- dovecot - dovecot.org

Replication issue: cannot delete or rename folders
by ppq＠tuta.io 15 Jan '21

15 Jan '21

Hi all, I'm trying to replace a shared NFS (rock solid, btw) with a replicated two-node setup. However I've been struggling with an issue connected in some way with the replication between the two servers (master-master). The issue is once a folder (say "aaa") is created one one account, it cannot be renamed or deleted. If deleted, it will instantly reappear (when replication is running) or when renamed to "bbb", the operation will fail with an error like the one below: Jan 15 18:21:22 ms1 dovecot: dsync-local(test2(a)mydomain.ext)<JtJJARLPAWBPJAAAxdOQ8Q>: Error: rename(/var/vmail-local/mydomain.ext/test2/idx/.bbb <http://mydomain.ext/test2/idx/.bbb>, /var/vmail-local/mydomain.ext/test2/idx/.aaa <http://mydomain.ext/test2/idx/.aaa>) failed: Directory not empty Jan 15 18:21:22 ms1 dovecot: dsync-local(test2(a)mydomain.ext)<JtJJARLPAWBPJAAAxdOQ8Q>: Error: rename(/var/vmail-local/mydomain.ext/test2/idx/.bbb <http://mydomain.ext/test2/idx/.bbb>, /var/vmail-local/mydomain.ext/test2/idx/.aaa <http://mydomain.ext/test2/idx/.aaa>) failed: Directory not empty I can see that the index directory contains both the .aaa and .bbb index directories with dovecot.log files inside. If I stop the one of the nodes all works nicely and I can create, delete and rename folders at will. My setup is as below. dovecot --version -> 2.3.4.1 (f79e8e7e4) the indexes are in a separate directory on /var/vmail-local/ (performance reasons). the mail spool is mounted on /var/vmail/ One node has local disks for everything. It runs with mmap_disable=no, mail_fsync=optimized, mail_nfs_storage=no, mail_nfs_index=no The other node has an NFS based /var/vmail/ and local disks for indexes. On this node I'm using the following settings: mmap_disable=yes, mail_fsync=always, mail_nfs_storage=yes, mail_nfs_index=no The nfs server is v4 The two servers are "orchestrated" by a two-node director cluster. I'm sure I'm missing or misconfigured something. The doveconf -n config is, part from the NFS quick, the same on both nodes as follows: -------- # 2.3.4.1 (f79e8e7e4): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.4 () doveconf: Warning: service auth { client_limit=1000 } is lower than required under max. load (2012) doveconf: Warning: service anvil { client_limit=1000 } is lower than required under max. load (1515) # OS: Linux 5.4.78-2-pve x86_64 Debian 10.7 # Hostname: dovecot1.mydomain.ext auth_master_user_separator = + auth_mechanisms = plain login default_process_limit = 500 disable_plaintext_auth = no doveadm_password = # hidden, use -P to show it doveadm_port = 12727 imap_capability = +SPECIAL-USE XLIST listen = *,[::] lmtp_rcpt_check_quota = yes log_timestamp = "%Y-%m-%d %H:%M:%S " login_trusted_networks = 172.16.20.0/24 172.16.30.0/24 mail_fsync = always mail_max_userip_connections = 100 mail_nfs_storage = yes mail_plugins = quota notify replication lazy_expunge acl mail_privileged_group = vmail mmap_disable = yes namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox EXPUNGED { autoexpunge = 1 days autoexpunge_max_mails = 20 } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = separator = . } passdb { args = /etc/dovecot/dovecot-sql.conf driver = sql } passdb { args = /etc/dovecot/master-users driver = passwd-file master = yes result_success = continue } passdb { driver = pam } plugin { acl = vfile:/etc/dovecot/dovecot.acl lazy_expunge = EXPUNGED mail_replica = tcp:172.16.30.100:12727 quota = dict:user::file:/var/vmail/%d/%n/.quotausage quota_rule = EXPUNGED:ignore quota_status_nouser = DUNNO quota_status_overquota = 552 5.2.2 Mailbox is full quota_status_success = DUNNO sieve = /var/vmail/%d/%n/.sieve sieve_after = /var/vmail/%d/%n/.ispconfig.sieve sieve_before = /var/vmail/%d/%n/.ispconfig-before.sieve sieve_max_actions = 100 sieve_max_redirects = 25 sieve_max_script_size = 2M } protocols = imap pop3 lmtp service aggregator { fifo_listener replication-notify-fifo { group = root mode = 0660 user = vmail } unix_listener replication-notify { group = root mode = 0660 user = vmail } } service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0660 user = postfix } unix_listener auth-userdb { group = vmail mode = 0600 user = vmail } user = root } service doveadm { inet_listener { port = 12727 } } service imap-login { client_limit = 1000 process_limit = 512 } service lmtp { inet_listener lmtp { port = 24 } unix_listener /var/spool/postfix/private/dovecot-lmtp { group = postfix mode = 0600 user = postfix } } service quota-status { client_limit = 1 executable = quota-status -p postfix unix_listener /var/spool/postfix/private/quota-status { group = postfix mode = 0660 user = postfix } } service replicator { process_min_avail = 1 unix_listener replicator-doveadm { mode = 0600 user = vmail } } service stats { unix_listener stats-reader { group = vmail mode = 0660 user = vmail } unix_listener stats-writer { group = vmail mode = 0660 user = vmail } } ssl = required ssl_cert = </etc/letsencrypt/live/mail.mydomain.ext/fullchain.pem <http://mail.mydomain.ext/fullchain.pem> ssl_dh = # hidden, use -P to show it ssl_key = # hidden, use -P to show it userdb { driver = prefetch } userdb { args = /etc/dovecot/dovecot-sql.conf driver = sql } userdb { driver = passwd } protocol imap { auth_verbose = yes mail_plugins = quota imap_quota notify replication lazy_expunge acl } protocol pop3 { auth_verbose = yes mail_plugins = quota notify replication lazy_expunge acl pop3_uidl_format = %08Xu%08Xv } protocol lda { mail_plugins = sieve quota notify replication lazy_expunge acl postmaster_address = postmaster(a)dovecot1.mydomain.ext } protocol lmtp { mail_plugins = quota sieve notify replication lazy_expunge acl postmaster_address = postmaster(a)dovecot1.mydomain.ext } -------------- My sql config is this: --- password_query = SELECT email as user, password, maildir as userdb_home, CONCAT( maildir_format, ':', maildir, '/', IF(maildir_format='maildir','Maildir',maildir_format)) as userdb_mail, uid as userdb_uid, gid as userdb_gid, CONCAT('*:storage=', quota, 'B') AS userdb_quota_rule, CONCAT(maildir, '/.sieve') as userdb_sieve FROM mail_user WHERE (login = '%u' OR email = '%u') AND `disable%Ls` = 'n' AND server_id = '20' AND EXISTS (SELECT domain_id FROM mail_domain WHERE domain = '%d' AND active = 'y' AND server_id = 20) user_query = SELECT email as user, maildir as home, CONCAT( maildir_format, ':', maildir, '/', IF(maildir_format='maildir','Maildir',maildir_format),':INDEX=/var/vmail-local/%d/%n/idx') as mail, uid, gid, CONCAT('*:storage=', quota, 'B') AS quota_rule, CONCAT(maildir, '/.sieve') as sieve FROM mail_user WHERE (login = '%u' OR email = '%u') AND `disable%Ls` = 'n' AND server_id = '20' --- Best regards,Dave

1 0

doveadm, userdb, and ssl=any-cert
by Felipe Gasper 15 Jan '21

15 Jan '21

Hello, We have a server that answers userdb queries for Dovecot. As of 2.3.11 we’re finding that if proxying fields like `ssl=any-cert` are in a userdb response for doveadm, then doveadm complains about not recognizing that field, e.g.: ----- doveadm(_mainaccount(a)xferme.tld): Error: User lookup failed: Invalid settings in userdb: Invalid userdb input 'ssl=any-cert': Invalid value: any-cert doveadm(_mainaccount(a)xferme.tld): Warning: Event 0x55a3f911b9c0 leaked (parent=(nil)): mail-storage-service.c:1335 ----- We can avoid sending this field in response when doveadm is the requesting service, but was this apparent change in 2.3.11 intended? Thank you! cheers, -Felipe Gasper

1 0

Authentication segfault with Dovecot 2.3.13
by Harald Leithner 14 Jan '21

14 Jan '21

Hi, we have a problem upgrading Dovecot from 2.2 to 2.3.13 on one server it seems one user triggers a segfault while trying to authenticate. The user works fine with 2.2.36.4, our last update try mid-late 2020 was aborted because of this reason. While debugging the problem we noticed that the "auth_debug_passwords = no" option doesn't work at least in our logfiles are the passwords logged. We replaced the password in the log with "THIS_SHOULD_NOT_GET_LOGGED" and the user part with "user@redacted". The user uses APOP for authentication, but other users login successfully with APOP. Here is a stacktrace and a log dump: Jan 6 16:29:44 mail kernel: auth[2208397]: segfault at ec ip 00007f67fc147174 sp 00007ffeed993150 error 4 in libdovecot.so.0.0.0[7f67fc06e000+fc000] Jan 6 16:29:44 mail kernel: Code: 1f 80 00 00 00 00 41 54 e8 79 fd ff ff 31 f6 49 89 c4 48 89 c7 31 c0 e8 ca f8 ff ff 4c 89 e0 41 5c c3 0f 1f 40 00 53 48 89 fb <f6> 87 ec 00 00 00 04 75 43 48 83 3d 7b aa 0a 00 00 0f 85 50 15 f4 Jan 6 16:29:44 mail systemd[1]: Started Process Core Dump (PID 2208677/UID 0). Jan 6 16:29:44 mail systemd-coredump[2208678]: Process 2208397 (auth) of user 489 dumped core.#012#012Stack trace of thread 2208397:#012#0 0x00007f67fc147174 event_create_passthrough (libdovecot.so.0 + 0x116174)#012#1 0x0000555678812d6e auth_request_finished_event (auth + 0x1bd6e)#012#2 0x00005556788159ae auth_request_log_finished (auth + 0x1e9ae)#012#3 0x0000555678816ee0 n/a (auth + 0x1fee0)#012#4 0x0000555678826dc1 passdb_handle_credentials (auth + 0x2fdc1)#012#5 0x0000555678816c7e n/a (auth + 0x1fc7e)#012#6 0x0000555678824f27 n/a (auth + 0x2df27)#012#7 0x000055567881b02d auth_request_handler_auth_begin (auth + 0x2402d)#012#8 0x000055567880dfaf n/a (auth + 0x16faf)#012#9 0x00007f67fc143a79 io_loop_call_io (libdovecot.so.0 + 0x112a79)#012#10 0x00007f67fc144ae2 io_loop_handler_run_internal (libdovecot.so.0 + 0x113ae2)#012#11 0x00007f67fc143b21 io_loop_handler_run (libdovecot.so.0 + 0x112b21)#012#12 0x00007f67fc143ce0 io_loop_run (libdovecot.so.0 + 0x112ce0)#012#13 0x00007f67fc0b96f3 master_service_run (libdovecot.so.0 + 0x886f3)#012#14 0x000055567880c2db main (auth + 0x152db)#012#15 0x00007f67fbc9d042 __libc_start_main (libc.so.6 + 0x27042)#012#16 0x000055567880c48e _start (auth + 0x1548e) Jan 6 16:29:44 mail dovecot[2208071]: auth: Debug: client in: AUTH#011134#011PLAIN#011service=imap#011session=tgog/jy4erm5j7ZO#011lip=lan-ip#011rip=client-ip#011lport=143#011rport=47482 Jan 6 16:29:44 mail dovecot[2208071]: auth: Debug: client passdb out: CONT#011134 Jan 6 16:29:44 mail dovecot[2208071]: auth: Debug: client in: CONT<hidden> Jan 6 16:29:44 mail dovecot[2208071]: auth: Debug: sql(user@redacted,client-ip,<tgog/jy4erm5j7ZO>): Performing passdb lookup Jan 6 16:29:44 mail dovecot[2208071]: auth: Debug: sql(user@redacted,client-ip,<tgog/jy4erm5j7ZO>): cache expired Jan 6 16:29:44 mail dovecot[2208071]: auth-worker(2208404): Debug: conn unix:auth-worker (pid=2208397,uid=489): auth-worker<229>: Handling PASSV request Jan 6 16:29:44 mail dovecot[2208071]: auth-worker(2208404): Debug: conn unix:auth-worker (pid=2208397,uid=489): auth-worker<229>: sql(user@redacted,client-ip,<tgog/jy4erm5j7ZO>): Performing passdb lookup Jan 6 16:29:44 mail dovecot[2208071]: auth-worker(2208404): Debug: conn unix:auth-worker (pid=2208397,uid=489): auth-worker<229>: sql(user@redacted,client-ip,<tgog/jy4erm5j7ZO>): query: SELECT passwd as password, '127.0.0.1' as host, userid as destuser, passwd AS pass, 'Y' AS nologin, 'Y' AS nodelay, 'Y' AS proxy FROM dbmail_users WHERE userid='user@redacted' UNION (SELECT password as password, '127.0.0.1' as host, username as destuser, password AS pass, 'Y' AS nologin, 'Y' AS nodelay, 'Y' AS proxy FROM sasl_fake_auth WHERE username='user@redacted') limit 1; Jan 6 16:29:44 mail dovecot[2208071]: auth-worker(2208404): conn unix:auth-worker (pid=2208397,uid=489): auth-worker<229>: sql(user@redacted,client-ip,<tgog/jy4erm5j7ZO>): Password mismatch Jan 6 16:29:44 mail dovecot[2208071]: auth-worker(2208404): Debug: conn unix:auth-worker (pid=2208397,uid=489): auth-worker<229>: sql(user@redacted,client-ip,<tgog/jy4erm5j7ZO>): Finished passdb lookup Jan 6 16:29:44 mail dovecot[2208071]: auth-worker(2208404): Debug: conn unix:auth-worker (pid=2208397,uid=489): auth-worker<229>: Finished Jan 6 16:29:44 mail dovecot[2208071]: auth: Debug: sql(user@redacted,client-ip,<tgog/jy4erm5j7ZO>): Finished passdb lookup Jan 6 16:29:44 mail dovecot[2208071]: auth: Debug: auth(user@redacted,client-ip,<tgog/jy4erm5j7ZO>): Auth request finished Jan 6 16:29:44 mail dovecot[2208071]: auth: Debug: client in: AUTH#011443#011APOP#011service=pop3#011secured=tls#011session=n58h/jy4a0i5j7ZO#011lip=lan-ip#011rip=client-ip#011lport=995#011rport=18539#011local_name=mail#011resp=<hidden> Jan 6 16:29:44 mail dovecot[2208071]: auth: Debug: sql(user@redacted,client-ip,<n58h/jy4a0i5j7ZO>): Performing passdb lookup Jan 6 16:29:44 mail dovecot[2208071]: auth: Debug: sql(user@redacted,client-ip,<n58h/jy4a0i5j7ZO>): cache hit: <hidden>#011host=127.0.0.1#011destuser=user@redacted#011pass=THIS_SHOULD_NOT_GET_LOGGED#011nologin=Y#011nodelay=Y#011proxy=Y Jan 6 16:29:44 mail dovecot[2208071]: auth: Debug: sql(user@redacted,client-ip,<n58h/jy4a0i5j7ZO>): Finished passdb lookup Jan 6 16:29:44 mail dovecot[2208071]: auth: Debug: auth(user@redacted,client-ip,<n58h/jy4a0i5j7ZO>): Auth request finished Jan 6 16:29:44 mail dovecot[2208071]: auth: Debug: client passdb out: FAIL#011443#011user=user@redacted#011nodelay#011pass=<hidden>#011nodelay=Y Jan 6 16:29:44 mail dovecot[2208071]: pop3-login: Debug: Ignoring unknown passdb extra field: nodelay Jan 6 16:29:44 mail dovecot[2208071]: pop3-login: Debug: Ignoring unknown passdb extra field: nodelay Jan 6 16:29:44 mail dovecot[2208071]: pop3-login: Disconnected (auth failed, 1 attempts in 0 secs): user=<user@redacted>, client-ip, APOP, TLS, TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) Jan 6 16:29:44 mail dovecot[2208071]: auth-worker(2208404): Debug: conn unix:auth-worker (pid=2208397,uid=489): Disconnected: Connection closed (fd=-1) Jan 6 16:29:44 mail dovecot[2208071]: auth: Fatal: master: service(auth): child 2208397 killed with signal 11 (core dumped)h-worker<1>: Handling PASSV request Jan 6 16:20:05 mail dovecot[2208071]: auth: Debug: client in: AUTH#01179#011PLAIN#011service=imap#011session=QY6V2zy4FUm5j7YD#011lip=lan-ip#011rip=client-ip#011lport=143#011rport=18709 Jan 6 16:20:05 mail dovecot[2208071]: auth: Debug: client passdb out: CONT#01179 Jan 6 16:20:05 mail dovecot[2208071]: auth: Debug: client in: CONT<hidden> Jan 6 16:20:05 mail dovecot[2208071]: auth: Debug: sql(user@redacted,client-ip,<QY6V2zy4FUm5j7YD>): Performing passdb lookup Jan 6 16:20:05 mail dovecot[2208071]: auth: Debug: sql(user@redacted,client-ip,<QY6V2zy4FUm5j7YD>): cache expired Jan 6 16:20:05 mail dovecot[2208071]: auth-worker(2208083): Debug: conn unix:auth-worker (pid=2208074,uid=489): auth-worker<235>: Handling PASSV request Jan 6 16:20:05 mail dovecot[2208071]: auth-worker(2208083): Debug: conn unix:auth-worker (pid=2208074,uid=489): auth-worker<235>: sql(user@redacted,client-ip,<QY6V2zy4FUm5j7YD>): Performing passdb lookup Jan 6 16:20:05 mail dovecot[2208071]: auth-worker(2208083): Debug: conn unix:auth-worker (pid=2208074,uid=489): auth-worker<235>: sql(user@redacted,client-ip,<QY6V2zy4FUm5j7YD>): query: SELECT passwd as password, '127.0.0.1' as host, userid as destuser, passwd AS pass, 'Y' AS nologin, 'Y' AS nodelay, 'Y' AS proxy FROM dbmail_users WHERE userid='user@redacted' UNION (SELECT password as password, '127.0.0.1' as host, username as destuser, password AS pass, 'Y' AS nologin, 'Y' AS nodelay, 'Y' AS proxy FROM sasl_fake_auth WHERE username='user@redacted') limit 1; Jan 6 16:20:05 mail dovecot[2208071]: auth-worker(2208083): conn unix:auth-worker (pid=2208074,uid=489): auth-worker<235>: sql(user@redacted,client-ip,<QY6V2zy4FUm5j7YD>): Password mismatch Jan 6 16:20:05 mail dovecot[2208071]: auth-worker(2208083): Debug: conn unix:auth-worker (pid=2208074,uid=489): auth-worker<235>: sql(user@redacted,client-ip,<QY6V2zy4FUm5j7YD>): Finished passdb lookup Jan 6 16:20:05 mail dovecot[2208071]: auth-worker(2208083): Debug: conn unix:auth-worker (pid=2208074,uid=489): auth-worker<235>: Finished Jan 6 16:20:05 mail dovecot[2208071]: auth: Debug: sql(user@redacted,client-ip,<QY6V2zy4FUm5j7YD>): Finished passdb lookup Jan 6 16:20:05 mail dovecot[2208071]: auth: Debug: auth(user@redacted,client-ip,<QY6V2zy4FUm5j7YD>): Auth request finished Jan 6 16:20:05 mail dovecot[2208071]: auth: Debug: client in: AUTH#011215#011APOP#011service=pop3#011secured=tls#011session=ZJWX2zy4VzO5j7YD#011lip=lan-ip#011rip=client-ip#011lport=995#011rport=13143#011local_name=mail#011resp=<hidden> Jan 6 16:20:05 mail dovecot[2208071]: auth: Debug: sql(user@redacted,client-ip,<ZJWX2zy4VzO5j7YD>): Performing passdb lookup Jan 6 16:20:05 mail dovecot[2208071]: auth: Debug: sql(user@redacted,client-ip,<ZJWX2zy4VzO5j7YD>): cache hit: <hidden>#011host=127.0.0.1#011destuser=user@redacted#011pass=THIS_SHOULD_NOT_GET_LOGGED#011nologin=Y#011nodelay=Y#011proxy=Y Jan 6 16:20:05 mail dovecot[2208071]: auth: Debug: sql(user@redacted,client-ip,<ZJWX2zy4VzO5j7YD>): Finished passdb lookup Jan 6 16:20:05 mail dovecot[2208071]: auth: Debug: auth(user@redacted,client-ip,<ZJWX2zy4VzO5j7YD>): Auth request finished Jan 6 16:20:05 mail dovecot[2208071]: auth: Debug: client passdb out: FAIL#011215#011user=user@redacted#011nodelay#011pass=<hidden>#011nodelay=Y Jan 6 16:20:05 mail dovecot[2208071]: pop3-login: Debug: Ignoring unknown passdb extra field: nodelay Jan 6 16:20:05 mail dovecot[2208071]: pop3-login: Debug: Ignoring unknown passdb extra field: nodelay Jan 6 16:20:05 mail dovecot[2208071]: pop3-login: Disconnected (auth failed, 1 attempts in 0 secs): user=<user@redacted>, client-ip, APOP, TLS, TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) Jan 6 16:20:05 mail dovecot[2208071]: auth-worker(2208083): Debug: conn unix:auth-worker (pid=2208074,uid=489): Disconnected: Connection closed (fd=-1) Jan 6 16:20:05 mail dovecot[2208071]: auth: Fatal: master: service(auth): child 2208074 killed with signal 11 (core dumped) Jan 6 16:20:20 mail dovecot[2208071]: auth: Debug: client in: AUTH#011218#011APOP#011service=pop3#011secured=tls#011session=wXyB3Dy4W0i5j7YD#011lip=lan-ip#011rip=client-ip#011lport=995#011rport=18523#011local_name=mail#011resp=<hidden> Jan 6 16:20:20 mail dovecot[2208071]: auth: Debug: sql(user@redacted,client-ip,<wXyB3Dy4W0i5j7YD>): Performing passdb lookup Jan 6 16:20:20 mail dovecot[2208071]: auth: Debug: sql(user@redacted,client-ip,<wXyB3Dy4W0i5j7YD>): cache hit: <hidden>#011host=127.0.0.1#011destuser=user@redacted#011pass=THIS_SHOULD_NOT_GET_LOGGED#011nologin=Y#011nodelay=Y#011proxy=Y Jan 6 16:20:20 mail dovecot[2208071]: auth: Debug: sql(user@redacted,client-ip,<wXyB3Dy4W0i5j7YD>): Finished passdb lookup Jan 6 16:20:20 mail dovecot[2208071]: auth: Debug: auth(user@redacted,client-ip,<wXyB3Dy4W0i5j7YD>): Auth request finished Jan 6 16:20:20 mail dovecot[2208071]: auth: Debug: client passdb out: FAIL#011218#011user=user@redacted#011nodelay#011pass=<hidden>#011nodelay=Y Jan 6 16:20:20 mail dovecot[2208071]: pop3-login: Debug: Ignoring unknown passdb extra field: nodelay Jan 6 16:20:20 mail dovecot[2208071]: pop3-login: Debug: Ignoring unknown passdb extra field: nodelay Jan 6 16:20:20 mail dovecot[2208071]: pop3-login: Disconnected (auth failed, 1 attempts in 0 secs): user=<user@redacted>, client-ip, APOP, TLS, TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) Jan 6 16:20:20 mail dovecot[2208071]: auth-worker(2208392): Debug: conn unix:auth-worker (pid=2208385,uid=489): Disconnected: Connection closed (fd=-1) Jan 6 16:20:20 mail dovecot[2208071]: auth: Fatal: master: service(auth): child 2208385 killed with signal 11 (core dumped) Any help is appreciated thanks Harald -- ITronic Harald Leithner Wiedner Hauptstraße 120/5.1, 1050 Wien, Austria Tel: +43-1-545 0 604 Mobil: +43-699-123 78 4 78 Mail: leithner(a)itronic.at | itronic.at

4 10

Dovecot v2.3.13 released
by Aki Tuomi 13 Jan '21

13 Jan '21

We are pleased to release v2.3.13. Please find it from locations below: https://dovecot.org/releases/2.3/dovecot-2.3.13.tar.gz https://dovecot.org/releases/2.3/dovecot-2.3.13.tar.gz.sig Binary packages in https://repo.dovecot.org/ Docker images in https://hub.docker.com/r/dovecot/dovecot Aki Tuomi Open-Xchange oy --- * CVE-2020-24386: Specially crafted command can cause IMAP hibernate to allow logged in user to access other people's emails and filesystem information. * Metric filter and global event filter variable syntax changed to a SQL-like format. See https://doc.dovecot.org/configuration_manual/event_filter/ * auth: Added new aliases for %{variables}. Usage of the old ones is possible, but discouraged. * auth: Removed RPA auth mechanism, SKEY auth mechanism, NTLM auth mechanism and related password schemes. * auth: Removed passdb-sia, passdb-vpopmail and userdb-vpopmail. * auth: Removed postfix postmap socket + auth: Added new fields for auth server events. These fields are now also available for all auth events. See https://doc.dovecot.org/admin_manual/list_of_events/#authentication-server for details. + imap-hibernate: Added imap_client_hibernated, imap_client_unhibernated and imap_client_unhibernate_retried events. See https://doc.dovecot.org/admin_manual/list_of_events/ for details. + lib-index: Added new mail_index_recreated event. See https://doc.dovecot.org/admin_manual/list_of_events/#mail-index-recreated + lib-sql: Support TLS options for cassandra driver. This requires cpp-driver v2.15 (or later) to work reliably. + lib-storage: Missing $HasAttachment / $HasNoAttachment flags are now added to existing mails if mail_attachment_detection_option=add-flags and it can be done inexpensively. + login proxy: Added login_proxy_max_reconnects setting (default 3) to control how many reconnections are attempted. + login proxy: imap/pop3/submission/managesieve proxying now supports reconnection retrying on more than just connect() failure. Any error except a non-temporary authentication failure will result in reconnect attempts. - auth: Lua passdb/userdb leaks stack elements per call, eventually causing the stack to become too deep and crashing the auth or auth-worker process. - auth: SASL authentication PLAIN mechanism could be used to trigger read buffer overflow. However, this doesn't seem to be exploitable in any way. - auth: v2.3.11 regression: GSSAPI authentication fails because dovecot disallows NUL bytes for it. - dict: Process used too much CPU when iterating keys, because each key used a separate write() syscall. - doveadm-server: Crash could occur if logging was done outside command handling. For example http-client could have done debug logging afterwards, resulting in either segfault or Panic: file http-client.c: line 642 (http_client_context_close): assertion failed: (cctx->clients_list == NULL). - doveadm-server: v2.3.11 regression: Trying to connect to doveadm server process via starttls assert-crashed if there were no ssl=yes listeners: Panic: file master-service-ssl.c: line 22 (master_service_ssl_init): assertion failed: (service->ssl_ctx_initialized). - fts-solr: HTTP requests may have assert-crashed: Panic: file http-client-request.c: line 1232 (http_client_request_send_more): assertion failed: (req->payload_input != NULL) - imap: IMAP NOTIFY could crash with a segmentation fault due to a bad configuration that causes errors. Sending the error responses to the client can cause the segmentation fault. This can for example happen when several namespaces use the same mail storage location. - imap: IMAP NOTIFY used on a shared namespace that doesn't actually exist (e.g. public namespace for a nonexistent user) can crash with a panic: Panic: Leaked view for index /tmp/home/asdf/mdbox/dovecot.list.index: Opened in (null):0 - imap: IMAP session can crash with QRESYNC extension if many changes are done before asking for expunged mails since last sync. - imap: Process might hang indefinitely if client disconnects after sending some long-running commands pipelined, for example FETCH+LOGOUT. - lib-compress: Mitigate crashes when configuring a not compiled in compression. Errors with compression configuration now distinguish between not supported and unknown. - lib-compression: Using xz/lzma compression in v2.3.11 could have written truncated output in some situations. This would result in "Broken pipe" read errors when trying to read it back. - lib-compression: zstd compression could have crashed in some situations: Panic: file ostream.c: line 287 (o_stream_sendv_int): assertion failed: (!stream->blocking) - lib-dict: dict client could have crashed in some rare situations when iterating keys. - lib-http: Fix several assert-crashes in HTTP client. - lib-index: v2.3.11 regression: When mails were expunged at the same time as lots of new content was being saved to the cache (e.g. cache file was lost and is being re-filled) a deadlock could occur with dovecot.index.cache / dovecot.index.log. - lib-index: v2.3.11 regression: dovecot.index.cache file was being purged (rewritten) too often when it had a field that hadn't been accessed for over 1 month, but less than 2 months. Every cache file change caused a purging in this situation. - lib-mail: MIME parts were not returned correctly by Dovecot MIME parser. Regression caused by fixing CVE-2020-12100. - lib-mail: When max nested MIME parts were reached, IMAP BODYSTRUCTURE was written in a way that may have caused confusion for both IMAP clients and Dovecot itself when parsing it. The truncated part is now written out using application/octet-stream MIME type. - lib-mail: v2.3.11 regression: Mail delivery / parsing crashed when the 10000th MIME part was message/rfc822 (or if parent was multipart/digest): Panic: file message-parser.c: line 167 (message_part_append): assertion failed: (ctx->total_parts_count <= ctx->max_total_mime_parts). - lib-oauth2: Dovecot incorrectly required oauth2 server introspection reply to contain username with invalid token. - lib-ssl-iostream, lib-dcrypt: Fix building with OpenSSL that has deprecated APIs disabled. - lib-storage: When mail's size is different from the cached one (in dovecot.index.cache or Maildir S=size in the filename), this is handled by logging "Cached message size smaller/larger than expected" error. However, in some situations this also ended up crashing with: Panic: file istream.c: line 315 (i_stream_read_memarea): assertion failed: (old_size <= _stream->pos - _stream->skip). - lib-storage: v2.3 regression: Copying/moving mails was taking much more memory than before. This was mainly visible when copying/moving thousands of mails in a single transaction. - lib-storage: v2.3.11 regression: Searching messages assert-crashed (without FTS): Panic: file message-parser.c: line 174 (message_part_finish): assertion failed: (ctx->nested_parts_count > 0). - lib: Dovecot v2.3 moved signal handlers around in ioloops, causing more CPU usage than in v2.2. - lib: Fixed JSON parsing: '\' escape sequence may have wrongly resulted in error if it happened to be at read boundary. Any NUL characters and '\u0000' will now result in parsing error instead of silently truncating the data. - lmtp, submission: Server may hang if SSL client connection disconnects during the delivery. If this happened repeated, it could have ended up reaching process_limit and preventing any further lmtp/submission deliveries. - lmtp: Proxy does not always properly log TLS connection problems as errors; in some cases, only a debug message is logged if enabled. - lmtp: The LMTP service can hang when commands are pipelined. This can particularly occur when one command in the middle of the pipeline fails. One example of this occurs for proxied LMTP transactions in which the final DATA or BDAT command is pipelined after a failing RCPT command. - login-proxy: The login_source_ips setting has no effect, and therefore the proxy source IPs are not cycled through as they should be. - master: Process was using 100% CPU in some situations when a broken service was being throttled. - pop3-login: POP3 login would fail with "Input buffer full" if the initial response for SASL was too long. - stats: Crash would occur when generating openmetrics data for metrics using aggregating functions.

