- dovecot - dovecot.org

Mailing list is being Spam Filtered by O-365
by White, Daniel E. (GSFC-770.0)[AEGIS] 20 Apr '23

20 Apr '23

Is there any chance that SPF and DKIM records could be added to appear in the headers ? The gubba-mint folks are getting extremely medieval about email security.

2 1

Request - extra variable in passdb for logging
by Bogusław Juza 20 Apr '23

20 Apr '23

Hi Staff, I'm creating the dovecot configuration for multiple user passwords e-mail site. It's working well, but I've one problem - I can't log, which password was used. I'm using auth-sql, the query looks like: password_query = \ SELECT `users`.`email` AS `user`, \ `shadow`.`passwd` AS `password`, \ FROM `shadow` WHERE `shadow`.`email` = '%u' AND \ ( ('%r'='127.0.0.1' AND `shadow`.`webmail`<>0) OR \ ('%r'<>'127.0.0.1' AND `shadow`.`imap`<>0 AND \ `shadow`.`hash`='%{sha512;rounds=5000:password}') \ ) LIMIT 1 The hash from random generated application password works as the selector, which password should be checked. It works fine, but in the log I have got only the e-mail and both IP addresses. I need to log one more information - which password was used (`shadow`.`id` column). It would be a great feature to have one more extra variable, which I could set in this query and which goes directly to log and nowhere else. I have tried something like: password_query = \ SELECT CONCAT(`users`.`email`,'#',`shadow`.`id`) AS `user`, ... and then "repair it" in user_query: SELECT `email` AS `user` WHERE `email` = REGEXP_SUBSTR('%u','[^#]+') and it even works well, except postfix-auth, which received email with #number as the username and it was problematic. So I'm kindly asking for this extra variable in next versions of Dovecot ;) Bogusław Juza

2 1

last_login plugin and $remote_ip
by Fabrizio Cuseo 19 Apr '23

19 Apr '23

Good morning. I am planning a dovecot system with: - 3 x glusterfs servers (with 2 volumes, 1 ssd for short term mail, and 1 with bigger hdd for long term archive mail) - 1 x mysql server (another server with active replica will be added) - 3 x mbox servers (with dovecot pop/imap/lmpt/sieve/postfix) - 3 x dovecot proxy/directors for pop3/imap/smtp - 4 x proxmox mail gateway for antispam/antivirus in front of smtp servers - 1 x centralized syslog server All have private ip addresses, and in front there is a firewall with HA_proxy to make high availability and load balancing. My only problem now is using last_login plugin; i have configured on the mailbox servers on pop3/imap, but the ip address that is written on mysql is the proxy/director address, not the real client ip address. No results using real_remote_ip. Apr 19 09:14:31 mailbox-01 dovecot: pop3-login: Login: user=<username(a)domain.it>, method=PLAIN, rip=172.16.27.31, lip=172.16.27.21, mpid=19723, session=<42nHLKv5JsqsEBsf> Apr 19 09:14:31 mailproxy-01 dovecot: pop3-login: proxy(username@domain.it,172.16.27.21:110): Started proxying to 172.16.27.21 (1.978 secs): user=<username(a)domain.it>, method=PLAIN, rip=212.66.96.188, lip=172.16.27.31, session=<u4+wLKv5ZUjUQmC8> Apr 19 09:14:34 mailbox-01 dovecot: pop3(username(a)domain.it)<19723><42nHLKv5JsqsEBsf>: Disconnected: Logged out top=0/0, retr=0/0, del=0/37, size=115779706 Apr 19 09:14:34 mailproxy-01 dovecot: pop3-login: proxy(username@domain.it,172.16.27.21:110): Disconnected by server (0s idle, in=45, out=82): user=<username(a)domain.it>, method=PLAIN, rip=212.66.96.188, lip=172.16.27.31, session=<u4+wLKv5ZUjUQmC8> in db I have last_ip: 172.16.27.31, not 212.66.96.188 ------------- dovecot -n # 2.3.16 (7e2e900c1a): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.16 (09c29328) # OS: Linux 5.15.0-69-generic x86_64 Ubuntu 22.04.2 LTS # Hostname: mailbox-01 auth_default_realm = XXXXXXXX.it default_client_limit = 2500 dict { mysql = mysql:/etc/dovecot/dovecot-dict-sql.conf.ext sieve = mysql:/etc/dovecot/dict-sieve-sql.conf sql = mysql:/etc/dovecot/dovecot-dict-sql.conf.ext } disable_plaintext_auth = no doveadm_api_key = # hidden, use -P to show it first_valid_gid = 89 first_valid_uid = 89 imap_client_workarounds = tb-extra-mailbox-sep delay-newmail login_greeting = Welcome to mail server mail_fsync = always mail_gid = 89 mail_location = mbox:~/mail:INBOX=/var/mail/%u mail_plugins = quota mail_privileged_group = mail mail_uid = 89 mailbox_list_index_very_dirty_syncs = yes mdbox_rotate_size = 128 M mmap_disable = yes namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = separator = . } passdb { driver = pam } passdb { args = /etc/dovecot/dovecot-sql.conf.ext driver = sql } plugin { last_login_dict = proxy::sql last_login_key = # hidden, use -P to show it last_login_precision = ms quota = count:User quota quota_clone_dict = proxy::mysql quota_grace = 50M quota_rule2 = Trash:storage=+100M quota_vsizes = yes quota_warning = storage=95%% quota-warning 95 %u quota_warning2 = storage=80%% quota-warning 80 %u sieve = dict:proxy::sieve;name=active sieve_extensions = +vacation-seconds sieve_vacation_default_period = 7d sieve_vacation_max_period = 30d sieve_vacation_min_period = 1h } pop3_client_workarounds = outlook-no-nuls oe-ns-eoh protocols = " imap lmtp pop3" service dict { unix_listener dict { group = mail2023 mode = 0660 user = mail2023 } } service doveadm { inet_listener { port = 2425 } inet_listener http { port = 8080 } unix_listener doveadm-server { user = mail2023 } } service imap { process_limit = 1024 } service lmtp { inet_listener lmtp { port = 24 } unix_listener /var/spool/postfix/private/dovecot-lmtp { group = mail2023 mode = 0666 user = mail2023 } } service pop3 { process_limit = 250 } service quota-warning { executable = script /usr/local/bin/quota-warning.sh unix_listener quota-warning { mode = 0666 user = mail2023 } user = mail2023 } service stats { unix_listener stats-reader { group = mail2023 mode = 0660 user = mail2023 } unix_listener stats-writer { group = mail2023 mode = 0660 user = mail2023 } } ssl_cert = </etc/dovecot/private/dovecot.pem ssl_client_ca_dir = /etc/ssl/certs ssl_dh = # hidden, use -P to show it ssl_key = # hidden, use -P to show it userdb { driver = passwd } userdb { args = /etc/dovecot/dovecot-sql.conf.ext driver = sql } protocol lmtp { mail_plugins = quota sieve quota quota_clone } protocol !indexer-worker { mail_vsize_bg_after_count = 100 } protocol lda { mail_plugins = quota sieve quota quota_clone } protocol imap { mail_max_userip_connections = 10 mail_plugins = quota quota imap_quota quota_clone last_login } protocol pop3 { mail_max_userip_connections = 2 mail_plugins = quota quota quota_clone last_login } in dovecot-dict-sql.conf.ext there is: map { pattern = shared/last-login/$service/$user/$remote_ip table = mail_last_login value_field = last_access value_type = uint fields { userid = $user service = $service last_ip = $remote_ip } } -- --- Fabrizio Cuseo - mailto:f.cuseo@panservice.it

2 2

Re: Mailing list update
by Peter Wienemann 19 Apr '23

19 Apr '23

Dear Aki, On 12.04.23 13:31, Aki Tuomi via dovecot wrote: > We finally managed to move from mailman2 to mailman3, and mail archives are now at https://dovecot.org/mailman3/archives and they can be now searched, too. thanks for this. > Please let us know if you have face any issues with the mailing list and we'll look into it. Is there a way to keep old links to archived messages (such as https://dovecot.org/pipermail/dovecot/<year>-<month>/<message-id>.html) intact? Best regards, Peter

3 3

Custom SASL authentication
by David Koski 19 Apr '23

19 Apr '23

Hello, I'm looking for a good way to apply a custom hash to passwords. My hope is to add passwords to a (MySQL) database: INSERT INTO users (user='joblo', pass=MYHASH('plain-password').. For SASL authentication, my thought first was to apply the same hash to the issued password and compare it with the hashed password in the database. I soon discovered the sql driver supplied by Dovecot doesn't provide that ability, unless I'm missing something. I'm looking for documentation on how to implement a custom authentication script if needed. Regards, David Koski dkoski(a)sutinen.com

4 6

imap Error: rename failed: Too many links
by Andrey Repin 18 Apr '23

18 Apr '23

Greetings, All! I'm facing a problem with one particular directory in a mailbox. The exact error line is: Apr 7 12:00:21 mxs dovecot: imap(vera): Error: rename(/home/vera/.mail/INBOX/Майя Николаевна/new/1678353168.M710968P25673.mxs.ads.ccenter.lan,S=5442,W=5513:2,ST, /home/vera/.mail/INBOX/Майя Николаевна/cur/1678353168.M710968P25673.mxs.ads.ccenter.lan,S=5442,W=5513:2,ST) failed: Too many links The rest of the mailbox behave correctly, as I can tell, but this specific subdir fails to report unread mail correctly. What are the options to fix it? # dovecot --version 2.2.22 (fe789d2) Config is in attachment, but I doubt it is of any interest. -- With best regards, Andrey Repin Friday, April 7, 2023 16:37:09 Sorry for my terrible english...

4 6

Maildir compression
by Jose David Bravo A 18 Apr '23

18 Apr '23

Hello, I would like to compress the maildir of some of our users, I'm thinking to use this script: [ https://github.com/George-NG/dovecot-maildir-compress/blob/master/dovecot-m… | https://github.com/George-NG/dovecot-maildir-compress/blob/master/dovecot-m… ] My question is, how dovecot will calculate the quota for that user after the compression? will dovecot calculate the quota of that user using the real size of the message file after compression, or the plain size before compression? Is it necessary to recreate the index of that maildir after the compression is made? If so, what command should I use? Thank you! Jose Bravo

2 1

Confusion re doveadm pw and protected private keys
by Paul Kroitor 18 Apr '23

18 Apr '23

Hello, It seems from this thread at letsencrypt : https://community.letsencrypt.org/t/changing-permissions-for-pem-files/19656 1 (see especially second post from _az) that doveadm pw now parses all files in the config, even ones not relevant to the pw aspect of the request. If it's not able to access all the files, it terminates prematurely with exit code 89. The result, at least for anyone using letsencrypt / certbot, is that doveadm pw fatally fails unless run as root, because the config includes the private key, which has permissions 600 root root. This makes the dovecot pw functionality unusable for web apps that want to calculate a password hash using it (e.g. RoundCube's password change feature). My understanding is that dovecot only really needs the private key for its main functionality, when it's running as root, and that there's no reason doveadm pw, which should (presumably) often be run as a regular user, needs access to it. Is this the intended behavior, or have I got something wrong? Thanks for all help, Paul

2 1

Shared / Public mailbox
by Stephane MAGNIER 15 Apr '23

15 Apr '23

Hi I wish to create a share mailbox ( well.. Apparently, this is a public mailbox). Let's say I have 2 users : user1 & user2 and the need to share a mailbox for "general inquiries" emails.. Despite of the 2 users' account creation ( user1 & user2) , should I create a third email account ( info1) for general inquiries for instance and instruct Dovecot that this mail box has to be shared ? In that case, logically, I have to declare into: "15-Mailboxes.conf" |namespace { type = public separator = / prefix = Public/ location = maildir:|||/var/spool2/mail|/info1/:CONTROL=/var/spool2/mail/Maildir/info1:INDEX=|||/var/spool2/mail|/info1 # Allow users to subscribe to the public folders. subscriptions = yes } | |and add a file : /etc/dovecot/dovecot-acl| || ||||/var/spool2/mail|/info1/| user=user1,user2 lrwstipekxa ||/var/spool2/mail|/info1|/* user=user1,user2 lrwstipekxa and add the plugin : plugin { acl = vfile }|| Is that the way to do it ? 2) Now what is the difference between a shared and Public mailbox ? I can see that the plugin is slightly different : |acl_shared_dict| <https://doc.dovecot.org/settings/plugin/acl-plugin/#plugin_setting-acl-acl_…> For me a "public"email folder is for sharing emails.. My understanding is: general email account can be shared ( like info1 in my example).. this is called a public mailbox.( specific email account, shared between users). So what is called a "Shared mailbox" ????? Thanks for your help ?

4 5

Mailing list update
by Aki Tuomi 13 Apr '23

13 Apr '23

Hi all! We finally managed to move from mailman2 to mailman3, and mail archives are now at https://dovecot.org/mailman3/archives and they can be now searched, too. Please let us know if you have face any issues with the mailing list and we'll look into it. Regards, Aki Tuomi Open-Xchange oy

4 9

Mailing list changes.
by dovecot＠ptld.com 13 Apr '23

13 Apr '23

I noticed starting today the Sender: header is no longer included on the mailing list. I used to use the Sender: header in sieve rules for sorting. Now the list emails only come From: rando email addresses. On the postfix mailing list it replaces the From: header with the list address instead of keeping the original email author. Is this the future intended behavior? Or can we get a Sender: or From: header to contain the list address for sorting?

3 3

Dovecot restoration.... problem
by Stephane Magnier 13 Apr '23

13 Apr '23

Hi, In the past, I've done a Dovecot Backup with a Rsync cmd... every day Today I need to get back these mailboxes.. and doesn't work out 1) first of all, I tried to make a simple copy... Now way . Couldn't access the INBOX Do you think that it could work that way ? I don't need to synchronized every minute. once a day is OK for me. 2) I did use the instruction doveadm --import -u user1 maildir:/home/user1/mail/ "" ALL It did start copying but apparently cannot got until the end... but noting visible onto Thunderbird... I didn't do any synchro between 2 dovecot servers. I just need to make a copy some times to times and rsync seemed to be a good option. But now, How can I get back online ??? Thanks

2 1

decrypt.rb
by Dave 11 Apr '23

11 Apr '23

Per the Dovecot site here: https://wiki.dovecot.org/Plugins/MailCrypt ... the "decrypt.rb" ruby script can be used to decrypt a Dovecot-encrypted message file from the command line. The script sort of runs successfully for me, in the sense that it doesn't error out, but it doesn't show the decrypted message. I've called it like so: decrypt.rb -k <PATH_TO_DOVECOT_KEYFILE> -f ./encrypted_message But when I do it just displays the info below and exits (I've subbed <DATA> tags for the actual data): ------------------[OUTPUT]----------------------- Key(s) (total: 1) - Key type : EC - Key digest: <DATA1> - Peer key : <DATA2> - Encrypted : <DATA3> - Kd hash : <DATA4> ------------------------------------------------------- I've tried specifying an output file as well, per the script's command line options, but the output file is 0 bytes. Does anyone have any suggestions? I *think* I'm using it the way it's intended to be used, but maybe I'm not?! -Dave

5 14

None
by None 11 Apr '23

11 Apr '23

... - maildir: change it to use '/' as hierarchy separator to allow '.' characters (for usernames in shared folders) ... Now changing the separator in the maildir-storage.c is trivial (even though it "can't" be changed :-), but fixing the resultant breakage in maildir-list.c needs a little more understanding. Timo, could you give me some pointers? I can see that I need to work out what imap_match_init() does. My motivation is to follow up on an earlier thread about reusing .mailboxlist files as .subscription files, preferably without rewriting them to replace the slashes with something else. Thanks -- Charlie

1 0

None
by None 11 Apr '23

11 Apr '23

checking IMAP connection. Based on that experimentation, it seems that when I try to verify certificate files with openssl, all checks out, but when I try to check thing through IMAPS, things go ugly (see log below). If I try same openssl s_client command on my web server, it gets everything correctly. As result from this one, I've even tried to use certificate from my web server with IMAP and even then openssl keeps on saying that there is bad record mac. Is this bug in dovecot's SSL handling or have I managed to mess something in my setup? URLS: CA cert: http://jylitalo.homeip.net/ca/ca.crt IMAPD cert: http://jylitalo.homeip.net/ca/imapd.crt [log starts] bash-2.05a$ openssl verify -CAfile /usr/local/www/data/ca/ca.crt /etc/ssl/certs/imapd.crt /etc/ssl/certs/imapd.crt: OK bash-2.05a$ openssl s_client -host localhost -port 993 -CAfile /usr/local/www/data/ca/ca.crt -verify -debug verify depth is 0 CONNECTED(00000003) depth=1 /C=FI/ST=Finland/L=Helsinki/O=Juha Ylitalo/CN=Juha Ylitalo/Email=jylitalo(a)iki.fi verify return:1 depth=0 /C=FI/ST=Finland/O=Juha Ylitalo/CN=coat.st-paul/Email=jylitalo(a)iki.fi verify return:1 47169:error:140943FC:SSL routines:SSL3_READ_BYTES:sslv3 alert bad record mac:/usr/src/secure/lib/libssl/../../../crypto/openssl/crypto/../ssl/s3_pkt.c:1046:SSL alert number 20 47169:error:140790E5:SSL routines:SSL23_WRITE:ssl handshake failure:/usr/src/secure/lib/libssl/../../../crypto/openssl/crypto/../ssl/s23_lib.c:226: bash-2.05a$ [log ends] -- Juha Ylitalo juha.o.ylitalo(a)nokia.com <work e-mail> +358 40 562 6152 http://linux.nokia.com/~jylitalo/ <work www>

1 0

None
by None 11 Apr '23

11 Apr '23

while (rename(src, dest) < 0 && count < 2) { if (errno != EEXIST) { rename can never return EEXIST in errno. maildir-save.c, line 124. /* move the file into new/ directory - syncing will pick it up from there */ if (rename(tmp_path, new_path) == 0) failed = FALSE; Here you can lose emails if the new/ folder contains a message whose base name is equal. The only way to avoid this is: 1) use link and unlink, not rename 2) leave messages that have a time_t part equal to or higher than time(NULL). Anyway, Maildir has a strict consistency criteria which says that all messages that are linked from tmp/ into new/ _must_ use time(NULL) plus a number that is guaranteed not to lapse within one second, and which does not collide with other messages in new/. new/ is the single entry point into cur/, and messages in new/ can not be "older" than the messages in cur/. The simple reasoning for this is that you can never guarantee that there is no message in cur/ that has the same base name, but perhaps different flags. It follows that when moving a message from new/ to cur/, it is required that the server only picks messages that are older than one second. Andy -- Andreas Aardal Hanssen http://www.andreas.hanssen.name/gpg

1 0

auth-worker fatal signal 11 core dump
by Anthony Carrico 07 Apr '23

07 Apr '23

I'm testing out dovecot/tls/openldap(via portunus). It seems to work fine. I can access Maildir with Thunderbird as expected. However according to the logs, auth-worker crashes when slapd closes: Apr 04 22:11:56 silver slapd[1745983]: conn=1054 op=1 UNBIND Apr 04 22:11:56 silver slapd[1745983]: conn=1054 fd=14 closed Apr 04 22:11:56 silver slapd[1745983]: conn=1053 op=2 UNBIND Apr 04 22:11:56 silver slapd[1745983]: conn=1053 fd=13 closed Apr 04 22:11:56 silver dovecot[2083465]: auth-worker: Fatal: master: service(auth-worker): child 2084984 killed with signal 11 (core dumped) Apr 04 22:11:56 silver dovecot[2083465]: auth: Fatal: master: service(auth): child 2084981 killed with signal 11 (core dumped) Here is the configuration. It is a minimal setup, just testing ldap for passdb: # 2.3.19.1 (9b53102964): /etc/dovecot/dovecot.conf # OS: Linux 6.1.7 x86_64 NixOS 22.11 (Raccoon) btrfs # Hostname: silver auth_mechanisms = plain login base_dir = /run/dovecot2 default_internal_group = dovecot2 default_internal_user = dovecot2 mail_location = maildir:/home/%n/Maildir:INBOX=/var/spool/mail/%n:INDEX=/var/lib/dovecot/indexes/%n:LAYOUT=Maildir++ passdb { args = /var/lib/dovecot/etc/dovecot-ldap.conf.ext driver = ldap } pop3_uidl_format = %08Xv%08Xu protocols = imap sendmail_path = /run/wrappers/bin/sendmail service auth { user = root } ssl_ca = </var/certs/.minica/cert.pem ssl_cert = </var/certs/silver/cert.pem ssl_dh = # hidden, use -P to show it ssl_key = # hidden, use -P to show it userdb { driver = passwd } Here is the ldap config: uris = ldaps://silver tls_ca_cert_file = "/var/certs/.minica/cert.pem" auth_bind = yes auth_bind_userdn = uid=%u,ou=users,dc=silver base = dc=silver Here is the stack trace: PID: 2084981 (auth) UID: 0 (root) GID: 0 (root) Signal: 11 (SEGV) Timestamp: Tue 2023-04-04 22:11:56 EDT (11h ago) Command Line: dovecot/auth Executable: /nix/store/s72dc8pc6g70dscya8ggsvn61rnfhixy-dovecot-2.3.19.1/libexec/dovecot/auth Control Group: /system.slice/dovecot2.service Unit: dovecot2.service Slice: system.slice Hostname: silver Storage: /var/lib/systemd/coredump/core.auth.0.9fed479ad6ac4f0e8c2d5f290d9ea3f5.2084981.1680660716000000.zst (present) Disk Size: 324.7K Message: Process 2084981 (auth) of user 0 dumped core. Module linux-vdso.so.1 with build-id 7aefd45ed44b5302cf82d7b5093cd9b882b8bc8a Module legacy.so with build-id fdd26faf7ff15c8fa78ef2091d38c5fb886da146 Module libscram.so.3 without build-id. Module libdb-5.3.so without build-id. Module libsasldb.so.3 without build-id. Module libplain.so.3 without build-id. Module libotp.so.3 without build-id. Module liblogin.so.3 without build-id. Module libgssapiv2.so.3 without build-id. Module libkeyutils.so.1 without build-id. Module libkrb5support.so.0 without build-id. Module libcom_err.so.3 without build-id. Module libk5crypto.so.3 without build-id. Module libkrb5.so.3 without build-id. Module libgssapi_krb5.so.2 without build-id. Module libgs2.so.3 without build-id. Module libdigestmd5.so.3 without build-id. Module libcrammd5.so.3 without build-id. Module libanonymous.so.3 without build-id. Module libresolv.so.2 with build-id 6bcddb1dd1be5b345df903815f364e5d967ae0ef Module libdl.so.2 with build-id 2e86539e324ffb14e185718fd284d3f3f2568f06 Module libm.so.6 with build-id 5cc630080219b350d8f9e4573c65d2dd931ea978 Module libz.so.1 without build-id. Module ld-linux-x86-64.so.2 with build-id 3be2bc3749163683f612e0fb8169ce51f75742fe Module libcrypto.so.3 with build-id ca321413716a256baa08042cb3f3c07a90cc82ce Module libssl.so.3 with build-id 4bf2aae91a0d91b0ca0a6fe1ab29b2b7653a17f6 Module libsasl2.so.3 without build-id. Module libaudit.so.1 without build-id. Module libc.so.6 with build-id 3d6884d200ead572b7b89a4133f645c7a3c039ed Module libpthread.so.0 with build-id 0f7050f6ef81222c7290351dfa67e5e062c797bf Module libsqlite3.so.0 with build-id 174a69054606e27a1c555838b07035346e83bfb0 Module libsodium.so.23 with build-id 1c1e5b232aa14bf5c942b3568bf70713da9ad11f Module liblber.so.2 without build-id. Module libldap.so.2 without build-id. Module libpam.so.0 without build-id. Module libcrypt.so.1 without build-id. Module libdovecot.so.0 without build-id. Module libstats_auth.so without build-id. Module auth without build-id. Stack trace of thread 2084981: #0 0x00007f824e28e824 pthread_rwlock_rdlock(a)GLIBC_2.2.5 (libc.so.6 + 0x8e824) #1 0x00007f824de312d9 CRYPTO_THREAD_read_lock (libcrypto.so.3 + 0x2312d9) #2 0x00007f824de1ea57 ossl_lib_ctx_get_data (libcrypto.so.3 + 0x21ea57) #3 0x00007f824de2d460 ossl_provider_deregister_child_cb (libcrypto.so.3 + 0x22d460) #4 0x00007f824de1e960 OSSL_LIB_CTX_free (libcrypto.so.3 + 0x21e960) #5 0x00007f824d8d4801 legacy_teardown (legacy.so + 0x7801) #6 0x00007f824de2ebfd ossl_provider_free (libcrypto.so.3 + 0x22ebfd) #7 0x00007f824ddf535b evp_cipher_free_int (libcrypto.so.3 + 0x1f535b) #8 0x00007f824e4cd46c SSL_CTX_free (libssl.so.3 + 0x3d46c) #9 0x00007f824e7852f5 ldap_int_tls_destroy (libldap.so.2 + 0x3d2f5) #10 0x00007f824e9ddbde _dl_fini (ld-linux-x86-64.so.2 + 0x5bde) #11 0x00007f824e2400c5 __run_exit_handlers (libc.so.6 + 0x400c5) #12 0x00007f824e24024e exit (libc.so.6 + 0x4024e) #13 0x00007f824e229255 __libc_start_call_main (libc.so.6 + 0x29255) #14 0x00007f824e229309 __libc_start_main@@GLIBC_2.34 (libc.so.6 + 0x29309) #15 0x000055b07d5c7675 _start (auth + 0x18675) ELF object binary architecture: AMD x86-64 As you can see, it seems to be crashing in the exit-handlers. Anyway, I thought I should report the crash I was observing. Thank you -- Anthony Carrico

2 4

Error: /proc/self/status is larger than expected
by Elisamuel Resto Donate 06 Apr '23

