- dovecot - dovecot.org

Zlib problem - dovecot.index.cache
by julio covolato 05 Feb '21

05 Feb '21

Hi I'm having problems with zlib giving an error in dovecot.index.cache, when I move a message from one folder to another, this error often appears "Cached message size smaller / biger than expected": Feb 03 19:02:07 imap(julio(a)xxx.com.br): Error: Corrupted record in index cache file /var/spool/vmail/vmail01/xxx.com.br/julio//Maildir/.Trash/dovecot.index.cache: UID 503914: Broken physical size in mailbox Trash: read(zlib(/var/spool/vmail/vmail01/xxx.com.br/julio//Maildir/.Trash/cur/1612388618.M2222P27195.saturn,S=34225,W=34342:2,S)) failed: Cached message size smaller than expected (34225 < 40960, box=Trash, UID=503914) I'm using the [1] dovecot-maildir-compress.sh script in crontab daily to compress old messages with 7 days old with bzip2. Crontab line: 30 2 * * * /usr/local/sbin/dovecot-maildir-compress.sh -t 7 /var/spool/vmail/vmail01/ > /dev/null 2>&1 Any suggestions on how to fix this error? [1] - https://github.com/extremeshok/dovecot-maildir-compression/blob/master/dove… Thanks. -- ---------------------------------- _ Engº Julio Cesar Covolato 0v0 <julio(a)psi.com.br> /(_)\ F: 55-11-99175-9260 ^ ^ PSI INTERNET ----------------------------------

1 0

Service unavailable, lots of idle dovecot-login processes
by Wolfgang 05 Feb '21

05 Feb '21

Hi, Web search turned no results to this problem: We have a small site running private e-mail for maybe 12 people, dovecot is used by Postfix-SASL and IMAP clients. PROBLEM: When starting dovecot, after a few hours, IMAP clients are no longer able to connect. Thunderbird indicates that connection is refused. On the server, we see 100 dovecot/imap-login processes. This is the process limit. If we increase the process limit to 200, same thing, we survive a few hours longer but eventually we're seeing 200 imap-login processes and rejected connections. When listing TCP connections via lsof, there are only around 30 connections open to IMAP and we have exactly the same amount of dovecot/imap processes. These connections are held by 30 dovecot/imap-login processes. The other 70 dovecot/imap-login processes seem to do nothing. They're all sitting in "epoll_wait(14," according to strace but don't have TCP connections open. The only way out of this that we have found is re-starting dovecot every few hours. BTW, service_count = 1 for improved security. Dovecot Version: 2.3.4.1 (f79e8e7e4) Interestingly we were using nearly the same config on our old server with 2.2.13 and did not see this issue. Any ideas how to solve that properly? Thank you, Wolfgang

3 8

BUG report: dbox movealt doesn't move reverse (to default location)
by Vitalii 05 Feb '21

05 Feb '21

Hi, Here is the problem that occured: #sudo doveadm -D altmove -u vv(a)vito.pp.ua all works properly and moves all storage to alt dir. However, to move it back to default storage I add '-r' by manual: #sudo doveadm -D altmove -u vv(a)vito.pp.ua -r all That seems behave like the original command ignoring '-r'. my dovecot conf: # 2.3.4.1 (f79e8e7e4): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.4 () # OS: Linux 4.19.0-9-amd64 x86_64 Debian 10.4 # Hostname: qemu7.internetguru.ca auth_mechanisms = plain login disable_plaintext_auth = no imapc_features = rfc822.size fetch-headers imapc_host = imap.gmail.com imapc_port = 993 imapc_ssl = imaps imapc_user = %u listen = *,[::] log_timestamp = "%Y-%m-%d %H:%M:%S " mail_attachment_dir = /wd640/mdbox-att/%d/%n mail_max_userip_connections = 100 mail_prefetch_count = 20 mail_privileged_group = vmail passdb { args = /etc/dovecot/dovecot-sql.conf driver = sql } plugin { quota = dict:user::file:/var/vmail/%d/%n/.quotausage sieve = /var/vmail/%d/%n/.sieve sieve_max_redirects = 25 } protocols = imap pop3 service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0660 user = postfix } unix_listener auth-userdb { group = vmail mode = 0600 user = vmail } user = root } service imap-login { client_limit = 1000 process_limit = 512 } service lmtp { unix_listener /var/spool/postfix/private/dovecot-lmtp { group = postfix mode = 0600 user = postfix } } service stats { unix_listener stats-reader { group = vmail mode = 0660 user = vmail } unix_listener stats-writer { group = vmail mode = 0660 user = vmail } } ssl_cert = </etc/postfix/smtpd.cert ssl_client_ca_dir = /etc/ssl/certs ssl_dh = # hidden, use -P to show it ssl_key = # hidden, use -P to show it userdb { driver = prefetch } userdb { args = /etc/dovecot/dovecot-sql.conf driver = sql } protocol imap { mail_plugins = quota imap_quota } protocol pop3 { mail_plugins = quota pop3_uidl_format = %08Xu%08Xv } protocol lda { mail_plugins = sieve quota postmaster_address = postmaster(a)some.ca } protocol lmtp { mail_plugins = quota sieve postmaster_address = postmaster(a)some.ca } I am using debian 10. P.S. I have not found much information about dbox attachments commands. Seems none needs them.

3 3

logging verbosity
by Fourhundred Thecat 05 Feb '21

05 Feb '21

Hello, I get lots of these messages in the log: dovecot: imap-login: Login: user(a)1.2.3.4, TLSv1.3 with .. dovecot: imap(user)<10889><glzsCIi6AMbUGQtL>: Disconnected for inactivity ... dovecot: imap(user)<10887><vzjQB4i6/MXUGQtL>: Logged out ... when user clicks on folder in Thunderbird, or sometimes even when the Thunderbird window is in focus (without clicking anything). Anyway, how can I suppress these info messages, while keeping the important ones, such as auth problems? I am using Dovecot v2.3.4.1 with 10-logging.conf with default values. I see there is this line: # Log unsuccessful authentication attempts and the reasons why they failed. auth_verbose = yes I definitely want to keep logging unsuccessful auth, but how can I suppress the verbose rest? and lastly, can these settings be set per-user? Can I suppress verbose for user 'bob' but keep for others? thanks,

5 5

Feb 03 13:27:19 aggregator: Fatal: chroot(/var/lib/dovecot/run/dovecot/.) failed: Operation not permitted
by Jörg Faudin Schulz 05 Feb '21

05 Feb '21

I'm trying to set up dsync replication. This seems to work partial - complete replica does work (delete the mailboxes on target, and they'll get filled again). But, changes don't seem to get populated on the replica server; I get the msg Feb 03 13:27:19 aggregator: Fatal: chroot(/var/lib/dovecot/run/dovecot/.) failed: Operation not permitted dovecot conf: # Pigeonhole version 0.5.13 (cdd19fe) # OS: Linux 4.4.0-193-generic x86_64 # Hostname: imap.faudin.de auth_mechanisms = plain login default_internal_group = root default_internal_user = vmail default_login_user = vmail doveadm_password = # hidden, use -P to show it doveadm_port = 2443 first_valid_gid = 0 imapc_features = rfc822.size fetch-headers imapc_port = 1143 imapc_ssl = starttls imapc_ssl_verify = no imapc_user = %u lda_mailbox_autocreate = yes lda_mailbox_autosubscribe = yes log_path = /dev/stderr mail_plugins = " notify replication" mail_prefetch_count = 20 mail_privileged_group = root managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext namespace inbox { inbox = yes location = mailbox Drafts { auto = create special_use = \Drafts } mailbox Junk { auto = create special_use = \Junk } mailbox Sent { auto = create special_use = \Sent } mailbox "Sent Messages" { auto = create special_use = \Sent } mailbox Trash { auto = create special_use = \Trash } prefix = } passdb { args = /etc/dovecot/dovecot-ldap.conf.ext driver = ldap } plugin { mail_replica = tcp:m.datilo.de:2443 postmaster = isomne valid address replication_sync_timeout = 2 sieve = file:/var/vmail/sieve/scripts/%u/sieve;active=/var/vmail/sieve/scripts/%u/.dovecot.sieve sieve_after = /etc/dovecot/sieve/sieve-after sieve_before = /etc/dovecot/sieve/sieve-before sieve_default = /etc/dovecot/sieve/default.sieve sieve_dir = /var/vmail/sieve/scripts/%u sieve_global_dir = /var/vmail/sieve } protocols = imap lmtp sieve service aggregator { unix_listener replication-notify { group = root mode = 0666 user = vmail } } service anvil { chroot = } service auth { chroot = unix_listener auth-client { mode = 0660 user = vmail } } service config { unix_listener config { group = root user = vmail } } service doveadm { group = root inet_listener { port = 2443 } user = vmail } service imap-login { chroot = inet_listener imap { port = 1143 } inet_listener imaps { port = 1993 ssl = yes } } service lmtp { chroot = inet_listener lmtp { port = 2525 } } service managesieve-login { chroot = inet_listener sieve { port = 4190 } } service replicator { process_min_avail = 1 unix_listener replicator-doveadm { group = root mode = 0600 user = vmail } } ssl = required ssl_cert = </run/secrets/letsencrypt-fullchain ssl_cipher_list = ALL:!kRSA:!SRP:!kDHd:!DSS:!aNULL:!eNULL:!EXPORT:!DES:!3DES:!MD5:!PSK:!RC4:!ADH:!LOW@STRENGTH:!SSLv2:!TLS1.0 ssl_client_ca_file = /var/run/secrets/letsencrypt-fullchain ssl_dh = # hidden, use -P to show it ssl_key = # hidden, use -P to show it ssl_min_protocol = TLSv1.2 ssl_prefer_server_ciphers = yes submission_host = exim-int-mailout:1587 userdb { args = /etc/dovecot/dovecot-ldap.conf.ext driver = ldap } protocol lmtp { mail_plugins = " notify replication sieve" } protocol lda { mail_plugins = " notify replication sieve" }

4 3

Several users, same mailbox
by Adrian 04 Feb '21

04 Feb '21

Hello, I have had Dovecot set up to use PAM authentication, as my current users all have system accounts on Debian. I've just moved over to passwdfile authentication, because I want to add new users who won't have logins on the system. This is working fine with my existing users. Now, the problem is that I want the new users to share the SAME (Maildir) 'mailbox'. Currently 10-mail.conf contains mail_location = maildir:/var/mail/%u:LAYOUT=fs so this needs to be overridden, or I need some new way of mapping users to mail locations. I could probably do it with symlinks from /var/mail/newuser to /var/mail/mail-location but there may be a better way to do it than that. I'd like it to be in a file, not needing mySQL or other database. Lastly, are there any implications for locking? These will be used rarely but if a second user logs in for the same mailbox they should get a lock error. dovecot -n # 2.3.4.1 (f79e8e7e4): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.4 () # OS: Linux 4.19.0-11-amd64 x86_64 Debian 10.7 ext4 # Hostname: example.com disable_plaintext_auth = no mail_location = maildir:/var/mail/%u:LAYOUT=fs Thanks in advance

2 1

Restarting indexing?
by Philip Warner 04 Feb '21

04 Feb '21

Hi, I have about 80GB of mail to index using Dovecot 2.3.4.1 and xapian 1.4.11 FTS. After about 18 hours I had to reboot the server for an unrelated reason (it was perhaps a quarter of the way through indexing). After reboot, the indexing did not restart, and I could find no way to restart it other than via the ‘doveadm index’ command, which I have now done, with the result that the indexing has restarted from scratch. Is there a way to coax it to restart from where it left off, in case I need another reboot? Sent from Mail for Windows 10

1 0

lmtp warning flooding logfile
by Michael Ruiz 03 Feb '21

03 Feb '21

Hi all, Checking my dovecot log files, I am seeing a huge flood of the following kind of message over and over. I'm not sure how I can get this to stop. Is there something wrong with my configuration? Regards, Michael dovecot[106888]: lmtp(572901): Warning: Event 0x55ee2285bd30 leaked (parent=(nil)): lmtp-client.c:173: 1 Time(s) dovecot[106888]: lmtp(572901): Warning: Event 0x55ee228774e0 leaked (parent=0x55ee228772d0): mail-storage-service.c:1336: 1 Time(s) dovecot[106888]: lmtp(572901): Warning: Event 0x55ee22877ef0 leaked (parent=0x55ee228711c0): mail-storage-service.c:1336: 1 Time(s) dovecot[106888]: lmtp(572901): Warning: Event 0x55ee2287b3b0 leaked (parent=0x55ee22856e00): smtp-server-transaction.c:58: 1 Time(s) dovecot[106888]: lmtp(572901): Warning: Event 0x55ee2287d5f0 leaked (parent=0x55ee2287db10): smtp-server-recipient.c:38: 1 Time(s) dovecot[106888]: lmtp(572901): Warning: Event 0x55ee2287db10 leaked (parent=0x55ee22856e00): smtp-server-transaction.c:58: 1 Time(s) dovecot[106888]: lmtp(572901): Warning: Event 0x55ee22883700 leaked (parent=0x55ee228877e0): smtp-server-recipient.c:38: 1 Time(s) dovecot[106888]: lmtp(572901): Warning: Event 0x55ee22883910 leaked

1 0

Custom quota exeed message
by rudolf＠padaru.de 03 Feb '21

03 Feb '21

Hey there, i need some help with custom quota messages with dovecot and postfix. The quota setup is clear and easy, now i want to manipulate the exceed message, which is generated, if the mailbox is full. Now i got something like that Your message to <user(a)my.server.com> was automatically discarded: Quota exceeded (mailbox for user is full) The first line so i think is generated from postfix and cant be edit or? The second line is generatet from dovecot and i can manipulate there with the quota_exceeded_message variable. My problem is, that the sender cant see the mail-adress where he originally send the mail. Because the user is an local user on my server. I need somethin like that: Your message to <peter.schmidt(a)schmidt.com> was automatically discarded: Quota exceeded (mailbox for user is full) Is there an way to manipulate the first line of answer? Ori s there an way, that i can run a custom script in the quota_exceeded_message var? With the latter variant i would be able to create something like: Your message to <user(a)my.server.com> was automatically discarded: Quota exceeded (mailbox for user <peter.schmidt(a)schmidt.com> is full) But configurations like quota_exceeded_message = script /my/script.sh wont execute the script. Does anybody have an idea? Mit freundlichen Grüßen Yours sincerely Pascal Rudolf

2 6

error getting messages from mdbox_deleted
by Marc Roos 03 Feb '21

03 Feb '21

I was trying to list messages deleted with doveadm -f flow -o mail_location=mdbox_deleted:/home/mail/xxxxxxx /mdbox fetch -u xxxxxxx "mailbox date.saved guid" ALL And getting this error. What is this about? doveadm(xxxxxxx): Panic: file mdbox-map.c: line 1494 (mdbox_map_get_uid_validity): assertion failed: (map->view != NULL) doveadm(xxxxxxx): Error: Raw backtrace: /usr/lib64/dovecot/libdovecot.so.0(+0xa192e) [0x7f854625592e] -> /usr/lib64/dovecot/libdovecot.so.0(default_fatal_handler+0x2a) [0x7f854625599a] -> /usr/lib64/dovecot/libdovecot.so.0(i_fatal+0) [0x7f85461e5257] -> /usr/lib64/dovecot/libdovecot-storage.so.0(+0x61830) [0x7f854654c830] -> /usr/lib64/dovecot/libdovecot-storage.so.0(mdbox_update_header+0xa0) [0x7f8546551110] -> /usr/lib64/dovecot/libdovecot-storage.so.0(+0x5d698) [0x7f8546548698] -> /usr/lib64/dovecot/libdovecot-storage.so.0(+0x5d7e0) [0x7f85465487e0] -> /usr/lib64/dovecot/libdovecot-storage.so.0(mailbox_sync_init+0x44) [0x7f85465372d4] -> /usr/lib64/dovecot/libdovecot-storage.so.0(mailbox_sync+0x37) [0x7f8546537377] -> doveadm(doveadm_mail_iter_init+0x98) [0x55b4cd34c118] -> doveadm(+0x305b1) [0x55b4cd34a5b1] -> doveadm(+0x2bdcc) [0x55b4cd345dcc] -> doveadm(+0x2c9ca) [0x55b4cd3469ca] -> doveadm(doveadm_cmd_ver2_to_mail_cmd_wrapper+0x233) [0x55b4cd347823] -> doveadm(doveadm_cmd_run_ver2+0x50c) [0x55b4cd357fac] -> doveadm(doveadm_cmd_try_run_ver2+0x37) [0x55b4cd358047] -> doveadm(main+0x1e4) [0x55b4cd336214] -> /lib64/libc.so.6(__libc_start_main+0xf5) [0x7f8545e08555] -> doveadm(+0x1c605) [0x55b4cd336605] Aborted

3 3

how to dovecot import to folder/, not folder/INBOX
by didar 02 Feb '21

02 Feb '21

Hi, I am trying to import old Gmail mails from a maildir source into dovecot folder. chowm -R vmail:vmail /tmp/batch-1234 doveadm import -u gmail maildir:/tmp/batch-1234 2011 all This works, but it imports the emails into "2011/INBOX" rather just into "2011". Since, the "gmail" user account has maildir storage itself, I rename the "%h/.2011.INBOX" to "%h/.2011" manually and it seems to be working. I am wondering if there is another cleaner way to do it? Maybe import into default INBOX and use "doveadm move" instead? Here is my passdb file: (this is a testing setup inside a VM in my laptop) didar:{plain}e5d903c1615cdcd9c3d088ec2cb71b11927f7650:::: jamir:{plain}9ffeba7706846ed6be4e6e52bcc7afd792330874:::: chaitali:{plain}09ce7f54c7fee999a27967b741dc2e5f3950e7e8:::: rajesh:{plain}308059d2078ba123c435ebf7d0f20d8f137330cf:::: samim:{plain}23b82f0b10a802d25f308960c6071b151e3c37b6:::: monibul:{plain}8da4d1ae5e520ff8fadd415cfbfbafc8fcebb367:::: owasim:{plain}7ef9cf46165c4729e09fc142432cd892e3365c44:::: office:{PBKDF2}$1$9b5a900650285343$5000$1d041a5a6caea807e26b8ff4b41e5389bb4b4427::::/opt/mailstore/common/.Office::userdb_mail=maildir:~/ banking:{PBKDF2}$1$429b69dc44c46b33$5000$25a4b4c106c3fa69a6890253aa9163b66f013d48::::/opt/mailstore/common/.Banking::userdb_mail=maildir:~/ gmail:{PBKDF2}$1$4fadc2241bf79ee5$5000$6b6db95f72fbe2d9dcd311fdad6f614302e98da7::::/opt/mailstore/common/.Gmail::userdb_mail=maildir:~/ automail:{PBKDF2}$1$549cf6f14ab5ceb0$5000$a18fe676ca716148ab1ba75f225044a960420bbf::::/opt/mailstore/common/.Automail::userdb_mail=maildir:~/ Here is my dovecot.conf: # 2.3.4.1 (f79e8e7e4): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.4 () # OS: Linux 4.19.0-13-amd64 x86_64 Debian 10.7 ext4 # Hostname: dovecot.vbox.lan auth_mechanisms = plain login info_log_path = /var/log/dovecot-info.log listen = 10.0.2.90 log_path = /var/log/dovecot.log mail_attachment_dir = /opt/mailstore/attachments mail_location = mdbox:/opt/mailstore/mdboxes/%u mail_plugins = acl namespace { list = children location = maildir:/opt/mailstore/common:INDEXPVT=~/.common prefix = Common/ separator = / subscriptions = no type = public } namespace inbox { inbox = yes location = mailbox Drafts { auto = subscribe special_use = \Drafts } mailbox Junk { auto = subscribe special_use = \Junk } mailbox Sent { auto = subscribe special_use = \Sent } mailbox Trash { auto = subscribe special_use = \Trash } prefix = separator = / type = private } passdb { args = /etc/dovecot/dai/passwd-imapauth driver = passwd-file } plugin { acl = vfile:/etc/dovecot/dai/global-acl } protocols = imap lmtp service imap-login { inet_listener imap { address = 127.0.0.1 } } service imap { process_limit = 50 } service lmtp { inet_listener lmtp { address = 10.0.2.90 port = 24 } user = vmail } ssl_cert = </etc/dovecot/dai/dai-dovecot.cert ssl_key = # hidden, use -P to show it userdb { args = /etc/dovecot/dai/passwd-imapauth default_fields = uid=vmail gid=vmail home=/opt/mailstore/mdboxes/%u driver = passwd-file } protocol imap { mail_max_userip_connections = 2 mail_plugins = acl imap_acl } protocol lmtp { auth_username_format = %n } -- It's all in the mind, ya know.

2 1

Obtaining the IMAP GUID from a sieve script
by Ron Garret 02 Feb '21

02 Feb '21

Is there any way to obtain the IMAP GUiD of a message that is being processed by a sieve script? I’m writing a filter that needs to to keep track of message identities as they are moved around between folders. I could add my own id header, but I’d rather not have to reinvent that wheel. Thanks, rg

6 11

Dovecot and mutt
by ＠lbutlr 02 Feb '21

02 Feb '21

I have a user who is unable to use mutt to login. I tested and sent a muttrc that worked for me and all he needed to do was put in his username and password. Which failed. After some back and forth, I figured out that his password contains a '$' and a '[' in it, and it seems like one of, or both, of these characters may be the issue. Is that expected? The account and password work properly via iOS and macOS mail, so the issue does't appear to be dovecot, but I find it very odd that mutt would have a glaring issue like this, so I am wondering if there is something else that I need to do. Mutt 2.0.4 (2020-12-30) The configuration looks like this: # Imap settings set imap_user = "user(a)example.com" set imap_pass = "lasH-hds[er$asd" # Not a real password # Smtp settings set smtp_url = "smtps://mail.covisp.net:587" set smtp_pass = "lasHhds[er$asd" # Remote mail folders set folder = "imaps://mail.covisp.net:993" set spoolfile = "+INBOX" set postponed = "+/Drafts" set record = "+/Sent Mail" set trash = "+/Trash" --

10 14

Master user password mismatch
by Gregory Sloop 01 Feb '21

01 Feb '21

Trying to get master users working. I'm not sure what info would be best, but here's the detail I have now, in trying to get it working. Setup the master user file, and enabled master users in the conf files. Created the master user file and user/password hash. Turned on authentication debug. When I try something like: telnet localhost 143 and then supply the master user login - kind of like this: 1 login joeb*jb-master somepassword I get this in the logs. (Some obfuscation done.) --- dovecot: auth: Debug: auth client connected (pid=24985) dovecot: auth: Debug: client in: AUTH#0111#011PLAIN#011service=imap#011secured#011session=MM6QC9a5SIYAAAAAAAAAAAAAAAAAAAAB#011lip=::1#011rip=::1#011lport=143#011rport=34376#011resp=<hidden> dovecot: auth: Debug: passwd-file(jb-master,::1,master,<MM6QC9a5SIYAAAAAAAAAAAAAAAAAAAAB>): Master user lookup for login: joeb dovecot: auth: Debug: passwd-file(jb-master,::1,master,<MM6QC9a5SIYAAAAAAAAAAAAAAAAAAAAB>): lookup: user=jb-master file=/etc/dovecot/masterusers-test dovecot: auth: passwd-file(jb-master,::1,master,<MM6QC9a5SIYAAAAAAAAAAAAAAAAAAAAB>): Password mismatch dovecot: auth: Debug: client passdb out: FAIL#0111#011user=jb-master --- Yet I can use htpasswd -b -c -s /etc/dovecot/masterusers-test jb-master somepassword And this succeeds. (I created the masterusers-test file with httpasswd) So, I must have the password right, but dovecot is till failing the auth, claiming a bad password. How do I go about getting more detail so I can determine what's wrong? TIA -Greg

3 4

Unknown euid and egid, wrong mail directory
by Michael Agbaglo 01 Feb '21

01 Feb '21

Hi! Trying to set up dovecot for local accounts and virtual users, sending test mail fails: dovecot sees a permission problem in /home but the mail should go to /srv/mail/example.net/alice. "euid=1001(<unknown>) egid=1001(<unknown>)" 1001 doesn't not exist in /etc/passwd - Where does it come from? M. root@broccoli:~# doveconf -n # 2.3.7.2 (3c910f64b): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.7.2 () # OS: Linux 5.4.0-65-generic x86_64 Ubuntu 20.04.2 LTS # Hostname: broccoli.example.net mail_home = /srv/mail/%d/%n mail_location = maildir:~/Maildir mail_privileged_group = mail namespace { list = children location = maildir:%%h/Maildir:INDEXPVT=~/Maildir/shared/%%u prefix = shared/%%u/ separator = / subscriptions = no type = shared } namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = separator = / type = private } passdb { driver = pam } passdb { args = /etc/dovecot/dovecot-ldap.conf.ext driver = ldap } protocols = " imap lmtp" service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0600 user = postfix } } service dict { unix_listener dict { group = vmail mode = 0600 user = vmail } } service lmtp { unix_listener /var/spool/postfix/private/dovecot-lmtp { group = postfix mode = 0600 user = postfix } } ssl = required ssl_cert = </etc/ssl/certs/ssl-cert-snakeoil.pem ssl_client_ca_dir = /etc/ssl/certs ssl_dh = # hidden, use -P to show it ssl_key = # hidden, use -P to show it ssl_min_protocol = TLSv1.2 userdb { driver = passwd } userdb { args = /etc/dovecot/dovecot-ldap.conf.ext driver = ldap } userdb { args = uid=vmail gid=vmail home=/srv/mail/%d/%n driver = static } root@broccoli:~# id postfix uid=116(postfix) gid=124(postfix) groups=124(postfix) root@broccoli:~# id dovecot uid=114(dovecot) gid=122(dovecot) groups=122(dovecot) root@broccoli:~# sendmail alice(a)example.net < /etc/issue.net root@broccoli:~# tail /var/log/mail.log Jan 30 21:31:47 broccoli postfix/pickup[4067]: 22AE117AA82: uid=0 from=<root> Jan 30 21:31:47 broccoli postfix/cleanup[35091]: 22AE117AA82: message-id=<20210130203147.22AE117AA82(a)broccoli.example.net> Jan 30 21:31:47 broccoli postfix/qmgr[854]: 22AE117AA82: from=<root(a)broccoli.example.net>, size=335, nrcpt=1 (queue active) Jan 30 21:31:47 broccoli dovecot: lmtp(35094): Connect from local Jan 30 21:31:47 broccoli dovecot: lmtp(alice(a)example.net)<35094><xGMOCjPCFWAWiQAAfCPMuA>: Error: mkdir(/home/alice/Maildir) failed: Permission denied (euid=1001(<unknown>) egid=1001(<unknown>) missing +w perm: /home, dir owned by 0:0 mode=0755) Jan 30 21:31:47 broccoli dovecot: lmtp(alice(a)example.net)<35094><xGMOCjPCFWAWiQAAfCPMuA>: Error: mkdir(/home/alice/Maildir) failed: Permission denied (euid=1001(<unknown>) egid=1001(<unknown>) missing +w perm: /home, dir owned by 0:0 mode=0755) Jan 30 21:31:47 broccoli dovecot: lmtp(alice(a)example.net)<35094><xGMOCjPCFWAWiQAAfCPMuA>: Error: lmtp-server: conn unix:pid=35093,uid=116 [1]: rcpt alice(a)example.net: Mailbox INBOX: Failed to autocreate mailbox: Internal error occurred. Refer to server log for more information. [2021-01-30 21:31:47] Jan 30 21:31:47 broccoli dovecot: lmtp(alice(a)example.net)<35094><xGMOCjPCFWAWiQAAfCPMuA>: msgid=<20210130203147.22AE117AA82(a)broccoli.example.net>: save failed to open mailbox INBOX: Mailbox INBOX: Failed to autocreate mailbox: Internal error occurred. Refer to server log for more information. [2021-01-30 21:31:47] Jan 30 21:31:47 broccoli dovecot: lmtp(35094): Disconnect from local: Client has quit the connection (state=READY) Jan 30 21:31:47 broccoli postfix/lmtp[35093]: 22AE117AA82: to=<alice(a)example.net>, relay=broccoli.example.net[private/dovecot-lmtp], delay=0.07, delays=0.04/0.01/0/0.02, dsn=4.2.0, status=deferred (host broccoli.example.net[private/dovecot-lmtp] said: 451 4.2.0 <alice(a)example.net> Internal error occurred. Refer to server log for more information. [2021-01-30 21:31:47] (in reply to end of DATA command))