5 6

migration with doveadm backup to new cluster running dovecot 2.2.36 and replicator
by Thomas Winterstein 12 Jan '21

12 Jan '21

Hello everyone, we are working on migrating from dovecot 2.0.9 (maildir) to 2.2.36 (mdbox). The new cluster has two backend mail servers which replicate through doveadm replicator. To move the data initially we use doveadm backup (imapc). Our migration command doveadm -o mail_fsync=never backup -R -u $user imapc: To test the replication of new and purge of old mails with live data changes we ran imapc on a daily basis but encountered the problem that some mailboxes multiplied in size. We then made sure that imapc and replication don't run at the same time but after the first incremental imapc process, we still had the same problems. The doveadm-backup man-page states that it's possible to run it multiple times during migration. But is it also possible to have the replicator running in between? From our understanding the doveadm backup should just work as an imap connection between the servers, synchronizing all changes made on the source to the destination. Or does the conversion from maildir to mdbox format in our case produce the problems? If you're not supposed to run the replicator before having fully migrated, how can we shorten the downtime? rsync? And how can we be sure that similar problems don't occur after the migration if we can't test all mechanisms together with live data? thanks -- Thomas Winterstein

3 7

Dovecot FST not using plugins
by Joan Moreau 12 Jan '21

12 Jan '21

Hello, With recent git version of dovecot, I can see that the FTS does not use the configured plugin anymore, but tries to sort the mailbox directly on the spot (which is of course very painful). Is there a change in the configuration file in order to recover the old behavior ? or something else has changed ? Thank you Joan

2 2

Remap login before authentication
by Miloslav Hůla 11 Jan '21

11 Jan '21

Hi, with Dovecot 2.3.4 I would like to allow user to login with two different usernames: - USERNAME (no domain) - now works - name.surname(a)domain.tld - would like to add Problem is, that the only authentication method I have is LDAP bind by USERNAME. Now I use: ============ passdb { driver = ldap args = /etc/dovecot/dovecot-ldap.conf.ext } # Args uris = ldaps://ldap.domain.tld auth_bind = yes auth_bind_userdn = uid=%u,dc=domain,dc=tld base = ============ I know passdb can remap user&domain, but I have no password hash at all. And for example '{SASL}' is not supported password scheme to return e.g. from SQL passdb. Is there any way how to achive this? Maybe somehow remap username in first passdb and then continue to LDAP bind? 1. login as name.surname(a)domain.tld 2. remap to USERNAME 3. do the LDAP bind Milo

2 5

Re: status of test code
by steve＠keptprivate.com 11 Jan '21

11 Jan '21

Update:I was finally able to build 2.3.13 on centos 8 (8.3). I managed this by going back to the qmailtoaster spec file, removing a few things no longer relevant (vpopmail) and disabling all the tests. Most tests were still running but there were also many that did not. The good news is the resulting executable in the RPM no longer complains about not being able to find libdovecot.so. i've done some basic testing on imap and everything appears to be working.Someone who maintains the tests and rpm build should really have a look. Doing a build on a fresh centos 8 machine, as I was able to with the qmailtoaster source rpm, should really be much simpler. My impression is the current spec file may have edits that were eroneously committed? SteveSent from my T-Mobile 4G LTE device------ Original message------From: steve(a)keptprivate.comDate: Sat, Jan 9, 2021 3:42 PMTo: dovecot(a)dovecot.org;Cc: Subject:status of test codeHi, I'm continuing to try to build 2.3.13 with a source RPM. At this point I've taken the source zip file and I'm working with the previously working qmailtoaster SPEC file and RPM build process. The toaster SPEC file runs the built-in dovecot tests after build... 2.3.11 would make it through all the tests with a few minor exceptions. 2.3.13 seems no longer able to run the test is lib-ssl-iostream or lib-lua (and perhaps others, but that's as far as I've gotten). I can selectively disable the tests to make progress, but it raises the question of what the plans are for the built-in tests. Also, I continue to not be able to find where all the testing is turned on/off at once? I'm sure it will be obvious when someone tells me but please tell me, because I'm pulling my hair out. Steve

2 1

lzma mdboxes with unexpected EOF
by Bjoern Franke 10 Jan '21

10 Jan '21

Hi, I'm running dovecot 2.3.13 (until 05.01. it was 2.3.11.3) on Arch Linux and used lzma compressed mdboxes. Yesterday a user called me that she is missing all mails from the beginning of the month until now. I took a look into the logs and saw several "lzma.read [...] unexpected EOF at <....>". As I had no clue why the mdboxes are broken, I tried to convert all 3 mailboxes to Maildir using "doveadm sync" to prevent further issues and stumbled upon several lzma errors for mdbox files of my own user. So I wrote a script which took the offset and size via "doveadm dump" und then dds the xz parts out of the broken mdboxes and extracts them via 7z. But I'm wondering why that happened at all. I stumpled upon [1] but there was no further discussion about it. Best Regards Bjoern [1]https://dovecot.org/pipermail/dovecot/2019-September/117007.html

1 1

auth error log format change
by Adrian Minta 10 Jan '21

10 Jan '21

Hi, we recently upgraded to 2.3.13 from 2.3.11 and the log format for auth errors seems to have change. This change may have an adverse effect on fail2ban rules. Is there a way to revert to old format ? Thank you ! Old log example: Jan 10 00:32:37 mail dovecot: auth-worker(50806): sql(name(a)domain,112.18.92.0.104,<Dg/+P3+49cMFt1xo>): Password mismatch Jan 10 03:20:02 mail dovecot: auth-worker(26057): sql(name(a)domain,112.18.92.0.104,<oMyxloG4M7AFt1xo>): Password mismatch New log example: Jan 10 00:32:37 mail dovecot: auth-worker(50806): conn unix:auth-worker (pid=22503,uid=0): auth-worker<585236>: sql(name(a)domain,112.18.92.0.104,<Dg/+P3+49cMFt1xo>): Password mismatch Jan 10 03:20:02 mail dovecot: auth-worker(26057): conn unix:auth-worker (pid=25928,uid=0): auth-worker<4234337>: sql(name(a)domain,112.18.92.0.104,<oMyxloG4M7AFt1xo>): Password mismatch -- Best regards, Adrian Minta

1 0

problem building on centos 8 (8.3 kernel)
by steve＠keptprivate.com 09 Jan '21

09 Jan '21

Hi, I'm converting from qmailtoaster/vpopmail build. When I try to build dovecot-2.3.13-2.src.rpm for centos 8.3 the first thing I run into is this: + sed -i 's|/etc/ssl|/etc/pki/dovecot|' doc/mkcert.sh doc/example-config/conf.d/10-ssl.conf + '[' -e buildinfo.commit ']' ++ head -1 buildinfo.commit + COMMIT=89f716dc2ec7362864a368d32533184b55fb7831 ++ /bin/sh /home/build/rpmbuild/SOURCES/lsb_release -is /bin/sh: /home/build/rpmbuild/SOURCES/lsb_release: No such file or directory + ID= error: Bad exit status from /var/tmp/rpm-tmp.WFaLYQ (%build) RPM build errors: Macro expanded in comment on line 455: %{_libdir}/dovecot/settings Bad exit status from /var/tmp/rpm-tmp.WFaLYQ (%build) I can get past this with an edit to the dovecot.spec file (removing sourcedir): if [ -e "buildinfo.commit" ]; then COMMIT=`head -1 buildinfo.commit` ID=`/bin/sh %̶{̶_̶s̶o̶u̶r̶c̶e̶d̶i̶r̶}̶/̶lsb_release -is` RELEASE=`/bin/sh %̶{̶_̶s̶o̶u̶r̶c̶e̶d̶i̶r̶}̶/̶lsb_release -rs` CODENAME=`/bin/sh %̶{̶_̶s̶o̶u̶r̶c̶e̶d̶i̶r̶}̶/̶lsb_release -cs` ARCH=`arch` fi The RPM builds but it fails to run with this message in the logs: Jan 6 20:52:11 beta1 systemd[1]: Starting Dovecot IMAP/POP3 email server... Jan 6 20:52:11 beta1 systemd[1]: Started Dovecot IMAP/POP3 email server. Jan 6 20:52:11 beta1 dovecot[356909]: /usr/sbin/dovecot: error while loading shared libraries: libdovecot.so.0: cannot open shared object file: No such file or directory Jan 6 20:52:11 beta1 systemd[1]: dovecot.service: Main process exited, code=exited, status=127/n/a Jan 6 20:52:11 beta1 systemd[1]: dovecot.service: Failed with result 'exit-code'. Any ideas what I have going wrong? Also, a side question, when I build the rpm it's not running the extensive tests that the old qmailtoaster source rpm used to run. I've looked through the spec file and I don't really see where to turn that back on. Sorry if any of this is stupid, but I'm new to building directly from the dovecot repo. Steve

3 3

Dovecot 2.3.13 source rpm build fails on Centos 8
by steve＠keptprivate.com 08 Jan '21

08 Jan '21

I tried to post this in a more nuanced way, but the fact is the latest source RPM does not build on the latest Centos 8.> + sed -i 's|/etc/ssl|/etc/pki/dovecot|' doc/mkcert.sh doc/example-config/conf.d/10-ssl.conf > + '[' -e buildinfo.commit ']' > ++ head -1 buildinfo.commit > + COMMIT=89f716dc2ec7362864a368d32533184b55fb7831 > ++ /bin/sh /home/build/rpmbuild/SOURCES/lsb_release -is > /bin/sh: /home/build/rpmbuild/SOURCES/lsb_release: No such file or directory > + ID= > error: Bad exit status from /var/tmp/rpm-tmp.WFaLYQ (%build) > > > RPM build errors: > Macro expanded in comment on line 455: %{_libdir}/dovecot/settings > > Bad exit status from /var/tmp/rpm-tmp.WFaLYQ (%build) > > I can get past this with an edit to the dovecot.spec file (removing sourcedir): > > if [ -e "buildinfo.commit" ]; then > COMMIT=`head -1 buildinfo.commit` > ID=`/bin/sh %̶{̶_̶s̶o̶u̶r̶c̶e̶d̶i̶r̶}̶/̶lsb_release -is` > RELEASE=`/bin/sh %̶{̶_̶s̶o̶u̶r̶c̶e̶d̶i̶r̶}̶/̶lsb_release -rs` > CODENAME=`/bin/sh %̶{̶_̶s̶o̶u̶r̶c̶e̶d̶i̶r̶}̶/̶lsb_release -cs` > ARCH=`arch` > fiCan someone who knows the source rpm build config. please respond?The committed spec file contains errors.ThanksSent from my T-Mobile 4G LTE device

3 6

2.3.13: newly introduced TLS bug : tls_construct_server_key_exchange
by Marius Schwarz 08 Jan '21

08 Jan '21

Hi, since the update from 2.3.11 to 2.3.13 some clients generate this bug : TLS handshaking: SSL_accept() failed: error:141EC044:SSL routines:tls_construct_server_key_exchange:internal error As it looks for now, they use the old SSL approach on Ports 993 and 995. SSL Config says: ssl = yes ssl_cert = </etc/pki/tls/certs/exim.pem ( Lets Encrypt R3 based cert ) ssl_key = </etc/pki/tls/private/exim.pem ssl_dh_parameters_length = 2048 ssl_dh= </etc/dovecot/dh.pem ssl_cipher_list = PROFILE=SYSTEM OS: Fedora 32 X86_64 Ext4 file storage on local disks Versions: dovecot-2.3.13-1.fc32.x86_64 openssl-1.1.1i-1.fc32.x86_64 best regards, Marius Schwarz

2 2

Re: problem building on centos 8 (8.3 kernel)
by steve＠keptprivate.com 07 Jan '21

07 Jan '21

Another thought... Could I use a different build mechanism that would result in the same installation rpm? There's no reason I have to use source rpms, I'm just used to it because of qmailtoaster.SteveSent from my T-Mobile 4G LTE device------ Original message------From: steve(a)keptprivate.comDate: Thu, Jan 7, 2021 3:48 PMTo: Aki Tuomi;dovecot(a)dovecot.org;Cc: Subject:Re: problem building on centos 8 (8.3 kernel) Any ideas about the lsb_release error in the spec file and where that came from? I have a very vanilla centos 8 install I'm trying to bulid on. Any thoughts appreciated because I'm stuck and at something of a loss on what to try next. My first thought is to look at spec file revisions.SteveSent from my T-Mobile 4G LTE device------ Original message------From: Aki TuomiDate: Thu, Jan 7, 2021 3:10 AMTo: steve@keptprivate.com;dovecot@dovecot.org;Cc: Subject:Re: problem building on centos 8 (8.3 kernel)> On 07/01/2021 03:57 steve(a)keptprivate.com wrote: > > > Hi, > > I'm converting from qmailtoaster/vpopmail build. > When I try to build dovecot-2.3.13-2.src.rpm for centos 8.3 the first thing I run into is this: > > + sed -i 's|/etc/ssl|/etc/pki/dovecot|' doc/mkcert.sh doc/example-config/conf.d/10-ssl.conf > + '[' -e buildinfo.commit ']' > ++ head -1 buildinfo.commit > + COMMIT=89f716dc2ec7362864a368d32533184b55fb7831 > ++ /bin/sh /home/build/rpmbuild/SOURCES/lsb_release -is > /bin/sh: /home/build/rpmbuild/SOURCES/lsb_release: No such file or directory > + ID= > error: Bad exit status from /var/tmp/rpm-tmp.WFaLYQ (%build) > > > RPM build errors: > Macro expanded in comment on line 455: %{_libdir}/dovecot/settings > > Bad exit status from /var/tmp/rpm-tmp.WFaLYQ (%build) > > I can get past this with an edit to the dovecot.spec file (removing sourcedir): > > if [ -e "buildinfo.commit" ]; then > COMMIT=`head -1 buildinfo.commit` > ID=`/bin/sh %̶{̶_̶s̶o̶u̶r̶c̶e̶d̶i̶r̶}̶/̶lsb_release -is` > RELEASE=`/bin/sh %̶{̶_̶s̶o̶u̶r̶c̶e̶d̶i̶r̶}̶/̶lsb_release -rs` > CODENAME=`/bin/sh %̶{̶_̶s̶o̶u̶r̶c̶e̶d̶i̶r̶}̶/̶lsb_release -cs` > ARCH=`arch` > fi > > The RPM builds but it fails to run with this message in the logs: > > Jan 6 20:52:11 beta1 systemd[1]: Starting Dovecot IMAP/POP3 email server... > Jan 6 20:52:11 beta1 systemd[1]: Started Dovecot IMAP/POP3 email server. > Jan 6 20:52:11 beta1 dovecot[356909]: /usr/sbin/dovecot: error while loading shared libraries: libdovecot.so.0: cannot open shared object > file: No such file or directory > Jan 6 20:52:11 beta1 systemd[1]: dovecot.service: Main process exited, code=exited, status=127/n/a > Jan 6 20:52:11 beta1 systemd[1]: dovecot.service: Failed with result 'exit-code'. > > Any ideas what I have going wrong? > > Also, a side question, when I build the rpm it's not running the extensive tests that the old qmailtoaster source rpm used to run. I've > looked through the spec file and I don't really see where to turn that back on. > > Sorry if any of this is stupid, but I'm new to building directly from the dovecot repo. > > Steve I think the file is installed under /usr/lib64/, so check ldd /usr/lib64/libdovecot.so.0 Is there some reason you are building the rpms yourself? Aki

1 0

Re: problem building on centos 8 (8.3 kernel)
by steve＠keptprivate.com 07 Jan '21

07 Jan '21

Any ideas about the lsb_release error in the spec file and where that came from? I have a very vanilla centos 8 install I'm trying to bulid on. Any thoughts appreciated because I'm stuck and at something of a loss on what to try next. My first thought is to look at spec file revisions.SteveSent from my T-Mobile 4G LTE device------ Original message------From: Aki TuomiDate: Thu, Jan 7, 2021 3:10 AMTo: steve@keptprivate.com;dovecot@dovecot.org;Cc: Subject:Re: problem building on centos 8 (8.3 kernel)> On 07/01/2021 03:57 steve(a)keptprivate.com wrote: > > > Hi, > > I'm converting from qmailtoaster/vpopmail build. > When I try to build dovecot-2.3.13-2.src.rpm for centos 8.3 the first thing I run into is this: > > + sed -i 's|/etc/ssl|/etc/pki/dovecot|' doc/mkcert.sh doc/example-config/conf.d/10-ssl.conf > + '[' -e buildinfo.commit ']' > ++ head -1 buildinfo.commit > + COMMIT=89f716dc2ec7362864a368d32533184b55fb7831 > ++ /bin/sh /home/build/rpmbuild/SOURCES/lsb_release -is > /bin/sh: /home/build/rpmbuild/SOURCES/lsb_release: No such file or directory > + ID= > error: Bad exit status from /var/tmp/rpm-tmp.WFaLYQ (%build) > > > RPM build errors: > Macro expanded in comment on line 455: %{_libdir}/dovecot/settings > > Bad exit status from /var/tmp/rpm-tmp.WFaLYQ (%build) > > I can get past this with an edit to the dovecot.spec file (removing sourcedir): > > if [ -e "buildinfo.commit" ]; then > COMMIT=`head -1 buildinfo.commit` > ID=`/bin/sh %̶{̶_̶s̶o̶u̶r̶c̶e̶d̶i̶r̶}̶/̶lsb_release -is` > RELEASE=`/bin/sh %̶{̶_̶s̶o̶u̶r̶c̶e̶d̶i̶r̶}̶/̶lsb_release -rs` > CODENAME=`/bin/sh %̶{̶_̶s̶o̶u̶r̶c̶e̶d̶i̶r̶}̶/̶lsb_release -cs` > ARCH=`arch` > fi > > The RPM builds but it fails to run with this message in the logs: > > Jan 6 20:52:11 beta1 systemd[1]: Starting Dovecot IMAP/POP3 email server... > Jan 6 20:52:11 beta1 systemd[1]: Started Dovecot IMAP/POP3 email server. > Jan 6 20:52:11 beta1 dovecot[356909]: /usr/sbin/dovecot: error while loading shared libraries: libdovecot.so.0: cannot open shared object > file: No such file or directory > Jan 6 20:52:11 beta1 systemd[1]: dovecot.service: Main process exited, code=exited, status=127/n/a > Jan 6 20:52:11 beta1 systemd[1]: dovecot.service: Failed with result 'exit-code'. > > Any ideas what I have going wrong? > > Also, a side question, when I build the rpm it's not running the extensive tests that the old qmailtoaster source rpm used to run. I've > looked through the spec file and I don't really see where to turn that back on. > > Sorry if any of this is stupid, but I'm new to building directly from the dovecot repo. > > Steve I think the file is installed under /usr/lib64/, so check ldd /usr/lib64/libdovecot.so.0 Is there some reason you are building the rpms yourself? Aki

1 0

Re: problem building on centos 8 (8.3 kernel)
by steve＠keptprivate.com 07 Jan '21

07 Jan '21

Hi,Yes, a whole subdir "dovecot" in /usr/lib64 with files. The actual so.0 file is a link to an so.0.0.0 file.I was able to successfully build test run the source rpm from qmailtoaster 2.3.11.I'm building from source because I have a patch I want to apply. My suspicion is the problem is config. related given the odd lsb_release issue that happens right at the start of the build.I've tried to review the spec files for differences, qmailtoaster 2.3.11 vs 2.3.13 but the differences are significant.SteveSent from my T-Mobile 4G LTE device------ Original message------From: Aki TuomiDate: Thu, Jan 7, 2021 3:10 AMTo: steve@keptprivate.com;dovecot@dovecot.org;Cc: Subject:Re: problem building on centos 8 (8.3 kernel)> On 07/01/2021 03:57 steve(a)keptprivate.com wrote: > > > Hi, > > I'm converting from qmailtoaster/vpopmail build. > When I try to build dovecot-2.3.13-2.src.rpm for centos 8.3 the first thing I run into is this: > > + sed -i 's|/etc/ssl|/etc/pki/dovecot|' doc/mkcert.sh doc/example-config/conf.d/10-ssl.conf > + '[' -e buildinfo.commit ']' > ++ head -1 buildinfo.commit > + COMMIT=89f716dc2ec7362864a368d32533184b55fb7831 > ++ /bin/sh /home/build/rpmbuild/SOURCES/lsb_release -is > /bin/sh: /home/build/rpmbuild/SOURCES/lsb_release: No such file or directory > + ID= > error: Bad exit status from /var/tmp/rpm-tmp.WFaLYQ (%build) > > > RPM build errors: > Macro expanded in comment on line 455: %{_libdir}/dovecot/settings > > Bad exit status from /var/tmp/rpm-tmp.WFaLYQ (%build) > > I can get past this with an edit to the dovecot.spec file (removing sourcedir): > > if [ -e "buildinfo.commit" ]; then > COMMIT=`head -1 buildinfo.commit` > ID=`/bin/sh %̶{̶_̶s̶o̶u̶r̶c̶e̶d̶i̶r̶}̶/̶lsb_release -is` > RELEASE=`/bin/sh %̶{̶_̶s̶o̶u̶r̶c̶e̶d̶i̶r̶}̶/̶lsb_release -rs` > CODENAME=`/bin/sh %̶{̶_̶s̶o̶u̶r̶c̶e̶d̶i̶r̶}̶/̶lsb_release -cs` > ARCH=`arch` > fi > > The RPM builds but it fails to run with this message in the logs: > > Jan 6 20:52:11 beta1 systemd[1]: Starting Dovecot IMAP/POP3 email server... > Jan 6 20:52:11 beta1 systemd[1]: Started Dovecot IMAP/POP3 email server. > Jan 6 20:52:11 beta1 dovecot[356909]: /usr/sbin/dovecot: error while loading shared libraries: libdovecot.so.0: cannot open shared object > file: No such file or directory > Jan 6 20:52:11 beta1 systemd[1]: dovecot.service: Main process exited, code=exited, status=127/n/a > Jan 6 20:52:11 beta1 systemd[1]: dovecot.service: Failed with result 'exit-code'. > > Any ideas what I have going wrong? > > Also, a side question, when I build the rpm it's not running the extensive tests that the old qmailtoaster source rpm used to run. I've > looked through the spec file and I don't really see where to turn that back on. > > Sorry if any of this is stupid, but I'm new to building directly from the dovecot repo. > > Steve I think the file is installed under /usr/lib64/, so check ldd /usr/lib64/libdovecot.so.0 Is there some reason you are building the rpms yourself? Aki

1 0

Server searches not working for 1 user only
by Ignacio García 07 Jan '21

07 Jan '21

Hi there I'm using dovecot version 2.3.4.1 precompiled in Debian stretch-backports (with Maildir, and Lucene FTS). Everything seems to be running fine but server searches by one user (precisely me) using roundcube 1.4.8. For all other checked users server searches work fine. My account is not particularly differnt from others, aprox same amount of mail. The only difference with others is that I use/check my mail constantly and from different devices at the same time (roundcube, a couple of instances of Thunderbird and Aquamail for Android always open). I only use IMAP. Googling around I read about deleting cache/index files with Dovecot recreating them automagically, but since I haven't found anything official on the Wiki, before I do something potentially stupid I wanted to confirm with you all for guidance on this Thanks so much in advance Ignacio

1 0

CVE-2020-24386: IMAP hibernation allows accessing other peoples mail
by Aki Tuomi 07 Jan '21

07 Jan '21

Open-Xchange Security Advisory 2021-01-04 Product: Dovecot Vendor: OX Software GmbH Internal reference: DOP-2009 (Bug ID) Vulnerability type: CWE-150: Improper Neutralization of Escape, Meta, or Control Sequences Vulnerable version: 2.2.26-2.3.11.3 Vulnerable component: imap Report confidence: Confirmed Solution status: Fixed by Vendor Fixed version: 2.3.13 Vendor notification: 2020-08-17 Solution date: 2020-08-27 Public disclosure: 2021-01-04 CVE reference: CVE-2020-24386 CVSS: 8.2 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N) Vulnerability Details: When imap hibernation is active, an attacker can cause Dovecot to discover file system directory structure and access other users' emails using specially crafted command. The attacker must have valid credentials to access the mail server. Risk: Attacker can access other users' emails and filesystem information. Workaround: Operators can choose to disable IMAP hibernation. IMAP hibernation is not on by default. To ensure imap hibernation is disabled, make sure imap_hibernate_timeout is set to 0 or unset. Solution: Operators should update to 2.3.13 or later version.