06 Apr '23

Hello, Writing to get some insight as to how I might rid myself of a the pesky error message on the subject. Every binary throws out that error, every LMTP delivery... basically every time any dovecot binary is executed. I am unsure if this is configuration related or not, but intuition says it is an issue with a kernel feature or compiler issue. I saw the error message in the source code (file ), but I don't understand enough of the dovecot architecture or what the code itself is doing in this case. Below and excerpt of a few lines of logs. Since I don't know what specifically this would relate to (and I don't quite remember the command to send the "safe" version of the configuration), I am sending this message in hopes that whatever is needed can be asked and I will provide it. Regards, -Sam [... postfix and rspamd output...] Mar 20 22:17:02 gaia postfix/qmgr[21403]: 4PgcGQ33LfzdT4h: from=<list(a)someml.tld>, size=12064, nrcpt=1 (queue active) Mar 20 22:17:02 gaia postfix/smtpd[18941]: disconnect from some.list.server[1.2.3.4] ehlo=2 starttls=1 mail=1 rcpt=1 data=1 quit=1 commands=7 Mar 20 22:17:02 gaia dovecot: lmtp(18954): Error: /proc/self/status is larger than expected Mar 20 22:17:02 gaia dovecot: lmtp(18954): Connect from local Mar 20 22:17:02 gaia dovecot: lmtp(sam(a)samresto.dev)<18954><vbRKLa4hGWQKSgAAw1YR2w>: Error: /proc/self/status is larger than expected Mar 20 22:17:02 gaia dovecot: message repeated 2 times: [ lmtp(sam(a)samresto.dev)<18954><vbRKLa4hGWQKSgAAw1YR2w>: Error: /proc/self/status is larger than expected] Mar 20 22:17:02 gaia dovecot: lmtp(sam(a)samresto.dev)<18954><vbRKLa4hGWQKSgAAw1YR2w>: sieve: msgid=<84cf4a75-db54-f33c-cea2-f4772cd182d8(a)samresto.dev>: fileinto action: stored mail into mailbox 'Lists/Folder' Mar 20 22:17:02 gaia dovecot: lmtp(sam(a)samresto.dev)<18954><vbRKLa4hGWQKSgAAw1YR2w>: Error: /proc/self/status is larger than expected Mar 20 22:17:02 gaia dovecot: indexer-worker(sam(a)samresto.dev)<18956><vbRKLa4hGWQKSgAAw1YR2w:RtkiMa4hGWQMSgAAw1YR2w>: Error: /proc/self/status is larger than expected Mar 20 22:17:02 gaia postfix/lmtp[18943]: 4PgcGQ33LfzdT4h: to=<sam(a)samresto.dev>, relay=wyvern.samresto.dev[private/dovecot-lmtp], delay=0.4, delays=0.31/0/0.01/0.07, dsn=2.0.0, status=sent (250 2.0.0 <sam(a)samresto.dev> vbRKLa4hGWQKSgAAw1YR2w Saved) Mar 20 22:17:02 gaia dovecot: lmtp(18954): Disconnect from local: Logged out (state=READY) Mar 20 22:17:02 gaia dovecot: lmtp(18954): Error: /proc/self/status is larger than expected Mar 20 22:17:02 gaia postfix/qmgr[21403]: 4PgcGQ33LfzdT4h: removed

6 11

Email not working
by Michael Hooker 05 Apr '23

05 Apr '23

Hi, First of all may I say I am not an expert on Dovecot so please forgive me if the answer to my query is obvious. After upgrading from Ubuntu 20.04 to 22.04 my email is not working. root@mail:~# doveconf -n # 2.3.16 (7e2e900c1a): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.16 (09c29328) # OS: Linux 5.15.0-60-generic x86_64 Ubuntu 22.04.1 LTS # Hostname: mail.odysseytours.nz auth_debug = yes auth_mechanisms = plain login auth_username_format = %{if;%d;eq;mail.odysseytours.nz;%Ln;%Lu} listen = *, :: mail_debug = yes mail_location = mbox:~/mail:INBOX=/var/mail/%u mail_privileged_group = mail managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } passdb { driver = pam } plugin { sieve = file:~/sieve;active=~/.dovecot.sieve } protocols = " imap lmtp sieve pop3" service stats { unix_listener stats-reader { group = vmail mode = 0660 user = vmail } unix_listener stats-writer { group = vmail mode = 0660 user = vmail } } ssl_cert = </etc/dovecot/private/dovecot.pem ssl_cipher_list = EECDH+CHACHA20:EECDH+AESGCM:EDH+AESGCM:AES256+EECDH ssl_client_ca_dir = /etc/ssl/certs ssl_dh = # hidden, use -P to show it ssl_key = # hidden, use -P to show it userdb { args = blocking=no driver = passwd } root@mail:~# doveadm user -f 'username' '*' nobody mike systemd-coredump sogo vmail mlmmj iredadmin iredapd snapd-range-524288-root snap_daemon Error: auth-master: userdb list: User listing returned failure Fatal: user listing failed root@mail:~# doveadm index -A -q \* doveadm(nobody): Error: mkdir(/nonexistent/mail/.imap) failed: Permission denied (euid=65534(nobody) egid=65534(nogroup)) doveadm(systemd-coredump): Error: mkdir(//mail/.imap) failed: Permission denied (euid=999(systemd-coredump) egid=999(systemd-coredump) missing +w perm: /, dir owned by 0:0 mode=0755) doveadm(snapd-range-524288-root): Error: mkdir(/nonexistent/mail/.imap) failed: Permission denied (euid=524288(snapd-range-524288-root) egid=524288(snapd-range-524288-root)) doveadm(snap_daemon): Error: mkdir(/nonexistent/mail/.imap) failed: Permission denied (euid=584788(snap_daemon) egid=584788(snap_daemon)) doveadm(3015804): Error: auth-master: userdb list: User listing returned failure doveadm: Error: Failed to iterate through some use Contents of /etc/dovecot/conf.d/10-auth.conf with all comments removed: auth_username_format=%{if;%d;eq;mail.odysseytours.nz;%Ln;%Lu} #https://serverfault.com/questions/260488/dovecot-user-lookup-fails-when-using-usernamedomain-format auth_mechanisms = plain login !include auth-system.conf.ext Contents of /etc/dovecot/conf.d/auth-system.conf.ext with all comments removed: passdb { driver = pam } userdb { driver = passwd ##https://doc.dovecot.org/configuration_manual/authentication/passwd/#authentication-passwd args = blocking=no } It says "Authentication failure (Password mismatch?)" but its definitely the correct password. root@mail:/home/mike# doveadm log errors Feb 22 02:43:48 Error: auth: passwd(postmaster(a)odysseytours.nz): getpwnam() failed: Address Don't know what this error means. root@mail:/home/mike# doveadm log errors Feb 22 02:43:48 Error: auth: passwd(postmaster(a)odysseytours.nz): getpwnam() failed: Address family not supported by protocol Don't know what this error means. Any help would be greatly appreciated.

2 1

Wildcard delivery from Postfix to Dovecot LDA issues
by EML 01 Apr '23

01 Apr '23

[apologies for postfix/dovecot cross-post] How, exactly, do postfix and dovecot communicate when postfix attempts to determine whether to deliver a message to the dovecot LDA, or to bounce it? In other words, how does postfix decide to bounce foo, and deliver bar, in these log messages: postfix/pipe[11857]: 933BCA071A: to=<foo(a)example.com>, relay=dovecot, ... status=bounced (user unknown) postfix/pipe[12266]: 8AD51A071A: to=<bar(a)example.com>, relay=dovecot, ... status=sent (delivered via dovecot service) The reason I ask is that the obvious answer with the main.cf setup doesn't appear to be sufficient, and dovecot appears to check whether or not the recipient exists in the userdb passwd file before allowing delivery. I have postfix set up for virtual hosts, as follows: virtual_mailbox_domains = example.com, sub.example.com virtual_mailbox_maps = hash:/var/www1/vdomains virtual_transport = dovecot where vdomains contains: bar(a)sub.example.com example.com/test/ bar(a)example.com example.com/test/ @sub.example.com example.com/test/ @example.com example.com/test/ postfix will deliver to bar(a)example.com, but not foo(a)example.com. I can't deliver anything to the subdomain. The interesting thing is that 'bar' already has a dovecot mailbox (the 'test' mailbox), but 'foo' doesn't. If this is correct, how do I do wildcard deliveries to dovecot, particularly for the subdomain?

2 2

Dovecot error invalid service_fd
by Michel Verdier 30 Mar '23

30 Mar '23

Hi all On debian stable, dovecot 2.3.13+dfsg1-2+deb11u1 and postfix 3.5.17-0+deb11u1 I set postfix sending mails to dovecot for mailbox storage: mailbox_transport = lmtp:unix:private/dovecot-lmtp dovecot listen with lmtp: service lmtp { unix_listener /var/spool/postfix/private/dovecot-lmtp { mode = 0666 user = postfix group = postfix } } passdb { driver = pam args = session=yes cache_key=%u%r%l dovecot } userdb { driver = passwd } # ls -l /var/spool/postfix/private/dovecot-lmtp srw-rw-rw- 1 postfix postfix 0 27 mars 11:24 /var/spool/postfix/private/dovecot-lmtp I get logs like this: postfix/lmtp[271076]: 6DB551008B3C1: to=..., relay=...[private/dovecot-lmtp], delay=0.7, delays=0.29/0.04/0.11/0.26, dsn=2.0.0, status=sent (250 2.0.0 ... postfix/qmgr[197419]: 6DB551008B3C1: removed dovecot: lmtp(271077): Disconnect from local: Client has quit the connection (state=READY) dovecot: log(253615): Error: Received master input for invalid service_fd 27: 27 271079 BYE I identify 271079 as the pid for dovecot auth worker process. If I add a timeout in dovecot: service auth-worker { idle_kill = 10s } Then I see error log coming 10 seconds after the end of every lmtp connexion from postfix. There is no other log messages around even with debug enable in dovecot. And mails are correctly delivered. Am I missing something or is this to be ignored? Cheers

1 0

Dovecot submission proxy constraints
by Peter Wienemann 29 Mar '23

29 Mar '23

Dear Dovecot experts, in 2017 Stephan Bosch mentioned in an email about the Dovecot submission proxy [0]: "The current implementation does require that the proxy has direct access to the user's mailbox for BURL (e.g. by running it on the same host as imap), but that restriction should be resolved soon, allowing for more complex setups." Is the mentioned restriction (access to mailbox) still valid in 2023 or has this constraint been lifted in the meantime? Best regards, Peter [0] https://dovecot.org/pipermail/dovecot/2017-December/110282.html

1 0

How to use dovecot with more recent versions of solr (8x, 9x)?
by jkdv＠w3.org 27 Mar '23

27 Mar '23

Hello, dovecot version 2.3.13 (89f716dc2) The dovecot solr installation guide [1] gives links and configuration info for sorl 7.7.0. However, sorl was deprecated some time ago. Those links to 7.7.0 don't work anymore. Sorl is currently available in versions 8.11.2 and 9.1.1 [3]. Specifically, one section in the guide states [2]: [[ Install schema.xml and solrconfig.xml Copy doc/solr-config-7.7.0.xml and doc/solr-schema-7.7.0.xml (Since Dovecot 2.3.6+) to /var/solr/data/dovecot/conf/ as solrconfig.xml and schema.xml. The managed-schema file is generated based on schema.xml. ]] Could someone confirm me if those 7.7.0 configuration files are compatible with 8.11.2? A diff between those files and the ones from the 8.11.2 dist reveal some changes, starting from the LuceneVersion. If they are not compatible, could someone tell me what changes were done in the doc/solr files that need to be replicated in the 8.x and 9.x versions? The doc is very opaque there as it only states that you should replace those files but doesn't go into details as to why, making it confusing on how to upgrade to a new version of solr. It would be great if the dovecot/solr doc page could be upgraded to reflect the new versions of solr. Thanks in advance for your help, --jose [1] https://doc.dovecot.org/configuration_manual/fts/solr/ [2] https://doc.dovecot.org/configuration_manual/fts/solr/#solr-configuration [3] https://downloads.apache.org/lucene/solr/

2 1

doveadm expunge unnecessarily tries to access TLS key
by Jesper Dybdal 27 Mar '23

27 Mar '23

I have just upgraded my Debian Buster (Dovecot 2.3.4, I think it was) to Bullseye (Dovecot 2.3.13). The Dovecot server works fine, which of course is the really important thing. But I have a cron job that cleans up all old mail from the mailbox that I use for my mobile phone by running "doveadm expunge" every night. That worked fine in 2.3.4, but now it fails: > jdmobile@nuser:~$ doveadm expunge mailbox '*' before 25d > doveconf: Fatal: Error in configuration file > /etc/dovecot/conf.d/10-ssl.conf line 23: ssl_cert: Can't open file > /etc/letsencrypt/live/nuser.dybdal.dk/fullchain.pem: Permission denied Of course, doveadm cannot access the TLS key when running as a normal user. But why should it try to access that key at all when I have just asked it to clean up my own files in my own Maildir? Is there a way to make it not try to access that key and do its job anyway? Or another way to delete old mail? (I could give it a "-u jdmobile" option and run it as root - but I really like to run things like that as a non-privileged user, so I won't make a stupid mistake that destroys the wrong mailbox.) Thanks, Jesper -- Jesper Dybdal https://www.dybdal.dk

2 2

Dovecot LTO build failure
by Arjen de Korte 26 Mar '23

26 Mar '23

In openSUSE Tumbleweed (and several other distributions as well), packages are build by default with linktime optimization (LTO) enabled. This didn´t work for Dovecot, so until now LTO was disabled for Dovecot. There is a way to make it work though, see the following link: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=997513#20 So far a fix has not made it to upstream, the latest version 2.3.30 still fails to build without this patch. Is there any news to report regarding this?

2 1

Re: User authentication using local file
by Horst Simon 23 Mar '23

23 Mar '23

OS environment: Linux qnap-nas 5.10.60-qnap #1 SMP Thu Jan 12 04:39:10 CST 2023 x86_64 GNU/Linux I enabled "auth-passwdfile.conf.ext” in 10-auth.conf #!include auth-deny.conf.ext #!include auth-master.conf.ext #!include auth-system.conf.ext #!include auth-sql.conf.ext #!include auth-ldap.conf.ext !include auth-passwdfile.conf.ext #!include auth-checkpassword.conf.ext #!include auth-static.conf.ext In this file I have following entries and I don’t know what to enter for userdb passdb { driver = passwd-file args = /opt/local/etc/dovecot/users } userdb { driver = passwd-file #args = username_format=%u /opt/local/etc/dovecot/users # Default fields that can be overridden by passwd-file #default_fields = quota_rule=*:storage=1G # Override fields from passwd-file #override_fields = home=/home/virtual/%u } In the users file I have 2 users defined as follow: user1:{SSHA512}<encrypted password>:::::: user2:{SSHA512}<encrypted password:::::: Dovecot gives following error message on startup: Mar 23 08:50:30 master: Info: Dovecot v2.3.20 (80a5ac675d) starting up for imap, lmtp, sieve (core dumps disabled) Mar 23 08:50:30 auth: Debug: Loading modules from directory: /opt/local/lib/dovecot/auth Mar 23 08:50:30 auth: Debug: Module loaded: /opt/local/lib/dovecot/auth/lib20_auth_var_expand_crypt.so Mar 23 08:50:30 auth: Fatal: userdb passwd-file: Missing args I don’t know what arguments I have to enter for userdb Horst > On 22 Mar 2023, at 23:00, Narcis Garcia > > Please, specify OS environment, Dovecot version, and what options did > you try. > > > El 22/3/23 a les 4:52, Horst Simon ha escrit: >> I try to configure to have user authenticate to a local file called >> users, with their mailboxes in ../../spool/dovecot, not in their home >> directories. I have this working correctly with pam authentication on >> different servers(openSuse and macOS). This server has no pam >> authentication so I need to use a local file, but I can not make any >> sense of the documentation, can someone please help on which files I >> need to change and to which values. >> I tried several options but getting all kind of errors with UID. >> >> Horst >> > > -- > > Narcis Garcia > > __________ > I'm using this dedicated address because personal addresses aren't > masked enough at this mail public archive. Public archive administrator > should fix this against automated addresses collectors. > > > ------------------------------ > > Subject: Digest Footer > > _______________________________________________ > dovecot mailing list > dovecot(a)dovecot.org > https://dovecot.org/mailman/listinfo/dovecot > > > ------------------------------ > > End of dovecot Digest, Vol 239, Issue 36 > ****************************************

2 4

User authentication using local file
by Horst Simon 22 Mar '23

22 Mar '23

I try to configure to have user authenticate to a local file called users, with their mailboxes in ../../spool/dovecot, not in their home directories. I have this working correctly with pam authentication on different servers(openSuse and macOS). This server has no pam authentication so I need to use a local file, but I can not make any sense of the documentation, can someone please help on which files I need to change and to which values. I tried several options but getting all kind of errors with UID. Horst

2 1

Re: Error: Can't load SSL certificate
by Horst Simon 22 Mar '23

22 Mar '23

The others are on openSUSE 15.4 and macOS, all are binary installs Entware build options Build options: ioloop=epoll openssl io_block_size=8192 SQL drivers: mysql Passdb: checkpassword ldap passwd passwd-file shadow sql Userdb: checkpassword ldap passwd prefetch passwd-file sql macOS build options Build options: ioloop=kqueue notify=kqueue openssl io_block_size=8192 SQL drivers: mysql Passdb: checkpassword pam passwd passwd-file sql Userdb: checkpassword passwd prefetch passwd-file sql openSUSE build options Build options: ioloop=epoll notify=inotify openssl io_block_size=8192 SQL driver plugins: mysql postgresql sqlite Passdb: checkpassword ldap pam passwd passwd-file shadow sql Userdb: checkpassword ldap(plugin) passwd prefetch passwd-file sql The libz.so are for OpenSUSE and the QNap in the same directories withe the same permissions The macOS does not have a libz.so, this dovecot was build by macports. All servers are running dovecot with the same user accounts. At the moment I will look into this issue later and will try to authenticate without using SSL. On the MACs and openSUSE I authenticate using pam, the QNAP does not use pam so I want to authenticate using a local password file, but I have problems to set it up correctly I have changed it 10-auth.conf to use auth-passwdfile.conf.ext and created a password file called userdb. I don’t know what else to change and what exactly should be in the userdb file. The log only shows Mar 20 23:52:45 auth: Debug: auth client connected (pid=6966) Mar 20 23:52:45 imap-login: Info: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=192.168.117.5, lip=192.168.117.2, session=<AhJNZ1T3GcDAqHUF> I need to fix this first before I can enable SSL again. Maybe I should open a new threat Horst > > My suggests to look for: > > 1. Are your other servers setups installed from "Entware for QNAP" too? > 2. Do your other servers have libz.so* located under /opt/lib/ too? > 3. Did you compare owner and permissions of every libz.so* file between > servers too? > 4. Are other servers running Dovecot with same user account? > > > El 20/3/23 a les 4:01, Horst Simon ha escrit: >> I try to logon to map using dovecot with SSL required. I get following >> entries in the log:Mar 20 13:49:30 auth: Debug: Loading modules from >> directory: /opt/lib/dovecot/modules/auth >> Mar 20 13:49:30 auth: Debug: Module loaded: >> /opt/lib/dovecot/modules/auth/lib20_auth_var_expand_crypt.so >> Mar 20 13:49:30 auth: Debug: Read auth token secret from >> /opt/var/run/dovecot/auth-token-secret.dat >> Mar 20 13:49:30 auth: Debug: passwd-file /opt/etc/dovecot/userdb:Read 1 >> users in 0 secs >> Mar 20 13:49:30 auth: Debug: auth client connected (pid=26120) >> Mar 20 13:49:30 imap-login: Error: Failed to initialize SSL server >> context: Can't load SSL certificate (ssl_cert setting): >> error:12800067:DSO support routines::could not load the shared library: >> filename(libz.so): libz.so: cannot open shared object file: No such file >> or directory, error:12800067:DSO support routines::could not load the >> shared library: user=<>, rip=192.168.117.5, lip=192.168.117.2, >> session=<eX3e+Uv3k8DAqHUF> >> Mar 20 13:49:30 imap-login: Info: Disconnected: TLS initialization >> failed. (no auth attempts in 0 secs): user=<>, rip=192.168.117.5, >> lip=192.168.117.2, session=<eX3e+Uv3k8DAqHUF >> >> The library files exist in the include directory >> [/opt] # find . -name libz* -print >> >> ./lib/opkg/info/libzstd.control >> >> ./lib/opkg/info/libzstd.list >> >> ./lib/libz.so >> >> ./lib/libz.so.1 >> >> ./lib/libz.so.1.2.13 >> >> ./lib/libzstd.so >> >> ./lib/libzstd.so.1 >> >> ./lib/libzstd.so.1.5.2 >> >> ./lib/libz.a >> >> >> Have the dovecot settings the same on other servers and it works, >> Dovecot is v2.3.18, installed from Entware for QNAP. Any help?appreciated. >> >> Horst >> >> >> > > -- > > Narcis Garcia >

1 1

ot: how to t/s TBird problems ?
by Voytek Eymont 22 Mar '23

22 Mar '23

I have a Dovecot/Postfix/MariaDB on a Centos, just have a user ask me: ------------------ I recently upgraded my Thunderbird email client and have experienced problems since. It appears that when Tbird polls for new messages it gets held up waiting for a response from the server I'm using POP port 995. Any ideas as to why I'm having a problem ? ------------------- how to investigate such issue ? CentOS release 6.10 (Final) # dovecot --version 2.3.11.3 (502c39af9) load average on server 0.05/0.01 user log shows like: Oct 12 10:08:50 pop3-login: Info: Login: user=<user(a)tld.com.au>, method=PLAIN, rip=49.111.222.333, lip=103.xxx.yyy.zzz, mpid=17371, TLS, session=<E83xW8rqDPkxw3EW> Oct 12 10:09:34 pop3(user(a)tld.com.au)<17371><E83xW8rqDPkxw3EW>: Info: Disconnected: Logged out top=0/0, retr=0/0, del=0/114194, size=10616009472 Oct 12 10:14:36 imap-login: Info: Login: user=<user(a)tld.com.au>, method=PLAIN, rip=49.111.222.333, lip=103.xxx.yyy.zzz, mpid=17460, TLS, session=<ftiLcMrqR/gxw3EW> Oct 12 10:14:37 imap(user(a)tld.com.au)<17460><ftiLcMrqR/gxw3EW>: Info: Logged out in=152 out=69724 deleted=0 expunged=0 trashed=0 hdr_count=0 hdr_bytes=0 body_count=1 body_bytes=68628 Oct 12 10:28:27 pop3-login: Info: Login: user=<user(a)tld.com.au>, method=PLAIN, rip=49.111.222.333, lip=103.xxx.yyy.zzz, mpid=17714, TLS, session=<+WsXosrqK/gxw3EW> Oct 12 10:29:16 pop3(user(a)tld.com.au)<17714><+WsXosrqK/gxw3EW>: Info: Disconnected: Logged out top=0/0, retr=1/76174, del=0/114195, size=10616085600 Oct 12 10:32:19 imap-login: Info: Login: user=<user(a)tld.com.au>, method=PLAIN, rip=49.111.222.333, lip=103.xxx.yyy.zzz, mpid=17817, TLS, session=<bZftr8rqq/gxw3EW> Oct 12 10:32:20 imap(user(a)tld.com.au)<17817><bZftr8rqq/gxw3EW>: Info: Logged out in=153 out=135592 deleted=0 expunged=0 trashed=0 hdr_count=0 hdr_bytes=0 body_count=1 body_bytes=134503 Oct 12 10:45:58 imap-login: Info: Login: user=<user(a)tld.com.au>, method=PLAIN, rip=49.111.222.333, lip=103.xxx.yyy.zzz, mpid=18081, TLS, session=<U3674Mrqzfgxw3EW> Oct 12 10:45:59 imap(user(a)tld.com.au)<18081><U3674Mrqzfgxw3EW>: Info: Logged out in=152 out=24602 deleted=0 expunged=0 trashed=0 hdr_count=0 hdr_bytes=0 body_count=1 body_bytes=23514 Oct 12 10:48:49 pop3-login: Info: Login: user=<user(a)tld.com.au>, method=PLAIN, rip=49.111.222.333, lip=103.xxx.yyy.zzz, mpid=18135, TLS, session=<y1/r6srqtPsxw3EW> Oct 12 10:49:53 pop3(user(a)tld.com.au)<18135><y1/r6srqtPsxw3EW>: Info: Disconnected: Logged out top=0/0, retr=2/166190, del=0/114197, size=10616251743 Oct 12 10:50:42 imap(user(a)tld.com.au)<3274><cr10yqTqifgxw3EW>: Info: Logged out in=192516 out=5957294 deleted=0 expunged=0 trashed=0 hdr_count=263 hdr_bytes=358656 body_count=126 body_bytes=5110403 Oct 12 10:50:42 imap(user(a)tld.com.au)<3271><hLl0yqTqh/gxw3EW>: Info: Logged out in=78324 out=58677 deleted=0 expunged=0 trashed=0 hdr_count=0 hdr_bytes=0 body_count=0 body_bytes=0 Voytek

4 3

iPhone Mail clients generate high Solr I/O
by Alessio Cecchi 22 Mar '23

22 Mar '23

Hi, I'm running a mail server with Dovecot 2.3.20 and Apache Solr as FTS backend. It seems that iPhone/iPad Mail clients are generating some IMAP searches, especially on header Message-ID, that are increasing our Solr I/O load, especially during the night. Are these kind of queries normal? What are they? You can find some logs below. Dovecot logs: Mar 13 21:06:14 dovecot: imap-login: Login: user=<user@domain>, method=PLAIN, rip=x.x.x.x, lip=z.z.z.z, mpid=11263, secured, session=<PQSppM32gePCBJGh> Mar 13 21:06:14 dovecot: imap(user@domain) session=<PQSppM32gePCBJGh>: ID sent: name=iPhone Mail, version=20D67, os=iOS, os-version=16.3.1 (20D67) Mar 13 21:06:14 dovecot: imap(user@domain) session=<PQSppM32gePCBJGh>: Disconnected: Logged out in=207 out=1128 deleted=0 expunged=0 autoexpunged=0 trashed=0 appended=0 hdr_count=0 hdr_bytes=0 body_count=0 body_bytes=0 Solr logs: 2023-03-13 21:06:14.411 INFO (qtp1671846437-1652) [ x:dovecot] o.a.s.c.S.Request [dovecot] webapp=/solr path=/select params={q={!lucene+q.op%3DAND}hdr:<DB8P189MB08692AE65580C36C3B7D6F53C1F59(a)domain6.tld>+OR+hdr:<\!\%26\!AAAAAAAAAAAYAAAAAAAAAI\/Oo\%2BConZZMkCvmEY7yWqjCgAAAEAAAAP968Yud4n1LmhwJxWgTURQBAAAAAA%3D%3D(a)domain5.tld>+OR+hdr:<CALEb\-gfyeQ1zJhjGKS3V8Rn3gk3byNa9co9nOU1L2BtUtKO0aw(a)domain7.tld>+OR+hdr:<AS4P195MB1790AA65F5F367F3CF0888BEDEA19(a)domain5.tld>+OR+hdr:<24E36A6E5BB2410C8090482B3E1EB40F(a)domain8.tld>&fl=uid,score&sort=uid+asc&fq=%2Bbox:d0f433254ee1b161c82c00002e1056c4+%2Buser:user@domain&rows=88&wt=xml} hits=0 status=0 QTime=275 2023-03-13 21:06:14.511 INFO (qtp1671846437-1628) [ x:dovecot] o.a.s.c.S.Request [dovecot] webapp=/solr path=/select params={q={!lucene+q.op%3DAND}hdr:<af03d59c\-2cd5\-1165\-aea5\-6ce7cfe16a89(a)domain.tld>+OR+hdr:<CAJbcrLvxCOGy6fcKBuhuu9B1SALwm9opS\-\-O\-kcMd3nevKrf1A(a)domain7.tld>+OR+hdr:<00eb01d8c8dc$caa8a580$5ff9f080$(a)domain1.tld>+OR+hdr:<VE1PR08MB4846DD525845DC743D47ED52EEBA9(a)domain7.tld>+OR+hdr:<00c701d8bb83$f307bc70$d9173550$(a)domain1.tld>&fl=uid,score&sort=uid+asc&fq=%2Bbox:d0f433254ee1b161c82c00002e1056c4+%2Buser:user@domain&rows=88&wt=xml} hits=0 status=0 QTime=59 2023-03-13 21:06:14.714 INFO (qtp1671846437-1652) [ x:dovecot] o.a.s.c.S.Request [dovecot] webapp=/solr path=/select params={q={!lucene+q.op%3DAND}hdr:<AS4P195MB179002723893D3932AF83A4CDEA29(a)domain5.tld>+OR+hdr:<F3112D85FDF144319FB0ABE348A75AE5(a)domain8.tld>+OR+hdr:<AM9PR10MB510032098A44B16182C9AAF39C4D9(a)domain8.tld>+OR+hdr:<\!\%26\!AAAAAAAAAAAYAAAAAAAAAI\/Oo\%2BConZZMkCvmEY7yWqjCgAAAEAAAADl2MLfkWRxJjQW\%2B3dOhZn0BAAAAAA%3D%3D(a)domain5.tld>+OR+hdr:<CAJbcrLtAEjLO0wbK5AAp8a3p0iRaoUeKA1wsD2ppDFeMnhL\-kA(a)domain7.tld>&fl=uid,score&sort=uid+asc&fq=%2Bbox:d0f433254ee1b161c82c00002e1056c4+%2Buser:user@domain&rows=88&wt=xml} hits=0 status=0 QTime=178 2023-03-13 21:06:14.771 INFO (qtp1671846437-1628) [ x:dovecot] o.a.s.c.S.Request [dovecot] webapp=/solr path=/select params={q={!lucene+q.op%3DAND}hdr:<DU0P189MB208990AA60E3EB5CB2F9BE98DCD39@domain>+OR+hdr:<DDA00A9A19CE4864AD87EF31B0E2113F(a)domain8.tld>+OR+hdr:<GV1PR01MB882049EDFF560AF4F4444F4BB1EE9(a)domain7.tld>&fl=uid,score&sort=uid+asc&fq=%2Bbox:d0f433254ee1b161c82c00002e1056c4+%2Buser:user@domain&rows=88&wt=xml} hits=0 status=0 QTime=34 2023-03-13 21:06:14.899 INFO (qtp1671846437-1652) [ x:dovecot] o.a.s.c.S.Request [dovecot] webapp=/solr path=/select params={q={!lucene+q.op%3DAND}hdr:<AS4P195MB1790922D3154E37AEF263FD1DEDF9(a)domain5.tld>+OR+hdr:<02E5E16DF27945B6A764F49A5D9E055E(a)domain8.tld>+OR+hdr:<CAEK\-5TdF_f%3Dn\%2BL1VWj3EVP9i%3DQe\%2BWaYcW%3DFNy8GSLfE5O1U7dw(a)domain7.tld>+OR+hdr:<4edb1720076ab71575067b0fc2b5d96c(a)domain2.tld>+OR+hdr:<1657012847.68884591(a)domain6.tld>&fl=uid,score&sort=uid+asc&fq=%2Bbox:4830f5144ee1b161c82c00002e1056c4+%2Buser:user@domain&rows=1&wt=xml} hits=0 status=0 QTime=46 Thanks -- Alessio Cecchi Postmaster @http://www.qboxmail.it https://www.linkedin.com/in/alessice