3 3

Dovecot Gmail OAuth2.0 Setting Question
by 福田泰葵 01 Feb '21

01 Feb '21

Dear Sir or Madam Unable to build OAuth2.0 authentication to Gmail using dovecot as proxy. I have a question about how to use dovecot as a proxy to perform OAuth 2.0 authentication to Gmail using a mail client. 1. Is the following all I need to do to authenticate to Gmail using dovecot as a proxy? - passdb passdb { driver = oauth2 mechanisms = oauthbearer xoauth2 args = /etc/dovecot/dovecot-oauth2.token.conf.ext } passdb { driver = oauth2 mechanisms = plain login args = /etc/dovecot/dovecot-oauth2.plain.conf.ext } - create dovecot-oauth2.token.conf.ext and dovecot-oauth2.plain.conf.ext - create gmail service account api 2. grant_url in dovecot-oauth2.token.conf.ext and dovecot-oauth2.plain.conf.ext is URL for obtaining a Google access token for a web server that I have built myself? 3. I use a Gmail service account, so I don’t need a client ID and secret ID, right? 4. Do I set introspection_url to the URL of my own web server with the access token used for authentication to Google as the response? 5. The documentation says “pass_attrs = host=127.0.0.1”, but if you are authenticating to Gmail, I should use “pass_attrs = proxy=y host=%{if;%s;eq;imap;imap.gmail.com;%{if;%s;eq;pop3;smtp .gmail.com;pop.gmail.com}} port=%{if;%s;eq;imap;993;%{if;%s;eq;pop3;587;465}} proxy_mech=xoauth2 pass=%{oauth2:access_token} user=%{oauth2:email oauth2:email}”? 6. What is the difference between dovecot-oauth2.token.conf.ext and dovecot-oauth2.plain.conf.ext ? Do I need to configure both? I used https://doc.dovecot.org/configuration_manual/authentication/oauth2/#proxy as a reference. I would appreciate your reply. Yours faithfully, ------------------------------ e-mail: taiki.fukuda(a)justsystems.com TEL: 03-5324-7900 mobile: 080-6198-7328 ------------------------------

3 21

Undefined SSL object
by Frank Elsner 31 Jan '21

31 Jan '21

Hi community, when doing imapsync to my dovecot server (Host2) I get the following Host2 capability before authentication: IMAP4rev1 SASL-IR LOGIN-REFERRALS ID ENABLE IDLE LITERAL+ STARTTLS AUTH=PLAIN AUTH=LOGIN AUTH DEBUG: .../IO/Socket/SSL.pm:1117: global error: Undefined SSL object Host2: Socket successfuly converted to SSL Beside this message all works fine. What is it? SSL setting? How to overcome the message? Greetings, Frank

2 1

Processing incoming mail efficiently
by Ron Garret 30 Jan '21

30 Jan '21

I’ve asked a related question on this list before but I now have a much better handle on what I’m doing and I realize that I still don’t know the answer, so I’m going to ask this again in a slightly different form. I’m writing a spam filter, so obviously I need to feed incoming mail to it somehow. The “obvious” way to do this is with a sieve script using the pipe extension. There are two problems with this: 1. This will always pipe the entire file no matter how big it is. The filter will often not need to process the body of the message, only the headers, or only the first part of a multipart MIME message. Is there any way to allow my filter to open the file in which the message is stored rather than piping it a copy of the message? 2. Once the filter has processed the message and decided if it’s spam it still needs to move the message to the appropriate folder (INBOX or Junk). To do this it needs to somehow correlate the *content* of the message that was piped to it with the UID of the message that needs to be moved. One way to do this is to pull out the message-id header and then use doveadm to find the file containing the message with that message-id, but there are two problems with this. First, not all messages have message-ids. I can work around this by adding my own message-id to messages that don’t already have them, but this just feel wrong. And second, unless dovecot keeps an index of message-ids (does it?) then this will be horribly inefficient because it will have to essentially grep for the message id every time I want to move a message. So it seems like there has to be a better way, but I can’t think of what that would be. I figure this has to be a solved problem because I am obviously not the first person to write a spam filter for dovecot. What is the Right Way to do this? Thanks, rg

3 6

What is the right way to move messages between mailboxes?
by Ron Garret 30 Jan '21

30 Jan '21

I’m working on a spam filter. Incoming messages are sent to an “incoming” folder (via a sieve script) where they are processed by the filter and moved either to INBOX or Junk. My question is: what is the right way to effect this move? Can I just mv the file? With Dovecot automatically notice this and update any connected IMAP clients? Or is there some other procedure and/or utility (doveadm?) that I should be using for this? Thanks, rg

1 0

dovecot and broken uidlist
by Maciej Milaszewski 29 Jan '21

29 Jan '21

Hi I have been trying resolve my problem with dovecot for a few days and I dont have idea.... My environment is: dovecot director+5 dovecot guest dovecot-2.2.36.4 from source Linux 3.16.0-11-amd64 storage via nfs (NetApp) all works fine but when I update OS from debian 8 (kernel 3.16.x) to debian 9 (kernel 4.9.x ) sometimes I get random in logs: Broken dovecot-uidlist examle: Error: Broken file /vmail2/po/pollygraf.xxx_pg_pollygraf/Maildir/dovecot-uidlist line 88: Invalid data: (for random users - sometimes 10 error in day per node, some times more) File looks ok But if I change kernel to 3.16.x problem with "Broken file dovecot-uidlist" - not exists if turn to 4.9 or 5.x - problem exists I have storage via nfs with opions: rw,sec=sys,noexec,noatime,tcp,hard,rsize=65536,wsize=65536,intr,nordirplus,nfsvers=3,tcp,actimeo=120 I tested with "nocto" or without "nocto" - nothing changes ...... nfs options in node: mmap_disable = yes mail_fsync = always I bet the configuration is correct and I wonder why the problem occurs with other kernels 3.x.x - ok 4.x - not ok I check and user who have problem did not connect to another node in this time I dont have idea why problem exists on the kernel 4.x but not in 3.x

6 14

Long Term Archival
by Rupert Gallagher 29 Jan '21

29 Jan '21

Hello, I would like to know what is your strategy for legally compliant long term archival of e-mails (up to 10 years). Thank you

3 2

10G mails use 90G on disk
by Markus Schönhaber 29 Jan '21

29 Jan '21

Hello, on a system I administer the disk where Dovecot's mailstore (mdbox) resides got filled up to the brim although the combined quotas for the users are much smaller than the disk's capacity. For one user I see the following: doveadm quota get -u <USER>@<DOMAIN> Username Quota name Type Value Limit % <USER>@<DOMAIN> User quota STORAGE 10231248 20971520 48 <USER>@<DOMAIN> User quota MESSAGE 11176 - 0 So this user has used ~10G of his 20G quota. But looking at the space used on disk: # du -hs /var/spool/vmail/mail/<DOMAIN>/<USER>/storage/ 90G /var/spool/vmail/mail/<DOMAIN>/<USER>/storage/ What might be the reason that mail size and disk space used differ so much? And most of all: how can I prevent that from happening? Regards mks # doveconf -n # 2.3.13 (89f716dc2): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.13 (cdd19fe3) # OS: Linux 4.19.0-13-amd64 x86_64 Debian 10.7 ext4 # Hostname: … auth_mechanisms = plain login dict { quota = pgsql:/etc/dovecot/dovecot-dict-sql.conf.ext } imap_id_log = * login_log_format_elements = user=<%u> method=%m rip=%r lip=%l lport=%a mpid=%e %c mail_home = /var/spool/vmail/home/%d/%n mail_location = mdbox:/var/spool/vmail/mail/%d/%n mail_plugins = " quota acl" managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Entwürfe { special_use = \Drafts } mailbox Entw&APw-rfe { special_use = \Drafts } mailbox "Gelöschte Objekte" { special_use = \Trash } mailbox "Gel&APY-schte Objekte" { special_use = \Trash } mailbox "Gesendete Objekte" { special_use = \Sent } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = separator = / } passdb { args = /etc/dovecot/dovecot-sql.conf.ext driver = sql } plugin { acl = vfile mail_log_events = delete undelete expunge copy mailbox_delete mailbox_rename mail_log_fields = uid box msgid size quota = dict:User quota::proxy::quota recipient_delimiter = + sieve = file:~/sieve;active=~/.dovecot.sieve sieve_redirect_envelope_from = orig_recipient } protocols = " imap lmtp sieve" service auth-worker { user = $default_internal_user } service auth { inet_listener { port = 12345 } unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0666 user = postfix } } service dict { unix_listener dict { group = vmail mode = 0600 user = vmail } } service lmtp { unix_listener /var/spool/postfix/private/dovecot-lmtp { group = postfix mode = 0600 user = postfix } } service stats { client_limit = 10000 unix_listener stats-writer { group = vmail user = vmail } } ssl_cert = </etc/letsencrypt/live/<DOMAIN>/fullchain.pem ssl_dh = # hidden, use -P to show it ssl_key = # hidden, use -P to show it userdb { args = /etc/dovecot/dovecot-sql.conf.ext driver = sql } verbose_proctitle = yes protocol lmtp { mail_plugins = " quota acl quota sieve" } protocol lda { mail_plugins = " quota acl sieve" } protocol imap { mail_plugins = " quota acl imap_quota acl" } remote 192.168.1.0/24 { protocol imap { disable_plaintext_auth = no } }

2 4

mail event
by Marc Roos 29 Jan '21

29 Jan '21

> > Using mail_log plugin is always very recommended, > > https://doc.dovecot.org/configuration_manual/plugins/mail_event_logging/ > I am not sure if I am correct, but I think this logs every deleted message not? I was testing with this a while ago. Is there also an option that only logs something like '300 messages deleted'?

1 0

SMTP tool for Email validation
by Amol Kale 29 Jan '21

29 Jan '21

Hi, We are looking for a tool for bulk SMTP testing / Email validation using telnet or similar protocol ( which doesn't send the mails ) It generally involves steps like NSlookup to check MX of destination server, opening port25, telnet to communicate with client server, then finally checking the correctness of user email account. Please connect if you have such ready tool with you or you can develop Process example- <https://blog.mailtrap.io/verify-email-address-without-sending/> https://blog.mailtrap.io/verify-email-address-without-sending/ Thanks & regards Amol Kale Founder Director Talent Trackers HR 7350002596

4 3

Enabling auth_cache_verify_password_with_worker disables proxy mode
by Malte Schmidt 29 Jan '21

29 Jan '21

Setting "auth_cache_verify_password_with_worker = yes" in order to leverage multiple cores for the Dovecot authentication-process causes Dovecot not to proxy anymore. With debug-logging I figured: auth_cache_verify_password_with_worker = no passdb out: OK 1 user=username host=bla port=10993 ssl=any-cert mail_crypt_global_public_key=key mail_crypt_global_private_key=otherkey hostip=123.123.123.123 proxy pass=pw auth_cache_verify_password_with_worker = yes passdb out: OK 1 user=username The rest seems missing. Dovecot version: v2.3.11.3 Searching for this issue, I found at least two posts mentioning the same symptoms: https://dovecot.org/pipermail/dovecot/2018-April/111583.html https://dovecot.org/pipermail/dovecot/2020-April/118564.html https://listen.jpberlin.de/pipermail/dovecot/2020-April/001915.html (same as the english one from april 2020)

2 1

Infinity loop when run "doveadm quota get -A" from Dovecot Director with 500 users
by Duc Anh Do 29 Jan '21

29 Jan '21

Hi all, I have one Dovecot Director, two Dovecot Backends and one LDAP server with about 500 users. I would like to run *doveadm quota get -A* from the Director. In each Backend, there is no problem when run the command: # doveadm quota get -A user1 User quota STORAGE 0 1048576000000000 0 user1 User quota MESSAGE 0 - 0 … user500 User quota STORAGE 0 1048576000000000 0 user500 User quota MESSAGE 0 - 0 However, when I run from the Director, the command might stuck in an infinity loop (I have to terminate to quit): # doveadm quota get -A user1 User quota STORAGE 0 1048576000000000 0 user1 User quota MESSAGE 0 - 0 … user49 User quota STORAGE 0 1048576000000000 0 user49 User quota MESSAGE 0 - 0 user66 User quota STORAGE 0 1048576000000000 0 user66 User quota MESSAGE 0 - 0 ^Cdoveadm(user86): Error: doveadm server failure doveadm: Error: Failed to iterate through some users doveadm: Error: backend2.local:24245: Command quota get failed for user53: EOF doveadm: Error: backend1.local:24245: Command quota get failed for user66: EOF doveadm: Error: Aborted This problem occurs in both Dovecot 2.2.36 and Dovecot 2.3.11, 2.3.13 (I build Dovecot from source). It's ok for me to get quota of one user from the Director: # doveadm quota get -u user1 Quota name Type Value Limit % User quota STORAGE 0 1048576000000000 0 User quota MESSAGE 0 - 0 And if there's only one Backend, *doveadm quota get -A* from the Director works well too. After investigating, I found the infinity loop: File src/doveadm/doveadm-mail-server.c: static void doveadm_server_flush_one(struct doveadm_server *server) { unsigned int count = array_count(&server->queue); do { io_loop_run(current_ioloop); } while (array_count(&server->queue) == count && doveadm_server_have_used_connections(server) && !DOVEADM_MAIL_SERVER_FAILED()); } In case there're many Backends, I see only global variable *current_ioloop* is used to notify in the callback function. Might this be a race condition? I understand there's a workaround to do my work: - Run *doveadm user '*'* to get all users - Loop through all users and run *doveadm quota get -u xxx* Thanks, Anh Do

2 2

Dovecot Mail Server - Cloud Compatibility
by Kristie Buller 28 Jan '21

28 Jan '21

4 3

2.13 read, i_stream_read_memarea: assertion failed: (!stream->blocking)
by Stuart Henderson 28 Jan '21

28 Jan '21

I'm seeing this on some mailboxes with 2.13 on OpenBSD amd64 (recent snapshot): dovecot: imap(sthen)<47220><ARy1oKS5lWDDX7sa>: Panic: file istream.c: line 332 (i_stream_read_memarea): assertion failed: (!stream->blocking) Using sieve, imapsieve, replicator, zlib (zlib_save = lz4 and has been for some time, so the relevant messages probably use this). Using mmap_disable because OpenBSD. Any suggestions how to handle it, preferably automatically? (even if a message is corrupt/lost it would be really nice if a standard client could still access the mailbox rather than kill the imap process while reading headers). bt first for ease of reading, followed by bt full in case it has any additional clues. (gdb) bt #0 thrkill () at /tmp/-:3 #1 0x00000e9158c7c3ae in _libc_abort () at /usr/src/lib/libc/stdlib/abort.c:51 #2 0x00000e91adc00c26 in default_fatal_finish (type=LOG_TYPE_PANIC, status=0) at failures.c:459 #3 0x00000e91adbff034 in fatal_handler_real (ctx=0x7f7ffffcdd90, format=<optimized out>, args=<optimized out>) at failures.c:471 #4 0x00000e91adbfffb1 in i_internal_fatal_handler (ctx=0x0, format=0x6 <error: Cannot access memory at address 0x6>, args=0x0) at failures.c:866 #5 0x00000e91adbff266 in i_panic (format=0x6 <error: Cannot access memory at address 0x6>) at failures.c:523 #6 0x00000e91adc0f15c in i_stream_read_memarea (stream=0xe917ead3480) at istream.c:332 #7 0x00000e91adc1925f in read_more (sstream=0xe91431c4800) at istream-seekable.c:149 #8 0x00000e91adc19090 in read_from_buffer (sstream=0xe91431c4800, ret_r=0x7f7ffffcded8) at istream-seekable.c:204 #9 0x00000e91adc1856d in i_stream_seekable_read (stream=0xe91431c4800) at istream-seekable.c:265 #10 0x00000e91adc0f0a4 in i_stream_read_memarea (stream=0xe91431c4880) at istream.c:313 #11 0x00000e91adc16bbc in i_stream_limit_read (stream=0xe91e9ccca00) at istream-limit.c:49 #12 0x00000e91adc0f0a4 in i_stream_read_memarea (stream=0xe91e9ccca80) at istream.c:313 #13 0x00000e91adc0f79c in i_stream_read_copy_from_parent (istream=<optimized out>) at istream.c:387 #14 0x00000e918e9729fa in i_stream_mail_read (stream=0xe91e9ccc000) at istream-mail.c:115 #15 0x00000e91adc0f0a4 in i_stream_read_memarea (stream=0xe91e9ccc080) at istream.c:313 #16 0x00000e91adc104f5 in i_stream_read (stream=0xe91e9ccc080) at istream.c:271 #17 i_stream_read_data (stream=0xe91e9ccc080, data_r=0x7f7ffffce110, size_r=0x7f7ffffce100, threshold=1) at istream.c:747 #18 0x00000e91adbd6a18 in i_stream_read_bytes (stream=0x0, data_r=<optimized out>, size_r=<optimized out>, wanted=<optimized out>) at ../../src/lib/istream.h:214 #19 message_parse_header_next (ctx=0xe9183e1b180, hdr_r=0x7f7ffffce1d0) at message-header-parser.c:85 #20 0x00000e91adbceef2 in read_header (mstream=0xe91e9cc6000) at istream-header-filter.c:195 #21 i_stream_header_filter_read (stream=0xe91e9cc6000) at istream-header-filter.c:450 #22 0x00000e91adc0f0a4 in i_stream_read_memarea (stream=0xe91e9cc6080) at istream.c:313 #23 0x00000e91adc104f5 in i_stream_read (stream=0xe91e9cc6080) at istream.c:271 #24 i_stream_read_data (stream=0xe91e9cc6080, data_r=0x7f7ffffce2c0, size_r=0x7f7ffffce2c8, threshold=0) at istream.c:747 #25 0x00000e91adbdc07b in i_stream_read_bytes (stream=0xe91e9cc6080, data_r=<optimized out>, size_r=<optimized out>, wanted=<error reading variable: Cannot access memory at address 0x1>) at ../../src/lib/istream.h:214 #26 message_get_header_size (input=0xe91e9cc6080, hdr=0x7f7ffffce328, has_nuls_r=0x7f7ffffce3b7) at message-size.c:19 #27 0x00000e8f25e767d9 in imap_msgpart_get_partial_header (mail=0xe91e9cc4848, mail_input=<optimized out>, msgpart=0xe91c92a2048, virtual_size_r=<optimized out>, result_r=0x7f7ffffce408, have_crlfs_r=<optimized out>) at imap-msgpart.c:401 #28 imap_msgpart_open_normal (mail=<optimized out>, msgpart=0xe91c92a2048, part=<optimized out>, virtual_size_r=<optimized out>, result_r=0x7f7ffffce408, have_crlfs_r=<optimized out>) at imap-msgpart.c:637 #29 imap_msgpart_open (mail=<optimized out>, msgpart=0xe91c92a2048, result_r=0x7f7ffffce408) at imap-msgpart.c:706 #30 0x00000e8f25e672ff in fetch_body_msgpart (ctx=0xe9159845368, mail=<optimized out>, body=0xe91e9cb4398) at imap-fetch-body.c:184 #31 0x00000e8f25e65837 in imap_fetch_more_int (ctx=0xe9159845368, cancel=false) at imap-fetch.c:562 #32 0x00000e8f25e6552c in imap_fetch_more (ctx=0xe9159845368, cmd=0xe9159845048) at imap-fetch.c:617 #33 0x00000e8f25e55521 in cmd_fetch (cmd=0xe9159845048) at cmd-fetch.c:337 #34 0x00000e8f25e62d12 in command_exec (cmd=0xe9159845048) at imap-commands.c:201 #35 0x00000e8f25e61576 in client_command_input (cmd=0xe9159845048) at imap-client.c:1204 #36 0x00000e8f25e61682 in client_command_input (cmd=0xe9159845048) at imap-client.c:1269 #37 0x00000e8f25e5ffb4 in client_handle_next_command (client=0xe9159845848, remove_io_r=<optimized out>) at imap-client.c:1313 #38 client_handle_input (client=0xe9159845848) at imap-client.c:1327 #39 0x00000e8f25e5e755 in client_input (client=0xe9159845848) at imap-client.c:1371 #40 0x00000e91adc1c851 in io_loop_call_io (io=0xe91eb5d0b00) at ioloop.c:714 #41 0x00000e91adc1f84c in io_loop_handler_run_internal (ioloop=0xe9162373d00) at ioloop-kqueue.c:164 #42 0x00000e91adc1cfd9 in io_loop_handler_run (ioloop=0xe9162373d00) at ioloop.c:766 #43 0x00000e91adc1cce8 in io_loop_run (ioloop=0xe9162373d00) at ioloop.c:739 #44 0x00000e91adb77655 in master_service_run (service=0xe9193c39600, callback=0x6) at master-service.c:853 #45 0x00000e8f25e70dd1 in main (argc=1, argv=<optimized out>) at main.c:532 (gdb) bt full #0 thrkill () at /tmp/-:3 No locals. #1 0x00000e9158c7c3ae in _libc_abort () at /usr/src/lib/libc/stdlib/abort.c:51 sa = { __sigaction_u = { __sa_handler = 0x0, __sa_sigaction = 0x0 }, sa_mask = 4294967295, sa_flags = 0 } mask = 4294967263 #2 0x00000e91adc00c26 in default_fatal_finish (type=LOG_TYPE_PANIC, status=0) at failures.c:459 recursed = 0 backtrace = <optimized out> #3 0x00000e91adbff034 in fatal_handler_real (ctx=0x7f7ffffcdd90, format=<optimized out>, args=<optimized out>) at failures.c:471 status = 6 #4 0x00000e91adbfffb1 in i_internal_fatal_handler (ctx=0x0, format=0x6 <error: Cannot access memory at address 0x6>, args=0x0) at failures.c:866 No locals. #5 0x00000e91adbff266 in i_panic (format=0x6 <error: Cannot access memory at address 0x6>) at failures.c:523 ctx = { type = LOG_TYPE_PANIC, exit_status = 0, timestamp = 0x0, timestamp_usecs = 0, log_prefix = 0x0, log_prefix_type_pos = 0 } args = {{ gp_offset = 40, fp_offset = 48, overflow_arg_area = 0x7f7ffffcddf0, reg_save_area = 0x7f7ffffcdce0 }} #6 0x00000e91adc0f15c in i_stream_read_memarea (stream=0xe917ead3480) at istream.c:332 _stream = 0xe917ead3400 old_size = 0 ret = 0 #7 0x00000e91adc1925f in read_more (sstream=0xe91431c4800) at istream-seekable.c:149 ret = <optimized out> size = <optimized out> #8 0x00000e91adc19090 in read_from_buffer (sstream=0xe91431c4800, ret_r=0x7f7ffffcded8) at istream-seekable.c:204 old_skip = <optimized out> stream = 0xe91431c4800 size = <optimized out> data = <optimized out> avail_size = <optimized out> #9 0x00000e91adc1856d in i_stream_seekable_read (stream=0xe91431c4800) at istream-seekable.c:265 sstream = 0xe91431c4800 ret = 16019855444480 size = <optimized out> data = <optimized out> pos = <optimized out> #10 0x00000e91adc0f0a4 in i_stream_read_memarea (stream=0xe91431c4880) at istream.c:313 _stream = 0xe91431c4800 old_size = 0 ret = <optimized out> #11 0x00000e91adc16bbc in i_stream_limit_read (stream=0xe91e9ccca00) at istream-limit.c:49 lstream = 0xe91e9ccca00 pos = 16017421909770 ret = <optimized out> left = <optimized out> #12 0x00000e91adc0f0a4 in i_stream_read_memarea (stream=0xe91e9ccca80) at istream.c:313 _stream = 0xe91e9ccca00 old_size = 0 ret = <optimized out> #13 0x00000e91adc0f79c in i_stream_read_copy_from_parent (istream=<optimized out>) at istream.c:387 stream = 0xe91e9ccc000 pos = <optimized out> ret = <optimized out> #14 0x00000e918e9729fa in i_stream_mail_read (stream=0xe91e9ccc000) at istream-mail.c:115 mstream = 0xe91e9ccc000 ret = <optimized out> size = <optimized out> #15 0x00000e91adc0f0a4 in i_stream_read_memarea (stream=0xe91e9ccc080) at istream.c:313 _stream = 0xe91e9ccc000 old_size = 0 ret = <optimized out> #16 0x00000e91adc104f5 in i_stream_read (stream=0xe91e9ccc080) at istream.c:271 _stream = 0xe91e9ccc000 ret = <optimized out> #17 i_stream_read_data (stream=0xe91e9ccc080, data_r=0x7f7ffffce110, size_r=0x7f7ffffce100, threshold=1) at istream.c:747 read_more = false ret = <error reading variable ret (Cannot access memory at address 0x0)> #18 0x00000e91adbd6a18 in i_stream_read_bytes (stream=0x0, data_r=<optimized out>, size_r=<optimized out>, wanted=<optimized out>) at ../../src/lib/istream.h:214 No locals. #19 message_parse_header_next (ctx=0xe9183e1b180, hdr_r=0x7f7ffffce1d0) at message-header-parser.c:85 skip = <error reading variable skip (Cannot access memory at address 0x0)> line = 0xe9183e1b180 colon_pos = 4294967295 no_newline = <error reading variable no_newline (Cannot access memory at address 0x0)> crlf_newline = <error reading variable crlf_newline (Cannot access memory at address 0x0)> continued = false size = 0 msg = 0xe91adafee50 <uchar_nul> "" startpos = 0 continues = <error reading variable continues (Cannot access memory at address 0x0)> i = <optimized out> parse_size = <optimized out> ret = <optimized out> last_crlf = <optimized out> last_no_newline = <optimized out> #20 0x00000e91adbceef2 in read_header (mstream=0xe91e9cc6000) at istream-header-filter.c:195 highwater_offset = <optimized out> max_buffer_size = 8192 hdr = 0x0 hdr_ret = <optimized out> ret = <optimized out> ret2 = <optimized out> #21 i_stream_header_filter_read (stream=0xe91e9cc6000) at istream-header-filter.c:450 mstream = 0xe91e9cc6000 v_offset = <optimized out> ret = <optimized out> #22 0x00000e91adc0f0a4 in i_stream_read_memarea (stream=0xe91e9cc6080) at istream.c:313 _stream = 0xe91e9cc6000 old_size = 0 ret = <optimized out> #23 0x00000e91adc104f5 in i_stream_read (stream=0xe91e9cc6080) at istream.c:271 _stream = 0xe91e9cc6000 ret = <optimized out> #24 i_stream_read_data (stream=0xe91e9cc6080, data_r=0x7f7ffffce2c0, size_r=0x7f7ffffce2c8, threshold=0) at istream.c:747 read_more = false ret = <error reading variable ret (Cannot access memory at address 0x0)> #25 0x00000e91adbdc07b in i_stream_read_bytes (stream=0xe91e9cc6080, data_r=<optimized out>, size_r=<optimized out>, wanted=<error reading variable: Cannot access memory at address 0x1>) at ../../src/lib/istream.h:214 No locals. #26 message_get_header_size (input=0xe91e9cc6080, hdr=0x7f7ffffce328, has_nuls_r=0x7f7ffffce3b7) at message-size.c:19 size = 0 msg = 0xe91adafee50 <uchar_nul> "" startpos = <error reading variable startpos (Cannot access memory at address 0x0)> missing_cr_count = <error reading variable missing_cr_count (Cannot access memory at address 0x0)> ret = <optimized out> i = <optimized out> #27 0x00000e8f25e767d9 in imap_msgpart_get_partial_header (mail=0xe91e9cc4848, mail_input=<optimized out>, msgpart=0xe91c92a2048, virtual_size_r=<optimized out>, result_r=0x7f7ffffce408, have_crlfs_r=<optimized out>) at imap-msgpart.c:401 hdr_size = { physical_size = 0, virtual_size = 0, lines = 0 } hdr_fields = 0xe91c92a21f8 hdr_count = <optimized out> input = 0xe91e9cc6080 has_nuls = false #28 imap_msgpart_open_normal (mail=<optimized out>, msgpart=0xe91c92a2048, part=<optimized out>, virtual_size_r=<optimized out>, result_r=0x7f7ffffce408, have_crlfs_r=<optimized out>) at imap-msgpart.c:637 hdr_size = { physical_size = 0, virtual_size = 0, lines = 0 } body_size = { physical_size = 0, virtual_size = 0, lines = 0 } input = <optimized out> unknown_crlfs = <error reading variable unknown_crlfs (Cannot access memory at address 0x0)> part_size = <error reading variable part_size (Cannot access memory at address 0x0)> #29 imap_msgpart_open (mail=<optimized out>, msgpart=0xe91c92a2048, result_r=0x7f7ffffce408) at imap-msgpart.c:706 part = <optimized out> ret = <optimized out> virtual_size = 1 binary = <optimized out> have_crlfs = <optimized out> #30 0x00000e8f25e672ff in fetch_body_msgpart (ctx=0xe9159845368, mail=<optimized out>, body=0xe91e9cb4398) at imap-fetch-body.c:184 result = { input = 0x0, size = 0, size_field = (unknown: 0), binary_decoded_input_has_nuls = false } str = <optimized out> #31 0x00000e8f25e65837 in imap_fetch_more_int (ctx=0xe9159845368, cancel=false) at imap-fetch.c:562 _data_stack_cur_id = <optimized out> client = <optimized out> ret = <optimized out> handlers = 0xe91e9cb4020 count = 5 #32 0x00000e8f25e6552c in imap_fetch_more (ctx=0xe9159845368, cmd=0xe9159845048) at imap-fetch.c:617 ret = <optimized out> #33 0x00000e8f25e55521 in cmd_fetch (cmd=0xe9159845048) at cmd-fetch.c:337 qresync_args = { qresync_sample_seqset = 0xe9159845368, qresync_sample_uidset = 0xe9159845020 } args = <optimized out> send_vanished = <optimized out> client = 0xe9159845848 messageset = <optimized out> search_args = 0x0 ret = <optimized out> ctx = 0x0 next_arg = <optimized out> list_arg = <optimized out> #34 0x00000e8f25e62d12 in command_exec (cmd=0xe9159845048) at imap-commands.c:201 hook = <optimized out> #35 0x00000e8f25e61576 in client_command_input (cmd=0xe9159845048) at imap-client.c:1204 client = 0xe9159845848 command = <optimized out> tag = <optimized out> ret = <optimized out> name = <optimized out> #36 0x00000e8f25e61682 in client_command_input (cmd=0xe9159845048) at imap-client.c:1269 client = 0xe9159845848 command = <optimized out> tag = <optimized out> ret = <optimized out> name = <optimized out> #37 0x00000e8f25e5ffb4 in client_handle_next_command (client=0xe9159845848, remove_io_r=<optimized out>) at imap-client.c:1313 No locals. #38 client_handle_input (client=0xe9159845848) at imap-client.c:1327 _data_stack_cur_id = <optimized out> handled_commands = false ret = <optimized out> remove_io = <optimized out> #39 0x00000e8f25e5e755 in client_input (client=0xe9159845848) at imap-client.c:1371 output = 0xe92088000a0 bytes = 218 cmd = <optimized out> #40 0x00000e91adc1c851 in io_loop_call_io (io=0xe91eb5d0b00) at ioloop.c:714 ioloop = 0xe9162373d00 t_id = 0 #41 0x00000e91adc1f84c in io_loop_handler_run_internal (ioloop=0xe9162373d00) at ioloop-kqueue.c:164 tv = { tv_sec = 3, tv_usec = 410626 } ts = { tv_sec = 3, tv_nsec = 410626000 } ctx = 0xe9171193980 msecs = <optimized out> events_count = <optimized out> events = <optimized out> ret = <optimized out> i = <optimized out> io = 0xe91eb5d0b00 #42 0x00000e91adc1cfd9 in io_loop_handler_run (ioloop=0xe9162373d00) at ioloop.c:766 No locals. #43 0x00000e91adc1cce8 in io_loop_run (ioloop=0xe9162373d00) at ioloop.c:739 No locals. #44 0x00000e91adb77655 in master_service_run (service=0xe9193c39600, callback=0x6) at master-service.c:853 No locals. #45 0x00000e8f25e70dd1 in main (argc=1, argv=<optimized out>) at main.c:532 set_roots = {0xe91adc66270 <smtp_submit_setting_parser_info>, 0xe8f25e7e310 <imap_setting_parser_info>, 0x0} login_set = { auth_socket_path = 0xe9136774490 "HEADER.FIELDS (DATE FROM SENDER SUBJECT TO CC MESSAGE-ID REFERENCES CONTENT-TYPE CONTENT-DESCRIPTION IN-REPLY-TO REPLY-TO LINES LIST-POST X-LABEL)", postlogin_socket_path = 0x0, postlogin_timeout_secs = 60, callback = 0xe8f25e70fc0 <login_client_connected>, failure_callback = 0xe8f25e712b0 <login_client_failed>, request_auth_token = true } username = <optimized out> storage_service_flags = <optimized out> service_flags = <optimized out> auth_socket_path = <optimized out> c = <optimized out> error = 0x7f7ffffcea18 "]\353\374\377\177\177" (gdb)

