- dovecot - dovecot.org

Directory name have some malicious characters.
by hfh＠cndns.com 20 May '19

20 May '19

Directory name have some malicious characters, is it safe?How can I exclude some characters,thanks!

1 0

Plugins/Mailcrypt: mail_crypt_private_password not assigned by password_query
by Max Kostikov 20 May '19

20 May '19

I try to use Mailcrypt encrypted user keys with conjustion with dbsync replication(Dovecot 2.3.6 in FreeBSD 12.0 enviroment) but was unsuccessful. If I provide a password in mail_crypt_private_password variable directly in Dovecot config all things works as expected plugin { mail_crypt_curve = prime256v1 mail_crypt_save_version = 2 mail_crypt_require_encrypted_user_key = yes mail_crypt_private_password = 12345 } but when I remove this and trying to get the same user password in password_query it seems password doesn't assigned password_query = SELECT username AS user, password, \ '%w' AS userdb_mail_crypt_private_password \ FROM mailbox WHERE username = LCASE('%u') \ AND active = '1' with errors like this in log at server where message was accepted from remote system May 20 00:40:31 server1 dovecot[35417]: dsync-local(foo(a)example.com)<Y51qBF/b4VyHigAAJQnBKg>: Error: dsync(server1.example.com): read() failed: read(/var/mail/example.com/foo/new/1558305609.M674400P35456.server1.example… failed: Private key not available: Cannot decrypt key a4ceb2df0287c0c0ccb0d76e31d91824e1f13e9ffe63d1e04a9a233a073d8a64: Cannot decrypt key 5d19a9246ddce2759a21462974add562dd90f2cb2aa3ff6a5af1af1e3e9b58e6: Password not available (last sent=mail, last recv=mail_request (EOL)) and errors at replica server May 20 00:40:31 server2 dovecot[63985]: dsync-local(foo(a)example.com)<MpW+HV/b4VwD+wAAfP91Tw>: Error: dsync(server2.example.com): read() failed: read() failed: dot-input stream ends without '.' line (last sent=mail_request (EOL), last recv=mail) The question is it possible to have password encrypted user keys with Dovecot dbsync replication or we found a new bug? -- With best regards, Max Kostikov W: https://kostikov.co | DeltaChat: mk(a)eprove.net

1 0

Permission denied
by ＠lbutlr 19 May '19

19 May '19

mail dovecot: lda(user@domain)<955><rPK3B2Gr4Vy7AwAAIdGjjQ>: msgid=<4562Sm6YyYzvmrD(a)mail.covisp.net>: save failed to INBOX: Mailbox INBOX: open(/usr/local/virtual/user(a)domain/tmp/1558293345.M130062P955.mail.covisp.net) failed: Permission denied The permissions on /usr/local/virual have not changed and are still owed by user/group 89/89 dovecot-sql.conf.ext: user_query = select 89 as uid, 89 as gid, concat('/usr/local/virtual/', maildir) as home FROM mailbox where username = '%u' dovecot.conf: first_valid_uid = 89 # ls -lsdn /usr/local/virtual/ 8 drwx------ 29 89 89 1536 Mar 12 23:30 /usr/local/virtual/ # ls -lsdn /usr/local/virtual/backup\(a)southgaylord.com 184 drwx------ 2056 89 89 92672 May 19 12:43 /usr/local/virtual/user@domain Do I need to compile dovecot with vpopmail support? -- I WILL NOT DO THE DIRTY BIRD Bart chalkboard Ep. AABF08

1 0

Repo for RHEL8
by TG Servers 19 May '19

19 May '19

2 2

Merging existing mailboxes to aliases
by Lefteris Tsintjelis 19 May '19

19 May '19

I am trying to merge all, existing or not, different mailboxes in one with the mailbox alias plugin. If I add the following lines, will the existing mailboxes automatically merge in one mailbox and corresponding links auto create? If not, do I have to do this manually? mailbox_alias_new = Spam mailbox_alias_new2 = Junk E-mail mailbox_alias_new3 = Sent Items mailbox_alias_new4 = Sent Messages mailbox_alias_new5 = Deleted Items mailbox_alias_old = Junk mailbox_alias_old2 = Junk mailbox_alias_old3 = Sent mailbox_alias_old4 = Sent mailbox_alias_old5 = Trash Lefteris

3 4

Do we need ssl_dh_parameters_length in version 2.3
by MRob 19 May '19

19 May '19

Hi, I couldn't really find documentation about ssl_dh_parameters_length except for mention in passing on the page https://wiki2.dovecot.org/SSL/DovecotConfiguration For version 2.3 and above is that setting necessary? If so what are the values I can use, is setting it high like 4096 beneficial or make any problems for clients? Thanks for assistance.

