- dovecot - dovecot.org

Block insecure connections
by Andrea Gabellini 09 Aug '21

09 Aug '21

Hello, I am writing for advice on how to deal with a problem. I have a Dovecot Proxy/Director -> Backend installation, all with version 2.3 Encryption on POP3 / IMAP connections is currently optional. I would like to set it as mandatory but despite the numerous reminders many users have not taken steps to adapt. Setting it as mandatory would mean having too many calls to support. I would therefore like to block the connection to only some of them and slowly reach my target. I can't find how and where to fit in to be able to do such a thing. At first I thought about postlogin, but the user ended up on a proxy and I can't use it. I tried to use the forwarding function on the proxy and postlogin on the backend, but I didn't succeed in the first part. In pseudo code, I would like to do this: if connection is not secured { if user is in my list { block the connection; } } Thanks in advance for any suggestions, Andrea -- __________________________ People says "more memory increases the computerspeed" and they are right: More memory Windows detects, the sooner it crashes. __________________________ TIM San Marino S.p.A. Andrea Gabellini Engineering R&D TIM San Marino S.p.A. - https://www.telecomitalia.sm Via Ventotto Luglio, 212 - Piano -2 47893 - Borgo Maggiore - Republic of San Marino Tel: (+378) 0549 886237 Fax: (+378) 0549 886188 -- Informativa Privacy Questa email ha per destinatari dei contatti presenti negli archivi di TIM San Marino S.p.A.. Tutte le informazioni vengono trattate e tutelate nel rispetto della normativa vigente sulla protezione dei dati personali (Reg. EU 2016/679). Per richiedere informazioni e/o variazioni e/o la cancellazione dei vostri dati presenti nei nostri archivi potete inviare una email a privacy(a)telecomitalia.sm. Avviso di Riservatezza Il contenuto di questa e-mail e degli eventuali allegati e' strettamente confidenziale e destinato alla/e persona/e a cui e' indirizzato. Se avete ricevuto per errore questa e-mail, vi preghiamo di segnalarcelo immediatamente e di cancellarla dal vostro computer. E' fatto divieto di copiare e divulgare il contenuto di questa e-mail. Ogni utilizzo abusivo delle informazioni qui contenute da parte di persone terze o comunque non indicate nella presente e-mail potra' essere perseguito ai sensi di legge.

2 2

doveadm pw
by Doug Hardie 07 Aug '21

07 Aug '21

mail# doveadm pw Enter new password: Retype new password: {CRYPT}$2y$05$oSB6end9V.YumJMzON7lfeOL9N8TXK6jhYqjHOEnPd1NLZ9.QNaTy I thought the default was supposed to be CRAM-MD5. I don't find anywhere I have entered CRYPT. There is one reference to it in auth-passwdfile.conf.ext, but changing that has no effect. Is this a bug, change, or my mistake? Thanks, mail# doveconf -n # 2.3.15 (0503334ab1): /usr/local/etc/dovecot/dovecot.conf # Pigeonhole version 0.5.15 (e6a84e31) # OS: FreeBSD 13.0-RELEASE-p1 amd64 ufs # Hostname: mail auth_mechanisms = plain cram-md5 auth_stats = yes base_dir = /var/run/home_mail/ first_valid_gid = 0 lda_mailbox_autocreate = yes login_log_format_elements = user=<%u> method=%m rip=%r lip=%l mpid=%e %c %k session=<%{session}> port=%a mail_gid = 2222 mail_home = /var/mail/home_mail/%n mail_location = maildir:/var/mail/home_mail/%n/Maildir mail_log_prefix = "%s(%u)[%r]<%{session}>: " mail_uid = 2222 managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext namespace inbox { inbox = yes location = mailbox Drafts { autoexpunge = 5 days special_use = \Drafts } mailbox Junk { autoexpunge = 2 days special_use = \Junk } mailbox Sent { autoexpunge = 1 weeks special_use = \Sent } mailbox "Sent Messages" { autoexpunge = 2 days special_use = \Sent } mailbox Trash { autoexpunge = 2 days special_use = \Trash } prefix = } passdb { args = scheme=CRYPT username_format=%n /usr/local/etc/dovecot/users driver = passwd-file } plugin { mail_log_events = delete undelete expunge copy mailbox_delete mailbox_rename mail_log_fields = uid box msgid size from sieve = file:/var/mail/home_mail/%n/sieve;active=/var/mail/home_mail/%n/.dovecot.sieve stats_refresh = 30 secs stats_track_cmds = yes } postmaster_address = doug(a)sermon-archive.info protocols = imap service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0660 user = postfix } unix_listener auth-userdb { group = vmail mode = 0666 user = vmail } } service imap-login { inet_listener imap { port = 143 } inet_listener imaps { port = 993 ssl = yes } inet_listener imaps2 { port = 998 ssl = yes } } service stats { unix_listener stats-reader { group = vmail mode = 0660 user = vmail } unix_listener stats-writer { group = vmail mode = 0660 user = vmail } } ssl_cert = </etc/ssl/certs/mail.pem ssl_dh = # hidden, use -P to show it ssl_key = # hidden, use -P to show it syslog_facility = local0 userdb { args = home=/var/mail/home_mail/%d/%n allow_all_users=yes driver = static } verbose_proctitle = yes protocol lda { mail_plugins = " sieve" } protocol imap { mail_plugins = " mail_log notify" } protocol pop3 { mail_plugins = " mail_log notify" } -- Doug

3 3

Dovecot GSSAPI Authentication problem
by Lucas Castro 06 Aug '21

06 Aug '21

Hello, I'm getting problem to setup dovecot imap/pop service authentication through Kerberos. Already read https://wiki.dovecot.org/Authentication/Kerberos. My guess is kerberos is working but something goes wrong after. The keytab and ticket ( for ldap userdb lookup ) -rw------- 1 dovecot dovecot 498 ago 3 20:20 /etc/dovecot/imap.keytab -rw------- 1 dovecot root 1503 ago 4 11:40 /etc/dovecot/imap.ticket dovecot --version 2.3.13 (89f716dc2) the dovecot setting # 2.3.13 (89f716dc2): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.13 (cdd19fe3) # OS: Linux 5.10.0-7-amd64 x86_64 Debian 11.0 # Hostname: postfix10.zw.local auth_gssapi_hostname = $ALL auth_krb5_keytab = /etc/dovecot/imap.keytab auth_mechanisms = gssapi auth_username_translation = /@ import_environment = TZ KRB5CCNAME=/etc/dovecot/imap.ticket KRB5_KTNAME=/etc/dovecot/imap.keytab mail_gid = 5000 mail_home = /var/mail/virtual/%d/%n mail_location = maildir:~/mail mail_privileged_group = mail mail_uid = 5000 namespace inbox { disabled = no inbox = yes list = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = type = private } protocols = " imap lmtp pop3" service lmtp { unix_listener /var/spool/postfix/private/dovecot-lmtp { group = postfix mode = 0600 user = postfix } } ssl_cert = </etc/dovecot/private/dovecot.pem ssl_client_ca_dir = /etc/ssl/certs ssl_dh = # hidden, use -P to show it ssl_key = # hidden, use -P to show it userdb { args = /etc/dovecot/dovecot-ldap.conf.ext driver = ldap } protocol lmtp { postmaster_address = postmaster(a)zw.local } When I launch Thunderbird, mail log raise this Aug 4 13:42:23 postfix10 dovecot: auth: Debug: client in: AUTH#0111#011GSSAPI#011service=pop3#011session=Q3GdfL7IvLmsEAAs#011lip=10.16.0.220#011rip=172.16.0.44#011lport=110#011rport=47548 Aug 4 13:42:23 postfix10 dovecot: auth: Debug: gssapi(?,172.16.0.44,<Q3GdfL7IvLmsEAAs>): Using all keytab entries Aug 4 13:42:23 postfix10 dovecot: auth: Debug: client passdb out: CONT#0111#011 Aug 4 13:42:23 postfix10 dovecot: auth: Debug: client in: CONT<hidden> Aug 4 13:42:23 postfix10 dovecot: auth: Debug: gssapi(user0(a)zw.local,172.16.0.44,<Q3GdfL7IvLmsEAAs>): security context state completed. Aug 4 13:42:23 postfix10 dovecot: auth: Debug: client passdb out: CONT#0111#011YIGZBgkqhkiG9xIBAgICAG+BiTCBhqADAgEFoQMCAQ+iejB4oAMCARKicQRvsoco75BA/W0B9tS+UmJnunUg6vIcO5wr0fzZ7iGmCpsz0K2vL/qniGISDIwF9hDXXxs79bljbZE8Yx4dujqVuTPGMtewfhDtNfRNgYGNk/z28sDz7fs/dpIMKF2FAA1m9pFjBupQ1VkGbzMYc77U Aug 4 13:42:23 postfix10 dovecot: auth: Debug: client in: CONT<hidden> Aug 4 13:42:23 postfix10 dovecot: auth: Debug: gssapi(user0(a)zw.local,172.16.0.44,<Q3GdfL7IvLmsEAAs>): Negotiated security layer Aug 4 13:42:23 postfix10 dovecot: auth: Debug: client passdb out: CONT#0111#011BQQF/wAMAAAAAAAAAdf8bQH///86U2L5ErmqfWFYNQA= Aug 4 13:42:23 postfix10 dovecot: auth: Debug: client in: CONT<hidden> Aug 4 13:42:23 postfix10 dovecot: auth: Error: gssapi(user0(a)domain1.zw.local,172.16.0.44,<Q3GdfL7IvLmsEAAs>): All password databases were skipped Aug 4 13:42:23 postfix10 dovecot: auth: Debug: auth(user0(a)domain1.zw.local,172.16.0.44,<Q3GdfL7IvLmsEAAs>): Auth request finished Aug 4 13:42:25 postfix10 dovecot: auth: Debug: client passdb out: FAIL#0111#011user=user0@domain1.zw.local#011code=temp_fail#011original_user=user0@ZW.LOCAL Aug 4 13:42:25 postfix10 dovecot: pop3-login: Debug: Ignoring unknown passdb extra field: original_user Can someone help on this? -- Lucas Castro

2 2

Pigeonhole v0.5.16 released
by Timo Sirainen 06 Aug '21

06 Aug '21

Hi, Pigeonhole release for Dovecot v2.3.16. https://pigeonhole.dovecot.org/releases/2.3/dovecot-2.3-pigeonhole-0.5.16.t… <https://pigeonhole.dovecot.org/releases/2.3/dovecot-2.3-pigeonhole-0.5.16.t…> https://pigeonhole.dovecot.org/releases/2.3/dovecot-2.3-pigeonhole-0.5.16.t… <https://pigeonhole.dovecot.org/releases/2.3/dovecot-2.3-pigeonhole-0.5.16.t…> Binary packages in https://repo.dovecot.org/ <https://repo.dovecot.org/> Docker images in https://hub.docker.com/r/dovecot/dovecot <https://hub.docker.com/r/dovecot/dovecot> * .dovecot.sieve.log file now includes year in the header. * Change Sieve script result execution to delay definitive action execution to the end of a successful Sieve script execution session. This is part of an effort to solve problems with the Sieve duplicate test. As a side-effect, some rare temporary-error cases yield different results, in which partial failure is more likely.

1 0

Dovecot Debian repo instructions need updating
by Laura Smith 05 Aug '21

05 Aug '21

Re: https://doc.dovecot.org/installation_guide/dovecot_community_repositories/d… The instructions need updating for two reasons: 1) Keep up to date with Debian releases (https://wiki.debian.org/DebianReleases) i.e. remove reference to 8.0 "Jessie" and replace with 10.0 "Buster". 2) The instructions presented for key handling are not inline with Debian best-practices. As per https://wiki.debian.org/DebianRepository/UseThirdParty: "The key MUST be downloaded over a secure mechanism like HTTPS to a location only writable by root, which SHOULD be /usr/share/keyrings. The key MUST NOT be placed in /etc/apt/trusted.gpg.d or loaded by apt-key add. A sources.list entry SHOULD have the signed-by option set. The signed-by entry MUST point to a file, and not a fingerprint."

2 4

quota_grace
by dovecot＠ptld.com 05 Aug '21

05 Aug '21

There isn't much documentation on quota_grace. How would you disable quota grace? quota_grace = 0 quota_grace = 0% quota_grace = 0m quota_grace = -1 Assuming "0" isn't an "unlimited" setting?

2 1

dovecot + Procmail -> junk emails
by Stephane Magnier 03 Aug '21

03 Aug '21

Hi, Having moved from 'mbox' to 'Maildir', I'm trying to use a way to move a spam email to the Junk folder I declared the junk folder as; namespace inbox { type = private disabled = no ignore_on_failure = no list = yes subscriptions = yes #hidden = no #inbox = yes #prefix = INBOX/ mailbox "Drafts" { auto = subscribe special_use = \Drafts } mailbox "Junk" { auto = subscribe autoexpunge = 12 weeks special_use = \Junk } mailbox "Trash" { auto = no autoexpunge = 12 weeks special_use = \Trash } mailbox "Sent" { auto = subscribe special_use = \Sent } and spamassassin, very basic loadplugin Mail::SpamAssassin::Conf required_hits 5 required_score 5 rewrite_header subject [** SPAM ** ] add_header all Status _YESNO_, score=_SCORE_ required=_REQD_ tests=_TESTS_ autolearn=_AUTOLEARN_ version=_VERSION_ spf_timeout 60 rewrite_header to [Email could be SPAM ] fold_headers 0 #defang_mime 0 report_safe 0 and Procmail.. basic and I used what I found on the webpage : https://wiki.dovecot.org/procmail <https://wiki.dovecot.org/procmail> DELIVER="/usr/lib/dovecot/deliver -d $LOGNAME" SHELL="/bin/bash" SENDMAIL="/usr/sbin/sendmail -oi -t" LOGFILE="/var/log/procmail.log" DEFAULT="/var/spool2/mail/%u :0fw | /bin/spamc -s any ####################################### #:0 #* ^X-Spam-Status: Yes #$DEFAULT ####################################### :0 w * ^X-Spam-Status: Yes | $DELIVER -m Junk # ## deliver to INBOX and stop # deliver to INBOX and stop :0 w | $DELIVER But with this config, a spam email, stay into the Inbox :-( /var/log/procmail.log... doesn't exist Thanks for you help

3 3

Multiple Quota Limit Configurations
by Joseph D Wagner 02 Aug '21

02 Aug '21

Is this a valid quota rule? *:storage=0,messages=0 Or do I need to make them two separate rules? Joseph D Wagner

1 0

Timo - is the v2.3.15 GCC limitation really necessarily or it's just a bug?
by Mart Pirita 02 Aug '21

02 Aug '21

Hello. So far I have successfully built Dovecot until v2.3.14 on Centos 4-6 (yes I know, they are old, but as they are remote servers, distros can't upgraded), and sometimes I have also met compilation issues, but after highlighting them, Timo have fixed the code. Found from similar thread (Dovecot 2.3.15 compilation fails https://dovecot.org/list/dovecot/2021-June/122412.html ) that new GCC is needed. However I can't find such requirement in v2.3.15 change log. As seems that I'm not the only one with compilation issues, then @Timo - can You please fix the code so that also v2.3.15 can compiled on older distros? Compilation options: ./configure --prefix=/usr --with-ssl=openssl --with-ssldir=/etc/ssl --sysconfdir=/etc --with-pam --without-bsdauth --without-sql --without-nss --without-ldap --without-pgsql --without-mysql --without-sqlite --with-rundir=/var/run/dovecot --without-cassandra --without-lucene --without-solr --without-textcat --without-libcap --without-stemmer --disable-rpath --disable-dependency-tracking --disable-silent-rules --without-gssapi --without-cdb Compilation error: builtin-strftime -c -o test-smtp-params.o test-smtp-params.c test-smtp-params.c:29: error: unknown field `data' specified in initializer test-smtp-params.c:29: warning: missing braces around initializer test-smtp-params.c:29: warning: (near initialization for `test_params_buffer1.<anonymous>') test-smtp-params.c:30: warning: missing initializer test-smtp-params.c:30: warning: (near initialization for `test_params_buffer1.<anonymous>.<anonymous>.used') test-smtp-params.c:30: error: unknown field `used' specified in initializer test-smtp-params.c:31: warning: excess elements in struct initializer test-smtp-params.c:31: warning: (near initialization for `test_params_buffer1') test-smtp-params.c:33: error: unknown field `data' specified in initializer test-smtp-params.c:33: warning: missing braces around initializer test-smtp-params.c:33: warning: (near initialization for `test_params_buffer2.<anonymous>') test-smtp-params.c:34: warning: missing initializer test-smtp-params.c:34: warning: (near initialization for `test_params_buffer2.<anonymous>.<anonymous>.used') test-smtp-params.c:34: error: unknown field `used' specified in initializer test-smtp-params.c:35: warning: excess elements in struct initializer test-smtp-params.c:35: warning: (near initialization for `test_params_buffer2') make[3]: *** [test-smtp-params.o] Error 1 make[3]: Leaving directory `/usr/src/redhat/BUILD/dovecot-2.3.15/src/lib-smtp' make[2]: *** [all-recursive] Error 1 make[2]: Leaving directory `/usr/src/redhat/BUILD/dovecot-2.3.15/src' make[1]: *** [all-recursive] Error 1 make[1]: Leaving directory `/usr/src/redhat/BUILD/dovecot-2.3.15' make: *** [all] Error 2 error: Bad exit status from /var/tmp/rpm-tmp.7364 (%build) -- Mart

9 12

SQL Backend for IMAP METADATA Dictionary
by Joseph D Wagner 01 Aug '21

01 Aug '21

I've seen documentation on using a SQL backend for quota dictionary and passdb&userdb dictionary. However, I can't find any examples of a SQL backend for IMAP METADATA / mail_attributes_dict. Is this combination possible? If so, is there an example somewhere? I am unsure what data structures it's expected or how to create the map entries for it. Thanks in advance. Joseph D. Wagner

2 4

Disable authentication for submission service
by Dan Conway 01 Aug '21

01 Aug '21

Hello, Is it possible to disable the requirement for authentication on the submission service? I'm trying to require authentication for all, except for a handful of IP addresses. Thank you. ehlo test.com 250-aaa 250-AUTH PLAIN LOGIN 250-BURL imap 250-CHUNKING 250-DSN 250-ENHANCEDSTATUSCODES 250-SIZE 250 PIPELINING MAIL FROM:<test(a)test.com> 530 5.7.0 Authentication required.

8 11

Re: check_policy_service sends size=0
by dovecot＠ptld.com 01 Aug '21

01 Aug '21

> It sounds like a better approach would be to make Dovecot reject any > email no matter what the size is (even size=0) if a user is over > quota. I'll take further discussion to the dovecot mailing list then. If you are not aware, dovecot has by default a 10% over quota grace. So even being a couple of bytes over quota it would still accept a small message.

3 3

Re: Monitoring of director back end nodes
by Tom Sommer 31 Jul '21

31 Jul '21

On 2021-07-31 19:28, darkc0de wrote: > So dovemon for Dovecot pro, but nothing for community? https://github.com/brandond/poolmon --- Tom

1 0

Monitoring of director back end nodes
by Dan Conway 31 Jul '21

31 Jul '21

Hello, When working with director, the state of the backend nodes are not checked by Dovecot. The state always remains as "up". I understand that there are external applications documented that monitor backend nodes, and changes the state of them to "down" if they become unresponsive. The question I have is are there plans to implement something built into Dovecot that would monitor and change states based on backend "health"? Or will it always be dependent on an external service? Thanks.

3 2

quota-status fails when size=0 from Postfix
by Christoph Haas 30 Jul '21

30 Jul '21

Dear list, I've been pulling my hair out today and kindly ask you for help. I'm on Debian Bullseye with Dovecot 2.3.13 and Postfix 3.5.6. Users are stored in SQL and I want to use quotas. Basically I followed https://doc.dovecot.org/configuration_manual/quota_plugin/#quota-service With mail_debug enabled I see that the information from SQL is fetched correctly: dovecot: quota-status(test(a)bullseye.example.org)<45148><>: Debug: auth-master: userdb lookup(test(a)bullseye.example.org): auth USER input: test(a)bullseye.example.org quota_rule=*:bytes=1000 home=/var/vmail/bullseye.example.org/test uid=5000 gid=5000 So the quota rule "*:bytes=1000" is loaded as intended for testing. Before handing the email over to Dovecot through LMTP Postfix should call the quota-service (policy daemon) to determine if the user is over quota: smtpd_recipient_restrictions = \ reject_unauth_destination \ check_policy_service inet:localhost:12340 This is still by the book. What I found: - sending a test mail with Thunderbird properly returns a 5xx status (over quota) - sending a test mail with SWAKS returns DUNNO (swaks is an SMTP test tool) I have used tcpdump to look into the communication on port 12340 and the difference appears to be the "size=0" line that Postfix sends if I use SWAKS. Output from SWAKS: -> RCPT TO:<test(a)bullseye.example.org> <- 250 2.1.5 Ok However if Thunderbird sends an email it uses something like -> RCPT TO:<test(a)bullseye.example.org> SIZE=12345 If I understand the situation correctly then Postfix extracts the SIZE=… value and uses that to send it to the quota-status policy daemon. The user however is definitely over quota: $> doveadm quota get -u test(a)bullseye.example.org Quota name Type Value Limit % User quota STORAGE 1 1 100 User quota MESSAGE 1 - 0 So whatever the size of the incoming email is, it should be rejected. As quota-status returns DUNNO, Postfix will send the email to Dovecot through LMTP. And LMTP in turn does another quota check and correctly rejects the email: postfix/lmtp[45153]: 573419D6A3: to=<test(a)bullseye.example.org>, relay=iredmail-test[private/dovecot-lmtp], delay=0.08, delays=0.05/0.01/0.01/0.01, dsn=5.2.2, status=bounced (host iredmail-test[private/dovecot-lmtp] said: 552 5.2.2 <test(a)bullseye.example.org> Quota exceeded (mailbox for user is full) (in reply to end of DATA command)) Problem here is that a bounce is created and Postfix is sending backscatter. Had "quota-service" indicated that the mailbox is over quota then Postfix had instantly rejected the email without any bounce. I can also reproduce this effect by talking to the quota-status daemon: printf "recipient=test(a)bullseye.example.org\nsize=0\n\n" | nc localhost 12340 action=DUNNO printf "recipient=test(a)bullseye.example.org\nsize=10000\n\n" | nc localhost 12340 action=554 5.2.2 Quota exceeded (mailbox for user is full) Is this a feature? A bug? An evil coincidence? Thanks for reading this far. I know that this matter seems a bit complicated. But it feels like Dovecot's behavior leads to backscatter and of course I'd like to avoid that. Kindly… Christoph

4 14

[bug 2.3.15] seeing user-shared mailboxes across different storage types requires manual change to subscriptions
by Michal Soltys 29 Jul '21

29 Jul '21

Hi, While I was checking old bug I once reported (that one seems to be fixed, https://www.dovecot.org/list/dovecot/2017-January/106593.html) I discovered another issue happening under current version when user sharing his mailbox (with Maildir storage) is not visible under user using mdbox (or sdbox, also tested) - unless subscriptions file is manually adjusted (after subscribing). Consider following config: # 2.3.15 (0503334ab1): /etc/dovecot/dovecot.conf # OS: Linux 5.12.14-arch1-1 x86_64 Arch Linux btrfs # Hostname: hakai auth_debug = yes auth_mechanisms = plain login disable_plaintext_auth = no first_valid_uid = 1 listen = * mail_debug = yes mail_gid = dovecot mail_location = maildir:/var/mail1/%n/Maildir mail_plugins = acl mail_uid = dovecot namespace { inbox = yes location = prefix = separator = / type = private } namespace shared1 { inbox = no list = yes location = maildir:%%h/Maildir/ prefix = shared1/%%n/ separator = / subscriptions = no type = shared } namespace shared2 { inbox = no list = yes location = mdbox:%%h/mdbox/ prefix = shared2/%%n/ separator = / subscriptions = no type = shared } passdb { args = /etc/dovecot/local-maildir driver = passwd-file } passdb { args = /etc/dovecot/local-mdbox driver = passwd-file } plugin { acl = vfile acl_shared_dict = file:/var/mail-data/shared-database/shared-mailboxes.db } protocols = imap service auth { unix_listener auth-userdb { group = mail mode = 0660 user = dovecot } user = dovecot } service imap-login { inet_listener imap { address = * port = 143 } inet_listener imaps { address = * port = 993 } user = dovecot } service imap { executable = /usr/lib/dovecot/imap } userdb { driver = prefetch } userdb { args = /etc/dovecot/local-maildir driver = passwd-file } userdb { args = /etc/dovecot/local-mdbox driver = passwd-file } protocol imap { mail_max_userip_connections = 100 mail_plugins = acl imap_acl } /etc/dovecot/local-maildir: user1:{PLAIN}test:::user1:/var/mail1/user1::userdb_mail=maildir:/var/mail1/user1/Maildir userdb_home=/var/mail1/user1 user2:{PLAIN}test:::user2:/var/mail1/user2::userdb_mail=maildir:/var/mail1/user2/Maildir userdb_home=/var/mail1/user2 /etc/dovecot/local-mdbox: user3:{PLAIN}test:::user3:/var/mail2/user3::userdb_mail=mdbox:/var/mail2/user3/mdbox userdb_home=/var/mail2/user3 There are two shared namespaces - shared1 for Maildir mailboxes and shared2 for mdbox ones. 'user1' is sharing his 'qwer' folder to user3. doveadm mailbox create -u user1 -s qwer doveadm acl add -u user1 qwer user=user3 read lookup doveadm mailbox subscribe -u user3 shared1/user1/qwer This produces subscriptions file such as: 14:44 # cat /var/mail2/user3/mdbox/subscriptions V 2 Trash shared1 user1 qwer With all that in place, 'qwer' won't be visible to user3. But if we change the 'shared1 user1 qwer' to shared1/user1/qwer - then everything will be working fine. Sharing mdbox folder to maildir user (user3 -> user1) as well as maildir to maildir (user1 -> user2) works without issues.

1 1

Shared mailbox strange behaviors
by Ervin Hegedüs 27 Jul '21

27 Jul '21

Hi there, I've set up my Dovecot instance for shared mail accounts. I'm using Debian 10, Dovecot 2.3.4. This is what I did: #namespace { # type = private # separator = / # prefix = # location = # inbox = yes #} namespace { type = shared separator = / prefix = Osztott/%%u/ location = maildir:%%h:INDEX=~/shared/%%u subscriptions = no list = yes } Note, the word "Osztott" means "Shared" in my language. The strange behaviors: 1: as you can see, the first empty namespace is commented. This is because when I restarted the Dovecot instance, it sent this message to the log: Error: namespace configuration error: Duplicate namespace prefix: "" When I commented out these lines, the error message left. Why did that happen? What's the real solution? 2: with this config, I see the shared accounts under my account, with prefix "Osztott" - but the shared account is duplicated. There are two instances with similar names. In first mailbox I see the e-mails, this is fine. But under the "regular" name of the shared mailbox, there is the other mailbox with the same name + a suffix "-1", which is empty. Why is that second maildir there? Thank you for your help, a.