2 3

Where is dovemon
by lists＠mlserv.org 27 Jan '21

27 Jan '21

7 7

doveadm http api expunge call
by tim＠linux-daus.de 26 Jan '21

26 Jan '21

Hi all, i'm start porting some of my maintenance scripts from doveadm cli to doveadm http api. I stumble over the doveadm expunge call. The response doesn't contain any additional output but the generic doveadmresponse object without any additional information. The list is always empty wether the expunge has expunged some emails or not: [['doveadmResponse', [], 'tag1']] Other then the cli command wich outputs a list of the mails that were expunged. Is this a bug? Best regards, Tim

1 0

Forwarding parameters for imapc
by bra＠fsn.hu 26 Jan '21

26 Jan '21

Hi, I have the following IMAP setup: dovecot proxy -> dovecot server -> IMAP backend (imapc) What I want to achieve is to have the original client parameters from the proxy in the IMAP backend. Dovecot in proxy mode sends them via an ID command, like this: ID ("x-session-id" "SESS" "x-originating-ip" "IP" "x-originating-port" "PORT" "x-connected-ip" "IP" "x-connected-port" "PORT" "x-proxy-ttl" "4") Is it possible with current dovecot versions to send this to the imapc backend as well? Of course I would expect that if the dovecot proxy is in login_trusted_networks, information from it should be used (IMAP: ID, POP/LMTP: XCLIENT). If this is not the case, could you please implement it? Thanks,

1 0

Error "collect2: error: ld returned 213 exit status" when build Dovecot 2.3.13 on CentOS 7&8 with Valgrind
by Duc Anh Do 26 Jan '21

26 Jan '21

Hi all, I'm building Dovecot from source of Dovecot 2.3.13. When doing make check, I saw an error: make[1]: Entering directory '/home/xxx/rpmbuild/BUILD/xxx/dovecot-2.3.13/src/lib-ssl-iostream' for bin in test-iostream-ssl; do \ if ! /bin/sh ../../run-test.sh ../.. ./$bin; then exit 1; fi; \ done collect2: error: ld returned 213 exit status Failed to run: ./test-iostream-ssl This is my configuration in spec file: %configure \ INSTALL_DATA="install -c -p -m644" \ --docdir=%{_docdir}/%{name} \ --disable-static \ --disable-rpath \ --with-nss \ --with-shadow \ --with-pam \ --with-gssapi=plugin \ --with-ldap=plugin \ --with-sql=plugin \ --with-pgsql \ --with-mysql \ --with-sqlite \ --with-zlib \ --with-libcap \ --with-ssl=openssl \ --with-ssldir=%{ssldir} \ --with-docs I installed OpenSSL and Valgrind: # yum list installed | egrep "valgrind|openssl" openssl-devel.x86_64 1:1.1.1g-12.el8_3 @BaseOS openssl-libs.x86_64 1:1.1.1g-12.el8_3 @BaseOS valgrind.x86_64 1:3.16.0-2.el8 @AppStream valgrind-devel.x86_64 1:3.16.0-2.el8 @AppStream I investigated the problem and found something: - Unlike other lib-xxx, libtool doesn't generate executable binary test-iostream-ssl inside lib-ssl-iostream directory. That's a shell script and actual executable binary is inside ./libs directory ( https://www.gnu.org/software/libtool/manual/libtool.html#Linking-executables ): $ pwd /home/xxx/rpmbuild/BUILD/xxx/dovecot-2.3.13/src/lib-ssl-iostream $ file test-iostream-ssl test-iostream-ssl: POSIX shell script, ASCII text executable, with very long lines $ file .libs/test-iostream-ssl .libs/test-iostream-ssl: ELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, for GNU/Linux 3.2.0, BuildID[sha1]=c6a800c253c38a7eb78886286ef779d871550a6c, with debug_info, not stripped, too many notes (256) That means when running make check, Valgrind will monitor the shell script generated by libtool instead of the actual test code. And error occurs. - To confirm, I changed Makefile a bit: $ pwd /home/xxx/rpmbuild/BUILD/xxx/dovecot-2.3.13/src/lib-ssl-iostream $ vim Makefile check-local: for bin in $(test_programs); do \ export LD_LIBRARY_PATH=./.libs; \ if ! $(RUN_TEST) ./.libs/$$bin; then exit 1; fi; \ done Then do make check: $ cd ~/rpmbuild/BUILD/xxx/dovecot-2.3.13 $ make -C src/lib-ssl-iostream/ clean $ make -C src/lib-ssl-iostream/ check make[1]: Entering directory '/home/xxx/rpmbuild/BUILD/xxx/dovecot-2.3.13/src/lib-ssl-iostream' for bin in test-iostream-ssl; do \ export LD_LIBRARY_PATH=./.libs; \ if ! /bin/sh -x ../../run-test.sh ../.. ./.libs/$bin; then exit 1; fi; \ #if ! /bin/sh -x ../../run-test.sh ../.. ./$bin; then exit 1; fi; \ done ssl: handshake ....................................................... : ok ssl: o_stream_get_buffer_avail_size .................................. : ok ssl: small packets ................................................... : ok 0 / 3 tests failed + ret=0 + test -s test.out~19257 + test 0 '!=' 0 + exit 0 + rm -f test.out~19257 make[1]: Leaving directory '/home/xxx/rpmbuild/BUILD/xxx/dovecot-2.3.13/src/lib-ssl-iostream' make: Leaving directory '/home/xxx/rpmbuild/BUILD/xxx/dovecot-2.3.13/src/lib-ssl-iostream' - According to the manual of libtool, if I use libtool to generate library and executable binary, I should use libtool to execute (or debug or anything else). That will avoid misconfiguration and unexpected errors: - https://www.gnu.org/software/libtool/manual/html_node/Debugging-executables… - https://stackoverflow.com/a/14186488 My patch looks like this: diff --git a/src/lib-ssl-iostream/Makefile.am b/src/lib-ssl-iostream/Makefile.am index 5aaea5d..17ebf1d 100644 --- a/src/lib-ssl-iostream/Makefile.am +++ b/src/lib-ssl-iostream/Makefile.am @@ -56,6 +56,6 @@ noinst_PROGRAMS = $(test_programs) check-local: for bin in $(test_programs); do \ - if ! $(RUN_TEST) ./$$bin; then exit 1; fi; \ + if ! $(LIBTOOL) --mode execute $(RUN_TEST) ./$$bin; then exit 1; fi; \ done endif Result: make[2]: Entering directory '/home/xxx/rpmbuild/BUILD/xxx/dovecot-2.3.13/src/lib-ssl-iostream' make check-local make[3]: Entering directory '/home/xxx/rpmbuild/BUILD/xxx/dovecot-2.3.13/src/lib-ssl-iostream' for bin in test-iostream-ssl; do \ if ! /bin/sh ../../libtool --mode execute /bin/sh ../../run-test.sh ../.. ./$bin; then exit 1; fi; \ done ssl: handshake ....................................................... : ok ssl: o_stream_get_buffer_avail_size .................................. : ok ssl: small packets ................................................... : ok 0 / 3 tests failed make[3]: Leaving directory '/home/xxx/rpmbuild/BUILD/xxx/dovecot-2.3.13/src/lib-ssl-iostream' make[2]: Leaving directory '/home/xxx/rpmbuild/BUILD/xxx/dovecot-2.3.13/src/lib-ssl-iostream' Can anyone help to correct my understanding and my patch? Thanks, Anh Do

2 2

Deliver to different namespace with address detail
by Tobia Grosselle [ Terralink ] 25 Jan '21

25 Jan '21

can anyone confirm this?

1 0

Re: [BUG REPORT] In some cases dovecot sends (huge) binary data to solr for indexing
by Alexey Panov 25 Jan '21

25 Jan '21

Hello John, Sorry for a bit delayed reply. For some reason some of dovecot mail list messages are not reaching my inbox :( Indeed, I can confirm that your patch works as expected: meaning strips out just the message body. So yes, in my report I supposed to say: message bodies of affected messages are being ignored completely. Sorry for confusion and thanks again for such a useful patch!

1 0

New dovecot server, authentication confusion
by Jeff Abrahamson 24 Jan '21

24 Jan '21

I've set up a new dovecot+postfix instance with virtual (not system) users. I've a few questions, mostly about auth. I /think/ that postfix handles auth by asking dovecot. Users need to provide user + password to send (smtps) and receive (imaps). I see where I've configured this for dovecot, which is /etc/dovecot/passwd.db. That file contains lines like this: jeff@mobilitains.fr:{BLF-CRYPT}$2y$05$c... What concerns me is that I see occasional log items like this: Jan 24 11:26:33 nantes-m1 postfix/smtpd[4597]: fatal: no SASL authentication mechanisms (Also, I can't connect with thunderbird.) But I think I've configured SASL auth, so I'm not sure what to look at / how to debug this. I'm looking for suggestions how to approach this. I do not see how postfix knows who is allowed to connect, however. Am I correct that postfix delegates SASL to dovecot? This is the relevant config, I think: [T] jeff@nantes-m1:log $ doveconf -n # 2.3.7.2 (3c910f64b): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.7.2 () # OS: Linux 5.4.0-64-generic x86_64 Ubuntu 20.04.1 LTS # Hostname: nantes-m1.p27.eu auth_verbose = yes mail_location = mbox:~/mail:INBOX=/var/mail/%u mail_privileged_group = mail namespace inbox { inbox = yes location = mailbox Archive { auto = subscribe special_use = \Archive } mailbox Drafts { auto = subscribe special_use = \Drafts } mailbox Junk { auto = subscribe special_use = \Junk } mailbox Sent { auto = subscribe special_use = \Sent } mailbox Trash { auto = subscribe special_use = \Trash } prefix = } passdb { args = username_format=%u scheme=blf-crypt /etc/dovecot/passwd.db driver = passwd-file } plugin { sieve = file:~/sieve;active=~/.dovecot.sieve sieve_after = /var/mail/vmail/sieve-after sieve_before = /var/mail/vmail/sieve-before sieve_dir = ~/sieve } protocols = " imap" ssl = required ssl_cert = </etc/letsencrypt/live/nantes-m1.p27.eu/fullchain.pem ssl_client_ca_dir = /etc/ssl/certs ssl_dh = # hidden, use -P to show it ssl_key = # hidden, use -P to show it userdb { args = uid=4000 gid=4000 home=/var/mail/vmail/%d/%n driver = static } protocol lda { deliver_log_format = msgid=%m: %$ mail_plugins = sieve postmaster_address = postmaster@{{ primary_domain }} quota_full_tempfail = yes rejection_reason = Your message to <%t> was automatically rejected:%n%r } protocol imap { imap_client_workarounds = delay-newmail tb-extra-mailbox-sep tb-lsub-flags mail_max_userip_connections = 20 } [T] jeff@nantes-m1:log $ [T] jeff@nantes-m1:log $ postconf -n | grep -i sasl broken_sasl_auth_clients = yes smtpd_recipient_restrictions = reject_unknown_client_hostname,reject_unknown_sender_domain,reject_unknown_recipient_domain,permit_mynetworks,permit_sasl_authenticated,reject_unauth_destination,reject_invalid_hostname,reject_non_fqdn_sender smtpd_relay_restrictions = permit_mynetworks permit_sasl_authenticated defer_unauth_destination smtpd_sasl_auth_enable = yes smtpd_sasl_authenticated_header = yes smtpd_sasl_local_domain = smtpd_sasl_path = private/auth smtpd_sasl_security_options = noanonymous smtpd_sasl_type = dovecot [T] jeff@nantes-m1:log $ postconf -Mf smtp inet n - y - - smtpd submission inet n - y - - smtpd -o syslog_name=postfix/submission -o smtpd_tls_security_level=encrypt -o smtpd_sasl_auth_enable=yes -o smtpd_client_restrictions= -o smtpd_helo_restrictions= -o smtpd_sender_restrictions= -o smtpd_recipient_restrictions= -o smtpd_relay_restrictions=permit_sasl_authenticated,reject -o milter_macro_daemon_name=ORIGINATING smtps inet n - y - - smtpd -o syslog_name=postfix/smtps -o smtpd_tls_wrappermode=yes -o smtpd_sasl_auth_enable=yes -o smtpd_reject_unlisted_recipient=no -o smtpd_client_restrictions= -o smtpd_helo_restrictions= -o smtpd_sender_restrictions= -o smtpd_recipient_restrictions= -o smtpd_relay_restrictions=permit_sasl_authenticated,reject -o milter_macro_daemon_name=ORIGINATING ... Many thanks for any pointers. I'm also a bit confused on how to test it, really, short of connecting with a regular email client (mutt, thunderbird, etc.). If there are more appropriate tools that I've missed, I'm quite open to pointers. -- Jeff Abrahamson +33 6 24 40 01 57 +44 7920 594 255 http://p27.eu/jeff/ http://transport-nantes.com/

2 2

New dovecot server, authentication confusion
by Jeff Abrahamson 24 Jan '21

24 Jan '21

I've set up a new dovecot+postfix instance with virtual (not system) users. I've a few questions, mostly about auth. I /think/ that postfix handles auth by asking dovecot. Users need to provide user + password to send (smtps) and receive (imaps). I see where I've configured this for dovecot, which is /etc/dovecot/passwd.db. That file contains lines like this: jeff@mobilitains.fr:{BLF-CRYPT}$2y$05$c... What concerns me is that I see occasional log items like this: Jan 24 11:26:33 nantes-m1 postfix/smtpd[4597]: fatal: no SASL authentication mechanisms (Also, I can't connect with thunderbird.) But I think I've configured SASL auth, so I'm not sure what to look at / how to debug this. I'm looking for suggestions how to approach this. I do not see how postfix knows who is allowed to connect, however. Am I correct that postfix delegates SASL to dovecot? This is the relevant config, I think: [T] jeff@nantes-m1:log $ doveconf -n # 2.3.7.2 (3c910f64b): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.7.2 () # OS: Linux 5.4.0-64-generic x86_64 Ubuntu 20.04.1 LTS # Hostname: nantes-m1.p27.eu auth_verbose = yes mail_location = mbox:~/mail:INBOX=/var/mail/%u mail_privileged_group = mail namespace inbox { inbox = yes location = mailbox Archive { auto = subscribe special_use = \Archive } mailbox Drafts { auto = subscribe special_use = \Drafts } mailbox Junk { auto = subscribe special_use = \Junk } mailbox Sent { auto = subscribe special_use = \Sent } mailbox Trash { auto = subscribe special_use = \Trash } prefix = } passdb { args = username_format=%u scheme=blf-crypt /etc/dovecot/passwd.db driver = passwd-file } plugin { sieve = file:~/sieve;active=~/.dovecot.sieve sieve_after = /var/mail/vmail/sieve-after sieve_before = /var/mail/vmail/sieve-before sieve_dir = ~/sieve } protocols = " imap" ssl = required ssl_cert = </etc/letsencrypt/live/nantes-m1.p27.eu/fullchain.pem ssl_client_ca_dir = /etc/ssl/certs ssl_dh = # hidden, use -P to show it ssl_key = # hidden, use -P to show it userdb { args = uid=4000 gid=4000 home=/var/mail/vmail/%d/%n driver = static } protocol lda { deliver_log_format = msgid=%m: %$ mail_plugins = sieve postmaster_address = postmaster@{{ primary_domain }} quota_full_tempfail = yes rejection_reason = Your message to <%t> was automatically rejected:%n%r } protocol imap { imap_client_workarounds = delay-newmail tb-extra-mailbox-sep tb-lsub-flags mail_max_userip_connections = 20 } [T] jeff@nantes-m1:log $ [T] jeff@nantes-m1:log $ postconf -n | grep -i sasl broken_sasl_auth_clients = yes smtpd_recipient_restrictions = reject_unknown_client_hostname,reject_unknown_sender_domain,reject_unknown_recipient_domain,permit_mynetworks,permit_sasl_authenticated,reject_unauth_destination,reject_invalid_hostname,reject_non_fqdn_sender smtpd_relay_restrictions = permit_mynetworks permit_sasl_authenticated defer_unauth_destination smtpd_sasl_auth_enable = yes smtpd_sasl_authenticated_header = yes smtpd_sasl_local_domain = smtpd_sasl_path = private/auth smtpd_sasl_security_options = noanonymous smtpd_sasl_type = dovecot [T] jeff@nantes-m1:log $ postconf -Mf smtp inet n - y - - smtpd submission inet n - y - - smtpd -o syslog_name=postfix/submission -o smtpd_tls_security_level=encrypt -o smtpd_sasl_auth_enable=yes -o smtpd_client_restrictions= -o smtpd_helo_restrictions= -o smtpd_sender_restrictions= -o smtpd_recipient_restrictions= -o smtpd_relay_restrictions=permit_sasl_authenticated,reject -o milter_macro_daemon_name=ORIGINATING smtps inet n - y - - smtpd -o syslog_name=postfix/smtps -o smtpd_tls_wrappermode=yes -o smtpd_sasl_auth_enable=yes -o smtpd_reject_unlisted_recipient=no -o smtpd_client_restrictions= -o smtpd_helo_restrictions= -o smtpd_sender_restrictions= -o smtpd_recipient_restrictions= -o smtpd_relay_restrictions=permit_sasl_authenticated,reject -o milter_macro_daemon_name=ORIGINATING ... Many thanks for any pointers. I'm also a bit confused on how to test it, really, short of connecting with a regular email client (mutt, thunderbird, etc.). If there are more appropriate tools that I've missed, I'm quite open to pointers. -- Jeff Abrahamson +33 6 24 40 01 57 +44 7920 594 255 http://p27.eu/jeff/ http://transport-nantes.com/

1 0

Massive /tmp files
by MRob 22 Jan '21

22 Jan '21

Hello, I just found user who has single folder (standard maildir format) that filled with over 8mil files and 800GB in the /tmp subdirectory of that folder: /email/domain/username/.Folder/tmp The files in there are normal maildir email files. I think the dir ran out of inode space so its not ongoing problem. My question is only can I purge that folder without breaking something more? If it tries to re-fill again I will try to debug Thankyou!!

5 8

[BUG REPORT] In some cases dovecot sends (huge) binary data to solr for indexing
by Alexey Panov 21 Jan '21

21 Jan '21

In some cases (exact condition still unknown) dovecot sends binary data (attachments) to SOLR for indexing. This reduces index and overall FTS efficiency dramatically. In extreme condition (below an example of 20MB) dovecot’s hardwired timeout of 60s gets triggered during HTTP exchange with SOLR on just a single file. This results in an unfinished index which, by initial indexing, gets restarted over and over. With multiple affected mailboxes even on moderate usage this can cause an IO overload of the whole system. Message example (doveadm fetch text): https://filebin.ca/5oy5Wc1QrBK3/fetch-text.obfuscated.txt <https://filebin.ca/5oy5Wc1QrBK3/fetch-text.obfuscated.txt> Corresponding raw log data: https://filebin.ca/5oy6yqLSCr3H/rawlog.obfuscated.txt <https://filebin.ca/5oy6yqLSCr3H/rawlog.obfuscated.txt> (Both files were processed with perl doveadm-obfuscate.pl <https://www.dovecot.org/tools/doveadm-obfuscate.pl>; the script doesn’t replace non-latin characters so they were replaced with ‘R’ manually) Workaround: there is a useful patch by John Fawcett <https://www.mail-archive.com/dovecot@dovecot.org/msg82296.html> that allows to set the FTS indexing message body maximum size. It works perfectly, but affected messages are getting completely ignored by FTS. This bug report is a summarised result of this discussion <https://www.mail-archive.com/dovecot@dovecot.org/msg82599.html>.

2 1

Deliver to different namespace with address detail
by Tobia Grosselle [ Terralink ] 21 Jan '21

21 Jan '21

Hello, with this settings: Dovecot 2.3.7.2 (3c910f64b) namespace { list = yes type = private inbox = yes prefix = INBOX/ separator = / } namespace Archive { list = yes type = private inbox = no prefix = Archive/ separator = / mailbox Incoming { auto = create } } lmtp_save_to_detail_mailbox = yes recipient_delimiter = + userdb_query = SELECT accounts.username AS user, accounts.home AS home, CONCAT('mdbox:', accounts.home, '/mdbox') AS mail, CONCAT('mdbox:', accounts.home, '/archive') AS 'namespace/Archive/location', 'vmail' AS uid, 'vmail' as gid FROM accounts WHERE accounts.username = '%u' it is possible to deliver an email to Archive namespace instead of inbox with address detail (email+Archive/Incoming@domain)? If i try i see that the lmtp service search the path from the inbox namespace (so INBOX/Archive/Incoming). Thanks

2 2

Sieve fileinto :create is failing
by Ron Garret 21 Jan '21

21 Jan '21

I’m trying to get a sieve script to move messages into a folder, and to create that folder if it doesn’t already exist. I’m following the example code at: https://doc.dovecot.org/configuration_manual/sieve/examples/ and doing this: > require ["fileinto", "mailbox”]; > … > fileinto :create “myfolder”; > … That results in this error in the log file: error: unknown tagged argument ':create' for the fileinto command What am I doing wrong? rg

4 8

Where does sieve store its "vacation" state?
by Ron Garret 21 Jan '21

21 Jan '21

Pigeonhole/sieve has a “vacation” feature that keeps track of which addresses it has sent messages to already so it doesn’t send too many. The state for this feature seems to survive a dovecot restart, so it must be persistent somewhere and not just stored in RAM. But I don’t recall configuring any place where that state would reside. So where is it? rg

2 1

Mail crypt plugin with HSM
by Dima Kovalyov 21 Jan '21

21 Jan '21

Hello Dovecot developers, I'm using a mail-crypt plugin to perform encryption at rest using per user keys encrypted with their password. Great plugin and I really appreciate it's continuous development and improvement. I have a question regarding mail-crypt keys being stored in HSM. Is it possible? I'm almost sure I've seen some discussion about usage of PKCS#11 in mail-crypt but can't find it in the mailing list. Please advise. Thanks! - Dima