6 6

systemd-homed
by Yilin Wei 07 Jan '21

07 Jan '21

Hi, I’ve been looking into a problem with a local dovecot setup with ~systemd-homed~ and uses PAM authentication. To give a brief overview, ~systemd-homed~ mounts the users home directory upon particular authencation calls (which is configurable through ~/etc/pam.d~). Dovecot currently supports PAM authentication perfectly fine — the problem comes when a system has systemd-homed. This is because the session is created and deleted immediately afterwards [1]. This is a problem because if the server isn’t busy, systemd-homed can run it’s cleanup which causes the home directory to be unavailable once again [2]. To support this properly, ideally the whole of the imap/pop3/lda session needs to happen before the deletion of the session. Does the imap session happen within a ~verify_plain~ [3] call? If not, are there any other authentication backends which currently need to keep a live token? Yilin [1] https://github.com/dovecot/core/blob/266e54b7b8c34c9a58dd60a2e53c5ca7d1deae… [2] https://dovecot.org/pipermail/dovecot/2019-April/115559.html [3] https://github.com/dovecot/core/blob/266e54b7b8c34c9a58dd60a2e53c5ca7d1deae…

2 1

multiple mailstores
by Alexander Rivanykov 07 Jan '21

07 Jan '21

2 1

Dovecot + sis problem
by Michał Kiljański 07 Jan '21

07 Jan '21

Hi, My setup is: mail_attachment_dir = /var/mail/attachments mail_attachment_hash = %{sha512} mail_attachment_min_size = 64k mail_attachment_fs = sis posix Something works - but I expected that is one instance of file, and this file is linked to messages. But here in folder I have got this: sudo ls -la /var/mail/attachments/8b/67/ -rw-rw-rw- 3 buser dovecot 5425280 Jan 5 23:13 8b67b29a73b74ecf48e17e789051602cec13aa78cc01c06c8eee1ca4be7c8e07f700cdc9e9ca0381fa3541bdd4e26289de1d7eee763233dfaa0a200a264e5258-0258913a92f2f45f0d700000035f3f08 -rw-rw-rw- 1 cuser dovecot 5425280 Jan 5 23:13 8b67b29a73b74ecf48e17e789051602cec13aa78cc01c06c8eee1ca4be7c8e07f700cdc9e9ca0381fa3541bdd4e26289de1d7eee763233dfaa0a200a264e5258-28571b018ff2f45f0c700000035f3f08 -rw-rw-rw- 3 buser dovecot 5425280 Jan 5 23:13 8b67b29a73b74ecf48e17e789051602cec13aa78cc01c06c8eee1ca4be7c8e07f700cdc9e9ca0381fa3541bdd4e26289de1d7eee763233dfaa0a200a264e5258-50315d3a8ef2f45f0a700000035f3f08 -rw-rw-rw- 1 auser dovecot 5425280 Jan 5 23:13 8b67b29a73b74ecf48e17e789051602cec13aa78cc01c06c8eee1ca4be7c8e07f700cdc9e9ca0381fa3541bdd4e26289de1d7eee763233dfaa0a200a264e5258-586cdb378ef2f45f07700000035f3f08 drwxrwsrwx 2 buser dovecot 4096 Jan 5 23:13 hashes sudo ls -la /var/mail/attachments/8b/67/hashes/ -rw-rw-rw- 3 buser dovecot 5425280 Jan 5 23:13 8b67b29a73b74ecf48e17e789051602cec13aa78cc01c06c8eee1ca4be7c8e07f700cdc9e9ca0381fa3541bdd4e26289de1d7eee763233dfaa0a200a264e5258 What is wrog? How to setup SIS to get one instance of file? Regards Michal

2 2

Pigeonhole v0.5.13 released
by Aki Tuomi 06 Jan '21

06 Jan '21

We are pleased to release pigeonhole 0.5.13. You can download it from locations below: https://pigeonhole.dovecot.org/releases/2.3/dovecot-2.3-pigeonhole-0.5.13.t… https://pigeonhole.dovecot.org/releases/2.3/dovecot-2.3-pigeonhole-0.5.13.t… Binary packages in https://repo.dovecot.org/ Docker images in https://hub.docker.com/r/dovecot/dovecot Aki Tuomi Open-Xchange oy --- - duplicate: The test was handled badly in a multiscript (sieve_before, sieve_after) scenario in which an earlier script in the sequence with a duplicate test succeeded, while a later script caused a runtime failure. In that case, the message is recorded for duplicate tracking, while the message may not actually have been delivered in the end. - editheader: Sieve interpreter entered infinite loop at startup when the "editheader" configuration listed an invalid header name. This problem can only be triggered by the administrator. - relational: The Sieve relational extension can cause a segfault at compile time. This is triggered by invalid script syntax. The segfault happens when this match type is the last argument of the test command. This situation is not possible in a valid script; positional arguments are normally present after that, which would prevent the segfault. - sieve: For some Sieve commands the provided mailbox name is not properly checked for UTF-8 validity, which can cause assert crashes at runtime when an invalid mailbox name is encountered. This can be caused by the user by writing a bad Sieve script involving the affected commands ("mailboxexists", "specialuse_exists"). This can be triggered by the remote sender only when the user has written a Sieve script that passes message content to one of the affected commands. - sieve: Large sequences of 8-bit octets passed to certain Sieve commands that create or modify message headers that allow UTF-8 text (vacation, notify and addheader) can cause the delivery or IMAP process (when IMAPSieve is used) to enter a memory-consuming semi-infinite loop that ends when the process exceeds its memory limits. Logged in users can cause these hangs only for their own processes.

2 1

doveadm backup only working once?
by Engelbert Torremans 06 Jan '21

06 Jan '21

All, For the past 2 weeks I have been trying to get dovecot mail backup working between 2 debian 10 machines. Both machines are running the same OS (Debian 10) and configuration wise they are similar (except of course ip addresses, hostnames etc). My "main" machine is called "server" and the 2nd machine is "server2". See below for the dovecot -n output on server2. I created a testuser called synctest on both server1 and server2 and have sent a couple (2) email messages to synctest@server. Those testmessages are now present in /var/mail/synctest mbox file on server1. When trying to create a backup from server->server2 for user synctest I use this command: #doveadm -D -v backup -R -f -u synctest tcp:192.168.3.1:12345 (using something similar from server1 -> server2 like this: #doveadm -D -v backup -f -u synctest tcp:192.168.3.2:12345 has the same results btw) The first attempte appears to be working OK but the the 2nd attempt (nothing was changed on server1 before the 2nd attempt) fails with soemthing like: Error: Couldn't delete mailbox INBOX: Permission denied Before I can get a succesfull backup again I need to do this (on server2): #rm /var/mail/synctest #rm -r ~syncuser/mail/index/INBOX #doveadm mailbox delete -u synctest INBOX (if I don't do the rm /var/mail/synctest before the doveadm mailbox delete command I will also get a: Error: Can't delete mailbox INBOX: Permission denied Anybody any idea what is happening here? Should I enable replicator and/or aggregator? Output of 1st and 2nd dovadm backup attempt is below: root@server2:/home/synctest/mail# doveadm -D -v backup -R -f -u synctest tcp:192.168.3.1:12345 Debug: Loading modules from directory: /usr/lib/dovecot/modules/doveadm Debug: Skipping module doveadm_acl_plugin, because dlopen() failed: /usr/lib/dovecot/modules/doveadm/lib10_doveadm_acl_plugin.so: undefined symbol: acl_user_module (this is usually intentional, so just ignore this message) Debug: Skipping module doveadm_expire_plugin, because dlopen() failed: /usr/lib/dovecot/modules/doveadm/lib10_doveadm_expire_plugin.so: undefined symbol: expire_set_deinit (this is usually intentional, so just ignore this message) Debug: Skipping module doveadm_quota_plugin, because dlopen() failed: /usr/lib/dovecot/modules/doveadm/lib10_doveadm_quota_plugin.so: undefined symbol: quota_user_module (this is usually intentional, so just ignore this message) Debug: Module loaded: /usr/lib/dovecot/modules/doveadm/lib10_doveadm_sieve_plugin.so Debug: Skipping module doveadm_fts_lucene_plugin, because dlopen() failed: /usr/lib/dovecot/modules/doveadm/lib20_doveadm_fts_lucene_plugin.so: undefined symbol: lucene_index_iter_deinit (this is usually intentional, so just ignore this message) Debug: Skipping module doveadm_fts_plugin, because dlopen() failed: /usr/lib/dovecot/modules/doveadm/lib20_doveadm_fts_plugin.so: undefined symbol: fts_user_get_language_list (this is usually intentional, so just ignore this message) Debug: Skipping module doveadm_mail_crypt_plugin, because dlopen() failed: /usr/lib/dovecot/modules/doveadm/libdoveadm_mail_crypt_plugin.so: undefined symbol: mail_crypt_box_get_pvt_digests (this is usually intentional, so just ignore this message) doveadm(synctest)<13039><>: Debug: auth USER input: synctest system_groups_user=synctest uid=1006 gid=100 home=/home/synctest doveadm(synctest): Debug: remote(192.168.3.1:12345): auth USER input: synctest system_groups_user=synctest uid=1006 gid=100 home=/home/synctest doveadm(synctest): Debug: remote(192.168.3.1:12345): Effective uid=1006, gid=100, home=/home/synctest doveadm(synctest): Debug: remote(192.168.3.1:12345): Namespace inbox: type=private, prefix=, sep=, inbox=yes, hidden=no, list=yes, subscriptions=yes location=mbox:~/mail/mailboxes:INBOX=/var/mail/synctest:DIRNAME=mBoX-MeSsAgEs:INDEX=~/mail/index:CONTROL=~/mail/control doveadm(synctest): Debug: remote(192.168.3.1:12345): fs: root=/home/synctest/mail/mailboxes, index=/home/synctest/mail/index, indexpvt=, control=/home/synctest/mail/control, inbox=/var/mail/synctest, alt= doveadm(synctest): Debug: Effective uid=1006, gid=100, home=/home/synctest doveadm(synctest): Debug: Namespace inbox: type=private, prefix=, sep=, inbox=yes, hidden=no, list=yes, subscriptions=yes location=mbox:~/mail/mailboxes:INBOX=/var/mail/synctest:DIRNAME=mBoX-MeSsAgEs:INDEX=~/mail/index:CONTROL=~/mail/control doveadm(synctest): Debug: fs: root=/home/synctest/mail/mailboxes, index=/home/synctest/mail/index, indexpvt=, control=/home/synctest/mail/control, inbox=/var/mail/synctest, alt= doveadm(synctest): Debug: brain M: Namespace has location mbox:~/mail/mailboxes:INBOX=/var/mail/synctest:DIRNAME=mBoX-MeSsAgEs:INDEX=~/mail/index:CONTROL=~/mail/control doveadm(synctest): Debug: Namespace : Using permissions from /home/synctest/mail/mailboxes: mode=0700 gid=default dsync-local(synctest)<D+AKA91J81/vMgAAaso27A>: Debug: brain M: Remote mailbox tree: INBOX guid=f8ecea204a65f05fea460000b4581695 uid_validity=1609590090 uid_next=9 subs=no last_change=0 last_subs=0 dsync-local(synctest)<D+AKA91J81/vMgAAaso27A>: Debug: brain M: Mailbox INBOX: local=00000000000000000000000000000000/0/0, remote=f8ecea204a65f05fea460000b4581695/0/1: mailbox not selectable yet dsync-local(synctest)<D+AKA91J81/vMgAAaso27A>: Debug: Namespace : /home/synctest/mail/mailboxes/INBOX doesn't exist yet, using default permissions dsync-local(synctest)<D+AKA91J81/vMgAAaso27A>: Debug: Namespace : Using permissions from /home/synctest/mail/mailboxes: mode=0700 gid=default dsync-local(synctest)<D+AKA91J81/vMgAAaso27A>: Debug: Namespace : /home/synctest/mail/mailboxes/INBOX doesn't exist yet, using default permissions dsync-local(synctest)<D+AKA91J81/vMgAAaso27A>: Debug: Namespace : Using permissions from /home/synctest/mail/mailboxes: mode=0700 gid=default dsync-local(synctest)<D+AKA91J81/vMgAAaso27A>: Debug: Namespace : /home/synctest/mail/mailboxes/INBOX doesn't exist yet, using default permissions dsync-local(synctest)<D+AKA91J81/vMgAAaso27A>: Debug: Namespace : Using permissions from /home/synctest/mail/mailboxes: mode=0700 gid=default dsync-local(synctest)<D+AKA91J81/vMgAAaso27A>: Debug: Namespace : /home/synctest/mail/mailboxes/INBOX doesn't exist yet, using default permissions dsync-local(synctest)<D+AKA91J81/vMgAAaso27A>: Debug: Namespace : Using permissions from /home/synctest/mail/mailboxes: mode=0700 gid=default dsync-local(synctest)<D+AKA91J81/vMgAAaso27A>: Debug: brain M: Import INBOX: Import change type=expunge GUID=<unknown> UID=1 hdr_hash= result=Expunged mail not found locally dsync-local(synctest)<D+AKA91J81/vMgAAaso27A>: Debug: brain M: Import INBOX: Import change type=expunge GUID=<unknown> UID=2 hdr_hash= result=Expunged mail not found locally dsync-local(synctest)<D+AKA91J81/vMgAAaso27A>: Debug: brain M: Import INBOX: Import change type=expunge GUID=<unknown> UID=3 hdr_hash= result=Expunged mail not found locally dsync-local(synctest)<D+AKA91J81/vMgAAaso27A>: Debug: brain M: Import INBOX: Import change type=expunge GUID=<unknown> UID=4 hdr_hash= result=Expunged mail not found locally dsync-local(synctest)<D+AKA91J81/vMgAAaso27A>: Debug: brain M: Import INBOX: Import change type=expunge GUID=<unknown> UID=5 hdr_hash= result=Expunged mail not found locally dsync-local(synctest)<D+AKA91J81/vMgAAaso27A>: Debug: brain M: Import INBOX: Import change type=expunge GUID=<unknown> UID=6 hdr_hash= result=Expunged mail not found locally dsync-local(synctest)<D+AKA91J81/vMgAAaso27A>: Debug: brain M: Import INBOX: Last common UID=0. Delayed expunges= dsync-local(synctest)<D+AKA91J81/vMgAAaso27A>: Debug: brain M: Import INBOX: Import change type=save GUID=8bce3bc615e7f2a1dfad970a3cd36bdb UID=7 hdr_hash= result=Mail's UID is above local UIDNEXT - No more local mails found dsync-local(synctest)<D+AKA91J81/vMgAAaso27A>: Debug: brain M: Import INBOX: Import change type=save GUID=c9cdf5f725d4195db78b20bbacad189b UID=8 hdr_hash= result=New mail dsync-local(synctest)<D+AKA91J81/vMgAAaso27A>: Debug: brain M: import mail uid 0 guid 8bce3bc615e7f2a1dfad970a3cd36bdb dsync-local(synctest)<D+AKA91J81/vMgAAaso27A>: Debug: brain M: Import INBOX: Import mail body for GUID=8bce3bc615e7f2a1dfad970a3cd36bdb UID=0 dsync-local(synctest)<D+AKA91J81/vMgAAaso27A>: Debug: /home/synctest/mail/index/INBOX/dovecot.index.cache: Compressed, file_seq changed 0 -> 1609779677, size=32, max_uid=0 dsync-local(synctest)<D+AKA91J81/vMgAAaso27A>: Debug: brain M: import mail uid 0 guid c9cdf5f725d4195db78b20bbacad189b dsync-local(synctest)<D+AKA91J81/vMgAAaso27A>: Debug: brain M: Import INBOX: Import mail body for GUID=c9cdf5f725d4195db78b20bbacad189b UID=0 dsync-local(synctest)<D+AKA91J81/vMgAAaso27A>: Debug: brain M: Import INBOX: Saved UIDs: 7:8 dsync-local(synctest)<D+AKA91J81/vMgAAaso27A>: Debug: brain M: Import INBOX: Finish update: min_next_uid=9 min_first_recent_uid=1 min_highest_modseq=10 min_highest_pvt_modseq=0 dsync-local(synctest)<D+AKA91J81/vMgAAaso27A>: Debug: brain M: Import INBOX: Reassign UIDs: 1: This appears to work perfectly well the first time (maybe I am overlooking some issue already at this stage?) At least after the backup has been completed /var/mail/syncuser on server2 contains all the messages that are also present on server1. And the ~syncuser/mail/index/INBOX folder also exists (don't know why this is created btw?) But then when running the same command for the 2nd time (and no changes on the /var/mail/synctest file on server1) the command failes like this (permission denied to delete INBOX at the end): root@server2:/home/synctest/mail# doveadm -D -v backup -R -f -u synctest tcp:192.168.3.1:12345 Debug: Loading modules from directory: /usr/lib/dovecot/modules/doveadm Debug: Skipping module doveadm_acl_plugin, because dlopen() failed: /usr/lib/dovecot/modules/doveadm/lib10_doveadm_acl_plugin.so: undefined symbol: acl_user_module (this is usually intentional, so just ignore this message) Debug: Skipping module doveadm_expire_plugin, because dlopen() failed: /usr/lib/dovecot/modules/doveadm/lib10_doveadm_expire_plugin.so: undefined symbol: expire_set_deinit (this is usually intentional, so just ignore this message) Debug: Skipping module doveadm_quota_plugin, because dlopen() failed: /usr/lib/dovecot/modules/doveadm/lib10_doveadm_quota_plugin.so: undefined symbol: quota_user_module (this is usually intentional, so just ignore this message) Debug: Module loaded: /usr/lib/dovecot/modules/doveadm/lib10_doveadm_sieve_plugin.so Debug: Skipping module doveadm_fts_lucene_plugin, because dlopen() failed: /usr/lib/dovecot/modules/doveadm/lib20_doveadm_fts_lucene_plugin.so: undefined symbol: lucene_index_iter_deinit (this is usually intentional, so just ignore this message) Debug: Skipping module doveadm_fts_plugin, because dlopen() failed: /usr/lib/dovecot/modules/doveadm/lib20_doveadm_fts_plugin.so: undefined symbol: fts_user_get_language_list (this is usually intentional, so just ignore this message) Debug: Skipping module doveadm_mail_crypt_plugin, because dlopen() failed: /usr/lib/dovecot/modules/doveadm/libdoveadm_mail_crypt_plugin.so: undefined symbol: mail_crypt_box_get_pvt_digests (this is usually intentional, so just ignore this message) doveadm(synctest)<13056><>: Debug: auth USER input: synctest system_groups_user=synctest uid=1006 gid=100 home=/home/synctest doveadm(synctest): Debug: remote(192.168.3.1:12345): auth USER input: synctest system_groups_user=synctest uid=1006 gid=100 home=/home/synctest doveadm(synctest): Debug: remote(192.168.3.1:12345): Effective uid=1006, gid=100, home=/home/synctest doveadm(synctest): Debug: remote(192.168.3.1:12345): Namespace inbox: type=private, prefix=, sep=, inbox=yes, hidden=no, list=yes, subscriptions=yes location=mbox:~/mail/mailboxes:INBOX=/var/mail/synctest:DIRNAME=mBoX-MeSsAgEs:INDEX=~/mail/index:CONTROL=~/mail/control doveadm(synctest): Debug: remote(192.168.3.1:12345): fs: root=/home/synctest/mail/mailboxes, index=/home/synctest/mail/index, indexpvt=, control=/home/synctest/mail/control, inbox=/var/mail/synctest, alt= doveadm(synctest): Debug: Effective uid=1006, gid=100, home=/home/synctest doveadm(synctest): Debug: Namespace inbox: type=private, prefix=, sep=, inbox=yes, hidden=no, list=yes, subscriptions=yes location=mbox:~/mail/mailboxes:INBOX=/var/mail/synctest:DIRNAME=mBoX-MeSsAgEs:INDEX=~/mail/index:CONTROL=~/mail/control doveadm(synctest): Debug: fs: root=/home/synctest/mail/mailboxes, index=/home/synctest/mail/index, indexpvt=, control=/home/synctest/mail/control, inbox=/var/mail/synctest, alt= doveadm(synctest): Debug: brain M: Namespace has location mbox:~/mail/mailboxes:INBOX=/var/mail/synctest:DIRNAME=mBoX-MeSsAgEs:INDEX=~/mail/index:CONTROL=~/mail/control doveadm(synctest): Debug: Namespace : /home/synctest/mail/mailboxes/INBOX doesn't exist yet, using default permissions doveadm(synctest): Debug: Namespace : Using permissions from /home/synctest/mail/mailboxes: mode=0700 gid=default dsync-local(synctest)<VqbhHQhL818AMwAAaso27A>: Debug: brain M: Local mailbox tree: INBOX guid=f8ecea204a65f05fea460000b4581695 uid_validity=1609590090 uid_next=9 subs=no last_change=0 last_subs=0 dsync-local(synctest)<VqbhHQhL818AMwAAaso27A>: Debug: brain M: Remote mailbox tree: INBOX guid=f8ecea204a65f05fea460000b4581695 uid_validity=1609590090 uid_next=9 subs=no last_change=0 last_subs=0 dsync-local(synctest)<VqbhHQhL818AMwAAaso27A>: Debug: brain M: Mailbox INBOX: local=f8ecea204a65f05fea460000b4581695/0/1, remote=f8ecea204a65f05fea460000b4581695/0/1: Mailboxes are equal dsync-local(synctest)<VqbhHQhL818AMwAAaso27A>: Debug: Namespace : /home/synctest/mail/mailboxes/INBOX doesn't exist yet, using default permissions dsync-local(synctest)<VqbhHQhL818AMwAAaso27A>: Debug: Namespace : Using permissions from /home/synctest/mail/mailboxes: mode=0700 gid=default dsync-local(synctest)<VqbhHQhL818AMwAAaso27A>: Debug: brain M: Import INBOX: Import change type=expunge GUID=<unknown> UID=1 hdr_hash= result=Expunged mail has no GUID, can't verify it dsync-local(synctest)<VqbhHQhL818AMwAAaso27A>: Debug: brain M: Import INBOX: Import change type=expunge GUID=<unknown> UID=2 hdr_hash= result=Expunged mail has no GUID, can't verify it dsync-local(synctest)<VqbhHQhL818AMwAAaso27A>: Debug: brain M: Import INBOX: Import change type=expunge GUID=<unknown> UID=3 hdr_hash= result=Expunged mail has no GUID, can't verify it dsync-local(synctest)<VqbhHQhL818AMwAAaso27A>: Debug: brain M: Import INBOX: Import change type=expunge GUID=<unknown> UID=4 hdr_hash= result=Expunged mail has no GUID, can't verify it dsync-local(synctest)<VqbhHQhL818AMwAAaso27A>: Debug: brain M: Import INBOX: Import change type=expunge GUID=<unknown> UID=5 hdr_hash= result=Expunged mail has no GUID, can't verify it dsync-local(synctest)<VqbhHQhL818AMwAAaso27A>: Debug: brain M: Import INBOX: Import change type=expunge GUID=<unknown> UID=6 hdr_hash= result=Expunged mail has no GUID, can't verify it dsync-local(synctest)<VqbhHQhL818AMwAAaso27A>: Warning: Deleting mailbox 'INBOX': UID=7 already exists locally for a different mail: Headers hashes don't match (9fc2f2229a1a2a8d5f12304cb5287f97 vs b62e0281b4f375a45040c552b55ab31a) dsync-local(synctest)<VqbhHQhL818AMwAAaso27A>: Debug: brain M: Import INBOX: Import change type=save GUID=8bce3bc615e7f2a1dfad970a3cd36bdb UID=7 hdr_hash=9fc2f2229a1a2a8d5f12304cb5287f97 result=Headers hashes don't match (9fc2f2229a1a2a8d5f12304cb5287f97 vs b62e0281b4f375a45040c552b55ab31a) dsync-local(synctest)<VqbhHQhL818AMwAAaso27A>: Debug: brain M: Import INBOX: Saved UIDs: dsync-local(synctest)<VqbhHQhL818AMwAAaso27A>: Debug: doveadm-sieve: Iterating Sieve mailbox attributes dsync-local(synctest)<VqbhHQhL818AMwAAaso27A>: Debug: sieve: Pigeonhole version 0.5.4 () initializing dsync-local(synctest)<VqbhHQhL818AMwAAaso27A>: Debug: sieve: include: sieve_global is not set; it is currently not possible to include `:global' scripts. dsync-local(synctest)<VqbhHQhL818AMwAAaso27A>: Debug: sieve: file storage: Using active Sieve script path: /home/synctest/.dovecot.sieve dsync-local(synctest)<VqbhHQhL818AMwAAaso27A>: Debug: sieve: file storage: Using script storage path: /home/synctest/sieve dsync-local(synctest)<VqbhHQhL818AMwAAaso27A>: Debug: sieve: file storage: Using permissions from /home/synctest/sieve: mode=0700 gid=-1 dsync-local(synctest)<VqbhHQhL818AMwAAaso27A>: Debug: sieve: file storage: Relative path to sieve storage in active link: sieve/ dsync-local(synctest)<VqbhHQhL818AMwAAaso27A>: Debug: sieve: file storage: sync: Synchronization active dsync-local(synctest)<VqbhHQhL818AMwAAaso27A>: Error: Couldn't delete mailbox INBOX: Permission denied root@server2:/home/synctest/mail# dovecot -n # 2.3.4.1 (f79e8e7e4): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.4 () # OS: Linux 4.19.0-12-amd64 x86_64 Debian 10.6 # Hostname: server2.fritz.box auth_username_format = %Ln doveadm_password = # hidden, use -P to show it lda_mailbox_autocreate = yes login_trusted_networks = 192.168.3.0/24 mail_location = mbox:~/mail/mailboxes:INBOX=/var/mail/%u:DIRNAME=mBoX-MeSsAgEs:INDEX=~/mail/index:CONTROL=~/mail/control mail_privileged_group = mail managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } passdb { driver = pam } plugin { sieve = ~/.dovecot.sieve sieve_default = /var/lib/dovecot/sieve/default.sieve sieve_dir = ~/sieve } postmaster_address = postmaster@"domain" protocols = imap pop3 lmtp service doveadm { inet_listener { port = 12345 } } service managesieve-login { inet_listener sieve { port = 4190 } } ssl_cert = </etc/letsencrypt/live/"domain"/fullchain.pem ssl_dh = # hidden, use -P to show it ssl_key = # hidden, use -P to show it userdb { driver = passwd } protocol lmtp { mail_plugins = " sieve" } protocol lda { mail_plugins = " sieve" }

4 6

Pigeonhole v0.5.13 build fails on OS X 10.11.6
by Steve Akerman 06 Jan '21

06 Jan '21

Hi, Dovecot 2.3.13 builds successfully on this old OS X, but pigeonhole v0.5.13fails as below: gcc -DHAVE_CONFIG_H -I. -I../.. -I/usr/local/include/dovecot -I../.. -I../../src/lib-managesieve -fPIE -DPIE -std=gnu99 -g -O2 -Wall -W -Wmissing-prototypes -Wmissing-declarations -Wpointer-arith -Wchar-subscripts -Wformat=2 -Wbad-function-cast -Wno-duplicate-decl-specifier -Wstrict-aliasing=2 -fstack-protector-strong -U_FORTIFY_SOURCE -D_FORTIFY_SOURCE=2 -I../.. -MT managesieve_login-client.o -MD -MP -MF .deps/managesieve_login-client.Tpo -c -o managesieve_login-client.o `test -f 'client.c' || echo './'`client.c In file included from client.c:23: ./managesieve-proxy.h:8:15: warning: declaration of 'enum login_proxy_failure_type' will not be visible outside of this function [-Wvisibility] enum login_proxy_failure_type type, ^ client.c:518:3: error: field designator 'proxy_failed' does not refer to any field in type 'struct client_vfuncs' .proxy_failed = managesieve_proxy_failed, ^ 1 warning and 1 error generated. make: *** [managesieve_login-client.o] Error 1 This appears to be related to the change from manage sieve_proxy_ error to manage sieve_proxy_failed. Pigeonhole v0.5.11 builds without problem on the same machine. The warning appears to be related to the lack of a declaration, but I am no expert. The error I have no idea!!! Is this related to my old compiler, or is there an issue here? Can anyone propose a workaround, as I would like to use Dovecot 2.3.13, but will get version mismatch errors if I do not upgrade pigeonhole. Thanks in advance

1 1

Ubuntu packages
by Aki Tuomi 06 Jan '21

06 Jan '21

Hi! Since Ubuntu 20.04 LTS is nowadays available, we have dropped 16.04 support from 2.3.13 as per policy of supporting two latest releases of operating system. Dovecot 2.3.11.3 is latest version we provide packages for 16.04. Please find Ubuntu 20.04 packages at https://repo.dovecot.org/ Kind regards, Aki Tuomi Open-Xchange oy

1 0

Imapsieve FLAG cause executes a pipe call twice
by DocMAX 06 Jan '21

06 Jan '21

I have this setup: imapsieve_mailbox1_name = * imapsieve_mailbox1_causes = FLAG imapsieve_mailbox1_before = file:~/sieve/learn-flag.sieve Now if i change the SPAM flag i can see: Dez 24 14:49:08 server dovecot[219886]: imap(docmax)<221469><BStCETa3fMzAqAEB>: Debug: imapsieve: mailbox Junk-E-Mail/dziennik.pl: FLAG event (changed flags: NonJunk) Dez 24 14:49:08 server dovecot[219886]: imap(docmax)<221469><BStCETa3fMzAqAEB>: Debug: imapsieve: Matched static mailbox rule [1] Dez 24 14:49:08 server dovecot[219886]: imap(docmax)<221469><BStCETa3fMzAqAEB>: Debug: imapsieve: mailbox Junk-E-Mail/dziennik.pl: FLAG event (changed flags: Junk) Dez 24 14:49:08 server dovecot[219886]: imap(docmax)<221469><BStCETa3fMzAqAEB>: Debug: imapsieve: Matched static mailbox rule [1] Dez 24 14:49:11 server dovecot[219886]: imap(docmax)<221469><BStCETa3fMzAqAEB>: Debug: imapsieve: mailbox Junk-E-Mail/dziennik.pl: FLAG event (changed flags: Junk) Dez 24 14:49:11 server dovecot[219886]: imap(docmax)<221469><BStCETa3fMzAqAEB>: Debug: imapsieve: Matched static mailbox rule [1] Dez 24 14:49:11 server dovecot[219886]: imap(docmax)<221469><BStCETa3fMzAqAEB>: Debug: imapsieve: mailbox Junk-E-Mail/dziennik.pl: FLAG event (changed flags: NonJunk) And my script is: require [ "variables" , "imap4flags", "fileinto", "vnd.dovecot.pipe", "copy", "imapsieve", "vnd.dovecot.execute" ]; if hasflag :is "Junk" { pipe :copy "rspam-spam"; stop; } if hasflag :is "NonJunk" { pipe :copy "rspam-ham"; stop; } Dez 24 15:05:24 server dovecot[222484]: imap(docmax)<224089></EW5RDa3UMPAqAEB>: Debug: sieve: action pipe: running program: rspam-spam Dez 24 15:05:24 server dovecot[222484]: imap(docmax)<224089></EW5RDa3UMPAqAEB>: Debug: sieve: action pipe: running program: rspam-ham Dez 24 15:05:27 server dovecot[222484]: imap(docmax)<224089></EW5RDa3UMPAqAEB>: Debug: sieve: action pipe: running program: rspam-spam Dez 24 15:05:27 server dovecot[222484]: imap(docmax)<224089></EW5RDa3UMPAqAEB>: Debug: sieve: action pipe: running program: rspam-spam Dez 24 15:05:32 server dovecot[222484]: imap(docmax)<224089></EW5RDa3UMPAqAEB>: Debug: sieve: action pipe: running program: rspam-spam Dez 24 15:05:32 server dovecot[222484]: imap(docmax)<224089></EW5RDa3UMPAqAEB>: Debug: sieve: action pipe: running program: rspam-ham Dez 24 15:05:36 server dovecot[222484]: imap(docmax)<224089></EW5RDa3UMPAqAEB>: Debug: sieve: action pipe: running program: rspam-spam Dez 24 15:05:36 server dovecot[222484]: imap(docmax)<224089></EW5RDa3UMPAqAEB>: Debug: sieve: action pipe: running program: rspam-spam I espected to have only ONE pipe when i change flag (in Thunderbird). Instead i get multiple calls. Why is that and how can i fix it? Regards, DocMAX

3 2

Dovecot Folder and file permissions.
by Thomas Strike 06 Jan '21

06 Jan '21

While working with adding a website to apache on my server something caused a blanket resetting of all file permissions on the server to apache:apache. I have most of the server running again but my mail services is another story. I have configured vmail on a Postfix with Dovecot and mariadb install. What I need is help with reestablishing the correct file and folder permissions that dovecot uses. The following is my configuration; # OS: Linux 4.18.0-147.3.1.el8_1.x86_64 x86_64 CentOS Linux release 8.1.1911 (Core) xfs # Dovecot version# 2.2.36 (1f10bfa63) # Hostname: sleepyvalley auth_mechanisms = plain login mail_home = /var/vmail/%d/%n mail_location = maildir:/var/vmail/%d/%n mail_privileged_group = mail mail_uid = vmail mbox_write_locks = fcntl namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } passdb { args = /etc/dovecot/dovecot-sql.conf.ext driver = sql } passdb { args = scheme=CRAM-MD5 username_format=%u /etc/dovecot/users driver = passwd-file } postmaster_address = postmaster(a)sleepyvalley.net service auth-worker { user = vmail } service auth { unix_listener /var/spool/postfix/private/auth { mode = 0666 } unix_listener auth-userdb { mode = 0666 user = vmail } } service lmtp { unix_listener /var/spool/postfix/private/dovecot-lmtp { group = postfix mode = 0666 user = postfix } } ssl_cert = </etc/letsencrypt/live/mail.sleepyvalley.net/fullchain.pem ssl_cipher_list = PROFILE=SYSTEM ssl_key = # hidden, use -P to show it userdb { args = /etc/dovecot/dovecot-sql.conf.ext driver = sql } userdb { args = uid=vmail gid=vmail home=/home/vmail/%d/%n driver = static } I really need help with this, thanks.