1 0

Submission server and Outlook delivery notification
by Tobia Grosselle [ Terralink ] 26 Jul '21

26 Jul '21

Version: 2.3.15 (0503334ab1) Hello everyone, it seems that the delivery notification function on Outlook doesn't work with Dovecot Submission service, is expected? Will it be implemented? Thanks in advance

1 0

Dovecot and Android's Gmail app
by Jakub Filo 26 Jul '21

26 Jul '21

Hello, does anyone else have this problem with connecting to dovecot (imap) via gmail app on Android, where after removing messages, they reappear shortly after? It happens seemingly randomly, not always. -- Jakub Filo jakub(a)plantroon.com

2 1

Set vhost count in config
by William Edwards 23 Jul '21

23 Jul '21

Hi, Can we do `doveadm director update ... 100` in the on-disk config, so the vhost count is retained after the ring goes down? I could not find such an option in doveconf. -- With kind regards, William Edwards

1 0

Quick Question
by Stephane Magnier 23 Jul '21

23 Jul '21

Hi, Is there a way to transform a "*mbox*" structure ( in the folder : like /var/spool/mail/........ ) into a *maildir* structure ? I would dream to see a doveadm instruction doing something like : */doveadm /var/spool/mail/%u /var/spool2/./*...... something like this.. That would be great !! :-) Thanks and regards

2 2

dovecot and auth cache
by Maciej Milaszewski 23 Jul '21

23 Jul '21

Hi In my lab I have tested auth cache in dovecot like: 1) test auth doveadm auth login ala(a)domain.ltd pass passdb: ala(a)domain.ltd auth succeeded - user ala(a)domain.ltd is in mysql (klater galera) 2)I stop the galley cluster 3)test auth - via cache doveadm auth login ala(a)domain.ltd pass passdb: ala(a)domain.ltd auth succeeded 4)flush cache root@msmtp3:~# doveadm auth cache flush 2 cache entries flushed root@msmtp3:~# doveadm auth cache flush 0 cache entries flushed - cache is emty 5)test auth doveadm auth login ala(a)domain.ltd pass passdb: ala(a)domain.ltd auth succeeded Why 5 step give - successed ? doveconf -n # 2.3.4.1 (f79e8e7e4): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.4 () # OS: Linux 4.19.0-12-amd64 x86_64 Debian 10.9 ... auth_cache_negative_ttl = 5 mins auth_cache_ttl = 5 mins ... If I restart dovecot works correctly - I mean: doveadm auth login ala(a)domain.ltd pass not auth I dont have any idea

1 1

BDAT to DATA translation on submission service when checkpassword is involved
by Dan Conway 23 Jul '21

23 Jul '21

Hello, I'm having issues with Dovecot translating "BDAT" commands (CHUNKING) into "DATA" commands when the backend does not support it in the submission service. I use "checkpassword" to authenticate users and judging by older mailing list entries the presence of "submission_*" directives must be in place for Dovecot to translate. Even with these directives set, the translation doesn't seem to occur. checkpassword returns "director_tag=remote_smtp" (along with other fields such as nopassword=y proxy=y) which in turn sets the backend host to relay the connection to. I have a feeling the use of checkpassword has something to do with this lack of translation. If the "submission_*" directives must be in place for this translation to occur, which ones are they? Can I return these fields from checkpassword? Output of doveconf -n: # 2.3.15 (0503334ab1): /etc/dovecot/dovecot.conf # OS: Linux 4.15.0-147-generic x86_64 Ubuntu 18.04.5 LTS # Hostname: xyz auth_debug = yes auth_debug_passwords = yes auth_mechanisms = plain login auth_verbose = yes director_mail_servers = x.x.x.x@remote_smtp director_servers = x.x.x.x disable_plaintext_auth = no mail_log_prefix = "%Us(%u) [%r]: " passdb { args = /usr/local/bin/checkpassword driver = checkpassword } protocols = " imap pop3 submission" service anvil { client_limit = 3553 } service auth { client_limit = 3550 } service director { fifo_listener login/proxy-notify { mode = 0600 user = $default_login_user } inet_listener { address = x.x.x.x port = 9090 } unix_listener director-admin { mode = 0600 } unix_listener login/director { mode = 0666 } } service imap-login { executable = imap-login director inet_listener imap { address = x.x.x.x port = 143 } inet_listener imaps { address = x.x.x.x port = 993 ssl = yes } process_limit = 1000 process_min_avail = 0 service_count = 1 } service imap { process_limit = 2048 process_min_avail = 0 service_count = 1 vsz_limit = 384 M } service pop3-login { executable = pop3-login director inet_listener pop3 { address = x.x.x.x port = 110 } inet_listener pop3s { address = x.x.x.x port = 995 ssl = yes } process_limit = 450 } service pop3 { process_limit = 190 process_min_avail = 0 service_count = 1 } service submission-login { executable = submission-login director inet_listener smtp { address = x.x.x.x port = 25 } inet_listener smtps { address = x.x.x.x port = 465 ssl = yes } inet_listener submission { address = x.x.x.x port = 587 } process_limit = 2000 } ssl_cert = </etc/... ssl_dh = # hidden, use -P to show it ssl_key = # hidden, use -P to show it ssl_min_protocol = TLSv1.1 submission_backend_capabilities = submission_host = x.x.x.x submission_relay_host = x.x.x.x submission_relay_port = 465 submission_relay_ssl = smtps submission_relay_trusted = yes userdb { args = /etc/dovecot/userdb.conf driver = ldap } protocol imap { imap_logout_format = bytes=%i/%o, del=%e mail_max_userip_connections = 20 } protocol pop3 { mail_max_userip_connections = 20 pop3_logout_format = top=%t/%p, retr=%r/%b, del=%d/%m, size=%s } protocol submission { mail_max_userip_connections = 10 } local_name *.domain.com { ssl_cert = </etc/... ssl_key = # hidden, use -P to show it }

2 1

folders and subfolders
by Stephane Magnier 22 Jul '21

22 Jul '21

Hi, Still looking for the way to create folders and sub folders.. Today, I am using "mbox", which apparently doesn't work for this ? correct ? So, I would probably need to use maildir.. ( https://doc.dovecot.org/configuration_manual/mail_location/Maildir/ ] Today, what I am using is :*mbox, *which is gather all the mailboxes of user 1, user 2 in one folder... like : mbox:/var/spool2/mail/%u 1) I suppose, that If I am using "mbox" with .. : LAYOUT=fs, I won't get these folders and subfolders ? - Correct ? 2) Instead of having : "maildir:~/Maildir " which, I suppose got each_user folder into their own home directory_ .. correct ? Can I have : *maildir:/var/spool2/mail/%u *? ( I would prefer to gather all users' mailbox into one folder like /var/spool2/mail/ ) 3) if so, *mbox:/var/spool2/mail/%u:INBOX=/var/spool/mail/%u* => can become : *maildir:/var/spool2/mail/%u:LAYOUT=fs:INBOX=/var/spool/mail/%u* What do you think ?... before trying and breaking everything :-)... if so, I will be killed Thanks and regards

5 20

Doveadm encrypt/decrypt files manually with per-user folder keys
by Ben Burk 21 Jul '21

21 Jul '21

There is an example of manually encrypting/decrypting mail processed by the mail_crypt plugin here: https://doc.dovecot.org/configuration_manual/mail_crypt_plugin/ It outlines how one would manually encrypt/decrypt messages using global keys: doveadm fs get/put crypt private_key_path=foo:public_key_path=foo2:posix:prefix=/path/to/files/root path/to/file Is there a way to accomplish this using per-user folder keys? Is there some way of making sense of the information in the dovecot-attributes file to accomplish this? -- Ben Burk BURK.TECH System Administrator

2 6

Traffic accounting
by Jesús Ángel del Pozo Domínguez 20 Jul '21

20 Jul '21

Hello, Could you please tell me whether is it possible to do traffic accounting using Dovecot 2.3.4? What I'd like to do is to collect network traffic (both in & out) for each user (both POP and IMAP traffic). Regards,

4 4

dovecot-lmtp crashing when setting lmtp_proxy=yes
by Camilo Sperberg 19 Jul '21

19 Jul '21

Hi all: We are currently in the process of setting up dovecot proxy so that we can deploy multiple machines in order to keep growing. We are trying now to create an entry point, and from there send the traffic to either the same machine or another node. For this, we are using a MySQL database with information about which server hosts which mailboxes, which turns out to be working great for sending out mail and general authentification. This was really simple to set up, kudos for that! However, whenever I want to *receive* email, I just have to enable the lmtp_proxy setting which makes the lmtp process segfault. This happens everytime as I can reliable reproduce it + get a stack trace of it. The process will crash on every incoming email. I have attached: - Complete output of dovecot-sysreport - A core dump of the crashed process Main information: Using dovecot v2.3.14 (cee3cbc0d) on Ubuntu 18.04 LTS: Linux 5.4.0-1046-gcp x86_64 Ubuntu 18.04.5 LTS. Our MTA is postfix. Logs around the crashed process: Jul 15 14:53:21 server postfix/postscreen[19402]: CONNECT from [XX.XX.XX.XX]:36411 to [10.164.0.18]:25 Jul 15 14:53:22 server postfix/dnsblog[19406]: addr XX.XX.XX.XX listed by domain dnsbl.sorbs.net as 127.0.0.6 Jul 15 14:53:27 server postfix/postscreen[19402]: PASS NEW [XX.XX.XX.XX]:36411 Jul 15 14:53:27 server postfix/smtpd[19408]: connect from mail-XX.google.com [XX.XX.XX.XX] Jul 15 14:53:28 server postfix/smtpd[19408]: B765F401DB: client= mail-XX.google.com[XX.XX.XX.XX] Jul 15 14:53:28 server postfix/cleanup[19411]: B765F401DB: message-id=< XX+5j3RpXXXXXOK7GHdiDSGSPXXXX(a)mail.gmail.com> Jul 15 14:53:29 server postfix/qmgr[1414]: B765F401DB: from=< unreal4u(a)gmail.com>, size=2815, nrcpt=1 (queue active) Jul 15 14:53:29 server dovecot: lmtp(19413): Connect from local Jul 15 14:53:29 server kernel: [1738624.857507] lmtp[19413]: segfault at 0 ip 00007fd486cd0a37 sp 00007ffc12a6c118 error 4 in libdovecot.so.0.0.0[7fd486ba1000+1aa000] Jul 15 14:53:29 server kernel: [1738624.857514] Code: eb de 90 48 85 d2 75 1e eb 33 66 0f 1f 84 00 00 00 00 00 84 c0 74 18 48 83 c7 01 48 83 c6 01 88 47 ff 48 83 ea 01 48 83 fa 01 <0f> b6 06 77 e4 c6 07 00 31 c0 80 3e 00 0f 95 c0 f7 d8 c3 b8 ff ff Jul 15 14:53:29 server dovecot: lmtp(19413): Fatal: master: service(lmtp): child 19413 killed with signal 11 (core dumped) Jul 15 14:53:29 server postfix/lmtp[19412]: B765F401DB: to=<YYY(a)YYYY.YY>, relay=ZZZ.ZZZ.ZZ[private/dovecot-lmtp], delay=0.88, delays=0.84/0.01/0.01/0.03, dsn=4.4.2, status=deferred (lost connection with ZZZ.ZZZ.ZZ[private/dovecot-lmtp] while sending RCPT TO) Jul 15 14:53:29 server postfix/smtpd[19408]: disconnect from mail-XX.google.com[XX.XX.XX.XX] ehlo=2 starttls=1 mail=1 rcpt=1 data=1 quit=1 commands=7 Am I missing something in the conf? Did I encounter a bug? If you need more information, please let me know. Greetings, Camilo Sperberg

2 2

Major upgrade of mail server
by Shawn Heisey 18 Jul '21

18 Jul '21

I have a mail server in AWS that is currently running Ubuntu 18. Every time I log in, I am reminded that I can upgrade to Ubuntu 20. On Ubuntu 18, the dovecot version is 3.3.0-1ubuntu0.3. On Ubuntu 20, it is 2.3.7.2-1ubuntu3. Many other packages, probably including the mysql server, would also be upgraded. Dovecot and Postfix use a postfixadmin database in mysql for users, and postfix is using dovecot-lda to deliver mail. I am using managesieve from dovecot on roundcube webmail. As far as I know, my own user is the only one with sieve scripts actually in use ... and I have a LOT of filters/folders for various mailing lists. I've been a little bit terrified of doing an upgrade, because I do have a couple of people using my mail server for real work email and I don't want to disrupt them. I'm writing today to find out what are the likely pain points I might encounter when doing this kind of major upgrade, and if there is any helpful information that can help me get through those problems. I'm hoping that it will go smoothly and everything just works. Here's the doveconf -n output: https://apaste.info/FUgF If I have been silly enough to include sensitive data from the config, I would appreciate a heads up so I know what passwords to change. I did a quick glance and didn't see anything. Thanks, Shawn

5 5

Dovecot book for a newbie
by techlists＠phpcoderusa.com 16 Jul '21

16 Jul '21

Hi, Please recommend a Dovecot book for a newbie... I have a fair amount of Linux PHP hosting experience - LAMP virtual host configurations. I'm new to BIND, Postfix, and Dovecot. I'm running Ubuntu 20.04lts. I have a test server almost working. Can send but not receive. Would like to understand more. I'm guessing it is a Zone (MX) / SSL / Client configuration issue. Thanks in advance!!

5 8

OT somewhat, how to unsubscribe?
by Christy S 16 Jul '21

16 Jul '21

Hi folks, It's been a while since I've subscribed and I don't remember how to get off the mailing list. We've changed how we're handling mail now, so dovecot is no longer being used. Can anyone help? MOst mailing lists have a blurb at the bottom with instructions but this one doesn't seem to. Thanks Christy

3 2

Dovecot geographically distributed
by Claudio Corvino 16 Jul '21

16 Jul '21

Hi, I have a single Dovecot (2.3.4.1) IMAP/LMTP server on HQ "A" and I would like to create a backup server distributed to HQ "B", two HQ are connected through an IPsec tunnel. User mailboxes (type mbox) are on NFS storage. I don't need HA, it could even be an active / passive configuration with a floating IP, but I don't know how to keep in sync the two remote NFS filesystems. I don't know if Dovecot replication is suitable for me. Thanks -- *Claudio Corvino IT Systems Administrator*

1 0

2FA/MFA with IMAP & postfix/submission
by Alex 16 Jul '21

16 Jul '21

Hi, I have a dovecot-2.3.13 system on fedora34 with a few hundred IMAP4 accounts, as well as postfix users using submission. Clients are using primarily Outlook on Windows and old squirrelmail. Are there multi-factor options available? If it is not available, do you have any recommendations on where I should look to do this? All of the links related to this topic appear to be very old, or limited to Linux PAM users.

12 19

function for whitelisting IPs
by White, Daniel E. (GSFC-770.0)[NICS] 16 Jul '21

16 Jul '21

Sebastian, Do you have any examples of such a function and how/where it is used ? -----Original Message----- From: dovecot <dovecot-bounces(a)dovecot.org> on behalf of Sebastian <sebastian(a)sebbe.eu> Reply-To: Dovecot Mailing List <dovecot(a)dovecot.org> Date: Thursday, July 15, 2021 at 01:19 To: 'Mailing List' <dovecot(a)dovecot.org> Subject: [EXTERNAL] Sv: 2FA/MFA with IMAP & postfix/submission Main problem is that not many clients do natively support multifactor. Some clients, do popup a login dialog if the server rejects the password as invalid, which can be used to create a "cheaty variant" of multifactor, but some clients just popup an error dialog and tell the user to just correct password in settings. Some clients even go as long as requiring the user to delete the account with wrong password and set up a new connection. So no, it cannot be relied upon. I have a better idea: Have a function for whitelisting IPs, possible /24's or similiar, where a login to roundcube or other webmail client (with 2FA) will add the IP onto a whitelist for that account. Or perhaps, just "set" the country of the account based on GeoIP. When an account tries to login via IMAP or SMTP, you just check if IP and/or GeoIP country is right, and reject the login as invalid if so not. The only thing a client needs to do to get his IMAP or SMTP client to work again if it stops working, is to login once via the web client. -----Ursprungligt meddelande----- Från: dovecot-bounces(a)dovecot.org <dovecot-bounces(a)dovecot.org> För Alex Skickat: den 15 juli 2021 02:10 Till: dovecot(a)dovecot.org Ämne: 2FA/MFA with IMAP & postfix/submission Hi, I have a dovecot-2.3.13 system on fedora34 with a few hundred IMAP4 accounts, as well as postfix users using submission. Clients are using primarily Outlook on Windows and old squirrelmail. Are there multi-factor options available? If it is not available, do you have any recommendations on where I should look to do this? All of the links related to this topic appear to be very old, or limited to Linux PAM users.

7 10

TLS Security
by Stefan Schumacher 15 Jul '21

15 Jul '21

Hi, I wish to build a new secure email server. It seems I am on the right way – at least I get no more error messages for Postfix – but Dovecot is still making trouble. I am using Dovecot 1:2.3.4.1-5+deb10u6 and I am using ISPconfig 3.25 to do the rough configuring and nano and whats left of my brain to do the finer details. Lets start with what I added to conf.d/10-ssl.conf ssl_cert = </etc/letsencrypt/live/servername/fullchain.pem ssl_key = </etc/letsencrypt/live/servername/privkey.pem ssl_cipher_list = EECDH+ECDSA+AESGCM:EECDH+aRSA+AESGCM:EECDH+ECDSA+SHA384:EECDH+ECDSA+SHA256:EECDH+aRSA+SHA384:EECDH+aR$ ssl_protocols = !SSLv2 !SSLv3 !TLSv1 !TLSv1.1 ssl_min_protocol = TLSv1.2 As you can see, I clearly do not want to use TLS before v1.2. I think this is not unreasonable in the year 2021. Now, after the changes I ran Kali (I use it to verify the results of my experiments) and - this is a mailing list, so no screenshots: It says: SSL/TLS Deprecated TLS v1.0 and TLS v1.1 Detection. I get this for the ports 143, 110, 993 and 995. I thought I had done everything one could to disable old TLS-Versions. What am I doing wrong? Yours sincerely Stefan Schumacher

4 6

AW: TLS Security
by Stefan Schumacher 15 Jul '21

15 Jul '21

Hi Justina, Kali tools is of course extremly unprecise. Excuse me, I had a long stressful day and wanted to get this out before the end of the Day. Kali is a rolling release and I keep it up to date by upgrading every few days. I also update the feeds. What I actually use for security scans is the former OpenVAS, which now has been relegated to being a part of the Community Edition of the Greenbone suite. You have seen the values I have in Dovecot. What follows now are my settings in the postfix main.cf. As you can clearly see it, it should prevent connections from TLS below 1.2. Dovecot is of course not very fresh because it's Debian 10 and Debian 11 is just around the corner (a few days). These are the settings of my postfix main.cf. I am very tempted to grab an Image of Debian 11 and install ISPConfig and my Dovecot and Postfix settings there. I am of course open to any other suggestions. A the moment I consider to install a new Bullseye RC2 and then put my configuration on it. I am of course open for any other suggestions. Yours sincerely Stefan smtpd_use_tls = yes smtpd_tls_cert_file = /etc/postfix/smtpd.cert smtpd_tls_key_file = /etc/postfix/smtpd.key smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache smtpd_tls_eecdh_grade = strong smtpd_tls_protocols= !SSLv2, !SSLv3, !TLSv1, !TLSv1.1 smtpd_tls_mandatory_protocols= !SSLv2, !SSLv3, !TLSv1, !TLSv1.1 smtpd_tls_mandatory_ciphers = high smtpd_tls_security_level=may smtpd_tls_ciphers = high tls_preempt_cipherlist = yes smtpd_tls_mandatory_exclude_ciphers = aNULL, MD5 , DES, ADH, RC4, PSD, SRP, 3DES, eNULL smtpd_tls_exclude_ciphers = aNULL, MD5 , DES, ADH, RC4, PSD, SRP, 3DES, eNULL smtp_tls_mandatory_protocols = !SSLv2, !SSLv3, !TLSv1, !TLSv1.1 smtp_tls_protocols = !SSLv2, !SSLv3, !TLSv1, !TLSv1.1 ________________________________ Von: justina colmena ~biz <justina(a)colmena.biz> Gesendet: Mittwoch, 14. Juli 2021 18:50 An: dovecot(a)dovecot.org <dovecot(a)dovecot.org>; Stefan Schumacher <s.schumacher(a)consulting1x1.com> Betreff: Re: TLS Security Interesting. Assuming your "Kali" tools are in fact up to date to test with newer protocols TLS1.2+, is Dovecot compiled against a recent version of the OpenSSL or GnuTLS library or whatever it uses to support the newer TLS protocols? Definitely an outdated cipher issue, on Postfix as well as Dovecot.... On July 14, 2021 6:55:19 AM AKDT, Stefan Schumacher <s.schumacher(a)consulting1x1.com> wrote: Hi, I wish to build a new secure email server. It seems I am on the right way – at least I get no more error messages for Postfix – but Dovecot is still making trouble. I am using Dovecot 1:2.3.4.1-5+deb10u6 and I am using ISPconfig 3.25 to do the rough configuring and nano and whats left of my brain to do the finer details. Lets start with what I added to conf.d/10-ssl.conf ssl_cert = </etc/letsencrypt/live/servername/fullchain.pem ssl_key = </etc/letsencrypt/live/servername/privkey.pem ssl_cipher_list = EECDH+ECDSA+AESGCM:EECDH+aRSA+AESGCM:EECDH+ECDSA+SHA384:EECDH+ECDSA+SHA256:EECDH+aRSA+SHA384:EECDH+aR$ ssl_protocols = !SSLv2 !SSLv3 !TLSv1 !TLSv1.1 ssl_min_protocol = TLSv1.2 As you can see, I clearly do not want to use TLS before v1.2. I think this is not unreasonable in the year 2021. Now, after the changes I ran Kali (I use it to verify the results of my experiments) and - this is a mailing list, so no screenshots: It says: SSL/TLS Deprecated TLS v1.0 and TLS v1.1 Detection. I get this for the ports 143, 110, 993 and 995. I thought I had done everything one could to disable old TLS-Versions. What am I doing wrong? Yours sincerely Stefan Schumacher -- Sent from my Android device with K-9 Mail. Please excuse my brevity.

1 0

Verifying replication
by Arnold Hendriks 15 Jul '21

15 Jul '21

Dear Dovecot people, I've set up Dovecot replication a couple of years ago. I'm watching the general server health and having Nagios check doveadm replicator status regularly. I'm seeing accounts replicating, disk space usage obviously shows that things work in principle, however, I still wonder whether the replication actually works properly. Accounts I check work, but 1-5% of the messages could easily be missing without me noticing it. These servers have I think about 50K accounts (a lot of them dormant) and between 1 to 2TB of mail. I'm trying to get some more confidence as to whether replication is actually working properly and whether I'm not missing anything that will burn me if I ever have to 'fallback'. Has anyone ever done some verification outside of simply watching doveadm replication stats, to see if they are missing anything ? Eg, I could imagine a process that generates a list of accounts, and then generates hashes on both sides of the replication for each mailbox folder. If the hashes match, the folder gets removed from the list, and once all folders are removed, the account gets removed. Iterating the account list should finally reduce it to 0, or a few extremely high traffic accounts which can be checked manually or be ignored. But I'm trying to avoid reinventing the wheel. Has anyone done anything like this, or can suggest a different approach? With regards, Arnold Hendriks

1 1

Forcing replication - difference is a 0x0D 0x0D 0xA sequence?
by Arnold Hendriks 15 Jul '21

15 Jul '21

I've found a few mailboxes on my system that were being replicated where the mailboxes are not in sync. On server 1 I see: dovecot1:/# doveadm fetch -u s0000000 "size.physical size.virtual" mailbox-guid c92f64f79f0d1ed01e6d5b314f04886c uid 115 size.physical: 1815 size.virtual: 1843 On server 2 I see: dovecot2:/# doveadm fetch -u s0000000 "size.physical size.virtual" mailbox-guid c92f64f79f0d1ed01e6d5b314f04886c uid 115 size.physical: 1805 size.virtual: 1833 Running ' doveadm replicator replicate -f s0000000 "*" ' does not fix the issue. I've compared the mails and the difference appears to be that the primary server (where the mail comes in) has a few occurences of "0D 0D 0A" (hex) which on the replicated server looks like "0D 0A". (ie, \r\r\n was replicated as \r\n ?) Is there a way to force these two messages to be in sync again ? Is the \r\r\n being replicated as \r\n a known issue ? (I'm not sure if I could replicate this, this message dates back to 2007 so probably wasn't even received originally on this server. Replication was configured much later than 2007)

1 0

folders management
by Stephane Magnier 15 Jul '21

15 Jul '21

Hi, Sorry to ask you , maybe a silly question :-) On my folders' architecture, I can see all the folders underneeth each other fodler1 folder2 etc.... I would like to have the possibility to have _folders INTO folders_, like Folder1 Folder2 .......folder 21 ......folder 22 Folders 3 Apparently, this is link to this déclaration :__*_mbox_:/var/spool2/mail/%u. *Is that correct ? is that the "mbox" declaration? or Am I complety wrong ? If I have need to change...I have to change it for what ? * Can I use this new structure with NFS shares ? * What is the backside of it ? Now, if I make this modification.. on an existing dovecot system... , Will it make a true disaster ? or I can change the declaration easily? Thanks and regards,

2 1

Restrict number of mail moved/copied
by Amol Kulkarni 14 Jul '21

14 Jul '21

Hello, I need to restrict number of mail moved/copied by end user using imap in operation. Is there any configuration for that ? Thanks and regards, Amol

1 0

dsync I/O Stalled
by Paolo Daniele 14 Jul '21

14 Jul '21

Hi guys, i've a strange problem between 2 servers. It happened after a changing on our network core routing infrastructure. We've moved to Juniper network and eBGP and iBGP of our server. One of this server is behind a firewall and communicate with another server in another country to sync our emails. Doveadmin replica seems to be fine, but sometimes i get this error message: dsync-server(aaaaa(a)bbb.bb): Error: Timeout during state=sync_mails (send=done recv=mails) It seems like the remote server has troubles to reach our local server but if i do a stupid ping i'm not losing anything. Maybe is there something am i missing? I thought that it could be related to a MTU problem but i'm not so sure and i've increased MTU on the routers involved in routing process without success. I wa missing that both servers are behind a load balancer wich is in our local DC. Can you give me some hints? Regards, Paolo -- Paolo Daniele Intendo s.r.l. E-mail: paolo.daniele(a)intendo.it Business Unit TLCWEB Tel.: +39 0968 430786 Via Coschi, 11 Skype: paolo_daniele1 88046 - Lamezia Terme, Cz Web: http://www.tlcweb.it Italia Web: http://www.intendo.it

2 2

Potential bug: Assumption that POSIX time functions do not clobber errno
by Florian Weimer 13 Jul '21

13 Jul '21

We accidentally ran the dovecot 2.3.14 testsuite on a host where clock_gettime (and probably time and gettimeofday) succeed, but set errno to ENOSYS. This behavior is unusual, but permitted by POSIX: successful function calls can overwrite errno, as long as they don't set it to 0. The relevant log excerpt looks like this: make[3]: Entering directory '/builddir/build/BUILD/dovecot-2.3.14/src/master' for bin in test-auth-client test-auth-master test-master-login-auth; do \ if ! ./$bin; then exit 1; fi; \ done test-common.c:200: Assert failed: suppress == TRUE connection refused: run (ret == -1) .................................. : ok: Connection failed CLIENT: Error: auth-client: conn unix:./auth-client-test: connect(./auth-client-test) failed: Function not implemented connection refused ................................................... : FAILED connection timed out: run (ret == -1) ................................ : ok: Connection failed connection timed out: timeout ........................................ : ok connection timed out ................................................. : ok bad version: run (ret == -1) ......................................... : ok: Connection failed bad version .......................................................... : ok disconnect version: run (ret == -1) .................................. : ok: Internal failure disconnect version ................................................... : ok auth PLAIN disconnect: run (ret < 0) ................................. : ok auth PLAIN disconnect ................................................ : ok auth PLAIN reconnect: run (ret < 0) .................................. : ok auth PLAIN reconnect ................................................. : ok auth PLAIN failure: run (ret < 0) .................................... : ok auth PLAIN failure ................................................... : ok auth PLAIN success: run (ret == 0) ................................... : ok auth PLAIN success ................................................... : ok auth LOGIN failure 1: run (ret < 0) .................................. : ok auth LOGIN failure 1 ................................................. : ok auth LOGIN failure 2: run (ret < 0) .................................. : ok auth LOGIN failure 2 ................................................. : ok auth LOGIN success: run (ret == 0) ................................... : ok auth LOGIN success ................................................... : ok auth PLAIN parallel failure: run (ret < 0) ........................... : ok auth PLAIN parallel failure .......................................... : ok auth PLAIN parallel success: run (ret == 0) .......................... : ok auth PLAIN parallel success .......................................... : ok auth LOGIN parallel failure 1: run (ret < 0) ......................... : ok auth LOGIN parallel failure 1 ........................................ : ok auth LOGIN parallel failure 2: run (ret < 0) ......................... : ok auth LOGIN parallel failure 2 ........................................ : ok auth LOGIN parallel success: run (ret == 0) .......................... : ok auth LOGIN parallel success .......................................... : ok 1 / 49 tests failed make[3]: Leaving directory '/builddir/build/BUILD/dovecot-2.3.14/src/master' “Function not implemented” suggests that dovecot somehow used the clock_gettime (or gettimeofday) ENOSYS error instead of the expected ECONNREFUSED error code. Unfortunately, I have not figured out where this exactly happens. I don't expect that the problematic glibc build escapes to the wild It was a glibc 2.34 development snapshot, and this particular source of ENOSYS errors is gone again. So fixing this is not urgent. Thanks, Florian