1 0

Timeout/Event leak
by Lefteris Tsintjelis 20 Jan '21

20 Jan '21

Hi, any idea what all this is? Jan 19 18:23:00 master: Warning: Killed with signal 15 (by pid=33729 uid=0 code=kill) Jan 19 18:23:03 config: Warning: Killed with signal 15 (by pid=1 uid=0 code=kill) Jan 19 18:23:03 stats: Warning: Killed with signal 15 (by pid=1 uid=0 code=kill) Jan 19 18:23:03 auth: Warning: Killed with signal 15 (by pid=1 uid=0 code=kill) Jan 19 18:23:03 auth: Warning: Timeout leak: 0x1059ce0 (auth-request-handler.c:617) Jan 19 18:23:03 auth: Warning: Timeout leak: 0x1059ce0 (auth-request-handler.c:617) Jan 19 18:23:03 auth: Warning: Timeout leak: 0x1059ce0 (auth-request-handler.c:617) Jan 19 18:23:03 auth: Warning: Timeout leak: 0x1059ce0 (auth-request-handler.c:617) Jan 19 18:23:03 auth: Warning: Timeout leak: 0x1059ce0 (auth-request-handler.c:617) Jan 19 18:23:03 auth: Warning: Timeout leak: 0x1059ce0 (auth-request-handler.c:617) Jan 19 18:23:03 auth: Warning: Timeout leak: 0x1059ce0 (auth-request-handler.c:617) Jan 19 18:23:03 auth: Warning: Timeout leak: 0x1059ce0 (auth-request-handler.c:617) Jan 19 18:23:03 auth: Warning: Timeout leak: 0x1059ce0 (auth-request-handler.c:617) Jan 19 18:23:03 auth: Warning: Timeout leak: 0x1059ce0 (auth-request-handler.c:617) Jan 19 18:23:03 auth: Warning: Event 0x120f0020 leaked (parent=0x120ecc20): auth-request.c:621 Jan 19 18:23:03 auth: Warning: Event 0x120ece20 leaked (parent=0x120ecc20): auth-request.c:111 Jan 19 18:23:03 auth: Warning: Event 0x120ecc20 leaked (parent=0x120ca620): auth-request.c:110 Jan 19 18:23:03 auth: Warning: Event 0x120eca20 leaked (parent=0x120ec620): auth-request.c:621 Jan 19 18:23:03 auth: Warning: Event 0x120ec820 leaked (parent=0x120ec620): auth-request.c:111 Jan 19 18:23:03 auth: Warning: Event 0x120ec620 leaked (parent=0x120b8620): auth-request.c:110 Jan 19 18:23:03 auth: Warning: Event 0x120ec220 leaked (parent=0x1207ee20): auth-request.c:667 Jan 19 18:23:03 auth: Warning: Event 0x120ec020 leaked (parent=0x1207ee20): auth-request.c:111 Jan 19 18:23:03 auth: Warning: Event 0x1207ee20 leaked (parent=0x12087220): auth-request.c:110 Jan 19 18:23:03 auth: Warning: Event 0x1207ec20 leaked (parent=0x1207e820): auth-request.c:667 Jan 19 18:23:03 auth: Warning: Event 0x1207ea20 leaked (parent=0x1207e820): auth-request.c:111 Jan 19 18:23:03 auth: Warning: Event 0x1207e820 leaked (parent=0x12087220): auth-request.c:110 Jan 19 18:23:03 auth: Warning: Event 0x1207e620 leaked (parent=0x1207e220): auth-request.c:621 Jan 19 18:23:03 auth: Warning: Event 0x1207e420 leaked (parent=0x1207e220): auth-request.c:111 Jan 19 18:23:03 auth: Warning: Event 0x1207e220 leaked (parent=0x120ca620): auth-request.c:110 Jan 19 18:23:03 auth: Warning: Event 0x1207e020 leaked (parent=0x120ada20): auth-request.c:621 Jan 19 18:23:03 auth: Warning: Event 0x120adc20 leaked (parent=0x120ada20): auth-request.c:111 Jan 19 18:23:03 auth: Warning: Event 0x120ada20 leaked (parent=0x120ad820): auth-request.c:110 Jan 19 18:23:03 auth: Warning: Event 0x120ad820 leaked (parent=0x12087220): auth-client-connection.c:338 Jan 19 18:23:03 auth: Warning: Event 0x120ad220 leaked (parent=0x120b8a20): auth-request.c:621 Jan 19 18:23:03 auth: Warning: Event 0x120ad020 leaked (parent=0x120b8a20): auth-request.c:111 Jan 19 18:23:03 auth: Warning: Event 0x120b8a20 leaked (parent=0x120ca620): auth-request.c:110 Jan 19 18:23:03 auth: Warning: Event 0x120b8420 leaked (parent=0x120cac20): auth-request.c:621 Jan 19 18:23:03 auth: Warning: Event 0x120cae20 leaked (parent=0x120cac20): auth-request.c:111 Jan 19 18:23:03 auth: Warning: Event 0x120cac20 leaked (parent=0x120caa20): auth-request.c:110 Jan 19 18:23:03 auth: Warning: Event 0x120caa20 leaked (parent=0x12087220): auth-client-connection.c:338 Thank you

2 2

Dovecot Gmail OAuth2.0 Setting Question
by 福田泰葵 19 Jan '21

19 Jan '21

Dear Sir or Madam Unable to build OAuth2.0 authentication to Gmail using dovecot as proxy. I have a question about how to use dovecot as a proxy to perform OAuth 2.0 authentication to Gmail using a mail client. 1. Is the following all I need to do to authenticate to Gmail using dovecot as a proxy? - passdb passdb { driver = oauth2 mechanisms = oauthbearer xoauth2 args = /etc/dovecot/dovecot-oauth2.token.conf.ext } passdb { driver = oauth2 mechanisms = plain login args = /etc/dovecot/dovecot-oauth2.plain.conf.ext } - create dovecot-oauth2.token.conf.ext and dovecot-oauth2.plain.conf.ext - create gmail service account api 2. grant_url in dovecot-oauth2.token.conf.ext and dovecot-oauth2.plain.conf.ext is URL for obtaining a Google access token for a web server that I have built myself? 3. I use a Gmail service account, so I don’t need a client ID and secret ID, right? 4. Do I set introspection_url to the URL of my own web server with the access token used for authentication to Google as the response? 5. The documentation says “pass_attrs = host=127.0.0.1”, but if you are authenticating to Gmail, I should use “pass_attrs = proxy=y host=%{if;%s;eq;imap;imap.gmail.com;%{if;%s;eq;pop3;smtp .gmail.com;pop.gmail.com}} port=%{if;%s;eq;imap;993;%{if;%s;eq;pop3;587;465}} proxy_mech=xoauth2 pass=%{oauth2:access_token} user=%{oauth2:email oauth2:email}”? 6. What is the difference between dovecot-oauth2.token.conf.ext and dovecot-oauth2.plain.conf.ext ? Do I need to configure both? I used https://doc.dovecot.org/configuration_manual/authentication/oauth2/#proxy as a reference. I would appreciate your reply. Yours faithfully, ------------------------------ e-mail: taiki.fukuda(a)justsystems.com TEL: 03-5324-7900 mobile: 080-6198-7328 ------------------------------

1 0

dovecot 2.3.13 : make check FAILURE : Assert failed: buffer_append_full_file
by J Lumby 19 Jan '21

19 Jan '21

After successfully building dovecot 2.3.13 (linux kernel 5.10.1 , glibc-2.32 , gcc-9.3) make check had one failure as follows : test-buffer-istream.c:54: Assert failed: buffer_append_full_file(result, TEST_FILENAME, SIZE_MAX, &error) == BUFFER_APPEND_READ_ERROR test-buffer-istream.c:56: Assert failed: error != NULL && *error != '\0' buffer_append_full_file .............................................. : FAILED After a brief look at the referenced code in test-buffer-istream.c , I can't find out what this FAIL really means or whether it is serious. The assert is finding that the result of the call to buffer_append_full_file is not BUFFER_APPEND_READ_ERROR, but it does not report what the result code actually was. Maybe errno was actually 0 and call succeeded? I don't know. Nor can I see how to add some code to find out. Can anyone offer any advice on what this means and/or how to investigate? Cheers, John Lumby

2 6

Changing the default delivery mailbox to something other than INBOX
by Ron Garret 18 Jan '21

18 Jan '21

Is there an easy way (i.e. a built-in configuration setting) to change the name of the mailbox that the dovecot LDA delivers mail into? The default is INBOX but I’d like mail to be delivered to some other mailbox. The reason for this is that I want all incoming mail to be invisible to the user by default until it has been screened for viruses and spam. I know I could do this with Sieve, but that is a PITA. More details in case anyone is interested: The goal of this filter is to make it work with very little training. To bootstrap the process, the filter is given access to outgoing mail (via a milter) which it uses as a reliable training corpus for good messages. It then leverages that information to filter incoming messages. For example, messages from senders which have been the recipients of outgoing messages are presumed to be good. There is also a spam honeypot to provide a reliable spam corpus. One of the heuristics I want to use is to look for the same subject line in multiple messages from unknown users received over a period of an hour or so because those are almost invariably spam. But that requires a time delay between when a message is received and when it is filtered, and that in turn requires a place to store messages for a while before they are processed. While they are in that temporary storage, I don’t want them in the user’s face, but I do want them to be accessible if the user wants to see them (e.g. if they know that an important message is coming in which may be stuck in the temp storage). So I’d like to make something like an INCOMING mailbox where all mail is delivered. The messages in INCOMING are scanned by the filter and moved to Junk or INBOX as appropriate. Thanks, rg

3 12

mbox to pst advice
by Marc Roos 18 Jan '21

18 Jan '21

Anyone an idea how to convert mbox ot pst on linux?

3 6

fts_solr: Indexing failed (fails on particular messages/mailboxes by timeout)
by Alexey Panov 18 Jan '21

18 Jan '21

Hello, I am running recent dovecot 2.3.13 (89f716dc2) within dockerized mailcow setup. During just another update routine I decided to reindex all mailboxes and some of them fail (timeout) on exactly SAME messages in SAME mailboxes: > doveadm(u@d): Error: fts_solr: Indexing failed: Request timed out (Request queued 73.213 secs ago, 1 send attempts in 73.098 secs, 60.597 in http ioloop, 0.000 in other ioloops, connected 127.875 secs ago) > doveadm(u@d): Error: Mailbox Sent: Mail search failed: Internal error occurred. Refer to server log for more information. [2021-01-14 11:23:46] > doveadm(u@d): Error: Mailbox Sent: Transaction commit failed: FTS transaction commit failed: backend deinit This error is persistent and affects only some, but always same folders of same mailboxes (i mean solr can't finish indexing them at all). I/O is in perfect condition and has no corruptions. I also tried to do fts rescan which made no change. RAM is fine, I haven't seen OOM conditions. During my research I found this discussion <https://www.mail-archive.com/dovecot@dovecot.org/msg76944.html> which lead me idea of reducing the batch_size to as low as 10 (for testing purposes). Observing SOLR logs during reindexing on the mailbox/folder causing the error I noticed the following strange behaviour. Firstly, it goes very fast but then always kinda freezes on these messages: > solr-mailcow_1 | 2021-01-14 16:05:09.615 INFO (qtp524223214-1151) [ x:dovecot-fts] o.a.s.u.p.LogUpdateProcessorFactory [dovecot-fts] webapp=/solr path=/update params={}{add=[6883/78a0ec27b091da5e4054000013681708/u@d (1688878773188952064), 6884/78a0ec27b091da5e4054000013681708/u@d (1688878773203632128), 6885/78a0ec27b091da5e4054000013681708/u@d (1688878773218312192), 6886/78a0ec27b091da5e4054000013681708/u@d (1688878773227749376), 6887/78a0ec27b091da5e4054000013681708/u@d (1688878773237186560), 6888/78a0ec27b091da5e4054000013681708/u@d (1688878773244526592), 6889/78a0ec27b091da5e4054000013681708/u@d (1688878773250818048), 6890/78a0ec27b091da5e4054000013681708/u@d (1688878773259206656), 6891/78a0ec27b091da5e4054000013681708/u@d (1688878773272838144), 6892/78a0ec27b091da5e4054000013681708/u@d (1688878773288566784)]} 0 101 > solr-mailcow_1 | 2021-01-14 16:06:42.540 INFO (qtp524223214-1143) [ x:dovecot-fts] o.a.s.u.p.LogUpdateProcessorFactory [dovecot-fts] webapp=/solr path=/update params={}{add=[6893/78a0ec27b091da5e4054000013681708/u@d (1688878773329461248), 6894/78a0ec27b091da5e4054000013681708/u@d (1688878773332606976), 6895/78a0ec27b091da5e4054000013681708/u@d (1688878774361260032), 6896/78a0ec27b091da5e4054000013681708/u@d (1688878850290745344), 6897/78a0ec27b091da5e4054000013681708/u@d (1688878851347709952), 6898/78a0ec27b091da5e4054000013681708/u@d (1688878852404674560), 6899/78a0ec27b091da5e4054000013681708/u@d (1688878853586419712), 6900/78a0ec27b091da5e4054000013681708/u@d (1688878870704422912), 6901/78a0ec27b091da5e4054000013681708/u@d (1688878870709665792), 6902/78a0ec27b091da5e4054000013681708/u@d (1688878870727491584)]} 0 92891 It takes almost one and a half minute to get those ten messages (6893-6902) indexed. It freezes exactly on that position every time I restart indexing. Actually only reducing the batch_size to 10 made it through. It was timing out with the default batch_size exactly here each time. Than it goes further again blazing fast until it reaches here: > solr-mailcow_1 | 2021-01-14 16:07:26.148 INFO (qtp524223214-1151) [ x:dovecot-fts] o.a.s.u.p.LogUpdateProcessorFactory [dovecot-fts] webapp=/solr path=/update params={}{add=[7443/78a0ec27b091da5e4054000013681708/u@d (1688878884286627840), 7444/78a0ec27b091da5e4054000013681708/u@d (1688878884293967872), 7445/78a0ec27b091da5e4054000013681708/u@d (1688878884304453632), 7446/78a0ec27b091da5e4054000013681708/u@d (1688878884502634496), 7447/78a0ec27b091da5e4054000013681708/u@d (1688878900331937792), 7448/78a0ec27b091da5e4054000013681708/u@d (1688878900508098560), 7449/78a0ec27b091da5e4054000013681708/u@d (1688878916409753600), 7450/78a0ec27b091da5e4054000013681708/u@d (1688878916424433664), 7451/78a0ec27b091da5e4054000013681708/u@d (1688878916438065152), 7452/78a0ec27b091da5e4054000013681708/u@d (1688878916448550912)]} 0 30682 > solr-mailcow_1 | 2021-01-14 16:09:40.277 INFO (qtp524223214-1325) [ x:dovecot-fts] o.a.s.u.p.LogUpdateProcessorFactory [dovecot-fts] webapp=/solr path=/update params={}{add=[7463/78a0ec27b091da5e4054000013681708/u@d (1688879057103486976)]} 0 1 > solr-mailcow_1 | 2021-01-14 16:10:00.628 INFO (qtp524223214-1009) [ x:dovecot-fts] o.a.s.u.p.LogUpdateProcessorFactory [dovecot-fts] webapp=/solr path=/update params={}{add=[7453/78a0ec27b091da5e4054000013681708/u@d (1688878916486299648), 7454/78a0ec27b091da5e4054000013681708/u@d (1688878916489445376), 7455/78a0ec27b091da5e4054000013681708/u@d (1688878916496785408), 7456/78a0ec27b091da5e4054000013681708/u@d (1688878917584158720), 7457/78a0ec27b091da5e4054000013681708/u@d (1688878994974310400), 7458/78a0ec27b091da5e4054000013681708/u@d (1688879073177108480), 7459/78a0ec27b091da5e4054000013681708/u@d (1688879074234073088), 7460/78a0ec27b091da5e4054000013681708/u@d (1688879075288940544), 7461/78a0ec27b091da5e4054000013681708/u@d (1688879076339613696), 7462/78a0ec27b091da5e4054000013681708/u@d (1688879077392384000)]} 0 154455 This results in the following error on the console where I start reindexing: > $ docker-compose exec dovecot-mailcow doveadm index -u u@d 'Sent' > doveadm(u@d): Error: fts_solr: Indexing failed: Request timed out (Request queued 134.122 secs ago, 1 send attempts in 134.098 secs, 131.923 in http ioloop, 0.000 in other ioloops, connected 376.408 secs ago) > doveadm(u@d): Error: Mailbox Sent: Mail search failed: Internal error occurred. Refer to server log for more information. [2021-01-14 17:09:40] > doveadm(u@d): Error: Mailbox Sent: Transaction commit failed: FTS transaction commit failed: backend deinit The last message about indexed block of ten messages (2021-01-14 16:10:00.628 7453-7462) arrives already after reindexing error on the other console occurs and doveadm exits. Interestingly, exactly at the time mentioned in the error message (2021-01-14 17:09:40, i.e. 16:06:40 - I don’t know why timezone differs) a message about indexing of a single message 7463 arrives (which is actually NEXT message to the block that gets indexed 20 seconds later). The whole mailbox consists of 8530 messages and doveadm/solr can’t finish indexing it at all starting over and over. Can you please help me understanding the reason of this behaviour? P.S. Is there any possibility to determine what message in vmail maildir corresponds to solr log, e.g. to 7463/78a0ec27b091da5e4054000013681708/u@d (1688879057103486976) ? Thanks, Programmierus

2 4

Additional custom fields in map dict with static values.
by Mimiko 17 Jan '21

17 Jan '21

Hello. Dovector version 2.2.27. How can I add custom fields in the map for the last_login. For example: map { pattern = shared/last_login/imap/$user/$client_ip table = users_last_login value_field = last_login_imap_int value_type = string fields { userid = $user last_login_client_ip_imap = $client_ip custom_field_name = some_static_value } }

1 0

Antispam plugin
by Maciej Milaszewski 17 Jan '21

17 Jan '21

Hi System centos8 + dovecot-2.3.8 from repo # 2.3.8 (9df20d2db): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.8 (b7b03ba2) # OS: Linux 4.18.0-193.19.1.el8_2.x86_64 x86_64 CentOS Linux release 8.2.2004 (Core) I need "Antispam plugin". What antispam-plugin I must use ? In older version dovecot-2.2.36.4 i use "dovecot-antispam-plugin" but in centos I had a problem with configure - probably toold wersion "./configure: line 3193: DC_DOVECOT: command not found" In wiki dovect is "antispam-plugin" I try this http://hg.dovecot.org/dovecot-antispam-plugin but get 404 Backand spamassassin

4 3

Re: dovecot 2.3.13 : make check FAILURE : Assert failed: buffer_append_full_file
by steve＠keptprivate.com 16 Jan '21

16 Jan '21

I was experiencing multiple failures with make check on a fresh installation of CentOS 8.3.The solution for me was to use mock instead of rpmbuild. (I was not building as root with rpmbuild.) With mock all tests were successful. Sent from my T-Mobile 4G LTE device------ Original message------From: J LumbyDate: Sat, Jan 16, 2021 11:31 AMTo: dovecot(a)dovecot.org;Cc: Subject:dovecot 2.3.13 : make check FAILURE : Assert failed: buffer_append_full_fileAfter successfully building dovecot 2.3.13 (linux kernel 5.10.1 , glibc-2.32 , gcc-9.3) make check had one failure as follows : test-buffer-istream.c:54: Assert failed: buffer_append_full_file(result, TEST_FILENAME, SIZE_MAX, &error) == BUFFER_APPEND_READ_ERROR test-buffer-istream.c:56: Assert failed: error != NULL && *error != '\0' buffer_append_full_file .............................................. : FAILED After a brief look at the referenced code in test-buffer-istream.c , I can't find out what this FAIL really means or whether it is serious. The assert is finding that the result of the call to buffer_append_full_file is not BUFFER_APPEND_READ_ERROR, but it does not report what the result code actually was. Maybe errno was actually 0 and call succeeded? I don't know. Nor can I see how to add some code to find out. Can anyone offer any advice on what this means and/or how to investigate? Cheers, John Lumby

1 0

outlook 2019 imap folder subscription
by Alexander Rivanykov 16 Jan '21

16 Jan '21

1 0

The use of %w in password_query leads to "Failed to expand plugin setting" error
by Filidor Wiese 16 Jan '21

16 Jan '21

Hi, I'm trying to convert my existing users to a more modern password scheme by following the how-to at https://wiki.dovecot.org/HowTo/ConvertPasswordSchemes. One of the steps is to include the use of '%w' in the password_query, like so: password_query = \ SELECT domain, password, '%w' AS userdb_plain_pass, \ domain as userdb_domain, concat('*:storage=', quota) AS userdb_quota_rule, 5000 as userdb_uid, 5000 as userdb_gid, '/home/%d/%n' as userdb_home \ FROM users WHERE (catch='%n' AND domain='%d') and also to configure: userdb { driver = prefetch } in order to combine the user/password_query into one. Now that all seemed to work well, except for one thing. When a user has a % sign in their password, the following error occurs: Error: Failed to expand plugin setting plain_pass = 'Tfew3322gYEp$%5Qjk0': Unknown variable '%Q' Which indicates that dovecot is trying to expand variables in the password. As a consequence, the login process fails. Is there some way around this behavior? Thanks in advance, Filidor Wiese

4 5

Replication issue: cannot delete or rename folders
by ppq＠tuta.io 15 Jan '21

15 Jan '21

Hi all, I'm trying to replace a shared NFS (rock solid, btw) with a replicated two-node setup. However I've been struggling with an issue connected in some way with the replication between the two servers (master-master). The issue is once a folder (say "aaa") is created one one account, it cannot be renamed or deleted. If deleted, it will instantly reappear (when replication is running) or when renamed to "bbb", the operation will fail with an error like the one below: Jan 15 18:21:22 ms1 dovecot: dsync-local(test2(a)mydomain.ext)<JtJJARLPAWBPJAAAxdOQ8Q>: Error: rename(/var/vmail-local/mydomain.ext/test2/idx/.bbb <http://mydomain.ext/test2/idx/.bbb>, /var/vmail-local/mydomain.ext/test2/idx/.aaa <http://mydomain.ext/test2/idx/.aaa>) failed: Directory not empty Jan 15 18:21:22 ms1 dovecot: dsync-local(test2(a)mydomain.ext)<JtJJARLPAWBPJAAAxdOQ8Q>: Error: rename(/var/vmail-local/mydomain.ext/test2/idx/.bbb <http://mydomain.ext/test2/idx/.bbb>, /var/vmail-local/mydomain.ext/test2/idx/.aaa <http://mydomain.ext/test2/idx/.aaa>) failed: Directory not empty I can see that the index directory contains both the .aaa and .bbb index directories with dovecot.log files inside. If I stop the one of the nodes all works nicely and I can create, delete and rename folders at will. My setup is as below. dovecot --version -> 2.3.4.1 (f79e8e7e4) the indexes are in a separate directory on /var/vmail-local/ (performance reasons). the mail spool is mounted on /var/vmail/ One node has local disks for everything. It runs with mmap_disable=no, mail_fsync=optimized, mail_nfs_storage=no, mail_nfs_index=no The other node has an NFS based /var/vmail/ and local disks for indexes. On this node I'm using the following settings: mmap_disable=yes, mail_fsync=always, mail_nfs_storage=yes, mail_nfs_index=no The nfs server is v4 The two servers are "orchestrated" by a two-node director cluster. I'm sure I'm missing or misconfigured something. The doveconf -n config is, part from the NFS quick, the same on both nodes as follows: -------- # 2.3.4.1 (f79e8e7e4): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.4 () doveconf: Warning: service auth { client_limit=1000 } is lower than required under max. load (2012) doveconf: Warning: service anvil { client_limit=1000 } is lower than required under max. load (1515) # OS: Linux 5.4.78-2-pve x86_64 Debian 10.7 # Hostname: dovecot1.mydomain.ext auth_master_user_separator = + auth_mechanisms = plain login default_process_limit = 500 disable_plaintext_auth = no doveadm_password = # hidden, use -P to show it doveadm_port = 12727 imap_capability = +SPECIAL-USE XLIST listen = *,[::] lmtp_rcpt_check_quota = yes log_timestamp = "%Y-%m-%d %H:%M:%S " login_trusted_networks = 172.16.20.0/24 172.16.30.0/24 mail_fsync = always mail_max_userip_connections = 100 mail_nfs_storage = yes mail_plugins = quota notify replication lazy_expunge acl mail_privileged_group = vmail mmap_disable = yes namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox EXPUNGED { autoexpunge = 1 days autoexpunge_max_mails = 20 } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = separator = . } passdb { args = /etc/dovecot/dovecot-sql.conf driver = sql } passdb { args = /etc/dovecot/master-users driver = passwd-file master = yes result_success = continue } passdb { driver = pam } plugin { acl = vfile:/etc/dovecot/dovecot.acl lazy_expunge = EXPUNGED mail_replica = tcp:172.16.30.100:12727 quota = dict:user::file:/var/vmail/%d/%n/.quotausage quota_rule = EXPUNGED:ignore quota_status_nouser = DUNNO quota_status_overquota = 552 5.2.2 Mailbox is full quota_status_success = DUNNO sieve = /var/vmail/%d/%n/.sieve sieve_after = /var/vmail/%d/%n/.ispconfig.sieve sieve_before = /var/vmail/%d/%n/.ispconfig-before.sieve sieve_max_actions = 100 sieve_max_redirects = 25 sieve_max_script_size = 2M } protocols = imap pop3 lmtp service aggregator { fifo_listener replication-notify-fifo { group = root mode = 0660 user = vmail } unix_listener replication-notify { group = root mode = 0660 user = vmail } } service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0660 user = postfix } unix_listener auth-userdb { group = vmail mode = 0600 user = vmail } user = root } service doveadm { inet_listener { port = 12727 } } service imap-login { client_limit = 1000 process_limit = 512 } service lmtp { inet_listener lmtp { port = 24 } unix_listener /var/spool/postfix/private/dovecot-lmtp { group = postfix mode = 0600 user = postfix } } service quota-status { client_limit = 1 executable = quota-status -p postfix unix_listener /var/spool/postfix/private/quota-status { group = postfix mode = 0660 user = postfix } } service replicator { process_min_avail = 1 unix_listener replicator-doveadm { mode = 0600 user = vmail } } service stats { unix_listener stats-reader { group = vmail mode = 0660 user = vmail } unix_listener stats-writer { group = vmail mode = 0660 user = vmail } } ssl = required ssl_cert = </etc/letsencrypt/live/mail.mydomain.ext/fullchain.pem <http://mail.mydomain.ext/fullchain.pem> ssl_dh = # hidden, use -P to show it ssl_key = # hidden, use -P to show it userdb { driver = prefetch } userdb { args = /etc/dovecot/dovecot-sql.conf driver = sql } userdb { driver = passwd } protocol imap { auth_verbose = yes mail_plugins = quota imap_quota notify replication lazy_expunge acl } protocol pop3 { auth_verbose = yes mail_plugins = quota notify replication lazy_expunge acl pop3_uidl_format = %08Xu%08Xv } protocol lda { mail_plugins = sieve quota notify replication lazy_expunge acl postmaster_address = postmaster(a)dovecot1.mydomain.ext } protocol lmtp { mail_plugins = quota sieve notify replication lazy_expunge acl postmaster_address = postmaster(a)dovecot1.mydomain.ext } -------------- My sql config is this: --- password_query = SELECT email as user, password, maildir as userdb_home, CONCAT( maildir_format, ':', maildir, '/', IF(maildir_format='maildir','Maildir',maildir_format)) as userdb_mail, uid as userdb_uid, gid as userdb_gid, CONCAT('*:storage=', quota, 'B') AS userdb_quota_rule, CONCAT(maildir, '/.sieve') as userdb_sieve FROM mail_user WHERE (login = '%u' OR email = '%u') AND `disable%Ls` = 'n' AND server_id = '20' AND EXISTS (SELECT domain_id FROM mail_domain WHERE domain = '%d' AND active = 'y' AND server_id = 20) user_query = SELECT email as user, maildir as home, CONCAT( maildir_format, ':', maildir, '/', IF(maildir_format='maildir','Maildir',maildir_format),':INDEX=/var/vmail-local/%d/%n/idx') as mail, uid, gid, CONCAT('*:storage=', quota, 'B') AS quota_rule, CONCAT(maildir, '/.sieve') as sieve FROM mail_user WHERE (login = '%u' OR email = '%u') AND `disable%Ls` = 'n' AND server_id = '20' --- Best regards,Dave

1 0

doveadm, userdb, and ssl=any-cert
by Felipe Gasper 15 Jan '21

15 Jan '21

Hello, We have a server that answers userdb queries for Dovecot. As of 2.3.11 we’re finding that if proxying fields like `ssl=any-cert` are in a userdb response for doveadm, then doveadm complains about not recognizing that field, e.g.: ----- doveadm(_mainaccount(a)xferme.tld): Error: User lookup failed: Invalid settings in userdb: Invalid userdb input 'ssl=any-cert': Invalid value: any-cert doveadm(_mainaccount(a)xferme.tld): Warning: Event 0x55a3f911b9c0 leaked (parent=(nil)): mail-storage-service.c:1335 ----- We can avoid sending this field in response when doveadm is the requesting service, but was this apparent change in 2.3.11 intended? Thank you! cheers, -Felipe Gasper