2 1

CVE fixed?
by Oren Savich 05 Jan '21

05 Jan '21

Hi, I wanted to know if you fixed CVE-2020-24386 & CVE-2020-25275. If so, in what commits? thanks in advance!

2 1

Panic file istream-seekable.c
by Eric Mauger 04 Jan '21

04 Jan '21

2 1

set up for Dovecot redundancy -- store on edge server only if link to backofc server is down, otherwise deliver to final dest?
by PGNet Dev 04 Jan '21

04 Jan '21

I run Postfix + Dovecot. Currently, I've got a cloud-instance of Postfix that handles all the anti-spam/auth/routing. On successful 'pass', it resends email -- over a VPN link -- to a *local* Postfix instance, which then LMTP-delivers to a Dovecot instance on the same box. Works great. I'd like to set up some IMAP redundancy, so that if the VPN link is down for any reason, mail is stored/accessible, and -- eventually -- correctly (re)delivered to the local Dovecot instance when the link's up again. The goal state I'm considering looks like: @cloud Postfix LMTP delivery from Postfix to "Dovecot1" @local LMTP (re)delivery from "Dovecot1", @cloud, to "Dovecot2" IDEALLY, no IMAP mail should ever be persistently stored on the @cloud Dovecot instance -- unless the VPN link is down. Then, when the VPN link is up again, the @cloud-stored IMAP mail should me 'moved' to the @local instance. I.e., I do _not_ want a replicated store. My question is how transparent/automated can this be done? I'd guess that somewhere in Dovecot's config I need logic that provides the conditional delivery to just @cloud vs 'all the way' to @local ... Any suggestions as to how to put this VPN-conditional redundancy in place?

2 2

deleting maildata from virtual users
by Alexander Rivanykov 04 Jan '21

04 Jan '21

2 4

CVE-2020-25275: MIME parsing crashes with particular messages
by Aki Tuomi 04 Jan '21

04 Jan '21

Open-Xchange Security Advisory 2021-01-04 Product: Dovecot Vendor: OX Software GmbH Internal reference: DOV-4113 (Bug ID) Vulnerability type: CWE-20: Improper Input Validation Vulnerable version: 2.3.11-2.3.11.3 Vulnerable component: lda, lmtp, imap Report confidence: Confirmed Solution status: Fixed by Vendor Fixed version: 2.3.13 Vendor notification: 2020-09-10 Solution date: 2020-09-14 Public disclosure: 2021-01-04 CVE reference: CVE-2020-25275 CVSS: 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Researcher credit: Innokentii Sennovskiy (Rumata888) from BI.ZONE Vulnerability Details: Mail delivery / parsing crashed when the 10 000th MIME part was message/rfc822 (or if parent was multipart/digest). This happened due to earlier MIME parsing changes for CVE-2020-12100. Risk: Malicious sender can crash dovecot repeatedly by sending / uploading message with more than 10 000 MIME parts. Workaround: These are usually dropped by MTA, where the mitigation can also be applied. Solution: Operators should update to 2.3.13 or later version.

1 0

TLS problem with iOS 9 Mail clients
by Maik Musall 02 Jan '21

02 Jan '21

Hi everyone, recently I migrated my mail server from an Ubuntu 16.04 box to an Ubuntu 20.04 box, so from dovecot 2.2.22 to 2.3.7.2, and to openssl 1.1.1.f. While everything else works fine, I have one important user stuck on an iOS 9 device that I need to support for a while longer, with which the IMAP TLS handshake keeps failing. From the logs: TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol I didn’t find a debug option to dump the TLS handshake details, so I analyzed a packet dump and found the following capabilities and cipher suites offered by the client: Transport Layer Security TLSv1 Record Layer: Handshake Protocol: Client Hello Content Type: Handshake (22) Version: TLS 1.0 (0x0301) Length: 149 Handshake Protocol: Client Hello Handshake Type: Client Hello (1) Length: 145 Version: TLS 1.0 (0x0301) Random: 5fef787ac06215d0a4edefd17602fadf409ab0512e04e62ade6192f2499f4896 Session ID Length: 0 Cipher Suites Length: 50 Cipher Suites (25 suites) Cipher Suite: TLS_EMPTY_RENEGOTIATION_INFO_SCSV (0x00ff) Cipher Suite: TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384 (0xc024) Cipher Suite: TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256 (0xc023) Cipher Suite: TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA (0xc00a) Cipher Suite: TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA (0xc009) Cipher Suite: TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA (0xc008) Cipher Suite: TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 (0xc028) Cipher Suite: TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 (0xc027) Cipher Suite: TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA (0xc014) Cipher Suite: TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA (0xc013) Cipher Suite: TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA (0xc012) Cipher Suite: TLS_DHE_RSA_WITH_AES_256_CBC_SHA256 (0x006b) Cipher Suite: TLS_DHE_RSA_WITH_AES_128_CBC_SHA256 (0x0067) Cipher Suite: TLS_DHE_RSA_WITH_AES_256_CBC_SHA (0x0039) Cipher Suite: TLS_DHE_RSA_WITH_AES_128_CBC_SHA (0x0033) Cipher Suite: TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA (0x0016) Cipher Suite: TLS_RSA_WITH_AES_256_CBC_SHA256 (0x003d) Cipher Suite: TLS_RSA_WITH_AES_128_CBC_SHA256 (0x003c) Cipher Suite: TLS_RSA_WITH_AES_256_CBC_SHA (0x0035) Cipher Suite: TLS_RSA_WITH_AES_128_CBC_SHA (0x002f) Cipher Suite: TLS_RSA_WITH_3DES_EDE_CBC_SHA (0x000a) Cipher Suite: TLS_ECDHE_ECDSA_WITH_RC4_128_SHA (0xc007) Cipher Suite: TLS_ECDHE_RSA_WITH_RC4_128_SHA (0xc011) Cipher Suite: TLS_RSA_WITH_RC4_128_SHA (0x0005) Cipher Suite: TLS_RSA_WITH_RC4_128_MD5 (0x0004) Compression Methods Length: 1 Compression Methods (1 method) Compression Method: null (0) Extensions Length: 54 Extension: server_name (len=19) Type: server_name (0) Length: 19 Server Name Indication extension Extension: supported_groups (len=8) Extension: ec_point_formats (len=2) Type: ec_point_formats (11) Length: 2 EC point formats Length: 1 Elliptic curves point formats (1) EC point format: uncompressed (0) Extension: status_request (len=5) Type: status_request (5) Length: 5 Certificate Status Type: OCSP (1) Responder ID list Length: 0 Request Extensions Length: 0 Extension: signed_certificate_timestamp (len=0) Type: signed_certificate_timestamp (18) Length: 0 I already tweaked the dovecot-ssl config down with "ssl_min_protocol = TLSv1” and included ECDHE-ECDSA-AES256-SHA in the cipher list, but the client still won’t connect. Does anyone have an idea what else I could try? Thanks Maik

2 6

LDA ignores virtual mailbox settings
by Toni Mueller 01 Jan '21

01 Jan '21

Hi, I have a Debian/Buster system with Postfix and Dovecot from the Debian repo, and with virtual users only (ie, no system users). These virtual users are having all of their uids, gids, homes and mail quota in an PostgreSQL database. The intent is to have postfix deliver the email via dovecot's LDA, so I can set quota on a per-user basis. But for some odd reason, Dovecot's LDA can't find the user data from the userdb, and then complains about not being able to write to /var/mail. The following example shows how things fail when delivering a message from Postfix's queue (therefore, the passdb failure is expected): In /etc/dovecot.conf, I have this, amongst other things: mail_location = maildir:~/Maildir:INBOX=~/Maildir passdb { driver = sql args = /etc/dovecot/dovecot-sql.conf.ext } userdb { driver = prefetch } userdb { driver = sql args = /etc/dovecot/dovecot-sql.conf.ext } protocol lda { mail_plugins = autocreate quota mail_log trash virtual notify } 16:04:16 postfix/qmgr[4970]: 8CD6CE072E: from=<user(a)example.com>, size=880, nrcpt=1 (queue active) 16:04:16 dovecot: auth: Debug: master in: USER#0111#011user(a)example.com#011service=lda 16:04:16 dovecot: auth: Debug: prefetch(user(a)example.com): passdb didn't return userdb entries, trying the next userdb 16:04:16 dovecot: auth: Debug: sql(user(a)example.com): SELECT '/path-to-mailboxen/' || virtual_users.home AS home, uid , gid , quota as quota_rule FROM virtual_users WHERE email = 'user(a)example.com' AND status = 'A' 16:04:16 dovecot: auth: Debug: userdb out: USER#0111#011user@example.com#011home=/path-to-mailboxen/example.com/user#011uid=12345#011gid=12345#011quota_rule=*:storage=0 ^^^^^^^^^^^^^^^^^^^^^^ This shows that the database lookup works. The intended effect should be that the message is delivered to /path-to-mailboxen/example.com/user/Maidir/new 16:04:16 dovecot: lda(user(a)example.com)<5291><DDxBHYCw6F+rFAAApiCoHg>: Error: setegid(privileged) failed: Operation not permitted 16:04:16 dovecot: lda(user(a)example.com)<5291><DDxBHYCw6F+rFAAApiCoHg>: Error: Mailbox INBOX: open(/var/mail/user(a)example.com) failed: Permission denied (euid=12345(mailbox) egid=12345(mailbox) missing +w perm: /var/mail, we're not in group 8(mail), dir owned by 0:8 mode=0775) ^^^^^^^^^^^^^^^^^^^^^^ And this shows that dovecot-lda just ignores the result. 16:04:16 dovecot: lda(user(a)example.com)<5291><DDxBHYCw6F+rFAAApiCoHg>: Error: Mailbox INBOX: Failed to autocreate mailbox: Mailbox INBOX: open(/var/mail/user(a)example.com) failed: Permission denied (euid=12345(mailbox) egid=12345(mailbox) missing +w perm: /var/mail, we're not in group 8(mail), dir owned by 0:8 mode=0775) 16:04:16 dovecot: lda(user(a)example.com)<5291><DDxBHYCw6F+rFAAApiCoHg>: msgid=<20201226224933.014608(a)laptop.example.com>: save failed to open mailbox INBOX: Mailbox INBOX: Failed to autocreate mailbox: Mailbox INBOX: open(/var/mail/user(a)example.com) failed: Permission denied (euid=12345(mailbox) egid=12345(mailbox) missing +w perm: /var/mail, we're not in group 8(mail), dir owned by 0:8 mode=0775) 16:04:16 postfix/pipe[5284]: 8CD6CE072E: to=<user(a)example.com>, orig_to=<userA(a)example2.com>, relay=dovecot, delay=62083, delays=62083/0.04/0/0.04, dsn=4.3.0, status=deferred (temporary failure) In /etc/postfix/master.cf, I have this to call it: dovecot unix - n n - - pipe flags=DRhu user=_mailbox argv=/usr/lib/dovecot/deliver -f ${sender} -d ${user}@${domain} -a ${recipient} I've tried strace-ing dovecot-lda, but it didn't really help me to understand why it discards the result of the userdb lookup. Can anyone please provide a cluebat, please? Thanks, Toni

5 15

Re: Using dovecot with RoundCubeMail - where is the information for new mail in (blue coloured) directories?
by Scott Ruckh 01 Jan '21

01 Jan '21

On 2020-12-20 17:37, Philip Rhoades wrote: > @lbutlr, > > > On 2020-12-21 00:43, @lbutlr wrote: >> On 20 Dec 2020, at 04:05, Philip Rhoades <phil(a)pricom.com.au> wrote: >>> I guess that is what it seems to look like to me as well - but what >>> does that mean for what I am trying to do? - ie reset the blue folder >>> highlight arbitrarily? >> >> Sound like the Roundcube style choices are outside th purview of >> dovecot. > > > Hmm . . the first response I got here was that it was definitely an > IMAP thing . . I think he was unclear about the actual problem . . > > I will try the RCM forum . . > > Thanks, > > P. I am not sure I have understood this thread completely, but I am running dovecot/RoundCube. If a folder has new messages, then it has a badge that is dark blue (with the theme I am using) with the number of un-read messages. Otherwise it has a badge that is light-blue to indicate un-read messages only. Folders with no badges have zero un-read messages. So there is definitely a distinction for "new" messages.

2 1

migration from 2.0.16
by Barbara M. 01 Jan '21

01 Jan '21

I have an old server with CentOS 6.x and dovecot 2.0.16 (postfix-2.6.6 and roundcube), that was an update from a 1.x many years ago ... Users in /etc/passwd Mailbox format mbox some filtering via procmail About 5.000 users, 1 TB data (/var/mail + /home/users) Obviously I am searching for a smooth upgrade path (with no or minimal downtime and users problems) ;-) Until few days ago my idea was a CentOS 8.x new box with the standard default packages (dovecot-2.3.8, postfix-3.3, ...). Now this can be reconsidered. I suppose there will be a RockyLinux or something equivalent but if there is a good reason I can consider Debian or other OS if they have a decent EOL or some advantages. Anyway, the more relevant problem at the moment is collect info for the best approch to have a smooth dovecot upgrade. My dream is the possibility to configure a new server and rsync the data (/var/mail + /home/users), and, when the tests are satisfiable do the final sync and swap the IP, but I suppose deleting the .imap folders isn't a simple complete solution to compatibility problems. Any hints, links, experiences are appreciated. Thanks, B.

6 9

Initial Replication
by David Morsberger 01 Jan '21

01 Jan '21

I searched the archives and do not see a question/answer for this. Should I perform a set of ordered steps after setting up replication? I have setup dovecot on both ends with identical config except for the remote hostname. Main concern is the existing server gets replicated to the new server. I want nothing from new server replicated to the old server. Risking "Trial and error" and "crossing fingers” doesn’t work with production emails Specifically: Do I need to setup the mail directories for the various virtual users on the remote? If so, do the directories need to empty? Should I initially do a manually one-way synch using doveadm from the existing server? If so, is there a way of turning off automatic replication while the manual one runs? Anything else? T David

2 2

Imap client with ~7500 imap cmds ~250/~500 read() syscall
by Marc Roos 31 Dec '20

31 Dec '20

I am playing a bit with the monitoring, and I have noticed there is one client of the chart with ~7500, while the others are between ~17 and ~60 (dovecot_user_num_cmds). I assume this is related to the client, or is it possible something is wrong on the server side? Is someone having also such numbers or is this really strange. Is it possible to limit these cmd's?

3 8

mail-crypt when using passwd-file driver
by Adam Gould 31 Dec '20

31 Dec '20

Hi, I am just finishing my first personal email server build so I would really appreciate it if the response to my question can be spelled out in enough detail since I am struggling to fill in the gaps to get this working. I have scoured Google and the archives but I am not fully understanding the implementation for my setup. I am looking for a solution to encrypt email using a mechanism that increases the difficulty of decrypting my email. For example, having a plain-text decryption key on disk would not be suitable. From what I understand mail-crypt supports using the user password supplied via IMAP to decrypt email. Can someone explain how this technically works? i.e. is the private key encrypted in disk and then unlocked using the supplied password? Can someone also please step me through 1. how I would ammen the configuration below in order to set this up. 2. the command required to generate keys 3. Any help in understanding the limitations such as password changes or caveats around generating keys securely I am happy to take my notes and update the wiki to help others. Thanks, Adam # 2.3.8 (9df20d2db): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.8 (b7b03ba2) # OS: Linux 4.18.0-240.1.1.el8_3.x86_64 x86_64 Red Hat Enterprise Linux release 8.3 (Ootpa) # Hostname: mailserver.example.com debug_log_path = /var/log/dovecot-debug.log info_log_path = /var/log/dovecot-info.log lda_mailbox_autocreate = yes log_path = /var/log/dovecot.log log_timestamp = "%Y-%m-%d %H:%M:%S " mail_home = /var/mail/%d/%n/ mail_location = maildir:~/mail/ mail_privileged_group = mail managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext namespace inbox { inbox = yes location = mailbox Archive { auto = create special_use = \Archive } mailbox Drafts { auto = create special_use = \Drafts } mailbox Junk { auto = create special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { auto = create special_use = \Trash } prefix = } passdb { args = scheme=CRYPT username_format=%n@%d /etc/dovecot/passdb driver = passwd-file } plugin { recipient_delimiter = - sieve = ~/.dovecot.sieve sieve_dir = ~/sieve sieve_global_dir = /etc/sieve/global/ } protocols = imap lmtp service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0600 user = postfix } } service imap-login { inet_listener imap { address = * port = 143 ssl = yes } } service lmtp { unix_listener /var/spool/postfix/private/dovecot-lmtp { group = postfix mode = 0600 user = postfix } } ssl_cert = </etc/letsencrypt/live/mail.example.com/fullchain.pem ssl_cipher_list = ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384: DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA: ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256: DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384: AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH: !EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA ssl_dh = # hidden, use -P to show it ssl_key = # hidden, use -P to show it ssl_min_protocol = TLSv1.2 ssl_prefer_server_ciphers = yes userdb { args = uid=vmail gid=vmail home=/var/mail/%d/%n driver = static } protocol lmtp { mail_fsync = optimized mail_plugins = " sieve" recipient_delimiter = - }

2 1

Solr and FTS - assertion failure
by Antonino Esposito 31 Dec '20

31 Dec '20

Hi, in the latest weeks i'm working on the Solr integration and immediately i've faced the assertion failure errors, on 2.0.19, 2.2.9 and 2.3.11.3 servers in our network. Reading the thread on debian ML, I realize this issue is related to nested MIME and it affects large mailboxes In my case, the error in dovecot.log pairs with the following on solr.log and it seems the rows value has the same value of the last UID recorded in the mailbox. For your reference, here is the Solr logs, where *2276996170* is the value passed by Dovecot as rows number and it clearly don't fit with the rows data type. Have you had experienced the same behaviour? Is there a workaround? Thanks Antonino 2020-12-30 12:07:33.897 ERROR (qtp1162918744-918) [ x:qadisha] o.a.s.h.RequestHandlerBase org.apache.solr.common.SolrException: For input string: "2276996170" at org.apache.solr.common.params.SolrParams.getInt(SolrParams.java:236) at org.apache.solr.search.QParser.getSortSpec(QParser.java:274) at org.apache.solr.handler.component.QueryComponent.prepare(QueryComponent.java:189) at org.apache.solr.handler.component.SearchHandler.handleRequestBody(SearchHandler.java:337) at org.apache.solr.handler.RequestHandlerBase.handleRequest(RequestHandlerBase.java:214) at org.apache.solr.core.SolrCore.execute(SolrCore.java:2627) at org.apache.solr.servlet.HttpSolrCall.execute(HttpSolrCall.java:795) at org.apache.solr.servlet.HttpSolrCall.call(HttpSolrCall.java:568) at org.apache.solr.servlet.SolrDispatchFilter.doFilter(SolrDispatchFilter.java:415) at org.apache.solr.servlet.SolrDispatchFilter.doFilter(SolrDispatchFilter.java:345) at org.eclipse.jetty.servlet.ServletHandler$CachedChain.doFilter(ServletHandler.java:1596) at org.eclipse.jetty.servlet.ServletHandler.doHandle(ServletHandler.java:545) at org.eclipse.jetty.server.handler.ScopedHandler.handle(ScopedHandler.java:143) at org.eclipse.jetty.security.SecurityHandler.handle(SecurityHandler.java:590) at org.eclipse.jetty.server.handler.HandlerWrapper.handle(HandlerWrapper.java:127) at org.eclipse.jetty.server.handler.ScopedHandler.nextHandle(ScopedHandler.java:235) at org.eclipse.jetty.server.session.SessionHandler.doHandle(SessionHandler.java:1610) at org.eclipse.jetty.server.handler.ScopedHandler.nextHandle(ScopedHandler.java:233) at org.eclipse.jetty.server.handler.ContextHandler.doHandle(ContextHandler.java:1300) at org.eclipse.jetty.server.handler.ScopedHandler.nextScope(ScopedHandler.java:188) at org.eclipse.jetty.servlet.ServletHandler.doScope(ServletHandler.java:485) at org.eclipse.jetty.server.session.SessionHandler.doScope(SessionHandler.java:1580) at org.eclipse.jetty.server.handler.ScopedHandler.nextScope(ScopedHandler.java:186) at org.eclipse.jetty.server.handler.ContextHandler.doScope(ContextHandler.java:1215) at org.eclipse.jetty.server.handler.ScopedHandler.handle(ScopedHandler.java:141) at org.eclipse.jetty.server.handler.ContextHandlerCollection.handle(ContextHandlerCollection.java:221) at org.eclipse.jetty.server.handler.InetAccessHandler.handle(InetAccessHandler.java:177) at org.eclipse.jetty.server.handler.HandlerCollection.handle(HandlerCollection.java:146) at org.eclipse.jetty.server.handler.HandlerWrapper.handle(HandlerWrapper.java:127) at org.eclipse.jetty.rewrite.handler.RewriteHandler.handle(RewriteHandler.java:322) at org.eclipse.jetty.server.handler.HandlerWrapper.handle(HandlerWrapper.java:127) at org.eclipse.jetty.server.Server.handle(Server.java:500) at org.eclipse.jetty.server.HttpChannel.lambda$handle$1(HttpChannel.java:383) at org.eclipse.jetty.server.HttpChannel.dispatch(HttpChannel.java:547) at org.eclipse.jetty.server.HttpChannel.handle(HttpChannel.java:375) at org.eclipse.jetty.server.HttpConnection.onFillable(HttpConnection.java:273) at org.eclipse.jetty.io.AbstractConnection$ReadCallback.succeeded(AbstractConnection.java:311) at org.eclipse.jetty.io.FillInterest.fillable(FillInterest.java:103) at org.eclipse.jetty.io.ChannelEndPoint$2.run(ChannelEndPoint.java:117) at org.eclipse.jetty.util.thread.strategy.EatWhatYouKill.runTask(EatWhatYouKill.java:336) at org.eclipse.jetty.util.thread.strategy.EatWhatYouKill.doProduce(EatWhatYouKill.java:313) at org.eclipse.jetty.util.thread.strategy.EatWhatYouKill.tryProduce(EatWhatYouKill.java:171) at org.eclipse.jetty.util.thread.strategy.EatWhatYouKill.run(EatWhatYouKill.java:129) at org.eclipse.jetty.util.thread.ReservedThreadExecutor$ReservedThread.run(ReservedThreadExecutor.java:375) at org.eclipse.jetty.util.thread.QueuedThreadPool.runJob(QueuedThreadPool.java:806) at org.eclipse.jetty.util.thread.QueuedThreadPool$Runner.run(QueuedThreadPool.java:938) at java.lang.Thread.run(Thread.java:748) Caused by: java.lang.NumberFormatException: For input string: "2276996170" at java.lang.NumberFormatException.forInputString(NumberFormatException.java:65) at java.lang.Integer.parseInt(Integer.java:583) at java.lang.Integer.valueOf(Integer.java:766) at org.apache.solr.common.params.SolrParams.getInt(SolrParams.java:233) ... 46 more 2020-12-30 12:07:33.897 INFO (qtp1162918744-918) [ x:qadisha] o.a.s.c.S.Request [qadisha] webapp=/solr path=/select params={q={!lucene+q.op%3DAND}from:mykeyword+OR+to:mykeyword+OR+subject:mykeyword&fl=uid,score&sort=uid+asc&fq=% 2Bbox:6d2c381de797e95fbb160000c46e3ae7+%2Buser:info@qadisha.it&rows=2276996170&wt=xml} status=400 QTime=1

2 2

Re: import_environment = $import_environment DEBUG=1 where should this be logged?
by Odhiambo Washington 30 Dec '20

30 Dec '20

Hi Marc, The same document says this: rawlog binary It works by checking if dovecot.rawlog/ directory exists in the logged in user's home directory, and writing the traffic to yyyymmdd-HHMMSS-pid.in and .out files. Each connection gets their own in/out files. *Rawlog will simply skip users who don't have the dovecot.rawlog/ directory and the performance impact for those users is minimal.* On Wed, 30 Dec 2020 at 20:10, Marc Roos <M.Roos(a)f1-outsourcing.eu> wrote: > > You know by any chance how to limit this only for one user? > > > > -----Original Message----- > From: Odhiambo Washington [mailto:odhiambo@gmail.com] > Sent: 30 December 2020 18:00 > To: dovecot > Subject: Re: import_environment = $import_environment DEBUG=1 where > should this be logged? > > > Hi Marc, > > If you read the link keenly - Debugging/Rawlog - Dovecot Wiki > <https://wiki.dovecot.org/Debugging/Rawlog> - you will realize that you > need to do some stuff. > I have done them and they produced the results. > > Edit /path/to/dovecot/conf.d/10-master.conf and add the following: > > Under this block: > > add executable = imap postlogin to the block that has service imap { > .... > ... > } > > Then create another block in the same file as follows: > > service postlogin { > executable = script-login -d rawlog > unix_listener postlogin { > } > } > > Identify the user for whom you want the rawlogs: > > doveadm user -u technical(a)mydomain.name > userdb: technical(a)mydomain.name > user : technical(a)mydomain.name > home : /var/spool/virtual/mydomain.name/technical > uid : 26 > gid : 26 > > Now do the following: > cd /var/spool/virtual/mydomain.name/technical > mkdir dovecot.rawlog > chown -R 26:26 dovecot.rawlog > > systemctl restart dovecot (or however you do it in CentOS) > > Now login to imap as the user .. perform some operations. > > Now look inside > /var/spool/virtual/mydomain.name/technical/dovecot.rawlog/ > > PS: Adapt as necessary. I tested this on FreeBSD with dovecot- 2.3.11.3 > > Ignore the /tmp/rawlog/%u portion of the HOWTO. I did it too, but there > was nothing in /tmp/rawlog/ even though I created the directory and did > chmod 1777 /tmp/rawlog. > > Adios. > > > > > On Wed, 30 Dec 2020 at 19:30, Marc Roos <M.Roos(a)f1-outsourcing.eu> > wrote: > > > > > You can also set DEBUG environment to have rawlog log an info > message > why it's not doing anything: > import_environment = $import_environment DEBUG=1 > > Where should this message appear, I also don't have this one. > > [1] > https://wiki2.dovecot.org/Debugging/Rawlog > > > > > -- > > Best regards, > Odhiambo WASHINGTON, > Nairobi,KE > +254 7 3200 0004/+254 7 2274 3223 > "Oh, the cruft.", grep ^[^#] :-) > > > -- Best regards, Odhiambo WASHINGTON, Nairobi,KE +254 7 3200 0004/+254 7 2274 3223 "Oh, the cruft.", grep ^[^#] :-)

1 0

Re: import_environment = $import_environment DEBUG=1 where should this be logged?
by Odhiambo Washington 30 Dec '20

30 Dec '20

Hi Marc, If you read the link keenly - Debugging/Rawlog - Dovecot Wiki <https://wiki.dovecot.org/Debugging/Rawlog> - you will realize that you need to do some stuff. I have done them and they produced the results. Edit /path/to/dovecot/conf.d/10-master.conf and add the following: Under this block: add executable = imap postlogin to the block that has service imap { .... ... } Then create another block in the same file as follows: service postlogin { executable = script-login -d rawlog unix_listener postlogin { } } Identify the user for whom you want the rawlogs: doveadm user -u technical(a)mydomain.name userdb: technical(a)mydomain.name user : technical(a)mydomain.name home : /var/spool/virtual/mydomain.name/technical uid : 26 gid : 26 Now do the following: cd /var/spool/virtual/mydomain.name/technical mkdir dovecot.rawlog chown -R 26:26 dovecot.rawlog systemctl restart dovecot (or however you do it in CentOS) Now login to imap as the user .. perform some operations. Now look inside /var/spool/virtual/mydomain.name/technical/dovecot.rawlog/ PS: Adapt as necessary. I tested this on FreeBSD with dovecot- 2.3.11.3 Ignore the /tmp/rawlog/%u portion of the HOWTO. I did it too, but there was nothing in /tmp/rawlog/ even though I created the directory and did chmod 1777 /tmp/rawlog. Adios. On Wed, 30 Dec 2020 at 19:30, Marc Roos <M.Roos(a)f1-outsourcing.eu> wrote: > > > You can also set DEBUG environment to have rawlog log an info message > why it's not doing anything: > import_environment = $import_environment DEBUG=1 > > Where should this message appear, I also don't have this one. > > [1] > https://wiki2.dovecot.org/Debugging/Rawlog > -- Best regards, Odhiambo WASHINGTON, Nairobi,KE +254 7 3200 0004/+254 7 2274 3223 "Oh, the cruft.", grep ^[^#] :-)

2 2

import_environment = $import_environment DEBUG=1 where should this be logged?
by Marc Roos 30 Dec '20

30 Dec '20

You can also set DEBUG environment to have rawlog log an info message why it's not doing anything: import_environment = $import_environment DEBUG=1 Where should this message appear, I also don't have this one. [1] https://wiki2.dovecot.org/Debugging/Rawlog

1 0

Getting rawlogging working with dovecot 2.2
by Marc Roos 30 Dec '20

30 Dec '20

According to this manual[1] I just have to add these lines to my config, not? protocol imap { rawlog_dir = /tmp/rawlog/%u } I should be seeing something in this /tmp/rawlog if I delete an message via imap not? I have already made this folder 777 and /tmp/rawlog/test 777, but still nothing is there. The normal syslog of dovecot does not report any errors. [1] https://wiki2.dovecot.org/Debugging/Rawlog

1 2

Virtual folder with 'younger' not updating
by Jonathan Casiot 30 Dec '20

30 Dec '20

I have a virtual folder set up with the following in dovecot-virtual: INBOX INBOX.temp ALL YOUNGER 86400 The problem is that messages older than 86,400 seconds (24 hours) never disappear from the folder. Is there any fix for this apart from adding INDEX=MEMORY to the mailbox location in the config file? I'm running Dovecot 2.2.36 on CentOS. Regards, -- Jonathan

2 6

read state not propagated
by Marc Roos 30 Dec '20

30 Dec '20

I have migrated the inbox namespace from mbox to mdbox by doing a doveadm backup to the new server. Both servers are having CentOS7 + dovecot-2.2.36-6.el7_8.1.x86_64, both servers have identical configurations (new server has some different vsz_limits and stats enabled) Now a user complains that an imap mailbox he opens at the same time with a colleague does not propagate the 'read' state. Previously if his colleague read the message, it would show on his mailbox also 'read'. After the transfer it keeps being unread for him. Am I correct to assume that he should indeed get an updated to 'read'? Where should I look to fix this? What can be the cause of this?

