- dovecot - dovecot.org

configure: error: fd passing is required for Dovecot to work
by zahn 06 Sep '19

06 Sep '19

Hello I changed our old gcc compiler from the version: gcc-4.1.2-13.fc6 to the newer one: gcc version 8.3.0 (GCC). Then I wanted to compile: Dovecot 2.3.7 and I get the following error with ./configure CPPFLAGS="-I/usr/local/openssl/include" \ LDFLAGS="-L/usr/local/openssl/lib" \ ./configure --prefix=/usr/local/dovecot \ --disable-static \ --with-ssl=openssl checking whether fd passing works... no configure: error: fd passing is required for Dovecot to work With the old Compiler configure works well. I couldn't find a solution on the Internet - can you help me ? -- Schöne Grüsse aus Oberdiessbach Martin Zahn Akadia AG Martin Zahn Software Ing. HTL Oracle Certificate Professional Information Technology Fichtenweg 10 CH-3672 Oberdiessbach Tel: +41 79 410 27 87 Web: www.akadia.com E-Mail: martin.zahn(a)akadia.com

3 2

Namespace structure
by Daniel Miller 06 Sep '19

06 Sep '19

Is the following "legal" for Dovecot? And...is this separation recommended or a bad idea? Particularly I'm asking about the "archives" namespace - I haven't actually implemented this yet and I'm checking before I break something. 10-mail.conf # Primary private namespace # Using sdbox for storage namespace inbox { type = private separator = / prefix = location = sdbox:/var/mail/%d/%n/sdbox inbox = yes hidden = no list = yes subscriptions = yes } # For long-term archival namespace archives { type = private separator = / prefix = Archives/ location = mdbox:/var/mail/%d/%n/Archives/mdbox subscriptions = no list = children } # Shared mailboxes mail_shared_explicit_inbox = yes namespace usershares { type = shared separator = / prefix = shared/%%n/ location = sdbox:/var/mail/%%d/%%n/sdbox subscriptions = no list = children } # Virtual mailboxes - for server-side searches namespace virtual { prefix = virtual/ separator = / location = virtual:/var/mail/%d/%n/virtual subscriptions = no list = children } -- Daniel

1 0

login failure after upgrade to dovecot 2.3.7.2
by MK 05 Sep '19

05 Sep '19

Hi List, after upgrading dovecot from version 2.2.33.2 to 2.3.7.2 I got a lot of error messages like the following if the process count of imap processes reaches nearly 1000 (~950 (there are a few pop-connections)). Sep 5 11:27:32 mailbox1 dovecot: imap-login: Internal login failure (pid=27728 id=116): user=<xxxx(a)xxxx.xx>, method=PLAIN, rip=x.x.x.x, lip=x.x.x.x, session=<qETa7cqRzpZV3IEw> Sep 5 11:27:33 mailbox1 dovecot: imap-login: Error: master(imap): net_connect_unix(imap) failed: Resource temporarily unavailable - http://wiki2.dovecot.org/SocketUnavailable (client-pid=27704, client-id=79, rip=x.x.x.x, created 511 msecs ago, received 0/4 bytes) Our setup consists of some servers with dovecot as proxy/redirector as frontend servers, redirecting the logged in users to the backend servers storing the mailboxes. OS is CentOS 6 on both server types. The backend server in question has usually ~ 2500 simultaneous imap connections. Before the update there where no problems. During the update I merged the old 2.2 config into the new 2.3 from the fresh installed binary (Repo from dovecot.org) As I found the failure above in the logfile I testet a lot, to figure out how to fix this, because for me it seemed to be some limit around 1000 connections/processes anywhere in the config. In the end I changed the default value of "default_client_limit" from ist default 1000 to 8192 and the problem was fixed for the moment. Now I'm trying to understand why this fixes the problem and what the difference is between 2.2 and 2.3. For me it seems like something changed in the architecture during the release change, but I didn't find anything. I looked into the release notes and also checked the differences beween the 2.2 and 2.3 default config values (using doveconf -d). Can anyone help? Here is the output of doveconf -n # 2.3.7.2 (3c910f64b): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.7.2 (7372921a) # OS: Linux 2.6.32-696.23.1.el6.x86_64 x86_64 CentOS release 6.10 (Final) auth_mechanisms = plain login default_client_limit = 8192 disable_plaintext_auth = no mail_location = mdbox:%h mail_plugins = quota zlib managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } passdb { args = /etc/dovecot/dovecot-sql.conf.ext driver = sql } plugin { quota = dict:User quota::file:%h/dovecot-quota quota_warning = storage=90%% quota-warning 90 %u sieve = file:~/sieve;active=~/.dovecot.sieve zlib_save = gz zlib_save_level = 6 } pop3_client_workarounds = outlook-no-nuls oe-ns-eoh protocols = imap pop3 lmtp sieve service imap-login { process_min_avail = 12 service_count = 0 } service imap { process_limit = 8192 } service lmtp { inet_listener lmtp { address = * port = 24 } } service pop3-login { process_min_avail = 12 service_count = 0 } service pop3 { process_limit = 1024 } service quota-warning { executable = script /scripts/quota.sh unix_listener quota-warning { user = vmail } user = vmail } ssl = no userdb { args = /etc/dovecot/dovecot-sql.conf.ext driver = sql } verbose_proctitle = yes protocol lmtp { mail_plugins = quota zlib sieve } protocol imap { mail_max_userip_connections = 30 mail_plugins = quota zlib imap_quota } protocol pop3 { mail_plugins = quota zlib } greetings, Oliver

1 0

dsync and altpath on shared storage.
by Peter Mogensen 05 Sep '19

05 Sep '19

Hi, I was wondering... If one had mdbox ALT path set to a shared storage mount (say, on NFS) and one wanted to move a mailbox to a different host... I guess it in principle wouldn't be necessary to copy all the ALT storage through dsync, when the volume could just be mounted on the new host. Is there anyway for dsync to avoid moving Gigabytes of data for could just be "moved" by moving the mount? /Peter

2 6

Different passdb backends for different services
by lists＠mlserv.org 05 Sep '19

05 Sep '19

Hi, as Dovecot supports submission, which is the sending direction, I am interested to know, if I can configure a separate passdb backend just for submission. I habe LDAP attributes that differ sending or receiving permissions. It would be nice, if I had a second passdb backend just for submission, which has a LDAP filter for locking this service. Example for IMAP, POP3, Sieve: (&(mail=%s)(mailAllowIncoming=TRUE)) Example for Submission: (&(mail=%s)(mailAllowOutgoing=TRUE)) Use case is to lock compromised accounts that send spam. An operator can notify the account owner by placing a warning messegae into his/her mailbox. Is this possible? Thanks in advance Christian

3 9

Global ACL in SQL or LDAP possible?
by lists＠mlserv.org 04 Sep '19

04 Sep '19

Hi, Can global ACLs for public folders be stored in SQL or LDAP instead of a dovecot-acl file? I could only find something for shared folders, but not for public folders? Thanks in advance Christian

1 1

Server administration
by Aleksandr Mette 04 Sep '19

04 Sep '19

Dear Sirs, There is Postfix+Dovecot+Sogo installation in our company. I have attentively red Installation and Configuration Guide. However, I could not find some information. Could you give me an advise how to: 1. Add/remove e-mail address 2. Change user e-mail address password 3. Add user e-mail address into mail alias 4. Forward e-mail 5. List all users e-mails What is the best GUI interface for Dovecot administration? With kind regards, Alex

9 14

How are imap images supposed to be stored
by d.gentner＠m4ever.de 04 Sep '19

04 Sep '19

Hello. This is a question about the imap protocol, since I am having a hard time finding these things out, so I hope you guys can help me. We are using Dovecot to receive mails and having an issue with Thunderbird. Basically, we are running into this bug with a lot of people: https://bugzilla.mozilla.org/show_bug.cgi?id=216308. <https://bugzilla.mozilla.org/show_bug.cgi?id=216308> The gist of it is, that sometimes, when there is an image linked with the imap:// protocol in the mail, then Thunderbird wants to subscribe to the folder that contains this mail, but fails. If I pull the mail off the server, it also has that link in the raw mail. However, most mails store the images as a base64 code block. I have actually seen mails getting changed over night, from imap:// links to base64 code blocks, but I can't reproduce that. All computers are supposed to have the same Thunderbird version and they do. My questions right now are: * Speaking about the general imap/mail protocol, do mails store images as base64 or imap:// links. What is the standard here? * Is there anything we can do to prevent Thunderbird from running into this bug? We are using Dovecot 2.2.36.4 * What can cause an email getting changed over night or getting synced back with the base64 blocks? It was already read, when we ran into the issue. With best regards, Domeniko Gentner

2 1

Mailcrypt plugin private password
by info＠unkn0wn3d.com 04 Sep '19

04 Sep '19

Hello there, is there a way to make the mailcrypt plugin use the user's password or at least store it in a hashed value? I'm using a passwd file for authentication. I feel uncomfortable saving the private password in plaintext in that file. Regards

2 5

plugin for IMAP protocol to modifie any email
by Matthew Brown 04 Sep '19

04 Sep '19

is there a plugin or anyway I can modifie any email content ? I would like to change body text, headers, attachments

3 3

CVE-2019-11500: Critical vulnerability in Dovecot and Pigeonhole
by Aki Tuomi 04 Sep '19

04 Sep '19

Dear subscribers, we have been made aware of critical vulnerability in Dovecot and Pigeonhole. --- Open-Xchange Security Advisory 2019-08-14 Product: Dovecot Vendor: OX Software GmbH Internal reference: DOV-3278 Vulnerability type: Improper input validation (CWE-20) Vulnerable version: All versions prior to 2.3.7.2 and 2.2.36.4 Vulnerable component: IMAP and ManageSieve protocol parsers (before and after login) Report confidence: Confirmed Solution status: Fixed by Vendor Fixed version: 2.3.7.2, 2.2.36.4 Researcher credits: Nick Roessler and Rafi Rubin, University of Pennsylvania Vendor notification: 2019-04-13 Solution date: 2019-06-05 Public disclosure: 2019-08-28 CVE reference: CVE-2019-11500 CVSS: 8.1 (CVSS3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vulnerability Details: IMAP and ManageSieve protocol parsers do not properly handle NUL byte when scanning data in quoted strings, leading to out of bounds heap memory writes. Risk: This vulnerability allows for out-of-bounds writes to objects stored on the heap up to 8096 bytes in pre-login phase, and 65536 bytes post-login phase, allowing sufficiently skilled attacker to perform complicated attacks that can lead to leaking private information or remote code execution. Abuse of this bug is very difficult to observe, as it does not necessarily cause a crash. Attempts to abuse this bug are not directly evident from logs. Steps to reproduce: This bug is best observed using valgrind to see the out of bounds read with following snippet: perl -e 'print "a id (\"foo\" \"".("x"x1021)."\\A\" \"bar\" \"\000".("x"x1020)."\\A\")\n"' | nc localhost 143 Solution: Operators should update to the latest Patch Release. There is no workaround for the issue. --- Aki Tuomi Open-Xchange oy

8 14

Dovecot and Apple's Mail.app not playing nicely?
by Coy Hile 03 Sep '19

03 Sep '19

Hi all, Is there anything cute one has to take into account when using Dovecot with users of Apple’s Mail.app? Behavior I’m seeing is that if I delete or move messages via Webmail (Roundcube, Horde, or even ActiveSync via Mail.app on my phone), they do get moved or deleted. However, if I take the same actions in the desktop mail client, when logging in to the Webmail (or phone) app, I see the messages still seeming to be in the Inbox. Is this known behavior? A peculiarity in Apple Mail? -- Coy Hile coy.hile(a)coyhile.com

4 5

Re: Re: Quota count and clone questions
by Bratislav ILIC 03 Sep '19

03 Sep '19

Hi, I presume you figured this out after all this time, but in any case. Since quota_clone is not cumulative, it always inserts new record with actual quota, to be able to get correct results in postfixadmin one must: DROP TRIGGER mergequota2 ON quota2; And to prevent ERROR: duplicate key value violates unique constraint "quota2_pkey": CREATE FUNCTION public.clone_quota2() RETURNS trigger LANGUAGE plpgsql AS $$ BEGIN UPDATE quota2 SET bytes = NEW.bytes, messages = NEW.messages WHERE username = NEW.username; IF found THEN RETURN NULL; ELSE RETURN NEW; END IF; END; $$; And then: CREATE TRIGGER clonequota2 BEFORE INSERT ON quota2 FOR EACH ROW EXECUTE PROCEDURE public.clone_quota2() ; And finally just put: quota_clone_dict = proxy::sqlquota Hope this helps somebody trying to figure out this too. > I figured out that I can't just drop maintaining quota2 if I want > postfixadmin to report the quota status. > > I also figured out a way to run a test on my config guesses. I will try > to fit it in today, or tomorrow. But any advise to the questions below > are welcomed! > >>On 2/13/19 8:53 PM, Robert Moskowitz via dovecot wrote: >> all this almost reads like I can drop maintaining the quota2 table? >> >> From https://wiki.dovecot.org/Quota/Count >> >> mailbox_list_index = yes >> # Avoid spending excessive time waiting for the quota calculation to >> finish when >> # mails' vsizes aren't already cached. If this many mails are opened, >> finish the >> # quota calculation on background in indexer-worker process. Mail >> deliveries will >> # be assumed to succeed, and explicit quota lookups will return >> internal error. >> mail_vsize_bg_after_count = 100 >> >> seems to belong in 10-mail.conf. That is where those var are shown. >> >> But: >> >> >> plugin { >> # 10MB quota limit >> quota = count:User quota >> quota_rule = *:storage=10M >> >> # This is required - it uses "virtual sizes" rather than "physical >> sizes" for quota counting: >> quota_vsizes = yes >> } >> >> I am having problems with. Right now for quota I have: >> >> plugin { >> quota = dict:user::proxy::sqlquota >> trash = /etc/dovecot/dovecot-trash.conf.ext >> } >> >> How do I reconcile these two? >> >> Then for clone: https://wiki.dovecot.org/Plugins/QuotaClone >> >> how does: >> >> mail_plugins = $mail_plugins quota quota_clone >> plugin { >> quota_clone_dict = redis:host=127.0.0.1:port=6379 >> } >> >> get replaced with something for mysql? >> >> dovecot-sql.conf.ext: >> >> driver = mysql >> connect = host=/var/lib/mysql/mysql.sock dbname=postfix user=postfix >> password=$Postfix_Database_Password >> default_pass_scheme = $cryptsha-CRYPT >> # following should all be on one line. >> password_query = SELECT username as user, password, >> concat('/home/vmail/', maildir) as userdb_home, >> concat('maildir:/home/vmail/', maildir) as userdb_mail, 101 as >> userdb_uid, 12 as userdb_gid FROM mailbox WHERE username = '%u' AND >> active = '1' >> # following should all be on one line >> user_query = SELECT concat('/home/vmail/', maildir) as home, >> concat('maildir:/home/vmail/', maildir) as mail, 101 AS uid, 12 AS >> gid, CONCAT('*:messages=30000:bytes=', quota) as quota_rule FROM >> mailbox WHERE username = '%u' AND active = '1' >> >> and >> >> dovecot-dict-sql.conf.ext: >> >> connect = host=/var/lib/mysql/mysql.sock dbname=postfix user=postfix >> password=$Postfix_Database_Password >> map { >> pattern = priv/quota/storage >> table = quota2 >> username_field = username >> value_field = bytes >> } >> map { >> pattern = priv/quota/messages >> table = quota2 >> username_field = username >> value_field = messages >> } >> >> >> >> thanks

1 0

Dovecot 2.3.7 - char "-" missing
by Domenico Pastore 03 Sep '19

03 Sep '19

Hello, i have update dovecot from version 2.2.15 to 2.3.7.2. I have a problem with mine java software because there is a different response when open connection to doveadm. I need open socket to doveadm for get imap quota of a mailbox. With version 2.2.15: # telnet 192.160.10.4 924 Trying 192.160.10.4... Connected to 192.160.10.4. Escape character is '^]'. - With version 2.3.7.2: # telnet 192.160.10.3 924 Trying 192.160.10.3... Connected to 192.160.10.3. Escape character is '^]'. The difference is "-" character. The version 2.3.7 not respond with "-" character after opening the connection. Is it possible to add the character again with a parameter? Why did doveadm's answer change? Br Domenico

3 2

Segfault with error 4 in doveadm-server
by holger＠dehnhardt.org 03 Sep '19

03 Sep '19

I set up dovecot on two servers with replication enabled. The replication is over a vpn connection. I get massive segfaults from doveadm-server every few minutes. dmesg: doveadm-server[30030]: segfault at 0 ip 0000557fa16d2e62 sp 00007ffdcaafec50 error 4 in doveadm-server[557fa16a3000+41000] [486397.225636] Code: 40 03 4c 8d 3c c3 48 8d 44 24 18 48 89 44 24 08 0f 1f 84 00 00 00 00 00 49 8b bc 24 60 01 00 00 e8 e3 2a 00 00 48 89 44 24 18 <48> 8b 13 48 8d 35 c4 8d 00 00 48 89 c7 e8 2c 2b 00 00 31 c0 c6 45 mail.err dovecot: doveadm: Fatal: master: service(doveadm): child 29507 killed with signal 11 (core dumps disabled) I am absolutely unaware of how I can come to the cause of this error. Can anyone give me a hint? ----------------------------- Configuration: # 2.2.13: /etc/dovecot/dovecot.conf # OS: Linux 5.1.14-xen x86_64 Debian 8.11 auth_debug = yes disable_plaintext_auth = no doveadm_password = xxxx doveadm_port = 4711 listen = * mail_access_groups = vmail mail_gid = vmail mail_home = /var/vmail/%d/%n mail_location = maildir:~/mail mail_plugins = " notify replication" mail_uid = vmail managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date ihave namespace inbox { inbox = yes location = mailbox Drafts { auto = subscribe special_use = \Drafts } mailbox Junk { auto = subscribe special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox Trash { auto = subscribe special_use = \Trash } prefix = } passdb { args = /etc/dovecot/dovecot-ldap.conf.ext driver = ldap } plugin { mail_log_events = delete undelete expunge copy mailbox_delete mailbox_rename mail_log_fields = uid box msgid size mail_replica = tcp:backup-vpn.local:12345 sieve = ~/.dovecot.sieve sieve_after = ~/sieve/after sieve_before = ~/sieve/before sieve_default = /var/vmail/%d/default.sieve sieve_dir = ~/sieve } protocols = " imap sieve pop3" service aggregator { fifo_listener replication-notify-fifo { mode = 0666 user = vmail } unix_listener replication-notify { mode = 0666 user = vmail } } service auth { unix_listener auth-client { group = vmail mode = 0660 user = vmail } unix_listener auth-userdb { mode = 0666 user = vmail } } service config { unix_listener config { user = vmail } } service doveadm { client_limit = 1 idle_kill = 0 inet_listener { address = master-vpn.local port = 12345 } process_limit = 0 process_min_avail = 0 user = vmail } service replicator { client_limit = 0 drop_priv_before_exec = no idle_kill = 4294967295 secs process_limit = 1 process_min_avail = 0 service_count = 0 unix_listener replicator-doveadm { group = vmail mode = 0666 user = dovecot } vsz_limit = 8 G } ssl_cert = </etc/ssl/certs/xxx.cert ssl_key = </etc/ssl/private/xxx.key userdb { args = /etc/dovecot/dovecot-ldap.conf.ext driver = ldap } protocol sieve { managesieve_implementation_string = Dovecot Pigeonhole managesieve_max_line_length = 65536 } protocol lda { mail_plugins = " notify replication acl sieve" } protocol imap { mail_plugins = " notify replication acl" }