1 0

Authentication segfault with Dovecot 2.3.13
by Harald Leithner 14 Jan '21

14 Jan '21

Hi, we have a problem upgrading Dovecot from 2.2 to 2.3.13 on one server it seems one user triggers a segfault while trying to authenticate. The user works fine with 2.2.36.4, our last update try mid-late 2020 was aborted because of this reason. While debugging the problem we noticed that the "auth_debug_passwords = no" option doesn't work at least in our logfiles are the passwords logged. We replaced the password in the log with "THIS_SHOULD_NOT_GET_LOGGED" and the user part with "user@redacted". The user uses APOP for authentication, but other users login successfully with APOP. Here is a stacktrace and a log dump: Jan 6 16:29:44 mail kernel: auth[2208397]: segfault at ec ip 00007f67fc147174 sp 00007ffeed993150 error 4 in libdovecot.so.0.0.0[7f67fc06e000+fc000] Jan 6 16:29:44 mail kernel: Code: 1f 80 00 00 00 00 41 54 e8 79 fd ff ff 31 f6 49 89 c4 48 89 c7 31 c0 e8 ca f8 ff ff 4c 89 e0 41 5c c3 0f 1f 40 00 53 48 89 fb <f6> 87 ec 00 00 00 04 75 43 48 83 3d 7b aa 0a 00 00 0f 85 50 15 f4 Jan 6 16:29:44 mail systemd[1]: Started Process Core Dump (PID 2208677/UID 0). Jan 6 16:29:44 mail systemd-coredump[2208678]: Process 2208397 (auth) of user 489 dumped core.#012#012Stack trace of thread 2208397:#012#0 0x00007f67fc147174 event_create_passthrough (libdovecot.so.0 + 0x116174)#012#1 0x0000555678812d6e auth_request_finished_event (auth + 0x1bd6e)#012#2 0x00005556788159ae auth_request_log_finished (auth + 0x1e9ae)#012#3 0x0000555678816ee0 n/a (auth + 0x1fee0)#012#4 0x0000555678826dc1 passdb_handle_credentials (auth + 0x2fdc1)#012#5 0x0000555678816c7e n/a (auth + 0x1fc7e)#012#6 0x0000555678824f27 n/a (auth + 0x2df27)#012#7 0x000055567881b02d auth_request_handler_auth_begin (auth + 0x2402d)#012#8 0x000055567880dfaf n/a (auth + 0x16faf)#012#9 0x00007f67fc143a79 io_loop_call_io (libdovecot.so.0 + 0x112a79)#012#10 0x00007f67fc144ae2 io_loop_handler_run_internal (libdovecot.so.0 + 0x113ae2)#012#11 0x00007f67fc143b21 io_loop_handler_run (libdovecot.so.0 + 0x112b21)#012#12 0x00007f67fc143ce0 io_loop_run (libdovecot.so.0 + 0x112ce0)#012#13 0x00007f67fc0b96f3 master_service_run (libdovecot.so.0 + 0x886f3)#012#14 0x000055567880c2db main (auth + 0x152db)#012#15 0x00007f67fbc9d042 __libc_start_main (libc.so.6 + 0x27042)#012#16 0x000055567880c48e _start (auth + 0x1548e) Jan 6 16:29:44 mail dovecot[2208071]: auth: Debug: client in: AUTH#011134#011PLAIN#011service=imap#011session=tgog/jy4erm5j7ZO#011lip=lan-ip#011rip=client-ip#011lport=143#011rport=47482 Jan 6 16:29:44 mail dovecot[2208071]: auth: Debug: client passdb out: CONT#011134 Jan 6 16:29:44 mail dovecot[2208071]: auth: Debug: client in: CONT<hidden> Jan 6 16:29:44 mail dovecot[2208071]: auth: Debug: sql(user@redacted,client-ip,<tgog/jy4erm5j7ZO>): Performing passdb lookup Jan 6 16:29:44 mail dovecot[2208071]: auth: Debug: sql(user@redacted,client-ip,<tgog/jy4erm5j7ZO>): cache expired Jan 6 16:29:44 mail dovecot[2208071]: auth-worker(2208404): Debug: conn unix:auth-worker (pid=2208397,uid=489): auth-worker<229>: Handling PASSV request Jan 6 16:29:44 mail dovecot[2208071]: auth-worker(2208404): Debug: conn unix:auth-worker (pid=2208397,uid=489): auth-worker<229>: sql(user@redacted,client-ip,<tgog/jy4erm5j7ZO>): Performing passdb lookup Jan 6 16:29:44 mail dovecot[2208071]: auth-worker(2208404): Debug: conn unix:auth-worker (pid=2208397,uid=489): auth-worker<229>: sql(user@redacted,client-ip,<tgog/jy4erm5j7ZO>): query: SELECT passwd as password, '127.0.0.1' as host, userid as destuser, passwd AS pass, 'Y' AS nologin, 'Y' AS nodelay, 'Y' AS proxy FROM dbmail_users WHERE userid='user@redacted' UNION (SELECT password as password, '127.0.0.1' as host, username as destuser, password AS pass, 'Y' AS nologin, 'Y' AS nodelay, 'Y' AS proxy FROM sasl_fake_auth WHERE username='user@redacted') limit 1; Jan 6 16:29:44 mail dovecot[2208071]: auth-worker(2208404): conn unix:auth-worker (pid=2208397,uid=489): auth-worker<229>: sql(user@redacted,client-ip,<tgog/jy4erm5j7ZO>): Password mismatch Jan 6 16:29:44 mail dovecot[2208071]: auth-worker(2208404): Debug: conn unix:auth-worker (pid=2208397,uid=489): auth-worker<229>: sql(user@redacted,client-ip,<tgog/jy4erm5j7ZO>): Finished passdb lookup Jan 6 16:29:44 mail dovecot[2208071]: auth-worker(2208404): Debug: conn unix:auth-worker (pid=2208397,uid=489): auth-worker<229>: Finished Jan 6 16:29:44 mail dovecot[2208071]: auth: Debug: sql(user@redacted,client-ip,<tgog/jy4erm5j7ZO>): Finished passdb lookup Jan 6 16:29:44 mail dovecot[2208071]: auth: Debug: auth(user@redacted,client-ip,<tgog/jy4erm5j7ZO>): Auth request finished Jan 6 16:29:44 mail dovecot[2208071]: auth: Debug: client in: AUTH#011443#011APOP#011service=pop3#011secured=tls#011session=n58h/jy4a0i5j7ZO#011lip=lan-ip#011rip=client-ip#011lport=995#011rport=18539#011local_name=mail#011resp=<hidden> Jan 6 16:29:44 mail dovecot[2208071]: auth: Debug: sql(user@redacted,client-ip,<n58h/jy4a0i5j7ZO>): Performing passdb lookup Jan 6 16:29:44 mail dovecot[2208071]: auth: Debug: sql(user@redacted,client-ip,<n58h/jy4a0i5j7ZO>): cache hit: <hidden>#011host=127.0.0.1#011destuser=user@redacted#011pass=THIS_SHOULD_NOT_GET_LOGGED#011nologin=Y#011nodelay=Y#011proxy=Y Jan 6 16:29:44 mail dovecot[2208071]: auth: Debug: sql(user@redacted,client-ip,<n58h/jy4a0i5j7ZO>): Finished passdb lookup Jan 6 16:29:44 mail dovecot[2208071]: auth: Debug: auth(user@redacted,client-ip,<n58h/jy4a0i5j7ZO>): Auth request finished Jan 6 16:29:44 mail dovecot[2208071]: auth: Debug: client passdb out: FAIL#011443#011user=user@redacted#011nodelay#011pass=<hidden>#011nodelay=Y Jan 6 16:29:44 mail dovecot[2208071]: pop3-login: Debug: Ignoring unknown passdb extra field: nodelay Jan 6 16:29:44 mail dovecot[2208071]: pop3-login: Debug: Ignoring unknown passdb extra field: nodelay Jan 6 16:29:44 mail dovecot[2208071]: pop3-login: Disconnected (auth failed, 1 attempts in 0 secs): user=<user@redacted>, client-ip, APOP, TLS, TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) Jan 6 16:29:44 mail dovecot[2208071]: auth-worker(2208404): Debug: conn unix:auth-worker (pid=2208397,uid=489): Disconnected: Connection closed (fd=-1) Jan 6 16:29:44 mail dovecot[2208071]: auth: Fatal: master: service(auth): child 2208397 killed with signal 11 (core dumped)h-worker<1>: Handling PASSV request Jan 6 16:20:05 mail dovecot[2208071]: auth: Debug: client in: AUTH#01179#011PLAIN#011service=imap#011session=QY6V2zy4FUm5j7YD#011lip=lan-ip#011rip=client-ip#011lport=143#011rport=18709 Jan 6 16:20:05 mail dovecot[2208071]: auth: Debug: client passdb out: CONT#01179 Jan 6 16:20:05 mail dovecot[2208071]: auth: Debug: client in: CONT<hidden> Jan 6 16:20:05 mail dovecot[2208071]: auth: Debug: sql(user@redacted,client-ip,<QY6V2zy4FUm5j7YD>): Performing passdb lookup Jan 6 16:20:05 mail dovecot[2208071]: auth: Debug: sql(user@redacted,client-ip,<QY6V2zy4FUm5j7YD>): cache expired Jan 6 16:20:05 mail dovecot[2208071]: auth-worker(2208083): Debug: conn unix:auth-worker (pid=2208074,uid=489): auth-worker<235>: Handling PASSV request Jan 6 16:20:05 mail dovecot[2208071]: auth-worker(2208083): Debug: conn unix:auth-worker (pid=2208074,uid=489): auth-worker<235>: sql(user@redacted,client-ip,<QY6V2zy4FUm5j7YD>): Performing passdb lookup Jan 6 16:20:05 mail dovecot[2208071]: auth-worker(2208083): Debug: conn unix:auth-worker (pid=2208074,uid=489): auth-worker<235>: sql(user@redacted,client-ip,<QY6V2zy4FUm5j7YD>): query: SELECT passwd as password, '127.0.0.1' as host, userid as destuser, passwd AS pass, 'Y' AS nologin, 'Y' AS nodelay, 'Y' AS proxy FROM dbmail_users WHERE userid='user@redacted' UNION (SELECT password as password, '127.0.0.1' as host, username as destuser, password AS pass, 'Y' AS nologin, 'Y' AS nodelay, 'Y' AS proxy FROM sasl_fake_auth WHERE username='user@redacted') limit 1; Jan 6 16:20:05 mail dovecot[2208071]: auth-worker(2208083): conn unix:auth-worker (pid=2208074,uid=489): auth-worker<235>: sql(user@redacted,client-ip,<QY6V2zy4FUm5j7YD>): Password mismatch Jan 6 16:20:05 mail dovecot[2208071]: auth-worker(2208083): Debug: conn unix:auth-worker (pid=2208074,uid=489): auth-worker<235>: sql(user@redacted,client-ip,<QY6V2zy4FUm5j7YD>): Finished passdb lookup Jan 6 16:20:05 mail dovecot[2208071]: auth-worker(2208083): Debug: conn unix:auth-worker (pid=2208074,uid=489): auth-worker<235>: Finished Jan 6 16:20:05 mail dovecot[2208071]: auth: Debug: sql(user@redacted,client-ip,<QY6V2zy4FUm5j7YD>): Finished passdb lookup Jan 6 16:20:05 mail dovecot[2208071]: auth: Debug: auth(user@redacted,client-ip,<QY6V2zy4FUm5j7YD>): Auth request finished Jan 6 16:20:05 mail dovecot[2208071]: auth: Debug: client in: AUTH#011215#011APOP#011service=pop3#011secured=tls#011session=ZJWX2zy4VzO5j7YD#011lip=lan-ip#011rip=client-ip#011lport=995#011rport=13143#011local_name=mail#011resp=<hidden> Jan 6 16:20:05 mail dovecot[2208071]: auth: Debug: sql(user@redacted,client-ip,<ZJWX2zy4VzO5j7YD>): Performing passdb lookup Jan 6 16:20:05 mail dovecot[2208071]: auth: Debug: sql(user@redacted,client-ip,<ZJWX2zy4VzO5j7YD>): cache hit: <hidden>#011host=127.0.0.1#011destuser=user@redacted#011pass=THIS_SHOULD_NOT_GET_LOGGED#011nologin=Y#011nodelay=Y#011proxy=Y Jan 6 16:20:05 mail dovecot[2208071]: auth: Debug: sql(user@redacted,client-ip,<ZJWX2zy4VzO5j7YD>): Finished passdb lookup Jan 6 16:20:05 mail dovecot[2208071]: auth: Debug: auth(user@redacted,client-ip,<ZJWX2zy4VzO5j7YD>): Auth request finished Jan 6 16:20:05 mail dovecot[2208071]: auth: Debug: client passdb out: FAIL#011215#011user=user@redacted#011nodelay#011pass=<hidden>#011nodelay=Y Jan 6 16:20:05 mail dovecot[2208071]: pop3-login: Debug: Ignoring unknown passdb extra field: nodelay Jan 6 16:20:05 mail dovecot[2208071]: pop3-login: Debug: Ignoring unknown passdb extra field: nodelay Jan 6 16:20:05 mail dovecot[2208071]: pop3-login: Disconnected (auth failed, 1 attempts in 0 secs): user=<user@redacted>, client-ip, APOP, TLS, TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) Jan 6 16:20:05 mail dovecot[2208071]: auth-worker(2208083): Debug: conn unix:auth-worker (pid=2208074,uid=489): Disconnected: Connection closed (fd=-1) Jan 6 16:20:05 mail dovecot[2208071]: auth: Fatal: master: service(auth): child 2208074 killed with signal 11 (core dumped) Jan 6 16:20:20 mail dovecot[2208071]: auth: Debug: client in: AUTH#011218#011APOP#011service=pop3#011secured=tls#011session=wXyB3Dy4W0i5j7YD#011lip=lan-ip#011rip=client-ip#011lport=995#011rport=18523#011local_name=mail#011resp=<hidden> Jan 6 16:20:20 mail dovecot[2208071]: auth: Debug: sql(user@redacted,client-ip,<wXyB3Dy4W0i5j7YD>): Performing passdb lookup Jan 6 16:20:20 mail dovecot[2208071]: auth: Debug: sql(user@redacted,client-ip,<wXyB3Dy4W0i5j7YD>): cache hit: <hidden>#011host=127.0.0.1#011destuser=user@redacted#011pass=THIS_SHOULD_NOT_GET_LOGGED#011nologin=Y#011nodelay=Y#011proxy=Y Jan 6 16:20:20 mail dovecot[2208071]: auth: Debug: sql(user@redacted,client-ip,<wXyB3Dy4W0i5j7YD>): Finished passdb lookup Jan 6 16:20:20 mail dovecot[2208071]: auth: Debug: auth(user@redacted,client-ip,<wXyB3Dy4W0i5j7YD>): Auth request finished Jan 6 16:20:20 mail dovecot[2208071]: auth: Debug: client passdb out: FAIL#011218#011user=user@redacted#011nodelay#011pass=<hidden>#011nodelay=Y Jan 6 16:20:20 mail dovecot[2208071]: pop3-login: Debug: Ignoring unknown passdb extra field: nodelay Jan 6 16:20:20 mail dovecot[2208071]: pop3-login: Debug: Ignoring unknown passdb extra field: nodelay Jan 6 16:20:20 mail dovecot[2208071]: pop3-login: Disconnected (auth failed, 1 attempts in 0 secs): user=<user@redacted>, client-ip, APOP, TLS, TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) Jan 6 16:20:20 mail dovecot[2208071]: auth-worker(2208392): Debug: conn unix:auth-worker (pid=2208385,uid=489): Disconnected: Connection closed (fd=-1) Jan 6 16:20:20 mail dovecot[2208071]: auth: Fatal: master: service(auth): child 2208385 killed with signal 11 (core dumped) Any help is appreciated thanks Harald -- ITronic Harald Leithner Wiedner Hauptstraße 120/5.1, 1050 Wien, Austria Tel: +43-1-545 0 604 Mobil: +43-699-123 78 4 78 Mail: leithner(a)itronic.at | itronic.at

4 10

Dovecot v2.3.13 released
by Aki Tuomi 13 Jan '21

13 Jan '21

We are pleased to release v2.3.13. Please find it from locations below: https://dovecot.org/releases/2.3/dovecot-2.3.13.tar.gz https://dovecot.org/releases/2.3/dovecot-2.3.13.tar.gz.sig Binary packages in https://repo.dovecot.org/ Docker images in https://hub.docker.com/r/dovecot/dovecot Aki Tuomi Open-Xchange oy --- * CVE-2020-24386: Specially crafted command can cause IMAP hibernate to allow logged in user to access other people's emails and filesystem information. * Metric filter and global event filter variable syntax changed to a SQL-like format. See https://doc.dovecot.org/configuration_manual/event_filter/ * auth: Added new aliases for %{variables}. Usage of the old ones is possible, but discouraged. * auth: Removed RPA auth mechanism, SKEY auth mechanism, NTLM auth mechanism and related password schemes. * auth: Removed passdb-sia, passdb-vpopmail and userdb-vpopmail. * auth: Removed postfix postmap socket + auth: Added new fields for auth server events. These fields are now also available for all auth events. See https://doc.dovecot.org/admin_manual/list_of_events/#authentication-server for details. + imap-hibernate: Added imap_client_hibernated, imap_client_unhibernated and imap_client_unhibernate_retried events. See https://doc.dovecot.org/admin_manual/list_of_events/ for details. + lib-index: Added new mail_index_recreated event. See https://doc.dovecot.org/admin_manual/list_of_events/#mail-index-recreated + lib-sql: Support TLS options for cassandra driver. This requires cpp-driver v2.15 (or later) to work reliably. + lib-storage: Missing $HasAttachment / $HasNoAttachment flags are now added to existing mails if mail_attachment_detection_option=add-flags and it can be done inexpensively. + login proxy: Added login_proxy_max_reconnects setting (default 3) to control how many reconnections are attempted. + login proxy: imap/pop3/submission/managesieve proxying now supports reconnection retrying on more than just connect() failure. Any error except a non-temporary authentication failure will result in reconnect attempts. - auth: Lua passdb/userdb leaks stack elements per call, eventually causing the stack to become too deep and crashing the auth or auth-worker process. - auth: SASL authentication PLAIN mechanism could be used to trigger read buffer overflow. However, this doesn't seem to be exploitable in any way. - auth: v2.3.11 regression: GSSAPI authentication fails because dovecot disallows NUL bytes for it. - dict: Process used too much CPU when iterating keys, because each key used a separate write() syscall. - doveadm-server: Crash could occur if logging was done outside command handling. For example http-client could have done debug logging afterwards, resulting in either segfault or Panic: file http-client.c: line 642 (http_client_context_close): assertion failed: (cctx->clients_list == NULL). - doveadm-server: v2.3.11 regression: Trying to connect to doveadm server process via starttls assert-crashed if there were no ssl=yes listeners: Panic: file master-service-ssl.c: line 22 (master_service_ssl_init): assertion failed: (service->ssl_ctx_initialized). - fts-solr: HTTP requests may have assert-crashed: Panic: file http-client-request.c: line 1232 (http_client_request_send_more): assertion failed: (req->payload_input != NULL) - imap: IMAP NOTIFY could crash with a segmentation fault due to a bad configuration that causes errors. Sending the error responses to the client can cause the segmentation fault. This can for example happen when several namespaces use the same mail storage location. - imap: IMAP NOTIFY used on a shared namespace that doesn't actually exist (e.g. public namespace for a nonexistent user) can crash with a panic: Panic: Leaked view for index /tmp/home/asdf/mdbox/dovecot.list.index: Opened in (null):0 - imap: IMAP session can crash with QRESYNC extension if many changes are done before asking for expunged mails since last sync. - imap: Process might hang indefinitely if client disconnects after sending some long-running commands pipelined, for example FETCH+LOGOUT. - lib-compress: Mitigate crashes when configuring a not compiled in compression. Errors with compression configuration now distinguish between not supported and unknown. - lib-compression: Using xz/lzma compression in v2.3.11 could have written truncated output in some situations. This would result in "Broken pipe" read errors when trying to read it back. - lib-compression: zstd compression could have crashed in some situations: Panic: file ostream.c: line 287 (o_stream_sendv_int): assertion failed: (!stream->blocking) - lib-dict: dict client could have crashed in some rare situations when iterating keys. - lib-http: Fix several assert-crashes in HTTP client. - lib-index: v2.3.11 regression: When mails were expunged at the same time as lots of new content was being saved to the cache (e.g. cache file was lost and is being re-filled) a deadlock could occur with dovecot.index.cache / dovecot.index.log. - lib-index: v2.3.11 regression: dovecot.index.cache file was being purged (rewritten) too often when it had a field that hadn't been accessed for over 1 month, but less than 2 months. Every cache file change caused a purging in this situation. - lib-mail: MIME parts were not returned correctly by Dovecot MIME parser. Regression caused by fixing CVE-2020-12100. - lib-mail: When max nested MIME parts were reached, IMAP BODYSTRUCTURE was written in a way that may have caused confusion for both IMAP clients and Dovecot itself when parsing it. The truncated part is now written out using application/octet-stream MIME type. - lib-mail: v2.3.11 regression: Mail delivery / parsing crashed when the 10000th MIME part was message/rfc822 (or if parent was multipart/digest): Panic: file message-parser.c: line 167 (message_part_append): assertion failed: (ctx->total_parts_count <= ctx->max_total_mime_parts). - lib-oauth2: Dovecot incorrectly required oauth2 server introspection reply to contain username with invalid token. - lib-ssl-iostream, lib-dcrypt: Fix building with OpenSSL that has deprecated APIs disabled. - lib-storage: When mail's size is different from the cached one (in dovecot.index.cache or Maildir S=size in the filename), this is handled by logging "Cached message size smaller/larger than expected" error. However, in some situations this also ended up crashing with: Panic: file istream.c: line 315 (i_stream_read_memarea): assertion failed: (old_size <= _stream->pos - _stream->skip). - lib-storage: v2.3 regression: Copying/moving mails was taking much more memory than before. This was mainly visible when copying/moving thousands of mails in a single transaction. - lib-storage: v2.3.11 regression: Searching messages assert-crashed (without FTS): Panic: file message-parser.c: line 174 (message_part_finish): assertion failed: (ctx->nested_parts_count > 0). - lib: Dovecot v2.3 moved signal handlers around in ioloops, causing more CPU usage than in v2.2. - lib: Fixed JSON parsing: '\' escape sequence may have wrongly resulted in error if it happened to be at read boundary. Any NUL characters and '\u0000' will now result in parsing error instead of silently truncating the data. - lmtp, submission: Server may hang if SSL client connection disconnects during the delivery. If this happened repeated, it could have ended up reaching process_limit and preventing any further lmtp/submission deliveries. - lmtp: Proxy does not always properly log TLS connection problems as errors; in some cases, only a debug message is logged if enabled. - lmtp: The LMTP service can hang when commands are pipelined. This can particularly occur when one command in the middle of the pipeline fails. One example of this occurs for proxied LMTP transactions in which the final DATA or BDAT command is pipelined after a failing RCPT command. - login-proxy: The login_source_ips setting has no effect, and therefore the proxy source IPs are not cycled through as they should be. - master: Process was using 100% CPU in some situations when a broken service was being throttled. - pop3-login: POP3 login would fail with "Input buffer full" if the initial response for SASL was too long. - stats: Crash would occur when generating openmetrics data for metrics using aggregating functions.

5 6

migration with doveadm backup to new cluster running dovecot 2.2.36 and replicator
by Thomas Winterstein 12 Jan '21

12 Jan '21

Hello everyone, we are working on migrating from dovecot 2.0.9 (maildir) to 2.2.36 (mdbox). The new cluster has two backend mail servers which replicate through doveadm replicator. To move the data initially we use doveadm backup (imapc). Our migration command doveadm -o mail_fsync=never backup -R -u $user imapc: To test the replication of new and purge of old mails with live data changes we ran imapc on a daily basis but encountered the problem that some mailboxes multiplied in size. We then made sure that imapc and replication don't run at the same time but after the first incremental imapc process, we still had the same problems. The doveadm-backup man-page states that it's possible to run it multiple times during migration. But is it also possible to have the replicator running in between? From our understanding the doveadm backup should just work as an imap connection between the servers, synchronizing all changes made on the source to the destination. Or does the conversion from maildir to mdbox format in our case produce the problems? If you're not supposed to run the replicator before having fully migrated, how can we shorten the downtime? rsync? And how can we be sure that similar problems don't occur after the migration if we can't test all mechanisms together with live data? thanks -- Thomas Winterstein

3 7

Dovecot FST not using plugins
by Joan Moreau 12 Jan '21

12 Jan '21

Hello, With recent git version of dovecot, I can see that the FTS does not use the configured plugin anymore, but tries to sort the mailbox directly on the spot (which is of course very painful). Is there a change in the configuration file in order to recover the old behavior ? or something else has changed ? Thank you Joan

2 2

Remap login before authentication
by Miloslav Hůla 11 Jan '21

11 Jan '21

Hi, with Dovecot 2.3.4 I would like to allow user to login with two different usernames: - USERNAME (no domain) - now works - name.surname(a)domain.tld - would like to add Problem is, that the only authentication method I have is LDAP bind by USERNAME. Now I use: ============ passdb { driver = ldap args = /etc/dovecot/dovecot-ldap.conf.ext } # Args uris = ldaps://ldap.domain.tld auth_bind = yes auth_bind_userdn = uid=%u,dc=domain,dc=tld base = ============ I know passdb can remap user&domain, but I have no password hash at all. And for example '{SASL}' is not supported password scheme to return e.g. from SQL passdb. Is there any way how to achive this? Maybe somehow remap username in first passdb and then continue to LDAP bind? 1. login as name.surname(a)domain.tld 2. remap to USERNAME 3. do the LDAP bind Milo

2 5

Re: status of test code
by steve＠keptprivate.com 11 Jan '21

11 Jan '21

Update:I was finally able to build 2.3.13 on centos 8 (8.3). I managed this by going back to the qmailtoaster spec file, removing a few things no longer relevant (vpopmail) and disabling all the tests. Most tests were still running but there were also many that did not. The good news is the resulting executable in the RPM no longer complains about not being able to find libdovecot.so. i've done some basic testing on imap and everything appears to be working.Someone who maintains the tests and rpm build should really have a look. Doing a build on a fresh centos 8 machine, as I was able to with the qmailtoaster source rpm, should really be much simpler. My impression is the current spec file may have edits that were eroneously committed? SteveSent from my T-Mobile 4G LTE device------ Original message------From: steve(a)keptprivate.comDate: Sat, Jan 9, 2021 3:42 PMTo: dovecot(a)dovecot.org;Cc: Subject:status of test codeHi, I'm continuing to try to build 2.3.13 with a source RPM. At this point I've taken the source zip file and I'm working with the previously working qmailtoaster SPEC file and RPM build process. The toaster SPEC file runs the built-in dovecot tests after build... 2.3.11 would make it through all the tests with a few minor exceptions. 2.3.13 seems no longer able to run the test is lib-ssl-iostream or lib-lua (and perhaps others, but that's as far as I've gotten). I can selectively disable the tests to make progress, but it raises the question of what the plans are for the built-in tests. Also, I continue to not be able to find where all the testing is turned on/off at once? I'm sure it will be obvious when someone tells me but please tell me, because I'm pulling my hair out. Steve

2 1

lzma mdboxes with unexpected EOF
by Bjoern Franke 10 Jan '21

10 Jan '21

Hi, I'm running dovecot 2.3.13 (until 05.01. it was 2.3.11.3) on Arch Linux and used lzma compressed mdboxes. Yesterday a user called me that she is missing all mails from the beginning of the month until now. I took a look into the logs and saw several "lzma.read [...] unexpected EOF at <....>". As I had no clue why the mdboxes are broken, I tried to convert all 3 mailboxes to Maildir using "doveadm sync" to prevent further issues and stumbled upon several lzma errors for mdbox files of my own user. So I wrote a script which took the offset and size via "doveadm dump" und then dds the xz parts out of the broken mdboxes and extracts them via 7z. But I'm wondering why that happened at all. I stumpled upon [1] but there was no further discussion about it. Best Regards Bjoern [1]https://dovecot.org/pipermail/dovecot/2019-September/117007.html

1 1

auth error log format change
by Adrian Minta 10 Jan '21

10 Jan '21

Hi, we recently upgraded to 2.3.13 from 2.3.11 and the log format for auth errors seems to have change. This change may have an adverse effect on fail2ban rules. Is there a way to revert to old format ? Thank you ! Old log example: Jan 10 00:32:37 mail dovecot: auth-worker(50806): sql(name(a)domain,112.18.92.0.104,<Dg/+P3+49cMFt1xo>): Password mismatch Jan 10 03:20:02 mail dovecot: auth-worker(26057): sql(name(a)domain,112.18.92.0.104,<oMyxloG4M7AFt1xo>): Password mismatch New log example: Jan 10 00:32:37 mail dovecot: auth-worker(50806): conn unix:auth-worker (pid=22503,uid=0): auth-worker<585236>: sql(name(a)domain,112.18.92.0.104,<Dg/+P3+49cMFt1xo>): Password mismatch Jan 10 03:20:02 mail dovecot: auth-worker(26057): conn unix:auth-worker (pid=25928,uid=0): auth-worker<4234337>: sql(name(a)domain,112.18.92.0.104,<oMyxloG4M7AFt1xo>): Password mismatch -- Best regards, Adrian Minta