1 0

move mails between mailboxes
by Tom Doenen 13 Jul '21

13 Jul '21

Hello, i am using dovecot 2.3.4.1 I am tyring to make a script using the doveadm move command to move old emails into a subfolder of the users INBOX ; say all mails from 2016 into INBOX/2016. Selecting and moving is not the issue; everything works just i am amazed that the (test) mail client Thunderbird downloads all mails in INBOX/2016 after the move. When i make an IMAP move of all 2016-mails in Thunderbird; mails are moved between the mailboxes without any mails being (re-)downloaded. So what am i missing here? Thank for the tip :) Kind regards, Tom the doveadm move debug output is : Debug: Loading modules from directory: /usr/lib/dovecot/modules Debug: Module loaded: /usr/lib/dovecot/modules/lib10_quota_plugin.so Debug: Module loaded: /usr/lib/dovecot/modules/lib20_listescape_plugin.so Debug: Module loaded: /usr/lib/dovecot/modules/lib20_zlib_plugin.so Debug: Loading modules from directory: /usr/lib/dovecot/modules/doveadm Debug: Skipping module doveadm_acl_plugin, because dlopen() failed: /usr/lib/dovecot/modules/doveadm/lib10_doveadm_acl_plugin.so: undefined symbol: acl_user_module (this is usually intentional, so just ignore this message) Debug: Skipping module doveadm_expire_plugin, because dlopen() failed: /usr/lib/dovecot/modules/doveadm/lib10_doveadm_expire_plugin.so: undefined symbol: expire_set_deinit (this is usually intentional, so just ignore this message) Debug: Module loaded: /usr/lib/dovecot/modules/doveadm/lib10_doveadm_quota_plugin.so Debug: Module loaded: /usr/lib/dovecot/modules/doveadm/lib10_doveadm_sieve_plugin.so Debug: Skipping module doveadm_fts_lucene_plugin, because dlopen() failed: /usr/lib/dovecot/modules/doveadm/lib20_doveadm_fts_lucene_plugin.so: undefined symbol: lucene_index_iter_deinit (this is usually intentional, so just ignore this message) Debug: Skipping module doveadm_fts_plugin, because dlopen() failed: /usr/lib/dovecot/modules/doveadm/lib20_doveadm_fts_plugin.so: undefined symbol: fts_user_get_language_list (this is usually intentional, so just ignore this message) Debug: Skipping module doveadm_mail_crypt_plugin, because dlopen() failed: /usr/lib/dovecot/modules/doveadm/libdoveadm_mail_crypt_plugin.so: undefined symbol: mail_crypt_box_get_pvt_digests (this is usually intentional, so just ignore this message) doveadm(tom(a)somedomain.org)<17541><>: Debug: auth USER input: tom(a)somedomain.org uid=5000 gid=5000 home=/mailstore/somedomain.org/to/tom/ doveadm(tom(a)somedomain.org): Debug: Effective uid=5000, gid=5000, home=/mailstore/somedomain.org/to/tom/ doveadm(tom(a)somedomain.org): Debug: Quota root: name=User quota backend=maildir args= doveadm(tom(a)somedomain.org): Debug: Quota rule: root=User quota mailbox=* bytes=8589934592 messages=0 doveadm(tom(a)somedomain.org): Debug: Quota rule: root=User quota mailbox=Trash bytes=+104857600 messages=0 doveadm(tom(a)somedomain.org): Debug: Quota warning: bytes=8589934592 (100%) messages=0 reverse=no command=quota-warning 100 tom(a)somedomain.org doveadm(tom(a)somedomain.org): Debug: Quota warning: bytes=8504035246 (99%) messages=0 reverse=no command=quota-warning 99 tom(a)somedomain.org doveadm(tom(a)somedomain.org): Debug: Quota warning: bytes=8418135900 (98%) messages=0 reverse=no command=quota-warning 98 tom(a)somedomain.org doveadm(tom(a)somedomain.org): Debug: Quota warning: bytes=8246337208 (96%) messages=0 reverse=no command=quota-warning 96 tom(a)somedomain.org doveadm(tom(a)somedomain.org): Debug: Quota warning: bytes=8074538516 (94%) messages=0 reverse=no command=quota-warning 94 tom(a)somedomain.org doveadm(tom(a)somedomain.org): Debug: Quota warning: bytes=7902739824 (92%) messages=0 reverse=no command=quota-warning 92 tom(a)somedomain.org doveadm(tom(a)somedomain.org): Debug: Quota warning: bytes=7730941132 (90%) messages=0 reverse=no command=quota-warning 90 tom(a)somedomain.org doveadm(tom(a)somedomain.org): Debug: Quota warning: bytes=7301444403 (85%) messages=0 reverse=no command=quota-warning 85 tom(a)somedomain.org doveadm(tom(a)somedomain.org): Debug: Quota warning: bytes=6871947673 (80%) messages=0 reverse=no command=quota-warning 80 tom(a)somedomain.org doveadm(tom(a)somedomain.org): Debug: Quota warning: bytes=6012954214 (70%) messages=0 reverse=no command=quota-warning 70 tom(a)somedomain.org doveadm(tom(a)somedomain.org): Debug: Quota warning: bytes=8589934592 (100%) messages=0 reverse=yes command=quota-warning 0 tom(a)somedomain.org doveadm(tom(a)somedomain.org): Debug: Quota grace: root=User quota bytes=47185920 doveadm(tom(a)somedomain.org): Debug: Namespace inbox: type=private, prefix=, sep=/, inbox=yes, hidden=no, list=yes, subscriptions=yes location=maildir:/mailstore/somedomain.org/to/tom:INDEX=/indexes/somedomain… doveadm(tom(a)somedomain.org): Debug: maildir++: root=/mailstore/somedomain.org/to/tom, index=/indexes/somedomain.org/to/tom, indexpvt=, control=, inbox=/mailstore/somedomain.org/to/tom/.INBOX, alt= doveadm(tom(a)somedomain.org): Debug: quota: quota_over_flag check: quota_over_script unset - skipping doveadm(tom(a)somedomain.org): Debug: Mailbox INBOX/2016: Mailbox opened because: move doveadm(tom(a)somedomain.org): Debug: Mailbox INBOX: Mailbox opened because: move doveadm(tom(a)somedomain.org): Debug: Mailbox INBOX/2016: saving UID 0: Opened mail because: mail stream doveadm(tom(a)somedomain.org): Debug: Mailbox INBOX: UID 52642: Opened mail because: mail stream doveadm(tom(a)somedomain.org): Debug: Mailbox INBOX/2016: saving UID 0: Opened mail because: mail stream doveadm(tom(a)somedomain.org): Debug: Mailbox INBOX: UID 52643: Opened mail because: mail stream doveadm(tom(a)somedomain.org): Debug: Mailbox INBOX/2016: saving UID 0: Opened mail because: mail stream doveadm(tom(a)somedomain.org): Debug: Mailbox INBOX: UID 52644: Opened mail because: mail stream doveadm(tom(a)somedomain.org): Debug: Mailbox INBOX/2016: saving UID 0: Opened mail because: mail stream doveadm(tom(a)somedomain.org): Debug: Mailbox INBOX: UID 52645: Opened mail because: mail stream doveadm(tom(a)somedomain.org): Debug: Mailbox INBOX/2016: saving UID 0: Opened mail because: mail stream doveadm(tom(a)somedomain.org): Debug: Mailbox INBOX: UID 52646: Opened mail because: mail stream doveadm(tom(a)somedomain.org): Debug: Mailbox INBOX/2016: saving UID 0: Opened mail because: mail stream doveadm(tom(a)somedomain.org): Debug: Mailbox INBOX: UID 52963: Opened mail because: mail stream doveadm(tom(a)somedomain.org): Debug: Mailbox INBOX/2016: saving UID 0: Opened mail because: mail stream doveadm(tom(a)somedomain.org): Debug: Mailbox INBOX: UID 52964: Opened mail because: mail stream doveadm(tom(a)somedomain.org): Debug: Mailbox INBOX/2016: saving UID 0: Opened mail because: mail stream doveadm(tom(a)somedomain.org): Debug: Mailbox INBOX: UID 52965: Opened mail because: mail stream doveadm(tom(a)somedomain.org): Debug: Mailbox INBOX/2016: saving UID 0: Opened mail because: mail stream doveadm(tom(a)somedomain.org): Debug: Mailbox INBOX: UID 52967: Opened mail because: mail stream doveadm(tom(a)somedomain.org): Debug: Mailbox INBOX/2016: saving UID 0: Opened mail because: mail stream doveadm(tom(a)somedomain.org): Debug: Mailbox INBOX: UID 52968: Opened mail because: mail stream doveadm(tom(a)somedomain.org): Debug: Mailbox INBOX/2016: saving UID 0: Opened mail because: mail stream doveadm(tom(a)somedomain.org): Debug: Mailbox INBOX: UID 52969: Opened mail because: mail stream doveadm(tom(a)somedomain.org): Debug: Mailbox INBOX/2016: saving UID 0: Opened mail because: mail stream doveadm(tom(a)somedomain.org): Debug: Mailbox INBOX: UID 52970: Opened mail because: mail stream doveadm(tom(a)somedomain.org): Debug: Mailbox INBOX/2016: saving UID 0: Opened mail because: mail stream doveadm(tom(a)somedomain.org): Debug: Mailbox INBOX: UID 52972: Opened mail because: mail stream etc etc... obscured config : # 2.3.4.1 (f79e8e7e4): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.4 () # OS: Linux 4.19.194-rt81 x86_64 Debian 10.0 ext4 # Hostname: hardy.somedomain.org auth_cache_negative_ttl = 7 mins auth_cache_size = 20 M auth_cache_ttl = 12 mins auth_cache_verify_password_with_worker = yes auth_failure_delay = 9 secs auth_mechanisms = plain login auth_username_chars = auth_worker_max_count = 90 default_client_limit = 2500 default_process_limit = 500 default_vsz_limit = 4 G hostname = post.somedomain.org imap_capability = +SPECIAL_USE imap_fetch_failure = no-after imap_hibernate_timeout = 15 secs imap_idle_notify_interval = 4 mins imap_max_line_length = 512 k lda_mailbox_autocreate = yes lda_mailbox_autosubscribe = yes lda_original_recipient_header = X-Original-To listen = * lmtp_rcpt_check_quota = yes login_log_format_elements = user=<%u> method=%m rip=%r lip=%l mpid=%e %c %k mail_cache_min_mail_count = 15 mail_fsync = never mail_location = maildir:/mailstore/%d/%2n/%n:INDEX=/indexes/%d/%2n/%n:INBOX=/mailstore/%d/%2n/%n/.INBOX:VOLATILEDIR=/tmp/dovecot:NO-NOSELECT:UTF-8 mail_max_keyword_length = 100 mail_plugins = quota zlib listescape mail_prefetch_count = 20 mail_privileged_group = mail mail_temp_scan_interval = 0 mailbox_idle_check_interval = 55 secs mailbox_list_index_include_inbox = yes mailbox_list_index_very_dirty_syncs = yes maildir_broken_filename_sizes = yes maildir_very_dirty_syncs = yes namespace inbox { inbox = yes location = mailbox Concepts { auto = no special_use = \Drafts } mailbox "Deleted Messages" { auto = no special_use = \Trash } mailbox Drafts { auto = subscribe special_use = \Drafts } mailbox Junk { auto = no special_use = \Junk } mailbox Sent { auto = subscribe special_use = \Sent } mailbox "Sent Messages" { auto = no special_use = \Sent } mailbox Trash { auto = subscribe special_use = \Trash } prefix = separator = / type = private } passdb { args = /etc/dovecot/passwd--%d driver = passwd-file } plugin { listescape_char = } quota = maildir:User quota quota_grace = 45M quota_rule = *:storage=8G quota_rule2 = Trash:storage=+100M quota_status_overquota = 552 5.2.2 User mailbox is full.. quota_status_succes = DUNNO quota_warning = storage=100%% quota-warning 100 %u quota_warning10 = storage=70%% quota-warning 70 %u quota_warning11 = -storage=100%% quota-warning 0 %u quota_warning2 = storage=99%% quota-warning 99 %u quota_warning3 = storage=98%% quota-warning 98 %u quota_warning4 = storage=96%% quota-warning 96 %u quota_warning5 = storage=94%% quota-warning 94 %u quota_warning6 = storage=92%% quota-warning 92 %u quota_warning7 = storage=90%% quota-warning 90 %u quota_warning8 = storage=85%% quota-warning 85 %u quota_warning9 = storage=80%% quota-warning 80 %u sieve = ~/dovecot.sieve sieve_extensions = +notify +imapflags +envelope +vacation +fileinto +date +relational +vacation-seconds sieve_user_log = /dev/null sieve_vacation_min_period = 1h sieve_vacation_send_from_recipient = yes virtual_overquota_bounce = yes zlib_save = gz zlib_save_level = 3 } pop3_fast_size_lookups = yes protocols = imap lmtp pop3 service auth-worker { user = $default_internal_user } service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0660 user = postfix } } service imap-hibernate { unix_listener imap-hibernate { group = $default_internal_group mode = 0660 } } service imap-login { inet_listener imap { port = 0 } inet_listener imaps { address = 100.100.100.104 port = 993 ssl = yes } process_min_avail = 20 service_count = 0 } service imap { extra_groups = $default_internal_group process_limit = 5000 unix_listener imap-master { user = $default_internal_user } } service lmtp { unix_listener /var/spool/postfix/private/dovecot-lmtp { group = postfix mode = 0600 user = postfix } } service pop3-login { inet_listener pop3 { port = 0 } inet_listener pop3s { address = 100.100.100.99 port = 995 ssl = yes } process_min_avail = 10 service_count = 0 } service pop3 { process_limit = 1000 } service quota-warning { executable = script /etc/dovecot/quota-warning.sh unix_listener quota-warning { user = vmail } user = vmail } service submission-login { inet_listener submission { address = 127.0.0.1 port = 587 ssl = yes } process_min_avail = 5 service_count = 1 } service submission { process_limit = 150 } ssl = required ssl_cert = </etc/ssl/private/somedomain.org.crta ssl_cipher_list = ALL:!SSLv2:!SSLv3:!DH:!kRSA:!SRP:!kDHd:!DSS:!aNULL:!eNULL:!EXPORT:!DES:!3DES:!MD5:!PSK:!RC4:!ADH:!LOW@STRENGTH:!EXP:!SEED:!IDEA:!RSA:!CAMELLIA:!SHA1:!SHA256:!SHA384 ssl_client_ca_dir = /etc/ssl/certs ssl_dh = # hidden, use -P to show it ssl_key = # hidden, use -P to show it ssl_min_protocol = TLSv1.2 ssl_prefer_server_ciphers = yes submission_host = 127.0.0.1 syslog_facility = local2 userdb { args = /etc/dovecot/passwd--%d driver = passwd-file result_failure = return-fail result_internalfail = return-fail } valid_chroot_dirs = /var/spool/vmail verbose_proctitle = yes protocol lmtp { mail_fsync = optimized mail_plugins = quota zlib listescape quota sieve zlib postmaster_address = postmaster(a)somedomain.org } protocol lda { mail_fsync = optimized } protocol imap { mail_max_userip_connections = 25 mail_plugins = quota zlib listescape imap_quota zlib } protocol pop3 { mail_max_userip_connections = 6 }

2 1

doveadm backup Error: Mailbox INBOX sync
by Pierre Sablé 13 Jul '21

13 Jul '21

Hi, the command "doveadm backup -u {user@mail} maildir:/home/backup/{user@mail}/mails/" returns the following error : dsync(user@mail): Error: Mailbox INBOX sync: mailbox_delete failed: INBOX can't be deleted. ...and nothing in dovecot logs dovecot actual version 2.3.15 I did not have this pb in dovecot 2.3.2 /Should this be considered a bug report?/ -- Pierre Sablé Formateur & Administrateur Systèmes Linux - DevOps Tel : 07.63.88.76.21 psable(a)dawan.fr www.dawan.fr

1 0

[ENHANCEMENT] Doveadm HTTP API and the mail-crypt plugin
by Kevin N. 13 Jul '21

13 Jul '21

Hello everybody, I was wondering, are there any plans for the near future to include the mail-crypt plugin related functions, like changing the user key password, into the doveadm http api? It would probably be possible to implement it in a more secure way than any other external ad-hoc solution. Wouldn't it? Cheers, K.

2 2

getting rid of the passwd file unknown user messages
by Marc 12 Jul '21

12 Jul '21

I have configured a userdb file, so I can test with some accounts and override settings. But it is a bit annoying getting unkown user messages for the majority of accounts not in this userdb. Is there a way to skip this reporting? dovecot: auth: passwd-file(aaaaaaaaaaaa,X.X.X.X,<lGapvOzGS5tNPz8/>): unknown user

2 3

Mailbox lost
by Stephane Magnier 12 Jul '21

12 Jul '21

Hi, Any idea why * * *list "" * *-> displays all I want to see but *lsub "" ** -> doesn't display anything ? and AFAIK, this is what I need to get in order any Email clients see my folders ? - Correct ? how can I make visible, by "lsub" all my folders ? Thanks and regards,

4 4

doveadm altmove -r still broken in 2.3.15
by María Arrea 12 Jul '21

12 Jul '21

2 1

High Availability Dovecot / Roundcube / PostfixAdmin ?
by White, Daniel E. (GSFC-770.0)[NICS] 12 Jul '21

12 Jul '21

This is a new setup, running on RHEL 8 with the latest everything. Has anyone out there set up a high availability pair of Dovecot servers - with Roundcube and PostfixAdmin - successfully ? "Callahan's Law: Shared pain is lessened; shared joy, increased — thus do we refute entropy" (Spider Robinson)

4 3

Sieve vacation + SRS + forwarded e-mail
by Saarts, Erik 10 Jul '21

10 Jul '21

Hello! Having a problem here and am unable to solve it on my own and even dr Google is unable to help. We have domain A on cloud, from where mail gets forwarded to our local server to domain B. Forwarding is done in SPF-compliant way by using SRS (this part we have no control over). This SRS address ends up in Return-Path header, and sieve vacation replies to this address. This is all absolutely correct, but also useless, as sending mail to SRS address leads nowhere. I've tried to edit headers in sieve before passing control to vacation, but that does not work. I tried modifying Return-Path to the value of X-Original-Sender (both in user's sieve file and using scripts in "sieve_before" parameter). Mail gets delivered with changed headers, but vacation acts upon original headers. Is there a workaround? MTA is postfix (3.1.15), dovecot is version 2.3.4.1 (f79e8e7e4), Pigeonhole version 0.5.4 LMTP as local delivery agent. Erik

2 1

Nabble
by Plutocrat 10 Jul '21

10 Jul '21

Not sure if this is an issue, but Nabble seems to have stopped archiving this newsgroup around 22 Jun. http://dovecot.2317879.n4.nabble.com/ Thought I should probably tell someone P.

1 0

Dovecot silently discards duplicates?
by dovecot＠ptld.com 09 Jul '21

09 Jul '21

I setup an alias(a)example.com in postfix to point at me(a)example.com I send one email to me(a)example.com and alias(a)example.com, tried both ways of using CC and putting both addresses in the To field. I see in postfix logs that it delivers two messages to dovecot-lmtp. However i only get one copy of the email in my inbox. I assume dovecot is detecting duplicate emails going to the same location and just discarding one of them. Is there a setting to control this behavior? Can dovecot be told to deliver what it was given and not decide to discard?

1 0

dsync replication fails with No space left on device / Out of memory
by Steven Varco 08 Jul '21

08 Jul '21

Hi All Since I configured dsync replication I get strange errors in the maillog on my two mail dovecot nodes: PRIMARY: Jul 2 01:21:42 mx01.example.com dovecot: doveadm: Error: read(mx02.example.com) failed: read(size=3148) failed: Connection reset by peer (last sent=mail, last recv=mail (EOL)) The secondary is more interesting: SECONDARY Jul 2 01:21:42 mx02 dovecot: doveadm: Error: close(-1[istream-seekable.c:237]) failed: No space left on device Jul 2 01:21:43 mx02 dovecot: doveadm: Fatal: pool_system_realloc(268435456): Out of memory Jul 2 01:21:43 mx02 dovecot: doveadm: Error: Raw backtrace: /usr/lib64/dovecot/libdovecot.so.0(+0xa192e) [0x7f2e9be4c92e] -> /usr/lib64/dovecot/libdovecot.so.0(+0xa1a0e) [0x7f2e9be4ca0e] -> /usr/lib64/dovecot/libdovecot.so.0(i_error+0) [0x7f2e9bddc3d3] -> /usr/lib64/dovecot/libdo Jul 2 01:21:43 mx02 dovecot: doveadm: Fatal: master: service(doveadm): child 2876 returned error 83 (Out of memory (service doveadm { vsz_limit=256 MB }, you may need to increase it) - set CORE_OUTOFMEM=1 environment to get core dump) Jul 2 01:21:51 mx02 dovecot: dsync-local(user(a)example.com): Error: Raw backtrace: /usr/lib64/dovecot/libdovecot.so.0(+0xa192e) [0x7fd56e17e92e] -> /usr/lib64/dovecot/libdovecot.so.0(+0xa1a0e) [0x7fd56e17ea0e] -> /usr/lib64/dovecot/libdovecot.so.0(i_error+0) [0x7fd56e10e3d3] -> /us Jul 2 01:21:51 mx02 dovecot: dsync-local(user(a)example.com): Fatal: master: service(doveadm): child 2882 returned error 83 (Out of memory (service doveadm { vsz_limit=256 MB }, you may need to increase it) - set CORE_OUTOFMEM=1 environment to get core dump) The error messages state that disk space and/or memory is a problem, but disk space and memory is enough available: mx02 [~] # df -h /srv/mail/ Filesystem Size Used Avail Use% Mounted on /dev/mapper/system-mail 10G 5.7G 4.3G 58% /srv/mail mx02 [~] # free -m total used free shared buff/cache available Mem: 3789 1602 1088 199 1097 1759 Swap: 471 93 378 I also tried to increase vsz_limit from 256 MB to 512 MB, which did not help. And for the sake of completness also the connection to the doveadm port works well from both nodes: mx01-prod [~] # telnet mx02 14310 Trying 172.20.19.225... Connected to mx02. Escape character is '^]'. ^] mx02 [~] # telnet mx01 14310 Trying 172.20.19.251... Connected to mx01. Escape character is '^]'. ^] Although mail replication seems to be working properly and mails are in sync on both nodes (as what I could see), I would like to find the cause of this messages, as this does definetely don’t look normal… I’m grateful for any help, since I’m quite on a struggle now… Steven Here’s my config -------------------------------------------------------------------------------- # doveconf -n # 2.2.36 (1f10bfa63): /etc/dovecot/dovecot.conf # Pigeonhole version 0.4.24 (124e06aa) # OS: Linux 3.10.0-1160.31.1.el7.x86_64 x86_64 CentOS Linux release 7.9.2009 (Core) # Hostname: mx01.example.com auth_mechanisms = plain login auth_verbose = yes dict { sqlquota = mysql:/etc/dovecot/dict-sqlquota.conf.ext } doveadm_password = # hidden, use -P to show it doveadm_port = 14310 first_valid_uid = 1000 mail_plugins = quota notify replication managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext mbox_write_locks = fcntl namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = separator = / type = private } passdb { args = /etc/dovecot/dovecot-sql.conf.ext driver = sql } plugin { mail_replica = tcp:mx02.example.com quota = maildir:User quota quota_exceeded_message = Quota exceeded, please go to http://www.example.com/over_quota_help for instructions on how to fix this. quota_rule2 = INBOX.Trash:storage=+100M quota_status_nouser = DUNNO quota_status_overquota = 552 5.2.2 Mailbox is full / Mailbox ist voll quota_status_success = DUNNO quota_warning = storage=90%% quota-warning 90 %u quota_warning2 = -storage=90%% quota-warning below %u sieve = file:~/sieve;active=~/.dovecot.sieve } postmaster_address = postmaster(a)example.com protocols = imap pop3 lmtp sieve replication_dsync_parameters = -d -l 30 -U service aggregator { fifo_listener replication-notify-fifo { user = vmail } unix_listener replication-notify { user = vmail } } service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0660 user = postfix } unix_listener auth-userdb { user = vmail } } service dict { unix_listener dict { user = vmail } } service doveadm { inet_listener { port = 14310 ssl = no } } service managesieve-login { inet_listener sieve { port = 4190 } } service quota-status { client_limit = 1 executable = quota-status -p postfix inet_listener { port = 14340 } } service quota-warning { executable = script /usr/local/libexec/dovecot/quota-warning.sh unix_listener quota-warning { user = vmail } user = vmail } service replicator { process_min_avail = 1 unix_listener replicator-doveadm { mode = 0600 user = vmail } } ssl = required ssl_cert = </etc/ssl/acme/certs/mail.example.com.chain.crt ssl_key = # hidden, use -P to show it userdb { args = /etc/dovecot/dovecot-sql.conf.ext driver = sql } verbose_proctitle = yes protocol lmtp { mail_plugins = quota notify replication sieve } protocol lda { mail_plugins = quota notify replication sieve } protocol imap { mail_max_userip_connections = 20 mail_plugins = quota notify replication imap_quota } -------------------------------------------------------------------------------- mx02.example.com has exact the same config, except of: -------------------------------------------------------------------------------- plugin { mail_replica = tcp:mx01.example.com -------------------------------------------------------------------------------- — https://steven.varco.ch/ https://www.tech-island.com/

5 6

Deleting an active sieve script leaves sieve unfunctional
by Tobias Leupold 07 Jul '21

07 Jul '21

Dear devs, I noticed this using Dovecot 2.3.7.2, set up on a newly created Ubuntu 20.04 server. If I delete a sieve script via KMail's managesieve interface, and the script is active, it leaves sieve unfunctional afterwards. What's happening is this: Dovecot creates a USER.sieve script containing all active scripts, e. g.: require ["include"]; include :personal "some-script"; include :personal "some-other-script"; Now if I delete "some-script", it's actually deleted, but USER.sieve is not updated (and still contains 'include :personal "some-script";'). So next time an email is filtered, this happens: mail log: Jul 5 15:20:01 server dovecot: lda(user@domain)<123456> <xxxxxxxxxxxxxxxxxxxxxx>: sieve: Failed to compile script `/srv/sieve/user(a)domain/active-script.sieve' (view user logfile `/srv/sieve/user(a)domain/active-script.sieve.log' for more information) active-script.sieve.log: sieve: info: started log at Jul 05 14:57:54. USER: line 12: error: included personal script 'some_script' does not exist. USER: error: validation failed. So, to avoid this, one has to FIRST deactivate the respectice script, so that USER.sieve is updated and THEN delete the script. Or to manually fix USER.sieve on the server, which is surely not what's intended. So the question is now: Is this a KMail bug, a Doveceot bug, or is the server misconfigured?! Thanks for all help! Cheers, Tobias