3 6

LMTP Post login script for acl_groups
by lists＠mlserv.org 03 Sep '19

03 Sep '19

Hi, I use a post login script for imap, to fetch acl groups from LDAP. Because Dovecot can only deal with a single value, which must be a comma seperated list of groups, I decided to use a post login script do deal with multi values in LDAP: This looks like this in LDAP: rnsMSACLGroup: admin rnsMSACLGroup: automx rnsMSACLGroup: amavis rnsMSACLGroup: postfix rnsMSACLGroup: dovecot rnsMSACLGroup: rspamd rnsMSACLGroup: powerdns rnsMSACLGroup: sogo rnsMSACLGroup: zabbix rnsMSACLGroup: dane-users rnsMSACLGroup: gentoo rnsMSACLGroup: openbsd My post login script looks like this: --------------------------------------------------------- #!/bin/sh BINDDN='cn=dovecot-postlogin,ou=people,ou=it,dc=roessner-net,dc=de' BINDPWFILE='/etc/dovecot/ldap-postlogin.secret' BASE='ou=people,ou=it,dc=roessner-net,dc=de' LDAPSEARCH="/usr/bin/ldapsearch" AWK="/usr/bin/awk" test -x ${LDAPSEARCH} || exec "$@" test -x ${AWK} || exec "$@" ACL_GROUPS=$( ${LDAPSEARCH} -LLL -ZZ -y ${BINDPWFILE} -xD ${BINDDN} -b ${BASE} "(rnsMSDovecotUser=${USER})" rnsMSACLGroup | \ grep rnsMSACLGroup | \ ${AWK} -vORS=, '{ print $2 }' | \ sed 's/,$/\n/' ) export ACL_GROUPS export USERDB_KEYS="${USERDB_KEYS} acl_groups" exec "$@" --------------------------------------------------------- This script is included in imap-postlogin executables and works for logged in users. But it does not work for LMTP. LMTP itself seems not to have any permissions to access the folders associated with these groups. I thought, I simply could add the imap-postlogin block to lmtp-postlogin and that would work, but it doesn't. So here is the question: What am I missing in Dovecot that LMTP can also have ACL_GROUPS like the imap service? Here is my config (non-defaults): --------------------------------------------------------- doveconf -n # 2.3.7.1 (0152c8b10): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.7.1 (db5c74be) # OS: Linux 4.19.44-gentoo x86_64 Gentoo Base System release 2.6 # Hostname: mx.roessner-net.de auth_cache_size = 64 M auth_master_user_separator = * auth_mechanisms = plain login auth_ssl_username_from_cert = yes auth_verbose = yes default_client_limit = 5000 default_process_limit = 500 default_vsz_limit = 512 M disable_plaintext_auth = no hostname = mail.roessner-net.de imap_client_workarounds = tb-extra-mailbox-sep tb-lsub-flags imap_max_line_length = 4 M lda_mailbox_autocreate = yes lda_mailbox_autosubscribe = yes lmtp_rcpt_check_quota = yes login_log_format_elements = user=<%u> method=%m rip=%r lip=%l mpid=%e %c %k mail_access_groups = vmail mail_attachment_dir = /var/mail/virtual/copymail/attachments mail_gid = vmail mail_location = sdbox:~/sdbox mail_max_keyword_length = 4096 mail_plugins = quota acl fts fts_lucene zlib mail_log notify mail_privileged_group = mail mail_save_crlf = yes mail_uid = vmail managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext vacation-seconds imapsieve vnd.dovecot.imapsieve mdbox_preallocate_space = yes mdbox_rotate_size = 128 M namespace { list = children location = sdbox:%%h/sdbox prefix = Shared/%%u/ separator = / subscriptions = no type = shared } namespace { hidden = no list = children location = maildir:/var/mail/virtual/public:INDEXPVT=~/Maildir/public prefix = Public/ separator = / subscriptions = no type = public } namespace inbox { inbox = yes location = mailbox Archive { auto = subscribe special_use = \Archive } mailbox "Deleted Messages" { special_use = \Trash } mailbox Drafts { auto = subscribe special_use = \Drafts } mailbox Junk-E-Mail { special_use = \Junk } mailbox Junk { auto = subscribe special_use = \Junk } mailbox Sent { auto = subscribe special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { auto = subscribe special_use = \Trash } prefix = separator = / type = private } passdb { args = /etc/dovecot/master-users driver = passwd-file master = yes pass = yes } passdb { args = /etc/dovecot/dovecot-ldap.conf.ext driver = ldap } plugin { acl = vfile:/etc/dovecot/dovecot-acl:cache_secs=300 acl_shared_dict = file:/var/mail/virtual/shared-mailboxes.db fts = lucene fts_autoindex = yes fts_lucene = whitespace_chars=@. imapsieve_mailbox1_before = file:/etc/dovecot/sieve/rspamd.d/report-spam.sieve imapsieve_mailbox1_causes = COPY FLAG imapsieve_mailbox1_name = Junk imapsieve_mailbox2_before = file:/etc/dovecot/sieve/rspamd.d/report-ham.sieve imapsieve_mailbox2_causes = COPY imapsieve_mailbox2_from = Junk imapsieve_mailbox2_name = * mail_log_events = delete undelete expunge copy save mailbox_create mailbox_delete mailbox_rename mail_log_fields = box msgid quota = count:User quota quota_grace = 10%% quota_rule = *:storage=300M:messages=20000 quota_rule2 = Trash:storage=+500M quota_rule3 = Sent:storage=+2G quota_rule4 = Archive:storage=+2G quota_status_nouser = DUNNO quota_status_overquota = 552 5.2.2 Mailbox is full quota_status_success = DUNNO quota_vsizes = yes quota_warning = storage=95%% quota-warning 95 %u quota_warning2 = storage=80%% quota-warning 80 %u quota_warning3 = -storage=100%% quota-warning below %u sieve = file:~/sieve;active=~/.dovecot.sieve sieve_after = /etc/dovecot/sieve/after sieve_before = /etc/dovecot/sieve/before sieve_extensions = +vacation-seconds sieve_global_extensions = +vnd.dovecot.pipe +vnd.dovecot.execute +vnd.dovecot.debug sieve_pipe_bin_dir = /usr/bin sieve_plugins = sieve_imapsieve sieve_extprograms sieve_vacation_default_period = 10d sieve_vacation_max_period = 30d sieve_vacation_min_period = 1h zlib_save = gz zlib_save_level = 6 } protocols = imap pop3 lmtp submission sieve service auth-worker { extra_groups = ssl-cert unix_listener auth-worker { mode = 0600 user = vmail } user = vmail } service auth { extra_groups = ssl-cert unix_listener /var/spool/postfix-submission/private/auth { group = postfix mode = 0666 user = postfix } unix_listener auth-userdb { mode = 0600 user = vmail } user = vmail } service config { unix_listener config { mode = 0600 user = vmail } } service dict { unix_listener dict { mode = 0600 user = vmail } } service imap-login { inet_listener imap { address = 127.0.0.1 134.255.226.248 ::1 2a05:bec0:28:1:134:255:226:248 } inet_listener imaps { port = 0 } } service imap-postlogin { executable = script-login /usr/local/bin/dovecot-masteruser.sh /usr/local/bin/dovecot-lastlogin.sh /usr/local/bin/dovecot-aclgroups.sh user = vmail } service imap { executable = imap imap-postlogin } service lmtp-postlogin { executable = script-login /usr/local/bin/dovecot-aclgroups.sh user = vmail } service lmtp { executable = lmtp lmtp-postlogin inet_listener lmtp { address = 127.0.0.1 port = 24 } unix_listener /var/spool/postfix/private/lmtp-dovecot { group = postfix mode = 0660 user = postfix } } service managesieve-login { inet_listener sieve { address = 127.0.0.1 134.255.226.248 ::1 2a05:bec0:28:1:134:255:226:248 } } service pop3-login { inet_listener pop3 { address = 127.0.0.1 134.255.226.248 ::1 2a05:bec0:28:1:134:255:226:248 } inet_listener pop3s { port = 0 } } service quota-status { client_limit = 1 executable = quota-status -p postfix inet_listener { address = 127.0.0.1 port = 12340 } } service quota-warning { executable = script /usr/local/bin/quota-warning.sh extra_groups = mail unix_listener quota-warning { group = vmail mode = 0600 user = vmail } user = vmail } ssl_cert = </etc/ssl/mail.roessner-net.de/cert/fullchain.pem ssl_cipher_list = ALL:!DH:!kRSA:!SRP:!kDHd:!DSS:!aNULL:!eNULL:!EXPORT:!DES:!3DES:!MD5:!PSK:!RC4:!ADH:!LOW@STRENGTH ssl_client_cert = </etc/ssl/mail.roessner-net.de/cert/fullchain.pem ssl_client_key = # hidden, use -P to show it ssl_dh = # hidden, use -P to show it ssl_key = # hidden, use -P to show it ssl_min_protocol = TLSv1.2 ssl_prefer_server_ciphers = yes submission_client_workarounds = whitespace-before-path submission_relay_host = mail.roessner-net.de submission_relay_port = 5870 submission_relay_ssl = starttls submission_relay_trusted = yes userdb { args = /etc/dovecot/dovecot-ldap-userdb.conf.ext driver = ldap } verbose_proctitle = yes protocol lmtp { mail_plugins = quota acl fts fts_lucene zlib mail_log notify sieve } protocol lda { mail_plugins = quota acl fts fts_lucene zlib mail_log notify sieve } protocol imap { mail_max_userip_connections = 50 mail_plugins = quota acl fts fts_lucene zlib mail_log notify imap_quota imap_acl imap_zlib imap_sieve } protocol submission { login_greeting = ESMTP } --------------------------------------------------------- Thanks for any help in advance Christian

3 15

dovecot 2.2 repo
by Bas van Rooijen 02 Sep '19

02 Sep '19

Hi, >From the v2.2.36.4 announcement message: "Binary packages are available at https://repo.dovecot.org/" My question is, where exactly? There's an instruction at repo.dovecot.org that tells you to replace 'ce-latest-2.3' with 'ce-<version>' but the given url doesn't even contain 'ce-latest-2.3' and http://repo.dovecot.org/ce-2.2.36 returns a 404. Thanks in advance! bvr.

4 3

Experimental docker images
by aki.tuomi＠dovecot.fi 02 Sep '19

02 Sep '19

Hi, you can now find experimental Docker images for dovecot CE releases (starting from 2.3.7.2) from https://hub.docker.com/r/dovecot/dovecot You can find instructions and more details on the repository page. ---- Aki

1 0

Re: Message delivered twice caused by an LMTP error "Got unexpected reply" during upgrade to 2.3
by Gabriele Nencioni 02 Sep '19

02 Sep '19

>>> On 08/09/2018 09:12 AM, Stephan Bosch wrote >>>>>> Can you make a pcap log of the LMTP communication between the two >>>>>> Dovecot hosts? That may give me a clue on which side of the >>>>>> communication is causing the issue. >>>>> Yes sure, where I can send it? >>>>> Here on list or at your address? >>>> >>>> Just send it to me. On 08/16/2018 10:21 AM, Stephan Bosch wrote: > Op 16/08/2018 om 09:46 schreef Gabriele Nencioni: >> On 08/15/2018 06:39 PM, Stephan Bosch wrote: >>> Op 15-8-2018 om 17:19 schreef Stephan Bosch: >>>> >>>> Op 13-8-2018 om 15:50 schreef Gabriele Nencioni: >>>>> So the scenario seems to be: >>>>> the error occurs between old directors and new backends >>>>> and between the new backends and the smtp submission_host (for >>>>> redirection) >>>>> and using the pipeline capability and attaching a file >>>>> >>>>> Let me know if you need more info >>>> In this case it is possible to obtain a debug log by enabling >>>> mail_debug=yes. Can you obtain a full debug log for such a failing >>>> submission session? >> Ok! It is attached. > > That is just weird. Dovecot reports that it cannot fully send the last > bits of the message and right thereafter the reply is received, which > Dovecot then interprets as out-of-sequence. The PCAP files tell me the > final CRLF.CRLF is actually sent to the other side, but somehow Dovecot > thinks it couldn't do that yet. > > Is this problem occurring for any and all SMTP client interactions, or > just every once in a while? Unfortunately it occurs just every once in a while and it is weird because at the second attempt the message is successful delivered or redirected. >>> Also, I don't see anything weird in the PCAP files: the command-reply >>> sequence is OK. This means that this is likely a bug in the current >>> Dovecot version. Those debug logs should tell me more. >> Ok! Which version of dovecot do you suggest to install? >> On debian current stable (stretch) repository there is the version >> number 2.2.27, have we to install it? > > If you're facing big trouble it is usually best to revert to the > previous version that worked I guess. Ok I'm agree! So, about you, which version can I try to install the 2.2.27 or the previous release of the 2.3 version such as v2.3.2 2018-06-29 or v2.3.1 2018-02-29? Regards, -- Gabriele Nencioni System Administrator eml gabriele.nencioni(a)register.it

2 6

purge causing reappearing mails?
by sch tel 02 Sep '19

02 Sep '19

3 3

flags not synced correctly with dovecot sync (dsync)
by Dan Christensen 31 Aug '19

31 Aug '19

I'm running dovecot 2.3.4.1 from https://repo.dovecot.org/ on Ubuntu 18.04 on three machines that I'll call server, laptop1 and laptop2. Both laptop1 and laptop2 run dovecot sync against server to keep local copies of my imap folders. Even when I initially had only two machines, laptop1 and server, I occasionally noticed that flags were lost, usually custom flags used by Gnus, but I couldn't reliably reproduce the problem. Now that I have two laptops syncing against the server, the problem has gotten worse and I figured out a way to reproduce it: - on server: create new IMAP folder test, and put two read messages in it - on laptop1: doveadm sync -u user -l 10 -m test -f user@server - on laptop2: doveadm sync -u user -l 10 -m test -f user@server At this point, all three machines show the two messages M1 and M2 as being read. - on laptop1: mark message M1 unread - on laptop2: mark message M2 unread - on laptop1: doveadm sync -u user -l 10 -m test -f user@server Both laptop1 and server have M1 unread, M2 read, as expected. - on laptop2: doveadm sync -u user -l 10 -m test -f user@server Now laptop2 and server have M1 *read*, M2 unread. - on laptop1: doveadm sync -u user -l 10 -m test -f user@server Now laptop1 and the server have both M1 and M2 *read*. - on laptop2: doveadm sync -u user -l 10 -m test -f user@server Now laptop2 has both read as well. The two lines that say "*read*" are wrong in my opinion. dsync propagated a read mark to an unread message, even though that message was marked unread more recently than it was marked read. I usually use stateful sync, and get many related problems. I just did a test in which M1 and M2 started out read, and I started with empty files named dstate.test on laptop1 and laptop2. Then I did the above procedure, using the command doveadm sync -u user -l 10 -m test -s "`cat dstate.test`" user@server > dstate.test At the end, laptop2 and server had both messages unread (which is good), but laptop1 had only M1 unread, and repeated runs of the sync command did not correct this. So the stateful sync failed to detect a change. Are these bugs in dovecot? Is there more information that I can provide? The output of doveconf -n on one machine is below, and the others are almost identical. Thanks for any help! Dan # 2.3.4.1 (3c0b8769e): /etc/dovecot/dovecot.conf # OS: Linux 4.15.0-45-generic x86_64 Ubuntu 18.04.1 LTS # Hostname: laptop2 auth_mechanisms = plain login listen = 127.0.0.1 mail_index_log2_max_age = 10 days mail_index_log_rotate_min_age = 1 days mail_index_log_rotate_min_size = 300 k mail_location = maildir:~/Maildir namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } passdb { args = scheme=CRYPT username_format=%u /etc/dovecot/users driver = passwd-file } protocols = imap service imap-login { inet_listener imap { address = * port = 143 } inet_listener imaps { address = * port = 943 ssl = yes } } service imap { process_limit = 25 } ssl_cert = </etc/dovecot/private/dovecot.pem ssl_client_ca_dir = /etc/ssl/certs ssl_dh = # hidden, use -P to show it ssl_key = # hidden, use -P to show it userdb { args = username_format=%u /etc/dovecot/users driver = passwd-file } protocol lda { postmaster_address = [elided] } protocol imap { mail_max_userip_connections = 20 }

3 8

Sieve Header question.
by Larry Rosenman 31 Aug '19

31 Aug '19

I'm trying to make my github processing better, but I'm missing something. I have the following: if address :all :contains "from" ["github.com"] { addflag "github"; addflag "MyFlags" "github"; set "mailbox" "GitHub"; if address :matches :user "to" "*" { set "GHUser" "${1}"; addflag "${GHUser}"; addflag "MyFlags" "${GHuser}"; } if header :matches "List-ID" "(.*/.*) <(.*)>" { set "mailbox" "github-lists/${1}"; } fileinto :flags "${MyFlags}" :create "${mailbox}"; stop; } I'm trying to match the apache-incubator-superset part of: List-ID: apache/incubator-superset <incubator-superset.apache.github.com> What am I missing? -- Larry Rosenman http://www.lerctr.org/~ler Phone: +1 214-642-9640 (c) E-Mail: larryrtx(a)gmail.com US Mail: 5708 Sabbia Dr, Round Rock, TX 78665-2106

1 1

problems witch quota working
by Bartłomiej Solarz-Niesłuchowski 30 Aug '19

30 Aug '19

Good evening! Dear list I have problem with quota-fs (rquota) support with dovecot. I use dovecot version: dovecot --version 2.3.7.1 (0152c8b10) build options: dovecot --build-options Build options: ioloop=epoll notify=inotify openssl io_block_size=8192 SQL driver plugins: mysql postgresql sqlite Passdb: checkpassword ldap pam passwd passwd-file shadow sql Userdb: checkpassword ldap(plugin) passwd prefetch passwd-file sql the privatedevices is in service set as no: systemctl show -p PrivateDevices dovecot PrivateDevices=no but quota (rquota on nfsv4) does not work: doveadm quota get -u solarz \doveadm(solarz): Error: Failed to get quota resource STORAGE: quota-fs: quotactl(Q_GETQUOTA, oceanic:/home) failed: No such file or directory Quota name Type Value Limit % User quota STORAGE error error error quota from os works: quota solarz Disk quotas for user solarz (uid 1761): Filesystem blocks quota limit grace files quota limit grace /dev/mapper/vg01-lvol00 1588264 40480000 40480000 12383 0 0 oceanic:/home 76318340 86284030 87416830 561911 1190000 1650000 configuration: # OS: Linux 5.2.9-200.fc30.x86_64 x86_64 Fedora release 30 (Thirty) # Hostname: dervish.wsisiz.edu.pl auth_cache_size = 8 k mail_access_groups = mail mail_fsync = always mail_location = maildir:~/Maildir:INBOX=/var/spool/mail/%u mail_max_userip_connections = 500 mail_nfs_index = yes mail_nfs_storage = yes mail_plugins = acl quota zlib trash mail_privileged_group = mail managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext mbox_write_locks = fcntl mmap_disable = yes namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } passdb { args = /etc/dovecot/deny-users deny = yes driver = passwd-file } passdb { args = cache_key=#hidden_use-P_to_show# max_requests=256 driver = pam } passdb { args = cache_key=#hidden_use-P_to_show# max_requests=256 driver = pam } plugin { quota = fs:User quota quota_grace = 10%% quota_status_nouser = DUNNO quota_status_overquota = 552 5.2.2 Mailbox is full quota_status_success = DUNNO quota_warning = storage=95%% quota-warning 95 %u quota_warning2 = storage=80%% quota-warning 80 %u sieve = file:~/sieve;active=~/.dovecot.sieve } postmaster_address = postmaster(a)wit.edu.pl protocols = imap pop3 service anvil { client_limit = 1155 } service auth { client_limit = 5248 user = root } service imap-login { client_limit = 1024 inet_listener imap { port = 0 } inet_listener imaps { address = [::], * port = 993 } process_limit = 1024 service_count = 0 } service imap { process_limit = 2048 vsz_limit = 512 M } service pop3-login { client_limit = 1024 inet_listener pop3 { port = 0 } inet_listener pop3s { address = [::], * port = 995 } process_limit = 128 service_count = 0 } service pop3 { process_limit = 2048 } service quota-warning { executable = script /usr/local/bin/quota-warning.sh user = dovenull } ssl = required ssl_cert = </etc/pki/tls/certs/ipop3d.pem ssl_cipher_list = PROFILE=SYSTEM ssl_dh = # hidden, use -P to show it ssl_key = # hidden, use -P to show it userdb { driver = passwd } userdb { driver = passwd } protocol imap { imap_client_workarounds = " tb-extra-mailbox-sep" mail_max_userip_connections = 200 mail_plugins = acl quota zlib trash imap_quota ssl_cert = </etc/pki/tls/certs/imapd.pem ssl_key = # hidden, use -P to show it } protocol pop3 { mail_max_userip_connections = 200 pop3_client_workarounds = outlook-no-nuls oe-ns-eoh pop3_uidl_format = %08Xu%08Xv ssl_cert = </etc/pki/tls/certs/ipop3d.pem ssl_key = # hidden, use -P to show it } Thank for any clues. Best Regards -- Bartłomiej Solarz-Niesłuchowski, Administrator WSISiZ e-mail: Bartlomiej.Solarz-Niesluchowski(a)wit.edu.pl tel. 223486547, fax 223486501 JID: solarz(a)jabber.wit.edu.pl 01-447 Warszawa, ul. Newelska 6, pokój 421, pon.-pt. 8-16 Motto - Jak sobie pościelisz tak sie wyśpisz

1 0

doveadm backup mdbox - initial copy slow
by Gerald Galster 30 Aug '19

30 Aug '19

Hello, when calling doveadm backup like in the following example, it seems to flush every email to disk maxing out harddrives (iops) and resulting in very poor performance: Calling doveadm -o plugin/quota= backup -u "statusmails(a)domain.com" "mdbox:/backup/vmail/domain.com/statusmails" finished in 212 secs [changes:1800 copy:1800 delete:0 expunge:0] The source mdbox holds 1800 small emails and uses about 20 MB disk space only. I've tried -f (full sync) and -l 30 (locking the mailbox) which did not get faster, nor did doveadm sync -1. When using doveadm import all mails are copied in less than 3 seconds: time doveadm -o mail=mdbox:/backup/vmail/domain.com/statusmails import mdbox:/var/vmail/domain.com/statusmails "" all real 0m2.605s Are there any other options I could try to speed up doveadm backup, avoiding the flush after each email? This is doveadm from dovecot 2.2 (>= 2.2.33). Does anyone get better results with 2.3 tree? Best regards Gerald

2 2

User / Pass SQL queries
by Michael Hallager 29 Aug '19

29 Aug '19

Hi all, Is there any reason Dovecot shows the 'user' variable (ie: user(a)domain.tld) being obtained in the password query and not the (more logical) user query? Thanks, Michael

2 1

permission issue after yum update
by Voytek Eymont 29 Aug '19

29 Aug '19

I've just updated my dovecot on centos, after 'yum update' dovecot failed to work, with manual restart it worked fine, just giving a warning: # dovecot Warning: Corrected permissions for login directory /var/run/dovecot/token-login dovecot --version 2.3.7.2 (3c910f64b) all's good, just reporting in case this is relevant to rpm maintainers thanks, V

1 0

download Dovecot
by Miquel Demur 29 Aug '19

29 Aug '19

I have downloaded in MacMini MacOS X applications directory the Dovecot.tzr.gz file from Dovecot v2.3.7.2 in https://www.dovecot.org/download I have clicked on dovecot-2.3.7.2 tar.gz and it creates a dovecot-2.3.7.2 directory containung 35 files. https://wiki2.dovecot.org/FrontPage?action=show&redirect=PageD%27Accueil#Do… https://wiki2.dovecot.org/FrontPage?action=show&redirect=PageD%27Accueil#Do… I have to compile to install in Terminal Application? ./configure make sudo make install in https://wiki2.dovecot.org/CompilingSource#Compiling_Dovecot_From_Sources without reference for dovecot.

2 1

Pigeonhole release v0.4.24.2
by Aki Tuomi 29 Aug '19

29 Aug '19

Hi! We are pleased to release Pigeonhole release v0.4.24.2 Tarball is available at https://pigeonhole.dovecot.org/releases/2.2/dovecot-2.2-pigeonhole-0.4.24.2… https://pigeonhole.dovecot.org/releases/2.2/dovecot-2.2-pigeonhole-0.4.24.2… Changes ------- * CVE-2019-11500: ManageSieve protocol parser does not properly handle NUL byte when scanning data in quoted strings, leading to out of bounds heap memory writes. Found by Nick Roessler and Rafi Rubin. --- Aki Tuomi Open-Xchange oy

2 2

Feature wishlist: Allow to hide client IP/host in submission service
by Sebastian Krause 28 Aug '19

28 Aug '19

Hi, In many mail setups a required feature (for privacy reasons) is to hide the host and IP of clients (in the "Received" header) that use the authenticated submission over port 587. In Postfix that's possible (https://serverfault.com/q/413533/86332) but not very nice to configure especially if you only want want to strip the Received header for port 587 submissions, but not on port 25. As far as I can see this configuration is not possible at all in the Dovecot submission server because the function which adds the Received header with the client's IP address (smtp_server_transaction_write_trace_record) is always called in submission-commands.c. It would be very useful if the submission server could anonymize the client with a single configuration option, then all the Postfix configuration mess (and using SASL) could be skipped by simply using the Dovecot submission server instead. The anonymization would work by replacing the client's EHLO host with "submission" and the IP address with 127.0.0.1. In full the Received header would look something like this where the first line is always the same: Received: from submission (unknown [127.0.0.1]) by mail.example.com with ESMTPSA id 8bV9D+51Yl1FOwAA1ctoJQ (envelope-from <john(a)example.com>) for <jane(a)example.com>; Sun, 25 Aug 2019 13:50:06 +0200 Sebastian

4 6

Pigeonhole release v0.5.7.2
by Aki Tuomi 28 Aug '19

28 Aug '19

Hi! We are pleased to release Pigeonhole release v0.5.7.2 Tarball is available at https://pigeonhole.dovecot.org/releases/2.3/dovecot-2.3-pigeonhole-0.5.7.2.… https://pigeonhole.dovecot.org/releases/2.3/dovecot-2.3-pigeonhole-0.5.7.2.… Binary packages are available at https://repo.dovecot.org/ Changes ------- * CVE-2019-11500: ManageSieve protocol parser does not properly handle NUL byte when scanning data in quoted strings, leading to out of bounds heap memory writes. Found by Nick Roessler and Rafi Rubin. --- Aki Tuomi Open-Xchange oy

1 0

Dovecot release v2.2.36.4
by Aki Tuomi 28 Aug '19

28 Aug '19

Hi! We are pleased to release Dovecot release v2.2.36.4 Tarball is available at https://dovecot.org/releases/2.2/dovecot-2.2.36.4.tar.gz https://dovecot.org/releases/2.2/dovecot-2.2.36.4.tar.gz.sig Binary packages are available at https://repo.dovecot.org/ Changes ------- * CVE-2019-11500: IMAP protocol parser does not properly handle NUL byte when scanning data in quoted strings, leading to out of bounds heap memory writes. Found by Nick Roessler and Rafi Rubin. --- Aki Tuomi Open-Xchange oy

1 0

Dovecot release v2.3.7.2
by Aki Tuomi 28 Aug '19

28 Aug '19

Hi! We are pleased to release Dovecot release v2.3.7.2 Tarball is available at https://dovecot.org/releases/2.3/dovecot-2.3.7.2.tar.gz https://dovecot.org/releases/2.3/dovecot-2.3.7.2.tar.gz.sig Binary packages are available at https://repo.dovecot.org/ Changes ------- * CVE-2019-11500: IMAP protocol parser does not properly handle NUL byte when scanning data in quoted strings, leading to out of bounds heap memory writes. Found by Nick Roessler and Rafi Rubin. --- Aki Tuomi Open-Xchange oy

1 0

unsubscrib
by Carlos Xavier 27 Aug '19

27 Aug '19

1 0

Group emails based on custom header
by Giovanni Mancuso 27 Aug '19

27 Aug '19

Hi, Can i "group by" e-mails based on custom header in imap? According to my experience if i use "XX UID SEARCH INTHREAD REFS HEADER myheader myvalue" i receive emails UID gathers by HEADER+VALUE, but in this way i need to fetch all emails using several imap SEARCH. Has dovecot any features that would help me do this? Thank you!!

