- dovecot - dovecot.org

acl_ignore_namespace & dovecot-acl-list files
by Vincent Brillault 29 Jun '21

29 Jun '21

Hi! After updating to 2.3.15, I was hoping to be able to get rid of some of the work-around I had in place when configuring shared folders in cluster mode in 2.3.14. Unfortunately it seems that I still need one. Running on CentOS7 with both a 'virtual' and 'shared' namespace, whenever I update the global vfile, I'm getting the following warning: ``` Error: open(/etc/dovecot/virtual/.temp.....8536.f1a78823779ee98d) failed: Read-only file system Error: dovecot-acl-list creation failed: safe_mkstemp(/etc/dovecot/virtual/.temp.....8536.) failed: Read-only file system Error: unlink(/etc/dovecot/virtual/dovecot-acl-list) failed: Read-only file system (in acl-backend-vfile-acllist.c:339) ``` I found it weird, as I'm using acl_ignore_namespace to ignore the virtual filesystem, but still dovecot seems to be trying to create a dovecot-acl-list file there. After digging into it and generating a backtrace where that error message is triggered, I believe I've trace it down to `acl_lookup_dict_rebuild`, which doesn't filter out "ignored" namespaces. The attached patch seems to solve the problem for me, but I must admit I didn't test it in depth so I'm not sure if I'm breaking something else... Let me know if I'm missing something, Thanks, Vincent PS: Some details: - Relevant configuration (let me know if I'm missing something): ``` mail_plugins = acl zlib virtual fts fts_solr namespace Virtual { prefix = Virtual/ separator = / hidden = yes list = no subscriptions = no location = virtual:/etc/dovecot/virtual:INDEX=~/virtual } namespace shared { type = shared prefix = shared/%%u/ list = children subscriptions = no location = imapc:~/shared/%%u } plugin { # ACLs acl = vfile:/etc/dovecot/dovecot-acl acl_ignore_namespace = Virtual/ acl_ignore_namespace2 = shared/* acl_shared_dict = proxy::acl } ``` - Backtrace generated manually (adding `backtrace_get(&backtrace)` & printing the result under the `dovecot-acl-list creation failed` error): ``` Raw backtrace: /usr/lib64/dovecot/libdovecot.so.0(backtrace_append+0x42) [0x7ff99d364862] -> /usr/lib64/dovecot/libdovecot.so.0(backtrace_get+0x1e) [0x7ff99d36496e] -> /usr/lib64/dovecot/lib01_acl_plugin.so(+0xb071) [0x7ff99ca9f071] -> /usr/lib64/dovecot/lib01_acl_plugin.so(acl_backend_vfile_acllist_rebuild+0x1d) [0x7ff99ca9f3ed] -> /usr/lib64/dovecot/lib01_acl_plugin.so(acl_backend_vfile_acllist_refresh+0x250) [0x7ff99ca9f6b0] -> /usr/lib64/dovecot/lib01_acl_plugin.so(acl_backend_vfile_nonowner_iter_init+0x9) [0x7ff99ca9f849] -> /usr/lib64/dovecot/lib01_acl_plugin.so(acl_lookup_dict_rebuild+0x13e) [0x7ff99caa179e] -> /usr/lib64/dovecot/lib01_acl_plugin.so(+0xb245) [0x7ff99ca9f245] -> /usr/lib64/dovecot/lib01_acl_plugin.so(acl_backend_vfile_acllist_rebuild+0x1d) [0x7ff99ca9f3ed] -> /usr/lib64/dovecot/lib01_acl_plugin.so(+0xa9ad) [0x7ff99ca9e9ad] -> /usr/lib64/dovecot/lib01_acl_plugin.so(+0x6e4c) [0x7ff99ca9ae4c] -> /usr/lib64/dovecot/lib01_acl_plugin.so(acl_object_get_my_rights+0x75) [0x7ff99ca9af35] -> /usr/lib64/dovecot/lib01_acl_plugin.so(+0xe44e) [0x7ff99caa244e] -> /usr/lib64/dovecot/libdovecot-storage.so.0(mailbox_exists+0x6e) [0x7ff99d6845fe] -> /usr/lib64/dovecot/libdovecot-storage.so.0(mailbox_list_mailbox+0x226) [0x7ff99d694ff6] -> /usr/lib64/dovecot/libdovecot-storage.so.0(mailbox_list_iter_init_namespaces+0x282) [0x7ff99d6eecf2] -> dovecot/imap [vbrillau XXXXX LIST](cmd_list_full+0x55b) [0x563f9bb004bb] -> dovecot/imap [vbrillau XXXXX LIST](command_exec+0x64) [0x563f9bb0ab04] -> dovecot/imap [vbrillau XXXXX LIST](+0x1d9e2) [0x563f9bb089e2] -> dovecot/imap [vbrillau XXXXX LIST](+0x1da71) [0x563f9bb08a71] -> dovecot/imap [vbrillau XXXXX LIST](client_handle_input+0x205) [0x563f9bb08ef5] -> dovecot/imap [vbrillau XXXXX LIST](client_input+0x79) [0x563f9bb094d9] -> /usr/lib64/dovecot/libdovecot.so.0(io_loop_call_io+0x65) [0x7ff99d38a425] -> /usr/lib64/dovecot/libdovecot.so.0(io_loop_handler_run_internal+0x12b) [0x7ff99d38bdab] -> /usr/lib64/dovecot/libdovecot.so.0(io_loop_handler_run+0x59) [0x7ff99d38a529] -> /usr/lib64/dovecot/libdovecot.so.0(io_loop_run+0x38) [0x7ff99d38a768] -> /usr/lib64/dovecot/libdovecot.so.0(master_service_run+0x13) [0x7ff99d2f43c3] -> dovecot/imap [vbrillau XXXXX LIST](main+0x342) [0x563f9bafa2f2] -> /lib64/libc.so.6(__libc_start_main+0xf5) [0x7ff99ced1555] -> dovecot/imap [vbrillau XXXXX LIST](+0xf4f5) [0x563f9bafa4f5] ```

2 1

SSL23_GET_CLIENT_HELLO:unknown protocol
by Voytek Eymont 29 Jun '21

29 Jun '21

I have a user failing to get mail , using TBird client is this due to his TBird email client backlevel TLS support ? I'm trying to find out his TBird version, might be an older TBird # dovecot --version 2.3.15 (0503334ab1) # egrep "ssl_protocols|ssl_min_protocol" /etc/dovecot/conf.d/10-ssl.conf #ssl_min_protocol = TLSv1.2 Jun 29 14:23:27 pop3-login: Info: Disconnected: Connection closed: SSL_accept() failed: error:140760FC:SSL routines:SSL23_GET_CLIENT_HELLO:unknown protocol (no auth attempts in 1 secs): user=<>, rip= 111.222.333.555, lip=ser.ver.ip.add, TLS handshaking: SSL_accept() failed: error:140760FC:SSL routines:SSL23_GET_CLIENT_HELLO:unknown protocol, session=<kZ6p99/FW9iTMgHi> Jun 29 14:23:54 pop3-login: Info: Disconnected: Connection closed: SSL_accept() failed: error:140760FC:SSL routines:SSL23_GET_CLIENT_HELLO:unknown protocol (no auth attempts in 1 secs): user=<>, rip= 111.222.333.555, lip=ser.ver.ip.add, TLS handshaking: SSL_accept() failed: error:140760FC:SSL routines:SSL23_GET_CLIENT_HELLO:unknown protocol, session=<Gq5G+d/Fu1STMgHi>

2 2

Increase FTS timeouts for slow(er) machines
by Bojan Čekrlić 29 Jun '21

29 Jun '21

Hello list, I have a question which doesn’t seem to be answered by the documentation. I’m running Dovecot on a Raspberry PI-like computer. I’ve enabled full-text search (FTS) and installed Solr and Tika. Now, Dovecot will timeout Tika after 60 seconds and some emails will not get indexed as there’s simply not enough processing power on the device to work so fast. I don’t mind the slowness, so the question here is — how do I increase this timeout? Looking at the commits it seems that this option is hardcoded in the code and cannot be increased via configuration change? Thanks, B

2 2

good options for Multiple users on a common email account
by Pat G 28 Jun '21

28 Jun '21

Hi, i ve a mail server to manage with some email accounts but with multiples users (+50) using a common email. it indicates sometimes that it can't connect cause too many connections. what are the good options to allow a lot of users for a specific account ? i modifyied these options : auth_worker_max_count = 60 mail_max_userip_connections = 60 is it sufficient ? dovecot -n : auth_worker_max_count = 60 mail_location = maildir:/home/%u/Maildir namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } passdb { driver = pam } protocols = " imap" service imap-login { inet_listener imaps { port = 993 ssl = yes } } ssl_cert = </etc/ssl/certs/dovecot.pem ssl_key = # hidden, use -P to show it userdb { driver = passwd } protocol imap { mail_max_userip_connections = 60 } Regards, -- patg

3 3

Unable to run dovecot.2.3.15
by Joe Wong 28 Jun '21

28 Jun '21

Hello, I am trying to setup a new server on Centos 7 running 2.3.15, I compile the source with ./configure --with-pam , make then make install. I have another server using 2.3.8 so I copy my config files from there to /usr/local/etc/dovecot. I am using systemctl enable dovecot then systemctl start dovecot , however it failed to start. There is error found in /var/log/messages: Jun 28 09:14:37 new-ns1 systemd: Started Dovecot IMAP/POP3 email server. Jun 28 09:14:37 new-ns1 dovecot: Error: unlink(/usr/var/run/dovecot/login/login) failed: Read-only file system (in master-settings.c:739) Jun 28 09:14:37 new-ns1 dovecot: Error: unlink(/usr/var/run/dovecot/login/pop3) failed: Read-only file system (in master-settings.c:739) Jun 28 09:14:37 new-ns1 dovecot: Error: unlink(/usr/var/run/dovecot/login/imap) failed: Read-only file system (in master-settings.c:739) Jun 28 09:14:37 new-ns1 dovecot: Error: unlink(/usr/var/run/dovecot/login/dns-client) failed: Read-only file system (in master-settings.c:739) Jun 28 09:14:37 new-ns1 dovecot: Error: unlink(/usr/var/run/dovecot/login/ipc-proxy) failed: Read-only file system (in master-settings.c:739) Jun 28 09:14:37 new-ns1 dovecot: Error: unlink(/usr/var/run/dovecot/token-login/tokenlogin) failed: Read-only file system (in master-settings.c:739) Jun 28 09:14:37 new-ns1 dovecot: Error: unlink(/usr/var/run/dovecot/token-login/imap-urlauth) failed: Read-only file system (in master-settings.c:739) Jun 28 09:14:37 new-ns1 dovecot: Error: service(stats): unlink(/usr/var/run/dovecot/stats-reader) failed: Read-only file system Jun 28 09:14:37 new-ns1 dovecot: Error: service(stats): unlink(/usr/var/run/dovecot/stats-writer) failed: Read-only file system Jun 28 09:14:37 new-ns1 dovecot: Error: service(replicator): unlink(/usr/var/run/dovecot/replicator) failed: Read-only file system Jun 28 09:14:37 new-ns1 dovecot: Error: service(aggregator): unlink(/usr/var/run/dovecot/replication-notify) failed: Read-only file system Jun 28 09:14:37 new-ns1 dovecot: Error: service(aggregator): unlink(/usr/var/run/dovecot/replication-notify-fifo) failed: Read-only file system Jun 28 09:14:37 new-ns1 dovecot: Error: service(pop3): unlink(/usr/var/run/dovecot/login/pop3) failed: Read-only file system Jun 28 09:14:37 new-ns1 dovecot: Error: service(old-stats): unlink(/usr/var/run/dovecot/old-stats) failed: Read-only file system Jun 28 09:14:37 new-ns1 dovecot: Error: service(old-stats): unlink(/usr/var/run/dovecot/old-stats-mail) failed: Read-only file system Jun 28 09:14:37 new-ns1 dovecot: Error: service(old-stats): unlink(/usr/var/run/dovecot/old-stats-user) failed: Read-only file system Jun 28 09:14:37 new-ns1 dovecot: Error: service(log): unlink(/usr/var/run/dovecot/log-errors) failed: Read-only file system Jun 28 09:14:37 new-ns1 dovecot: Error: service(lmtp): unlink(/usr/var/run/dovecot/lmtp) failed: Read-only file system Jun 28 09:14:37 new-ns1 dovecot: Error: service(ipc): unlink(/usr/var/run/dovecot/ipc) failed: Read-only file system Jun 28 09:14:37 new-ns1 dovecot: Error: service(ipc): unlink(/usr/var/run/dovecot/login/ipc-proxy) failed: Read-only file system Jun 28 09:14:37 new-ns1 dovecot: Error: service(indexer-worker): unlink(/usr/var/run/dovecot/indexer-worker) failed: Read-only file system Jun 28 09:14:37 new-ns1 dovecot: Error: service(indexer): unlink(/usr/var/run/dovecot/indexer) failed: Read-only file system Jun 28 09:14:37 new-ns1 dovecot: Error: service(imap): unlink(/usr/var/run/dovecot/login/imap) failed: Read-only file system Jun 28 09:14:37 new-ns1 dovecot: Error: service(imap): unlink(/usr/var/run/dovecot/imap-master) failed: Read-only file system Jun 28 09:14:37 new-ns1 dovecot: Error: service(imap-urlauth-worker): unlink(/usr/var/run/dovecot/imap-urlauth-worker) failed: Read-only file system Jun 28 09:14:37 new-ns1 dovecot: Error: service(imap-urlauth): unlink(/usr/var/run/dovecot/token-login/imap-urlauth) failed: Read-only file system Jun 28 09:14:37 new-ns1 dovecot: Error: service(imap-urlauth-login): unlink(/usr/var/run/dovecot/imap-urlauth) failed: Read-only file system Jun 28 09:14:37 new-ns1 dovecot: Error: service(imap-hibernate): unlink(/usr/var/run/dovecot/imap-hibernate) failed: Read-only file system Jun 28 09:14:37 new-ns1 dovecot: Error: service(doveadm): unlink(/usr/var/run/dovecot/doveadm-server) failed: Read-only file system Jun 28 09:14:37 new-ns1 dovecot: Error: service(dns-client): unlink(/usr/var/run/dovecot/dns-client) failed: Read-only file system Jun 28 09:14:37 new-ns1 dovecot: Error: service(dns-client): unlink(/usr/var/run/dovecot/login/dns-client) failed: Read-only file system Jun 28 09:14:37 new-ns1 dovecot: Error: service(director): unlink(/usr/var/run/dovecot/director-admin) failed: Read-only file system Jun 28 09:14:37 new-ns1 dovecot: Error: service(director): unlink(/usr/var/run/dovecot/director-userdb) failed: Read-only file system Jun 28 09:14:37 new-ns1 dovecot: Error: service(dict): unlink(/usr/var/run/dovecot/dict) failed: Read-only file system Jun 28 09:14:37 new-ns1 dovecot: Error: service(dict-async): unlink(/usr/var/run/dovecot/dict-async) failed: Read-only file system Jun 28 09:14:37 new-ns1 dovecot: Error: service(config): unlink(/usr/var/run/dovecot/config) failed: Read-only file system Jun 28 09:14:37 new-ns1 dovecot: Error: service(auth): unlink(/usr/var/run/dovecot/login/login) failed: Read-only file system Jun 28 09:14:37 new-ns1 dovecot: Error: service(auth): unlink(/usr/var/run/dovecot/token-login/tokenlogin) failed: Read-only file system Jun 28 09:14:37 new-ns1 dovecot: Error: service(auth): unlink(/usr/var/run/dovecot/auth-login) failed: Read-only file system Jun 28 09:14:37 new-ns1 dovecot: Error: service(auth): unlink(/usr/var/run/dovecot/auth-client) failed: Read-only file system Jun 28 09:14:37 new-ns1 dovecot: Error: service(auth): unlink(/usr/var/run/dovecot/auth-userdb) failed: Read-only file system Jun 28 09:14:37 new-ns1 dovecot: Error: service(auth): unlink(/usr/var/run/dovecot/auth-master) failed: Read-only file system Jun 28 09:14:37 new-ns1 dovecot: Error: service(auth-worker): unlink(/usr/var/run/dovecot/auth-worker) failed: Read-only file system Jun 28 09:14:37 new-ns1 dovecot: Error: service(anvil): unlink(/usr/var/run/dovecot/anvil) failed: Read-only file system Jun 28 09:14:37 new-ns1 dovecot: Error: service(anvil): unlink(/usr/var/run/dovecot/anvil-auth-penalty) failed: Read-only file system Jun 28 09:14:37 new-ns1 dovecot: Fatal: Failed to start listeners Jun 28 09:14:37 new-ns1 systemd: dovecot.service: main process exited, code=exited, status=89/n/a Jun 28 09:14:37 new-ns1 systemd: Unit dovecot.service entered failed state. Jun 28 09:14:37 new-ns1 systemd: dovecot.service failed. What did I miss here ?

4 5

Dovecot mailing list and DKIM
by Kevin N. 28 Jun '21

28 Jun '21

Hello everybody, Going through my mail logs I noticed that a couple of messages from the Dovecot mailing list failed DKIM validation. For example, this one has failed: https://markmail.org/message/te7tycmpiutw4kia 'opendkim-testkey' shows that the key is OK. The messages in the example comes from yahoo.com, however other messages from yahoo.com, ones that are not sent through the mailing list, are properly validated. The failure is not specific to yahoo.com since a couple of other messages from other domains, sent though the mailing list, also failed DKIM validation. However, the vast majority of the messages from the list properly pass DKIM validation. From what I have read, mailing lists in general do not play very well with DKIM or SPF and the Dovecot mailing list also had some issues with this in the past. With the Dovecot mailing list, I am a bit curious about why the vast majority of the messages from the list pass DKIM validation while a couple of them fail. Does the Dovecot mailing list software alter the message in a way that causes the failure? Or is there something else going on? Any thoughts? Cheers.

4 9

ZLIB/ZSTD Compressed MBOX in Maildir++ layout
by Pedro Ribeiro 28 Jun '21

28 Jun '21

Hello everyone! Our archive namespace is kept in MBOX format with Maildir++ layout due to: * Need to have the email from all users/folders self contained (our base namespace uses MDBOX with single instance storage of attachments) * MBOX/FS layout isn't supported because some folders have messages and subfolders. I'm trying to compress that namespace using zstd/gzip following the informations from Dovecot documentation about the zlib plugin but when the (MBOX/Maildir++) compress and become with .zst/.zstd/.gz suffix (both tested) the system can't read the mailboxes and incorrectly reports the suffix (.zstd/.gz) as a subfolder name (following the Maildir++ file structure). Is there any way to make the MBOX/Maildir++ compatible with the zlib compression? Using Dovecot 2.3.14 on Debian10 Regards. -- Best regards, =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= Pedro Ribeiro Politécnico de Lisboa, Serviços da Presidência Departamento de Sistemas de Informação e Comunicações Phone: +351 210 464 700 (general) / VoIP: 80100 Helpdesk: helpdesk(a)net.ipl.pt / https://www.net.ipl.pt =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

2 5

Problem with Lua notification script since 2.3.15 update
by Ralf Becker 28 Jun '21

28 Jun '21

If the Lua-notifications are enabled, Dovecot imap dies immediately at authentication: Jun 28 09:17:29 imap-login: Info: Login: user=<ralf>, method=PLAIN, rip=172.18.0.12, lip=172.18.0.16, mpid=16, TLS, session=<dDhm9c/FYtqsEgAM> Jun 28 09:17:29 imap(ralf)<16><dDhm9c/FYtqsEgAM>: Panic: file dlua-script.c: line 224 (dlua_script_init): assertion failed: (lua_gettop(script->L) == 0) Jun 28 09:17:29 imap(ralf)<16><dDhm9c/FYtqsEgAM>: Error: Raw backtrace: /usr/lib/dovecot/libdovecot.so.0(backtrace_append+0x41) [0x7f9f537ca5c1] -> /usr/lib/dovecot/libdovecot.so.0(backtrace_get+0x22) [0x7f9f537ca6e2] -> /usr/lib/dovecot/libdovecot.so.0(+0x1070bb) [0x7f9f537d70bb] -> /usr/lib/dovecot/libdovecot.so.0(+0x107157) [0x7f9f537d7157] -> /usr/lib/dovecot/libdovecot.so.0(+0x5bb2b) [0x7f9f5372bb2b] -> /usr/lib/dovecot/libdovecot-lua.so.0(+0x5354) [0x7f9f53311354] -> /usr/lib/dovecot/modules/lib22_push_notification_lua_plugin.so(+0x3842) [0x7f9f532c6842] -> /usr/lib/dovecot/modules/lib20_push_notification_plugin.so(push_notification_driver_init+0x19c) [0x7f9f532d062c] -> /usr/lib/dovecot/modules/lib20_push_notification_plugin.so(+0x846f) [0x7f9f532d246f] -> /usr/lib/dovecot/modules/lib20_push_notification_plugin.so(+0x8b6a) [0x7f9f532d2b6a] -> /usr/lib/dovecot/libdovecot-storage.so.0(hook_mail_user_created+0x211) [0x7f9f539084e1] -> /usr/lib/dovecot/libdovecot-storage.so.0(mail_user_init+0x20b) [0x7f9f5390e80b] -> /usr/lib/dovecot/libdovecot-storage.so.0(mail_storage_service_next_with_session_suffix+0x587) [0x7f9f5390bd57] -> /usr/lib/dovecot/libdovecot-storage.so.0(mail_storage_service_lookup_next+0x53) [0x7f9f5390c4c3] -> dovecot/imap(client_create_from_input+0x180) [0x5626eb18fe40] -> dovecot/imap(+0x3112a) [0x5626eb19012a] -> /usr/lib/dovecot/libdovecot.so.0(+0x8d60e) [0x7f9f5375d60e] -> /usr/lib/dovecot/libdovecot.so.0(+0x8d97b) [0x7f9f5375d97b] -> /usr/lib/dovecot/libdovecot.so.0(+0x8e8be) [0x7f9f5375e8be] -> /usr/lib/dovecot/libdovecot.so.0(connection_input_default+0x15e) [0x7f9f537cef5e] -> /usr/lib/dovecot/libdovecot.so.0(io_loop_call_io+0x6d) [0x7f9f537ed3ed] -> /usr/lib/dovecot/libdovecot.so.0(io_loop_handler_run_internal+0x145) [0x7f9f537eea15] -> /usr/lib/dovecot/libdovecot.so.0(io_loop_handler_run+0x54) [0x7f9f537ed494] -> /usr/lib/dovecot/libdovecot.so.0(io_loop_run+0x40) [0x7f9f537ed600] -> /usr/lib/dovecot/libdovecot.so.0(master_service_run+0x17) [0x7f9f537609e7] -> dovecot/imap(main+0x469) [0x5626eb172c19] -> /lib/x86_64-linux-gnu/libc.so.6(__libc_start_main+0xf3) [0x7f9f535020b3] -> dovecot/imap(_start+0x2e) [0x5626eb172cae] Jun 28 09:17:29 imap(ralf)<16><dDhm9c/FYtqsEgAM>: Fatal: master: service(imap): child 16 killed with signal 6 (core dumps disabled - https://dovecot.org/bugreport.html#coredumps) I use the following Dovecot configuration: # Store METADATA information in a file dovecot-metadata in user's home mail_attribute_dict = file:%h/dovecot-metadata # enable metadata protocol imap { imap_metadata = yes } # add necessary plugins for Lua push notifications mail_plugins = $mail_plugins mail_lua notify push_notification push_notification_lua # Lua notification script and URL of EGroupware push server plugin { push_notification_driver = lua:file=/etc/dovecot/dovecot-push.lua push_lua_url = https://Bearer:secret@boulder.egroupware.org/egroupware/push } The Lua script is available under https://github.com/EGroupware/swoolepush/blob/master/doc/dovecot-push.lua The whole Dovecot configurations is available under https://github.com/EGroupware/build.opensuse.org/tree/master/server:eGroupW… Dovecot runs in a Ubuntu 20.04 based container and seems to use the correct liblua5.3: root@750978e5c0ee:/# dpkg -l|grep -i lua ii dovecot-lua 2:2.3.15-1+ubuntu20.04 amd64 secure POP3/IMAP server - LUA support ii liblua5.3-0:amd64 5.3.3-1.1ubuntu2 amd64 Shared library for the Lua interpreter version 5.3 ii lua-json 1.3.4-2 all JSON decoder/encoder for Lua ii lua-lpeg:amd64 1.0.2-1 amd64 LPeg library for the Lua language ii lua-socket:amd64 3.0~rc1+git+ac3201d-4 amd64 TCP/UDP socket library for the Lua language Everything was running fine with 2.3.13, have not tried with 2.3.14 yet. Any ideas? Ralf -- Ralf Becker EGroupware GmbH [www.egroupware.org] Handelsregister HRB Kaiserslautern 3587 Geschäftsführer Birgit und Ralf Becker Leibnizstr. 17, 67663 Kaiserslautern, Germany Telefon +49 631 31657-0

3 4

[BUG] doveadm / mail-crypt: Error when setting new password for a user key
by Kevin N. 28 Jun '21

28 Jun '21

Dovecot version: 2.3.14 When setting a new password for a user key you have the option to prompt the user for the old and the new password, instead of providing them as parameters (using -N and -O instead of -n and -o). However, running: doveadm mailbox cryptokey password -u user@domain -N -O produces an error instead of prompting the user for the old and the new password. The error is: password: option requires an argument -- 'O' You can work around this by providing a dummy input for -O which seems to be properly ignored in the end, but it would be nice to not throw any errors since -O should not expect an argument. Regards.

2 5

Support client_id variable expansion
by Eirik Rye 28 Jun '21

28 Jun '21

Hello, We are using imap_id_log='*' (and imap_id_retain=yes) to log user client information to the dovecot logs, and this information is aggregated to give us extra debugging information for customer support. However, as some clients send the ID information pre-login and others send it post-login, the aggregation logic is needlessly complex as we need to correlate the session IDs of the pre-login ID messages in order to determine the correct user. Hoping to simplify this, I wanted to log the client_id variable on logout, in imap_logout_format: imap_logout_format = in=%i out=%o deleted=%{deleted} expunged=%{expunged} trashed=%{trashed} hdr_count=%{fetch_hdr_count} hdr_bytes=%{fetch_hdr_bytes} body_count=%{fetch_body_count} body_bytes=%{fetch_body_bytes} client_id="%{client_id}" However, this only results in the following log being printed: client_id="UNSUPPORTED_VARIABLE_client_id" While examining the source code (login-common/client-common.c), it seems like this could be trivially supported by adding `client_id` to the `login_var_expand_empty_tab` struct, and adding the relevant code to populate this variable to `get_var_expand_table(struct client *client)`. I am willing to write a pull request for this, unless I am missing some obvious reason why expansion of the client's `client_id` field is not supported in the first place? - Eirik

2 1

Re: [Dovecot-news] Dovecot v2.3.15 released
by Daniel J. Luke 28 Jun '21

28 Jun '21

On Jun 21, 2021, at 7:20 AM, Timo Sirainen <timo(a)sirainen.com> wrote: > Here's a new release with some security fixes and quite a lot of other changes as well. > > * Removed support for Lua 5.2. Use version 5.1 or 5.3 instead. Looks like it doesn't want to build w/o lua now. On my MacOS system configure says: checking whether we will be linking in Lua... no ... but after fixing the implicit i_gettimeofday declaration, build fails with: /bin/sh ../../libtool --tag=CC --mode=link gcc -std=gnu99 -g -O2 -fstack-protector-strong -U_FORTIFY_SOURCE -D_FORTIFY_SOURCE=2 -Wall -W -Wmissing-prototypes -Wmissing-declarations -Wpointer-arith -Wchar-subscripts -Wformat=2 -Wbad-function-cast -Wno-duplicate-decl-specifier -Wstrict-aliasing=2 -I/opt/local/include -no-undefined -L/opt/local/lib -o libdict_lua.la libtool: link: ar cru .libs/libdict_lua.a ar: no archive members specified (this doesn't happen with 2.3.14.1) -- Daniel J. Luke

5 7

Backing up per user keys for mailcrypt
by Ben Burk 28 Jun '21

28 Jun '21

I am wondering how I can back up keys for mail users in their password-protected form, without exporting them from `doveadm mailbox cryptokey export`, which requires a password. The goal here is to perform routine backups to keep keys current. Relevant config is as follows: mail_attribute_dict = file:%h/Maildir/dovecot-attributes mail_plugins = $mail_plugins mail_crypt plugin { mail_crypt_curve = secp521r1 mail_crypt_save_version = 2 mail_crypt_require_encrypted_user_key = yes } Am i correct in assuming I should back up the dovecot-attributes file? Are there any ancillary files that need to be backed up as well, such as indexes, to properly read and handle this file? I have viewed the file and it appears there are several keys at play for a single mail user. Do different folders in a users imap space have different encryption keys? Are all of these keys populated in this dovecot-attributes file? Is there any established procedure for restoring keys? Is it as simple as placing the dovecot-attributes file, if that is infact what needs to be backed up beforehand to perform a restore. -- Ben Burk BURK.TECH System Administrator

2 1

Python module for HTTP API
by Michael Ströder 28 Jun '21

28 Jun '21

HI! Can anybody recommend a high-level Python module for accessing doveadm's HTTP API? [1] Ciao, Michael. [1] https://doc.dovecot.org/admin_manual/doveadm_http_api/

3 4

Quota Config With Prefetch Creating Alias Directories
by dovecot＠ptld.com 27 Jun '21

27 Jun '21

Using Dovecot 2.3.8 with Postfix & MySQL on Centos. I have a sql table with account info, email addresses, password, quotas, etc I have another sql table for aliases containing which alias points to what email address. For imap access im using passdb password_query with prefetch. I setup quotas using count and configured postfix to check quotas with check_policy_service before accepting email. Discovered that it wont lookup quotas using prefetch. Added a second userdb so quota request can use user_query instead of the imap password_query prefetch version. userdb { driver = sql args = /etc/dovecot/mysql_quota.include skip = found result_success = return-ok result_failure = return-ok } This worked for existing email addresses in the accounts table. But any email sent to an alias was rejected because user not found. Not by postfix, postfix can see its an alias, but when postfix does check_policy_service dovecot issued the rejection because its not finding the alias in the accounts table per the userdb user_query. I added "result_failure = return-ok" to the userdb so if user_query doesn't find the address postfix is asking to accept mail for, it will fall back on quota default values. Then dovecot isn't forcing the mail to be rejected and postfix knows if its a valid user or alias. This seems to solve the issue, dovecot will return per user quotas or if not found then the global quota and let postfix decided whats a valid address to accept or reject. But now there is a side effect. Every time you ask dovecot for a quota, and if its a first time use of a newly created account dovecot creates the index directories and index files on disk. Because im using result_failure=return-ok which tells dovecot the user was found to prevent aliases from being rejected, dovecot is also creating directories and indexes for those aliases postfix is sending over check_policy_service. First question: Is this the best way to configure dovecot using quota verification for postfix to work will aliases? Second question: How can i prevent directories and indexes being created for non found user (aliases) accounts? Thank you.

2 3

Dovecot v2.3.14.1 released
by Timo Sirainen 24 Jun '21

24 Jun '21

Hi, This is an "important fixes only" release in case you don't want to upgrade to v2.3.15. There is no matching Pigeonhole release - use the same v2.3.14 instead. https://dovecot.org/releases/2.3/dovecot-2.3.14.1.tar.gz <https://dovecot.org/releases/2.3/dovecot-2.3.14.1.tar.gz> https://dovecot.org/releases/2.3/dovecot-2.3.14.1.tar.gz.sig <https://dovecot.org/releases/2.3/dovecot-2.3.14.1.tar.gz.sig> Binary packages in https://repo.dovecot.org/ <https://repo.dovecot.org/> Docker images in https://hub.docker.com/r/dovecot/dovecot <https://hub.docker.com/r/dovecot/dovecot> * CVE-2021-29157: Dovecot does not correctly escape kid and azp fields in JWT tokens. This may be used to supply attacker controlled keys to validate tokens, if attacker has local access. * CVE-2021-33515: On-path attacker could have injected plaintext commands before STARTTLS negotiation that would be executed after STARTTLS finished with the client. - lib-index: Corrupted mime.parts in dovecot.index.cache may have resulted in Panic: file imap-bodystructure.c: line 206 (part_write_body): assertion failed: (text == ((part->flags & MESSAGE_PART_FLAG_TEXT) != 0)) - imap: SETMETADATA could not be used to unset metadata values. Instead NIL was handled as a "NIL" string. v2.3.14 regression.