6 13

Postfix / Dovecot Not Able to Authenticate
by techlists＠phpcoderusa.com 06 Jul '21

06 Jul '21

Hi My name is Keith Smith. I am a PHP developer and have been a freelance PHP developer since 2006. I have been working on a PHP web server in the hope of learning more about Linux hosting server administration. Over the years I have had the opportunity to create many PHP virtual hosts. I have not worked with or configured BIND, Postfix, and Dovecot before about 3 weeks ago. My home server is connected to the Internet via my home office business cable account. No blocked ports and I am able run one or more servers. I am running Ubuntu 20.04lts / Apache / MySql (or a clone) / PHP / BIND9 / Postfix / Dovecot / Let's Encrypt SSL. My server’s FQDN is : soho.keiththewebguy.com as is my reverse lookup on my IP : 98.191.108.149. The purpose is for learning. I intend to run one such configured server out of my home office running one domain or more (virtual hosts) and would like to configure Postfix/Dovecot to service one or more email addresses per virtual hosting. I have BIND working. At least enough that a simple web page can be displayed. I've installed Postfix and Dovecot and am getting an authentication issue that shows up in the logs. I do not know all that you might need. Please let me know. I admit I find Postfix and Dovecot difficult to understand. I am at the newbie stage. I've scoured the Internet looking for answers. After I configured Postfix and Dovecot I issued the commend : telnet keiththewebguy.com 25 on my web server. It returned: Trying 98.191.108.149... Connected to keiththewebguy.com. Escape character is '^]'. 220 soho.keiththewebguy.com ESMTP Postfix I issued : ehlo soho.keiththewebguy.com 250-soho.keiththewebguy.com 250-PIPELINING 250-SIZE 10240000 250-VRFY 250-ETRN 250-STARTTLS 250-AUTH PLAIN LOGIN 250-ENHANCEDSTATUSCODES 250-8BITMIME 250-DSN 250 CHUNKING I issued : quit 221 2.0.0 Bye Connection closed by foreign host. --- I assume this means things are configured correctly. I am looking at both logs: 1) /var/log/mail.err which contains no content. 2) /var/log/mail.log which is verbose. To /etc/dovecot/dovecot.conf I added the following for debugging: auth_verbose = yes auth_verbose_passwords = no auth_debug = yes auth_debug_passwords = yes mail_debug = yes verbose_ssl = yes I am trying to connect using Thunderbird. Config: IMAP port 993 / ssl/TLS / Normal Password / username : keith(a)keiththewebguy.com and password that is in /etc/dovecot/dovecot-users SMTP port 25 / STARTTLS / Normal Password / username : keith(a)keiththewebguy.com and password that is in /etc/dovecot/dovecot-users Thunderbird tests these configurations and reports them as found on the server. When I press the done button to create the email account I get a message "Unable to log into the server. Probably wrong configuration, username, or password.". The output when trying to create the Thunderbird account: /var/log/mail.log =============== Jul 5 18:58:35 soho dovecot: imap-login: Debug: SSL: where=0x10, ret=1: before SSL initialization Jul 5 18:58:35 soho dovecot: imap-login: Debug: SSL: where=0x2001, ret=1: before SSL initialization Jul 5 18:58:35 soho dovecot: imap-login: Debug: SSL: where=0x2002, ret=-1: before SSL initialization Jul 5 18:58:35 soho dovecot: imap-login: Debug: SSL: where=0x2001, ret=1: before SSL initialization Jul 5 18:58:35 soho dovecot: imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3/TLS read client hello Jul 5 18:58:35 soho dovecot: imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3/TLS write server hello Jul 5 18:58:35 soho dovecot: imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3/TLS write certificate Jul 5 18:58:35 soho dovecot: imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3/TLS write key exchange Jul 5 18:58:35 soho dovecot: imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3/TLS write server done Jul 5 18:58:35 soho dovecot: imap-login: Debug: SSL: where=0x2002, ret=-1: SSLv3/TLS write server done Jul 5 18:58:35 soho dovecot: message repeated 2 times: [ imap-login: Debug: SSL: where=0x2002, ret=-1: SSLv3/TLS write server done] Jul 5 18:58:35 soho dovecot: imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3/TLS write server done Jul 5 18:58:35 soho dovecot: imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3/TLS read client key exchange Jul 5 18:58:35 soho dovecot: imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3/TLS read change cipher spec Jul 5 18:58:35 soho dovecot: imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3/TLS read finished Jul 5 18:58:35 soho dovecot: imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3/TLS write session ticket Jul 5 18:58:35 soho dovecot: imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3/TLS write change cipher spec Jul 5 18:58:35 soho dovecot: imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3/TLS write finished Jul 5 18:58:35 soho dovecot: imap-login: Debug: SSL: where=0x20, ret=1: SSL negotiation finished successfully Jul 5 18:58:35 soho dovecot: imap-login: Debug: SSL: where=0x2002, ret=1: SSL negotiation finished successfully Jul 5 18:58:35 soho dovecot: auth: Debug: Loading modules from directory: /usr/lib/dovecot/modules/auth Jul 5 18:58:35 soho dovecot: auth: Debug: Module loaded: /usr/lib/dovecot/modules/auth/lib20_auth_var_expand_crypt.so Jul 5 18:58:35 soho dovecot: auth: Debug: Read auth token secret from /var/run/dovecot/auth-token-secret.dat Jul 5 18:58:35 soho dovecot: auth: Debug: passwd-file /etc/dovecot/dovecot-users: Read 1 users in 0 secs Jul 5 18:58:35 soho dovecot: auth: Debug: auth client connected (pid=2021) Jul 5 18:58:35 soho dovecot: auth: Debug: client in: AUTH#0111#011PLAIN#011service=imap#011secured=tls#011session=wVJ55GTGvspiv2yV#011lip=192.168.1.10#011rip=98.191.108.149#011lport=993#011rport=51902#011local_name=mail.keiththewebguy.com#011ssl_cipher=ECDHE-RSA-AES128-GCM-SHA256#011ssl_cipher_bits=128#011ssl_pfs=KxECDHE#011ssl_protocol=TLSv1.2 Jul 5 18:58:35 soho dovecot: auth: Debug: client passdb out: CONT#0111#011 Jul 5 18:58:35 soho dovecot: auth: Debug: client in: CONT#0111#011AGtlaXRoQGtlaXRodGhld2ViZ3V5LmNvbQBJY2VjcmVhbS1Db25lXjIx (previous base64 data may contain sensitive data) Jul 5 18:58:35 soho dovecot: auth: Debug: passwd-file(keith(a)keiththewebguy.com,98.191.108.149,<wVJ55GTGvspiv2yV>): Performing passdb lookup Jul 5 18:58:35 soho dovecot: auth: Debug: passwd-file(keith(a)keiththewebguy.com,98.191.108.149,<wVJ55GTGvspiv2yV>): lookup: user=keith(a)keiththewebguy.com file=/etc/dovecot/dovecot-users Jul 5 18:58:35 soho dovecot: auth: passwd-file(keith(a)keiththewebguy.com,98.191.108.149,<wVJ55GTGvspiv2yV>): unknown user Jul 5 18:58:35 soho dovecot: auth: Debug: passwd-file(keith(a)keiththewebguy.com,98.191.108.149,<wVJ55GTGvspiv2yV>): Finished passdb lookup Jul 5 18:58:35 soho dovecot: auth: Debug: auth(keith(a)keiththewebguy.com,98.191.108.149,<wVJ55GTGvspiv2yV>): Auth request finished Jul 5 18:58:37 soho dovecot: auth: Debug: client passdb out: FAIL#0111#011user=keith(a)keiththewebguy.com Jul 5 18:58:37 soho dovecot: auth: Debug: client in: AUTH#0112#011LOGIN#011service=imap#011secured=tls#011session=wVJ55GTGvspiv2yV#011lip=192.168.1.10#011rip=98.191.108.149#011lport=993#011rport=51902#011local_name=mail.keiththewebguy.com#011ssl_cipher=ECDHE-RSA-AES128-GCM-SHA256#011ssl_cipher_bits=128#011ssl_pfs=KxECDHE#011ssl_protocol=TLSv1.2 Jul 5 18:58:41 soho dovecot: auth: Debug: client passdb out: CONT#0112#011VXNlcm5hbWU6 Jul 5 18:58:41 soho dovecot: auth: Debug: client in: CONT#0112#011a2VpdGhAa2VpdGh0aGV3ZWJndXkuY29t (previous base64 data may contain sensitive data) Jul 5 18:58:41 soho dovecot: auth: Debug: client passdb out: CONT#0112#011UGFzc3dvcmQ6 Jul 5 18:58:41 soho dovecot: auth: Debug: client in: CONT#0112#011SWNlY3JlYW0tQ29uZV4yMQ== (previous base64 data may contain sensitive data) Jul 5 18:58:41 soho dovecot: auth: Debug: passwd-file(keith(a)keiththewebguy.com,98.191.108.149,<wVJ55GTGvspiv2yV>): Performing passdb lookup Jul 5 18:58:41 soho dovecot: auth: Debug: passwd-file(keith(a)keiththewebguy.com,98.191.108.149,<wVJ55GTGvspiv2yV>): lookup: user=keith(a)keiththewebguy.com file=/etc/dovecot/dovecot-users Jul 5 18:58:41 soho dovecot: auth: passwd-file(keith(a)keiththewebguy.com,98.191.108.149,<wVJ55GTGvspiv2yV>): unknown user Jul 5 18:58:41 soho dovecot: auth: Debug: passwd-file(keith(a)keiththewebguy.com,98.191.108.149,<wVJ55GTGvspiv2yV>): Finished passdb lookup Jul 5 18:58:41 soho dovecot: auth: Debug: auth(keith(a)keiththewebguy.com,98.191.108.149,<wVJ55GTGvspiv2yV>): Auth request finished Jul 5 18:58:43 soho dovecot: auth: Debug: client passdb out: FAIL#0112#011user=keith(a)keiththewebguy.com Jul 5 18:58:43 soho dovecot: auth: Debug: client in: AUTH#0113#011PLAIN#011service=imap#011secured=tls#011session=wVJ55GTGvspiv2yV#011lip=192.168.1.10#011rip=98.191.108.149#011lport=993#011rport=51902#011local_name=mail.keiththewebguy.com#011ssl_cipher=ECDHE-RSA-AES128-GCM-SHA256#011ssl_cipher_bits=128#011ssl_pfs=KxECDHE#011ssl_protocol=TLSv1.2#011resp=AGtlaXRoQGtlaXRodGhld2ViZ3V5LmNvbQBJY2VjcmVhbS1Db25lXjIx (previous base64 data may contain sensitive data) Jul 5 18:58:47 soho dovecot: auth: Debug: passwd-file(keith(a)keiththewebguy.com,98.191.108.149,<wVJ55GTGvspiv2yV>): Performing passdb lookup Jul 5 18:58:47 soho dovecot: auth: Debug: passwd-file(keith(a)keiththewebguy.com,98.191.108.149,<wVJ55GTGvspiv2yV>): lookup: user=keith(a)keiththewebguy.com file=/etc/dovecot/dovecot-users Jul 5 18:58:47 soho dovecot: auth: passwd-file(keith(a)keiththewebguy.com,98.191.108.149,<wVJ55GTGvspiv2yV>): unknown user Jul 5 18:58:47 soho dovecot: auth: Debug: passwd-file(keith(a)keiththewebguy.com,98.191.108.149,<wVJ55GTGvspiv2yV>): Finished passdb lookup Jul 5 18:58:47 soho dovecot: auth: Debug: auth(keith(a)keiththewebguy.com,98.191.108.149,<wVJ55GTGvspiv2yV>): Auth request finished Jul 5 18:58:49 soho dovecot: auth: Debug: client passdb out: FAIL#0113#011user=keith(a)keiththewebguy.com Jul 5 18:58:49 soho dovecot: imap-login: Debug: SSL alert: close notify Jul 5 18:58:49 soho dovecot: imap-login: Disconnected (auth failed, 3 attempts in 14 secs): user=<keith(a)keiththewebguy.com>, method=PLAIN, rip=98.191.108.149, lip=192.168.1.10, TLS, session=<wVJ55GTGvspiv2yV> Jul 5 18:58:49 soho dovecot: imap-login: Debug: SSL alert: close notify ================== I see the following lines: passwd-file /etc/dovecot/dovecot-users: Read 1 users in 0 secs passwd-file(keith(a)keiththewebguy.com,98.191.108.149,<wVJ55GTGvspiv2yV>): Performing passdb lookup passwd-file(keith(a)keiththewebguy.com,98.191.108.149,<wVJ55GTGvspiv2yV>): lookup: user=keith(a)keiththewebguy.com file=/etc/dovecot/dovecot-users file(keith(a)keiththewebguy.com,98.191.108.149,<wVJ55GTGvspiv2yV>): unknown user passwd-file(keith(a)keiththewebguy.com,98.191.108.149,<wVJ55GTGvspiv2yV>): Finished passdb lookup auth(keith(a)keiththewebguy.com,98.191.108.149,<wVJ55GTGvspiv2yV>): Auth request finished client passdb out: FAIL#0111#011user=keith(a)keiththewebguy.com - - - - dovecot -n : # 2.3.7.2 (3c910f64b): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.7.2 () # OS: Linux 5.4.0-77-generic x86_64 Ubuntu 20.04.2 LTS ext4 # Hostname: soho.keiththewebguy.com auth_debug = yes auth_debug_passwords = yes auth_mechanisms = plain login auth_verbose = yes mail_debug = yes mail_location = maildir:/var/mail/vhosts/%d/%n mail_privileged_group = mail namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } passdb { args = scheme=PLAIN username_format=%u /etc/dovecot/dovecot-users driver = passwd-file } protocols = " imap lmtp pop3" service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0666 user = postfix } } service imap-login { inet_listener imaps { port = 993 ssl = yes } } service lmtp { unix_listener /var/spool/postfix/private/dovecot-lmtp { group = postfix mode = 0600 user = postfix } } ssl = required ssl_cert = </etc/letsencrypt/live/keiththewebguy.com/fullchain.pem ssl_client_ca_dir = /etc/ssl/certs ssl_dh = # hidden, use -P to show it ssl_key = # hidden, use -P to show it userdb { args = uid=vmail gid=vmail home=/var/mail/vhosts/%d/%n driver = static } verbose_ssl = yes - - - Any thoughts are most welcome!! Thanks in advance!!

2 5

master - master syncronization: *-temp-1-temp-1-temp-2-* recursion
by Heiko Schlittermann 05 Jul '21

05 Jul '21

Hi, I'm using dovecot 2.3.4.1 (f79e8e7e4) (Debian Build) and doing master/master replication. Recently we added a huuge .Archive* folder structure to the items being replicated. And now, suddenly we see new folders with a naming like *-temp-1-temp-1-temp-2-* appearing. This finally lead to infinite recursion until the replicator crashed. I've a theory, but please see below (**) for influence from outside of dovecot: SiteA starts replication of a huge .Archive folder, which doesn't exist on siteB yet A B .Archive ----> .Archive-temp-1 Because it takes ages to sync, the replicator on siteB now sees the new .Archive-temp-1 folder and starts replicating this back to siteA .Archive-temp-1-temp-1 <----- .Archive-temp-1 If now the replicator on siteA hits that new folder, it starts replicating it to site B .Archive-temp-1-temp-1 ----> .Archive-temp-1-temp-1-temp-2 … and so on. Sometimes the digit is "2", or even "3". I didn't check the Dovecot source yet, if the Replicator fails to skip the temporary folders it gets "injected" from the other side. (**) Possible external influence: On siteA a cronjob once per day moves the .Archive* folders to another filesystem and replaces the .Archive* directory with a symlink. This script "touches" the dovecot-uidlist.lock prior to its action (but doesn't check if there is already a lock). Could this mailbox move *behind* the back of the replicator be a reason for the odd behaviour? Additional info: On *both* nodes the config looks like this: doveadm_password = <password> service doveadm { inet_listener { port = 9090 ssl = yes } } replication_max_conns = 16 plugin { mail_replica = tcps:<other site>:9090 } service replicator { process_min_avail = 1 unix_listener replicator-doveadm { mode = 0666 user = dovecot } } service aggregator { fifo_listener replication-notify-fifo { mode = 0666 user = dovecot } unix_listener replication-notify { mode = 0666 user = dovecot } }

1 0

Duplicate users with multiple userdb iteration
by Slavko 05 Jul '21

05 Jul '21

Hi, recently i decided to use quota_over_flag with passwd_file userdb. The main idea is to prevent dovecot (or vmail) user to have write access to file with passwords. To do it, i setup separate userdb as this (SQL userdb is SQLite based, thus the same problem with write): passdb { args = /etc/dovecot/dovecot-sql.conf.ext driver = sql } userdb { args = username_format=%u /etc/dovecot/over_quota default_fields = quota_over_flag=1 driver = passwd-file result_internalfail = continue-fail result_success = continue-fail } userdb { args = /etc/dovecot/dovecot-sql.conf.ext driver = sql } For testing i add one user into over_quota file: slavko(a)slavino.eu::::::: With this setting the doveadm user with user in over_quota seems to work: doveadm user slavko(a)slavino.eu field value uid 20000 gid 20000 home /srv/vmail/slavino.eu/slavko mail maildir:~/Maildir quota_over_flag 1 quota_rule *:storage=0M quota2_rule *:storage=0M But the user iteration shows duplicate users: doveadm user '*' slavko(a)slavino.eu slavko(a)slavino.eu ... As we discussed on IRC, it is how iteration works, as it emit users as soon as it meet it, but this doesn't correspond with "multiple userdb are merged" in docs (for iteration). I am surprised by this mainly because the particular userdb has set result_success to "continue-fail" and thus have to set user not found as with any user, which is not in this db. But it seems, that iteration ignores this result. I wrote this as we discussed via IRC, i am not subscribed, thus please CC me. regards -- Slavko http://slavino.sk

1 0

Re: Re: lost mailbox
by Stephane Magnier 05 Jul '21

05 Jul '21

Hi , Thanks Erwan, Yes I did it.. what worries me is, that that instruction lsub "" * seems not to work.. I mean I am not allowed to see it b lsub "" * b NO [NOPERM] No permission to read subscriptions (0.001 + 0.000 secs). So not sure that this is the fault of Thunderbird :-) Thanks for your help

2 1

Pb with Dovecot and visble folders
by Stephane Magnier 04 Jul '21

04 Jul '21

Hi, I've got a problem with my Dovecot installation.. Up to now, that was working fine.but today [root@mbox admin]# telnet localhost 143 Trying ::1... telnet: connect to address ::1: Connection refused Trying 127.0.0.1... Connected to localhost. Escape character is '^]'. * OK [CAPABILITY IMAP4rev1 SASL-IR LOGIN-REFERRALS ID ENABLE IDLE LITERAL+ STARTTLS AUTH=PLAIN] Dovecot ready. a login azt000 xxxxxx a OK [CAPABILITY IMAP4rev1 SASL-IR LOGIN-REFERRALS ID ENABLE IDLE SORT SORT=DISPLAY THREAD=REFERENCES THREAD=REFS THREAD=ORDEREDSUBJECT MULTIAPPEND URL-PARTIAL CATENATE UNSELECT CHILDREN NAMESPACE UIDPLUS LIST-EXTENDED I18NLEVEL=1 CONDSTORE QRESYNC ESEARCH ESORT SEARCHRES WITHIN CONTEXT=SEARCH LIST-STATUS BINARY MOVE SNIPPET=FUZZY PREVIEW=FUZZY LITERAL+ NOTIFY SPECIAL-USE QUOTA] Logged in b list "" * * LIST (\NoInferiors \UnMarked) "/" ssss * LIST (\NoInferiors \UnMarked) "/" 2021-TEST * LIST (\NoInferiors \UnMarked) "/" 2015 * LIST (\NoInferiors \UnMarked) "/" 2020-IT * LIST (\NoInferiors \UnMarked) "/" 2018-PERSO * LIST (\NoInferiors \UnMarked) "/" 2017 * LIST (\NoInferiors \UnMarked) "/" 2020-MARKETING * LIST (\NoInferiors \UnMarked) "/" 2019-AZT * LIST (\NoInferiors \UnMarked) "/" 2019-ADMIN * LIST (\NoInferiors \UnMarked) "/" "2020- PERSO" * LIST (\NoInferiors \UnMarked) "/" sss * LIST (\NoInferiors \UnMarked) "/" 2019-COMPTA * LIST (\NoInferiors \UnMarked) "/" 2019-PERSO * LIST (\NoInferiors \UnMarked) "/" 2017-ADMIN * LIST (\NoInferiors \UnMarked) "/" 2016 * LIST (\NoInferiors \UnMarked) "/" 2020-compta * LIST (\NoInferiors \Marked \Trash) "/" Trash * LIST (\NoInferiors \UnMarked) "/" Archives * LIST (\NoInferiors \UnMarked \Sent) "/" Sent * LIST (\NoInferiors \Marked \Junk) "/" Junk * LIST (\NoInferiors \UnMarked \Drafts) "/" Drafts * LIST (\NoInferiors \UnMarked \Sent) "/" "Sent Messages" * LIST (\NoInferiors \UnMarked) "/" INBOX/2021-AZT * LIST (\NoInferiors \UnMarked) "/" INBOX/2021-WebMEETING * LIST (\NoInferiors \UnMarked) "/" INBOX/2021-zezez * LIST (\NoInferiors \UnMarked) "/" INBOX/2021-PERSO * LIST (\NoInferiors \UnMarked) "/" INBOX/2021-MARKETING * LIST (\NoInferiors \UnMarked) "/" INBOX/2021-COMPTA * LIST (\NoInferiors \UnMarked) "/" INBOX/2021-ADMIN * LIST (\NoInferiors \UnMarked) "/" INBOX/2021-ATV * LIST (\NoInferiors \UnMarked) "/" INBOX/2021-test * LIST (\HasChildren) "/" INBOX b OK List completed (0.016 + 0.000 + 0.015 secs). *c lsub "" ** c NO [NOPERM] No permission to read subscriptions (0.001 + 0.000 secs). If I understand correctly, lsub should see what is visible by the Email client ? How can I let all the folders visible ? [root@mbox dovecot]# cat dovecot-new.conf # 2.3.8 (9df20d2db): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.8 (b7b03ba2) # OS: Linux 4.18.0-305.3.1.el8.x86_64 x86_64 CentOS Linux release 8.4.2105 nfs4 # Hostname: mbox1.aztgrp.net auth_debug_passwords = yes auth_username_format = %n disable_plaintext_auth = no login_trusted_networks = 177.18.0.0/16 127.0.0.1 ::1 mail_access_groups = mail mail_fsync = always mail_location = mbox:/var/spool2/mail/%u:INBOX=/var/spool/mail/%u:INDEX=/var/indexes/%u:CONTROL=/var/spool/mail-control mail_plugins = " quota" mail_privileged_group = mail managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date ihave mbox_very_dirty_syncs = yes mbox_write_locks = fcntl namespace inbox { inbox = yes location = mailbox Drafts { auto = subscribe special_use = \Drafts } mailbox Junk { auto = subscribe special_use = \Junk } mailbox Sent { auto = subscribe special_use = \Sent } mailbox "Sent Messages" { auto = subscribe special_use = \Sent } mailbox Trash { auto = no special_use = \Trash } mailbox virtual/All { auto = no special_use = \All } prefix = } passdb { driver = pam } plugin { quota_grace = 10%% quota_max_mail_size = 100M quota_rule = *:storage=10000M quota_rule2 = Trash:Storage=+100M quota_status_nouser = DUNNO quota_status_overquota = 552 5.2.2 Mailbox is full quota_status_success = DUNNO quota_warning = storage=95%% quota-warning 95 %u quota_warning2 = storage=80%% quota-warning 80 %u sieve = file:~/sieve;active=~/.dovecot.sieve } pop3_uidl_format = %v-%u service auth { unix_listener auth-master { mode = 0666 } } service dict { unix_listener dict { mode = 0600 user = mail } } service imap-login { inet_listener imap { address = * port = 143 } inet_listener imaps { address = * port = 993 ssl = yes } } service lmtp { inet_listener lmtp { address = ::1, 127.0.0.1 port = 24 } } service pop3-login { inet_listener pop3 { address = * port = 110 } inet_listener pop3s { address = * port = 995 ssl = yes } } service quota-warning { executable = script /usr/local/bin/quota-warning.sh unix_listener quota-warning { user = mail } user = dovecot } ssl = required ssl_ca = </etc/mail/ssl/ssl1/STAR_xxxxp_net.ca-bundle ssl_cert = </etc/mail/ssl/ssl1/STAR_xxxp_net.crt ssl_key = # hidden, use -P to show it userdb { driver = passwd } verbose_proctitle = yes protocol lmtp { mail_plugins = autocreate quota acl fts fts_solr zlib mail_log notify sieve } protocol lda { mail_plugins = " quota sieve quota" } protocol imap { mail_max_userip_connections = 80 mail_plugins = " quota quota imap_quota" ssl_cert = </etc/mail/ssl/ssl1/STAR_xxxp_net.crt ssl_key = # hidden, use -P to show it } protocol pop3 { mail_max_userip_connections = 10 mail_plugins = " quota" } protocol submission { mail_max_userip_connections = 10 mail_plugins = " quota" } My dovecot config Thanks and regards,

1 0

Bypass Trash Folder Sometimes.
by dovecot＠ptld.com 04 Jul '21

04 Jul '21

Is there a way, or a config setting, that would allow you to for-reals delete an email from the inbox instead of sending it to the Trash folder? Not always, the default behavior should still send deleted emails to the trash folder, but on a per case bases be able to just delete an email without it going to the trash folder. Same like how the windows desktop works. If you Delete a file on your desktop it goes to the recycle bin. However if you do Shift + Delete the file gets deleted without going to the recycle bin.