2 1

doveadm mailbox handling for directory only
by sch tel 27 Aug '19

27 Aug '19

1 1

non-terminating processes
by Randy Bush 26 Aug '19

26 Aug '19

FreeBSD psg.com 11.3-RELEASE-p3 FreeBSD 11.3-RELEASE-p3 dovecot 2.3.6 (7eab80676) (latest from binary package system) symptom: multiple imap4s users complain that they can not fetch mail stopping and restarting dovecot is a temporary workaround dovenull 3713 0.0 0.0 11036 6816 - I 02:27 0:00.17 dovecot/imap-login user19 3714 0.0 0.0 9464 4756 - S 02:27 0:00.46 dovecot/imap dovenull 6261 0.0 0.0 11036 6812 - I 02:47 0:00.12 dovecot/imap-login dovenull 6262 0.0 0.0 11036 6804 - I 02:47 0:00.09 dovecot/imap-login dovenull 6263 0.0 0.0 11036 6804 - I 02:47 0:00.08 dovecot/imap-login user00 6264 0.0 0.0 9476 4924 - S 02:47 0:00.27 dovecot/imap user00 6265 0.0 0.0 9464 5444 - S 02:47 0:00.91 dovecot/imap user1 6266 0.0 0.0 9484 4636 - S 02:47 0:00.16 dovecot/imap dovenull 6277 0.0 0.0 11036 6804 - I 02:47 0:00.08 dovecot/imap-login user1 6279 0.0 0.0 9940 5096 - S 02:47 0:00.69 dovecot/imap dovenull 54595 0.0 0.0 11036 6916 - I 09:24 0:00.04 dovecot/imap-login dovenull 54596 0.0 0.0 11036 6916 - I 09:24 0:00.04 dovecot/imap-login user19 54597 0.0 0.0 9464 4784 - S 09:24 0:00.06 dovecot/imap user19 54598 0.0 0.0 9468 4676 - S 09:24 0:00.05 dovecot/imap dovenull 67450 0.0 0.0 11036 6924 - I 11:13 0:00.05 dovecot/imap-login userid0 67453 0.0 0.0 9488 4844 - S 11:13 0:00.05 dovecot/imap dovecot 68853 0.0 0.0 11484 6920 - S 11:29 0:00.32 dovecot/auth dovenull 74048 0.0 0.0 11036 6916 - I 12:15 0:00.03 dovecot/imap-login user54 74050 0.0 0.0 9552 4944 - I 12:15 0:00.02 dovecot/imap dovenull 74054 0.0 0.0 11036 6916 - I 12:15 0:00.03 dovecot/imap-login user54 74056 0.0 0.0 9492 5152 - I 12:15 0:00.06 dovecot/imap dovenull 74582 0.0 0.0 11036 6932 - S 12:20 0:00.07 dovecot/imap-login user19 74586 0.0 0.0 13572 7632 - S 12:20 0:04.14 dovecot/imap dovenull 74670 0.0 0.0 11036 6932 - S 12:21 0:00.05 dovecot/imap-login user01 74674 0.0 0.0 16768 6500 - S 12:21 0:02.33 dovecot/imap dovenull 74770 0.0 0.0 11036 6932 - S 12:21 0:00.05 dovecot/imap-login user01 74772 0.0 0.0 11500 5756 - S 12:21 0:00.08 dovecot/imap dovenull 74782 0.0 0.0 11036 6932 - I 12:21 0:00.04 dovecot/imap-login user01 74786 0.0 0.0 9460 5516 - I 12:21 0:00.05 dovecot/imap dovenull 74893 0.0 0.0 11036 6936 - I 12:22 0:00.04 dovecot/imap-login id0 74894 0.0 0.0 10644 5552 - S 12:22 0:00.05 dovecot/imap dovenull 74952 0.0 0.0 11036 6928 - I 12:23 0:00.03 dovecot/imap-login id0en 74954 0.0 0.0 9480 4900 - S 12:23 0:00.05 dovecot/imap dovenull 74958 0.0 0.0 11036 6916 - I 12:23 0:00.03 dovecot/imap-login id002 74959 0.0 0.0 9452 4756 - S 12:23 0:00.04 dovecot/imap dovenull 74961 0.0 0.0 11036 6916 - I 12:23 0:00.03 dovecot/imap-login id0 74962 0.0 0.0 9572 5088 - S 12:23 0:00.05 dovecot/imap dovenull 74964 0.0 0.0 11036 6916 - I 12:23 0:00.03 dovecot/imap-login id0 74966 0.0 0.0 9528 4892 - S 12:23 0:00.02 dovecot/imap dovenull 76400 0.0 0.0 11036 6916 - I 12:35 0:00.03 dovecot/imap-login user19 76401 0.0 0.0 9468 4804 - I 12:35 0:00.01 dovecot/imap root 76686 0.0 0.0 11484 7072 - S 12:38 0:00.37 dovecot/auth -w dovenull 77507 0.0 0.0 11036 6940 - I 12:45 0:00.16 dovecot/imap-login user5 77511 0.0 0.1 69164 12120 - I 12:45 0:00.49 dovecot/imap dovenull 78745 0.0 0.0 11036 6932 - S 12:56 0:00.05 dovecot/imap-login dovenull 78748 0.0 0.0 11036 6932 - S 12:56 0:00.06 dovecot/imap-login user5 78761 0.0 0.0 9476 5268 - S 12:56 0:00.12 dovecot/imap user5 78766 0.0 0.0 9492 5212 - S 12:56 0:00.12 dovecot/imap dovenull 78776 0.0 0.0 11036 6916 - S 12:56 0:00.03 dovecot/imap-login usr4 78777 0.0 0.0 9452 4564 - I 12:56 0:00.01 dovecot/imap root 88537 0.0 0.0 7940 1648 - Ss 00:51 0:04.00 /usr/local/sbin/dovecot -c /usr/local/etc/dovecot/dovecot.conf dovecot 88538 0.0 0.0 7880 1832 - S 00:51 0:01.04 dovecot/anvil root 88539 0.0 0.0 7880 1820 - S 00:51 0:00.86 dovecot/log dovenull 88540 0.0 0.0 11036 3992 - S 00:51 0:00.10 dovecot/imap-login root 88541 0.0 0.0 8008 3176 - S 00:51 0:04.18 dovecot/config dovecot 88542 0.0 0.0 7880 2592 - S 00:51 0:01.57 dovecot/stats dovenull 88544 0.0 0.0 11036 4088 - S 00:51 0:00.16 dovecot/imap-login dovenull 88545 0.0 0.0 11036 4064 - S 00:51 0:00.17 dovecot/imap-login dovenull 88546 0.0 0.0 11036 4016 - I 00:51 0:00.11 dovecot/imap-login user00 88547 0.0 0.0 9476 4156 - S 00:51 0:00.45 dovecot/imap usr9 88548 0.0 0.0 9460 4168 - S 00:51 0:00.49 dovecot/imap user1 88551 0.0 0.0 9452 3148 - S 00:51 0:00.22 dovecot/imap dovenull 88557 0.0 0.0 11036 4024 - I 00:52 0:00.11 dovecot/imap-login user17 88561 0.0 0.0 9472 3128 - S 00:52 0:00.22 dovecot/imap user17 88565 0.0 0.0 9472 3120 - S 00:52 0:00.23 dovecot/imap dovenull 88576 0.0 0.0 11036 3776 - I 00:52 0:00.18 dovecot/imap-login user19 88579 0.0 0.0 9604 2872 - S 00:52 0:00.40 dovecot/imap clues? just installing 2.3.7 from source to see if that helps randy

2 2

sometimes no shared cipher after upgrade from 2.2 to 2.3
by Kristijan Savic - ratiokontakt GmbH 23 Aug '19

23 Aug '19

We recently upgraded from dovecot 2.2 to 2.3.7.1-1 Not many, but some users are experiencing difficulties. The dovecot directors log: Aug 21 14:28:49 director01 dovecot: pop3-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=redacted, lip=10.0.0.120, TLS handshaking: SSL_accept() failed: error:1408A0C1:SSL routines:ssl3_get_client_hello:no shared cipher, session=<EeoTt5+QXwVUl87W> Any ide what could be causing it? Thanks, Kristijan

4 6

Trying to install Mailcrypt, receive completely blank emails
by sewing 22 Aug '19

22 Aug '19

Hi - perhaps someone can help me. Starting from a good and well-functioning mailserver setup, I have installed MailCrypt as per the instructions (I think) to have the per-user passworded keys setup. dovecot.conf /Added:/ mail_attribute_dict = file:%h/Maildir/dovecot-attributes mail_plugins = $mail_plugins mail_crypt dovecot-sql.conf.ext /commented this/ #password_query = SELECT email as user, password FROM virtual_users WHERE email='%u'; /Added this/ password_query = SELECT \ email as user, password, \ '%w' AS userdb_mail_crypt_private_password \ FROM virtual_users WHERE email='%u'; 90-plugin.conf /Updated this section/ plugin { mail_crypt_curve = secp521r1 mail_crypt_save_version = 2 /Have also tried all configurations this option set /#mail_crypt_require_encrypted_user_key = yes } /The user is in the mailserver SQL database:/ | user | password | userdb_mail_crypt_private_password | +----------------------+------------------------------------------------------------------------------------------------------------+------------------------------------+ | user@domain | 4t63ttt36tttttt3rt6r763r76t8998t858t4y48ht4huu4hti.76876t847t47yt4ty478yt4wgwygfwffweggggggggggwy8yey83//FElgiApZU. | %w /I have reissued the keys as other problem resolutions have instructed to do, and I can see the new keys are active./ doveadm -o plugin/mail_crypt_private_password=(same password as user@domain when created in SQL) mailbox cryptokey generate -u user@domain -UR /I have restarted dovecot and postfix each time./ /I then send an email either from the user@domain > user@domain OR otheruser@otherdomain > user@domain from Outlook. Authentication is fine (POP and SMTP). No errors appear in any logs - the logs show the mail as being received and I can see the mail in the user@domain /cur folder. If I try to Postcat any of these messages I get:/ postcat '1*********2.M**********3.(host),S=633,W=649:2,S' *** ENVELOPE RECORDS 1*********2.M*********3.(host),S=633,W=649:2,S *** message_size: YPTED postcat: fatal: invalid size record: YPTED??? */Within a minute or so I receive the email in the Outlook Inbox - except it is completely empty of anything. There is no TO / FROM/ SUBJECT / Body or even Routing information. See screencaps from Outlook/* <http://dovecot.2317879.n4.nabble.com/file/t5785/message_list_view.jpg> <http://dovecot.2317879.n4.nabble.com/file/t5785/empty-emails.jpg> /This happens with existing user mailboxes and new test mailboxes I create. If I deactivate Mailcrypt all mailboxes/user-accounts work fine. Any ideas??? I would like to get the working - thanks in advance for your expertise and time!/ Graham -- Sent from: http://dovecot.2317879.n4.nabble.com/

1 0

imapsieve suddenly not working anymore
by Thomas Stein 21 Aug '19

21 Aug '19

Hello one and all. Dovecot version 2.3.7.1 I've configured imapsieve like https://wiki.dovecot.org/HowTo/AntispamWithSieve a while a go and it worked for years now. Suddenly i noticed moving mails to the spamfolder does not trigger the report-spam.sieve script anymore. sieve-test gives: ~/.maildir/.Spam/cur $ sieve-test /usr/share/dovecot/sieve/report-spam.sieve 1542388745.M99384P16720.meine-oma.de\,S\=8173\,W\=8373\:2\,S -D sieve-test(himbeere): Debug: sieve: Pigeonhole version 0.5.7.1 (db5c74be) initializing sieve-test(himbeere): Debug: sieve: include: sieve_global is not set; it is currently not possible to include `:global' scripts. sieve-test(himbeere): Debug: sieve: Sieve imapsieve plugin for Pigeonhole version 0.5.7.1 (db5c74be) loaded sieve-test(himbeere): Debug: sieve: Sieve Extprograms plugin for Pigeonhole version 0.5.7.1 (db5c74be) loaded debug: file storage: Using Sieve script path: /usr/share/dovecot/sieve/report-spam.sieve. debug: file script: Opened script `report-spam' from `/usr/share/dovecot/sieve/report-spam.sieve'. debug: Script binary /usr/share/dovecot/sieve/report-spam.svbin successfully loaded. debug: binary save: not saving binary /usr/share/dovecot/sieve/report-spam.svbin, because it is already stored. report-spam: error: the imapsieve extension cannot be used outside IMAP. sieve-test(himbeere): Info: final result: failed; resolved with successful implicit keep ~/.maildir/.Spam/cur $ I'm not sure the "the imapsieve extension cannot be used outside IMAP" is the error already or thats only because the sieve-test script. Any ideas on that? cheers, t.

1 3

maildir very dirty sync option
by Yousif Alkhateeb 20 Aug '19

20 Aug '19

Hello , I have an active passive dovecot setup with glusterfs as a mail storage and using maildirs, we used to have a problem when users with large mailboxes sync their folders. This caused the load average to increase in the server , after a while we have enabled the very_dirty_sync option in dovecot , things got better and the problem disappeared but we need to know if there is any thing else that we need to do or know about the very_dirty_sync option that may cause future problems . Thanks in advance

3 2

Dovecot and Oauth
by Michael Hallager 20 Aug '19

20 Aug '19

Hi all, I am considering expanding a mail server to support Oauth with Google. I have read through the following: https://wiki.dovecot.org/PasswordDatabase/oauth2 however, it doesn't work and appears to me to be missing important information, the least of which is API authorisation. Searching with Google, I can't find any more information beyond what amounts to C&P'ing of the above link. Has anyone successfully deployed Oauth with Google and could they please send me their config files? Thanks, Michael

2 1

Dovecot and hard links?
by ＠lbutlr 18 Aug '19

18 Aug '19

I was looking at a mail folder and I noted that a file in the inbox had a total of 11 hard links to it: 👹 # exa -lH cur/1564249738.M167990P53982.mail.covisp.net,S=8572,W=8738:2,Sgl .rw------- 11 8.6k vpopmail 19 Jul 19:59 cur/1564249738.M167990P53982.mail.covisp.net,S=8572,W=8738:2,Sgl 👹 # find . -samefile cur/1564249738.M167990P53982.mail.covisp.net,S=8572,W=8738:2,Sgl [6:59] [/usr/local/virtual/kreme(a)kreme.com/Maildir] ./.Junk/cur/1564253637.M808919P50422.mail.covisp.net,S=8572,W=8738:2,bc ./.Junk/cur/1564253637.M808920P50422.mail.covisp.net,S=8572,W=8738:2,bc ./.Junk/cur/1564253723.M977674P50422.mail.covisp.net,S=8572,W=8738:2,bc ./.Junk/cur/1564253723.M977675P50422.mail.covisp.net,S=8572,W=8738:2,bc ./.Junk/cur/1564253723.M977676P50422.mail.covisp.net,S=8572,W=8738:2,bc ./.Junk/cur/1563587951.M591499P47868.mail.covisp.net,S=8572,W=8738:2, ./.Junk/cur/1564851795.M381461P10380.mail.covisp.net,S=8572,W=8738:2,bc ./.Junk/cur/1564851795.M381462P10380.mail.covisp.net,S=8572,W=8738:2,bc ./.Junk/cur/1564852369.M760020P10380.mail.covisp.net,S=8572,W=8738:2,bc ./.Trash/cur/1563587951.M591499P47868.mail.covisp.net,S=8572,W=8738:2,S ./cur/1564249738.M167990P53982.mail.covisp.net,S=8572,W=8738:2,Sgl A bit of background: a few weeks ago I had thousands of files in the mail store that had hundreds of links, and I got that all cleaned up through juggling some grep and awk to delete all but one of the linked files. I figured this was caused by something I’d done when I moved local users into being virtual users and eliminated pam authentication in favor of sql. But this gives me pause. I think it’s normal for a file in the INBOX that is marked as junk or as deleted to have a single hard link (or at least it is since the default was set to maildir_copy_with_hardlinks), but 11? And when do these hard links get cleaned off? If I delete the trashed and junked messages, when does dovecot go through and removed the linked files in the cur/ folder? (It’s not immediate, I trashed those copies in Junk and Trash and the original file is still in the cur folder) -- There is nothing so stupid that some person somewhere will not, with earnestness, say it.

3 5

Re: Submission and TLS client certificate
by Christian Rößner 18 Aug '19

18 Aug '19

Hi, > Am 18.08.2019 um 16:52 schrieb Stephan Bosch via dovecot <dovecot(a)dovecot.org>: > > > >>> On 18/08/2019 10:09, Christian Rößner via dovecot wrote: >> Hi, >> is there some configuration parameter in Dovecot, which sends a TLS client certificate to the SMTP server? I would need this to have XCLIENT enabled and TLS with Postfix. This way I could permit sending based on the certificates fingerprint. > > Can you elaborate? Are you talking about the submission relay service or submission of outgoing messages from e.g. Sieve? The submission relay service. I like the idea of this service. Currently I did not activate the relay trust option, because I have no idea on how I could give permissions on the Postfix side. If Dovecot would send the certificate as reply to the smtpd_ask_ccert option, I could turn on XCLIENT in Dovecot and give permission based on the certificate fingerprint. At the moment I do STARTTLS from Dovecot to Postfix and have added Dovecot‘s IP to mynetworks in Postfix. But I would prefer XCLIENT. Thanks in advance Christian > > Regards, > > Stephan. > >> Thanks in advance >> Christian >> Von unterwegs aus gesendet >> -- >> Rößner-Network-Solutions >> Karl-Bröger-Str. 10, 36304 Alsfeld <x-apple-data-detectors://0/0> >> Fax: +49 6631 78823409 <tel:+49%206631%2078823409>, Mobil: +49 171 9905345 <tel:+49%20171%209905345> >> USt-IdNr.: DE225643613, https://roessner.website <https://roessner.website/> >> PGP Fingerprint: 8FB3 132F 85D8 C9C7 A9F1 9A3F 5183 D46C B885 897E

1 0

Submission and TLS client certificate
by Christian Rößner 18 Aug '19

18 Aug '19

Hi, is there some configuration parameter in Dovecot, which sends a TLS client certificate to the SMTP server? I would need this to have XCLIENT enabled and TLS with Postfix. This way I could permit sending based on the certificates fingerprint. Thanks in advance Christian Von unterwegs aus gesendet -- Rößner-Network-Solutions Karl-Bröger-Str. 10, 36304 Alsfeld Fax: +49 6631 78823409, Mobil: +49 171 9905345 USt-IdNr.: DE225643613, https://roessner.website PGP Fingerprint: 8FB3 132F 85D8 C9C7 A9F1 9A3F 5183 D46C B885 897E

2 1

exim+dovecot+sieve issue
by JM 18 Aug '19

18 Aug '19

Hi, We have mail server in production, with Exim + Dovecot + Mailman + OpenLDAP + Roundcube webmail server. Openldap keeps mail accounts in db, exim uses lmtp transport to deliver messages to dovecot. Mailman is responsible for mailing lists, Roundcube webmail has managsieve module to create sieve filters. Exim router,transport for dovecot > localuser: > driver = accept > domains = +local_domains : +virt_domains > check_local_user > transport = dovecot_lmtp > cannot_route_message = Unknown account > no_more > dovecot_lmtp: > driver = lmtp > socket = /var/spool/dovecot/lmtp > batch_max = 500 > rcpt_include_affixes It worked perfectly, but after upgrade from Dovecot 2.2 to Dovecot 2.3 major version, I've found a lot of strange errors in exim panic.log > mail exim[7821] Failed to get user name for uid 1175 > mail exim[7880]: Failed to get user name for uid 1173 etc where uids are ldap accounts and recognized by system (id 1175 shows user's name and group) Even worse, some clients start to receive notify email with strange content, when sending email to mailing lists > user(a)domain.com > Delay reason: error in redirect data: malformed address: > someuser1(a)domain.com may not follow someuser2(a)domain.com in " > someuser3(a)domain.com ..some crap here.." , where someuser addresses are > not related to recipient address and unknown for sender. After some investigation,I've found out that dovecot's sieve produces these errors (I suspect sieve vacation, when user creates vacation via Roundcube webmail). If set "submission_host = exim ip" in dovecot.conf, exim doesn't produce errors in panic.log anymore, but clients still receive email with malformed address. Please help me to find the root of the problem (some broken sieve filter in user's maildir, misconfiguration or breaking changes in new Dovecot version?) Current software Gentoo with 4.14.90 kernel Dovecot-2.3.7.1 Exim-4.92.1 Mailman 2.1.29 Openldap-2.4.47 Roundcube-1.3.8 Dovecot.conf attached Regards, Juri

2 1

2.3.7 + stats
by Matt Bryant 17 Aug '19

17 Aug '19

Is there any additional documentation/information around the new stats module. Have added some metrics just to see what they produce ## ## Metrics ### metric imap { event_name = imap_command_finished #source_location = example.c:123 #categories = fields = name args running_usecs bytes_in bytes_out #filter { # field_key = wildcard #} } metric sql { event_name = sql_query_finished } metric auth { event_name = auth_request_finished fields = user transport error successful } and get the following [root@stargate dovecot]# doveadm stats dump metric_name field count sum min max avg median stddev %95 imap duration 370 2007904499 130 62955249 5426768.92 2068 16436817.37 60026465 imap name 370 0 0 0 0.00 0 0.00 0 imap args 0 0 0 0 0.00 0 0.00 0 imap running_usecs 370 2007865330 81 62955127 5426663.05 1991 16436816.76 60026329 imap bytes_in 370 5366 2 173 14.50 8 19.04 35 imap bytes_out 370 2119971 0 941517 5729.65 41 53760.89 2082 sql duration 18 28991 991 2305 1610.61 1660 377.36 2305 auth duration 12 26046980 8146 7079879 2170581.67 847730 2457811.23 7079879 auth user 12 0 0 0 0.00 0 0.00 0 auth transport 12 0 0 0 0.00 0 0.00 0 auth error 0 0 0 0 0.00 0 0.00 0 auth successful 0 0 0 0 0.00 0 0.00 0 the main wiki page on stats/events doesnt really hold much detail whats stores for each event the above fields dont make much sense and top no longer works out of the box [root@stargate dovecot]# doveadm stats top usage: doveadm [-Dv] [-f <formatter>] stats <command> [<args>] dump [-s <stats socket path>] [-r] [-f <fields>] has is been removed ? do you need to specify something additional now ??? rgds Matt

3 2

James spooling messages problem
by Adam Raszkiewicz 16 Aug '19

16 Aug '19

For some reason my James setup is creating some kind of spooling queue of sending messages. It will queue 3 of them and then forth “sent” message will make 1st one to be sent outside. Any thoughts? Thanks -- Adam

1 0

SASL: encoded packet size too big
by Eugene 16 Aug '19

16 Aug '19

Hello! Dovecot uses it's own SASL implementation, doesn't it? Aug 14 23:45:23 example.com auth[10428]: GSSAPI client step 1 Aug 14 23:45:23 example.com auth[10428]: encoded packet size too big (813804546 > 65536) Aug 14 23:45:23 example.com dovecot[10085]: auth-worker(10428): Error: LDAP: Can't connect to server: ldap://ipa2.example.com Aug 14 23:45:23 example.com dovecot[10085]: auth: Error: auth worker: Aborted USER request for eugene: Lookup timed out Aug 14 23:45:23 example.com dovecot[10085]: imap: Error: auth-master: login: request [3847225345]: Login auth request failed: Internal auth failure (auth connected 60000 msecs ago, request took 60000 msecs, client-pid=10362 client-id=1) Looks like cyrus-sasl encountered same problem earlier. https://lists.andrew.cmu.edu/pipermail/cyrus-sasl/2017-March/003001.html I never have such an issue with ldapsearch. So, I assume there is a similar problem in Dovecot SASL implementation. -- Eugene Bright IT engineer Tel: + 79257289622