2 1

Import collection of files containing one raw message each into dovecot
by Markus Schönhaber 21 Mar '23

21 Mar '23

Hi, given a bunch of files, each containing the raw source of a single email message. There's no structural or naming scheme like Maildir or something. Is there a (easy) way to import those mails into dovecot? AIUI doveadm import needs a source location in a supported mailbox format - which doesn't seem applicable here. -- Regards mks

2 2

"doveadm altmove -r" not working ?
by Benoit Branciard 21 Mar '23

21 Mar '23

Hello, I have some trouble using "doveadm altmove -r". Regular "doveadm altmove" is OK, selected mails were moved to alternate storage as expected. But I can't manage to get them back to original location, "doveadm altmove -r" has no effect. We are using Dovecot 2.3.4 (Debian Buster package). mail_location = mdbox:~/mdbox:DIRNAME=_@@_dbox-Mails_@@_:ALT=/slow%h/mdbox doveadm altmove -u myuser since 90d -> some message files are created under /slow/my/homedir/mdbox/storage doveadm altmove -r -u myuser all -> message files are still sitting under /slow/my/homedir/mdbox/storage, none were created into /my/homedir/mdbox/storage. Is there some known issues with doveadm altmove in this version ? Or am I missing something ? I can share more config details if needed. -- Benoit BRANCIARD Université Paris 1 Panthéon-Sorbonne - DSIUN-SIS B405 - Centre PMF - 90 rue de Tolbiac - 75013 Paris Tel. 01 44 07 89 68 http://dsiun.univ-paris1.fr

4 5

Read-only / archive mode for IMAP mailboxes?
by Rᴇɴᴇ́ Pꜰᴇɪꜰꜰᴇʀ 20 Mar '23

20 Mar '23

Hello! We are currently exploring email archiving solutions. Is there a way to use an IMAP mailbox in read-only / archive mode? The requirement is that delibveries of new emails should be possible (via SMTP/LMTP), but no messages should be deleted via IMAP access. Frankly I don't think this works, but maybe some of you have tried this already. Regards, René. -- )\._.,--....,'``. fL Let GNU/Linux work for you while you take a nap. /, _.. \ _\ (`._ ,. R. Pfeiffer <lynx at luchs.at> + https://web.luchs.at/ `._.-(,_..'--(,_..'`-.;.' - System administration + Consulting + Teaching - 📨 Got mail delivery problems? https://web.luchs.at/information/blockedmail.php 📯 Complete contact information: https://web.luchs.at/kontakt/ 🔏 Download latest GPG/PGP keys: https://web.luchs.at/kontakt/gpg.asc ⛔ W͇A͇R͇N͇I͇N͇G͇:͇ ͇D͇O͇ ͇_͇N͇O͇T͇_͇ ͇S͇E͇N͇D͇ ͇E͇M͇A͇I͇L͇S͇ ͇W͇I͇T͇H͇ ͇H͇T͇M͇L͇ ͇C͇O͇N͇T͇E͇N͇T͇ ͇T͇O͇ ͇M͇Y͇ ͇E͇M͇A͇I͇L͇ ͇A͇D͇D͇R͇E͇S͇S͇!͇ ⛔

3 3

Remote backup of IMAP user fails with dsync_remote epoll_ctl error
by dml＠plumeriahale.net 20 Mar '23

20 Mar '23

I’m trying backup a user’s IMAP folders from a system running dovecot 2.1.7. to a system running dovecot 2.3.19.1. After much perusing of the web and Dovecot documentation I tried this: 1) On the 2.1.7 host set up the doveadm server to listen on TCP port 2425 and defined a doveadm_password value 2) Issued the following command on the 2.13.19.1 system: doveadm -o doveadm_password=<password> backup -R -u <username> -S <host>:2425 tcp:<host> 3) The command returned the following errors: Error: doveadm server disconnected before handshake: EOF Error: Command backup failed for <username>: EOF 4) In the Dovecot log on the 2.1.7 system I found the following error message: dsync(<username>): Error: user <username>: Initialization failed: Namespace '': Unknown mail storage driver tcp dovecot: dsync(<username>): Fatal: User init failed A couple of questions: 1) I thought that setting up doveadm-server as an inet_listener (with a password) meant that all communications (including the backup) occurred over that link - is that not correct? Or does SSH also need to be enabled as well? 2) Am I specifying the arguments correctly? The definition of the destination argument is confusing in the documentation - if doveadm is trying to backup a user’s IMAP mailboxes from a remote source, and you’ve already specified the information needed to connect to the remote sources doveadm-server why would the source need to be specified again via the TCP: argument?

1 0

Disable folder creation for details username
by Robert Blayzor 20 Mar '23

20 Mar '23

This may be more of a CPanel issue than Dovecot but CPanel uses Dovecot and not sure if this is a knob we have available in Dovecot or we need to reach out to Cpanel directly to see if this is some custom code they added to their distros. Anyway, W/R/T emails sent with dtails/ + addresses ie: foo+bar(a)mydomain.com And with LDA/LMTP, in Cpanel by default the detials part, in this case "bar" will be created in it's own folder. Automatically. To us, this can be an attack vector/DOS from a malicious actor so we want to turn it off. We understand there is: lda_mailbox_autocreate Which we have yes, as we do want to create mailboxes automatically when the first message comes in, but not these folders. I don't know if this folder autocreation on detail part is a Dovecot thing, or specific to Cpanel. It appears CPanel has a patch/code to option to turn it off, but it's only on a per mailbox basis. We want to turn this behavior off globally. As far as I know, CPanel doesn't release whatever patches they made to make this happen, asking here if anyone has experience with this before we start chasing them for answers. -- inoc.net!rblayzor XMPP: rblayzor.AT.inoc.net PGP: https://pgp.inoc.net/rblayzor/

2 2

Dovecot unified event filtering
by Felix Auringer 20 Mar '23

20 Mar '23

Hello, I have an issue with debug logging when using a custom plugin for Dovecot. In my plugin, I create a child event of the session's user event: ```c struct event *plugin_event = event_create(list->ns->user->event); event_set_name(plugin_event, "oidc_shared_mailboxes_plugin"); event_set_min_log_level(plugin_event, LOG_TYPE_WARNING); event_set_append_log_prefix(plugin_event, "oidc-shared-mailboxes-plugin: "); ``` I then use passthrough events like the following: ``` e_debug(event_create_passthrough(data->event)->event(), "Modified mailbox_list_iter_init was called."); e_warning(event_create_passthrough(event)->event(), "Did not find required key 'roles' in the JWT body."); ``` `e_warning` and `e_error` work fine. If I understand the documentation for the unified event filtering (https://doc.dovecot.org/configuration_manual/event_filter/#unified-filter-l…) correctly, I should be able to enable debug logging for with `log_debug = event="oidc_shared_mailboxes_plugin"`. However, this setting has no influence on the logging behavior. The setting I have to set for the debug logging to work is `mail_debug = yes` (I do not have to set `log_debug` at all). Is this intended behavior or am I doing something wrong? Best regards, Felix Auringer Here is the output of `dovecot -n` (I removed the passdb, userdb, namespace, service, and managesieve settings as they cluttered the output): ``` # 2.3.19 (b3ad6004dc): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.19 (4eae2f79) # OS: Linux 5.10.0-15-amd64 x86_64 Debian 11.6 # Hostname: c3dd5b346d22 auth_mechanisms = plain login xoauth2 oauthbearer debug_log_path = /dev/stdout disable_plaintext_auth = no first_valid_uid = 1000 info_log_path = /dev/stdout last_valid_uid = 1000 log_debug = event="oidc_shared_mailboxes_plugin" log_path = /dev/stdout login_greeting = Hello there! .... GIZ Mail! mail_location = maildir:~/mail mail_plugins = " oidc_shared_mailboxes" plugin { oidc_shared_mailboxes_client_id = dovecot-test } protocols = imap lmtp ``` --- Gesellschaft für interkulturelles Zusammenleben gGmbH (GIZ) Felix Auringer IT Reformationsplatz 2 13597 Berlin Tel: 030/513 0100 00; Fax: 030/513 0100 09 www.giz.berlin; felix.auringer(a)giz.berlin Amtsgericht Charlottenburg HRB 200872 B Geschäftsführerin: Dr. Britta Marschke

2 1

Error: Can't load SSL certificate
by Horst Simon 20 Mar '23

20 Mar '23

I try to logon to map using dovecot with SSL required. I get following entries in the log:Mar 20 13:49:30 auth: Debug: Loading modules from directory: /opt/lib/dovecot/modules/auth Mar 20 13:49:30 auth: Debug: Module loaded: /opt/lib/dovecot/modules/auth/lib20_auth_var_expand_crypt.so Mar 20 13:49:30 auth: Debug: Read auth token secret from /opt/var/run/dovecot/auth-token-secret.dat Mar 20 13:49:30 auth: Debug: passwd-file /opt/etc/dovecot/userdb:Read 1 users in 0 secs Mar 20 13:49:30 auth: Debug: auth client connected (pid=26120) Mar 20 13:49:30 imap-login: Error: Failed to initialize SSL server context: Can't load SSL certificate (ssl_cert setting): error:12800067:DSO support routines::could not load the shared library: filename(libz.so): libz.so: cannot open shared object file: No such file or directory, error:12800067:DSO support routines::could not load the shared library: user=<>, rip=192.168.117.5, lip=192.168.117.2, session=<eX3e+Uv3k8DAqHUF> Mar 20 13:49:30 imap-login: Info: Disconnected: TLS initialization failed. (no auth attempts in 0 secs): user=<>, rip=192.168.117.5, lip=192.168.117.2, session=<eX3e+Uv3k8DAqHUF The library files exist in the include directory [/opt] # find . -name libz* -print ./lib/opkg/info/libzstd.control ./lib/opkg/info/libzstd.list ./lib/libz.so ./lib/libz.so.1 ./lib/libz.so.1.2.13 ./lib/libzstd.so ./lib/libzstd.so.1 ./lib/libzstd.so.1.5.2 ./lib/libz.a Have the dovecot settings the same on other servers and it works, Dovecot is v2.3.18, installed from Entware for QNAP. Any help appreciated. Horst

2 1

Can't seem to setup remote access to doveadmI'm using
by dml＠plumeriahale.net 18 Mar '23

18 Mar '23

I’m running version 2.1.7 under Raspbian Wheezy (and have been for a number of years). I want to allow one of my other computers to remotely issue doveadm commands to my server but can’t seem to find the right way to add an inet listener to permit this. Using ‘doveconf -a’ I’ve found the default service definition for doveadm-server. So I copied that and added it to the dovecot configuration with an inet listener section added to it. But that was rejected as a duplicate service definition when I restarted dovecot. I then tried specifying a “host:port” value for the doveadm_socket_path value but that didn’t work as no listening socket at that port appeared when I restarted dovecot. I can’t seem to find in any of the dovecot documentation a way to do this and there seems to be nothing like a “Here’s how to setup doveadm remote access” section in the documentation (which would be most helpful). How can I get doveadm-server to listen not only locally (as it’s already doing) but also open an inet port for remote access?

3 2

Re: [EXT] Re: Corrupted sizes using zlib plugin
by Tim Evers 16 Mar '23

16 Mar '23

Am 06.03.23 um 16:45 schrieb Aki Tuomi: >> On 06/03/2023 16:52 EET Tim Evers <te-ml-ext(a)artfiles.de> wrote: >> >> >> Am 06.03.23 um 15:29 schrieb Aki Tuomi: >>>> On 06/03/2023 15:56 EET Tim Evers <te-ml-ext(a)artfiles.de> wrote: >>>> >>>> >>>> Am 06.03.23 um 14:49 schrieb Aki Tuomi: >>>>>> On 06/03/2023 15:45 EET Tim Evers <te-ml-ext(a)artfiles.de> wrote: >>>>>> >>>>>> >>>>>> Am 06.03.23 um 14:00 schrieb Aki Tuomi: >>>>>>>> On 06/03/2023 13:06 EET Tim Evers <te-ml-ext(a)artfiles.de> wrote: >>>>>>>> >>>>>>>> >>>>>>>> Am 06.03.23 um 11:59 schrieb Aki Tuomi: >>>>>>>> >>>>>>>>>> On 06/03/2023 12:44 EET Tim Evers <te-ml-ext(a)artfiles.de> wrote: >>>>>>>>>> >>>>>>>>>> >>>>>>>>>> Am 06.03.23 um 11:42 schrieb Aki Tuomi: >>>>>>>>>> >>>>>>>>>>>> On 06/03/2023 12:32 EET Tim Evers <te-ml-ext(a)artfiles.de> wrote: >>>>>>>>>>>> >>>>>>>>>>>> >>>>>>>>>>>> Hi, >>>>>>>>>>>> >>>>>>>>>>>> since I did not get any feedback on my bug report post regarding >>>>>>>>>>>> corrupted sizes while using zlib >>>>>>>>>>>> (https://dovecot.org/pipermail/dovecot/2023-February/126105.html) I >>>>>>>>>>>> would like to confirm that this bug report reached someone in charge. >>>>>>>>>>>> >>>>>>>>>>>> Or if not - I would kindly ask for directions on how to post it in a way >>>>>>>>>>>> that spawns some action. >>>>>>>>>>>> >>>>>>>>>>>> Thx >>>>>>>>>>>> >>>>>>>>>>>> Tim >>>>>>>>>>> Can you try erasing dovecot.index.cache and see if the problem fixes itself? It's possible your cache contains invalid values from old errors. >>>>>>>>>>> >>>>>>>>>>> Aki >>>>>>>>>> Did that already several times (other dovecot.index.* files too). The >>>>>>>>>> only thing that helps is actually deleting the dovecot-uidlist file but >>>>>>>>>> the problem returns. >>>>>>>>>> >>>>>>>>>> Tim >>>>>>>>> I think it's because the value on the filename is wrong. The filename contains the virtual and physical size. >>>>>>>>> >>>>>>>>> Can you try if https://github.com/dovecot/tools/blob/main/maildir-size-fix.pl fixes your issue? >>>>>>>>> >>>>>>>>> Aki >>>>>>>> Quoting >>>>>>>> >>>>>>>> https://doc.dovecot.org/configuration_manual/zlib_plugin/ : >>>>>>>> >>>>>>>> "All mails must have ,|S=<size>|in their filename where <size> contains >>>>>>>> the original uncompressed mail size, otherwise there will be problems >>>>>>>> with quota calculation as well as other potential random failures." >>>>>>>> >>>>>>>> And the script you send: >>>>>>>> >>>>>>>> "# Check if the files are compressed. Use the uncompressed size for S=size." >>>>>>>> >>>>>>>> Which it does in my example. S= contains the uncompressed size, not the >>>>>>>> size on disk. Is this not correct? All Files are written exclusively by >>>>>>>> dovecot, no other software is involved. >>>>>>>> >>>>>>>> Tim >>>>>>> Can you send output from `doveconf -n`? I am having suspicion that zlib plugin isn't always involved in your config, which causes the compressed file to be cached wrongly. Especially it feels like your IMAP protocol does not have compression on while LMTP does. >>>>>>> >>>>>>> Aki >>>>>> Actually it is the other way round (I removed zlib from lmtp to reduce >>>>>> the impact of the problem): >>>>>> >>>>>> # 2.3.20 (80a5ac675d): /etc/dovecot/dovecot.conf >>>>>> # Pigeonhole version 0.5.20 (149edcf2) >>>>>> # OS: Linux 4.15.0-204-generic x86_64 Ubuntu 18.04.6 LTS >>>>>> # Hostname: node2.mst27.artfiles.de >>>>>> auth_verbose = yes >>>>>> auth_worker_max_count = 1000 >>>>>> default_client_limit = 5000 >>>>>> dict { >>>>>> sqlquota = mysql:/etc/dovecot/dovecot-dict-sql.conf.ext >>>>>> } >>>>>> disable_plaintext_auth = no >>>>>> import_environment = TZ CLUSTERNAME >>>>>> lda_mailbox_autocreate = yes >>>>>> lda_mailbox_autosubscribe = yes >>>>>> mail_location = maildir:~/Maildir >>>>>> mail_plugins = " mail_log notify old_stats" >>>>>> mailbox_idle_check_interval = 10 mins >>>>>> maildir_broken_filename_sizes = yes >>>>>> managesieve_notify_capability = mailto >>>>>> managesieve_sieve_capability = fileinto reject envelope >>>>>> encoded-character vacation subaddress comparator-i;ascii-numeric >>>>>> relational regex imap4flags copy include variables body enotify >>>>>> environment mailbox date index ihave duplicate mime foreverypart >>>>>> extracttext editheader imapsieve vnd.dovecot.imapsieve >>>>>> namespace inbox { >>>>>> inbox = yes >>>>>> location = >>>>>> mailbox Drafts { >>>>>> auto = subscribe >>>>>> special_use = \Drafts >>>>>> } >>>>>> mailbox Junk { >>>>>> auto = subscribe >>>>>> special_use = \Junk >>>>>> } >>>>>> mailbox Sent { >>>>>> auto = subscribe >>>>>> special_use = \Sent >>>>>> } >>>>>> mailbox "Sent Messages" { >>>>>> special_use = \Sent >>>>>> } >>>>>> mailbox Trash { >>>>>> auto = subscribe >>>>>> special_use = \Trash >>>>>> } >>>>>> prefix = INBOX. >>>>>> separator = . >>>>>> } >>>>>> passdb { >>>>>> args = /etc/dovecot/dovecot-sql.conf.ext >>>>>> driver = sql >>>>>> } >>>>>> plugin { >>>>>> imapsieve_mailbox1_before = file:~/af_report-spam.sieve >>>>>> imapsieve_mailbox1_causes = COPY >>>>>> imapsieve_mailbox1_name = INBOX.Junk >>>>>> imapsieve_mailbox2_before = file:~/af_report-ham.sieve >>>>>> imapsieve_mailbox2_causes = COPY >>>>>> imapsieve_mailbox2_from = INBOX.Junk >>>>>> imapsieve_mailbox2_name = * >>>>>> quota = dict:User quota::proxy::sqlquota >>>>>> quota_rule = *:storage=0:messages=0 >>>>>> sieve = file:~/sieve;active=~/.dovecot.sieve >>>>>> sieve_before = file:~/af_master.sieve >>>>>> sieve_before2 = file:~/af_konto.sieve >>>>>> sieve_before3 = file:~/af_domain.sieve >>>>>> sieve_before4 = file:~/af_spamfilter.sieve >>>>>> sieve_extensions = +editheader >>>>>> sieve_filter_bin_dir = /usr/local/bin/sieve >>>>>> sieve_global_extensions = +vnd.dovecot.pipe +vnd.dovecot.filter >>>>>> +vnd.dovecot.environment >>>>>> sieve_max_redirects = 100 >>>>>> sieve_pipe_bin_dir = /usr/local/bin/sieve >>>>>> sieve_plugins = sieve_imapsieve sieve_extprograms >>>>>> stats_refresh = 30 secs >>>>>> zlib_save = gz >>>>>> zlib_save_level = 6 >>>>>> } >>>>>> pop3_no_flag_updates = yes >>>>>> protocols = " imap lmtp sieve pop3" >>>>>> service anvil { >>>>>> client_limit = 6203 >>>>>> } >>>>>> service auth-worker { >>>>>> process_limit = 1000 >>>>>> } >>>>>> service auth { >>>>>> client_limit = 6300 >>>>>> } >>>>>> service dict { >>>>>> process_limit = 500 >>>>>> unix_listener dict { >>>>>> group = vmail >>>>>> mode = 0600 >>>>>> user = vmail >>>>>> } >>>>>> } >>>>>> service imap-login { >>>>>> process_limit = 4000 >>>>>> process_min_avail = 0 >>>>>> service_count = 0 >>>>>> vsz_limit = 512 M >>>>>> } >>>>>> service imap { >>>>>> client_limit = 1 >>>>>> process_limit = 4000 >>>>>> vsz_limit = 1 G >>>>>> } >>>>>> service lmtp { >>>>>> inet_listener lmtp { >>>>>> address = 127.0.0.1 >>>>>> port = 10024 >>>>>> } >>>>>> process_limit = 80 >>>>>> process_min_avail = 20 >>>>>> vsz_limit = 2 G >>>>>> } >>>>>> service pop3-login { >>>>>> process_limit = 2000 >>>>>> service_count = 0 >>>>>> vsz_limit = 512 M >>>>>> } >>>>>> service pop3 { >>>>>> client_limit = 1 >>>>>> process_limit = 2000 >>>>>> vsz_limit = 1 G >>>>>> } >>>>>> service stats { >>>>>> fifo_listener stats-mail { >>>>>> mode = 0600 >>>>>> user = vmail >>>>>> } >>>>>> } >>>>>> ssl_cert = </etc/dovecot/private/dovecot.pem >>>>>> ssl_client_ca_dir = /etc/ssl/certs >>>>>> ssl_key = # hidden, use -P to show it >>>>>> submission_host = smtp4.artfiles.de >>>>>> syslog_facility = local5 >>>>>> userdb { >>>>>> args = /etc/dovecot/dovecot-sql.conf.ext >>>>>> driver = sql >>>>>> } >>>>>> protocol lmtp { >>>>>> mail_plugins = " mail_log notify old_stats sieve quota" >>>>>> } >>>>>> protocol imap { >>>>>> mail_max_userip_connections = 50 >>>>>> mail_plugins = " mail_log notify old_stats quota imap_quota >>>>>> imap_sieve zlib imap_old_stats" >>>>>> rawlog_dir = /var/log/rawlog/%u >>>>>> } >>>>>> protocol pop3 { >>>>>> mail_max_userip_connections = 50 >>>>>> mail_plugins = " mail_log notify old_stats zlib" >>>>>> } >>>>> It will probably compound on the issue though, especially when rebuilding caches and indexes, as it will record the sizes wrong. I'm not sure if this is *really* the issue, but it's most likely culprit. The 8192 is very odd number to have there, which either indicates that the zlib plugin is not consistently used, or you have some issues with the gz library itself. >>>>> >>>>> Aki >>>> Not sure if I understand this - shouldn't dovecot always note the >>>> decompressed size in cache and filename regardless if it's compressed or >>>> not? >>>> >>>> I just removed the zlib plugin from lmtp to reduce the footprint of the >>>> problem. The problem itself showed up first while lmtp zlib was on. >>>> >>>> Tim >>> It is complaining about the **physical** size though, that is, the amount stored on disk. If you have a dovecot process which is unaware of compression, it can record the wrong size for the file. >>> >>> Aki >> OK, I see. Another thing I noticed: The uidlist entry for a suspicious >> number of these problematic files contains what looks like a GUID: >> >> G1674674677.M641373P33277.node2 >> >> If I remove the uidlist and let dovecot recreate it, it is usually gone. >> Might that be an indicator of some other process writing to the uidlist >> file? the GUID is not mentioned in the dovecot docs as far as I can see. >> >> Tim > It sure sounds like that. > > Aki OK, for future reference: I think I found the issue. There was a periodic doveadm quotacheck job that was unaware of the zlib compression. I fixed that and no new corruption occured (though I still see errors from already corrupted cache data - that will hopefully dry up over time). However: I have still no idea why dovecot is complaining about the index.* files. It seems that the source of the wrong data is the dovecot-uidlist. Also I don't see why the quotacheck cmd (doveadm quota recalc -u <>) **sometimes** updates the dovecot-uidlist file. The quota itself is stored in a sql dict. Thanks to all who provided their input and especially Aki for the support! Tim

1 0

Postfix : root and system user authentication
by Aymeric Agon-Rambosson 16 Mar '23