2 1

Re: imap failing
by LuKreme 18 May '19

18 May '19

Ugh. Sorry about this, using gmail and it’s weird and annoying meant to send to list On Thu, May 16, 2019 at 00:46 LuKreme <kremels(a)kreme.com> wrote: > One more bit of info. After leaving s_client up for a bit, I got another > line > > CONNECTED(00000003) > 675481056:error:140790E5:SSL routines:ssl23_write:ssl handshake > failure:/usr/src/crypto/openssl/ssl/s23_lib.c:177: > --- > no peer certificate available > --- > No client certificate CA names sent > --- > SSL handshake has read 0 bytes and written 307 bytes > --- > New, (NONE), Cipher is (NONE) > Secure Renegotiation IS NOT supported > Compression: NONE > Expansion: NONE > No ALPN negotiated > SSL-Session: > Protocol : TLSv1.2 > Cipher : 0000 > Session-ID: > Session-ID-ctx: > Master-Key: > Key-Arg : None > PSK identity: None > PSK identity hint: None > SRP username: None > Start Time: 1557988789 > Timeout : 300 (sec) > Verify return code: 0 (ok) > --- > > I guess I wasn't patient enough before. But the certs are in the exact > same place as they've been all along and are working fine with apache. > I can also send mail, if that is at all relevant. (postconf -n is in > another post in this thread) > -- Sent from Gmail Mobile

3 3

Find last day of login
by Lefteris Tsintjelis 18 May '19

18 May '19

I am using dovecot virtual maildir accounts. Is it possible to find last day of login for an account by checking the last modification time of the maildir files? Lefteris

3 4

How to continuously gather statistics?
by Roel van Duijnhoven 17 May '19

17 May '19

Hello, I recently upgraded to the latest version of Dovecot, and want to use the newly introduced logging / event system. I want to fetch the statistics every couple of seconds, and push those to our logging platform. Metrics such as: number of IMAP commands, average time they took, etc. However the metrics as reported by Dovecot continously increment. So I see two solutions: - Our solution could keep track of the previous values. But that could also break if the statistics are reset for some reason (e.g. threshold reached). - My second thought was to use "stats -r". That *should* clear the statistics directly after fetching them. And thus, give a better picture. However I am not sure if this gives me actual useful results. Or is there maybe a better approach to fetch statistics that I overlooked? Thanks a lot. Best, Roel van Duijnhoven

2 1

Dovecot Separator change
by Oliver Werner 16 May '19

16 May '19

Hi community, actually we are using dovecot 2.2.27 without shares mailboxes. Now we would like to implement it. So the problem is that our separator is dot „.“ and the username like „firstname.surname“. That’s doesn’t works with shared mailboxes. Are there a migration guide for changing „.“ to „/„ or it's not possible? kind regards Oliver

1 0

File-dictionary based quotas and SETQUOTA
by Ganael Laplanche 16 May '19

16 May '19

Hello, I am trying to set up file-dictionary based quotas while supporting the SETQUOTA IMAP command. I am using the following configuration : ---- plugin { quota = dict:User quota::file:%h/Maildir/dovecot-quota quota_set = dict:file:%h/Maildir/dovecot-quota } ---- which enables correct quota accounting + setting through SETQUOTA. A user's dovecot-quota file ends with the following contents : ---- priv/quota/limit/storage 5242880 priv/quota/limit/messages 20 priv/quota/messages 1 priv/quota/storage 8506282 ---- which shows a correct accounting (1 mail received, ~8MB used) and correct setting after having used the following IMAP command through a master user : A2 SETQUOTA "User quota" (STORAGE 5242880 MESSAGE 20) *But* the problem is that I am unable to fetch the limits and consume them from userdb (as a consequence, the limits are never applied). On the consuming side, I am using a dictionary userdb to try to fetch the 'priv/quota/limit/storage' value from the file but it does not work because the key is never found. Here is my configuration : ---- userdb { driver = dict args = /etc/dovecot/dovecot-dict-quota.conf.ext } ---- and my dovecot-dict-quota.conf.ext file : ---- uri = file:%h/Maildir/dovecot-quota iterate_disable = yes key quota { key = priv/quota/limit/storage default_value = 100 } userdb_fields { quota_rule = *:storage=%{dict:quota} } ---- If I try to fetch the quota for that user : # doveadm quota get -u ganael.laplanche(a)centralesupelec.fr Quota name Type Value Limit % User quota STORAGE 8307 100 8307 User quota MESSAGE 1 - 0 the default rule is returned (100). The logs show : May 16 12:02:45 mailhost1-saclay dovecot: auth-worker(12899): Debug: dict(Ganael.Laplanche(a)centralesupelec.fr): Lookup: shared/priv/quota/limit/ storage not found, using default value 100 We can see that the default quota rule has been applied because the key is not found. The problem is that a "shared/" prefix is always prepended when looking for the key I configured (priv/quota/limit/storage). If I test the dictionary manually, the key is found : # doveadm dict get -u ganael.laplanche(a)centralesupelec.fr "file:/var/vmail/l/ laplanche_gan/Maildir/dovecot-quota" priv/quota/limit/storage 5242880 Does anyone know how to prevent Dovecot from adding that prefix and make it fetch the correct value from userdb ? Best regards, -- Ganael Laplanche <ganael.laplanche(a)centralesupelec.fr> Unix Systems Engineer @CentraleSupelec Rennes

