclipse.jetty.server.handler.ContextHandler.doScope(ContextHandler.java:1355) ~[tika-server-standard-2.8.0.jar:2.8.0] Aug 12 19:52:36 svr04tika[2035]: at org.eclipse.jetty.server.handler.ScopedHandler.handle(ScopedHandler.java:141) ~[tika-server-standard-2.8.0.jar:2.8.0] Aug 12 19:52:36 svr04tika[2035]: at org.eclipse.jetty.server.handler.ContextHandlerCollection.handle(ContextHandlerCollection.java:191) ~[tika-server-standard-2.8.0.jar:2.8.0] Aug 12 19:52:36 svr04tika[2035]: at org.eclipse.jetty.server.handler.HandlerWrapper.handle(HandlerWrapper.java:127) ~[tika-server-standard-2.8.0.jar:2.8.0] Aug 12 19:52:36 svr04tika[2035]: at org.eclipse.jetty.server.Server.handle(Server.java:516) ~[tika-server-standard-2.8.0.jar:2.8.0] Aug 12 19:52:36 svr04tika[2035]: at org.eclipse.jetty.server.HttpChannel.lambda$handle$1(HttpChannel.java:487) ~[tika-server-standard-2.8.0.jar:2.8.0] Aug 12 19:52:36 svr04tika[2035]: at org.eclipse.jetty.server.HttpChannel.dispatch(HttpChannel.java:732) ~[tika-server-standard-2.8.0.jar:2.8.0] Aug 12 19:52:36 svr04tika[2035]: at org.eclipse.jetty.server.HttpChannel.handle(HttpChannel.java:479) ~[tika-server-standard-2.8.0.jar:2.8.0] Aug 12 19:52:36 svr04tika[2035]: at org.eclipse.jetty.server.HttpConnection.onFillable(HttpConnection.java:277) ~[tika-server-standard-2.8.0.jar:2.8.0] Aug 12 19:52:36 svr04tika[2035]: at org.eclipse.jetty.io.AbstractConnection$ReadCallback.succeeded(AbstractConnection.java:311) ~[tika-server-standard-2.8.0.jar:2.8.0] Aug 12 19:52:36 svr04tika[2035]: at org.eclipse.jetty.io.FillInterest.fillable(FillInterest.java:105) ~[tika-server-standard-2.8.0.jar:2.8.0] Aug 12 19:52:36 svr04tika[2035]: at org.eclipse.jetty.io.ChannelEndPoint$1.run(ChannelEndPoint.java:104) ~[tika-server-standard-2.8.0.jar:2.8.0] Aug 12 19:52:36 svr04tika[2035]: at org.eclipse.jetty.util.thread.QueuedThreadPool.runJob(QueuedThreadPool.java:883) ~[tika-server-standard-2.8.0.jar:2.8.0] Aug 12 19:52:36 svr04tika[2035]: at org.eclipse.jetty.util.thread.QueuedThreadPool$Runner.run(QueuedThreadPool.java:1034) ~[tika-server-standard-2.8.0.jar:2.8.0] Aug 12 19:52:36 svr04tika[2035]: at java.lang.Thread.run(Thread.java:1623) [?:?] Aug 12 19:52:36 svr04tika[2035]: Aug 12, 2023 7:52:36 PM org.apache.cxf.jaxrs.utils.JAXRSUtils logMessageHandlerProblem Aug 12 19:52:36 svr04tika[2035]: SEVERE: Problem with writing the data, class org.apache.tika.server.core.resource.TikaResource$$Lambda$387/0x00000008012a9300, ContentType: text/plain tail -f /var/log/dovecot/*log | grep http-client 2023-08-12 19:52:36 indexer-worker(recipient(a)example2.com)<lrVsHUQb2GR1dgAA+IOfAw:xKZLMEQb2GR3dgAA+IOfAw>: Debug: http-client: host 192.0.2.20: Host created 2023-08-12 19:52:36 indexer-worker(recipient(a)example2.com)<lrVsHUQb2GR1dgAA+IOfAw:xKZLMEQb2GR3dgAA+IOfAw>: Debug: http-client: host 192.0.2.20: Host session created 2023-08-12 19:52:36 indexer-worker(recipient(a)example2.com)<lrVsHUQb2GR1dgAA+IOfAw:xKZLMEQb2GR3dgAA+IOfAw>: Debug: http-client: peer 192.0.2.20:9998 (shared): Peer created 2023-08-12 19:52:36 indexer-worker(recipient(a)example2.com)<lrVsHUQb2GR1dgAA+IOfAw:xKZLMEQb2GR3dgAA+IOfAw>: Debug: http-client: peer 192.0.2.20:9998: Peer pool created 2023-08-12 19:52:36 indexer-worker(recipient(a)example2.com)<lrVsHUQb2GR1dgAA+IOfAw:xKZLMEQb2GR3dgAA+IOfAw>: Debug: http-client: peer 192.0.2.20:9998: Peer created 2023-08-12 19:52:36 indexer-worker(recipient(a)example2.com)<lrVsHUQb2GR1dgAA+IOfAw:xKZLMEQb2GR3dgAA+IOfAw>: Debug: http-client: queue http://192.0.2.20:9998: Setting up connection to 192.0.2.20:9998 (1 requests pending) 2023-08-12 19:52:36 indexer-worker(recipient(a)example2.com)<lrVsHUQb2GR1dgAA+IOfAw:xKZLMEQb2GR3dgAA+IOfAw>: Debug: http-client: peer 192.0.2.20:9998: Linked queue http://192.0.2.20:9998 (1 queues linked) 2023-08-12 19:52:36 indexer-worker(recipient(a)example2.com)<lrVsHUQb2GR1dgAA+IOfAw:xKZLMEQb2GR3dgAA+IOfAw>: Debug: http-client: queue http://192.0.2.20:9998: Started new connection to 192.0.2.20:9998 2023-08-12 19:52:36 indexer-worker(recipient(a)example2.com)<lrVsHUQb2GR1dgAA+IOfAw:xKZLMEQb2GR3dgAA+IOfAw>: Debug: http-client: request [Req1: PUT http://192.0.2.20/tika/] Submitted (requests left=1) 2023-08-12 19:52:36 indexer-worker(recipient(a)example2.com)<lrVsHUQb2GR1dgAA+IOfAw:xKZLMEQb2GR3dgAA+IOfAw>: Debug: http-client: request [Req1: PUT http://192.0.2.20/tika/] Waiting for request to finish 2023-08-12 19:52:36 indexer-worker(recipient(a)example2.com)<lrVsHUQb2GR1dgAA+IOfAw:xKZLMEQb2GR3dgAA+IOfAw>: Debug: http-client: peer 192.0.2.20:9998: Creating 1 new connections to handle requests (already 0 usable, connecting to 0, closing 0) 2023-08-12 19:52:36 indexer-worker(recipient(a)example2.com)<lrVsHUQb2GR1dgAA+IOfAw:xKZLMEQb2GR3dgAA+IOfAw>: Debug: http-client: peer 192.0.2.20:9998: Making new connection 1 of 1 (0 connections exist, 0 pending) 2023-08-12 19:52:36 indexer-worker(recipient(a)example2.com)<lrVsHUQb2GR1dgAA+IOfAw:xKZLMEQb2GR3dgAA+IOfAw>: Debug: http-client: conn 192.0.2.20:9998 [1]: Connecting 2023-08-12 19:52:36 indexer-worker(recipient(a)example2.com)<lrVsHUQb2GR1dgAA+IOfAw:xKZLMEQb2GR3dgAA+IOfAw>: Debug: http-client: conn 192.0.2.20:9998 [1]: Waiting for connect (fd=28) to finish for max 0 msecs 2023-08-12 19:52:36 indexer-worker(recipient(a)example2.com)<lrVsHUQb2GR1dgAA+IOfAw:xKZLMEQb2GR3dgAA+IOfAw>: Debug: http-client: conn 192.0.2.20:9998 [1]: HTTP connection created (1 parallel connections exist) 2023-08-12 19:52:36 indexer-worker(recipient(a)example2.com)<lrVsHUQb2GR1dgAA+IOfAw:xKZLMEQb2GR3dgAA+IOfAw>: Debug: http-client: conn 192.0.2.20:9998 [1]: Client connected (fd=28) 2023-08-12 19:52:36 indexer-worker(recipient(a)example2.com)<lrVsHUQb2GR1dgAA+IOfAw:xKZLMEQb2GR3dgAA+IOfAw>: Debug: http-client: conn 192.0.2.20:9998 [1]: Connected 2023-08-12 19:52:36 indexer-worker(recipient(a)example2.com)<lrVsHUQb2GR1dgAA+IOfAw:xKZLMEQb2GR3dgAA+IOfAw>: Debug: http-client: conn 192.0.2.20:9998 [1]: Ready for requests 2023-08-12 19:52:36 indexer-worker(recipient(a)example2.com)<lrVsHUQb2GR1dgAA+IOfAw:xKZLMEQb2GR3dgAA+IOfAw>: Debug: http-client: peer 192.0.2.20:9998: Successfully connected (1 connections exist, 0 pending) 2023-08-12 19:52:36 indexer-worker(recipient(a)example2.com)<lrVsHUQb2GR1dgAA+IOfAw:xKZLMEQb2GR3dgAA+IOfAw>: Debug: http-client: peer 192.0.2.20:9998: Successfully connected (1 connections exist, 0 pending) 2023-08-12 19:52:36 indexer-worker(recipient(a)example2.com)<lrVsHUQb2GR1dgAA+IOfAw:xKZLMEQb2GR3dgAA+IOfAw>: Debug: http-client: peer 192.0.2.20:9998: Using 1 idle connections to handle 1 requests (1 total connections ready) 2023-08-12 19:52:36 indexer-worker(recipient(a)example2.com)<lrVsHUQb2GR1dgAA+IOfAw:xKZLMEQb2GR3dgAA+IOfAw>: Debug: http-client: queue http://192.0.2.20:9998: Connection to peer 192.0.2.20:9998 claimed request [Req1: PUT http://192.0.2.20:9998/tika/] 2023-08-12 19:52:36 indexer-worker(recipient(a)example2.com)<lrVsHUQb2GR1dgAA+IOfAw:xKZLMEQb2GR3dgAA+IOfAw>: Debug: http-client: conn 192.0.2.20:9998 [1]: Claimed request [Req1: PUT http://192.0.2.20:9998/tika/] 2023-08-12 19:52:36 indexer-worker(recipient(a)example2.com)<lrVsHUQb2GR1dgAA+IOfAw:xKZLMEQb2GR3dgAA+IOfAw>: Debug: http-client: request [Req1: PUT http://192.0.2.20/tika/] Sent header 2023-08-12 19:52:36 indexer-worker(recipient(a)example2.com)<lrVsHUQb2GR1dgAA+IOfAw:xKZLMEQb2GR3dgAA+IOfAw>: Debug: http-client: peer 192.0.2.20:9998: No more requests to service for this peer (1 connections exist, 0 pending) 2023-08-12 19:52:36 indexer-worker(recipient(a)example2.com)<lrVsHUQb2GR1dgAA+IOfAw:xKZLMEQb2GR3dgAA+IOfAw>: Debug: http-client: conn 192.0.2.20:9998 [1]: Got 422 response for request [Req1: PUT http://192.0.2.20:9998/tika/] Unprocessable Entity (took 3 ms + 106 ms in queue) 2023-08-12 19:52:36 indexer-worker(recipient(a)example2.com)<lrVsHUQb2GR1dgAA+IOfAw:xKZLMEQb2GR3dgAA+IOfAw>: Debug: http-client: request [Req1: PUT http://192.0.2.20/tika/] Finished 2023-08-12 19:52:36 indexer-worker(recipient(a)example2.com)<lrVsHUQb2GR1dgAA+IOfAw:xKZLMEQb2GR3dgAA+IOfAw>: Debug: http-client: queue http://192.0.2.20:9998: Dropping request [Req1: PUT http://192.0.2.20:9998/tika/] 2023-08-12 19:52:36 indexer-worker(recipient(a)example2.com)<lrVsHUQb2GR1dgAA+IOfAw:xKZLMEQb2GR3dgAA+IOfAw>: Debug: http-client: host 192.0.2.20: Host is idle (timeout = 100 msecs) 2023-08-12 19:52:36 indexer-worker(recipient(a)example2.com)<lrVsHUQb2GR1dgAA+IOfAw:xKZLMEQb2GR3dgAA+IOfAw>: Debug: http-client: request [Req1: PUT http://192.0.2.20/tika/] Free (requests left=1) 2023-08-12 19:52:36 indexer-worker(recipient(a)example2.com)<lrVsHUQb2GR1dgAA+IOfAw:xKZLMEQb2GR3dgAA+IOfAw>: Debug: http-client: peer 192.0.2.20:9998: No requests to service for this peer (1 connections exist, 0 pending) 2023-08-12 19:52:36 indexer-worker(recipient(a)example2.com)<lrVsHUQb2GR1dgAA+IOfAw:xKZLMEQb2GR3dgAA+IOfAw>: Debug: http-client: conn 192.0.2.20:9998 [1]: No more requests queued; going idle (timeout = 100 msecs) 2023-08-12 19:52:37 indexer-worker(recipient(a)example2.com)<lrVsHUQb2GR1dgAA+IOfAw:xKZLMEQb2GR3dgAA+IOfAw>: Debug: http-client: host 192.0.2.20: Idle host timed out 2023-08-12 19:52:37 indexer-worker(recipient(a)example2.com)<lrVsHUQb2GR1dgAA+IOfAw:xKZLMEQb2GR3dgAA+IOfAw>: Debug: http-client: host 192.0.2.20: Host destroy 2023-08-12 19:52:37 indexer-worker(recipient(a)example2.com)<lrVsHUQb2GR1dgAA+IOfAw:xKZLMEQb2GR3dgAA+IOfAw>: Debug: http-client: host 192.0.2.20: Host session destroy 2023-08-12 19:52:37 indexer-worker(recipient(a)example2.com)<lrVsHUQb2GR1dgAA+IOfAw:xKZLMEQb2GR3dgAA+IOfAw>: Debug: http-client: queue http://192.0.2.20:9998: Destroy 2023-08-12 19:52:37 indexer-worker(recipient(a)example2.com)<lrVsHUQb2GR1dgAA+IOfAw:xKZLMEQb2GR3dgAA+IOfAw>: Debug: http-client: peer 192.0.2.20:9998: Unlinked queue http://192.0.2.20:9998 (0 queues linked) 2023-08-12 19:52:37 indexer-worker(recipient(a)example2.com)<lrVsHUQb2GR1dgAA+IOfAw:xKZLMEQb2GR3dgAA+IOfAw>: Debug: http-client: conn 192.0.2.20:9998 [1]: Idle connection timed out 2023-08-12 19:52:37 indexer-worker(recipient(a)example2.com)<lrVsHUQb2GR1dgAA+IOfAw:xKZLMEQb2GR3dgAA+IOfAw>: Debug: http-client: conn 192.0.2.20:9998 [1]: Connection close 2023-08-12 19:52:37 indexer-worker(recipient(a)example2.com)<lrVsHUQb2GR1dgAA+IOfAw:xKZLMEQb2GR3dgAA+IOfAw>: Debug: http-client: conn 192.0.2.20:9998 [1]: Connection disconnect 2023-08-12 19:52:37 indexer-worker(recipient(a)example2.com)<lrVsHUQb2GR1dgAA+IOfAw:xKZLMEQb2GR3dgAA+IOfAw>: Debug: http-client: conn 192.0.2.20:9998 [1]: Disconnected: Connection closed (fd=28) 2023-08-12 19:52:37 indexer-worker(recipient(a)example2.com)<lrVsHUQb2GR1dgAA+IOfAw:xKZLMEQb2GR3dgAA+IOfAw>: Debug: http-client: conn 192.0.2.20:9998 [1]: Detached peer 2023-08-12 19:52:37 indexer-worker(recipient(a)example2.com)<lrVsHUQb2GR1dgAA+IOfAw:xKZLMEQb2GR3dgAA+IOfAw>: Debug: http-client: peer 192.0.2.20:9998: Lost a connection (0 queues linked, 0 connections left, 0 connections pending, 0 requests pending, 0 requests urgent) 2023-08-12 19:52:37 indexer-worker(recipient(a)example2.com)<lrVsHUQb2GR1dgAA+IOfAw:xKZLMEQb2GR3dgAA+IOfAw>: Debug: http-client: conn 192.0.2.20:9998 [1]: Connection destroy 2023-08-12 19:52:37 indexer-worker(recipient(a)example2.com)<lrVsHUQb2GR1dgAA+IOfAw:xKZLMEQb2GR3dgAA+IOfAw>: Debug: http-client: peer 192.0.2.20:9998: Dropping peer now 2023-08-12 19:52:37 indexer-worker(recipient(a)example2.com)<lrVsHUQb2GR1dgAA+IOfAw:xKZLMEQb2GR3dgAA+IOfAw>: Debug: http-client: peer 192.0.2.20:9998: Peer close unclear 2 me whether this is a bug in dovecot or in tika, or a matter of (mis)config. ??

1 0

sso / sharing authenticated sessions how does it work
by Marc 12 Aug '23

12 Aug '23

I am totally not experienced with setting up sso etc. I was wondering if/how it is possible to share an authenticated session between dovecot and the mail client with the webmail so a user does not need to login again.