1 0

problem building on centos 8 (8.3 kernel)
by steve＠keptprivate.com 09 Jan '21

09 Jan '21

Hi, I'm converting from qmailtoaster/vpopmail build. When I try to build dovecot-2.3.13-2.src.rpm for centos 8.3 the first thing I run into is this: + sed -i 's|/etc/ssl|/etc/pki/dovecot|' doc/mkcert.sh doc/example-config/conf.d/10-ssl.conf + '[' -e buildinfo.commit ']' ++ head -1 buildinfo.commit + COMMIT=89f716dc2ec7362864a368d32533184b55fb7831 ++ /bin/sh /home/build/rpmbuild/SOURCES/lsb_release -is /bin/sh: /home/build/rpmbuild/SOURCES/lsb_release: No such file or directory + ID= error: Bad exit status from /var/tmp/rpm-tmp.WFaLYQ (%build) RPM build errors: Macro expanded in comment on line 455: %{_libdir}/dovecot/settings Bad exit status from /var/tmp/rpm-tmp.WFaLYQ (%build) I can get past this with an edit to the dovecot.spec file (removing sourcedir): if [ -e "buildinfo.commit" ]; then COMMIT=`head -1 buildinfo.commit` ID=`/bin/sh %̶{̶_̶s̶o̶u̶r̶c̶e̶d̶i̶r̶}̶/̶lsb_release -is` RELEASE=`/bin/sh %̶{̶_̶s̶o̶u̶r̶c̶e̶d̶i̶r̶}̶/̶lsb_release -rs` CODENAME=`/bin/sh %̶{̶_̶s̶o̶u̶r̶c̶e̶d̶i̶r̶}̶/̶lsb_release -cs` ARCH=`arch` fi The RPM builds but it fails to run with this message in the logs: Jan 6 20:52:11 beta1 systemd[1]: Starting Dovecot IMAP/POP3 email server... Jan 6 20:52:11 beta1 systemd[1]: Started Dovecot IMAP/POP3 email server. Jan 6 20:52:11 beta1 dovecot[356909]: /usr/sbin/dovecot: error while loading shared libraries: libdovecot.so.0: cannot open shared object file: No such file or directory Jan 6 20:52:11 beta1 systemd[1]: dovecot.service: Main process exited, code=exited, status=127/n/a Jan 6 20:52:11 beta1 systemd[1]: dovecot.service: Failed with result 'exit-code'. Any ideas what I have going wrong? Also, a side question, when I build the rpm it's not running the extensive tests that the old qmailtoaster source rpm used to run. I've looked through the spec file and I don't really see where to turn that back on. Sorry if any of this is stupid, but I'm new to building directly from the dovecot repo. Steve

3 3

Dovecot 2.3.13 source rpm build fails on Centos 8
by steve＠keptprivate.com 08 Jan '21

08 Jan '21

I tried to post this in a more nuanced way, but the fact is the latest source RPM does not build on the latest Centos 8.> + sed -i 's|/etc/ssl|/etc/pki/dovecot|' doc/mkcert.sh doc/example-config/conf.d/10-ssl.conf > + '[' -e buildinfo.commit ']' > ++ head -1 buildinfo.commit > + COMMIT=89f716dc2ec7362864a368d32533184b55fb7831 > ++ /bin/sh /home/build/rpmbuild/SOURCES/lsb_release -is > /bin/sh: /home/build/rpmbuild/SOURCES/lsb_release: No such file or directory > + ID= > error: Bad exit status from /var/tmp/rpm-tmp.WFaLYQ (%build) > > > RPM build errors: > Macro expanded in comment on line 455: %{_libdir}/dovecot/settings > > Bad exit status from /var/tmp/rpm-tmp.WFaLYQ (%build) > > I can get past this with an edit to the dovecot.spec file (removing sourcedir): > > if [ -e "buildinfo.commit" ]; then > COMMIT=`head -1 buildinfo.commit` > ID=`/bin/sh %̶{̶_̶s̶o̶u̶r̶c̶e̶d̶i̶r̶}̶/̶lsb_release -is` > RELEASE=`/bin/sh %̶{̶_̶s̶o̶u̶r̶c̶e̶d̶i̶r̶}̶/̶lsb_release -rs` > CODENAME=`/bin/sh %̶{̶_̶s̶o̶u̶r̶c̶e̶d̶i̶r̶}̶/̶lsb_release -cs` > ARCH=`arch` > fiCan someone who knows the source rpm build config. please respond?The committed spec file contains errors.ThanksSent from my T-Mobile 4G LTE device

3 6

2.3.13: newly introduced TLS bug : tls_construct_server_key_exchange
by Marius Schwarz 08 Jan '21

08 Jan '21

Hi, since the update from 2.3.11 to 2.3.13 some clients generate this bug : TLS handshaking: SSL_accept() failed: error:141EC044:SSL routines:tls_construct_server_key_exchange:internal error As it looks for now, they use the old SSL approach on Ports 993 and 995. SSL Config says: ssl = yes ssl_cert = </etc/pki/tls/certs/exim.pem ( Lets Encrypt R3 based cert ) ssl_key = </etc/pki/tls/private/exim.pem ssl_dh_parameters_length = 2048 ssl_dh= </etc/dovecot/dh.pem ssl_cipher_list = PROFILE=SYSTEM OS: Fedora 32 X86_64 Ext4 file storage on local disks Versions: dovecot-2.3.13-1.fc32.x86_64 openssl-1.1.1i-1.fc32.x86_64 best regards, Marius Schwarz

2 2

Re: problem building on centos 8 (8.3 kernel)
by steve＠keptprivate.com 07 Jan '21

07 Jan '21

Another thought... Could I use a different build mechanism that would result in the same installation rpm? There's no reason I have to use source rpms, I'm just used to it because of qmailtoaster.SteveSent from my T-Mobile 4G LTE device------ Original message------From: steve(a)keptprivate.comDate: Thu, Jan 7, 2021 3:48 PMTo: Aki Tuomi;dovecot(a)dovecot.org;Cc: Subject:Re: problem building on centos 8 (8.3 kernel) Any ideas about the lsb_release error in the spec file and where that came from? I have a very vanilla centos 8 install I'm trying to bulid on. Any thoughts appreciated because I'm stuck and at something of a loss on what to try next. My first thought is to look at spec file revisions.SteveSent from my T-Mobile 4G LTE device------ Original message------From: Aki TuomiDate: Thu, Jan 7, 2021 3:10 AMTo: steve@keptprivate.com;dovecot@dovecot.org;Cc: Subject:Re: problem building on centos 8 (8.3 kernel)> On 07/01/2021 03:57 steve(a)keptprivate.com wrote: > > > Hi, > > I'm converting from qmailtoaster/vpopmail build. > When I try to build dovecot-2.3.13-2.src.rpm for centos 8.3 the first thing I run into is this: > > + sed -i 's|/etc/ssl|/etc/pki/dovecot|' doc/mkcert.sh doc/example-config/conf.d/10-ssl.conf > + '[' -e buildinfo.commit ']' > ++ head -1 buildinfo.commit > + COMMIT=89f716dc2ec7362864a368d32533184b55fb7831 > ++ /bin/sh /home/build/rpmbuild/SOURCES/lsb_release -is > /bin/sh: /home/build/rpmbuild/SOURCES/lsb_release: No such file or directory > + ID= > error: Bad exit status from /var/tmp/rpm-tmp.WFaLYQ (%build) > > > RPM build errors: > Macro expanded in comment on line 455: %{_libdir}/dovecot/settings > > Bad exit status from /var/tmp/rpm-tmp.WFaLYQ (%build) > > I can get past this with an edit to the dovecot.spec file (removing sourcedir): > > if [ -e "buildinfo.commit" ]; then > COMMIT=`head -1 buildinfo.commit` > ID=`/bin/sh %̶{̶_̶s̶o̶u̶r̶c̶e̶d̶i̶r̶}̶/̶lsb_release -is` > RELEASE=`/bin/sh %̶{̶_̶s̶o̶u̶r̶c̶e̶d̶i̶r̶}̶/̶lsb_release -rs` > CODENAME=`/bin/sh %̶{̶_̶s̶o̶u̶r̶c̶e̶d̶i̶r̶}̶/̶lsb_release -cs` > ARCH=`arch` > fi > > The RPM builds but it fails to run with this message in the logs: > > Jan 6 20:52:11 beta1 systemd[1]: Starting Dovecot IMAP/POP3 email server... > Jan 6 20:52:11 beta1 systemd[1]: Started Dovecot IMAP/POP3 email server. > Jan 6 20:52:11 beta1 dovecot[356909]: /usr/sbin/dovecot: error while loading shared libraries: libdovecot.so.0: cannot open shared object > file: No such file or directory > Jan 6 20:52:11 beta1 systemd[1]: dovecot.service: Main process exited, code=exited, status=127/n/a > Jan 6 20:52:11 beta1 systemd[1]: dovecot.service: Failed with result 'exit-code'. > > Any ideas what I have going wrong? > > Also, a side question, when I build the rpm it's not running the extensive tests that the old qmailtoaster source rpm used to run. I've > looked through the spec file and I don't really see where to turn that back on. > > Sorry if any of this is stupid, but I'm new to building directly from the dovecot repo. > > Steve I think the file is installed under /usr/lib64/, so check ldd /usr/lib64/libdovecot.so.0 Is there some reason you are building the rpms yourself? Aki

1 0

Re: problem building on centos 8 (8.3 kernel)
by steve＠keptprivate.com 07 Jan '21

07 Jan '21

Any ideas about the lsb_release error in the spec file and where that came from? I have a very vanilla centos 8 install I'm trying to bulid on. Any thoughts appreciated because I'm stuck and at something of a loss on what to try next. My first thought is to look at spec file revisions.SteveSent from my T-Mobile 4G LTE device------ Original message------From: Aki TuomiDate: Thu, Jan 7, 2021 3:10 AMTo: steve@keptprivate.com;dovecot@dovecot.org;Cc: Subject:Re: problem building on centos 8 (8.3 kernel)> On 07/01/2021 03:57 steve(a)keptprivate.com wrote: > > > Hi, > > I'm converting from qmailtoaster/vpopmail build. > When I try to build dovecot-2.3.13-2.src.rpm for centos 8.3 the first thing I run into is this: > > + sed -i 's|/etc/ssl|/etc/pki/dovecot|' doc/mkcert.sh doc/example-config/conf.d/10-ssl.conf > + '[' -e buildinfo.commit ']' > ++ head -1 buildinfo.commit > + COMMIT=89f716dc2ec7362864a368d32533184b55fb7831 > ++ /bin/sh /home/build/rpmbuild/SOURCES/lsb_release -is > /bin/sh: /home/build/rpmbuild/SOURCES/lsb_release: No such file or directory > + ID= > error: Bad exit status from /var/tmp/rpm-tmp.WFaLYQ (%build) > > > RPM build errors: > Macro expanded in comment on line 455: %{_libdir}/dovecot/settings > > Bad exit status from /var/tmp/rpm-tmp.WFaLYQ (%build) > > I can get past this with an edit to the dovecot.spec file (removing sourcedir): > > if [ -e "buildinfo.commit" ]; then > COMMIT=`head -1 buildinfo.commit` > ID=`/bin/sh %̶{̶_̶s̶o̶u̶r̶c̶e̶d̶i̶r̶}̶/̶lsb_release -is` > RELEASE=`/bin/sh %̶{̶_̶s̶o̶u̶r̶c̶e̶d̶i̶r̶}̶/̶lsb_release -rs` > CODENAME=`/bin/sh %̶{̶_̶s̶o̶u̶r̶c̶e̶d̶i̶r̶}̶/̶lsb_release -cs` > ARCH=`arch` > fi > > The RPM builds but it fails to run with this message in the logs: > > Jan 6 20:52:11 beta1 systemd[1]: Starting Dovecot IMAP/POP3 email server... > Jan 6 20:52:11 beta1 systemd[1]: Started Dovecot IMAP/POP3 email server. > Jan 6 20:52:11 beta1 dovecot[356909]: /usr/sbin/dovecot: error while loading shared libraries: libdovecot.so.0: cannot open shared object > file: No such file or directory > Jan 6 20:52:11 beta1 systemd[1]: dovecot.service: Main process exited, code=exited, status=127/n/a > Jan 6 20:52:11 beta1 systemd[1]: dovecot.service: Failed with result 'exit-code'. > > Any ideas what I have going wrong? > > Also, a side question, when I build the rpm it's not running the extensive tests that the old qmailtoaster source rpm used to run. I've > looked through the spec file and I don't really see where to turn that back on. > > Sorry if any of this is stupid, but I'm new to building directly from the dovecot repo. > > Steve I think the file is installed under /usr/lib64/, so check ldd /usr/lib64/libdovecot.so.0 Is there some reason you are building the rpms yourself? Aki

1 0

Re: problem building on centos 8 (8.3 kernel)
by steve＠keptprivate.com 07 Jan '21

07 Jan '21

Hi,Yes, a whole subdir "dovecot" in /usr/lib64 with files. The actual so.0 file is a link to an so.0.0.0 file.I was able to successfully build test run the source rpm from qmailtoaster 2.3.11.I'm building from source because I have a patch I want to apply. My suspicion is the problem is config. related given the odd lsb_release issue that happens right at the start of the build.I've tried to review the spec files for differences, qmailtoaster 2.3.11 vs 2.3.13 but the differences are significant.SteveSent from my T-Mobile 4G LTE device------ Original message------From: Aki TuomiDate: Thu, Jan 7, 2021 3:10 AMTo: steve@keptprivate.com;dovecot@dovecot.org;Cc: Subject:Re: problem building on centos 8 (8.3 kernel)> On 07/01/2021 03:57 steve(a)keptprivate.com wrote: > > > Hi, > > I'm converting from qmailtoaster/vpopmail build. > When I try to build dovecot-2.3.13-2.src.rpm for centos 8.3 the first thing I run into is this: > > + sed -i 's|/etc/ssl|/etc/pki/dovecot|' doc/mkcert.sh doc/example-config/conf.d/10-ssl.conf > + '[' -e buildinfo.commit ']' > ++ head -1 buildinfo.commit > + COMMIT=89f716dc2ec7362864a368d32533184b55fb7831 > ++ /bin/sh /home/build/rpmbuild/SOURCES/lsb_release -is > /bin/sh: /home/build/rpmbuild/SOURCES/lsb_release: No such file or directory > + ID= > error: Bad exit status from /var/tmp/rpm-tmp.WFaLYQ (%build) > > > RPM build errors: > Macro expanded in comment on line 455: %{_libdir}/dovecot/settings > > Bad exit status from /var/tmp/rpm-tmp.WFaLYQ (%build) > > I can get past this with an edit to the dovecot.spec file (removing sourcedir): > > if [ -e "buildinfo.commit" ]; then > COMMIT=`head -1 buildinfo.commit` > ID=`/bin/sh %̶{̶_̶s̶o̶u̶r̶c̶e̶d̶i̶r̶}̶/̶lsb_release -is` > RELEASE=`/bin/sh %̶{̶_̶s̶o̶u̶r̶c̶e̶d̶i̶r̶}̶/̶lsb_release -rs` > CODENAME=`/bin/sh %̶{̶_̶s̶o̶u̶r̶c̶e̶d̶i̶r̶}̶/̶lsb_release -cs` > ARCH=`arch` > fi > > The RPM builds but it fails to run with this message in the logs: > > Jan 6 20:52:11 beta1 systemd[1]: Starting Dovecot IMAP/POP3 email server... > Jan 6 20:52:11 beta1 systemd[1]: Started Dovecot IMAP/POP3 email server. > Jan 6 20:52:11 beta1 dovecot[356909]: /usr/sbin/dovecot: error while loading shared libraries: libdovecot.so.0: cannot open shared object > file: No such file or directory > Jan 6 20:52:11 beta1 systemd[1]: dovecot.service: Main process exited, code=exited, status=127/n/a > Jan 6 20:52:11 beta1 systemd[1]: dovecot.service: Failed with result 'exit-code'. > > Any ideas what I have going wrong? > > Also, a side question, when I build the rpm it's not running the extensive tests that the old qmailtoaster source rpm used to run. I've > looked through the spec file and I don't really see where to turn that back on. > > Sorry if any of this is stupid, but I'm new to building directly from the dovecot repo. > > Steve I think the file is installed under /usr/lib64/, so check ldd /usr/lib64/libdovecot.so.0 Is there some reason you are building the rpms yourself? Aki

1 0

Server searches not working for 1 user only
by Ignacio García 07 Jan '21

07 Jan '21

Hi there I'm using dovecot version 2.3.4.1 precompiled in Debian stretch-backports (with Maildir, and Lucene FTS). Everything seems to be running fine but server searches by one user (precisely me) using roundcube 1.4.8. For all other checked users server searches work fine. My account is not particularly differnt from others, aprox same amount of mail. The only difference with others is that I use/check my mail constantly and from different devices at the same time (roundcube, a couple of instances of Thunderbird and Aquamail for Android always open). I only use IMAP. Googling around I read about deleting cache/index files with Dovecot recreating them automagically, but since I haven't found anything official on the Wiki, before I do something potentially stupid I wanted to confirm with you all for guidance on this Thanks so much in advance Ignacio

1 0

CVE-2020-24386: IMAP hibernation allows accessing other peoples mail
by Aki Tuomi 07 Jan '21

07 Jan '21

Open-Xchange Security Advisory 2021-01-04 Product: Dovecot Vendor: OX Software GmbH Internal reference: DOP-2009 (Bug ID) Vulnerability type: CWE-150: Improper Neutralization of Escape, Meta, or Control Sequences Vulnerable version: 2.2.26-2.3.11.3 Vulnerable component: imap Report confidence: Confirmed Solution status: Fixed by Vendor Fixed version: 2.3.13 Vendor notification: 2020-08-17 Solution date: 2020-08-27 Public disclosure: 2021-01-04 CVE reference: CVE-2020-24386 CVSS: 8.2 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N) Vulnerability Details: When imap hibernation is active, an attacker can cause Dovecot to discover file system directory structure and access other users' emails using specially crafted command. The attacker must have valid credentials to access the mail server. Risk: Attacker can access other users' emails and filesystem information. Workaround: Operators can choose to disable IMAP hibernation. IMAP hibernation is not on by default. To ensure imap hibernation is disabled, make sure imap_hibernate_timeout is set to 0 or unset. Solution: Operators should update to 2.3.13 or later version.

6 6

systemd-homed
by Yilin Wei 07 Jan '21

07 Jan '21

Hi, I’ve been looking into a problem with a local dovecot setup with ~systemd-homed~ and uses PAM authentication. To give a brief overview, ~systemd-homed~ mounts the users home directory upon particular authencation calls (which is configurable through ~/etc/pam.d~). Dovecot currently supports PAM authentication perfectly fine — the problem comes when a system has systemd-homed. This is because the session is created and deleted immediately afterwards [1]. This is a problem because if the server isn’t busy, systemd-homed can run it’s cleanup which causes the home directory to be unavailable once again [2]. To support this properly, ideally the whole of the imap/pop3/lda session needs to happen before the deletion of the session. Does the imap session happen within a ~verify_plain~ [3] call? If not, are there any other authentication backends which currently need to keep a live token? Yilin [1] https://github.com/dovecot/core/blob/266e54b7b8c34c9a58dd60a2e53c5ca7d1deae… [2] https://dovecot.org/pipermail/dovecot/2019-April/115559.html [3] https://github.com/dovecot/core/blob/266e54b7b8c34c9a58dd60a2e53c5ca7d1deae…

2 1

multiple mailstores
by Alexander Rivanykov 07 Jan '21

07 Jan '21

2 1

Dovecot + sis problem
by Michał Kiljański 07 Jan '21

07 Jan '21

Hi, My setup is: mail_attachment_dir = /var/mail/attachments mail_attachment_hash = %{sha512} mail_attachment_min_size = 64k mail_attachment_fs = sis posix Something works - but I expected that is one instance of file, and this file is linked to messages. But here in folder I have got this: sudo ls -la /var/mail/attachments/8b/67/ -rw-rw-rw- 3 buser dovecot 5425280 Jan 5 23:13 8b67b29a73b74ecf48e17e789051602cec13aa78cc01c06c8eee1ca4be7c8e07f700cdc9e9ca0381fa3541bdd4e26289de1d7eee763233dfaa0a200a264e5258-0258913a92f2f45f0d700000035f3f08 -rw-rw-rw- 1 cuser dovecot 5425280 Jan 5 23:13 8b67b29a73b74ecf48e17e789051602cec13aa78cc01c06c8eee1ca4be7c8e07f700cdc9e9ca0381fa3541bdd4e26289de1d7eee763233dfaa0a200a264e5258-28571b018ff2f45f0c700000035f3f08 -rw-rw-rw- 3 buser dovecot 5425280 Jan 5 23:13 8b67b29a73b74ecf48e17e789051602cec13aa78cc01c06c8eee1ca4be7c8e07f700cdc9e9ca0381fa3541bdd4e26289de1d7eee763233dfaa0a200a264e5258-50315d3a8ef2f45f0a700000035f3f08 -rw-rw-rw- 1 auser dovecot 5425280 Jan 5 23:13 8b67b29a73b74ecf48e17e789051602cec13aa78cc01c06c8eee1ca4be7c8e07f700cdc9e9ca0381fa3541bdd4e26289de1d7eee763233dfaa0a200a264e5258-586cdb378ef2f45f07700000035f3f08 drwxrwsrwx 2 buser dovecot 4096 Jan 5 23:13 hashes sudo ls -la /var/mail/attachments/8b/67/hashes/ -rw-rw-rw- 3 buser dovecot 5425280 Jan 5 23:13 8b67b29a73b74ecf48e17e789051602cec13aa78cc01c06c8eee1ca4be7c8e07f700cdc9e9ca0381fa3541bdd4e26289de1d7eee763233dfaa0a200a264e5258 What is wrog? How to setup SIS to get one instance of file? Regards Michal

2 2

Pigeonhole v0.5.13 released
by Aki Tuomi 06 Jan '21

06 Jan '21

We are pleased to release pigeonhole 0.5.13. You can download it from locations below: https://pigeonhole.dovecot.org/releases/2.3/dovecot-2.3-pigeonhole-0.5.13.t… https://pigeonhole.dovecot.org/releases/2.3/dovecot-2.3-pigeonhole-0.5.13.t… Binary packages in https://repo.dovecot.org/ Docker images in https://hub.docker.com/r/dovecot/dovecot Aki Tuomi Open-Xchange oy --- - duplicate: The test was handled badly in a multiscript (sieve_before, sieve_after) scenario in which an earlier script in the sequence with a duplicate test succeeded, while a later script caused a runtime failure. In that case, the message is recorded for duplicate tracking, while the message may not actually have been delivered in the end. - editheader: Sieve interpreter entered infinite loop at startup when the "editheader" configuration listed an invalid header name. This problem can only be triggered by the administrator. - relational: The Sieve relational extension can cause a segfault at compile time. This is triggered by invalid script syntax. The segfault happens when this match type is the last argument of the test command. This situation is not possible in a valid script; positional arguments are normally present after that, which would prevent the segfault. - sieve: For some Sieve commands the provided mailbox name is not properly checked for UTF-8 validity, which can cause assert crashes at runtime when an invalid mailbox name is encountered. This can be caused by the user by writing a bad Sieve script involving the affected commands ("mailboxexists", "specialuse_exists"). This can be triggered by the remote sender only when the user has written a Sieve script that passes message content to one of the affected commands. - sieve: Large sequences of 8-bit octets passed to certain Sieve commands that create or modify message headers that allow UTF-8 text (vacation, notify and addheader) can cause the delivery or IMAP process (when IMAPSieve is used) to enter a memory-consuming semi-infinite loop that ends when the process exceeds its memory limits. Logged in users can cause these hangs only for their own processes.