3 6

Re: Dovecot - Microsoft Azure AD
by Aki Tuomi 15 Aug '19

15 Aug '19

Hi! Dovecot supports Lua userdb, which can be used to implement custom user databases, maybe this might work for you? See https://doc.dovecot.org/configuration_manual/authentication/lua_based_authe… for more details. Aki > On 15/08/2019 12:16 Lennart Boettcher <lennart.boettcher(a)secpoint.onmicrosoft.com> wrote: > > > Hello, > > Thank you for the quick reply. > > > > > > I have expressed myself wrongly. Our idea was to use the Azure-AD as userdb by doing the user lookup with the help of Microsoft's Graph API. OAuth2 would then of course only be the authorization procedure to access the user accounts using the Graph API. > > > > > > One would then implement a graph-userdb and no oauth-userdb. OAuth is, as you correctly mentioned, only an authorization mechanism. > > > > > > Here is a link to the GraphAPI: https://docs.microsoft.com/de-de/graph/api/overview?view=graph-rest-1.0 > > > And here is another link to the Graph Explorer, with which you can see how the GraphAPI works: https://developer.microsoft.com/en-us/graph/graph-explorer > > > > > We already use this procedure for the passdb lookup and it works very well. > > > > > Greetings > > Lennart Boettcher > > > > > ------------------------------ > > From: Aki Tuomi <aki.tuomi(a)open-xchange.com> > Sent: 14 August 2019 14:57 > To: Lennart Boettcher <lennart.boettcher(a)secpoint.onmicrosoft.com>; Lennart Boettcher via dovecot <dovecot(a)dovecot.org> > Subject: Re: Dovecot - Microsoft Azure AD > > > > On 14/08/2019 15:36 Lennart Boettcher via dovecot <dovecot(a)dovecot.org> wrote: > > > > > > > > Hello, > > > > I am currently trying to connect my Dovecot mail server to Microsoft's Azure-AD and use it as password and user database. I am using version 2.3.7.1. > > > > > > > > > > > > Using the Azure-AD as passdb already works. In this context I noticed that the scope implementation is not yet merged. > > > > > > > > > > > > Since I haven't found any hints for an OAuth2 userdb implementation yet, I wanted to ask if there are any plans for an implementation. > > > > > > > > > > Greetings > > > > Lennart Boettcher > > > > > > > > > > Dovecot 2.3 supports oauth2. I don't know how "oauth2 user database" would work, since oauth2 is an authentication mechanism. I suggest you use LDAP or static userdb, or set mail_* settings for user settings. > > Aki >

1 0

Dovecot not responding to external clients
by Edwin Humphries 15 Aug '19

15 Aug '19

Hi all I have Dovecot on my Linux-Mint workstation, running IMAP for the Thunderbird client thereon, but previously also for my phone and laptop clients as well. Since upgrading to Linux-Mint 19, however, although the Thunderbird client on the workstation works just fine, the other clients can't connect. I've disabled the firewall, and nmap shows the ports open, so it seems like some setting in the server. Can anyone help? > Dovecot version is 2.2.33.2 (d6601f4ec) > > dovecot -n output: > > # 2.2.33.2 (d6601f4ec): /etc/dovecot/dovecot.conf > # Pigeonhole version 0.4.21 (92477967) > # OS: Linux 4.15.0-55-generic x86_64 Linux Mint 19.1 Tessa > mail_location = mbox:~/mail:INBOX=/var/mail/%u > mail_privileged_group = mail > namespace inbox { > inbox = yes > location = > mailbox Drafts { > special_use = \Drafts > } > mailbox Junk { > special_use = \Junk > } > mailbox Sent { > special_use = \Sent > } > mailbox "Sent Messages" { > special_use = \Sent > } > mailbox Trash { > special_use = \Trash > } > prefix = > } > passdb { > driver = pam > } > protocols = " imap" > ssl_cert = </etc/dovecot/private/dovecot.pem > ssl_client_ca_dir = /etc/ssl/certs > ssl_key = # hidden, use -P to show it > userdb { > driver = passwd > } > -- Regards, Edwin Humphries

2 2

Autoexpunge not working for Junk?
by Amir Caspi 14 Aug '19

14 Aug '19

Hi all, I set up dovecot a couple of months ago and am having trouble getting autoexpunge=30d to work on my Trash and Junk mailboxes. Not sure why not because I'm not getting error messages in my log. Running "doveadm search -u <user> mailbox Junk savedbefore 30d" shows me many messages (I've got messages back to mid-May, and a couple of other users have them back to early April, although if this setting were working, there should be nothing earlier than June 24). Running a manual doveadm expunge works fine... it's just autoexpunge that seems to not be running at all. I'm using sendmail as the MTA and procmail as the LDA, so dovecot is running purely for IMAP/POP service. Any help is much appreciated. Thanks! doveconf -n: # 2.2.36 (1f10bfa63): /etc/dovecot/dovecot.conf # OS: Linux 3.10.0-957.21.3.el7.x86_64 x86_64 CentOS Linux release 7.6.1810 (Core) # Hostname: REDACTED auth_username_format = %Ln first_valid_uid = 1000 mail_location = mbox:~/mail:INBOX=/var/spool/mail/%u mailbox_list_index = yes mbox_write_locks = fcntl namespace compat1 { alias_for = hidden = yes list = no location = prefix = mail/ separator = / } namespace compat2 { alias_for = hidden = yes list = no location = prefix = ~/mail/ separator = / } namespace compat3 { alias_for = hidden = yes list = no location = prefix = ~%u/mail/ separator = / } namespace inbox { inbox = yes location = mailbox Archive { special_use = \Archive } mailbox "Deleted Messages" { autoexpunge = 30 days special_use = \Trash } mailbox Drafts { special_use = \Drafts } mailbox Junk { autoexpunge = 30 days special_use = \Junk } mailbox "Junk E-mail" { autoexpunge = 30 days special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Spam { autoexpunge = 30 days special_use = \Junk } mailbox Trash { autoexpunge = 30 days special_use = \Trash } prefix = separator = / } passdb { driver = pam } pop3_uidl_format = %08Xv%08Xu ssl_cert = # REDACTED ssl_cipher_list = # REDACTED ssl_dh_parameters_length = # REDACTED ssl_key = # hidden, use -P to show it ssl_prefer_server_ciphers = yes userdb { driver = passwd } --- Amir

7 14

segmentation fault in fs_list_get_path
by David M. Johnson 14 Aug '19

14 Aug '19

Hi, There seems to be a straightforward bug in src/lib-storage/list/mailbox-list-fs.c:79. set->index_dir is unchecked prior to dereferencing (unlike on line 126 in the same file, where it is properly checked). This manifested on a FreeBSD server running dovecot 2.3.6 when clients tried to retrieve mail with subscriptions like `~/bar/baz`. This caused the `imap` child to crash, e.g. (slightly anonymized) Core was generated by `imap: [foo w.x.y.z EXAMINE]'. Program terminated with signal SIGSEGV, Segmentation fault. #0 0x0000000011593af4 in fs_list_get_path (_list=0x12444848, name=0x12416880 "/home/foo/bar/baz", type=MAILBOX_LIST_PATH_TYPE_INDEX, path_r=0x7fffffffe150) at mailbox-list-fs.c:79 79 *set->index_dir == '\0') (gdb) bt #0 0x0000000011593af4 in fs_list_get_path (_list=0x12444848, name=0x12416880 "/home/foo/bar/baz", type=MAILBOX_LIST_PATH_TYPE_INDEX, path_r=0x7fffffffe150) at mailbox-list-fs.c:79 #1 0x0000000011559dd0 in mbox_list_get_path (list=0x12444848, name=0x124da410 "~/bar/baz", type=MAILBOX_LIST_PATH_TYPE_INDEX, path_r=0x7fffffffe2c8) at mbox-storage.c:96 #2 0x000000001150ed0b in mailbox_list_get_path (list=0x12444848, name=0x124da410 "~/bar/baz", type=MAILBOX_LIST_PATH_TYPE_INDEX, path_r=0x7fffffffe2c8) at mailbox-list.c:1387 #3 0x00000000114f8aaf in get_path_to (box=0x124da048, type=MAILBOX_LIST_PATH_TYPE_INDEX, internal_path=0x124da250, path_r=0x7fffffffe2c8) at mail-storage.c:2662 #4 0x00000000114f89e9 in mailbox_get_path_to (box=0x124da048, type=MAILBOX_LIST_PATH_TYPE_INDEX, path_r=0x7fffffffe2c8) at mail-storage.c:2678 #5 0x00000000114f928c in mailbox_create_missing_dir (box=0x124da048, type=MAILBOX_LIST_PATH_TYPE_INDEX) at mail-storage.c:2826 #6 0x00000000115cf049 in index_storage_mailbox_alloc_index (box=0x124da048) at index-storage.c:243 #7 0x00000000115cf43f in index_storage_mailbox_open (box=0x124da048, move_to_memory=false) at index-storage.c:297 #8 0x000000001155a715 in mbox_mailbox_open_finish (mbox=0x124da048, move_to_memory=false) at mbox-storage.c:413 #9 0x000000001155a94b in mbox_mailbox_open_existing (mbox=0x124da048) at mbox-storage.c:452 #10 0x0000000011559309 in mbox_mailbox_open (box=0x124da048) at mbox-storage.c:489 #11 0x00000000115a446e in mailbox_list_index_open_mailbox (box=0x124da048) at mailbox-list-index.c:720 #12 0x00000000114f43ed in mailbox_open_full (box=0x124da048, input=0x0) at mail-storage.c:1294 #13 0x00000000114f4117 in mailbox_open (box=0x124da048) at mail-storage.c:1350 #14 0x000000000103d788 in select_open (ctx=0x12443228, mailbox=0x12416810 "~/bar/baz", readonly=true) at cmd-select.c:287 #15 0x000000000103d307 in cmd_select_full (cmd=0x12443048, readonly=true) at cmd-select.c:415 #16 0x0000000001034afa in cmd_examine (cmd=0x12443048) at cmd-examine.c:8 #17 0x000000000104a520 in command_exec (cmd=0x12443048) at imap-commands.c:201 #18 0x000000000104804e in client_command_input (cmd=0x12443048) at imap-client.c:1164 #19 0x00000000010483cf in client_command_input (cmd=0x12443048) at imap-client.c:1227 #20 0x00000000010469fc in client_handle_next_command (client=0x12442848, remove_io_r=0x7fffffffe8c7) at imap-client.c:1269 #21 0x00000000010463c0 in client_handle_input (client=0x12442848) at imap-client.c:1283 #22 0x0000000001044134 in client_input (client=0x12442848) at imap-client.c:1329 #23 0x0000000011b6bd1c in io_loop_call_io (io=0x1244f240) at ioloop.c:703 #24 0x0000000011b6fc08 in io_loop_handler_run_internal (ioloop=0x1242b0a0) at ioloop-kqueue.c:160 #25 0x0000000011b6c37e in io_loop_handler_run (ioloop=0x1242b0a0) at ioloop.c:755 #26 0x0000000011b6c146 in io_loop_run (ioloop=0x1242b0a0) at ioloop.c:728 #27 0x0000000011a87dcb in master_service_run (service=0x12436000, callback=0x1060080 <client_connected>) at master-service.c:781 #28 0x000000000105f870 in main (argc=1, argv=0x7fffffffeb20) at main.c:523 (gdb) p set->index_dir $3 = 0x0 The following one-liner fixes the immediate problem (although I didn't look closely to see what set->index_dir means in the context of MAILBOX_LIST_PATH_TYPE_INDEX): --- src/lib-storage/list/mailbox-list-fs.c~ 2019-04-30 06:25:06.000000000 -0600 +++ src/lib-storage/list/mailbox-list-fs.c 2019-08-02 16:23:57.254087000 -0600 @@ -76,6 +76,7 @@ if (mailbox_list_try_get_absolute_path(_list, &name)) { if (type == MAILBOX_LIST_PATH_TYPE_INDEX && + set->index_dir != NULL && *set->index_dir == '\0') return 0; *path_r = name; David

2 1

auth module logging
by AP 14 Aug '19

14 Aug '19

Hi, As per my discussion with cmouse on irc, I'm currently just using dovecot for its auth mechanism, etc capabilities (alas, Exim does not support argon directly). Tis a fun little side project. :) I have the config pared down as far as I think is reasonable (see below) and all is working well except that dovecot is very silent. Errors hit the logs but I would appreciate seeing successful auths happen for the additional piece of mind. Cmouse and I couldn't find a way to do it on irc and it appears that the capability is missing. Successul /logins/ can be logged but auths, by themselves, cannot. I would appreciate if the ability was added. Dovecot 2.3.7.1 is in use. Thanks # Pigeonhole version 0.5.7.1 (db5c74be) # OS: Linux 5.2.4 x86_64 Debian 10.0 # Hostname: bob auth_mechanisms = plain login auth_verbose = yes auth_verbose_passwords = sha1:16 log_timestamp = "%Y-%m-%d %H:%M:%S %z " mail_log_prefix = "%{pid}<%{session}> %{service}(%{user}): " passdb { args = /etc/dovecot/dovecot-sql.conf.ext driver = sql } service anvil { unix_listener anvil-auth-penalty { mode = 00 } } service auth-worker { user = $default_internal_user } service auth { unix_listener auth-client { group = Debian-exim mode = 0660 } } ssl = no userdb { args = /etc/dovecot/dovecot-sql.conf.ext driver = sql } AP

3 3

dovecot-uidlist invalid data
by Király Balázs 14 Aug '19

14 Aug '19

Hi! I'm struggling with the following error: Aug 4 21:32:00 mx02 dovecot: imap(xxx(a)xxx.tld)<17693><w14vpU+PCCSwPxpo>: Error: Mailbox INBOX: Broken file /home/vmail/xxx.tld/xxx/dovecot-uidlist line 6246: Invalid data: Aug 4 21:49:22 mx02 dovecot: imap(xxx(a)xxx.tld)<21879><YNhW40+PLoBOGLlU>: Error: Mailbox INBOX: Broken file /home/vmail/xxx.tld/xxx/dovecot-uidlist line 6249: Invalid data: It seems the first part is not incremented properly and sometimes it has a jump in it, like the line 6246: 18810 :1564935891.M816284P8904.mx01.m.ininet.hu,S=12145,W=12409 18812 :1564947092.M542714P2651.mx01.m.ininet.hu,S=12275,W=12517 Even though I deleted all the dovecot* files the error comes back. I have the maildirs through NFS, but I set to store the INDEX files locally. I have failover configuration, that means when one of my servers die another one takes the active IP and start to serve dovecot users, so its always one server that serves all the users, no load balacing. Any idea what am I missing or how could I fixed this problem? uname -a Linux mx02.m.mydomain.tld 4.19.0-5-amd64 #1 SMP Debian 4.19.37-5 (2019-06-19) x86_64 GNU/Linux dovecot -n # 2.3.4.1 (f79e8e7e4): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.4 () # OS: Linux 4.19.0-5-amd64 x86_64 Debian 10.0 nfs # Hostname: mx02.m.mydomain.tld auth_mechanisms = plain login auth_verbose = yes default_client_limit = 10000 default_process_limit = 1000 dict { quota = mysql:/etc/dovecot/dovecot-dict-sql.conf.ext } disable_plaintext_auth = no mail_fsync = always mail_location = maildir:/home/vmail/%d/%n:INDEX=/var/indexes/%d/%n mail_plugins = " quota" mail_privileged_group = mail mmap_disable = yes namespace inbox { inbox = yes location = mailbox Drafts { auto = subscribe special_use = \Drafts } mailbox Sent { auto = subscribe special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Spam { auto = subscribe special_use = \Junk } mailbox Trash { auto = subscribe special_use = \Trash } prefix = INBOX. separator = . type = private } passdb { args = /etc/dovecot/dovecot-sql.conf.ext driver = sql } plugin { quota = dict:User quota::proxy::quota sieve = /home/vmail/default.sieve sieve_default = /home/vmail/default.sieve sieve_extensions = +editheader sieve_global_dir = /var/lib/dovecot/sieve } protocols = " imap pop3" service auth-worker { user = vmail } service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0660 user = postfix } unix_listener auth-userdb { mode = 0600 user = vmail } user = $default_internal_user } service dict { unix_listener dict { group = vmail mode = 0600 user = vmail } } service imap-login { inet_listener imaps { port = 993 ssl = yes } } service imap { process_limit = 1024 } service pop3 { process_limit = 1024 } service stats { unix_listener stats-reader { group = vmail mode = 0660 user = vmail } unix_listener stats-writer { group = vmail mode = 0660 user = vmail } } ssl_cert = </etc/postfix/ssl/mail.mydomain.tld-dovecot.crt ssl_client_ca_dir = /etc/ssl/certs ssl_dh = # hidden, use -P to show it ssl_key = # hidden, use -P to show it userdb { args = /etc/dovecot/dovecot-sql.conf.ext driver = sql } protocol lda { mail_plugins = " quota sieve" } protocol imap { mail_max_userip_connections = 20 mail_plugins = " quota quota imap_quota" } protocol pop3 { mail_max_userip_connections = 20 mail_plugins = " quota quota" } Thanks, Balazs

2 1

Emails not visible after renaming folders
by Aleksandr 14 Aug '19

14 Aug '19

Hello, I have strange problem with "losing" emails after rename mail folder(s) (via imap client: thunderbird, roundcude, etc..) How to reproduce: 1. Create some folder name, like TEST 2. Create sub-folder under TEST (like SUBTEST) Structure: TEST |--SUBTEST # doveadm mailbox list -u postmaster@testmailbox Spam Trash Sent Drafts INBOX TEST TEST/SUBTEST 3. Move (or copy) mails from INBOX to SUBTEST (all looks fine, and mails visible under SUBTEST) 4. Rename TEST folder to any new name, NEWTEST Let`s try to view mails in mail client in NEWTEST-SUBTEST, folder have no emails :( mailsrv# doveadm -f table mailbox status -u postmaster@testmailbox "messages vsize" NEWTEST* mailbox messages vsize NEWTEST 0 0 NEWTEST/SUBTEST 0 0 If doveadm force-resync postmaster@testmailbox, mails will be visible in INBOX mailsrv# doveadm -f table mailbox status -u postmaster@testmailbox "messages vsize" INBOX* mailbox messages vsize INBOX 2 28 Dovecot installation: CentOS x86_64 Linux 7.5.1804 Storage: HDD Local Partition - XFS filesystem / multi-dbox (mdbox) as mail_storage (this problem is not reproduced with the settings as Maildir storage !) somthing wrong with mapping indices. ---- [start] ---- # dovecot -n # 2.2.36 (1f10bfa63): /etc/dovecot/dovecot.conf # Pigeonhole version 0.4.21 (92477967) # OS: Linux 3.10.0-862.2.3.el7.x86_64 x86_64 CentOS Linux release 7.5.1804 (Core) # Hostname: xxxx auth_mechanisms = plain login digest-md5 cram-md5 base_dir = /var/run/dovecot/ default_client_limit = 20000 default_login_user = dovecot default_process_limit = 10000 dict { quota = redis:host=127.0.0.1:prefix=user/:timeout_msecs=1000 } disable_plaintext_auth = no first_valid_gid = 90 first_valid_uid = 90 imapc_features = rfc822.size fetch-headers imapc_host = xxxx imapc_user = %u lda_mailbox_autocreate = yes lda_mailbox_autosubscribe = yes login_greeting = xxxx. login_log_format_elements = user=<%u> method=%m rip=%r lip=%l %c login_trusted_networks = 10.0.1.0/24 mail_access_groups = mail mail_debug = yes mail_fsync = never mail_gid = 97 mail_location = mdbox:~/mail/mailboxes:FULLDIRNAME=mBoX-MeSsAgEs:INDEX=~/mail/index:CONTROL=~/mail/control:INBOX=~/mail/mailboxes/inbox mail_log_prefix = "%{session} %Us(%u): " mail_max_lock_timeout = 30 secs mail_plugins = quota zlib mail_prefetch_count = 20 mail_privileged_group = mail mail_uid = 97 managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables enotify environment mailbox date index ihave duplicate mime foreverypart extracttext vacation-seconds editheader mbox_lock_timeout = 30 secs mbox_very_dirty_syncs = yes mbox_write_locks = fcntl namespace inbox { inbox = yes list = yes location = mailbox Drafts { auto = subscribe special_use = \Drafts } mailbox Sent { auto = subscribe special_use = \Sent } mailbox Spam { auto = subscribe } mailbox Trash { auto = subscribe special_use = \Trash } prefix = separator = / type = private } passdb { args = /etc/dovecot/dovecot-ldap.conf driver = ldap } plugin { cgroup_basedir = /usr/sys/cgroup hostingAccount = default quota = dict:User quota::proxy::quota quota_grace = 0%% quota_over_flag_value = TRUE quota_over_script = account-quota mismatch %u quota_rule = *:storage=4T quota_warning = storage=101%% account-quota block %u quota_warning1 = -storage=100%% account-quota unblock %u sieve = file:~/sieve;active=~/.dovecot.sieve sieve_before = /home/sieve/%d/ sieve_extensions = +editheader +vacation-seconds -body sieve_max_redirects = 200 sieve_vacation_min_period = 1s trash_folder = Trash zlib_save = lz4 zlib_save_level = 6 } pop3_delete_type = expunge protocols = imap pop3 sieve service account-quota { executable = script /usr/local/scripts/account-quota unix_listener account-quota { mode = 0666 user = dovecot } user = dovecot } service anvil { chroot = /var/empty client_limit = 0 drop_priv_before_exec = no executable = anvil extra_groups = group = $default_internal_user idle_kill = 4294967295 secs privileged_group = process_limit = 1 process_min_avail = 1 protocol = service_count = 0 type = anvil unix_listener anvil-auth-penalty { group = $default_internal_user mode = 0660 user = dovecot } unix_listener anvil { group = $default_internal_user mode = 0660 user = dovecot } user = $default_internal_user vsz_limit = 18446744073709551615 B } service auth-worker { chroot = /var/empty user = $default_internal_user } service auth { chroot = /var/empty executable = /usr/libexec/dovecot/auth unix_listener auth-client { mode = 0660 } unix_listener auth-master { mode = 0666 } unix_listener auth-userdb { mode = 0777 } user = $default_internal_user } service dict { executable = /usr/libexec/dovecot/dict unix_listener dict { mode = 0600 user = $default_internal_user } } service imap-login { executable = /usr/libexec/dovecot/imap-login inet_listener imap { address = xxxxxxx port = 143 } process_limit = 10000 process_min_avail = 1 service_count = 0 user = dovecot } service imap { executable = /usr/libexec/dovecot/imap process_limit = 18000 process_min_avail = 1 service_count = 0 vsz_limit = 256 M } service lmtp { process_limit = 10 } service pop3-login { executable = /usr/libexec/dovecot/pop3-login inet_listener pop3 { address = xxxxxx port = 110 } process_limit = 1000 process_min_avail = 1 service_count = 0 user = dovecot vsz_limit = 256 M } service pop3 { executable = /usr/libexec/dovecot/pop3 process_limit = 1000 process_min_avail = 1 service_count = 0 } service send-warning { executable = script /usr/local/scripts/send-warning unix_listener send-warning { mode = 0666 user = dovecot } user = dovecot } shutdown_clients = no ssl_cert = </etc/dovecot/xxxx.crt ssl_key = # hidden, use -P to show it userdb { args = /etc/dovecot/dovecot-ldap.conf driver = ldap } verbose_proctitle = yes protocol lda { mail_plugins = sieve quota cgroups zlib } protocol imap { imap_client_workarounds = delay-newmail tb-extra-mailbox-sep mail_max_userip_connections = 50 mail_plugins = quota imap_quota mail_log notify cgroups zlib } protocol pop3 { mail_max_userip_connections = 20 mail_plugins = quota cgroups zlib pop3_client_workarounds = outlook-no-nuls oe-ns-eoh pop3_enable_last = no pop3_no_flag_updates = yes pop3_uidl_format = %08Xu%08Xv } ---- [end] ---- Regards, Aleksandr.