3 4

Dovecot v2.3.15 released
by Timo Sirainen 23 Jun '21

23 Jun '21

Hi, Here's a new release with some security fixes and quite a lot of other changes as well. https://dovecot.org/releases/2.3/dovecot-2.3.15.tar.gz <https://dovecot.org/releases/2.3/dovecot-2.3.15.tar.gz> https://dovecot.org/releases/2.3/dovecot-2.3.15.tar.gz.sig <https://dovecot.org/releases/2.3/dovecot-2.3.15.tar.gz.sig> Binary packages in https://repo.dovecot.org/ <https://repo.dovecot.org/> Docker images in https://hub.docker.com/r/dovecot/dovecot <https://hub.docker.com/r/dovecot/dovecot> * CVE-2021-29157: Dovecot does not correctly escape kid and azp fields in JWT tokens. This may be used to supply attacker controlled keys to validate tokens, if attacker has local access. * CVE-2021-33515: On-path attacker could have injected plaintext commands before STARTTLS negotiation that would be executed after STARTTLS finished with the client. * Disconnection log messages are now more standardized across services. They also always now start with "Disconnected" prefix. * Dovecot now depends on libsystemd for systemd integration. * Removed support for Lua 5.2. Use version 5.1 or 5.3 instead. * config: Some settings are now marked as "hidden". It's discouraged to change these settings. They will no longer be visible in doveconf output, except if they have been changed or if doveconf -s parameter is used. See https://doc.dovecot.org/settings/advanced/ for details. * imap-compress: Compression level is now algorithm specific. See https://doc.dovecot.org/settings/plugin/compress-plugin/ * indexer-worker: Convert "Indexed" info logs to an event named "indexer_worker_indexing_finished". See https://doc.dovecot.org/admin_manual/list_of_events/#indexer-worker-indexin… + Add TSLv1.3 support to min_protocols. + Allow configuring ssl_cipher_suites. (for TLSv1.3+) + acl: Add acl_ignore_namespace setting which allows to entirely ignore ACLs for the listed namespaces. + imap: Support official RFC8970 preview/snippet syntax. Old methods of retrieving preview information via IMAP commands ("SNIPPET and PREVIEW with explicit algorithm selection") have been deprecated. + imapc: Support INDEXPVT for imapc storage to enable private message flags for cluster wide shared mailboxes. + lib-storage: Add new events: mail_opened, mail_expunge_requested, mail_expunged, mail_cache_lookup_finished. See https://doc.dovecot.org/admin_manual/list_of_events/#mail + zlib, imap-compression, fs-compress: Support compression levels that the algorithm supports. Before, we would allow hardcoded value between 1 to 9 and would default to 6. Now we allow using per-algorithm value range and default to whatever default the algorithm specifies. - *-login: Commands pipelined together with and just after the authenticate command cause these commands to be executed twice. This applies to all protocols that involve user login, which currently comprises of imap, pop3, submisision and managesieve. - *-login: Processes are supposed to disconnect the oldest non-logged in connection when process_limit was reached. This didn't actually happen with the default "high-security mode" (with service_count=1) where each connection is handled by a separate process. - *-login: When login process reaches client/process limits, oldest client connections are disconnected. If one of these was still doing anvil lookup, this caused a crash. This could happen only if the login process limits were very low or if the server was overloaded. - Fixed building with link time optimizations (-flto). - auth: Userdb iteration with passwd driver does not always return all users with some nss drivers. - dsync: Shared INBOX not synced when "mail_shared_explicit_inbox" was disabled. If a user has a shared mailbox which is another user's INBOX, dsync didn't include the mailbox in syncing unless explicit naming is enabled with "mail_shared_explicit_inbox" set to "yes". - dsync: Shared namespaces were not synced with "-n" flag. - dsync: Syncing shared INBOX failed if mail_attribute_dict was not set. If a user has a shared mailbox that is another user's INBOX, dsync failed to export the mailbox if mail attributes are disabled. - fts-solr, fts-tika: Using both Solr FTS and Tika may have caused HTTP requests to assert-crash: Panic: file http-client-request.c: line 1232 (http_client_request_send_more): assertion failed: (req->payload_input != NULL) - fts-tika: 5xx errors returned by Tika server as indexing failures. However, Tika can return 5xx for some attachments every time. So the 5xx error should be retried once, but treated as success if it happens on the retry as well. v2.3 regression. - fts-tika: v2.3.11 regression: Indexing messages with fts-tika may have resulted in Panic: file message-parser.c: line 802 (message_parser_deinit_from_parts): assertion failed: (ctx->nested_parts_count == 0 || i_stream_have_bytes_left(ctx->input)) - imap: SETMETADATA could not be used to unset metadata values. Instead NIL was handled as a "NIL" string. v2.3.14 regression. - imap: IMAP BINARY FETCH crashes at least on empty base64 body: Panic: file index-mail-binary.c: line 358 (blocks_count_lines): assertion failed: (block_count == 0 || block_idx+1 == block_count) - imap: If IMAP client using the NOTIFY command was disconnected while sending FETCH notifications to the client, imap could crash with Panic: Trying to close mailbox INBOX with open transactions. - imap: Using IMAP COMPRESS extension can cause IMAP connection to hang when IMAP commands are >8 kB long. - imapc: If remote server sent BYE but didn't immediately disconnect, it could cause infinite busy-loop. - lib-index: Corrupted cache record size in dovecot.index.cache file could have caused a crash (segfault) when accessing it. - lib-oauth2: JWT token time validation now works correctly with 32-bit systems. - lib-ssl-iostream: Checking hostnames against an SSL certificate was case-sensitive. - lib-storage: Corrupted mime.parts in dovecot.index.cache may have resulted in Panic: file imap-bodystructure.c: line 206 (part_write_body): assertion failed: (text == ((part->flags & MESSAGE_PART_FLAG_TEXT) != 0)) - lib-storage: Index rebuilding (e.g. via doveadm force-resync) didn't preserve the "hdr-pop3-uidl" header. Because of this, the next pop3 session could have accessed all of the emails' metadata to read their POP3 UIDL (opening dbox files). - listescape: When using the listescape plugin and a shared namespace the plugin didn't work properly anymore resulting in errors like: "Invalid mailbox name: Name must not have '/' character." - lmtp: Connection crashes if connection gets disconnected due to multiple bad commands and the last bad command is BDAT. - lmtp: The Dovecot-specific LMTP parameter XRCPTFORWARD was blindly forwarded by LMTP proxy without checking that the backend has support. This caused a command parameter error from the backend if it was running an older Dovecot release. This could only occur in more complex setups where the message was proxied twice; when the proxy generated the XRCPTFORWARD parameter itself the problem did not occur, so this only happened when it was forwarded. - lmtp: The LMTP proxy crashes with a panic when the remote server replies with an error while the mail is still being forwarded through a DATA/BDAT command. - lmtp: Username may have been missing from lmtp log line prefixes when it was performing autoexpunging. - master: Dovecot would incorrectly fail with haproxy 2.0.14 service checks. - master: Systemd service: Dovecot announces readiness for accepting connections earlier than it should. The following environment variables are now imported automatically and can be omitted from import_environment setting: NOTIFY_SOCKET LISTEN_FDS LISTEN_PID. - master: service { process_min_avail } was launching processes too slowly when master was forking a lot of processes. - util: Make the health-check.sh example script POSIX shell compatible.

4 4

Quota warning script is never sent when reverse=yes
by Jesús Ángel del Pozo Domínguez 23 Jun '21

23 Jun '21

Hi there, I set up Dovecot to call a quota warning script: plugin { quota_warning = storage=100%% quota-warning 100 %u quota_warning2 = storage=95%% quota-warning 95 %u quota_warning3 = storage=80%% quota-warning 80 %u quota_warning4 = -storage=100%% quota-warning below %u } The script is called whenever the quota exceeds the corresponding amount (80%, 95% and 100%). However, on deleting messages to free space, the script is not being called even though the quota drops below 100%. I have manually tested the script, and it works: $ /usr/local/bin/quota-warning.sh below user(a)foo.bar Could you please give me any hint to fix this. I would like to call the quota-warning script so that I can clear the over_quota_flag field in the database. Regards,

1 0

ssl_min_protocol v2.3.15
by Theo Pannen 23 Jun '21

23 Jun '21

Hello, it seems that the default value for ssl_min_protocol has changed from TLSv1 to TLSv1.2, right? After upgrading to v2.3.15 and with ssl_min_protocol commented out, the server no longer offers TLSv1 and TLSv1.1. This is a good idea, but should be documented. Theo

2 1

CVE-2021-33515: SMTP Submission service STARTTLS injection
by Timo Sirainen 22 Jun '21

22 Jun '21

Open-Xchange Security Advisory 2021-06-21 Product: Dovecot Vendor: OX Software GmbH Internal reference: DOV-4583 (Bug ID) Vulnerability type: CWE-74: Failure to Sanitize Data into a Different Plane ('Injection') Vulnerable version: 2.3.0-2.3.14 Vulnerable component: submission Report confidence: Confirmed Solution status: Fixed by Vendor Fixed version: 2.3.14.1 Vendor notification: 2021-05-21 Solution date: 2021-05-22 Public disclosure: 2021-06-21 CVE reference: CVE-2021-33515 CVSS: 4.2 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N) Researcher credit: Fabian Ising and Damian Poddebniak of Münster University of Applied Sciences Vulnerability Details: On-path attacker could inject plaintext commands before STARTTLS negotiation that would be executed after STARTTLS finished with the client. Only the SMTP submission service is affected. Risk: Attacker can potentially steal user credentials and mails. The attacker needs to have sending permissions on the submission server (a valid username and password). Workaround: None. Solution: Operators should update to 2.3.14.1 or later version.

3 3

Dovecot deliver and imap process hangs
by Rok Saksida 22 Jun '21

22 Jun '21

Hello. Dovecot version: 2.2.36 OS: CentOS Linux release 7.9.2009 (Core) Kernel: 3.10.0-1160.11.1.el7.x86_64 I have two dovecot servers in replication master/master. Sometimes happens that deliver or imap process hangs and causing high CPU usage. In log's I only see locking failures but not initial cause why this happened. For mail storage I use ZFS pool with compression enabled. I made some digging and find this option: mmap_disable = yes. I will try this setting today evening. But I wondering if you have any idea why this happening and how to start solving this problems? Is there any additional setting like mmap_disable that can help solved this issues? -- BR

1 0

Upgrade path
by Andrea Gabellini 22 Jun '21

22 Jun '21

Hello, I have a configuration with two proxy/director and two backend with replication. All at version 2.3.10.1. What is the suggested upgrade path to 2.3.15? I think to switch traffic to only one proxy and one backend and upgrade the two servers that remain without traffic. Then I switch the traffic to these upgraded servers and proceed with the upgrade of the others two. Is this correct? Or is best to upgrade first the two proxy/director and next the two backend? Thanks, Andrea -- __________________________ Business is like riding a bicycle. Either you keep moving or you fall down. __________________________ TIM San Marino S.p.A. Andrea Gabellini Engineering R&D TIM San Marino S.p.A. - https://www.telecomitalia.sm Via Ventotto Luglio, 212 - Piano -2 47893 - Borgo Maggiore - Republic of San Marino Tel: (+378) 0549 886237 Fax: (+378) 0549 886188 -- Informativa Privacy Questa email ha per destinatari dei contatti presenti negli archivi di TIM San Marino S.p.A.. Tutte le informazioni vengono trattate e tutelate nel rispetto della normativa vigente sulla protezione dei dati personali (Reg. EU 2016/679). Per richiedere informazioni e/o variazioni e/o la cancellazione dei vostri dati presenti nei nostri archivi potete inviare una email a privacy(a)telecomitalia.sm. Avviso di Riservatezza Il contenuto di questa e-mail e degli eventuali allegati e' strettamente confidenziale e destinato alla/e persona/e a cui e' indirizzato. Se avete ricevuto per errore questa e-mail, vi preghiamo di segnalarcelo immediatamente e di cancellarla dal vostro computer. E' fatto divieto di copiare e divulgare il contenuto di questa e-mail. Ogni utilizzo abusivo delle informazioni qui contenute da parte di persone terze o comunque non indicate nella presente e-mail potra' essere perseguito ai sensi di legge.

1 0

CVE-2021-29157: oauth2 JWT local validation path traversal
by Timo Sirainen 21 Jun '21

21 Jun '21

Open-Xchange Security Advisory 2021-06-21 Product: Dovecot Vendor: OX Software GmbH Internal reference: DOV-4476 (Bug ID) Vulnerability type: CWE-24: Path Traversal: '../filedir' Vulnerable version: 2.3.11-2.3.14 Vulnerable component: imap, pop3, submission, managesieve Report confidence: Confirmed Solution status: Fixed by Vendor Fixed version: 2.3.14.1 Vendor notification: 2021-03-22 Solution date: 2021-04-14 Public disclosure: 2021-06-21 CVE reference: CVE-2021-29157 CVSS: 6.7 (CVSS3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N) Researcher credit: Kirin of Tencent Security Xuanwu Lab Vulnerability Details: Dovecot does not correctly escape kid and azp fields in JWT tokens. This may be used to supply attacker controlled keys to validate tokens in some configurations. This requires attacker to be able to write files to local disk. Risk: Local attacker can login as any user and access their emails. Workaround: Disable local JWT validation in oauth2, or use a different dict driver than fs:posix. Solution: Operators should update to 2.3.14.1 or later version.

1 0

CVE-2020-28200: Sieve excessive resource usage
by Timo Sirainen 21 Jun '21

21 Jun '21

Open-Xchange Security Advisory 2021-06-21 Product: Dovecot Vendor: OX Software GmbH Internal reference: DOV-4159 (Bug ID) Vulnerability type: CWE-400 Vulnerable version: 1.2.0-2.3.14 Vulnerable component: lmtp, lda Report confidence: Confirmed Solution status: Fixed by Vendor Fixed version: 2.3.15 Vendor notification: 2020-09-23 Solution date: 2020-12-07 Public disclosure: 2021-06-21 CVE reference: CVE-2020-28200 CVSS: 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) Researcher credit: Innokentii Sennovskii from BI.ZONE Vulnerability Details: Sieve interpreter is not protected against abusive scripts that claim excessive resource usage. Especially scripts using massive amounts of regexps. Risk: Attacker can DoS the mail delivery system by using excessive amount of CPU and/or reaching the lmtp/lda process limits. Workaround: Disabling the regex sieve extension avoids the worst problems. lmtp_user_concurrency_limit may also be helpful. Solution: Operators should update to 2.3.15 or later version.

1 0

Pigeonhole v0.5.15 released
by Timo Sirainen 21 Jun '21

21 Jun '21

Hi, Pigeonhole release for Dovecot v2.3.15. One thing we noticed a bit before release is that if you're using imap_sieve_filter plugin, the IMAP FILTER command may trigger the new excessive resource usage check since it can be processing many messages rapidly. You may want to prevent this with protocol imap { sieve_max_cpu_time=0 } https://pigeonhole.dovecot.org/releases/2.3/dovecot-2.3-pigeonhole-0.5.15.t… <https://pigeonhole.dovecot.org/releases/2.3/dovecot-2.3-pigeonhole-0.5.15.t…> https://pigeonhole.dovecot.org/releases/2.3/dovecot-2.3-pigeonhole-0.5.15.t… <https://pigeonhole.dovecot.org/releases/2.3/dovecot-2.3-pigeonhole-0.5.15.t…> Binary packages in https://repo.dovecot.org/ <https://repo.dovecot.org/> Docker images in https://hub.docker.com/r/dovecot/dovecot <https://hub.docker.com/r/dovecot/dovecot> * CVE-2020-28200: Sieve interpreter is not protected against abusive scripts that claim excessive resource usage. Fixed by limiting the user CPU time per single script execution and cumulatively over several script runs within a configurable timeout period. Sufficiently large CPU time usage is summed in the Sieve script binary and execution is blocked when the sum exceeds the limit within that time. The block is lifted when the script is updated after the resource usage times out. * Disconnection log messages are now more standardized across services. They also always now start with "Disconnected" prefix. - managesieve: Commands pipelined together with and just after the authenticate command cause these commands to be executed twice.

1 0

error: "The certificate is empty"
by A. Schulze 18 Jun '21

18 Jun '21

Hello, on a farm of multiple identical dovecot servers I start seeing this error on usual POP3S access on one of many servers: pop3-login: Error: Failed to initialize SSL server context: Can't load SSL certificate (ssl_cert setting): The certificate is empty: I'm running 2.3.14 compiled against openssl-1.1.1k on Debian Buster Looks like it's this code: https://github.com/dovecot/core/blob/a5209c83c3a82386c94d466eec5fea394973e8… called from here: https://github.com/dovecot/core/blob/a5209c83c3a82386c94d466eec5fea394973e8… To me it /looks/ like a resource problem. The farm handle a million pop3 sessions per hour while only 50k (5%) are using TLS. The farm is up and running since ~2 weeks. When started, the automatic deployment *did* check that pop3s was working well. Also today on all farmservers the certificate file is valid, contain expected content. the server is currently offline but not restarted to allow further investigation. the setup is quite normal just checked over all Farmservers: - doveconf | grep ssl | sha256sum - sha256sum $( doveconf | grep 'ssl_cert = <' | awk -F\< '{ print $2 }' ) the output is identical. Any idea is appreciated ... Andreas

1 0

Maildir to Mdbox and folder structure after the conversion
by Marco Usai 18 Jun '21

18 Jun '21

Using the dsync command I've converted a Dovecot mail folder from Maildir to Mdbox format. (see https://dovecot.org/pipermail/dovecot/2021-June/122304.html) The folder resulting from the conversion (see https://pastebin.com/6U4CDTQi ), however, has a completely different directory structure from the one used by the destination server where it will be transferred (see https://pastebin.com/nMEvqmqp ) What do I have to do to make the folder obtained after the conversion have a directory structure identical to the one used by the destination server ? Thank You.

3 4

Empty response with userFile from doveadm HTTP API
by lab＠403.sk 18 Jun '21

18 Jun '21

Hi, I must be doing something terribly wrong, but I am not able to get a non empty response from doveadm HTTP API when using userFile parameter. E. g. in getQuota or search command. Single user or wildcard working as expected. ./doveadm_cli.py --apikey $key --apiurl http://localhost:8180/doveadm/v1 (doveadm) quotaGet userFile=/tmp/f [] Results: 0 cat /tmp/f box1(a)domain.tld box2(a)domain.tld Result with plain cURL is exactly the same. curl -X POST http://localhost:8180/doveadm/v1 -H "Content-Type: application/json" -H "Authorization: X-Dovecot-API xxx" -d '[["quotaGet",{"userFile":"/tmp/f"},"tag1"]]' [["doveadmResponse",[],"tag1"]] Doveadm binary has no problem of reading that file. In a debug log I can see request finishes after "Handling LIST request" and does not jump to "Handling USER request" as in doveadm (binary) case. Am I missing something? dovecot: doveadm(::1): Executing command quota get dovecot: doveadm: Debug: auth-master: userdb list: Started listing users (user_mask=*) dovecot: doveadm: Debug: auth-master: conn unix:/var/run/dovecot/auth-userdb: Connecting dovecot: doveadm: Debug: auth-master: conn unix:/var/run/dovecot/auth-userdb (pid=13811,uid=0): Client connected (fd=8) dovecot: doveadm(::1): Debug: auth-master: userdb list: Finished listing users dovecot: doveadm(::1): Debug: auth-master: conn unix:/var/run/dovecot/auth-userdb (pid=13811,uid=0): Disconnected: Connection closed (fd=8) dovecot: auth: Debug: master in: LIST#0111#011user=* dovecot: doveadm(::1): doveadm: ::1 - - "POST /doveadm/v1 HTTP/1.1" 200 77 "http://localhost:8180/doveadm/v1" "python-requests/2.6.0 CPython/2.7.5" dovecot: auth-worker(13875): Debug: Loading modules from directory: /usr/lib64/dovecot/auth dovecot: auth-worker(13875): Debug: Module loaded: /usr/lib64/dovecot/auth/lib20_auth_var_expand_crypt.so dovecot: auth-worker(13875): Debug: Module loaded: /usr/lib64/dovecot/auth/libdriver_mysql.so dovecot: auth-worker(13875): Debug: Module loaded: /usr/lib64/dovecot/auth/libdriver_sqlite.so dovecot: auth-worker(13875): Debug: conn unix:auth-worker (pid=13839,uid=97): Server accepted connection (fd=15) dovecot: auth-worker(13875): Debug: conn unix:auth-worker (pid=13839,uid=97): Sending version handshake dovecot: auth-worker(13875): Debug: conn unix:auth-worker (pid=13839,uid=97): auth-worker<1>: Handling LIST request dovecot: auth-worker(13875): Debug: conn unix:auth-worker (pid=13839,uid=97): auth-worker<1>: sql(*): Performing userdb lookup dovecot: auth-worker(13875): Debug: conn unix:auth-worker (pid=13839,uid=97): auth-worker<1>: sql(*): SELECT email AS user FROM mailbox WHERE active=1 dovecot: auth-worker(13875): Debug: conn unix:auth-worker (pid=13839,uid=97): auth-worker<1>: sql(*): Finished userdb lookup dovecot: auth-worker(13875): Debug: conn unix:auth-worker (pid=13839,uid=97): auth-worker<1>: Finished doveconf -n # 2.3.14 (cee3cbc0d): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.14 (1b5c82b2) # OS: Linux 3.10.0-862.2.3.el7.x86_64 x86_64 CentOS Linux release 7.5.1804 (Core) # Hostname: xxx auth_debug = yes auth_mechanisms = plain login cram-md5 auth_verbose = yes default_client_limit = 6000 default_process_limit = 512 disable_plaintext_auth = no doveadm_api_key = # hidden, use -P to show it mail_debug = yes mail_home = /h/v/%d/%n mail_location = maildir:~/Maildir mail_plugins = quota managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext mbox_write_locks = fcntl namespace inbox { inbox = yes list = yes location = mailbox "Deleted Items" { special_use = \Trash } mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Items" { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Spam { special_use = \Junk } mailbox Trash { special_use = \Trash } prefix = type = private } passdb { args = /etc/dovecot/local-sql.conf driver = sql } plugin { quota = maildir quota_grace = 10M quota_rule2 = Kos:storage=+100M quota_rule3 = Trash:storage=+100M quota_rule4 = Deleted Messages:storage=+100M quota_status_nouser = DUNNO quota_status_overquota = 552 5.2.2 Mailbox is full quota_status_success = DUNNO sieve = file:~/sieve;active=~/.dovecot.sieve } service auth-worker { idle_kill = 30 secs } service auth { unix_listener /var/spool/postfix/private/auth { group = mail mode = 0660 user = postfix } unix_listener auth-userdb { mode = 0600 user = vmail } } service doveadm { client_limit = 1 inet_listener http { address = localhost port = 8180 } process_min_avail = 1 unix_listener doveadm-server { mode = 0600 user = vmail } user = vmail } service imap-login { process_limit = 4096 process_min_avail = 10 service_count = 1 } service imap { process_limit = 4096 } service lmtp { process_min_avail = 5 unix_listener /var/spool/postfix/private/dovecot-lmtp { group = postfix mode = 0600 user = postfix } user = vmail } service pop3-login { client_limit = 2048 } service quota-status { client_limit = 1 executable = quota-status -p postfix process_min_avail = 5 unix_listener /var/spool/postfix/private/dovecot-quota-status { group = postfix mode = 0600 user = postfix } user = vmail } ssl_ca = </etc/pki/tls/cert.pem ssl_cert = </etc/pki/o/default.pem ssl_cipher_list = HIGH:!aNULL:!SSLv2:!ADH:!EXP:!eNULL:!RC4:!MEDIUM:!LOW ssl_dh = # hidden, use -P to show it ssl_key = # hidden, use -P to show it ssl_prefer_server_ciphers = yes userdb { driver = prefetch } userdb { args = /etc/dovecot/local-sql.conf driver = sql } verbose_proctitle = yes protocol lmtp { mail_plugins = quota sieve } protocol imap { mail_max_userip_connections = 50 mail_plugins = quota imap_quota } Kind regards, Libor

1 0

Question Regarding The 'poolp' Guide On How To Deploy A Mail Server's Last Portion Regarding Dovecot With 'sieve' Scripts
by Samuel Banya 18 Jun '21

18 Jun '21

Hello everyone, I've been following the "poolp" guide on how to deploy an email server on OpenBSD: - https://poolp.org/posts/2019-09-14/setting-up-a-mail-server-with-opensmtpd-… I'm currently at the very end of the guide in which he is using sieve with Dovecot to do some final filtering. The unfortunate thing is that when I run these two commands in the '/usr/local/lib/dovecot/sieve' directory: sievec report-ham.sieve sievec report-spam.sieve I'm getting the following error: # sievec report-ham.sieve report-ham: line 1: error: require command: unknown Sieve capability `vnd.dovecot.pipe'. report-ham: line 1: error: require command: unknown Sieve capability `imapsieve'. report-ham: line 15: error: unknown command 'pipe' (only reported once at first occurrence). report-ham: error: validation failed. sievec(root): Fatal: failed to compile sieve script 'report-ham.sieve' # sievec report-spam.sieve report-spam: line 1: error: require command: unknown Sieve capability `vnd.dovecot.pipe'. report-spam: line 1: error: require command: unknown Sieve capability `imapsieve'. report-spam: line 7: error: unknown command 'pipe' (only reported once at first occurrence). report-spam: error: validation failed. sievec(root): Fatal: failed to compile sieve script 'report-spam.sieve' What's interesting is that this same post has the same exact error, and I tried his workaround which did NOT work unfortunately: - http://dovecot.2317879.n4.nabble.com/sieve-compile-error-td70414.html This is what was present BEFORE my changes in ' plugin { sieve_plugins = sieve_imapsieve sieve_extprograms sieve_global_extensions = +vnd.dovecot.pipe +vnd.dovecot.environment imapsieve_mailbox1_name = Junk imapsieve_mailbox1_causes = COPY APPEND imapsieve_mailbox1_before = file:/usr/local/lib/dovecot/sieve/report-spam.sieve imapsieve_mailbox2_name = * imapsieve_mailbox2_from = Junk imapsieve_mailbox2_causes = COPY imapsieve_mailbox2_before = file:/usr/local/lib/dovecot/sieve/report-ham.sieve imapsieve_mailbox3_name = Inbox imapsieve_mailbox3_causes = APPEND imapsieve_mailbox3_before = file:/usr/local/lib/dovecot/sieve/report-ham.sieve sieve_pipe_bin_dir = /usr/local/lib/dovecot/sieve } This is what was present AFTER my changes in '/etc/dovecot/conf.d/90-plugin.conf' (aka I followed this post's workaround http://dovecot.2317879.n4.nabble.com/sieve-compile-error-td70414.html) plugin { sieve_plugins = sieve_imapsieve sieve_extprograms sieve_global_extensions = +vnd.dovecot.environment +vnd.dovecot.debug +vnd.dovecot.pipe imapsieve_mailbox1_name = Junk imapsieve_mailbox1_causes = COPY APPEND imapsieve_mailbox1_before = file:/usr/local/lib/dovecot/sieve/report-spam.sieve imapsieve_mailbox2_name = * imapsieve_mailbox2_from = Junk imapsieve_mailbox2_causes = COPY imapsieve_mailbox2_before = file:/usr/local/lib/dovecot/sieve/report-ham.sieve imapsieve_mailbox3_name = Inbox imapsieve_mailbox3_causes = APPEND imapsieve_mailbox3_before = file:/usr/local/lib/dovecot/sieve/report-ham.sieve sieve_pipe_bin_dir = /usr/local/lib/dovecot/sieve } Any ideas on what I can do? Please let me know if this is better suited for the OpenSMTPD mailing list instead though.