3 3

How to use xapian with non-text attachments
by André Rodier 03 Jul '21

03 Jul '21

Hello, I am developing a hosting platform on Debian Bullseye, with Dovecot amongst other tools. I am trying to use the xapian full test search plugin, but I can see the attachments are skipped: This is what I have in the logs when running the indexing in verbose mode: ----------------------------------------------------------------------- doveadm(camille): Info: FTS Xapian: fts_backend_xapian_check_access doveadm(camille): Info: FTS Xapian: Memory stats : Used = 56 MB, Free = 66 MB doveadm(camille): Info: FTS Xapian: fts_backend_xapian_index_hdr doveadm(camille): Info: FTS Xapian: fts_backend_xapian_query doveadm(camille): Info: FTS Xapian: Query= uid:"44" doveadm(camille): Info: FTS Xapian: Ngram(S) -> 63 items (total 0 KB) doveadm(camille): Info: FTS Xapian: fts_backend_xapian_update_unset_build_key doveadm(camille): Info: FTS Xapian: fts_backend_xapian_update_set_build_key doveadm(camille): Info: FTS Xapian: New part (Header=Message- Id,Type=(null),Disposition=(null)) doveadm(camille): Info: FTS Xapian: fts_backend_xapian_update_build_more doveadm(camille): Info: FTS Xapian: fts_backend_xapian_check_access doveadm(camille): Info: FTS Xapian: Memory stats : Used = 56 MB, Free = 66 MB doveadm(camille): Info: FTS Xapian: fts_backend_xapian_index_hdr doveadm(camille): Info: FTS Xapian: fts_backend_xapian_query doveadm(camille): Info: FTS Xapian: Query= uid:"44" doveadm(camille): Info: FTS Xapian: Ngram(XMID) -> 4 items (total 0 KB) doveadm(camille): Info: FTS Xapian: fts_backend_xapian_update_unset_build_key doveadm(camille): Info: FTS Xapian: fts_backend_xapian_update_set_build_key doveadm(camille): Info: FTS Xapian: New part (Header=X- Mailer,Type=(null),Disposition=(null)) doveadm(camille): Info: FTS Xapian: Unknown header (indexing) 'xmailer' doveadm(camille): Info: FTS Xapian: fts_backend_xapian_update_set_build_key doveadm(camille): Info: FTS Xapian: New part (Header=MIME- Version,Type=(null),Disposition=(null)) doveadm(camille): Info: FTS Xapian: Unknown header (indexing) 'mimeversion' doveadm(camille): Info: FTS Xapian: fts_backend_xapian_update_set_build_key doveadm(camille): Info: FTS Xapian: New part (Header=Content- Type,Type=(null),Disposition=(null)) doveadm(camille): Info: FTS Xapian: Unknown header (indexing) 'contenttype' doveadm(camille): Info: FTS Xapian: fts_backend_xapian_update_set_build_key doveadm(camille): Info: FTS Xapian: New part (Header=Authentication- Results,Type=(null),Disposition=(null)) doveadm(camille): Info: FTS Xapian: Unknown header (indexing) 'authenticationresults' doveadm(camille): Info: FTS Xapian: fts_backend_xapian_update_set_build_key doveadm(camille): Info: FTS Xapian: New part (Header=X-AV- Checked,Type=(null),Disposition=(null)) doveadm(camille): Info: FTS Xapian: Unknown header (indexing) 'xavchecked' doveadm(camille): Info: FTS Xapian: fts_backend_xapian_update_set_build_key doveadm(camille): Info: FTS Xapian: New part (Header=Content- Type,Type=(null),Disposition=(null)) doveadm(camille): Info: FTS Xapian: Unknown header (indexing) 'contenttype' doveadm(camille): Info: FTS Xapian: fts_backend_xapian_update_set_build_key doveadm(camille): Info: FTS Xapian: New part (Header=(null),Type=text/plain,Disposition=(null)) doveadm(camille): Info: FTS Xapian: fts_backend_xapian_update_build_more doveadm(camille): Info: FTS Xapian: fts_backend_xapian_update_unset_build_key doveadm(camille): Info: FTS Xapian: fts_backend_xapian_update_set_build_key doveadm(camille): Info: FTS Xapian: New part (Header=Content- Type,Type=(null),Disposition=(null)) doveadm(camille): Info: FTS Xapian: Unknown header (indexing) 'contenttype' doveadm(camille): Info: FTS Xapian: fts_backend_xapian_update_set_build_key doveadm(camille): Info: FTS Xapian: New part (Header=Content- Description,Type=(null),Disposition=(null)) doveadm(camille): Info: FTS Xapian: Unknown header (indexing) 'contentdescription' doveadm(camille): Info: FTS Xapian: fts_backend_xapian_update_set_build_key doveadm(camille): Info: FTS Xapian: New part (Header=Content- Disposition,Type=(null),Disposition=(null)) doveadm(camille): Info: FTS Xapian: Unknown header (indexing) 'contentdisposition' doveadm(camille): Info: FTS Xapian: fts_backend_xapian_update_set_build_key doveadm(camille): Info: FTS Xapian: New part (Header=Content-Transfer- Encoding,Type=(null),Disposition=(null)) doveadm(camille): Info: FTS Xapian: Unknown header (indexing) 'contenttransferencoding' doveadm(camille): Info: FTS Xapian: fts_backend_xapian_update_set_build_key doveadm(camille): Info: FTS Xapian: New part (Header=(null),Type=text/csv,Disposition=attachment; filename="file.csv") doveadm(camille): Info: FTS Xapian: Skipping part of type 'text/csv' and disposition 'attachment; filename="file.csv"' doveadm(camille): Info: FTS Xapian: fts_backend_xapian_update_set_mailbox doveadm(camille): Info: FTS Xapian: Unset box 'INBOX' (c0d4e304584e5460dae30000075d7e67) doveadm(camille): Info: FTS Xapian: fts_backend_xapian_oldbox doveadm(camille): Info: FTS Xapian: Done indexing 'INBOX' (c0d4e304584e5460dae30000075d7e67) (13 msgs in 261 ms, rate: 49.8) doveadm(camille): Info: FTS Xapian: fts_backend_xapian_release (unset_box) doveadm(camille): Info: FTS Xapian: Committed 'unset_box' in 17 ms doveadm(camille): Info: FTS Xapian: Box is empty doveadm(camille): Info: FTS Xapian: fts_backend_xapian_update_deinit (/home/users/camille/mails/indexes/xapian-indexes) doveadm(camille): Info: FTS Xapian: fts_backend_xapian_release (update_deinit) doveadm(camille): Info: FTS Xapian: Committed 'update_deinit' in 0 ms doveadm(camille): Info: FTS Xapian: Deinit /home/users/camille/mails/indexes/xapian-indexes) ----------------------------------------------------------------------- Especially thos line: doveadm(camille): Info: FTS Xapian: Skipping part of type 'text/csv' and disposition 'attachment; filename="file.csv"' I have seen this as a bug on fts-xapian: https://github.com/grosjo/fts-xapian/issues/68 Which then references a PR on Dovecot core itself: https://github.com/dovecot/core/pull/155 Any idea on how to use xapian with non-text attachments ? Thanks a lot for your help! André

2 2

sieve match with contain asterisk
by Hardy Flor 03 Jul '21

03 Jul '21

Hello, I want to find a keyword in the subject between two "*". How do I have to mask the "*" correctly? I tried: if header :matches "subject" "\*xyz\**" if header :matches "subject" "\\*xyz\\**" Hardy

2 3

lost mailbox
by Stephane Magnier 02 Jul '21

02 Jul '21

Hi, I used dovect with the following setup : mbox:/var/spool2/mail/%u:INBOX=/var/spool/mail/%u If I have a look via cmd line [root@mbxx1 ~]# telnet localhost 143 Trying ::1... telnet: connect to address ::1: Connection refused Trying 127.0.0.1... Connected to localhost. Escape character is '^]'. * OK [CAPABILITY IMAP4rev1 SASL-IR LOGIN-REFERRALS ID ENABLE IDLE LITERAL+ STARTTLS AUTH=PLAIN] Dovecot ready. a login azt000 lassiemag76 a OK [CAPABILITY IMAP4rev1 SASL-IR LOGIN-REFERRALS ID ENABLE IDLE SORT SORT=DISPLAY THREAD=REFERENCES THREAD=REFS THREAD=ORDEREDSUBJECT MULTIAPPEND URL-PARTIAL CATENATE UNSELECT CHILDREN NAMESPACE UIDPLUS LIST-EXTENDED I18NLEVEL=1 CONDSTORE QRESYNC ESEARCH ESORT SEARCHRES WITHIN CONTEXT=SEARCH LIST-STATUS BINARY MOVE SNIPPET=FUZZY PREVIEW=FUZZY LITERAL+ NOTIFY SPECIAL-USE QUOTA] Logged in b list "" ** * LIST (\NoInferiors) "/" 2015 * LIST (\NoInferiors) "/" 2020-IT * LIST (\NoInferiors) "/" 2018-PERSO * LIST (\NoInferiors) "/" 2017 * LIST (\NoInferiors) "/" 2020-MARKETING * LIST (\NoInferiors) "/" 2019-AZT * LIST (\NoInferiors) "/" 2019-ADMIN * LIST (\NoInferiors) "/" "2020- PERSO" * LIST (\NoInferiors) "/" sss * LIST (\NoInferiors) "/" 2019-COMPTA * LIST (\NoInferiors) "/" 2019-PERSO * LIST (\NoInferiors) "/" 2017-ADMIN * LIST (\NoInferiors) "/" 2016 * LIST (\NoInferiors \UnMarked) "/" 2020-compta * LIST (\NoInferiors \UnMarked \Trash) "/" Trash * LIST (\NoInferiors \UnMarked) "/" Archives * LIST (\NoInferiors \Sent) "/" Sent * LIST (\NoInferiors \Marked \Junk) "/" Junk * LIST (\NoInferiors \UnMarked \Drafts) "/" Drafts * LIST (\NoInferiors \UnMarked \Sent) "/" "Sent Messages" * LIST (\NoInferiors) "/" INBOX/2021-AZT * LIST (\NoInferiors) "/" INBOX/2021-WebMEETING * LIST (\NoInferiors) "/" INBOX/2021-zezez * LIST (\NoInferiors) "/" INBOX/2021-PERSO * LIST (\NoInferiors) "/" INBOX/2021-MARKETING * LIST (\NoInferiors \UnMarked) "/" INBOX/2021-COMPTA * LIST (\NoInferiors \UnMarked) "/" INBOX/2021-ADMIN * LIST (\NoInferiors \UnMarked) "/" INBOX/2021-ATV * LIST (\NoInferiors \UnMarked) "/" INBOX/2021-test * LIST (\HasChildren) "/" INBOX b OK List completed (0.009 + 0.000 + 0.008 secs). If I've opened my thunderbird.. I have just the INBOX and nothing else ???????????????????????? and the folder : 2021-ADMIN and 2021-ATV and that's it I've tried to do : /doveadm force-resync -u user1 : /nothing happened Any idea in order to syncrhonized a folder with .... thunderbird ?

2 1

How can I prevent sieve filter from being applied to some mail users?
by yuryb 02 Jul '21

02 Jul '21

We have an emarket(a)example.com mailbox that receives orders from customers. Postfix redirects such emails to the email addresses of our sales managers, as well as to the special address parser(a)example.com, which is used by some analytical software. For this, a file named "Virtual" has been created in the Postfix folder with the following contents:emarket@example.com manager1@example.com,manager2@example.com,manager3@example.com,parser@example.comIn addition, Dovecot places all such emails in the Orders folder of each sales manager. For this, a Sieve filter rule has been created: require ["fileinto", "envelope"]; if envelope: is "to" "emarket(a)example.com" { fileinto "Orders"; stop; } But the problem is that the analytics software that uses the parser(a)example.com mailbox is subscribed only to the default Inbox folder. And it doesn't know how to work with the Orders folder. So I need to somehow prevent the filter from being applied to the parser(a)example.com mailbox. How can I do this using Dovecot or Sieve?

1 0

Bug: empty prefix value in userdb lookup defaults to "yes"?
by Dan Malm 02 Jul '21

02 Jul '21

Hi, I'm trying to migrate some users into our system from another one that also run dovecot but with different prefix and separator settings than we do. I've setup userdb to return these values for a test user to match the other systems separator/prefix setup: { "home": "/customers/b/5/3/cdeadbeef/mail/m0123456789abcdef/", "namespace/inbox/separator": "/", "uid": 10000001, "namespace/inbox/prefix": "", "gid": 10000001 } But the empty value for prefix seems to get converted to some default value of "yes" as when I log in with that user dovecot throws this error: Error: namespace configuration error: list=yes requires prefix=yes to end with separator / Dovecot version: 2.3.13 OS: Ubuntu 20.04.2 -- BR/Mvh. Dan Malm, Systems Engineer, One.com

2 3

SSHA512 Salting in SQL Query
by dovecot＠ptld.com 02 Jul '21

02 Jul '21

I don't understand what im doing wrong. Password = test Salt = salt MariaDB> select to_base64(concat(sha2('testsalt', 512), 'salt')); NmM4MzhlOTM0ZTNmZWVmYWU2Y2ZhNTNhZjExMzc1ZDQ5NTRmODVjNmY1ZWQ4ODhjMDJjZDc4MDZhNzE2OTZkMWNiNDQ5ZjJiZTc4ZTllNmVhMzAxYTk1YzgxZjI4YWQ4NzY2ZjNhZTU4MmY5YmVhYWMzM2M3ZGMyYjdiYTkxODdzYWx0 [root@host /]# doveadm pw -p test -t {SSHA512.b64}NmM4MzhlOTM0ZTNmZWVmYWU2Y2ZhNTNhZjExMzc1ZDQ5NTRmODVjNmY1ZWQ4ODhjMDJjZDc4MDZhNzE2OTZkMWNiNDQ5ZjJiZTc4ZTllNmVhMzAxYTk1YzgxZjI4YWQ4NzY2ZjNhZTU4MmY5YmVhYWMzM2M3ZGMyYjdiYTkxODdzYWx0 Fatal: reverse password verification check failed: Password mismatch Can someone point me in the right direction? Thanks.

2 1

Pigeonhole bug: corrupted redirected emails
by Peter Williams 01 Jul '21

01 Jul '21

Hello, (Please CC me on any replies since I'm not subscribed to this mailing list.) I'm writing to report a bug that I just ran into, involving Sieve/Pigeonhole message redirections. I recently added a rule involving redirections and the redirected messages were getting corrupted. I traced the issue down to the fact that an Mbox-style "From " header line was getting intermixed with the message headers -- note the entry between the two "Received:" headers in this example, which shows the text being delivered to the MTA on stdin: X-Sieve: Pigeonhole Sieve 0.4.24 (124e06aa) X-Sieve-Redirected-From: peter Delivered-To: peter Received: from dovecot by newton.cx with LMTP id xxx for <peter>; Thu, 01 Jul 2021 04:32:50 +0000 From peter(a)newton.cx Thu Jul 01 04:32:50 2021 Received: from xxx by newton.cx with esmtpsa xxx (Exim 4.94.2) (envelope-from <peter(a)newton.cx>) id xxxx for peter(a)newton.cx; Thu, 01 Jul 2021 04:32:50 +0000 Message-ID: <xxx> Subject: qqtestqq This was happening with trivial test messages, and trivial Sieve rules, but I can provide specifics if they would be helpful. Versions: CentOS 7.9.2009; Dovecot 2.2.36; Pigeonhole 0.4.24; Exim 4.92.2. Below I've added the output of `dovecot -n`. My `sendmail_path` setting was empty before, but as a workaround I've set it to a wrapper script that strips out everything before the `From `, "solving" the problem. Thanks so much for building Dovecot, I've been using it with great success for more than a decade! Best, Peter ========================================================= # 2.2.36 (1f10bfa63): /etc/dovecot/dovecot.conf # Pigeonhole version 0.4.24 (124e06aa) # OS: Linux 4.14.210-rh241-20201203010913.xenU.x86_64 x86_64 CentOS Linux release 7.9.2009 (Core) ext3 # Hostname: newton.cx auth_username_format = %Ln mail_location = mdbox:/var/spool/mail/%n mail_plugins = zlib managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded- character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext mbox_write_locks = fcntl namespace inbox { hidden = no inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = separator = . type = private } passdb { driver = pam } plugin { recipient_delimiter = + sieve = ~/.dovecot.sieve sieve_before = /etc/dovecot/dspam.sieve sieve_dir = /var/lib/sieve-users/%u sieve_global_dir = /etc/dovecot/sieve-global zlib_save = gz zlib_save_level = 7 } protocols = imap pop3 lmtp sieve sendmail_path = /usr/sbin/dovecot-sieve-sendmail.sh service imap-login { inet_listener imap { port = 143 } inet_listener imaps { port = 993 ssl = yes } } service managesieve-login { inet_listener sieve { address = 127.0.0.1 port = 4190 } } service pop3-login { inet_listener pop3 { port = 0 } inet_listener pop3s { port = 995 ssl = yes } } ssl_cert = </etc/letsencrypt/live/newton.cx/fullchain.pem ssl_key = # hidden, use -P to show it userdb { driver = passwd } protocol lmtp { mail_plugins = zlib sieve } protocol lda { mail_plugins = zlib sieve } protocol imap { mail_max_userip_connections = 20 } protocol pop3 { pop3_uidl_format = %08Xu%08Xv }

1 0

Dovecot LMTP Process Hung
by Miguel Ângelo Santos Pereira 01 Jul '21

01 Jul '21

Hey there guys, Here's what I found in the logs: Jul 1 08:10:27 tango dovecot: imap-login: Warning: Event 0x564fff5fcb20 leaked (parent=(nil)): client-common.c:217 Jul 1 08:10:27 tango dovecot: master: Warning: Sent SIGTERM to 1 auth processes Jul 1 08:10:27 tango dovecot: master: Warning: Processes aren't dying after reload, sent SIGTERM to 12 processes. Jul 1 08:10:27 tango dovecot: pop3-login: Warning: Event 0x5567deff4a00 leaked (parent=(nil)): client-common.c:217 Jul 1 08:10:27 tango dovecot: pop3-login: Warning: Event 0x5562c9058d40 leaked (parent=(nil)): client-common.c:217 Jul 1 08:10:27 tango dovecot: imap-login: Warning: Event 0x5571f845a200 leaked (parent=(nil)): client-common.c:217 Jul 1 08:10:27 tango dovecot: imap-login: Warning: Event 0x5571f84593d0 leaked (parent=(nil)): client-common.c:217 Jul 1 08:10:27 tango dovecot: imap-login: Warning: Event 0x5571f841bf60 leaked (parent=(nil)): client-common.c:217 Jul 1 08:10:27 tango dovecot: imap-login: Warning: Event 0x5571f83f48d0 leaked (parent=(nil)): client-common.c:217 Jul 1 08:10:27 tango dovecot: imap-login: Warning: Event 0x5571f83f4060 leaked (parent=(nil)): client-common.c:217 Jul 1 08:10:27 tango dovecot: imap-login: Warning: Event 0x564fff5fcb20 leaked (parent=(nil)): client-common.c:217 Jul 1 08:10:27 tango dovecot: imap-login: Warning: Event 0x564fff5e0c50 leaked (parent=(nil)): client-common.c:217 Jul 1 08:10:27 tango dovecot: imap-login: Warning: Event 0x564fff5c1c00 leaked (parent=(nil)): client-common.c:217 Jul 1 08:10:27 tango dovecot: imap-login: Warning: Event 0x564fff59f330 leaked (parent=(nil)): client-common.c:217 Jul 1 08:10:27 tango dovecot: imap-login: Warning: Event 0x564fff4db1f0 leaked (parent=(nil)): client-common.c:217 Jul 1 08:09:59 tango dovecot: master: Warning: Sent SIGTERM to 1 stats processes Jul 1 08:09:59 tango dovecot: master: Warning: Sent SIGTERM to 1 pop3-login processes Jul 1 08:09:59 tango dovecot: master: Warning: Sent SIGTERM to 5 imap processes Jul 1 08:09:59 tango dovecot: master: Warning: Sent SIGTERM to 1 imap-login processes Jul 1 08:09:59 tango dovecot: master: Warning: Sent SIGTERM to 1 config processes Jul 1 08:09:59 tango dovecot: master: Warning: Sent SIGTERM to 1 auth processes Jul 1 08:09:59 tango dovecot: master: Warning: Processes aren't dying after reload, sent SIGTERM to 10 processes. Jul 1 08:09:59 tango dovecot: stats: Warning: Killed with signal 15 (by pid=28266 uid=0 code=kill) Jul 1 08:09:59 tango dovecot: imap: Warning: Killed with signal 15 (by pid=28266 uid=0 code=kill) Jul 1 08:09:59 tango dovecot: imap: Warning: Killed with signal 15 (by pid=28266 uid=0 code=kill) Jul 1 08:09:59 tango dovecot: imap: Warning: Killed with signal 15 (by pid=28266 uid=0 code=kill) Jul 1 08:09:59 tango dovecot: imap: Warning: Killed with signal 15 (by pid=28266 uid=0 code=kill) -- We noticed this as the server wouldn't stop overloading, reaching 150+ load, we had to reboot it. It's not the first time we see this, and kill -9 PID wouldn't do anything to the processes, at all. Any idea guys? We're stuck here. I've tried to increase the RAM allocation for dovecot, hope it helps. -- *Com os meus melhores cumprimentos,* *Best Regards,* *Miguel Ângelo Santos Pereira*

1 1

Dovecot sync broke after upgrade to OpenBSD 6.9
by William Orr 01 Jul '21

01 Jul '21

Hey, I have two mailservers running OpenBSD 6.9, and I use bidirectional syncing of my maildirs through doveadm. After the upgrade, I noticed that the sync process was failing. OpenBSD 6.8 shipped with Dovecot 2.3.13, 6.9 ships with 2.3.14. Here's the output of the dovecot --build-options: kefka|~|03:01:50|89$ dovecot --build-options Build options: ioloop=kqueue notify=kqueue openssl io_block_size=8192 SQL driver plugins: mysql postgresql sqlite Passdb: bsdauth checkpassword ldap passwd passwd-file sql Userdb: checkpassword ldap(plugin) passwd prefetch passwd-file sql I did not compile this manually, this is from packages. More info about configure options passed are available here, in the Makefile from ports https://cvsweb.openbsd.org/cgi-bin/cvsweb/ports/mail/dovecot/Makefile?rev=1… Here's a sample run of the sync: kefka|~|02:57:05|0$ doas doveadm sync -u worr(a)worrbase.com remote:sabin.worrbase.com doveadm(VERSION dsync 3 5): Error: User doesn't exist dsync-local(worr)<FNQIMvI9omB4VwEADTvxNg>: Error: read(sabin.worrbase.com) failed: EOF (version not received) dsync-local(worr)<FNQIMvI9omB4VwEADTvxNg>: Error: Remote command returned error 67: /usr/bin/ssh -i /root/.ssh/id_ed25519.dsync sabin.worrbase.com /usr/local/bin/dsync-in-wrapper.sh kefka|~|02:57:08|75$ cat /usr/local/bin/dsync-in-wrapper.sh #!/bin/ksh read username /usr/local/bin/doveadm dsync-server -u "$username" I ktraced the process, and noticed that in the communication with the remote mail server, that a bunch of doveadm plugins fail to load. It's worth noting that these are plugins that are dlopen(3)ed in response to certain commands sent over the wire, so they don't show up in ldd(1) output. kefka|~|03:00:08|0$ doas kdump | grep symbol "doveadm:/usr/local/lib/dovecot/doveadm/lib10_doveadm_acl_plugin.so: undefined symbol 'acl_user_module' "doveadm:/usr/local/lib/dovecot/doveadm/lib10_doveadm_acl_plugin.so: undefined symbol 'acl_mailbox_get_aclobj' "doveadm:/usr/local/lib/dovecot/doveadm/lib10_doveadm_acl_plugin.so: undefined symbol 'acl_mailbox_list_get_backend' "doveadm:/usr/local/lib/dovecot/doveadm/lib10_doveadm_acl_plugin.so: undefined symbol 'acl_object_list_init' "doveadm:/usr/local/lib/dovecot/doveadm/lib10_doveadm_acl_plugin.so: undefined symbol 'acl_object_list_next' "doveadm:/usr/local/lib/dovecot/doveadm/lib10_doveadm_acl_plugin.so: undefined symbol 'acl_backend_rights_match_me' "doveadm:/usr/local/lib/dovecot/doveadm/lib10_doveadm_acl_plugin.so: undefined symbol 'acl_rights_get_id' "doveadm:/usr/local/lib/dovecot/doveadm/lib10_doveadm_acl_plugin.so: undefined symbol 'acl_object_list_deinit' "doveadm:/usr/local/lib/dovecot/doveadm/lib10_doveadm_acl_plugin.so: undefined symbol 'acl_object_get_my_rights' "doveadm:/usr/local/lib/dovecot/doveadm/lib10_doveadm_acl_plugin.so: undefined symbol 'acl_rights_update_import' "doveadm:/usr/local/lib/dovecot/doveadm/lib10_doveadm_acl_plugin.so: undefined symbol 'acl_mailbox_update_acl' "doveadm:/usr/local/lib/dovecot/doveadm/lib10_doveadm_acl_plugin.so: undefined symbol 'acl_lookup_dict_rebuild' "doveadm:/usr/local/lib/dovecot/doveadm/lib10_doveadm_acl_plugin.so: undefined symbol 'acl_backend_nonowner_lookups_iter_init' "doveadm:/usr/local/lib/dovecot/doveadm/lib10_doveadm_acl_plugin.so: undefined symbol 'acl_backend_nonowner_lookups_iter_next' "doveadm:/usr/local/lib/dovecot/doveadm/lib10_doveadm_acl_plugin.so: undefined symbol 'acl_backend_nonowner_lookups_iter_deinit' "doveadm:/usr/local/lib/dovecot/doveadm/lib10_doveadm_acl_plugin.so: undefined symbol 'acl_backend_nonowner_lookups_rebuild' "doveadm:/usr/local/lib/dovecot/doveadm/lib10_doveadm_acl_plugin.so: undefined symbol 'acl_lookup_dict_is_enabled' "doveadm:/usr/local/lib/dovecot/doveadm/lib10_doveadm_acl_plugin.so: undefined symbol 'acl_lookup_dict_iterate_visible_init' "doveadm:/usr/local/lib/dovecot/doveadm/lib10_doveadm_acl_plugin.so: undefined symbol 'acl_lookup_dict_iterate_visible_next' "doveadm:/usr/local/lib/dovecot/doveadm/lib10_doveadm_acl_plugin.so: undefined symbol 'acl_lookup_dict_iterate_visible_deinit' "doveadm:/usr/local/lib/dovecot/doveadm/lib10_doveadm_quota_plugin.so: undefined symbol 'quota_user_module' "doveadm:/usr/local/lib/dovecot/doveadm/lib10_doveadm_quota_plugin.so: undefined symbol 'quota_root_get_resources' "doveadm:/usr/local/lib/dovecot/doveadm/lib10_doveadm_quota_plugin.so: undefined symbol 'quota_get_resource' "doveadm:/usr/local/lib/dovecot/doveadm/lib20_doveadm_fts_plugin.so: undefined symbol 'fts_list_backend' "doveadm:/usr/local/lib/dovecot/doveadm/lib20_doveadm_fts_plugin.so: undefined symbol 'fts_backend_lookup' "doveadm:/usr/local/lib/dovecot/doveadm/lib20_doveadm_fts_plugin.so: undefined symbol 'fts_backend_lookup_done' "doveadm:/usr/local/lib/dovecot/doveadm/lib20_doveadm_fts_plugin.so: undefined symbol 'fts_search_args_expand' "doveadm:/usr/local/lib/dovecot/doveadm/lib20_doveadm_fts_plugin.so: undefined symbol 'fts_language_find' "doveadm:/usr/local/lib/dovecot/doveadm/lib20_doveadm_fts_plugin.so: undefined symbol 'fts_user_get_language_list' "doveadm:/usr/local/lib/dovecot/doveadm/lib20_doveadm_fts_plugin.so: undefined symbol 'fts_language_detect' "doveadm:/usr/local/lib/dovecot/doveadm/lib20_doveadm_fts_plugin.so: undefined symbol 'fts_language_list_get_first' "doveadm:/usr/local/lib/dovecot/doveadm/lib20_doveadm_fts_plugin.so: undefined symbol 'fts_user_language_find' "doveadm:/usr/local/lib/dovecot/doveadm/lib20_doveadm_fts_plugin.so: undefined symbol 'fts_tokenizer_reset' "doveadm:/usr/local/lib/dovecot/doveadm/lib20_doveadm_fts_plugin.so: undefined symbol 'fts_tokenizer_final' "doveadm:/usr/local/lib/dovecot/doveadm/lib20_doveadm_fts_plugin.so: undefined symbol 'fts_tokenizer_next' "doveadm:/usr/local/lib/dovecot/doveadm/lib20_doveadm_fts_plugin.so: undefined symbol 'fts_filter_filter' "doveadm:/usr/local/lib/dovecot/doveadm/lib20_doveadm_fts_plugin.so: undefined symbol 'fts_backend_optimize' "doveadm:/usr/local/lib/dovecot/doveadm/lib20_doveadm_fts_plugin.so: undefined symbol 'fts_backend_rescan' "doveadm:/usr/local/lib/dovecot/doveadm/libdoveadm_mail_crypt_plugin.so: undefined symbol 'mail_crypt_user_get_public_key' "doveadm:/usr/local/lib/dovecot/doveadm/libdoveadm_mail_crypt_plugin.so: undefined symbol 'mail_crypt_user_generate_keypair' "doveadm:/usr/local/lib/dovecot/doveadm/libdoveadm_mail_crypt_plugin.so: undefined symbol 'mail_crypt_box_get_public_key' "doveadm:/usr/local/lib/dovecot/doveadm/libdoveadm_mail_crypt_plugin.so: undefined symbol 'mail_crypt_box_generate_keypair' "doveadm:/usr/local/lib/dovecot/doveadm/libdoveadm_mail_crypt_plugin.so: undefined symbol 'mail_crypt_box_get_pvt_digests' "doveadm:/usr/local/lib/dovecot/doveadm/libdoveadm_mail_crypt_plugin.so: undefined symbol 'mail_crypt_acl_secure_sharing_enabled'" "doveadm:/usr/local/lib/dovecot/doveadm/libdoveadm_mail_crypt_plugin.so: undefined symbol 'mail_crypt_box_share_private_keys' "doveadm:/usr/local/lib/dovecot/doveadm/libdoveadm_mail_crypt_plugin.so: undefined symbol 'mail_crypt_box_set_shared_key' "doveadm:/usr/local/lib/dovecot/doveadm/libdoveadm_mail_crypt_plugin.so: undefined symbol 'mail_crypt_get_private_key' I checked on both machines, and these symbols are all undefined in the associated libraries. I do notice though, that these symbols seem to be present in similar dovecot, non-doveadm plugins: kefka|~|03:04:56|130$ nm -A /usr/local/lib/dovecot/doveadm/lib10_doveadm_acl_plugin.so | grep acl_user_module /usr/local/lib/dovecot/doveadm/lib10_doveadm_acl_plugin.so: U acl_user_module kefka|~|03:05:14|0$ nm -A /usr/local/lib/dovecot/lib01_acl_plugin.so | grep acl_user_module /usr/local/lib/dovecot/lib01_acl_plugin.so:0001b008 D acl_user_module However, the doveadm plugins don't link against them? kefka|~|03:04:24|1$ ldd /usr/local/lib/dovecot/doveadm/lib10_doveadm_acl_plugin.so /usr/local/lib/dovecot/doveadm/lib10_doveadm_acl_plugin.so: Start End Type Open Ref GrpRef Name 000001d89e043000 000001d89e04d000 dlib 1 0 0 /usr/local/lib/dovecot/doveadm/lib10_doveadm_acl_plugin.so Is anyone else seeing issues like this? Is there perhaps a misconfiguration on my end? Here's the full output of dovecot -n # 2.3.14 (cee3cbc0d): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.14 (1b5c82b2) # OS: OpenBSD 6.9 amd64 # Hostname: kefka.worrbase.com auth_username_format = %n default_vsz_limit = 512 M doveadm_password = # hidden, use -P to show it dsync_remote_cmd = /usr/bin/ssh -i /root/.ssh/id_ed25519.dsync %{host} /usr/local/bin/dsync-in-wrapper.sh first_valid_uid = 1000 imap_client_workarounds = delay-newmail tb-extra-mailbox-sep tb-lsub-flags mail_location = maildir:~/Maildir mail_plugins = " notify replication" managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext mbox_write_locks = fcntl mmap_disable = yes namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Sent { special_use = \Sent } mailbox Spam { special_use = \Junk } mailbox Trash { special_use = \Trash } prefix = separator = / } passdb { driver = bsdauth } plugin { mail_replica = remoteprefix:root@sabin.worrbase.com sieve = ~/.dovecot.sieve sieve_dir = ~/.sieve sieve_user_log = ~/.dovecot.sieve.log } pop3_client_workarounds = outlook-no-nuls oe-ns-eoh postmaster_address = postmaster(a)worrbase.com protocols = imap lmtp service aggregator { fifo_listener replication-notify-fifo { mode = 0666 } unix_listener replication-notify { mode = 0666 } } service imap-login { inet_listener imap { port = 143 } inet_listener imaps { port = 993 ssl = yes } } service lmtp { inet_listener lmtp { address = localhost port = 2525 } } service managesieve-login { inet_listener sieve { port = 4190 } inet_listener sieve_deprecated { port = 2000 } } service pop3-login { inet_listener pop3 { port = 0 } inet_listener pop3s { port = 0 } } service replicator { process_min_avail = 1 unix_listener replicator-doveadm { mode = 0666 } } ssl = required ssl_cert = </etc/mail/certs/mail.worrbase.com.crt ssl_cipher_list = ALL:HIGH:!TLSv1:!SSLv3:!SSLv2:!MEDIUM:!LOW:!EXP:!RC4:!MD5:!aNULL:@STRENGTH ssl_client_ca_file = /etc/ssl/cert.pem ssl_dh = # hidden, use -P to show it ssl_key = # hidden, use -P to show it ssl_min_protocol = TLSv1.1 userdb { driver = passwd } protocol lmtp { mail_plugins = " notify replication sieve" } protocol lda { mail_plugins = " notify replication sieve" } protocol imap { mail_max_userip_connections = 20 mail_plugins = " notify replication" } Let me know if I need to provide more info. Thanks so much for the help!