3 4

Auth driver
by Riccardo Paolo Bestetti 14 Aug '19

14 Aug '19

(resending to the list; I apologize, I'm not using my usual email client) Hello, That's actually great news. The perspective of working in-tree didn't make me particularly happy. Could you point me to any documentation or examples? While I can find many plugins in the repo and around the Internet, I could find none which add authdb drivers. Best Regards, Riccardo P. Bestetti Da: Aki Tuomi <aki.tuomi(a)open-xchange.com> Inviato: venerdì 9 agosto 2019 13:56 A: Riccardo Paolo Bestetti <riccardo.kyogre(a)live.it>; dovecot(a)dovecot.org <dovecot(a)dovecot.org> Oggetto: Re: Auth driver On 9.8.2019 14.51, Riccardo Paolo Bestetti via dovecot wrote: > Greetings! > > I'm planning to implement a new auth driver. It's going to be, in concept, similar to the Lua and CheckPassword drivers, in that it allows an user program to carry out the authentication and user enumeration steps. If you do this, please make it as 3rd party repository. Dovecot auth supports plugins. Aki

3 2

Should dovecot not be using different logging facility and severity levels?
by Marc Roos 14 Aug '19

14 Aug '19

Should dovecot not be using different severity levels like auth.warn? On my system everything goes to loglevel info: lev_info:Aug 9 16:18:24 mail03 dovecot: imap-login: Aborted login (auth failed, 1 attempts in 2 secs): user=<xxxxx>, method=PLAIN, rip=x.x.x.x, lip=x.x.x.x, TLS, session=<UBXJ2K+PYh68zmjw> lev_info:Aug 9 16:18:29 mail03 dovecot: auth-worker(28656): pam(krinfo,188.206.104.240,<LOLx2K+PYx68zmjw>): unknown user lev_info:Aug 9 16:18:50 mail03 dovecot: imap-login: Aborted login (auth failed, 1 attempts in 25 secs): user=<xxxxx>, method=PLAIN, rip=x.x.x.x, lip=x.x.x.x, TLS: Disconnected, session=<LOLx2K+PYx68zmjw> lev_info:Aug 9 16:18:53 mail03 dovecot: auth-worker(28656): pam(krinfo,188.206.104.240,<qJOm2q+Pax68zmjw>): unknown user lev_info:Aug 9 16:19:01 mail03 dovecot: imap-login: Aborted login (auth failed, 1 attempts in 8 secs): user=<xxxxx>, method=PLAIN, rip=x.x.x.x, lip=x.x.x.x, TLS, session=<qJOm2q+Pax68zmjw> lev_info:Aug 9 16:19:13 mail03 dovecot: auth-worker(28656): pam(krinfo,188.206.104.240,<k8/X26+Pch68zmjw>): unknown user lev_info:Aug 9 16:19:15 mail03 dovecot: imap-login: Aborted login (auth failed, 1 attempts in 2 secs): user=<xxxxx>, method=PLAIN, rip=x.x.x.x, lip=x.x.x.x, TLS, session=<k8/X26+Pch68zmjw> lev_info:Aug 9 16:19:24 mail03 dovecot: auth-worker(28656): pam(krinfo,188.206.104.240,<MjBy3K+Pfh68zmjw>): unknown user lev_info:Aug 9 16:19:26 mail03 dovecot: imap-login: Aborted login (auth failed, 1 attempts in 2 secs): user=<xxxxx>, method=PLAIN, rip=x.x.x.x, lip=x.x.x.x, TLS, session=<MjBy3K+Pfh68zmjw> lev_info:Aug 9 16:19:27 mail03 dovecot: auth-worker(28656): pam(krinfo,188.206.104.240,<oRmo3K+Pfx68zmjw>): unknown user lev_info:Aug 9 16:19:29 mail03 dovecot: imap-login: Aborted login (auth failed, 1 attempts in 2 secs): user=<xxxxx>, method=PLAIN, rip=x.x.x.x, lip=x.x.x.x, TLS, session=<oRmo3K+Pfx68zmjw> lev_info:Aug 9 16:19:47 mail03 dovecot: auth-worker(29664): pam(krinfo,188.206.104.240,<14Pb3a+Pih68zmjw>): unknown user lev_info:Aug 9 16:19:49 mail03 dovecot: imap-login: Aborted login (auth failed, 1 attempts in 2 secs): user=<xxxxx>, method=PLAIN, rip=x.x.x.x, lip=x.x.x.x, TLS, session=<14Pb3a+Pih68zmjw> lev_info:Aug 9 16:19:51 mail03 dovecot: auth-worker(29664): pam(krinfo,188.206.104.240,<99cO3q+Pix68zmjw>): unknown user lev_info:Aug 9 16:19:53 mail03 dovecot: imap-login: Aborted login (auth failed, 1 attempts in 2 secs): user=<xxxxx>, method=PLAIN, rip=x.x.x.x, lip=x.x.x.x, TLS, session=<99cO3q+Pix68zmjw> This is how failed attempts are logged by vsftpd fac_authpriv:Aug 9 16:24:42 web01 vsftpd[7255]: pam_ldap(vsftpd:auth): Authentication failure; user=xxxxx fac_authpriv:Aug 9 16:24:42 web01 vsftpd[7255]: pam_unix(vsftpd:auth): authentication failure; logname= uid=0 euid=0 tty=ftp ruser=xxxxx rhost=xxxxx user=xxxxx fac_ftp:Aug 9 16:24:44 web01 vsftpd[7255]: [xxxxx] FAIL LOGIN: Client "x.x.x.x" lev_notice:Aug 9 16:24:42 web01 vsftpd[7255]: pam_ldap(vsftpd:auth): Authentication failure; user=xxxxx lev_notice:Aug 9 16:24:42 web01 vsftpd[7255]: pam_unix(vsftpd:auth): authentication failure; logname= uid=0 euid=0 tty=ftp ruser=xxxxx rhost=xxxxx user=xxxxx lev_warn:Aug 9 16:24:44 web01 vsftpd[7255]: [xxxxx] FAIL LOGIN: Client "x.x.x.x" Using dovecot-2.2.36-3.el7.x86_64 on CentOS7

4 4

ACL ignored for master users
by Philip Iezzi 14 Aug '19

14 Aug '19

Hi there! I can't get ACL working for master users. Login as master user works fine though, and I am able to access any mailbox using the auth_master_user_separator "*", tested e.g. via Python's imaplib: import imaplib imap = imaplib.IMAP4_SSL('imap.example.com') imap.login('foo(a)example.com*admin-acldemo', '**********') ('OK', [b'Logged in']) My /etc/dovecot/dovecot-acl looks like this: * user=admin lr bar(a)example.com user=admin-acldemo lr So, if I didn't misunderstand https://wiki.dovecot.org/Authentication/MasterUsers and https://wiki.dovecot.org/ACL documentation, this should only give "admin" master user access to all mailaccounts and limiting "admin-acldemo" master user to only a single mailaccount. That's what I would like to accomplish. But no matter what I put into dovecot-acl (it could even be empty), master users always have access to all existing mailaccounts. The whole dovecot-acl seems to be ignored and there are no logs pointing to any problem (syntax, access permissions) with that file. In mail.log I am getting a successful login message: dovecot: imap-login: Login: user=<foo(a)example.com>, method=PLAIN, ... So the login with "foo(a)example.com*admin-acldemo" seems to get resolved to a regular "foo(a)example.com" user login. My current setup (relevant config options): # 2.3.7.1 (0152c8b10): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.7.1 (db5c74be) # OS: Linux 4.15.18-18-pve x86_64 Debian 9.9 auth_master_user_separator = * mail_plugins = quota acl passdb { args = /etc/dovecot/passwd.masterusers driver = passwd-file master = yes pass = yes } plugin { acl = vfile:/etc/dovecot/dovecot-acl acl_user = %u master_user = %u } protocol lmtp { mail_plugins = quota acl sieve } protocol lda { mail_plugins = quota acl sieve } protocol imap { mail_plugins = quota acl imap_acl imap_quota } On ACL documentation it says: > Note that master users have their own ACLs. They're not the the mailbox owners, so by default they have no permissions to any of the mailboxes and on Authentication/MasterUsers documentation: > If ACL plugin is enabled, the Master user is still subject to ACLs just like any other user, which means that by default the master user has no access to any mailboxes of the user. So it must be somehow possible to limit master users to specific mailbox(es) via ACL. I could allow master users to be able to log in as themselves, by adding two passdb sections (one with `master = yes`, the other `master = no`), but then I see no way to do a user context switch (where ACLs would get respected...) after logging in with "admin". Any help greatly appreciated! Thanks in advance. Cheers, Philip

1 1

Dovecot - Microsoft Azure AD
by Lennart Boettcher 14 Aug '19

14 Aug '19

Hello, I am currently trying to connect my Dovecot mail server to Microsoft's Azure-AD and use it as password and user database. I am using version 2.3.7.1. Using the Azure-AD as passdb already works. In this context I noticed that the scope implementation is not yet merged. Since I haven't found any hints for an OAuth2 userdb implementation yet, I wanted to ask if there are any plans for an implementation. Greetings Lennart Boettcher

2 1

Solr, Dovecot & macOS / iOS
by James Brown 14 Aug '19

14 Aug '19

I’m thinking of getting Solr working with my Dovecot server. Server is new 6-core Mac Mini, mail store of over 1/2 TB. Mailboxes with 100s of thousands of messages. But I’m not sure if: a) it will make enough of a difference and b) does Mail.app and other mail clients on Macs or iOS devices perform searches on their local copy of mail or does it just send a search request to the server? I’m guessing the searches are done locally so no point in Solr? Does anyone know? Thanks, James.

4 5

Dovecot Sieve doesn't move spam to Junk folder in maildir
by Nagy Tibor 13 Aug '19

13 Aug '19

I have an *Ubuntu 16.04* mail server with postfix/spamassassin/*dovecot-2.2.2**2* with virtual mailboxes in maildir format. The whole process is working excellently since a year. Spams are marked with "*****SPAM*****" in subject and with "X-Spam-Flag: YES" in email header. I tried now to add sieve to dovecot to move the SPAM messages into the Junk folder without any success, I don't see any sign that sieve does something at all. The output of "dovecot -n": # 2.2.22 (fe789d2): /etc/dovecot/dovecot.conf # Pigeonhole version 0.4.13 (7b14904) # OS: Linux 4.4.0-72-generic x86_64 Ubuntu 16.04.2 LTS ext4 auth_mechanisms = cram-md5 auth_verbose = yes base_dir = /var/run/dovecot/ info_log_path = /var/log/dovecot.info log_path = /var/log/dovecot log_timestamp = "%Y-%m-%d %H:%M:%S " mail_location = maildir:/home/vmail/%d/%n managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext namespace { inbox = yes location = prefix = separator = / } passdb { args = /etc/dovecot/passwd driver = passwd-file } plugin { sieve = /etc/dovecot/sieve/default.sieve } protocols = imap pop3 service auth { executable = /usr/lib/dovecot/auth unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0666 user = postfix } user = root } service imap-login { chroot = login executable = /usr/lib/dovecot/imap-login inet_listener imap { port = 0 } user = dovecot } service imap { executable = /usr/lib/dovecot/imap } service pop3-login { chroot = login executable = /usr/lib/dovecot/pop3-login inet_listener pop3 { port = 0 } inet_listener pop3s { port = 0 } user = dovecot } service pop3 { executable = /usr/lib/dovecot/pop3 } ssl_cert = </etc/ssl/certs/dovecot.pem ssl_key = </etc/ssl/private/dovecot.pem userdb { args = /etc/dovecot/users driver = passwd-file } valid_chroot_dirs = /var/spool/vmail protocol pop3 { pop3_uidl_format = %08Xu%08Xv } protocol lda { mail_plugins = " sieve" } I've added only plugin and protocol lda now. The content of the file default.sieve: require "fileinto"; if header :contains "X-Spam-Flag" "YES" { fileinto "Junk"; } The test SPAM message is marked as SPAM, but not moved to the folder Junk. I don't see anything in mail.log that is associated to sieve.: ul 30 20:05:12 zg-3 postfix/smtpd[4446]: connect from smtp4.enternet.hu[62.112.192.37] Jul 30 20:05:13 zg-3 postfix/smtpd[4446]: 3C4CC9F570: client=smtp4.enternet.hu[62.112.192.37] Jul 30 20:05:13 zg-3 postfix/cleanup[4450]: 3C4CC9F570: message-id=<c6b3bca5-ece3-9e69-8e30-28173abc2ec6(a)hu.inter.net> Jul 30 20:05:13 zg-3 postfix/qmgr[1557]: 3C4CC9F570: from=<nagyt(a)hu.inter.net>, size=918, nrcpt=1 (queue active) Jul 30 20:05:13 zg-3 postfix/smtpd[4446]: disconnect from smtp4.enternet.hu[62.112.192.37] ehlo=2 starttls=1 mail=1 rcpt=1 data=1 quit=1 commands=7 Jul 30 20:05:13 zg-3 postfix/pickup[3949]: 5F7FEA3CBC: uid=1003 from=<nagyt(a)hu.inter.net> Jul 30 20:05:13 zg-3 postfix/pipe[4451]: 3C4CC9F570: to=<tibor(a)softxs.ch>, relay=spamassassin, delay=0.15, delays=0.05/0.01/0/0.1, dsn=2.0.0, status=sent (delivered via spamassassin service) Jul 30 20:05:13 zg-3 postfix/qmgr[1557]: 3C4CC9F570: removed Jul 30 20:05:13 zg-3 postfix/cleanup[4450]: 5F7FEA3CBC: message-id=<c6b3bca5-ece3-9e69-8e30-28173abc2ec6(a)hu.inter.net> Jul 30 20:05:13 zg-3 postfix/qmgr[1557]: 5F7FEA3CBC: from=<nagyt(a)hu.inter.net>, size=3304, nrcpt=1 (queue active) Jul 30 20:05:13 zg-3 postfix/virtual[4455]: 5F7FEA3CBC: to=<tibor(a)softxs.ch>, relay=virtual, delay=0.02, delays=0.01/0.01/0/0, dsn=2.0.0, status=sent (delivered to maildir) Jul 30 20:05:13 zg-3 postfix/qmgr[1557]: 5F7FEA3CBC: removed What can be wrong?

2 2

dovecot acl delete messages questions
by hfh＠cndns.com 13 Aug '19

13 Aug '19

Dovecot's acl plugin can prevent deletion of messages,it works very well! I want: Some ips can delete messages, other ips can not delete messages,can anyone help me? hfh(a)cndns.com

1 0

LastLogin update
by Jorge Bastos 13 Aug '19

13 Aug '19

Howdy, I'd like an adive on what to use. I have sql users, and i want to have the lastlogin of them, what is the native option for this: * Using last_login plugin which will give me the last login? * Use postlogin for imap and pop3n which will give me besides lastlogin the IP and protocol? Thanks in advanced,

8 13

ACL ignored for master users
by Philip Iezzi 12 Aug '19

12 Aug '19

Hi there! I can't get ACL working for master users. Login as master user works fine though, and I am able to access any mailbox using the auth_master_user_separator "*", tested e.g. via Python's imaplib: >>> import imaplib >>> imap = imaplib.IMAP4_SSL('imap.example.com') >>> imap.login('foo(a)example.com*admin-acldemo', '**********') ('OK', [b'Logged in']) My /etc/dovecot/dovecot-acl looks like this: * user=admin lr bar(a)example.com user=admin-acldemo lr So, if I didn't misunderstand https://wiki.dovecot.org/Authentication/MasterUsers and https://wiki.dovecot.org/ACL documentation, this should only give "admin" master user access to all mailaccounts and limiting "admin-acldemo" master user to only a single mailaccount. But no matter what I put into dovecot-acl (it could even be empty), master users always have access to all existing mailaccounts. The whole dovecot-acl seems to be ignored and there are no logs pointing to any problem (syntax, access permissions) with that file. In mail.log I am getting a successful login message: dovecot: imap-login: Login: user=<foo(a)example.com>, method=PLAIN, rip=..., lip=..., mpid=42371, TLS, session=<T9GKEuyPKGxRPtGS> My current setup (relevant config options): # 2.3.7.1 (0152c8b10): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.7.1 (db5c74be) # OS: Linux 4.15.18-18-pve x86_64 Debian 9.9 auth_master_user_separator = * mail_plugins = quota acl passdb { args = /etc/dovecot/passwd.masterusers driver = passwd-file master = yes pass = yes } plugin { acl = vfile:/etc/dovecot/dovecot-acl acl_user = %u master_user = %u } protocol lmtp { mail_plugins = quota acl sieve } protocol lda { mail_plugins = quota acl sieve } protocol imap { mail_plugins = quota acl imap_acl imap_quota } On ACL documentation it says: > Note that master users have their own ACLs. They're not the the mailbox owners, so by default they have no permissions to any of the mailboxes and on Authentication/MasterUsers documentation: > If ACL plugin is enabled, the Master user is still subject to ACLs just like any other user, which means that by default the master user has no access to any mailboxes of the user. So it must be somehow possible to limit master users to specific mailbox(es) via ACL. If I disable `master = yes` master users won't be able to login at all. Any help greatly appreciated! Thanks in advance. Cheers, Philip

1 0

dovecot-lmtp and postfix
by Coy Hile 12 Aug '19

12 Aug '19

Hi all, I’ve got postfix setup to use dovecot-lmtp for (virtual) user delivery, and things to users or aliases that Dovecot knows about now get delivered correctly. However, I’ve done something wrong with postfix and/or the LMTP configuration because upon RCPT TO, instead of forwarding the mail off to the configured smartest, somehow dovecot-lmtp is ending up in the mix. (Perhaps this is more a postfix question than a dovecot one, but, I’ll start here.) Relevant postfix config: [root@81716ec5-bca4-6d53-ed81-bd1a55d46b4f /opt/local/etc/postfix]# postconf -n canonical_maps = hash:/opt/local/etc/postfix/canonical command_directory = /opt/local/sbin compatibility_level = 2 daemon_directory = /opt/local/libexec/postfix data_directory = /var/db/postfix debug_peer_level = 2 debugger_command = PATH=/bin:/usr/bin:/usr/local/bin:/usr/X11R6/bin ddd $daemon_directory/$process_name $process_id & sleep 5 default_database_type = hash home_mailbox = Maildir/ html_directory = no inet_interfaces = all inet_protocols = all mail_owner = postfix mailbox_size_limit = 102400000 mailq_path = /opt/local/bin/mailq manpage_directory = /opt/local/man message_size_limit = 51200000 meta_directory = /opt/local/libexec/postfix mynetworks = $myhostname, 127.0.0.0/8, 10.0.0.0/8, 172.16.0.0/12 192.168.0.0/16 newaliases_path = /opt/local/bin/newaliases owner_request_special = no queue_directory = /var/spool/postfix queue_minfree = 76800000 readme_directory = /opt/local/share/doc/postfix recipient_canonical_maps = hash:/opt/local/etc/postfix/recipient_canonical recipient_delimiter = + relayhost = relay.svc.a4b01392-e48d-4cdf-cacf-f850d1800d45.basement.cns.coyhile.com sample_directory = /opt/local/share/examples/postfix sender_canonical_maps = hash:/opt/local/etc/postfix/sender_canonical sendmail_path = /opt/local/sbin/sendmail setgid_group = maildrop shlib_directory = /opt/local/lib/postfix smtpd_banner = $myhostname ESMTP smtpd_client_restrictions = permit_mynetworks, permit_sasl_authenticated, reject_unknown_reverse_client_hostname smtpd_data_restrictions = permit_mynetworks, reject_unauth_pipelining, permit_sasl_authenticated smtpd_helo_required = yes smtpd_helo_restrictions = permit_mynetworks, permit_sasl_authenticated, reject_invalid_helo_hostname, reject_non_fqdn_helo_hostname smtpd_recipient_restrictions = permit_mynetworks, permit_sasl_authenticated, reject_unlisted_recipient, reject_non_fqdn_recipient, reject_unauth_destination, reject_unknown_recipient_domain, check_recipient_access hash:/opt/local/etc/postfix/filtered_domains smtpd_sasl_auth_enable = yes smtpd_sasl_path = private/auth smtpd_sasl_type = dovecot smtpd_sender_restrictions = permit_mynetworks, permit_sasl_authenticated, reject_unlisted_sender, reject_non_fqdn_sender, reject_unknown_sender_domain smtputf8_enable = no strict_rfc821_envelopes = yes unknown_local_recipient_reject_code = 550 virtual_alias_maps = pgsql:/opt/local/etc/postfix/postfix_virtual_aliases.cf virtual_mailbox_domains = pgsql:/opt/local/etc/postfix/postfix_virtual_domains.cf virtual_transport = lmtp:unix:private/dovecot-lmtp [root@81716ec5-bca4-6d53-ed81-bd1a55d46b4f /opt/local/etc/postfix]# And the dovecot config: doveconf -n # 2.3.6 (7eab80676): /opt/local/etc/dovecot/dovecot.conf # Pigeonhole version 0.5.6 (92dc263a) doveconf: Warning: NOTE: You can get a new clean config file with: doveconf -Pn > dovecot-new.conf doveconf: Warning: Obsolete setting in /opt/local/etc/dovecot/conf.d/10-ssl.conf:80: ssl_dh_parameters_length is no longer needed doveconf: Warning: Obsolete setting in /opt/local/etc/dovecot/conf.d/10-ssl.conf:81: ssl_protocols has been replaced by ssl_min_protocol doveconf: Warning: NOTE: You can get a new clean config file with: doveconf -Pn > dovecot-new.conf doveconf: Warning: Obsolete setting in /opt/local/etc/dovecot/conf.d/10-ssl.conf:80: ssl_dh_parameters_length is no longer needed doveconf: Warning: Obsolete setting in /opt/local/etc/dovecot/conf.d/10-ssl.conf:81: ssl_protocols has been replaced by ssl_min_protocol doveconf: Warning: service auth { client_limit=840 } is lower than required under max. load (1524) # OS: SunOS 5.11 i86pc # Hostname: 81716ec5-bca4-6d53-ed81-bd1a55d46b4f.coyhile.com auth_mechanisms = plain login auth_socket_path = /var/run/dovecot/auth-userdb imap_idle_notify_interval = 29 mins lda_mailbox_autocreate = yes lda_mailbox_autosubscribe = yes mail_attachment_dir = /var/mail/attachments mail_fsync = never mail_location = mdbox:~/mdbox mail_plugins = " acl" mail_privileged_group = vmail managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext imapsieve vnd.dovecot.imapsieve namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } passdb { args = /opt/local/etc/dovecot/dovecot-sql.conf.ext driver = sql } plugin { acl_defaults_from_inbox = yes imapsieve_mailbox1_before = file:/etc/dovecot/sieve/report-spam.sieve imapsieve_mailbox1_causes = COPY imapsieve_mailbox1_name = Junk imapsieve_mailbox2_before = file:/etc/dovecot/sieve/report-ham.sieve imapsieve_mailbox2_causes = COPY imapsieve_mailbox2_from = Junk imapsieve_mailbox2_name = * sieve = file:~/sieve;active=~/.dovecot.sieve sieve_global_extensions = +vnd.dovecot.pipe sieve_pipe_bin_dir = /etc/dovecot/sieve sieve_plugins = sieve_imapsieve sieve_extprograms } protocols = imap pop3 lmtp submission service auth-worker { user = vmail } service auth { client_limit = 840 inet_listener { port = 2222 } unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0666 user = postfix } unix_listener auth-userdb { group = vmail mode = 0666 user = vmail } } service imap-login { inet_listener imaps { port = 993 ssl = yes } process_min_avail = 3 service_count = 0 vsz_limit = 1 G } service imap { process_min_avail = 3 service_count = 256 } service lmtp { unix_listener /var/spool/postfix/private/dovecot-lmtp { group = postfix mode = 0600 user = postfix } } service pop3-login { inet_listener pop3 { port = 0 } inet_listener pop3s { port = 0 } } ssl_cert = </opt/local/etc/dovecot/certs/dovecot.pem ssl_cipher_list = ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256 ssl_key = # hidden, use -P to show it ssl_min_protocol = TLSv1.2 ssl_prefer_server_ciphers = yes userdb { args = /opt/local/etc/dovecot/dovecot-sql.conf.ext driver = sql } protocol lmtp { mail_plugins = " acl sieve" } protocol lda { mail_plugins = " acl sieve" } protocol imap { mail_max_userip_connections = 50 mail_plugins = " acl imap_acl imap_sieve” } And in syslog I see: 2019-08-11T15:37:57+00:00 81716ec5-bca4-6d53-ed81-bd1a55d46b4f postfix/smtpd[56103]: [ID 197553 mail.info] 12327F13D: client=ns1.coyhile.com[172.17.64.25] 2019-08-11T15:38:40+00:00 81716ec5-bca4-6d53-ed81-bd1a55d46b4f postfix/cleanup[56365]: [ID 197553 mail.info] 12327F13D: message-id=<> 2019-08-11T15:38:40+00:00 81716ec5-bca4-6d53-ed81-bd1a55d46b4f postfix/qmgr[56018]: [ID 197553 mail.info] 12327F13D: from=<coy.hile(a)coyhile.com>, size=354, nrcpt=1 (queue active) 2019-08-11T15:38:40+00:00 81716ec5-bca4-6d53-ed81-bd1a55d46b4f dovecot: [ID 702911 mail.info] lmtp(50179): Connect from local 2019-08-11T15:38:40+00:00 81716ec5-bca4-6d53-ed81-bd1a55d46b4f postfix/lmtp[56821]: [ID 197553 mail.info] 12327F13D: to=<coyhile(a)gmail.com>, relay=81716ec5-bca4-6d53-ed81-bd1a55d46b4f.localdomain[private/dovecot-lmtp], delay=55, delays=55/0.01/0/0.03, dsn=5.1.1, status=bounced (host 81716ec5-bca4-6d53-ed81-bd1a55d46b4f.localdomain[private/dovecot-lmtp] said: 550 5.1.1 <coyhile(a)gmail.com> User doesn't exist: coyhile(a)gmail.com (in reply to RCPT TO command)) Given both of those configurations, shouldn’t it see that gmail address and send it off to the relay host? -Coy