16 Mar '23

Hello everyone, >From what I understand of the documentation, it is impossible to log in to the dovecot server as root, or as any user not in the interval between first_valid_uid and last_valid_uid. I have been able to verify this. However, when we have a postfix server on the same machine, that delegates authentication to dovecot SASL according to the configuration described at https://doc.dovecot.org/configuration_manual/howto/postfix_and_dovecot_sasl/, we can indeed log in as root on the postfix server. Proof (/var/log/mail.log with auth=debug) : Mar 13 20:16:37 ricorambo dovecot: auth: Debug: client in: AUTH#0111#011PLAIN#011service=smtp#011nologin#011lip=<redacted>#011rip=<redacted>#011secured#011resp=<hidden> Mar 13 20:16:37 ricorambo dovecot: auth: Debug: pam(root,<redacted>): Performing passdb lookup Mar 13 20:16:37 ricorambo dovecot: auth-worker(136499): Debug: Loading modules from directory: /usr/lib/dovecot/modules/auth Mar 13 20:16:37 ricorambo dovecot: auth-worker(136499): Debug: Module loaded: /usr/lib/dovecot/modules/auth/lib20_auth_var_expand_crypt.so Mar 13 20:16:37 ricorambo dovecot: auth-worker(136499): Debug: conn unix:auth-worker (pid=136444,uid=111): Server accepted connection (fd=13) Mar 13 20:16:37 ricorambo dovecot: auth-worker(136499): Debug: conn unix:auth-worker (pid=136444,uid=111): Sending version handshake Mar 13 20:16:37 ricorambo dovecot: auth-worker(136499): Debug: conn unix:auth-worker (pid=136444,uid=111): auth-worker<1>: Handling PASSV request Mar 13 20:16:37 ricorambo dovecot: auth-worker(136499): Debug: conn unix:auth-worker (pid=136444,uid=111): auth-worker<1>: pam(root,<redacted>): Performing passdb lookup Mar 13 20:16:37 ricorambo dovecot: auth-worker(136499): Debug: conn unix:auth-worker (pid=136444,uid=111): auth-worker<1>: pam(root,<redacted>): lookup service=dovecot Mar 13 20:16:37 ricorambo dovecot: auth-worker(136499): Debug: conn unix:auth-worker (pid=136444,uid=111): auth-worker<1>: pam(root,<redacted>): #1/1 style=1 msg=Password: Mar 13 20:16:37 ricorambo dovecot: auth-worker(136499): Debug: conn unix:auth-worker (pid=136444,uid=111): auth-worker<1>: pam(root,<redacted>): Finished passdb lookup Mar 13 20:16:37 ricorambo dovecot: auth-worker(136499): Debug: conn unix:auth-worker (pid=136444,uid=111): auth-worker<1>: Finished Mar 13 20:16:37 ricorambo dovecot: auth: Debug: pam(root,<redacted>): Finished passdb lookup Mar 13 20:16:37 ricorambo dovecot: auth: Debug: auth(root,<redacted>): Auth request finished Mar 13 20:16:37 ricorambo dovecot: auth: Debug: client passdb out: OK#0111#011user=root#011 At this moment, the smtps client connecting to postfix produces "Authentication successful" and we can continue. In contrast, when we try to login to dovecot directly as root, we have the following : Mar 13 20:28:38 ricorambo dovecot: auth: Debug: client in: AUTH#0111#011PLAIN#011service=imap#011secured=tls#011session=<redacted>#011lip=<redacted>#011rip=<redacted>#011lport=993#011rport=52004#011local_name=mail.ricorambo.su#011resp=<hidden> Mar 13 20:28:38 ricorambo dovecot: auth: Debug: pam(root,<redacted>,<redacted>): Performing passdb lookup Mar 13 20:28:38 ricorambo dovecot: auth-worker(137089): Debug: Loading modules from directory: /usr/lib/dovecot/modules/auth Mar 13 20:28:38 ricorambo dovecot: auth-worker(137089): Debug: Module loaded: /usr/lib/dovecot/modules/auth/lib20_auth_var_expand_crypt.so Mar 13 20:28:38 ricorambo dovecot: auth-worker(137089): Debug: conn unix:auth-worker (pid=137079,uid=111): Server accepted connection (fd=13) Mar 13 20:28:38 ricorambo dovecot: auth-worker(137089): Debug: conn unix:auth-worker (pid=137079,uid=111): Sending version handshake Mar 13 20:28:38 ricorambo dovecot: auth-worker(137089): Debug: conn unix:auth-worker (pid=137079,uid=111): auth-worker<1>: Handling PASSV request Mar 13 20:28:38 ricorambo dovecot: auth-worker(137089): Debug: conn unix:auth-worker (pid=137079,uid=111): auth-worker<1>: pam(root,<redacted>,<redacted>): Performing passdb lookup Mar 13 20:28:38 ricorambo dovecot: auth-worker(137089): Debug: conn unix:auth-worker (pid=137079,uid=111): auth-worker<1>: pam(root,<redacted>,<redacted>): lookup service=dovecot Mar 13 20:28:38 ricorambo dovecot: auth-worker(137089): Debug: conn unix:auth-worker (pid=137079,uid=111): auth-worker<1>: pam(root,<redacted>,<redacted>): #1/1 style=1 msg=Password: Mar 13 20:28:38 ricorambo dovecot: auth-worker(137089): Debug: conn unix:auth-worker (pid=137079,uid=111): auth-worker<1>: pam(root,<redacted>,<redacted>): Finished passdb lookup Mar 13 20:28:38 ricorambo dovecot: auth-worker(137089): Debug: conn unix:auth-worker (pid=137079,uid=111): auth-worker<1>: Finished Mar 13 20:28:38 ricorambo dovecot: auth: Debug: pam(root,<redacted>,<eU8pHs32JMuE40wF>): Finished passdb lookup Mar 13 20:28:38 ricorambo dovecot: auth: Debug: auth(root,<redacted>,<eU8pHs32JMuE40wF>): Auth request finished Mar 13 20:28:38 ricorambo dovecot: auth: Debug: client passdb out: OK#0111#011user=root#011#011original_user=root(a)ricorambo.su Mar 13 20:28:38 ricorambo dovecot: auth: Debug: master in: REQUEST#<redacted> Mar 13 20:28:38 ricorambo dovecot: auth: Debug: passwd(root,<redacted>,<redacted>): Performing userdb lookup Mar 13 20:28:38 ricorambo dovecot: auth-worker(137089): Debug: conn unix:auth-worker (pid=137079,uid=111): auth-worker<2>: Handling USER request Mar 13 20:28:38 ricorambo dovecot: auth-worker(137089): Debug: conn unix:auth-worker (pid=137079,uid=111): auth-worker<2>: passwd(root,<redacted>,<redacted>): Performing userdb lookup Mar 13 20:28:38 ricorambo dovecot: auth-worker(137089): Debug: conn unix:auth-worker (pid=137079,uid=111): auth-worker<2>: passwd(root,<redacted>,<redacted>): lookup Mar 13 20:28:38 ricorambo dovecot: auth-worker(137089): Debug: conn unix:auth-worker (pid=137079,uid=111): auth-worker<2>: passwd(root,<redacted>,<redacted>): Finished userdb lookup Mar 13 20:28:38 ricorambo dovecot: auth-worker(137089): Debug: conn unix:auth-worker (pid=137079,uid=111): auth-worker<2>: Finished Mar 13 20:28:38 ricorambo dovecot: auth: Debug: passwd(root,<redacted>,<redacted>): Finished userdb lookup Mar 13 20:28:38 ricorambo dovecot: auth: Debug: master userdb out: USER#<redacted> Mar 13 20:28:38 ricorambo dovecot: imap-login: Login: user=<root>, method=PLAIN, rip=<redacted>, lip=192.168.1.22, mpid=137090, TLS, session=<redacted> Mar 13 20:28:38 ricorambo dovecot: imap(root): Error: Invalid settings in userdb: userdb returned 0 as uid Mar 13 20:28:38 ricorambo dovecot: imap(root): Warning: Event 0xaaab0e9db2a0 leaked (parent=0xaaab0e9cdc80): mail-storage-service.c:1336 Mar 13 20:28:38 ricorambo dovecot: imap(root): Warning: Event 0xaaab0e9cdc80 leaked (parent=(nil)): main.c:246 At this moment, the imap client produces "Internal server error" and finishes. Steps to reproduce : - Delegate SASL authentication from postfix to dovecot as such : /etc/postfix/master.cf smtps inet n - y - - smtpd -o syslog_name=postfix/smtps -o smtpd_tls_wrappermode=yes -o smtpd_sasl_auth_enable=yes -o smtpd_relay_restrictions=permit_sasl_authenticated,reject -o smtpd_recipient_restrictions=permit_sasl_authenticated,reject -o smtpd_sasl_type=dovecot -o smtpd_sasl_path=private/auth and of course : /etc/dovecot/conf.d/10-master.conf unix_listener /var/spool/postfix/private/auth { mode = 0660 user = postfix group = postfix } - login to your server, port 465, with a client like openssl : openssl s_client -connect mail.example.org:465 EHLO whateveryouwant AUTH PLAIN \0root\0password (in base 64, ofc) You should be able to login, and produce the first log trace I have included. My question is, is this a feature or a bug ? The hardcoded impossibility to login as root to dovecot, and the honouring of the variables {first,last}_valid_{u,g}id, are those specific to login to dovecot directly, or should they be applicable to any other process that has delegated its authentication to dovecot ? If this is a feature, that is if postfix cannot profit from the variables {first,last}_valid_{u,g}id (or the hardcoded forbidding of root) through dovecot sasl : - This should maybe made more obvious somewhere in the documentation. - What would be the good way to prevent root login to postfix, when authentication is delegated to dovecot ? The dovecot version is 2.3.13 (89f716dc2) The system is the following : Linux 5.10.0-21-arm64 #1 SMP Debian 5.10.162-1 (2023-01-21) aarch64 GNU/Linux Thank you in advance for your time. I have included the output of dovecot -n for reference. Best regards, Aymeric

6 10

Build dovecot from source
by Horst Simon 16 Mar '23

16 Mar '23

I am sorry if this is not the correct list for asking this. T try to build dovecot 2.3.20 from source on a QNAP NAS, which is a linux variant. There is an dovecot available, but this does not include a pigeonhole sieve, that’s why I try to build it from source. The configure script works fine, but the make fails as follows: *** Warning: Linking the executable test-http-payload against the loadable module *** libssl_iostream_openssl.so is not portable! libtool: link: gcc -std=gnu99 -g -O2 -fstack-protector-strong -U_FORTIFY_SOURCE -D_FORTIFY_SOURCE=2 -mfunction-return=keep -mindirect-branch=keep -Wall -W -Wmissing-prototypes -Wmissing-declarations -Wpointer-arith -Wchar-subscripts -Wformat=2 -Wbad-function-cast -fno-builtin-strftime -Wstrict-aliasing=2 -Wl,--as-needed -o .libs/test-http-payload test-http-payload.o -Wl,--export-dynamic -L/share/CACHEDEV1_DATA/.qpkg/Entware/lib -L/share/CACHEDEV1_DATA/.qpkg/Apache81/lib ./.libs/libhttp.a ../lib-dns/.libs/libdns.a ../lib-ssl-iostream/.libs/libssl_iostream.a ../lib-master/.libs/libmaster.a ../lib-auth/.libs/libauth.a ../lib-settings/.libs/libsettings.a ../lib-test/.libs/libtest.a ../lib/.libs/liblib.a -ldl ../lib-ssl-iostream/.libs/libssl_iostream_openssl.so -Wl,-rpath -Wl,/opt/lib/dovecot /opt/bin/ld: ../lib-ssl-iostream/.libs/libssl_iostream_openssl.so: undefined reference to `ENGINE_set_default@OPENSSL_1_1_0' /opt/bin/ld: ../lib-ssl-iostream/.libs/libssl_iostream_openssl.so: undefined reference to `ENGINE_init@OPENSSL_1_1_0' /opt/bin/ld: ../lib-ssl-iostream/.libs/libssl_iostream_openssl.so: undefined reference to `ENGINE_load_builtin_engines@OPENSSL_1_1_0' /opt/bin/ld: ../lib-ssl-iostream/.libs/libssl_iostream_openssl.so: undefined reference to `ENGINE_free@OPENSSL_1_1_0' /opt/bin/ld: ../lib-ssl-iostream/.libs/libssl_iostream_openssl.so: undefined reference to `ENGINE_finish@OPENSSL_1_1_0' /opt/bin/ld: ../lib-ssl-iostream/.libs/libssl_iostream_openssl.so: undefined reference to `ENGINE_by_id@OPENSSL_1_1_0' collect2: error: ld returned 1 exit status make[3]: *** [Makefile:892: test-http-payload] Error 1 make[3]: Leaving directory '/share/CACHEDEV1_DATA/temp/dovecot-2.3.20/src/lib-http' make[2]: *** [Makefile:573: all-recursive] Error 1 make[2]: Leaving directory '/share/CACHEDEV1_DATA/temp/dovecot-2.3.20/src' make[1]: *** [Makefile:702: all-recursive] Error 1 make[1]: Leaving directory '/share/CACHEDEV1_DATA/temp/dovecot-2.3.20' make: *** [Makefile:546: all] Error 2 I already asked in the GitHub forum, but haven’t received any answers, that why I m asking here if anyone can help me to get it working. Horst

1 0

Bug with lmtp_save_to_detail_mailbox
by Dejan 15 Mar '23

15 Mar '23

> lmtp_save_to_detail_mailbox = yes Plus-delivery conflicts with existing, reserved files such as "subscriptions": Message for kim+subscriptions@ results in: lmtp(kim(a)***.com)<14493><SK7sEvaHEWSdOAAAvAYmHA>: Error: ....stat(/var/mails/***/kim/Maildir/subscriptions/tmp) failed: Not a directory Version: 2.3.18

2 4

dovecot crash with Panic: file istream-header-filter.c: line 663
by Patrick Mansfield 13 Mar '23

13 Mar '23

Hi - I'm hitting a crash in dovecot, I get this logged followed by a terse stack trace and systemd-coredump details not included here - full gdb stack trace and more details are further down: Mar 12 10:32:26 goffin dovecot[8269]: imap-login: Login: user=<patman>, method=PLAIN, rip=192.168.1.4, lip=192.168.1.1, mpid=8477, TLS, session=<5RvGYLf2RrDAqAEE> Mar 12 10:32:26 goffin audit[8304]: USER_AUTH pid=8304 uid=0 auid=4294967295 ses=4294967295 subj=kernel msg='op=PAM:authentication grantors=pam_usertype,pam_localuser,pam_unix acct="patman" exe="/usr/libexec/dovecot/auth" hostname=192.168.1.4 addr=192.168.1.4 terminal=dovecot res=success' Mar 12 10:32:26 goffin audit[8304]: USER_ACCT pid=8304 uid=0 auid=4294967295 ses=4294967295 subj=kernel msg='op=PAM:accounting grantors=pam_unix,pam_localuser acct="patman" exe="/usr/libexec/dovecot/auth" hostname=192.168.1.4 addr=192.168.1.4 terminal=dovecot res=success' Mar 12 10:32:26 goffin dovecot[8269]: imap-login: Login: user=<patman>, method=PLAIN, rip=192.168.1.4, lip=192.168.1.1, mpid=8479, TLS, session=<PnHKYLf2SrDAqAEE> Mar 12 10:32:27 goffin dovecot[8269]: imap(patman)<8452><r+ynYLf2PrDAqAEE>: Panic: file istream-header-filter.c: line 663 (i_stream_header_filter_snapshot_free): assertion failed: (snapshot->mstream->snapshot_pending) Mar 12 10:32:27 goffin audit[8452]: ANOM_ABEND auid=4294967295 uid=1000 gid=1000 ses=4294967295 subj=kernel pid=8452 comm="imap" exe="/usr/libexec/dovecot/imap" sig=6 res=1 email client is fairemail version 1.2042a on android, but an older version had the same problem. I mainly use fairemail to read emails on my phone, and that is working fine but I noticed that deleted emails were not actually getting deleted, that it has a bunch of "pending operations" it has were not running, and that dovecot has been crashing like this since about feb 2 (over a month ago). I can't figure out what changed at that time, but my cert says it should have expired over a year ago, but the cert as created 26 months ago. log files only go back to Feb 5 so just missed that. I generated a new cert but it's still crashing (I probably still need to do something on the client side or my setup is broken). I assume there is something wrong or some "snapshot" thing that's stuck, but since it's crashing I can't figure out what the undelysing problem is. Thanks for any help. More details: -------------------------------------------------------------------------------- # dovecot --version 2.3.20 (80a5ac675d) Running with up to date fedora core 37. -------------------------------------------------------------------------------- # dovecot -n # 2.3.20 (80a5ac675d): /etc/dovecot/dovecot.conf # OS: Linux 6.1.15-200.fc37.x86_64 x86_64 Fedora release 37 (Thirty Seven) # Hostname: specu mail_location = mbox:~/Mail:INBOX=~/Mail/inbox mbox_write_locks = fcntl namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } passdb { driver = pam } ssl = required ssl_cert = </etc/pki/dovecot/certs/dovecot.pem ssl_cipher_list = PROFILE=SYSTEM ssl_key = # hidden, use -P to show it userdb { driver = passwd } -------------------------------------------------------------------------------- gdb backtrace via coredumpctl debug PID: Core was generated by `dovecot/imap'. Program terminated with signal SIGABRT, Aborted. --Type <RET> for more, q to quit, c to continue without paging-- #0 __pthread_kill_implementation (threadid=<optimized out>, signo=signo@entry=6, no_tid=no_tid@entry=0) at pthread_kill.c:44 44 return INTERNAL_SYSCALL_ERROR_P (ret) ? INTERNAL_SYSCALL_ERRNO (ret) : 0; (gdb) bt #0 __pthread_kill_implementation (threadid=<optimized out>, signo=signo@entry=6, no_tid=no_tid@entry=0) at pthread_kill.c:44 #1 0x00007fa3840afec3 in __pthread_kill_internal (signo=6, threadid=<optimized out>) at pthread_kill.c:78 #2 0x00007fa38405fa76 in __GI_raise (sig=sig@entry=6) at ../sysdeps/posix/raise.c:26 #3 0x00007fa3840497fc in __GI_abort () at abort.c:79 #4 0x00007fa3847541e3 in default_fatal_finish (status=0, type=LOG_TYPE_PANIC) at ../lib/failures.c:465 #5 fatal_handler_real (ctx=<optimized out>, format=<optimized out>, args=<optimized out>) at ../lib/failures.c:477 #6 0x00007fa3847ff5f7 in i_internal_fatal_handler (ctx=<optimized out>, format=<optimized out>, args=<optimized out>) at ../lib/failures.c:879 #7 0x00007fa3847540e1 in i_panic (format=0x7fa384844040 "file %s: line %d (%s): assertion failed: (%s)") at ../lib/failures.c:530 #8 0x00007fa38474fdf8 in i_stream_header_filter_snapshot_free (_snapshot=<optimized out>) at ../lib-mail/istream-header-filter.c:663 #9 i_stream_header_filter_snapshot_free (_snapshot=0x56150ea92250) at ../lib-mail/istream-header-filter.c:655 #10 0x00007fa38480cb6c in i_stream_snapshot_free (_snapshot=_snapshot@entry=0x56150ea9d2a0) at ../lib/istream.c:253 #11 0x00007fa38480cc14 in i_stream_unref (stream=0x56150ea9d338) at ../lib/istream.c:66 #12 0x00007fa3847dd179 in message_parse_header_deinit (_ctx=_ctx@entry=0x56150ea9d0c8) at ../lib-mail/message-header-parser.c:52 #13 0x00007fa3847deea1 in preparsed_parse_next_header (ctx=0x56150ea9d050, block_r=0x7ffc8222ca70) at ../lib-mail/message-parser-from-parts.c:310 #14 0x00007fa3847dfedc in message_parser_parse_next_block (ctx=ctx@entry=0x56150ea9d050, block_r=block_r@entry=0x7ffc8222ca70) at ../lib-mail/message-parser.c:838 #15 0x00007fa3847e0029 in message_parser_parse_header (ctx=0x56150ea9d050, hdr_size=hdr_size@entry=0x56150ea5ff00, callback=callback@entry=0x7fa3849aa3f0 <index_mail_parse_part_header_cb>, context=context@entry=0x56150ea5fc78) at ../lib-mail/message-parser.c:877 #16 0x00007fa3849aa60a in index_mail_parse_headers_internal (mail=mail@entry=0x56150ea5fc78, headers=headers@entry=0x0) at index/index-mail-headers.c:465 #17 0x00007fa3849aa71e in index_mail_parse_headers (mail=0x56150ea5fc78, headers=0x0, reason=<optimized out>) at index/index-mail-headers.c:499 #18 0x00007fa3849b021e in index_mail_parse_bodystructure_full (mail=0x56150ea5fc78, field=MAIL_CACHE_IMAP_BODYSTRUCTURE) at index/index-mail.c:1491 #19 0x00007fa3849b02b3 in index_mail_parse_bodystructure (mail=mail@entry=0x56150ea5fc78, field=field@entry=MAIL_CACHE_IMAP_BODYSTRUCTURE) at index/index-mail.c:1515 #20 0x00007fa3849b06cd in index_mail_get_special (_mail=0x56150ea5fc78, field=<optimized out>, value_r=0x7ffc8222cbe0) at index/index-mail.c:1713 #21 0x00007fa38492fa1e in mail_get_special (mail=<optimized out>, field=field@entry=MAIL_FETCH_IMAP_BODYSTRUCTURE, value_r=value_r@entry=0x7ffc8222cbe0) at /usr/src/debug/dovecot-2.3.20-1.fc37.x86_64/src/lib-storage/mail.c:418 #22 0x000056150dcf458c in fetch_bodystructure (ctx=0x56150ea57530, mail=<optimized out>, context=<optimized out>) at /usr/src/debug/dovecot-2.3.20-1.fc37.x86_64/src/imap/imap-fetch.c:740 #23 0x000056150dcfa3f3 in imap_fetch_more_int (ctx=ctx@entry=0x56150ea57530, cancel=false) at /usr/src/debug/dovecot-2.3.20-1.fc37.x86_64/src/imap/imap-fetch.c:562 #24 0x000056150dcfa6cd in imap_fetch_more (ctx=0x56150ea57530, cmd=0x56150ea57368) at /usr/src/debug/dovecot-2.3.20-1.fc37.x86_64/src/imap/imap-fetch.c:617 #25 0x000056150dceed11 in cmd_fetch (cmd=0x56150ea57368) at /usr/src/debug/dovecot-2.3.20-1.fc37.x86_64/src/imap/cmd-fetch.c:382 #26 0x000056150dcf79a5 in command_exec (cmd=cmd@entry=0x56150ea57368) at /usr/src/debug/dovecot-2.3.20-1.fc37.x86_64/src/imap/imap-commands.c:201 #27 0x000056150dcfd712 in client_command_input (cmd=<optimized out>, cmd@entry=0x56150ea57368) at /usr/src/debug/dovecot-2.3.20-1.fc37.x86_64/src/imap/imap-client.c:1232 #28 0x000056150dcfd7b8 in client_command_input (cmd=<optimized out>) at /usr/src/debug/dovecot-2.3.20-1.fc37.x86_64/src/imap/imap-client.c:1302 #29 0x000056150dcfdc05 in client_handle_next_command (remove_io_r=<synthetic pointer>, client=0x56150ea567f8) at /usr/src/debug/dovecot-2.3.20-1.fc37.x86_64/src/imap/imap-client.c:1344 #30 client_handle_input (client=client@entry=0x56150ea567f8) at /usr/src/debug/dovecot-2.3.20-1.fc37.x86_64/src/imap/imap-client.c:1358 #31 0x000056150dcfdfd4 in client_input (client=0x56150ea567f8) at /usr/src/debug/dovecot-2.3.20-1.fc37.x86_64/src/imap/imap-client.c:1402 #32 0x00007fa3848183ad in io_loop_call_io (io=0x56150ea890b0) at ../lib/ioloop.c:737 #33 0x00007fa38481973a in io_loop_handler_run_internal (ioloop=ioloop@entry=0x56150ea2def0) at ../lib/ioloop-epoll.c:222 #34 0x00007fa3848197e4 in io_loop_handler_run (ioloop=ioloop@entry=0x56150ea2def0) at ../lib/ioloop.c:789 #35 0x00007fa3848199a0 in io_loop_run (ioloop=0x56150ea2def0) at ../lib/ioloop.c:762 #36 0x00007fa384788bf7 in master_service_run (service=0x56150ea2dd40, callback=callback@entry=0x56150dd00ae0 <client_connected>) at ../lib-master/master-service.c:869 #37 0x000056150dce9c4d in main (argc=<optimized out>, argv=<optimized out>) at /usr/src/debug/dovecot-2.3.20-1.fc37.x86_64/src/imap/main.c:566 (gdb)

3 6

Option to disable client-initiated renegotiation
by Serg 13 Mar '23

13 Mar '23

Hello, is there any way to disallow client-initiated renegotiation at the dovecot? I haven't found any mention of this feature within source code as well as at the documentation. I am asking about it because without this feature mail server is vulnerable to a TLS renegotiation DoS attack which can consume a lot of CPU and is harder to combat comparing to a basic TLS connections flood.