1 0

Multiple non-plaintext mechanisms using multiple passdbs.
by Jesús Ángel del Pozo Domínguez 17 Jun '21

17 Jun '21

Hi there, Although I have set up TLS in my Dovecot installation, I would like to also set up some non-plaintext authentication mechanism, specifically CRAM-MD5 and SCRAM-SHA-1. As I read in the documents, "The problem with non-plaintext auth mechanisms is that the password must be stored either in plaintext, or using a mechanism-specific scheme that’s incompatible with all other non-plaintext mechanisms". I will not be storing the user's passwords in plaintext, so I will have to use different mechanism-specific hash schemes. I was wondering whether it would be possible to have several auth databases, one for each non-plaintext mechanism. Well, in reality, I will have just one database with multiple hashes: SHA512-CRYPT, CRAM-MD5 and SCRAM-SHA-1 but then I am going to set up three different passdb instances in dovecot, each one with its own SQL configuration. For example: passdb { driver = sql args = /etc/dovecot/dovecot-sql-plain.conf.ext } passdb { driver = sql args = /etc/dovecot/dovecot-sql-cram-md5.conf.ext } passdb { driver = sql args = /etc/dovecot/dovecot-sql-scram-sha-1.conf.ext } Most users would use TLS and PLAIN as authentication mechanism so the last two password databases will not be used at all. However, those users using CRAM-MD5 or SCRAM-SHA-1 would try the other databases. My users table would be somewhat like this: CREATE TABLE users ( username VARCHAR(128) NOT NULL, domain VARCHAR(128) NOT NULL, password VARCHAR(77) NOT NULL, password_cram_md5 VARCHAR(74) NOT NULL, password_scram_sha_1 VARCHAR(100) NOT NULL, home VARCHAR(255) NOT NULL, uid INTEGER NOT NULL, gid INTEGER NOT NULL, active CHAR(1) DEFAULT 'Y' NOT NULL ); username: foo(a)bar.com domain: bar.com password: {SHA512-CRYPT}$6$Mih5.y90z...CqxX2LxfMJMqoC42NvBK1 password_cram_md5: {CRAM-MD5}a457...2a74f63442e7473e9576cf2e password_scram_sha_1: {SCRAM-SHA-1}4096,4...9AYjadouwXqiqc3UM= Obviously, the SQL query in each dovecot-sql-....ext file would be different. For instance: /etc/dovecot/dovecot-sql-plain.conf.ext default_pass_scheme = SHA512-CRYPT password_query = \ SELECT username, domain, password, home AS userdb_home, uid AS userdb_uid FROM users WHERE username = '%n' AND domain = '%d' /etc/dovecot/dovecot-sql-cram-md5.conf.ext default_pass_scheme = CRAM-MD5 password_query = \ SELECT username, domain, password_cram_md5 AS password, home AS userdb_home, uid AS userdb_uid FROM users WHERE username = '%n' AND domain = '%d' /etc/dovecot/dovecot-sql-scram-sha-1.conf.ext default_pass_scheme = SCRAM-SHA-1 password_query = \ SELECT username, domain, password_scram_sha_1 AS password, home AS userdb_home, uid AS userdb_uid FROM users WHERE username = '%n' AND domain = '%d' Could you please tell me whether this set up would work? Do you believe is worth the complexity or maybe I had better keep it more simple and use just PLAIN auth with TLS? Cheers, Jesús Ángel

1 0

Mapping usernames used for authentication to UNIX usernames
by Frank Volf 17 Jun '21

17 Jun '21

Hi, I'm looking for some advice or pointers how to best solve a small problem that I have. I have no doubt that this can be done in dovecot, but I'm struggling to find the easiest way to implement it. First of all, what I have: I have a relative small dovecot setup for a dozen domains, and about 50 users in total. All users use IMAP to retrieve mail, and SMTP submission protocol to submit email. Because of the small size, every user has its own UNIX account, authentication is done using PAM and mail is stored in a Maildir folder in their home directory. Works perfectly! There is one minor inconvenience. When a new mail client is configured, users (often guided by the auto config generator of the mail client) tend to use their email address as the username to authenticate instead of their UNIX account name, which fails of course. Would it be possible to configure something that will map an email address to the UNIX account name and use the account name for authentication and obtaining the related information (uid, gid, home dir)? I do have two concerns: 1) I do not want to break existing mail configurations, so authentication with the UNIX username should still be possible. 2) I cannot do a simple reg. exp for the translation because every email domain has e.g. an info(a)domain.com mailbox, and I do not want them all to go to UNIX user "info". As said, I would appreciate any advice on how this can be configured the easiest. Thanks in advance. Kind regards, Frank

4 3

Re: N-way replication, multiple masters
by Henry 17 Jun '21

17 Jun '21

1 GB data per day is very little volume ,I think dovecot replication, rsync also suitable. Hi Mail replication – honestly, I don’t have any hard metrics for that. I’m anticipating its less than 1 GB per day. Link speed – being AWS inter AZ its 100Mbps-1GBps. I’m conscious if I go inter region the strategy may need to change. Thanks Raymond Raymond Sellars (<raymond.sellars(a)orionhealth.com>) 在 2021年6月17日星期四上午11:30:23 [GMT+8] 寫道： #yiv6469694122 #yiv6469694122 -- _filtered {} _filtered {} _filtered {} _filtered {} _filtered {}#yiv6469694122 #yiv6469694122 p.yiv6469694122MsoNormal, #yiv6469694122 li.yiv6469694122MsoNormal, #yiv6469694122 div.yiv6469694122MsoNormal {margin:0cm;font-size:11.0pt;font-family:sans-serif;}#yiv6469694122 a:link, #yiv6469694122 span.yiv6469694122MsoHyperlink {color:blue;text-decoration:underline;}#yiv6469694122 span.yiv6469694122EmailStyle19 {font-family:sans-serif;color:#1F497D;font-weight:normal;font-style:normal;}#yiv6469694122 .yiv6469694122MsoChpDefault {font-size:10.0pt;} _filtered {}#yiv6469694122 div.yiv6469694122WordSection1 {}#yiv6469694122 Hi Mail replication – honestly, I don’t have any hard metrics for that. I’m anticipating its less than 1 GB per day. Link speed – being AWS inter AZ its 100Mbps-1GBps. I’m conscious if I go inter region the strategy may need to change. Thanks Raymond From: Henry <hl1723(a)yahoo.com.hk> Sent: Thursday, 17 June 2021 3:20 PM To: Raymond Sellars <raymond.sellars(a)orionhealth.com> Subject: Re: N-way replication, multiple masters How many data for mail replication ? and the link speed? Raymond Sellars (<raymond.sellars(a)orionhealth.com>) 在 2021年6月17日星期四上午11:10:23 [GMT+8] 寫道：

1 0

N-way replication, multiple masters
by Raymond Sellars 17 Jun '21

17 Jun '21

Hi Looking for some guidance on how to setup a dovecot cluster with more than 2 servers. Ideally as multiple masters so I don't have the complexity of back recovery/synchronisation in failover situations. And I can utilised upstream load balancers (director or other) to automatically move between available nodes. Current pattern is: High availability at one site (AWS availability zone) with two active servers behind dovecot directors and an AWS network load balancer in front of the directors. A third dovecot server as a disaster recovery instance (another availability zone or region), with ideally real time and bidirectional replication. Behind a different network and NLB access path. Dovecot --version = 2.3.14 Centos 7 Previously for the HA pair we utilised NFS but the AWS EFS equivalent doesn't perform ( very high latency and NFS meta data caching required). And then for DR we utilised the dovecot replication. 2 way so I have automated recovery and could do active active testing/verification as required with no down time. This help verify recovery pathways. https://doc.dovecot.org/configuration_manual/replication/# - reading the documentation is seems clear that replication only supports a PAIR of masters. Any ideas on how I can add in a 3rd replication node? Two pairs? I'm happy to utilise a star pattern. HA 1 <-> HA2, HA 1 <-> DR. Not possible? Can I run more than one replicator? Or should I utilise doveadm sync via cron jobs and 2-way sync. Any thoughts, suggestions most welcome. How are others achieving > 2 clusters for dovecot servers supporting the same domain? Most of this is for availability rather than purely performance scaling. Thanks Raymond

1 0

working locally not externally, how to check what failed?
by Voytek Eymont 17 Jun '21

17 Jun '21

this morning I noticed not getting any email on remote to server mail client, though, in webmail/squirellmail on mail host there were new emails restarting with doveadm stop/dovecot 'fixed it' what could've gone wrong, what to look for in the logs ? thanks for any pointers long running dovecot/postfix/mysql setup dovecot --version 2.3.14 (cee3cbc0d)

1 0

Piping to doveadm pw
by Kevin N. 16 Jun '21

16 Jun '21

Hello everybody, I am using 'doveadm pw' from inside a bash script to generate the salted hash for a user provided password. I call it like: doveadm pw -s SHA256-CRYPT -u $user -p $password Is there any possible way to use piping (so it won't show up in ps for example) to pass the username and password to 'doveadm pw' instead of using arguments? Dovecot version: 2.3.14 Many thanks, Kevin

3 4

LMTP with hardlinks ?
by Vladislav Kurz 16 Jun '21

16 Jun '21

Hello, I'm looking for deduplication of mails via hardlinks during delivery. I.e. a mail that is sent to multiple recipients (to, cc, bcc) should be stored only once. I did some search and found only some non-complete information. dovecot-lda has a "-p path" option that does the delivery using symlinks if possible (i.e. same uid/gid and same filesystem). This is working by hand, but could not find any hints how to use this with postfix. Found only suggestion of a wrapper, that was probably never implemented - in this thread: https://dovecot.org/pipermail/dovecot/2008-June/031158.html In this message: https://dovecot.org/list/dovecot/2013-February/088540.html there is statement that: LMTP always delivers the mail to the first user. Then it tries to copy the first mail to the second user, because in some setups this can be done using hard links. I was not able to get this in my setup, and I'd like to know if this statement is really true. I have all mail in /var/vmail, all owned by vmail user, but still mail delivered to multiple users is duplicated. If this is really supposed to make hardlinks (which would be great), is there any way to debug it? E.g. see if the hardlink was attempted but failed for some reason, or if the message was delivered in the same LMTP session ? -- Best Regards Vladislav Kurz

1 1

lda to lmtp
by Laura Steynes 14 Jun '21

14 Jun '21

Hi, Although dovecot-lda serves us fine, we only average 8k messages an hour, peaking at 11k, over 4 machines (mostly for redundancy, we've run this fine on just 1 machine, but sometimes clamav makes things get upset, so we added some more especially since we are growing rapidly, we decided to see if lmtp would be of benefit, so far, we cant tell any difference, I guess it is only 120-130 messages a minute, maybe if we were doing 200 a minute we might see gain? The question is with lda we used postfix settings destination_recipient_limit=1, we have not added this with lmtp,is this needed?

6 9

sieve not updating headers?
by Daniel J. Luke 13 Jun '21

13 Jun '21

Hello, I've recently converted from using procmail as an lda to using lmtp+sieve (and it's overall great). My setup is currently doing post-queue spamassassin to pickup user rules (and to be substantially similar to how it worked before). It mostly works, but I get some mail forwarded from another host that also runs spamassassin, so the mail comes with X-Spam headers already set. I can see that my sieve_before script successfully sends the message off to spamc/spamd - however the message ends up in my mailbox with only the pre-existing X-Spam headers (I had expected them to be replaced or to see duplicates). I thought I'd try to just strip them from incoming mail so I used deleteheader, I got a trace saying it matches and deletes the headers, then sends the mail off to spamc/spamd - but the message that ends up in my mailbox has the headers that were presumably deleted. My before.sieve looks like this: require ["vnd.dovecot.filter","editheader"]; # rule:[spamfilter] if size :under 10485760 { deleteheader :matches "X-Spam-Flag" "*"; deleteheader :matches "X-Spam-Status" "*"; deleteheader :matches "X-Spam-Level" "*"; deleteheader :matches "X-Spam-Checker-Version" "*"; filter "spamc" ["-s","10485760","-U","/var/run/spamd.sock"]; } Trace file says: ## Started executing script 'before' 6: size :under test 6: comparing message size 4197 6: with lower limit 10485760 6: jump if result is false 6: not jumping 11: deleteheader command 11: deleting matching occurrences of header `X-Spam-Flag' 11: header `X-Spam-Flag' not found 12: deleteheader command 12: deleting matching occurrences of header `X-Spam-Status' 12: starting `:matches' match with `i;ascii-casemap' comparator: 12: matching value `No, score=-0.2 required=5.0 tests=DKIM_SIGNED,DKIM_VALID, DKIM_VALID_AU,DKIM_.. .' 12: with key `*' => 1 12: deleting header with value `No, score=-0.2 required=5.0 tests=DKIM_SIGNED,DKIM_VALID, DKIM_VALI D_AU,DKIM_VALID_EF,FREEMAIL_FROM,HTML_MESSAGE, RCVD_IN_DNSWL_NONE,SPF_HELO_NONE,SPF_PASS autolearn=ham au tolearn_force=no version=3.4.2' 12: finishing match with result: matched 13: deleteheader command 13: deleting matching occurrences of header `X-Spam-Level' 13: header `X-Spam-Level' not found 14: deleteheader command 14: deleting matching occurrences of header `X-Spam-Checker-Version' 14: starting `:matches' match with `i;ascii-casemap' comparator: 14: matching value `SpamAssassin 3.4.2 (2018-09-13) on braeburn.macports.org' 14: with key `*' => 1 14: deleting header with value `SpamAssassin 3.4.2 (2018-09-13) on braeburn.macports.org' 14: finishing match with result: matched 16: filter action 16: execute program `spamc' 16: executed program successfully 16: changed message ## Finished executing script 'before' It then falls through my personal sieve filter and hits the implicit keep at the end and ends up in my inbox - with the original headers. So, two questions: 1. What am I missing? 2. Is there a way to match any X-Spam-* header? (when I tried deleteheader :matches "X-Spam*" it didn't match anything). Thanks. -- Daniel J. Luke

4 6

Use of Sieve with Dovecot not possible cause of error
by DarkFish82 12 Jun '21

12 Jun '21

**What happened?** The description of the problem concerns the Thunderbird but also the stand alone version and other sieve editors. I would like to edit Sieve via the plugin/program. My mail account works without problems and can also send/receive. Creating a new account is possible without any problems. As soon as I click on "Connect", the loading bar is permanently there and nothing happens. I have activated debugging in the settings, but I don't know where it is saved. if someone tells me, I can submit the required log later. **Settings** Settings from Sieve: Server imap.xxxxxx.eu: 4190 (Secured connection) Username my(a)fancydomain.eu **Logs** dovecot-mailcow_1 | May 9 02:47:16 04888203e1b5 dovecot: managesieve-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=92.123.123.123, lip=123.123.123.123, TLS handshaking: SSL_accept() failed: error:14094412:SSL routines:ssl3_read_bytes:sslv3 alert bad certificate: SSL alert number 42 **What i tried?** 1. gnutls-cli --starttls -p 4190 imap.xxxxxx.eu Output: `Processed 129 CA certificate(s). Resolving "imap.xxxxxxxxx.eu:4190"... Connecting to "2a03:4000:34:522:981b:xxxx:xxxx:xxxx:4190"... Simple Client Mode: "IMPLEMENTATION" "Dovecot Pigeonhole" "SIEVE" "fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext vacation-seconds editheader imapflags notify imapsieve vnd.dovecot.imapsieve" "NOTIFY" "mailto" "SASL" "" "STARTTLS" "VERSION" "1.0" OK "Dovecot ready."` 2. telnet xxx.xxx.xxx.xxx 4190 output: Connected to xxx.xxx.xxx.xxx. Escape character is "^]". "IMPLEMENTATION" "Dovecot Pigeonhole" "SIEVE" "fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext vacation-seconds editheader imapflags notify imapsieve vnd.dovecot.imapsieve" "NOTIFY" "mailto" "SASL" "" "STARTTLS" "VERSION" "1.0" OK "Dovecot ready." 3. Added in dovecot.conf in "service managesieve-login" "ssl = no" and after that "ssl = true" but also not working. dovecot config: service managesieve-login { inet_listener sieve { port = 4190 ssl = no } inet_listener sieve_haproxy { port = 14190 haproxy = yes } service_count = 1 process_min_avail = 2 vsz_limit = 1G } **OS/Software Informations** Client Thunderbird: OS: Windows 10 Sieve Version: 0.5.3 Thunderbird Version: 78.11.0 Client Standalone: OS: Windows 10 Sieve Version: 0.5.2 Mailcow: OS: Ubuntu 20.04 Mailcow Versions: acme-mailcow (mailcow/acme:1.78) clamd-mailcow (mailcow/clamd:1.39) dockerapi-mailcow (mailcow/dockerapi:1.38) dovecot-mailcow (mailcow/dovecot:1.145) ejabberd-mailcow (mailcow/ejabberd:1.5) ipv6nat-mailcow (robbertkl/ipv6nat) memcached-mailcow (memcached:alpine) mysql-mailcow (mariadb:10.5) netfilter-mailcow (mailcow/netfilter:1.41) nginx-mailcow (nginx:mainline-alpine) olefy-mailcow (mailcow/olefy:1.7) php-fpm-mailcow (mailcow/phpfpm:1.74) postfix-mailcow (mailcow/postfix:1.61) redis-mailcow (redis:5-alpine) rspamd-mailcow (mailcow/rspamd:1.76) sogo-mailcow (mailcow/sogo:1.98) solr-mailcow (mailcow/solr:1.7) unbound-mailcow (mailcow/unbound:1.13) watchdog-mailcow (mailcow/watchdog:1.91) -- Sent from: http://dovecot.2317879.n4.nabble.com/

1 0

Shared Mailboxes in Dovecot Cluster & director configuration
by Vincent Brillault 10 Jun '21

10 Jun '21

Hi! I've been trying to set a shared namespace on a test dovecot cluster and I've had some weird issues. I'm not sure if this is a feature or a bug, so please advice. As some features (like acl_ignore_namespace) are only in the upcoming 2.3.15, after some initial debugging, I've update the system I'm using to the master branches (df1b4b8750fdb87d38ac9accb8a1dea02ac3ce2e for core and 7090e62564bcb7bff7efc89bd2a42b1d32d9e475 for pigeonhole), but it didn't change the initial issues I was having. I've been following https://doc.dovecot.org/configuration_manual/shared_mailboxes/cluster_setup/ and linked documentations to set up the cluster. You'll find at the end of the mail the parts of the configuration that seems to be relevant. The issues I've had was with the `You’ll need to setup master user logins to work for all the users.` and `imapc_master_user` (for which the bullet points recommend to use `%{userdb:sharing_user}` but is then set to `%u` in the example. For the sake of the tests, I'm using one director and one backend. On this installation: - user1 shared the folder 'Junk' with user2 - after logging as user2, I run `a2 SELECT shared/user1/Junk` Initially on the director, I had (excluding other, unrelated configuration): ``` # Connection back from backends for shared mailbox access passdb { args = password=XXXX allow_nets=${IPs of backend} driver = static master = yes mechanisms = plain result_success = continue } ``` However, this lead to login failures on the director as the backend was logging directly as user1, without master user set! After further debugging, I now have on the director: ``` # Connection back from backends for shared mailbox access passdb { args = password=XXXX allow_nets=${IPs of backend} driver = static master = yes mechanisms = plain result_success = continue } passdb { args = password=XXXX allow_nets=${IPs of backend} driver = static mechanisms = plain result_success = continue } ``` And this works! Looking at the log, it's not that my `imapc_master_user` is not recognized, just that there are two imapc connections from the backend to the frontend. - The first one logs as user1 directly, with no master user set: ``` ${backend} dovecot[29900]: imap(user2)<29917><Mi/7WD/EgYi8uE1E>: Debug: imapc(${director}:993): Authenticating as user1 ``` - The second connection logs as expected, as user1 with user2 set as the master user: ``` ${backend} dovecot[29900]: imap(user2)<29917><Mi/7WD/EgYi8uE1E>: Debug: imapc(${director}:993): Authenticating as user2 for user user1 ``` Is it normal to have these two connections back to the director? From the documentation, I would have only expected the 2nd one. Going further, if I add a static part to imapc_master_user, like for example `imapc_master_user = X%{userdb:sharing_user}`, the logged authentications become: ``` ${backend} dovecot: imap(user2)<31073><xu94pz/EqYi8uE1E>: Debug: imapc(${director}:993): Authenticating as X for user user1 [...] ${backend} dovecot: imap(user2)<31073><xu94pz/EqYi8uE1E>: Debug: imapc(${director}:993): Authenticating as Xuser2 for user user1 ``` It looks to me that for the first connection, imapc_master_user is resolved with the wrong context, without `userdb:sharing_user` resolving to anything? Thanks in advance, let me know if you need more details. Vincent Brillault PS configuration details (relevant parts of doveconf -n): - Backend: ``` auth_master_user_separator = * imapc_features = fetch-bodystructure fetch-headers rfc822.size search modseq imapc_host = ${director} imapc_master_user = %{userdb:sharing_user} imapc_password = # hidden, use -P to show it imapc_port = 993 imapc_sasl_mechanisms = plain imapc_ssl = imaps imapc_ssl_verify = no mail_plugins = acl zlib virtual fts fts_solr namespace { list = children location = imapc:~/shared/%%u prefix = shared/%%u/ type = shared } namespace Virtual { hidden = yes list = no location = virtual:/etc/dovecot/virtual:INDEX=~/virtual prefix = Virtual/ separator = / subscriptions = no } namespace inbox { inbox = yes location = mailbox "Deleted Items" { auto = subscribe special_use = \Trash } mailbox Drafts { auto = subscribe special_use = \Drafts } mailbox "Sent Items" { auto = subscribe special_use = \Sent } mailbox Spam { auto = create special_use = \Junk } prefix = } passdb { args = password=#hidden_use-P_to_show# allow_nets=${IPs of director} userdb_namespace/shared/disabled=yes driver = static master = yes } passdb { args = password=#hidden_use-P_to_show# allow_nets=${IPs of director} userdb_sharing_user=%u driver = static } plugin { acl = vfile:/etc/dovecot/dovecot-acl acl_ignore_namespace = Virtual/ acl_ignore_namespace2 = shared/* acl_shared_dict = file:/mail/sharing/shared-mailboxes [...] } ``` - Director (final & working version): ``` auth_master_user_separator = * auth_mechanisms = plain login xoauth2 oauthbearer gssapi auth_socket_path = director-userdb passdb { args = /etc/dovecot/passdb-masterusers.conf.ext driver = ldap master = yes mechanisms = plain login result_success = continue } passdb { args = password=#hidden_use-P_to_show# allow_nets=${IPs of backend} driver = static master = yes mechanisms = plain result_success = continue } passdb { args = password=#hidden_use-P_to_show# allow_nets=${IPs of backend} driver = static mechanisms = plain result_success = continue } passdb { args = /etc/dovecot/passdb-oauth2.conf.ext driver = oauth2 mechanisms = xoauth2 oauthbearer result_failure = return-fail result_internalfail = return-fail result_success = continue } passdb { args = /etc/dovecot/passdb-cerndc.conf.ext driver = ldap } ```

2 2

2.3.13 broken submission relay smtp parser
by Tony Hain 09 Jun '21

09 Jun '21

I have a new install of dovecot 2.3.13, along with exim 4.94, in an Azure hosted FreeBSD 12.2 VM. I have been running exim on local hardware with FreeBSD for 15+ years, but dovecot and Azure are a new "learning experience". I am getting an error response in dovecot.log when trying to use the submission relay function, which is apparently new in 2.3... It would appear the parser is either broken or has a character set limitation that no other smtp implementation has. I finally gave up trying to figure out what I might have done wrong in setting up exim and pointed dovecot at mailjet and got the same error. Jun 08 19:39:42 submission(testing(a)dispatch.tndh.net)<89538><lOfAL0zEFNmsOCrh>: Warning: smtp-client: conn in-v3.mailjet.com:587 (104.199.96.85:587) [1]: Received invalid EHLO response line: Unexpected character in EHLO keyword Jun 08 19:39:42 submission(testing(a)dispatch.tndh.net)<89538><lOfAL0zEFNmsOCrh>: Warning: smtp-client: conn in-v3.mailjet.com:587 (104.199.96.85:587) [1]: Received invalid EHLO response line: Unexpected character in EHLO keyword I didn't try the mailjet path with telnet, but I had done that earlier with the local exim server and I can't see any invalid characters, even in the tcpdump pcap file. Jun 08 10:49:42 submission(testing(a)dispatch.tndh.net)<29791><j8NnyETEqV2sOCq3>: Warning: smtp-client: conn 127.0.0.1:58 [1]: Received invalid EHLO response line: Unexpected character in EHLO keyword # telnet localhost 58 Trying 127.0.0.1... Connected to localhost. Escape character is '^]'. 220 secure smtp server ehlo dovecot.tndh.net 250-exim.tndh.net Hello dovecot.tndh.net [127.0.0.1] 250-SIZE 536870912 250-8BITMIME 250-VRFY 250-PIPELINING 250-X_PIPE_CONNECT 250-AUTH CRAM-MD5 250-CHUNKING 250-SMTPUTF8 250 HELP This might be some confusion about starttls on the mailjet path, but if that is true the error message is wrong; and it wouldn't be true for the local exim open smtp port. If it really is smtp, it would be most helpful if the error message actually reported what string it is taking issue with. I have the dovecot-sysreport, but I am not encouraged about sending it when stdout presented: # dovecot-sysreport Gathering configurations ... grep: The -P option is not supportedgrep: The -P option is not supported grep: The -P option is not supported Gathering system informations ... Creating archive ... All done! Please report file dovecot-sysreport-TNDH-mail-1623209001.tar.gz Removing temp files at /tmp/tmp.kphlba44 ... # While dovecot -n stdout presented the line: ssl_key = # hidden, use -P to show it expecting people to put sensitive configuration on a public mail list without knowing what the tool is including is a challenge, but when the tool is errantly using the command line option that is also used for exposing the private data by a related tool, it is even less likely that I want to do that. While the dovecot -n option did hide passwords, it did not hide the username associated with that. I will put dovecot -n (redacted) here, but until I have time to see exactly what the sysreport included, I am not releasing that. # 2.3.13 (89f716dc2): /usr/local/etc/dovecot/dovecot.conf # Pigeonhole version 0.5.13 (cdd19fe3) # OS: FreeBSD 12.2-RELEASE-p4 amd64 ufs # Hostname: TNDH-mail.g4msrgoph2uevil3ys5jvbbpza.jx.internal.cloudapp.net auth_debug = yes auth_debug_passwords = yes auth_verbose = yes debug_log_path = /var/log/dovecot-debug.log disable_plaintext_auth = no first_valid_uid = 220 hostname = dispatch.tndh.net imap_idle_notify_interval = 20 mins info_log_path = /var/log/dovecot-info.log last_valid_uid = 220 log_debug = (event=* AND cat=*) log_path = /var/log/dovecot.log login_greeting = tndh.net Mailer Server Ready ... login_trusted_networks = 127.0.0.1 10.0.0.4 mail_debug = yes mail_location = maildir:/usr/local/var/dovecot/vhosts/%d/%n mail_plugins = mail_log notify notify_status managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext namespace inbox { inbox = yes location = mailbox Drafts { auto = subscribe special_use = \Drafts } mailbox Junk { auto = subscribe special_use = \Junk } mailbox Sent { auto = subscribe special_use = \Sent } mailbox Trash { auto = subscribe special_use = \Trash } mailbox virtual/Flagged { auto = subscribe special_use = \Flagged } prefix = separator = / type = private } passdb { args = username_format=%n /usr/local/var/dovecot/db/%d/passwd driver = passwd-file } plugin { expire = Trash mail_home = /usr/local/var/dovecot/vhosts/%d/%n mail_log_events = delete undelete expunge copy mailbox_delete mailbox_rename mail_log_fields = uid box msgid size recipient_delimiter = + sieve = /usr/local/var/dovecot/vhosts/%d/%n/sieve/.dovecot.sieve sieve_after = /usr/local/var/dovecot/vhosts/%d/%n/sieve/sieve-after.d sieve_before = /usr/local/var/dovecot/vhosts/%d/%n/sieve/sieve-before.d sieve_dir = /usr/local/var/dovecot/vhosts/%d/%n/sieve sieve_global_path = /usr/local/var/dovecot/vhosts/sieve/default.sieve } pop3_client_workarounds = outlook-no-nuls oe-ns-eoh protocols = imap pop3 lmtp submission service auth-worker { user = vmail } service imap-login { inet_listener imap { port = 143 } inet_listener imaps { port = 993 ssl = yes } } service stats { unix_listener stats-writer { mode = 0666 } } service submission-login { inet_listener submission { port = 465 ssl = yes } } ssl_cert = </usr/local/etc/dovecot/ssl/certs/dovecot.pem ssl_key = # hidden, use -P to show it submission_relay_host = in-v3.mailjet.com submission_relay_password = # hidden, use -P to show it submission_relay_port = 587 submission_relay_rawlog_dir = /var/log submission_relay_ssl = starttls submission_relay_user = **-as-if-I-want-this-on-a-public-list-** userdb { args = username_format=%n /usr/local/var/dovecot/db/%d/passwd driver = passwd-file } verbose_ssl = yes protocol lmtp { mail_fsync = optimized mail_plugins = mail_log notify notify_status sieve } protocol imap { mail_max_userip_connections = 10 mail_plugins = mail_log notify notify_status imap_sieve } protocol pop3 { mail_max_userip_connections = 10 mail_plugins = mail_log notify notify_status } protocol lda { mail_fsync = optimized mail_plugins = mail_log notify notify_status sieve }

3 5

Dovecot Subfolder Always Uses dot separator with mdbox
by Steven Smith 09 Jun '21

09 Jun '21

I’m trying to configure dovecot to use mailbox subfolders that look like both foo/bar on the IMAP client and the filesystem. But the subfolders created all look like foo.bar, not foo/bar with a proper nesting structure. This also happens when the folder ‘bar’ is moved into the folder ‘foo’—A new folder `foo.bar’ is created. I believe that i’m following the configuration rules at https://wiki.dovecot.org/MailboxFormat/Maildir#Maildir_and_filesystems and https://wiki.dovecot.org/MailLocation/Maildir. This issue happens whether I set separator to its default, ‘.’, or ‘/’: > mail_location = mdbox:/private/var/mail/tld.hostname.mail/%Ln/mdbox:LAYOUT=fs > namespace inbox { > … > separator = / > … > } The IMAP client is macOS Mail.app version 14.0. I’d greatly appreciate any help or pointers to fix this configuration issue. dovecot -n > # 2.3.13 (): /opt/local/etc/dovecot/dovecot.conf > # Pigeonhole version 0.5.13 () > # OS: Darwin 20.4.0 x86_64 apfs > # Hostname: mail.hostname.tld > aps_topic = com.apple.mail.XServer.ffffffff-ffff-fff-ffffffffff > auth_cache_size = 10 M > auth_gssapi_hostname = $ALL > auth_krb5_keytab = /opt/local/etc/dovecot/imap.keytab > auth_mechanisms = plain gssapi > auth_realms =mail.hostname.tld > auth_socket_path = /opt/local/var/run/dovecot/auth-userdb > auth_username_format = %Ln > debug_log_path = /opt/local/var/log/mail/mail-debug.log > disable_plaintext_auth = no > first_valid_gid = 6 > first_valid_uid = 6 > imap_id_log = * > imap_id_send = "name" * "version" * > imap_idle_notify_interval = 29 mins > imap_urlauth_submit_user = submit > info_log_path = /opt/local/var/log/mail/mail-info.log > last_valid_gid = 100 > lda_mailbox_autocreate = yes > log_path = /opt/local/var/log/mail/mail-err.log > login_log_format_elements = user=<%u> method=%m rip=%r lip=%l mpid=%e %c > mail_access_groups = mail > mail_attachment_dir = /private/var/mail/tld.hostname.mail/attachments > mail_attachment_fs = sis posix:mode=0666 > mail_gid = mail > mail_home = /private/var/mail/tld.hostname.mail > mail_location = mdbox:/private/var/mail/tld.hostname.mail/%Ln/mdbox:LAYOUT=fs > mail_log_prefix = "%s(pid %p user %u): " > mail_plugins = quota zlib acl fts fts_solr fts_lucene > mail_privileged_group = mail > mail_uid = _dovecot > managesieve_notify_capability = mailto > managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext imapsieve vnd.dovecot.imapsieve > mdbox_rotate_size = 200 M > namespace inbox { > inbox = yes > location = > mailbox Archive { > auto = subscribe > special_use = \Archive > } > mailbox Drafts { > auto = subscribe > special_use = \Drafts > } > mailbox Junk { > auto = create > special_use = \Junk > } > mailbox Notspam_train { > auto = create > special_use = \Junk > } > mailbox Sent { > auto = subscribe > special_use = \Sent > } > mailbox "Sent Messages" { > special_use = \Sent > } > mailbox Spam_train { > auto = create > special_use = \Junk > } > mailbox Trash { > auto = create > special_use = \Trash > } > prefix = > separator = / > } > passdb { > driver = pam > name = pam > } > plugin { > fts = solr > fts_autoindex = yes > fts_autoindex_exclude = \Junk > fts_solr = url=http://127.0.0.1:8983/solr/dovecot/ > imapsieve_mailbox1_before = file:/opt/local/etc/dovecot/sieve/report-spam.sieve > imapsieve_mailbox1_causes = COPY APPEND > imapsieve_mailbox1_name = Spam_train > imapsieve_mailbox2_before = file:/opt/local/etc/dovecot/sieve/report-ham.sieve > imapsieve_mailbox2_causes = COPY APPEND > imapsieve_mailbox2_name = Notspam_train > mail_log_events = delete undelete expunge copy mailbox_delete mailbox_rename > mail_log_fields = uid box msgid from subject size flags > quota_grace = 10%% > quota_rule = *:storage=16G > quota_rule2 = Trash:storage=+256M > quota_warning = storage=100%% quota-exceeded %u > quota_warning2 = storage=80%% quota-warning %u > recipient_delimiter = + > sieve = /private/var/mail/tld.hostname.mail/rules/%Ln/dovecot.sieve > sieve_after = /opt/local/etc/dovecot/sieve-after.d > sieve_before = /opt/local/etc/dovecot/sieve-before.d > sieve_dir = /private/var/mail/tld.hostname.mail/rules/%Ln/%u > sieve_global_extensions = +vnd.dovecot.pipe +vnd.dovecot.environment > sieve_pipe_bin_dir = /opt/local/etc/dovecot/sieve > sieve_plugins = sieve_imapsieve sieve_extprograms > sieve_quota_max_storage = 50M > } > postmaster_address = postmaster(a)hostname.tld > protocols = imap lmtp sieve > quota_full_tempfail = yes > sendmail_path = /opt/local/sbin/sendmail > service auth-worker { > group = mail > user = root > } > service auth { > extra_groups = _keytabusers > idle_kill = 15 mins > unix_listener /opt/local/var/spool/postfix/private/auth { > group = mail > mode = 0660 > user = _postfix > } > } > service dns-client { > unix_listener dns-client { > mode = 0600 > } > } > service imap-login { > inet_listener imap { > address = 127.0.0.1, ::1 > port = 143 > } > inet_listener imaps { > port = 993 > ssl = yes > } > process_min_avail = 6 > service_count = 0 > vsz_limit = 2 G > } > service imap { > process_limit = 200 > process_min_avail = 6 > } > service lmtp { > unix_listener /opt/local/var/spool/postfix/private/dovecot-lmtp { > group = mail > mode = 0660 > user = _postfix > } > } > ssl = required > ssl_ca = </opt/local/etc/certificates/cert.chain.pem > ssl_cert = </opt/local/etc/certificates/cert.cert.pem > ssl_cipher_list = ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256 > ssl_dh = # hidden, use -P to show it > ssl_key = # hidden, use -P to show it > ssl_min_protocol = TLSv1.2 > ssl_prefer_server_ciphers = yes > userdb { > driver = passwd > name = passwd > } > verbose_proctitle = yes > protocol lda { > mail_fsync = optimized > mail_plugins = quota zlib acl fts fts_solr fts_lucene sieve push_notify > } > protocol imap { > mail_max_userip_connections = 50 > mail_plugins = quota zlib acl fts fts_solr fts_lucene imap_acl imap_quota imap_zlib imap_sieve > } > protocol lmtp { > mail_fsync = optimized > mail_plugins = quota zlib acl fts fts_solr fts_lucene sieve > }

2 3

Correct procedure to convert Maildir format to Mdbox
by Marco Usai 09 Jun '21

09 Jun '21

Hi, I need to migrate mail from a shared hosting that stores mail in the Maildir format to another one that uses the Mdbox format. Both hosts use Dovecot, though I don't know what version, because neither has Dovecot command line/ssh utilities available. So I installed Debian 10.9 + Dovecot-imapd (ver.2.3.4.1 stable), then in "/etc/dovecot/conf.d/10-mail.conf" I changed "mail_location = mbox:~/mail:INBOX=/var/mail/%u" to "mail_location = mdbox:~/mdbox" and "#separator =" to "separator = /" . I moved the contents of the folder containing the mail in Maildir format to ~/Maildir/ and then I ran "dsync -v -u user mirror maildir:~/Maildir/". The only users on the system are root and a limited priviledges user, but on the Debian server I didn't recreate any mail account/user that existed on the source server. The conversion command is executed without showing errors: the resulting ~/mdbox folder has a size of 370 MB while the ~/Maildir/ folder was 456 MB. I would like to know if the procedure I followed is correct and if the absence of errors when the command is executed means that the conversion was successful, or if I need to do some other test/check to make sure the whole conversion process is ok. Thank you.