2 2

Gmail to Dovecot migration
by Yuri 12 Aug '19

12 Aug '19

Hi everyone, I'm trying to migrate my gmail to dovecot following instructions at https://wiki.dovecot.org/Migration/Gmail Using -a 'virtual/All' option does not seem to work because the gmail folder with that name does not exist, but -a '[Gmail]/All Mail' seem to work. I'm using the following command: sudo doveadm \ -o imapc_host=imap.gmail.com \ -o imapc_user=user(a)gmail.com \ -o imapc_password=gmailpassword \ -o imapc_features="rfc822.size gmail-migration" \ -o imapc_port=993 \ -o imapc_ssl=imaps \ -o ssl_client_ca_dir=/etc/ssl/certs \ -o imapc_ssl_verify=yes \ backup -a '[Gmail]/All Mail' -O '-$GmailHaveLabels' -R -u user(a)exmaple.com imapc: The problem is this command only migrates approximately 25% of my emails by size. Google Takeout exports 4 times more data in mbox format, the size of exported mboxes aligns with what Google tells me a the bottom of gmail settings page. I experimented with other options of 'doveadm backup' command, but they all resulted in less data being migrated. The above options are the best I was able to achive so far. Another option I was considering is to convert Google Takeout mboxes to dovecot format. I tried using 'doveadm import' command, but got confused with various user and search query options of the command. The best I was able to achive was to output a folder under /Takeout which mimics my mbox structure, but with no imported messages. A third option I'm considering is to convert Google Takeout mboxes using mb2md command. Conversion seems to work fine, but the output is in the traditional (dotted) format, and for historical reasons I use 'LAYOUT=fs' option. So I need to do some extra work to convert folder names. And even if I do so, I'm still not sure if I can import Maildir to dovecot because dovecot's Maildir has other information, such as indices, logs, etc., not just email folders. I'll keep investigating the second and the third option because it seems that Google Takeout gives me all my emails, but I'm not sure if those are the right paths. I wanted to ask the experts about the best option to migrate gmail to dovecot. Has anyone being able to successfully migrate all their emails from gmail and what steps have been used for that? My Dovecot version: 2.3.4.1 Thank you, Yuri

1 1

What does `iterate_query` for SQL want as output?
by Coy Hile 10 Aug '19

10 Aug '19

Hi all, In an earlier thread, https://dovecot.org/pipermail/dovecot/2019-August/116694.html I got a lot of useful help about migration. On my older host, everything was static; on the newer host, I’m storing user information in Postgres. usernames are of the form <login@REALM>, say ‘hile(a)coyhile.xn--com-to0a as basically a Kerberos principal, and authentication and individual lookups work. My `users` table looks thus: mail=> \d users Table "public.users" Column | Type | Modifiers ----------+------+----------- username | text | not null domain | text | not null password | text | not null mail=> and contains, as an example: username | domain | password ------------------+-------------+------------------------------------------------------------------------------------------------------- hile(a)coyhile.com | coyhile.com | [REDACTED] (1 row) Naively, I’d expect something this to work for the iteration query: iterate_query = SELECT username, domain FROM users But, when I do that, I end up doveadm backup -D -A -R -f ssh -i id_rsa.dsync imap01.coyhile.com /opt/local/bin/doveadm dsync-server -A doveadm(hile@coyhile.com@coyhile.com): Info: User no longer exists, skipping [root@81716ec5-bca4-6d53-ed81-bd1a55d46b4f /tmp]# Note the extra “(a)coyhile.xn--com-9o0a in there. Thanks, — Coy Hile coy.hile(a)coyhile.com

2 6

Auth driver
by Riccardo Paolo Bestetti 09 Aug '19

09 Aug '19

Greetings! I'm planning to implement a new auth driver. It's going to be, in concept, similar to the Lua and CheckPassword drivers, in that it allows an user program to carry out the authentication and user enumeration steps. The rationale is that such a solution would provide better decoupling between Dovecot and the user authentication and enumeration logic. Existing integrated logic (auth/ directory in the source tree) is, even encompassing a great number of common use cases, ultimately inflexible. Writing custom drivers implementing logic, while being a solution to the inflexibility problem, is clearly not what drivers were engineered for: for one they don't support dynamic loading, making it necessary to recompile Dovecot to make changes, which is unacceptable in many situations, e.g. when using a packaged or containerized version of the software. In this email, I intend to explain what characteristics my driver will have and why it solves the proposed problem better than existing code (such as CheckPassword, Lua and proxy), in the hope to get useful feedback and I will pose some technical questions to which I could not find definitive answers by myself yet. These are going to be the characteristics of my driver (with particular emphasis to the differences to the existing drivers): - It is going to be a completely generic mechanism exposing all funcionality of Dovecot's interface, both password check and enumeration, and will fully support authentication methods with continuations. - It is going to be performant, communicating with external programs through sockets (unix or inet). - It is going to communicate using a simple, dynamic-schema, well-understood protocol, which is probably going to be JSON, being very easy to generate and parse. This is why the existing drivers do not already provide what I described: - CheckPassword is heavy (fork & 2*exec), and it's generally a mess, having initially been provided as a compatibility feature and having then been hacked to support additional functionality; it's architecturally unfeasable to support continuations with it and anyway any further extension will probably make it explode :) - Lua works but it's limited, in that it dictates a language and also dictates that the auth logic should run on the same server as Dovecot (and under Dovecot's control). It also doesn't seem to support plain password checks, but only user-password enumeration, making it non-generic (at least this is what can be inferred from the documentation and examples.) - Other possible solutions, such as (mis)using the proxy driver to communicate with an external program are not well documented and nothing guarantees the proxy protocol will not change anyway, being an internal feature. And now, the technical questions. I know these could be answered by reading the code, which is something I'm doing, but I'm finding some architectural details quite difficult to grasp due to their complexity: - From what I gather from [1], auth-worker processes only process a single request before being killed from auth. Would setting service_count to something different cause auth-workers to be reused or would it just leak the auth-workers? In the first case, is the preinit of the auth driver repeated, or is the existing instance of the auth driver reused? You could also point me to the relevant code sections which start, keep track of and initialize auth-workers. - How does a driver specify what to run in an auth-worker as opposed to in the auth process? (This is strongly related to the first question, and maybe it is more general, so you may want to answer this one first.) Please, feel free to only answer parts of my email. Any input on any of the matters is very welcome. Best regards, Riccardo P. Bestetti [1] https://wiki.dovecot.org/Services#auth-worker

2 1

Re: Upgrading to v2.3.X breaks ssl san?
by Aki Tuomi 09 Aug '19

09 Aug '19

> On 07/08/2019 14:28 telsch <telsch(a)gmx.de> wrote: > > > with v2.2.34 i can use: > > ssl_ca = </etc/ssl/ca-bundle.pem > ssl_cert = </etc/ssl-imap.pem > > after upgrade to v2.3.X it doesn't work like before. > > it's working if i manual cat ca-bundle.pem and ssl-imap.pem into one > file and using only: > > ssl_cert = </etc/ssl-imap.pem > > i thought ssl_ca is where to put the intermediate cert? (Sorry for duplicate mail, keyboard acted up...) No, that has always been a mistake and it was fixed in 2.3. Our SSL pages in documentation & wiki have always recommended concatenating the intermediates with the cert. Aki

3 3

IMAP folders showing no messages in Office 365 Outlook
by Andrew Bernard 08 Aug '19

08 Aug '19

I'm new to Dovecot. Using Dovecot IMAP with Postfix, everything works fine using Thunderbird. But with the same setup, no messages show in IMAP folders for user accounts created in Outlook, accessing exactly the same server as the accounts in Thunderbird. Dovecot version 2.3.7.1. Is there any configuration required that is special to support Office 365 Outlook clients? How to debug this? Andrew

3 3

Re: How to make the client tool only display emails within 30 days?
by hfh＠cndns.com 08 Aug '19

08 Aug '19

Thank you so much, I tried it！ hfh(a)cndns.com 发件人： Aki Tuomi via dovecot 发送时间： 2019-08-08 15:47 收件人： hfh(a)cndns.com; dovecot 主题： Re: How to make the client tool only display emails within 30 days? On 8.8.2019 10.46, hfh--- via dovecot wrote: doveadm search -u matt mailbox "*" savedbefore 30d Dovecot's configuration or plugin can do similar effects like the above？ Outlook uses pop or imap to receive mail within 30 days. Virtual plugin can be used to do these kind of configurations. Aki

1 0

How to make the client tool only display emails within 30 days?
by hfh＠cndns.com 08 Aug '19

08 Aug '19

doveadm search -u matt mailbox "*" savedbefore 30d Dovecot's configuration or plugin can do similar effects like the above？ Outlook uses pop or imap to receive mail within 30 days.

2 1

How to make the client tool only display emails within 30 days?
by hfh＠cndns.com 08 Aug '19

08 Aug '19

How to make the client tool only display emails within 30 days? thanks！！！ hfh(a)cndns.com

2 1

Upgrading to v2.3.X breaks ssl san?
by telsch 07 Aug '19

07 Aug '19

3 5

Problem Solr and centos 7
by HTMLServices.it 07 Aug '19

07 Aug '19

Hi everyone Given that I am not an expert, I am doing tests with Solr, I installed following the guide but I have no benefits on the search, the search on the body on 28000 mails takes a few minutes and then goes to timeout. I had installed version 8.2.0 of solr then I thought that there is something not compatible with centos 7 so I installed version 7.7.0 as an example on the guide https://wiki2.dovecot.org/Plugins/FTS/Solr. I did several tests but I can't get it to work, this is the test server link: http://5.39.2.59:8987/solr/#/ I only changed the door because the 8983 is busy even making a query from the panel it seems to me not working .... thanks to all Bic

2 3

auth-policy crashing
by James 07 Aug '19

07 Aug '19

My auth process is dumping core. This happens several times per day but dovecot can operate normally for hours between errors. The crash occurs in src/auth/auth-policy.c, line 356: t@1 (l@1) program terminated by signal SEGV (no mapping at the fault address) Current function is auth_policy_parse_response 356 context->request->policy_refusal = FALSE; ...context->request is null. Add markers to the code... } if (context->request == NULL) fprintf(stderr, "2222222222222222222222222222 context->request == NULL\n"); i_stream_unref(&context->payload); if (context->request == NULL) fprintf(stderr, "1111111111111111111111111111 context->request == NULL\n"); if (context->parse_error) { context->result = (context->set->policy_reject_on_fail ? -1 : 0); } if (context->request == NULL) fprintf(stderr, "AAAAAAAAAAAAAAAAAAAAAAAAAAAA context->request == NULL\n"); context->request->policy_refusal = FALSE; if (context->result < 0) { ...gives at the time of the crash... Aug 1 14:25:44 mailhost dovecot: [ID 702911 mail.error] auth: Error: 1111111111111111111111111111 context->request == NULL Aug 1 14:25:44 mailhost dovecot: [ID 702911 mail.error] auth: Error: AAAAAAAAAAAAAAAAAAAAAAAAAAAA context->request == NULL ...so context->result is not null before the call (no 222) to i_stream_unref but is after. dovecot.conf has: auth_policy_server_url = http://policyserver.lan/ auth_policy_server_timeout_msecs = 3000 auth_policy_hash_nonce = Ohr9phaeSeip2Pahaez2raiGohxoo5Ia auth_policy_request_attributes = remote=%{rip} auth_policy_check_before_auth = yes auth_policy_check_after_auth = yes auth_policy_report_after_auth = yes To simplify the problem I used a dummy policy server, in nginx.conf: location / { default_type application/json; return 200 "{\"status\":0,\"msg\":\"accepted\"}"; } however no matter what rubbish a policy server sends back it should not cause dovecot to crash. I've tried 32 and 64 bit and two compilers (gcc and SunStudio), all result in crashes. Adding: keepalive_timeout 0; ...to nginx.conf appears to reduce the crashes. It happens with a variety of users and with debug output I see no pattern. James.

2 6

[BUG?] Double quota calulation when special folder is present
by Mark Moseley 07 Aug '19

07 Aug '19

Just hoping to get some dev eyes on this. I'm incredibly reluctant to throw the word 'bug' around (since 99 times out of 100, it's not -- it's almost always the config), but I can't think of any way that this could be a config issue, esp when the pre-2.2.34 version works as expected. I noticed during troubleshooting that dovecot errors out if I try to create a subfolder called 'INBOX' but it'll happily create a subfolder called INBOX.SomethingElse (i.e. a folder called INBOX.INBOX.SomethingElse - resulting in a directory called .INBOX.SomethingElse on the filesystem, and leading to the problem described below). Is that sub-subfolder creation (where the top level subfolder matches the namespace name) supposed to be allowed? It seems odd that 'INBOX' (as a subfolder of INBOX) would be blocked but INBOX.SomethingElse (as a subfolder of INBOX) would be allowed. I'd expect INBOX.SomethingElse (i.e. INBOX.INBOX.SomethingElse) would be blocked as well. On Wed, Mar 13, 2019 at 4:46 AM Bernd Wurst via dovecot <dovecot(a)dovecot.org> wrote: > Hello, > > we're operating dovecot on a small server. Some years ago, we migrated > from courier IMAP to dovecot. Therefore, we defined our default > Namespace "inbox" with prefix "INBOX." to have this compatible. I found > this in some migration docs those days. Generally, everything worked as > expected. > > Our only namespace is configured like this: > > namespace inbox { > separator = . > prefix = INBOX. > inbox = yes > } > > Regularly, there is no folder named INBOX or .INBOX in the file system, > I suppose this is correct. But I found a special corner case today when > it comes to quota calculation. > > When - for whatever reason - a folder .INBOX.foo (for arbitrary values > of foo) exists, the whole mailbox is counted twice in quota > recalculation. Just creating .INBOX does nothing but a subfolder > triggers the problem. > > This is my shell view (replaced username and file path and deleted > unnecessary debug output) > > $ cat maildirsize > 268435456S > 14697 17 > $ maildirmake .INBOX.foo > $ sudo doveadm -D quota recalc -u <user> > [...] > doveadm(<user>): Debug: Namespace inbox: type=private, prefix=INBOX., > sep=., inbox=yes, hidden=no, list=yes, subscriptions=yes > location=maildir:/home/.../test > doveadm(<user>): Debug: maildir++: root=/home/.../test, index=, > indexpvt=, control=, inbox=/home/.../test, alt= > doveadm(<user>): Debug: Namespace : type=private, prefix=, sep=, > inbox=no, hidden=yes, list=no, subscriptions=no location=fail::LAYOUT=none > doveadm(<user>): Debug: none: root=, index=, indexpvt=, control=, > inbox=, alt= > doveadm(<user>): Debug: quota: quota_over_flag check: quota_over_script > unset - skipping > doveadm(<user>): Debug: Quota root User quota: Recalculated relative > rules with bytes=268435456 count=0. Now grace=26843545 > doveadm(<user>): Debug: Namespace INBOX.: Using permissions from > /home/.../test: mode=0700 gid=default > > $ cat maildirsize > 268435456S > 29394 34 > > > So the used quota has exactly been doubled by just creating an empty > subfolder. > > Do you have any pointers for fixing my configuration or is this a bug in > dovecot? > > I coincidentally resurrected a months-old thread with this same issue a few days ago. I'm seeing the exact same after upgrading from 2.2.32 to 2.2.36. The original poster (who also narrowed it down to something in 2.2.34) mentioned a workaround that does indeed work, namely setting mailbox_list_index=no: > doveadm -o 'mailbox_list_index=no' quota recalc -u myuser I've been staring at diffs of 2.2.33 and 2.2.34 without anything jumping out at me (not a C guy, sadly). Maybe src/lib-storage/index/index-storage.c or src/lib-storage/list/mailbox-list-fs-iter.c or src/lib-storage/list/mailbox-list-index-iter.c or src/lib-storage/list/mailbox-list-index.c? The latter few have some added strcmp's against "INBOX". Then again, there's a lot of new code in the diffs under src/lib-storage that references INBOX specifically.

3 5

Dovecot replication and userdb "noreplicate".
by Reio Remma 07 Aug '19

07 Aug '19

Hello! I finally took the time and spent two days to set up replication for my server and now I have a question or two. I initially set noreplicate userdb field to 1 for all but a test user, but I could still see in the logs that all mailboxes were trying to connect to the other server via SSH. Is that normal? Jun 22 16:55:22 host dovecot: dsync-local(user(a)host.ee)<>: Error: Remote command returned error 84: ssh -i /home/vmail/.ssh/vmail.pem -l vmail backup.host.ee doveadm dsync-server -D -u user(a)host.ee Then I ended up setting mail_replica in userdb for only my test user, but I could still see in the logs that it was trying to sync the others as well, despite mail_replica being 0 for the rest. Jun 22 20:52:59 host dovecot: doveadm(user(a)host.ee): Fatal: -N parameter requires syncing with remote host I also notice (and read from recent posts) that sieve script replication doesn't work at all. Dovecot v2.3.6 and Pigeonhole from the official Dovecot CentOS repo. Thanks, Reio PS: Getting SSH for Dovecot to work with SELinux on CentOS 7 was fun as usual. :)

3 6

Incorrect link on download page
by Peter 06 Aug '19

06 Aug '19

The link to the latest 2.2 release points to 2.2.36.1 but the latest 2.2 is actually 2.2.36.3. Peter

2 1

doveadm: Error: open(/proc/self/io) failed
by me＠tdiehl.org 06 Aug '19

06 Aug '19

Hi, I am running dovecot-2.2.36-3.el7.x86_64 on a Centos 7 machine. I keep seeing the following errors in the dovecot.log: Jul 22 12:52:04 vmail2 dovecot: doveadm: Error: open(/proc/self/io) failed: Permission denied Dovecot -n is listed below: # 2.2.36 (1f10bfa63): /etc/dovecot/dovecot.conf # Pigeonhole version 0.4.24 (124e06aa) # OS: Linux 3.10.0-957.21.3.el7.x86_64 x86_64 CentOS Linux release 7.6.1810 (Core) # Hostname: vmail2.kmg.mydomain.com auth_master_user_separator = * auth_mechanisms = PLAIN LOGIN deliver_log_format = from=%{from}, envelope_sender=%{from_envelope}, subject=%{subject}, msgid=%m, size=%{size}, %$ dict { acl = mysql:/etc/dovecot/dovecot-share-folder.conf quotadict = mysql:/etc/dovecot/dovecot-used-quota.conf } doveadm_password = # hidden, use -P to show it doveadm_port = 2525 first_valid_uid = 2000 last_valid_uid = 2000 mail_gid = 2000 mail_location = maildir:%Lh/Maildir/:INDEX=%Lh/Maildir/ mail_plugins = quota mailbox_alias acl mail_log notify stats replication mail_uid = 2000 managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext imapsieve vnd.dovecot.imapsieve namespace { inbox = yes location = mailbox Archive { auto = no special_use = \Archive } mailbox Archives { auto = no special_use = \Archive } mailbox "Deleted Messages" { auto = no special_use = \Trash } mailbox Drafts { auto = subscribe special_use = \Drafts } mailbox Junk { auto = subscribe special_use = \Junk } mailbox "Junk E-mail" { auto = no special_use = \Junk } mailbox Sent { auto = subscribe special_use = \Sent } mailbox "Sent Items" { auto = no special_use = \Sent } mailbox "Sent Messages" { auto = no special_use = \Sent } mailbox Spam { auto = no special_use = \Junk } mailbox Trash { auto = subscribe special_use = \Trash } prefix = separator = / type = private } namespace { list = children location = maildir:%%Lh/Maildir/:INDEX=%%Lh/Maildir/Shared/%%Ld/%%Ln prefix = Shared/%%u/ separator = / subscriptions = yes type = shared } passdb { args = /etc/dovecot/dovecot-mysql.conf driver = sql } passdb { args = /etc/dovecot/dovecot-master-users driver = passwd-file master = yes } plugin { acl = vfile acl_shared_dict = proxy::acl fts_autoindex = yes fts_autoindex_max_recent_msgs = 50 imapsieve_mailbox1_before = file:/usr/lib64/dovecot/sieve/report-spam.sieve imapsieve_mailbox1_causes = COPY imapsieve_mailbox1_name = Spam imapsieve_mailbox2_before = file:/usr/lib64/dovecot/sieve/report-ham.sieve imapsieve_mailbox2_causes = COPY imapsieve_mailbox2_from = Spam imapsieve_mailbox2_name = * mail_log_events = delete undelete expunge mailbox_delete mailbox_rename mail_log_fields = uid box msgid size from subject mail_replica = tcp:vmail1.kmg.mydomain.com mailbox_alias_new = Sent Messages mailbox_alias_new2 = Sent Items mailbox_alias_old = Sent mailbox_alias_old2 = Sent quota = dict:user::proxy::quotadict quota_grace = 10%% quota_warning = storage=100%% quota-warning 100 %u quota_warning2 = storage=95%% quota-warning 95 %u quota_warning3 = storage=90%% quota-warning 90 %u quota_warning4 = storage=85%% quota-warning 85 %u sieve = ~/sieve/dovecot.sieve sieve_before = /var/vmail/sieve/dovecot.sieve sieve_dir = ~/sieve sieve_global_dir = /var/vmail/sieve sieve_global_extensions = +vnd.dovecot.pipe +vnd.dovecot.execute sieve_max_redirects = 30 sieve_pipe_bin_dir = /usr/lib64/dovecot/sieve sieve_plugins = sieve_imapsieve sieve_extprograms sieve_vacation_send_from_recipient = yes stats_refresh = 30 secs stats_track_cmds = yes } protocols = pop3 imap sieve lmtp service aggregator { fifo_listener replication-notify-fifo { user = vmail } unix_listener replication-notify { user = vmail } } service auth { unix_listener /var/spool/postfix/private/dovecot-auth { group = postfix mode = 0666 user = postfix } unix_listener auth-master { group = vmail mode = 0666 user = vmail } unix_listener auth-userdb { group = vmail mode = 0660 user = vmail } } service config { unix_listener config { user = vmail } } service dict { unix_listener dict { group = vmail mode = 0660 user = vmail } } service doveadm { inet_listener { port = 2525 } user = vmail } service imap-login { process_limit = 500 service_count = 1 } service lmtp { executable = lmtp -L inet_listener lmtp { address = 127.0.0.1 port = 24 } process_min_avail = 5 unix_listener /var/spool/postfix/private/dovecot-lmtp { group = postfix mode = 0600 user = postfix } user = vmail } service managesieve-login { inet_listener sieve { address = 127.0.0.1 port = 4190 } } service pop3-login { service_count = 1 } service quota-warning { executable = script /usr/local/bin/dovecot-quota-warning.sh unix_listener quota-warning { group = vmail mode = 0660 user = vmail } } service replicator { process_min_avail = 1 unix_listener replicator-doveadm { group = vmail mode = 0666 } } service stats { fifo_listener stats-mail { mode = 0644 user = vmail } inet_listener { address = 127.0.0.1 port = 24242 } } ssl = required ssl_cert = </etc/pki/tls/certs/my_cert.crt ssl_cipher_list = ECDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:ECDH+3DES:DH+3DES:RSA+AESGCM:RSA+AES:RSA+3DES:!aNULL:!MD5 ssl_client_ca_file = /etc/pki/tls/cert.pem ssl_key = # hidden, use -P to show it ssl_prefer_server_ciphers = yes syslog_facility = local5 userdb { args = /etc/dovecot/dovecot-mysql.conf driver = sql } protocol lda { lda_mailbox_autocreate = yes lda_mailbox_autosubscribe = yes mail_plugins = quota mailbox_alias acl mail_log notify stats replication sieve } protocol lmtp { lmtp_save_to_detail_mailbox = yes mail_plugins = quota sieve recipient_delimiter = + } protocol imap { imap_client_workarounds = tb-extra-mailbox-sep mail_max_userip_connections = 30 mail_plugins = quota mailbox_alias acl mail_log notify stats replication imap_quota imap_acl imap_stats imap_sieve } protocol pop3 { mail_max_userip_connections = 30 mail_plugins = quota mailbox_alias acl mail_log notify stats replication pop3_client_workarounds = outlook-no-nuls oe-ns-eoh pop3_uidl_format = %08Xu%08Xv } Everything seems to be working properly and the dovecot wiki says that /proc/self/io is for statistics. I am thinking they are harmless but they are generating a bunch of noise in the logs and if harmless, I would like to silence them. Can someone let me know what causes this and if I should be concerned about this? My Google foo has not been helpful on this. Regards, -- Tom me(a)tdiehl.org