1 0

Dovecot submission panics on SMTP RCPT error
by IB Development Team 10 Aug '23

10 Aug '23

Hi, If SMTP server rejects RCPT with message aaa bbbbbbbbbb ccccccc dd eeeeeeeeeeee ffffffffffff gggggggggg hh iiiiii jj kk llll mmmmmmmmmm nnn o ppppppppppppppp rrrrrr ssssss t uuuu w xxxxxxx yyyyyy zzzzzzzz aa bbbbbbbbbbb cccccccc dd eeeeee fff gggggg hhhhhhh iiiiiiii jj kkkkkk ll mm nnnn ooooo ppppppp qqqq r ssss tttttt uuuuuuuuuuuuu www xxx yyyyyyy zzzzz aaaaa bbbbbbbbb ccc ddddddd when submitting message via dovecot submisstion server, dovecot panics: 2023-08-10 17:10:04 myhost exim[...] rejected RCPT <[...]>: aa bbbbbbbbbb ccccccc dd eeeeeeeeeeee ffffffffffff gggggggggg hh iiiiii jj kk llll mmmmmmmmmm nnn o ppppppppppppppp rrrrrr ssssss t uuuu w xxxxxxx yyyyyy zzzzzzzz aa bbbbbbbbbbb cccccccc dd eeeeee fff gggggg hhhhhhh iiiiiiii jj kkkkkk ll mm nnnn ooooo ppppppp qqqq r ssss tttttt uuuuuuuuuuuuu www xxx yyyyyyy zzzzz aaaaa bbbbbbbbb ccc ddddddd 2023-08-10 17:10:04 myhost dovecot: submission(test)<7274><bAOu/ZICuuDAqHoB>: Panic: file smtp-server-reply.c: line 625 (smtp_server_reply_send_real): assertion failed: (text[0] == '-') 2023-08-10 17:10:04 myhost dovecot: submission(test)<7274><bAOu/ZICuuDAqHoB>: Error: Raw backtrace: /usr/lib/dovecot/libdovecot.so.0(backtrace_append+0x42) [0x7f64c8e484e2] -> /usr/lib/dovecot/libdovecot.so.0(backtrace_get+0x1e) [0x7f64c8e485fe] -> /usr/lib/dovecot/libdovecot.so.0(+0xfc49b) [0x7f64c8e5449b] -> /usr/lib/dovecot/libdovecot.so.0(+0xfc531) [0x7f64c8e54531] -> /usr/lib/dovecot/libdovecot.so.0(+0x53aee) [0x7f64c8dabaee] -> /usr/lib/dovecot/libdovecot.so.0(+0x4751c) [0x7f64c8d9f51c] -> /usr/lib/dovecot/libdovecot.so.0(+0x7b605) [0x7f64c8dd3605] -> /usr/lib/dovecot/libdovecot.so.0(+0x122171) [0x7f64c8e7a171] -> /usr/lib/dovecot/libdovecot.so.0(io_loop_call_io+0x69) [0x7f64c8e69f59] -> /usr/lib/dovecot/libdovecot.so.0(io_loop_handler_run_internal+0x132) [0x7f64c8e6b592] -> /usr/lib/dovecot/libdovecot.so.0(io_loop_handler_run+0x50) [0x7f64c8e6a000] -> /usr/lib/dovecot/libdovecot.so.0(io_loop_run+0x40) [0x7f64c8e6a1c0] -> /usr/lib/dovecot/libdovecot.so.0(master_service_run+0x13) [0x7f64c8de04e3] -> dovecot/submission(main+0x4df) [0x562f3ac7c11f] -> /lib/x86_64-linux-gnu/libc.so.6(__libc_start_main+0xea) [0x7f64c8ba4d0a] -> dovecot/submission(_start+0x2a) [0x562f3ac7c1aa] Error message is configured in exim4.conf with begin routers mytestrouter: [...] cannot_route_message = aa bbbbbbbbbb ccccccc dd eeeeeeeeeeee ffffffffffff gggggggggg hh iiiiii jj kk llll mmmmmmmmmm nnn o ppppppppppppppp rrrrrr ssssss t uuuu w xxxxxxx yyyyyy zzzzzzzz aa bbbbbbbbbbb cccccccc dd eeeeee fff gggggg hhhhhhh iiiiiiii jj kkkkkk ll mm nnnn ooooo ppppppp qqqq r ssss tttttt uuuuuuuuuuuuu www xxx yyyyyyy zzzzz aaaaa bbbbbbbbb ccc ddddddd Dovecot installed from up-to-date Debian 11 package: # dpkg -s dovecot-core | grep Version Version: 1:2.3.13+dfsg1-2+deb11u1 -- Regards, Paweł Bogusławski IB Development Team E: dev(a)ib.pl

2 2

Dovecot and Thunderbird 15
by Elise 10 Aug '23

10 Aug '23

Hi, I recently had some issues with Thunderbird 15 when removing e-mail. With my other mailclient Outlook I could without any issue. As I don't grand POP3 mail pickup, I disabled that in dovecot.conf #service pop3-login { # inet_listener pop3 { # address = 10.10.10.52 # } # inet_listener pop3s { # address = 10.10.10.52 # } #} Enabling the above and restarting Dovecot solved the issue. Is it TB related or do I overlook a config parameter? E.

2 3

Question about custom flags
by d.meister-braeuer＠heinlein-support.de 09 Aug '23

09 Aug '23

Hello all, RFC3501 describes among other things that custom flags can be set for mails. These can be allowed or forbidden in the server: "Servers MAY permit the client to define new keywords in the mailbox". When I am on our server, it also looks like dovecot basically allows this: a select INBOX FLAGS (\Answered \Flagged \Deleted \Seen \Draft $Forwarded Old $ITipAnalyzed $ITipProcessed Forwarded NonJunk $cl_1 $cl_2 $cl_3) OK [PERMANENTFLAGS (\Answered \Flagged \Deleted \Seen \Draft $Forwarded Old $ITipAnalyzed $ITipProcessed Forwarded NonJunk $cl_1 $cl_2 $cl_3 \*)] Flags permitted. The only option that goes in this direction is this one: mail_max_keyword_length But basically describes something else as well, if I see it correctly. Is there a way to prevent dovecot from giving custom flags, or what is the name of the parameter where you can set this? Best

1 0

Outlook not showing all email in inbox at random
by David Koski 09 Aug '23

09 Aug '23

I manage IT for a small office with about 10 workstations. Dovecot has been installed for years and is now at 2.3.4.1-5 (Debian). I just discovered that the user cannot see many emails in the inbox. I was alerted when email was not appearing to be coming in for many hours. Other users observed the same thing. On investigation, I noticed many inbox emails missing in the Outlook GUI from times past that were on the server. It appears to be a broken client (Outlook 2019) to me but troubleshooting has yielded no solid leads. The profile and OST files have been re-created many times with no change in outcome. Each time, the inbox does not synchronize about 40 most recent emails but does for the last one for the day before and many before that. It may well be an Outlook issue so I'm looking for information to work around an Outlook bug if necessary. Thunderbird works perfectly. Also, interestingly, I can copy email from Thunderbird (or move emails on the server) to a temporary directory form the inbox, then move them back and they will appear if I don't move too many at a time. Regards, David Koski dkoski(a)sutinen.com

4 7

Application to automate mail-crypt plugin with user keys
by Benedikt Zumtobel 08 Aug '23

08 Aug '23

Hi everyone, I run a very small (about 10 users) mailserver setup with the mail-crypt plugin activated and wanted to transition from a global key setup to user keys. Since I couldn't find a satisfying solution to reencrypt mailboxes when users change their password I started writing a script that ended up being a small webservice giving users a simple selfservice portal to change their password. I consider it pretty much done by now and it's public on github. Maybe it's useful for somebody else. However its use case is very narrow since I initially wrote this just for myself. It does only support a Postgres user store for instance. The main reason, however, for this post is me wondering if anybody would bother to give me some feedback. Especially for the following aspects: I execute doveadm from within my application. The advantage is that I can keep the code very light (~650 lines of code) while at the same time don't have to care about the crypto stuff which I wouldn't dare trying anyways. The disadvantage of this approach is that I had to write a doveadm wrapper that needs the setuid bit to execute doveadm mailbox commands. I consider this a bit hacky but a better solution didn't come to my mind. Another aspect is the password that is being used to encrypt the private key. When creating a new user in the database I generate a unique salt. This salt is prefixed to the user's clear text password and the resulting string is run trough the sha3-512 hash function. The output is the mail_crypt_private_password. You find the project here: https://github.com/nonce9/pwch Criticism is welcome. Benedikt

4 3

Dovecot bug submit - Dovecot stats
by Brent Clark 07 Aug '23

07 Aug '23

Good day Guys Just a brief background, Im looking to enable and run doveadm stats, as per https://doc.dovecot.org/configuration_manual/stats/ When I run the command: doveadm stats add --description "IMAP SELECT commands" --exporter log-exporter --exporter-include "name timestamps" --fields "bytes_in bytes_out" --group-by "cmd_name tagged_reply_state" imap_cmd_select "event=imap_command_finished AND name=SELECT" I get: ==> /var/log/mail.info <== Aug 3 05:52:36 bullseye dovecot: stats: Error: Raw backtrace: /usr/lib/dovecot/libdovecot.so.0(backtrace_append+0x42) [0x7f08c7097582] -> /usr/lib/dovecot/libdovecot.so.0(backtrace_get+0x1e) [0x7f08c709769e] -> /usr/lib/dovecot/libdovecot.so.0(+0x1022fb) [0x7f08c70a42fb] -> /usr/lib/dovecot/libdovecot.so.0(+0x102391) [0x7f08c70a4391] -> /usr/lib/dovecot/libdovecot.so.0(+0x55589) [0x7f08c6ff7589] -> dovecot/stats(+0x5aa5) [0x561765217aa5] -> dovecot/stats(stats_metrics_add_dynamic+0x11f) [0x56176521a80f] -> dovecot/stats(+0x6724) [0x561765218724] -> /usr/lib/dovecot/libdovecot.so.0(connection_input_default+0x155) [0x7f08c709bd05] -> /usr/lib/dovecot/libdovecot.so.0(io_loop_call_io+0x69) [0x7f08c70ba529] -> /usr/lib/dovecot/libdovecot.so.0(io_loop_handler_run_internal+0x132) [0x7f08c70bbc12] -> /usr/lib/dovecot/libdovecot.so.0(io_loop_handler_run+0x50) [0x7f08c70ba5d0] -> /usr/lib/dovecot/libdovecot.so.0(io_loop_run+0x40) [0x7f08c70ba790] -> /usr/lib/dovecot/libdovecot.so.0(master_service_run+0x13) [0x7f08c702d353] -> dovecot/stats(main+0x128) [0x561765217e38] -> /lib/x86_64-linux-gnu/libc.so.6(__libc_start_main+0xea) [0x7f08c6ca8d0a] -> dovecot/stats(_start+0x2a) [0x561765217eba] ==> /var/log/mail.warn <== Aug 3 06:23:51 bullseye dovecot: stats: Fatal: master: service(stats): child 38121 killed with signal 6 (core dumped) I installed and run systemd-coredump, dovecot-sysreport Please will you take a look at the various attached files (coredumps etc) Many thanks. Kind Regards Brent Clark

2 1

doveadm fts lookup: Is "search query" documented anywhere?
by Graham Leggett 07 Aug '23

07 Aug '23

Hi all, According to the —help option for doveadm fts, there is a “lookup” option as follows: [root@aurora ~]# doveadm fts --help usage: doveadm [-Dv] [-f <formatter>] fts <command> [<args>] expand [-u <user>|-A] [-S <socket_path>] <search query> lookup [-u <user>|-A] [-S <socket_path>] <search query> optimize [-u <user>|-A] [-S <socket_path>] [<namespace>] rescan [-u <user>|-A] [-S <socket_path>] [<namespace>] tokenize [-u <user>|-A] [-S <socket_path>] <text> The option does not appear to be documented anywhere (eg https://doc.dovecot.org/3.0/man/doveadm-fts.1/) and “search query” doesn’t appear to be defined. Guessing that it might be just plain text, I tried searching for a known word, but this failed as follows: [root@aurora ~]# doveadm fts lookup -u test(a)example.com sweet Fatal: Unknown argument SWEET Anyone know? Regards, Graham —

2 2

Trash deleted date?
by joe a 07 Aug '23

07 Aug '23

Using Thunderbird client. Cannot sort "Trash" Folder by time/date deleted. I can display both "Received" and "Date" columns, but they show identical data. Does dovecot create a "deleted" time stamp? dovecote 2.3.20 (80a5ac675d) TB 102.14.0 64 bit

1 0

passwdb deny.ip
by mauric＠gmx.ch 06 Aug '23

06 Aug '23

Hello i understod in the last discussion thread <Forcing imap authentication failure for certain IP addresses> that also IP can be filter, ok the ip are available in deny.ip. Please why this are not blocked? # dovecot version 2.3.4.1 (f79e8e7e4) passdb { args = /etc/dovecot/deny.ip args = /etc/dovecot/dovecot-sql.conf.ext driver = sql } cat mail.log | grep 'sql(name,' Aug 06 01:29:11 Dovecot/auth-worker(7927): Info: sql(Name,A.B.232.146): unknown user # cat deny.ip | grep A.B.232.146 A.B.232.146 meny thanks

3 3

mail-crypt long-term support? How to backup?
by eaerhaerhaehae aehraerhaeha 05 Aug '23

05 Aug '23

3 6

Dovecot shared folders - examples of the "doveadm acl" command?
by Graham Leggett 05 Aug '23

05 Aug '23

Hi all, The old wiki has been taken down, and all the links I can find through google are now broken. Does anyone have a concrete example of “doveadm acl” to grant someone access to a shared folder? Regards, Graham —

2 2

fail2ban / ldap login failure
by micha＠micha.waw.pl 05 Aug '23

05 Aug '23

[Debian Bookworm + Dovecot 2] I have user database in ldap (samba). I want to use fail2ban to restrict unsuccessful login attempts, but... I cannot see "Authentication failure" message in ANY log. (/var/log/mail.log shows successful logins as well as disconnects.) How should I proceed?

2 1

Pigeonhole redirect is adding a message-id header when it already exists
by Sébastien Riccio 04 Aug '23

04 Aug '23

Hello, We are using sieve filter to redirect incoming mails to an external mailbox (gmail) an we are seeing some forwarded e-mails being rejected by gmail because of duplicate headers. I think was able to identify the probable cause of the duplicate headers: It seems that when the original message's "Message-ID" is not compliant, pigeonhole acts like if the header is not existing and adds it's own Message-ID. This result in having two "Message-ID" headers being submitted to the destination mail server. Original Message-ID: Message-ID: 1883biz_pay_after_purchase:0:0_572392900$ae7ed6e4d53b424c84aaf83b30c507e7 Pigeon hole adds his own Message-ID: Message-ID: <dovecot-sieve-1664386049-21512-0@510faa1ff2d9> Gmail answer: 550-5.7.1 [94.103.100.17] Our system has detected that this message is not RFC 550-5.7.1 5322 compliant: duplicate headers. To reduce the amount of spam sent 550-5.7.1 to Gmail, this message has been blocked. Please review 550 5.7.1 RFC 5322 specifications for more information. While I understand the original "Message-ID" seems to be all but compliant with RFCs, shouldn't a "Message-ID" be added only when "Message-ID" is really missing ? When redirecting a message, If the original "Message-ID" exists but is bogus shouldn't it still be forwarded untouched ? Also, maybe if pigeonhole is adding it's own "Message-ID", shouldn't it remove any previous "Message-ID" to avoid generating duplicate headers ? (but maybe it could break some DKIM stuff?) Any ideas how to workaround this issue ? Thanks a lot for your feedbacks! Sébastien RICCIO SYSTEM ADMINISTRATOR P +41 840 888 888 F +41 840 888 000 M sriccio(a)swisscenter.com<mailto:sriccio@swisscenter.com>

9 17

Using / in folder names
by Scott 04 Aug '23

04 Aug '23

Is this possible at all ? I am trying to import a PST file and it has a slash in the folder name. Dovecot errors out with : APPEND "Caixa de Entrada_VIDA/S1" (\Seen) NO [CANNOT] Invalid mailbox name: Name must not have '/' characters My namespace separator is the dot and I configured the listescape plugin to escape / but it still doesn't work. The listescape documentation says: The / character is disallowed on POSIX systems. This plugin allows you to use all of these characters, as long as the virtual separator (i.e. what is set by the separator setting and used as such by the IMAP protocol) is changed to something else, which means that the plugin does not make it possible to use the virtual separator in folder names. So it seems that as long as I use the dot, it should work ? Except it doesn't... How can I do this import ? Thank you!