3 5

AUTH command behaviour when authentication process failed or aborted by user is changed
by Михаил Сандаков 30 Dec '20

30 Dec '20

Hi all, I have tried to update from 2.3.10.1 to 2.3.11.3 and found some strange change of dovecot behaviour at pop3 authentication. Firstly this changes have been found by my tests with curl. But this can be simply reproduced with telnet too. On version 2.3.10.1 when authentication is failed or aborted by client, client can send "AUTH [auth method]" to retry authentication with the same or another authentication method. Example of client <-> server conversation: server <<< +OK Dovecot ready. client >>> AUTH DIGEST-MD5 server <<< [some_auth_data] client >>> * server <<< -ERR Authentication aborted by client. client >>> AUTH CRAM-MD5 server <<< [another_auth_data] But on version 2.3.11.3 in the same cases client must send only "auth method" without "AUTH". Example of successful conversation on this version: server <<< OK Dovecot ready. client >>> AUTH DIGEST-MD5 server <<< [some_auth_data] client >>> * server <<< -ERR Authentication aborted by client. client >>> CRAM-MD5 server <<< [another_auth_data] And example of what happens if a client will try to do that in an old way on version 2.3.11.3: server <<< OK Dovecot ready. client >>> AUTH DIGEST-MD5 server <<< [some_auth_data] client >>> * server <<< -ERR Authentication aborted by client. client >>> AUTH CRAM-MD5 server <<< ERR [AUTH] Unsupported authentication mechanism. As you can see dovecot tries to find an authentication method by string "AUTH" not by "CRAM-MD5". This change looks strange to me. And changes break curl, because it uses an old way to make authentication. To reproduce it with curl you can just do something like: [user(a)10.52.48.220]# curl -u [user]:[password] --verbose pop3://[dovecot-host] Also seems like new behaviour is not fully accorded to rfc1734 ( https://tools.ietf.org/html/rfc1734) Based on this part of rfc: "If an AUTH command fails with a negative response, the session remains in the AUTHORIZATION state and client may try another authentication mechanism by issuing another AUTH command, or may attempt to authenticate by using the USER/PASS or APOP commands." I think "AUTH command" means full auth command started with "AUTH", not only authentication method. But I may be wrong in the interpretation of this part. I suppose this changes was made in commit https://github.com/dovecot/core/commit/2c42881c056e5ab2e2e14b2f800d6dc72026…, but not sure about this. Seems like if authentication is aborted or failed client->current_cmd is not going to be cleaned. So I suggest to revert old behaviour in this cases. If I am right with commit, it seems like we just need to add clearing client->current_cmd if the authentication process has failed somehow.

2 2

dovecot+ldap with keepalive
by Maciej Milaszewski 28 Dec '20

28 Dec '20

Hi I have dovecot-2.36.4 (director +5 nodes) - backend to auth is openldap+keepalived to second ldap For test i shutdown my ldap server - keepalive works perfectly VIP switched - ldapserach works ok (all connect to second ldap) but I noticed strange dovecot behavior - some user get "no response" or "waiting waiting" in dovecot i use: auth_cache_negative_ttl = 5 mins auth_cache_size = 20 M auth_cache_ttl = 5 mins service lmtp { inet_listener lmtp { address = 127.0.0.1 10.0.100.4 port = 24 } process_min_avail = 5 protocol lmtp { auth_socket_path = director-userdb mail_plugins = quota expire notify mail_log passdb { args = proxy=y nopassword=y port=24 driver = static name = } syslog_facility = local3 } in ldap server i have: idletimeout 256 Any idea ?

1 0

Re: .imap folders
by Aki Tuomi 28 Dec '20

28 Dec '20

On 28/12/2020 13.10, Elise wrote: > Op 27-12-20 om 16:16 schreef Aki Tuomi: > >> The .imap directories contain indexes for dovecot. If you want to put >> them elsewhere, try adding :INDEX=/somewhere/else/%u to your mail >> location. > > Thanks for this. Where should I put this line or is that part of the > command line? > > /Elise > in your mail location, where you have specified `mbox:~/...` We do not recommend using mbox mail format for read-write, as the support for that is limited. Aki

2 1

Very slow mail download/notification with dovecot 2.3.7 and Thunderbird
by ml_dovecot＠thorsten-reichelt.de 28 Dec '20

28 Dec '20

Hi! I know that there are many results if I search for "dovecot thunderbird very slow" on Google but none of them helped me with my problem. :( (I already posted this on February 2020, but forgot to answer. O.o) I am running Ubuntu 20.04 (4GB RAM, 40GB HDD with EXT4) server with the following software: - Dovecot 2.3.7.2 ---- All accounts are using Maildir ---- Sieve filters - Postfix 3.4.13 ---- with opendkim, spamassassin, razor, pyzor, .... And as IMAP client I am using Thunderbird 78.6 on Windows 10. Sieve is used to sort some incoming mails into my 228 folders (56 INBOX. folders and its subfolders (output of "find .INBOX.* -maxdepth 4 -type d -print |wc -l")). The total size of my Maildir directory is 5.5GB. My problem is that it always takes very very long to synchronize the INBOX and its subfolders. Even if there are only a few new messages to be downloaded. Sometimes Thunderbird outputs something like "downloading message 1 of 19" and it takes at least 60 seconds to download all of them. None of these mails is larger than 5kB. And sometimes it seems that the transfer is suspended for a long time and it takes >5 Minutes to synchronize only a few mails. :( And it seems that some folders are never updated in TB. In example I sort all messages from this list into a "INBOX.Mailinglists.ML-Dovecot" subfolder by using a simple sieve rule. But even after 10 minutes TB thinks that there are no new messages. As soon as I click on the ML-Dovecot folder I see in the /var/log/dovecot-info.log file that TB logs on to the server and then displays hundreds, of new messages. I checked twice but I have subscribed to all 228 folders. How can I find the bottleneck? Is there a test tool available that simulates a simple mail client and can analyse an IMAP server? This is the output of "dovecot -n": =============================== # 2.3.7.2 (3c910f64b): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.7.2 () # OS: Linux 5.4.0-54-generic x86_64 Ubuntu 20.04.1 LTS # Hostname: mail.XXXXXXX.de auth_mechanisms = plain login debug_log_path = /var/log/dovecot-debug.log default_client_limit = 15653 default_process_limit = 5200 first_valid_uid = 150 info_log_path = /var/log/dovecot-info.log last_valid_uid = 150 lda_original_recipient_header = X-Original-To log_path = /var/log/dovecot-error.log login_log_format_elements = user=<%u> method=%m rip=%r lip=%l mpid=%e %c %k mail_gid = mail mail_home = /var/vmail/%d/%n mail_location = maildir:~/Maildir mail_uid = vmail managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext namespace inbox { inbox = yes location = mailbox Archive { special_use = \Archive } mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } passdb { args = /etc/dovecot/dovecot-sql.conf.ext driver = sql } plugin { sieve = ~/.dovecot.sieve sieve_default = /var/vmail/global.sieve sieve_dir = ~/sieve } postmaster_address = thorsten(a)MY_DOMAIN.TLD protocols = " imap sieve pop3" service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0666 user = postfix } unix_listener auth-userdb { group = mail mode = 0666 user = vmail } } service imap-login { inet_listener imap { port = 143 } inet_listener imaps { port = 993 ssl = yes } process_limit = 50 process_min_avail = 2 service_count = 20 } service imap { process_limit = 1024 } service managesieve-login { inet_listener sieve { port = 4190 } service_count = 0 } ssl_cert = </etc/ssl/mail/mail.XXXXXXX.de.fullchain.pem ssl_cipher_list = ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384 ssl_dh = # hidden, use -P to show it ssl_key = # hidden, use -P to show it ssl_min_protocol = TLSv1.2 syslog_facility = local5 userdb { args = /etc/dovecot/dovecot-sql.conf.ext driver = sql } protocol lda { deliver_log_format = msgid=%m: %$ mail_plugins = " sieve" rejection_reason = Your message to <%t> was automatically rejected:%n%r } protocol imap { imap_client_workarounds = tb-extra-mailbox-sep imap_idle_notify_interval = 10 mins mail_max_userip_connections = 100 mail_plugins = } protocol sieve { info_log_path = /var/log/dovecot-sieve.log mail_max_userip_connections = 100 managesieve_implementation_string = Dovecot Pigeonhole managesieve_max_line_length = 65536 =============================== Output of "free -h": =============================== free -h total used free shared buff/cache available Mem: 3.8Gi 1.7Gi 1.1Gi 10Mi 958Mi 1.7Gi Swap: 1.0Gi 375Mi 648Mi =============================== Thank you very much! Thorsten

5 6

.imap folders
by Elise 27 Dec '20

27 Dec '20

My user account is located at /usr/home/elise and has a subfolder ./mail In that folder I have some subfolders/subdirectories. What happens now is that dovecot creates all kind of .imap folders in these subfolders. They are all exact mirrors of the base folder(s) the .imap is part of. Can you tell me how I can prevent that dovecot creates these .imap folders other than in my home user folder /usr/home/elise and the /usr/home/elise/mail folder? /Elise

2 1

IMAP from localhost (Squirrelmail) works, IMAP from remote (Outlook) does not authenticate
by Wayne Carrel 25 Dec '20

25 Dec '20

I have been struggling with this for some time now. I have searched, tried, broke it, fixed it, and still no luck. Will somebody please help me see what is wrong? [root@mail ~]# dovecot --version 2.2.36 (1f10bfa63) [root@mail ~]# dovecot -n # 2.2.36 (1f10bfa63): /etc/dovecot/dovecot.conf # OS: Linux 3.10.0-1160.2.2.el7.x86_64 x86_64 CentOS Linux release 7.9.2009 (Core) # Hostname: mail.mydomainname.com auth_mechanisms = plain login disable_plaintext_auth = no first_valid_uid = 1000 mail_location = maildir:~/Maildir mbox_write_locks = fcntl namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } passdb { driver = pam } service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0666 user = postfix } unix_listener auth-userdb { group = postfix user = postfix } } service imap-login { inet_listener imap { port = 143 } inet_listener imaps { port = 993 ssl = yes } } ssl_cert = </etc/pki/dovecot/certs/dovecot.pem ssl_key = # hidden, use -P to show it userdb { driver = passwd } >From maillog: (Successful login from localhost via squirrel mail) Dec 24 16:14:19 mail dovecot: imap-login: Login: user=<terry>, method=PLAIN, rip=::1, lip=::1, mpid=2279, secured, session=<CJKj9z23kN0AAAAAAAAAAAAAAAAAAAAB> (Unsuccessful login from remote ip via Outlook) Dec 24 16:13:53 mail dovecot: imap-login: Disconnected (auth failed, 1 attempts in 4 secs): user=<terry(a)mydomainname.com>, method=PLAIN, rip=75.xx.xx.xx, lip=198.xx.xx.xx, session=<1s/i9T23yspLRsWA> I would be most grateful for any assistance anyone can provide -- my head is sore from beating against the wall! 😊

3 2

doveadm backup -f -n inbox doing writes?
by Marc Roos 22 Dec '20

22 Dec '20

If I start a 'doveadm backup -f -n inbox' on the source server, why do also disk writes increase on the source server (indexes mostly?)

2 2

Repeated Inbox Corruption, how to Troubleshoot?
by Bryan K. Walton 21 Dec '20

21 Dec '20

We are running Dovecot Version 2.3.8 (9df20d2db) (from the CentOS 8 repos). Twice in the last week, I've encountered an issue where my Mutt imap client logs into our imap server and has 0 new messages (when I know that there are a lot of new messages waiting on me). Both times, I've had to shut down my mail client, and then run: doveadm -Dv force-resync -u <username> INBOX After which, I reopen Mutt and all of my new emails appear in the inbox of my mail client. Running the force-resync shows no problems. Furthermore, "doveadm log errors" shows no errors on my account and there is nothing in the logs showing that anything is corrupted for me. Yet, the force-resync is fixing a problem that I can't locate. Where should I be looking (or how should I update my logging) so that I can find out the source of the problem that is causing my repeated inbox problems? Thanks! Bryan Walton -- Bryan K. Walton 319-337-3877 Linux Systems Administrator Leepfrog Technologies, Inc

2 2

Fail2ban and login_trusted_networks
by Javi Legido 21 Dec '20

21 Dec '20

Hi there. First of all many thanks to all the people involved in this project for their time, I really appreciate it. Second my use case: a) Container running Webmail (roundcube) with dovecot-ident plugin enabled <https://github.com/roundcube/roundcubemail/issues/5336#issuecomment-2281310…> . b) Container running Dovecot 2.3.4.1 (docker-mailserver-mysql <https://github.com/Kedu-SCCL/docker-mailserver-mysql>) with fail2ban enabled Since I need to add the private IP address of the webmail to "login_trusted_networks" to "...allow to override their IP addresses and ports" I can keep login to webmail even though if the IP is blocked. Question: there's any way to: a) Allow a certain IP range to override it's IP address and ports (as in "login_trusted_networks") but b) Be blocked, as any other incoming connections, by fail2ban? More context. Once the public IP is banned (8.8.8.8 in this example): ``` 2020-12-21 10:10:31,371 fail2ban.filter [309]: INFO [dovecot] Found 8.8.8.8 - 2020-12-21 10:10:31 2020-12-21 10:10:39,189 fail2ban.filter [309]: INFO [dovecot] Found 8.8.8.8 - 2020-12-21 10:10:39 2020-12-21 10:10:51,222 fail2ban.filter [309]: INFO [dovecot] Found 8.8.8.8 - 2020-12-21 10:10:51 2020-12-21 10:10:52,008 fail2ban.actions [309]: NOTICE [dovecot] Ban 8.8.8.8 ``` I can't reach dovecot by telnet from this public IP: ``` telnet mail.example.com 143 Trying 9.9.9... telnet: Unable to connect to remote host: Connection refused ``` Unless I removed the ban: ``` docker exec mail fail2ban-client set dovecot unbanip 8.8.8.8 ``` Many thanks. Javier

3 3

Using dovecot with RoundCubeMail - where is the information for new mail in (blue coloured) directories?
by Philip Rhoades 21 Dec '20

21 Dec '20

People, Every few years I try to work this problem out - occasionally I would like to re-mark a dir as having new mail so that the dir shows up as blue-coloured in RCM. Every time I Google in vain and then have a go at working it out myself but the only thing I can see is that there is a change in the appropriate dir dovecot.index.log file after having the blue dir clicked on (and the colour of the dir name changes back to black) - so is the information stored somewhere in RCM itself? Thanks, Phil. -- Philip Rhoades PO Box 896 Cowra NSW 2794 Australia E-mail: phil(a)pricom.com.au

5 10

Required key not available
by David Matthews 19 Dec '20

19 Dec '20

hello dovecot -n # 2.3.4.1 (f79e8e7e4): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.4 () # OS: Linux 4.19.0-12-amd64 x86_64 Debian 10.0 what is the meaning / cause of this in mail.err:- ---------------------------------------------------------- dovecot: imap(david)<5004><vCVKAtO2UI1/AAAB>: Error: Mailbox Trash: open() failed with mbox: Required key not available ---------------------------------------------------------- I can telnet to port 143, log in and list folders, but cannot open them. This seems to have resulted from an experimental install (now purged) of courier-imap (I maintain a webmail program). Before this, dovecot just worked; now this problem remains even after a reinstall. -- David Matthews mail(a)dmatthews.org

1 0

Using dovecot with RoundCubeMail - where is the information for new mail in (blue coloured) directories?
by Philip Rhoades 19 Dec '20

19 Dec '20

People, Every few years I try to work this problem out - occasionally I would like to re-mark a dir as having new mail so that the dir shows up as blue-coloured in RCM. Every time I Google in vain and then have a go at working it out myself but the only thing I can see is that there is a change in the appropriate dir dovecot.index.log file after having the blue dir clicked on (and the colour of the dir name changes back to black) - so is the information stored somewhere in RCM itself? Thanks, Phil. -- Philip Rhoades PO Box 896 Cowra NSW 2794 Australia E-mail: phil(a)pricom.com.au

3 3

ulimit -n vs client_limit vs process_limit
by Joseph Tam 19 Dec '20

19 Dec '20

As many of my users are accessing their mail remotely, I've seen service loads increase and came across this log messages which I haven't seen before imap-login: Error: socketpair() failed: Too many open files: user=<*>, ... I gather I have to increase file descriptor limits, which is currently set to match default_client_limit = 1000 What should I set "ulimit -n" relative to client_limit? Or perhaps I've roofed service imap-login { process_limit = 2 ... } and should adjust that? Joseph Tam <jtam.home(a)gmail.com>

3 3

Dovecot Replication Errors (only) when using tcps: as the mail_replica Protocol
by Reuben Farrelly 18 Dec '20

18 Dec '20

Hi, I've been seeing errors logged for some time with replication processes, whereby replication sessions seem to be timing out periodically. This is with dovecot version 2.3.10.1 (a3d0e1171) and both are Gentoo x86_64. After some investigation I've determined that these timeouts are only ever occurring with tcps as the replication connection type. These errors never occur if non-encrypted tcp is configured. I've been able to validate this by changing only the replica_type on both ends of the replication configuration to tcp, and with no other changes and after a few days of operation there is not a single error logged. mail_replica = tcps:lightning.reub.net:4813 <<< periodic timeouts mail_replica = tcp:lightning.reub.net:4814 <<< works perfectly Example of the error: Jun 12 15:45:44 thunderstorm.reub.net dovecot[21149]: dsync-local(kaylene)<zx+WKTAU416UMwAAzkCIew>: Error: dsync(lightning.reub.net): I/O has stalled, no activity for 600 seconds (last sent=mailbox_delete, last recv=handshake) Jun 12 15:45:44 thunderstorm.reub.net dovecot[21149]: dsync-local(kaylene)<zx+WKTAU416UMwAAzkCIew>: Error: Timeout during state=recv_mailbox_tree doveadm: Error: Timeout during state=slave_recv_mailbox: 6 Time(s) doveadm: Error: Timeout during state=sync_mails (send=mail_requests recv=attributes): 31 Time(s) doveadm: Error: dsync(thunderstorm.reub.net): I/O has stalled, no activity for 600 seconds (last sent=mail_change (EOL), last recv=mailbox): 31 Time(s) doveadm: Error: dsync(thunderstorm.reub.net): I/O has stalled, no activity for 600 seconds (last sent=mailbox_delete, last recv=mailbox_delete): 6 Time(s) It is seen on both sides of the replication setup. The replica is offsite but only a few ms of latency away and there is no packet loss. The replication is happening over IPv6, and the local firewall is logging that sessions are always permitted, and only ever finishing due to tcp-fin or tcp-rst-from-client . SSL appears to be correctly configured, and it seems that the replication itself is for the most part working. Clients are able to use imaps just fine so I don't think there's anything much wrong from an SSL perspective else I'd be seeing complete replication failure and/or client devices unable to connect. Can anyone suggest how we can further debug this problem? Thanks, Reuben

4 3

Outlook with Dovecot
by Elise 17 Dec '20

17 Dec '20

dovecot-2.3.11.3_1 Hi group, I have a problem with connecting Outlook 2019 client to my server (BSD 21.2). Running Postfix and Dovecot. [all.log] Dec 12 16:53:41 poseidon dovecot[36185]: imap-login: Disconnected (auth failed, 1 attempts in 2 secs): user=<elise(a)xxxxx.xx>, method=PLAIN, rip=82.x.x.x.x, lip=10.x.x.x, TLS: Connection closed, session=<U62faUa24N5SsH9H> Providing the correct email address and password. Strang thing is that with Thunderbird it all works fine; only Outlook is refused. tx, Elise [dovecot.conf] auth_mechanisms = plain login disable_plaintext_auth = no mail_location = mbox:/usr/home/%u:INBOX=/var/mail/%u mail_privileged_group = mail passdb { driver = pam } protocols = imap service auth { unix_listener auth-client { group = mail mode = 0660 user = postfix } unix_listener auth-master { mode = 0666 } user = root } service imap-login { inet_listener imap { address = 10.x.x.x } inet_listener imaps { address = 10.x.x.x } } #service pop3-login { # inet_listener pop3 { # address = 10.x.x.x # } # inet_listener pop3s { # address = 10.x.x.x # } #} ssl = yes ssl_ca = </usr/local/share/certs/ca-root-nss.crt ssl_cert = </usr/local/etc/dehydrated/certs/xxxx.xxx/fullchain.pem ssl_key = </usr/local/etc/dehydrated/certs/xxxx.xxx/privkey.pem ssl_cipher_list = HIGH:+TLSv1.2:+TLSv1.3 ssl_dh = </usr/local/etc/dovecot/dh.pem userdb { driver = passwd } protocol imap { imap_client_workarounds = "delay-newmail tb-extra-mailbox-sep " } #protocol pop3 { # pop3_client_workarounds = outlook-no-nuls oe-ns-eoh # pop3_uidl_format = %08Xu%08Xv #} protocol lda { postmaster_address = postmaster(a)xxxxx.xxxx sendmail_path = /usr/sbin/sendmail mail_plugins = sieve }

7 11

Special files under dovecot mail box
by hfh＠cndns.com 17 Dec '20

17 Dec '20

Hello, even if all the mails(messages) are deleted from my mail box (such as the sent box), the capacity of the following special files will not change, that is, these files will only increase and easily occupy the disk. Is there any other way besides using doveadm index manually? In addition, will these files be affected if they are deleted? -rw-------. 1 vmail vmail 3912 Dec 1 13:52 dovecot.index -rw-------. 1 vmail vmail 127008 Dec 17 17:21 dovecot.index.cache -rw-------. 1 vmail vmail 18800 Dec 17 17:21 dovecot.index.log -rw-------. 1 vmail vmail 1567 Jun 20 2019 dovecot.index.thread Dovecot version is 2.2.36.

1 0

Disallow acces via imap, but keep lmtp running
by Julian Kippels 17 Dec '20

17 Dec '20

Hi all, what is the best way to temporarily disable access to a mailbox via imap, but keep it possible to deliver to the mailbox via lmtp? I want to migrate some mailboxes around and would like to ensure that the users cannot access their mail while doing so. I would like to keep the users from logging in entirely rather than setting ACLs. Thanks in advance Julian

5 4

Re: Disallow acces via imap, but keep lmtp running
by Julian Kippels 16 Dec '20

16 Dec '20

I thought about that, but that would also kill their access to wifi and other services, because it all comes from the same LDAP. Julian Am Tue, 15 Dec 2020 23:37:58 +0100 schrieb Jos <jos(a)cloudzeeland.nl>: > You could change their password temporily and do the migration? > > — Verstuurd via een mobiele telefoon > > > Op 15 dec. 2020 om 23:22 heeft Julian Kippels <kippels(a)hhu.de> het > > volgende geschreven: > > > > Hi all, > > > > what is the best way to temporarily disable access to a mailbox via > > imap, but keep it possible to deliver to the mailbox via lmtp? > > I want to migrate some mailboxes around and would like to ensure > > that the users cannot access their mail while doing so. > > I would like to keep the users from logging in entirely rather than > > setting ACLs. > > > > Thanks in advance > > Julian

3 2

Dovecot Director scaling / performance
by tim＠linux-daus.de 15 Dec '20

15 Dec '20

Hi, currently i'm going to evaluate the Dovecot Director. Are there someone with experience how the Dovecot Director does scale? The last current information i could find was a post on this mailing list from 2012: 4 Directors are well known, >75 are too much. Are there any more up to date experience regarding how many user (current and new/s) a single Dovecot Director/proxy node could handle and how many director nodes in a ring are known to work (well)? Best regards, Tim

2 1

Putting UIDL value into X-UIDL: header
by Süleyman Düzdaban 15 Dec '20

15 Dec '20

Hi, Is there any way to put UIDL value into X-UIDL: header with Dovecot or Sieve? As stated in https://wiki2.dovecot.org/Migration page QPopper can do that. I'm asking this for preventing clients who are using POP to re-download messages and making future migrations easy. I can really benefit from inserting UIDL values even only for the new messages from now on, but if there is any way to put it into all messages in all mailboxes (Maildir) I would be grateful for that too. Dovecot version: 2.3.8 (9df20d2db) Thanks in advance.