2 1

Panic -Dsync Replication
by Antonino Sidoti 07 Jun '21

07 Jun '21

Hi, I am seeing this; Jun 07 16:17:22 Warning: lmtp(nino(a)sidoti.id.au)<20211><vJkREfC5vWDzTgAAv/fbcw>: replication(nino(a)sidoti.id.au): Sync failure: Timeout in 2 secs Jun 07 16:17:22 Panic: replicator: data stack: Out of memory when allocating 268435496 bytes Jun 07 16:17:22 Fatal: replicator: master: service(replicator): child 77583 killed with signal 6 (core not dumped - https://dovecot.org/bugreport.html#coredumps) It started when I added the following to my configuration; replication_sync_timeout = 2 If I remove the above line then sync works properly and no errors. # 2.3.14 (cee3cbc0d): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.14 (1b5c82b2) # OS: OpenBSD 6.9 amd64 ffs # Hostname: obsd-mx1.stonyrange.com doveadm_password = # hidden, use -P to show it doveadm_port = 2727 hostname = mx1.stonyrange.com listen = * mail_gid = vmail mail_home = /var/vmail/%d/%n/Home mail_location = maildir:/var/vmail/%d/%n/Maildir mail_plugins = " notify replication" mail_uid = vmail managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext imapsieve vnd.dovecot.imapsieve namespace inbox { inbox = yes location = mailbox "Deleted Messages" { special_use = \Trash } mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } passdb { args = scheme=BLF-CRYPT /etc/mail/passwd driver = passwd-file } plugin { imapsieve_mailbox1_before = file:/usr/local/lib/dovecot/sieve/report-spam.sieve imapsieve_mailbox1_causes = COPY imapsieve_mailbox1_name = Junk imapsieve_mailbox2_before = file:/usr/local/lib/dovecot/sieve/report-ham.sieve imapsieve_mailbox2_causes = COPY imapsieve_mailbox2_from = Junk imapsieve_mailbox2_name = * mail_replica = tcp:108.160.141.103:2727 replication_sync_timeout = 2 sieve = file:~/sieve;active=~/.dovecot.sieve sieve_global_extensions = +vnd.dovecot.pipe +vnd.dovecot.environment sieve_pipe_bin_dir = /usr/local/lib/dovecot/sieve sieve_plugins = sieve_imapsieve sieve_extprograms } protocols = imap lmtp service aggregator { fifo_listener replication-notify-fifo { user = vmail } unix_listener replication-notify { user = vmail } } service auth { unix_listener auth-userdb { user = vmail } } service doveadm { inet_listener { port = 2727 } user = vmail } service imap-login { inet_listener imap { port = 0 } inet_listener imaps { port = 993 ssl = yes } } service managesieve-login { inet_listener sieve { port = 4190 } } service replicator { drop_priv_before_exec = yes process_min_avail = 1 unix_listener replicator-doveadm { mode = 0600 user = vmail } } ssl = required ssl_cert = </etc/ssl/stonyrange.com.fullchain.pem ssl_dh = # hidden, use -P to show it ssl_key = # hidden, use -P to show it userdb { args = /etc/mail/passwd driver = passwd-file } protocol imap { mail_plugins = " notify replication imap_sieve" } protocol lmtp { mail_plugins = " notify replication sieve" } Antonino Sidoti

2 3

Definitive guide to running ObjectiveFS on top of a Clustered File System?
by Roel van Duijnhoven 06 Jun '21

06 Jun '21

Hey there, I am working on migrating a Dovecot system with + 50.000 users / 5TB on mail data to a new set-up that is better scalable. But I found it difficult to find a good solution. In this email I lay out what I learned, in the hope that others can profit. But also others can help me on this design before I actually start migrating. *My aim is to get a clustered file system setup for Dovecot. But with the additional constraint of not having to pay on a per-mailbox basis to some vendor. * Why a clustered file system? I believe this yields the best solution. Your machines are now stateless: consuming services. And scaling or recovery is now relatively easy. Why the constraint of not paying per-mailbox? If you did pay a fee per mailbox; you probably would be better of just using a managed mail service altogether. High-level ======== We are going to use ObjectiveFS as our clustered file system (not involved with them in any way). They use Fuse to make it behave like a POSIX filesystem. Due to the way they compact files that belong together it handles a large number of small files relatively fine. The great thing is: we can mount this filesystem on multiple machines. This piece of software is proprietary, but it's price is very reasonable, and it is a fixed monthly cost. We can use S3, Google Cloud Storage, or others as the actual storage system. We store metadata about the mailboxes in a database that is available to all machines. We can use any managed database service for this. We explicitly set the proxy_host for each user in this database. Thus every user gets routed to the same machine. We make sure to distributed the users among the available machines. All traffic is received by a TCP load balancer. This will forward the traffic to the underlying machines. Ideally this is a managed cloud service. I think there are two valid choices. But I prefer the first one: - Use a TCP pass-through load balancer. This way the source IP is retained without requiring any change to the protocol (an example of this is Google Cloud external TCP/UDP Network Load Balancing <https://cloud.google.com/load-balancing/docs/network>). - Use an TCP SSL terminating load balancer. And make it forward in HaProxy's PROXY format so we retain the source IP. That traffic is now routed to N-machines. Each of those machines runs Dovecot. And Dovecot is configured with Dovecot Proxy (not to be confused with HaProxy's PROXY protocol). Such that Dovecot will proxy the connection to another machine if required (or continue on this machine if you are already on the correct proxy_host). I believe this can be done using proxy_maybe <https://doc.dovecot.org/configuration_manual/authentication/proxies/>. Depending on the choice of load balancer you may need to configure Dovecot to understand HaProxy's PROXY format. We are going to use the maildir format. And store those files on the ObjectiveFS filesystem. The index to Dovecot is stored on a local SSD. Choice motivations =============== ObjectiveFS: - Can probably be another clustered file system as well. - But ObjectiveFS works quite well because it has support for handling many small files. And can be configured with a local SSD disk. - Using this software can get a clustered file system to run quite easy. Regarding the mailbox format: - dbox is said to be more performant. And having less files is an advantage in general. But one big disadvantage: because the index contains crucial information, you will need to place this index on the Clustered File System as well. Maildir does not have this problem, and that is why we prefer it. - obox is only available as Dovecot Pro, and solves a lot of problems. But you really can only get Dovecot Pro if you pay a fee per mailbox. We don't want that! Why don't use Dovecot Director as well? - You can not run Dovecot Director on the same machine as your Dovecot Backend / proxy. Thus we would need to introduce 2 additional hosts to just accept and route the traffic. This would increase the complexity of our solution. - But it could be build on top of this set-up fairly easy. - I don't see too many advantages for Director however currently. - One big advantage *could* be if it would automatically remove failed nodes. However this only works if you use Dovemon <https://doc.dovecot.org/configuration_manual/dovemon/>. And that is packaged with OX/Dovecot and thus requires paying per user. - So in case you want to put a node down you get a slightly easier API to do so. Namely *doveadm director add <backend server ip> 0*. However we can simply imitate this by updating our database and changing the proxy_host to another destination as well. Load balancer - You could also set-up your MX records to directly point to your Dovecot nodes. This should work as well I guess. - But I think the load balancer makes for better control, over changing and managing DNS. Questions ======== In general I'd like to know whether this is a good idea! But some other questions I have at this point that could make or break this setup: - Can a Dovecot backend instance be configured to *also* run Dovecot proxy? - Can a Dovecot Proxy node receive HaProxy PROXY traffic? Details ===== Once I am sure I am on the right track I'd like to post the settings I use for the software as well. But let's first discuss the stuff above! Best, Roel van Duijnhoven

2 1

possible minor bug: lmtp excessice newlines
by Laura Steynes 06 Jun '21

06 Jun '21

Aki, unnecessary newlines in lmtp received header? Received: from mail6.xxxxxxxxxx.com by mail6.xxxxxxx.com with LMTP id xxxxxxxxxxxxxxxxxx (envelope-from <xxxxxx(a)xxxxxxxx.net>) for <xxx(a)xxxxxxxx.net>; Sat, 05 Jun 2021 14:19:07 +0100 is this intentional Aki ? Evident is multiple clients, in widescreen, so is inot client squashing the header # Dovecot version 2.3.14 # Pigeonhole version 0.5.14 # OS: Linux 5.10.41 x86_64

1 0

Panic on indexer-worker and Dovecot stop to search on Solr
by Alessio Cecchi 03 Jun '21

03 Jun '21

Hi, I have setup on a (little busy) Dovecot server FTS with Solr and Virtual folder to enable "search in all folders" for users. All works fine until for some users the indexer-worker process crash. After this crash Dovecot stop to query Solr for new search in BODY, returning SERVERBUG, for all users on the server and only with a dovecot restart users can search in BODY again. Before the dovecot restart I can see that on Solr server no query from dovecot arriving anymore (for SEARCH BODY because SEARCH in FROM/TO/SUBJECT still works fine) Dovecot version is 2.3.14 (from RPM) and Apache Solr si 7.7.3. Here is the error found in the log: May 31 14:58:13 Panic: indexer-worker(user(a)email.com) session=<VA0oxZ/DXtG5Ydlx:0KzOIkLdtGDSawAAxbYlJw>: file http-client-request.c: line 1240 (http_client_request_send_more): assertion failed: (req->payload_input != NULL) May 31 14:58:13 Error: indexer-worker(user(a)email.com) session=<VA0oxZ/DXtG5Ydlx:0KzOIkLdtGDSawAAxbYlJw>: Raw backtrace: /usr/lib64/dovecot/libdovecot.so.0(backtrace_append+0x42) [0x7f3d91b2cac2] -> /usr/lib64/dovecot/libdovecot.so.0(backtrace_get+0x1e) [0x7f3d91b2cbce] -> /usr/lib64/dovecot/libdovecot.so.0(+0xf3cde) [0x7f3d91b39cde] -> /usr/lib64/dovecot/libdovecot.so.0(+0xf3d81) [0x7f3d91b39d81] -> /usr/lib64/dovecot/libdovecot.so.0(i_fatal+0) [0x7f3d91a8b25a] -> /usr/lib64/dovecot/libdovecot.so.0(http_client_request_send_more+0x3dd) [0x7f3d91ad39ad] -> /usr/lib64/dovecot/libdovecot.so.0(http_client_connection_output+0xf1) [0x7f3d91ad8101] -> /usr/lib64/dovecot/libdovecot.so.0(+0x11d2b0) [0x7f3d91b632b0] -> /usr/lib64/dovecot/libdovecot.so.0(io_loop_call_io+0x65) [0x7f3d91b51f45] -> /usr/lib64/dovecot/libdovecot.so.0(io_loop_handler_run_internal+0x12b) [0x7f3d91b538fb] -> /usr/lib64/dovecot/libdovecot.so.0(io_loop_handler_run+0x59) [0x7f3d91b52049] -> /usr/lib64/dovecot/libdovecot.so.0(io_loop_run+0x38) [0x7f3d91b52288] -> /usr/lib64/dovecot/libdovecot.so.0(http_client_wait+0xcd) [0x7f3d91ae120d] -> /usr/lib64/dovecot/lib21_fts_solr_plugin.so(solr_connection_select+0xe4) [0x7f3d8fca1174] -> /usr/lib64/dovecot/lib21_fts_solr_plugin.so(+0x45d4) [0x7f3d8fc9d5d4] -> /usr/lib64/dovecot/lib20_fts_plugin.so(fts_backend_get_last_uid+0x6e) [0x7f3d90e103fe] -> /usr/lib64/dovecot/lib20_fts_plugin.so(+0xf952) [0x7f3d90e16952] -> /usr/lib64/dovecot/lib20_fts_plugin.so(+0x10ef6) [0x7f3d90e17ef6] -> /usr/lib64/dovecot/lib20_virtual_plugin.so(+0x966a) [0x7f3d90bfc66a] -> /usr/lib64/dovecot/lib20_fts_plugin.so(+0x10ba6) [0x7f3d90e17ba6] -> /usr/lib64/dovecot/libdovecot-storage.so.0(mail_precache+0x2e) [0x7f3d91e3cb0e] -> dovecot/indexer-worker [user(a)email.com Virtual/All - 5300/20832](+0x2924) [0x5648464be924] -> /usr/lib64/dovecot/libdovecot.so.0(io_loop_call_io+0x65) [0x7f3d91b51f45] -> /usr/lib64/dovecot/libdovecot.so.0(io_loop_handler_run_internal+0x12b) [0x7f3d91b538fb] -> /usr/lib64/dovecot/libdovecot.so.0(io_loop_handler_run+0x59) [0x7f3d91b52049] -> /usr/lib64/dovecot/libdovecot.so.0(io_loop_run+0x38) [0x7f3d91b52288] -> /usr/lib64/dovecot/libdovecot.so.0(master_service_run+0x13) [0x7f3d91abcbb3] -> dovecot/indexer-worker [user(a)email.com Virtual/All - 5300/20832](main+0xd7) [0x5648464be1f7] -> /lib64/libc.so.6(__libc_start_main+0xf5) [0x7f3d9169a555] -> dovecot/indexer-worker [user(a)email.com Virtual/All - 5300/20832](+0x22ba) [0x5648464be2ba] May 31 14:58:13 Fatal: indexer-worker(user(a)email.com) session=<VA0oxZ/DXtG5Ydlx:0KzOIkLdtGDSawAAxbYlJw>: master: service(indexer-worker): child 27602 killed with signal 6 (core dumps disabled - https://dovecot.org/bugreport.html#coredumps) on Solr side I found this error log: org.apache.solr.common.SolrException: Early EOF at org.apache.solr.handler.loader.XMLLoader.load(XMLLoader.java:190) at org.apache.solr.handler.UpdateRequestHandler$1.load(UpdateRequestHandler.java:97) at org.apache.solr.handler.ContentStreamHandlerBase.handleRequestBody(ContentStreamHandlerBase.java:68) at org.apache.solr.handler.RequestHandlerBase.handleRequest(RequestHandlerBase.java:199) at org.apache.solr.core.SolrCore.execute(SolrCore.java:2551) at org.apache.solr.servlet.HttpSolrCall.execute(HttpSolrCall.java:733) at org.apache.solr.servlet.HttpSolrCall.call(HttpSolrCall.java:531) at org.apache.solr.servlet.SolrDispatchFilter.doFilter(SolrDispatchFilter.java:395) [...] and [com.ctc.wstx.exc.WstxLazyException] com.ctc.wstx.exc.WstxIOException: Early EOF at com.ctc.wstx.exc.WstxLazyException.throwLazily(WstxLazyException.java:45) at com.ctc.wstx.sr.StreamScanner.throwLazyError(StreamScanner.java:728) at com.ctc.wstx.sr.BasicStreamReader.safeFinishToken(BasicStreamReader.java:3678) at com.ctc.wstx.sr.BasicStreamReader.getText(BasicStreamReader.java:860) at org.apache.solr.handler.loader.XMLLoader.readDoc(XMLLoader.java:419) at org.apache.solr.handler.loader.XMLLoader.processUpdate(XMLLoader.java:260) at org.apache.solr.handler.loader.XMLLoader.load(XMLLoader.java:188) at org.apache.solr.handler.UpdateRequestHandler$1.load(UpdateRequestHandler.java:97) This is the relevant part of dovecot configuration: plugin { fts = solr fts_autoindex = yes fts_decoder = decode2text fts_enforced = body fts_index_timeout = 5s fts_solr = url=http://10.0.1.3:8983/solr/dovecot/ [...] } Is this an already know bug? Any workaround? Thanks -- Alessio Cecchi Postmaster @ http://www.qboxmail.it https://www.linkedin.com/in/alessice

2 4

Dovecot Stats for Logwatch
by Plutocrat 03 Jun '21

03 Jun '21

Hi all, I run logwatch on a few servers and the script on there which parses the dovecot logs provides waaaaaay too much detail, and contains a bunch of stuff I'm not interested in. There's not much point in having a log summary if its 100Kb long! The one for exim is also terrible, but I've replaced that with eximstats, and a bit of bash scripting and have something I can work with. I might at some point look at replacing that too. Now to my question. I haven't found anything in the dovecot family which compares to eximstats. I was wondering if there possibly is a report tool, or a way of extracting stats from doveadm just for key metrics such as 'number of POP logins in the last 24 hours', number of failed passwords, etc. Things that might be interesting on a logwatch report. Or maybe someone has written a script already that can be used in logwatch in perl, python, bash, whatever. Any pointers, suggestions, or ideas for useful summary metrics to pull out of the logfiles are appreciated. I suspect I might end up writing one myself anyway, but I'm just keen to see what already exists, get the benefit of anyone else's experiences in this matter before I start. P.

3 8

fts_autoindex_exclude for everything in a namespace?
by Daniel J. Luke 03 Jun '21

03 Jun '21

Hi, I've recently moved a system from using procmail to delivering via dovecot-lmtp w/ sieve - and it's great! I've got a copy of incoming mail going into mbox archives (that I compress after months end), and my mail log is full of "Error: fts: Failed to sync mailbox #Archive: Mailbox isn't selectable", though. I /think/ fts_autoindex_exclude = #Archive/* is what I want, but it doesn't seem to silence the error. I don't need the #Archive mailboxes visible to clients, but I don't mind if they are. I tried some setting the archive prefix = AutoArchive and setting list = yes, but that didn't silence the error. I feel like I'm probably missing something obvious :) dovecot 2.3.14 / pigenohole 0.5.14 relevant config from dovecot -n: mail_location = mbox:~/Mail/:INBOX=~/.mbox:INDEX=~/.dovecot-indexes mail_plugins = fts fts_lucene zlib namespace { inbox = yes location = mailbox Drafts { auto = no special_use = \Drafts } mailbox Sent { auto = subscribe special_use = \Sent } mailbox Trash { auto = no special_use = \Trash } mailbox spam { auto = create special_use = \Junk } prefix = separator = / } namespace archive { inbox = no list = no location = mbox:~/MailArchive/ prefix = "#Archive/" separator = / } plugin { fts = lucene fts_autoindex = yes fts_lucene = whitespace_chars=@. recipient_delimiter = + sieve = file:~/.sieve;active=~/.dovecot.sieve sieve_default = /usr/local/etc/dovecot/sieve/default.sieve sieve_default_name = file_spam } and the archive sieve script (which works) looks like this: if currentdate :matches "month" "*" { set "month" "${1}"; } if currentdate :matches "year" "*" { set "year" "${1}"; } if true { fileinto :copy :create "#Archive/${year}-${month}"; } -- Daniel J. Luke

1 0

userdb volatiledir setting not working
by Александер Скобельцын 02 Jun '21

02 Jun '21

Hi all! I just can't deal with VOLATILEDIR userdb setting on my mailservers. For example dovecot-uidlist.lock files are still being created over our network mail store. So, several days ago I changed my user and passwd query setting to include this option and restarted all my dovecot servers. Now it looks like (we use mysql driver): user_query = \ SELECT \ `u`.`pop` AS `home`, \ `u`.`uid`, \ `u`.`gid`, \ CONCAT('maildir:', `u`.`smtp`, ':INDEX=/var/dovecot_indexes/%d/%u:VOLATILEDIR=/var/dovecot_indexes/%d/%u') AS `mail`, \ CONCAT('*:bytes=', `u`.`quota`, 'M') AS `quota_rule` ,\ CONCAT('url=http://', fts_solr, ':8983/solr/dovecot/') AS fts_solr \ FROM `users` AS `u` \ JOIN `domains` AS `d` ON `d`.`domain_id` = `u`.`domain_id` \ WHERE \ `u`.`username` = '%u' \ AND `u`.`enabled` = 1 \ AND `d`.`enabled` = 1 \ AND `u`.`type` IN ('local', 'piped') password_query = \ SELECT \ `u`.`username` AS `user`, \ `u`.`crypt` AS `password`, \ `u`.`pop` AS `userdb_home`, \ `u`.`uid` AS `userdb_uid`, \ `u`.`gid` AS `userdb_gid`, \ CONCAT('maildir:', `u`.`smtp`, ':INDEX=/var/dovecot_indexes/%d/%u:VOLATILEDIR=/var/dovecot_indexes/%d/%u') AS `userdb_mail`, \ CONCAT('*:bytes=', `u`.`quota`, 'M') AS `userdb_quota_rule` \ FROM `users` AS `u` \ JOIN `domains` AS `d` ON `d`.`domain_id` = `u`.`domain_id` \ WHERE \ `u`.`username` = '%u' \ AND `u`.`enabled` = 1 \ AND `d`.`enabled` = 1 \ AND `u`.`type` IN ('local', 'piped') The aim was to move .lock and another temp files out of network storage our mails are stored. We use CephFS for storing user emails (maildir format). In addition we use 3 imap servers, each mount exact same path in cephfs and 2 dovecot directors to handle user=imapserver mapping, so user shouldn't exist on more than one imapserver at a time. Am I must use CONTROL directive in addition to force move control files from network store for VOLATILEDIR setting to work properly or I just misconfigured something? Extra info: dovecot --version 2.3.14 (cee3cbc0d)

1 0

debugging file permissions wrong
by Laura Steynes 02 Jun '21

02 Jun '21

Hi, In trying to debug a strange error where client can't login, I enabled all the usual debug settings, this is all good, it works for imap and pop3 fine, but the problem is when used with dovecot's LDA there is a nasty issue. the file created by debug_log_path in this case /var/log/dovecot/debug.log , this file created as root, again this is fine for nice logging of imap and pop3, but this causes postfix not to deliver mail, for write permission denied, LDA runs as vmail, all my sub sections like *_listener also = vmail and all my uid/gid settings are also to user/group vmail obviously you wont main log files to not be owned by vmail for case of security, so is there a way to set the ownership of the debug file - apart from the obvious of remembering 40 minutes later when you get alert of high mailq level to chown the file :) If there is no way, may the developers take this as a feature request please. Thanks Loz

2 3

New Configuration
by Eric Shields | Mass Transit Honchkrow 29 May '21

29 May '21

Hi, I'm setting up an email server behind a NAT, and I have the necessary DNS records, iptables/ufw rules, and ACLs in place. However, I cannot sign in with my chosen username, which does exist on the same computer I'm hosting the server on. I am using PAM, not a database, to hold credential information, and SSL certificates are active. However, I am getting signal 15 for the following processes: anvil, config, and auth. I can confirm through telnet that the ports I am using are open, and these ports are also open on the WAN side, which I believe is needed. Do you have any pointers for me, or any additional clarifying details? - 🚏

2 1

Different Maildir Locations
by Gabx 28 May '21

28 May '21

Hi, on my vps (debian stable) I have an email system with postfix, dovecot, virtual users and domains. I have 3 users with different mail_locations. the first mail_location = maildir: ~ / Maildir the second mail_location = maildir: ~ / user1 / Maildir the third mail_location = maildir: ~ / user2 / mail In postfix the above schema is represented in virtual_mailbox_maps. In dovecot mail_location is set maildir:~/Maildir. The first user receives regular mail, the other two none. I tried to see if in dovecot there was the possibility to configure the mail_location specifically for each single user, but with namespaces and userdb I am a bit confused and I have not found specific examples for my case. regards Gab -- GPG fingerprint: 5A6A F742 ACEA C9A7 93A8 8D5E 7AEF 5A02 D080 89F7 Contact: xmpp://gabx@jabber.tcpreset.net

3 14

replicator: Panic: data stack: Out of memory when allocating ...
by Jörg Faudin Schulz 28 May '21

28 May '21

frequently, the replicator fails on allocating memory: replicator: Panic: data stack: Out of memory when allocating ... bytes. I already have increased default_vsz_limit=1024M but this only increased the ... value. What can be done here? dovecot_branch=release-2.3.14

2 3

Mailbox problem on centos O/S after some "fiddling"
by John Richards 28 May '21

28 May '21

Good day from Somerset, England Version 2.2.10 Problem after a huge centos update Data:- Server has 8 mailboxes under /var/mail/"user name" history:- After update, mail to ONE user was going into mqueue as undeliverable Had to delete and recreate the user. somewhere along the line (ME!) /var/mail/;imap var/mail/new were deleted After new user and reboot server no one could access mailboxes with password error except ONE user randomly....This created the /var/mail/.mbox folder and sub folders but with the owner as the user name. Then any mail for other users was put in the /var/new folder and just sat there. only the "owner" of this folder could get mail, everyone else was prohibited with password error. chown the folder (owner:group) to root did nothing BUT When .mbox was give PUBLIC execute permissions (771) suddenly everything works fine! I do not understand why dovecot creates this folder as we ONLY ever use pop3 (currently with plain text auth but going to secure when this sorted) for mail and also why when it writes the blank folder it "owns" it with the user accessing it (also the /var/mail/new folder takes the same owner) I have trolled everywhere and spent a whole day on this so any clues would be very gratefully accepted as do not like to leave this folder as 771 (note the folder INBOX within it is only 770 and the log file in that is 660) Is this INBOX needed at all for pop3 ? rgds John Richards UK ================= dovecot -n # 2.2.10: /etc/dovecot/dovecot.conf # OS: Linux 3.10.0-514.2.2.el7.x86_64 x86_64 CentOS Linux release 7.3.1611 (Core ) ext4 auth_mechanisms = plain login disable_plaintext_auth = no mail_location = mbox:/var/mail/:INBOX=/var/mail/%u mbox_write_locks = fcntl namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } passdb { driver = shadow } protocols = pop3 service imap-login { inet_listener imap { port = 143 } inet_listener imaps { port = 993 ssl = yes } } ssl_cert = </etc/pki/tls/certs/watchetwebdesign.co.uk.crt ssl_key = </etc/pki/tls/private/watchetwebdesign.co.uk.key userdb { driver = passwd }

2 1

NFS Locking Question
by Zane Zak 28 May '21

28 May '21

Hi! I'm hoping to get some clarification on NFS locking before deploying a new setup. We have a single exim server that delivers mail to mbox files in /var/mail. We have a separate server running dovecot that reads mail from these mbox files. So only one exim server and one dovecot server, but they're separate VMs and handle locking with dotlocks. I was noticing frequent mbox file corruption. I then set "mail_nfs_storage = yes", and have seen no mbox corruption since. However, I'm now seeing messages like this in the logs for every read... Error: nfs_flush_fcntl: fcntl(/var/mail/username, F_RDLCK) failed: Bad file descriptor Is there a configuration change that needs to be made on the dovecot or the NFS servers, or are these messages harmless. Thanks! ZZ

2 1

mail-crypt-plugin: encrypted user keys
by Daniel Schuermann 28 May '21

28 May '21

Hi, I tried to enable encrypted folder keys using mail-crypt-plugin. It works as expected when using unencrypted folder keys. When I add mail_crypt_require_encrypted_user_key = yes as shown below, I somehow manage to crash dovecot: dovecot: lmtp(82060): Fatal: master: service(lmtp): child 82060 killed with signal 6 (core not dumped - https://dovecot.org/bugreport.html#coredumps - set service lmtp { drop_priv_before_exec=yes }) dovecot: lmtp(67814): Panic: file mail-user.c: line 229 (mail_user_deinit): assertion failed: ((*user)->refcount== 1) lmtp(root): Info: msgid=<07e3a23b2aaea60b(a)mx.2718282.net>: save failed to INBOX: generate_keypair(INBOX) failed: mail_crypt_require_encrypted_user_key set, cannot generate user keypair without password or key My config files: # 2.3.14 (cee3cbc0d): /etc/mail/imap.conf # OS: OpenBSD 6.9 amd64 auth_verbose = yes debug_log_path = /var/log/dovecot info_log_path = /var/log/dovecot mail_attribute_dict = file:%h/Maildir/dovecot-attributes mail_debug = yes namespace inbox { ... } passdb { args = /etc/mail/imap-sqlite.conf driver = sql } plugin { mail_crypt_curve = secp521r1 mail_crypt_require_encrypted_user_key = yes mail_crypt_save_version = 2 } protocols = imap lmtp service imap-login { ... } ssl = required ssl_cert = </etc/ssl/rsa.crt ssl_key = # hidden, use -P to show it ssl_min_protocol = TLSv1.2 ssl_prefer_server_ciphers = yes userdb { args = /etc/mail/imap-sqlite.conf driver = sql override_fields = uid=vmail gid=vmail } # file: /etc/mail/imap-sqlite.conf driver = sqlite connect = /etc/mail/sqlite.db default_pass_scheme = BLF-CRYPT user_query = SELECT '/home/vmail/'||destination AS home FROM virtuals WHERE email = '%u' password_query = SELECT email as user, password, '%w' AS \ userdb_mail_crypt_private_password FROM credentials WHERE email = '%u'

2 1

missing +w perm
by Jeff Abrahamson 28 May '21

28 May '21

I've started seeing the following error in mail.err for precisely one user on precisely one domain: Error: mkdir(/var/mail/vmail//jeff/mail) failed: Permission denied (euid=1000(jeff) egid=1001(jeff) missing +w perm: /var/mail/vmail/, dir owned by 4000:4000 mode=0755) Error: Mailbox INBOX: Failed to autocreate mailbox: Internal error occurred. In mail.log I see a bit more: Warning: Failed to parse address from `From_'-line: Missing domain Error: mkdir(/var/mail/vmail//jeff/mail) failed: Permission denied (euid=1000(jeff) egid=1001(jeff) missing +w perm: /var/mail/vmail/, dir owned by 4000:4000 mode=0755) Error: mkdir(/var/mail/vmail//jeff/mail) failed: Permission denied (euid=1000(jeff) egid=1001(jeff) missing +w perm: /var/mail/vmail/, dir owned by 4000:4000 mode=0755) Error: Mailbox INBOX: Failed to autocreate mailbox: Internal error occurred. Refer to server log for more information. save failed to open mailbox INBOX: Mailbox INBOX: Failed to autocreate mailbox: Internal error occurred. And yet there's no apparent problem sending and receiving mail for user jeff, for all domains handled by the server. Other users have no issues. The /var/mail/vmail/ hierarchy is all owned by vmail:vmail (4000:4000) and directories are all 0755. I suspect a red herring except it's been continuing for a week now. I was reading this page (following some searching), but it doesn't seem pertinent in the end. https://wiki2.dovecot.org/MailLocation/mbox#A.2BAC8-var.2BAC8-mail.2BAC8_do… Any suggestions what this might be? -- Jeff Abrahamson +33 6 24 40 01 57 +44 7920 594 255 http://p27.eu/jeff/ http://mobilitains.fr/

2 2

backup v rsync
by Jeff Abrahamson 27 May '21

27 May '21

I've been migrating from a dovecot 2.2.22 instance to a dovecot 2.3.7.2 instance. (Said differently, from an ubuntu 16.04 host to a 20.04 host.) It's a tiny site: only a handful of users actually had to migrate, most either died on the old one or were born on the new one. The main user in need of migration was me. After fiddling with dsync and not getting it working, I threw in the towel. This is a migration I had to do once for precisely one user. I had been using the old host exclusively, so it was easy to shut down both dovecot instances the time it took me to rsync my data from one to the other. Now that seems to work, almost. Mail is being delivered to my inbox, anyway. Most other folders are looking inaccessible to my mail client (thunderbird, for this test). The main difference between the two servers, aside from the above, is a switch from mail_location = maildir:~/Maildir to mail_home = /var/mail/vmail/%d/%n mail_location = maildir:/var/mail/vmail/%d/%n/mail:LAYOUT=fs mail_privileged_group = mail I corrected permissions and ownership when I copied the data. Now I think the problem is that LAYOUT=fs means that I should have a slightly different folder hierarchy now. The question is how best to fix this. I have things like this .Archives.2020 .Archives.2020/new .Archives.2020/tmp .Archives.2020/cur when I think I should have things like this Archives Archives/2021 Archives/2021/new Archives/2021/tmp Archives/2021/cur And, again, this is one-off, so a manual fix seems most appropriate. I'm quite tempted simply to shut down the dovecot instance for a minute at a quiet moment (mail retries...) and rename directories as indicated above. I only have to rename five directories. Having gotten myself in a bit of a muddle on this, I thought perhaps a reality check that I'm not about to make it worse would be appropriate. Many thanks. -- Jeff Abrahamson +33 6 24 40 01 57 +44 7920 594 255 https://www.p27.eu/jeff/ https://www.mobilitains.fr/

2 2

API command for ACL Delete
by Rhodri Jones 27 May '21

27 May '21

I asked previously for info about the API options for doveadm acl delete but I think my question was misunderstood. I want to know the command I would use (with curl for instance) that corresponds with: doveadm acl delete -u <targetmailbox> INBOX user=<targetuser> Using the python client for doveadm http API I can see the valid parameters but I don't seem to be able to get the correct syntax. (doveadm) aclDelete ? invalid parameter: ? valid parameters for aclDelete: - userFile (string) - allUsers (boolean) - mailbox (string) - user (string) - socketPath (string) - id (string) --

2 2

API command for ACL Delete
by Rhodri Jones 26 May '21

26 May '21

Can anyone tell me how to do the following using the API. doveadm acl get -u <targetmailbox> INBOX doveadm acl delete -u <targetmailbox> INBOX user=$user Are the ACL API options documented somewhere? Thanks --

2 1

Re: [EXT] Re: Dovecot Stats for Logwatch
by Plutocrat 26 May '21

26 May '21

On 26/05/2021 14.33, Aki Tuomi wrote: > I am not sure what is not working for you... > does `doveadm stats dump` work? a) Before any stats config it works without error, but gives no output. doveadm stats dump metric_name field count sum min max avg median stddev %95 b) If I then enable conf.d/95-stats.conf containing service stats { inet_listener http { port = 9900 } } metric client_connections { filter = event=client_connection_finished } metric auth_success { filter = (event=auth_request_finished AND success=yes) } metric mail_delivery { filter = event=mail_delivery_finished } ... it works but doesn't seem to collect any data, even if left for 24 hours doveadm stats dump metric_name field count sum min max avg median stddev %95 client_connections duration 0 0 0 0 0.00 0 0.00 0 auth_success duration 0 0 0 0 0.00 0 0.00 0 mail_delivery duration 0 0 0 0 0.00 0 0.00 0 c) If I then enable the bits of config that I'm informed will populate the data repository: # In 10-master.conf mail_plugins = stats # In 20-imap.conf protocol imap { mail_plugins = $mail_plugins quota imap_quota } # In 20-pop.conf protocol pop3 { mail_plugins = $mail_plugins quota } ... it then complains doveadm stats dump Fatal: Plugin 'stats' not found from directory /usr/lib/dovecot/modules d) I just changed the in in 10-master-conf to reference old-stats instead of stats, based on my new knowledge and it doesn't complain about the missing module any more. But I'm still not collecting data after 30 mins. doveadm stats dump metric_name field count sum min max avg median stddev %95 client_connections duration 0 0 0 0 0.00 0 0.00 0 auth_success duration 0 0 0 0 0.00 0 0.00 0 mail_delivery duration 0 0 0 0 0.00 0 0.00 0 I can do wget http://localhost:9900/metrics and I just get a file that says VERSION stats-reader-server 2 0 At this point I'm thinking I'll just write a bash script to parse the logs, but thought I'd see it through as it might help other intrepid dovecot users. P.