2 1

bug: usersfile very weird behaviour regarding path to mbox
by Mikel Pérez 13 Mar '23

13 Mar '23

dovecot --version 2.3.20 (80a5ac675d) having the following setup: (1) aioria:/srv/franper/mail # cat /etc/dovecot/users ***snip*** ventas-respaldo@franper.net:*snip*:1001:1000::/srv/franper/mail/ventas (2) aioria:/srv/franper/mail # ls -lha total 0 drwxr-x---. 1 1001 1000 238 Mar 13 05:07 . drwxr-sr-x. 1 1000 1001 62 Oct 24 21:29 .. ***snip*** drwxr-x---. 1 1001 1000 578 Mar 4 18:53 ventas drwx------. 1 1001 1000 246 Mar 13 05:07 ventas-respaldo (3) aioria:/srv/franper/mail # date -u Mon Mar 13 05:09:06 UTC 2023 where (1) I'm trying to expose the contents of the mbox ventas as ventas-respaldo(a)franper.net, well, for some reason it disregards that I'm pointing at /srv/franper/mail/ventas BUT does take the directory path at /srv/franper/mail and then constructs a /srv/franper/mail/ventas-respaldo path, which you can confirm with (2) showing ventas-respaldo modification date being today's date (3) because a client (Thunderbird 103 if you're interested but I think that it's not its fault at all) tried accessing ventas-respaldo(a)franper.net which should have pointed to /srv/franper/mail/ventas but instead did this very weird thing. Nowhere in /etc/dovecot/users do I have a line pointing to /srv/franper/mail/ventas-respaldo. dovecut just generates it somehow. dovecot -n: # 2.3.20 (80a5ac675d): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.20 (149edcf2) # OS: Linux 6.2.1-1-default x86_64 ## (OpenSUSE micro OS) # Hostname: aioria disable_plaintext_auth = no mail_location = maildir:/srv/franper/mail/%n managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables b ody enotify environment mailbox date index ihave duplicate mime foreverypart extracttext namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } passdb { args = scheme=CRYPT username_format=%u /etc/dovecot/users driver = passwd-file } plugin { sieve = file:~/sieve;active=~/.dovecot.sieve } ssl = required ssl_cert = <*snip* ssl_cipher_list = ALL:!DH:!kRSA:!SRP:!kDHd:!DSS:!aNULL:!eNULL:!EXPORT:!DES:!3DES:!MD5:!PSK:!RC4:!ADH:!LOW@STRENGTH ssl_key = # hidden, use -P to show it ssl_options = no_compression ssl_prefer_server_ciphers = yes userdb { args = username_format=%u /etc/dovecot/users driver = passwd-file } tell me if you need the sysreport tar and big thanks

1 0

set imap flags in user sieve scripts
by spi 11 Mar '23

11 Mar '23

Hi all Could anyone lead me into the right direction please? I use 'addflag ...' or 'fileinto :flags ...' in global sieve scripts to flag and sort incoming mail - that works. Trying to do that with custom user scripts doesn't work - I get the error that imap4flags only can be used in global scripts. Is there any way to get incoming mails labled and sorted by user sieve scripts? So something like this for a particular user doesn't work: if address :domain "From" "whatever.com"{ fileinto :flags ["\\todo"] "working/whatever"; } -- Cheers spi

3 4

Inconsistent filtering with debugging
by Christian Wolf 11 Mar '23

11 Mar '23

Hello, I have the problem, that I have a Postfix/Dovecot combination running with Sieve activated. The sieve script is running in general as some messages get filtered and moved to the appropriate folders. Now, I see that for the envelope filter, the behavior differs depending if I am debugging the rules or if the mails are received in a regular way. I have something like this: require "envelope"; # ... if envelope :is "to" "foo(a)subdaomin.example.com" { fileinto "INBOX.bar"; stop; } # ... The thing is if I call sieve-filter on the INBOX, I get the information that the mail is to be moved to the appropriate folder. However during delivery the mail is not moved there. Other rules in the script are working so it is installed in general. Of course, I could send mails to the mail address for testing but I have no clue on where to look for issues, especially as the "main debugging tool" for the rules (sieve-filter) is strangely behaving differently. The reason, I wanted to use the envelope was because the mails are delivered to foo(a)subdomain.example.com. From there, some virtual aliases are forwarded to a cental account bar(a)example.net using postfix virtual aliases. Thus, the Delivered-To header is always showing the value bar(a)example.net which is not suited for filtering. I could filter the Received headers but hoped for a more "high level" solution. Can you give me any advice? Christian

3 3

Winbind auhentication
by Luciano Mannucci 10 Mar '23

10 Mar '23

Helo all! I'm trying to set up a dovecot server so that it authenticates local user via /etc/passwd (I'm on a Freebsd 13.1) and via winbindd for those that it cannot find localy. The samba suite is alive and well, postfix gets happily mail from domain users and saves it with correct name and permissions from the windows domain. If I try to authenticate a domain user via wbinfo it works, with dovecot it doesn't. I guess I'v forgot something in the dovecot config... :) Here is my doveconf -n: # 2.3.20 (80a5ac675d): /usr/local/etc/dovecot/dovecot.conf # Pigeonhole version 0.5.20 (149edcf2) # OS: FreeBSD 13.1-RELEASE-p5 powerpc ufs # Hostname: numeron.mcs.it auth_cache_size = 30 k auth_debug_passwords = yes auth_mechanisms = plain ntlm login auth_use_winbind = yes auth_username_format = %n auth_winbind_helper_path = /usr/local/bin/ntlm_auth default_client_limit = 1128 default_vsz_limit = 712 M disable_plaintext_auth = no first_valid_uid = 0 info_log_path = /var/log/dovecot/logfile.info listen = * lock_method = flock log_path = /var/log/dovecot/logfile login_greeting = Dovecot at Nameron Ready. mail_location = mbox:/var/spool/dovecot/%u:INBOX=/var/mail/%u mail_plugins = fts managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext passdb { driver = passwd } protocols = imap pop3 service replication-notify-fifo { name = aggregator } service anvil-auth-penalty { name = anvil } service auth-worker { name = auth-worker } service auth-client { user = root name = auth } service config { name = config } service dict-async { name = dict-async } service dict { name = dict } service login/proxy-notify { name = director } service dns-client { name = dns-client } service doveadm-server { name = doveadm } service imap-hibernate { name = imap-hibernate } service imap { service_count = 0 name = imap-login } service imap-urlauth { name = imap-urlauth-login } service imap-urlauth-worker { name = imap-urlauth-worker } service token-login/imap-urlauth { name = imap-urlauth } service imap-master { name = imap } service indexer-worker { name = indexer-worker } service indexer { name = indexer } service ipc { name = ipc } service lmtp { name = lmtp } service log-errors { name = log } service sieve { name = managesieve-login } service login/sieve { name = managesieve } service old-stats-mail { name = old-stats } service pop3 { process_limit = 255 service_count = 1 name = pop3-login } service login/pop3 { name = pop3 } service replicator-doveadm { name = replicator } service login/stats-writer { unix_listener { group = mail mode = 0666 user = dovecot path = stats-reader } unix_listener { group = mail mode = 0666 user = dovecot path = stats-writer } name = stats } service submission { name = submission-login } service login/submission { name = submission } ssl = no userdb { driver = passwd } protocol pop3 { pop3_client_workarounds = outlook-no-nuls oe-ns-eoh pop3_enable_last = yes pop3_uidl_format = %08Xu%08Xv service replication-notify-fifo { name = aggregator } service anvil-auth-penalty { name = anvil } service auth-worker { name = auth-worker } service auth-client { name = auth } service config { name = config } service dict-async { name = dict-async } service dict { name = dict } service login/proxy-notify { name = director } service dns-client { name = dns-client } service doveadm-server { name = doveadm } service imap-hibernate { name = imap-hibernate } service imap { name = imap-login } service imap-urlauth { name = imap-urlauth-login } service imap-urlauth-worker { name = imap-urlauth-worker } service token-login/imap-urlauth { name = imap-urlauth } service imap-master { name = imap } service indexer-worker { name = indexer-worker } service indexer { name = indexer } service ipc { name = ipc } service lmtp { name = lmtp } service log-errors { name = log } service sieve { name = managesieve-login } service login/sieve { name = managesieve } service old-stats-mail { name = old-stats } service pop3 { name = pop3-login } service login/pop3 { name = pop3 } service replicator-doveadm { name = replicator } service login/stats-writer { name = stats } service submission { name = submission-login } service login/submission { name = submission } } protocol lda { debug_log_path = /var/log/dovecot/lda-debug.log info_log_path = /var/log/dovecot/lda.info log_path = /var/log/dovecot/lda.err mail_debug = yes postmaster_address = l(a)mcs.it service replication-notify-fifo { name = aggregator } service anvil-auth-penalty { name = anvil } service auth-worker { name = auth-worker } service auth-client { name = auth } service config { name = config } service dict-async { name = dict-async } service dict { name = dict } service login/proxy-notify { name = director } service dns-client { name = dns-client } service doveadm-server { name = doveadm } service imap-hibernate { name = imap-hibernate } service imap { name = imap-login } service imap-urlauth { name = imap-urlauth-login } service imap-urlauth-worker { name = imap-urlauth-worker } service token-login/imap-urlauth { name = imap-urlauth } service imap-master { name = imap } service indexer-worker { name = indexer-worker } service indexer { name = indexer } service ipc { name = ipc } service lmtp { name = lmtp } service log-errors { name = log } service sieve { name = managesieve-login } service login/sieve { name = managesieve } service old-stats-mail { name = old-stats } service pop3 { name = pop3-login } service login/pop3 { name = pop3 } service replicator-doveadm { name = replicator } service login/stats-writer { name = stats } service submission { name = submission-login } service login/submission { name = submission } } root@numeron:~# Thanks for any hint, Luciano. -- /"\ /Via A. Salaino, 7 - 20144 Milano (Italy) \ / ASCII RIBBON CAMPAIGN / PHONE : +39 02485781 FAX: +39 0248028247 X AGAINST HTML MAIL / E-MAIL: posthamster(a)sublink.sublink.ORG / \ AND POSTINGS / WWW: http://www.lesassaie.IT/

2 2

NFS and performances
by tomate aceite 10 Mar '23

10 Mar '23

Thanks!!!!

1 0

how to setup timestamp
by tomate aceite 10 Mar '23

10 Mar '23

*Thanks** Alessio Cecchi*

1 0

index locally
by tomate aceite 10 Mar '23

10 Mar '23

Thanks guys for all the help. I will check if i can do a rsync script.

1 0

Backend doesn't support GUIDs
by Jose Celestino 09 Mar '23

09 Mar '23

Hi, Have some old dboxes where doveadm sync fails with "Backend doesn't support GUIDs, sync with header hashes instead". The error is right after reading from the folder dovecot.index.log.2. The dovecot version is 2.3.10. Any fix/workaround for the error?

1 0

how to setup timestamp
by tomate aceite 08 Mar '23

08 Mar '23

Does anyone got any example about how to implement delay_until = timestamp ? I am not sure where i can setup it. Thanks!

2 1

Missing mailboxes after migration from Maildir -> mdbox
by A 08 Mar '23

08 Mar '23

I migrated from existing dovecot Maildir to dbox. After adding separator to the namespace it migrated all Inbox mails, but the other mailboxes like user-created ones and "Junk", "Sent" and so on has not been migrated. Any advice would be helpful, here is my dovconf: https://pastebin.com/rDSeBcLe My migration I made using: 1. Edit dovecot.conf with new mdbox and adding separator 2. dsync mirror per user with old maildir:~/mail 3. missing mailboxes: tried with doveadm sync also with -f mode and specified mailboxes. No luck. dsync -v -u admin@(removed) mirror maildir:~/mail mail_home = /var/vmail/mailboxes/%d/%n #mail_location = maildir:~/mail:LAYOUT=fs mail_location=mdbox:~/mdbox My directorys: root@mail:/var/vmail/mailboxes/example.de/admin# ls -l insgesamt 56 drwxrwx--- 2 vmail vmail 4096 8. Mär 01:14 cur -rw-rw---- 1 vmail vmail 160 8. Mär 01:14 dovecot.index.log -rw-rw---- 1 vmail vmail 3712 8. Mär 01:14 dovecot.list.index.log -rw-rw---- 1 vmail vmail 96 8. Mär 01:14 dovecot.mailbox.log -rw-rw---- 1 vmail vmail 51 8. Mär 01:14 dovecot-uidlist -rw-rw---- 1 vmail vmail 8 8. Mär 01:14 dovecot-uidvalidity -r--r--r-- 1 vmail vmail 0 8. Mär 00:57 dovecot-uidvalidity.6407cf6d drwxrwx--- 20 vmail vmail 4096 8. Mär 02:51 mail drwx------ 7 vmail vmail 4096 8. Mär 13:52 mailboxes drwx------ 13 vmail vmail 4096 8. Mär 02:36 Maildir drwx------ 5 vmail vmail 4096 8. Mär 04:20 mdbox drwxrwx--- 2 vmail vmail 4096 8. Mär 01:14 new -rw-rw---- 1 vmail vmail 28 8. Mär 01:14 subscriptions drwxrwx--- 2 vmail vmail 4096 8. Mär 01:14 tmp drwxrwx--- 2 vmail vmail 4096 8. Mär 00:57 xapian-indexes root@mail:/var/vmail/mailboxes/example.de/admin/mail# ls -l insgesamt 87576 drwxrwx--- 2 vmail vmail 9113600 8. Mär 02:20 cur -rw-rw---- 1 vmail vmail 1602296 8. Mär 02:20 dovecot.index -rw-rw---- 1 vmail vmail 73030876 8. Mär 02:41 dovecot.index.cache -rw-rw---- 1 vmail vmail 441656 8. Mär 02:39 dovecot.index.log -rw-rw---- 1 vmail vmail 83568 8. Mär 02:20 dovecot.index.log.2 -rwxrwx--- 1 vmail vmail 206490 17. Jun 2019 dovecot.index.thread -rwxrwx--- 1 vmail vmail 51 2. Aug 2019 dovecot-keywords -rw-rw---- 1 vmail vmail 1392 8. Mär 01:25 dovecot.list.index -rw-rw---- 1 vmail vmail 6712 8. Mär 02:41 dovecot.list.index.log -rwxrwx--- 1 vmail vmail 1464 8. Mär 02:20 dovecot.mailbox.log -rw-rw---- 1 vmail vmail 4875528 8. Mär 02:20 dovecot-uidlist -rwxrwx--- 1 vmail vmail 8 8. Mär 01:25 dovecot-uidvalidity -rwxrwx--- 1 vmail vmail 0 17. Jun 2019 dovecot-uidvalidity.5a6912f0 drwxrwx--- 5 vmail vmail 4096 7. Mär 20:14 Drafts -rw-rw---- 1 vmail vmail 49 6. Mär 11:10 maildirsize drwxrwx--- 5 vmail vmail 4096 7. Mär 20:44 'Mailling Listen' drwxrwx--- 2 vmail vmail 204800 8. Mär 00:04 new drwxrwx--- 5 vmail vmail 4096 7. Mär 20:14 Sent drwxrwx--- 5 vmail vmail 4096 7. Mär 20:44 Spam drwxrwx--- 5 vmail vmail 4096 26. Feb 19:44 'SPF Fail' -rw-rw---- 1 vmail vmail 23 8. Mär 02:20 subscriptions drwxrwx--- 2 vmail vmail 4096 8. Mär 02:20 tmp drwxrwx--- 5 vmail vmail 4096 26. Feb 19:12 Trash drwxrwx--- 5 vmail vmail 4096 7. Mär 22:30 ubb drwxrwx--- 10 vmail vmail 4096 27. Feb 18:44 xapian-indexes

1 0

index locally
by tomate aceite 08 Mar '23

08 Mar '23

Hello, Do you know if is possible to store indexes locally instead of NFS in dovecot 2.2.7 ? Thanks.

3 2

Dovecot "Mailbox sharing between users".
by Jobst Schmalenbach 07 Mar '23

07 Mar '23

Hi I have appended the important bits of my server configuration to the end of this email I am trying to get "Mailbox sharing between users" to work. For starters it is very hard to follow the doc only https://doc.dovecot.org/configuration_manual/shared_mailboxes/shared_mailbo… without an actual example. I tried to use this (sorry in German) https://dokuwiki.tachtler.net/doku.php?id=tachtler:dovecot_shares and this got me a little further down the track. I followed the instructions required for the dovecot config files. Restarted dovecot, not errors displayed in the logs. I have got access to two user accounts, say USER1 and USER2. I executed this lines doveadm acl set -u USER1 INBOX user=USER2 admin create delete expunge insert lookup post read write write-deleted write-seen doveadm acl set -u USER2 INBOX user=USER1 admin create delete expunge insert lookup post read write write-deleted write-seen and created (just to be sure) two folders for each user /home/USER1/Mail/shared/USER1 /home/USER1/Mail/shared/USER2 /home/USER2/Mail/shared/USER1 /home/USER2/Mail/shared/USER2 The tried to create a mailboxes like so /home/USER1/Mail/shared/USER1/testa /home/USER1/Mail/shared/USER2/testb /home/USER2/Mail/shared/USER1/testa /home/USER2/Mail/shared/USER2/testb They are not created and no error is displayed - even looking at the dovecot logs. What I see in the folders for BOTH users though (for every folder) dovecot.list.index.log On the command line I can see the .imap files and do a 'ls -alR' in the folders, but no created mbox. I can definitely see the folders, but I cannot create a mbox file. What am I doing wrong? Help please. --------------------------------------------------------------------------------------------------------------------------------------------------------------- Here are the important configuration items # 2.3.16 (7e2e900c1a): /etc/dovecot/dovecot.conf # OS: Linux 4.18.0-425.13.1.el8_7.x86_64 x86_64 AlmaLinux release 8.7 (Stone Smilodon) xfs namespace shared { list = children location = maildir:~/Mail/:INDEX=~/Mail/shared/%%u:CONTROL=~/Mail/shared/ prefix = shared/%%u/ separator = / subscriptions = yes type = shared } mail_location = mbox:/home/%u/Mail/:INBOX=/var/mail/%u mail_plugins = acl passdb { driver = pam } plugin { acl = vfile acl_shared_dict = file:/var/lib/dovecot/db/shared-mailboxes.db } service auth { unix_listener auth-userdb { group = dovecot mode = 0777 user = dovecot } } protocol imap { mail_plugins = " acl imap_acl" } --

1 0

Flags/tags lost when moving e-mails to another folder
by Alexis Ben Miloud--Josselin 06 Mar '23

06 Mar '23

Hi, I have an issue with e-mail tags/flags. The IMAP user is using Thunderbird or Roundcube with Thunderbird tags. When the user (with an IMAP client) moves an e-mail from a folder to another, tags set on the e-mail are lost. When we check the filesystem, we can see the "a" tag: -rw-rw---- 2 test mailusers 2498 Dec 29 15:31 'cur/1676643827.M563793P15241.<HOSTNAME>,S=2498,W=2551:2,a' When we move the e-mail to another folder, the tag disappear: -rw-rw---- 2 test mailusers 2498 Dec 29 15:31 '.test/cur/1676644340.M214404P22014.<HOSTNAME>,S=2498,W=2551:2,' In both folders, the dovecot-keywords file is: 0 $LABEL1 The problem appeared after a major system upgrade (Debian 9 to 10). Dovecot version went from 2.2.27 to 2.3.4.1. Some system informations: # dovecot --version 2.3.4.1 (f79e8e7e4) # cat /etc/debian_version 10.13 # uname -a Linux <HOSTNAME> 4.19.0-23-amd64 #1 SMP Debian 4.19.269-1 (2022-12-20) x86_64 GNU/Linux # findmnt /var TARGET SOURCE FSTYPE OPTIONS /var /dev/vda3 ext4 rw,nosuid,relatime # findmnt /home TARGET SOURCE FSTYPE OPTIONS /home /dev/vdb ext4 rw,nosuid,nodev,noexec,relatime The output of `dovecot -n output` is here (link expires in one year): https://paste.evolix.org/?96d46acaea638568#56g7AQLuzJxxy4xintpexJCPgiAAG23c… Here are the operations I see on an e-mail file using strace: 15507 link("/home/test/Maildir/cur/1672326270.M619318P11927.<HOSTNAME>,S=2498,W=2551:2,Sa", "/home/test/Maildir/.test/tmp/1672326456.M737812P15507.<HOSTNAME>") = 0 15507 rename("/home/test/Maildir/.test/tmp/1672326456.M737812P15507.<HOSTNAME>", "/home/test/Maildir/.test/cur/1672326456.M737813P15507.<HOSTNAME>,S=2498,W=2551:2,S") = 0 15507 unlink("/home/test/Maildir/cur/1672326270.M619318P11927.<HOSTNAME>,S=2498,W=2551:2,Sa") = 0 Setting mbox_lazy_writes to yes and/or unsetting mail_cache_fields doesn't change anything. Any idea of what I am missing? Could this be a bug in Dovecot? Thanks in advance, -- Alexis Ben Miloud--Josselin <abenmiloud(a)evolix.fr> Evolix - Hébergement et Infogérance Open Source Marseille (37 rue Guibal, Pôle Média, 13003) / Paris / Montréal http://evolix.com | Twitter: @Evolix @EvolixNOC | http://blog.evolix.com

2 2

Re: Corrupted sizes using zlib plugin
by Tim Evers 06 Mar '23

06 Mar '23

Am 06.03.23 um 11:42 schrieb Aki Tuomi: >> On 06/03/2023 12:32 EET Tim Evers <te-ml-ext(a)artfiles.de> wrote: >> >> >> Hi, >> >> since I did not get any feedback on my bug report post regarding >> corrupted sizes while using zlib >> (https://dovecot.org/pipermail/dovecot/2023-February/126105.html) I >> would like to confirm that this bug report reached someone in charge. >> >> Or if not - I would kindly ask for directions on how to post it in a way >> that spawns some action. >> >> Thx >> >> Tim > Can you try erasing dovecot.index.cache and see if the problem fixes itself? It's possible your cache contains invalid values from old errors. > > Aki Did that already several times (other dovecot.index.* files too). The only thing that helps is actually deleting the dovecot-uidlist file but the problem returns. Tim

2 3

Corrupted sizes using zlib plugin
by Tim Evers 06 Mar '23

06 Mar '23

Hi, since I did not get any feedback on my bug report post regarding corrupted sizes while using zlib (https://dovecot.org/pipermail/dovecot/2023-February/126105.html) I would like to confirm that this bug report reached someone in charge. Or if not - I would kindly ask for directions on how to post it in a way that spawns some action. Thx Tim

2 1

Setting up the mail-crypt plugin with virtual accounts that have no home directories
by Jeremy 05 Mar '23

05 Mar '23

Hi again, I am using dovecot 2.3.16, along with postfix and a PostgreSQL database for managing virtual accounts. After an initial topic from me about encrypting already existent mail, I could now use some pointers on how to set up the mail-crypt plugin for pure virtual accounts (i.e. that have no matching system users and/or home directories. I hope somebody can clarify a few things that are not entirely clear to me yet. After doing my own research, I believe the following should be possible: I'd like to use the password of virtual email accounts to let dovecot encrypt/decrypt the keys needed to encrypt/decrypt the mail in the relevant folders. As per the documentation @ https://doc.dovecot.org/configuration_manual/mail_crypt_plugin/ I believe this would be all the configuration I need: # Config mail_attribute_dict = file:%h/Maildir/dovecot-attributes mail_plugins = $mail_plugins mail_crypt plugin { mail_crypt_curve = secp521r1 # or some other preferred curve mail_crypt_save_version = 2 mail_crypt_require_encrypted_user_key = yes # necessary for encrypting keys with user password } # File: /etc/dovecot/dovecot-sql.conf.ext password_query = SELECT \ email as user, password, \ '%w' AS userdb_mail_crypt_private_password \ FROM virtual_users WHERE email='%u'; My first question is: Is it possible to configure mail_attribute_dict in such a way as to not use home directories. Since I only use virtual accounts, without those accounts having home directories, can I somehow tell dovecot to save the attributes into the PostsreSQL database, for instance? If not, can you suggest another approach, without having to create home directories for virtual users? My second question is: The documentation warns about not using password directly in the above SQL query: > Choosing encryption key > DO NOT use password directly. It can contain % which is interpreted as > variable expansion and can cause errors. Does this refer to not accidentally substituting '%w' with password? In other words, if I leave the above query as is, should I be good, even if plain text passwords of users potentially have % signs in them? Or would I need to take further measurements? (The passwords in my database are already hashed, by the way). I hope somebody can offer some guidance on this. Thanks.

2 7

bug report: imap-login not killed
by Sacha 05 Mar '23

05 Mar '23

Hi, We have growing imap-login processes until we reach the max processes. This occurs when a particular user have a login error due to our LDAP misconfiguration: --- Mar 4 14:59:33 hera dovecot[2226963]: auth: Error: plain(john.doe,XX.XX.XX.XX,<13C0eBP2354lqXpO>): user not found from any userdbs Mar 4 14:59:33 hera dovecot[2226963]: imap: Error: auth-master: login: request [1001652225]: Login auth request failed: Authenticated user not found from userdb, auth lookup id=1001652225 (auth connected 2 msecs ago, request took 1 msecs, client-pid=2235348 client-id=1) Mar 4 14:59:33 hera dovecot[2226963]: imap-login: Internal login failure (pid=2235348 id=1): user=<ohn.doe>, method=PLAIN, rip=XX.XX.XX.XX, lip=18 5.233.100.1, mpid=2235359, TLS, session=<13C0eBP2354lqXpO> --- The origin of is issue is when passdb finds the user and userdb not. The result is imap-login processes with no timeout growing until we reach the max processes. * OS version Debian stable - Bullseye * Dovecot version dpkg -l |grep dovecot ii dovecot-antispam 2.0+20171229-1+b7 amd64 Dovecot plugins for training spam filters ii dovecot-common 1:2.1.7-7+deb7u1 all Transitional package for dovecot ii dovecot-core 1:2.3.13+dfsg1-2+deb11u1 amd64 secure POP3/IMAP server - core files ii dovecot-core-dbgsym 1:2.3.13+dfsg1-2+deb11u1 amd64 debug symbols for dovecot-core ii dovecot-imapd 1:2.3.13+dfsg1-2+deb11u1 amd64 secure POP3/IMAP server - IMAP daemon ii dovecot-imapd-dbgsym 1:2.3.13+dfsg1-2+deb11u1 amd64 debug symbols for dovecot-imapd ii dovecot-ldap 1:2.3.13+dfsg1-2+deb11u1 amd64 secure POP3/IMAP server - LDAP support ii dovecot-managesieved 1:2.3.13+dfsg1-2+deb11u1 amd64 secure POP3/IMAP server - ManageSieve server ii dovecot-mysql 1:2.3.13+dfsg1-2+deb11u1 amd64 secure POP3/IMAP server - MySQL support ii dovecot-pop3d 1:2.3.13+dfsg1-2+deb11u1 amd64 secure POP3/IMAP server - POP3 daemon ii dovecot-sieve 1:2.3.13+dfsg1-2+deb11u1 amd64 secure POP3/IMAP server - Sieve filters support * doveconf -n --- # 2.3.13 (89f716dc2): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.13 (cdd19fe3) doveconf: Warning: service auth { client_limit=1000 } is lower than required under max. load (4096) doveconf: Warning: service anvil { client_limit=1000 } is lower than required under max. load (4099) # OS: Linux 5.10.0-21-cloud-amd64 x86_64 Debian 11.6 ext4 # Hostname: XXX auth_mechanisms = plain login default_process_limit = 1024 first_valid_gid = 8 first_valid_uid = 109 last_valid_gid = 8 last_valid_uid = 109 login_greeting = XXX listening. mail_access_groups = mail mail_gid = 8 mail_location = maildir:/srv/vmail/%d/%n mail_privileged_group = mail mail_uid = 109 managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy i nclude variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext imapflags notify imapsieve vnd.dovecot.imapsieve vnd.dovecot.filter namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } passdb { args = /etc/dovecot/dovecot-ldap.conf driver = ldap } passdb { args = /etc/dovecot/dovecot-ldap-girondix.conf driver = ldap } passdb { args = /etc/dovecot/dovecot-oauth2.conf.ext driver = oauth2 mechanisms = xoauth2 oauthbearer } plugin { quota_rule = *:storage=100M quota_rule2 = Trash:storage=10%% recipient_delimiter = + sieve = /srv/vmail/%d/%n/dovecot.sieve sieve_default = /var/lib/dovecot/sieve/default.sieve sieve_dir = /srv/vmail/%d/%n/sieve sieve_extensions = +notify +imapflags +vnd.dovecot.filter sieve_filter_bin_dir = /usr/lib/dovecot/sieve-filter sieve_global_extensions = +vnd.dovecot.pipe sieve_max_script_size = 1M sieve_pipe_bin_dir = /etc/dovecot/sieve sieve_pipe_socket_dir = sieve-pipe sieve_plugins = sieve_imapsieve sieve_extprograms sieve_redirect_envelope_from = orig_recipient } protocols = imap pop3 sieve service auth { unix_listener /var/spool/postfix/private/auth { group = mail mode = 0600 user = postfix } unix_listener auth-master { group = mail mode = 0660 user = vmail } unix_listener auth-userdb { group = mail mode = 0600 user = vmail } } service imap-login { inet_listener imap { port = 0 } } service imap { vsz_limit = 1 G } service lmtp { executable = lmtp -L process_min_avail = 2 } service pop3-login { inet_listener pop3 { port = 0 } } ssl_cert = </srv/letsencrypt/pem/mail.aquilenet.fr.pem ssl_client_ca_dir = /etc/ssl/certs ssl_dh = # hidden, use -P to show it ssl_key = # hidden, use -P to show it userdb { args = /etc/dovecot/dovecot-ldap.conf driver = ldap } userdb { args = /etc/dovecot/dovecot-ldap-girondix.conf driver = ldap } protocol lmtp { auth_username_format = %n info_log_path = /var/log/dovecot-lmtp.log mail_plugins = " sieve" } protocol lda { mail_plugins = " mailbox_alias sieve" } protocol imap { imap_client_workarounds = delay-newmail tb-extra-mailbox-sep imap_idle_notify_interval = 30 secs mail_max_userip_connections = 50 mail_plugins = quota mailbox_alias imap_quota } protocol pop3 { mail_plugins = quota mailbox_alias acl pop3_client_workarounds = outlook-no-nuls oe-ns-eoh } ---

2 2

Multiple scripts with postlogin
by Dan Conway 03 Mar '23

03 Mar '23

Hello, I'm having trouble understanding how to execute separate scripts with postlogin. According to the documentation, it should be as simple as: You can run multiple post-login scripts by just giving multiple scripts as parameters to|script-login|, for example: executable = script-login rawlog /usr/local/bin/postlogin.sh /usr/local/bin/postlogin2.sh Given this information, I supplied two scripts to service imap-postlogin below: service imap { executable = imap imap-postlogin } service imap-postlogin { executable = script-login -d rawlog /usr/local/bin/postlogin.pl /usr/local/bin/postlogin2.pl user = $default_internal_user unix_listener imap-postlogin { } } Both scripts simply print "Script 1" and "Script 2" to STDERR. Here is what they look like: #!/usr/bin/perl use strict; use warnings; print STDERR "Script 1\n"; system("/usr/lib/dovecot/script-login"); After logging in, only the first script is executed. The second one is ignored. I tried not executing "/usr/lib/dovecot/script-login" in the first script, in hopes that it would execute the second script, but it only denies the connection after printing "Script 1" imap-postlogin: Error: Script 1 imap(<user>): Error: Post-login script denied access to user <user> Am I missing something? Thanks.