3 9

RE: Forcing imap authentication failure for certain IP addresses
by aki.tuomi 02 Aug '23

02 Aug '23

One way is to use https://doc.dovecot.org/configuration_manual/authentication/auth_policy/or you can use passdb { driver = passwd-file deny = yes args = username_formar=%{rip} /etc/dovecot/deny.ip}or you can use https://doc.dovecot.org/configuration_manual/authentication/lua_based_authe… write this in Lua.Aki -------- Original message --------From: Hippo Man <hippoman(a)gmail.com> Date: 8/1/23 18:14 (GMT+02:00) To: dovecot(a)dovecot.org Subject: Forcing imap authentication failure for certain IP addresses I'm running dovecot 2.3.18 under Debian 11.I want to do something that's a bit unusual: when IMAP connections are attemptedfrom a few specific IP addresses, I want to force an IMAP authentication failurefrom those connections, no matter what user ID and password are specified.I know that I can use iptables to completely block imap access from those IPaddresses to the IMAP ports. However, in these specific cases, I'd prefer thatthe connection goes through to dovecot, but for dovecot then to always generateauthentication failures for those specific connections ... even if a validuser ID and password happen to be specified.Is there a way to do this in dovecot?Thank you very much in advance.-- hippoman(a)gmail.com Take a hippopotamus to lunch today. .---------, 0__0 / ( oo'---, / oo\ ,\ | | \ ,=__/ \ / / /------| /| |__|-' |__|'

3 5

sieve passing body as arguments to executed script
by Jonathan Davis 02 Aug '23

02 Aug '23

I ran into an issue when trying to wildcard match the email body where the variable was empty, which lead me to extracttext and forverypart, however I am running into an odd error. When I deliver an email with the body of 'this is the body text of email' it dies with the following error: sogo: line 236: error: specified :args item `this is the body text of email??' is invalid The sieve in question: if header :matches "Subject" "*" { set "emailsubject" "${1}"; } if header :matches "From" "*" { set "emailfrom" "${1}"; } foreverypart { if header :mime :type :is "Content-Type" "text" { extracttext :first 80 "emailbody"; break; } } execute "script.php" ["${emailfrom}", "${emailsubject}", "${emailbody}"]; I tried downloading the log to see if ?? was a character not rendering correctly in console, but local text editors show the same. I'm not sure where it is coming from or what it is. I tried :quotewildcard with set :quotewildcard "quotedbody" ${emailbody}"; And passed "${quotedbody}" as an argument, however the same error was appearing in the logs. If I'm approaching this problem incorrectly, the end result is I want to pass the entire contents of the email to the script. - Jonathan

1 0

Postlogin script ACL_GROUPS from LDAP
by Andrzej Milewski 01 Aug '23

01 Aug '23

Hello, I am testing the Dovecot mail server with the iRedMail configuration. My backend is based on LDAP. I would like to set up the "Public" folders in such a way as to grant permissions to specific groups of users. To achieve this, I created the following entry in the configuration: acl = vfile:/etc/dovecot/dovecot-acl-global:cache_secs=300 For individual users, the global permissions work correctly, and I achieve what I want. However, I am unsure how to grant permissions for a group. Specifically, I know that I should include permissions for groups in this file, for example: Public/ anyone l Public/IT_Suwalki group=grupa1 lrwstipek Public/IT_Suwalki/* group=grupa1 lrwstipekxa But I don't know how to associate users with groups. From what I managed to figure out, the user should have the "ACL_GROUPS=grupa1,grupa2" variable, and it should be passed by the postlogin script. But how can I do that? Do you have any working example of such a script? Which LDAP attributes should this script utilize? In my LDAP, there is an attribute called "memberOfGroup"; can I use it? Thank you for all the suggestions. -- Andrzej Milewski andrzej.milewski(a)gmail.com tel. 0603957324

1 0

Imaptest sigfault error
by DeJa Wu 31 Jul '23

31 Jul '23

I Tried to run the test with imaptest and got a segfault error. Debug: Reading symbols from imaptest...done. (gdb) run user="puser%d(a)am.local" users=0-100000 pass=Us123456 host=ha-rr.am.local ssl=any-cert clients=100000 port=993 - secs=300 no_pipelining Starting program: /usr/bin/imaptest user="puser%d(a)am.local" users=0-100000 pass=Us123456 host=ha-rr.am.local ssl=any-cert clients=100000 port=993 - secs=300 no_pipelining [Thread debugging using libthread_db enabled] Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1". Logi Sele Logo 100% 100% 100% 179 163 154 551/637 [0%] 245 247 250 1153/1372 [1%] 238 240 238 1725/2086 [2%] 213 215 219 2250/2725 [2%] 213 209 203 2760/3364 (263 stalled >3s) [3%] 220 226 228 3308/4024 (854 stalled >3s) [4%] 247 245 247 3870/4765 (1338 stalled >3s) [4%] 239 237 239 4414/5482 (1800 stalled >3s) [5%] 259 257 259 4998/6259 (2299 stalled >3s) [6%] 270 274 271 5599/7069 (2809 stalled >3s) [7%] 3843 46 26 ms/cmd avg Logi Sele Logo 100% 100% 100% 243 242 237 6122/7798 (3369 stalled >3s) [7%] 242 239 237 6697/8524 (3937 stalled >3s) [8%] 241 241 248 7251/9247 (4542 stalled >3s) [9%] 229 231 234 7776/9934 (5143 stalled >3s) [9%] 230 228 225 8332/10624 (5800 stalled >3s) [10%] Program received signal SIGSEGV, Segmentation fault. 0x00007ffff7f1745f in io_loop_handler_run_internal () from /usr/lib/dovecot/libdovecot.so.0 How can I fix this?

2 1

Notification "API" for external replication
by Heiko Schlittermann 31 Jul '23

31 Jul '23

Hi Aki and all the Dovecot team, thank you for your work on Dovecot. As the "built-in" replication is going to cease (I do not want to discuss the reasoning or any judgement here): Can you (the Dovecot developers) ensure that a kind of "notification socket"¹ will be there, even if you do not provide a the replicator feature? And - but that's already a feature request - could you use this (or an other socket) for notifications on sieve script changes? I can imagine using this socket as an "official" interface to external software. Actually that would implicate that the notification messages are documented and stable, but I'm sure, this would be possible (if not done already). ¹) That is how I understand the current mechanism of the replication: the replicator gets a notification via the socket and starts replicating the mailbox. Best regards from Dresden/Germany Viele Grüße aus Dresden Heiko Schlittermann -- SCHLITTERMANN.de ---------------------------- internet & unix support - Heiko Schlittermann, Dipl.-Ing. (TU) - {fon,fax}: +49.351.802998{1,3} - gnupg encrypted messages are welcome --------------- key ID: F69376CE -

2 1

Accessing SSL parameters via dovecot variables
by Graham Leggett 26 Jul '23

26 Jul '23

Hi all, Dovecot supports variables, which can be used in filters. Does the SSL code expose variables linked to the client certificate? The answer today appears to be no, and if that’s true I plan to patch it, but just need to confirm I am not missing something. Regards, Graham —

2 2

Filtering by SASL auth mechanism
by Graham Leggett 26 Jul '23

26 Jul '23

Hi all, I want dovecot to behave differently depending on what SASL mechanism was used. Most specifically, if EXTERNAL, I want auth_ssl_username_from_cert to be yes, but no otherwise. There is a filtering mechanism that supports protocol, remote, etc. https://doc.dovecot.org/configuration_manual/config_file/ Would it make sense to add a SASL mechanism filter like this: mechanism external { # … } Regards, Graha —

1 0

SASL External and LDAP - Login attempt with empty password
by Graham Leggett 26 Jul '23

26 Jul '23

Hi all, I am trying to configure dovecot to accept SASL EXTERNAL authentication with a client certificate and no password. I have tried the following configuration: passdb { driver = ldap # Path for LDAP configuration file, see example-config/dovecot-ldap.conf.ext args = /etc/dovecot/dovecot-ldap-external.conf.ext mechanisms = external default_fields = noauthenticate=y } In the logs I see dovecot correctly negotiate SASL EXTERNAL, but eventually we reach this line and we fail: https://github.com/dovecot/core/blob/34a18f5a79bf7eca58e55aff3e1fe69468292d… Which is in turn reached by following this code: https://github.com/dovecot/core/blob/34a18f5a79bf7eca58e55aff3e1fe69468292d… In theory, if I understand this correctly, what is missing is a field to say “don’t try check any password”, which field is this supposed to be? “nopassword”? “noauthenticate”? I am happy to patch this, but need some guidance as what the correct approach is. Regards, Graham —

1 0

Quota possibly overcomplicating, need sanity check?
by David Mehler 25 Jul '23

25 Jul '23

Hello, New setup and trying to get quotas going. It's a Dovecot/Postfix/Mariadb virtual user setup. In my db I have a varchar field called quota with a default value of 128. Here's what I have in dovecot configs for quota: # Plugins mail_plugins = acl mail_crypt quota service stats { fifo_listener stats-mail { user = vmail mode = 0644 } inet_listener { address = 127.0.0.1 port = 24242 } } # quota status service quota-status { executable = quota-status -p postfix unix_listener /var/spool/postfix/private/dovecot-quota { user = postfix group = postfix mode = 0660 } client_limit = 1 } # Quota warnings service quota-warning { executable = script /usr/local/bin/quota-warning.sh user = vmail unix_listener quota-warning { group = vmail mode = 0660 user = vmail } } plugin { quota = count:User quota quota2 = maildir:Shared quota:ns=public/ quota_max_mail_size = 100M # Required for 'count' quota driver quota_vsizes = yes quota_rule2 = Trash:storage=+10%% quota_rule = *:storage=1G quota_rule2 = Trash:storage=100M quota_rule3 = SPAM:ignore quota_warning = storage=100%% quota-warning +100 %u quota_warning2 = storage=95%% quota-warning +95 %u quota_warning3 = storage=80%% quota-warning +80 %u quota_warning4 = -storage=100%% quota-warning -100 %u # user is no longer over quota quota_exceeded_message = User %u has exhausted allowed storage space. quota_grace = 10%% # 10% is the default quota_status_success = DUNNO quota_status_nouser = DUNNO quota_status_overquota = "552 5.2.2 Mailbox is full" ## Stats ### how often to session statistics (must be set) stats_refresh = 30 secs ### track per-IMAP command statistics (optional) stats_track_cmds = yes } The protocol imap has the imap_quota plugin and protocol lmtp has the quota plugin. I've also got lmtp_rcpt_check_quota = yes mailbox_list_index = yes In my dovecot-sql.conf file my user query looks like this: user_query = SELECT concat('*:storage=', quota, 'M') AS quota_rule FROM accounts WHERE username = '%Ln' AND domain = '%Ld' AND sendonly = false; Postfix checks: check_policy_service unix:private/dovecot-quota Am I overcomplicating? Thanks. Dave.

1 0

mail_crypt on existing mailstore
by David Mehler 25 Jul '23

25 Jul '23

Hello, I've got a pre-existing mailstore, it's a Postfix/Dovecot/Mariadb virtual-user setup, with users and mailboxes. I'd now like to get mail_crypt going. Can I do this with this existing store or if not how would I set this up? Thanks. Dave.

1 0

subscription, dots and subscribe to shared folder.
by Julien Nadal 24 Jul '23

24 Jul '23

Hello; We were able to set up shared folders in a cluster (using dovecot as proxy on dedicated front-end servers, without using director) by following https://doc.dovecot.org/configuration_manual/shared_mailboxes/cluster_setup/. Here is our related conf on imap farms (dovecot v2.3.16 on Almalinux): namespaces: mail_location = maildir:~/Maildir namespace default { inbox = yes location = prefix = separator = / } namespace shared { list = children location = imapc:~/shared/%%u:INDEXPVT=~/shared-pvt/%%u prefix = shared/%%u/ separator = / subscriptions = no type = shared } imapc settings: imapc_features = fetch-bodystructure fetch-headers rfc822.size search modseq acl delay-login imapc_host = XXXXXX imapc_master_user = %{user} imapc_password = XXXXXX imapc_port = XXXXXX passdb { args = password=#hidden_use-P_to_show# userdb_namespace/shared/disabled=yes userdb_acl_user=%{auth_user} allow_nets=XXXXX/XX driver = static master = yes } dict { acl-mysql = mysql:/etc/dovecot/conf.d/dovecot-dict-sql.conf.ext } This way, a folder is created under ~/ : shared & shared-pvt : When user A shares a folder with B, B will find ~/shared/userA/sharedfolder I should mention that the user authentication (backend: mysql) uses the full email address as we are in a multi-tenant context. So the folder looks like ~/shared/usera(a)domain.tld/folder Since then, everything works perfectly, we can share and see the shared folders in the webmail (SOGo). Unfortunately, accessing these folders through an imap client (tested on Thunderbird and MSOutlook) is impossible because the subscription fails (the folder is listed, but the subscription doesn't seem to do anything). I could not find any relevant logs but I was able to confirm on the command line: I am able to view folder with LIST, subscribe with an "OK" output, but the folder is not listed with LSUB. So I could see that the subscribtion file in maildir shows incorrect entries: V 2 Sent Trash Drafts Junk shared/testuser1@sub domain tld/INBOX/folder The dots in the folder names are replaced by tabs. I was able to recover things by editing the file as follows: Sent Trash Drafts Junk shared/testuser1(a)sub.domain.tld/INBOX/folder This means that Maildir++ and V2 subscription can't handle dots in folders. I found a previous discussion: https://dovecot.org/pipermail/dovecot/2021-January/121233.html But the final advice can't be applied on our side: - changing LAYOUT to FS is not possible for us - we have already migrated the dot separator to slash - changing the layout only for shared namespaces does not solve the problem and totally breaks the access to shared folders. Thanks a lot for your advice Best regards Julien

3 4

Outlook and IMAP Flags
by Laura Smith 22 Jul '23

22 Jul '23

Hi I've tried searching the internet, but the only thing I can find is a post on a MIcrosoft forum where a Microsoft reps claims flags are not supported on IMAP (I thought it was an RFC3501 feature ?). Anyway, I have a user who has Outlook/Windows on desktop and iOS (iPhone/iPad) for remote. On the iOS devices, the user can happily set flags against messages with zero issues. And indeed, when they set these flags, they are shown in Outlook. However if they attempt to set the flag in Outlook, nothing happens. Outlook continues showing the message as if it was unflagged. Any ideas ? Laura

2 1

Exclude folders from fts xapian on a per-user basis
by Adam Kessel 21 Jul '23

21 Jul '23

Is there any way for a user to specify folders they want excluded from fts xapian indexing? Or can this only be done globally in /etc?

1 0

Dovecot pigeon/sieve and SELinux
by Graham Leggett 21 Jul '23

21 Jul '23

Hi all, I am in the process of migrating a dovecot installation from RHEL8 to RHEL9, this time round I am trying to get everything to work in selinux enforcing mode. First error I am stuck on is as follows: Error: sieve: file storage: Failed to stat sieve storage path: stat(/var/lib/dovecot/sieve/vacation.sieve) failed: Permission denied (euid=377(vmail) egid=376(vmail) missing +x perm: /var/lib/dovecot, we're not in group 97(dovecot), dir owned by 97:97 mode=0750) It appears that the vmail user cannot access /var/lib/dovecot, because under RHEL9 the permissions are hidden to the world. [root@seawitch dovecot]# ls -al /var/lib/dovecot total 12 drwxr-x---. 3 dovecot dovecot 36 Jul 21 17:51 . Am I correct in interpreting the error message as meaning that /var/lib/dovecot/sieve is not a correct directory for global sieve scripts, and they need to go somewhere else? If they do need to go somewhere else, in the world of enforcing selinux, where do they go? While dovecot-selinux is documented, sieve is not mentioned: https://linux.die.net/man/8/dovecot_selinux So, let’s work around the above error by adding the vmail user to the dovvecot group. Is this even a good idea? /usr/sbin/usermod -a -G dovecot vmail Now we hit the next error: Error: sieve: file storage: Failed to stat sieve storage path: stat(/var/lib/dovecot/sieve/vacation.sieve) failed: Permission denied (euid=380(vmail) egid=378(vmail) missing +w perm: /var/lib/dovecot/sieve/vacation.sieve stat(/var/lib/dovecot/sieve/vacation.sieve) failed: Permission denied, dir owned by 0:0 mode=0755) This error is weird. Dovecot is trying to open the original vacation.sieve source file for write - why? We have pre-compiled all the global sieve scripts: [root@marcopolo ~]# ls -al /var/lib/dovecot/sieve/ total 36 drwxr-xr-x. 5 root root 4096 Jul 21 17:29 . drwxr-x---. 3 dovecot dovecot 36 Jul 21 17:29 .. -rwxr-xr-x. 1 root root 284 Jul 21 08:47 junk.sieve -rw-r--r--. 1 root root 277 Jul 21 17:29 junk.svbin -rwxr-xr-x. 1 root root 316 Jul 21 08:47 report-ham.sieve -rw-r--r--. 1 root root 476 Jul 21 17:29 report-ham.svbin -rwxr-xr-x. 1 root root 201 Jul 21 08:47 report-spam.sieve -rw-r--r--. 1 root root 382 Jul 21 17:29 report-spam.svbin drwxr-xr-x. 2 root root 6 Jul 21 08:47 sieve-execute drwxr-xr-x. 2 root root 6 Jul 21 08:47 sieve-filter drwxr-xr-x. 2 root root 6 Jul 21 08:47 sieve-pipe -rwxr-xr-x. 1 root root 309 Jul 21 08:47 vacation.sieve -rw-r--r--. 1 root root 558 Jul 21 17:29 vacation.svbin Is the error perhaps inaccurate, and it’s trying to open a temp file for write, failing (correctly, it has no business opening a temp file for write at this point), and then claiming the failure on the temp file is a failure on the source file? So to sum up: - In an SELinux world of Redhat, what directory do global sieve scripts go? - What permissions and selinux context are required on the global sieve scripts directory? Regards, Graham —

1 0

IMAP account can't save any email with attachment
by Chris Thomas 20 Jul '23

20 Jul '23

Hi, I'm getting a curious problem where if I write a draft without an attachment and click save. It'll work without any issue at all. But if I do the same, then attach a file to the email, it'll sit there for a couple of minutes before timing out (I'm using thunderbird), it'll eventually give you a message saying "Your draft message was not copied to your drafts folder (Drafts) due to network or file access errors." I've got all of dovecots verbose logging turned on. I'm using dovecot as a submission server through to the postfix server to do the actual sending. All the logging is turned on there too. But I can't figure out what the problem is. Is there anything I can look for in the logs that will help me out? chris

2 3

Re: Tons of imap-login processes despite client_limit very high
by Joseph Tam 20 Jul '23

20 Jul '23

https://www.mail-archive.com/dovecot%40dovecot.org/msg85850.html From: D D <pierre.alletru(a)gmail.com> > We're seeing a ton of imap-login processes running even when using high performance mode (https://doc.dovecot.org/admin_manual/login_processes/#high-performance-mode) According to the docs: > > "process_min_avail should be set to be at least the number of CPU cores in the system, so that all of them will be used. Otherwise new processes are created only once an existing one’s connection count reaches client_limit" > > We have process_min_avail=4, client_limit=0 and default_client_limit=200000. So we'd expect seeing only 4 imap-login processes serving a ton of connections each. Yet, we see thousands of imap-login processes (more than half of all the imap processes): > ... > > Is having so many imap-login processes normal with our config? Did we misunderstand the docs or is there something wrong here? > > > default_client_limit = 1048576 > default_process_limit = 200000 > > service imap-login { > # client_limit = 0 # default is 0 > # process_limit = 0 # default is 0 > service_count = 100 This service limit might be your culprit. I wrote about the strange interaction between service_count and process_limit here: https://www.mail-archive.com/dovecot%40dovecot.org/msg85850.html This gotcha should really be documented. Joseph Tam <jtam.home(a)gmail.com>

3 4

Fatal error in http-client.c when passdb is oauth2 and userdb is sql
by Евгений Бахтин 19 Jul '23

19 Jul '23

5 5

-d ${user}@${nexthop} or -d ${recipient}?
by rixati6186＠iturchia.com 18 Jul '23

18 Jul '23

What's the differency between these two lines; 1- flags=DORhu user=vmail:vmail argv=/usr/local/libexec/dovecot/dovecot-lda -f ${sender} -r ${recipient} -d ${user}@${nexthop} 2- flags=DRhu user=vmail:vmail argv=/usr/local/libexec/dovecot/dovecot-lda -f ${sender} -d ${recipient} and which one should I use, based on a setup like; Dovecot, Postfix, Postfixadmin, ManageSieve and virtual users hosted in SQL? Thanks in advance.