2 3

Problem with per-user \Seen flag on public folder
by Bartek Szady 26 May '21

26 May '21

Hello I have noticed that when per-user \Seen flag is configured dovecot do not respond properly to 'store' command. eg.: =============== 42 uid store 6 +Flags (\Seen) 42 OK Store completed (0.001 + 0.000 secs). 43 IDLE + idling DONE 43 OK Idle completed (3.204 + 3.203 + 3.203 secs). =============== Thunderbird is confused by this and read emails turns into unread after a while. When global flag is stored dovecot responds as it should, I think: =============== 32 uid store 3 -Flags (\Flagged) * 2 FETCH (UID 3 FLAGS ()) 32 OK Store completed (0.002 + 0.000 + 0.001 secs). 33 IDLE + idling DONE 33 OK Idle completed (5.362 + 5.362 + 5.361 secs). =============== When per-user \Seen flag is not configured: =============== 25 uid store 6 +Flags (\Seen) * 4 FETCH (UID 6 FLAGS (\Seen)) 25 OK Store completed (0.002 + 0.000 + 0.001 secs). 26 IDLE + idling * OK Still here DONE 26 OK Idle completed (65.076 + 65.076 + 65.076 secs). =============== # doveconf -n # 2.3.14 (cee3cbc0d): dovecot-int.conf # OS: Linux 5.1.16 x86_64 # Hostname: #hidden auth_mechanisms = plain login base_dir = /var/run/dovecot-int default_internal_group = dovecot1 default_internal_user = dovecot1 default_login_user = dovenull1 disable_plaintext_auth = no login_log_format = int %$: %s mail_debug = yes mail_location = maildir:~/Mail/Maildir mail_log_prefix = "int-%s(%u)<%{pid}><%{session}>: " namespace { inbox = yes location = prefix = separator = / type = private } passdb { args = scheme=MD5-CRYPT /etc/dovecot/passwd-int driver = passwd-file } passdb { args = scheme=MD5-CRYPT /etc/dovecot/virtual-int driver = passwd-file } passdb { driver = pam } plugin { acl = vfile } protocols = pop3 imap service auth { user = root } service imap-login { group = dovenull1 inet_listener imap { address = <ips> } user = dovecot1 } service pop3-login { group = dovenull1 inet_listener pop3 { address = <ips> } } service stats { unix_listener stats-writer { mode = 0660 user = pubmail } } ssl_cert = </var/lib/openssl/certs/imap-int.crt ssl_dh = # hidden, use -P to show it ssl_key = # hidden, use -P to show it userdb { args = /etc/dovecot/virtual-int driver = passwd-file } userdb { driver = passwd } protocol imap { mail_plugins = acl imap_acl namespace { location = maildir:/srv/mail/public:LAYOUT=fs:INDEXPVT=~/Mail/public prefix = publiczne/ separator = / subscriptions = no type = public } ssl = yes } Bartek

2 1

What am I doing wrong?
by Ron Garret 26 May '21

26 May '21

I’m trying to run an imapsieve script when a user sends a message (this is part of a spam filter and I want to use outgoing messages to train the filter on good content). This is my config: plugin { sieve_plugins = sieve_imapsieve sieve_extprograms sieve = file:/var/mail/sieve/incoming.sieve # From elsewhere to Junk imapsieve_mailbox1_name = Junk imapsieve_mailbox1_causes = COPY imapsieve_mailbox1_before = file:/var/mail/sieve/spam.sieve # From Junk to elsewhere imapsieve_mailbox2_name = * imapsieve_mailbox2_from = Junk imapsieve_mailbox2_causes = COPY imapsieve_mailbox2_before = file:/var/mail/sieve/ham.sieve # Sent imapsieve_mailbox3_name = 'Sent Messages' imapsieve_mailbox3_causes = APPEND imapsieve_mailbox3_before = file:/var/mail/sieve/sent.sieve sieve_pipe_bin_dir = /var/mail/sieve sieve_global_extensions = +vnd.dovecot.pipe +vnd.dovecot.environment } The first two scripts (for training spam and ham respectively) both work. Once upon a time I had the third one working as well, but apparently I changed something that made it break and I have no idea what that could be. (Yes, I need to get my code into revision control. I’ve already beaten myself up over that more than once.) The problem appears to be in the config, not the sieve script, because the script is never compiled into a .svbin while the other scripts in the same directory are compiled. But just for the record, this is the sieve script: > ➔ cat /var/mail/sieve/sent.sieve > require ["vnd.dovecot.pipe", "copy", "imapsieve", "environment", "variables"]; > > if environment :matches "imap.user" "*" { > set "username" "${1}"; > } > > pipe :copy "train.py" [ "sent", "${username}" ]; Does anyone here see the problem that I’m missing? Thanks, rg

1 1

sqlite + IMAP Authentication issues - user unknown
by Scott Edwards 26 May '21

26 May '21

Hello, I'm not on the maillist, please reply all. It's been a few years since I've setup a mail server (I feel like a noob!). The following syslog message is isolating the auth issues. I have sqlite, and want to keep it this way. I don't see more than a few mailboxes to setup until sometime later, but if it does grow, I'll stand up PostgreSQL. FQDN is 'localcar.repair'. May 24 21:01:45 localcar dovecot: auth: Debug: client in: AUTH#0116#011PLAIN#011service=imap#011secured=tls#011session=Rb8dshnD/Gwv2Ixo#011lip=45.33.2.221#011rip=47.216.140.104#011lport=993#011rport=27900#011local_name=localcar.repair#011ssl_cipher=TLS_AES_128_GCM_SHA256#011ssl_cipher_bits=128#011ssl_pfs=KxANY#011ssl_protocol=TLSv1.3#011resp=<hidden> May 24 21:01:49 localcar dovecot: auth-worker(20614): Debug: sql(webmaster-foo(a)localcar.repair,47.216.140.104,<Rb8dshnD/Gwv2Ixo>): query: SELECT password, userid as user FROM users WHERE userid = 'webmaster-foo' AND domain = 'localcar.repair' May 24 21:01:49 localcar dovecot: auth-worker(20614): sql(webmaster-foo(a)localcar.repair,47.216.140.104,<Rb8dshnD/Gwv2Ixo>): unknown user (given password: topsecret) May 24 21:01:51 localcar dovecot: auth: Debug: client passdb out: FAIL#0116#011user=webmaster-l5buyjuxao8@localcar.repair#011original_user=webmaster-foo@localcar.repair May 24 21:01:51 localcar dovecot: imap-login: Debug: Ignoring unknown passdb extra field: original_user root@localcar:/etc/dovecot# sqlite3 users SQLite version 3.27.2 2019-02-25 16:06:06 Enter ".help" for usage hints. sqlite> .schema CREATE TABLE users ( userid VARCHAR(128) NOT NULL, domain VARCHAR(128) NOT NULL, password VARCHAR(64) NOT NULL, home VARCHAR(255) NOT NULL, uid INTEGER NOT NULL, gid INTEGER NOT NULL ); sqlite> select * from users; webmaster-foo|localcar.repair|topsecret|/tmp|1000|1000 Thunderbird naturally says "Login to server localcar.repair with username webmaster-foo(a)localcar.repair failed. [ ok ] Restarting dovecot (via systemctl): dovecot.service. root@localcar:/etc/dovecot# dovecot -n # 2.3.4.1 (f79e8e7e4): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.4 () # OS: Linux 4.19.0-16-amd64 x86_64 Debian 10.9 # Hostname: localcar.repair auth_debug = yes auth_verbose = yes auth_verbose_passwords = yes mail_location = mbox:~/mail:INBOX=/var/mail/%u mail_privileged_group = mail namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } passdb { args = /etc/dovecot/dovecot-sql.conf.ext driver = sql } protocols = " imap lmtp" ssl_cert = </etc/dovecot/private/dovecot.pem ssl_client_ca_dir = /etc/ssl/certs ssl_dh = # hidden, use -P to show it ssl_key = # hidden, use -P to show it userdb { args = /etc/dovecot/dovecot-sql.conf.ext driver = sql } Thank you, Scott

2 2

Help with "doveadm" - Socket ?
by White, Daniel E. (GSFC-770.0)[NICS] 25 May '21

25 May '21

doveadm [-f formatter] mailbox status [-A|-u user] [-S socket_path] [-t] fields mailbox ... Where do I find this "socket_path", please ? I am trying to untangle a very old CentOS 6 instance. Thanks in advance.

4 7

Panic: file ostream-zlib.c
by Bouke J. Henstra | ICT Diensten 24 May '21

24 May '21

Hello, At the moment I am investigating an issue (probably) related to Dovecot /zlib. I am hoping someone is willing to help. Thanks. #Background information Every time a certain user checked her e-mail the following errors would appear in "/var/log/mail.err" (please find the lines below). I am using zlib (please find the details in the configuration below). I did include the Dovecot version, OS details, CPU details and file system details in this message. I did migrate the whole mail domain to Microsoft 365 (as the user has an active subscription and had to move on - for me this was the fastest method to help the user in this case). The mailbox still exists on the server. I suspect there's file corruption somewhere? I am routing mail from the domain to xxxxx-xx.mail.protection.outlook.com (just to be sure that the user doesn't miss anything - mx records have been updated). I did notice that the user had issues with receiving mail. Outlook would keep trying to fetch mail and was hard to close (user had to kill Outlook through the task manager - after migrating to Microsoft 365 this problem is resolved too). I would like to find out what causes/caused this problem. I would like to understand the problem and would like to try to avoid future problems. I did run "dovecot-sysreport" but I did notice the data is not anonymized. I can anonymize the details and submit those if required. #Dovcecot version root@s1:/# dovecot --version 2.3.4.1 (f79e8e7e4) #Operating system root@s1:/# uname -a Linux s1 4.19.0-16-amd64 #1 SMP Debian 4.19.181-1 (2021-03-19) x86_64 GNU/Linux root@s1:/# cat /etc/debian_version 10.9 #CPU Architecture root@s1:/# lscpu Architecture: x86_64 CPU op-mode(s): 32-bit, 64-bit Byte Order: Little Endian #File System ext4 errors=continue,usrjquota=quota.user,grpjquota=quota.group,jqfmt=vfsv0 0 1 #Errors May 17 22:37:11 s1 dovecot: imap(xxxx(a)xxxxx.xx)<18570><MxyEjIzCs8pSoYVo>: Panic: file ostream-zlib.c: line 37 (o_stream_zlib_close): assertion failed: (zstream->ostream.finished || zstream->ostream.ostream.stream_errno != 0 || zstream->ostream.error_handling_disabled) May 17 22:37:11 s1 dovecot: imap(xxxx(a)xxxxx.xx)<18570><MxyEjIzCs8pSoYVo>: Error: Raw backtrace: /usr/lib/dovecot/libdovecot.so.0(+0xdb73b) [0x7f45c109973b] -> /usr/lib/dovecot/libdovecot.so.0(+0xdb7d1) [0x7f45c10997d1] -> /usr/lib/dovecot/libdovecot.so.0(+0x4a199) [0x7f45c1008199] -> /usr/lib/dovecot/modules/lib20_zlib_plugin.so(+0x3c6f) [0x7f45c0dc3c6f] -> /usr/lib/dovecot/libdovecot.so.0(+0xffd5e) [0x7f45c10bdd5e] -> /usr/lib/dovecot/libdovecot.so.0(o_stream_destroy+0x16) [0x7f45c10bdd86] -> /usr/lib/dovecot/libdovecot-storage.so.0(maildir_save_finish+0x18d) [0x7f45c11d046d] -> /usr/lib/dovecot/libdovecot-storage.so.0(mailbox_save_cancel+0x4d) [0x7f45c11a867d] -> dovecot/imap(+0x10f36) [0x5606b3187f36] -> dovecot/imap(+0x10ff3) [0x5606b3187ff3] -> /usr/lib/dovecot/libdovecot.so.0(io_loop_call_io+0x6f) [0x7f45c10afbef] -> /usr/lib/dovecot/libdovecot.so.0(io_loop_handler_run_internal+0x136) [0x7f45c10b11e6] -> /usr/lib/dovecot/libdovecot.so.0(io_loop_handler_run+0x4c) [0x7f45c10afc8c] -> /usr/lib/dovecot/libdovecot.so.0(io_loop_run+0x40) [0x7f45c10afdf0] -> /usr/lib/dovecot/libdovecot.so.0(master_service_run+0x13) [0x7f45c1030123] -> dovecot/imap(main+0x325) [0x5606b3187bf5] -> /lib/x86_64-linux-gnu/libc.so.6(__libc_start_main+0xeb) [0x7f45c0e1309b] -> dovecot/imap(_start+0x2a) [0x5606b3187d8a] May 17 22:37:11 s1 dovecot: imap(xxxx(a)xxxxx.xx)<18570><MxyEjIzCs8pSoYVo>: Fatal: master: service(imap): child 18570 killed with signal 6 (core dumps disabled - https://dovecot.org/bugreport.html#coredumps) May 17 22:54:52 s1 dovecot: imap(xxxx(a)xxxxx.xx)<20321><HrbpyozCn8tSoYVo>: Panic: file ostream-zlib.c: line 37 (o_stream_zlib_close): assertion failed: (zstream->ostream.finished || zstream->ostream.ostream.stream_errno != 0 || zstream->ostream.error_handling_disabled) May 17 22:54:52 s1 dovecot: imap(xxxx(a)xxxxx.xx)<20321><HrbpyozCn8tSoYVo>: Error: Raw backtrace: /usr/lib/dovecot/libdovecot.so.0(+0xdb73b) [0x7fda4a55473b] -> /usr/lib/dovecot/libdovecot.so.0(+0xdb7d1) [0x7fda4a5547d1] -> /usr/lib/dovecot/libdovecot.so.0(+0x4a199) [0x7fda4a4c3199] -> /usr/lib/dovecot/modules/lib20_zlib_plugin.so(+0x3c6f) [0x7fda4a27ec6f] -> /usr/lib/dovecot/libdovecot.so.0(+0xffd5e) [0x7fda4a578d5e] -> /usr/lib/dovecot/libdovecot.so.0(o_stream_destroy+0x16) [0x7fda4a578d86] -> /usr/lib/dovecot/libdovecot-storage.so.0(maildir_save_finish+0x18d) [0x7fda4a68b46d] -> /usr/lib/dovecot/libdovecot-storage.so.0(mailbox_save_cancel+0x4d) [0x7fda4a66367d] -> dovecot/imap(+0x10f36) [0x5559c9e82f36] -> dovecot/imap(+0x10ff3) [0x5559c9e82ff3] -> /usr/lib/dovecot/libdovecot.so.0(io_loop_call_io+0x6f) [0x7fda4a56abef] -> /usr/lib/dovecot/libdovecot.so.0(io_loop_handler_run_internal+0x136) [0x7fda4a56c1e6] -> /usr/lib/dovecot/libdovecot.so.0(io_loop_handler_run+0x4c) [0x7fda4a56ac8c] -> /usr/lib/dovecot/libdovecot.so.0(io_loop_run+0x40) [0x7fda4a56adf0] -> /usr/lib/dovecot/libdovecot.so.0(master_service_run+0x13) [0x7fda4a4eb123] -> dovecot/imap(main+0x325) [0x5559c9e82bf5] -> /lib/x86_64-linux-gnu/libc.so.6(__libc_start_main+0xeb) [0x7fda4a2ce09b] -> dovecot/imap(_start+0x2a) [0x5559c9e82d8a] May 17 22:54:52 s1 dovecot: imap(xxxx(a)xxxxx.xx)<20321><HrbpyozCn8tSoYVo>: Fatal: master: service(imap): child 20321 killed with signal 6 (core dumps disabled - https://dovecot.org/bugreport.html#coredumps) #Config root@s1:/opt/scripts# dovecot -n # 2.3.4.1 (f79e8e7e4): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.4 () # OS: Linux 4.19.0-16-amd64 x86_64 Debian 10.9 # Hostname: s1.xxxxx.xx auth_mechanisms = plain login disable_plaintext_auth = no imap_capability = +SPECIAL-USE XLIST listen = *,[::] lmtp_rcpt_check_quota = yes log_timestamp = "%Y-%m-%d %H:%M:%S " mail_max_userip_connections = 100 mail_plugins = quota zlib mail_privileged_group = vmail namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = separator = . } passdb { args = /etc/dovecot/dovecot-sql.conf driver = sql } plugin { quota = dict:user::file:/var/vmail/%d/%n/.quotausage quota_status_nouser = DUNNO quota_status_overquota = 552 5.2.2 Mailbox is full quota_status_success = DUNNO sieve = /var/vmail/%d/%n/.sieve sieve_after = /var/vmail/%d/%n/.ispconfig.sieve sieve_before = /var/vmail/%d/%n/.ispconfig-before.sieve sieve_max_actions = 100 sieve_max_redirects = 25 sieve_max_script_size = 2M zlib_save = gz zlib_save_level = 9 } protocols = imap pop3 lmtp service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0660 user = postfix } unix_listener auth-userdb { group = vmail mode = 0600 user = vmail } user = root } service imap-login { client_limit = 1000 process_limit = 512 } service lmtp { unix_listener /var/spool/postfix/private/dovecot-lmtp { group = postfix mode = 0600 user = postfix } } service quota-status { client_limit = 1 executable = quota-status -p postfix unix_listener /var/spool/postfix/private/quota-status { group = postfix mode = 0660 user = postfix } } service stats { unix_listener stats-reader { group = vmail mode = 0660 user = vmail } unix_listener stats-writer { group = vmail mode = 0660 user = vmail } } ssl_cert = </etc/postfix/smtpd.cert ssl_cipher_list = ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384 ssl_dh = # hidden, use -P to show it ssl_key = # hidden, use -P to show it ssl_min_protocol = TLSv1.2 userdb { driver = prefetch } userdb { args = /etc/dovecot/dovecot-sql.conf driver = sql } protocol imap { auth_verbose = yes mail_plugins = quota zlib quota imap_quota } protocol pop3 { auth_verbose = yes mail_plugins = quota zlib quota pop3_uidl_format = %08Xu%08Xv } protocol lda { mail_plugins = quota zlib sieve quota postmaster_address = postmaster(a)xxxxx.xx } protocol lmtp { mail_plugins = quota zlib quota sieve postmaster_address = postmaster(a)xxxxx.xx -- Kind regards, Bouke J. Henstra

2 1

BUG report
by Oleg Pyzin 23 May '21

23 May '21

Hello! I've compiled Dovecot without any error, but couldn't run it. ------------- The error is: ------------- Feb 09 19:22:50 master: Panic: kevent(EV_ADD, READ, 21) failed: Invalid argument Feb 09 19:22:50 master: Error: Raw backtrace: 0 libdovecot.0.dylib 0x00216d58 askpass + 136 -> 1 libdovecot.0.dylib 0x00216e78 backtrace_get + 36 -> 2 libdovecot.0.dylib 0x00221fe8 i_set_debug_file + 248 -> 3 libdovecot.0.dylib 0x002220fc default_fatal_handler + 56 -> 4 dovecot 0x000039a0 dup2_append + 1884 -> 5 libdovecot.0.dylib 0x00221a8c i_panic + 120 -> 6 libdovecot.0.dylib 0x0022c13c io_loop_handle_add + 244 -> 7 libdovecot.0.dylib 0x0022f2c8 timeout_add_short + 416 -> 8 libdovecot.0.dylib 0x0022f574 io_add_to + 76 -> 9 dovecot 0x00007dd4 service_monitor_stop_close + 288 -> 10 dovecot 0x00008cdc services_monitor_start + 840 -> 11 dovecot 0x00004aa4 main + 3336 -> 12 dovecot 0x00003048 start + 68 ------------- dovecot -n: admin.MacPPC[/opt/local/var/log/dovecot] <467-7> $ sudo dovecot -n # 2.3.11.3 (): /opt/local/etc/dovecot/dovecot.conf # OS: Darwin 9.8.0 Power Macintosh hfs # Hostname: MacPPC.Dlink default_client_limit = 50 default_internal_group = _dovecot default_process_limit = 10 default_vsz_limit = 128 M info_log_path = /opt/local/var/log/dovecot/info listen = * log_path = /opt/local/var/log/dovecot/error login_plugin_dir = /opt/local/lib/dovecot mail_location = maildir:/private/srv/mail/%u namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } protocols = imap pop3 service imap { process_limit = 32 } service pop3 { process_limit = 32 } service submission { process_limit = 32 } ssl_cert = </etc/ssl/certs/dovecot.pem ssl_key = # hidden, use -P to show it userdb { driver = passwd } ------------------------------ Will be a very gratefull for the help, Oleg

1 0

Issue with dovecot v2.3.4.1 and mail_crypt plugin. Email received, but not encrypted on disk until moved out of root Maildir folder. IMAP child crashes when mail is read from folder message was moved to.
by Ben Burk 23 May '21

23 May '21

Recently I attempted enabling the mail_crypt plugin on a per user basis as summarized below: uname -a Linux smtp 4.19.0-16-amd64 #1 SMP Debian 4.19.181-1 (2021-03-19) x86_64 GNU/Linux dovecot --version 2.3.4.1 (f79e8e7e4) $ cat /etc/dovecot/conf.d/10-mailcrypt.conf mail_attribute_dict = file:%h/Maildir/dovecot-attributes mail_plugins = $mail_plugins mail_crypt plugin { mail_crypt_curve = secp521r1 mail_crypt_save_version = 2 mail_crypt_require_encrypted_user_key = yes } cat dovecot-sql.conf.ext driver = mysql connect = host=127.0.0.1 dbname=VVVVV user=WWWWWW password=XXXXXX user_query = SELECT user, \ concat('*:bytes=', quota) AS quota_rule, \ '/mail/%d/%n' AS home, \ uid, gid \ FROM virtual_users WHERE user='%u'; password_query = SELECT user, password, crypt as userdb_mail_crypt_save_version, '%w' AS userdb_mail_crypt_private_password FROM virtual_users WHERE user='%u'; dovecot -n # 2.3.4.1 (f79e8e7e4): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.4 () # OS: Linux 4.19.0-16-amd64 x86_64 Debian 10.9 # Hostname: smtp.burk.tech auth_verbose = yes mail_attribute_dict = file:%h/Maildir/dovecot-attributes mail_location = maildir:~/Maildir:LAYOUT=fs mail_plugins = quota mail_crypt mail_privileged_group = mail namespace inbox { inbox = yes location = mailbox Drafts { auto = subscribe special_use = \Drafts } mailbox Junk { auto = subscribe special_use = \Junk } mailbox Sent { auto = subscribe special_use = \Sent } mailbox Trash { auto = subscribe special_use = \Trash } prefix = type = private } passdb { driver = pam } plugin { mail_crypt_curve = secp521r1 mail_crypt_require_encrypted_user_key = # hidden, use -P to show it mail_crypt_save_version = 2 } protocols = imap service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0660 user = postfix } unix_listener auth-userdb { mode = 0777 } } service lmtp { unix_listener /var/spool/postfix/private/dovecot-lmtp { group = postfix mode = 0600 user = postfix } } ssl = required ssl_cert = </etc/dovecot/fullchain.cer.pem ssl_dh = # hidden, use -P to show it ssl_key = # hidden, use -P to show it ssl_min_protocol = TLSv1.2 ssl_prefer_server_ciphers = yes userdb { driver = passwd } verbose_ssl = yes protocol lmtp { hostname = smtp.burk.tech postmaster_address = postmaster(a)burk.tech } protocol imap { mail_max_userip_connections = 50 } The issue I've noticed occurs when the following settings above are enabled and mail is received into the root of the Maildir fs, then mail is moved to another folder (including a file being deleted). Upon a client's retrieval of messages from the folder where mail was moved to, the log spits out the following: May 22 19:18:15 smtp dovecot: imap-login: Login: user=<ben>, method=PLAIN, rip=XXX.XXX.XXX.XXX, lip=YYY.YYY.YYY.YYY, mpid=31682, TLS, session=<7oASZPPCkN9EdIVp> May 22 19:18:15 smtp dovecot: imap(ben)<31682><7oASZPPCkN9EdIVp>: Error: Mailbox Trash: Saving mail: save: read() failed: read(/mail/burk.tech/ben/Maildir/Receipts/cur/1621724316.M515979P30417.smtp,S=2903,W=2964:2,S) failed: Private key not available: Cannot decrypt key f9e7a6b9dd24535a29915fb46336047b07ae5b9fea5eda8e03cf9a8fa009f88b: Cannot decrypt key 876c6bfbc355a86c3c924a5841bb2e5c6e1b0c5496d5116c4fcb9c511f803c87: Password not available May 22 19:18:15 smtp dovecot: imap(ben)<31682><7oASZPPCkN9EdIVp>: Error: Mailbox Trash: copy: i_stream_read() failed: read(/mail/burk.tech/ben/Maildir/Receipts/cur/1621724316.M515979P30417.smtp,S=2903,W=2964:2,S) failed: Private key not available: Cannot decrypt key f9e7a6b9dd24535a29915fb46336047b07ae5b9fea5eda8e03cf9a8fa009f88b: Cannot decrypt key 876c6bfbc355a86c3c924a5841bb2e5c6e1b0c5496d5116c4fcb9c511f803c87: Password not available May 22 19:18:15 smtp dovecot: imap(ben)<31682><7oASZPPCkN9EdIVp>: Error: Mailbox Trash: Saving mail: read() failed: read(/mail/burk.tech/ben/Maildir/Receipts/cur/1621724316.M515979P30417.smtp,S=2903,W=2964:2,S) failed: Private key not available: Cannot decrypt key f9e7a6b9dd24535a29915fb46336047b07ae5b9fea5eda8e03cf9a8fa009f88b: Cannot decrypt key 876c6bfbc355a86c3c924a5841bb2e5c6e1b0c5496d5116c4fcb9c511f803c87: Password not available (read reason=) May 22 19:18:15 smtp dovecot: imap(ben)<31682><7oASZPPCkN9EdIVp>: Panic: file ostream-encrypt.c: line 631 (o_stream_encrypt_close): assertion failed: (estream->finalized || estream->ctx_sym == NULL || estream->ostream.ostream.stream_errno != 0) May 22 19:18:15 smtp dovecot: imap(ben)<31682><7oASZPPCkN9EdIVp>: Error: Raw backtrace: /usr/lib/dovecot/libdovecot.so.0(+0xdb73b) [0x7fdb3ce7273b] -> /usr/lib/dovecot/libdovecot.so.0(+0xdb7d1) [0x7fdb3ce727d1] -> /usr/lib/dovecot/libdovecot.so.0(+0x4a199) [0x7fdb3cde1199] -> /usr/lib/dovecot/libdovecot.so.0(+0x49276) [0x7fdb3cde0276] -> /usr/lib/dovecot/libdovecot.so.0(+0xffd5e) [0x7fdb3ce96d5e] -> /usr/lib/dovecot/libdovecot.so.0(o_stream_destroy+0x16) [0x7fdb3ce96d86] -> /usr/lib/dovecot/libdovecot-storage.so.0(maildir_save_finish+0x18d) [0x7fdb3cfa946d] -> /usr/lib/dovecot/libdovecot-storage.so.0(mailbox_save_cancel+0x4d) [0x7fdb3cf8167d] -> /usr/lib/dovecot/libdovecot-storage.so.0(mail_storage_copy+0x122) [0x7fdb3cf73f22] -> /usr/lib/dovecot/libdovecot-storage.so.0(+0x5badc) [0x7fdb3cf81adc] -> /usr/lib/dovecot/libdovecot-storage.so.0(mailbox_move+0x31) [0x7fdb3cf81c11] -> dovecot/imap(+0x128f5) [0x563bd267a8f5] -> dovecot/imap(command_exec+0x70) [0x563bd2687dc0] -> dovecot/imap(+0x1e3f2) [0x563bd26863f2] -> dovecot/imap(+0x1e494) [0x563bd2686494] -> dovecot/imap(client_handle_input+0x1b5) [0x563bd2686845] -> dovecot/imap(client_input+0x7e) [0x563bd2686d6e] -> /usr/lib/dovecot/libdovecot.so.0(io_loop_call_io+0x6f) [0x7fdb3ce88bef] -> /usr/lib/dovecot/libdovecot.so.0(io_loop_handler_run_internal+0x136) [0x7fdb3ce8a1e6] -> /usr/lib/dovecot/libdovecot.so.0(io_loop_handler_run+0x4c) [0x7fdb3ce88c8c] -> /usr/lib/dovecot/libdovecot.so.0(io_loop_run+0x40) [0x7fdb3ce88df0] -> /usr/lib/dovecot/libdovecot.so.0(master_service_run+0x13) [0x7fdb3ce09123] -> dovecot/imap(main+0x325) [0x563bd2678bf5] -> /lib/x86_64-linux-gnu/libc.so.6(__libc_start_main+0xeb) [0x7fdb3cbf209b] -> dovecot/imap(_start+0x2a) [0x563bd2678d8a] May 22 19:18:15 smtp dovecot: imap-login: Debug: SSL alert: close notify May 22 19:18:15 smtp dovecot: imap(ben)<31682><7oASZPPCkN9EdIVp>: Fatal: master: service(imap): child 31682 killed with signal 6 (core dumps disabled - https://dovecot.org/bugreport.html#coredumps) My keys for the user are as follows: ben(a)smtp.burk.tech :~$ doveadm mailbox cryptokey list -U doveadm(ben): Error: net_connect_unix(/var/run/dovecot/stats-writer) failed: Permission denied Folder Active Public ID yes 876c6bfbc355a86c3c924a5841bb2e5c6e1b0c5496d5116c4fcb9c511f803c87 I've checked and it appears that the mail as its received into the root of Maildir is not initially encrypted. It is stored plaintext. However, when the mail is moved, it is then properly encrypted. ben(a)smtp.burk.tech :~/Maildir/cur$ file 1621726534.31820_1.smtp\:2\, 1621726534.31820_1.smtp:2,: SMTP mail, ASCII text ben(a)smtp.burk.tech :~/Maildir/Receipts/cur$ file 1621726595.M343917P30832.smtp\,S\=2927\,W\=2988\:2\,S 1621726595.M343917P30832.smtp,S=2927,W=2988:2,S: MailCrypt -- Ben Burk BURK.TECH System Administrator