2 1

doveadm backup only working once?
by Engelbert Torremans 06 Jan '21

06 Jan '21

All, For the past 2 weeks I have been trying to get dovecot mail backup working between 2 debian 10 machines. Both machines are running the same OS (Debian 10) and configuration wise they are similar (except of course ip addresses, hostnames etc). My "main" machine is called "server" and the 2nd machine is "server2". See below for the dovecot -n output on server2. I created a testuser called synctest on both server1 and server2 and have sent a couple (2) email messages to synctest@server. Those testmessages are now present in /var/mail/synctest mbox file on server1. When trying to create a backup from server->server2 for user synctest I use this command: #doveadm -D -v backup -R -f -u synctest tcp:192.168.3.1:12345 (using something similar from server1 -> server2 like this: #doveadm -D -v backup -f -u synctest tcp:192.168.3.2:12345 has the same results btw) The first attempte appears to be working OK but the the 2nd attempt (nothing was changed on server1 before the 2nd attempt) fails with soemthing like: Error: Couldn't delete mailbox INBOX: Permission denied Before I can get a succesfull backup again I need to do this (on server2): #rm /var/mail/synctest #rm -r ~syncuser/mail/index/INBOX #doveadm mailbox delete -u synctest INBOX (if I don't do the rm /var/mail/synctest before the doveadm mailbox delete command I will also get a: Error: Can't delete mailbox INBOX: Permission denied Anybody any idea what is happening here? Should I enable replicator and/or aggregator? Output of 1st and 2nd dovadm backup attempt is below: root@server2:/home/synctest/mail# doveadm -D -v backup -R -f -u synctest tcp:192.168.3.1:12345 Debug: Loading modules from directory: /usr/lib/dovecot/modules/doveadm Debug: Skipping module doveadm_acl_plugin, because dlopen() failed: /usr/lib/dovecot/modules/doveadm/lib10_doveadm_acl_plugin.so: undefined symbol: acl_user_module (this is usually intentional, so just ignore this message) Debug: Skipping module doveadm_expire_plugin, because dlopen() failed: /usr/lib/dovecot/modules/doveadm/lib10_doveadm_expire_plugin.so: undefined symbol: expire_set_deinit (this is usually intentional, so just ignore this message) Debug: Skipping module doveadm_quota_plugin, because dlopen() failed: /usr/lib/dovecot/modules/doveadm/lib10_doveadm_quota_plugin.so: undefined symbol: quota_user_module (this is usually intentional, so just ignore this message) Debug: Module loaded: /usr/lib/dovecot/modules/doveadm/lib10_doveadm_sieve_plugin.so Debug: Skipping module doveadm_fts_lucene_plugin, because dlopen() failed: /usr/lib/dovecot/modules/doveadm/lib20_doveadm_fts_lucene_plugin.so: undefined symbol: lucene_index_iter_deinit (this is usually intentional, so just ignore this message) Debug: Skipping module doveadm_fts_plugin, because dlopen() failed: /usr/lib/dovecot/modules/doveadm/lib20_doveadm_fts_plugin.so: undefined symbol: fts_user_get_language_list (this is usually intentional, so just ignore this message) Debug: Skipping module doveadm_mail_crypt_plugin, because dlopen() failed: /usr/lib/dovecot/modules/doveadm/libdoveadm_mail_crypt_plugin.so: undefined symbol: mail_crypt_box_get_pvt_digests (this is usually intentional, so just ignore this message) doveadm(synctest)<13039><>: Debug: auth USER input: synctest system_groups_user=synctest uid=1006 gid=100 home=/home/synctest doveadm(synctest): Debug: remote(192.168.3.1:12345): auth USER input: synctest system_groups_user=synctest uid=1006 gid=100 home=/home/synctest doveadm(synctest): Debug: remote(192.168.3.1:12345): Effective uid=1006, gid=100, home=/home/synctest doveadm(synctest): Debug: remote(192.168.3.1:12345): Namespace inbox: type=private, prefix=, sep=, inbox=yes, hidden=no, list=yes, subscriptions=yes location=mbox:~/mail/mailboxes:INBOX=/var/mail/synctest:DIRNAME=mBoX-MeSsAgEs:INDEX=~/mail/index:CONTROL=~/mail/control doveadm(synctest): Debug: remote(192.168.3.1:12345): fs: root=/home/synctest/mail/mailboxes, index=/home/synctest/mail/index, indexpvt=, control=/home/synctest/mail/control, inbox=/var/mail/synctest, alt= doveadm(synctest): Debug: Effective uid=1006, gid=100, home=/home/synctest doveadm(synctest): Debug: Namespace inbox: type=private, prefix=, sep=, inbox=yes, hidden=no, list=yes, subscriptions=yes location=mbox:~/mail/mailboxes:INBOX=/var/mail/synctest:DIRNAME=mBoX-MeSsAgEs:INDEX=~/mail/index:CONTROL=~/mail/control doveadm(synctest): Debug: fs: root=/home/synctest/mail/mailboxes, index=/home/synctest/mail/index, indexpvt=, control=/home/synctest/mail/control, inbox=/var/mail/synctest, alt= doveadm(synctest): Debug: brain M: Namespace has location mbox:~/mail/mailboxes:INBOX=/var/mail/synctest:DIRNAME=mBoX-MeSsAgEs:INDEX=~/mail/index:CONTROL=~/mail/control doveadm(synctest): Debug: Namespace : Using permissions from /home/synctest/mail/mailboxes: mode=0700 gid=default dsync-local(synctest)<D+AKA91J81/vMgAAaso27A>: Debug: brain M: Remote mailbox tree: INBOX guid=f8ecea204a65f05fea460000b4581695 uid_validity=1609590090 uid_next=9 subs=no last_change=0 last_subs=0 dsync-local(synctest)<D+AKA91J81/vMgAAaso27A>: Debug: brain M: Mailbox INBOX: local=00000000000000000000000000000000/0/0, remote=f8ecea204a65f05fea460000b4581695/0/1: mailbox not selectable yet dsync-local(synctest)<D+AKA91J81/vMgAAaso27A>: Debug: Namespace : /home/synctest/mail/mailboxes/INBOX doesn't exist yet, using default permissions dsync-local(synctest)<D+AKA91J81/vMgAAaso27A>: Debug: Namespace : Using permissions from /home/synctest/mail/mailboxes: mode=0700 gid=default dsync-local(synctest)<D+AKA91J81/vMgAAaso27A>: Debug: Namespace : /home/synctest/mail/mailboxes/INBOX doesn't exist yet, using default permissions dsync-local(synctest)<D+AKA91J81/vMgAAaso27A>: Debug: Namespace : Using permissions from /home/synctest/mail/mailboxes: mode=0700 gid=default dsync-local(synctest)<D+AKA91J81/vMgAAaso27A>: Debug: Namespace : /home/synctest/mail/mailboxes/INBOX doesn't exist yet, using default permissions dsync-local(synctest)<D+AKA91J81/vMgAAaso27A>: Debug: Namespace : Using permissions from /home/synctest/mail/mailboxes: mode=0700 gid=default dsync-local(synctest)<D+AKA91J81/vMgAAaso27A>: Debug: Namespace : /home/synctest/mail/mailboxes/INBOX doesn't exist yet, using default permissions dsync-local(synctest)<D+AKA91J81/vMgAAaso27A>: Debug: Namespace : Using permissions from /home/synctest/mail/mailboxes: mode=0700 gid=default dsync-local(synctest)<D+AKA91J81/vMgAAaso27A>: Debug: brain M: Import INBOX: Import change type=expunge GUID=<unknown> UID=1 hdr_hash= result=Expunged mail not found locally dsync-local(synctest)<D+AKA91J81/vMgAAaso27A>: Debug: brain M: Import INBOX: Import change type=expunge GUID=<unknown> UID=2 hdr_hash= result=Expunged mail not found locally dsync-local(synctest)<D+AKA91J81/vMgAAaso27A>: Debug: brain M: Import INBOX: Import change type=expunge GUID=<unknown> UID=3 hdr_hash= result=Expunged mail not found locally dsync-local(synctest)<D+AKA91J81/vMgAAaso27A>: Debug: brain M: Import INBOX: Import change type=expunge GUID=<unknown> UID=4 hdr_hash= result=Expunged mail not found locally dsync-local(synctest)<D+AKA91J81/vMgAAaso27A>: Debug: brain M: Import INBOX: Import change type=expunge GUID=<unknown> UID=5 hdr_hash= result=Expunged mail not found locally dsync-local(synctest)<D+AKA91J81/vMgAAaso27A>: Debug: brain M: Import INBOX: Import change type=expunge GUID=<unknown> UID=6 hdr_hash= result=Expunged mail not found locally dsync-local(synctest)<D+AKA91J81/vMgAAaso27A>: Debug: brain M: Import INBOX: Last common UID=0. Delayed expunges= dsync-local(synctest)<D+AKA91J81/vMgAAaso27A>: Debug: brain M: Import INBOX: Import change type=save GUID=8bce3bc615e7f2a1dfad970a3cd36bdb UID=7 hdr_hash= result=Mail's UID is above local UIDNEXT - No more local mails found dsync-local(synctest)<D+AKA91J81/vMgAAaso27A>: Debug: brain M: Import INBOX: Import change type=save GUID=c9cdf5f725d4195db78b20bbacad189b UID=8 hdr_hash= result=New mail dsync-local(synctest)<D+AKA91J81/vMgAAaso27A>: Debug: brain M: import mail uid 0 guid 8bce3bc615e7f2a1dfad970a3cd36bdb dsync-local(synctest)<D+AKA91J81/vMgAAaso27A>: Debug: brain M: Import INBOX: Import mail body for GUID=8bce3bc615e7f2a1dfad970a3cd36bdb UID=0 dsync-local(synctest)<D+AKA91J81/vMgAAaso27A>: Debug: /home/synctest/mail/index/INBOX/dovecot.index.cache: Compressed, file_seq changed 0 -> 1609779677, size=32, max_uid=0 dsync-local(synctest)<D+AKA91J81/vMgAAaso27A>: Debug: brain M: import mail uid 0 guid c9cdf5f725d4195db78b20bbacad189b dsync-local(synctest)<D+AKA91J81/vMgAAaso27A>: Debug: brain M: Import INBOX: Import mail body for GUID=c9cdf5f725d4195db78b20bbacad189b UID=0 dsync-local(synctest)<D+AKA91J81/vMgAAaso27A>: Debug: brain M: Import INBOX: Saved UIDs: 7:8 dsync-local(synctest)<D+AKA91J81/vMgAAaso27A>: Debug: brain M: Import INBOX: Finish update: min_next_uid=9 min_first_recent_uid=1 min_highest_modseq=10 min_highest_pvt_modseq=0 dsync-local(synctest)<D+AKA91J81/vMgAAaso27A>: Debug: brain M: Import INBOX: Reassign UIDs: 1: This appears to work perfectly well the first time (maybe I am overlooking some issue already at this stage?) At least after the backup has been completed /var/mail/syncuser on server2 contains all the messages that are also present on server1. And the ~syncuser/mail/index/INBOX folder also exists (don't know why this is created btw?) But then when running the same command for the 2nd time (and no changes on the /var/mail/synctest file on server1) the command failes like this (permission denied to delete INBOX at the end): root@server2:/home/synctest/mail# doveadm -D -v backup -R -f -u synctest tcp:192.168.3.1:12345 Debug: Loading modules from directory: /usr/lib/dovecot/modules/doveadm Debug: Skipping module doveadm_acl_plugin, because dlopen() failed: /usr/lib/dovecot/modules/doveadm/lib10_doveadm_acl_plugin.so: undefined symbol: acl_user_module (this is usually intentional, so just ignore this message) Debug: Skipping module doveadm_expire_plugin, because dlopen() failed: /usr/lib/dovecot/modules/doveadm/lib10_doveadm_expire_plugin.so: undefined symbol: expire_set_deinit (this is usually intentional, so just ignore this message) Debug: Skipping module doveadm_quota_plugin, because dlopen() failed: /usr/lib/dovecot/modules/doveadm/lib10_doveadm_quota_plugin.so: undefined symbol: quota_user_module (this is usually intentional, so just ignore this message) Debug: Module loaded: /usr/lib/dovecot/modules/doveadm/lib10_doveadm_sieve_plugin.so Debug: Skipping module doveadm_fts_lucene_plugin, because dlopen() failed: /usr/lib/dovecot/modules/doveadm/lib20_doveadm_fts_lucene_plugin.so: undefined symbol: lucene_index_iter_deinit (this is usually intentional, so just ignore this message) Debug: Skipping module doveadm_fts_plugin, because dlopen() failed: /usr/lib/dovecot/modules/doveadm/lib20_doveadm_fts_plugin.so: undefined symbol: fts_user_get_language_list (this is usually intentional, so just ignore this message) Debug: Skipping module doveadm_mail_crypt_plugin, because dlopen() failed: /usr/lib/dovecot/modules/doveadm/libdoveadm_mail_crypt_plugin.so: undefined symbol: mail_crypt_box_get_pvt_digests (this is usually intentional, so just ignore this message) doveadm(synctest)<13056><>: Debug: auth USER input: synctest system_groups_user=synctest uid=1006 gid=100 home=/home/synctest doveadm(synctest): Debug: remote(192.168.3.1:12345): auth USER input: synctest system_groups_user=synctest uid=1006 gid=100 home=/home/synctest doveadm(synctest): Debug: remote(192.168.3.1:12345): Effective uid=1006, gid=100, home=/home/synctest doveadm(synctest): Debug: remote(192.168.3.1:12345): Namespace inbox: type=private, prefix=, sep=, inbox=yes, hidden=no, list=yes, subscriptions=yes location=mbox:~/mail/mailboxes:INBOX=/var/mail/synctest:DIRNAME=mBoX-MeSsAgEs:INDEX=~/mail/index:CONTROL=~/mail/control doveadm(synctest): Debug: remote(192.168.3.1:12345): fs: root=/home/synctest/mail/mailboxes, index=/home/synctest/mail/index, indexpvt=, control=/home/synctest/mail/control, inbox=/var/mail/synctest, alt= doveadm(synctest): Debug: Effective uid=1006, gid=100, home=/home/synctest doveadm(synctest): Debug: Namespace inbox: type=private, prefix=, sep=, inbox=yes, hidden=no, list=yes, subscriptions=yes location=mbox:~/mail/mailboxes:INBOX=/var/mail/synctest:DIRNAME=mBoX-MeSsAgEs:INDEX=~/mail/index:CONTROL=~/mail/control doveadm(synctest): Debug: fs: root=/home/synctest/mail/mailboxes, index=/home/synctest/mail/index, indexpvt=, control=/home/synctest/mail/control, inbox=/var/mail/synctest, alt= doveadm(synctest): Debug: brain M: Namespace has location mbox:~/mail/mailboxes:INBOX=/var/mail/synctest:DIRNAME=mBoX-MeSsAgEs:INDEX=~/mail/index:CONTROL=~/mail/control doveadm(synctest): Debug: Namespace : /home/synctest/mail/mailboxes/INBOX doesn't exist yet, using default permissions doveadm(synctest): Debug: Namespace : Using permissions from /home/synctest/mail/mailboxes: mode=0700 gid=default dsync-local(synctest)<VqbhHQhL818AMwAAaso27A>: Debug: brain M: Local mailbox tree: INBOX guid=f8ecea204a65f05fea460000b4581695 uid_validity=1609590090 uid_next=9 subs=no last_change=0 last_subs=0 dsync-local(synctest)<VqbhHQhL818AMwAAaso27A>: Debug: brain M: Remote mailbox tree: INBOX guid=f8ecea204a65f05fea460000b4581695 uid_validity=1609590090 uid_next=9 subs=no last_change=0 last_subs=0 dsync-local(synctest)<VqbhHQhL818AMwAAaso27A>: Debug: brain M: Mailbox INBOX: local=f8ecea204a65f05fea460000b4581695/0/1, remote=f8ecea204a65f05fea460000b4581695/0/1: Mailboxes are equal dsync-local(synctest)<VqbhHQhL818AMwAAaso27A>: Debug: Namespace : /home/synctest/mail/mailboxes/INBOX doesn't exist yet, using default permissions dsync-local(synctest)<VqbhHQhL818AMwAAaso27A>: Debug: Namespace : Using permissions from /home/synctest/mail/mailboxes: mode=0700 gid=default dsync-local(synctest)<VqbhHQhL818AMwAAaso27A>: Debug: brain M: Import INBOX: Import change type=expunge GUID=<unknown> UID=1 hdr_hash= result=Expunged mail has no GUID, can't verify it dsync-local(synctest)<VqbhHQhL818AMwAAaso27A>: Debug: brain M: Import INBOX: Import change type=expunge GUID=<unknown> UID=2 hdr_hash= result=Expunged mail has no GUID, can't verify it dsync-local(synctest)<VqbhHQhL818AMwAAaso27A>: Debug: brain M: Import INBOX: Import change type=expunge GUID=<unknown> UID=3 hdr_hash= result=Expunged mail has no GUID, can't verify it dsync-local(synctest)<VqbhHQhL818AMwAAaso27A>: Debug: brain M: Import INBOX: Import change type=expunge GUID=<unknown> UID=4 hdr_hash= result=Expunged mail has no GUID, can't verify it dsync-local(synctest)<VqbhHQhL818AMwAAaso27A>: Debug: brain M: Import INBOX: Import change type=expunge GUID=<unknown> UID=5 hdr_hash= result=Expunged mail has no GUID, can't verify it dsync-local(synctest)<VqbhHQhL818AMwAAaso27A>: Debug: brain M: Import INBOX: Import change type=expunge GUID=<unknown> UID=6 hdr_hash= result=Expunged mail has no GUID, can't verify it dsync-local(synctest)<VqbhHQhL818AMwAAaso27A>: Warning: Deleting mailbox 'INBOX': UID=7 already exists locally for a different mail: Headers hashes don't match (9fc2f2229a1a2a8d5f12304cb5287f97 vs b62e0281b4f375a45040c552b55ab31a) dsync-local(synctest)<VqbhHQhL818AMwAAaso27A>: Debug: brain M: Import INBOX: Import change type=save GUID=8bce3bc615e7f2a1dfad970a3cd36bdb UID=7 hdr_hash=9fc2f2229a1a2a8d5f12304cb5287f97 result=Headers hashes don't match (9fc2f2229a1a2a8d5f12304cb5287f97 vs b62e0281b4f375a45040c552b55ab31a) dsync-local(synctest)<VqbhHQhL818AMwAAaso27A>: Debug: brain M: Import INBOX: Saved UIDs: dsync-local(synctest)<VqbhHQhL818AMwAAaso27A>: Debug: doveadm-sieve: Iterating Sieve mailbox attributes dsync-local(synctest)<VqbhHQhL818AMwAAaso27A>: Debug: sieve: Pigeonhole version 0.5.4 () initializing dsync-local(synctest)<VqbhHQhL818AMwAAaso27A>: Debug: sieve: include: sieve_global is not set; it is currently not possible to include `:global' scripts. dsync-local(synctest)<VqbhHQhL818AMwAAaso27A>: Debug: sieve: file storage: Using active Sieve script path: /home/synctest/.dovecot.sieve dsync-local(synctest)<VqbhHQhL818AMwAAaso27A>: Debug: sieve: file storage: Using script storage path: /home/synctest/sieve dsync-local(synctest)<VqbhHQhL818AMwAAaso27A>: Debug: sieve: file storage: Using permissions from /home/synctest/sieve: mode=0700 gid=-1 dsync-local(synctest)<VqbhHQhL818AMwAAaso27A>: Debug: sieve: file storage: Relative path to sieve storage in active link: sieve/ dsync-local(synctest)<VqbhHQhL818AMwAAaso27A>: Debug: sieve: file storage: sync: Synchronization active dsync-local(synctest)<VqbhHQhL818AMwAAaso27A>: Error: Couldn't delete mailbox INBOX: Permission denied root@server2:/home/synctest/mail# dovecot -n # 2.3.4.1 (f79e8e7e4): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.4 () # OS: Linux 4.19.0-12-amd64 x86_64 Debian 10.6 # Hostname: server2.fritz.box auth_username_format = %Ln doveadm_password = # hidden, use -P to show it lda_mailbox_autocreate = yes login_trusted_networks = 192.168.3.0/24 mail_location = mbox:~/mail/mailboxes:INBOX=/var/mail/%u:DIRNAME=mBoX-MeSsAgEs:INDEX=~/mail/index:CONTROL=~/mail/control mail_privileged_group = mail managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } passdb { driver = pam } plugin { sieve = ~/.dovecot.sieve sieve_default = /var/lib/dovecot/sieve/default.sieve sieve_dir = ~/sieve } postmaster_address = postmaster@"domain" protocols = imap pop3 lmtp service doveadm { inet_listener { port = 12345 } } service managesieve-login { inet_listener sieve { port = 4190 } } ssl_cert = </etc/letsencrypt/live/"domain"/fullchain.pem ssl_dh = # hidden, use -P to show it ssl_key = # hidden, use -P to show it userdb { driver = passwd } protocol lmtp { mail_plugins = " sieve" } protocol lda { mail_plugins = " sieve" }

4 6

Pigeonhole v0.5.13 build fails on OS X 10.11.6
by Steve Akerman 06 Jan '21

06 Jan '21

Hi, Dovecot 2.3.13 builds successfully on this old OS X, but pigeonhole v0.5.13fails as below: gcc -DHAVE_CONFIG_H -I. -I../.. -I/usr/local/include/dovecot -I../.. -I../../src/lib-managesieve -fPIE -DPIE -std=gnu99 -g -O2 -Wall -W -Wmissing-prototypes -Wmissing-declarations -Wpointer-arith -Wchar-subscripts -Wformat=2 -Wbad-function-cast -Wno-duplicate-decl-specifier -Wstrict-aliasing=2 -fstack-protector-strong -U_FORTIFY_SOURCE -D_FORTIFY_SOURCE=2 -I../.. -MT managesieve_login-client.o -MD -MP -MF .deps/managesieve_login-client.Tpo -c -o managesieve_login-client.o `test -f 'client.c' || echo './'`client.c In file included from client.c:23: ./managesieve-proxy.h:8:15: warning: declaration of 'enum login_proxy_failure_type' will not be visible outside of this function [-Wvisibility] enum login_proxy_failure_type type, ^ client.c:518:3: error: field designator 'proxy_failed' does not refer to any field in type 'struct client_vfuncs' .proxy_failed = managesieve_proxy_failed, ^ 1 warning and 1 error generated. make: *** [managesieve_login-client.o] Error 1 This appears to be related to the change from manage sieve_proxy_ error to manage sieve_proxy_failed. Pigeonhole v0.5.11 builds without problem on the same machine. The warning appears to be related to the lack of a declaration, but I am no expert. The error I have no idea!!! Is this related to my old compiler, or is there an issue here? Can anyone propose a workaround, as I would like to use Dovecot 2.3.13, but will get version mismatch errors if I do not upgrade pigeonhole. Thanks in advance

1 1

Ubuntu packages
by Aki Tuomi 06 Jan '21

06 Jan '21

Hi! Since Ubuntu 20.04 LTS is nowadays available, we have dropped 16.04 support from 2.3.13 as per policy of supporting two latest releases of operating system. Dovecot 2.3.11.3 is latest version we provide packages for 16.04. Please find Ubuntu 20.04 packages at https://repo.dovecot.org/ Kind regards, Aki Tuomi Open-Xchange oy

1 0

Imapsieve FLAG cause executes a pipe call twice
by DocMAX 06 Jan '21

06 Jan '21

I have this setup: imapsieve_mailbox1_name = * imapsieve_mailbox1_causes = FLAG imapsieve_mailbox1_before = file:~/sieve/learn-flag.sieve Now if i change the SPAM flag i can see: Dez 24 14:49:08 server dovecot[219886]: imap(docmax)<221469><BStCETa3fMzAqAEB>: Debug: imapsieve: mailbox Junk-E-Mail/dziennik.pl: FLAG event (changed flags: NonJunk) Dez 24 14:49:08 server dovecot[219886]: imap(docmax)<221469><BStCETa3fMzAqAEB>: Debug: imapsieve: Matched static mailbox rule [1] Dez 24 14:49:08 server dovecot[219886]: imap(docmax)<221469><BStCETa3fMzAqAEB>: Debug: imapsieve: mailbox Junk-E-Mail/dziennik.pl: FLAG event (changed flags: Junk) Dez 24 14:49:08 server dovecot[219886]: imap(docmax)<221469><BStCETa3fMzAqAEB>: Debug: imapsieve: Matched static mailbox rule [1] Dez 24 14:49:11 server dovecot[219886]: imap(docmax)<221469><BStCETa3fMzAqAEB>: Debug: imapsieve: mailbox Junk-E-Mail/dziennik.pl: FLAG event (changed flags: Junk) Dez 24 14:49:11 server dovecot[219886]: imap(docmax)<221469><BStCETa3fMzAqAEB>: Debug: imapsieve: Matched static mailbox rule [1] Dez 24 14:49:11 server dovecot[219886]: imap(docmax)<221469><BStCETa3fMzAqAEB>: Debug: imapsieve: mailbox Junk-E-Mail/dziennik.pl: FLAG event (changed flags: NonJunk) And my script is: require [ "variables" , "imap4flags", "fileinto", "vnd.dovecot.pipe", "copy", "imapsieve", "vnd.dovecot.execute" ]; if hasflag :is "Junk" { pipe :copy "rspam-spam"; stop; } if hasflag :is "NonJunk" { pipe :copy "rspam-ham"; stop; } Dez 24 15:05:24 server dovecot[222484]: imap(docmax)<224089></EW5RDa3UMPAqAEB>: Debug: sieve: action pipe: running program: rspam-spam Dez 24 15:05:24 server dovecot[222484]: imap(docmax)<224089></EW5RDa3UMPAqAEB>: Debug: sieve: action pipe: running program: rspam-ham Dez 24 15:05:27 server dovecot[222484]: imap(docmax)<224089></EW5RDa3UMPAqAEB>: Debug: sieve: action pipe: running program: rspam-spam Dez 24 15:05:27 server dovecot[222484]: imap(docmax)<224089></EW5RDa3UMPAqAEB>: Debug: sieve: action pipe: running program: rspam-spam Dez 24 15:05:32 server dovecot[222484]: imap(docmax)<224089></EW5RDa3UMPAqAEB>: Debug: sieve: action pipe: running program: rspam-spam Dez 24 15:05:32 server dovecot[222484]: imap(docmax)<224089></EW5RDa3UMPAqAEB>: Debug: sieve: action pipe: running program: rspam-ham Dez 24 15:05:36 server dovecot[222484]: imap(docmax)<224089></EW5RDa3UMPAqAEB>: Debug: sieve: action pipe: running program: rspam-spam Dez 24 15:05:36 server dovecot[222484]: imap(docmax)<224089></EW5RDa3UMPAqAEB>: Debug: sieve: action pipe: running program: rspam-spam I espected to have only ONE pipe when i change flag (in Thunderbird). Instead i get multiple calls. Why is that and how can i fix it? Regards, DocMAX

3 2

Dovecot Folder and file permissions.
by Thomas Strike 06 Jan '21

06 Jan '21

While working with adding a website to apache on my server something caused a blanket resetting of all file permissions on the server to apache:apache. I have most of the server running again but my mail services is another story. I have configured vmail on a Postfix with Dovecot and mariadb install. What I need is help with reestablishing the correct file and folder permissions that dovecot uses. The following is my configuration; # OS: Linux 4.18.0-147.3.1.el8_1.x86_64 x86_64 CentOS Linux release 8.1.1911 (Core) xfs # Dovecot version# 2.2.36 (1f10bfa63) # Hostname: sleepyvalley auth_mechanisms = plain login mail_home = /var/vmail/%d/%n mail_location = maildir:/var/vmail/%d/%n mail_privileged_group = mail mail_uid = vmail mbox_write_locks = fcntl namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } passdb { args = /etc/dovecot/dovecot-sql.conf.ext driver = sql } passdb { args = scheme=CRAM-MD5 username_format=%u /etc/dovecot/users driver = passwd-file } postmaster_address = postmaster(a)sleepyvalley.net service auth-worker { user = vmail } service auth { unix_listener /var/spool/postfix/private/auth { mode = 0666 } unix_listener auth-userdb { mode = 0666 user = vmail } } service lmtp { unix_listener /var/spool/postfix/private/dovecot-lmtp { group = postfix mode = 0666 user = postfix } } ssl_cert = </etc/letsencrypt/live/mail.sleepyvalley.net/fullchain.pem ssl_cipher_list = PROFILE=SYSTEM ssl_key = # hidden, use -P to show it userdb { args = /etc/dovecot/dovecot-sql.conf.ext driver = sql } userdb { args = uid=vmail gid=vmail home=/home/vmail/%d/%n driver = static } I really need help with this, thanks.

2 1

CVE fixed?
by Oren Savich 05 Jan '21

05 Jan '21

Hi, I wanted to know if you fixed CVE-2020-24386 & CVE-2020-25275. If so, in what commits? thanks in advance!

2 1

Panic file istream-seekable.c
by Eric Mauger 04 Jan '21

04 Jan '21

2 1

set up for Dovecot redundancy -- store on edge server only if link to backofc server is down, otherwise deliver to final dest?
by PGNet Dev 04 Jan '21

04 Jan '21

I run Postfix + Dovecot. Currently, I've got a cloud-instance of Postfix that handles all the anti-spam/auth/routing. On successful 'pass', it resends email -- over a VPN link -- to a *local* Postfix instance, which then LMTP-delivers to a Dovecot instance on the same box. Works great. I'd like to set up some IMAP redundancy, so that if the VPN link is down for any reason, mail is stored/accessible, and -- eventually -- correctly (re)delivered to the local Dovecot instance when the link's up again. The goal state I'm considering looks like: @cloud Postfix LMTP delivery from Postfix to "Dovecot1" @local LMTP (re)delivery from "Dovecot1", @cloud, to "Dovecot2" IDEALLY, no IMAP mail should ever be persistently stored on the @cloud Dovecot instance -- unless the VPN link is down. Then, when the VPN link is up again, the @cloud-stored IMAP mail should me 'moved' to the @local instance. I.e., I do _not_ want a replicated store. My question is how transparent/automated can this be done? I'd guess that somewhere in Dovecot's config I need logic that provides the conditional delivery to just @cloud vs 'all the way' to @local ... Any suggestions as to how to put this VPN-conditional redundancy in place?

2 2

deleting maildata from virtual users
by Alexander Rivanykov 04 Jan '21

04 Jan '21

2 4

CVE-2020-25275: MIME parsing crashes with particular messages
by Aki Tuomi 04 Jan '21

04 Jan '21

Open-Xchange Security Advisory 2021-01-04 Product: Dovecot Vendor: OX Software GmbH Internal reference: DOV-4113 (Bug ID) Vulnerability type: CWE-20: Improper Input Validation Vulnerable version: 2.3.11-2.3.11.3 Vulnerable component: lda, lmtp, imap Report confidence: Confirmed Solution status: Fixed by Vendor Fixed version: 2.3.13 Vendor notification: 2020-09-10 Solution date: 2020-09-14 Public disclosure: 2021-01-04 CVE reference: CVE-2020-25275 CVSS: 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Researcher credit: Innokentii Sennovskiy (Rumata888) from BI.ZONE Vulnerability Details: Mail delivery / parsing crashed when the 10 000th MIME part was message/rfc822 (or if parent was multipart/digest). This happened due to earlier MIME parsing changes for CVE-2020-12100. Risk: Malicious sender can crash dovecot repeatedly by sending / uploading message with more than 10 000 MIME parts. Workaround: These are usually dropped by MTA, where the mitigation can also be applied. Solution: Operators should update to 2.3.13 or later version.