1 0

dovecot: lda(info@mydomain) - vacation action: discarding vacation response to mailinglist recipient?
by rixati6186＠iturchia.com 18 Jul '23

18 Jul '23

Hello, I'm trying to set auto reply for my email account, through Roundcube and ManageSieve plugin (the plugin itself and its regular filtering works fine), however the auto-reply doesn't arrive to the sender's inbox, when I tested it with sending an email to myself/my server, from my Gmail account, my maillog has a line, stating; Jul 18 15:28:06 mailsrv dovecot: lda(info(a)mywebsite.com)<44812><uikMAlaFtmQMrwAAI6rZ/g>: sieve: msgid=<CA+GnASfyKJDPB-K2uCvxaOL-XQQ7Uv=yJt7sgJSYm-YJzYJSfQ(a)mail.gmail.com>: vacation action: discarding vacation response to mailinglist recipient <mysendermail(a)gmail.com> Any idea would be much appreciated, thank you!

1 1

Re: Fatal error in http-client.c when passdb is oauth2 and userdb is sql
by Евгений Бахтин 18 Jul '23

18 Jul '23

2 1

Re: Fatal error in http-client.c when passdb is oauth2 and userdb is sql
by Евгений Бахтин 18 Jul '23

18 Jul '23

2 1

Tons of imap-login processes despite client_limit very high
by D D 18 Jul '23

18 Jul '23

Hi Dovecot community. We're seeing a ton of imap-login processes running even when using high performance mode (https://doc.dovecot.org/admin_manual/login_processes/#high-performance-mode) According to the docs: "process_min_avail should be set to be at least the number of CPU cores in the system, so that all of them will be used. Otherwise new processes are created only once an existing one’s connection count reaches client_limit" We have process_min_avail=4, client_limit=0 and default_client_limit=200000. So we'd expect seeing only 4 imap-login processes serving a ton of connections each. Yet, we see thousands of imap-login processes (more than half of all the imap processes): $ ps aux | grep imap-login | wc -l 1278 $ ps aux | grep imap | wc -l 2154 We use verbose_proctitle=yes and a there seem to be 2 types of these processes, about half for a single IP and about half we suspect for multiple IPs: $ ps aux | grep imap-log _apt 1941081 0.0 0.0 10420 8700 ? S 14:57 0:00 dovecot/imap-login [84.115.232.178 TLS proxy] _apt 1941589 0.0 0.0 10532 8648 ? S 14:57 0:00 dovecot/imap-login [119.202.86.160 TLS proxy] _apt 1941789 0.0 0.0 10188 8620 ? S 14:57 0:00 dovecot/imap-login [0 pre-login + 2 TLS proxies] _apt 1942144 0.0 0.0 10716 8748 ? S 14:57 0:00 dovecot/imap-login [0 pre-login + 3 TLS proxies] _apt 1942428 0.0 0.0 10800 8712 ? S 14:57 0:00 dovecot/imap-login [5.41.100.37 TLS proxy] ... $ ps aux | grep imap-log | grep pre-login | wc -l 624 $ ps aux | grep imap-log | grep -v pre-login | wc -l 654 Is having so many imap-login processes normal with our config? Did we misunderstand the docs or is there something wrong here? default_client_limit = 1048576 default_process_limit = 200000 service imap-login { # client_limit = 0 # default is 0 # process_limit = 0 # default is 0 service_count = 100 process_min_avail = 4 vsz_limit = 2G inet_listener imap { } inet_listener imaps { haproxy = yes port = 994 } }

2 3

cram-md5, sasl and lua (inheriting technical debt)
by tknb8＠tunenet.dk 18 Jul '23

18 Jul '23

Hello, I am exploring the posibility of migrating an exsisting setup to postfix+dovecot. The issue being that many clients are currently configured for cram-md5 authentication. I am fully aware that this is a really, really, really bad idea, but re configuring all clients at once is not feasible with limited end user support resources. I have a setup running with LUA for the passdb, and everything works with PLAIN login. To keep compatibility with the PLAIN login mechanism i have tried to store {PLAIN} passwords in the DB, since proper secure password storage is incompatible with CRAM-MD5. My issue is that the LUA function auth_password_verify(req, pass) not even seems to be called for cram-md5 logins. Reading through the documentation also seems to indicate that the callenge is not passed to the LUA function making it impossible to compute the hash in LUA or the function req.password_verify(req, row.password, pass). Is my assumption correct that cram-md5 can not work with a LUA script ? Kind regards, Peter K.

2 1

Many IDLE imap processes but very few connections moved to imap-hibernate
by pierre.alletru＠gmail.com 17 Jul '23

17 Jul '23

Hi Dovecot community! I have a strange issue with imap-hibernate. Or more likely it behaves as it's supposed to and it's just that I don't really understand it. I have enabled it, and it works, but for some reason hibernation happens only to a tiny amount of connections, whereas I have a lot of IDLE imap processes. And I can't find any relevant errors in the logs. ## config ## mail_debug = yes verbose_proctitle = yes $ doveconf imap_hibernate_timeout imap_hibernate_timeout = 5 secs $ doveconf -a | grep -A 21 'service imap-hibernate' service imap-hibernate { chroot = client_limit = 0 drop_priv_before_exec = no executable = imap-hibernate extra_groups = group = idle_kill = 0 privileged_group = process_limit = 0 process_min_avail = 0 protocol = imap service_count = 0 type = unix_listener imap-hibernate { group = $default_internal_group mode = 0660 user = } user = $default_internal_user vsz_limit = 18446744073709551615 B } ## imap processes ## $ ps aux | grep "dovecot/imap" | wc -l 2214 ps aux | grep "dovecot/imap" | grep IDLE | wc -l 1258 $ ps aux | grep "imap-hibernate" syslog 1571453 0.0 0.0 4748 3156 ? S 15:44 0:00 dovecot/imap-hibernate [18 connections] As you can see here I have 1258 IDLE imap processes (out of 2214 in total), and only 18 connections in imap-hibernate. I'd like to have all IDLE processes to be moved to imap-hibernate in order to save up memory. Any idea why these 1k+ IDLE imap processes are not moved into imap-hibernate? Thank you!

2 1

Problem connecting with desktop client
by Wolfgang Paul Rauchholz 17 Jul '23

17 Jul '23

I run my home server under Rocky Linux 9. The server is modem / router and as such has two firewall interfaces; internal and external. Dovecot version is dovecot-2.3.16-8.el9.x86_64 kernel is: 5.14.0-284.18.1.el9_2.x86_64 My domain is wo-lar.com Postfix and Dovecot are up and running, and I can send and receive emails from CLI. But I cannot connect from desktop clients. I get the following error message: Server message: Can't connect to host "tcp://wo-lar.com:143" I tried to telnet from my desktop and server. Results are the same: - I always get a connection refused: telnet wo-lar.com 143 telnet / telnet <Server LAN IP> 143. On server only: telnet 127.0.0.1 143 - telnet wo-lar 143 (without .com!) establishes a connection [root@home wp.rauchholz]# telnet wo-lar 143 Trying 79.152.236.25... Connected to wo-lar. Escape character is '^]'. OK [CAPABILITY IMAP4rev1 SASL-IR LOGIN-REFERRALS ID ENABLE IDLE LITERAL+ STARTTLS AUTH=PLAIN AUTH=LOGIN] Dovecot ready. I went through all kinds for conf files and search for wo-lar string, but can't find it anywhere Where is the mistake hiding? Thanks for helping. Wolfgang

2 4

Re: Replication going away?
by William Edwards 16 Jul '23

16 Jul '23

> Op 16 jul. 2023 om 17:57 heeft Aki Tuomi <aki.tuomi(a)open-xchange.com> het volgende geschreven: > > Hi! > > Yes, director and replicator are removed, and won't be available for pro users either. > > For NFS setups (or similar shared setups), we have documented a way to use Lua to run a director-like setup, see > > https://doc.dovecot.org/3.0/configuration_manual/howto/director_with_lua/ It would probably be good to share this link in the aforementioned Director removal thread. > > Regards to replication, doveadm sync is not being removed. So you can still run doveadm sync on your system to have a primary / backup setup. > > Aki > >> On 16/07/2023 18:34 EEST William Edwards via dovecot <dovecot(a)dovecot.org> wrote: >> >> >> Top posting because nothing specific to reply to, sorry. Not exactly sure, but there’s another thread about the removal of Director in favour of Dovecot Pro on 3.x. Perhaps this change is related. >> >> William Edwards >> >>>> Op 16 jul. 2023 om 16:33 heeft Daniele <danix(a)kernel-panic.it> het volgende geschreven: >>> >>> Hello, >>> >>> Just like Vladimir, I'm a bit concerned about this change, and I'd really appreciate if someone could let us know if the replication feature (that works so well!) will be replaced or removed; and, in case of removal, what would be recommended replacement? >>> Thanks in advance and best regards, >>> Daniele >>> >>>> On 09-Jul-23 9:36 PM, Vladimir Mishonov via dovecot wrote: >>>> Hello everyone. >>>> >>>> Just saw this commit in the official Github repo: >>>> >>>> https://github.com/dovecot/core/commit/4c04e4c30fd4817a8b0e11d04d9681173f69… >>>> >>>> Looking at the commit details, it appears that it completely removes the replication feature. I'm a bit perplexed by this change and am not sure what might be the justification for it. Personally, I find replication to be very useful, as it allows me to maintain a synchronized mirror of all of my mailboxes on my home server, for use as backup in case the primary server goes down for some reason. >>>> >>>> Perhaps there's some sort of replacement being planned for this feature? Or maybe the relevant code is simply going to be refactored to a plugin or external program, and there's nothing to worry about at all? >>>> >>>> In any case, I'd greatly appreciate if one of the developers could comment on this change. >>>> >>> >>> _______________________________________________ >>> dovecot mailing list -- dovecot(a)dovecot.org >>> To unsubscribe send an email to dovecot-leave(a)dovecot.org >>> >> >> _______________________________________________ >> dovecot mailing list -- dovecot(a)dovecot.org >> To unsubscribe send an email to dovecot-leave(a)dovecot.org >

1 0

user lookup fails username is SHA256 @domain
by Daniel Botting 16 Jul '23

16 Jul '23

Hi all, I'm currently building a replacement personal mailserver on Debian 11 (hopefully upgrade it to 12 and it will continue to work). My existing personal mailserver is serving a handful of mailboxes for three domains, virtual users, on an older version of Debian. When I attempt to deliver mail to the server (using swaks) it is accepted by Exim and passed to lda, as per the logs below the lda is somehow seeing the CRYPT entry as if it was the local part? Output from syslog: Jul 16 09:50:02 imap2 dovecot: lda({SHA256-CRYPT}generated-sha(a)example.domain)<700316><>: Debug: auth-master: userdb lookup({SHA256-CRYPT}generated-sha(a)example.domain): Started userdb lookup Jul 16 09:50:02 imap2 dovecot: lda({SHA256-CRYPT}generated-sha(a)example.domain)<700316><>: Debug: auth-master: conn unix:/run/dovecot/auth-userdb: Connecting Jul 16 09:50:02 imap2 dovecot: lda({SHA256-CRYPT}generated-sha(a)example.domain)<700316><>: Debug: auth-master: conn unix:/run/dovecot/auth-userdb (pid=700293,uid=0): Client connected (fd=9) Jul 16 09:50:02 imap2 dovecot: auth: Debug: master in: USER#0111#011{SHA256-CRYPT}generated-sha(a)example.domain#011service=lda Jul 16 09:50:02 imap2 dovecot: auth: Username character disallowed by auth_username_chars: 0x7b (username: {SHA256-CRYPT}generated-sha(a)example.domain) Jul 16 09:50:02 imap2 dovecot: auth: Debug: userdb out: NOTFOUND#0111 Jul 16 09:50:02 imap2 dovecot: lda({SHA256-CRYPT}generated-sha(a)example.domain)<700316><>: Debug: auth-master: userdb lookup({SHA256-CRYPT}generated-sha(a)example.domain): auth USER input: Jul 16 09:50:02 imap2 dovecot: lda({SHA256-CRYPT}generated-sha(a)example.domain)<700316><>: Debug: auth-master: userdb lookup({SHA256-CRYPT}generated-sha(a)example.domain): Userdb lookup failed Jul 16 09:50:02 imap2 dovecot: lda(700316): Debug: auth-master: conn unix:/run/dovecot/auth-userdb (pid=700293,uid=0): Disconnected: Connection closed (fd=9) From what I've read 0x7b is hex for { so disallowed by auth_username_chars line is because of this problem. Doveconf -n output: # 2.3.20 (80a5ac675d): /etc/dovecot/dovecot.conf # OS: Linux 5.10.0-21-amd64 x86_64 Debian 11.6 # Hostname: mailserver.fqdn auth_debug = yes auth_debug_passwords = yes auth_verbose = yes mail_debug = yes mail_location = maildir:~/Maildir namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } passdb { args = /etc/vmail/%d/passwd driver = passwd-file } protocols = " imap" service auth { unix_listener auth-client { group = Debian-exim mode = 0660 } } service stats { unix_listener stats-reader { group = vmail mode = 0660 user = vmail } unix_listener stats-writer { group = vmail mode = 0660 user = vmail } } ssl = required ssl_cert = </path/to/cert.pem ssl_client_ca_dir = /etc/ssl/certs ssl_key = # hidden, use -P to show it userdb { args = uid=vmail gid=vmail home=/var/local/vmail/%d/%u driver = static } Example of line in passwd file: username:{SHA256-CRYPT}generated-sha I followed https://doc.dovecot.org/configuration_manual/howto/simple_virtual_install/ before posting to ensure I hadn't missed something obvious. Any thoughts on this would be appreciated. Thanks Daniel

1 0

Windows 11 Outlook 365 and dovecot
by The Doctor 16 Jul '23

16 Jul '23

Are there any known Idssues? I help set up a client this morning using Win11 and Dovecot and the client cannot delete e-mail like he did previously. -- Member - Liberal International This is doctor(a)nk.ca Ici doctor(a)nk.ca Yahweh, King & country!Never Satan President Republic!Beware AntiChrist rising! Look at Psalms 14 and 53 on Atheism https://www.empire.kred/ROOTNK?t=94a1f39b We look outside to find assurance, and then we fail. -unknown Beware https://mindspring.com

3 2

Options to track performance?
by Christian 15 Jul '23

15 Jul '23

Hi there, after upgrading my dovecot on a bookworm container, I now have a weird delay when imap clients like Evolution connect the first time. Is there any performance logging configuration I could enable, to see what dovecot is doing in which timing? I suspect some timeout or delay somewhere, but unable to find it so far. Kind regards Chris

1 0

Options to track performance?
by Christian 15 Jul '23

15 Jul '23

Hi there, after upgrading my dovecot on a bookworm container, I now have a weird delay when imap clients like Evolution connect the first time. Is there any performance logging configuration I could enable, to see what dovecot is doing in which timing? I suspect some timeout or delay somewhere, but unable to find it so far. Kind regards Chris

1 0

dovecot and argonid
by Maciej Milaszewski 13 Jul '23

13 Jul '23

Hi For test I try use new auth (argonid) fot dovecot-2.3.20 I change only in sql: password: {ARGON2ID}........ in dovecot.conf i set default_vsz_limit = 2000 M and I can't auth Jul 12 15:07:43 dovecot8 dovecot: auth-worker(44928): conn unix:auth-worker (pid=23437,uid=114): auth-worker<4772376>: sql(user12,xxx.xxx.xxx.12,<VfN04EkA0LUK>): Password mismatch Jul 12 15:07:43 dovecot8 dovecot: imap-login: Disconnected: Connection closed (auth failed, 1 attempts in 105 secs): user=<user12>, method=PLAIN, rip=xxx.xxx.xxx.12, lip=xxx.xxx.xxx.12, secured, session=<VfN04EkA0LUK> I try telnet ip 144 a login username pass Any idea ?