3 3

Pigeonhole - Auto create default per user script
by dovecot＠ptld.com 01 Jul '21

01 Jul '21

Is there a way to have a per-user default sieve script get auto created if it doesn't exist? Or created on first time use like when the directory set by plugin{sieve=file:~/} gets created? Not global scripts.

2 1

Pigeonhole sieve_user_log
by dovecot＠ptld.com 01 Jul '21

01 Jul '21

https://doc.dovecot.org/configuration_manual/sieve/configuration/ Pigeonhole creates logs separate from main dovecot logs. I see sieve_user_log allows you to change log location and it says if you don't set it logs are still made by default. I can not find anything about log rotation of these pigeonhole logs or if there is a way to disable this logging. Do i need to worry about this log growing out of control? Is there a way to disable it? Does it prune/purge itself? Any practical reason to keep these logs?

2 1

Feature/patch request
by Bucher, Dr. Damian 30 Jun '21

30 Jun '21

Hi, we ran into a problem, while using filesystem snapshots on a GPFS-filesystem. With this we want to give the users the opportunity to restore Mailboxes from this snapshots in case they deleted mail by accident. For each snapshot we create a namespace via a postlogin skript (with INDEX=MEMORY to avoid writing index files to a ro filesystem). The snapshot are of course read only. When accessing the mailboxes in the namespaces, dovecot generates an error (ro filesystem): Error: Mailbox #backup20/Mail/deleted-messages: open() failed with mbox: Read-only file system We tracked that down to a problem in src/lib-storage/index/mbox/mbox-file.c (yes, we are still using mbox ;) ) fd = open(mailbox_get_path(&mbox->box), mbox_is_backend_readonly(mbox) ? O_RDONLY : O_RDWR); if (fd == -1 && errno == EACCES && !mbox->backend_readonly) { mbox->backend_readonly = TRUE; fd = open(mailbox_get_path(&mbox->box), O_RDONLY); } Here the mailbox is opened and it is checked wether the file is ro or rw. Since the snapshot contains the original file permissions, the file is of course rw, but the filesystem is ro. Unfortunately the code only checks for file permissions (errno == EACCES), which doesn’t catch our error condition (FS ro). We think that exchanging this to (errno == EACCESS || errno == EROFS) would catch the file system ro error correctly and set the readonly flag correctly and open the mailbox ro. (this probably hast to be done for other mailbox formats in the corresponding files too) What do you think? Is there a chance to implement that in an upcoming release? Best regards Damian — Postmaster@WWU WWU IT Westfälische Wilhelms-Universität (WWU) Münster Röntgenstr. 7-13, 48149 Münster mailto:postmaster@uni-muenster.de

2 2

oauth2
by Andrea Gabellini 30 Jun '21

30 Jun '21

Hello, Dovecot 2.3.15 installed from repository on CentOS 7.9 I would like to try the oauth2 mechanism to autenticate my users. I have installed a working demo of KeyCloak and I have a working installation of Dovecot 2.3.15 with LDAP backend and plain authentication. My Thunderbird client always says "that the server doesn't manage the authentication method", but with a "openssl s_client -connect" command I get: * OK [CAPABILITY IMAP4rev1 SASL-IR LOGIN-REFERRALS ID ENABLE IDLE LITERAL+ AUTH=PLAIN AUTH=OAUTHBEARER AUTH=XOAUTH2] IMAP ready. Putting Dovecot in debug I can't see any error or warning on oauth2 authentication. I'm following the offical guide: auth_mechanisms = plain oauthbearer xoauth2 passdb { driver = oauth2 mechanisms = xoauth2 oauthbearer args = /etc/dovecot/dovecot-oauth2.conf.ext } /etc/dovecot/dovecot-oauth2.conf.ext: tokeninfo_url = https://www.googleapis.com/oauth2/v3/tokeninfo?access_token= introspection_url = https://www.googleapis.com/oauth2/v2/userinfo #force_introspection = yes username_attribute = email tls_ca_cert_file = /etc/ssl/certs/ca-certificates.crt I'm using an explicit wrong configuration to thrown some errors and verify that Dovecot is really using the OAUTH2 mechanism, but I don't get any errors... What I'm doing wrong? Thanks, Andrea -- __________________________ Okay, okay, I'll take it back ... UNfuck you ! __________________________ TIM San Marino S.p.A. Andrea Gabellini Engineering R&D TIM San Marino S.p.A. - https://www.telecomitalia.sm Via Ventotto Luglio, 212 - Piano -2 47893 - Borgo Maggiore - Republic of San Marino Tel: (+378) 0549 886237 Fax: (+378) 0549 886188 -- Informativa Privacy Questa email ha per destinatari dei contatti presenti negli archivi di TIM San Marino S.p.A.. Tutte le informazioni vengono trattate e tutelate nel rispetto della normativa vigente sulla protezione dei dati personali (Reg. EU 2016/679). Per richiedere informazioni e/o variazioni e/o la cancellazione dei vostri dati presenti nei nostri archivi potete inviare una email a privacy(a)telecomitalia.sm. Avviso di Riservatezza Il contenuto di questa e-mail e degli eventuali allegati e' strettamente confidenziale e destinato alla/e persona/e a cui e' indirizzato. Se avete ricevuto per errore questa e-mail, vi preghiamo di segnalarcelo immediatamente e di cancellarla dal vostro computer. E' fatto divieto di copiare e divulgare il contenuto di questa e-mail. Ogni utilizzo abusivo delle informazioni qui contenute da parte di persone terze o comunque non indicate nella presente e-mail potra' essere perseguito ai sensi di legge.

2 7

Panic indexer-worker on Dovecot 2.3.15
by Alessio Cecchi 30 Jun '21

30 Jun '21

Hi, after the upgrade to dovecot 2.3.15 the Panic: indexer-worker error is still present. I don't know if is related to searching in a Virtual folder (look for my previous email on list with subject "Panic on indexer-worker and Dovecot stop to search on Solr" for more details). Here the relevant configuration of FTS plugin: plugin { fts = solr fts_autoindex = no fts_autoindex_exclude = \Junk fts_autoindex_exclude2 = \Drafts fts_decoder = decode2text fts_enforced = body fts_index_timeout = 5s fts_solr = url=http://10.0.0.32:8983/solr/dovecot/ [...] I'm running Dovecot with FTS Solr 7.7, here the log error and the bt full: Jun 29 13:06:26 Panic: indexer-worker(user1(a)company.net) session=<SLTLmOXFFIy5Ydlu:6BC4HLH+2mBHQwAAxbYlJw>: file http-clien t-request.c: line 1240 (http_client_request_send_more): assertion failed: (req->payload_input != NULL) Jun 29 13:06:26 Error: indexer-worker(user1(a)company.net) session=<SLTLmOXFFIy5Ydlu:6BC4HLH+2mBHQwAAxbYlJw>: Raw backtrace: /usr/lib64/dovecot/libdovecot.so.0(backtrace_append+0x42) [0x7f7212b36862] -> /usr/lib64/dovecot/libdovecot.so.0(backtrace_get+0x1e) [0x7f7212b3696e] -> /usr/lib64/dovecot/libdovecot.so.0(+0xf50fe) [0x7f7212b440fe] -> /usr/lib64/dovecot/libdovecot.so.0(+0xf51a1) [ 0x7f7212b441a1] -> /usr/lib64/dovecot/libdovecot.so.0(i_fatal+0) [0x7f7212a9460c] -> /usr/lib64/dovecot/libdovecot.so.0(http_client_ request_send_more+0x3dd) [0x7f7212add54d] -> /usr/lib64/dovecot/libdovecot.so.0(http_client_connection_output+0xf1) [0x7f7212ae1ca1] -> /usr/lib64/dovecot/libdovecot.so.0(+0x11e870) [0x7f7212b6d870] -> /usr/lib64/dovecot/libdovecot.so.0(io_loop_call_io+0x65) [0x7f 7212b5c425] -> /usr/lib64/dovecot/libdovecot.so.0(io_loop_handler_run_internal+0x12b) [0x7f7212b5ddab] -> /usr/lib64/dovecot/libdove cot.so.0(io_loop_handler_run+0x59) [0x7f7212b5c529] -> /usr/lib64/dovecot/libdovecot.so.0(io_loop_run+0x38) [0x7f7212b5c768] -> /usr /lib64/dovecot/libdovecot.so.0(http_client_wait+0xcd) [0x7f7212aeadbd] -> /usr/lib64/dovecot/lib21_fts_solr_plugin.so(solr_connectio n_select+0xe5) [0x7f7210a79265] -> /usr/lib64/dovecot/lib21_fts_solr_plugin.so(+0x4684) [0x7f7210a75684] -> /usr/lib64/dovecot/lib20 _fts_plugin.so(fts_backend_get_last_uid+0x6e) [0x7f7211e1944e] -> /usr/lib64/dovecot/lib20_fts_plugin.so(+0xf9d2) [0x7f7211e1f9d2] - > /usr/lib64/dovecot/lib20_fts_plugin.so(+0x10f56) [0x7f7211e20f56] -> /usr/lib64/dovecot/lib20_virtual_plugin.so(+0x94da) [0x7f7211 a014da] -> /usr/lib64/dovecot/lib20_fts_plugin.so(+0x10ba6) [0x7f7211e20ba6] -> /usr/lib64/dovecot/libdovecot-storage.so.0(mail_prec ache+0x2e) [0x7f7212e48fae] -> dovecot/indexer-worker [user1(a)company.net Virtual/All](+0x2bb1) [0x55559e522bb1] -> /usr/lib 64/dovecot/libdovecot.so.0(io_loop_call_io+0x65) [0x7f7212b5c425] -> /usr/lib64/dovecot/libdovecot.so.0(io_loop_handler_run_internal +0x12b) [0x7f7212b5ddab] -> /usr/lib64/dovecot/libdovecot.so.0(io_loop_handler_run+0x59) [0x7f7212b5c529] -> /usr/lib64/dovecot/libd ovecot.so.0(io_loop_run+0x38) [0x7f7212b5c768] -> /usr/lib64/dovecot/libdovecot.so.0(master_service_run+0x13) [0x7f7212ac63c3] -> do vecot/indexer-worker [user1(a)company.net Virtual/All](main+0xd7) [0x55559e522437] -> /lib64/libc.so.6(__libc_start_main+0xf5 ) [0x7f72126a3555] -> dovecot/indexer-worker [user1(a)company.net Virtual/All](+0x24fa) [0x55559e5224fa] Jun 29 13:06:26 Fatal: indexer-worker(user1(a)company.net) session=<SLTLmOXFFIy5Ydlu:6BC4HLH+2mBHQwAAxbYlJw>: master: service(indexer-worker): child 17223 killed with signal 6 (core dumped) # gdb /usr/libexec/dovecot/indexer-worker /var/core/core.indexer-worker.17223 GNU gdb (GDB) Red Hat Enterprise Linux 7.6.1-120.el7 Copyright (C) 2013 Free Software Foundation, Inc. License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html> This is free software: you are free to change and redistribute it. There is NO WARRANTY, to the extent permitted by law. Type "show copying" and "show warranty" for details. This GDB was configured as "x86_64-redhat-linux-gnu". For bug reporting instructions, please see: <http://www.gnu.org/software/gdb/bugs/>... Reading symbols from /usr/libexec/dovecot/indexer-worker...Reading symbols from /usr/lib/debug/usr/libexec/dovecot/indexer-worker.debug...done. done. [New LWP 17223] [Thread debugging using libthread_db enabled] Using host libthread_db library "/lib64/libthread_db.so.1". Core was generated by `dovecot/indexer-worker'. Program terminated with signal 6, Aborted. #0 0x00007f72126b7387 in raise () from /lib64/libc.so.6 Missing separate debuginfos, use: debuginfo-install bzip2-libs-1.0.6-13.el7.x86_64 expat-2.1.0-12.el7.x86_64 glibc-2.17-324.el7_9.x86_64 libgcc-4.8.5-44.el7.x86_64 libzstd-1.5.0-1.el7.x86_64 xz-libs-5.2.2-1.el7.x86_64 zlib-1.2.7-19.el7_9.x86_64 (gdb) bt full #0 0x00007f72126b7387 in raise () from /lib64/libc.so.6 No symbol table info available. #1 0x00007f72126b8a78 in abort () from /lib64/libc.so.6 No symbol table info available. #2 0x00007f7212b440b7 in default_fatal_finish (status=0, type=<optimized out>) at failures.c:459 backtrace = 0x55559eb75970 "/usr/lib64/dovecot/libdovecot.so.0(backtrace_append+0x42) [0x7f7212b36862] -> /usr/lib64/dovecot/libdovecot.so.0(backtrace_get+0x1e) [0x7f7212b3696e] -> /usr/lib64/dovecot/libdovecot.so.0(+0xf50fe) [0"... recursed = 0 #3 fatal_handler_real (ctx=<optimized out>, format=<optimized out>, args=<optimized out>) at failures.c:471 status = 0 #4 0x00007f7212b441a1 in i_internal_fatal_handler (ctx=<optimized out>, format=<optimized out>, args=<optimized out>) at failures.c:866 No locals. #5 0x00007f7212a9460c in i_panic (format=format@entry=0x7f7212b85cf8 "file %s: line %d (%s): assertion failed: (%s)") at failures.c:523 ctx = {type = LOG_TYPE_PANIC, exit_status = 0, timestamp = 0x0, timestamp_usecs = 0, log_prefix = 0x0, log_prefix_type_pos = 0} args = {{gp_offset = 40, fp_offset = 48, overflow_arg_area = 0x7ffe7b6e7150, reg_save_area = 0x7ffe7b6e7090}} #6 0x00007f7212add54d in http_client_request_send_more (req=req@entry=0x55559eca9db8, pipelined=pipelined@entry=false) at http-client-request.c:1240 conn = 0x55559ec8b750 cctx = 0x55559ebb63a8 output = 0x55559ecafa70 res = <optimized out> error = <optimized out> offset = <optimized out> __func__ = "http_client_request_send_more" #7 0x00007f7212ae1ca1 in http_client_connection_continue_request (conn=0x55559ec8b750) at http-client-connection.c:1342 tmp_conn = 0x55559ec8b750 count = 1 ret = <optimized out> reqs = <optimized out> req = 0x55559eca9db8 pipelined = false #8 http_client_connection_output (conn=0x55559ec8b750) at http-client-connection.c:1374 output = <optimized out> ret = <optimized out> #9 0x00007f7212b6d870 in stream_send_io (fstream=0x55559ec8cb20) at ostream-file.c:526 ostream = 0x55559ec8cbc0 am = 0x55559ec8cb20 use_cork = true ret = <optimized out> ---Type <return> to continue, or q <return> to quit--- #10 0x00007f7212b5c425 in io_loop_call_io (io=0x55559ec925f0) at ioloop.c:715 ioloop = 0x55559ecaf4d0 t_id = 6 __func__ = "io_loop_call_io" #11 0x00007f7212b5ddab in io_loop_handler_run_internal (ioloop=ioloop@entry=0x55559ecaf4d0) at ioloop-epoll.c:222 ctx = 0x55559ecab870 events = <optimized out> list = 0x55559ec8c8e0 io = <optimized out> tv = {tv_sec = 0, tv_usec = 0} events_count = <optimized out> msecs = <optimized out> ret = 1 i = 0 call = <optimized out> __func__ = "io_loop_handler_run_internal" #12 0x00007f7212b5c529 in io_loop_handler_run (ioloop=ioloop@entry=0x55559ecaf4d0) at ioloop.c:767 __func__ = "io_loop_handler_run" #13 0x00007f7212b5c768 in io_loop_run (ioloop=0x55559ecaf4d0) at ioloop.c:740 __func__ = "io_loop_run" #14 0x00007f7212aeadbd in http_client_wait () at http-client.c:339 prev_ioloop = 0x55559eb7b050 client_ioloop = 0x55559ecaf4d0 prev_client_ioloop = 0x55559eb7b050 __func__ = "http_client_wait" #15 0x00007f7210a79265 in solr_connection_select (conn=0x55559eb8b150, query=<optimized out>, pool=<optimized out>, box_results_r=0x7ffe7b6e7400) at solr-connection.c:211 lctx = {result_pool = 0x55559ec03910, payload = 0x0, io = 0x0, request_status = 0, parser = 0x0, results = 0x0} http_req = 0x55559ecb3b48 url = <optimized out> #16 0x00007f7210a75684 in fts_backend_solr_get_last_uid (_backend=0x55559eb8b090, box=0x55559ebe59a8, last_uid_r=0x7ffe7b6e74a4) at fts-backend-solr.c:238 hdr = {last_indexed_uid = 0, settings_checksum = 0, unused = 0} #17 0x00007f7211e1944e in fts_backend_get_last_uid (backend=<optimized out>, box=box@entry=0x55559ebe59a8, last_uid_r=last_uid_r@entry=0x7ffe7b6e74a4) at fts-api.c:106 hdr = {last_indexed_uid = 2, settings_checksum = 0, unused = 317606002} #18 0x00007f7211e1f9d2 in fts_mailbox_get_last_cached_seq (box=box@entry=0x55559ebe59a8, seq_r=seq_r@entry=0x7ffe7b6e74f4) at fts-storage.c:85 flist = <optimized out> seq1 = 21845 seq2 = 2663132384 last_uid = 21845 ---Type <return> to continue, or q <return> to quit--- #19 0x00007f7211e20f56 in fts_mail_precache_init (_mail=<optimized out>, _mail=<optimized out>) at fts-storage.c:478 ft = 0x55559ec8c820 flist = 0x55559ebca0a0 last_seq = 21845 #20 fts_mail_index (_mail=0x55559ecaed08) at fts-storage.c:501 ft = 0x55559ec8c820 flist = 0x55559ebca0a0 pmail = 0x55559ecaed08 #21 fts_mail_precache (_mail=0x55559ecaed08) at fts-storage.c:562 _data_stack_cur_id = 5 mail = 0x55559ecaed08 fmail = <optimized out> ft = 0x55559ec8c820 ret = 0 __func__ = "fts_mail_precache" #22 0x00007f7211a014da in virtual_mail_precache (mail=<optimized out>) at virtual-mail.c:243 vmail = <optimized out> backend_mail = 0x55559ecaed08 p = <optimized out> #23 0x00007f7211e20ba6 in fts_mail_precache (_mail=0x55559ec027f8) at fts-storage.c:555 mail = 0x55559ec027f8 fmail = 0x55559ec02f70 ft = 0x55559ebff760 ret = 0 __func__ = "fts_mail_precache" #24 0x00007f7212e48fae in mail_precache (mail=0x55559ec027f8) at mail.c:455 _data_stack_cur_id = 4 p = 0x55559ec027f8 ret = <optimized out> #25 0x000055559e522bb1 in index_mailbox_precache (conn=<optimized out>, box=0x55559eb9c498) at master-connection.c:119 counter = 1 max = 93 percentage_sent = 0 storage = <optimized out> status = {messages = 93, recent = 0, unseen = 0, uidvalidity = 1624964785, uidnext = 94, first_unseen_seq = 0, first_recent_uid = 94, last_cached_seq = 0, highest_modseq = 0, highest_pvt_modseq = 0, keywords = 0x0, permanent_flags = 0, flags = 0, permanent_keywords = false, allow_new_keywords = false, nonpermanent_modseqs = false, no_modseq_tracking = false, have_guids = true, have_save_guids = true, have_only_guid128 = false} uids = <optimized out> username = 0x55559eba0e18 "user1(a)company.net" first_uid = 1 percentage_str = "\261\376\332`" ---Type <return> to continue, or q <return> to quit--- percentage = <optimized out> error = MAIL_ERROR_NONE trans = 0x55559ebf1b00 ctx = 0x55559ebf3640 last_uid = 2 ret = 0 index_event = 0x55559ebf3250 box_vname = 0x55559eb9c830 "Virtual/All" errstr = <optimized out> search_args = 0x0 mail = 0x55559ec027f8 metadata = {guid = '\000' <repeats 15 times>, virtual_size = 0, physical_size = 0, first_save_date = 0, cache_fields = 0x0, precache_fields = (MAIL_FETCH_STREAM_HEADER | MAIL_FETCH_STREAM_BODY | MAIL_FETCH_RECEIVED_DATE | MAIL_FETCH_SAVE_DATE | MAIL_FETCH_PHYSICAL_SIZE | MAIL_FETCH_VIRTUAL_SIZE | MAIL_FETCH_UIDL_BACKEND | MAIL_FETCH_GUID | MAIL_FETCH_POP3_ORDER), backend_ns_prefix = 0x0, backend_ns_type = (unknown: 0)} seq = <optimized out> #26 index_mailbox (user=<optimized out>, user=<optimized out>, what=<optimized out>, max_recent_msgs=<optimized out>, mailbox=<optimized out>, conn=0x55559ebd8a80) at master-connection.c:238 box = 0x55559eb9c498 status = {messages = 2662839088, recent = 21845, unseen = 1, uidvalidity = 0, uidnext = 2662837936, first_unseen_seq = 21845, first_recent_uid = 313289502, last_cached_seq = 32626, highest_modseq = 140730969257744, highest_pvt_modseq = 93826223419056, keywords = 0x55559eb7aeb0, permanent_flags = 313289927, flags = 32626, permanent_keywords = false, allow_new_keywords = false, nonpermanent_modseqs = false, no_modseq_tracking = false, have_guids = true, have_save_guids = false, have_only_guid128 = false} errstr = <optimized out> ret = 0 ns = <optimized out> path = 0x55559eb74a50 "/home/vmail/domains/2/company.net/0/user1/Maildir/virtual/All" error = 93 sync_flags = <optimized out> #27 master_connection_input_line (line=<optimized out>, conn=0x55559ebd8a80) at master-connection.c:280 str = <optimized out> max_recent_msgs = 0 ret = <optimized out> args = <optimized out> input = {event_parent = 0x0, module = 0x55559e52343f "mail", service = 0x55559e523430 "indexer-worker", username = 0x55559eb72038 "user1(a)company.net", session_id = 0x0, session_id_prefix = 0x55559eb7205f "SLTLmOXFFIy5Ydlu", session_create_time = 0, local_ip = {family = 0, u = {ip6 = { __in6_u = {__u6_addr8 = '\000' <repeats 15 times>, __u6_addr16 = {0, 0, 0, 0, 0, 0, 0, 0}, __u6_addr32 = {0, 0, 0, 0}}}, ip4 = {s_addr = 0}}}, remote_ip = {family = 0, u = {ip6 = {__in6_u = { __u6_addr8 = '\000' <repeats 15 times>, __u6_addr16 = {0, 0, 0, 0, 0, 0, 0, 0}, __u6_addr32 = {0, 0, 0, 0}}}, ---Type <return> to continue, or q <return> to quit--- ip4 = {s_addr = 0}}}, local_port = 0, remote_port = 0, userdb_fields = 0x0, forward_fields = 0x0, flags_override_add = (unknown: 0), flags_override_remove = (unknown: 0), no_userdb_lookup = false, debug = false, conn_secured = false, conn_ssl_secured = false} service_user = 0x55559ebcb318 user = 0x55559eba0cf8 error = 0x0 #28 master_connection_input (conn=0x55559ebd8a80) at master-connection.c:320 _data_stack_cur_id = 3 line = <optimized out> #29 0x00007f7212b5c425 in io_loop_call_io (io=0x55559ec54760) at ioloop.c:715 ioloop = 0x55559eb7b050 t_id = 2 __func__ = "io_loop_call_io" #30 0x00007f7212b5ddab in io_loop_handler_run_internal (ioloop=ioloop@entry=0x55559eb7b050) at ioloop-epoll.c:222 ctx = 0x55559eb7bc40 events = <optimized out> list = 0x55559eb86770 io = <optimized out> tv = {tv_sec = 2147483, tv_usec = 0} events_count = <optimized out> msecs = <optimized out> ret = 1 i = 0 call = <optimized out> __func__ = "io_loop_handler_run_internal" #31 0x00007f7212b5c529 in io_loop_handler_run (ioloop=ioloop@entry=0x55559eb7b050) at ioloop.c:767 __func__ = "io_loop_handler_run" #32 0x00007f7212b5c768 in io_loop_run (ioloop=0x55559eb7b050) at ioloop.c:740 __func__ = "io_loop_run" #33 0x00007f7212ac63c3 in master_service_run (service=0x55559eb7aeb0, callback=callback@entry=0x55559e5225f0 <client_connected>) at master-service.c:862 No locals. #34 0x000055559e522437 in main (argc=1, argv=0x55559eb7ab90) at indexer-worker.c:76 storage_service_flags = (MAIL_STORAGE_SERVICE_FLAG_USERDB_LOOKUP | MAIL_STORAGE_SERVICE_FLAG_TEMP_PRIV_DROP | MAIL_STORAGE_SERVICE_FLAG_NO_IDLE_TIMEOUT) c = <optimized out> (gdb) quit Hope can be fixed. Thanks -- Alessio Cecchi Postmaster @ http://www.qboxmail.it https://www.linkedin.com/in/alessice