2 1

OAuth2: local validation with RFC9068 tokens
by Tomas Habarta 01 Mar '23

01 Mar '23

Hello, my IdP is kind of progressive and implemented RFC9068, where all access tokens now come with typ "at+JWT". Since the setup has used local validation, I had to switch and currently use introspection endpoint. Looked around at the src and there seems to be relatively simple check of the token typ checking the only fixed value of "JWT" -- do you think you could consider tuning it a little bit so that local validation works also with such tokens? I am not an expert on OAuth2 so have no idea whether this is a valid request, but think that such a token is still JWT but has the required structure per RFC, which should not anyhow be in collision with a simple "JWT" typ. Saying that, I would not wonder if the statement is not correct :) Many thanks, Tomas

1 0

Can't receive mail before connecting with mutt and sending mail
by efeizbudak 01 Mar '23

01 Mar '23

Hi everyone, I've recently set up an email server. I also have mail crypt plugin and the users are set up through pam. The problem is that whenever I set up a new user, it can send mail but not receive it until the account is connected with mutt and at least one mail is sent. I've noticed that the mail_attribute_dict file is also not set up before doing this. One peculiar thing about all this is that if an account is connected through the stock android email app, the same "send email to get email" trick does not work. How can I debug this? Thank you! -- All the best, Efe The funny quote of this email is trivial and left as an exercise.

1 0

"sh: doveadm: command not found" with doveadm -Dv backup -R
by James Brown 01 Mar '23

01 Mar '23

I’m moving from an old mail server to a new one. On the new one, trying to transfer mailboxes from the old machine using doveadm. It fails saying it can’f find doveadm: % sudo doveadm -Dv backup -R -u myuser(a)bordo.com.au remote:mail.bordo.com.au Password: Debug: Loading modules from directory: /usr/local/lib/dovecot/doveadm Debug: Skipping module doveadm_acl_plugin, because dlopen() failed: dlopen(/usr/local/lib/dovecot/doveadm/lib10_doveadm_acl_plugin.so, 0x000A): symbol not found in flat namespace '_acl_backend_nonowner_lookups_iter_deinit' (this is usually intentional, so just ignore this message) Debug: Skipping module doveadm_quota_plugin, because dlopen() failed: dlopen(/usr/local/lib/dovecot/doveadm/lib10_doveadm_quota_plugin.so, 0x000A): symbol not found in flat namespace '_quota_get_resource' (this is usually intentional, so just ignore this message) Debug: Skipping module doveadm_fts_plugin, because dlopen() failed: dlopen(/usr/local/lib/dovecot/doveadm/lib20_doveadm_fts_plugin.so, 0x000A): symbol not found in flat namespace '_fts_backend_lookup' (this is usually intentional, so just ignore this message) Debug: Skipping module doveadm_mail_crypt_plugin, because dlopen() failed: dlopen(/usr/local/lib/dovecot/doveadm/libdoveadm_mail_crypt_plugin.so, 0x000A): symbol not found in flat namespace '_mail_crypt_acl_secure_sharing_enabled' (this is usually intentional, so just ignore this message) Feb 28 12:42:02 Debug: Loading modules from directory: /usr/local/lib/dovecot/doveadm Feb 28 12:42:02 Debug: Skipping module doveadm_acl_plugin, because dlopen() failed: dlopen(/usr/local/lib/dovecot/doveadm/lib10_doveadm_acl_plugin.so, 0x000A): symbol not found in flat namespace '_acl_backend_nonowner_lookups_iter_deinit' (this is usually intentional, so just ignore this message) Feb 28 12:42:02 Debug: Skipping module doveadm_quota_plugin, because dlopen() failed: dlopen(/usr/local/lib/dovecot/doveadm/lib10_doveadm_quota_plugin.so, 0x000A): symbol not found in flat namespace '_quota_get_resource' (this is usually intentional, so just ignore this message) Feb 28 12:42:02 Debug: Skipping module doveadm_fts_plugin, because dlopen() failed: dlopen(/usr/local/lib/dovecot/doveadm/lib20_doveadm_fts_plugin.so, 0x000A): symbol not found in flat namespace '_fts_backend_lookup' (this is usually intentional, so just ignore this message) Feb 28 12:42:02 Debug: Skipping module doveadm_mail_crypt_plugin, because dlopen() failed: dlopen(/usr/local/lib/dovecot/doveadm/libdoveadm_mail_crypt_plugin.so, 0x000A): symbol not found in flat namespace '_mail_crypt_acl_secure_sharing_enabled' (this is usually intentional, so just ignore this message) Feb 28 12:42:02 doveadm(myuser(a)bordo.com.au)<76814><>: Debug: auth-master: userdb lookup(myuser(a)bordo.com.au): Started userdb lookup Feb 28 12:42:02 doveadm(myuser(a)bordo.com.au)<76814><>: Debug: auth-master: conn unix:/usr/local/var/run/dovecot/auth-userdb: Connecting Feb 28 12:42:02 doveadm(myuser(a)bordo.com.au)<76814><>: Debug: auth-master: conn unix:/usr/local/var/run/dovecot/auth-userdb (uid=0): Client connected (fd=9) Feb 28 12:42:02 doveadm(myuser(a)bordo.com.au)<76814><>: Debug: auth-master: userdb lookup(myuser(a)bordo.com.au): auth USER input: myuser(a)bordo.com.au home=/usr/local/virtual/bordo.com.au/myuser mail=maildir:/usr/local/virtual/bordo.com.au/myuser uid=102 gid=102 quota=*:storage=0 Feb 28 12:42:02 doveadm(myuser(a)bordo.com.au)<76814><>: Debug: auth-master: userdb lookup(myuser(a)bordo.com.au): Finished userdb lookup (username=myuser(a)bordo.com.au home=/usr/local/virtual/bordo.com.au/myuser mail=maildir:/usr/local/virtual/bordo.com.au/myuser uid=102 gid=102 quota=*:storage=0) Feb 28 12:42:02 doveadm(myuser(a)bordo.com.au)<76814><>: Debug: Added userdb setting: mail=maildir:/usr/local/virtual/bordo.com.au/myuser Feb 28 12:42:02 doveadm(myuser(a)bordo.com.au)<76814><>: Debug: Added userdb setting: plugin/quota=*:storage=0 Feb 28 12:42:02 doveadm(myuser(a)bordo.com.au): Debug: Effective uid=102, gid=102, home=/usr/local/virtual/bordo.com.au/myuser Feb 28 12:42:02 doveadm(myuser(a)bordo.com.au): Debug: open(/proc/self/stat) failed: No such file or directory Feb 28 12:42:02 doveadm(myuser(a)bordo.com.au): Debug: open(/proc/self/io) failed: No such file or directory Feb 28 12:42:02 doveadm(myuser(a)bordo.com.au): Debug: Namespace inbox: type=private, prefix=, sep=, inbox=yes, hidden=no, list=yes, subscriptions=yes location=maildir:/usr/local/virtual/bordo.com.au/myuser Feb 28 12:42:02 doveadm(myuser(a)bordo.com.au): Debug: maildir++: root=/usr/local/virtual/bordo.com.au/myuser, index=, indexpvt=, control=, inbox=/usr/local/virtual/bordo.com.au/myuser, alt= Feb 28 12:42:02 doveadm(myuser(a)bordo.com.au): Debug: brain M: Namespace has location maildir:/usr/local/virtual/bordo.com.au/myuser Feb 28 12:42:02 doveadm(myuser(a)bordo.com.au): Debug: Mailbox INBOX: Couldn't open mailbox in list index: Mailbox not found Feb 28 12:42:02 doveadm(myuser(a)bordo.com.au): Debug: Namespace : Using permissions from /usr/local/virtual/bordo.com.au/myuser: mode=0700 gid=default (root(a)mail.bordo.com.au) Password: sh: doveadm: command not found Feb 28 12:42:06 dsync-local(myuser(a)bordo.com.au)<SJq/Iepb/WMOLAEAiJz6GQ>: Error: read(mail.bordo.com.au) failed: EOF (version not received) Feb 28 12:42:06 dsync-local(myuser(a)bordo.com.au)<SJq/Iepb/WMOLAEAiJz6GQ>: Error: Remote command returned error 127: ssh mail.bordo.com.au doveadm dsync-server -umyuser(a)bordo.com.au -U Feb 28 12:42:06 dsync-local(myuser(a)bordo.com.au)<SJq/Iepb/WMOLAEAiJz6GQ>: Debug: User session is finished Feb 28 12:42:06 dsync-local(myuser(a)bordo.com.au)<SJq/Iepb/WMOLAEAiJz6GQ>: Debug: auth-master: conn unix:/usr/local/var/run/dovecot/auth-userdb (uid=0): Disconnected: Connection closed (fd=9) Does this mean the remote machine can’t fine doveadm? (Both machines are running macOS) I could probably transfer the mailboxes using rsync, but I thought that doveadm was a better way. Thanks, James.

2 2

Re: Auth variables unknown variable -- about to go crazy
by efeizbudak 28 Feb '23

28 Feb '23

1 0

Auth variables unknown variable -- about to go crazy
by efeizbudak 28 Feb '23

28 Feb '23

Hi everyone, I'm trying to configure my email server to encrypt mails on a per user basis. I have the following in my conf: mail_plugins = $mail_plugins mail_crypt mail_attribute_dict = file:%h/Mail/dovecot-attributes plugin { mail_crypt_curve = secp521r1 mail_crypt_save_version = 2 mail_crypt_require_encrypted_user_key = yes mail_crypt_private_password = %N{password} } And I'm getting %password unknown variable error. I use pam to store the passwords. All I want is to be able to hash the user password and use that to encrypt/decrypt the keys. Can someone _please_ help me? -- All the best, Efe The funny quote of this email is trivial and left as an exercise.

2 1

re: "Timeout (180s) while waiting for lock for transaction log file" since 2.3 upgrade?
by graeme vetterlein 26 Feb '23

26 Feb '23

This is an old thread (but still the best search match for the error message). Several other people pointed at NFS, so it got me to look. Indeed what appear to happen (for me at least) was .... The folders being imapped, some of them were on a NFSv3 mount. The NFS server had been shutdown. The imap process appeared to hang (presumably trying to read from the defunct NFS mount point) this held the lock , so other imap processes (possibly not using NFS) hung awaiting the lock. The "fix" was to bing the NFS server back online ...and as it turned out restart a number of things like autofs and dovecot (Normally NFS clients just carry on, so the timeout must have affected things) My long-term fix came from: https://docs.oracle.com/cd/E19620-01/805-5233/z400163399f/index.html Namely to add -soft in /etc/auto_master This should cause a "fail" instead of a hang. -- Graeme

1 0

Cannot reach documentation site
by Ken Bass 26 Feb '23

26 Feb '23

doc.dovecot.org does not have a DNS entry. It worked a few days ago, but not now.

3 3

quota groups
by Ken Young 26 Feb '23

26 Feb '23

Hello, How can I set up groups to give each group a different quota? for example, group A has mail storage 1GB, and users in this group get 1GB quota etc. Thanks. Ken Y

1 0

Small suggestion for improvement of pigeonhole/imapsieve documentation
by Matthias Petermann 25 Feb '23

25 Feb '23

Hello all, this is my first post on this list and I would like to introduce myself briefly. My name is Matthias and I am from Saxony in Germany. I'm working with Unix and mail systems for a long time - actually with focus for NetBSD and Cyrus IMAP. Occasionally I also use Dovecot, which has several reasons. Today, one of the reasons was that I would like to trigger Sieve scripts when moving mail within mailbox folders - i.e. at an unspecified time after the actual mail arrival. In doing so, I came across the imapsieve extension for Pigeonhole fairly quickly and decided that the administrative Sieve scripts in imapsieve were exactly what I needed. However, despite having debug logging fully up, I couldn't figure out until just now why my sieve script wasn't running despite having IMAP events logged. Even intentionally defining an invalid script did not result in an error, so it seemed to be ignored altogether. Until I just now came across that I seem to have misunderstood the documentation. The template shown for the imapsieve_mailboxXXX_ parameters suggested to me that a sequence number of three digits must / can be specified here. Thus, I started numbering my parameters with imapsieve_mailbox001. However, while researching in various forums, I came across only examples that use imapsieve_mailbox1_ as the first parameter. In desperation I tried this out - now it works for me, too. Long story short - I don't know if I'm the only one who has made this mistake so far. A little hint in the documentation[1] would have helped me, how the XXX is meant exactly. I am referring to this section: ``` This setting configures the name of a mailbox for which administrator scripts are configured. The `XXX’ in this setting is a sequence number, which allows configuring multiple associations between Sieve scripts and mailboxes. The settings defined hereafter with matching sequence numbers apply to the mailbox named by this setting. The sequence of configured mailboxes ends at the first missing imapsieve_mailboxXXX_name setting. This setting supports wildcards with a syntax compatible with the IMAP LIST command, meaning that this setting can apply to multiple or even all (“*”) mailboxes. ``` What do you think about adding a small explanatory sentence to the documentation? For example: ``` This setting configures the name of a mailbox for which administrator scripts are configured. The `XXX’ in this setting is a sequence number, which allows configuring multiple associations between Sieve scripts and mailboxes. The sequence number must begin with the digit 1 without preceding zeros and may have a maximum of three digits. The settings defined hereafter with matching sequence numbers apply to the mailbox named by this setting. The sequence of configured mailboxes ends at the first missing imapsieve_mailboxXXX_name setting. This setting supports wildcards with a syntax compatible with the IMAP LIST command, meaning that this setting can apply to multiple or even all (“*”) mailboxes. ``` Many greetings Matthias [1] https://doc.dovecot.org/configuration_manual/sieve/plugins/imapsieve/

1 0

Restored mail folders conflict with renamed original ones
by Nikolaos Milas 24 Feb '23

24 Feb '23

Hello, We are running Dovecot 2.3.18 (together with Postfix) on CentOS 7. It uses a Maildir structure. We have a user who has organized his mailbox as shows up at the end of this mail. The user had forgotten that he had renamed his "Grants Active \ European" (.Grants Active.European) folder to "Grants Active \ International" (.Grants Active.International), he thought that it was lost and requested a restore of "Grants Active \ European" (with all of its subfolders) from backup. Since we did that (using a simple "cp -rp" from a backup, observing timestamps, ownership and permissions), mail client software won't see "European" mail folder in "Grants Active" mail folder; "International" mail folder shows up but only with two folders, those which do not exist in "European" branch (obviously, these were created later). I have tried to run the command "doveadm index -u userx Grants\ Active" and likewise for each and every mail subfolder under "Grants\ Active"; I have also tried deleting the dovecot.index.cache and dovecot.index.log from the latter ("Grants\ Active") and then run: doveadm -vD force-resync -u userx Grants\ Active but it didn't do the trick: Mail clients are still stuck as I explained. In the end, I thought that the snag might be that mail folders that are not appearing have identical (duplicate) UIDs; As an example: [root@mailx .Grants Active.European]# cat dovecot-uidlist 3 V1548680759 N1 G64e70a1130343f61003c0000715faa8d [root@mailx .Grants Active.European]# cd .. [root@mailx Maildir]# cd .Grants\ Active.International [root@mailx .Grants Active.International]# cat dovecot-uidlist 3 V1548680759 N1 G64e70a1130343f61003c0000715faa8d If so, how should we overcome this issue? I guess I could simply delete the restored folders to return to an acceptable state? If nevertheless we need to restore the ".European" mail folder from a backup (as it was before getting renamed), what would be the right way to do so? Is there another way to resolve the issue without deleting the restored mail folders? Here is the list of mail folders in this mailbox (I have intentionally removed lots of them, to reduce irrelevant content; this mailbox includes a large number of mail folders): # doveadm mailbox list -u userx IGARSS 2024 IAC2022 Junk ... Junk E-mail INBOX.EMISSION ... Trash Trash.Equality Trash.sadf ... Grants Active Grants Active.European Grants Active.European.URBAN RELEAF Grants Active.European.SMURBS Grants Active.European.SMURBS.In Kind Grants Active.European.SMURBS.Final Reports Grants Active.European.RI-URBANS Grants Active.European.QA4EO Grants Active.European.ATMO-ACCESS Grants Active.European.IGOSP Grants Active.European.GAUSS Grants Active.European.E-SHAPE Grants Active.European.CIROCCO Grants Active.European.InCASE Grants Active.European.EIFFEL Grants Active.European.ARSINOE Grants Active.International Grants Active.International.2324 Grants Active.International.GAUSS Grants Active.International.CIROCCO Grants Active.International.IGOSP Grants Active.International.ATMO-ACCESS Grants Active.International.URBAN RELEAF Grants Active.International.InCASE Grants Active.International.ARSINOE Grants Active.International.RI-URBANS Grants Active.International.E-SHAPE Grants Active.International.EIFFEL Grants Active.International.QA4EO Grants Active.International.SMURBS Grants Active.International.SMURBS.Final Reports Grants Active.International.SMURBS.In Kind Grants Active.International.India Grants Active.Urban ReLeaf Grants Active.National Grants Active.National.ΑΓ ΠΑΡΑΣΚΕΥΗ Grants Active.National.ΠΕΤΡΟΥΠΟΛΗ Grants Active.National.CLIMATTICA Grants Active.National.ΝΑΥΠΛΙΟ Grants Active.National.ΕΔΒΜ Grants Active.National.PANGEA Grants Active.National.ΕΛΙΔΕΚ Grants Active.National.ΕΛΙΔΕΚ.OXONIAN - Δέσποινα Grants Active.National.ΕΛΙΔΕΚ.Νασια PhD Grants Active.National.CLIMPACT Sent ... INBOX Please, provide some guidance on what we should do to make these mail folders work correctly again. Sorry, I am not very knowledgeable on mail inner architecture and operations; please let me know if you need additional info. Thanks in advance, Nick

2 6

How to get a server listed in the IMAP Test wiki?
by Leander Beernaert 24 Feb '23

24 Feb '23

Hey, We recently announced Gluon (https://github.com/ProtonMail/gluon/) our IMAP server library we are using in Proton Bridge(https://github.com/ProtonMail/proton-bridge). We would love to have it have it listed in the IMAP Server Compliancy Status wiki page (https://imapwiki.org/ImapTest/ServerStatus) What do we need to do or whom do we need to contact to make this happen? Additionally, We have been using running imaptest (https://github.com/dovecot/imaptest) against our server library, but due to variety of configuration parameters, we would really appreciate it (if possible) if someone could point out to us the test setup used to validate each of those servers. Thank you in advance for your time. Kind Regards, Leander Beernaert Proton AG

4 6

creating a mailbox via imap
by Gabriele Bulfon 23 Feb '23

23 Feb '23

Hi, is there any way with Dovecot to open an admin imap connection and create a brand new mailbox? With Cyrus imapd I can do this by connecting as the Cyrus admin user and then create a folder "user/newuser(a)domain.tld". Thanks Gabriele Sonicle S.r.l. : http://www.sonicle.com Music: http://www.gabrielebulfon.com eXoplanets : https://gabrielebulfon.bandcamp.com/album/exoplanets

3 2

doveadm sending invalid AUTHENTICATE to uw-imap
by Chris Candreva 23 Feb '23

23 Feb '23

I'm migrating a legacy uw-imap system to Dovecot, on a Rocky (RHEL) 8 server running Dovecot 2.3.16-3 from their repos. I am using a master user to import all users for an imaps connection from the old server to the new. On a trial run however, it worked for about half the users. Half are giving an error of the form: dsync(user): Error: imapc(host:993): Command '1 AUTHENTICATE PLAIN xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx' failed with BAD: 1 Missing or invalid argument to AUTHENTICATE I can't seem to get the IMAP command for the users that did work. However, on the face of it, that is an invalid AUTHENTICATE command. If I take that string and brake it up into (what I've googled is) the proper form of multi-command form of 1 AUTHENTICATE PLAIN + xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx then the login succeeds. I have not been able to find anyone else with this problem in my search. Is this a known issue, is there a way to force the multi-line AUTHENTICATE, something else I'm missing ? Any help is appreciate on this! -Chris -- --- ======================================================================== Chris Candreva -- chris(a)westnet.com -- http://www.westnet.com/~chris

3 4

Redundant Database, Pgsql ?
by Paul Kudla 23 Feb '23

23 Feb '23

I am aware that there are provising for redundant database connections Basically i was working on my main db server (which is also a mail sever) I current have this in the dovecot-pgsql.conf ______________________________________________________________________ driver = pgsql connect = host=localhost port=5433 dbname=scom_billing user=pgsql password=xxxxxxxxx default_pass_scheme = PLAIN password_query = SELECT username as user, password FROM email_users WHERE username = '%u' and password <> 'alias' and status = True and destination = '%u' user_query = SELECT home, uid, gid FROM email_users WHERE username = '%u' and password <> 'alias' and status = True and destination = '%u' #iterate_query = SELECT user, password FROM email_users WHERE username = '%u' and password <> 'alias' and status = True and destination = '%u' iterate_query = SELECT "username" as user, domain FROM email_users WHERE status = True and alias_flag = False _______________________________________________________________________ Basically I have replicaed servers all over the place but mail18 (because dovecot only knows of one db instance) went down as well. May I please get some guidance on what to add to talk to another postgresql server (i have 6 replicated servers so would probably want a couple worst case issue) -- Happy Sunday !!! Thanks - paul Paul Kudla Scom.ca Internet Services <http://www.scom.ca> 004-1009 Byron Street South Whitby, Ontario - Canada L1N 4S3 Toronto 416.642.7266 Main 1.866.411.7266 Fax 1.888.892.7266 Email paul(a)scom.ca

10 13

Can I encrypt already existant unencrypted mail before I start using the mail-crypt plugin?
by mailinglist-subscriptions 23 Feb '23

23 Feb '23

Hi, I am using dovecot 2.3.16, along with postfix and a PostgreSQL database for managing virtual accounts. I'd like to start using the mail-crypt plugin. However, I'm having a bit some difficulty understanding the documentation at https://doc.dovecot.org/configuration_manual/mail_crypt_plugin to reach my goal. I plan to ask questions about those issues by starting new threads in this mailing list. But before I even come to that, I'd like to investigate the following: The above documentation only addresses a clean install and doesn't seem to mention encrypting already existent unencrypted mails, like my server has. Is it possible to encrypt those before I start using the mail-crypt plugin, such that it will be able to decrypt those messages as well? If it is, I am assuming that how I would go about achieving that will be very dependent on the ultimate configuration I have in mind (pub/priv keys, etc.). So I don't expect a full-fledged guide. However, if you could perhaps give a general overview of what would be needed to achieve this, I would very much appreciate that. Thank you.

4 4

Re: Auth-worker, unknown scheme ARGON2ID
by James Brown 22 Feb '23

22 Feb '23

On 21 Feb 2023, at 10:12 pm, James Brown <jlbrown(a)bordo.com.au> wrote: > > The new one has Dovecot compiled with same configure options, same configuration files, but fails to authenticate: > > Feb 21 21:51:03 master: Info: Dovecot v2.3.20 (80a5ac675d) starting up for imap, pop3 (core dumps disabled) > Feb 21 21:51:33 auth-worker(11701): Error: conn unix:auth-worker (uid=214): auth-worker<1>: sql(jlbrown@bordo.com.au,::1,<bRgbkDP2udEBAAAAAAAAAAAAAAAAAAB>): Unknown scheme ARGON2ID > > ./configure --with-ssl=openssl --with-mysql > > Was what I used to compile. > > Using OpenSSL 3.0.8. New server is running macOS 13.2.1 Ventura. > > (Have also installed libsodium 1.0.18_1) > > Any help would be most appreciated. > > thanks, > > James. I’ve spent ages on this and am getting really desperate! :-( CPPFLAGS=-I/opt/homebrew/Cellar/openssl(a)3/3.0.8/include LDFLAGS=-L/opt/homebrew/opt/openssl@3/lib ./configure --with-ssl=openssl --with-mysql ... Install prefix . : /usr/local File offsets ... : 64bit I/O polling .... : kqueue I/O notifys .... : kqueue SSL ............ : yes (OpenSSL) GSSAPI ......... : no passdbs ........ : static passwd passwd-file pam checkpassword sql : -shadow -bsdauth -ldap userdbs ........ : static prefetch passwd passwd-file checkpassword sql sudo doveadm pw -l SHA1 SSHA512 SCRAM-SHA-256 BLF-CRYPT PLAIN HMAC-MD5 OTP SHA512 SHA DES-CRYPT CRYPT SSHA MD5-CRYPT PLAIN-MD4 PLAIN-MD5 SCRAM-SHA-1 CLEAR CLEARTEXT SSHA256 MD5 PBKDF2 SHA256 CRAM-MD5 PLAIN-TRUNC SMD5 DIGEST-MD5 LDAP-MD5 How do I get ARGON2I, ARGON2ID in that list? Has anybody got Dovecot to work on recent macOS with these password schemes? Any hints? Thanks, James.

2 8

Auth-worker, unknown scheme ARGON2ID
by James Brown 21 Feb '23

21 Feb '23

On my current mail server I was able to upgrade everyone’s password scheme to ARGON2ID with no issues, I just had to have: service auth { vsz_limit = 0 } This was an older version of macOS than the new server I’m trying to migrate to. The new one has Dovecot compiled with same configure options, same configuration files, but fails to authenticate: Feb 21 21:51:03 master: Info: Dovecot v2.3.20 (80a5ac675d) starting up for imap, pop3 (core dumps disabled) Feb 21 21:51:33 auth-worker(11701): Error: conn unix:auth-worker (uid=214): auth-worker<1>: sql(jlbrown@bordo.com.au,::1,<bRgbkDP2udEBAAAAAAAAAAAAAAAAAAB>): Unknown scheme ARGON2ID ./configure --with-ssl=openssl --with-mysql Was what I used to compile. Using OpenSSL 3.0.8. New server is running macOS 13.2.1 Ventura. (Have also installed libsodium 1.0.18_1) Any help would be most appreciated. thanks, James.