2 3

Proper way to enable statistics on Dovecot 2.3.20?
by rixati6186＠iturchia.com 12 Jul '23

12 Jul '23

Hi. I'm using Dovecot on OpenBSD OS. "dovecot --version" reports: 2.3.20 (80a5ac675d) and this is my configuration file: https://termbin.com/m4to How to properly set the statistics for the version I use? I have both "service stats" and "service old-stats" and it seems I'm not really getting any statistics. Where's my mistake? Thanks in advance. ("doveadm oldstats top" command gives an empty page with columns.) Thanks.

2 6

argon2id best practices, generating and database storage
by David Mehler 12 Jul '23

12 Jul '23

Hello, To users of argon2id as a password hash, what are best practices/what do you use to generate the argon2id password hashes? I want to know if I should do more than: doveadm pw -s ARGON2ID Also, for storing an argon2id password hash in a database (mysql/mariadb in this example) what value(s) do you use for the field? Thanks. Dave.

1 0

Motion for OCSP Support in Dovecot
by novoMedia 12 Jul '23

12 Jul '23

Currently, Dovecot does not offer any support for OCSP, leaving system administrators with a dilemma: choosing between security or compatibility. - What is OCSP? OCSP (Online Certificate Status Protocol) is a network protocol used to check the validity and revocation status of digital certificates in real-time. - What is Must-Staple? "Must-Staple" is a certificate extension that enforces the inclusion of OCSP stapling information, requiring servers to present the certificate's revocation status during the TLS handshake. - What advantages does the use of Must-Staple offer? The inclusion of a 'must-staple' flag in a certificate mandates the presence of an OCSP response during a TLS handshake, ensuring that a revoked certificate remains (at worst) only usable until the expiration of the latest OCSP response, rather than the expiration of the certificate itself (subject to specific client/implementation). https://www.reddit.com/r/selfhosted/comments/aye79v/the_case_for_ocsp_musts… - What is the current issue with Dovecot? Presently, any system administrator who intends to issue must-staple certificates, faces the dilemma to either chose to a) Refrain from issuing must-staple certificates at all, resulting in the loss of a valuable security feature. b) Issue must-staple certificates without an OCSP response in Dovecot, thereby breaking the TLS RFC (and “hope for the best” on the client side…). A "stuck between a rock and a hard place" situation. - Any other reasons to implement OCSP? Regulatory frameworks such as HIPAA, PCI-DSS and more require the implementation of OCSP to enhance privacy and security. Personally, this requirement does not impact me since I am neither located in the United States nor have customers there. Nonetheless, it is worth noting this requirement for individuals or entities who are subject to these regulations. - Is there demand for OCSP in Dovecot? https://github.com/mjhas/dovecot/issues/44 (First GitHub Google hit for “dovecot ocsp”) https://serverfault.com/questions/830434/do-postfix-and-dovecot-support-ocs… https://dovecot.org/pipermail/dovecot/2018-October/113368.html https://www.dovecot.org/list/dovecot/2016-March/103395.html - Summary By implementing a simple OCSP solution, Dovecot could effectively solve this predicament without any drawbacks for its users. The focus here is on simplicity. It is unnecessary to employ a comprehensive OCSP resolver/responder like the one used in Nginx; rather, it would suffice to allow the definition of a simple file path containing the OCSP response alongside the certificate (honoring TLS SNI). Please kindly consider my motion.

4 6

mail-crypt key sharing
by Robert Senger 12 Jul '23

12 Jul '23

Hi all, I am trying to setup mailbox sharing (not public mailboxes) together with mail-crypt plugin and encrypted folder keys. According to the source code of the mail-crypt plugin (there's code trying to retrieve private keys for shared mailboxes), and its documentation, this should be possible: ----- If you are using global keys, mails can be shared within the key scope. The global key can be provided with several different scopes: Global scope: key is configured in dovecot.conf file Per-user(group) scope: key is configured in userdb file With folder keys, key sharing can be done to single user, or multiple users. When key is shared to single user, and the user has public key available, the folder key is encrypted to recipient’s public key. If you have mail_crypt_acl_require_secure_key_sharing enabled, you can’t share the key to groups or someone with no public key. ----- The documentation mentions key sharing, but I have no idea how this could be implemented, and did not find anything else than this mail- crypt documentation in the whole web... I assume that I need to export the user key of the users's folder that should be shared, and import it into the receiving users keys, encrypted with the receiving user's key. Is that right? Any hints how to do that? Regards, Robert -- Robert Senger

1 2

Shared folders?
by joe a 11 Jul '23

11 Jul '23

Is it possible to setup shared folders between virtual users on the same server?

5 9

Public mailboxes and mailcrypt
by Robert Senger 11 Jul '23

11 Jul '23

Hi there, is there a possibility to combine public mailboxes (as described in the first link below) with mailcrypt plugin using per-user keys (as described in the second link below)? I assume, no. But if there's a solution like, for example, storing the decryption key multiple times with different password protection, or by using a global key for the public mailbox only, let me know... I know that I could simply turn off encryption for the public mailbox, and I know how to do that. That's the fllback solution... ;) Regards, Robert (1) https://doc.dovecot.org/configuration_manual/shared_mailboxes/public_shared… (2) https://doc.dovecot.org/configuration_manual/mail_crypt_plugin/ -- Robert Senger

3 3

How to disable BINARY extension
by Ralf Becker 10 Jul '23

10 Jul '23

Reason for disabling are many broken mails containing unescaped equal signs ("=") and our webmailer is using BINARY, when offered, and than does not display the mail and reports Dovecots error "Invalid quoted-printable input trailer: '=' not followed by two hex digits". I'm fully aware that the mails are broken, unfortunately all sorts of programs or senders generate them ... I can use imap_capability = <full-list-of-caps-without-binary> but this is for multiple reasons not ideal: - new caps would never show up - pre-login the are also displayed There seems to be no syntax like: imap_capability = -BINARY Is there any other way to disable just binary? Ralf -- Ralf Becker EGroupware GmbH [www.egroupware.org] Handelsregister HRB Kaiserslautern 3587 Geschäftsführer Birgit und Ralf Becker Leibnizstr. 17, 67663 Kaiserslautern, Germany Telefon +49 631 31657-0

1 0

meaning of LIST output
by joe a 10 Jul '23

10 Jul '23

having trouble using offlineimap to copy folders to a local store for spamassasin to use. Says "no folder to sync (folderfilter issue?)" Thinking I simply did not know the proper folder name, did telnet to dovecot server for list of folders, see this,(snippet): . . . * LIST (\HasNoChildren \UnMarked) "." Cabinet.Missed-SPAM * LIST (\HasNoChildren) "." Cabinet.Missed-HAM * LIST (\HasNoChildren \UnMarked) "." Cabinet.Marked-SPAM . . . What is the significance of not one being not "UnMarked"? joe a.

1 0

rename virtual user?
by joe a 09 Jul '23

09 Jul '23

Possible to change a virtual user account, in passwd file, to another name and or domain?

3 3

Public mailboxes and mailcrypt
by Robert Senger 09 Jul '23

09 Jul '23

Hi there, is there a possibility to combine public mailboxes (as described in the first link below) with mailcrypt plugin using per-user keys (as described in the second link below)? I assume, no. But if there's a solution like, for example, storing the decryption key multiple times with different password protection, or by using a global key for the public mailbox only, let me know... I know that I could simply turn off encryption for the public mailbox, and I know how to do that. That's the fllback solution... ;) Regards, Robert (1) https://doc.dovecot.org/configuration_manual/shared_mailboxes/public_shared… (2) https://doc.dovecot.org/configuration_manual/mail_crypt_plugin/ -- Robert Senger

1 0

Fwd: dovecot and postfix, authentication issue
by jeremy ardley 06 Jul '23

06 Jul '23

On 6/7/23 20:49, joe a wrote: > On 7/6/2023 8:12 AM, jeremy ardley via dovecot wrote: >> >> On 6/7/23 19:15, joe a wrote: >>> >>> If your example was meant to show the correct way, I cannot see any >>> difference between that and what my posted config shows other than >>> the sequential (contiguous?) in your example. >> >> Perhaps try the different configuration out? Or even better, stick to >> one auithentication method only. >> >> >> Jeremy >> > > Sorry, not to appear dense or argumentative, but I did not see any > difference in your example, vs what exists, other than that in your > example they are grouped together. > > Is that what you suggest I try, or are my aging eyes and brain missing > something there? > How about just using PAM? In dovecot.conf : auth_mechanisms = plain login passdb { driver = pam } userdb { driver = passwd } This will then call pam whose config is mainly determined by cat /etc/pam.d/dovecot #%PAM-1.0 #auth required pam_faillock.so preauth silent audit #auth [default=die] pam_faillock.so authfail audit @include common-auth @include common-account @include common-session Assuming the pam config is defaults then you will get pam authenticating local users against the local (unix) passwd file. In turn this will authenticate dovecot users and then postfix users This may sound complex but it's pretty standard to have postfix --> dovecot --> pam --> unix_local

2 2

dovecot and postfix, authentication issue
by joe a 06 Jul '23

06 Jul '23

Greetings from a new dovecot user. Have setup dovecot on openSuse 15.4 with postfix as the MTA. Both are the latest version in that distribution. Simple virtual user setup using /etc/dovecot/passwd Dovecot seems to be working and all the defined users are authenticating well enough for imapsync to migrate files to the mailboxes. However, when attempting to send test mail via postfix, only some users are authenticated and have mail delivered. Using swaks (smtp toolkit) the failures are: 550 5.1.1 <some.user(a)mydomain.com>: Recipient address rejected: User unknown in local recipient table I'm puzzled, probably some simple thing overlooked. To avoid clutter, I won't include postfix items unless asked. dovecot --version 2.3.20 (80a5ac675d) dovecot -n # 2.3.20 (80a5ac675d): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.20 (149edcf2) # OS: Linux 5.14.21-150400.24.66-default x86_64 # Hostname: flitch auth_verbose = ob-fuskate disable_plaintext_auth = no first_valid_uid = 100 info_log_path = /var/log/dovecot-info.log log_path = /var/log/dovecot.log mail_location = maildir:~/Maildir managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } passdb { driver = pam } passdb { args = /etc/dovecot/passwd driver = passwd-file } plugin { sieve = file:~/sieve;active=~/.dovecot.sieve } protocols = imap lmtp service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0660 user = postfix } } service lmtp { unix_listener /var/spool/postfix/private/dovecot-lmtp { group = postfix mode = 0600 user = postfix } } ssl = no ssl_cipher_list = ALL:!aNULL:!eNULL:!EXPORT:!DES:!3DES:!MD5:!PSK:!RC4:!ADH:!LOW@STRENGTH ssl_options = no_compression ssl_prefer_server_ciphers = yes userdb { driver = passwd } userdb { args = uid=vmail gid=vmail home=/home/vmail/%u driver = static }

3 6

director_username_hash usable variables
by Stefano Cecconello 06 Jul '23

06 Jul '23

Hi, From the documentation of the director_username_hash core setting ( https://doc.dovecot.org/settings/core/#core_setting-director_username_hash ), it seems that it is possible to use some variables for the hashing of the username from a proxy\director : . Variables that can be used for this setting: * Global variables * %{user}, %u \ Username (username@domain) * %{username}, %n \ Username * %{domain}, %d \ Domain . If i need to use in the hash calculation some variables that are not global, like domain_first \ orig_username authentication_variables ( https://doc.dovecot.org/configuration_manual/config_file/config_variables/#a uthentication-variables ), are those be parsed\read from the director_hash_username settings ? Or the only variables allowed to be used are : * %{user}, %u \ Username (username@domain) * %{username}, %n \ Username * %{domain}, %d \ Domain * Global: %% * Global: env:<name> * Global: uid * Global: gid * Global: pid * Global: hostname In order to see if these variables are read\parsed during the hashing, somebody know if there is a way to log their value in the dovecot log ? Thanks Stefano

1 0

Chrooting
by Alexey Vlasov 30 Jun '23

30 Jun '23

Hi, I have the following hier for chrooting local users: /var/mail/.u336084 /var/mail/.u336084/bin /var/mail/.u336084/dev [cut here] /var/mail/.u336084/proc /var/mail/.u336084/var/ [cut here] /var/mail/.u336084/var/mail/ /var/mail/.u336084/var/mail/u336084 /var/mail/.u336084/var/mail/u336084/Mail /var/mail/.u336084/Mail -> var/mail/u336084/Mail (symlink) passwd file: u336084:x:1340334:255::/var/mail/.u336084:/bin/bash Chroot works fine, for SSH, FTP and etc, for example: # chroot /var/mail/.u336084 /bin/bash Given the current hierarchy, is it possible to tell the dovecot to do the same chroot? I found strange behavior that users cannot delete IMAP-folders: [pid 25055] stat("/var/mail/.u336084/Mail/.www1", {st_mode=S_IFDIR|0700, st_size=167, ...}) = 0 [pid 25055] stat("/var/mail/.u336084/Mail/.Trash.www1", 0x7ffeddc3d5c0) = -1 ENOENT (No such file or directory) [pid 25055] stat("/var/mail/.u336084/Mail/.Trash", {st_mode=S_IFDIR|0777, st_size=198, ...}) = 0 [pid 25055] fcntl(16, F_SETLK, {l_type=F_UNLCK, l_whence=SEEK_SET, l_start=0, l_len=0}) = 0 [pid 25055] fcntl(16, F_SETLK, {l_type=F_WRLCK, l_whence=SEEK_SET, l_start=0, l_len=0}) = 0 [pid 25055] fstat(16, {st_mode=S_IFREG|0600, st_size=0, ...}) = 0 [pid 25055] stat("/var/mail/.u336084/Mail/mailboxes.lock", {st_mode=S_IFREG|0600, st_size=0, ...}) = 0 [pid 25055] unlink("/var/mail/.u336084/Mail/mailboxes.lock") = 0 [pid 25055] close(16) = 0 [pid 25055] write(7, "96 NO [CANNOT] Renaming not supported across conflicting directory permissions (0.002 + 0.000 + 0.001 secs).\r\n", 110) = 110 [pid 25055] epoll_wait(11, [{EPOLLIN, {u32=1794732256, u64=94916277006560}}], 7, 1800000) = 1 Btw I don't see any conflicting dirs: root@:/var/mail/u336084# ls -ld /var/mail/.u336084/Mail/.www1 drwx------ 5 u336084 virtmail 167 Jun 27 13:26 /var/mail/.u336084/Mail/.www1 root@:/var/mail/u336084# ls -ld /var/mail/.u336084/Mail lrwxrwxrwx 1 u336084 virtmail 26 Apr 28 21:43 /var/mail/.u336084/Mail -> var/mail/u336084/Mail root@:/var/mail/u336084# ls -ld Mail drwx------ 16 u336084 virtmail 4096 Jun 30 01:25 Mail All folders have right owner u336084. With this configuration Courier worked properly, I noteced the problem after migration to Dovecot. Thanks in advance.

1 0

Warning sqlpool(mysql): Query failed
by Alessio Cecchi 27 Jun '23

27 Jun '23

Hi, with the last dovecot version (2.3.13) I see many of this warnings via "doveadm log errors": Feb 17 03:26:28 Warning: dict(31513): conn unix:dict (pid=31330,uid=95): dict(mysql)<email1(a)company1.com>: sqlpool(mysql): Query failed, retrying: MySQL server has gone away (idled for 679 secs) Feb 17 03:48:53 Warning: dict(31013): conn unix:dict (pid=31805,uid=95): dict(mysql)<email2(a)company2.com>: sqlpool(mysql): Query failed, retrying: MySQL server has gone away (idled for 685 secs) Feb 17 03:54:12 Warning: dict(32529): conn unix:dict (pid=3147,uid=95): dict(mysql)<email3(a)company3.com>: sqlpool(mysql): Query failed, retrying: MySQL server has gone away (idled for 670 secs) What do they mean? I thinks are related to inactivity timeout on mysql server (where I have a wait_timeout=600), but these warnings could be problems or can be fixed with some setting in dovecot? My dovecot configuration about dict: dict { acl = mysql:/etc/dovecot/dovecot-dict-sql.conf.ext expire = mysql:/etc/dovecot/dovecot-dict-sql.conf.ext sieve = mysql:/etc/dovecot/dovecot-dict-sieve-sql.conf.ext sqlquota = mysql:/etc/dovecot/dovecot-dict-sql.conf.ext } plugin { [...] acl_shared_dict = proxy::acl expire_dict = proxy::expire quota2 = dict:Quota Usage::noenforcing:proxy::sqlquota sieve = file:~/sieve;active=~/.dovecot.sieve sieve_before = dict:proxy::sieve;name=activesql [...] } service dict { process_limit = 500 unix_listener dict { group = vmail mode = 0660 user = vmail } } Thanks -- Alessio Cecchi Postmaster @ http://www.qboxmail.it https://www.linkedin.com/in/alessice

2 1

Re: Postfix: running a script on authentication failure
by Joseph Tam 27 Jun '23

27 Jun '23

On Thu, 22 Jun 2023, Michael Peddemors wrote: > * Use services like RATS-AUTH to block IPs that can safely be blocked as known hackers.. Cool. Are there other DNSRBLs (apart from bl.blocklist.de) that list BFD attack IPs? > * Use services like RATS-NULL (or SpamHaus DROP lists) right in the firewall level. There are SOME networks > that should simply be 'unplugged' Can't find it in https://spamrats.com/. Is it an DNSRBL or downloadable file? > * Turn off port 110 (well, all plain text authentication) 90% less email compromise reports when you do.. That will disable STARTTLS though. Even though it's not plaintext, maybe that is a good thing as it avoids MITM banner stripping attacks. Joseph Tam <jtam.home(a)gmail.com>

2 1

Server migration, password scheme/hashing, argon2i, argon2d, argon2id, sha512, sha512-crypt, tiger2, salt?
by David Mehler 24 Jun '23

24 Jun '23

Hello, I'm migrating to a new server. It's running Debian 11 currently though that's going 12 this weekend. Currently it uses Openssl v3.0.9, and dovecot 2.3.13 and MySQL (in this case Mariadb) for storing user account information v10.6.14. My question is in regards password storage and scheme/encryption/salts. Currently they are stored in Mariadb password field with a type of varchar and a 255 character length, and are stored as SHA512-CRYPT. I'm wondering if I should keep this as is or when I migrate go to another scheme? I'm thinking argon2i, argon2d, argon2id, sha512, sha512-crypt, tiger2, saltt? Discussion/opinions welcome. Thanks. Dave.