1 0

TLS problem with iOS 9 Mail clients
by Maik Musall 02 Jan '21

02 Jan '21

Hi everyone, recently I migrated my mail server from an Ubuntu 16.04 box to an Ubuntu 20.04 box, so from dovecot 2.2.22 to 2.3.7.2, and to openssl 1.1.1.f. While everything else works fine, I have one important user stuck on an iOS 9 device that I need to support for a while longer, with which the IMAP TLS handshake keeps failing. From the logs: TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol I didn’t find a debug option to dump the TLS handshake details, so I analyzed a packet dump and found the following capabilities and cipher suites offered by the client: Transport Layer Security TLSv1 Record Layer: Handshake Protocol: Client Hello Content Type: Handshake (22) Version: TLS 1.0 (0x0301) Length: 149 Handshake Protocol: Client Hello Handshake Type: Client Hello (1) Length: 145 Version: TLS 1.0 (0x0301) Random: 5fef787ac06215d0a4edefd17602fadf409ab0512e04e62ade6192f2499f4896 Session ID Length: 0 Cipher Suites Length: 50 Cipher Suites (25 suites) Cipher Suite: TLS_EMPTY_RENEGOTIATION_INFO_SCSV (0x00ff) Cipher Suite: TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384 (0xc024) Cipher Suite: TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256 (0xc023) Cipher Suite: TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA (0xc00a) Cipher Suite: TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA (0xc009) Cipher Suite: TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA (0xc008) Cipher Suite: TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 (0xc028) Cipher Suite: TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 (0xc027) Cipher Suite: TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA (0xc014) Cipher Suite: TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA (0xc013) Cipher Suite: TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA (0xc012) Cipher Suite: TLS_DHE_RSA_WITH_AES_256_CBC_SHA256 (0x006b) Cipher Suite: TLS_DHE_RSA_WITH_AES_128_CBC_SHA256 (0x0067) Cipher Suite: TLS_DHE_RSA_WITH_AES_256_CBC_SHA (0x0039) Cipher Suite: TLS_DHE_RSA_WITH_AES_128_CBC_SHA (0x0033) Cipher Suite: TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA (0x0016) Cipher Suite: TLS_RSA_WITH_AES_256_CBC_SHA256 (0x003d) Cipher Suite: TLS_RSA_WITH_AES_128_CBC_SHA256 (0x003c) Cipher Suite: TLS_RSA_WITH_AES_256_CBC_SHA (0x0035) Cipher Suite: TLS_RSA_WITH_AES_128_CBC_SHA (0x002f) Cipher Suite: TLS_RSA_WITH_3DES_EDE_CBC_SHA (0x000a) Cipher Suite: TLS_ECDHE_ECDSA_WITH_RC4_128_SHA (0xc007) Cipher Suite: TLS_ECDHE_RSA_WITH_RC4_128_SHA (0xc011) Cipher Suite: TLS_RSA_WITH_RC4_128_SHA (0x0005) Cipher Suite: TLS_RSA_WITH_RC4_128_MD5 (0x0004) Compression Methods Length: 1 Compression Methods (1 method) Compression Method: null (0) Extensions Length: 54 Extension: server_name (len=19) Type: server_name (0) Length: 19 Server Name Indication extension Extension: supported_groups (len=8) Extension: ec_point_formats (len=2) Type: ec_point_formats (11) Length: 2 EC point formats Length: 1 Elliptic curves point formats (1) EC point format: uncompressed (0) Extension: status_request (len=5) Type: status_request (5) Length: 5 Certificate Status Type: OCSP (1) Responder ID list Length: 0 Request Extensions Length: 0 Extension: signed_certificate_timestamp (len=0) Type: signed_certificate_timestamp (18) Length: 0 I already tweaked the dovecot-ssl config down with "ssl_min_protocol = TLSv1” and included ECDHE-ECDSA-AES256-SHA in the cipher list, but the client still won’t connect. Does anyone have an idea what else I could try? Thanks Maik

2 6

LDA ignores virtual mailbox settings
by Toni Mueller 01 Jan '21

01 Jan '21

Hi, I have a Debian/Buster system with Postfix and Dovecot from the Debian repo, and with virtual users only (ie, no system users). These virtual users are having all of their uids, gids, homes and mail quota in an PostgreSQL database. The intent is to have postfix deliver the email via dovecot's LDA, so I can set quota on a per-user basis. But for some odd reason, Dovecot's LDA can't find the user data from the userdb, and then complains about not being able to write to /var/mail. The following example shows how things fail when delivering a message from Postfix's queue (therefore, the passdb failure is expected): In /etc/dovecot.conf, I have this, amongst other things: mail_location = maildir:~/Maildir:INBOX=~/Maildir passdb { driver = sql args = /etc/dovecot/dovecot-sql.conf.ext } userdb { driver = prefetch } userdb { driver = sql args = /etc/dovecot/dovecot-sql.conf.ext } protocol lda { mail_plugins = autocreate quota mail_log trash virtual notify } 16:04:16 postfix/qmgr[4970]: 8CD6CE072E: from=<user(a)example.com>, size=880, nrcpt=1 (queue active) 16:04:16 dovecot: auth: Debug: master in: USER#0111#011user(a)example.com#011service=lda 16:04:16 dovecot: auth: Debug: prefetch(user(a)example.com): passdb didn't return userdb entries, trying the next userdb 16:04:16 dovecot: auth: Debug: sql(user(a)example.com): SELECT '/path-to-mailboxen/' || virtual_users.home AS home, uid , gid , quota as quota_rule FROM virtual_users WHERE email = 'user(a)example.com' AND status = 'A' 16:04:16 dovecot: auth: Debug: userdb out: USER#0111#011user@example.com#011home=/path-to-mailboxen/example.com/user#011uid=12345#011gid=12345#011quota_rule=*:storage=0 ^^^^^^^^^^^^^^^^^^^^^^ This shows that the database lookup works. The intended effect should be that the message is delivered to /path-to-mailboxen/example.com/user/Maidir/new 16:04:16 dovecot: lda(user(a)example.com)<5291><DDxBHYCw6F+rFAAApiCoHg>: Error: setegid(privileged) failed: Operation not permitted 16:04:16 dovecot: lda(user(a)example.com)<5291><DDxBHYCw6F+rFAAApiCoHg>: Error: Mailbox INBOX: open(/var/mail/user(a)example.com) failed: Permission denied (euid=12345(mailbox) egid=12345(mailbox) missing +w perm: /var/mail, we're not in group 8(mail), dir owned by 0:8 mode=0775) ^^^^^^^^^^^^^^^^^^^^^^ And this shows that dovecot-lda just ignores the result. 16:04:16 dovecot: lda(user(a)example.com)<5291><DDxBHYCw6F+rFAAApiCoHg>: Error: Mailbox INBOX: Failed to autocreate mailbox: Mailbox INBOX: open(/var/mail/user(a)example.com) failed: Permission denied (euid=12345(mailbox) egid=12345(mailbox) missing +w perm: /var/mail, we're not in group 8(mail), dir owned by 0:8 mode=0775) 16:04:16 dovecot: lda(user(a)example.com)<5291><DDxBHYCw6F+rFAAApiCoHg>: msgid=<20201226224933.014608(a)laptop.example.com>: save failed to open mailbox INBOX: Mailbox INBOX: Failed to autocreate mailbox: Mailbox INBOX: open(/var/mail/user(a)example.com) failed: Permission denied (euid=12345(mailbox) egid=12345(mailbox) missing +w perm: /var/mail, we're not in group 8(mail), dir owned by 0:8 mode=0775) 16:04:16 postfix/pipe[5284]: 8CD6CE072E: to=<user(a)example.com>, orig_to=<userA(a)example2.com>, relay=dovecot, delay=62083, delays=62083/0.04/0/0.04, dsn=4.3.0, status=deferred (temporary failure) In /etc/postfix/master.cf, I have this to call it: dovecot unix - n n - - pipe flags=DRhu user=_mailbox argv=/usr/lib/dovecot/deliver -f ${sender} -d ${user}@${domain} -a ${recipient} I've tried strace-ing dovecot-lda, but it didn't really help me to understand why it discards the result of the userdb lookup. Can anyone please provide a cluebat, please? Thanks, Toni

5 15

Re: Using dovecot with RoundCubeMail - where is the information for new mail in (blue coloured) directories?
by Scott Ruckh 01 Jan '21

01 Jan '21

On 2020-12-20 17:37, Philip Rhoades wrote: > @lbutlr, > > > On 2020-12-21 00:43, @lbutlr wrote: >> On 20 Dec 2020, at 04:05, Philip Rhoades <phil(a)pricom.com.au> wrote: >>> I guess that is what it seems to look like to me as well - but what >>> does that mean for what I am trying to do? - ie reset the blue folder >>> highlight arbitrarily? >> >> Sound like the Roundcube style choices are outside th purview of >> dovecot. > > > Hmm . . the first response I got here was that it was definitely an > IMAP thing . . I think he was unclear about the actual problem . . > > I will try the RCM forum . . > > Thanks, > > P. I am not sure I have understood this thread completely, but I am running dovecot/RoundCube. If a folder has new messages, then it has a badge that is dark blue (with the theme I am using) with the number of un-read messages. Otherwise it has a badge that is light-blue to indicate un-read messages only. Folders with no badges have zero un-read messages. So there is definitely a distinction for "new" messages.

2 1

migration from 2.0.16
by Barbara M. 01 Jan '21

01 Jan '21

I have an old server with CentOS 6.x and dovecot 2.0.16 (postfix-2.6.6 and roundcube), that was an update from a 1.x many years ago ... Users in /etc/passwd Mailbox format mbox some filtering via procmail About 5.000 users, 1 TB data (/var/mail + /home/users) Obviously I am searching for a smooth upgrade path (with no or minimal downtime and users problems) ;-) Until few days ago my idea was a CentOS 8.x new box with the standard default packages (dovecot-2.3.8, postfix-3.3, ...). Now this can be reconsidered. I suppose there will be a RockyLinux or something equivalent but if there is a good reason I can consider Debian or other OS if they have a decent EOL or some advantages. Anyway, the more relevant problem at the moment is collect info for the best approch to have a smooth dovecot upgrade. My dream is the possibility to configure a new server and rsync the data (/var/mail + /home/users), and, when the tests are satisfiable do the final sync and swap the IP, but I suppose deleting the .imap folders isn't a simple complete solution to compatibility problems. Any hints, links, experiences are appreciated. Thanks, B.

6 9

Initial Replication
by David Morsberger 01 Jan '21

01 Jan '21

I searched the archives and do not see a question/answer for this. Should I perform a set of ordered steps after setting up replication? I have setup dovecot on both ends with identical config except for the remote hostname. Main concern is the existing server gets replicated to the new server. I want nothing from new server replicated to the old server. Risking "Trial and error" and "crossing fingers” doesn’t work with production emails Specifically: Do I need to setup the mail directories for the various virtual users on the remote? If so, do the directories need to empty? Should I initially do a manually one-way synch using doveadm from the existing server? If so, is there a way of turning off automatic replication while the manual one runs? Anything else? T David

2 2

Imap client with ~7500 imap cmds ~250/~500 read() syscall
by Marc Roos 31 Dec '20

31 Dec '20

I am playing a bit with the monitoring, and I have noticed there is one client of the chart with ~7500, while the others are between ~17 and ~60 (dovecot_user_num_cmds). I assume this is related to the client, or is it possible something is wrong on the server side? Is someone having also such numbers or is this really strange. Is it possible to limit these cmd's?

3 8

mail-crypt when using passwd-file driver
by Adam Gould 31 Dec '20

31 Dec '20

Hi, I am just finishing my first personal email server build so I would really appreciate it if the response to my question can be spelled out in enough detail since I am struggling to fill in the gaps to get this working. I have scoured Google and the archives but I am not fully understanding the implementation for my setup. I am looking for a solution to encrypt email using a mechanism that increases the difficulty of decrypting my email. For example, having a plain-text decryption key on disk would not be suitable. From what I understand mail-crypt supports using the user password supplied via IMAP to decrypt email. Can someone explain how this technically works? i.e. is the private key encrypted in disk and then unlocked using the supplied password? Can someone also please step me through 1. how I would ammen the configuration below in order to set this up. 2. the command required to generate keys 3. Any help in understanding the limitations such as password changes or caveats around generating keys securely I am happy to take my notes and update the wiki to help others. Thanks, Adam # 2.3.8 (9df20d2db): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.8 (b7b03ba2) # OS: Linux 4.18.0-240.1.1.el8_3.x86_64 x86_64 Red Hat Enterprise Linux release 8.3 (Ootpa) # Hostname: mailserver.example.com debug_log_path = /var/log/dovecot-debug.log info_log_path = /var/log/dovecot-info.log lda_mailbox_autocreate = yes log_path = /var/log/dovecot.log log_timestamp = "%Y-%m-%d %H:%M:%S " mail_home = /var/mail/%d/%n/ mail_location = maildir:~/mail/ mail_privileged_group = mail managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext namespace inbox { inbox = yes location = mailbox Archive { auto = create special_use = \Archive } mailbox Drafts { auto = create special_use = \Drafts } mailbox Junk { auto = create special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { auto = create special_use = \Trash } prefix = } passdb { args = scheme=CRYPT username_format=%n@%d /etc/dovecot/passdb driver = passwd-file } plugin { recipient_delimiter = - sieve = ~/.dovecot.sieve sieve_dir = ~/sieve sieve_global_dir = /etc/sieve/global/ } protocols = imap lmtp service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0600 user = postfix } } service imap-login { inet_listener imap { address = * port = 143 ssl = yes } } service lmtp { unix_listener /var/spool/postfix/private/dovecot-lmtp { group = postfix mode = 0600 user = postfix } } ssl_cert = </etc/letsencrypt/live/mail.example.com/fullchain.pem ssl_cipher_list = ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384: DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA: ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256: DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384: AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH: !EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA ssl_dh = # hidden, use -P to show it ssl_key = # hidden, use -P to show it ssl_min_protocol = TLSv1.2 ssl_prefer_server_ciphers = yes userdb { args = uid=vmail gid=vmail home=/var/mail/%d/%n driver = static } protocol lmtp { mail_fsync = optimized mail_plugins = " sieve" recipient_delimiter = - }

2 1

Solr and FTS - assertion failure
by Antonino Esposito 31 Dec '20

31 Dec '20

Hi, in the latest weeks i'm working on the Solr integration and immediately i've faced the assertion failure errors, on 2.0.19, 2.2.9 and 2.3.11.3 servers in our network. Reading the thread on debian ML, I realize this issue is related to nested MIME and it affects large mailboxes In my case, the error in dovecot.log pairs with the following on solr.log and it seems the rows value has the same value of the last UID recorded in the mailbox. For your reference, here is the Solr logs, where *2276996170* is the value passed by Dovecot as rows number and it clearly don't fit with the rows data type. Have you had experienced the same behaviour? Is there a workaround? Thanks Antonino 2020-12-30 12:07:33.897 ERROR (qtp1162918744-918) [ x:qadisha] o.a.s.h.RequestHandlerBase org.apache.solr.common.SolrException: For input string: "2276996170" at org.apache.solr.common.params.SolrParams.getInt(SolrParams.java:236) at org.apache.solr.search.QParser.getSortSpec(QParser.java:274) at org.apache.solr.handler.component.QueryComponent.prepare(QueryComponent.java:189) at org.apache.solr.handler.component.SearchHandler.handleRequestBody(SearchHandler.java:337) at org.apache.solr.handler.RequestHandlerBase.handleRequest(RequestHandlerBase.java:214) at org.apache.solr.core.SolrCore.execute(SolrCore.java:2627) at org.apache.solr.servlet.HttpSolrCall.execute(HttpSolrCall.java:795) at org.apache.solr.servlet.HttpSolrCall.call(HttpSolrCall.java:568) at org.apache.solr.servlet.SolrDispatchFilter.doFilter(SolrDispatchFilter.java:415) at org.apache.solr.servlet.SolrDispatchFilter.doFilter(SolrDispatchFilter.java:345) at org.eclipse.jetty.servlet.ServletHandler$CachedChain.doFilter(ServletHandler.java:1596) at org.eclipse.jetty.servlet.ServletHandler.doHandle(ServletHandler.java:545) at org.eclipse.jetty.server.handler.ScopedHandler.handle(ScopedHandler.java:143) at org.eclipse.jetty.security.SecurityHandler.handle(SecurityHandler.java:590) at org.eclipse.jetty.server.handler.HandlerWrapper.handle(HandlerWrapper.java:127) at org.eclipse.jetty.server.handler.ScopedHandler.nextHandle(ScopedHandler.java:235) at org.eclipse.jetty.server.session.SessionHandler.doHandle(SessionHandler.java:1610) at org.eclipse.jetty.server.handler.ScopedHandler.nextHandle(ScopedHandler.java:233) at org.eclipse.jetty.server.handler.ContextHandler.doHandle(ContextHandler.java:1300) at org.eclipse.jetty.server.handler.ScopedHandler.nextScope(ScopedHandler.java:188) at org.eclipse.jetty.servlet.ServletHandler.doScope(ServletHandler.java:485) at org.eclipse.jetty.server.session.SessionHandler.doScope(SessionHandler.java:1580) at org.eclipse.jetty.server.handler.ScopedHandler.nextScope(ScopedHandler.java:186) at org.eclipse.jetty.server.handler.ContextHandler.doScope(ContextHandler.java:1215) at org.eclipse.jetty.server.handler.ScopedHandler.handle(ScopedHandler.java:141) at org.eclipse.jetty.server.handler.ContextHandlerCollection.handle(ContextHandlerCollection.java:221) at org.eclipse.jetty.server.handler.InetAccessHandler.handle(InetAccessHandler.java:177) at org.eclipse.jetty.server.handler.HandlerCollection.handle(HandlerCollection.java:146) at org.eclipse.jetty.server.handler.HandlerWrapper.handle(HandlerWrapper.java:127) at org.eclipse.jetty.rewrite.handler.RewriteHandler.handle(RewriteHandler.java:322) at org.eclipse.jetty.server.handler.HandlerWrapper.handle(HandlerWrapper.java:127) at org.eclipse.jetty.server.Server.handle(Server.java:500) at org.eclipse.jetty.server.HttpChannel.lambda$handle$1(HttpChannel.java:383) at org.eclipse.jetty.server.HttpChannel.dispatch(HttpChannel.java:547) at org.eclipse.jetty.server.HttpChannel.handle(HttpChannel.java:375) at org.eclipse.jetty.server.HttpConnection.onFillable(HttpConnection.java:273) at org.eclipse.jetty.io.AbstractConnection$ReadCallback.succeeded(AbstractConnection.java:311) at org.eclipse.jetty.io.FillInterest.fillable(FillInterest.java:103) at org.eclipse.jetty.io.ChannelEndPoint$2.run(ChannelEndPoint.java:117) at org.eclipse.jetty.util.thread.strategy.EatWhatYouKill.runTask(EatWhatYouKill.java:336) at org.eclipse.jetty.util.thread.strategy.EatWhatYouKill.doProduce(EatWhatYouKill.java:313) at org.eclipse.jetty.util.thread.strategy.EatWhatYouKill.tryProduce(EatWhatYouKill.java:171) at org.eclipse.jetty.util.thread.strategy.EatWhatYouKill.run(EatWhatYouKill.java:129) at org.eclipse.jetty.util.thread.ReservedThreadExecutor$ReservedThread.run(ReservedThreadExecutor.java:375) at org.eclipse.jetty.util.thread.QueuedThreadPool.runJob(QueuedThreadPool.java:806) at org.eclipse.jetty.util.thread.QueuedThreadPool$Runner.run(QueuedThreadPool.java:938) at java.lang.Thread.run(Thread.java:748) Caused by: java.lang.NumberFormatException: For input string: "2276996170" at java.lang.NumberFormatException.forInputString(NumberFormatException.java:65) at java.lang.Integer.parseInt(Integer.java:583) at java.lang.Integer.valueOf(Integer.java:766) at org.apache.solr.common.params.SolrParams.getInt(SolrParams.java:233) ... 46 more 2020-12-30 12:07:33.897 INFO (qtp1162918744-918) [ x:qadisha] o.a.s.c.S.Request [qadisha] webapp=/solr path=/select params={q={!lucene+q.op%3DAND}from:mykeyword+OR+to:mykeyword+OR+subject:mykeyword&fl=uid,score&sort=uid+asc&fq=% 2Bbox:6d2c381de797e95fbb160000c46e3ae7+%2Buser:info@qadisha.it&rows=2276996170&wt=xml} status=400 QTime=1

2 2

Re: import_environment = $import_environment DEBUG=1 where should this be logged?
by Odhiambo Washington 30 Dec '20

30 Dec '20

Hi Marc, The same document says this: rawlog binary It works by checking if dovecot.rawlog/ directory exists in the logged in user's home directory, and writing the traffic to yyyymmdd-HHMMSS-pid.in and .out files. Each connection gets their own in/out files. *Rawlog will simply skip users who don't have the dovecot.rawlog/ directory and the performance impact for those users is minimal.* On Wed, 30 Dec 2020 at 20:10, Marc Roos <M.Roos(a)f1-outsourcing.eu> wrote: > > You know by any chance how to limit this only for one user? > > > > -----Original Message----- > From: Odhiambo Washington [mailto:odhiambo@gmail.com] > Sent: 30 December 2020 18:00 > To: dovecot > Subject: Re: import_environment = $import_environment DEBUG=1 where > should this be logged? > > > Hi Marc, > > If you read the link keenly - Debugging/Rawlog - Dovecot Wiki > <https://wiki.dovecot.org/Debugging/Rawlog> - you will realize that you > need to do some stuff. > I have done them and they produced the results. > > Edit /path/to/dovecot/conf.d/10-master.conf and add the following: > > Under this block: > > add executable = imap postlogin to the block that has service imap { > .... > ... > } > > Then create another block in the same file as follows: > > service postlogin { > executable = script-login -d rawlog > unix_listener postlogin { > } > } > > Identify the user for whom you want the rawlogs: > > doveadm user -u technical(a)mydomain.name > userdb: technical(a)mydomain.name > user : technical(a)mydomain.name > home : /var/spool/virtual/mydomain.name/technical > uid : 26 > gid : 26 > > Now do the following: > cd /var/spool/virtual/mydomain.name/technical > mkdir dovecot.rawlog > chown -R 26:26 dovecot.rawlog > > systemctl restart dovecot (or however you do it in CentOS) > > Now login to imap as the user .. perform some operations. > > Now look inside > /var/spool/virtual/mydomain.name/technical/dovecot.rawlog/ > > PS: Adapt as necessary. I tested this on FreeBSD with dovecot- 2.3.11.3 > > Ignore the /tmp/rawlog/%u portion of the HOWTO. I did it too, but there > was nothing in /tmp/rawlog/ even though I created the directory and did > chmod 1777 /tmp/rawlog. > > Adios. > > > > > On Wed, 30 Dec 2020 at 19:30, Marc Roos <M.Roos(a)f1-outsourcing.eu> > wrote: > > > > > You can also set DEBUG environment to have rawlog log an info > message > why it's not doing anything: > import_environment = $import_environment DEBUG=1 > > Where should this message appear, I also don't have this one. > > [1] > https://wiki2.dovecot.org/Debugging/Rawlog > > > > > -- > > Best regards, > Odhiambo WASHINGTON, > Nairobi,KE > +254 7 3200 0004/+254 7 2274 3223 > "Oh, the cruft.", grep ^[^#] :-) > > > -- Best regards, Odhiambo WASHINGTON, Nairobi,KE +254 7 3200 0004/+254 7 2274 3223 "Oh, the cruft.", grep ^[^#] :-)

1 0

Re: import_environment = $import_environment DEBUG=1 where should this be logged?
by Odhiambo Washington 30 Dec '20

30 Dec '20

Hi Marc, If you read the link keenly - Debugging/Rawlog - Dovecot Wiki <https://wiki.dovecot.org/Debugging/Rawlog> - you will realize that you need to do some stuff. I have done them and they produced the results. Edit /path/to/dovecot/conf.d/10-master.conf and add the following: Under this block: add executable = imap postlogin to the block that has service imap { .... ... } Then create another block in the same file as follows: service postlogin { executable = script-login -d rawlog unix_listener postlogin { } } Identify the user for whom you want the rawlogs: doveadm user -u technical(a)mydomain.name userdb: technical(a)mydomain.name user : technical(a)mydomain.name home : /var/spool/virtual/mydomain.name/technical uid : 26 gid : 26 Now do the following: cd /var/spool/virtual/mydomain.name/technical mkdir dovecot.rawlog chown -R 26:26 dovecot.rawlog systemctl restart dovecot (or however you do it in CentOS) Now login to imap as the user .. perform some operations. Now look inside /var/spool/virtual/mydomain.name/technical/dovecot.rawlog/ PS: Adapt as necessary. I tested this on FreeBSD with dovecot- 2.3.11.3 Ignore the /tmp/rawlog/%u portion of the HOWTO. I did it too, but there was nothing in /tmp/rawlog/ even though I created the directory and did chmod 1777 /tmp/rawlog. Adios. On Wed, 30 Dec 2020 at 19:30, Marc Roos <M.Roos(a)f1-outsourcing.eu> wrote: > > > You can also set DEBUG environment to have rawlog log an info message > why it's not doing anything: > import_environment = $import_environment DEBUG=1 > > Where should this message appear, I also don't have this one. > > [1] > https://wiki2.dovecot.org/Debugging/Rawlog > -- Best regards, Odhiambo WASHINGTON, Nairobi,KE +254 7 3200 0004/+254 7 2274 3223 "Oh, the cruft.", grep ^[^#] :-)

2 2

import_environment = $import_environment DEBUG=1 where should this be logged?
by Marc Roos 30 Dec '20

30 Dec '20

You can also set DEBUG environment to have rawlog log an info message why it's not doing anything: import_environment = $import_environment DEBUG=1 Where should this message appear, I also don't have this one. [1] https://wiki2.dovecot.org/Debugging/Rawlog

1 0

Getting rawlogging working with dovecot 2.2
by Marc Roos 30 Dec '20

30 Dec '20

According to this manual[1] I just have to add these lines to my config, not? protocol imap { rawlog_dir = /tmp/rawlog/%u } I should be seeing something in this /tmp/rawlog if I delete an message via imap not? I have already made this folder 777 and /tmp/rawlog/test 777, but still nothing is there. The normal syslog of dovecot does not report any errors. [1] https://wiki2.dovecot.org/Debugging/Rawlog

1 2

Virtual folder with 'younger' not updating
by Jonathan Casiot 30 Dec '20

30 Dec '20

I have a virtual folder set up with the following in dovecot-virtual: INBOX INBOX.temp ALL YOUNGER 86400 The problem is that messages older than 86,400 seconds (24 hours) never disappear from the folder. Is there any fix for this apart from adding INDEX=MEMORY to the mailbox location in the config file? I'm running Dovecot 2.2.36 on CentOS. Regards, -- Jonathan

2 6

read state not propagated
by Marc Roos 30 Dec '20

30 Dec '20

I have migrated the inbox namespace from mbox to mdbox by doing a doveadm backup to the new server. Both servers are having CentOS7 + dovecot-2.2.36-6.el7_8.1.x86_64, both servers have identical configurations (new server has some different vsz_limits and stats enabled) Now a user complains that an imap mailbox he opens at the same time with a colleague does not propagate the 'read' state. Previously if his colleague read the message, it would show on his mailbox also 'read'. After the transfer it keeps being unread for him. Am I correct to assume that he should indeed get an updated to 'read'? Where should I look to fix this? What can be the cause of this?

3 5

AUTH command behaviour when authentication process failed or aborted by user is changed
by Михаил Сандаков 30 Dec '20

30 Dec '20

Hi all, I have tried to update from 2.3.10.1 to 2.3.11.3 and found some strange change of dovecot behaviour at pop3 authentication. Firstly this changes have been found by my tests with curl. But this can be simply reproduced with telnet too. On version 2.3.10.1 when authentication is failed or aborted by client, client can send "AUTH [auth method]" to retry authentication with the same or another authentication method. Example of client <-> server conversation: server <<< +OK Dovecot ready. client >>> AUTH DIGEST-MD5 server <<< [some_auth_data] client >>> * server <<< -ERR Authentication aborted by client. client >>> AUTH CRAM-MD5 server <<< [another_auth_data] But on version 2.3.11.3 in the same cases client must send only "auth method" without "AUTH". Example of successful conversation on this version: server <<< OK Dovecot ready. client >>> AUTH DIGEST-MD5 server <<< [some_auth_data] client >>> * server <<< -ERR Authentication aborted by client. client >>> CRAM-MD5 server <<< [another_auth_data] And example of what happens if a client will try to do that in an old way on version 2.3.11.3: server <<< OK Dovecot ready. client >>> AUTH DIGEST-MD5 server <<< [some_auth_data] client >>> * server <<< -ERR Authentication aborted by client. client >>> AUTH CRAM-MD5 server <<< ERR [AUTH] Unsupported authentication mechanism. As you can see dovecot tries to find an authentication method by string "AUTH" not by "CRAM-MD5". This change looks strange to me. And changes break curl, because it uses an old way to make authentication. To reproduce it with curl you can just do something like: [user(a)10.52.48.220]# curl -u [user]:[password] --verbose pop3://[dovecot-host] Also seems like new behaviour is not fully accorded to rfc1734 ( https://tools.ietf.org/html/rfc1734) Based on this part of rfc: "If an AUTH command fails with a negative response, the session remains in the AUTHORIZATION state and client may try another authentication mechanism by issuing another AUTH command, or may attempt to authenticate by using the USER/PASS or APOP commands." I think "AUTH command" means full auth command started with "AUTH", not only authentication method. But I may be wrong in the interpretation of this part. I suppose this changes was made in commit https://github.com/dovecot/core/commit/2c42881c056e5ab2e2e14b2f800d6dc72026…, but not sure about this. Seems like if authentication is aborted or failed client->current_cmd is not going to be cleaned. So I suggest to revert old behaviour in this cases. If I am right with commit, it seems like we just need to add clearing client->current_cmd if the authentication process has failed somehow.

2 2