1 0

service(imap-login): Fatal: setrlimit(RLIMIT_DATA, 268435456): Invalid argument macOS
by James Brown 21 Feb '23

21 Feb '23

I fixed the issue with Dovecot not starting on macOS Ventura by adding this to 10-master.conf: service log { vsz_limit = 0 } But now when I try to login via Imap on port 143 I get the same error for imap-login: Feb 20 15:55:41 imap-login: Error: Feb 20 15:55:41 service(imap-login): Fatal: setrlimit(RLIMIT_DATA, 268435456): Invalid argument Feb 20 15:55:41 imap-login: Fatal: master: service(imap-login): child 11781 returned error 89 (Fatal failure) Feb 20 15:55:41 master: Error: service(imap-login): command startup failed, throttling for 60.000 secs Feb 20 16:13:04 imap-login: Error: Feb 20 16:13:04 service(imap-login): Fatal: setrlimit(RLIMIT_DATA, 268435456): Invalid argument Feb 20 16:13:04 imap-login: Fatal: master: service(imap-login): child 20370 returned error 89 (Fatal failure) Feb 20 16:13:04 master: Error: service(imap-login): command startup failed, throttling for 60.000 secs Config: sudo /usr/local/sbin/dovecot -n # 2.3.20 (80a5ac675d): /usr/local/etc/dovecot/dovecot.conf # OS: Darwin 22.3.0 arm64 apfs # Hostname: mail-server-mac-studio.local auth_mechanisms = plain login auth_verbose = yes auth_verbose_passwords = yes default_internal_group = mail default_internal_user = _dovecot default_login_user = _dovenull first_valid_gid = 0 first_valid_uid = 102 last_valid_gid = 501 last_valid_uid = 105 log_path = /var/log/dovecot.log mail_gid = 102 mail_location = maildir:/usr/local/virtual/%d/%u mail_uid = 102 namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } passdb { args = /usr/local/etc/dovecot/dovecot-sql.conf.ext driver = sql } protocols = imap pop3 service auth { unix_listener /var/spool/postfix/private/auth { group = _postfix mode = 0660 user = _postfix } unix_listener auth-userdb { mode = 0660 user = _vmail } } service imap-login { vsz_limit = 0 } service log { vsz_limit = 0 } ssl_cert = </etc/letsencrypt/live/mail.bordo.com.au/fullchain.pem ssl_dh = # hidden, use -P to show it ssl_key = # hidden, use -P to show it userdb { driver = prefetch } userdb { args = /usr/local/etc/dovecot/dovecot-sql.conf.ext driver = sql } protocol imap { mail_max_userip_connections = 40 } Quitting Dovecot and restarting and I now get: Feb 20 17:01:11 master: Info: Dovecot v2.3.20 (80a5ac675d) starting up for imap, pop3 (core dumps disabled) Feb 20 17:01:11 master: Error: service(anvil): command startup failed, throttling for 2.000 secs Then trying to connect on port 143 log says: Feb 20 17:20:08 master: Error: service(config): command startup failed, throttling for 2.000 secs Feb 20 17:20:08 config: Error: Feb 20 17:20:08 service(config): Fatal: setrlimit(RLIMIT_DATA, 268435456): Invalid argument Feb 20 17:20:08 anvil: Fatal: master: service(anvil): child 43250 returned error 89 (Fatal failure) Feb 20 17:20:08 config: Fatal: master: service(config): child 52530 returned error 89 (Fatal failure) Feb 20 17:20:08 stats: Fatal: master: service(stats): child 52531 returned error 89 (Fatal failure) Feb 20 17:20:08 stats: Error: Feb 20 17:20:08 service(stats): Fatal: setrlimit(RLIMIT_DATA, 268435456): Invalid argument Feb 20 17:20:08 master: Error: service(stats): command startup failed, throttling for 2.000 secs Feb 20 17:20:10 config: Error: Feb 20 17:20:10 service(config): Fatal: setrlimit(RLIMIT_DATA, 268435456): Invalid argument Feb 20 17:20:10 config: Fatal: master: service(config): child 52532 returned error 89 (Fatal failure) Feb 20 17:20:10 master: Error: service(config): command startup failed, throttling for 4.000 secs Feb 20 17:20:10 imap-login: Fatal: Error reading configuration: read(/usr/local/var/run/dovecot/config) failed: EOF - Also failed to read config by executing doveconf: /usr/local/var/run/dovecot/config is a UNIX socket (path is from CONFIG_FILE environment) Feb 20 17:20:10 master: Error: service(imap-login): command startup failed, throttling for 2.000 secs Any suggestions? This is really driving me crazy! thanks, James.

2 1

Get correct subjects in summary but wrong article body after transitioning between servers
by Steinar Bang 19 Feb '23

19 Feb '23

I am transitioning between servers (both debian 11.6 with dovecot 2.3.13) and I'm seeing some strange behaviour after the transition: it seems like dovecot is listing the correct subject for the test messages I'm sending in what's shown in my MUA's summary. But the body of the message is an old message. Dovecot is serving messages from Maildir folders in the users' home directories. And I may have messed up some things here: I rsynced the maildirs and then still got some deliveries both places when the MX records were in transition, so I did a belated rsync, thinking that "Maildir can handle that". But I weren't thinking about the dovecot files, ie: drwx------ 2 sb sb 155648 Feb 11 06:43 cur -rw------- 1 sb sb 30 Nov 23 18:14 dovecot-keywords -rw------- 1 sb sb 116407 Feb 11 06:43 dovecot-uidlist -rw------- 1 sb sb 8 Feb 28 2022 dovecot-uidvalidity -rw------- 1 sb sb 0 Mar 17 2011 dovecot-uidvalidity.4d821095 -rw------- 1 sb sb 38016 Jan 31 15:38 dovecot.index -rw------- 1 sb sb 203852 Feb 5 21:37 dovecot.index.cache -rw------- 1 sb sb 15076 Feb 11 06:43 dovecot.index.log -rw------- 1 sb sb 6424 Feb 4 08:06 dovecot.list.index -rw------- 1 sb sb 7796 Feb 11 06:43 dovecot.list.index.log -rw------- 1 sb sb 3048 Mar 6 2022 dovecot.mailbox.log drwx------ 2 sb sb 4096 Feb 11 06:43 new -rw------- 1 sb sb 738 Mar 6 2022 subscriptions drwx------ 2 sb sb 4096 Feb 6 22:05 tmp Are there any of these that could have been adversely affected by the rsync? Will regenerating these files fix the behaviour where I get the wrong article when fetching them? What is the best way to regenerate them? Can these feil be safely deleted and will be autogenerated? (I also see that some of these files are quite old. I had another server transition in 2017, so the files from 2011 has been rsynced into that server and not touched since) Thanks! - Steinar

1 2

Roundcube <-> Dovecot timeouts under very moderate load on big Dovecot nodes
by Malte Schmidt 18 Feb '23

18 Feb '23

Due to a recent topic regarding the performance of the Roundcube webmailer with Dovecot as a backend, I set up imapproxy successfully, shrinking the response latency of the webmailer heavily, which is great. However, I still encounter strange timeouts on some requests when Roundcube tries to access Dovecot. Be it for authentication or to FETCH data. I run the tests/benchmarks via distributed JMeter from 4 nodes, they access the webmailer which in turn accesses the Dovecot via imapproxy. There are 16 different mailaccounts spread over two dovecot nodes with the first one acting as a proxy if the account resides on the second. The problems start at around 100 concurrent users and gets worse the more users are added. The timeouts make up for a small percentage of the requests (0.0something percent). The timeout is reached after 30 seconds of Dovecot not answering, due to the timeout set in the webserver the webmailer is running on. Now I am wondering how to further debug this and what could be the reason. Some requests towards Dovecot are certainly taking longer than 30 seconds, while the average request takes mostly less than 1. The Dovecot is running on two big hardware machines with 48 cores, 96G memory and SSD storage. The load on the Dovecot nodes while the test is running is minimal. Best regards, M. Schmidt

1 0

dovecot_login accepts blank password for exim smtp auth
by Jeff Rogers 18 Feb '23

18 Feb '23

Hi all, I recently discovered a configuration issue on my system where a system user account had a blank rather than invalid or disabled password in the passwd/shadow database. The user could not be logged into through login/telnet/ssh because it was marked as a system account (uid < 100). Dovecot also would not authenticate the user for the same reason. However, I'm using exim using dovecot_login for authentication, and that would authenticate the user with a blank and allow me to be used as an open relay. This is clearly a config issue on my part (since fixed), but should dovecot_login guard against blank passwords or system users just as a normal login does? I'm running dovecot 2.2.36 (1f10bfa63) Exim version 4.96 I don't know which software supplies the dovecot_login connenector. The SMTP session would include AUTH LOGIN 334 VXNlcm5hbWU6 cG9zdGZpeA== 334 UGFzc3dvcmQ6 <-- nothing, just a return here 235 Authentication succeeded DONE

2 1

Special authentication use case
by Philippe MARASSE 17 Feb '23

17 Feb '23

Folks, I'm trying to configure dovecot SASL with two use cases : - First with XOAUTH2 : I've managed to get it working, pretty right out of the box, developers have done a great job :-) - Second with Client TLS Certificate with no luck. Let me explain, the certificate brought by the client does not have any clue of associated email, I have to check that username (=email) sent by the client is really related to some information included in the certificate (I have to extract the OU and then lookup into a table of authorized mails for that OU). Is it possible to do that with dovecot ? I think yes but I'm looking for direction to achieve that. Lua maybe ? Our configuration : - OS : Debian 11 $ /usr/sbin/dovecot --version 2.3.13 (89f716dc2) Regards. -- Philippe MARASSE Responsable pôle Infrastructures - DSIO Centre Hospitalier Henri Laborit CS 10587 - 370 avenue Jacques Cœur 86021 Poitiers Cedex Tel : 05.49.44.57.19

1 1

Re: SOLVED: Re: Dovecot does not start on MacOS 12.01, and now 13.2.1 - RLIMIT_DATA
by James Brown 17 Feb '23

17 Feb '23

Sorry, replying to an old thread found on mail-archive.com <http://mail-archive.com/>, so it’s not threaded email. https://www.mail-archive.com/dovecot@dovecot.org/msg84776.html I have just installed Dovecot onto Mac Studio running Ventura (macOS 13.2.1) and get the same error with Dovecot 2.3.20: service(log): Fatal: setrlimit(RLIMIT_DATA, 268435456): Invalid argument Adding the ’service log’ stanza to 10-master.conf fixed the issue. Is this still the correct way to handle it? If so it would be great to have it documented somewhere. Just lucky I found the above mail thread. Thanks, James. Hi! That solution is bit overly broad way to solve this, I would instead recommend service log { vsz_limit = 0 } so that only service log is affected. Aki > On 31/10/2021 20:36 Don Feliciano <don.felici...(a)icloud.com> wrote: > > > > A kind person who isn’t on the mailing list share the solution to this with > me: > > default_vsz_limit = 0 > > > > On Oct 28, 2021, at 12:12 PM, Don Feliciano <don.felici...(a)icloud.com> > > wrote: > > > > > > Warning: fd limit (ulimit -n) is lower than required under max. load (256 < > > 1000), because of default_client_limit > > Oct 28 12:08:48 service(log): Fatal: setrlimit(RLIMIT_DATA, 268435456): > > Invalid argument > > > > > > > On Oct 27, 2021, at 11:08 AM, Don Feliciano <don.felici...(a)icloud.com> > > > wrote: > > > > > > I've been happily running Dovecot on my Mac for many years (installed via > > > Homebrew). After upgrading to Monterey (MacOS 12.01), it no longer starts: > > > > > > $ sw_vers > > > ProductName: macOS > > > ProductVersion: 12.0.1 > > > BuildVersion: 21A559 > > > > > > $ uname -a > > > Darwin dfelicia-mac 21.1.0 Darwin Kernel Version 21.1.0: Wed Oct 13 > > > 17:33:23 PDT 2021; root:xnu-8019.41.5~1/RELEASE_X86_64 x86_64 > > > > > > $ sudo dovecot -F > > > Oct 27 10:11:18 service(log): Fatal: setrlimit(RLIMIT_DATA, 268435456): > > > Invalid argument

1 0

Could not override "mail_location" with "userdb_mail" statment in "/etc/passwd"
by Xavier 17 Feb '23

17 Feb '23

Hi, ** Using Dovecot 2.2.22 and Postfix 3.1.0 ** I plan to migrate all accounts on my server from mbox to maildir storage but before i want to make some tests on dedicated accounts. To do so i want to overide the general "mail_location" ( mail_location = mbox:~/mail:INBOX=/var/mail/%u ) with "maildir:~/Maildir" only for some test accounts. To do so i modified my "/etc/passwd" file using something like that : testm2m_mydomain.tld:x:2122:2122::/home/mail/testm2m_mydomain.tld:/bin/false:userdb_mail=maildir:~/Maildir Also tried testm2m_mydomain.tld:x:2122:2122::/home/mail/testm2m_mydomain.tld:/bin/false::userdb_mail=maildir:~/Maildir And as mentioned in the doc (https://wiki.dovecot.org/LDA/Postfix) i added -d "$USER" in my Postfix "mailbox_command" but it don't seem to work (my new mail_location for this test user is is not taken into account). When i try to make an "doveadm user testm2m_mydomain.tld" i get this : 8<-------------------------------- field value uid 2122 gid 2122 home /home/mail/testm2m_mydomain.tld mail mbox:~/mail:INBOX=/var/mail/testm2m_mydomain.tld system_groups_user testm2m_mydomain.tld 8<-------------------------------- My modification is not taken into account ... Any help is welcome ! /Xavier

2 4

dovecot director how to obtain hashed
by tomate aceite 16 Feb '23

16 Feb '23

Morning again! Working with my directors node. Does anybody now how to obtain a list of all users hashes? I know how to obtain for one user example: *doveadm director status user@domain* I am looking to a way or command to take a list of hashed epired (1)#: doveadm director status manolito@mydomain > Current: 10.X.X.108 (expires 2023-02-17 12:17:59) > Hashed: 10.X.X.108 > Initial config: 10.X.X.108 > Where are stored the hashed ? To lock for the info , etc... Thanks in advance!!!

1 0

Error: Broken file dovecot-uidlist
by Sohin Vyacheslav 16 Feb '23

16 Feb '23

Hi All, In mail.log are exists error messages "Error: Broken file /data/mail/vhosts/domain.com/user(a)domain.com/Maildir/dovecot-uidlist line XX: Invalid data: for some email accounts. For example, dovecot-uidlist line 21197: Invalid data: When I open line 21197 in editor: # vim +21197 dovecot-uidlist 1750207 :1676454069.M698819P4439.mail-b,S=963716,W=976359 and then check this file size # ls -l /data/mail/vhosts/domain.com/user@domain.com/Maildir/cur/1676454069.M698819P4439.mail-b,S=963716,W=976359:2,S -rw------- 1 vmail vmail 963716 Feb 15 10:41 I see that size is the same: 963176 bytes. So what exactly mentioned in error message "dovecot-uidlist line 21197: Invalid data:"? -- Best wishes Sohin Vyacheslav

3 6

Corrupted sizes in cache once again
by Tim Evers 15 Feb '23

15 Feb '23

Hi, I run a fairly large Dovecot Installation (around 100k mailboxes) on several servers. gzip compression is on. Every once in a while I get the dreaded "cache corruption" messages in the log: Error: Corrupted record in index cache file /[redacted]/Maildir/dovecot.index.cache: UID 3868: Broken physical size in mailbox INBOX: read(zlib(/[redacted]/Maildir/cur/1674129792.M797543P21755.node2,S=8099,W=8276:2,)) failed: Cached message size smaller than expected (2877 < 8099, box=INBOX, UID=3868) Error: Corrupted record in index cache file /[redacted]/Maildir/dovecot.index.cache: UID 3875: Broken physical size in mailbox INBOX: read(zlib(/[redacted]/Maildir/cur/1674212201.M985809P29112.node2,S=13907,W=14121:2,)) failed: Cached message size smaller than expected (5533 < 8192, box=INBOX, UID=3875) The first entry shows 2877 (size on disk) vs. 8099 (real size unzipped, also in the filename: S=8099). The second entry shows 5533 (size on disk) vs. 8192 - this is not correct in any way. Size on disk is 13907 as noted in the filename. Both mails were delivered trough LMTP and retrieved by the POP3 service. Anyone with an idea what might be happening here? I've read all available info in the doc and in the previous discussions / bug reports, but nothing seems to match my case. And where does that 8192 come from - it looks suspicious? Version is 2.3.7.2 (Ubuntu 20.04) doveconf -n excerpt: protocol lmtp { mail_plugins = " old_stats mail_log notify zlib sieve quota" } protocol imap { mail_max_userip_connections = 50 mail_plugins = " old_stats mail_log notify zlib imap_old_stats quota imap_quota imap_sieve" } protocol pop3 { mail_max_userip_connections = 50 mail_plugins = " old_stats mail_log notify zlib" } Tim

5 12

Error: Corrupted index cache file
by Sohin Vyacheslav 15 Feb '23

15 Feb '23

Hi All, In mail.log exists an error messages "Error: Corrupted index cache file /data/mail/vhosts/domain.com/user(a)domain.com/Maildir/dovecot.index.cache: invalid record size" for some accounts. I tried these steps to fix it: 1. Running commands # doveadm -D -v index -u user(a)domain.com INBOX # doveadm -v force-resync -u user(a)domain.com INBOX after this I saw that the following files are updated in ../Maildir/: dovecot.index.cache dovecot.index.log dovecot-uidlist But after some time error messages occurred again. 2. Added NFS mount option 'nordirplus' to /etc/fstab with remount /data partition, add 'mmap_disable = yes' and 'mail_fsync = always' to 10-mail.conf as advised on https://doc.dovecot.org/configuration_manual/nfs/ (because /data partition mounted via NFS); 3. Renaming 3 files with/without Dovecot service pre-stop. # mv dovecot.index old.dovecot.index # mv dovecot.index.cache old.dovecot.index.cache # mv dovecot.index.log old.dovecot.index.log Unfortunately, all done steps didn't fix issue. What is the proper way to fix corrupted index cache errors? dovecot package: 1:2.2.33.2-1ubuntu4.8 (Ubuntu-18.04). p.s. for some of email accounts also exists error messages "Error: Broken file ../Maildir/dovecot-uidlist line ###: Invalid data:" besides mentioned cache error. -- Best wishes Sohin Vyacheslav

4 7

NFS and performances
by tomate aceite 15 Feb '23

15 Feb '23

Hello, i have some question about NFS, dovecot director, and imap settings. I was reading all dovecot documentation ad mail lists, but some aspect are not clear to me. I am looking for performance / tunning my infra to work in a more efficient way because we experiences some issues some days ago. This is my infra: I got an infra with 2 dovecot-directors and 3 imap backend. I got all the emails stored in a common NFS share filer to all the imap nodes. ( Index are locally stored in each imap node.) My NFS mount options: (0)#: nfsstat -m /data/mail from myipaddress:/export/mail/maildirs > Flags: > rw,nosuid,noexec,noatime,vers=3,rsize=1048576,wsize=1048576,namlen=255,hard,nordirplus,proto=tcp,timeo=600,retrans=2,sec=sys,mountaddr=10.0.0.205,mountvers=3,mountport=20048,mountproto=tcp,local_lock=none,addr=10.0.0.205 > *Questions*: ( https://wiki.dovecot.org/PerformanceTuning , https://doc.dovecot.org/configuration_manual/nfs/ >> i am following these steps ) 1) Is my NFS correct setup with the mount options well optimized ? Not sure if someone is using the same flags that me or got a better recomendation to used. 2) Set *mmap_disable = yes ??? * >> This must be set to yes if you store indexes to shared filesystems. In my case i got them locally in each imap node not in NFS share folder. I got setup mmap_disable = no , is this correct? I think no is the correct option here with indexes locally. because i can read here: https://wiki1.dovecot.org/NFS > > >> High performance NFS setup with indexes on local disk (see below for > benefits): > > mmap_disable = no > 3) Set* mail_fsync = always ???* Documentation: https://wiki.dovecot.org/PerformanceTuning always > > Use fsync after all disk writes. > > Recommended for NFS to make sure there aren’t any delayed write()s. > 3.a) where i can setup this option *mail_fsync = always , *because i run doveconf -n in director, and imap nodes, and they are not showing nothing. 3.b) *In which node ? *Do i need to add the setting in dovecot.conf in *director node or in imap node or in both ?* Not sure if this is the correct way: This is an attemp of setup, not sure if is correct? 0)#: doveconf -n > # 2.3.13 (89f716dc2): /etc/dovecot/dovecot.conf > # Pigeonhole version 0.5.13 (cdd19fe3) > # OS: Linux 5.10.0-20-amd64 x86_64 Debian 11.6 > > mail_debug = yes > mail_fsync = always > mail_max_userip_connections = 20 > mail_nfs_storage = yes > mail_plugins = " notify mail_log" > mail_privileged_group = mail > > > > protocol lmtp { > mail_fsync = always > mail_plugins = " notify mail_log sieve mail_lua push_notification > push_notification_lua" > plugin { > ... > } > 4) Do not set *mail_nfs_index *or *mail_nfs_storage* (i.e. keep them as no) ????? First option make sense but the second one not. https://doc.dovecot.org/settings/core/#core_setting-mail_nfs_storage mail_nfs_storage >>> >>> Default: no >>> >>> Values: Boolean >>> >>> Flush NFS caches whenever it is necessary to do so. >>> >> > This setting should only be enabled if you are using multiple servers > on NFS. > So should be possible to enable this option *mail_nfs_storage = yes ?????* 4) I got this setting in *dovecot-sql.conf ( director ) * driver = mysql > connect = host=myserver.X dbname=maildb user=dovecot > password=XXXXXXXXXXXXXXXX > default_pass_scheme = SHA > password_query = select login as user, crypt_sha1 as password, home as > userdb_home, uid AS userdb_uid, gid AS userdb_gid, > concat(maildir,':INDEX=/data/indexes/',login) as userdb_mail from mailbox > left join aliases on aliases.systemid = aliasid where login = '%u' and > inactive = 0; > user_query = select home, maildir as mail, uid, gid from mailbox left join > aliases on aliases.systemid = aliasid where login = '%u' and inactive = 0; > iterate_query = select distinct login as user from mailbox; > I would like to implement * ITERINDEX* and probably *VOLATILEDIR *but not sure if this is the correct change or if i need to change something into the database. from: password_query = select login as user, crypt_sha1 as password, home as > userdb_home, uid AS userdb_uid, gid AS userdb_gid, > concat(maildir,':INDEX=/data/indexes/',login) as userdb_mail from mailbox > left join aliases on aliases.systemid = aliasid where login = '%u' and > inactive = 0; > to: password_query = select login as user, crypt_sha1 as password, home as > userdb_home, uid AS userdb_uid, gid AS userdb_gid, > concat(maildir,':INDEX=/data/indexes/',login,':ITERINDEX',':VOLATILEDIR=/tmp/%2.256Nu/%u',login) > as userdb_mail from mailbox left join aliases on aliases.systemid = aliasid > where login = '%u' and inactive = 0; > But not sure if is working correctly, * i checked debuging* in my imap node in this way: auth_verbose = yes > auth_verbose_passwords = no > auth_debug = yes > auth_debug_passwords = yes > mail_debug = yes > verbose_ssl = yes > This is the output log: Feb 15 09:32:53 my-imap-server dovecot: auth: Debug: sql(manolo1(a)mydomain,10.X.X.109,<eWEh7bj09N4KAjxt>): cache hit: {SHA}8376922a27e83b9eadcdec3596a70bf6c4db5730#011user=manolo1@mydomain #011userdb_home=/data/mail/tmydomain/users/manolo1#011userdb_uid=700#011userdb_gid=700#011userdb_mail=/data/mail/mydomain/users/manolo1/Maildir/:INDEX=/data/indexes/manolo1@mydomain :ITERINDEX:VOLATILEDIR=/tmp/3a/manolo1@mydomain *Not sure if is correct the output or should i need to change something into the database or this change only afect locally?* 5) *mailbox_list_index = yes ???* Mailbox list indexes can be used to optimize IMAP STATUS commands. They are > also required for IMAP NOTIFY extension to be enabled. > *It is this option necesary to add? in order to work with ITERINDEX option ?* https://www.mail-archive.com/dovecot@dovecot.org/msg75035.html ( i see your answer to this post ) 6) *What is the best way to do a maintenance in a backend?* The last time i flushed all the user in a director from a backend node to do a maintenance, after the maintenance done i rebalanced the director cluster, but the next day when user started tp connect we got high peak I/O , etc with a lot of problems, because new users in this backend node were re-indexes o creating new indexes. *Are there any way to do in a safer way? *Without loosing the hashed for the directors nodes. Thanks in advance!!!!!!!