2 3

configuring Dovecot submission service
by Computerisms Corporation 24 Jun '23

24 Jun '23

Hi Dovecot Gurus, I have been playing around with the submission service. I have managed to get all the things working that I want working with two exceptions. I have not found (or possibly I have overlooked) solutions in the documentation or discussions on the 'net. First; I would like to be able to authenticate against my backend MTA using the user-supplied credentials. I have tried setting submission_relay_user as %u and submission_relay_password as %w, but these seem to be passed through as literal strings, and of course my backend MTA has no idea who %u is. I found a post from 2019 that indicates passing the submission_relay_user/password to the backend is not a supported function, but hoping that maybe that is outdated info. I also found: https://doc.dovecot.org/3.0/configuration_manual/authentication/proxies/ Which seems to indicate it could pass credentials to a non-Dovecot MTA backend, but I am not really clear from the docs on how to set that up, and I did not find any relevant examples to work from. Seems like it would be setting up a Director service, maybe? I have done that before and I do manage multiple email servers, but none of them is clustered or configured to be interoperable, so not sure if this is a viable approach. Second; I am wondering about the possibility of having multiple submission_relay_host entries. For example if I have dovecot submission services running on my standard port 587 and 465 connect to a relay on the same box through localhost, but could I have another submission service running on another port, say 5587, and relay all traffic received on that port through a completely different host? I am thinking I could set that up by running a separate instance of dovecot for just that service, but maybe there is a more suitable way? I don't have a solid use-case for this in mind at the moment, but given that I do manage multiple email servers, I am thinking that if this is possible it might provide some useful corner-case configurations down the road. Thank you for reading my post, any thoughts, information, or pointers to relevant documentation would be most appreciated. -- Bob Miller 867-334-7117 www.computerisms.ca

2 3

Postfix: running a script on authentication failure
by André Rodier 22 Jun '23

22 Jun '23

Hello, all. I just set-up a new server, running postfix, with submission(s) activated on standard ports (587, 465) Shortly after it has been setup, I see brute force attacks (not surprising) from a whole /24 network (more surprising). I carefully checked the logs, and see the modus operandi, which basically loop across the IP addresses in the network, to avoid being blacklisted by tools like fail2ban. And it is true, even with fail2ban activated, no IP is blacklisted. By activating verbose logging, I see multiple user names are tried, not only passwords. Is there any way, with postfix, to run a script on authentication failure, with information like the IP address and the username passed, for instance. I basically need features that fail2ban doesn't offer - I would like to not rely on reading logs, removing one step and acting more pro-actively. - If a script is called on authentication failure, it is fairly easy to use a Levenshtein distance to differentiate between a user having lost his password and a brute force attack. - If I log all the failure in a database, with the IP address, and the whois information, the script would take decision according to the whois information. What are you using on your side ? - Do you know any service, that I could use, to get the network to ban from an IP address reputation, something like crowdsec, for instance ? - Anyone has success with Suricata, Snort, or a tool like this ? Please, do not suggest third party hosted services, I want to be part of my self-hosting solution. Kind regards, André

4 4

Postfix: running a script on authentication failure
by André Rodier 22 Jun '23

22 Jun '23

Hello, all. I just set-up a new server, running postfix, with submission(s) activated on standard ports (587, 465) Shortly after it has been setup, I see brute force attacks (not surprising) from a whole /24 network (more surprising). I carefully checked the logs, and see the modus operandi, which basically loop across the IP addresses in the network, to avoid being blacklisted by tools like fail2ban. And it is true, even with fail2ban activated, no IP is blacklisted. By activating verbose logging, I see multiple user names are tried, not only passwords. Is there any way, with postfix, to run a script on authentication failure, with information like the IP address and the username passed, for instance. I basically need features that fail2ban doesn't offer - I would like to not rely on reading logs, removing one step and acting more pro-actively. - If a script is called on authentication failure, it is fairly easy to use a Levenshtein distance to differentiate between a user having lost his password and a brute force attack. - If I log all the failure in a database, with the IP address, and the whois information, the script would take decision according to the whois information. What are you using on your side ? - Do you know any service, that I could use, to get the network to ban from an IP address reputation, something like crowdsec, for instance ? - Anyone has success with Suricata, Snort, or a tool like this ? Please, do not suggest third party hosted services, I want to be part of my self-hosting solution. Kind regards, André

1 0

el9 rpms
by Marc 21 Jun '23

21 Jun '23

Is there a specific reason why there are (still) no el9 packages? https://repo.dovecot.org/ce-2.3.17/centos/ https://repo.dovecot.org/ce-2.3-latest/rhel/

4 7

Re: Submission behaviour
by Joseph Tam 21 Jun '23

21 Jun '23

From: "André Rodier" > chain input { > > # Limit new imap connections ala fail2ban > meta nfproto ipv4 tcp dport imaps ct state new,untracked \ > limit rate over 10/minute add @banned_imap_ipv4 { ip saddr } I'm don't know all the subttlties of this rule, but there are some mail clients (MacOSX Mail comes to mind) that will bombard your IMAP server with new connections when it does a global search. It will open a new connection for each mailbox, then do a search. When your connection limit is reached, it will then close all the open connections and do another round. This may be interpreted as a BFD attack, and you'll lock out a legitimate user. Joseph Tam <jtam.home(a)gmail.com>

1 0

Dovecot reposting inactivity as auth failed
by pedro＠netsecpt.pt 21 Jun '23

21 Jun '23

Hi , i am having an issue with dovecot , in log files of imap inactivity lines have the word included "auth failed" , witch is not true , what happens next is that fail2ban is looking for that word too in log file of dovecot ,and when it finds it it bans my public ip address . Is there any change to change this behavior in dovecot , what i mean is to insert "auth failed" when in fact it is an authentication failed , and not use it as general for every thing in log file . Dovecot Version : 2.3.19.1 (9b53102964) Log imap line with issues : dovecot: imap-login: Disconnected: Inactivity (auth failed, 1 attempts in 180 secs): user=<myemail@mydomain>, method=PLAIN, rip=xxx.xxx.xx.xx, lip=xxx.xxx.xxx.xxx, TLS, TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits), session=<some_hash> Thank you

3 6

Submission behaviour
by André Rodier 20 Jun '23

20 Jun '23

Hi, I have used fail2ban for a while, to block brute force attacks on ssh, imap(s) or submission(s) ports. More because I wanted to reduce the noise in the logs rather than a fear of a broken password. Then, with nftables, I realised you can achieve the same thing, as long as a TCP connection isn't close. This works very well for SSH, but I then realised it works for a modern IMAP server that supports IDLE, since the connection is kept open, for instance the excellent Dovecot mail server. Here an example, of nftable ruleset, for dovecot imap(s): ------------------------------------------------------------------- table inet filter { set banned_imap_ipv4 { type ipv4_addr flags dynamic,timeout timeout 1d } set banned_imap_ipv6 { type ipv6_addr size 65535 flags dynamic,timeout timeout 1d } chain input { # Limit new imap connections ala fail2ban meta nfproto ipv4 tcp dport imaps ct state new,untracked \ limit rate over 10/minute add @banned_imap_ipv4 { ip saddr } meta nfproto ipv6 tcp dport imaps ct state new,untracked \ limit rate over 10/minute add @banned_imap_ipv6 { ip6 saddr } # Reject the traffic explicitly ip saddr @banned_imap_ipv4 tcp dport imaps reject with icmp type admin-prohibited ip6 saddr @banned_imap_ipv6 tcp dport imaps reject with icmpv6 type admin-prohibited tcp dport { imap, imaps } ct state new counter accept \ comment "Accept imap/imaps connections" } } ------------------------------------------------------------------- Surprisingly, this is working very well with Dovecot, and various modern clients like Evolution or Thunderbird, as well as K9 on Android. There is also a way to save the rules before restarting the firewall, which works very well as well: ------------------------------------------------------------------- # nft list set inet filter banned_imap_ipv4 table inet filter { set banned_imap_ipv4 { type ipv4_addr size 65535 flags dynamic,timeout timeout 1d elements = { 162.142.125.214 timeout 1d expires 23h44m16s600ms } } } ------------------------------------------------------------------- Now, the question I have is this. I can limit new TCP connections to a reasonable amount, like 10 per minute, because I know I will not try to send that amount of emails from a single IP. However, is there an option, in Postfix, to keep the TCP connection opened for submission(s) protocols (ports 465 or 587) Thanks for your insights.

1 0

Re: Dovecot reposting inactivity as auth failed
by Joseph Tam 20 Jun '23

20 Jun '23

From: pedro(a)netsecpt.pt > Hi , i am having an issue with dovecot , in log files of imap inactivity lines have the word included "auth failed" , witch is not true , what happens next is that fail2ban is looking for that word too in log file of dovecot ,and when it finds it it bans my public ip address . > Is there any change to change this behavior in dovecot , what i mean is to insert "auth failed" when in fact it is an authentication failed , and not use it as general for every thing in log file . Putting aside the semantics that not supplying credentials before the timeout *is* an auth failure, I would think the best way to handle this is to change the pattern fail2ban triggers to be more specific about what it considers an auth failure. If this is a typical log entry you want to avoid an automatic ban dovecot: imap-login: Disconnected: Inactivity (auth failed, 1 attempts in 180 secs): user= ... I would modify /etc/fail2ban/filter.d/dovecot.conf to limit it to 0-99sec like so failregex = ...( in \d{1,2} secs)... Some BFD attempts will leak through but it avoids triggering on any inactivity >99s. Joseph Tam <jtam.home(a)gmail.com>

1 0

Cannot get mail-crypt plugin to work
by rcooper＠dwford.com 16 Jun '23

16 Jun '23

dovecot 2.2.27 and then 2.2.36 (tried both) Trying to enable mail-crypt in global key mode. Nothing is ever encrypted, even when I move mail from folder to folder. I have tried everything available to find here, google, etc and I assume I am missing something fundamental. Debug log shows the plugin loading Jun 15 08:26:00 srv2 dovecot: POP3(rick): Debug: Loading modules from directory: /usr/lib/dovecot Jun 15 08:26:00 srv2 dovecot: POP3(rick): Debug: Module loaded: /usr/lib/dovecot/lib10_mail_crypt_plugin.so Jun 15 08:26:00 srv2 dovecot: POP3(rick): Debug: mail_crypt_plugin: mail_crypt_curve setting missing - generating EC keys disabled (I assume because global not per user) my 10-mailcrypt.conf in .conf.d mail_plugins = $mail_plugins mail_crypt plugin { mail_crypt_global_private_key = </certs/ecprivkey.pem mail_crypt_global_public_key = </certs/ecpubkey.pem mail_crypt_save_version = 2 } I have also tried base64 encoded .pem files inline. I have also added the mail_plugins line to my protocol definitions to no avail and when I do that dovecot -n shows the lines as mail_plugins = " mail_crypt mail_crypt" so I assume it's a mistake to add mail_plugins = $mail_plugins mail_crypt to the protocol sections. Some online tutorials say must do this and others do not mention it at all. Just looking for some guidance as to where to go next.

3 4

zlib compressed folders
by Michael Grant 15 Jun '23

15 Jun '23

I’ve been playing with zlib compressed mail archives. I can’t seem to get it to work. I followed the instructions here: https://doc.dovecot.org/configuration_manual/zlib_plugin/ I’m not interested in being able to save, just read-only would be great. I have some compressed mail archives, for example 2020.gz in my ~/mail/ directory. I have some uncompressed ones too like 2021. Both are mbox formatted. In my imap client, I see both 2020.gz and 2021 as imap folders. I can access mail in 2021 but not in 2020.gz. It just says it’s empty. My local.conf has this in it: mail_plugins = $mail_plugins zlib I know for sure this is being read because if I change this to some non-existent plugin, I see an in the log complaining about a non-existent plugin. I’ve tried also adding in the lines for saving but no difference. Would love to know if there’s something more I need to do. Also, should I expect to see a folder named 2020 instead of 2020.gz in my imap clients? My suspicion is that dovecot is treating these as uncompressed imap folders which it can’t read because they look like garbage. Is there some doveadm command to get it to re-scan folders that I need to run and then realize this is a folder using zlib? Michael Grant

3 3

Empty oldstats
by djdejawu＠gmail.com 15 Jun '23

15 Jun '23

I'm facing a problem to get integration dovecot and Netdata agent to monitor current status of dovecot sessions. First of all I've been set up a socket for reading data with Netdata agent: service old-stats { unix_listener old-stats { group = netdata user = vmail mode = 0660 } } Then in netdata agent UI i've found that all stats collected from this source are zeroed. Hm, maybe I did something wrong, and I goes to check classic command, what Netdata agent uses in Dovecot socket: # doveadm oldstats dump global reset_timestamp last_update num_logins num_cmds num_connected_sessions user_cpu sys_cpu clock_time min_faults maj_faults vol_cs invol_cs disk_input disk_output read_count read_bytes write_count write_bytes mail_lookup_path mail_lookup_attr mail_read_count mail_read_bytes mail_cache_hits auth_successes auth_master_successes auth_failures auth_db_tempfails auth_cache_hits auth_cache_misses 1686759269 0.000000 0 0 0 0.0 0.0 0.0 0 0 0 0 0 0 0 0 0 00 0 0 0 0 0 0 0 0 0 0 Yep, all stats not counted. How to count stats in my setup? Oldstat plugin is enabled. mail_plugins = quota acl old_stats plugin { old_stats_refresh = 10 secs old_stats_track_cmds = yes } # dovecot --version 2.3.19.1 (9b53102964) BR, DeJa

1 0

Empty oldstats
by DeJa Wu 15 Jun '23

15 Jun '23

I'm facing a problem to get integration dovecot and Netdata agent to monitor current status of dovecot sessions. First of all I've been set up a socket for reading data with Netdata agent: service old-stats { unix_listener old-stats { group = netdata user = vmail mode = 0660 } } Then in netdata agent UI i've found that all stats collected from this source are zeroed. Hm, maybe I did something wrong, and I goes to check classic command, what Netdata agent uses in Dovecot socket: # doveadm oldstats dump global reset_timestamp last_update num_logins num_cmds num_connected_sessions user_cpu sys_cpu clock_time min_faults maj_faults vol_cs invol_cs disk_input disk_output read_count read_bytes write_count write_bytes mail_lookup_path mail_lookup_attr mail_read_count mail_read_bytes mail_cache_hits auth_successes auth_master_successes auth_failures auth_db_tempfails auth_cache_hits auth_cache_misses 1686759269 0.000000 0 0 0 0.0 0.0 0.0 0 0 0 0 0 0 0 0 0 00 0 0 0 0 0 0 0 0 0 0 Yep, all stats not counted. How to count stats in my setup? Oldstat plugin is enabled. mail_plugins = quota acl old_stats plugin { old_stats_refresh = 10 secs old_stats_track_cmds = yes } # dovecot --version 2.3.19.1 (9b53102964)

1 0

Panic: file acl-backend-vfile.c: line 123 on access from Nextcloud Imap-Client
by forum＠xp8.de 15 Jun '23