7 12

GSSAPI vs group check
by Németh Ákos Ferenc 05 Aug '19

05 Aug '19

Dear All, Is it possible to make any authorization (eg. checking of group membership) in case of GSSAPI authentication? Our dovecot authenticates the users against PAM and GSSAPI. In the PAM file I'm able to check if a user is a member of a selected (e.g mailreader) group. If the user is member, he can login otherwise not (see below). If the user has a valid Kerberos ticket and he tries to login via GSSAPI, I can't restrict him if he is not a member of the selected group. How can I overcome this issue? My config: passdb { driver = pam # [session=yes] [setcred=yes] [failure_show_msg=yes] [max_requests=<n>] # [cache_key=<key>] [<service name>] #args = dovecot } userdb { # <doc/wiki/AuthDatabase.Passwd.txt> driver = passwd # [blocking=no] #args = # Override fields from passwd #override_fields = home=/home/virtual/%u } ...in PAM file: auth [success=1 default=ignore] pam_succeed_if.so user ingroup mailreader auth [success=ignore default=2] pam_succeed_if.so user ingroup admins auth [success=ignore default=1] pam_succeed_if.so uid >= 1000 auth [success=3 default=ignore] pam_winbind.so krb5_auth krb5_ccache_type=FILE cached_login auth [success=ignore default=1] pam_succeed_if.so uid < 1000 auth [success=1 default=ignore] pam_unix.so nullok_secure try_first_pass auth requisite pam_deny.so auth required pam_permit.so Thank you. Br, Ákos

2 3

doveadm sis deduplicate problem
by Peter Benko 03 Aug '19

03 Aug '19

Hi all, I'm running dovecot 2.3.7.1, with mdbox and single instance storage. I use offline deduplication like this: mail_attachment_fs = sis-queue /mailboxes/%d/_attachments_/queue:posix Each week I run doveadm sis deduplicate to deduplicate the mail attachments. Everything was fine until I mistakenly run doveadm sis deduplicate twice, simultaneously. I ended up having some error messages like this: Error: unlink(/mailboxes/domain.com/_attachments_/queue/067518ec61f872420813727326… failed: No such file or directory (in doveadm-sis.c:260) Also, the sis store has a suspicious temporary (leftover?) file (in the according _attachments_/06/75/ dir): -rw------- 4 vmail vmail 941197 Aug 2 15:48 temp.server-name.9633.77f5a7183d74f72b So the question is, shall I be nervous about this temp file? Does the error mean that the deduplication did not finish correctly? Is my mail store in a consistent state now? What shall I do with the temp file? I'd really appreciate some help... Regards, Peter

1 0

Sieve redirect
by B Fischer 03 Aug '19

03 Aug '19

What is the intended way to configure Sieve for the redirect command? Can I do it using in Dovecot (e.g. using the submission config) or does it have to be done in sendmail? I'm running Dovecot in a container and the MTA/MSA is in another container. Dovecot version: 2.3.2.1 (0719df592) - Björn

1 0

index failed
by ＠lbutlr 02 Aug '19

02 Aug '19

When reindexing I go the following error Mailbox test: UID=1: read(/path/to/mail,S=4248,W=4349) failed: Cached message size larger than expected (4248 > 1182, box=test, UID=1) (read reason=mail stream) In this case, the message was an unimportant test message with no content, so I simply removed it, but had it been important what would I need to do? -- Nine-tenths of the universe is the knowledge of the position and direction of everything in the other tenth. Every atom has its biography, every star its file, every chemical exchange its equivalent of the inspector with a clipboard. It is unaccounted for because it is doing the accounting for the rest of it. Nine-tenths of the universe, in fact, is the paperwork. --The Thief of Time

1 0

Question about replication
by Coy Hile 02 Aug '19

02 Aug '19

Good morning, I’m looking at dovecot replication for the first time for a particular use case: The VM running dovecot is currently in a public cloud, and I want to move it on-premises, so I want to replicate all mail data from the older instance to the new (then cutover internal DNS) (and in the process update to newer features on the internal instance such as mdbox vs Maildir). However, the new instance I’m building is internal, would have access to the internet only via NAT, so the replication would have to be one way. Is there anything in particular that I need to keep in mind when I’m trying to setup this sort of setup? The documentation that I’ve read seems to imply (or assume) synchronous, bidirectional replication. Thanks, and apologies if this is an obvious question; this is my first foray into doing something not utterly trivial with Dovecot.

2 3

Re: Panic: Module context expire_mail_user_module missing (Debian 10)
by Alexander Dalloz 02 Aug '19

02 Aug '19

Am 2019-08-02 11:05, schrieb Thomas Krause: Thomas, please keep the discussion on list. There is zero need to copy send any list discussion to my personal address. > # diff dovecot.conf dovecot.conf-ok > 5c5 > < mail_plugins = quota mailbox_alias acl zlib expire > --- >> mail_plugins = quota mailbox_alias acl zlib #expire > 170c170 > < expire = mysql:/etc/dovecot/dovecot-expire.conf > --- >> #expire = mysql:/etc/dovecot/dovecot-expire.conf > > > # 2.3.4.1 (f79e8e7e4): /etc/dovecot/dovecot.conf > # Pigeonhole version 0.5.4 () > doveconf: Warning: NOTE: You can get a new clean config file with: > doveconf -Pn > dovecot-new.conf > doveconf: Warning: Obsolete setting in /etc/dovecot/dovecot.conf:16: > ssl_dh_parameters_length is no longer needed > doveconf: Warning: Obsolete setting in /etc/dovecot/dovecot.conf:17: > ssl_protocols has been replaced by ssl_min_protocol > doveconf: Warning: NOTE: You can get a new clean config file with: > doveconf -Pn > dovecot-new.conf > doveconf: Warning: Obsolete setting in /etc/dovecot/dovecot.conf:16: > ssl_dh_parameters_length is no longer needed > doveconf: Warning: Obsolete setting in /etc/dovecot/dovecot.conf:17: > ssl_protocols has been replaced by ssl_min_protocol Fix those obvious things. > # OS: Linux 4.19.0-5-amd64 x86_64 Debian 10.0 > # Hostname: mail.example.org > auth_mechanisms = PLAIN LOGIN > dict { > acl = mysql:/etc/dovecot/dovecot-share-folder.conf > expire = mysql:/etc/dovecot/dovecot-expire.conf > quotadict = mysql:/etc/dovecot/dovecot-used-quota.conf > } > first_valid_uid = 1001 > last_valid_uid = 1001 > login_log_format_elements = user=<%u> rip=%r mpid=%e > session=<%{session}> > mail_gid = 1001 > mail_plugins = quota mailbox_alias acl zlib expire The expire plugin enabled under mail_plugins, but no configuration in the plugins { } section. So it has zeor function as you have not defined the mailboxes to track. > mail_uid = 1001 > managesieve_notify_capability = mailto > managesieve_sieve_capability = fileinto reject envelope > encoded-character vacation subaddress comparator-i;ascii-numeric > relational regex imap4flags copy include variables body enotify > environment mailbox date index ihave duplicate mime foreverypart > extracttext > namespace { > inbox = yes > location = > mailbox Archive { > auto = no > special_use = \Archive > } > mailbox Archives { > auto = no > special_use = \Archive > } > mailbox "Deleted Messages" { > auto = no > special_use = \Trash > } > mailbox Drafts { > auto = subscribe > special_use = \Drafts > } > mailbox Junk { > auto = subscribe > special_use = \Junk > } > mailbox "Junk E-mail" { > auto = no > special_use = \Junk > } > mailbox Sent { > auto = subscribe > special_use = \Sent > } > mailbox "Sent Items" { > auto = no > special_use = \Sent > } > mailbox "Sent Messages" { > auto = no > special_use = \Sent > } > mailbox Spam { > auto = no > special_use = \Junk > } > mailbox Trash { > auto = subscribe > special_use = \Trash > } > prefix = > separator = / > type = private > } > passdb { > args = /etc/dovecot/dovecot-mysql.conf > driver = sql > } > plugin { > acl = vfile > acl_shared_dict = proxy::acl > auth_socket_path = /var/run/dovecot/auth-master > mailbox_alias_new = Sent Messages > mailbox_alias_new2 = Sent Items > mailbox_alias_old = Sent > mailbox_alias_old2 = Sent > quota = dict:user::proxy::quotadict > quota_grace = 10%% > quota_rule = *:storage=1G > quota_warning = storage=100%% quota-warning 100 %u > quota_warning2 = storage=95%% quota-warning 95 %u > quota_warning3 = storage=90%% quota-warning 90 %u > quota_warning4 = storage=85%% quota-warning 85 %u > sieve = ~/.dovecot.sieve > sieve_dir = ~/sieve > sieve_max_redirects = 30 > zlib_save = gz > zlib_save_level = 6 > } Above not expire configuration. See https://wiki.dovecot.org/Plugins/Expire And you should consider migrating to the autoexpunge settings. > protocols = pop3 imap sieve lmtp > service anvil { > client_limit = 1203 > } > service auth { > client_limit = 1400 > unix_listener /var/spool/postfix/private/dovecot-auth { > group = postfix > mode = 0666 > user = postfix > } > unix_listener auth-client { > group = www-data > mode = 0660 > } > unix_listener auth-master { > group = vmail > mode = 0666 > user = vmail > } > unix_listener auth-userdb { > group = vmail > mode = 0660 > user = vmail > } > } > service dict { > process_limit = 150 > unix_listener dict { > group = vmail > mode = 0660 > user = vmail > } > } > service imap-login { > process_limit = 500 > service_count = 1 > } > service lmtp { > unix_listener /var/spool/postfix/private/dovecot-lmtp { > group = postfix > mode = 0660 > user = postfix > } > user = vmail > } > service pop3-login { > process_limit = 500 > service_count = 1 > } > service quota-warning { > executable = script /usr/local/bin/dovecot-quota-warning.sh > unix_listener quota-warning { > group = vmail > mode = 0660 > user = vmail > } > } > ssl = required > ssl_cert = </etc/ssl/ssl.crt/mail.example.org.pem > ssl_cipher_list = > EDH+CAMELLIA:EDH+aRSA:EECDH+aRSA+AESGCM:EECDH+aRSA+SHA256:EECDH:+CAMELLIA128:+AES128:+SSLv3:!aNULL:!eNULL:!LOW:!3DES:!MD5:!EXP:!PSK:!DSS:!RC4:!SEED:!IDEA:!ECDSA:kEDH:CAMELLIA128-SHA:AES128-SHA > ssl_key = # hidden, use -P to show it > ssl_prefer_server_ciphers = yes > userdb { > args = /etc/dovecot/dovecot-mysql.conf > driver = sql > } > protocol lda { > auth_socket_path = /var/run/dovecot/auth-master > lda_mailbox_autocreate = yes > lda_mailbox_autosubscribe = yes > mail_plugins = quota mailbox_alias acl zlib expire sieve > postmaster_address = root > } > protocol lmtp { > lmtp_save_to_detail_mailbox = yes > mail_plugins = quota mailbox_alias acl zlib expire sieve > postmaster_address = postmaster > recipient_delimiter = + > } > protocol imap { > imap_client_workarounds = tb-extra-mailbox-sep > mail_max_userip_connections = 30 > mail_plugins = quota mailbox_alias acl zlib expire imap_quota > imap_acl > } > protocol pop3 { > mail_max_userip_connections = 30 > mail_plugins = quota mailbox_alias acl zlib expire > pop3_client_workarounds = outlook-no-nuls oe-ns-eoh > } Alexander

1 0

Panic: Module context expire_mail_user_module missing (Debian 10)
by Thomas Krause 02 Aug '19

02 Aug '19

Hi all, I tried to migrate a mailserver from Debian 9 (Dovecot 2.2.27) to Debian 10 (Dovecot 2.3.4.1). I moved the mail-partition and /etc/dovecot from the old to the new server. Dovecot started with 2 warnings. When trying to fetch mails via pop3 the server crashes: Aug 1 16:56:47 mail19 dovecot: pop3-login: Login: user=<testuser>, rip=::1, mpid=22394, session=<rutwcw+PRp4AAAAAAAAAAAAAAAAAAAAB> Aug 1 16:56:47 mail19 dovecot: pop3(testuser)<22394><rutwcw+PRp4AAAAAAAAAAAAAAAAAAAAB>: Panic: Module context expire_mail_user_module missing Aug 1 16:56:47 mail19 dovecot: pop3(testuser)<22394><rutwcw+PRp4AAAAAAAAAAAAAAAAAAAAB>: Error: Raw backtrace: /usr/lib/dovecot/libdovecot.so.0(+0xdb13b) [0x7fd14ea7713b] -> /usr/lib/dovecot/libdovecot.so.0 (+0xdb1d1) [0x7fd14ea771d1] -> /usr/lib/dovecot/libdovecot.so.0(+0x4a001) [0x7fd14e9e6001] -> /usr/lib/dovecot/modules/lib20_expire_plugin.so(+0x23b2) [0x7fd14e7953b2] -> /usr/lib/dovecot/libdovecot-storage.so.0 (hook_mailbox_allocated+0x89) [0x7fd14eb89409] -> /usr/lib/dovecot/libdovecot-storage.so.0(mailbox_alloc+0xda) [0x7fd14eb84c5a] -> dovecot/pop3(client_init_mailbox+0x58) [0x55781fb5fba8] -> dovecot/pop3(+0x5645) [0x55781fb5e645] -> dovecot/pop3(+0x5882) [0x55781fb5e882] -> /usr/lib/dovecot/libdovecot.so.0(+0x6f601) [0x7fd14ea0b601] -> /usr/lib/dovecot/libdovecot.so.0(+0x6f97b) [0x7fd14ea0b97b] -> /usr/lib/dovecot/libdo vecot.so.0(+0x7030d) [0x7fd14ea0c30d] -> /usr/lib/dovecot/libdovecot.so.0(io_loop_call_io+0x6f) [0x7fd14ea8d5ef] -> /usr/lib/dovecot/libdovecot.so.0(io_loop_handler_run_internal+0x136) [0x7fd14ea8ebe6] -> /usr/l ib/dovecot/libdovecot.so.0(io_loop_handler_run+0x4c) [0x7fd14ea8d68c] -> /usr/lib/dovecot/libdovecot.so.0(io_loop_run+0x40) [0x7fd14ea8d7f0] -> /usr/lib/dovecot/libdovecot.so.0(master_service_run+0x13) [0x7fd14e a0dfd3] -> dovecot/pop3(main+0x2cf) [0x55781fb5e13f] -> /lib/x86_64-linux-gnu/libc.so.6(__libc_start_main+0xeb) [0x7fd14e7f909b] -> dovecot/pop3(_start+0x2a) [0x55781fb5e29a] Aug 1 16:56:47 mail19 dovecot: pop3(testuser)<22394><rutwcw+PRp4AAAAAAAAAAAAAAAAAAAAB>: Fatal: master: service(pop3): child 22394 killed with signal 6 (core dumps disabled - https://dovecot.org/bugreport.h tml#coredumps) What can I do? I tried to enable core dumps (installed systemd-coredump and modified limits.conf) but it didn't work. Best regards, Thomas.

2 3

Patch needed for debian buster in version 2.2.36.1
by Simone Lazzaris 02 Aug '19

02 Aug '19

Hi all; I've just compiled version 2.2.36.1 on a new debian buster (debian 10) and it seems that this patch https://github.com/dovecot/core/commit/ 63a74b9e8e0604486a15a879e7f1a27257322400.patch is needed to make it work. Without the patch, the authentication segfaults. *Simone Lazzaris* *Qcom S.p.A.* simone.lazzaris(a)qcom.it[1] | www.qcom.it[2] * LinkedIn[3]* | *Facebook*[4] [5] -------- [1] mailto:simone.lazzaris@qcom.it [2] https://www.qcom.it [3] https://www.linkedin.com/company/qcom-spa [4] http://www.facebook.com/qcomspa [5] https://www.qcom.it/includes/NUOVAemail-banner.gif

2 1

IMAP frontend authenticating proxy with GSSAPI/Kerberos SSO
by Gert van Dijk 01 Aug '19

01 Aug '19

Hi, My IMAP backend server is lacking SSO authentication, so I am trying to set up Dovecot in front of it as an authenticating proxy. Fortunately, my backend server provides a way to ignore the password provided and will simply trust the username given to be authenticated, using plain login authentication. I'm struggling with setting this up, as it seems to me that as soon as I enable GSSAPI/Kerberos SSO in Dovecot it ignores my passdb proxy settings and it creates a local mail store instead. Is this behavior intentional, and why? See also my Q on Serverfault.com [1], where some user has reported this set up to be working with the same backend server and provided some hints, but I believe I'm hitting a combination that cannot be working with this version. Dovecot version: v2.3.4.1 (from Debian Buster) dovecot -n (I'm using only a single flat file dovecot.conf): ===== # dovecot -n # 2.3.4.1 (f79e8e7e4): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.4 () # OS: Linux 4.15.0-46-generic x86_64 Debian 10.0 overlay # Hostname: imap.sub.mydomain.tld auth_debug = yes auth_default_realm = MY-REALM.DOMAIN.TLD auth_gssapi_hostname = imap.sub.mydomain.tld auth_krb5_keytab = /etc/dovecot/imap.keytab auth_mechanisms = gssapi auth_realms = MY-REALM.DOMAIN.TLD auth_username_format = %n auth_verbose = yes log_path = /dev/stderr mail_gid = 65534 mail_location = mbox:/tmp mail_uid = 65534 passdb { args = proxy=y host=127.0.0.1 port=1143 pass=#hidden_use-P_to_show# driver = static } protocols = imap ssl = required ssl_cert = </etc/dovecot-ssl/cert.crt ssl_cipher_list = ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384 ssl_key = # hidden, use -P to show it ssl_min_protocol = TLSv1.2 ssl_prefer_server_ciphers = yes ===== My comments are lost with "dovecot -n", so here I repeat some why's. ===== # uid/gid of nobody or else: # imap(username)<15><6SCG0QOPgtcKAAYE>: Error: Couldn't drop privileges: User is missing UID (see mail_uid setting) mail_uid = 65534 mail_gid = 65534 # Have to set dummy mail_location or else: # Error: mail_location not set and autodetection failed: Mail storage autodetection failed with home=(not set) mail_location = mbox:/tmp ===== (Ideally, I don't want to set any local storage storage, Dovecot should just be a proxy in my case.) Log, debug enabled, with client connecting: ===== master: Info: Dovecot v2.3.4.1 (f79e8e7e4) starting up for imap auth: Debug: Loading modules from directory: /usr/lib/dovecot/modules/auth auth: Debug: Module loaded: /usr/lib/dovecot/modules/auth/lib20_auth_var_expand_crypt.so auth: Debug: Loading modules from directory: /usr/lib/dovecot/modules/auth auth: Debug: Module loaded: /usr/lib/dovecot/modules/auth/libmech_gssapi.so auth: Debug: Read auth token secret from /var/run/dovecot/auth-token-secret.dat auth: Debug: auth client connected (pid=9) auth: Debug: client in: AUTH 1 GSSAPI service=imap secured=tls session=9WOjSwWP8toKAAYE lip=9.9.9.9 rip=1.2.3.4 lport=143 rport=56050 local_name=sub.mydomain.tld ssl_cipher=ECDHE-RSA-AES128-GCM-SHA256 ssl_cipher_bits=128 ssl_pfs=KxECDHE ssl_protocol=TLSv1.2 auth: Debug: gssapi(?,1.2.3.4,<9WOjSwWP8toKAAYE>): Obtaining credentials for imap(a)sub.mydomain.tld auth: Debug: client passdb out: CONT 1 auth: Debug: client in: CONT<hidden> auth: Debug: gssapi(username,1.2.3.4,<9WOjSwWP8toKAAYE>): security context state completed. auth: Debug: client passdb out: CONT 1 YIGZBgkqhki[...]7Bm1G auth: Debug: client in: CONT<hidden> auth: Debug: gssapi(username,1.2.3.4,<9WOjSwWP8toKAAYE>): Negotiated security layer auth: Debug: client passdb out: CONT 1 BQQF/w[...]yjNOo= auth: Debug: client in: CONT<hidden> auth: Debug: static(username,1.2.3.4,<9WOjSwWP8toKAAYE>): lookup auth: Info: static(username,1.2.3.4,<9WOjSwWP8toKAAYE>): No password returned (and no nopassword) auth: Debug: client passdb out: OK 1 user=username original_user=username(a)MY-REALM.DOMAIN.TLD auth: Debug: master in: REQUEST 3940810753 9 1 740b6a075ea21dbe10397f3734262bbe session_pid=12 request_auth_token auth: Debug: master userdb out: USER 3940810753 username auth_token=d1503de7036a68a85ea9db25f32bc9df3ebf08a8 auth_user=username(a)MY-REALM.DOMAIN.TLD imap-login: Info: Login: user=<username>, method=GSSAPI, rip=1.2.3.4, lip=9.9.9.9, mpid=12, TLS, session=<9WOjSwWP8toKAAYE> ===== The good news is that everything related to Kerberos/GSSAPI authentication seems to work fine! Noteworthy in the above output I think is the line "auth: Debug: client passdb out: ..." which does not mention any proxy related settings any longer which aligns with my observations: - The client is then logged into an empty mailbox in local storage. Not okay. - No attempt to connect to my backend server is made (checked with tcpdump). Not okay. Somehow I start to believe that as soon as I set auth_mechanisms = gssapi, any args/field in passdb are ignored. Is that a bug or am I looking at a feature? What else have I tried: - Using imapc proxy [2], but that example config does not work in my Dovecot version with the error: auth: Error: prefetch(username,1.2.3.4,): userdb lookup not possible with only userdb prefetch - Using a passdb with master=yes and pass=yes. passdb { driver = static args = proxy=y host=127.0.0.1 port=1143 pass=dummypass master = yes pass = yes } This fails with the error: auth: Fatal: Master passdb can't have pass=yes if there are no passdbs master: Error: service(auth): command startup failed, throttling for 2 secs imap-login: Info: Disconnected: Auth process broken (disconnected before auth was ready, waited 0 secs): user=<>, rip=1.2.3.4, lip=9.9.9.9, session=<0i46qgWPntsKAAYE> imap-login: Warning: Timeout leak: 0x7efe483e8120 (auth-server-connection.c:397) Any help or clues are very much appreciated. Thanks! [1]: https://serverfault.com/q/951010/135437 [2]: https://wiki.dovecot.org/HowTo/ImapcProxy Gert van Dijk