3 4

How to reset / remove all replicator users
by Ralf Becker 14 Dec '20

14 Dec '20

After creating a new replication pair, it was started with an old sqlite userdb, we use for iteration / replication. The situation was quickly resolved by generating a new sqlite userdb, as it is done hourly anyway. Unfortunately I can not get ride of all access users from the replication: / # doveadm replicator status Queued 'sync' requests 0 Queued 'high' requests 0 Queued 'low' requests 0 Queued 'failed' requests 0 Queued 'full resync' requests 14 Waiting 'failed' requests 1 Total number of known users 724 / # doveadm user '*'|wc -l 507 The replication process creates again and again a lot (empty) mailboxes on both sides of the replication. I tried the obvious with no avail: / # doveadm replicator remove '*' Error: Replicator failed: User not found I also tried restarting the pair one after the other, but it seems the users to replicate are somewhere persisted. I'm also trying to delete the users from the newly created (empty) mailboxes, but the number of known users in "doveadm replicator status" is unchanged: root:/var/dovecot/imap# for domain in $(ls -1 |grep -v bb-trunk.egroupware.de|grep -v outdoor-training.de|grep -v rbz-); do for user in $domain/*; do echo "$(basename $user)@$domain"; doveadm replicator remove "$(basename $user)@$domain"; done; rm -rf $domain; done Any idea what else I can do, or where the replication stores it's users? Ralf -- Ralf Becker EGroupware GmbH [www.egroupware.org] Handelsregister HRB Kaiserslautern 3587 Geschäftsführer Birgit und Ralf Becker Leibnizstr. 17, 67663 Kaiserslautern, Germany Telefon +49 631 31657-0

2 1

How to setup Dovecot director in a NAT-like environment?
by Richard Mader 14 Dec '20

14 Dec '20

How can I setup Dovecot director in a NAT like environment? My mailservers are running within docker and one of them behind a router, so the IP that dovecot binds to does not match the IP that other mailservers have to use to connect to them. Since when running director the servers connect to each other, I'd guess I'd have to set the external IP of the servers in the "director_servers". If I do that I'm unable to start the director nodes since they cannnot find out which of the addresses is their own. I had a quick peek at the sourcecode and director detects its own address by trying to bind to all of the addresses. Since we're behind a NAT, that will of course fail for its external IP. When I set the local address or localhost in the "director_servers" directive, then the director nodes are able to start but they are denied when connecting to other nodes. When using the NAT-internal IP I've got the following error: > Error: Remote director thinks it's someone else (connected to > <other-directors-external-ip>:9090, remote says it's > <other-directors-internal-ip>:9090) When using localhost/127.0.0.1 then I get: > Info: Connecting to <other-directors-external-ip>:9090 (as 127.0.0.1): > Alone in director ring - trying to connect to others > Error: connect(<other-directors-external-ip>:9090) failed: Invalid > argument Is it somehow possible to tell director which of the addresses within "director_servers" is its own address, that it then advertises to other servers, instead of trying figuring that out itself by trying to bind to all ip-addresses on startup? Kafka e.g. has the "advertised.listeners" property to set a custom host to announce to clients and to other Kafka nodes. If there is not such a property or any other workaround, I might consider implementing this into director myself. Although I might need some help getting started since this is my first time contributing to a non Scala/Java or Typescript/NodeJS Project. So far I've discovered that Github seems to be the official repo and is not just a mirror and I was able to compile it on my machine. Now I've got questions such as, where can I find the binaries that I've just compiled and whats the best way to get them running locally and to test my changes, where are unit tests located, ...? Best Regards, Richard

2 1

Migrate mailbox from NFS folder to new NFS folder
by Claudio Corvino 14 Dec '20

14 Dec '20

Hi everyone, I need to migrate many user mailboxes from an NFS folder to a new NFS folder, both mounted on the same Dovecot server (2.2.27). Once migrated, users will connect to a new Dovecot server (2.3.4.1). I would like to know how to use /doveadm backup/ (or sync?) instead of /rsync/ as I noted that after migration with rsync I have duplicates and some e-mails marked as unread. What is the correct way to achieve this? Thanks Cheers

2 1

Unexpected behavior of doveadm mailbox delete -e -s
by Mar Alegre 13 Dec '20

13 Dec '20

Hello, I have encountered what I believe to be a bug, or at least inaccurate documentation. I am running version 2.3.4.1 of Dovecot (installed via the default repo for Debian 10), so my apologies if this has been fixed in a more recent version. I tried to look for changelogs but was not able to find any. The `doveadm mailbox delete` command accepts flags `-e` and `-s` (among others). The flags are described by both the man pages and the wiki as follows: - `-e`: Require mailboxes to be empty before deleting. - `-s`: Unsubscribe deleted mailboxes. Based on these descriptions, I would expect that when both of these flags are combined, a directory that is not empty would be neither deleted nor unsubscribed. However, I have discovered that when I run the command `doveadm mailbox delete -u $myusername -e -s $non_empty_dir`, the result is that the directory is not deleted, but it *is* unsubscribed. I assume this is a bug, but if it is intended, the documentation should probably be updated to more clearly communicate that the `-s` flag will cause a directory to be unsubscribed even if it is not deleted. Best, Mar Alegre

2 1

fyi: please change /var/run to /run in debian buster repository
by Michael 12 Dec '20

12 Dec '20

hey, just one minor thing: if there's any time left, please change in the repository debian/buster in the package dovecot-core in the file /lib/systemd/system/dovecot.service the line PIDFile=/var/run/dovecot/master.pid to PIDFile=/run/dovecot/master.pid because systemd always shows the following warning: Dec 12 15:46:30 mail systemd[1]: /lib/systemd/system/dovecot.service:9: PIDFile= references path below legacy directory /var/run/, updating /var/run/dovecot/master.pid → /run/dovecot/master.pid; please update the unit file accordingly. creating a drop-in in /etc/systemd/system/dovecot.service.d/ doesn't do anything. greetings...

2 1

important message
by jk00100033＠gmail.com 12 Dec '20

12 Dec '20

I've invited you to fill out the following form: Untitled form To fill it out, visit: https://docs.google.com/forms/d/e/1FAIpQLSeqI7QUpet4levWQvhvUuqn1Au-fqPDo0W… Greetings! To You Mr. Joe is my name; I work in a Bank here in Benin. And I personally handle transactions of Mr. Martin Quick who eventually died on the 5th of February 2017 from injuries sustained in a road accident that happened 3 years ago. Prior to his death, Mr. Martin Quick lived and worked in Benin Republic and was doing Contracting with Benin Energy dept. He has (Four million, three hundred thousand Euros) in a fixed account with the bank with no other beneficiary. Now I write to seek your consent to present you as an oversea based partner to stand in as next of kin to the late Mr. Martin Quick. Let me know if it is ok to work with you. please email me in my private email for more details ( kukuaj001(a)gmail.com ) please email me in my private email for more details ( kukuaj001(a)gmail.com ) My best Regards Mr. Joe. Google Forms: Create and analyze surveys.

4 3

Potential issue with lmtp_rawlog_dir when using TLS
by John Fawcett 11 Dec '20

11 Dec '20

Hi not sure why this happens, but looks like lmtp_rawlog_dir blocks the successful negotiation of an lmtp starttls connection. Reproducible with openssl s_client. Two runs with only difference the presence of lmtp_rawlog_dir setting in dovecot config. Failed connection with lmtp_rawlog_dir Dec 10 21:01:31 server03 dovecot[41002]: lmtp(41021): Connect from ::1 Dec 10 21:01:31 server03 dovecot[41002]: lmtp(41021): Debug: SSL: where=0x10, ret=1: before SSL initialization Dec 10 21:01:31 server03 dovecot[41002]: lmtp(41021): Debug: SSL: where=0x2001, ret=1: before SSL initialization Dec 10 21:01:31 server03 dovecot[41002]: lmtp(41021): Debug: SSL: where=0x2002, ret=-1: before SSL initialization Dec 10 21:01:31 server03 dovecot[41002]: lmtp(41021): Debug: SSL: where=0x2002, ret=-1: error Dec 10 21:01:31 server03 dovecot[41002]: lmtp(41021): Debug: SSL error: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number Dec 10 21:01:31 server03 dovecot[41002]: lmtp(41021): Error: lmtp-server: conn [::1]:53876 [2]: SSL handshake failed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number Dec 10 21:01:31 server03 dovecot[41002]: lmtp(41021): Debug: SSL error: SSL_accept() syscall failed: Invalid argument Dec 10 21:01:31 server03 dovecot[41002]: lmtp(41021): Disconnect from ::1: SSL Initialization failed (state=READY) Successful connection without lmtp_rawlog_dir Dec 10 20:59:07 server03 dovecot[40970]: lmtp(40988): Connect from ::1 Dec 10 20:59:07 server03 dovecot[40970]: lmtp(40988): Debug: SSL: where=0x10, ret=1: before SSL initialization Dec 10 20:59:07 server03 dovecot[40970]: lmtp(40988): Debug: SSL: where=0x2001, ret=1: before SSL initialization Dec 10 20:59:07 server03 dovecot[40970]: lmtp(40988): Debug: SSL: where=0x2002, ret=-1: before SSL initialization Dec 10 20:59:07 server03 dovecot[40970]: lmtp(40988): Debug: SSL: where=0x2002, ret=-1: before SSL initialization Dec 10 20:59:07 server03 dovecot[40970]: lmtp(40988): Debug: SSL: where=0x2002, ret=-1: before SSL initialization Dec 10 20:59:07 server03 dovecot[40970]: lmtp(40988): Debug: SSL: where=0x2002, ret=-1: before SSL initialization Dec 10 20:59:07 server03 dovecot[40970]: lmtp(40988): Debug: SSL: where=0x2002, ret=-1: before SSL initialization Dec 10 20:59:07 server03 dovecot[40970]: lmtp(40988): Debug: SSL: where=0x2001, ret=1: before SSL initialization Dec 10 20:59:07 server03 dovecot[40970]: lmtp(40988): Debug: SSL_get_servername() failed Dec 10 20:59:07 server03 dovecot[40970]: lmtp(40988): Debug: SSL: where=0x2001, ret=1: SSLv3/TLS read client hello Dec 10 20:59:07 server03 dovecot[40970]: lmtp(40988): Debug: SSL: where=0x2001, ret=1: SSLv3/TLS write server hello Dec 10 20:59:07 server03 dovecot[40970]: lmtp(40988): Debug: SSL: where=0x2001, ret=1: SSLv3/TLS write change cipher spec Dec 10 20:59:07 server03 dovecot[40970]: lmtp(40988): Debug: SSL: where=0x2001, ret=1: TLSv1.3 write encrypted extensions Dec 10 20:59:07 server03 dovecot[40970]: lmtp(40988): Debug: SSL: where=0x2001, ret=1: SSLv3/TLS write certificate Dec 10 20:59:07 server03 dovecot[40970]: lmtp(40988): Debug: SSL: where=0x2001, ret=1: TLSv1.3 write server certificate verify Dec 10 20:59:07 server03 dovecot[40970]: lmtp(40988): Debug: SSL: where=0x2001, ret=1: SSLv3/TLS write finished Dec 10 20:59:07 server03 dovecot[40970]: lmtp(40988): Debug: SSL: where=0x2001, ret=1: TLSv1.3 early data Dec 10 20:59:07 server03 dovecot[40970]: lmtp(40988): Debug: SSL: where=0x2002, ret=-1: TLSv1.3 early data Dec 10 20:59:07 server03 dovecot[40970]: lmtp(40988): Debug: SSL: where=0x2002, ret=-1: TLSv1.3 early data Dec 10 20:59:07 server03 dovecot[40970]: lmtp(40988): Debug: SSL: where=0x2002, ret=-1: TLSv1.3 early data Dec 10 20:59:07 server03 dovecot[40970]: lmtp(40988): Debug: SSL: where=0x2002, ret=-1: TLSv1.3 early data Dec 10 20:59:07 server03 dovecot[40970]: lmtp(40988): Debug: SSL: where=0x2002, ret=-1: TLSv1.3 early data Dec 10 20:59:07 server03 dovecot[40970]: lmtp(40988): Debug: SSL: where=0x2002, ret=-1: TLSv1.3 early data Dec 10 20:59:07 server03 dovecot[40970]: lmtp(40988): Debug: SSL: where=0x2002, ret=-1: TLSv1.3 early data Dec 10 20:59:07 server03 dovecot[40970]: lmtp(40988): Debug: SSL: where=0x2001, ret=1: TLSv1.3 early data Dec 10 20:59:07 server03 dovecot[40970]: lmtp(40988): Debug: SSL: where=0x2001, ret=1: SSLv3/TLS read finished Dec 10 20:59:07 server03 dovecot[40970]: lmtp(40988): Debug: SSL: where=0x20, ret=1: SSLv3/TLS write session ticket Dec 10 20:59:07 server03 dovecot[40970]: lmtp(40988): Debug: SSL: where=0x2001, ret=1: SSLv3/TLS write session ticket Dec 10 20:59:07 server03 dovecot[40970]: lmtp(40988): Debug: SSL: where=0x2001, ret=1: SSLv3/TLS write session ticket Dec 10 20:59:07 server03 dovecot[40970]: lmtp(40988): Debug: SSL: where=0x2002, ret=1: SSL negotiation finished successfully John

1 0

Dovecot 2.3.11.3 LMTP dropping connection after first part of multipart message received
by Steve Akerman 11 Dec '20

11 Dec '20

Good afternoon I have been using Dovecot with great success for several months now with one problem: I have received several messages (3 to date out of a much larger number) which cause Dovecot LMTP to drop the connection with sendmail after only receiving the first part of the message. Dovecot saves the first part to INBOX, and then drops the link with sendmail as it sees the rest of the data from sendmail as new (and invalid) commands Sendmail sees the delivery as unsuccessful and requeues the message, so the cycle continues until i kill the queue These messages are all Multipart MIME I have attached an extract from the log which shows the above sequence Finally, I have kept one such message from the sendmail queue (df and qf) should this be useful, but prefer not to post here as not sanitised Any help in correcting my configuration would be appreciated. Thanks Steve MAIL LOG extract ------------------------- Dec 9 12:00:10 phone dovecot[179]: lmtp(20774): Connect from local Dec 9 12:00:10 phone sm-mta-rx[20764]: STARTTLS=client, relay=localhost, version=TLSv1.3, verify=OK, cipher=TLS_AES_256_GCM_SHA384, bits=256/256 Dec 9 12:00:10 phone dovecot[179]: lmtp(20775): Connect from local Dec 9 12:00:10 phone sm-mta-rx[20763]: STARTTLS=client, relay=localhost, version=TLSv1.3, verify=OK, cipher=TLS_AES_256_GCM_SHA384, bits=256/256 Dec 9 12:00:10 phone dovecot[179]: lmtp(*********)<20775><8EieKDqu0F8nUQAA0J78UA>: msgid=<39113a86-fdbb-4cea-b1c3-d225dff93328(a)info.ameli.fr <mailto:39113a86-fdbb-4cea-b1c3-d225dff93328@info.ameli.fr>>: saved mail to INBOX Dec 9 12:00:10 phone dovecot[179]: lmtp(20775): Disconnect from local: Too many invalid commands. (state=READY) Dec 9 12:00:10 phone sm-mta-rx[20763]: STARTTLS: write error=syscall error (-1), errno=32, get_error=error:00000000:lib(0):func(0):reason(0), retry=1, ssl_err=5 Dec 9 12:00:10 phone sm-mta-rx[20763]: 0B89mOON016803: SYSERR(root): timeout writing message to localhost: Broken pipe Dec 9 12:00:10 phone sm-mta-rx[20763]: 0B89mOON016803: 0: fl=0x0, mode=20666: CHR: dev=30/1306024, ino=301, nlink=1, u/gid=0/0, size=0 Dec 9 12:00:10 phone sm-mta-rx[20763]: 0B89mOON016803: 1: fl=0x1, mode=20666: CHR: dev=30/1306024, ino=301, nlink=1, u/gid=0/0, size=0 Dec 9 12:00:10 phone sm-mta-rx[20763]: 0B89mOON016803: 2: fl=0x1, mode=20666: CHR: dev=30/1306024, ino=301, nlink=1, u/gid=0/0, size=0 Dec 9 12:00:10 phone sm-mta-rx[20763]: 0B89mOON016803: 3: fl=0x4002, mode=100600: dev=1/2, ino=26089780, nlink=1, u/gid=0/23, size=2041 Dec 9 12:00:10 phone sm-mta-rx[20763]: 0B89mOON016803: 4: fl=0x0, mode=20666: CHR: dev=30/1306024, ino=575, nlink=1, u/gid=0/0, size=0 Dec 9 12:00:10 phone sm-mta-rx[20763]: 0B89mOON016803: 5: fl=0x2, mode=140666: SOCK localhost->[[UNIX: /var/run/mDNSResponder]] Dec 9 12:00:10 phone sm-mta-rx[20763]: 0B89mOON016803: 6: fl=0x0, mode=100640: dev=1/2, ino=25887976, nlink=1, u/gid=0/23, size=12288 Dec 9 12:00:10 phone sm-mta-rx[20763]: 0B89mOON016803: 7: fl=0x0, mode=100640: dev=1/2, ino=25887976, nlink=1, u/gid=0/23, size=12288 Dec 9 12:00:10 phone sm-mta-rx[20763]: 0B89mOON016803: 8: fl=0x0, mode=100600: dev=1/2, ino=26088246, nlink=1, u/gid=0/23, size=58024 Dec 9 12:00:10 phone sm-mta-rx[20763]: 0B89mOON016803: 9: fl=0x6, mode=140444: SOCK localhost->(Invalid argument) Dec 9 12:00:10 phone sm-mta-rx[20763]: 0B89mOON016803: 10: fl=0x6, mode=140444: SOCK localhost->(Invalid argument) Dec 9 12:00:10 phone sm-mta-rx[20763]: 0B89mOON016803: 11: fl=0x0, mode=100640: dev=1/2, ino=25768590, nlink=1, u/gid=0/23, size=12288 Dec 9 12:00:10 phone sm-mta-rx[20763]: 0B89mOON016803: 12: fl=0x0, mode=100640: dev=1/2, ino=25768590, nlink=1, u/gid=0/23, size=12288 Dec 9 12:00:10 phone sm-mta-rx[20763]: 0B89mOON016803: MCI@0x0: NULL Dec 9 12:00:10 phone sm-mta-rx[20763]: 0B89mOON016803: MCI@0x7fae2c814818: flags=26404c<CACHED,ESMTP,8BITMIME,INMIME,ENHSTAT,PIPELINED,TLSACT>, errno=32, herrno=0, exitstat=75, state=8, pid=0, maxsize=0, phase=client DATA 354, mailer=dovecot, status=4.4.2, rstatus=(null), host=localhost, lastuse=Wed Dec 9 12:00:10 2020\n Dec 9 12:00:10 phone sm-mta-rx[20763]: 0B89mOON016803: to=<s****************>, delay=1+01:11:31, xdelay=00:00:00, mailer=dovecot, pri=4787366, relay=localhost, dsn=4.4.2, reply=75, stat=Deferred ######################*****############## ### DOVECOT Mailer specification ### ##################*****################## Mdovecot, P=[IPC], F=zDFMPhnul59, S=EnvFromSMTP/HdrFromSMTP, R=EnvToSMTP/HdrFromSMTP, T=DNS/RFC822/X-Unix, A=FILE /var/run/dovecot/lmtp dovecot -n ————— # 2.3.11.3 (502c39af9): /usr/local/etc/dovecot/dovecot.conf # Pigeonhole version 0.5.11 (d71e0372) doveconf: Warning: service auth { client_limit=100 } is lower than required under max. load (300) doveconf: Warning: service anvil { client_limit=100 } is lower than required under max. load (203) # OS: Darwin 15.6.0 x86_64 # Hostname: *************** doveconf: Error: t_readlink(/var/run/dovecot//dovecot.conf) failed: readlink() failed: Permission denied auth_mechanisms = cram-md5 auth_username_format = %Ln base_dir = /var/run/dovecot/ default_client_limit = 100 default_internal_group = _dovecot default_internal_user = _dovecot default_login_user = _dovenull hostname =***************** lda_mailbox_autocreate = yes mail_gid = 530 mail_home = /var/mail/%d/%n mail_location = sdbox:~/dbox mail_uid = 530 managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } passdb { args = scheme=SSHA256 username_format=%u /usr/local/etc/dovecot/users driver = passwd-file } plugin { sieve = file:~/sieve;active=~/.dovecot.sieve } postmaster_address = postmaster protocols = imap lmtp service auth { unix_listener auth-userdb { group = mailusers mode = 0777 user = _dovecot }

2 2

Disconnected: Inactivity (auth failed, 2 attempts in 180 secs)
by basti 11 Dec '20

11 Dec '20

Hello, I have a problem with "apple mail". Once it work as expected, then it does not answer. Dez 10 00:16:04 vsrv10563 dovecot[17121]: imap-login: Login: user=<info(a)example.com>, method=PLAIN, rip=77.xx.xxx.xxx, lip=31.xx.xxx.xxx, mpid=4490, TLS, session=<Oit4OxC2CTZNFv7P> Dez 10 00:17:38 vsrv10563 dovecot[17121]: imap-login: Login: user=<info(a)example.com>, method=PLAIN, rip=77.xx.xxx.xxx, lip=31.xx.xxx.xxx, mpid=5174, TLS, session=<IhlpQhC2XjZNFv7P> Dez 10 00:18:14 vsrv10563 dovecot[17121]: imap-login: Disconnected: Inactivity (auth failed, 2 attempts in 180 secs): user=<user(a)example.com>, method=CRAM-MD5, rip=77.xx.xxx.xxx, lip=31.xx.xxx.xxx, TLS, session=<tkVXOxC2DDZNFv7P> Dez 10 00:18:14 vsrv10563 dovecot[17121]: imap-login: Disconnected: Inactivity during authentication (auth failed, 2 attempts in 179 secs): user=<info(a)example.com>, method=CRAM-MD5, rip=77.xx.xxx.xxx, lip=31.xx.xxx.xxx, TLS, session=<pHVeOxC2HzZNFv7P> Dez 10 00:18:14 vsrv10563 dovecot[17121]: imap-login: Disconnected: Inactivity (auth failed, 2 attempts in 180 secs): user=<test(a)example.com>, method=CRAM-MD5, rip=77.xx.xxx.xxx, lip=31.xx.xxx.xxx, TLS, session=<J6ZXOxC2OTZNFv7P> Dez 10 00:18:14 vsrv10563 dovecot[17121]: imap-login: Disconnected: Inactivity (auth failed, 2 attempts in 180 secs): user=<user(a)example.com>, method=CRAM-MD5, rip=77.xx.xxx.xxx, lip=31.xx.xxx.xxx, TLS, session=<oUFXOxC2ATZNFv7P> Dez 10 04:00:22 vsrv10563 dovecot[17121]: imap-login: Login: user=<test(a)example.com>, method=PLAIN, rip=77.xx.xxx.xxx, lip=31.xx.xxx.xxx, mpid=24532, TLS, session=<QYSEXxO2DzZNFv7P> Dez 10 04:03:06 vsrv10563 dovecot[17121]: imap-login: Disconnected: Inactivity during authentication (auth failed, 2 attempts in 180 secs): user=<info(a)example.com>, method=CRAM-MD5, rip=77.xx.xxx.xxx, lip=31.xx.xxx.xxx, TLS, session=<fo2FXxO2BDZNFv7P> Dez 10 04:03:07 vsrv10563 dovecot[17121]: imap-login: Disconnected: Inactivity during authentication (auth failed, 2 attempts in 180 secs): user=<user(a)example.com>, method=CRAM-MD5, rip=77.xx.xxx.xxx, lip=31.xx.xxx.xxx, TLS, session=<ekWNXxO2VTZNFv7P> Dez 10 04:03:09 vsrv10563 dovecot[17121]: imap-login: Disconnected: Inactivity during authentication (auth failed, 2 attempts in 180 secs): user=<user(a)example.com>, method=CRAM-MD5, rip=77.xx.xxx.xxx, lip=31.xx.xxx.xxx, TLS, session=<YE6sXxO2HTZNFv7P> Then fail2ban block the IP. Has anybody similar problems? This there a way to fix this? Thunderbird does not have this problem. Best Regards,

1 0

Standalone Directors
by William Edwards 11 Dec '20

11 Dec '20

Situation: We will be switching to Dovecot proxy + Director with three email clusters - each cluster will host different email domains and users - with CephFS storage. Problem: A Director instance has one 'director_mail_servers' setting, meaning I could only use one set of email servers, while the set of email servers in the cluster depends on the client's domain. (The reason I use Dovecot proxy is so people can use the same IMAP/POP/SMTP hostnames; regardless of which email server / email cluster they're hosted on.) Question: Is it possible to set 'director_mail_servers' based on the client's email domain? Met vriendelijke groeten, William Edwards

2 2

problems after upgrade from 2.2.27 to 2.3.4.1
by Lampa 09 Dec '20

09 Dec '20

Hello, after debian version from 9 to, also dovecot was upgraded. There was problems with right imap and imap-login connection settings. I adjusted process_limit, service count increased /proc/sys/net/core/somaxconn from 128 to 1024 for imap It's a system with 1000+ imap and 200+ pop3 connections. When imap connections are over 1000 problems begins. Problem one: 2020-12-07T12:46:39.575586+01:00 vhermes dovecot: master: Error: service(pop3): Initial status notification not received in 30 seconds, killing the process 2020-12-07T12:46:39.576448+01:00 vhermes dovecot: pop3: Fatal: master: service(pop3): child 13975 killed with signal 9 2020-12-07T12:46:42.015726+01:00 vhermes dovecot: master: Error: service(lmtp): Initial status notification not received in 30 seconds, killing the process 2020-12-07T12:46:42.016680+01:00 vhermes dovecot: lmtp: Fatal: master: service(lmtp): child 13985 killed with signal 9 2020-12-07T12:46:42.061963+01:00 vhermes dovecot: master: Error: service(lmtp): Initial status notification not received in 30 seconds, killing the process 2020-12-07T12:46:42.062973+01:00 vhermes dovecot: lmtp: Fatal: master: service(lmtp): child 13987 killed with signal 9 problem two: 2020-12-07T13:55:43.106017+01:00 vhermes dovecot: pop3: Error: net_connect_unix(/var/run/dovecot/stats-writer) failed: Resource temporarily unavailable 2020-12-07T13:56:22.300893+01:00 vhermes dovecot: lmtp: Error: net_connect_unix(/var/run/dovecot/stats-writer) failed: Resource temporarily unavailable 2020-12-07T13:58:11.721892+01:00 vhermes dovecot: imap: Error: net_connect_unix(/var/run/dovecot/stats-writer) failed: Resource temporarily unavailable problem three - lot of 2020-12-07T10:16:24.773347+01:00 vhermes dovecot: imap-login: Error: master(imap): net_connect_unix(imap) failed: Resource temporarily unavailable - http://wiki2.dovecot.org/SocketUnavailable problem four - crashing 020-12-09T07:53:26.914331+01:00 vhermes dovecot: imap(user@domain)<5426><cv8ehAK2npZX7MQb>: Panic: file message-parser.c: line 174 (message_part_finish): assertion failed: (ctx->nested_parts_count > 0) 2020-12-09T07:53:26.916771+01:00 vhermes dovecot: imap(user@domain)<5426><cv8ehAK2npZX7MQb>: Error: Raw backtrace: /usr/lib/dovecot/libdovecot.so.0(+0xdb62b) [0x7f31bb0d462b] -> /usr/lib/dovecot/libdovecot.so.0(+0xdb6c1) [0x7f31bb0d46c1] -> /usr/lib/dovecot/libdovecot.so.0(+0x4a149) [0x7f31bb043149] -> /usr/lib/dovecot/libdovecot.so.0(+0x474ac) [0x7f31bb0404ac] -> /usr/lib/dovecot/libdovecot.so.0(message_parser_parse_next_block+0x104) [0x7f31bb0bc844] -> /usr/lib/dovecot/libdovecot.so.0(message_search_msg+0xa8) [0x7f31bb0bedf8] -> /usr/lib/dovecot/libdovecot-storage.so.0(+0xcf89e) [0x7f31bb25789e] -> /usr/lib/dovecot/libdovecot-storage.so.0(mail_search_args_foreach+0x45) [0x7f31bb1d9445] -> /usr/lib/dovecot/libdovecot-storage.so.0(+0xd0774) [0x7f31bb258774] -> /usr/lib/dovecot/libdovecot-storage.so.0(+0xd1a68) [0x7f31bb259a68] -> /usr/lib/dovecot/libdovecot-storage.so.0(index_storage_search_next_nonblock+0x61) [0x7f31bb25a0e1] -> /usr/lib/dovecot/libdovecot-storage.so.0(mailbox_search_next_nonblock+0x28) [0x7f31bb1e2e58] -> dovecot/imap [user@domain 1.2.3.4 UID SORT](+0x2691f) [0x559347dc891f] -> dovecot/imap [user@domain 1.2.3.4 UID SORT](command_exec+0x70) [0x559347dc1d80] -> dovecot/imap [user@domain 1.2.3.4 UID SORT](+0x25ed2) [0x559347dc7ed2] -> /usr/lib/dovecot/libdovecot.so.0(io_loop_handle_timeouts+0x111) [0x7f31bb0ea8f1] -> /usr/lib/dovecot/libdovecot.so.0(io_loop_handler_run_internal+0xd0) [0x7f31bb0ec070] -> /usr/lib/dovecot/libdovecot.so.0(io_loop_handler_run+0x4c) [0x7f31bb0eab7c] -> /usr/lib/dovecot/libdovecot.so.0(io_loop_run+0x40) [0x7f31bb0eace0] -> /usr/lib/dovecot/libdovecot.so.0(master_service_run+0x13) [0x7f31bb06b0d3] -> dovecot/imap [user@domain 1.2.3.4 UID SORT](main+0x325) [0x559347db2bf5] -> /lib/x86_64-linux-gnu/libc.so.6(__libc_start_main+0xeb) [0x7f31bae5609b] -> dovecot/imap [user@domain 1.2.3.4 UID SORT](_start+0x2a) [0x559347db2d8a] 2020-12-09T07:53:26.917634+01:00 vhermes dovecot: imap(user@domain)<5426><cv8ehAK2npZX7MQb>: Fatal: master: service(imap): child 5426 killed with signal 6 (core dumps disabled - https://dovecot.org/bugreport.html#coredumps) Seems that last problem is solved (if same) https://github.com/dovecot/core/commit/a668d767a710ca18ab6e7177d8e8be22a6b0… Thank you for any help -- Lampa