15 Jun '23

Hello, with activated imap_aci i get the following error: Jun 15 08:40:02 konsrvdata2 dovecot: imap(xp8it)<439797><iKSIViX+vKoKXggM>: Panic: file acl-backend-vfile.c: line 123 (acl_backend_vfile_get_local_dir): assertion failed: (list == ns->list) Jun 15 08:40:02 konsrvdata2 dovecot: imap(xp8it)<439797><iKSIViX+vKoKXggM>: Error: Raw backtrace: /usr/lib/dovecot/libdovecot.so.0(backtrace_append+0x46) [0x7f4d46caede6] -> /usr/lib/dovecot/libdovecot.so.0(backtrace_get+0x22) [0x7f4d46caef02] -> /usr/lib/dovecot/libdovecot.so.0(+0x109cdb) [0x7f4d46cbbcdb] -> /usr/lib/dovecot/libdovecot.so.0(+0x109d77) [0x7f4d46cbbd77] -> /usr/lib/dovecot/libdovecot.so.0(+0x5cf73) [0x7f4d46c0ef73] -> /usr/lib/dovecot/modules/lib01_acl_plugin.so(+0x7fbf) [0x7f4d4696dfbf] -> /usr/lib/dovecot/modules/lib01_acl_plugin.so(+0xb795) [0x7f4d46971795] -> /usr/lib/dovecot/modules/lib01_acl_plugin.so(acl_backend_get_default_object+0x69) [0x7f4d46971499] -> /usr/lib/dovecot/modules/lib01_acl_plugin.so(acl_backend_get_default_rights+0x13) [0x7f4d469714c3] -> /usr/lib/dovecot/modules/lib01_acl_plugin.so(+0x8e53) [0x7f4d4696ee53] -> /usr/lib/dovecot/modules/lib02_imap_acl_plugin.so(+0x3975) [0x7f4d46960975] -> dovecot/imap(command_exec+0xa4) [0x55d9dc7f6364] -> dovecot/imap(+0x22312) [0x55d9dc7f4312] -> dovecot/imap(+0x223c4) [0x55d9dc7f43c4] -> dovecot/imap(client_handle_input+0x1bd) [0x55d9dc7f47cd] -> dovecot/imap(client_input+0x74) [0x55d9dc7f4d94] -> /usr/lib/dovecot/libdovecot.so.0(io_loop_call_io+0x6d) [0x7f4d46cd1f8d] -> /usr/lib/dovecot/libdovecot.so.0(io_loop_handler_run_internal+0x13a) [0x7f4d46cd368a] -> /usr/lib/dovecot/libdovecot.so.0(io_loop_handler_run+0x54) [0x7f4d46cd2034] -> /usr/lib/dovecot/libdovecot.so.0(io_loop_run+0x40) [0x7f4d46cd21f0] -> /usr/lib/dovecot/libdovecot.so.0(master_service_run+0x17) [0x7f4d46c446c7] -> dovecot/imap(main+0x4ea) [0x55d9dc7e5d0a] -> /lib/x86_64-linux-gnu/libc.so.6(+0x29d90) [0x7f4d469add90] -> /lib/x86_64-linux-gnu/libc.so.6(__libc_start_main+0x80) [0x7f4d469ade40] -> dovecot/imap(_start+0x25) [0x55d9dc7e5da5] Jun 15 08:40:02 konsrvdata2 dovecot: imap(xp8it)<439797><iKSIViX+vKoKXggM>: Fatal: master: service(imap): child 439797 killed with signal 6 (core dumped) Bug? Any Ideas? Greets! root@konsrvdata2:/etc/dovecot/conf.d# dovecot --version 2.3.16 (7e2e900c1a) root@konsrvdata2:/etc/dovecot/conf.d# doveconf -n # 2.3.16 (7e2e900c1a): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.16 (09c29328) # OS: Linux 5.15.0-67-generic x86_64 Ubuntu 22.04.2 LTS ext4 # Hostname: konsrvdata2 auth_mechanisms = plain cram-md5 auth_username_format = %Ln disable_plaintext_auth = no mail_home = /srv/dovecot/home/%d/%n/ mail_location = maildir:/srv/dovecot/mail/%d/%n/ mail_plugins = acl mail_privileged_group = mail managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext namespace { list = yes location = maildir:/srv/dovecot/mail/waldkindergarten-ts:INDEXPVT=/srv/dovecot/mail/xp8it/shared/waldkindergarten-ts prefix = shared/%%u/ separator = / type = shared } namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = separator = / } passdb { args = scheme=CRYPT username_format=%u /etc/dovecot/users driver = passwd-file } plugin { acl = vfile acl_defaults_from_inbox = yes acl_shared_dict = file:/srv/dovecot/db/shared-mailboxes.db sieve = file:~/sieve;active=~/.dovecot.sieve } protocols = " imap lmtp sieve sieve" service lmtp { unix_listener /var/spool/postfix/private/dovecot-lmtp { group = postfix mode = 0600 user = postfix } } service managesieve-login { inet_listener sieve { port = 4190 } } ssl_cert = </etc/dovecot/private/imap.konis.info.fullchain.pem ssl_client_ca_dir = /etc/ssl/certs ssl_dh = # hidden, use -P to show it ssl_key = # hidden, use -P to show it userdb { args = uid=vmail gid=vmail driver = static } protocol lmtp { mail_plugins = acl sieve } protocol lda { mail_plugins = acl sieve } protocol imap { mail_plugins = acl imap_acl }

1 0

Re: imap syncing issues
by dovecot＠x9p.org 14 Jun '23

14 Jun '23

Paul Kudla already suggested setting fetch intervals and to avoid microsoft clients. You can debug the issue with tcpdump like this: # tcpdump -X -s100 -nni lo0 port 143 (replace lo0 for lo, eth0 or the name of your interface) disable all clients, enable the one you want to debug/see the commands. me deleting a message and client issuing the command: 14:40:17.386079 127.0.0.1.48376 > 127.0.0.1.143: P 1410:1437(27) ack 177507 win 256 <nop,nop,timestamp 1610013520 2861364932> (DF) ......(REDACTED) 0030: aa8c f6c4 3131 3120 7569 6420 6d6f 7665 ....111 uid move 0040: 2034 3732 3920 2254 7261 7368 220d 0a 4729 "Trash".. 14:40:17.486259 127.0.0.1.143 > 127.0.0.1.48376: P 177507:177624(117) ack 1437 win 256 <nop,nop,timestamp 2861364932 1610013520> (DF) ......(REDACTED) 0030: 5ff6 db50 2a20 4f4b 205b 434f 5059 5549 _..P* OK [COPYUI 0040: 4420 3136 3830 3237 3234 3630 2034 3732 D 1680272460 472 0050: 3920 3132 365d 204d 6f76 6564 2055 4944 9 126] Moved UID Cheers, x9p On 6/14/23 17:19, Michael Grant wrote: > > Yes, I’m the sole person responsible for messing this up. My Linux > machine, my server, I installed it, I configured it, perhaps I caused > this.... > > It could be some misbehaving imap client that is causing this, that’s > one of the things I’m trying to understand. I don’t see any errors in > the mail log which is where dovecot logs to. All the clients are as > up to date as possible. > > One way forward that I know of is to remove all the imap clients and > start over, adding one by one seeing if it starts breaking again. I > was hoping first to see if I could figure out what’s gone wrong before > doing this. > > *From: *dovecot(a)x9p.org > *Sent: *14 June 2023 18:05 > *To: *Michael Grant <mailto:mgrant@grant.org>; dovecot(a)dovecot.org > *Subject: *Re: imap syncing issues > > The issue seems to be with the clients (an update maybe?), not the server. > > do you have console/root access to dovecot and files? > > On 6/14/23 11:17, Michael Grant via dovecot wrote: > > I’m having synchronization issues in imap. I am accessing my mail > from several different imap clients: K9 on Android, Windows 11 and > 10 mail client, and Android Gmail app. Both desktop and laptop, > tablet, phone. I know I have more than the usual number of imap > connections... > > Often when I delete a message in one place, it doesn’t get deleted > in another. For example, if I delete a message on K9 then open my > laptop, it’s still there in W11 Mail. But just now, I deleted > some messages on my laptop and swiped down on K9 and the message > disappeared on K9. But K9 shows other messages which have been > deleted in Windows 11 Mail. I’ve not yet been able to figure out > a pattern. It’s annoying me. I have to delete messages in > several different places. Messages not coming back, they’re just > not being deleted in one place and that delete operation is not > syncing to the others. > > Messages seem to be being marked as read properly across devices. > This seems to be an issue with delete only, so far as I’ve noticed. > > I’ve long been using multiple imap clients, this syncing issue > started maybe 6 to 8 months ago. > > Is there a good way to get debugging info out of dovecot as to > what the clients are doing? > > Or does anyone have any advise which might help resolve this > without resorting to me digging into the imap protocol? > > Michael Grant > > > > _______________________________________________ > > dovecot mailing list --dovecot(a)dovecot.org > > To unsubscribe send an email todovecot-leave(a)dovecot.org >

1 0

imap syncing issues
by Michael Grant 14 Jun '23

14 Jun '23

I’m having synchronization issues in imap. I am accessing my mail from several different imap clients: K9 on Android, Windows 11 and 10 mail client, and Android Gmail app. Both desktop and laptop, tablet, phone. I know I have more than the usual number of imap connections... Often when I delete a message in one place, it doesn’t get deleted in another. For example, if I delete a message on K9 then open my laptop, it’s still there in W11 Mail. But just now, I deleted some messages on my laptop and swiped down on K9 and the message disappeared on K9. But K9 shows other messages which have been deleted in Windows 11 Mail. I’ve not yet been able to figure out a pattern. It’s annoying me. I have to delete messages in several different places. Messages not coming back, they’re just not being deleted in one place and that delete operation is not syncing to the others. Messages seem to be being marked as read properly across devices. This seems to be an issue with delete only, so far as I’ve noticed. I’ve long been using multiple imap clients, this syncing issue started maybe 6 to 8 months ago. Is there a good way to get debugging info out of dovecot as to what the clients are doing? Or does anyone have any advise which might help resolve this without resorting to me digging into the imap protocol? Michael Grant

3 2

Migration dovecot server with local users to dovecot with virtual mailboxes
by tseegerkrb＠gmail.com 12 Jun '23

12 Jun '23

Hello, we are using a dovecot server with NIS, we want to transfer it to a new setup. As backend a mysql server will be used in the future. My problem is, if I just copy the maildir or use "doveadm import" all mails are flagged as "unseen". How can i preserve the flags? This is how I have tried it so far. root@mail / $ doveadm import -s -u testuser(a)testdomain.local maildir:/tmp/testuser-maildir-230608/Maildir/:INDEX=MEMORY "" "All" As a "workaround" I tried to change the flags. root@mail / $ doveadm -v flags add -u testuser(a)testdomain.local "Seen" "ALL" This led partially to the desired success, the mails are shown as "seen", but the folders (e.g. Roundcube) still show unread mails. dovecot -n ############################################ # 2.3.13 (89f716dc2): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.13 (cdd19fe3) # OS: Linux 5.10.0-23-cloud-amd64 x86_64 Debian 11.7 # Hostname: mail.testdomain.local auth_mechanisms = plain login mail_fsync = always mail_gid = vmail mail_home = /var/vmail/mailboxes/%d/%n mail_location = maildir:~/mail:LAYOUT=fs:INDEX=MEMORY mail_privileged_group = vmail mail_uid = vmail managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext imapsieve vnd.dovecot.imapsieve mmap_disable = yes namespace inbox { inbox = yes location = mailbox Drafts { auto = subscribe special_use = \Drafts } mailbox Sent { auto = subscribe special_use = \Sent } mailbox Spam { auto = subscribe special_use = \Junk } mailbox Trash { auto = subscribe special_use = \Trash } prefix = } passdb { args = /etc/dovecot/dovecot-sql.conf driver = sql } plugin { imapsieve_mailbox1_before = file:/var/vmail/sieve/global/learn-spam.sieve imapsieve_mailbox1_causes = COPY imapsieve_mailbox1_name = Spam imapsieve_mailbox2_before = file:/var/vmail/sieve/global/learn-ham.sieve imapsieve_mailbox2_causes = COPY imapsieve_mailbox2_from = Spam imapsieve_mailbox2_name = * quota = maildir:User quota quota_exceeded_message = User %u has exhausted allowed storage space. sieve = file:/var/vmail/sieve/%d/%n/scripts;active=/var/vmail/sieve/%d/%n/active-script.sieve sieve_before = /var/vmail/sieve/global/spam-global.sieve sieve_global_extensions = +vnd.dovecot.pipe sieve_pipe_bin_dir = /usr/bin sieve_plugins = sieve_imapsieve sieve_extprograms } protocols = imap lmtp sieve service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0660 user = postfix } unix_listener auth-userdb { group = vmail mode = 0660 user = vmail } } service imap-login { inet_listener imap { port = 143 } process_min_avail = 1 service_count = 1 } service lmtp { unix_listener /var/spool/postfix/private/dovecot-lmtp { group = postfix mode = 0660 user = postfix } user = vmail } service managesieve-login { inet_listener sieve { port = 4190 } } ssl = required ssl_ca = </etc/dovecot/private/ca-testdomain.local_tls_srv_crt.crt ssl_cert = </etc/dovecot/private/mail.testdomain.local_tls_srv_crt.crt ssl_cipher_list = ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384 ssl_dh = # hidden, use -P to show it ssl_key = # hidden, use -P to show it ssl_min_protocol = TLSv1.2 userdb { args = /etc/dovecot/dovecot-sql.conf driver = sql } protocol imap { imap_idle_notify_interval = 29 mins mail_max_userip_connections = 20 mail_plugins = " quota imap_quota imap_sieve" } protocol lmtp { mail_plugins = " sieve notify push_notification quota" postmaster_address = postmaster(a)testdomain.local } ############################################ Thanks for your help

5 6

dovecot with sieve vacation plugin
by spi 12 Jun '23

12 Jun '23

Hi all I have an issue understanding the sieve vacation plugin. I can get it trigger for particular emails or something, but I don't get the sender setting right. My setup: I've got an external email address a(a)aaa.com and a local b(a)bbb.local (which is used in virtual_mailbox_maps in postfix or for user authentication in dovecot). Emails for a(a)aaa.com get stored in the b(a)bbb.local mailbox. Postfix uses an external relay to transfer emails from a(a)aaa.com. Sending and receiving emails works as a charm. In received emails I see headers for Return-Path: <the original sender> Delivered-To: b(a)bbb.local Envelope-To: a(a)aaa.com X-Original-to: a(a)aaa.com In sieve I've got configured for the user b(a)bbb.local require "vacation"; if allof ( address :domain "From" "other-sender.com", currentdate :value "ge" "date" "2023-05-24" ) { vacation :from "a <a(a)aaa.com>" #:addresses ["a(a)aaa.com", "b(a)bbb.local"] :addresses ["a(a)aaa.com"] :subject "Out of office by EoL" "bla bla bla"; } The issue: When I receive an email from e. g. john(a)other-sender.com a vacation response gets created and sent. The From header ist set to the value configured by ":addresses ["a(a)aaa.com"]". But: a) If I set "sieve_vacation_send_from_recipient = yes" in dovecot.conf the sender header in the vaction response is filled in with b(a)bbb.local. b) If I set "sieve_vacation_send_from_recipient = no" in dovecot.conf the sender header in the vaction response stays blank (which I understand is the preferred way). Different settings for sieve_vacation_use_original_recipient don't seem to make any difference. In both cases a) and b) postfix tries todeliver the email directly to the receiving mail server and does not care for my sender relay host map (sender_dependent_relayhost_maps in postfix main.cf), well of course as there is no relay host for @bbb.local (case a)) and in case b) the sender is blank. In my understanding the vacation plugin uses the original recipient as sender for the out of office reply which in my case is in the X-Original-to header (I use lmtp and have also set "lda_original_recipient_header = X-Original-To"). But it does not - it sticks with the b(a)bbb.local mail address as sender. If I omitted the sender setting - how could I tell postfix to relay these ooo mails through the correct relay (like based on the From header domain in the vacation response)? What would the right approach be to set the sender right or get postfix to relay the vacation responses correctly? Any help would be appreciated! -- Cheers spi

2 8

Re: No-novice with Dovecot, but need novice-like advice (was Dovecot cracked?!)
by Jochen Bern 11 Jun '23

11 Jun '23

On 09.06.23 00:36, Richard Troy wrote: > OH, sure, I got it down to a trickle, but these few Russian sites > always managed to get their spam through and (FWIW, if you can characterize the offenders by country, trying a GeoIP filter as a stop-gap measure sounds rather promising.) > Give me a white-list of the > ONLY accounts that can relay; NOTHING ELSE can relay. ... THAT would do > it! But no! Neither in Postfix nor dovecot is there such a thing! I'm afraid that that's not *entirely* true ... : > /etc/postfix# grep senderauth main.cf > smtpd_sender_login_maps = hash:/etc/postfix/senderauth > /etc/postfix# head -2 senderauth ; grep bern senderauth | sed -e 's/[-a-z\.]*'"$DOMAIN/DOMAIN/g" > # Envelope Sender: Requires SMTP AUTH as one of: > # actual.address(a)dom.ain user.1(a)dom.ain, another(a)else.where > jochen.bern(a)DOMAIN.pawisda.de jochen.bern(a)DOMAIN.de (Also works with unspecified local part, i.e., "@some.dom.ain" for the left-hand side.) > Combine that with a greylist type function where the usual IP addresses > for particular users were let through, and new ones delayed, THAT would > be awesome, too! Please define "delayed". The kind where you tell the client to retry later and then close the connection is available for postfix under the name of postgrey, but is probably quite disruptive when used with an M*S*A port; same caveat for mechanisms that prevent the connection altogether, like one could build with iptables. The search keyword for the kind where "the server is just deeaaaaaaadddd slllooooowwwww" would be "Teergrube". [Yes, I'm German, so I capitalize German nouns like German does. :-> ] None of those are *built right into* postfix or dovecot, likely because it's too much complexity to maintain for a huge user base that doesn't use the functionality all too often. > And if someone tells me I'm wrong and points me at how to do these > things, I'll fall out of my damned chair! [promptly invents the sport of Comfy Cushion Curling] > IF we had an IMAP supported password CHANGING scheme, we'd gladly run > encrypted passwords, but there isn't, and we haven't invented (finished > inventing!) our own web-way to change 'em and so we're stuck with plain > text until one of these things changes. Your server is Linux and SSH client software has become quite available (PuTTY on Windows). For OS-based users who don't need *shell* access to the server, I've had some success just setting the "passwd" command as their login "shell" (in /etc/passwd . Plus adding it to /etc/shells if necessary.) Dunno how readily you could find an equivalent for the *virtual* accounts' password backend ... (Yes, it'd be better to have it seamlessly integrated into the IMAP protocol, but don't forget that you'd need the *MUAs* to start supporting it as well before the general public will ever even learn about the new feature ...) Kind regards, -- Jochen Bern Systemingenieur Binect GmbH