1 0

Dovecot Subfolder Always Uses dot separator with mdbox
by Steven Smith 22 May '21

22 May '21

I’m trying to configure dovecot to use mailbox subfolders that look like both foo/bar on the IMAP client and the filesystem. But the subfolders created all look like foo.bar, not foo/bar with a proper nesting structure. This also happens when the folder ‘bar’ is moved into the folder ‘foo’—A new folder `foo.bar’ is created. I believe that i’m following the configuration rules at https://wiki.dovecot.org/MailboxFormat/Maildir#Maildir_and_filesystems and https://wiki.dovecot.org/MailLocation/Maildir. This issue happens whether I set separator to its default, ‘.’, or ‘/’: > mail_location = mdbox:/private/var/mail/tld.hostname.mail/%Ln/mdbox:LAYOUT=fs > namespace inbox { > … > separator = / > … > } The IMAP client is macOS Mail.app version 14.0. I’d greatly appreciate any help or pointers to fix this configuration issue. dovecot -n > # 2.3.13 (): /opt/local/etc/dovecot/dovecot.conf > # Pigeonhole version 0.5.13 () > # OS: Darwin 20.4.0 x86_64 apfs > # Hostname: mail.hostname.tld > aps_topic = com.apple.mail.XServer.ffffffff-ffff-fff-ffffffffff > auth_cache_size = 10 M > auth_gssapi_hostname = $ALL > auth_krb5_keytab = /opt/local/etc/dovecot/imap.keytab > auth_mechanisms = plain gssapi > auth_realms =mail.hostname.tld > auth_socket_path = /opt/local/var/run/dovecot/auth-userdb > auth_username_format = %Ln > debug_log_path = /opt/local/var/log/mail/mail-debug.log > disable_plaintext_auth = no > first_valid_gid = 6 > first_valid_uid = 6 > imap_id_log = * > imap_id_send = "name" * "version" * > imap_idle_notify_interval = 29 mins > imap_urlauth_submit_user = submit > info_log_path = /opt/local/var/log/mail/mail-info.log > last_valid_gid = 100 > lda_mailbox_autocreate = yes > log_path = /opt/local/var/log/mail/mail-err.log > login_log_format_elements = user=<%u> method=%m rip=%r lip=%l mpid=%e %c > mail_access_groups = mail > mail_attachment_dir = /private/var/mail/tld.hostname.mail/attachments > mail_attachment_fs = sis posix:mode=0666 > mail_gid = mail > mail_home = /private/var/mail/tld.hostname.mail > mail_location = mdbox:/private/var/mail/tld.hostname.mail/%Ln/mdbox:LAYOUT=fs > mail_log_prefix = "%s(pid %p user %u): " > mail_plugins = quota zlib acl fts fts_solr fts_lucene > mail_privileged_group = mail > mail_uid = _dovecot > managesieve_notify_capability = mailto > managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext imapsieve vnd.dovecot.imapsieve > mdbox_rotate_size = 200 M > namespace inbox { > inbox = yes > location = > mailbox Archive { > auto = subscribe > special_use = \Archive > } > mailbox Drafts { > auto = subscribe > special_use = \Drafts > } > mailbox Junk { > auto = create > special_use = \Junk > } > mailbox Notspam_train { > auto = create > special_use = \Junk > } > mailbox Sent { > auto = subscribe > special_use = \Sent > } > mailbox "Sent Messages" { > special_use = \Sent > } > mailbox Spam_train { > auto = create > special_use = \Junk > } > mailbox Trash { > auto = create > special_use = \Trash > } > prefix = > separator = / > } > passdb { > driver = pam > name = pam > } > plugin { > fts = solr > fts_autoindex = yes > fts_autoindex_exclude = \Junk > fts_solr = url=http://127.0.0.1:8983/solr/dovecot/ > imapsieve_mailbox1_before = file:/opt/local/etc/dovecot/sieve/report-spam.sieve > imapsieve_mailbox1_causes = COPY APPEND > imapsieve_mailbox1_name = Spam_train > imapsieve_mailbox2_before = file:/opt/local/etc/dovecot/sieve/report-ham.sieve > imapsieve_mailbox2_causes = COPY APPEND > imapsieve_mailbox2_name = Notspam_train > mail_log_events = delete undelete expunge copy mailbox_delete mailbox_rename > mail_log_fields = uid box msgid from subject size flags > quota_grace = 10%% > quota_rule = *:storage=16G > quota_rule2 = Trash:storage=+256M > quota_warning = storage=100%% quota-exceeded %u > quota_warning2 = storage=80%% quota-warning %u > recipient_delimiter = + > sieve = /private/var/mail/tld.hostname.mail/rules/%Ln/dovecot.sieve > sieve_after = /opt/local/etc/dovecot/sieve-after.d > sieve_before = /opt/local/etc/dovecot/sieve-before.d > sieve_dir = /private/var/mail/tld.hostname.mail/rules/%Ln/%u > sieve_global_extensions = +vnd.dovecot.pipe +vnd.dovecot.environment > sieve_pipe_bin_dir = /opt/local/etc/dovecot/sieve > sieve_plugins = sieve_imapsieve sieve_extprograms > sieve_quota_max_storage = 50M > } > postmaster_address = postmaster(a)hostname.tld > protocols = imap lmtp sieve > quota_full_tempfail = yes > sendmail_path = /opt/local/sbin/sendmail > service auth-worker { > group = mail > user = root > } > service auth { > extra_groups = _keytabusers > idle_kill = 15 mins > unix_listener /opt/local/var/spool/postfix/private/auth { > group = mail > mode = 0660 > user = _postfix > } > } > service dns-client { > unix_listener dns-client { > mode = 0600 > } > } > service imap-login { > inet_listener imap { > address = 127.0.0.1, ::1 > port = 143 > } > inet_listener imaps { > port = 993 > ssl = yes > } > process_min_avail = 6 > service_count = 0 > vsz_limit = 2 G > } > service imap { > process_limit = 200 > process_min_avail = 6 > } > service lmtp { > unix_listener /opt/local/var/spool/postfix/private/dovecot-lmtp { > group = mail > mode = 0660 > user = _postfix > } > } > ssl = required > ssl_ca = </opt/local/etc/certificates/cert.chain.pem > ssl_cert = </opt/local/etc/certificates/cert.cert.pem > ssl_cipher_list = ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256 > ssl_dh = # hidden, use -P to show it > ssl_key = # hidden, use -P to show it > ssl_min_protocol = TLSv1.2 > ssl_prefer_server_ciphers = yes > userdb { > driver = passwd > name = passwd > } > verbose_proctitle = yes > protocol lda { > mail_fsync = optimized > mail_plugins = quota zlib acl fts fts_solr fts_lucene sieve push_notify > } > protocol imap { > mail_max_userip_connections = 50 > mail_plugins = quota zlib acl fts fts_solr fts_lucene imap_acl imap_quota imap_zlib imap_sieve > } > protocol lmtp { > mail_fsync = optimized > mail_plugins = quota zlib acl fts fts_solr fts_lucene sieve > }

1 0

Dovecot v2.3.13 reporting (very) incorrect vsize for some maildir folders
by Eirik Rye 22 May '21

22 May '21

Hello! Dovecot v2.3.13. Full, but anonymized, `doveconf -n` attached. We are in the process of migrating maildir-backed users from filesystem quotes, to using dovecot's "count" quota backend. This is not reflected in the doveconf output because we're overriding `quota`, `quota_rule` and `quota_vsizes` in userdb: {"quota":"count:User quota","quota_rule":"*:storage=15G","quota_vsizes":"yes"} Afterwards, for a couple users, we received reports that mail delivery had failed because they were over quota. When looking into it for a specific user, we noticed that the vsize reported for a particular folder (with 47k messages) was reported as being nearly 50 times larger than it's on-disk size: root@mail02:~# doveadm mailbox status -u anonymized_user 'messages recent unseen vsize' 'anonymized/folder/name' [...] anonymized/folder/name messages=47338 recent=0 unseen=0 vsize=14335366070 However, the filesystem itself reports a much smaller size (but correct message count): root@mail02:~# du -hd1 /home/anonymized_user/Maildir/.anonymized.folder.name/ 313M /home/anonymized_user/Maildir/.anonymized.folder.name/cur 36K /home/anonymized_user/Maildir/.anonymized.folder.name/tmp 4.0K /home/anonymized_user/Maildir/.anonymized.folder.name/new 320M /home/anonymized_user/Maildir/.anonymized.folder.name/ root@mail02:~# ls /home/anonymized_user/Maildir/.anonymized.folder.name/cur | wc -l 47338 I have tried: - `doveadm force-resync -u anonymized_user` - deleting the index files in the specific folder, and running `doveadm index -u anonymized_user '*'` as well as `doveadm mailbox status -u anonymized_user vsize '*'` - deleting all `*index*` files in maildir, and running `doveadm index -u anonymized_user '*'` as well as `doveadm mailbox status -u anonymized_user vsize '*'` - comparing all maildir-sizes (S=) with their actual sizes to see if there are discrepancies. There are none. - regardless of the above, set `maildir_broken_filename_sizes = yes`, deleted indexes and reindexed. Even after deleting the list index (dovecot.list.index) as well as the mailbox indexes, recalculating the vsize seems very quick so I feel like the incorrect vsize is being fetched from a cache somewhere instead of being recalculated..? Any idea what is causing dovecot to report this wildly incorrect mailbox size? Are there any other files (not matching `*index*`) that are responsible? I'd rather not touch the user's control files, for obvious reasons. On a side note: We're also experiencing some issues with `mail_vsize_bg_after_count`. It seems to work correctly by returning a temporary error and deferring to a background job, but the indexer-worker job often times never appears to start (or do anything) at all: dovecot 29622 0.0 0.0 4120 1124 ? S 15:22 0:00 dovecot/indexer [0 clients, 0 requests] 266248 29623 0.0 0.0 6008 4604 ? S 15:22 0:00 dovecot/indexer-worker [idling] Waiting a while, and attempting to refetch the quota returns the same temperror with no indexer-worker being started. However, this is a separate issue from the above and can be ignored for now. Best regards, Eirik Rye

4 11

director & backend on same server with director_proxy_maybe
by lucas.raynaud＠ircf.fr 21 May '21

21 May '21

Hello, I've 2 mail servers, as test server, with dovecot as backend and setup pop3 and imap connections and NFS. For prevent issues with simultaneous connections I want to setup up Director on the same VM and on the same instance as the backend Dovecot. I found in the documentation that this configuration is broken, but can work with development, and after research on the internet and on the questions encountered previously as on : https://dovecot.org/pipermail/dovecot/2015-July/101483.html https://dovecot.org/pipermail/dovecot/2011-September/130939.html https://dovecot.org/pipermail/dovecot/2012-June/136535.html I find it quite unclear if this is really possible with director_proxy_maybe, which according to the changelog, allows this setup to work. Today I've reached this level with those errors: IPs : mail4 : XX.XX.111.8 mail3 : XX.XX.51.247 doveadm director ring status director ip port type last failed status // on mail3 XX.XX.51.247 9090 self never synced XX.XX.111.8 9090 l+r never synced doveadm director status lucas.raynaud(a)ircf.fr Current: 5.196.111.8 (expires 2021-05-21 10:48:51) Hashed: 5.196.111.8 Initial config: login with lucas.raynaud(a)ircf.fr on mail4 mail log on mail4 May 21 10:51:52 mail4 dovecot: auth-worker(12917): Debug: sql(lucas.raynaud(a)ircf.fr,XX.XX.111.8,<4h3SK9PCYsIFxG8I>): query: SELECT password, 'y' as proxy_maybe, 'y' as director_proxy_maybe FROM mail_user WHERE (login = 'lucas.raynaud(a)ircf.fr' OR email = 'lucas.raynaud(a)ircf.fr') AND disableimap = 'n' AND server_id = '8' May 21 10:51:52 mail4 dovecot: auth: Debug: client passdb out: OK#0111#011user=lucas.raynaud@ircf.fr#011director_proxy_maybe=y#011lip=XX.XX.111.8#011lport=143#011proxy#011pass=x9Im.bprP!CWzbgQ May 21 10:51:52 mail4 dovecot: imap-login: Debug: Ignoring unknown passdb extra field: director_proxy_maybe May 21 10:51:52 mail4 dovecot: imap-login: Debug: Ignoring unknown passdb extra field: lip May 21 10:51:52 mail4 dovecot: imap-login: Debug: Ignoring unknown passdb extra field: lport May 21 10:51:52 mail4 dovecot: imap-login: Error: proxy: host not given: user=<lucas.raynaud(a)ircf.fr>, method=PLAIN, rip=XX.XX.111.8, lip=XX.XX.111.8, secured, session=<4h3SK9PCYsIFxG8I> May 21 10:51:52 mail4 dovecot: imap-login: Disconnected (internal failure, 1 successful auths): user=<lucas.raynaud(a)ircf.fr>, method=PLAIN, rip=XX.XX.111.8, lip=XX.XX.111.8, secured, session=<4h3SK9PCYsIFxG8I> no log on mail3 login with lucas.raynaud(a)ircf.fr on mail3 mail log on mail3 May 21 10:55:07 mail3 dovecot: auth-worker(19907): Debug: sql(lucas.raynaud(a)ircf.fr,XX.XX.51.247,<Hh5yN9PCRtAFxDP3>): query: SELECT password, 'y' as proxy_maybe, 'y' as director_proxy_maybe FROM mail_user WHERE (login = 'lucas.raynaud(a)ircf.fr' OR email = 'lucas.raynaud(a)ircf.fr') AND disableimap = 'n' AND server_id = '8' May 21 10:55:07 mail3 dovecot: auth: Debug: client passdb out: OK#0111#011user=lucas.raynaud@ircf.fr#011director_proxy_maybe=y#011lip=XX.XX.51.247#011lport=143#011proxy#011pass=x9Im.bprP!CWzbgQ May 21 10:55:07 mail3 dovecot: imap-login: Debug: Ignoring unknown passdb extra field: director_proxy_maybe May 21 10:55:07 mail3 dovecot: imap-login: Debug: Ignoring unknown passdb extra field: lip May 21 10:55:07 mail3 dovecot: imap-login: Debug: Ignoring unknown passdb extra field: lport May 21 10:55:07 mail3 dovecot: imap-login: proxy(lucas.raynaud(a)ircf.fr): Login failed to XX.XX.111.8:143: [UNAVAILABLE] Account is temporarily unavailable.: user=<lucas.raynaud(a)ircf.fr>, method=PLAIN, rip=XX.XX.51.247, lip=XX.XX.51.247, secured, session=<Hh5yN9PCRtAFxDP3> May 21 10:55:07 mail3 dovecot: imap-login: Disconnected (proxy dest auth failed): user=<lucas.raynaud(a)ircf.fr>, method=PLAIN, rip=XX.XX.51.247, lip=XX.XX.51.247, secured, session=<Hh5yN9PCRtAFxDP3> mail log on mail4 May 21 10:55:07 mail4 dovecot: auth-worker(13096): Debug: sql(lucas.raynaud(a)ircf.fr,XX.XX.51.247,<rI10N9PCyKsFxDP3>): query: SELECT password, 'y' as proxy_maybe, 'y' as director_proxy_maybe FROM mail_user WHERE (login = 'lucas.raynaud(a)ircf.fr' OR email = 'lucas.raynaud(a)ircf.fr') AND disableimap = 'n' AND server_id = '8' May 21 10:55:07 mail4 dovecot: auth: Debug: client passdb out: OK#0111#011user=lucas.raynaud@ircf.fr#011director_proxy_maybe=y#011lip=XX.XX.111.8#011lport=143#011proxy#011pass=x9Im.bprP!CWzbgQ May 21 10:55:07 mail4 dovecot: imap-login: Debug: Ignoring unknown passdb extra field: director_proxy_maybe May 21 10:55:07 mail4 dovecot: imap-login: Debug: Ignoring unknown passdb extra field: lip May 21 10:55:07 mail4 dovecot: imap-login: Debug: Ignoring unknown passdb extra field: lport May 21 10:55:07 mail4 dovecot: imap-login: Error: proxy: host not given: user=<lucas.raynaud(a)ircf.fr>, method=PLAIN, rip=XX.XX.51.247, lip=XX.XX.111.8, session=<rI10N9PCyKsFxDP3> May 21 10:55:07 mail4 dovecot: imap-login: Disconnected (internal failure, 1 successful auths): user=<lucas.raynaud(a)ircf.fr>, method=PLAIN, rip=XX.XX.51.247, lip=XX.XX.111.8, session=<rI10N9PCyKsFxDP3> sql query : password_query = SELECT password, 'y' as proxy_maybe, 'y' as director_proxy_maybe FROM mail_user WHERE (login = '%u' OR email = '%u') AND disable%Ls = 'n' AND server_id = '8' It seems that Director is working but not adding the "host" extra field when it should, also it's strange that the director_proxy_maybe is unknown. Is it really possible to configure director on same instance as backend? Is director_proxy_maybe working? Also do you have answers about my problems? Thanks for advance. Lucas ############ mail3's and mail4's configs are the same. dovecot -n # 2.2.27 (): /etc/dovecot/dovecot.conf # Pigeonhole version 0.4.16 () # OS: Linux 4.9.0-14-amd64 x86_64 Debian 9.13 auth_debug = yes auth_debug_passwords = yes auth_mechanisms = plain login auth_proxy_self = XX.XX.111.8 auth_verbose = yes dict { quota = mysql:/etc/dovecot/dovecot-dict-sql.conf.ext } director_mail_servers = XX.XX.111.8 XX.XX.51.247 director_servers = XX.XX.111.8 XX.XX.51.247 director_user_expire = 5 mins disable_plaintext_auth = no doveadm_port = 24245 mail_location = mbox:~/mail:INBOX=/var/mail/%u mail_plugins = " quota" mail_privileged_group = vmail managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } passdb { args = /etc/dovecot/dovecot-sql.conf.ext driver = sql } plugin { quota = dict:user::file:/var/vmail/%d/%n/.quotausage quota_warning = storage=90%% quota-warning 90 %u sieve = /var/vmail/%d/%n/.sieve sieve_after = /etc/dovecot/sieve/after.d sieve_before = /var/vmail/%d/%n/sieve sieve_dir = /var/vmail/%d/%n/sieve/ sieve_global_dir = /etc/dovecot/sieve } pop3_reuse_xuidl = yes pop3_save_uidl = yes pop3_uidl_format = UID%u-%v protocols = " imap sieve pop3" service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0660 user = postfix } unix_listener auth-userdb { group = vmail mode = 0600 user = vmail } } service director { fifo_listener login/proxy-notify { mode = 0666 user = $default_login_user } inet_listener { port = 9090 } unix_listener director-userdb { mode = 0600 } unix_listener login/director { mode = 0666 } } service doveadm { inet_listener { port = 24245 } } service imap-login { executable = imap-login director inet_listener imap { port = 143 } } service ipc { unix_listener ipc { user = dovecot } } service pop3-login { executable = pop3-login director inet_listener pop3 { port = 110 } } service quota-warning { executable = script /usr/local/bin/mail-scripts/quota-warning.sh unix_listener quota-warning { group = vmail mode = 0660 user = vmail } user = vmail } ssl_cert = </opt/ssl/ircf.crt ssl_key = # hidden, use -P to show it userdb { args = /etc/dovecot/dovecot-sql.conf.ext driver = sql } protocol lmtp { auth_socket_path = director-userdb } protocol doveadm { auth_socket_path = director-userdb } protocol lda { mail_plugins = " quota sieve quota" } protocol imap { auth_socket_path = director-userdb mail_max_userip_connections = 16 mail_plugins = " quota quota imap_quota" } protocol pop3 { auth_socket_path = director-userdb mail_max_userip_connections = 16 mail_plugins = " quota quota" } local 10.10.10.0/24 { doveadm_password = # hidden, use -P to show it }

1 0

Re: WG: blocking - sql(acastus@example.ch,IP): unknown user
by mauric＠gmx.ch 20 May '21

20 May '21

>Hi! >You can try auth_policy_server such as weakforced. See <https://github.com/PowerDNS/weakforced> https://github.com/PowerDNS/weakforced and <https://doc.dovecot.org/configuration_manual/authentication/auth_policy/#au thentication-auth-policy> https://doc.dovecot.org/configuration_manual/authentication/auth_policy/#aut hentication-auth-policy >Aki And this Weakforced, i dont found for Debian Booster, so I have try to install but this need other meny requirements pakage, so please this are also possible as package for Debian? here any running with this this setup? I don't found any example on the net... or you using fail2ban? Mauri

1 0

Sendmail and Doecot
by Stephane Magnier 20 May '21

20 May '21

Hi, I am using Dovecot v 2.2.32 and Sendmail 8.15.2 My "folder" config on Dovecot is : mbox:/var/spool2/%u/mail:LAYOUT=fs:INBOX=/var/spool/mail/%u But in fact, any email arriving into the mailbox, stays in Sendmail into the file location (by default) : /var/spool/mail/user1 and any folder created, can be reached via Dovecot and is located to /var/spool2/user1 If I want to backup the user1's emails, I need to backup the "dovecot" location ( /var/spool2/user1) but also the Sendmail file location ( /var/spool/mail/user1) If I don't do that, I loose fresh emails which are still into the Sendmail directory, which are not copied into the Dovecot location.. Sounds weird I would expect to backup only my Dovecot directory and my email client should see only the Dovecot directory I would expect to have small sendmail email file user ( /var/spool/mail/user1 ) and i should't car about these files. Everything should be copied automatically into my Dovecot location what do you think ? Best regards, Stéve

3 2

blocking - sql(acastus@example.ch,IP): unknown user
by mauric＠gmx.ch 19 May '21

19 May '21

hello running with following Setup booster, postfix, Dovecot, mysql and meny other nice tools searching for solutions I see meny other running with same questions like this, so please what i need to read or setup that i don't receive so many failed logon try? "unknown user" i see, meny "fix" this fail2ban, but iam shure that Dovecot has also any solution for this? so friendly asking how to close this request from trying for failed logon. May 14 time Dovecot/auth-worker(8075): Debug: Loading modules from directory: /usr/lib/dovecot/modules/auth May 14 time Dovecot/auth-worker(8075): Debug: Module loaded: /usr/lib/dovecot/modules/auth/lib20_auth_var_expand_crypt.so May 14 time Dovecot/auth-worker(8075): Debug: Module loaded: /usr/lib/dovecot/modules/auth/libdriver_mysql.so May 14 time Dovecot/auth-worker(8043): Debug: sql(acastus(a)example.ch,IP): query: SELECT username AS user, password, '/folder/example.ch/acastus' AS userdb_home, '10000' AS userdb_uid, '10000' AS userdb_gid, CONCAT('maildir:storage=', (quota*1024)) as userdb_quota FROM mailbox WHERE username='acastus(a)example.ch' AND active = 1 May 14 time Dovecot/auth-worker(8026): Info: sql(acastus(a)example.ch,IP): unknown user thanks Mauri

3 2

Separating Dovecot and Postfix
by White, Daniel E. (GSFC-770.0)[NICS] 14 May '21

14 May '21

I am struggling to update a very old set of mail servers. Some are supposed to be relays (MTAs by my understanding) while others are where the mailboxes live (MDA) In rebuilding the MDA servers, is postfix required on the same server or can dovecot connect to postfix on a separate MTA server ? The old MDAs have both installed, but the config files are a mess.

3 4

lmtp(5672): Fatal: master: service(lmtp): child 5672 killed with signal 11 (core dumped)
by Alex 14 May '21

14 May '21

Hi Sometimes I see such lines in the logs May 10 23:15:31 mail dovecot[374]: lmtp(452): Fatal: master: service(lmtp): child 452 killed with signal 11 (core not dumped - https://dovecot.org/bugreport.html#coredumps - set /proc/sys/fs/suid_dumpable to 2) May 12 18:50:19 mail dovecot[374]: lmtp(3533): Fatal: master: service(lmtp): child 3533 killed with signal 11 (core not dumped - https://dovecot.org/bugreport.html#coredumps - set /proc/sys/fs/suid_dumpable to 2) May 13 17:21:34 mail dovecot[4910]: lmtp(5672): Fatal: master: service(lmtp): child 5672 killed with signal 11 (core dumped) and postfix logs: postfix/lmtp[28025]: 502DA17E1BC3: to=<email(a)domain.com>, relay=1.0.1.1[1.0.1.1]:11111, delay=0.78, delays=0.69/0/0.09/0, dsn=4.4.2, status=deferred (lost connection with 1.0.1.1[1.0.1.1] while receiving the initial server greeting) It was the spam message This error was in some previous versions too Information for debugging: dovecot is working in lxc container with Centos 8 in Proxmox 5.4.101-1-pve #1 SMP PVE 5.4.101-1 (Fri, 26 Feb 2021 13:13:09 +0100) x86_64 x86_64 x86_64 GNU/Linux # gdb /usr/libexec/dovecot/lmtp 'core-lmtp-5672-!usr!libexec!dovecot!lmtp' GNU gdb (GDB) Red Hat Enterprise Linux 8.2-12.el8 Copyright (C) 2018 Free Software Foundation, Inc. License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html> This is free software: you are free to change and redistribute it. There is NO WARRANTY, to the extent permitted by law. Type "show copying" and "show warranty" for details. This GDB was configured as "x86_64-redhat-linux-gnu". Type "show configuration" for configuration details. For bug reporting instructions, please see: <http://www.gnu.org/software/gdb/bugs/>. Find the GDB manual and other documentation resources online at: <http://www.gnu.org/software/gdb/documentation/>. For help, type "help". Type "apropos word" to search for commands related to "word"... Reading symbols from /usr/libexec/dovecot/lmtp...Reading symbols from /usr/lib/debug/usr/libexec/dovecot/lmtp-2.3.14-1.0.rhel8.x86_64.debug...done. done. [New LWP 5672] [Thread debugging using libthread_db enabled] Using host libthread_db library "/lib64/libthread_db.so.1". Core was generated by `dovecot/lmtp'. Program terminated with signal SIGSEGV, Segmentation fault. #0 __strlen_sse2 () at ../sysdeps/x86_64/multiarch/../strlen.S:120 120 movdqu (%rax), %xmm4 (gdb) bt #0 __strlen_sse2 () at ../sysdeps/x86_64/multiarch/../strlen.S:120 #1 0x00007fbc3f65725b in p_strdup (pool=0x5620ae47d3e0, str=0x8 <error: Cannot access memory at address 0x8>) at strfuncs.c:51 #2 0x00007fbc3f5b292a in setting_copy () at settings-parser.c:1538 #3 0x00007fbc3f5b2d8a in settings_dup_full () at settings-parser.c:1600 #4 0x00007fbc3f9547ba in mail_user_alloc (parent_event=0x0, username=0x7fbc3fa0b24a "raw mail user", set_info=0x5620ae46e458, set=0x5620ae430220) at mail-user.c:113 #5 0x00007fbc3f9a1dc5 in raw_storage_create_from_set (set_info=<optimized out>, set=<optimized out>) at raw-storage.c:25 #6 0x00005620ad66769a in client_raw_user_create (client=0x5620ae4aa8b8, client=0x5620ae4aa8b8) at lmtp-client.c:105 #7 client_create (fd_in=17, fd_out=17, conn=0x7fff7071af50) at lmtp-client.c:177 #8 0x00007fbc3f5acc99 in master_service_client_connection_callback (service=0x5620ae427130, conn=0x7fff7071af50) at master-service.c:980 #9 0x00007fbc3f5ad015 in master_service_listen (l=0x5620ae427610) at master-service.c:1212 #10 0x00007fbc3f63904d in io_loop_call_io (io=0x5620ae5032b0) at ioloop.c:714 #11 0x00007fbc3f63a679 in io_loop_handler_run_internal (ioloop=ioloop@entry=0x5620ae4272d0) at ioloop-epoll.c:222 #12 0x00007fbc3f6390f0 in io_loop_handler_run (ioloop=0x5620ae4272d0) at ioloop.c:766 #13 0x00007fbc3f639268 in io_loop_run (ioloop=0x5620ae4272d0) at ioloop.c:739 #14 0x00007fbc3f5ac557 in master_service_run (service=0x5620ae427130, callback=callback@entry=0x5620ad666fa0 <client_connected>) at master-service.c:853 #15 0x00005620ad666dcd in main (argc=<optimized out>, argv=<optimized out>) at main.c:168 (gdb) bt full #0 __strlen_sse2 () at ../sysdeps/x86_64/multiarch/../strlen.S:120 No locals. #1 0x00007fbc3f65725b in p_strdup (pool=0x5620ae47d3e0, str=0x8 <error: Cannot access memory at address 0x8>) at strfuncs.c:51 mem = <optimized out> len = <optimized out> #2 0x00007fbc3f5b292a in setting_copy () at settings-parser.c:1538 strlist_info = {module_name = 0x0, defines = 0x0, defaults = 0x0, type_offset = 18446744073709551615, struct_size = 0, parent_offset = 18446744073709551615, parent = 0x0, check_func = 0x0, expand_check_func = 0x0, dependencies = 0x0, dynamic_parsers = 0x0} #3 0x00007fbc3f5b2d8a in settings_dup_full () at settings-parser.c:1600 strlist_info = {module_name = 0x0, defines = 0x0, defaults = 0x0, type_offset = 18446744073709551615, struct_size = 0, parent_offset = 18446744073709551615, parent = 0x0, check_func = 0x0, expand_check_func = 0x0, dependencies = 0x0, dynamic_parsers = 0x0} #4 0x00007fbc3f9547ba in mail_user_alloc (parent_event=0x0, username=0x7fbc3fa0b24a "raw mail user", set_info=0x5620ae46e458, set=0x5620ae430220) at mail-user.c:113 pool = 0x5620ae47d3e0 #5 0x00007fbc3f9a1dc5 in raw_storage_create_from_set (set_info=<optimized out>, set=<optimized out>) at raw-storage.c:25 user = <optimized out> ns = <optimized out> ns_set = <optimized out> mail_set = <optimized out> error = 0x7fff7071af50 "\021" #6 0x00005620ad66769a in client_raw_user_create (client=0x5620ae4aa8b8, client=0x5620ae4aa8b8) at lmtp-client.c:105 sets = <optimized out> sets = <optimized out> #7 client_create (fd_in=17, fd_out=17, conn=0x7fff7071af50) at lmtp-client.c:177 rcpt_param_extensions = {0x5620ad66be6b "XRCPTFORWARD", 0x0} cap_rcpt_forward = {name = 0x5620ad66be6b "XRCPTFORWARD", params = 0x0} workarounds = <optimized out> lmtp_set = {protocol = SMTP_PROTOCOL_SMTP, capabilities = SMTP_CAPABILITY_NONE, workarounds = (unknown: 1886498356), hostname = 0x5620ae426760 "", login_greeting = 0x1 <error: Cannot access memory at address 0x1>, rawlog_dir = 0x0, ssl = 0x0, max_client_idle_time_msecs = 1886498432, max_pipelined_commands = 32767, max_bad_commands = 1062726285, max_recipients = 32700, command_limits = {max_parameters_size = 94698362529624, max_auth_size = 140446494082554, max_data_size = 140735079886496}, max_message_size = 94698362822992, mail_param_extensions = 0x2ae426758, rcpt_param_extensions = 0x7fff7071ae34, xclient_extensions = 0x7071aec0, socket_send_buffer_size = 15936827190723348992, socket_recv_buffer_size = 11513522008, event_parent = 0x5620ae46e150, debug = false, auth_optional = false, tls_required = false, mail_path_allow_broken = false, rcpt_domain_optional = false} client = 0x5620ae4aa8b8 pool = <optimized out> #8 0x00007fbc3f5acc99 in master_service_client_connection_callback (service=0x5620ae427130, conn=0x7fff7071af50) at master-service.c:980 No locals. #9 0x00007fbc3f5ad015 in master_service_listen (l=0x5620ae427610) at master-service.c:1212 service = 0x5620ae427130 conn = {fd = 17, listen_fd = 10, name = 0x5620ae4276c0 "lmtp", remote_ip = {family = 2, u = {ip6 = {__in6_u = {__u6_addr8 = "\n\000\003e", '\000' <repeats 11 times>, __u6_addr16 = {10, 25859, 0, 0, 0, 0, 0, 0}, __u6_addr32 = {1694695434, 0, 0, 0}}}, ip4 = {s_addr = 1694695434}}}, local_ip = {family = 2, u = {ip6 = {__in6_u = {__u6_addr8 = "\n\000\n\a", '\000' <repeats 11 times>, __u6_addr16 = {10, 1802, 0, 0, 0, 0, 0, 0}, __u6_addr32 = {118095882, 0, 0, 0}}}, ip4 = {s_addr = 118095882}}}, remote_port = 50660, local_port = 24, real_remote_ip = {family = 2, u = { ip6 = {__in6_u = {__u6_addr8 = "\n\000\003e", '\000' <repeats 11 times>, __u6_addr16 = {10, 25859, 0, 0, 0, 0, 0, 0}, __u6_addr32 = {1694695434, 0, 0, 0}}}, ip4 = {s_addr = 1694695434}}}, real_local_ip = {family = 2, u = {ip6 = {__in6_u = {__u6_addr8 = "\n\000\n\a", '\000' <repeats 11 times>, __u6_addr16 = {10, 1802, 0, 0, 0, 0, 0, 0}, __u6_addr32 = {118095882, 0, 0, 0}}}, ip4 = { s_addr = 118095882}}}, real_remote_port = 50660, real_local_port = 24, proxy = {hostname = 0x0, cert_common_name = 0x0, alpn = 0x0, alpn_size = 0, ssl = false, ssl_client_cert = false}, proxied = false, fifo = false, ssl = false, accepted = true} #10 0x00007fbc3f63904d in io_loop_call_io (io=0x5620ae5032b0) at ioloop.c:714 ioloop = 0x5620ae4272d0 t_id = 2 __func__ = "io_loop_call_io" #11 0x00007fbc3f63a679 in io_loop_handler_run_internal (ioloop=ioloop@entry=0x5620ae4272d0) at ioloop-epoll.c:222 ctx = 0x5620ae42c5f0 events = <optimized out> event = 0x5620ae42c670 --Type <RET> for more, q to quit, c to continue without paging--c list = 0x5620ae43adc0 io = <optimized out> tv = {tv_sec = 2147483, tv_usec = 0} events_count = <optimized out> msecs = <optimized out> ret = <optimized out> i = 0 j = <optimized out> call = <optimized out> __func__ = "io_loop_handler_run_internal" #12 0x00007fbc3f6390f0 in io_loop_handler_run (ioloop=0x5620ae4272d0) at ioloop.c:766 __func__ = "io_loop_handler_run" #13 0x00007fbc3f639268 in io_loop_run (ioloop=0x5620ae4272d0) at ioloop.c:739 __func__ = "io_loop_run" #14 0x00007fbc3f5ac557 in master_service_run (service=0x5620ae427130, callback=callback@entry=0x5620ad666fa0 <client_connected>) at master-service.c:853 No locals. #15 0x00005620ad666dcd in main (argc=<optimized out>, argv=<optimized out>) at main.c:168 set_roots = {0x5620ad86e640 <smtp_submit_setting_parser_info>, 0x5620ad86e580 <lda_setting_parser_info>, 0x5620ad86e2a0 <lmtp_setting_parser_info>, 0x0} service_flags = <optimized out> storage_service_flags = (MAIL_STORAGE_SERVICE_FLAG_USERDB_LOOKUP | MAIL_STORAGE_SERVICE_FLAG_TEMP_PRIV_DROP | MAIL_STORAGE_SERVICE_FLAG_NO_LOG_INIT | MAIL_STORAGE_SERVICE_FLAG_NO_IDLE_TIMEOUT) tmp_base_dir = 0x5620ae41e758 "" c = <optimized out> error = 0x7fff707492d8 ""