2 2

qoutas for local domains
by Benny Pedersen 01 Aug '19

01 Aug '19

will it be possible to let local users have free qoutas while remote domains is qouta limited ? my wish is to let 2 local domains be qouta free, if possible, if not i like to let it be work to do, if i can provide a patch

1 0

dovecot/imap crashes on Centos 7
by marvin alcantara 30 Jul '19

30 Jul '19

Hi All, I have my dovecot/imap crashing on my Centos7 server. Below is the stacktrace I got: #0 0x00007f32d9b84e58 in array_count_i (array=0x55b332a1f8f8) at array.h:155 No locals. #1 array_get_i (count_r=<synthetic pointer>, array=0x55b332a1f8f8) at array.h:209 No locals. #2 seq_range_lookup (array=0x55b332a1f8f8, seq=7715, idx_r=0x7ffe5d719574) at seq-range-array.c:14 data = <optimized out> idx = <optimized out> left_idx = <optimized out> right_idx = <optimized out> count = <optimized out> #3 0x00007f32d9b859ae in seq_range_exists (array=array@entry=0x55b332a1f8f8, seq=seq@entry=7715) at seq-range-array.c:391 idx = 32766 #4 0x00007f32d9e4b3d9 in mailbox_search_result_add (result=result@entry=0x55b332a1f8e0, uid=7715) at mailbox-search-result.c:121 __FUNCTION__ = "mailbox_search_result_add" #5 0x00007f32d9eb0f30 in index_search_result_update_appends (result=result@entry=0x55b332a1f8e0, old_messages_count=<optimized out>) at index-search-result.c:168 t = 0x55b332a417d0 search_ctx = 0x55b332a1a580 mail = 0x55b332ae8e58 search_arg = {next = 0x55b332a7c0a0, type = SEARCH_SEQSET, value = {subargs = 0x0, seqset = { arr = {buffer = 0x55b3329da360, element_size = 8}, v = 0x55b3329da360, v_modifiable = 0x55b3329da360}, str = 0x0, time = 0, size = 0, flags = 0, search_flags = (unknown: 0), date_type = 0, thread_type = MAIL_THREAD_NONE, modseq = 0x0, search_result = 0x0, mime_part = 0x0}, initialized = {search_args = 0x0, keywords = 0x0, mailbox_glob = 0x0}, context = 0x0, hdr_field_name = 0x0, match_not = 0, match_always = 0, nonmatch_always = 0, fuzzy = 0, no_fts = 0, result = -1} message_count = 160 ret = <optimized out> __FUNCTION__ = "index_search_result_update_appends" #6 0x00007f32d9ebbc37 in search_result_update (result=0x55b332a1f8e0, ctx=0x55b332a2ed90) at index-sync-search.c:78 No locals. #7 index_sync_search_results_update (ctx=ctx@entry=0x55b332a2ed90) at index-sync-search.c:88 results = 0x55b332a3b4a0 i = <optimized out> count = <optimized out> #8 0x00007f32d9ebc4b4 in index_mailbox_sync_deinit (_ctx=0x55b332a2ed90, status_r=0x55b332a1f858) at index-sync.c:353 ctx = 0x55b332a2ed90 sync_rec = {seq1 = 0, seq2 = 0, type = MAILBOX_SYNC_TYPE_EXPUNGE} delayed_expunges = true ret = <optimized out> #9 0x00007f32d9e9e400 in mailbox_list_index_sync_deinit (ctx=0x55b332a2ed90, status_r=0x55b332a1f858) at mailbox-list-index.c:976 ibox = 0x55b332a3f990 box = 0x55b332a3b098 #10 0x00007f32d9e3b568 in mailbox_sync_deinit (_ctx=<optimized out>, status_r=<optimized out>) at mail-storage.c:1953 ctx = <optimized out> box = <optimized out> errormsg = <optimized out> error = MAIL_ERROR_NONE ret = <optimized out> #11 0x000055b33188c431 in imap_sync_finish (ctx=ctx@entry=0x55b332a1f7e0, aborting=aborting@entry=false) at imap-sync.c:279 client = 0x55b3329fb6a8 ret = 0 #12 0x000055b33188cfed in imap_sync_more (ctx=0x55b332a1f7e0) at imap-sync.c:594 str = <optimized out> ret = 1 __FUNCTION__ = "imap_sync_more" #13 0x000055b33188d676 in cmd_sync_continue (sync_cmd=0x55b3329fce58) at imap-sync.c:629 cmd = 0x55b3329f5b20 prev = <optimized out> client = 0x55b3329fb6a8 ctx = 0x55b332a1f7e0 ret = <optimized out> __FUNCTION__ = "cmd_sync_continue" #14 0x000055b33188db34 in cmd_sync_client (sync_cmd=0x55b3329fce58) at imap-sync.c:720 ctx = <optimized out> flags = <optimized out> client = 0x55b3329fb6a8 imap_flags = <optimized out> no_newmail = <optimized out> #15 cmd_sync_delayed_real (client=0x55b3329fb6a8) at imap-sync.c:833 cmd = <optimized out> first_expunge = <optimized out> first_nonexpunge = <optimized out> #16 cmd_sync_delayed (client=client@entry=0x55b3329fb6a8) at imap-sync.c:841 _data_stack_cur_id = 3 #17 0x000055b331873707 in client_input_append (cmd=0x55b3329fce58) at cmd-append.c:121 ctx = 0x55b3329fcff0 client = 0x55b3329fb6a8 reason = <optimized out> finished = <optimized out> lit_offset = <optimized out> __FUNCTION__ = "client_input_append" #18 0x00007f32d9b72be2 in io_loop_call_io (io=0x55b3329f5c70) at ioloop.c:600 ioloop = 0x55b3329e29c0 t_id = 2 __FUNCTION__ = "io_loop_call_io" #19 0x00007f32d9b742cf in io_loop_handler_run_internal (ioloop=ioloop@entry=0x55b3329e29c0) at ioloop-epoll.c:223 ctx = 0x55b3329e44e0 events = <optimized out> list = 0x55b3329e5f40 io = <optimized out> tv = {tv_sec = 3, tv_usec = 487057} events_count = <optimized out> msecs = <optimized out> ret = 1 i = 0 call = <optimized out> __FUNCTION__ = "io_loop_handler_run_internal" #20 0x00007f32d9b72c7c in io_loop_handler_run (ioloop=ioloop@entry=0x55b3329e29c0) at ioloop.c:649 No locals. #21 0x00007f32d9b72e38 in io_loop_run (ioloop=0x55b3329e29c0) at ioloop.c:624 __FUNCTION__ = "io_loop_run" #22 0x00007f32d9af7c03 in master_service_run (service=0x55b3329e2860, callback=callback@entry=0x55b33188de30 <client_connected>) at master-service.c:724 No locals. #23 0x000055b331873262 in main (argc=1, argv=0x55b3329e25f0) at main.c:484 set_roots = {0x55b331a9e700 <imap_setting_parser_info>, 0x7f32da3475a0, 0x0} login_set = {auth_socket_path = 0x55b3329da048 "\001", postlogin_socket_path = 0x0, postlogin_timeout_secs = 60, callback = 0x55b33188e600 <login_client_connected>, failure_callback = 0x55b33188df40 <login_client_failed>, request_auth_token = 1} service_flags = <optimized out> storage_service_flags = <optimized out> username = 0x0 auth_socket_path = <optimized out> c = <optimized out> Dovecot version: dovecot-2.2.36-3.el7.x86_64 I would like to ask for your inputs regarding this.Thank you very much for your help! Regards,Marvin

1 0

Bug with latest GCC 9
by Martin Liška 29 Jul '19

29 Jul '19

Hi. As mentioned here: https://bugzilla.opensuse.org/show_bug.cgi?id=1123136 there's a new issue with GCC 9, it's related to: https://gcc.gnu.org/gcc-9/porting_to.html#complit in: /* Not const! Never return this as a result directly! */ #define SMTP_ADDRESS_LITERAL(localpart, domain) \ &((struct smtp_address){ (localpart), (domain) }) Thanks, Martin

2 4

sieve scripts not synching for 2.3.5.1 pre-built
by Jan-Pieter Cornet 29 Jul '19

29 Jul '19

Hi, We're synching mailboxes, changing format from maildir to mdbox, using doveadm backup/doveadm sync. When still running 2.2.36, 'doveadm backup' also synched the sieve scripts, without issues. After the upgrade to 2.3.5.1, the sieve sync stopped working. We're using the pre-built 2.3 packages from https://repo.dovecot.org/ce-2.3-latest/debian/stretch In fact, when I now remove the dovecot-2.3 packages, and use my own old 2.2.36 packages, using the exact same config, the sieve scripts are being copied again. In 2.2.36, when I migrate a mailbox, I do see Pigeonhole being initialized. Eg: userimap-dev1:~ # doveadm -D backup -u xtra30 "doveadm -D dsync-server -u xtra30+mdbox=.8d1&4&03&xtra30" (note: that strange destination user signals to the auth proxy that we want the new mdbox storage instead of the default for this user) Debug: Loading modules from directory: /usr/lib/dovecot/modules Debug: Module loaded: /usr/lib/dovecot/modules/lib02_lazy_expunge_plugin.so Debug: Module loaded: /usr/lib/dovecot/modules/lib10_quota_plugin.so Debug: Module loaded: /usr/lib/dovecot/modules/lib20_zlib_plugin.so Debug: Loading modules from directory: /usr/lib/dovecot/modules/doveadm Debug: Skipping module doveadm_acl_plugin, because dlopen() failed: /usr/lib/dovecot/modules/doveadm/lib10_doveadm_acl_plugin.so: undefined symbol: acl_user_module (this is usually intentional, so just ignore this message) Debug: Skipping module doveadm_expire_plugin, because dlopen() failed: /usr/lib/dovecot/modules/doveadm/lib10_doveadm_expire_plugin.so: undefined symbol: expire_set_deinit (this is usually intentional, so just ignore this message) Debug: Module loaded: /usr/lib/dovecot/modules/doveadm/lib10_doveadm_quota_plugin.so Debug: Module loaded: /usr/lib/dovecot/modules/doveadm/lib10_doveadm_sieve_plugin.so [...skipping a bunch of lines...] dsync-local(xtra30): Debug: brain M: Mailbox Spam: local=88b39d12998d9e5cbb700000436edcce/0/1, remote=00000000000000000000000000000000/0/0: mailbox not selectable yet dsync-local(xtra30): Debug: brain M: Mailbox Test: local=801bb932e98d9e5c3d6d0000436edcce/0/1, remote=00000000000000000000000000000000/0/0: mailbox not selectable yet dsync-local(xtra30): Debug: brain M: Mailbox Trash: local=fc9b162b86479f5cc85a0000436edcce/0/1, remote=00000000000000000000000000000000/0/0: mailbox not selectable yet dsync-remote(xtra30): Debug: brain S: Skipping unchanged mailbox e7c1961d84479f5c885a0000436edcce dsync-local(xtra30): Debug: doveadm-sieve: Iterating Sieve mailbox attributes dsync-local(xtra30): Debug: sieve: Pigeonhole version 0.4.24 () initializing dsync-local(xtra30): Debug: sieve: include: sieve_global is not set; it is currently not possible to include `:global' scripts. dsync-local(xtra30): Debug: sieve: file storage: Using active Sieve script path: /var/mail/.8d1/index/7/oldsieve/x/xt/xtra30/dovecot.sieve [... skipping a lot of sieve debug lines that seem fine ...] dsync-remote(xtra30): Debug: sieve: file script: Opened script `xtra30-testfilter' from `/var/mail/.8d1/index/4/03/xtra30/sieve/scripts/xtra30-testfilter.sieve' dsync-remote(xtra30): Debug: doveadm-sieve: Assigned value for key `vendor/vendor.dovecot/pvt/server/sieve/default' (last change: 2019-03-29 22:27:41) dsync-remote(xtra30): Debug: brain S: Import INBOX: Import attribute vendor/vendor.dovecot/pvt/server/sieve/default: Nonexistent locally dsync-remote(xtra30): Debug: brain S: Import INBOX: Last common UID=0. Delayed expunges= dsync-remote(xtra30): Debug: brain S: Import INBOX: Import change type=save GUID=1553894809.M254847P28859.userimap11.xs4all.net,S=1311,W=1342 UID=1 hdr_hash= result=Mail's UID is above local UIDNEXT - No more local mails found [...] Afterwards, the sieve scripts have been transferred, even including last-modified time of any scripts. However, with 2.3.5.1, it seems doveadm-sieve is never called from dsync. Output includes: userimap-dev1:~ # doveadm -D backup -u xtra30 "doveadm -D dsync-server -u xtra30+mdbox=.8d1&4&03&xtra30" Debug: Loading modules from directory: /usr/lib/dovecot/modules Debug: Module loaded: /usr/lib/dovecot/modules/lib02_lazy_expunge_plugin.so Debug: Module loaded: /usr/lib/dovecot/modules/lib10_quota_plugin.so Debug: Module loaded: /usr/lib/dovecot/modules/lib20_zlib_plugin.so Debug: Loading modules from directory: /usr/lib/dovecot/modules/doveadm Debug: Skipping module doveadm_acl_plugin, because dlopen() failed: /usr/lib/dovecot/modules/doveadm/lib10_doveadm_acl_plugin.so: undefined symbol: acl_lookup_dict_iterate_visible_next (this is usually intentional, so just ignore this message) Debug: Skipping module doveadm_expire_plugin, because dlopen() failed: /usr/lib/dovecot/modules/doveadm/lib10_doveadm_expire_plugin.so: undefined symbol: expire_set_deinit (this is usually intentional, so just ignore this message) Debug: Module loaded: /usr/lib/dovecot/modules/doveadm/lib10_doveadm_quota_plugin.so Debug: Module loaded: /usr/lib/dovecot/modules/doveadm/lib10_doveadm_sieve_plugin.so [... skipping some lines again ..] dsync-local(xtra30)<SCSfIc5Wo1zTKAAAsPW7qw>: Debug: brain M: Mailbox Spam: local=88b39d12998d9e5cbb700000436edcce/0/1, remote=00000000000000000000000000000000/0/0: mailbox not selectable yet dsync-local(xtra30)<SCSfIc5Wo1zTKAAAsPW7qw>: Debug: brain M: Mailbox Test: local=801bb932e98d9e5c3d6d0000436edcce/0/1, remote=00000000000000000000000000000000/0/0: mailbox not selectable yet dsync-local(xtra30)<SCSfIc5Wo1zTKAAAsPW7qw>: Debug: brain M: Mailbox Trash: local=fc9b162b86479f5cc85a0000436edcce/0/1, remote=00000000000000000000000000000000/0/0: mailbox not selectable yet dsync-remote(xtra30)<h8hfIs5Wo1zWKAAAsPW7qw>: Debug: brain S: Skipping unchanged mailbox e7c1961d84479f5c885a0000436edcce dsync-remote(xtra30)<h8hfIs5Wo1zWKAAAsPW7qw>: Debug: brain S: Import INBOX: Last common UID=0. Delayed expunges= dsync-remote(xtra30)<h8hfIs5Wo1zWKAAAsPW7qw>: Debug: brain S: Import INBOX: Import change type=save GUID=1553894809.M254847P28859.userimap11.xs4all.net,S=1311,W=1342 UID=1 hdr_hash= result=Mail's UID is above local UIDNEXT - No more local mails found [...] In the above output from 2.3.5.1, all lines starting with "Debug: doveadm-sieve: Iterating Sieve mailbox attributes" are absent. I have no idea why. We can "work around" it by explicitly doing an rsync of the sieve storage after the migration, but that's a bit of a hack. Attached is a doveconf -n output for 2.3.5.1. -- Jan-Pieter Cornet <johnpc(a)xs4all.net> Systeembeheer XS4ALL Internet bv www.xs4all.nl

6 7

IMAP copy stopped copying flags
by Andrzej A. Filip 29 Jul '19

29 Jul '19

Is it intended behavior? It seems to be caused by upgrade to 1:2.3.2-2 on Debian/Testing. -- A. Filip

4 6

submission configuration issues
by Jean-Daniel Dupas 29 Jul '19

29 Jul '19

Hello, I'm having trouble configuring the submission proxy. I have configured the submission service as follow: submission_host = smtp.example.com submission_relay_host = localhost submission_relay_port = 8587 submission_relay_rawlog_dir = /var/log/dovecot/ submission_relay_trusted = yes My main issue is that until I login, dovecot-submission won't connect to the backend and query the capabilities and so won't report the right capabilities. That mean that the first EHLO message don't get the right capabilities list. " EHLO example.com 250-smtp.example.com 250-8BITMIME 250-AUTH PLAIN LOGIN 250-BURL imap 250-CHUNKING 250-ENHANCEDSTATUSCODES 250-SIZE 250 PIPELINING " This list don't contains VRFY, DNS, and SIZE is not specified (all of these is present in backend EHLO response). After login, if I send an new EHLO command, everything is properly reported. The raw log shows that unlike what the documentation says, dovecot don't try to connect to the backend until the user is properly logged. In my raw log I show that after I logged in dovecot-submission, the later open a connection to the backend and send a X-CLIENT command. Now, if I try to force the capabilities by using: submission_backend_capabilities = VRFY 8BITMIME DSN dovecot properly reports all SMTP capabilities in the first EHLO response, but it completely stops emitting X-CLIENT command to the backend and try to simply forward the command without authentication, which result in postfix rejecting the command with an unauthorized user error. What is wrong with my configuration ? Thanks. Jean-Daniel

4 7

Help with IMAP IDLE
by Jorge Bastos 29 Jul '19

29 Jul '19

Hi, I'm becaming crazy about this! I've asked before, not no matter what i do or conf, never works. How can i make IDLE work for real with MSOutlook, so that i can receive emails when they arrive, instead of changing folder/get out and in my account? Here's my conf, should it be reflected in postconf -n (is it the running conf?): ================== root@fastmail:/etc/dovecot# grep -ir idle * conf.d/20-imap.conf.ucf-dist:# If nothing happens for this long while client is IDLEing, move the connection conf.d/20-imap.conf.ucf-dist:# IDLEing. conf.d/20-imap.conf.ucf-dist:#imap_idle_notify_interval = 2 mins conf.d/20-imap.conf:imapc_max_idle_time = 1440 mins conf.d/20-imap.conf:# IDLEing. conf.d/20-imap.conf:#imap_idle_notify_interval = 2 mins conf.d/20-imap.conf:imap_idle_notify_interval = 1 min conf.d/20-imap.conf:#imap_client_workarounds = outlook-idle conf.d/10-mail.conf.ucf-dist:# When IDLE command is running, mailbox is checked once in a while to see if conf.d/10-mail.conf.ucf-dist:#mailbox_idle_check_interval = 30 secs conf.d/10-mail.conf:# When IDLE command is running, mailbox is checked once in a while to see if conf.d/10-mail.conf:#mailbox_idle_check_interval = 30 secs root@fastmail:/etc/dovecot# postconf -n|grep -i idle root@fastmail:/etc/dovecot#

7 16

Since multiple ,matches
by ＠lbutlr 27 Jul '19

27 Jul '19

I have a rule in sieve like the following: if anyof (header :contains ["to"] [ "box", "change", "cornell”, “twitter”]) { setflag "\\Seen"; fileinto :create "misc"; stop; } The messages that come in are using address extensions, so user+twitter(a)example.com, for example. The trouble is, this sieve recipe doesn’t get triggered and the message gets filed into the extension folder “twitter” or “cornell” instead of “misc”. I have a very similar recipe following that one: if header :contains "to" "root" { setflag "\\Seen"; addflag "$label5"; fileinto :create "root"; stop; } And that one works as I expect. Is that multiple match format valid for :contains (I’ve only seen it used for :regex)? I don’t get an error. Is there a way to run a debug log for the sieve recipe? Preferably for a single user. -- Vernon: Now this is the thought that wakes me up in the middle of the night. That when I get older, these kids are going to take care of me Carl: I wouldn't count on it.

1 1

Re: Dovecot, FreeBSD, and Solr?
by J. de Meijer 27 Jul '19

27 Jul '19

> Hello, > > Does anyone have this combination going? I'm running freebsd and dovecot, to which i'd like to add solr text search. I am stuck on xml schema integration, if anyone has any notes i'd appreciate them. I basically followed https://www.c0ffee.net/blog/mail-server-guide/ And dovecot with solr is running fine on freebsd for me.

3 3

corrupt mdbox index / zero mails showing in imap
by Mike 27 Jul '19

27 Jul '19

Hi, I have recently migrated (under emergency conditions) a dovecot imap/pop based server to a new instance. The mailboxes used mdbox format and due to various screwups I had corrupt indexes. I thought I'd cleaned this up but then I found that this new instance hadn't been set up correctly for nfs. Long story short, I still get users with new cases of corrupt indexes. The symptom is imap either showing NO mail in their inbox, or, not showing any recently delivered mail in the box, until I rm -f dovecot.map.index / doveadm force-resync -u user. It would be a huge help if there could be some method to detect if this is the case for any given user and to proactively do the force-resync process for them instead of waiting for that support call (or service cancellation...). I have looked around and have not found any tool capable of 'linting' an mdbox format inbox, and it seems like something like this should have been or would be an extremely useful debugging tool both during development as well as to troubleshoot stuff in the field. I would love to know if anyone either has such a tool, or any general suggestion how I could go about finding these cases and addressing them. I believe I have the nfs issue resolved and will not be creating new cases, so I just want to fix the ~3000 boxes I have now and move forward. Thank you. Mike-

2 2

doveadm migration to server with no root access
by jon rose 26 Jul '19

26 Jul '19

Hi I am trying to do mailbox migrations using doveadm to a server that I do not have root access on without success. Is this possible? What I have done and results: ssh to server with mailboxes to copy and then su cp /etc/dovecot/dovecot.conf /root/tmp/dovecot_new.conf append text below** to end of dovecot_new.conf try to copy mail 3 different ways (all fail see error messages) doveadm -D -v -c /root/tmp/dovecot_new.conf -o mail_fsync=never sync -1 -u test(a)propertyzone.co.za pop3c: fail with: Error: Mailbox INBOX.Archive sync: mailbox_set_subscribed failed: Subscriptions not supported doveadm -D -v -c /root/tmp/dovecot_new.conf -o mail_fsync=never sync -u test(a)propertyzone.co.za pop3c: fail with: Error: Can't create mailbox INBOX.Archive: POP3 mailbox creation isn't supported doveadm -D -v -c /root/tmp/dovecot_new.conf -o mail_fsync=never backup -u test(a)propertyzone.co.za pop3c: fail with: dsync(test(a)propertyzone.co.za): Panic: file mailbox-list-delete.c: line 473 (mailbox_list_delete_symlink_default): assertion failed: (ret > 0) ** append at end of dovecot_new.conf pop3c_host = dedi225.jnb3.host-h.net pop3c_user = test(a)propertyzone.co.za pop3c_password = ***** namespace inbox { inbox = yes } namespace { prefix = POP3-MIGRATION-NS/ location = pop3c: list = no hidden = yes } protocol doveadm { mail_plugins = $mail_plugins pop3_migration } plugin { pop3_migration_mailbox = POP3-MIGRATION-NS/INBOX -- Sent from: http://dovecot.2317879.n4.nabble.com/

2 4