2 1

No-novice with Dovecot, but need novice-like advice (was Dovecot cracked?!)
by Richard Troy 09 Jun '23

09 Jun '23

Hi All, This is my first posting here, and maybe I should have found this WAY back in January, '23, if not LONG before. I want to be but I find it difficult here to be brief. ... Surely background will surely help: A 27 or so year old Fedora / Postfix / Dovecot site I built had a major disaster in January and I've not yet been able to fully recover because Dovecot has let the damned spammers in again and again and again and again! OH, sure, I got it down to a trickle, but these few Russian sites always managed to get their spam through and I just had to shut Dovecot down entirely. I never found out how they got in, etc. And I've STRONGLY suspected Dovecot got cracked - at least the modern version in the youngest version for the youngest Fedora we had back in January - uh, Fedora Server 37 - I've forgotten the matching Dovecot version. In the disaster, we lost /var but not /etc, so I figured recovery would be easy and for nearly everything, it was. But NOT Dovecot (and insofar as it matters, Postfix), and in these 5+ months I've tried so many things, I'm sure I've forgotten most of them and I don't know that a retroactive look is worth doing. ...I kept some notes that might be useful if anyone wants to see the evidence of the cracking, but in short, I kept a constant watch on the logs and when ANY relay happened that shouldn't, I'd instantly know it and shut things off entirely. However, that became untenable as I couldn't find the problem and had to just shut it off, pissing off users, etc, but I've had to do things like spend a month and a half traveling, and so forth and, well... Life goes on, as the saying goes. --- NOW I want to try again. It's my perception that it's a waste of time to even LOOK at the old Dovecot configuration stuff. I feel I need to REMOVE it ALL, and I could use some help being SURE to get it all gone. And then I think I need to do a FULL new installation. Overkill? IDK. I could use some advice about SAFE ways to make changes and test to ensure we do NOT become an open mail relay EVER AGAIN. ALSO WORTH SAYING is that if Dovecot were all that damned safe and secure I wouldn't so easily be able to propose a new feature that would make a HUGE difference to sites like mine: Give me a white-list of the ONLY accounts that can relay; NOTHING ELSE can relay. ... THAT would do it! But no! Neither in Postfix nor dovecot is there such a thing! Combine that with a greylist type function where the usual IP addresses for particular users were let through, and new ones delayed, THAT would be awesome, too! And this isn't even all that hard to do - I could do it if I didn't already have a thousand obligations in life! And if someone tells me I'm wrong and points me at how to do these things, I'll fall out of my damned chair! And after picking myself up, I'll find a way to send that person some sort of gift. THIS WOULD HAVE SOLVED ALL MY PROBLEMS. And I'm sure MANY others could use this, too! --- THIS configuration: I'd like to find a way to have both virtual and our existing "unix accounts" users. IF we had an IMAP supported password CHANGING scheme, we'd gladly run encrypted passwords, but there isn't, and we haven't invented (finished inventing!) our own web-way to change 'em and so we're stuck with plain text until one of these things changes. BTW, isn't this a HUGE and OBVIOUS hole that should have been fixed decades ago?! If a major provider like the Dovecot.org team added a way to update passwords to the IMAP protocol, all the rest of the folks would follow along for sure! OR, "is that a thing" and I'm just ignorant of it? So, again, plain-text, in cram, of course. What else? Coach me on "the right way" if you want, but if users can't change it themselves, they'd rather I can retrieve it for them if needed... I'm sure the corporate world doesn't do it this way, but their code isn't open source, or am I wrong?... --- In closing I don't actually anticipate ANY help. My father, an even earlier computer user than me, once observed, "you can ask for information until you're blue in the face, and nobody will say a thing, but post the WRONG thing and a hundred people will post to point out you're wrong!" GIVEN how EASY it is to have your email system become an instant open relay at the hands of the spammers out there, how the hell Dovecot can advertise the way it is WITHOUT a serious guide about this is just frustrating and laughable. But I'd love to be shown where they DO help with this! Thanks for any and all help, Richard

5 13

Remove attachments
by Oliver Glas 08 Jun '23

08 Jun '23

5 6

Help needed with imap_sieve and mail_crypt plugin
by Robert Senger 08 Jun '23

08 Jun '23

Hi there, I was using imap_sieve for many years now to pipe mails upon user action (moving mails to the SPAM folder) into spamassassin to train spam detection. This worked fine all the time. Now we're moving to encrypted mail storage on per user basis, with encrypted private keys. This works well, but it breaks the spamassassin training upon user action since it would feed encrypted mail into spamassassin, which makes no sense. So, my question is, is there a possibility to call the mail_crypt plugin from imap_sieve to decrypt the email (that means, decrypt the private key with the user password, decrypt the email that's moved to the SPAM folder) before it's piped into spamassassin? Thanks for help! Robert -- Robert Senger

2 2

Repeating imap processes crashes with signal 11 after imapc-client timeout leak
by Nikolaos Pyrgiotis 07 Jun '23

07 Jun '23

Hello, We run a 5 instances dovecot cluster ondebian 11 virtual machines, a dovecot proxy, 2directors and 2dovecot backends. All dovecot instances run version 2.3.20. We use a glusterfs mounted volume on the backends forthe mail storage. Our users all use thunderbird mail client and they do not report any issue with the imap service. Since we have configured the dovecot cluster we see multiple random imap crashes with signal 11 and timeout leaks in the logs on both the backends for multiple users. Is this is a configuration problem or a bug with imapc or imap; I would appreciate if you could assist us to debug this further. A coredump is attached if it helps. The logs look similar to this: Jun 01 16:21:13 doveb0-rmt0-cn1 dovecot[75106]: imap(user(a)domie02.com)<105800><BxSqJw39DLgKZQD+>: Warning: Timeout leak: 0x7f9a92c0c1c0 (imapc-client.c:475) Jun 01 16:21:13 doveb0-rmt0-cn1 dovecot[75106]: imap(user(a)domie02.com)<105800><BxSqJw39DLgKZQD+>: Warning: Raw backtrace for leaks: /usr/lib/dovecot/libdovecot.so.0(backtrace_append+0x42) [0x7f9a92a7e872] -> /usr/lib/dovecot/libdovecot.so.0(backtrace_get+0x1e) [0x7f9a92a7e98e] -> /usr/lib/dovecot/libdovecot.so.0(io_loop_destroy+0x2b5) [0x7f9a92aa21e5] -> /usr/lib/dovecot/libdovecot-storage.so.0(imapc_client_run+0x115) [0x7f9a92c0bcb5] -> /usr/lib/dovecot/libdovecot-storage.so.0(imapc_mailbox_run_nofetch+0x20) [0x7f9a92c089f0] -> /usr/lib/dovecot/libdovecot-storage.so.0(imapc_mailbox_sync_init+0x868) [0x7f9a92c0b198] -> /usr/lib/dovecot/libdovecot-storage.so.0(mailbox_sync_init+0x58) [0x7f9a92bbfa68] -> dovecot/imap(imap_sync_init+0x95) [0x5605e4ebbe55] -> dovecot/imap(+0x17343) [0x5605e4ea5343] -> dovecot/imap(cmd_idle+0xb4) [0x5605e4ea5674] -> dovecot/imap(command_exec+0xa4) [0x5605e4eb04d4] -> dovecot/imap(+0x2044f) [0x5605e4eae44f] -> dovecot/imap(+0x204fa) [0x5605e4eae4fa] -> dovecot/imap(client_handle_input+0x1b5) [0x5605e4eae9d5] -> dovecot/imap(client_input+0x70) [0x5605e4eaef40] -> /usr/lib/dovecot/libdovecot.so.0(io_loop_call_io+0x69) [0x7f9a92aa1819] -> /usr/lib/dovecot/libdovecot.so.0(io_loop_handler_run_internal+0x132) [0x7f9a92aa2f02] -> /usr/lib/dovecot/libdovecot.so.0(io_loop_handler_run+0x50) [0x7f9a92aa18c0] -> /usr/lib/dovecot/libdovecot.so.0(io_loop_run+0x40) [0x7f9a92aa1a80] -> /usr/lib/dovecot/libdovecot.so.0(master_service_run+0x13) [0x7f9a92a143c3] -> dovecot/imap(main+0x4fa) [0x5605e4e9ff0a] -> /lib/x86_64-linux-gnu/libc.so.6(__libc_start_main+0xea) [0x7f9a927d2d0a] -> dovecot/imap(_start+0x2a) [0x5605e4e9ffca] Jun 01 16:23:49 doveb0-rmt0-cn1 dovecot[75106]: imap(user(a)domie02.com)<105800><BxSqJw39DLgKZQD+>: Fatal: master: service(imap): child 105800 killed with signal 11 (core dumped) Below i post the dovecot configuration of one of the two dovecot backends: # 2.3.20 (80a5ac675d): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.20 (149edcf2) # OS: Linux 5.10.0-23-amd64 x86_64 Debian 11.7 fuse.glusterfs # Hostname: doveb0-rmt0-cn1 auth_cache_negative_ttl = 5 mins auth_cache_size = 50 M auth_default_realm = domie02.com auth_master_user_separator = * auth_mechanisms = plain login auth_verbose = yes auth_worker_max_count = 16 disable_plaintext_auth = no first_valid_uid = 499 hostname = smtp.domie02.com imapc_features = fetch-bodystructure fetch-headers rfc822.size search modseq acl delay-login imapc_host = 10.101.0.250 imapc_max_idle_time = 5 mins imapc_password = # hidden, use -P to show it imapc_sasl_mechanisms = plain login imapc_ssl = starttls imapc_ssl_verify = no last_valid_uid = 499 lda_mailbox_autocreate = yes lda_mailbox_autosubscribe = yes login_greeting = You have successfully logged in to domie02.com IMAP server login_trusted_networks = 10.101.0.74 10.101.0.73 mail_always_cache_fields = flags hdr.* date.received date.sent mail_cache_fields = flags date.received guid size.physical size.virtual imap.bodystructure body.snippet mail_debug = yes mail_fsync = always mail_location = mdbox:/var/vmail/%d/%n/mdbox:VOLATILEDIR=/dev/shm/dovecot/%2.256Nu/%d/%n mail_plugins = " notify mail_log zlib acl" mail_privileged_group = mail managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext mdbox_rotate_size = 200 M mmap_disable = yes namespace Domie02 { list = children location = imapc:/var/vmail/%d/%n/shared/indexes/%%n:INDEXPVT=/var/vmail/%d/%n/shared-pvt/%%n:VOLATILEDIR=/dev/shm/dovecot/%2.256Nu/%d/%n/%%n prefix = shared.%%n. separator = . subscriptions = no type = shared } namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Spam.Virus { auto = subscribe } mailbox Spam { auto = subscribe } mailbox Trash { special_use = \Trash } prefix = separator = . subscriptions = yes type = private } passdb { args = password=#hidden_use-P_to_show# driver = static master = yes override_fields = allow_real_nets=127.0.0.0/8,local,10.101.0.74,10.101.0.73 userdb_acl_user=%{auth_user} userdb_namespace/Domie02/disabled=yes result_success = continue } passdb { args = password=#hidden_use-P_to_show# driver = static override_fields = allow_real_nets=127.0.0.0/8,local,10.101.0.74,10.101.0.73 result_success = continue } passdb { args = /etc/dovecot/dovecot-ldap-users.conf.ext driver = ldap } passdb { args = /etc/dovecot/dovecot-ldap-groups.conf.ext driver = ldap } plugin { acl = vfile:/etc/dovecot/global-acls/%d/master-dovecot-acl:cache_secs=300 acl_defaults_from_inbox = yes acl_globals_only = no acl_shared_dict =file:/var/dovecot-acl/%d/shared-mailboxes.db imap_compress_deflate_level = 6 mail_log_events = flag_change mail_log_fields = uid box flags sieve =file:~/sieve;active=~/sieve/%n.sieve sieve_before = /var/vmail/global-sieve/global.sieve sieve_env_email_address = %u sieve_env_mailbox_prefix = %{userdb:mailbox_prefix} sieve_global = /var/vmail/sieve sieve_global_extensions = +editheader +vnd.dovecot.environment zlib_save = zstd zlib_save_level = 5 } protocols = " imap lmtp sieve submission" service auth-worker { user = dovecot } service auth { unix_listener auth-userdb { group = mail mode = 0666 user = vmail } } service doveadm { inet_listener dovadm-dom-mgmt { address = 10.100.1.71 port = 8080 ssl = no } inet_listener dovadm-dom { address = 10.101.0.71 port = 8080 ssl = no } vsz_limit = 256 M } service imap-login { inet_listener imap-dom { address = 10.101.0.71 port = 143 ssl = no } inet_listener imap { port = 0 } inet_listener imaps-dom { address = 10.101.0.71 port = 993 ssl = yes } inet_listener imaps { port = 0 } process_limit = 400 process_min_avail = 2 service_count = 20 vsz_limit = 512 M } service imap { process_limit = 2048 process_min_avail = 0 service_count = 1 vsz_limit = 4 G } service lmtp { inet_listener lmtp-dom { address = 10.101.0.71 port = 24 ssl = no } process_limit = 0 process_min_avail = 0 service_count = 0 unix_listener lmtp { mode = 0666 } vsz_limit = 256 M } service managesieve-login { inet_listener sieve-dom { address = 10.101.0.71 port = 4190 ssl = no } inet_listener sieve { port = 0 } process_limit = 0 process_min_avail = 0 service_count = 0 vsz_limit = 64 M } service managesieve { process_limit = 1024 process_min_avail = 0 service_count = 1 vsz_limit = 256 M } service submission-login { inet_listener submission-dom { address = 10.101.0.71 port = 587 ssl = no } inet_listener submission { port = 0 } inet_listener submissions-dom { address = 10.101.0.71 port = 465 ssl = yes } process_limit = 250 process_min_avail = 2 service_count = 1 vsz_limit = 256 M } service submission { process_limit = 1024 process_min_avail = 0 service_count = 1 vsz_limit = 256 M } ssl = required ssl_cert = </etc/ssl/certs/doveb0-rmt0-cn1.mail.rmt.domie02.com.pem ssl_client_ca_dir = /etc/ssl/certs ssl_key = # hidden, use -P to show it submission_max_mail_size = 30000 k submission_relay_host = 10.101.0.7 submission_relay_port = 587 submission_relay_ssl = starttls submission_relay_ssl_verify = no submission_relay_trusted = yes userdb { driver = prefetch } userdb { args = /etc/dovecot/dovecot-ldap-users.conf.ext driver = ldap } userdb { args = /etc/dovecot/dovecot-ldap-groups.conf.ext driver = ldap } protocol lmtp { mail_plugins = " notify mail_log zlib acl sieve acl" } protocol lda { mail_plugins = " notify mail_log zlib acl sieve acl" } protocol imap { mail_max_userip_connections = 100 mail_plugins = " notify mail_log zlib acl" } protocol sieve { mail_max_userip_connections = 40 } protocol submission { mail_max_userip_connections = 70 } local 10.101.0.71 { doveadm_allowed_commands = doveadm_password = # hidden, use -P to show it } local 10.100.1.71 { doveadm_allowed_commands = doveadm_password = # hidden, use -P to show it } } Thank you, Nikolaos Pyrgiotis

2 1

sieve accepting instructions from email
by Marc 07 Jun '23

07 Jun '23

Before switching to sieve, I used to have something in procmail that would allow you to turn on an auto reply by sending an email. - send email to yourself with request - receive auth code - send auth code and auto reply text - receive confirmation the auto reply is on Is there some solution in sieve (plugin) to configure your sieve rules via such email commands?

2 1

Multiple backends with NFSv4.1 (supports file locking): should work without Director, right?
by pierre.alletru＠gmail.com 05 Jun '23

05 Jun '23

Hi Dovecot community, We're looking at running multiple Dovecot backend servers in parallel, all using the same shared NFSv4.1 mount to store mailboxes in the maildir format. We've read in multiple places that running multiple backends with a shared NFS can result in issues like index files corruption. The standard solution seems to use the Director feature, or some kind of IP based proxy/load balancer. But: 1 - The Director feature will be removed in future free versions of Dovecot (https://dovecot.org/mailman3/archives/list/dovecot@dovecot.org/thread/ILA3C…) 2 - NFSv4 and above support file locking (flock and fcntl, flock being emulated using fcntl). 3 - It looks like Dovecot does use file locking, though we're unsure if it does on everything and in particular on index files. Thus, we are wondering if the need for Director is still relevant with NFSv4? Shouldn't it work without Director thanks to file locking? Has anyone tried it? We're thinking that the documentation and various threads on the subject may be outdated, based on NFSv3 and lower (no file locking). If it doesn't work, anybody knows why? Isn't file locking there precisely to handle concurrency? Thanks!

10 17