2 2

Outlook creating IMAP folders even though forbidden by ACLs
by Matt Grant 13 May '21

13 May '21

Hi! Is it well known that Outlook cannot process RFC 2086 or RFC 4134 ACLs? We are using Outlook 2013, 2016 and 2019, and with 2013 can definitely create shared folders with content that are not saved to the server, even though Outlook 'pretends' quite erroneously that they are - black hole for critical email that we must keep according to engineering contracts for design documentation purposes. Thank you! Matt Grant

2 1

Problem with replication between two servers (ispconfig)
by Claudio Junior 12 May '21

12 May '21

Hi people, I am setting up replication between two servers. The installation of the servers was done using ispconfig and the operating system is debian 10. The problem is that after following the guide for this configuration, https://wiki.dovecot.org/Replication, when I start the server, replication does not start. I have also checked, via tcpdump, on the port associated with doveadm. If I force it with the command "doveadm -D sync -u user @ domain -d -N -l 30 -U" the replication happens, but it is not updating when the user receives emails on server01. At this time server02 will not receive emails (via postfix), and will also not have users accessing via pop3 or imap, but I have the idea of configuring so that both servers have these services working. The configuration of the servers is below: root@server01:~# doveconf -n # 2.3.4.1 (f79e8e7e4): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.4 () # OS: Linux 4.19.0-16-amd64 x86_64 Debian 10.9 # Hostname: server01.example.net auth_mechanisms = plain login debug_log_path = /var/log/dovecot.debug disable_plaintext_auth = no doveadm_password = # hidden, use -P to show it doveadm_port = 2727 imap_capability = +SEPCIAL-USE XLIST listen = *,[::] lmtp_rcpt_check_quota = yes log_timestamp = "%Y-%m-%d %H:%M:%S " mail_debug = yes mail_max_userip_connections = 100 mail_plugins = quota notify replication mail_privileged_group = vmail namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { auto = subscribe autoexpunge = 60 days special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { auto = subscribe autoexpunge = 60 days special_use = \Trash } prefix = separator = . } passdb { args = /etc/dovecot/dovecot-sql.conf driver = sql } plugin { mail_replica = tcp:server02.example.net:2727 quota = dict:user::file:/var/vmailquota/%d/%n/.quotausage quota_status_nouser = DUNNO quota_status_overquota = 552 5.2.2 Mailbox is full quota_status_success = DUNNO sieve = /var/vmail/%d/%n/.sieve sieve_after = /var/vmail/%d/%n/.ispconfig.sieve sieve_before = /var/vmail/%d/%n/.ispconfig-before.sieve sieve_max_actions = 100 sieve_max_redirects = 25 sieve_max_script_size = 2M } protocols = imap pop3 lmtp service aggregator { fifo_listener replication-notify-fifo { mode = 0660 user = vmail } unix_listener replication-notify { mode = 0660 user = vmail } } service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0660 user = postfix } unix_listener auth-userdb { group = vmail mode = 0600 user = vmail } user = root } service doveadm { inet_listener { port = 2727 } unix_listener doveadm-server { user = vmail } } service imap-login { client_limit = 1000 process_limit = 512 } service lmtp { unix_listener /var/spool/postfix/private/dovecot-lmtp { group = postfix mode = 0600 user = postfix } } service quota-status { client_limit = 1 executable = quota-status -p postfix unix_listener /var/spool/postfix/private/quota-status { group = postfix mode = 0660 user = postfix } } service replicator { process_min_avail = 1 unix_listener replicator-doveadm { mode = 0660 user = vmail } } service stats { unix_listener stats-reader { group = vmail mode = 0660 user = vmail } unix_listener stats-writer { group = vmail mode = 0660 user = vmail } } ssl_cert = </etc/postfix/smtpd.cert ssl_cipher_list = ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384 ssl_dh = # hidden, use -P to show it ssl_key = # hidden, use -P to show it ssl_min_protocol = TLSv1.2 userdb { driver = prefetch } userdb { args = /etc/dovecot/dovecot-sql.conf driver = sql } protocol imap { auth_verbose = yes mail_plugins = quota imap_quota } protocol pop3 { auth_verbose = yes mail_plugins = quota pop3_uidl_format = %08Xu%08Xv } protocol lda { mail_plugins = sieve quota postmaster_address = postmaster(a)server01.example.net } protocol lmtp { mail_plugins = quota sieve postmaster_address = postmaster(a)server01.example.net } local_name server01.example.net { ssl_cert = </etc/letsencrypt/live/server01.example.net/fullchain.pem ssl_key = # hidden, use -P to show it } local_name mail.example.net { ssl_cert = </etc/letsencrypt/live/mail.example.net/fullchain.pem ssl_key = # hidden, use -P to show it } local_name mail.otherdomain1.com.br { ssl_cert = </etc/letsencrypt/live/mail.otherdomain1.com.br/fullchain.pem ssl_key = # hidden, use -P to show it } root@server02:/var/vmail# doveconf -n # 2.3.4.1 (f79e8e7e4): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.4 () # OS: Linux 4.19.0-16-amd64 x86_64 Debian 10.9 # Hostname: server02.example.net auth_mechanisms = plain login debug_log_path = /var/log/dovecot.debug disable_plaintext_auth = no doveadm_password = # hidden, use -P to show it doveadm_port = 2727 listen = *,[::] log_timestamp = "%Y-%m-%d %H:%M:%S " mail_debug = yes mail_max_userip_connections = 100 mail_plugins = " notify replication" mail_privileged_group = vmail namespace inbox { inbox = yes location = mailbox Drafts { auto = no special_use = \Drafts } mailbox Junk { auto = subscribe autoexpunge = 60 days special_use = \Junk } mailbox Sent { auto = no special_use = \Sent } mailbox "Sent Messages" { auto = no special_use = \Sent } mailbox Trash { auto = subscribe autoexpunge = 60 days special_use = \Trash } prefix = } passdb { args = /etc/dovecot/dovecot-sql.conf driver = sql } plugin { mail_replica = tcp:server01.example.net:2727 quota = dict:user::file:/var/vmailquota/%d/%n/.quotausage sieve = /var/vmail/%d/%n/.sieve sieve_max_redirects = 25 } protocols = imap pop3 service aggregator { fifo_listener replication-notify-fifo { group = root mode = 0660 user = vmail } unix_listener replication-notify { group = root mode = 0660 user = vmail } } service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0660 user = postfix } unix_listener auth-userdb { group = vmail mode = 0600 user = vmail } user = root } service doveadm { inet_listener { port = 2727 } unix_listener doveadm-server { user = vmail } } service imap-login { client_limit = 1000 process_limit = 512 } service lmtp { unix_listener /var/spool/postfix/private/dovecot-lmtp { group = postfix mode = 0600 user = postfix } } service replicator { unix_listener replicator-doveadm { group = root mode = 0660 user = vmail } } service stats { unix_listener stats-reader { group = vmail mode = 0660 user = vmail } unix_listener stats-writer { group = vmail mode = 0660 user = vmail } } ssl_cert = </etc/postfix/smtpd.cert ssl_dh = # hidden, use -P to show it ssl_key = # hidden, use -P to show it userdb { driver = prefetch } userdb { args = /etc/dovecot/dovecot-sql.conf driver = sql } protocol imap { mail_plugins = quota imap_quota } protocol pop3 { mail_plugins = quota pop3_uidl_format = %08Xu%08Xv } protocol lda { mail_plugins = sieve quota postmaster_address = postmaster(a)example.net } protocol lmtp { mail_plugins = quota sieve postmaster_address = postmaster(a)example.net } root@server02:/var/vmail# Att Claudio Jr. -- Claudio da Silva Junior csjunior(a)gmail.com

2 2

Variable expansion in password field (again?!)
by Mathias Rabe 11 May '21

11 May '21

Hi list, I’m experimenting with the mail-crypt-plugin in Dovecot v2.3.4.1 on Debian 10 Buster. I’m also running a OpenLDAP-Server for user lookup. My LDAP-settings looks like this: hosts = ### dn = cn=###,dc=###,dc=## dnpass = ### tls = yes auth_bind = no ldap_version = 3 base = ou=people,dc=###,dc=## scope = subtree user_attrs = \ =quota_rule=*:bytes=%{ldap:mailQuota}, \ =home=/var/vmail/mailboxes/%d/%{ldap:uid}, \ =mail=maildir:/var/vmail/mailboxes/%d/%{ldap:uid}/mail user_filter = (&(mail=%u)(objectClass=person)(mailEnabled=TRUE)) pass_attrs = mail=user,userPassword=password,=userdb_mail_crypt_private_password=%w,mailCrypt=userdb_mail_crypt_save_version pass_filter = (&(mail=%u)(objectClass=person)(mailEnabled=TRUE)) iterate_attrs = mail=user iterate_filter = (objectClass=person) default_pass_scheme = SSHA-512 The users can log-in and everything works fine including the mail-crypt-plugin until an user password contains a % I get the following error message (example): Error: Failed to expand plugin setting mail_crypt_private_password = '"1234%Passwort"': Unknown variable '%P‘ I’ve found some mails but I didn’t found a solution. It seems that Dovecot tries to expand some variable in the password: https://dovecot.org/pipermail/dovecot/2019-July/116338.html https://dovecot.org/pipermail/dovecot/2020-April/118634.html So this seems to be a bug or something. Is there any new information on this topic or even any solution or workaround? Thank you very much! Mathias

3 2

sudden performance drop - i/o related
by Marcin Gryszkalis 11 May '21

11 May '21

Hi I have exim/dovecot server that worked great for last few years and two weeks ago it got ill ;) First were users reporting errors on saving mails to Sent (timeouts). Now the logs are infested with warnings about long waits: May 10 10:18: Maildir /mail/xxx Synchronization took 193 seconds (1 new msgs, 0 flag change attempts, 0 expunge attempts) May 10 10:18: Maildir /mail/xxx Synchronization took 125 seconds (1 new msgs, 0 flag change attempts, 0 expunge attempts) May 10 10:18: Maildir /mail/xxx Synchronization took 211 seconds (1 new msgs, 0 flag change attempts, 0 expunge attempts) May 10 10:18: Maildir /mail/xxx Synchronization took 107 seconds (8 new msgs, 0 flag change attempts, 0 expunge attempts) May 10 10:18: Transaction log file /mail/xxx was locked for 36 seconds (Mailbox was synchronized) May 10 10:18: Transaction log file /mail/xxx was locked for 160 seconds (Mailbox was synchronized) May 10 10:18: Transaction log file /mail/xxx was locked for 72 seconds (Mailbox was synchronized) May 10 10:18: Locking transaction log file /mail/xxx took 60 seconds (syncing) May 10 10:18: Locking transaction log file /mail/xxx took 38 seconds (syncing) May 10 10:18: Locking transaction log file /mail/xxx took 35 seconds (syncing) It looks like i/o risen from 150writes/s to 500writes/s (in top hours) - but there's no real change in number of emails or the volume. Number of users is steady (~100 active users, ~250 imap sessions), number of emails (by count or by volume) is rising and falling within 15% margin. The box is FreeBSD 11.4, dovecot is 2.3.13. Filesystem is ZFS, disks are fine, free space is around 20% (~200GB) Layout is Maildir. CPU is not overloaded (2x6core), same with memory (48GB). I didn't change anything in configuration. Tonight I did some finetuning like maildir_copy_with_hardlinks=yes or mail_fsync=never/optimized (I'm not happy with that but I'm afraid it won't really help and I'll be able to revert that). I'm also thinking about switching from Maildir to sdbox (I know it won't hurt). I don't know where to look to find where the i/o goes. I don't have any metrics/stats enabled (I looked at the docs but it looks it's not really simple and needs some digging to get valuable config). Maybe somebody has suggestions what to look for? For detailed per-process stats I need to rebuild kernel with dtrace (other night I guess)... Simple top (in i/o mode - similar to linux's iotop) doesn't catch short living processes (like LDA deliveries). best regards -- Marcin Gryszkalis, PGP 0xA5DBEEC7 http://fork.pl/gpg.txt

2 3

mdbox / selecting folder accesses hundrets of others
by Florian Lohoff 10 May '21

10 May '21

Dovecot: 2.3.4 Hi, i am debugging a problem where after a force-resync removed all cache files (All files are 44 byte). Trying to open a folder takes literally minutes (Huge mailbox - 220K folder, 45GByte compressed storage) After i straced the imap process i can see the imap process accesses hundrets of other completely unrelated folders: Thats from the logfile - You can see mutt selecting the mailbox "zzzzzzt": May 07 18:05:19 imap(inbox@wasteland)<20381><hlkrmL/B5qwgAwDvnxMdAGcc/5MSpYxQ>: Debug: fts: No fts setting - plugin disabled May 07 18:05:19 imap(inbox@wasteland)<20381><hlkrmL/B5qwgAwDvnxMdAGcc/5MSpYxQ>: Debug: quota: quota_over_flag check: quota_over_script unset - skipping May 07 18:05:19 imap(inbox@wasteland)<20381><hlkrmL/B5qwgAwDvnxMdAGcc/5MSpYxQ>: Debug: Mailbox zzzzzzt: Mailbox opened because: SELECT From strace -p 20381 - This goes on for minutes opening thousands of unrelated folders. It is noteworthy that it mostly opens nested folders which are rare here: [...] open("/var/vmail/wasteland/inbox/mdbox/mailboxes/gerries/are/hawt", O_RDONLY|O_NONBLOCK|O_DIRECTORY|O_CLOEXEC) = 15 fstat(15, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents(15, /* 3 entries */, 32768) = 72 stat("/var/vmail/wasteland/inbox/mdbox/mailboxes/gerries/are/hawt/yeah", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 stat("/var/vmail/wasteland/inbox/mdbox/mailboxes/gerries/are/hawt/yeah/dbox-Mails", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents(15, /* 0 entries */, 32768) = 0 close(15) = 0 open("/var/vmail/wasteland/inbox/mdbox/mailboxes/karl588594", O_RDONLY|O_NONBLOCK|O_DIRECTORY|O_CLOEXEC) = 15 fstat(15, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents(15, /* 3 entries */, 32768) = 80 stat("/var/vmail/wasteland/inbox/mdbox/mailboxes/karl588594/b3914", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 stat("/var/vmail/wasteland/inbox/mdbox/mailboxes/karl588594/b3914/dbox-Mails", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents(15, /* 0 entries */, 32768) = 0 close(15) = 0 open("/var/vmail/wasteland/inbox/mdbox/mailboxes/ben", O_RDONLY|O_NONBLOCK|O_DIRECTORY|O_CLOEXEC) = 15 fstat(15, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents(15, /* 4 entries */, 32768) = 104 stat("/var/vmail/wasteland/inbox/mdbox/mailboxes/ben/gang", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 stat("/var/vmail/wasteland/inbox/mdbox/mailboxes/ben/gang/dbox-Mails", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 Reopening the same folder again is quick and seamless. So it seems this is some cache recreation code looking into other folders. I am bit puzzled on why it does this. mail_debug=yes did now show anything. Any more debug options for mdbox i might set to find out about its decisions? Flo -- Florian Lohoff f(a)zz.de Any sufficiently advanced technology is indistinguishable from magic.

3 5

Writing an custom imap command
by Ryan Beethe 10 May '21

10 May '21

I'm interested in writing a custom imap command that behaves a bit like IDLE but synchronizes some state that is specific to my mail client / mail server. I found that stateless commands were trivial to understand, and I really like the plugin pattern for registering custom commands. But I have a few questions on how to write a long-running command that I was not able to answer by reading through the code. This mailing list seems like the best place to ask them. For reference, the source code for my custom command is here: https://github.com/Splintermail/splintermail-client/blob/dev/server/xkeysyn… Thanks, Ryan ------ 1. Why does cmd-idle.c sometimes call client_command_free()? But sometimes it doesn't? For example, cmd_idle_continue() frees it in some branches but not others. That makes no sense to me; it seems like it should be based on your entrypoint (mailbox notify callback vs input callback vs timeout callback), not based on which branch of logic within that entrypoint. 2. Why does cmd-idle.c ever call client_destroy()? That seems like something that should be invoked only by the imap process, not by any command. It calls it in cmd-idle.c:idle_callback (which is a mailbox notify callback). It invokes it after idle_sync_now() when it detects that client->disconnected is set. Maybe that happens in imap_sync_init() or something? 3. Why does cmd-idle.c ever call client_disconnect()? That also seems like the responsibility of the imap process, and not any command. idle_client_input_more() detects when i_stream_read returns -1, meaning that the client has *already disconnected*. Then it calls client_disconnect(). I think this is the crazy part... the istream is effectively unique to the imap process, so it seems unreasonable that any command is responsible for cleaning it up; it should just always happen at the imap process level before exiting, right? 4. What does client_continue_pending_input() actually do, and under what conditions does it need to be called? There is one place that you *can't* call it; there is a section in imap-client.c:client_handle_input() that calls imap-client.c:client_handle_next_command(), which calls the cmd->func(). That makes sense; that's the input trigger for the command plugin, so maybe you only have to trigger it when you are receiving input that doesn't fit into the normal command args behavior. It has a comment that says "this function is called at the end of I/O callbacks (and only there)". It _is_ called by client_input() and by client_output(), but also by: - cmd-idle.c:idle_client_input (io_add_istream callback) - cmd-append.c:client_input_append (io_add_istream callback) - imap-search.c:cmd_search_more_callback (timeout_add callback) The first two cases seem to be the only io_add_istream() commands that even exist, so that explains them. I can't explain the imap-search.c case at all. Reading through it I have really no idea what client_continue_pending_input is really doing. My command has a DONE mechanic just like IDLE so I'm pretty sure I need to invoke this function, I'm just concerned I'm going to do it wrong if I don't understand the mechanics of it.

3 6

huge mdbox broken / Log synchronization error
by Florian Lohoff 10 May '21

10 May '21

Hi, its the second time in 6 Month i have issues with a huge mdbox. It broken in November and i restored from backup because force-resync twice didnt fix it. (And restore from borg-backup was MUCH faster than force-resync) This time i have heavy delivery into that mailbox (postfix concurrency 1) and i tried merging folders with doveadm move. The move froze and now i seem to have a broken mdbox: Errors are: May 05 10:21:09 lda(inbox(a)wasteland.rfc822.org): Error: Log synchronization error at seq=2736,offset=135540 for /var/vmail/wasteland.rfc822.org/inbox/mdbox/storage/dovecot.map.index: Extension record inc drops number below zero (uid=7757856, diff=-1, orig=0) trying root@pax:~# doveadm -D -v force-resync -u inbox(a)wasteland.rfc822.org \* now. Although this will mostly likely take 8-10 hours. Mailbox is 44GByte (Compressed mdbox) and 220K folders. This is dovecot on Debian/Stretch dovecot-core 1:2.2.27-3+deb9u7 dovecot-imapd 1:2.2.27-3+deb9u7 dovecot-ldap 1:2.2.27-3+deb9u7 dovecot-managesieved 1:2.2.27-3+deb9u7 dovecot-pop3d 1:2.2.27-3+deb9u7 dovecot-sieve 1:2.2.27-3+deb9u7 dovecot-solr 1:2.2.27-3+deb9u7 Flo -- Florian Lohoff f(a)zz.de Any sufficiently advanced technology is indistinguishable from magic.

3 10

How to set lmtp delivery file/directory permissions?
by Kurt Fitzner 08 May '21

08 May '21

I have my postfix/dovecot virtual mail system essentially (otherwise) configured where Postfix is calling Dovecot for its virtual transport: virtual_transport = lmtp:unix:private/dovecot-lmtp But I can't for the life of me see how to change the file permissions dovecot uses to create maildir folders and files. I looked at the maildir [1], lmtp [2], and other documents and they are either silent on permissions or seem to reference a shared mail permissions document [3] that claims file and folder permissions are inherited. I want all files dovecot creates to be made accessible to the mail group. Please tell me this wasn't hard-coded a la postfix. Thanks, Kurt Fitzner Links: ------ [1] https://wiki.dovecot.org/MailboxFormat/Maildir#Maildir_and_filesystems [2] https://doc.dovecot.org/configuration_manual/protocols/lmtp_server/ [3] https://doc.dovecot.org/admin_manual/filesystem_permission/

1 0

Issue with dovecot SASL
by Piyush Joshi 08 May '21

08 May '21

Hi, I am getting the following error while authenticating any user, using SASL with postfix, please help me to fix this issue. May 08 17:34:50 master: Info: Dovecot v2.2.36.4 (baf9232c1) starting up for imap, pop3, lmtp, sieve (core dumps disabled) May 08 17:35:10 master: Error: service(auth): command startup failed, throttling for 2 secs May 08 17:35:10 auth: Fatal: master: service(auth): child 6969 killed with signal 11 (core dumps disabled) *Dovecot Configuration Output* root@mail:/usr/local/dovecot/etc/dovecot/conf.d# /usr/local/dovecot/sbin/dovecot -n # 2.2.36.4 (baf9232c1): /usr/local/dovecot/etc/dovecot/dovecot.conf # Pigeonhole version 0.4.24.2 (aaba65b7) # OS: Linux 4.19.0-16-amd64 x86_64 Debian 10.9 # Hostname: mail.example.com auth_default_realm = example.com auth_mechanisms = plain login base_dir = /usr/local/dovecot/var/run/dovecot/ default_client_limit = 5000 default_process_limit = 500 default_vsz_limit = 512 M first_valid_uid = 1001 last_valid_uid = 1001 listen = 127.0.0.1 lmtp_save_to_detail_mailbox = yes log_path = /var/log/imap login_greeting = Messaging Server mail_gid = 1001 mail_location = maildir:/%Lh/Maildir/:INDEX=/%Lh/Maildir/ mail_plugins = quota acl fts fts_lucene mail_uid = 1001 managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext vacation-seconds imapflags notify namespace inbox { inbox = yes location = mailbox Archive { auto = subscribe special_use = \Archive } mailbox "Deleted Items" { special_use = \Trash } mailbox Drafts { auto = subscribe special_use = \Drafts } mailbox Junk { auto = subscribe special_use = \Junk } mailbox "Junk E-mail" { special_use = \Junk } mailbox Sent { auto = subscribe special_use = \Sent } mailbox "Sent Items" { special_use = \Sent } mailbox Trash { auto = subscribe special_use = \Trash } prefix = separator = . type = private } passdb { args = /usr/local/dovecot/etc/dovecot/dovecot-ldap.conf.ext driver = ldap } plugin { acl = vfile:/usr/local/dovecot/dovecot-acl/acl acl_shared_dict = file:/maildir/domains/dovecot/shared-mailboxes/shared-mailboxes.db fts = lucene fts_autoindex = yes fts_lucene = whitespace_chars=@. fts_tika = http://localhost:9997/tika/ quota = maildir:User quota quota_rule = *:storage=1G quota_warning = storage=85%% quota-warning 85 %u quota_warning2 = storage=90%% quota-warning 90 %u quota_warning3 = storage=95%% quota-warning 95 %u sieve = ~/.dovecot.sieve sieve_after = /usr/local/dovecot/sieve/default.sieve sieve_before = ~/sieve/01_vacation.sieve sieve_dir = ~/sieve sieve_extensions = +notify +imapflags +vacation +vacation-seconds sieve_global_dir = /usr/local/dovecot/sieve/ sieve_quota_max_scripts = 5 sieve_vacation_send_from_recipient = yes sieve_vacation_use_original_recipient = yes } pop3_client_workarounds = outlook-no-nuls oe-ns-eoh protocols = imap pop3 lmtp sieve service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0660 user = postfix } unix_listener auth-userdb { group = vmail mode = 0666 user = vmail } } service imap-login { inet_listener imap { port = 143 } inet_listener imaps { address = * port = 993 ssl = yes } } service imap-postlogin { executable = script-login /usr/local/dovecot/bin/postlogin.sh user = root } service imap { executable = /usr/local/dovecot/libexec/dovecot/imap imap-postlogin } service lmtp { executable = lmtp -L inet_listener lmtp { address = 127.0.0.1 ::1 port = 7025 } process_min_avail = 5 unix_listener /var/spool/postfix/private/dovecot-lmtp { group = postfix mode = 0600 user = postfix } user = vmail } service managesieve-login { inet_listener sieve-obsolete { port = 2000 } } service pop3-login { inet_listener pop3 { port = 110 } inet_listener pop3s { address = * port = 995 ssl = yes } } service quota-warning { executable = script /usr/local/dovecot/bin/quota-warning.sh unix_listener quota-warning { group = vmail mode = 0660 user = vmail } } service stats { unix_listener stats-reader { group = vmail mode = 0660 user = vmail } unix_listener stats-writer { group = vmail mode = 0660 user = vmail } } ssl = required ssl_ca = </etc/ssl/localcerts/intermediate.crt ssl_cert = </etc/ssl/localcerts/mail.crt ssl_key = # hidden, use -P to show it submission_host = 127.0.0.1 userdb { args = /usr/local/dovecot/etc/dovecot/dovecot-ldap.conf.ext driver = ldap } protocol lmtp { mail_plugins = quota acl fts fts_lucene sieve } protocol sieve { managesieve_logout_format = bytes ( in=%i : out=%o ) } protocol lda { info_log_path = /var/log/dovecot-lda.log log_path = /var/log/dovecot-lda-errors.log mail_plugins = quota acl fts fts_lucene sieve virtual } protocol imap { mail_max_userip_connections = 50 mail_plugins = quota acl fts fts_lucene imap_quota imap_acl } Thanks, Regards

1 0

Doveadm sync verbose not working?
by Plutocrat 07 May '21

07 May '21

Hi Was trying a sync with eg this. old is a host set up in my ssh config file. the user exists on both sides. The sync completes correctly copying mails back and forth, but offers no feedback. doveadm sync -u user(a)domain.com -f -R remote:old If I add -v I don't get any more information. Am I missing something? The manual says its meant to give more info and progress. doveadm -v sync -u user(a)domain.com -f -R remote:old Putting -v elsewhere on the commandline results in an error, so I think its in the right place. However -D works, but its a bit too verbose ... doveadm -D sync -u user(a)domain.com -f -R remote:old dovecot --version 2.3.7.2 (3c910f64b) P.