2 2

Question about login_log_format_elements in a proxy environment
by Adi Pircalabu 08 Dec '20

08 Dec '20

Hi, I have a Dovecot proxy setup with several proxy machines (currently running 2.3.11.3) in front of the real Dovecot servers (2.3.10.1) storing the mailboxes. "doveconf -a | egrep lip" returns: login_log_format_elements = user=<%u> method=%m rip=%r lip=%l mpid=%e %c session=<%{session}> In the real server maillog I'm expecting to have "lip" replaced with the IP address of the proxy. It works as expected for imap-login processes, however for pop3-login processes I still see the real server IP instead of the proxy IP. Ideas? Regards, -- Adi Pircalabu

2 8

Fts solr add fields message-id, date, in-reply-to
by michael1970 08 Dec '20

08 Dec '20

Hi, how can I add fields message-id, date, in-reply-to to fts solr index like hdr,body,subject or to? Thanks, Michael -- Sent from: http://dovecot.2317879.n4.nabble.com/

3 6

dovecot/imap killed with signal 6 after SEARCH in specific mailbox
by Jiri 07 Dec '20

07 Dec '20

Hi All, on my older production server (Deb9 dovecot version 2.2.27-3+deb9u6) a client reported that searching text in one mailbox failed while other mailboxes do search ok. He is using Rouddcube webmail and is searching the whole messages including the body. Errorlog shows panic and assertion failed logs. So I'v moved the 'problematic' mailbox to my latest production server (Deb10 2.3.4.1-5+deb10u4 = 2.3.4.1 (f79e8e7e4)) where I have more RAM to eliminate that and the same error appeared. There is nothing special about the mailbox, roughly 600MiB and 2200 messges. Other much larger mailboxes on the same server do search fine. After turning on imap logging in Roundcube mail, the critical command was: A0004 UID SEARCH RETURN (ALL) TEXT whatever I increased default_process_limit and default_client_limit, I run: doveadm index -u ttt(a)mail2.swpraha.cz -q INBOX but didn't help. I used the gdb method to reproduce it and to get the whole info including backtrace: vmail@s6mail:~$ gdb --args /usr/lib/dovecot/imap -u ttt(a)mail2.swpraha.cz (gdb) r Starting program: /usr/lib/dovecot/imap -u ttt(a)mail2.swpraha.cz process 4458 is executing new program: /usr/bin/doveconf process 4458 is executing new program: /usr/lib/dovecot/imap * PREAUTH [CAPABILITY IMAP4rev1 SASL-IR LOGIN-REFERRALS ID ENABLE IDLE SORT SORT=DISPLAY THREAD=REFERENCES THREAD=REFS THREAD=ORDEREDSUBJECT MULTIAPPEND URL-PARTIAL CATENATE UNSELECT CHILDREN NAMESPACE UIDPLUS LIST-EXTENDED I18NLEVEL=1 CONDSTORE QRESYNC ESEARCH ESORT SEARCHRES WITHIN CONTEXT=SEARCH LIST-STATUS BINARY MOVE SNIPPET=FUZZY LITERAL+ NOTIFY SPECIAL-USE QUOTA] Logged in as ttt(a)mail2.swpraha.cz a select INBOX * FLAGS (\Answered \Flagged \Deleted \Seen \Draft $MDNSent Junk $Forwarded NonJunk) * OK [PERMANENTFLAGS (\Answered \Flagged \Deleted \Seen \Draft $MDNSent Junk $Forwarded NonJunk \*)] Flags permitted. * 682 EXISTS * 0 RECENT * OK [UNSEEN 639] First unseen. * OK [UIDVALIDITY 1147771637] UIDs valid * OK [UIDNEXT 104487] Predicted next UID * OK [HIGHESTMODSEQ 53108] Highest a OK [READ-WRITE] Select completed (0.002 + 0.000 + 0.001 secs). A0004 UID SEARCH RETURN (ALL) TEXT whatewer imap(ttt(a)mail2.swpraha.cz)<4458><Auy4NnMnzl9qEQAAevFY8w>: Panic: file message-parser.c: line 174 (message_part_finish): assertion failed: (ctx->nested_parts_count > 0) imap(ttt(a)mail2.swpraha.cz)<4458><Auy4NnMnzl9qEQAAevFY8w>: Error: Raw backtrace: /usr/lib/dovecot/libdovecot.so.0(+0xdb62b) [0x7ffff7dbb62b] -> /usr/lib/dovecot/libdovecot.so.0(+0xdb661) [0x7ffff7dbb661] -> /usr/lib/dovecot/libdovecot.so.0(+0x4a149) [0x7ffff7d2a149] -> /usr/lib/dovecot/libdovecot.so.0(+0x474ac) [0x7ffff7d274ac] -> /usr/lib/dovecot/libdovecot.so.0(message_parser_parse_next_block+0x104) [0x7ffff7da3844] -> /usr/lib/dovecot/libdovecot.so.0(message_search_msg+0xa8) [0x7ffff7da5df8] -> /usr/lib/dovecot/libdovecot-storage.so.0(+0xcf89e) [0x7ffff7f3e89e] -> /usr/lib/dovecot/libdovecot-storage.so.0(mail_search_args_foreach+0x45) [0x7ffff7ec0445] -> /usr/lib/dovecot/libdovecot-storage.so.0(+0xd0774) [0x7ffff7f3f774] -> /usr/lib/dovecot/libdovecot-storage.so.0(+0xd1a68) [0x7ffff7f40a68] -> /usr/lib/dovecot/libdovecot-storage.so.0(index_storage_search_next_nonblock+0x10d) [0x7ffff7f4118d] -> /usr/lib/dovecot/libdovecot-storage.so.0(mailbox_search_next_nonblock+0x28) [0x7ffff7ec9e58] -> /usr/lib/dovecot/imap [ttt(a)mail2.swpraha.cz UID SEARCH](+0x2691f) [0x55555557a91f] -> /usr/lib/dovecot/imap [ttt(a)mail2.swpraha.cz UID SEARCH](command_exec+0x70) [0x555555573d80] -> /usr/lib/dovecot/imap [ttt(a)mail2.swpraha.cz UID SEARCH](+0x25ed2) [0x555555579ed2] -> /usr/lib/dovecot/libdovecot.so.0(io_loop_handle_timeouts+0x111) [0x7ffff7dd18f1] -> /usr/lib/dovecot/libdovecot.so.0(io_loop_handler_run_internal+0xd0) [0x7ffff7dd3070] -> /usr/lib/dovecot/libdovecot.so.0(io_loop_handler_run+0x4c) [0x7ffff7dd1b7c] -> /usr/lib/dovecot/libdovecot.so.0(io_loop_run+0x40) [0x7ffff7dd1ce0] -> /usr/lib/dovecot/libdovecot.so.0(master_service_run+0x13) [0x7ffff7d520d3] -> /usr/lib/dovecot/imap [ttt(a)mail2.swpraha.cz UID SEARCH](main+0x325) [0x555555564bf5] -> /lib/x86_64-linux-gnu/libc.so.6(__libc_start_main+0xeb) [0x7ffff7b3c09b] -> /usr/lib/dovecot/imap [ttt(a)mail2.swpraha.cz UID SEARCH](_start+0x2a) [0x555555564d8a] Program received signal SIGABRT, Aborted. __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:50 50 ../sysdeps/unix/sysv/linux/raise.c: No such file or directory. (gdb) bt full #0 __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:50 set = {__val = {0, 9355454118400172544, 1928, 1862, 1863, 93824992506008, 65, 140737352109185, 140737351192526, 140737351951989, 257, 145, 206158430224, 140737488344944, 140737488344736, 140737351756174}} pid = <optimized out> tid = <optimized out> ret = <optimized out> #1 0x00007ffff7b3a535 in __GI_abort () at abort.c:79 save_stage = 1 act = {__sigaction_handler = {sa_handler = 0x9ef, sa_sigaction = 0x9ef}, sa_mask = {__val = {30216, 93824992300426, 0, 513, 513, 140737351192526, 140737351744763, 140737351192526, 9355454118400172544, 140737351192526, 140737351951234, 140737488344944, 93824992503880, 140737351192526, 140737351951609, 140737351192526}}, sa_flags = -136625910, sa_restorer = 0x5} sigs = {__val = {32, 0 <repeats 15 times>}} #2 0x00007ffff7d2a481 in ?? () from /usr/lib/dovecot/libdovecot.so.0 No symbol table info available. #3 0x00007ffff7dbb661 in default_fatal_handler () from /usr/lib/dovecot/libdovecot.so.0 No symbol table info available. #4 0x00007ffff7d2a149 in i_panic () from /usr/lib/dovecot/libdovecot.so.0 No symbol table info available. #5 0x00007ffff7d274ac in ?? () from /usr/lib/dovecot/libdovecot.so.0 No symbol table info available. #6 0x00007ffff7da3844 in message_parser_parse_next_block () from /usr/lib/dovecot/libdovecot.so.0 No symbol table info available. #7 0x00007ffff7da5df8 in message_search_msg () from /usr/lib/dovecot/libdovecot.so.0 No symbol table info available. #8 0x00007ffff7f3e89e in ?? () from /usr/lib/dovecot/libdovecot-storage.so.0 No symbol table info available. #9 0x00007ffff7ec0445 in mail_search_args_foreach () from /usr/lib/dovecot/libdovecot-storage.so.0 No symbol table info available. #10 0x00007ffff7f3f774 in ?? () from /usr/lib/dovecot/libdovecot-storage.so.0 No symbol table info available. #11 0x00007ffff7f40a68 in ?? () from /usr/lib/dovecot/libdovecot-storage.so.0 No symbol table info available. #12 0x00007ffff7f4118d in index_storage_search_next_nonblock () from /usr/lib/dovecot/libdovecot-storage.so.0 No symbol table info available. #13 0x00007ffff7ec9e58 in mailbox_search_next_nonblock () from /usr/lib/dovecot/libdovecot-storage.so.0 No symbol table info available. #14 0x000055555557a91f in ?? () No symbol table info available. #15 0x0000555555573d80 in command_exec () No symbol table info available. #16 0x0000555555579ed2 in ?? () No symbol table info available. #17 0x00007ffff7dd18f1 in io_loop_handle_timeouts () from /usr/lib/dovecot/libdovecot.so.0 No symbol table info available. #18 0x00007ffff7dd3070 in io_loop_handler_run_internal () from /usr/lib/dovecot/libdovecot.so.0 No symbol table info available. #19 0x00007ffff7dd1b7c in io_loop_handler_run () from /usr/lib/dovecot/libdovecot.so.0 No symbol table info available. #20 0x00007ffff7dd1ce0 in io_loop_run () from /usr/lib/dovecot/libdovecot.so.0 No symbol table info available. #21 0x00007ffff7d520d3 in master_service_run () from /usr/lib/dovecot/libdovecot.so.0 No symbol table info available. #22 0x0000555555564bf5 in main () No symbol table info available. (gdb) ========================== dovecot -n: # 2.3.4.1 (f79e8e7e4): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.4 () # OS: Linux 5.4.65-1-pve x86_64 Debian 10.6 # Hostname: s6mail.ehosting.cz default_client_limit = 10000 default_process_limit = 1000 deliver_log_format = msgid=%m, from=%f, Subj=%s: %$ dict { expire = mysql:/etc/dovecot/dovecot-dict-sql.conf.ext quota = mysql:/etc/dovecot/dovecot-dict-sql.conf.ext } disable_plaintext_auth = no first_valid_gid = 150 first_valid_uid = 150 last_valid_gid = 150 last_valid_uid = 150 log_timestamp = "%Y-%m-%d %H:%M:%S " mail_plugins = quota trash expire mail_privileged_group = vmail managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext spamtest spamtestplus namespace inbox { inbox = yes location = mailbox Archive { auto = subscribe special_use = \Archive } mailbox Drafts { auto = subscribe special_use = \Drafts } mailbox Junk { auto = subscribe special_use = \Junk } mailbox Sent { auto = subscribe special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { auto = subscribe special_use = \Trash } prefix = separator = / } passdb { args = /etc/dovecot/dovecot-sql.conf.ext driver = sql } plugin { antispam_backend = pipe antispam_crm_binary = /bin/false antispam_dspam_args = --deliver=;--user;%u;--source=error;--signature=%%s antispam_dspam_binary = /usr/bin/dspam antispam_dspam_notspam = --class=innocent antispam_dspam_result_header = X-DSPAM-Result antispam_dspam_spam = --class=spam antispam_pipe_program = /usr/local/bin/postfix/reclasify-from-dovecot antispam_pipe_program_args = %u;%d antispam_pipe_program_notspam_arg = --ham antispam_pipe_program_spam_arg = --spam antispam_pipe_tmpdir = /tmp antispam_signature = X-CRM114-CacheID antispam_signature_missing = error antispam_spam = Junk;Spam antispam_spool2dir_notspam = /tmp/spamspool/%%020lu-%u-%%05luh antispam_spool2dir_spam = /tmp/spamspool/%%020lu-%u-%%05lus antispam_trash = trash;Trash;Deleted Items;Deleted Messages antispam_verbose_debug = 0 expire = Trash expire2 = Trash/* expire3 = Spam expire_dict = proxy::expire quota = dict:User quota::proxy::quota quota_exceeded_message = Uzivatel %u ma zaplnenou schranku. quota_rule = *:storage=1G quota_rule2 = Trash:storage=+100M sieve = file:~/sieve;active=~/.dovecot.sieve sieve_after = /etc/dovecot/sieve_after sieve_before = /etc/dovecot/sieve_before sieve_extensions = +spamtest +spamtestplus sieve_spamtest_max_value = 15 sieve_spamtest_status_header = X-Spam-Level sieve_spamtest_status_type = strlen trash = /etc/dovecot/dovecot-trash.conf.ext } pop3_client_workarounds = outlook-no-nuls oe-ns-eoh pop3_uidl_format = UID%u-%v postmaster_address = sysadmin(a)ehosting.cz protocols = " imap lmtp sieve pop3" service auth-worker { user = $default_internal_user } service dict { unix_listener dict { user = vmail } } service lmtp { unix_listener /var/spool/postfix/private/dovecot-lmtp { group = postfix mode = 0660 user = postfix } user = vmail } service stats { unix_listener stats-writer { user = vmail } } ssl_cert = </etc/dovecot/private/dovecot.pem ssl_client_ca_dir = /etc/ssl/certs ssl_dh = # hidden, use -P to show it ssl_key = # hidden, use -P to show it syslog_facility = local0 userdb { args = /etc/dovecot/dovecot-sql.conf.ext driver = sql } verbose_proctitle = yes protocol lmtp { mail_plugins = quota trash expire sieve quota trash expire } protocol lda { mail_plugins = quota trash expire sieve } protocol imap { mail_plugins = quota trash expire antispam imap_quota } ========================== The dovecot.err shows the two mentioned error lines (Panic:, Error:) plus: Dec 7 13:12:21 s6mail dovecot: imap(ttt(a)mail2.swpraha.cz)<13466><wezwvN61RK0AAAAAAAAAAAAAAAAAAAAB>: Fatal: master: service(imap): child 13466 killed with signal 6 (core dumps disabled - https://dovecot.org/bugreport.html#coredumps) Please let me know if you need any other details. Thanks for any suggestion --Jiri Kacena

2 2

logging in to postfixadmin failed probably because of a dovecot error
by peacecop kalmer: 07 Dec '20

07 Dec '20

I can’t log in to postfixadmin anymore. It says that the username or password is incorrect. It can’t be incorrect as I’ve stored them in Google and “Chrome”. I have two admin accounts and none of them can’t be used for logging in. So I changed the main password with “setup.php” and copied that hash into the configuration file. Then, I deleted one of the admin accounts directly in the database from the table “admin”. Finally, I tried to recreate that deleted admin account using “setup.php”. I get the following error message: “can’t encrypt password with dovecotpw, see error log for details”. I had a look into the error log file of postfixadmin and found these complaints: [Wed Dec 02 02:33:37.551048 2020] [authz_core:debug] [pid 30540] mod_authz_core.c(809): [client 192.168.1.65:54948] AH01626: authorization result of Require all granted: granted, referer:https://postfixadmin.tennis24.ee/setup.php [Wed Dec 02 02:33:37.551070 2020] [authz_core:debug] [pid 30540] mod_authz_core.c(809): [client 192.168.1.65:54948] AH01626: authorization result of : granted, referer:https://postfixadmin.tennis24.ee/setup.php [Wed Dec 02 02:33:37.551280 2020] [php7:warn] [pid 30540] [client 192.168.1.65:54948] PHP Warning: Cannot assign an empty string to a string offset in /usr/share/postfixadmin/variables.inc.php on line 31, referer:https://postfixadmin.tennis24.ee/setup.php [Wed Dec 02 02:33:37.568128 2020] [php7:notice] [pid 30540] [client 192.168.1.65:54948] dovecotpw password encryption failed., referer:https://postfixadmin.tennis24.ee/setup.php [Wed Dec 02 02:33:37.568155 2020] [php7:notice] [pid 30540] [client 192.168.1.65:54948] STDERR output: doveconf: Fatal: Error in configuration file /etc/dovecot/conf.d/10-ssl.conf line 13: ssl_cert: Can't open file /etc/letsencrypt/live/test.tennis24.ee/fullchain.pem: Permission denied\n, referer:https://postfixadmin.tennis24.ee/setup.php [Wed Dec 02 02:33:37.568897 2020] [deflate:debug] [pid 30540] mod_deflate.c(854): [client 192.168.1.65:54948] AH01384: Zlib: Compressed 1320 to 732 : URL /setup.php, referer:https://postfixadmin.tennis24.ee/setup.php Is the issue connected to the permission problem? If so why is the permission denied? I can't even receive any mails to the address kalmer(a)test.tennis24.ee anymore. If I send out it works fine but no mail arrives. -- *peacecop kalmer:* *Instituudi tee 3-27 * *76902 * *Harku * *Harku* *Harjumaa* Estonia *+372 652 4228 * *+372 5620 4556 * *__________________________________________________________________ *

2 1

http pipelining on auth_policy_server
by Adrian M 07 Dec '20

07 Dec '20

Hi, I'm curious to know if dovecot can be configured to do pipelining for auth_policy in order to use less connection to the server and keep them for longer. I'm working on making a small policy server and the lack of persistent connections is a cause of overhead. Thank you !

2 2

[patch] enhancement for adding limits to solr and tika parsing
by John Fawcett 07 Dec '20

07 Dec '20

Hi As mentioned in a previous thread, the solr + tika combination has caused me some issues due to attachment size. While tika seems to be able to parse large attachments, the resulting volume of text can overwhelm the solr server. One solution would be to throw resources at the problem, but in my case such large attachments don't contain anything worthwile indexing. Additionally I don't want people to be able to randomly crash my solr server by sending large compressed attachments that expand into huge volumes for solr. It's also a safety feature to have sane limits on what can be indexed. Attached is a first attempt to address the problem. I did not find a way to easily get actual attachment sizes, so I used an already available information - the overall message size. It may not be ideal but at least introduces limits where none existed. I have introduced two new parameters for the plugin section, for example: plugin { fts_max_size = 2M fts_max_size_tika = 1M } They can be used separately or together. Both sizes refer to the overall message size. The meaning is: fts_max_size - do not parse message bodies if the message size exceeds this value. A value of 0 indicates no limit. If the message body is not parsed, attachments are also not parsed. fts_max_size_tika - do not parse message attachments with tika if the message size exceeds this value. A value of 0 indicates no limit. If using both settings it makes sense to have fts_max_size > fts_max_size_tika, since with a smaller fts_max_size bodies are not indexed including attachments and the fts_max_size_tika will have no effect. The difference (ft_max_size - fts_max_size_tika) places an upper bound on the size of the non attachment body text that will be indexed. However, any attachments over the fts_size will automatically consume this limit and no body text will be indexed for those messages. I've only updated the tika parser not the script parser though the script parser potentially could benefit from this approach. The attached patch also includes the rolled up patch for using basic auth with the tika server and the previous posted patch (not mine) which solves an assert when using solr and tika together. John

1 0

Re: Re: Re: Dovecot+Solr+Tika segmentation fault
by Manuel Josupeit-Walter 07 Dec '20

07 Dec '20

>>> A fix was posted on this list which seems to avoid segfaults when >>> using solr+tika. I reposted it not long ago in response to another >>> question. Before exploring the other segfaults it would be worthwhile >>> getting that fix. If other segfaults continue then I suggest posting >>> the logging from Dovecot >> >> https://github.com/dovecot/core/commit/043d111cea78533cf22d3bfe0872c8376d84… >> (DOV-4090) >> >> Scheduled for 2.3.13. > > I applied the fix and will observe it for the next couple of days. Unfortunately, the issue still persists even with this patch. The log message is slightly different, though, regarding disconnection: Dec 03 17:10:49 server.name tika[988]: INFO tika/ (application/pdf) Dec 03 17:10:49 server.name tika[988]: INFO tika/ (image/png) Dec 03 17:10:49 server.name kernel: indexer-worker[15805]: segfault at 0 ip 00007f140483db64 sp 00007ffc04fa7960 error 4 in libdovecot.so.0.0.0[7f14047f3000+db000] Dec 03 17:10:49 server.name kernel: Code: 89 f5 48 8d b8 f0 01 00 00 48 8b 52 08 4c 8b 62 48 e8 90 89 fb ff 48 8b 44 24 08 be 00 20 00 00 4c 89 ef 48 8b 80 10 01 00 00 <4c> 8b 38 e8 64 b2 fb ff 48 8b 44 24 0 Dec 03 17:10:49 server.name dovecot[988]: Dec 03 16:10:49 indexer: Error: Indexer worker disconnected, discarding 1 requests for username_stripped Dec 03 17:10:49 server.name dovecot[988]: Dec 03 16:10:49 indexer-worker(username_stripped)<1952><Ed3ek5G1BMQgARa4EL8DAKGMINRlZjjS:c+gACAkOyV+gBwAAhFs1yA>: Fatal: master: service(indexer-worker): child 1952 killed It seems that there is something else going wrong in this version. Best, Manuel

3 3

quota-status for outgoing mail (Dovecot/Postfix)
by Peter Folta 06 Dec '20

06 Dec '20

[Dovecot version 2.3.11.3 (502c39af9)] Hi all, I’m using Dovecot’s quota-status service to let Postfix check the recipient’s quota before accepting emails following the guide here: https://blog.sys4.de/postfix-dovecot-mailbox-quota-en.html <https://blog.sys4.de/postfix-dovecot-mailbox-quota-en.html>. This works well for inbound emails. I would like to set up something similar for outbound email, i.e. if a user is over quota, they should not be allowed to send new emails. At the moment, the setup is in a bit of an inconsistent state: Users that have exceeded their quota are still able to send outbound emails but saving them in their Sent folder will fail leaving them without a copy. I have tried using Dovecot’s quota-status in Postfix’s smtpd_send_restrictions but didn’t get this to work. A quick look at the Dovecot source code seems to suggest that the quota-status plugin is only checking the recipient address: https://github.com/dovecot/core/blob/master/src/plugins/quota/quota-status.… <https://github.com/dovecot/core/blob/master/src/plugins/quota/quota-status.…> and https://github.com/dovecot/core/blob/master/src/plugins/quota/quota-status.… <https://github.com/dovecot/core/blob/master/src/plugins/quota/quota-status.…>. I suspect it’s not possible to use the quota-status service to control outbound email but thought I’d ask to confirm. I’m wondering if there’s a different way to achieve this? Thanks Peter

3 2

Files in tmp directory
by David Morsberger 05 Dec '20

05 Dec '20

I had to restore many thousands of dovecot emails from a crashed Mac Server to a new Ubuntu server. After completing I am noticing a few things that may be okay or may need to be fixed. 1) a couple of mailboxes have a lot (one has 102462) emails in the tmp directory. The files do not have the standard Mairdir++ filename format. An example: 1581262582.M397740P72267.mini.mmpcrofton.com <http://1581262582.m397740p72267.mini.mmpcrofton.com/> (missing the stuff at the end, ,S=,W=:2,S) 2) I see files in the cur directory that do not have the Maildir++ format. An example: 1601287326.V810Ie80087M240104.mmp-mail.mmpcrofton.com:2,S. (do not have the ,S=,W= values and the second value, V810Ie80087M240104, is longer that the other file names) How do I get the emails in (1) out of tmp? Do I need to convert the emails in (2)? David

2 3

Combine director and HAProxy for loadbalancig and failover
by Steven Varco 05 Dec '20

05 Dec '20

Hi All I’m trying to achive an active/active cluster with dovecot-director and HAProxy, as the director does not do health checks (loadblancing only) and I want both, loadblancing AND failover, where the latter is far more important to me (loadblancing I would just use as an addon and for curiosity, it is not really need in my setup). However, I’m not sure if this combination can be used that way, as I found almost no documentation on this. What I found is using either directory OR haproxy with dovecot, but not both. So I guess, that the description here is intended to use without the director: https://wiki2.dovecot.org/HAProxy This older list post is basically exaclty, what I’m trying to achive: https://dovecot.org/pipermail/dovecot/2015-July/101487.html Clients --> Load Balancer(HAProxy) --> Dovecot Proxy(DP) --> Dovecot Director(DD) --> MS1 / MS2 As far as I understood, this would require to (statically) set a host= entry for each client which would give another single point of failure? However reading the documentation: https://doc.dovecot.org/configuration_manual/haproxy/ assumes that this setup IS actually possible. Unfortunately it does not describe how dovecot must be setup at this point. So I assume since HAProxy is listening on port 1143 (for IMAP) and dovecot (with directror enabled) is listening on port 143, which is the main entry point for clients. So in this setup dovecot-director should first pass the mail traffic to HAProxy on port 1143 and then HAProxy passes it to the actual imap servers? So how would the dovecot setup on the director servers look like and how on the dovecot imap mail servers? My setup consist of each two machines: loadblancer (with HAProxy and dovecot-director) and dovecot imap servers. Last but not least, I found documentation for „dovemon“, which, if I got that correctly, should replace the external tool „poolmon“: https://doc.dovecot.org/configuration_manual/dovemon/ - However, I could not find out where the configuration YAML file (/etc/dovecot/dovemon.config.yml) should get included in the main dovecot configuration. By default this file would not be included at all and therefore would have no effect… thanks. Steven My setup: LOADBALANCERS: Currently one only running on: 10.0.2.26 haproxy: Exactly as: https://doc.dovecot.org/configuration_manual/haproxy/ where the backend servers line have been replaced with the mail servers. dovecot -n # 2.2.36 (1f10bfa63): /etc/dovecot/dovecot.conf # Pigeonhole version 0.4.24 (124e06aa) # OS: Linux 3.10.0-1127.19.1.el7.x86_64 x86_64 CentOS Linux release 7.8.2003 (Core) # Hostname: lb01.example.com auth_verbose = yes director_mail_servers = 10.0.2.30 10.0.2.29 director_servers = 10.0.2.26 disable_plaintext_auth = no first_valid_uid = 1000 haproxy_trusted_networks = 10.0.2.0/24 mail_location = maildir:~/Maildir managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext mbox_write_locks = fcntl namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } passdb { args = proxy=y ssl=any-cert nopassword=y driver = static } plugin { sieve = file:~/sieve;active=~/.dovecot.sieve } protocols = imap pop3 lmtp sieve service director { fifo_listener login/proxy-notify { mode = 0666 } inet_listener { port = 9090 } unix_listener director-userdb { mode = 0600 } unix_listener login/director { mode = 0666 } } service imap-login { executable = imap-login director inet_listener imap { port = 143 } inet_listener imap_haproxy { haproxy = yes port = 10143 } } service managesieve-login { inet_listener sieve { port = 4190 } } service pop3-login { executable = pop3-login director } ssl_cert = </etc/letsencrypt/live/mail-lb.tech-island.xyz/fullchain.pem ssl_key = # hidden, use -P to show it verbose_proctitle = yes protocol lmtp { auth_socket_path = director-userdb mail_plugins = " sieve" } protocol lda { mail_plugins = " sieve" } MAIL SERVERS: mx01: 10.0.2.30 mx02: 10.0.2.29 dovecot -n # 2.2.36 (1f10bfa63): /etc/dovecot/dovecot.conf # Pigeonhole version 0.4.24 (124e06aa) # OS: Linux 3.10.0-1127.19.1.el7.x86_64 x86_64 CentOS Linux release 7.8.2003 (Core) # Hostname: mx01.example.com auth_mechanisms = plain login auth_verbose = yes dict { sqlquota = mysql:/etc/dovecot/dict-sqlquota.conf.ext } doveadm_password = # hidden, use -P to show it doveadm_port = 14310 first_valid_uid = 1000 login_trusted_networks = 10.0.2.0/24 mail_location = maildir:~/Maildir mail_plugins = quota notify replication managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext mbox_write_locks = fcntl namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = separator = / type = private } passdb { args = /etc/dovecot/dovecot-sql.conf.ext driver = sql } plugin { mail_replica = tcp:10.0.2.29 quota = maildir:User quota quota_exceeded_message = Quota exceeded, please go to http://www.tech-island.xyz/over_quota_help for instructions on how to fix this. quota_rule2 = INBOX.Trash:storage=+100M quota_status_nouser = DUNNO quota_status_overquota = 552 5.2.2 Mailbox is full / Mailbox ist voll quota_status_success = DUNNO quota_warning = storage=90%% quota-warning 90 %u quota_warning2 = -storage=90%% quota-warning below %u sieve = file:~/sieve;active=~/.dovecot.sieve } postmaster_address = postmaster(a)tech-island.xyz protocols = imap pop3 lmtp sieve replication_dsync_parameters = -d -l 30 -U service aggregator { fifo_listener replication-notify-fifo { user = vmail } unix_listener replication-notify { user = vmail } } service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0660 user = postfix } unix_listener auth-userdb { user = vmail } } service dict { unix_listener dict { user = vmail } } service doveadm { inet_listener { port = 14310 } } service managesieve-login { inet_listener sieve { port = 4190 } } service quota-status { client_limit = 1 executable = quota-status -p postfix inet_listener { port = 14340 } } service quota-warning { executable = script /usr/local/libexec/dovecot/quota-warning.sh unix_listener quota-warning { user = vmail } user = vmail } service replicator { process_min_avail = 1 unix_listener replicator-doveadm { mode = 0600 user = vmail } } ssl = required ssl_cert = </etc/ssl/acme/certs/mail.tech-island.xyz.chain.crt ssl_key = # hidden, use -P to show it userdb { args = /etc/dovecot/dovecot-sql.conf.ext driver = sql } verbose_proctitle = yes protocol lmtp { mail_plugins = quota notify replication sieve } protocol lda { mail_plugins = quota notify replication sieve } protocol imap { mail_max_userip_connections = 20 mail_plugins = quota notify replication imap_quota } -- https://steven.varco.ch/

1 0

Server-side threading
by ohw.giles＠gmail.com 05 Dec '20

05 Dec '20

Hi list, Considering a message A in INBOX, where a reply B is sent and copied to the recipient's SENT folder, and to which a reply-to-reply C is received, again in INBOX, how should the list of threads in INBOX be (ideally) retrieved? Using THREADS=REFS when listing threads in INBOX to avoid matching unrelated threads unfortunately seems to miss the above example because B is only in SENT, not INBOX. REFERENCES allows A to be linked to C, but the sent message is missing from the returned thread. Of course this is by design. When listing messages in a selected mailbox, many modern clients provide the experience of listing the messages grouped by thread, showing all threads where *at least one message in the thread is in the selected mailbox*. IIUC, clients usually build their own indexes to achieve this, which seems wasteful. Does dovecot provide a server-side way to list or search messages and return threaded results in this manner?