1 0

Dovecot 2.3.15 compilation fails
by Andreas M. Kirchwitz 29 Jun '21

29 Jun '21

Hello Dovecot users and developers! Up to Dovecot 2.3.14.1 manual compilation of Dovecot sources was fine, I have an old 32-bit Linux server with GCC 4.4.7 where I compile almost all things manually. Works fine, never had problems with GCC versions. env LDFLAGS="-Wl,--no-as-needed" ./configure --prefix=/usr/local/dovecot --with-ssl=openssl --with-ssldir=/usr/local/dovecot/etc/dovecot/certs make Unfortunately, Dovecot 2.3.15 fails to compile at test-smtp-params.c (works with a recent GCC 11.1.1 on my desktop, but servers usually come with older stuff). I know a little bit of programming but that's above my head what goes wrong here and how I could fix it to continue (so I don't know if that's the only problem or if there will be more). See below (at the end) for the exact error message. I assume this compilation issue was not an intentional change/requirement between 2.3.14(.1) and 2.3.15, it just happened. I don't think that the problem is in "test-smtp-params.c" itself but some declarations somewhere else are missing, but I'm no expert here. There were too many changes in the src/lib-smtp source tree to understand what may have caused this (or maybe it's even somewhere else). Any help is highly appreciated. I'd be happy to help and try out any ideas or patches. I'd like to see that Dovecot can be compiled on as many platforms as possible, as long as there are no fundamental requirements making this impossible. Thanks a lot in advance and keep up the good work, Andreas [last lines of compilation process when error happens] gcc -DHAVE_CONFIG_H -I. -I../.. -I../../src/lib -I../../src/lib-test -I../../src/lib-settings -I../../src/lib-master -I../../src/lib-sasl -I../../src/lib-ssl-iostream -I../../src/lib-dns -I../../src/lib-program-client -I../../src/lib-mail -DTEST_BIN_DIR=\"/usr/local/src/dovecot-2.3.15/src/lib-smtp/test-bin\" -std=gnu99 -g -O2 -fstack-protector -U_FORTIFY_SOURCE -D_FORTIFY_SOURCE=2 -mfunction-return=keep -mindirect-branch=keep -Wall -W -Wmissing-prototypes -Wmissing-declarations -Wpointer-arith -Wchar-subscripts -Wformat=2 -Wbad-function-cast -fno-builtin-strftime -Wstrict-aliasing=2 -I/usr/local/OpenSSL-1.1.1/include -MT test-smtp-params.o -MD -MP -MF .deps/test-smtp-params.Tpo -c -o test-smtp-params.o test-smtp-params.c test-smtp-params.c:29: error: unknown field ‘data’ specified in initializer test-smtp-params.c:29: warning: missing braces around initializer test-smtp-params.c:29: warning: (near initialization for ‘test_params_buffer1.<anonymous>’) test-smtp-params.c:30: warning: missing initializer test-smtp-params.c:30: warning: (near initialization for ‘test_params_buffer1.<anonymous>.<anonymous>.used’) test-smtp-params.c:30: error: unknown field ‘used’ specified in initializer test-smtp-params.c:31: warning: excess elements in struct initializer test-smtp-params.c:31: warning: (near initialization for ‘test_params_buffer1’) test-smtp-params.c:33: error: unknown field ‘data’ specified in initializer test-smtp-params.c:33: warning: missing braces around initializer test-smtp-params.c:33: warning: (near initialization for ‘test_params_buffer2.<anonymous>’) test-smtp-params.c:34: warning: missing initializer test-smtp-params.c:34: warning: (near initialization for ‘test_params_buffer2.<anonymous>.<anonymous>.used’) test-smtp-params.c:34: error: unknown field ‘used’ specified in initializer test-smtp-params.c:35: warning: excess elements in struct initializer test-smtp-params.c:35: warning: (near initialization for ‘test_params_buffer2’) make[3]: *** [test-smtp-params.o] Error 1 make[3]: Leaving directory `/usr/local/src/dovecot-2.3.15/src/lib-smtp' make[2]: *** [all-recursive] Error 1 make[2]: Leaving directory `/usr/local/src/dovecot-2.3.15/src' make[1]: *** [all-recursive] Error 1 make[1]: Leaving directory `/usr/local/src/dovecot-2.3.15' make: *** [all] Error 2

7 6

acl_ignore_namespace & dovecot-acl-list files
by Vincent Brillault 29 Jun '21

29 Jun '21

Hi! After updating to 2.3.15, I was hoping to be able to get rid of some of the work-around I had in place when configuring shared folders in cluster mode in 2.3.14. Unfortunately it seems that I still need one. Running on CentOS7 with both a 'virtual' and 'shared' namespace, whenever I update the global vfile, I'm getting the following warning: ``` Error: open(/etc/dovecot/virtual/.temp.....8536.f1a78823779ee98d) failed: Read-only file system Error: dovecot-acl-list creation failed: safe_mkstemp(/etc/dovecot/virtual/.temp.....8536.) failed: Read-only file system Error: unlink(/etc/dovecot/virtual/dovecot-acl-list) failed: Read-only file system (in acl-backend-vfile-acllist.c:339) ``` I found it weird, as I'm using acl_ignore_namespace to ignore the virtual filesystem, but still dovecot seems to be trying to create a dovecot-acl-list file there. After digging into it and generating a backtrace where that error message is triggered, I believe I've trace it down to `acl_lookup_dict_rebuild`, which doesn't filter out "ignored" namespaces. The attached patch seems to solve the problem for me, but I must admit I didn't test it in depth so I'm not sure if I'm breaking something else... Let me know if I'm missing something, Thanks, Vincent PS: Some details: - Relevant configuration (let me know if I'm missing something): ``` mail_plugins = acl zlib virtual fts fts_solr namespace Virtual { prefix = Virtual/ separator = / hidden = yes list = no subscriptions = no location = virtual:/etc/dovecot/virtual:INDEX=~/virtual } namespace shared { type = shared prefix = shared/%%u/ list = children subscriptions = no location = imapc:~/shared/%%u } plugin { # ACLs acl = vfile:/etc/dovecot/dovecot-acl acl_ignore_namespace = Virtual/ acl_ignore_namespace2 = shared/* acl_shared_dict = proxy::acl } ``` - Backtrace generated manually (adding `backtrace_get(&backtrace)` & printing the result under the `dovecot-acl-list creation failed` error): ``` Raw backtrace: /usr/lib64/dovecot/libdovecot.so.0(backtrace_append+0x42) [0x7ff99d364862] -> /usr/lib64/dovecot/libdovecot.so.0(backtrace_get+0x1e) [0x7ff99d36496e] -> /usr/lib64/dovecot/lib01_acl_plugin.so(+0xb071) [0x7ff99ca9f071] -> /usr/lib64/dovecot/lib01_acl_plugin.so(acl_backend_vfile_acllist_rebuild+0x1d) [0x7ff99ca9f3ed] -> /usr/lib64/dovecot/lib01_acl_plugin.so(acl_backend_vfile_acllist_refresh+0x250) [0x7ff99ca9f6b0] -> /usr/lib64/dovecot/lib01_acl_plugin.so(acl_backend_vfile_nonowner_iter_init+0x9) [0x7ff99ca9f849] -> /usr/lib64/dovecot/lib01_acl_plugin.so(acl_lookup_dict_rebuild+0x13e) [0x7ff99caa179e] -> /usr/lib64/dovecot/lib01_acl_plugin.so(+0xb245) [0x7ff99ca9f245] -> /usr/lib64/dovecot/lib01_acl_plugin.so(acl_backend_vfile_acllist_rebuild+0x1d) [0x7ff99ca9f3ed] -> /usr/lib64/dovecot/lib01_acl_plugin.so(+0xa9ad) [0x7ff99ca9e9ad] -> /usr/lib64/dovecot/lib01_acl_plugin.so(+0x6e4c) [0x7ff99ca9ae4c] -> /usr/lib64/dovecot/lib01_acl_plugin.so(acl_object_get_my_rights+0x75) [0x7ff99ca9af35] -> /usr/lib64/dovecot/lib01_acl_plugin.so(+0xe44e) [0x7ff99caa244e] -> /usr/lib64/dovecot/libdovecot-storage.so.0(mailbox_exists+0x6e) [0x7ff99d6845fe] -> /usr/lib64/dovecot/libdovecot-storage.so.0(mailbox_list_mailbox+0x226) [0x7ff99d694ff6] -> /usr/lib64/dovecot/libdovecot-storage.so.0(mailbox_list_iter_init_namespaces+0x282) [0x7ff99d6eecf2] -> dovecot/imap [vbrillau XXXXX LIST](cmd_list_full+0x55b) [0x563f9bb004bb] -> dovecot/imap [vbrillau XXXXX LIST](command_exec+0x64) [0x563f9bb0ab04] -> dovecot/imap [vbrillau XXXXX LIST](+0x1d9e2) [0x563f9bb089e2] -> dovecot/imap [vbrillau XXXXX LIST](+0x1da71) [0x563f9bb08a71] -> dovecot/imap [vbrillau XXXXX LIST](client_handle_input+0x205) [0x563f9bb08ef5] -> dovecot/imap [vbrillau XXXXX LIST](client_input+0x79) [0x563f9bb094d9] -> /usr/lib64/dovecot/libdovecot.so.0(io_loop_call_io+0x65) [0x7ff99d38a425] -> /usr/lib64/dovecot/libdovecot.so.0(io_loop_handler_run_internal+0x12b) [0x7ff99d38bdab] -> /usr/lib64/dovecot/libdovecot.so.0(io_loop_handler_run+0x59) [0x7ff99d38a529] -> /usr/lib64/dovecot/libdovecot.so.0(io_loop_run+0x38) [0x7ff99d38a768] -> /usr/lib64/dovecot/libdovecot.so.0(master_service_run+0x13) [0x7ff99d2f43c3] -> dovecot/imap [vbrillau XXXXX LIST](main+0x342) [0x563f9bafa2f2] -> /lib64/libc.so.6(__libc_start_main+0xf5) [0x7ff99ced1555] -> dovecot/imap [vbrillau XXXXX LIST](+0xf4f5) [0x563f9bafa4f5] ```

2 1

SSL23_GET_CLIENT_HELLO:unknown protocol
by Voytek Eymont 29 Jun '21

29 Jun '21

I have a user failing to get mail , using TBird client is this due to his TBird email client backlevel TLS support ? I'm trying to find out his TBird version, might be an older TBird # dovecot --version 2.3.15 (0503334ab1) # egrep "ssl_protocols|ssl_min_protocol" /etc/dovecot/conf.d/10-ssl.conf #ssl_min_protocol = TLSv1.2 Jun 29 14:23:27 pop3-login: Info: Disconnected: Connection closed: SSL_accept() failed: error:140760FC:SSL routines:SSL23_GET_CLIENT_HELLO:unknown protocol (no auth attempts in 1 secs): user=<>, rip= 111.222.333.555, lip=ser.ver.ip.add, TLS handshaking: SSL_accept() failed: error:140760FC:SSL routines:SSL23_GET_CLIENT_HELLO:unknown protocol, session=<kZ6p99/FW9iTMgHi> Jun 29 14:23:54 pop3-login: Info: Disconnected: Connection closed: SSL_accept() failed: error:140760FC:SSL routines:SSL23_GET_CLIENT_HELLO:unknown protocol (no auth attempts in 1 secs): user=<>, rip= 111.222.333.555, lip=ser.ver.ip.add, TLS handshaking: SSL_accept() failed: error:140760FC:SSL routines:SSL23_GET_CLIENT_HELLO:unknown protocol, session=<Gq5G+d/Fu1STMgHi>

2 2

Increase FTS timeouts for slow(er) machines
by Bojan Čekrlić 29 Jun '21

29 Jun '21

Hello list, I have a question which doesn’t seem to be answered by the documentation. I’m running Dovecot on a Raspberry PI-like computer. I’ve enabled full-text search (FTS) and installed Solr and Tika. Now, Dovecot will timeout Tika after 60 seconds and some emails will not get indexed as there’s simply not enough processing power on the device to work so fast. I don’t mind the slowness, so the question here is — how do I increase this timeout? Looking at the commits it seems that this option is hardcoded in the code and cannot be increased via configuration change? Thanks, B

2 2

good options for Multiple users on a common email account
by Pat G 28 Jun '21

28 Jun '21

Hi, i ve a mail server to manage with some email accounts but with multiples users (+50) using a common email. it indicates sometimes that it can't connect cause too many connections. what are the good options to allow a lot of users for a specific account ? i modifyied these options : auth_worker_max_count = 60 mail_max_userip_connections = 60 is it sufficient ? dovecot -n : auth_worker_max_count = 60 mail_location = maildir:/home/%u/Maildir namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } passdb { driver = pam } protocols = " imap" service imap-login { inet_listener imaps { port = 993 ssl = yes } } ssl_cert = </etc/ssl/certs/dovecot.pem ssl_key = # hidden, use -P to show it userdb { driver = passwd } protocol imap { mail_max_userip_connections = 60 } Regards, -- patg

3 3

Unable to run dovecot.2.3.15
by Joe Wong 28 Jun '21

28 Jun '21

Hello, I am trying to setup a new server on Centos 7 running 2.3.15, I compile the source with ./configure --with-pam , make then make install. I have another server using 2.3.8 so I copy my config files from there to /usr/local/etc/dovecot. I am using systemctl enable dovecot then systemctl start dovecot , however it failed to start. There is error found in /var/log/messages: Jun 28 09:14:37 new-ns1 systemd: Started Dovecot IMAP/POP3 email server. Jun 28 09:14:37 new-ns1 dovecot: Error: unlink(/usr/var/run/dovecot/login/login) failed: Read-only file system (in master-settings.c:739) Jun 28 09:14:37 new-ns1 dovecot: Error: unlink(/usr/var/run/dovecot/login/pop3) failed: Read-only file system (in master-settings.c:739) Jun 28 09:14:37 new-ns1 dovecot: Error: unlink(/usr/var/run/dovecot/login/imap) failed: Read-only file system (in master-settings.c:739) Jun 28 09:14:37 new-ns1 dovecot: Error: unlink(/usr/var/run/dovecot/login/dns-client) failed: Read-only file system (in master-settings.c:739) Jun 28 09:14:37 new-ns1 dovecot: Error: unlink(/usr/var/run/dovecot/login/ipc-proxy) failed: Read-only file system (in master-settings.c:739) Jun 28 09:14:37 new-ns1 dovecot: Error: unlink(/usr/var/run/dovecot/token-login/tokenlogin) failed: Read-only file system (in master-settings.c:739) Jun 28 09:14:37 new-ns1 dovecot: Error: unlink(/usr/var/run/dovecot/token-login/imap-urlauth) failed: Read-only file system (in master-settings.c:739) Jun 28 09:14:37 new-ns1 dovecot: Error: service(stats): unlink(/usr/var/run/dovecot/stats-reader) failed: Read-only file system Jun 28 09:14:37 new-ns1 dovecot: Error: service(stats): unlink(/usr/var/run/dovecot/stats-writer) failed: Read-only file system Jun 28 09:14:37 new-ns1 dovecot: Error: service(replicator): unlink(/usr/var/run/dovecot/replicator) failed: Read-only file system Jun 28 09:14:37 new-ns1 dovecot: Error: service(aggregator): unlink(/usr/var/run/dovecot/replication-notify) failed: Read-only file system Jun 28 09:14:37 new-ns1 dovecot: Error: service(aggregator): unlink(/usr/var/run/dovecot/replication-notify-fifo) failed: Read-only file system Jun 28 09:14:37 new-ns1 dovecot: Error: service(pop3): unlink(/usr/var/run/dovecot/login/pop3) failed: Read-only file system Jun 28 09:14:37 new-ns1 dovecot: Error: service(old-stats): unlink(/usr/var/run/dovecot/old-stats) failed: Read-only file system Jun 28 09:14:37 new-ns1 dovecot: Error: service(old-stats): unlink(/usr/var/run/dovecot/old-stats-mail) failed: Read-only file system Jun 28 09:14:37 new-ns1 dovecot: Error: service(old-stats): unlink(/usr/var/run/dovecot/old-stats-user) failed: Read-only file system Jun 28 09:14:37 new-ns1 dovecot: Error: service(log): unlink(/usr/var/run/dovecot/log-errors) failed: Read-only file system Jun 28 09:14:37 new-ns1 dovecot: Error: service(lmtp): unlink(/usr/var/run/dovecot/lmtp) failed: Read-only file system Jun 28 09:14:37 new-ns1 dovecot: Error: service(ipc): unlink(/usr/var/run/dovecot/ipc) failed: Read-only file system Jun 28 09:14:37 new-ns1 dovecot: Error: service(ipc): unlink(/usr/var/run/dovecot/login/ipc-proxy) failed: Read-only file system Jun 28 09:14:37 new-ns1 dovecot: Error: service(indexer-worker): unlink(/usr/var/run/dovecot/indexer-worker) failed: Read-only file system Jun 28 09:14:37 new-ns1 dovecot: Error: service(indexer): unlink(/usr/var/run/dovecot/indexer) failed: Read-only file system Jun 28 09:14:37 new-ns1 dovecot: Error: service(imap): unlink(/usr/var/run/dovecot/login/imap) failed: Read-only file system Jun 28 09:14:37 new-ns1 dovecot: Error: service(imap): unlink(/usr/var/run/dovecot/imap-master) failed: Read-only file system Jun 28 09:14:37 new-ns1 dovecot: Error: service(imap-urlauth-worker): unlink(/usr/var/run/dovecot/imap-urlauth-worker) failed: Read-only file system Jun 28 09:14:37 new-ns1 dovecot: Error: service(imap-urlauth): unlink(/usr/var/run/dovecot/token-login/imap-urlauth) failed: Read-only file system Jun 28 09:14:37 new-ns1 dovecot: Error: service(imap-urlauth-login): unlink(/usr/var/run/dovecot/imap-urlauth) failed: Read-only file system Jun 28 09:14:37 new-ns1 dovecot: Error: service(imap-hibernate): unlink(/usr/var/run/dovecot/imap-hibernate) failed: Read-only file system Jun 28 09:14:37 new-ns1 dovecot: Error: service(doveadm): unlink(/usr/var/run/dovecot/doveadm-server) failed: Read-only file system Jun 28 09:14:37 new-ns1 dovecot: Error: service(dns-client): unlink(/usr/var/run/dovecot/dns-client) failed: Read-only file system Jun 28 09:14:37 new-ns1 dovecot: Error: service(dns-client): unlink(/usr/var/run/dovecot/login/dns-client) failed: Read-only file system Jun 28 09:14:37 new-ns1 dovecot: Error: service(director): unlink(/usr/var/run/dovecot/director-admin) failed: Read-only file system Jun 28 09:14:37 new-ns1 dovecot: Error: service(director): unlink(/usr/var/run/dovecot/director-userdb) failed: Read-only file system Jun 28 09:14:37 new-ns1 dovecot: Error: service(dict): unlink(/usr/var/run/dovecot/dict) failed: Read-only file system Jun 28 09:14:37 new-ns1 dovecot: Error: service(dict-async): unlink(/usr/var/run/dovecot/dict-async) failed: Read-only file system Jun 28 09:14:37 new-ns1 dovecot: Error: service(config): unlink(/usr/var/run/dovecot/config) failed: Read-only file system Jun 28 09:14:37 new-ns1 dovecot: Error: service(auth): unlink(/usr/var/run/dovecot/login/login) failed: Read-only file system Jun 28 09:14:37 new-ns1 dovecot: Error: service(auth): unlink(/usr/var/run/dovecot/token-login/tokenlogin) failed: Read-only file system Jun 28 09:14:37 new-ns1 dovecot: Error: service(auth): unlink(/usr/var/run/dovecot/auth-login) failed: Read-only file system Jun 28 09:14:37 new-ns1 dovecot: Error: service(auth): unlink(/usr/var/run/dovecot/auth-client) failed: Read-only file system Jun 28 09:14:37 new-ns1 dovecot: Error: service(auth): unlink(/usr/var/run/dovecot/auth-userdb) failed: Read-only file system Jun 28 09:14:37 new-ns1 dovecot: Error: service(auth): unlink(/usr/var/run/dovecot/auth-master) failed: Read-only file system Jun 28 09:14:37 new-ns1 dovecot: Error: service(auth-worker): unlink(/usr/var/run/dovecot/auth-worker) failed: Read-only file system Jun 28 09:14:37 new-ns1 dovecot: Error: service(anvil): unlink(/usr/var/run/dovecot/anvil) failed: Read-only file system Jun 28 09:14:37 new-ns1 dovecot: Error: service(anvil): unlink(/usr/var/run/dovecot/anvil-auth-penalty) failed: Read-only file system Jun 28 09:14:37 new-ns1 dovecot: Fatal: Failed to start listeners Jun 28 09:14:37 new-ns1 systemd: dovecot.service: main process exited, code=exited, status=89/n/a Jun 28 09:14:37 new-ns1 systemd: Unit dovecot.service entered failed state. Jun 28 09:14:37 new-ns1 systemd: dovecot.service failed. What did I miss here ?

4 5

Dovecot mailing list and DKIM
by Kevin N. 28 Jun '21

28 Jun '21

Hello everybody, Going through my mail logs I noticed that a couple of messages from the Dovecot mailing list failed DKIM validation. For example, this one has failed: https://markmail.org/message/te7tycmpiutw4kia 'opendkim-testkey' shows that the key is OK. The messages in the example comes from yahoo.com, however other messages from yahoo.com, ones that are not sent through the mailing list, are properly validated. The failure is not specific to yahoo.com since a couple of other messages from other domains, sent though the mailing list, also failed DKIM validation. However, the vast majority of the messages from the list properly pass DKIM validation. From what I have read, mailing lists in general do not play very well with DKIM or SPF and the Dovecot mailing list also had some issues with this in the past. With the Dovecot mailing list, I am a bit curious about why the vast majority of the messages from the list pass DKIM validation while a couple of them fail. Does the Dovecot mailing list software alter the message in a way that causes the failure? Or is there something else going on? Any thoughts? Cheers.

4 9

ZLIB/ZSTD Compressed MBOX in Maildir++ layout
by Pedro Ribeiro 28 Jun '21

28 Jun '21

Hello everyone! Our archive namespace is kept in MBOX format with Maildir++ layout due to: * Need to have the email from all users/folders self contained (our base namespace uses MDBOX with single instance storage of attachments) * MBOX/FS layout isn't supported because some folders have messages and subfolders. I'm trying to compress that namespace using zstd/gzip following the informations from Dovecot documentation about the zlib plugin but when the (MBOX/Maildir++) compress and become with .zst/.zstd/.gz suffix (both tested) the system can't read the mailboxes and incorrectly reports the suffix (.zstd/.gz) as a subfolder name (following the Maildir++ file structure). Is there any way to make the MBOX/Maildir++ compatible with the zlib compression? Using Dovecot 2.3.14 on Debian10 Regards. -- Best regards, =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= Pedro Ribeiro Politécnico de Lisboa, Serviços da Presidência Departamento de Sistemas de Informação e Comunicações Phone: +351 210 464 700 (general) / VoIP: 80100 Helpdesk: helpdesk(a)net.ipl.pt / https://www.net.ipl.pt =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

2 5

Problem with Lua notification script since 2.3.15 update
by Ralf Becker 28 Jun '21

28 Jun '21

If the Lua-notifications are enabled, Dovecot imap dies immediately at authentication: Jun 28 09:17:29 imap-login: Info: Login: user=<ralf>, method=PLAIN, rip=172.18.0.12, lip=172.18.0.16, mpid=16, TLS, session=<dDhm9c/FYtqsEgAM> Jun 28 09:17:29 imap(ralf)<16><dDhm9c/FYtqsEgAM>: Panic: file dlua-script.c: line 224 (dlua_script_init): assertion failed: (lua_gettop(script->L) == 0) Jun 28 09:17:29 imap(ralf)<16><dDhm9c/FYtqsEgAM>: Error: Raw backtrace: /usr/lib/dovecot/libdovecot.so.0(backtrace_append+0x41) [0x7f9f537ca5c1] -> /usr/lib/dovecot/libdovecot.so.0(backtrace_get+0x22) [0x7f9f537ca6e2] -> /usr/lib/dovecot/libdovecot.so.0(+0x1070bb) [0x7f9f537d70bb] -> /usr/lib/dovecot/libdovecot.so.0(+0x107157) [0x7f9f537d7157] -> /usr/lib/dovecot/libdovecot.so.0(+0x5bb2b) [0x7f9f5372bb2b] -> /usr/lib/dovecot/libdovecot-lua.so.0(+0x5354) [0x7f9f53311354] -> /usr/lib/dovecot/modules/lib22_push_notification_lua_plugin.so(+0x3842) [0x7f9f532c6842] -> /usr/lib/dovecot/modules/lib20_push_notification_plugin.so(push_notification_driver_init+0x19c) [0x7f9f532d062c] -> /usr/lib/dovecot/modules/lib20_push_notification_plugin.so(+0x846f) [0x7f9f532d246f] -> /usr/lib/dovecot/modules/lib20_push_notification_plugin.so(+0x8b6a) [0x7f9f532d2b6a] -> /usr/lib/dovecot/libdovecot-storage.so.0(hook_mail_user_created+0x211) [0x7f9f539084e1] -> /usr/lib/dovecot/libdovecot-storage.so.0(mail_user_init+0x20b) [0x7f9f5390e80b] -> /usr/lib/dovecot/libdovecot-storage.so.0(mail_storage_service_next_with_session_suffix+0x587) [0x7f9f5390bd57] -> /usr/lib/dovecot/libdovecot-storage.so.0(mail_storage_service_lookup_next+0x53) [0x7f9f5390c4c3] -> dovecot/imap(client_create_from_input+0x180) [0x5626eb18fe40] -> dovecot/imap(+0x3112a) [0x5626eb19012a] -> /usr/lib/dovecot/libdovecot.so.0(+0x8d60e) [0x7f9f5375d60e] -> /usr/lib/dovecot/libdovecot.so.0(+0x8d97b) [0x7f9f5375d97b] -> /usr/lib/dovecot/libdovecot.so.0(+0x8e8be) [0x7f9f5375e8be] -> /usr/lib/dovecot/libdovecot.so.0(connection_input_default+0x15e) [0x7f9f537cef5e] -> /usr/lib/dovecot/libdovecot.so.0(io_loop_call_io+0x6d) [0x7f9f537ed3ed] -> /usr/lib/dovecot/libdovecot.so.0(io_loop_handler_run_internal+0x145) [0x7f9f537eea15] -> /usr/lib/dovecot/libdovecot.so.0(io_loop_handler_run+0x54) [0x7f9f537ed494] -> /usr/lib/dovecot/libdovecot.so.0(io_loop_run+0x40) [0x7f9f537ed600] -> /usr/lib/dovecot/libdovecot.so.0(master_service_run+0x17) [0x7f9f537609e7] -> dovecot/imap(main+0x469) [0x5626eb172c19] -> /lib/x86_64-linux-gnu/libc.so.6(__libc_start_main+0xf3) [0x7f9f535020b3] -> dovecot/imap(_start+0x2e) [0x5626eb172cae] Jun 28 09:17:29 imap(ralf)<16><dDhm9c/FYtqsEgAM>: Fatal: master: service(imap): child 16 killed with signal 6 (core dumps disabled - https://dovecot.org/bugreport.html#coredumps) I use the following Dovecot configuration: # Store METADATA information in a file dovecot-metadata in user's home mail_attribute_dict = file:%h/dovecot-metadata # enable metadata protocol imap { imap_metadata = yes } # add necessary plugins for Lua push notifications mail_plugins = $mail_plugins mail_lua notify push_notification push_notification_lua # Lua notification script and URL of EGroupware push server plugin { push_notification_driver = lua:file=/etc/dovecot/dovecot-push.lua push_lua_url = https://Bearer:secret@boulder.egroupware.org/egroupware/push } The Lua script is available under https://github.com/EGroupware/swoolepush/blob/master/doc/dovecot-push.lua The whole Dovecot configurations is available under https://github.com/EGroupware/build.opensuse.org/tree/master/server:eGroupW… Dovecot runs in a Ubuntu 20.04 based container and seems to use the correct liblua5.3: root@750978e5c0ee:/# dpkg -l|grep -i lua ii dovecot-lua 2:2.3.15-1+ubuntu20.04 amd64 secure POP3/IMAP server - LUA support ii liblua5.3-0:amd64 5.3.3-1.1ubuntu2 amd64 Shared library for the Lua interpreter version 5.3 ii lua-json 1.3.4-2 all JSON decoder/encoder for Lua ii lua-lpeg:amd64 1.0.2-1 amd64 LPeg library for the Lua language ii lua-socket:amd64 3.0~rc1+git+ac3201d-4 amd64 TCP/UDP socket library for the Lua language Everything was running fine with 2.3.13, have not tried with 2.3.14 yet. Any ideas? Ralf -- Ralf Becker EGroupware GmbH [www.egroupware.org] Handelsregister HRB Kaiserslautern 3587 Geschäftsführer Birgit und Ralf Becker Leibnizstr. 17, 67663 Kaiserslautern, Germany Telefon +49 631 31657-0

3 4

[BUG] doveadm / mail-crypt: Error when setting new password for a user key
by Kevin N. 28 Jun '21

28 Jun '21

Dovecot version: 2.3.14 When setting a new password for a user key you have the option to prompt the user for the old and the new password, instead of providing them as parameters (using -N and -O instead of -n and -o). However, running: doveadm mailbox cryptokey password -u user@domain -N -O produces an error instead of prompting the user for the old and the new password. The error is: password: option requires an argument -- 'O' You can work around this by providing a dummy input for -O which seems to be properly ignored in the end, but it would be nice to not throw any errors since -O should not expect an argument. Regards.