3 2

Hide local IP from non delivery notifications
by Claudio Corvino 15 Feb '23

15 Feb '23

Hi everyone, I have an external MTA configured with Postfix that delivers email to an internal IMAP/LMTP Dovecot server configured to bind an LDAP to check if users exist. If the user does not exist, my MX sends a non delivery notification, and into the e-mail there's the local IP address of the Dovecot server. I can't find a way to remove or hide that IP, here is an example of line that contains the IP (with X) that I would like to hide/remove: *"The mail system<user@domain>: host hostname.domain.com <http://hostname.domain.com>[XXX.XXX.XXX.XXX] said: 550"* Thanks in advance! Cheers -- Claudio

5 6

crash when trying to upgrade from 2.0.x to 2.3.x
by Eugene M. Zheganin 15 Feb '23

15 Feb '23

Hello, I'm trying to migrate dovecot mail database from 2.0.9 on Linux to 2.3.20 on FreeBSD. I've rsync'd the entire database, grabbed all the configs, changed the paths and permission, but when trying to access the mail from Thunderbird I have reproducible crash in the logs: ===Cut=== Feb 14 17:12:10 it-r-support dovecot[5888]: auth-worker(6378): Debug: mysql(localhost): Finished query 'SELECT maildir, 1143 AS uid, 1143 AS gid FROM mailbox WHERE username = 'zheganin-em(a)alamics.ru' AND active = '1'' in 0 msecs Feb 14 17:12:10 it-r-support dovecot[5888]: auth-worker(6378): Debug: conn unix:auth-worker (uid=143): auth-worker<16>: sql(zheganin-em(a)alamics.ru,192.168.57.177,<oE2zjKn0FTXAqDmx>): Finished userdb lookup Feb 14 17:12:10 it-r-support dovecot[5888]: auth-worker(6378): Debug: conn unix:auth-worker (uid=143): auth-worker<16>: Finished Feb 14 17:12:10 it-r-support dovecot[5888]: auth: Debug: sql(zheganin-em(a)alamics.ru,192.168.57.177,<oE2zjKn0FTXAqDmx>): Finished userdb lookup Feb 14 17:12:10 it-r-support dovecot[5888]: auth: Debug: master userdb out: USER 1282408449zheganin-em(a)alamics.ru maildir=alamics.ru/zheganin-em/ uid=1143 gid=1143 auth_mech=PLAIN auth_token=15cceab95e1251ea97a8e5ff62c70d1b7a76c96f Feb 14 17:12:10 it-r-support dovecot[5888]: imap-login: Login: user=<zheganin-em(a)alamics.ru>, method=PLAIN, rip=192.168.57.177, lip=172.16.11.13, mpid=6405, session=<oE2zjKn0FTXAqDmx> Feb 14 17:12:10 it-r-support dovecot[5888]: imap(zheganin-em(a)alamics.ru)<6405><oE2zjKn0FTXAqDmx>: Panic: file array.c: line 10 (array_idx_modifiable_i): assertion failed: (idx < array->buffer->used / array->element_size) Feb 14 17:12:10 it-r-support dovecot[5888]: imap(zheganin-em(a)alamics.ru)<6405><oE2zjKn0FTXAqDmx>: Fatal: master: service(imap): child 6405 killed with signal 6 (core dumped) ===Cut=== There's an older thread here mentioning that probably doveadm force-resync would help, but it doesn't fix this. Is there something that could be done here ? I've also reported this in the FreeBSD bugtracker, but just in case decided to ask here too. Backtrace: ===Cut=== # lldb /usr/local/libexec/dovecot/imap --core imap-6404.core (lldb) target create "/usr/local/libexec/dovecot/imap" --core "imap-6404.core" Core file '/var/cores/imap-6404.core' (x86_64) was loaded. (lldb) bt * thread #1, name = 'imap', stop reason = signal SIGABRT * frame #0: 0x000000001151133a libc.so.7`__sys_thr_kill + 10 frame #1: 0x0000000011489c74 libc.so.7`__raise + 52 frame #2: 0x000000001153b109 libc.so.7`abort + 73 frame #3: 0x000000001137a336 libdovecot.so.0`___lldb_unnamed_symbol5855 + 150 frame #4: 0x0000000011378ad1 libdovecot.so.0`___lldb_unnamed_symbol5844 + 49 frame #5: 0x0000000011379881 libdovecot.so.0`___lldb_unnamed_symbol5846 + 33 frame #6: 0x0000000011378ceb libdovecot.so.0`i_panic + 187 frame #7: 0x000000001136a514 libdovecot.so.0`array_idx_modifiable_i + 100 frame #8: 0x0000000012054a78 lib20_fts_plugin.so`fts_user_autoindex_exclude + 72 frame #9: 0x0000000012051b3b lib20_fts_plugin.so`fts_mailbox_allocated + 267 frame #10: 0x000000001113ad0b libdovecot-storage.so.0`hook_mailbox_allocated + 155 frame #11: 0x0000000011134491 libdovecot-storage.so.0`mailbox_alloc + 449 frame #12: 0x0000000001044311 imap`cmd_select_full + 353 frame #13: 0x000000000104cd92 imap`command_exec + 178 frame #14: 0x000000000104b64a imap`___lldb_unnamed_symbol1265 + 58 frame #15: 0x000000000104b7b6 imap`___lldb_unnamed_symbol1265 + 422 frame #16: 0x000000000104a151 imap`client_handle_input + 465 frame #17: 0x00000000010488a8 imap`client_input + 120 frame #18: 0x00000000113936df libdovecot.so.0`io_loop_call_io + 111 frame #19: 0x0000000011396214 libdovecot.so.0`io_loop_handler_run_internal + 388 frame #20: 0x0000000011393dea libdovecot.so.0`io_loop_handler_run + 378 frame #21: 0x0000000011393c28 libdovecot.so.0`io_loop_run + 88 frame #22: 0x00000000112f6208 libdovecot.so.0`master_service_run + 24 frame #23: 0x000000000105af67 imap`main + 1383 frame #24: 0x000000000103c11d imap`_start + 269 (lldb) ===Cut=== Same backtrace in GDB: ===Cut=== # gdb /usr/local/libexec/dovecot/imap --core imap-6404.core GNU gdb (GDB) 12.1 [GDB v12.1 for FreeBSD] Copyright (C) 2022 Free Software Foundation, Inc. License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html> This is free software: you are free to change and redistribute it. There is NO WARRANTY, to the extent permitted by law. Type "show copying" and "show warranty" for details. This GDB was configured as "x86_64-portbld-freebsd13.1". Type "show configuration" for configuration details. For bug reporting instructions, please see: <https://www.gnu.org/software/gdb/bugs/>. Find the GDB manual and other documentation resources online at: <http://www.gnu.org/software/gdb/documentation/>. For help, type "help". Type "apropos word" to search for commands related to "word"... Reading symbols from /usr/local/libexec/dovecot/imap... (No debugging symbols found in /usr/local/libexec/dovecot/imap) [New LWP 100485] warning: Could not load shared library symbols for [vdso]. Do you need "set solib-search-path" or "set sysroot"? Core was generated by `dovecot/imap'. Program terminated with signal SIGABRT, Aborted. Sent by thr_kill() from pid 6404 and user 1143. #0 0x000000001151133a in thr_kill () from /lib/libc.so.7 (gdb) bt full #0 0x000000001151133a in thr_kill () from /lib/libc.so.7 No symbol table info available. #1 0x0000000011489c74 in raise () from /lib/libc.so.7 No symbol table info available. #2 0x000000001153b109 in abort () from /lib/libc.so.7 No symbol table info available. #3 0x000000001137a336 in ?? () from /usr/local/lib/dovecot/libdovecot.so.0 No symbol table info available. #4 0x0000000011378ad1 in ?? () from /usr/local/lib/dovecot/libdovecot.so.0 No symbol table info available. #5 0x0000000011379881 in ?? () from /usr/local/lib/dovecot/libdovecot.so.0 No symbol table info available. #6 0x0000000011378ceb in i_panic () from /usr/local/lib/dovecot/libdovecot.so.0 No symbol table info available. #7 0x000000001136a514 in array_idx_modifiable_i () from /usr/local/lib/dovecot/libdovecot.so.0 No symbol table info available. #8 0x0000000012054a78 in fts_user_autoindex_exclude () from /usr/local/lib/dovecot/lib20_fts_plugin.so No symbol table info available. #9 0x0000000012051b3b in fts_mailbox_allocated () from /usr/local/lib/dovecot/lib20_fts_plugin.so No symbol table info available. #10 0x000000001113ad0b in hook_mailbox_allocated () from /usr/local/lib/dovecot/libdovecot-storage.so.0 No symbol table info available. #11 0x0000000011134491 in mailbox_alloc () from /usr/local/lib/dovecot/libdovecot-storage.so.0 No symbol table info available. #12 0x0000000001044311 in cmd_select_full () No symbol table info available. #13 0x000000000104cd92 in command_exec () No symbol table info available. #14 0x000000000104b64a in ?? () No symbol table info available. #15 0x000000000104b7b6 in ?? () No symbol table info available. #16 0x000000000104a151 in client_handle_input () No symbol table info available. #17 0x00000000010488a8 in client_input () No symbol table info available. #18 0x00000000113936df in io_loop_call_io () from /usr/local/lib/dovecot/libdovecot.so.0 No symbol table info available. #19 0x0000000011396214 in io_loop_handler_run_internal () from /usr/local/lib/dovecot/libdovecot.so.0 No symbol table info available. #20 0x0000000011393dea in io_loop_handler_run () from /usr/local/lib/dovecot/libdovecot.so.0 No symbol table info available. #21 0x0000000011393c28 in io_loop_run () from /usr/local/lib/dovecot/libdovecot.so.0 No symbol table info available. --Type <RET> for more, q to quit, c to continue without paging-- #22 0x00000000112f6208 in master_service_run () from /usr/local/lib/dovecot/libdovecot.so.0 No symbol table info available. #23 0x000000000105af67 in main () No symbol table info available. (gdb) ===Cut=== Thanks. Eugene.

2 3

Feature Request: login_trusted_networks to take FQDN
by Sean Gallagher 15 Feb '23

15 Feb '23

In a previous post to this list I described a problem I was having validating client certificates on inet_listener lmtp connections. Subject: "Please Help: Dovecot ssl_ca selection based on remote IP address filtering not working." The problem there was that Dovecot does not "inspect" the subject name on the client certificate on LMTP connections. As such Any valid certificate will pass. In this context "valid" means the same as OpenSSL SSL_set_verify( ,SSL_VERIFY_PEER, ). I.e. the certificate chain is well formed and can be traced back to a trusted root. It does not say anything about the peer's identity. I propose here, that the "login_trusted_networks" setting be allowed to take a domain name - possibly with wildcards. Then the name on the client certificate could be checked against login_trusted_networks in much the same way that web browsers work. If you tell your web browser that you want to connect to www.example.com, the browser will check that the server's certificate matches "www.example.com". In the present case, if you tell Dovecot (through the login_trusted_networks setting) to allow connections from "smtp.example.com", then Dovecot could check the name on the client's certificate matches "smtp.example.com". More generally, example.com could issue client certificates with names matching "*.mua.example.com". Then you could tell Dovecot to allow connections from "*.mua.example.com" through the login_trusted_networks setting. These usages could largely replace the IP host and CIDR subnet usages currently allowed in the login_trusted_networks setting but both could exist side by side. Of course, more elaborate schemes could be devised involving database lookups, but the outlined proposal would be relatively easy to implement and cover a good majority of use cases. The alternative is to force the use of application-specific certificate authorities, or just ignore it and hope that no one knows how to spoof network traffic. That's My two cents... Sean. -- This email has been checked for viruses by AVG antivirus software. www.avg.com

1 0

IMAP folder subscription on Apple/Mac Mail
by Alex 13 Feb '23

13 Feb '23

Hi, We have a user with an iPhone who can't see their maildir mailboxes on dovecot-2.3.20 on fedora37. I've created a "subscriptions" file with all maildir mailboxes with the proper format (converted from mboxes using mb2md), but the user can only see their inbox. It appears this may be a known problem? https://wiki.dovecot.org/Clients Perhaps it's a problem with my "subscriptions" file, despite being able to see all mailboxes using K-9 on my android? Ideas for troubleshooting would be greatly appreciated.

1 1

Re: Pigeonhole Sieve Vacation Reply-To peculiarity with inbound AWS-SES
by Dr. Rolf Jansen 11 Feb '23

11 Feb '23

> Am 08.02.2023 um 20:03 schrieb Michael Peddemors <michael(a)linuxmagic.com>: > > Dovecot vacation message issues.. > Tough for any system to do correctly. > >> The problem here is that inbound mails from third parties utilizing AWS-SES come in with an unpersonalized envelope address and SES takes returns to this as bounce messages and changes the body's From: to „MAILER-DAEMON(a)xx-zzzz-1.amazonses.xn--com-5o0a, which is not even our MAILER-DAEMON but the one of the receiver of our reply. So the receiver gets no chance to know from the headers the identity of whom replied - he may assume it from the context the actual message, though. > > We addressed this by NOT returning vacation messages to systems that don't use 'proper' values in the MAIL FROM.. Eg Mailing Lists, Sender Rewrite schemes, and a slurry of other rules. Who is we? Your organization or the Pigeonhole developers? Actually, the question is, whether this is addressed somewhere in Pigeonhole’s code already? > But the problem is that if you are using the header From, or Reply-To etc, it's too easy to be sending to forged email addresses. > > Vacation bombing attacks for instance.. You got a point here, and of course I want to prevent this. > Now, there are legitimate cases of the MAIL FROM and header from not aligning, so it is best to send to the MAIL FROM addresses.. IF you don't send it to certain MAIL FROM formats, usually by not responding to anything with mailing list identifiers, auto-suppress headers, and a few others, you only end up with clean MAIL FROM to respond to. From the point of the view of our industrial customers, who are operating processes with our chemicals, this consideration is irrelevant. If they inform a production issue by mail to the responsible service technician, they expect an immediate response, since a production stop is unacceptable. OoO notices play a role here, because we would inform alternative addresses and fone numbers for attending the support case. That said, with Pigeonhole, we are almost there. > But if you have an example that is particularly bothering you, and represents your problem, we can walk through that as an example. I send an email from an account of a mail server (Postfix/Dovecot - outbound relay SES) running on an AWS-EC2 instance in São Paulo (Brazil) to another mail address of mine of a mail server (Postfix/Dovecot direct MX) on an AWS-EC2 instance in Frankfurt Germany, and here the Pigeonhole’s vacation reply is activated. In the following I changed my real mail address in Brazil to rolf(a)example.br and the real one in Germany to rolf(a)example.de: The Point of view of the both involved Postfixes of said transactions are: Sender (Brazil): postfix/submission/smtpd[29165]: 97006638E8: client=201-68-62-42.dsl.telesp.net.br[201.68.62.42], sasl_method=CRAM-MD5, sasl_username=rolf(a)example.br postfix/cleanup[29182]: 97006638E8: message-id=<707A1777-8F09-4335-99BA-70C0367C129A(a)example.br> postfix/qmgr[2058]: 97006638E8: from=<rolf(a)example.br>, size=39626, nrcpt=1 (queue active) postfix/smtp[29183]: 97006638E8: to=<rolf(a)example.de>, relay=email-smtp.sa-east-1.amazonaws.com[52.67.192.29]:587, delay=0.37, delays=0.05/0.01/0.13/0.18, dsn=2.0.0, status=sent (250 Ok 010301863b0211fe-9416f5b2-7e18-4c03-a5e5-2204dd7946f8-000000) Receiver (Germany): postfix/smtpd[86956]: connect from d215-2.smtp-out.sa-east-1.amazonses.com[23.249.215.2] postfix/smtpd[86956]: A44AB676E3: client=d215-2.smtp-out.sa-east-1.amazonses.com[23.249.215.2] postfix/cleanup[86957]: A44AB676E3: message-id=<010301863b0211fe-9416f5b2-7e18-4c03-a5e5-2204dd7946f8-000000(a)sa-east-1.amazonses.com> postfix/qmgr[915]: A44AB676E3: from=<010301863b0211fe-9416f5b2-7e18-4c03-a5e5-2204dd7946f8-000000(a)sa-east-1.amazonses.com>, size=40862, nrcpt=1 (queue active) postfix/local[86958]: A44AB676E3: passing <rolf(a)example.de> to transport=lmtp postfix/lmtp[86959]: A44AB676E3: to=<rolf(a)example.de>, relay=mail.example.de[private/dovecot-lmtp], delay=0.94, delays=0.83/0.01/0.04/0.07, dsn=2.0.0, status=sent (250 2.0.0 <rolf(a)example.de> +/goFGgl5mOwUwEAEYr/fg Saved) Sender of the OoO (Germany): postfix/qmgr[915]: 60242676F0: from=<rolf(a)example.de>, size=1177, nrcpt=1 (queue active) postfix/cleanup[86957]: 60242676F0: message-id=<dovecot-sieve-1676027240-343352-0(a)example.de> postfix/pickup[62932]: 60242676F0: uid=xxxx from=<rolf(a)example.de> postfix/smtp[86963]: 60242676F0: to=<010301863b0211fe-9416f5b2-7e18-4c03-a5e5-2204dd7946f8-000000(a)sa-east-1.amazonses.com>, relay=email-smtp.eu-central-1.amazonaws.com[3.74.180.161]:587, delay=0.31, delays=0.01/0.02/0.13/0.15, dsn=2.0.0, status=sent (250 Ok 010701863b022070-bb3e4541-8306-4438-b649-8879ec8ff666-000000) Receiver of the OoO notice (Brazil): postfix/smtpd[29184]: connect from d215-244.smtp-out.sa-east-1.amazonses.com[23.249.215.244] postfix/smtpd[29184]: 5F1346394E: client=d215-244.smtp-out.sa-east-1.amazonses.com[23.249.215.244] postfix/cleanup[29182]: 5F1346394E: message-id=<010301863b022c93-9842f45a-85ec-419f-8199-00e027888394-000000(a)sa-east-1.amazonses.com> postfix/qmgr[2058]: 5F1346394E: from=<>, size=3150, nrcpt=1 (queue active) postfix/local[29185]: 5F1346394E: passing <rolf(a)example.br> to transport=lmtp postfix/lmtp[29186]: 5F1346394E: to=<rolf(a)example.br>, relay=mail.example.br[private/dovecot-lmtp], delay=0.05, delays=0.01/0.01/0.02/0.01, dsn=2.0.0, status=sent (250 2.0.0 <rolf(a)example.br> RRZHGWwl5mMDcgAAjZNhtw Saved) The headers of the received OoO message (I removed the DKIM stuff for clarity) are: Return-Path: <> Delivered-To: rolf(a)example.br Received: from mail.example.br by example.br with LMTP id RRZHGWwl5mMDcgAAjZNhtw (envelope-from <>) for <rolf(a)example.br>; Fri, 10 Feb 2023 08:07:24 -0300 Received: from d215-244.smtp-out.sa-east-1.amazonses.com (d215-244.smtp-out.sa-east-1.amazonses.com [23.249.215.244]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.example.br (Postfix) with ESMTPS id 5F1346394E for <rolf(a)example.br>; Fri, 10 Feb 2023 08:07:24 -0300 (-03) DKIM-Signature: ... X-Sieve: Pigeonhole Sieve 0.5.20 (149edcf2) Message-ID: <010301863b022c93-9842f45a-85ec-419f-8199-00e027888394-000000(a)sa-east-1.amazonses.com> Date: Fri, 10 Feb 2023 11:07:23 +0000 From: MAILER-DAEMON(a)sa-east-1.amazonses.com To: rolf(a)example.br Subject: Out of Office - automatic notice In-Reply-To: <010301863b0211fe-9416f5b2-7e18-4c03-a5e5-2204dd7946f8-000000(a)sa-east-1.amazonses.com> References: <010301863b0211fe-9416f5b2-7e18-4c03-a5e5-2204dd7946f8-000000(a)sa-east-1.amazonses.com> Auto-Submitted: auto-replied (vacation) Precedence: bulk X-Auto-Response-Suppress: All MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit Feedback-ID: 1.sa-east-1.E7DnIghDRHBvwjrx2QL73gyWAj+NYISxiq7bqOVD27E=:AmazonSES X-SES-Outgoing: 2023.02.10-23.249.215.244 Note how there is not a single reference of the real origin of the OoO message, rolf(a)example.de. Instead we see From: MAILER-DAEMON(a)sa-east-1.amazonses.com. The receiver of this message need to guess the real address from the outside context. The actual problem is that Pigeonhole responds to to=<010301863b0211fe-9416f5b2-7e18-4c03-a5e5-2204dd7946f8-000000(a)sa-east-1.amazonses.com> instead of to=<rolf(a)example.de>. Amazon SES of the original sender (not our relay) takes this as a bounce and changes the relevant headers. This is not under our control. Perhaps this could be mitigated by adding a Reply-To: header which informs the original sender. Then the receiver of the OoO noice would at least have a reference to what and whom this is about. Best regards Rolf > On 2023-02-08 13:21, Dr. Rolf Jansen wrote: >> Am 08.02.2023 um 12:57 schrieb Michael Peddemors <michael(a)linuxmagic.com>: >>> On 2023-02-08 07:47, Dr. Rolf Jansen wrote: >>>> Am 08.02.2023 um 12:23 schrieb Michael Peddemors <michael(a)linuxmagic.com>: >>>>> On 2023-02-07 14:57, Dr. Rolf Jansen wrote: >>>>>> Am 07.02.2023 um 19:49 schrieb Michael Peddemors <michael(a)linuxmagic.com>: >>>>>>> On 2023-02-07 13:33, jeremy ardley wrote: >>>>>>>> On 8/2/23 05:08, Dr. Rolf Jansen wrote: >>>>>>>>> Am 07.02.2023 um 17:54 schrieb jeremy ardley<jeremy(a)ardley.org>: >>>>>>>>>> On 7/2/23 22:01, Dr. Rolf Jansen wrote: >>>>>>>>>> To begin with, usage of Amazons Simple Email Service (SES) is mandatory for outgoing mails from AWS-EC2 instances. >>>>>>>>>> I run AWS-EC2 instances using postfix to send a receive mail. They can send direct assuming I set up suitable SPF, but they typically forward mail to another host under my control that is not on AWS to use as the outgoing server. >>>>>>>>> OK, that’s another use case. Many do use a full fledged Postfix/Dovecot installation. However the outgoing port 25 into the internet is blocked by AWS, and therefore we may either use a third party relay for our outgoing emails or may use SES, which is not that bad - except some unusual peculiarities. >>>>>>>>> >>>>>>>> This is off topic, but to be precise: >>>>>>>> - AWS throttles but does not block traffic to a *destination* port 25. >>>>>>>> - The *origin* port on the EC2 instance is an unprivilged port, not port 25 >>>>>>>> - If you use a relayhost you typically send from an unprivilged EC2 port to port 587 on the relay host >>>>>>>> Jeremy >>>>>>> >>>>>>> And if you DO intend to send out to port 25, remember to update the PTR on your EC2 instance. >>>>>> I respond off-list. Generally a good hint but it’s like trying to bath salts (https://en.wikipedia.org/wiki/Bath_salts) when you are taking a shower. >>>>>> https://aws.amazon.com/premiumsupport/knowledge-center/ec2-port-25-throttle/ >>>>>> Although the link text (ec2-port-25-throttle) suggests throttling, it is actually blocking - read the text. This cannot be removed from standard EC2 instances. >>>>>> This also corresponds to my experience. On the console of an AWS-EC2 instance, I entered just now: >>>>>> telnet cyclaero.com 25 >>>>>> This hangs until timeout. At the same time cyclaero.com received emails from the internet on port 25. >>>>>> Trying 3.126.110.101... >>>>>> telnet: connect to address 3.126.110.101: Operation timed out >>>>>> telnet: Unable to connect to remote host >>>>> >>>>> There are a lot of malicous or compromised EC2 instances..It is good they block port by default, and the one day delay before unblocking (you can request it) helps stop those short term spam instances. >>>>> >>>>> Now, wish they blocked port 587 by default ;) >>>>> >>>>> Or at least tracked the attacks. >>>>> >>>>> Strange though, that people still try to set up email on EC2, doesn't make sense, and it isn't the cheapest alternative.

5 8

Please Help: Dovecot ssl_ca selection based on remote IP address filtering not working.
by Sean Gallagher 11 Feb '23

11 Feb '23

Hi All, I hope this is the correct place to post this. If not, apologies. I am in the process of updating my company's email servers and am trying to put Dovecot into an Alpine Linux container, hosted on ProxMox. In my setup, local mail deliveries via LMTP can come from the MSA (for intra-company mail) and an MTA (for inbound mail). The LMTP data is sent over IPv4 and is protected by TLS. Client certificates are used to authenticate sources. I wanted to prevent Dovecot from accepting LMTP from any other source and the method I came up with to do this was to use filtering on the "remote" address. I would create a "Fake" CA that had never signed a certificate and use that to evaluate the certificate presented by incoming connections from addresses other than the two legitimate sources. This would cause all connections from "bad" addresses to be rejected. This seemed simple enough on paper but Dovecot just isn't playing along. It seems that no matter what I do, I cannot get "remote" filtering to switch the "ssl_ca" parameter. I have put together a test bed to demonstrate. I then use openssl s_client to attempt to connect to the test bed container. I've attached the instructions to build the test bed from scratch. In all cases s_client reports "Acceptable client certificate CA names" "CN = Fake CA" I.e. it want's a certificate from the CA that has never signed a certificate and never will. Why not do the obvious thing? I use LDAP to authenticate individual users and the user name will be reported over LMTP. So to use the normal authentication mechanisms to authenticate the connection source, I would need to do two LDAP lookups, one for the connecting machine and one for the mail recipient. It is not clear if this is possible from the documentation.. *Questions:* Is config file filtering broken or am I doing it wrong? Is it possible to provide a different "ssl_ca" based on the remote IP address? Is there an easier way to restrict LMTP connections to specific remote IP addresses? p.s. Filtering just doesn't work like it's supposed to. Someone should look at that (especially multi-level) .. See this: https://dovecot.org/pipermail/dovecot/2016-June/104770.html Any help would be greatly appreciated. I am at my wits' end with this. -- This email has been checked for viruses by AVG antivirus software. www.avg.com

1 1

Why does creating a mailbox create it in all namespaces?
by e 10 Feb '23

10 Feb '23

When I create a mailbox using CREATE, it creates it in all namespaces? Is that supposed to happen? Look: ``` a namespace * NAMESPACE (("" "/")("Other/" "/")) NIL NIL a OK Namespace completed (0.001 + 0.000 secs). a list "" * * LIST (\HasNoChildren) "/" Other * LIST (\HasNoChildren) "/" INBOX a OK List completed (0.001 + 0.000 secs). a create Other/Drafts a OK Create completed (0.003 + 0.000 + 0.002 secs). a list "" * * LIST (\HasNoChildren) "/" Drafts * LIST (\HasChildren) "/" Other * LIST (\HasNoChildren) "/" Other/Drafts * LIST (\HasNoChildren) "/" INBOX a OK List completed (0.001 + 0.000 secs). ``` This is my namespace configuration ``` namespace { prefix = inbox = yes separator = / } namespace { prefix = Other/ separator = / } ``` And dovecot version is 2.3.7.2

2 1

doveadm: Error: Mailbox INBOX: Deleting corrupted cache: Cache file too large
by Ralf Hildebrandt 09 Feb '23

09 Feb '23

Hi! Upon issuing a % doveadm import -u restore(a)backup.invalid mdbox:/home/storage/mdbox I'm getting a: doveadm(restore(a)backup.invalid): Error: Mailbox INBOX: Deleting corrupted cache: Cache file too largea doveadm(restore(a)backup.invalid): Error: Corrupted dbox file /home/restore/mdbox/storage/m.7 (around offset=41602004): msg header has bad magic value doveadm(restore(a)backup.invalid): Error: Corrupted dbox file /home/restore/mdbox/storage/m.8 (around offset=17193748): msg header has bad magic value message -- but the process keeps running! Should I worry? dovecot packages: 2.3.20-3+ubuntu20.04 -- Ralf Hildebrandt Geschäftsbereich IT | Abteilung Netzwerk Charité - Universitätsmedizin Berlin Campus Benjamin Franklin Hindenburgdamm 30 | D-12203 Berlin Tel. +49 30 450 570 155 | Fax: +49 30 450 570 962 ralf.hildebrandt(a)charite.de | https://www.charite.de

1 0

Pigeonhole Sieve Vacation Reply-To peculiarity with inbound AWS-SES
by Dr. Rolf Jansen 08 Feb '23

08 Feb '23

To begin with, usage of Amazons Simple Email Service (SES) is mandatory for outgoing mails from AWS-EC2 instances. The Pro is, it does work and we may utilize email relays with high reputation for our outgoing mails at no additional costs. The Con's are that (A) SES does not relay mails with empty <> MAIL FROM addresses and (B) it fiddles with the envelope addresses of the relayed mails. Anyway this is out of our control, and while I could avoid (A) by switching the e-mail service provider, I still have no control over (B) because this affects replying to emails from others using AWS-SES. Problem A) The empty-MAIL-FROM may be effectively addressed by setting Pigeonhole’s sieve_vacation_send_from_recipient to ‚yes‘. Problem B) Pigeonhole Vacation utilizes the senders envelope address of the inbound message as the reply-address. The problem here is that inbound mails from third parties utilizing AWS-SES come in with an unpersonalized envelope address and SES takes returns to this as bounce messages and changes the body's From: to „MAILER-DAEMON(a)xx-zzzz-1.amazonses.xn--com-5o0a, which is not even our MAILER-DAEMON but the one of the receiver of our reply. So the receiver gets no chance to know from the headers the identity of whom replied - he may assume it from the context the actual message, though. I found the setting sieve_vacation_to_header_ignore_envelope, which was introduced in 2017 (https://dovecot.org/list/dovecot-cvs/2017-August/028917.html) My finding is, that this resolves the problem only half way. For a local workaround, I changed Line 1119 of cmd-vacation.c https://github.com/dovecot/pigeonhole/blob/34431d7a67474c00d5b0554f5d45b867… to: struct smtp_address real_to; if (smtp_address_init_from_msg(&real_to, &reply_to) >= 0) sctx = sieve_smtp_start_single(senv, &real_to, smtp_from, &output); else sctx = sieve_smtp_start_single(senv, smtp_to, smtp_from, &output); That in place and setting sieve_vacation_to_header_ignore_envelope to ‚yes‘, effectively resolves problem B as well. Best regards Rolf Jansen

6 10