1 0

doveadm sync return "failed: EOF (version not received)"
by Olivier Mars 04 Dec '20

04 Dec '20

Hi, I have 2 dovecot servers, server1.domain.tld and server2.domain.tld and I'm not able to do a simple doveadm backup command between them. Dovecot version 2.3.11.3, on debian buster, (installed from apt) I try to execute this cmd between to of my dovecot servers : doveadm sync -u postmaster(a)domain.tld remote:root@server2.domain.tld and it returns : doveadm(postmaster(a)domain.tld): Debug: remote(/var/run/dovecot/doveadm-server): auth-master: userdb lookup(postmaster(a)domain.tld): Started userdb lookup doveadm(postmaster(a)domain.tld): Debug: remote(/var/run/dovecot/doveadm-server): auth-master: conn unix:/var/run/dovecot/auth-userdb: Connecting doveadm(postmaster(a)domain.tld): Debug: remote(/var/run/dovecot/doveadm-server): auth-master: conn unix:/var/run/dovecot/auth-userdb (pid=118292,uid=0): Client connected (fd=15) doveadm(postmaster(a)domain.tld): Debug: remote(/var/run/dovecot/doveadm-server): auth-master: userdb lookup(postmaster(a)domain.tld): auth USER input: postmaster(a)domain.tld mail=maildir:/mails/2/domain.tld/postmaster/Maildir:INDEX=/var/lib/dovecot/indexes/domain.tld/postmaster@domain.tld home=/mails/2/domain.tld/postmaster quota_rule=*:storage=3145728000b:messages=500k doveadm(postmaster(a)domain.tld): Debug: remote(/var/run/dovecot/doveadm-server): auth-master: userdb lookup(postmaster(a)domain.tld): Finished userdb lookup (username=postmaster(a)domain.tld mail=maildir:/mails/2/domain.tld/postmaster/Maildir:INDEX=/var/lib/dovecot/indexes/domain.tld/postmaster@domain.tld home=/mails/2/domain.tld/postmaster quota_rule=*:storage=3145728000b:messages=500k) doveadm(postmaster(a)domain.tld): Debug: remote(/var/run/dovecot/doveadm-server): Added userdb setting: mail=maildir:/mails/2/domain.tld/postmaster/Maildir:INDEX=/var/lib/dovecot/indexes/domain.tld/postmaster@domain.tld doveadm(postmaster(a)domain.tld): Debug: remote(/var/run/dovecot/doveadm-server): Added userdb setting: plugin/quota_rule=*:storage=3145728000b:messages=500k doveadm(postmaster(a)domain.tld): Debug: remote(/var/run/dovecot/doveadm-server): Effective uid=65534, gid=65534, home=/mails/2/domain.tld/postmaster doveadm(postmaster(a)domain.tld): Debug: remote(/var/run/dovecot/doveadm-server): Quota root: name=Mailbox backend=count args= doveadm(postmaster(a)domain.tld): Debug: remote(/var/run/dovecot/doveadm-server): Quota rule: root=Mailbox mailbox=* bytes=3145728000 messages=512000 doveadm(postmaster(a)domain.tld): Debug: remote(/var/run/dovecot/doveadm-server): Quota grace: root=Mailbox bytes=314572800 (10%) doveadm(postmaster(a)domain.tld): Debug: remote(/var/run/dovecot/doveadm-server): Namespace inbox: type=private, prefix=INBOX., sep=., inbox=yes, hidden=no, list=yes, subscriptions=yes location=maildir:/mails/2/domain.tld/postmaster/Maildir:INDEX=/var/lib/dovecot/indexes/domain.tld/postmaster@domain.tld doveadm(postmaster(a)domain.tld): Debug: remote(/var/run/dovecot/doveadm-server): maildir++: root=/mails/2/domain.tld/postmaster/Maildir, index=/var/lib/dovecot/indexes/domain.tld/postmaster(a)domain.tld, indexpvt=, control=, inbox=/mails/2/domain.tld/postmaster/Maildir, alt= doveadm(postmaster(a)domain.tld): Debug: remote(/var/run/dovecot/doveadm-server): Namespace : type=private, prefix=, sep=, inbox=no, hidden=yes, list=no, subscriptions=no location=fail::LAYOUT=none doveadm(postmaster(a)domain.tld): Debug: remote(/var/run/dovecot/doveadm-server): none: root=, index=, indexpvt=, control=, inbox=, alt= doveadm(postmaster(a)domain.tld): Debug: remote(/var/run/dovecot/doveadm-server): quota: quota_over_flag check: quota_over_script unset - skipping doveadm(postmaster(a)domain.tld): Debug: remote(/var/run/dovecot/doveadm-server): brain M: Namespace INBOX. has location maildir:/mails/2/domain.tld/postmaster/Maildir:INDEX=/var/lib/dovecot/indexes/domain.tld/postmaster@domain.tld doveadm(postmaster(a)domain.tld): Debug: remote(/var/run/dovecot/doveadm-server): Namespace INBOX.: Using permissions from /mails/2/domain.tld/postmaster/Maildir: mode=0700 gid=default doveadm(postmaster(a)domain.tld): Error: remote(/var/run/dovecot/doveadm-server): read(root(a)server2.domain.tld) failed: EOF (version not received) doveadm(postmaster(a)domain.tld): Debug: remote(/var/run/dovecot/doveadm-server): auth-master: conn unix:/var/run/dovecot/auth-userdb (pid=118292,uid=0): Disconnected: Connection closed (fd=15) On the destination server, I can see that the destination server is well retrieving the user's info in userdb, before saying : server2 dovecot: doveadm: Error: read(<local>) failed: EOF (version not received) I tried to activate verbosity everywhere, but It does not show anything, like : ssh -v -lroot server2.domain.tld doveadm dsync-server -upostmaster(a)domain.tld -U debug1: Authentication succeeded (publickey). Authenticated to server2;domain.tld ([w.x.y.z]:22). debug1: channel 0: new [client-session] debug1: Requesting no-more-sessions(a)openssh.com debug1: Entering interactive session. debug1: pledge: network debug1: client_input_global_request: rtype hostkeys-00(a)openssh.com want_reply 0 debug1: Remote: /root/.ssh/authorized_keys:4: key options: agent-forwarding port-forwarding pty user-rc x11-forwarding debug1: Remote: /root/.ssh/authorized_keys:4: key options: agent-forwarding port-forwarding pty user-rc x11-forwarding debug1: Sending environment. debug1: Sending env LANG = fr_FR.UTF-8 debug1: Sending command: doveadm dsync-server -upostmaster(a)domain.tld -U debug1: client_input_channel_req: channel 0 rtype exit-status reply 0 debug1: client_input_channel_req: channel 0 rtype eow(a)openssh.com reply 0 debug1: channel 0: free: client-session, nchannels 1 Transferred: sent 2800, received 2820 bytes, in 0.1 seconds Bytes per second: sent 25466.2, received 25648.1 debug1: Exit status 0 If somebody can tell me some hints to go further, it'll be very apreciate. Thanks ! Here is the doveconf -n output (the two servers have the same) # 2.3.11.3 (502c39af9): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.11 (6c69c917) # OS: Linux 4.19.0-12-amd64 x86_64 Debian 10.6 # Hostname: server1 auth_cache_negative_ttl = 0 auth_cache_size = 100 M auth_cache_ttl = 5 mins auth_master_user_separator = * default_client_limit = 2000 disable_plaintext_auth = no doveadm_api_key = # hidden, use -P to show it doveadm_worker_count = 50 listen = w.x.y.z mail_fsync = always mail_gid = nogroup mail_location = maildir:~/Maildir:INDEX=/var/lib/dovecot/indexes/%d/%n mail_max_userip_connections = 300 mail_plugins = quota mail_uid = nobody maildir_very_dirty_syncs = yes namespace inbox { inbox = yes location = mailbox Drafts { auto = subscribe special_use = \Drafts } mailbox Junk { auto = subscribe autoexpunge = 90 days special_use = \Junk } mailbox Sent { auto = subscribe special_use = \Sent } mailbox "Sent Messages" { auto = no special_use = \Sent } mailbox Trash { auto = subscribe autoexpunge = 90 days special_use = \Trash } prefix = INBOX. separator = . } passdb { args = /etc/dovecot/master-users driver = passwd-file master = yes result_success = continue } passdb { args = /etc/dovecot/dovecot-sql.conf.ext driver = sql } plugin { imapsieve_mailbox1_before = file:/var/lib/dovecot/sieve/report-spam.sieve imapsieve_mailbox1_causes = COPY imapsieve_mailbox1_name = INBOX.Junk imapsieve_mailbox2_before = file:/var/lib/dovecot/sieve/report-ham.sieve imapsieve_mailbox2_causes = COPY imapsieve_mailbox2_from = INBOX.Junk imapsieve_mailbox2_name = * quota = count:Mailbox quota_rule = *:storage=1G:messages=500k quota_vsizes = yes sieve = file:~/sieve;active=~/.dovecot.sieve sieve_before = /var/lib/dovecot/sieve/antispam.sieve sieve_global_extensions = +vnd.dovecot.pipe +vnd.dovecot.environment +spamtest +spamtestplus sieve_pipe_bin_dir = /var/lib/dovecot/sieve sieve_plugins = sieve_imapsieve sieve_extprograms sieve_spamtest_max_header = X-Spam-Status: [[:alnum:]]+, score=-?[[:digit:]]+\.[[:digit:]] required=([[:digit:]]+\.[[:digit:]]).* sieve_spamtest_status_header = X-Spam-Status: [[:alnum:]]+, score=(-?[[:digit:]]+\.[[:digit:]]) sieve_spamtest_status_type = score } pop3_fast_size_lookups = yes pop3_reuse_xuidl = yes pop3_save_uidl = yes pop3_uidl_format = %f protocols = imap pop3 lmtp service anvil { client_limit = 5000 unix_listener anvil-auth-penalty { mode = 00 } } service auth { client_limit = 0 } service doveadm { inet_listener http { port = 8080 } vsz_limit = 2 G } service imap-login { process_limit = 2000 service_count = 1 } service imap { client_limit = 1 process_limit = 5000 vsz_limit = 1 G } service indexer-worker { process_limit = 20 } service lmtp { client_limit = 1 inet_listener lmtp { port = 24 } process_limit = 200 process_min_avail = 20 vsz_limit = 1 G } service pop3-login { process_limit = 2000 service_count = 1 } ssl = no submission_host = smtp.domain.tld:25 userdb { args = /etc/dovecot/dovecot-sql.conf.ext driver = sql } protocol lmtp { mail_plugins = quota sieve } protocol imap { mail_plugins = quota imap_sieve imap_quota }

1 0

Any RPMs for aarch64 available?
by Peter Cooper Jr. 04 Dec '20

04 Dec '20

Hey, I really appreciate Dovecot being available with standard repos in repo.dovecot.org. I'm currently using the "CentOS 7" one on Amazon Linux 2 and it works great for x86_64. I'm wondering if there are any plans for also providing arm builds (aarch64) at some point? Or if they're available somewhere else already? I may play around with compiling things myself, but just downloading an official package is generally the easier way to go so I thought it couldn't hurt to ask. Thanks, Peter

3 4

follow up to my mail issues I posted about
by Christy S 03 Dec '20

03 Dec '20

Okay. A few days late, but I've gone through the replies I received from several of you and consolidated responses into one mail. Of course life gets crazy when I need to sit down and work on things. "It seems to me Thunderbird is struggling to write to the Sent mailbox, so disk space, and file permissions are the obvious ones to check. And yes, on the server rather than your local machine, as you're using IMAP" It's definitely not disc space. I wouldn't think an upgrade would change permissions, but it's a place to check. I'm showing my newbieness here but, I'm not even sure what account should have access to those files. I know, it's a miracle I got all this working in the first place. I should have taken notes, but I did so much fiddling with this and that to make it behave that I didn't know what to write down. "Anything interesting in the dovecot logs at the time when you check?" So I looked up dovecot logs on google, and what I'm seeing is that dovecot generally writes to mail logs under /var/log. The stuff I sent in my first email came from mail.err in that folder. The only other file I could find was mail.log. Using tail on that file, I see entries like these. Dec 2 20:53:07 kylesmith-music postfix/smtpd[396853]: warning: unknown[212.70.149.37]: SASL LOGIN authentication failed: UGFzc3dvcmQ6 Dec 2 20:53:07 kylesmith-music postfix/smtpd[396853]: disconnect from unknown[212.70.149.37] ehlo=1 auth=0/1 rset=1 quit=1 commands=3/4 There are similar entries from a different ip address, but interestingly neither match the ip address of our fiber modem so I have no idea what's going on there. "First, do you have a backup prior to upgrading the server? You may want to refer to that to get a clean idea of how the configuration was set up initially. Sometimes the upgrade process can reset configuration files and its usually easier to work from a known working configuration. " I really wish I did, but I'm not sure how to effectively back up a VPS. "Second, can you describe how you set the mail stack you are using up?" I can tell you it's postfix and dovecot. That's what a lot of articles recommended, so I went with that. We use different devices so I chose to use imap as it interfaces directly with the stored mail on the server. Usually this is good, except now when it breaks. "Its possible the issue is SSL related but its difficult to say. There have been a number of breaks with SSL encryption in recent years which is why the cipher list has been adjusted," SSL is definitely my weakest point of knowledge. I know I had it working smoothly but it was basically following how to stuff. The reason we're using it even for mail has to do with someone in my husband's life who would get in and mess things up if he had the chance, so I'm trying to make sure he doesn't have that chance by locking things down tight. "google can also be out of date I'd recommend using a date filter when using it for checking configurations and limit it only to the last 1-2 years as you will get more relevant information typically." Oh my gosh, that alone would be extremely helpful. The number of seriously outdated articles I had to filter through when I set this up in the first place is just unreal. Mind telling me how to do a date filter? Otherwise, I'll google how to use google, hahaha. "The configuration parameter for the cipher list uses HIGH as a default profile and if I recall correctly that disables lower TLS versions that are susceptible to certain types of attacks. (SSL3,TLS1,TLS1.1,1.2 I think) The dovecot documentation explains what the defaults are for HIGH. The ! prevents using specifica protocols and configuration is usually a chain (processed from left to right until a match is found). DH is the diffie-helman exchange. Usually this file is recalculated on a per server basis to prevent pre-calculation attacks on SSL and usually it must meet a certain key length. DH Groups 1 and 2 are known to be insecure." Okay, that went way over my head, but it sounds like good information to have and study up more on, hopefully after I get the immediate issue solved. If I'm following you correctly at all though I could see that potentially being my issue, hmm. I will for sure see if I can get my hands on that book. "Some quick thoughts here — if the changes you mentioned did not solve the issue, I would definitely comment those back out so you are only troubleshooting one thing at a time." Fair point. I commented out the one about dh high, then hopefully reloaded the configuration, dovecot reload? That done, I tried sending an email from the domain to my gmail using thunderbird. I got the same message, but it did actually send this time. However, when I replied to the test message with my gmail account, it wasn't received by thunderbird. I do see it using the mail app on the server, though. "Next, are you able to send email using any other client?" I can send mail locally on the server from one account to another for sure. I managed it once, at least. Those mail clients seem clunky though so I may not be doing things correctly to test. "Third, try disabling all SSL and see if you are able to send via Thunderbird or really, any client at all…" Is there an easy way to disable ssl for now and then reenable it? That would definitely help narrow this down. "Your DH parameters are too weak. You should generate at least 2048 byte parameters." To be honest, I don't even recall setting up DH parameters. I would guess that probably happened when I was setting up ssl? Again, thank you to each of you for helping with this. I really try not to send stuff like this to mailing lists that are technical in nature, but this is important business mail he's potentially missing and I'm a bit out of my league. First project once this gets fixed will be learning how to back up the server. Christy

3 2

New Version
by Jorge Bastos 02 Dec '20

02 Dec '20

Howdy, Sorry the question, I havent seen any update on github since July, is everything ok with Dovecot? Thanks,

2 3

Re: Re: Dovecot+Solr+Tika segmentation fault
by Manuel Josupeit-Walter 02 Dec '20

02 Dec '20

>> A fix was posted on this list which seems to avoid segfaults when >> using solr+tika. I reposted it not long ago in response to another >> question. Before exploring the other segfaults it would be worthwhile >> getting that fix. If other segfaults continue then I suggest posting >> the logging from Dovecot >> > > https://github.com/dovecot/core/commit/043d111cea78533cf22d3bfe0872c8376d84… > (DOV-4090) > > Scheduled for 2.3.13. Meanwhile, I also found the fix from October. I can confirm that the issue occurred on 2.3.11.3 only. I switched to the previous version (which is pretty easy thanks to Docker) and the issue disappeared. All messages were indexed properly afterwards. I applied the fix and will observe it for the next couple of days. The assertions have been misplaced anyway from my viewpoint because the asserted fields (or properties or whatever, I don't know how they're called in C) are not accessed in every case. I am happy that this is scheduled for 2.3.13. Although, I hope that the payload_input or payload_output won't be NULL when payload_finished is true. :) Thanks a lot to you guys for all the effort. I would not be able to resolve this on my own without your help. Best, Manuel

1 0

Error: Mailbox INBOX: Sync failed
by Jos Chrispijn 02 Dec '20

02 Dec '20

Just saw in my logfile this line appeared: imap(xxxxxx)<56614><CMMJw9i0aoBSsH9H>: Error: Mailbox INBOX: Sync failed for mbox: Expunged message reappeared to mailbox (UID 174550 < 174552, seq=11, idx_msgs=9) Looks like messages' UIDs are mixed up? I thought that if Dovecot sees broken X-UID headers for "new" messages, they're silently fixed? Can you tell how I can correct this error/warning? Thanks! BR, Jos

1 1

Dovecot+Solr+Tika segmentation fault
by Manuel Josupeit-Walter 02 Dec '20

02 Dec '20

3 2

Bug report: invalid \HasNoChildren in response when asterisk is used in the name
by Merijn Schering 01 Dec '20

01 Dec '20

Hi, I'm using dovecot 2.3.4.1 (f79e8e7e4). I have created a folder called "Test with *". Now when I do a command: A3 LIST "" "%" RETURN (CHILDREN STATUS (MESSAGES UNSEEN)) It responds: * STATUS Test with * ( MESSAGES 0 UNSEEN 0 ) * LIST ( \HasNoChildren \UnMarked ) / Spam But it actually has children! This only happens when I use a * character in the name. I hope you can fix this some day. Thanks! Best regards, Merijn Schering Intermesh https://www.group-office.com https://twitter.com/GroupOffice

2 1

doveadm crash on import
by Ralf Hildebrandt 01 Dec '20

01 Dec '20

% doveadm import -u restore(a)backup.invalid mdbox:/home/copymail2/mdbox '' mailbox INBOX header Reply-To gmail.com results in: doveadm(restore(a)backup.invalid): Panic: fcntl(/home/copymail2/mdbox/mailboxes/INBOX/dbox-Mails/dovecot.index.log, write-lock, F_SETLKW) locking failed: Resource deadlock avoided (WRITE lock held by pid 37462) doveadm(restore(a)backup.invalid): Error: Raw backtrace: /usr/lib/dovecot/libdovecot.so.0(backtrace_append+0x42) [0x7fb131662d22] -> /usr/lib/dovecot/libdovecot.so.0(backtrace_get+0x1e) [0x7fb131662e3e] -> /usr/lib/dovecot/libdovecot.so.0(+0xed75e) [0x7fb13166d75e] -> /usr/lib/dovecot/libdovecot.so.0(+0xed7a1) [0x7fb13166d7a1] -> /usr/lib/dovecot/libdovecot.so.0(i_fatal+0) [0x7fb1315c2beb] -> /usr/lib/dovecot/libdovecot.so.0(+0xf2932) [0x7fb131672932] -> /usr/lib/dovecot/libdovecot.so.0(file_wait_lock_error+0x26) [0x7fb131672966] -> /usr/lib/dovecot/libdovecot.so.0(file_wait_lock+0x20) [0x7fb131672a00] -> /usr/lib/dovecot/libdovecot-storage.so.0(mail_transaction_log_file_lock+0x90)[0x7fb131a28050] -> /usr/lib/dovecot/libdovecot-storage.so.0(mail_transaction_log_lock_head+0x3d)[0x7fb131a2d4dd] -> /usr/lib/dovecot/libdovecot-storage.so.0(mail_transaction_log_append_begin+0x3e)[0x7fb131a26a8e] -> /usr/lib/dovecot/libdovecot-storage.so.0(+0xf52f2) [0x7fb131a202f2] -> /usr/lib/dovecot/libdovecot-storage.so.0(mail_index_transaction_commit_full+0x76)[0x7fb131a20826] -> /usr/lib/dovecot/libdovecot-storage.so.0(mail_index_transaction_commit+0x1c)[0x7fb131a208bc] -> /usr/lib/dovecot/libdovecot-storage.so.0(+0xdd619) [0x7fb131a08619] -> /usr/lib/dovecot/libdovecot-storage.so.0(mail_cache_add+0x214) [0x7fb131a08f24] -> /usr/lib/dovecot/libdovecot-storage.so.0(index_mail_parse_header+0x5a5) [0x7fb1319eaef5] -> /usr/lib/dovecot/libdovecot.so.0(+0xc5b13) [0x7fb131645b13] -> /usr/lib/dovecot/libdovecot.so.0(i_stream_read_memarea+0x74) [0x7fb13167ab14] -> /usr/lib/dovecot/libdovecot.so.0(i_stream_read+0x29) [0x7fb13167ae49] -> /usr/lib/dovecot/libdovecot.so.0(i_stream_read_data+0x3d) [0x7fb13167b7bd] -> /usr/lib/dovecot/libdovecot.so.0(message_parse_header_next+0x68) [0x7fb13164c288] -> /usr/lib/dovecot/libdovecot.so.0(message_parse_header+0x4f) [0x7fb13164cc5f] -> /usr/lib/dovecot/libdovecot-storage.so.0(+0xc9f61) [0x7fb1319f4f61] -> /usr/lib/dovecot/libdovecot-storage.so.0(+0xcb214) [0x7fb1319f6214] -> /usr/lib/dovecot/libdovecot-storage.so.0(index_storage_search_next_nonblock+0x10d)[0x7fb1319f69ed] -> /usr/lib/dovecot/libdovecot-storage.so.0(mailbox_search_next_nonblock+0x22)[0x7fb131978df2] -> /usr/lib/dovecot/libdovecot-storage.so.0(mailbox_search_next+0x3d)[0x7fb131978e5d] -> doveadm(+0x31c14) [0x557ac63f1c14] -> doveadm(+0x2c518) [0x557ac63ec518] -- Ralf Hildebrandt Geschäftsbereich IT | Abteilung Netzwerk Charité - Universitätsmedizin Berlin Campus Benjamin Franklin Hindenburgdamm 30 | D-12203 Berlin Tel. +49 30 450 570 155 | Fax: +49 30 450 570 962 ralf.hildebrandt(a)charite.de | https://www.charite.de

2 2

director_username_hash = %d and doveadm director map
by Ralf Becker 30 Nov '20

30 Nov '20

Our directors hash by domain (director_username_hash = %d), as some of our users share folders with other users of the same domain. We now started using director tags to map domains to their backends. Unfortunately doveadm director map seems no to work with director_username_hash = %d user hash mail server ip expire time <unknown> 432784257 10.44.88.1 2020-11-23 13:10:55 <unknown> 4244233328 10.44.88.1 2020-11-23 13:13:55 <unknown> 1913982503 10.44.88.1 2020-11-23 13:15:40 How can I check to which backend / IP a domain is maped, aka how is that hash calculated? doveadm director move seems also not to do anything meaningful for %d, or at least I have not found out how to use it to move a domain to a different backend. Hoping for some insight :) Ralf -- Ralf Becker EGroupware GmbH [www.egroupware.org] Handelsregister HRB Kaiserslautern 3587 Geschäftsführer Birgit und Ralf Becker Leibnizstr. 17, 67663 Kaiserslautern, Germany Telefon +49 631 31657-0

3 5

Dovecot cannot access mailcrypt decryption key
by Daniel Niewerth 30 Nov '20

30 Nov '20

2 1

A probably dumb question, but I'm stumped
by Christy S 30 Nov '20

30 Nov '20

Hi folks, I'm stumped on an error we're getting in dovecot after upgrading ubuntu. I will say up front that I'm far from a linux expert. I'm helping my husband by managing a virtual private server to handle his domain, including its email. We set this up two years ago and once I finally got the mail working, it's been humming along just fine since, until two days ago when I performed the ubuntu upgrade. Now, when we try to send mail through his domain thunderbird gives this error: Your message was sent but a copy was not placed in your sent folder (Sent) due to network or file access errors. Note that it says this, but the mail isn't actually sent at all. We are using SSL and have been since the beginning which might be part of our problem, but I'm not positive. A google search suggested adding two lines to the 10-ssl.conf file. ssl_dh = </usr/share/dovecot/dh.pem ssl_cipher_list = HIGH:!DH:!aNULL I did both of these things and restarted the server completely, but no luck. looking in /var/log/mail.err I see this. Nov 29 14:08:56 kylesmith-music dovecot: imap-login: Error: Failed to initialize SSL server context: Can't load SSL cert ificate: error:140AB18F:SSL routines:SSL_CTX_use_certificate:ee key too small: user=<>, rip=xxx.xxx.xxx.xxx, lip=xxx.xxx.xxx.xxx, session=<t4qrdkS1kPNLFhL4> What's interesting is that last line only showed up after I added the two lines to the config file. My guess is I need to do something with SSL, update it maybe? But I don't want to go fiddling around purely on a guess and potentially break things even more. So, any of you much more linux familiar types want to point me in the right direction? Thanks! Christy

4 3