2 5

Support client_id variable expansion
by Eirik Rye 28 Jun '21

28 Jun '21

Hello, We are using imap_id_log='*' (and imap_id_retain=yes) to log user client information to the dovecot logs, and this information is aggregated to give us extra debugging information for customer support. However, as some clients send the ID information pre-login and others send it post-login, the aggregation logic is needlessly complex as we need to correlate the session IDs of the pre-login ID messages in order to determine the correct user. Hoping to simplify this, I wanted to log the client_id variable on logout, in imap_logout_format: imap_logout_format = in=%i out=%o deleted=%{deleted} expunged=%{expunged} trashed=%{trashed} hdr_count=%{fetch_hdr_count} hdr_bytes=%{fetch_hdr_bytes} body_count=%{fetch_body_count} body_bytes=%{fetch_body_bytes} client_id="%{client_id}" However, this only results in the following log being printed: client_id="UNSUPPORTED_VARIABLE_client_id" While examining the source code (login-common/client-common.c), it seems like this could be trivially supported by adding `client_id` to the `login_var_expand_empty_tab` struct, and adding the relevant code to populate this variable to `get_var_expand_table(struct client *client)`. I am willing to write a pull request for this, unless I am missing some obvious reason why expansion of the client's `client_id` field is not supported in the first place? - Eirik

2 1

Re: [Dovecot-news] Dovecot v2.3.15 released
by Daniel J. Luke 28 Jun '21

28 Jun '21

On Jun 21, 2021, at 7:20 AM, Timo Sirainen <timo(a)sirainen.com> wrote: > Here's a new release with some security fixes and quite a lot of other changes as well. > > * Removed support for Lua 5.2. Use version 5.1 or 5.3 instead. Looks like it doesn't want to build w/o lua now. On my MacOS system configure says: checking whether we will be linking in Lua... no ... but after fixing the implicit i_gettimeofday declaration, build fails with: /bin/sh ../../libtool --tag=CC --mode=link gcc -std=gnu99 -g -O2 -fstack-protector-strong -U_FORTIFY_SOURCE -D_FORTIFY_SOURCE=2 -Wall -W -Wmissing-prototypes -Wmissing-declarations -Wpointer-arith -Wchar-subscripts -Wformat=2 -Wbad-function-cast -Wno-duplicate-decl-specifier -Wstrict-aliasing=2 -I/opt/local/include -no-undefined -L/opt/local/lib -o libdict_lua.la libtool: link: ar cru .libs/libdict_lua.a ar: no archive members specified (this doesn't happen with 2.3.14.1) -- Daniel J. Luke

5 7

Backing up per user keys for mailcrypt
by Ben Burk 28 Jun '21

28 Jun '21

I am wondering how I can back up keys for mail users in their password-protected form, without exporting them from `doveadm mailbox cryptokey export`, which requires a password. The goal here is to perform routine backups to keep keys current. Relevant config is as follows: mail_attribute_dict = file:%h/Maildir/dovecot-attributes mail_plugins = $mail_plugins mail_crypt plugin { mail_crypt_curve = secp521r1 mail_crypt_save_version = 2 mail_crypt_require_encrypted_user_key = yes } Am i correct in assuming I should back up the dovecot-attributes file? Are there any ancillary files that need to be backed up as well, such as indexes, to properly read and handle this file? I have viewed the file and it appears there are several keys at play for a single mail user. Do different folders in a users imap space have different encryption keys? Are all of these keys populated in this dovecot-attributes file? Is there any established procedure for restoring keys? Is it as simple as placing the dovecot-attributes file, if that is infact what needs to be backed up beforehand to perform a restore. -- Ben Burk BURK.TECH System Administrator

2 1

Python module for HTTP API
by Michael Ströder 28 Jun '21

28 Jun '21

HI! Can anybody recommend a high-level Python module for accessing doveadm's HTTP API? [1] Ciao, Michael. [1] https://doc.dovecot.org/admin_manual/doveadm_http_api/

3 4

Quota Config With Prefetch Creating Alias Directories
by dovecot＠ptld.com 27 Jun '21

27 Jun '21

Using Dovecot 2.3.8 with Postfix & MySQL on Centos. I have a sql table with account info, email addresses, password, quotas, etc I have another sql table for aliases containing which alias points to what email address. For imap access im using passdb password_query with prefetch. I setup quotas using count and configured postfix to check quotas with check_policy_service before accepting email. Discovered that it wont lookup quotas using prefetch. Added a second userdb so quota request can use user_query instead of the imap password_query prefetch version. userdb { driver = sql args = /etc/dovecot/mysql_quota.include skip = found result_success = return-ok result_failure = return-ok } This worked for existing email addresses in the accounts table. But any email sent to an alias was rejected because user not found. Not by postfix, postfix can see its an alias, but when postfix does check_policy_service dovecot issued the rejection because its not finding the alias in the accounts table per the userdb user_query. I added "result_failure = return-ok" to the userdb so if user_query doesn't find the address postfix is asking to accept mail for, it will fall back on quota default values. Then dovecot isn't forcing the mail to be rejected and postfix knows if its a valid user or alias. This seems to solve the issue, dovecot will return per user quotas or if not found then the global quota and let postfix decided whats a valid address to accept or reject. But now there is a side effect. Every time you ask dovecot for a quota, and if its a first time use of a newly created account dovecot creates the index directories and index files on disk. Because im using result_failure=return-ok which tells dovecot the user was found to prevent aliases from being rejected, dovecot is also creating directories and indexes for those aliases postfix is sending over check_policy_service. First question: Is this the best way to configure dovecot using quota verification for postfix to work will aliases? Second question: How can i prevent directories and indexes being created for non found user (aliases) accounts? Thank you.

2 3

Dovecot v2.3.14.1 released
by Timo Sirainen 24 Jun '21

24 Jun '21

Hi, This is an "important fixes only" release in case you don't want to upgrade to v2.3.15. There is no matching Pigeonhole release - use the same v2.3.14 instead. https://dovecot.org/releases/2.3/dovecot-2.3.14.1.tar.gz <https://dovecot.org/releases/2.3/dovecot-2.3.14.1.tar.gz> https://dovecot.org/releases/2.3/dovecot-2.3.14.1.tar.gz.sig <https://dovecot.org/releases/2.3/dovecot-2.3.14.1.tar.gz.sig> Binary packages in https://repo.dovecot.org/ <https://repo.dovecot.org/> Docker images in https://hub.docker.com/r/dovecot/dovecot <https://hub.docker.com/r/dovecot/dovecot> * CVE-2021-29157: Dovecot does not correctly escape kid and azp fields in JWT tokens. This may be used to supply attacker controlled keys to validate tokens, if attacker has local access. * CVE-2021-33515: On-path attacker could have injected plaintext commands before STARTTLS negotiation that would be executed after STARTTLS finished with the client. - lib-index: Corrupted mime.parts in dovecot.index.cache may have resulted in Panic: file imap-bodystructure.c: line 206 (part_write_body): assertion failed: (text == ((part->flags & MESSAGE_PART_FLAG_TEXT) != 0)) - imap: SETMETADATA could not be used to unset metadata values. Instead NIL was handled as a "NIL" string. v2.3.14 regression.

3 4

Dovecot v2.3.15 released
by Timo Sirainen 23 Jun '21

23 Jun '21

Hi, Here's a new release with some security fixes and quite a lot of other changes as well. https://dovecot.org/releases/2.3/dovecot-2.3.15.tar.gz <https://dovecot.org/releases/2.3/dovecot-2.3.15.tar.gz> https://dovecot.org/releases/2.3/dovecot-2.3.15.tar.gz.sig <https://dovecot.org/releases/2.3/dovecot-2.3.15.tar.gz.sig> Binary packages in https://repo.dovecot.org/ <https://repo.dovecot.org/> Docker images in https://hub.docker.com/r/dovecot/dovecot <https://hub.docker.com/r/dovecot/dovecot> * CVE-2021-29157: Dovecot does not correctly escape kid and azp fields in JWT tokens. This may be used to supply attacker controlled keys to validate tokens, if attacker has local access. * CVE-2021-33515: On-path attacker could have injected plaintext commands before STARTTLS negotiation that would be executed after STARTTLS finished with the client. * Disconnection log messages are now more standardized across services. They also always now start with "Disconnected" prefix. * Dovecot now depends on libsystemd for systemd integration. * Removed support for Lua 5.2. Use version 5.1 or 5.3 instead. * config: Some settings are now marked as "hidden". It's discouraged to change these settings. They will no longer be visible in doveconf output, except if they have been changed or if doveconf -s parameter is used. See https://doc.dovecot.org/settings/advanced/ for details. * imap-compress: Compression level is now algorithm specific. See https://doc.dovecot.org/settings/plugin/compress-plugin/ * indexer-worker: Convert "Indexed" info logs to an event named "indexer_worker_indexing_finished". See https://doc.dovecot.org/admin_manual/list_of_events/#indexer-worker-indexin… + Add TSLv1.3 support to min_protocols. + Allow configuring ssl_cipher_suites. (for TLSv1.3+) + acl: Add acl_ignore_namespace setting which allows to entirely ignore ACLs for the listed namespaces. + imap: Support official RFC8970 preview/snippet syntax. Old methods of retrieving preview information via IMAP commands ("SNIPPET and PREVIEW with explicit algorithm selection") have been deprecated. + imapc: Support INDEXPVT for imapc storage to enable private message flags for cluster wide shared mailboxes. + lib-storage: Add new events: mail_opened, mail_expunge_requested, mail_expunged, mail_cache_lookup_finished. See https://doc.dovecot.org/admin_manual/list_of_events/#mail + zlib, imap-compression, fs-compress: Support compression levels that the algorithm supports. Before, we would allow hardcoded value between 1 to 9 and would default to 6. Now we allow using per-algorithm value range and default to whatever default the algorithm specifies. - *-login: Commands pipelined together with and just after the authenticate command cause these commands to be executed twice. This applies to all protocols that involve user login, which currently comprises of imap, pop3, submisision and managesieve. - *-login: Processes are supposed to disconnect the oldest non-logged in connection when process_limit was reached. This didn't actually happen with the default "high-security mode" (with service_count=1) where each connection is handled by a separate process. - *-login: When login process reaches client/process limits, oldest client connections are disconnected. If one of these was still doing anvil lookup, this caused a crash. This could happen only if the login process limits were very low or if the server was overloaded. - Fixed building with link time optimizations (-flto). - auth: Userdb iteration with passwd driver does not always return all users with some nss drivers. - dsync: Shared INBOX not synced when "mail_shared_explicit_inbox" was disabled. If a user has a shared mailbox which is another user's INBOX, dsync didn't include the mailbox in syncing unless explicit naming is enabled with "mail_shared_explicit_inbox" set to "yes". - dsync: Shared namespaces were not synced with "-n" flag. - dsync: Syncing shared INBOX failed if mail_attribute_dict was not set. If a user has a shared mailbox that is another user's INBOX, dsync failed to export the mailbox if mail attributes are disabled. - fts-solr, fts-tika: Using both Solr FTS and Tika may have caused HTTP requests to assert-crash: Panic: file http-client-request.c: line 1232 (http_client_request_send_more): assertion failed: (req->payload_input != NULL) - fts-tika: 5xx errors returned by Tika server as indexing failures. However, Tika can return 5xx for some attachments every time. So the 5xx error should be retried once, but treated as success if it happens on the retry as well. v2.3 regression. - fts-tika: v2.3.11 regression: Indexing messages with fts-tika may have resulted in Panic: file message-parser.c: line 802 (message_parser_deinit_from_parts): assertion failed: (ctx->nested_parts_count == 0 || i_stream_have_bytes_left(ctx->input)) - imap: SETMETADATA could not be used to unset metadata values. Instead NIL was handled as a "NIL" string. v2.3.14 regression. - imap: IMAP BINARY FETCH crashes at least on empty base64 body: Panic: file index-mail-binary.c: line 358 (blocks_count_lines): assertion failed: (block_count == 0 || block_idx+1 == block_count) - imap: If IMAP client using the NOTIFY command was disconnected while sending FETCH notifications to the client, imap could crash with Panic: Trying to close mailbox INBOX with open transactions. - imap: Using IMAP COMPRESS extension can cause IMAP connection to hang when IMAP commands are >8 kB long. - imapc: If remote server sent BYE but didn't immediately disconnect, it could cause infinite busy-loop. - lib-index: Corrupted cache record size in dovecot.index.cache file could have caused a crash (segfault) when accessing it. - lib-oauth2: JWT token time validation now works correctly with 32-bit systems. - lib-ssl-iostream: Checking hostnames against an SSL certificate was case-sensitive. - lib-storage: Corrupted mime.parts in dovecot.index.cache may have resulted in Panic: file imap-bodystructure.c: line 206 (part_write_body): assertion failed: (text == ((part->flags & MESSAGE_PART_FLAG_TEXT) != 0)) - lib-storage: Index rebuilding (e.g. via doveadm force-resync) didn't preserve the "hdr-pop3-uidl" header. Because of this, the next pop3 session could have accessed all of the emails' metadata to read their POP3 UIDL (opening dbox files). - listescape: When using the listescape plugin and a shared namespace the plugin didn't work properly anymore resulting in errors like: "Invalid mailbox name: Name must not have '/' character." - lmtp: Connection crashes if connection gets disconnected due to multiple bad commands and the last bad command is BDAT. - lmtp: The Dovecot-specific LMTP parameter XRCPTFORWARD was blindly forwarded by LMTP proxy without checking that the backend has support. This caused a command parameter error from the backend if it was running an older Dovecot release. This could only occur in more complex setups where the message was proxied twice; when the proxy generated the XRCPTFORWARD parameter itself the problem did not occur, so this only happened when it was forwarded. - lmtp: The LMTP proxy crashes with a panic when the remote server replies with an error while the mail is still being forwarded through a DATA/BDAT command. - lmtp: Username may have been missing from lmtp log line prefixes when it was performing autoexpunging. - master: Dovecot would incorrectly fail with haproxy 2.0.14 service checks. - master: Systemd service: Dovecot announces readiness for accepting connections earlier than it should. The following environment variables are now imported automatically and can be omitted from import_environment setting: NOTIFY_SOCKET LISTEN_FDS LISTEN_PID. - master: service { process_min_avail } was launching processes too slowly when master was forking a lot of processes. - util: Make the health-check.sh example script POSIX shell compatible.

4 4

Quota warning script is never sent when reverse=yes
by Jesús Ángel del Pozo Domínguez 23 Jun '21

23 Jun '21

Hi there, I set up Dovecot to call a quota warning script: plugin { quota_warning = storage=100%% quota-warning 100 %u quota_warning2 = storage=95%% quota-warning 95 %u quota_warning3 = storage=80%% quota-warning 80 %u quota_warning4 = -storage=100%% quota-warning below %u } The script is called whenever the quota exceeds the corresponding amount (80%, 95% and 100%). However, on deleting messages to free space, the script is not being called even though the quota drops below 100%. I have manually tested the script, and it works: $ /usr/local/bin/quota-warning.sh below user(a)foo.bar Could you please give me any hint to fix this. I would like to call the quota-warning script so that I can clear the over_quota_flag field in the database. Regards,

1 0

ssl_min_protocol v2.3.15
by Theo Pannen 23 Jun '21

23 Jun '21

Hello, it seems that the default value for ssl_min_protocol has changed from TLSv1 to TLSv1.2, right? After upgrading to v2.3.15 and with ssl_min_protocol commented out, the server no longer offers TLSv1 and TLSv1.1. This is a good idea, but should be documented. Theo

2 1

CVE-2021-33515: SMTP Submission service STARTTLS injection
by Timo Sirainen 22 Jun '21

22 Jun '21

Open-Xchange Security Advisory 2021-06-21 Product: Dovecot Vendor: OX Software GmbH Internal reference: DOV-4583 (Bug ID) Vulnerability type: CWE-74: Failure to Sanitize Data into a Different Plane ('Injection') Vulnerable version: 2.3.0-2.3.14 Vulnerable component: submission Report confidence: Confirmed Solution status: Fixed by Vendor Fixed version: 2.3.14.1 Vendor notification: 2021-05-21 Solution date: 2021-05-22 Public disclosure: 2021-06-21 CVE reference: CVE-2021-33515 CVSS: 4.2 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N) Researcher credit: Fabian Ising and Damian Poddebniak of Münster University of Applied Sciences Vulnerability Details: On-path attacker could inject plaintext commands before STARTTLS negotiation that would be executed after STARTTLS finished with the client. Only the SMTP submission service is affected. Risk: Attacker can potentially steal user credentials and mails. The attacker needs to have sending permissions on the submission server (a valid username and password). Workaround: None. Solution: Operators should update to 2.3.14.1 or later version.

3 3

Dovecot deliver and imap process hangs
by Rok Saksida 22 Jun '21

22 Jun '21

Hello. Dovecot version: 2.2.36 OS: CentOS Linux release 7.9.2009 (Core) Kernel: 3.10.0-1160.11.1.el7.x86_64 I have two dovecot servers in replication master/master. Sometimes happens that deliver or imap process hangs and causing high CPU usage. In log's I only see locking failures but not initial cause why this happened. For mail storage I use ZFS pool with compression enabled. I made some digging and find this option: mmap_disable = yes. I will try this setting today evening. But I wondering if you have any idea why this happening and how to start solving this problems? Is there any additional setting like mmap_disable that can help solved this issues? -- BR

1 0

Upgrade path
by Andrea Gabellini 22 Jun '21

22 Jun '21

Hello, I have a configuration with two proxy/director and two backend with replication. All at version 2.3.10.1. What is the suggested upgrade path to 2.3.15? I think to switch traffic to only one proxy and one backend and upgrade the two servers that remain without traffic. Then I switch the traffic to these upgraded servers and proceed with the upgrade of the others two. Is this correct? Or is best to upgrade first the two proxy/director and next the two backend? Thanks, Andrea -- __________________________ Business is like riding a bicycle. Either you keep moving or you fall down. __________________________ TIM San Marino S.p.A. Andrea Gabellini Engineering R&D TIM San Marino S.p.A. - https://www.telecomitalia.sm Via Ventotto Luglio, 212 - Piano -2 47893 - Borgo Maggiore - Republic of San Marino Tel: (+378) 0549 886237 Fax: (+378) 0549 886188 -- Informativa Privacy Questa email ha per destinatari dei contatti presenti negli archivi di TIM San Marino S.p.A.. Tutte le informazioni vengono trattate e tutelate nel rispetto della normativa vigente sulla protezione dei dati personali (Reg. EU 2016/679). Per richiedere informazioni e/o variazioni e/o la cancellazione dei vostri dati presenti nei nostri archivi potete inviare una email a privacy(a)telecomitalia.sm. Avviso di Riservatezza Il contenuto di questa e-mail e degli eventuali allegati e' strettamente confidenziale e destinato alla/e persona/e a cui e' indirizzato. Se avete ricevuto per errore questa e-mail, vi preghiamo di segnalarcelo immediatamente e di cancellarla dal vostro computer. E' fatto divieto di copiare e divulgare il contenuto di questa e-mail. Ogni utilizzo abusivo delle informazioni qui contenute da parte di persone terze o comunque non indicate nella presente e-mail potra' essere perseguito ai sensi di legge.

1 0

CVE-2021-29157: oauth2 JWT local validation path traversal
by Timo Sirainen 21 Jun '21

21 Jun '21

Open-Xchange Security Advisory 2021-06-21 Product: Dovecot Vendor: OX Software GmbH Internal reference: DOV-4476 (Bug ID) Vulnerability type: CWE-24: Path Traversal: '../filedir' Vulnerable version: 2.3.11-2.3.14 Vulnerable component: imap, pop3, submission, managesieve Report confidence: Confirmed Solution status: Fixed by Vendor Fixed version: 2.3.14.1 Vendor notification: 2021-03-22 Solution date: 2021-04-14 Public disclosure: 2021-06-21 CVE reference: CVE-2021-29157 CVSS: 6.7 (CVSS3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N) Researcher credit: Kirin of Tencent Security Xuanwu Lab Vulnerability Details: Dovecot does not correctly escape kid and azp fields in JWT tokens. This may be used to supply attacker controlled keys to validate tokens in some configurations. This requires attacker to be able to write files to local disk. Risk: Local attacker can login as any user and access their emails. Workaround: Disable local JWT validation in oauth2, or use a different dict driver than fs:posix. Solution: Operators should update to 2.3.14.1 or later version.

1 0

CVE-2020-28200: Sieve excessive resource usage
by Timo Sirainen 21 Jun '21

21 Jun '21

Open-Xchange Security Advisory 2021-06-21 Product: Dovecot Vendor: OX Software GmbH Internal reference: DOV-4159 (Bug ID) Vulnerability type: CWE-400 Vulnerable version: 1.2.0-2.3.14 Vulnerable component: lmtp, lda Report confidence: Confirmed Solution status: Fixed by Vendor Fixed version: 2.3.15 Vendor notification: 2020-09-23 Solution date: 2020-12-07 Public disclosure: 2021-06-21 CVE reference: CVE-2020-28200 CVSS: 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) Researcher credit: Innokentii Sennovskii from BI.ZONE Vulnerability Details: Sieve interpreter is not protected against abusive scripts that claim excessive resource usage. Especially scripts using massive amounts of regexps. Risk: Attacker can DoS the mail delivery system by using excessive amount of CPU and/or reaching the lmtp/lda process limits. Workaround: Disabling the regex sieve extension avoids the worst problems. lmtp_user_concurrency_limit may also be helpful. Solution: Operators should update to 2.3.15 or later version.

1 0

Pigeonhole v0.5.15 released
by Timo Sirainen 21 Jun '21

21 Jun '21

Hi, Pigeonhole release for Dovecot v2.3.15. One thing we noticed a bit before release is that if you're using imap_sieve_filter plugin, the IMAP FILTER command may trigger the new excessive resource usage check since it can be processing many messages rapidly. You may want to prevent this with protocol imap { sieve_max_cpu_time=0 } https://pigeonhole.dovecot.org/releases/2.3/dovecot-2.3-pigeonhole-0.5.15.t… <https://pigeonhole.dovecot.org/releases/2.3/dovecot-2.3-pigeonhole-0.5.15.t…> https://pigeonhole.dovecot.org/releases/2.3/dovecot-2.3-pigeonhole-0.5.15.t… <https://pigeonhole.dovecot.org/releases/2.3/dovecot-2.3-pigeonhole-0.5.15.t…> Binary packages in https://repo.dovecot.org/ <https://repo.dovecot.org/> Docker images in https://hub.docker.com/r/dovecot/dovecot <https://hub.docker.com/r/dovecot/dovecot> * CVE-2020-28200: Sieve interpreter is not protected against abusive scripts that claim excessive resource usage. Fixed by limiting the user CPU time per single script execution and cumulatively over several script runs within a configurable timeout period. Sufficiently large CPU time usage is summed in the Sieve script binary and execution is blocked when the sum exceeds the limit within that time. The block is lifted when the script is updated after the resource usage times out. * Disconnection log messages are now more standardized across services. They also always now start with "Disconnected" prefix. - managesieve: Commands pipelined together with and just after the authenticate command cause these commands to be executed twice.

1 0

error: "The certificate is empty"
by A. Schulze 18 Jun '21

18 Jun '21

Hello, on a farm of multiple identical dovecot servers I start seeing this error on usual POP3S access on one of many servers: pop3-login: Error: Failed to initialize SSL server context: Can't load SSL certificate (ssl_cert setting): The certificate is empty: I'm running 2.3.14 compiled against openssl-1.1.1k on Debian Buster Looks like it's this code: https://github.com/dovecot/core/blob/a5209c83c3a82386c94d466eec5fea394973e8… called from here: https://github.com/dovecot/core/blob/a5209c83c3a82386c94d466eec5fea394973e8… To me it /looks/ like a resource problem. The farm handle a million pop3 sessions per hour while only 50k (5%) are using TLS. The farm is up and running since ~2 weeks. When started, the automatic deployment *did* check that pop3s was working well. Also today on all farmservers the certificate file is valid, contain expected content. the server is currently offline but not restarted to allow further investigation. the setup is quite normal just checked over all Farmservers: - doveconf | grep ssl | sha256sum - sha256sum $( doveconf | grep 'ssl_cert = <' | awk -F\< '{ print $2 }' ) the output is identical. Any idea is appreciated ... Andreas

1 0

Maildir to Mdbox and folder structure after the conversion
by Marco Usai 18 Jun '21

18 Jun '21

Using the dsync command I've converted a Dovecot mail folder from Maildir to Mdbox format. (see https://dovecot.org/pipermail/dovecot/2021-June/122304.html) The folder resulting from the conversion (see https://pastebin.com/6U4CDTQi ), however, has a completely different directory structure from the one used by the destination server where it will be transferred (see https://pastebin.com/nMEvqmqp ) What do I have to do to make the folder obtained after the conversion have a directory structure identical to the one used by the destination server ? Thank You.

3 4