1 0

Adding virtual folders to an existing dovecot installation
by Christian Wolf 06 May '21

06 May '21

Hello dear dovecot mailinglist, I am having a dovecot installation that is working so far (together with sieve and managesieve). Now, I found the possibility to add a virtual folder to the server promising. I sort various mails using a per-user sieve script into subfolders. This works well on the latop but the mobile device does not like too many folders to check. So, I wanted to create a virtual inbox that holds all unread messages. I found this documentation: https://doc.dovecot.org/configuration_manual/virtual_plugin/ Now, I have first one question: When I use the virtual folder and read a message/mark it as read, will this be reflected on the underlaying folder or will it cause trouble on dovecot? As far as I understand, usage of sieve filtering and the virtual plugin is considered critical as mentioned in the documentation. This is due to the fact, that the virtual mailboxes are read-only by default (unless a folder is prefixed with a !-symbol). Sieve will try to filter the virtual folder as well be default and moving a message to another folder will fail the read-only assumption. Honestly, I do not get the content of https://doc.dovecot.org/ configuration_manual/virtual_plugin/#sieve-filters-with-virtual-mailboxes by 100%. The first paragraph indicates that sieve plus virtual mailboxes are a complete no-go, while the second indicates that a safe configuration is needed. Could someone please elaborate this a bit more? I have not yet changed anything as I did not want blindly break my production mail system. The current (unaltered) configuration I will attach below. Bonus question: Is it possible to restrict the effect of the virtual plugin to certain (virtual) user accounts? Thank you very much Christian # dovecot --version 2.3.13 (89f716dc2) #dovecot -n # 2.3.13 (89f716dc2): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.13 (cdd19fe3) # OS: Linux 5.11.2-arch1-1 x86_64 # Hostname: server-hh.hh.lupus auth_mechanisms = plain login mail_location = maildir:~/Maildir managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext namespace inbox { inbox = yes location = mailbox Drafts { auto = subscribe special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { auto = subscribe special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Templates { auto = subscribe } mailbox Trash { auto = subscribe special_use = \Trash } prefix = } passdb { args = scheme=PLAIN username_format=%n /home/.vmail/%d/etc/shadow driver = passwd-file } plugin { sieve = file:~/sieve;active=~/.dovecot.sieve stats_refresh = 30 secs stats_track_cmds = yes } protocols = imap lmtp sieve service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0660 user = postfix } } service stats { fifo_listener stats-mail { mode = 0600 user = vmail } } ssl = required ssl_cert = </etc/letsencrypt/live/dovecot/fullchain.pem ssl_cipher_list = ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM- SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA- AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128- SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128- SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256- SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS- AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256- SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128- SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:! MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA ssl_dh = # hidden, use -P to show it ssl_key = # hidden, use -P to show it ssl_prefer_server_ciphers = yes userdb { args = uid=vmail gid=vmail home=/home/.vmail/%d/mails/%n driver = static } protocol lmtp { mail_plugins = " sieve" postmaster_address = postmaster(a)example.com } protocol lda { mail_plugins = " sieve" } protocol imap { mail_plugins = " old_stats" }

2 1

disable pop3 ports?
by Dan Egli 05 May '21

05 May '21

I admit I don't quite understand dovecot's config yet, but this is driving me batty. I was looking at my server and noticed that dovecot was listening on the pop3 ports (110/TCP). Since I do not use pop3 at all, nor does anyone who has ever or ever will connect to the server, that seems like a needless waste. So I went through the config files and commented out every reference to pop3 in them. But when I restart dovecot, it STILL opens a listener on 110. How do I fix this? The ONLY external ports I want dovecot listening to are imap4 and imap4s. Thanks! -- Dan Egli From my Test Server

10 20

POP3 mailbox errors and changing permissions on folders
by John Richards 05 May '21

05 May '21

1 0

How to Host Multiple Mail Domains (Email Hosting) in iRedMail Full Featured Linux Mail Server
by Turritopsis Dohrnii Teo En Ming 04 May '21

04 May '21

Subject: How to Host Multiple Mail Domains (Email Hosting) in iRedMail Full Featured Linux Mail Server Author: Mr. Turritopsis Dohrnii Teo En Ming (TARGETED INDIVIDUAL) Country: Singapore Date: 3rd May 2021 Monday Type of Publication: PDF Manual Document Version: 20210503.01 ***IMPORTANT NOTICE*** Please note that Turritopsis Dohrnii Teo En Ming’s guide is based on Xiao Guoan’s guide at linuxbabe.com. Reference Guide Used by Teo En Ming: How to Host Multiple Mail Domains in iRedMail with Nginx Link: https://www.linuxbabe.com/mail-server/set-up-iredmail-multiple-domains-nginx Original Author: Xiao Guoan The following is a list of open-source software that will be automatically installed and configured by iRedMail. • Postfix SMTP server • Dovecot IMAP server • Nginx web server to serve the admin panel and webmail • OpenLDAP, MySQL/MariaDB, or PostgreSQL for storing user information • Amavised-new for DKIM signing and verification • SpamAssassin for anti-spam • ClamAV for anti-virus • Roundcube webmail • SOGo groupware, providing webmail, calendar (CalDAV), contacts (CardDAV), tasks and ActiveSync services. • Fail2ban for protecting SSH • mlmmj mailing list manager • Netdata server monitoring • iRedAPD Postfix policy server for greylisting In addition, you need to add MX, A and TXT records to your ISC BIND DNS domain name server. Redundant download links for Turritopsis Dohrnii Teo En Ming's PDF manual: [1] https://www.mediafire.com/file/q6txmx0rc1cwfzw/Additional+Mail+Domains+1st+… [2] https://www.docdroid.net/Q9TRL5D/additional-mail-domains-1st-release-pdf [3] https://www.scribd.com/document/506193434/Additional-Mail-Domains-1st-Relea… [4] https://drive.google.com/file/d/10AYGt4-omBeC3vXJfzswQq0M7E09gXpG/view?usp=… [5] https://drive.google.com/file/d/113dy0AKmBYGugBueK1vS_dJwI35J6XmJ/view?usp=… [6] https://drive.google.com/file/d/1dhpYIZp31ug5hoiVNbjh6uh99s_PEx8q/view?usp=… Mr. Turritopsis Dohrnii Teo En Ming, 43 years old as of 4th May 2021, is a TARGETED INDIVIDUAL living in Singapore. He is an IT Consultant with a System Integrator (SI)/computer firm in Singapore. He is an IT enthusiast. -----BEGIN EMAIL SIGNATURE----- The Gospel for all Targeted Individuals (TIs): [The New York Times] Microwave Weapons Are Prime Suspect in Ills of U.S. Embassy Workers Link: https://www.nytimes.com/2018/09/01/science/sonic-attack-cuba-microwave.html ******************************************************************************************** Singaporean Targeted Individual Mr. Turritopsis Dohrnii Teo En Ming's Academic Qualifications as at 14 Feb 2019 and refugee seeking attempts at the United Nations Refugee Agency Bangkok (21 Mar 2017), in Taiwan (5 Aug 2019) and Australia (25 Dec 2019 to 9 Jan 2020): [1] https://tdtemcerts.wordpress.com/ [2] https://tdtemcerts.blogspot.sg/ [3] https://www.scribd.com/user/270125049/Teo-En-Ming -----END EMAIL SIGNATURE-----

1 0

mail_crypt module and error with tmp directory
by Fiorenza Meini 04 May '21

04 May '21

Hi, I successfully enable mail_crypt module but I'm experiencing a strange behaviour with tmp directory while accessing with POP3 protocol: I see in log file: Error: istream-seekable: safe_mkstemp(/tmp/dovecot.pop3.) failed: Permission denied I changed tmp directory configuration (mail_temp_dir variable) and setting it with 777 permission, but the error is the same. On client side it's working everything, but I'd like to understand the error and if I have to be worried about it. Thank you and regards Fiorenza -- Fiorenza Meini/Spazio Web Via Dante Alighieri, 10 - 13900 - BIELLA tel. +39 015 2431982-1 - fax 015 2522600 https://esseweb.eu -- Questo messaggio e i suoi allegati ai sensi del Regolamento (UE) 2016/679 sono indirizzati esclusivamente alle persone indicate. La diffusione, copia o qualsiasi altra azione derivante dalla conoscenza di queste informazioni sono rigorosamente vietate. Qualora abbiate ricevuto questo documento per errore siete pregati di darne immediata comunicazione al mittente e provvedere alla sua distruzione.

2 8

[Dovecot] Doveadm sometimes failed "to iterate through some users" after upgrade to 2.2
by Alessio Cecchi 04 May '21

04 May '21

Hi, I'm running every week in cron "doveadm expunge -A mailbox Spam before 30d" and monthly "doveadm quota recalc -A". After the upgrade to dovecot 2.2.12 (from 2.1.17), "doveadm -A" sometimes exit with this error: doveadm(user(a)domain.com): Error: User listing returned failure doveadm: Error: Failed to iterate through some users # echo $? 75 If I re-run the same command the user where doveadm stops changeing (always in alphabetical order): info@ mario@ pippo@ zazza@ and finally, after 3 or 4 run, ends with success. I have enable debug (via doveadm -D and auth/mail debub in 10-logging.con) but there are no errors or difference in the log when doveadm exit with the error (error code is 75). If I run # doveadm expunge -A mailbox Spam savedbefore 30d doveadm works fine Can somebody help me? Here is my configuration: # dovecot -n # 2.2.12: /etc/dovecot/dovecot.conf # OS: Linux 2.6.32-5-amd64 x86_64 Debian 6.0.9 auth_debug = yes auth_master_user_separator = * auth_verbose = yes deliver_log_format = msgid=%m, from=%f, subject="%s": %$ dict { expire = mysql:/etc/dovecot/dovecot-dict-sql.conf.ext sqlquota = mysql:/etc/dovecot/dovecot-dict-sql.conf.ext } disable_plaintext_auth = no dotlock_use_excl = no first_valid_gid = 89 first_valid_uid = 89 imap_client_workarounds = delay-newmail tb-extra-mailbox-sep tb-lsub-flags imap_idle_notify_interval = 29 mins imap_logout_format = in=%i out=%o session=<%{session}> last_valid_gid = 89 last_valid_uid = 89 lda_mailbox_autocreate = yes lda_mailbox_autosubscribe = yes listen = * mail_debug = yes mail_fsync = always mail_location = maildir:~/Maildir mail_nfs_index = yes mail_nfs_storage = yes mail_plugins = quota expire maildir_very_dirty_syncs = yes managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date ihave vnd.dovecot.duplicate mmap_disable = yes namespace { list = children location = maildir:%%h/Maildir:INDEX=~/Maildir/shared/%%u prefix = shared/%%n/ separator = / subscriptions = no type = shared } namespace inbox { inbox = yes location = mailbox Drafts { auto = subscribe special_use = \Drafts } mailbox Sent { auto = subscribe special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Spam { auto = subscribe special_use = \Junk } mailbox Trash { auto = subscribe special_use = \Trash } prefix = separator = / } passdb { args = username_format=%Ld /etc/dovecot/extra/alias-domains-denylogin.txt deny = yes driver = passwd-file } passdb { args = /etc/dovecot/extra/master-users driver = passwd-file master = yes pass = yes } passdb { args = /etc/dovecot/dovecot-sql.conf.ext driver = sql } plugin { expire = Trash expire2 = Spam expire_dict = proxy::expire quota = maildir:UserQuota quota2 = dict:Quota Usage::noenforcing:proxy::sqlquota quota_grace = 10M quota_rule2 = Trash:storage=+100M quota_warning = storage=95%% quota-warning 95 %u quota_warning2 = storage=80%% quota-warning 80 %u sieve = ~/.dovecot.sieve sieve_before = /etc/dovecot/sieve/before.sieve sieve_dir = ~/sieve sieve_extensions = +vnd.dovecot.duplicate -vacation } pop3_client_workarounds = outlook-no-nuls oe-ns-eoh pop3_logout_format = top=%t/%p, retr=%r/%b, del=%d/%m, size=%s, bytes=%i/%o, session=<%{session}> protocols = imap pop3 sieve service auth-worker { process_limit = 1000 } service auth { client_limit = 5500 unix_listener auth-userdb { group = vchkpw mode = 0660 user = vpopmail } } service dict { process_limit = 300 unix_listener dict { group = vchkpw mode = 0660 user = vpopmail } } service imap-login { process_min_avail = 4 service_count = 0 } service imap { process_limit = 4000 service_count = 100 } service managesieve-login { inet_listener sieve { port = 4190 } } service pop3-login { service_count = 0 } service pop3 { process_limit = 1023 service_count = 100 } service quota-warning { executable = script /etc/dovecot/scripts/quota-warning.sh unix_listener quota-warning { user = vpopmail } user = vpopmail } ssl_cert = </etc/dovecot/ssl/wildcard-myemail.net.pem ssl_key = </etc/dovecot/ssl/wildcard-myemail.net.key submission_host = localhost userdb { args = /etc/dovecot/dovecot-sql.conf.ext driver = sql } protocol lda { mail_location = maildir:~/Maildir:INDEX=MEMORY mail_plugins = quota expire sieve } protocol imap { mail_max_userip_connections = 15 mail_plugins = quota expire imap_quota } protocol sieve { mail_max_userip_connections = 2 } protocol pop3 { mail_max_userip_connections = 5 } -- Alessio Cecchi is: @ ILS -> http://www.linux.it/~alessice/ on LinkedIn -> http://www.linkedin.com/in/alessice Assistenza Sistemi GNU/Linux -> http://www.cecchi.biz Cloud Email Hosting -> http://www.qboxmail.com @ PLUG -> ex-Presidente, adesso senatore a vita, http://www.prato.linux.it

3 3

Latest git FATAL error
by Joan Moreau 03 May '21

03 May '21

Hello On latest git of dovecot, I get Apr 24 04:07:36 gjserver dovecot[857958]: imap-login: Panic: file client-common.c: line 293 (client_disconnect): assertion failed: (client->prev == NULL && client->next == NULL) and login process crash On 2.3.14, there is no problems Hope it helps JM

3 17

Problem with Log-File
by Volf, Ronald (IRV) 03 May '21

03 May '21

Hello ! We want to log error in a File directly : /var/log/IRV_MdM/Dovecot_main.log. We got this error: 'Can't open log file /var/log/IRV_MdM/Dovecot_main.log: Permission denied' Please have a look at our Problem. Is it a bug or an incorrect config ? Our Dir-Structure is: (for testing, we changed all to mod 777) 2021-05-03 04:29:32 IRV-20210501-V02-rvh:~ # dir -d /var/ /var/log/ /var/log/IRV_MdM/ /var/log/IRV_MdM/Dovecot_main.log drwxrwxrwx 11 root root 4096 2021-04-30 20:36:51 /var/ drwxrwxrwx 21 root root 4096 2021-05-03 02:53:34 /var/log/ drwxrwxrwx 4 IRV_MdM IRV_MdMG 4096 2021-05-03 04:28:09 /var/log/IRV_MdM/ -rwxrwxrwx 1 IRV_MdM IRV_MdMG 14 2021-05-03 01:36:18 /var/log/IRV_MdM/Dovecot_main.log 2021-05-03 04:29:48 IRV-20210501-V02-rvh:~ # Version: 2021-05-03 04:28:05 IRV-20210501-V02-rvh:~ # dovecot --version 2.3.14 (cee3cbc0d) 2021-05-03 04:28:12 IRV-20210501-V02-rvh:~ # Logs: 2021-05-03 04:28:51 IRV-20210501-V02-rvh:~ # doveadm log find Debug: /var/log/IRV_MdM/Dovecot_main.log Info: /var/log/IRV_MdM/Dovecot_main.log Warning: /var/log/IRV_MdM/Dovecot_main.log Error: /var/log/IRV_MdM/Dovecot_main.log Fatal: /var/log/IRV_MdM/Dovecot_main.log Config: 2021-05-03 04:45:27 IRV-20210501-V02-rvh:~ # dovecot -n # 2.3.14 (cee3cbc0d): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.14 (1b5c82b2) # OS: Linux 5.12.0-1-default x86_64 ext3 # Hostname: IRV-20210501-V02-rvh auth_cache_size = 20 M auth_debug = yes auth_debug_passwords = yes auth_verbose = yes auth_verbose_passwords = plain default_internal_user = IRV_MdM default_login_user = IRV_MdM_Login deliver_log_format = msgid=%m: %$ (From=%f, To=%t, Subject=%s, Size=%p/%w, Dsn=%{storage_id}) disable_plaintext_auth = no first_valid_uid = 10000 last_valid_gid = 49999 last_valid_uid = 49999 listen = * log_path = /var/log/IRV_MdM/Dovecot_main.log log_timestamp = "%Y-%m-%d %H:%M:%S " login_greeting = Welcome to the INetS - Multi-Device-Mail-Server. mail_access_groups = IRV_MdMG mail_debug = yes mail_location = maildir:/var/spool/IRV_MdM/User/%u/Mail:CONTROL=/var/spool/IRV_MdM/User/%u/C trl:INDEX=/var/spool/IRV_MdM/User/%u/Index:LAYOUT=fs mail_temp_dir = /var/spool/IRV_MdM/Tmp managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } passdb { args = /etc/dovecot/dovecot-sql.conf.ext driver = sql } plugin { sieve = file:~/sieve;active=~/.dovecot.sieve } pop3_client_workarounds = outlook-no-nuls oe-ns-eoh postmaster_address = <mailto:Support@IRV.at> Support(a)IRV.at ssl_cert = /Apps_IRV/Web/Cert/IRV_star_irv_at/IRV_STAR_irv_at.Crt.crt ssl_cipher_list = ALL:!aNULL:!eNULL:!EXPORT:!DES:!3DES:!MD5:!PSK:!RC4:!ADH:!LOW@STRENGTH ssl_key = # hidden, use -P to show it ssl_options = no_compression ssl_prefer_server_ciphers = yes userdb { driver = prefetch } userdb { args = /etc/dovecot/dovecot-sql.conf.ext driver = sql } verbose_proctitle = yes 2021-05-03 04:45:42 IRV-20210501-V02-rvh:~ # OS: 2021-05-03 04:45:42 IRV-20210501-V02-rvh:~ # i_ver Isg-Release: Version = 07.00.22 from 2021-01-22 21:13. Linux-Release: openSUSE Tumbleweed 20210430 Linux 5.12.0-1-default x86_64. 2021-05-03 05:13:01 IRV-20210501-V02-rvh:~ # Please send the reply to Support(a)IRV.at. Mit freundlichen Grüßen / with best regards Ing. Ronald VOLF <http://www.irv.at/> IRV Datenverarbeitung GmbH Internet: <http://www.irv.at/> www.irv.at Mail: <mailto:Sales@IRV.at> Sales(a)IRV.at Tel.: (+43-2236) 2236 7 * Fax: (+43-2236) 2191 7 / 30 Addr.: Brown Boveri Strasse 6, Top 18 2351 Wr. Neudorf, Austria

3 2

Sieve - disable redirect
by Miloslav Hůla 03 May '21

03 May '21

Hi, I would like to disallow "redirect" in sieve scripts to prevent automatical e-mail forwarding out of organisation. I'dint find a way in [1], only "sieve_extensions" option and when I try "sieve_extensions = -redirect" I got: # sievec test.sieve sievec(root): Warning: sieve: ignored unknown extension 'redirect' while configuring available extensions Is there any way? Kind regards Milo [1] https://doc.dovecot.org/configuration_manual/sieve/configuration/

1 1

setmetadata and NIL
by Steffen 03 May '21

03 May '21

Hi everybody, I played with Dovecot's metadata in dovecot-core 2:2.3.14-5+debian9 from repo deb https://repo.dovecot.org/ce-2.3-latest/debian/stretch stretch main https://tools.ietf.org/html/rfc5464#section-4.3 and https://github.com/coi-dev/coi-specs/blob/master/webpush-spec.md use NIL to remove items. Unsubscribe To unsubscribe from push notification set the previously push annotation to NIL. *Example for unsubscribing from push notifications: * C: a SETMETADATA "" (/private/vendor/vendor.dovecot/webpush/subscriptions/31754ee7-d3ee-4226-b112-6895ed26fcf8 NIL) S: a OK SETMETADATA complete and C: a SETMETADATA INBOX (/private/comment NIL) S: a OK SETMETADATA complete In the above example, the entry "/private/comment" is removed from the mailbox "INBOX". However, the metadata is stored as string NIL instead of removed: cat /home/user/Maildir/dovecot-attributes priv/369c8f17e81ff151f40400002e27b77f/vendor/vendor.dovecot/pvt/server/vendor/vendor.dovecot/webpush/subscriptions/31754ee7-d3ee-4226-b112-6895ed26fcf8 NIL priv/369c8f17e81ff151f40400002e27b77f/comment NIL shared/369c8f17e81ff151f40400002e27b77f/comment NIL a GETMETADATA (DEPTH 1) "" (/private/vendor/vendor.dovecot/webpush/subscriptions) * METADATA "" (/private/vendor/vendor.dovecot/webpush/subscriptions/31754ee7-d3ee-4226-b112-6895ed26fcf8 {3} NIL) a OK Getmetadata completed (0.001 + 0.000 secs). Do I have misinterpreted the samples? I though, the metadata is to be removed and getmetadata should not return the string NIL. Kind regards, -- Steffen

2 1

Can the disable_plaintext_auth setting get overridden for a specific port?
by Steve Dondley 03 May '21

03 May '21

In 10-auth.conf, I have "disable_plaintext_auth = yes" For port 143, I'd like to do something like this to override that setting: service imap-login { inet_listener imap { port = 143 disable_plain_text_auth = no } } Based on https://wiki.dovecot.org/LoginProcess and https://doc.dovecot.org/configuration_manual/service_configuration/ it doesn't seem like this is supported. But maybe there is another way to accomplish this?

3 2

Error and Panic (with coredump)
by Thomas Knaute 03 May '21

03 May '21

Hi there, i'm pretty new to this stuff, just tell me if you need more information. Apr 26 17:15:43 dilia dovecot: imap(user(a)domain.de)<78561><rtYxnuHAZoPAqBSC>: Error: i_stream_seekable_write_failed: close((&sstream->fd)) @ istream-seekable.c:246 failed (fd=21): Bad fi le descriptor Apr 26 17:15:43 dilia dovecot: imap(user(a)domain.de)<78561><rtYxnuHAZoPAqBSC>: Panic: file istream-seekable.c: line 226 (read_from_buffer): assertion failed: (*ret_r >0) Apr 26 17:15:43 dilia dovecot: imap(user(a)domain.de)<78561><rtYxnuHAZoPAqBSC>: Error: Raw backtrace: /usr/lib/dovecot/libdovecot.so.0(+0xdb73b) [0x7f13aead973b] -> /usr/lib/dovecot/libdov ecot.so.0(+0xdb7d1) [0x7f13aead97d1] -> /usr/lib/dovecot/libdovecot.so.0(+0x4a199) [0x7f13aea48199] -> /usr/lib/dovecot/libdovecot.so.0(+0x4c7cf) [0x7f13aea4a7cf] -> /usr/lib/dovecot/libdove cot.so.0(+0xee6e2) [0x7f13aeaec6e2] -> /usr/lib/dovecot/libdovecot.so.0(+0xeeb46) [0x7f13aeaecb46] -> /usr/lib/dovecot/libdovecot.so.0(+0xe6cd9) [0x7f13aeae4cd9] -> /usr/lib/dovecot/libdovec ot.so.0(i_stream_get_size+0x2a) [0x7f13aeae5baa] -> /usr/lib/dovecot/modules/lib20_zlib_plugin.so(+0x417c) [0x7f13ae80817c] -> /usr/lib/dovecot/libdovecot-storage.so.0(index_mail_set_seq+0x2 5) [0x7f13aec57eb5] -> /usr/lib/dovecot/libdovecot-storage.so.0(+0xd19ce) [0x7f13aec5e9ce] -> /usr/lib/dovecot/libdovecot-storage.so.0(index_storage_search_next_nonblock+0x61) [0x7f13aec5f0e 1] -> /usr/lib/dovecot/libdovecot-storage.so.0(mailbox_search_next_nonblock+0x28) [0x7f13aebe7e58] -> dovecot/imap [user(a)domain.de 192.168.xxx.xxx UID SORT](+0x2695f) [0x55740be9495f] -> dovecot/imap [user(a)domain.de 192.168.xxx.xxx UID SORT](imap_search_start+0xdc) [0x55740be9528c] -> dovecot/imap [user(a)domain.de 192.168.xxx.xxx UID SORT](cmd_sort+0x271) [0x55740be87b7 1] -> dovecot/imap [user(a)domain.de 192.168.xxx.xxx UID SORT](command_exec+0x70) [0x55740be8ddc0] -> dovecot/imap [user(a)domain.de 192.168.xxx.xxx UID SORT](+0x1e3f2) [0x55740be8c3f2] -> dovecot/imap [user(a)domain.de 192.168.xxx.xxx UID SORT](+0x1e494) [0x55740be8c494] -> dovecot/imap [user(a)domain.de 192.168.xxx.xxx UID SORT](client_handle_input+0x1b5) [0x55740be8c845] -> dovecot/imap [user(a)domain.de 192.168.xxx.xxx UID SORT](client_input+0x7e) [0x55740be8cd6e] -> /usr/lib/dovecot/libdovecot.so.0(io_loop_call_io+0x6f) [0x7f13aeaefbef] -> /usr/lib/dovec ot/libdovecot.so.0(io_loop_handler_run_internal+0x136) [0x7f13aeaf11e6] -> /usr/lib/dovecot/libdovecot.so.0(io_loop_handler_run+0x4c) [0x7f13aeaefc8c] -> /usr/lib/dovecot/libdovecot.so.0(io_ loop_run+0x40) [0x7f13aeaefdf0] -> /usr/lib/dovecot/libdovecot.so.0(master_service_run+0x13) [0x7f13aea70123] -> dovecot/imap [user(a)domain.de 192.168.xxx.xxx UID SORT](main+0x325) [0x5574 0be7ebf5] -> /lib/x86_64-linux-gnu/libc.so.6(__libc_start_main+0xeb) [0x7f13ae85709b] Apr 26 17:15:44 dilia dovecot: imap(user(a)domain.de)<78561><rtYxnuHAZoPAqBSC>: Fatal: master: service(imap): child 78561 killed with signal 6 (core dumped) # 2.3.4.1 (f79e8e7e4): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.4 () # OS: Linux 4.19.0-9-amd64 x86_64 Debian 10.9 # Hostname: dilia.intern.domain.de auth_cache_size = 10 M auth_default_realm = domain.de auth_mechanisms = plain login default_vsz_limit = 1 G disable_plaintext_auth = no imapc_features = " fetch-headers" imapc_host = mail.intern.domain.de imapc_user = %u mail_location = maildir:~/Maildir mail_plugins = zlib acl mail_prefetch_count = 20 managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify envir onment mailbox date index ihave duplicate mime foreverypart extracttext namespace { hidden = no ignore_on_failure = no inbox = no list = children location = maildir:%%h/Maildir:INDEX=%h/shared/%%u:CONTROL=%h/shared/%%u prefix = shared/%%u/ separator = / subscriptions = yes type = shared } namespace inbox { hidden = no inbox = yes list = yes location = mailbox Drafts { auto = subscribe special_use = \Drafts } mailbox Junk { auto = subscribe special_use = \Junk } mailbox Sent { auto = subscribe special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { auto = subscribe special_use = \Trash } prefix = INBOX/ separator = / subscriptions = yes type = private } passdb { args = /etc/dovecot/dovecot-ldap.conf.ext driver = ldap } plugin { acl = vfile acl_shared_dict = file:/var/lib/dovecot/db/shared-mailboxes.db mail_log_events = delete undelete expunge copy mailbox_delete mailbox_rename mail_log_fields = uid box msgid size sieve = file:~/sieve;active=~/.dovecot.sieve zlib_save = gz zlib_save_level = 6 } protocols = " imap lmtp sieve" service auth { unix_listener /var/spool/postfix/private/auth { mode = 0666 } unix_listener auth-userdb { group = vmail user = vmail } } service imap-login { process_min_avail = 12 service_count = 0 } service imap { process_limit = 8192 } service lmtp { inet_listener lmtp { address = 127.0.0.1 port = 24 } } service managesieve-login { inet_listener sieve { port = 4190 } inet_listener sieve_deprecated { port = 2000 } } ssl_cert = </etc/ssl/certs/mail.intern.combined.cer ssl_cipher_list = ALL:!kRSA:!SRP:!kDHd:!DSS:!aNULL:!eNULL:!EXPORT:!DES:!3DES:!MD5:!PSK:!RC4:!ADH:!LOW:!DH@STRENGTH ssl_dh = # hidden, use -P to show it ssl_key = # hidden, use -P to show it ssl_min_protocol = TLSv1.2 ssl_prefer_server_ciphers = yes userdb { driver = prefetch } userdb { args = /etc/dovecot/dovecot-ldap.conf.ext driver = ldap } verbose_proctitle = yes protocol lmtp { mail_plugins = zlib acl sieve } protocol imap { mail_max_userip_connections = 20 mail_plugins = zlib acl imap_zlib imap_acl } Regards, Thomas

2 5

Sieve Auth failing (ignore previous message please)
by Dan Egli 02 May '21

02 May '21

Hi folks. I'm VERY new to Dovecot and Sieve. But I'm having an issue that I need help with. For some reason my sieve daemon won't allow people to log on. I have dovecot set to read information from a MySQL table, and that works fine. I can login to dovecot's imap server just fine. But I have SOGo for the webmail and it won't login to the sieve daemon. Here's what I see in the log files when I, for example, try to save my preferences in SOGo: ==> info.log <== Apr 28 00:33:14 lmtp(5938): Info: Connect from 127.0.0.1 ==> /var/log/sogo/sogod.log <== Apr 28 00:33:14 sogod [24168]: <0x0x557cfa9083c0[SOGoSieveManager]> failure. Attempting with a renewed password (no authname supported) Apr 28 00:33:14 sogod [24168]: <0x0x557cfa9083c0[SOGoSieveManager]> Could not login 'dan(a)newideatest.site' on Sieve server: <0x0x557cfaa03a70[NGSieveClient]: socket=<NGActiveSocket[0x0x557cfa89d540]: mode=rw address=<0x0x557cfa89d5d0[NGInternetSocketAddress]: host=localhost port=45456> connectedTo=<0x0x557cfa837c00[NGInternetSocketAddress]: host=127.0.0.1 port=4190>>>: {RawResponse = "{}"; result = 0; } ==> info.log <== Apr 28 00:33:14 lmtp(5938): Info: Disconnect from 127.0.0.1: Remote closed connection unexpectedly (state=READY) ==> /var/log/sogo/sogod.log <== Apr 28 00:33:14 sogod [24168]: 2600:387:8:7::70 "POST /SOGo/so/dan(a)newideatest.site/Preferences/save HTTP/1.1" 503 46/3676 0.024 - - 0 - 17 I've read a lot of pages about getting sieve running, but they show things I don't get. For example, from https://rtcamp.com/tutorials/mail/server/sieve-filtering/ I see that telnet localhost 4190 should give this: Escape character is '^]'. *"IMPLEMENTATION" "Dovecot Pigeonhole" "SIEVE" "fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date ihave" *"NOTIFY" "mailto" "SASL" "PLAIN LOGIN" "STARTTLS" "VERSION" "1.0" OK "Dovecot ready." But I don't see any of that. Escape character is '^]'. 220 jupiter.newideatest.site Dovecot ready. I've gotten to the point where I'm pulling my hair out. I don't understand dovecot well enough to even begin to guess what's going on. So I could REALLY use some pointers. Thanks all! Oh, ignore the first message. For some reason my MUA will occasionally send a draft to the smtp server. I still haven't figured that one out yet. -- Dan Egli From my Test Server

3 3

Ability to reject invalid client certificate at TLS handshake time
by Gert van Dijk 02 May '21

02 May '21

Hi, After a bit of struggling I've been able to set up TLS client certificate authentication with Dovecot for both IMAP and Submission. Users are required to present a valid certificate, cool so far! What I noticed however on non-StartTLS listeners IMAPS (993) and SMTPS (465), is that during the TLS handhake presenting a valid client certificate is seemingly optional and is only checked later at time of protocol-level login (external auth in my case). I'd like to change that for security purposes and also a bit of obscurity. Not having the ability to interact with Dovecot on protocol level lowers the attack vector as well as the ease of checking my network security. Also, it would prevent (anonymous) network scanners to easily detect what kind of service is running on the port as they can see the IMAP/SMTP banner without presenting a valid TLS client certificate currently. Is it possible in any version of Dovecot to configure it to set up a TLS server listening context that requires a handshake with a valid client certificate? I'm using Dovecot 2.3.4.1 (actual Debian Buster version 2.3.4.1-5+deb10u6), but willing to upgrade to any newer version when this is offered. Going through some newer revisions changelog this seems not the case, so I didn't spend time on upgrading yet. Relevant config snippets for IMAP authenticating proxy that I use (something similar for Submission): # Opens 143 on StartTLS and 993 in wrapped TLS-only mode. # Only 993 is exposed to the internet. protocols = imap passdb { driver = static args = proxy=y host=10.1.2.3 port=1143 pass=masterpass nopassword=y } auth_username_format = %n ssl = required ssl_cert = </etc/dovecot-ssl/cert.crt ssl_key = </etc/dovecot-ssl/key.pem ssl_prefer_server_ciphers = yes ssl_min_protocol = TLSv1.2 ssl_cipher_list = [omitted for brevity] ssl_ca = </etc/dovecot-ssl/client-ca.crt ssl_verify_client_cert = yes # Required to set this to 'no' if no CRL is set up yet ssl_require_crl = no auth_ssl_require_client_cert = yes # Take the username from the client certificate (CN) auth_mechanisms = external auth_ssl_username_from_cert = yes ssl_cert_username_field = commonName Current behaviour from a client when deliberately not presenting a client certificate shows the IMAP banner: $ openssl s_client -connect myserver:993 CONNECTED(00000003) --- Certificate chain 0 [...] --- Server certificate -----BEGIN CERTIFICATE----- [...] --- Acceptable client certificate CA names C = NL, O = Gert van Dijk, [...] --- SSL handshake has read 1096 bytes and written 413 bytes Verification: OK --- New, TLSv1.3, Cipher is TLS_AES_256_GCM_SHA384 Server public key is 384 bit Secure Renegotiation IS NOT supported Compression: NONE Expansion: NONE No ALPN negotiated Early data was not sent Verify return code: 0 (ok) --- * OK [CAPABILITY IMAP4rev1 SASL-IR LOGIN-REFERRALS ID ENABLE IDLE LITERAL+ LOGINDISABLED AUTH=EXTERNAL] Dovecot (Debian) ready. Expected: TLS alert during handshake, e.g. on my Apache TLS client certificate required configured instance: $ openssl s_client -connect myserver:443 139676785239360:error:14094410:SSL routines:ssl3_read_bytes:sslv3 alert handshake failure:../ssl/record/rec_layer_s3.c:1543:SSL alert number 40 IOW, I was hoping for something like this to exist: ssl_verify_client_cert = required OR service imap-login { inet_listener imaps { port = 993 ssl = client-cert-required } } Thanks, Gert

2 2