1 0

Password database - external verification
by Richard Hector 16 May '19

16 May '19

Hi all, I'm currently using a PostgreSQL database for my user/password db, directly from dovecot. The trouble with that is that I'm stuck with whatever hash algorithms dovecot supports - which IIRC means (a subset of?) what libc has been compiled with, which can be a bit restrictive. So I'd like to use an external tool, which would also let me integrate other applications (eg web apps). PAM seems to be most suited to sharing accounts with the OS, which isn't what I want. BSDAuth likewise, but I'm not using BSD. CheckPassword looks like a somewhat convoluted protocol, but maybe the best bet? IMAP - well, that's circular :-) OAuth2 looks possible, but seems to be focused on http? Any suggestions? And recommended implementations? How hard is it to add extra methods? Thanks, Richard

2 2

Dovecot not connecting to OpenLDAP
by Elias Falconi 16 May '19

16 May '19

Hi, We recently shutdown our old LDAP server and repointed our mail server (dovecot + postfix) to our new LDAP server and ever since we've been unable to fetch mail. Mail is getting delivered, but we just can't pop it. We're using Ubuntu 16.04, btw. We keep on getting the following error messages in /var/log/dovecote: 2019-05-15 16:27:43 auth: Error: LDAP /etc/dovecot/dovecot-ldap.conf.ext: ldap_start_tls_s() failed: Can't contact LDAP server 2019-05-15 16:39:36 auth: Error: LDAP /etc/dovecot/dovecot-ldap.conf.ext: ldap_start_tls_s() failed: Connect error 2019-05-15 16:39:43 auth: Error: LDAP /etc/dovecot/dovecot-ldap.conf.ext: ldap_start_tls_s() failed: Local error However, our server is finding our LDAP users and postfix doesn't seem to have a problem, just Dovecot. Also, when we try to connect via Dovecot, we get the following message: -ERR [SYS/TEMP] Temporary authentication failure. [mail:2019-05-15 21:40:06] Our /etc/dovecot/dovecot.conf contains the following: ## Dovecot configuration file # If you're in a hurry, see http://wiki2.dovecot.org/QuickConfiguration # "doveconf -n" command gives a clean output of the changed settings. Use it # instead of copy&pasting files when posting to the Dovecot mailing list. # '#' character and everything after it is treated as comments. Extra spaces # and tabs are ignored. If you want to use either of these explicitly, put the # value inside quotes, eg.: key = "# char and trailing whitespace " # Most (but not all) settings can be overridden by different protocols and/or # source/destination IPs by placing the settings inside sections, for example: # protocol imap { }, local 127.0.0.1 { }, remote 10.0.0.0/8 { } # Default values are shown for each setting, it's not required to uncomment # those. These are exceptions to this though: No sections (e.g. namespace {}) # or plugin settings are added by default, they're listed only as examples. # Paths are also just examples with the real defaults being based on configure # options. The paths listed here are for configure --prefix=/usr # --sysconfdir=/etc --localstatedir=/var # Enable installed protocols !include_try /usr/share/dovecot/protocols.d/*.protocol # A comma separated list of IPs or hosts where to listen in for connections. # "*" listens in all IPv4 interfaces, "::" listens in all IPv6 interfaces. # If you want to specify non-default ports or anything more complex, # edit conf.d/master.conf. #listen = *, :: # Base directory where to store runtime data. #base_dir = /var/run/dovecot/ # Name of this instance. In multi-instance setup doveadm and other commands # can use -i <instance_name> to select which instance is used (an alternative # to -c <config_path>). The instance name is also added to Dovecot processes # in ps output. #instance_name = dovecot # Greeting message for clients. #login_greeting = Dovecot ready. # Space separated list of trusted network ranges. Connections from these # IPs are allowed to override their IP addresses and ports (for logging and # for authentication checks). disable_plaintext_auth is also ignored for # these networks. Typically you'd specify your IMAP proxy servers here. #login_trusted_networks = # Space separated list of login access check sockets (e.g. tcpwrap) #login_access_sockets = # With proxy_maybe=yes if proxy destination matches any of these IPs, don't do # proxying. This isn't necessary normally, but may be useful if the destination # IP is e.g. a load balancer's IP. #auth_proxy_self = # Show more verbose process titles (in ps). Currently shows user name and # IP address. Useful for seeing who are actually using the IMAP processes # (eg. shared mailboxes or if same uid is used for multiple accounts). #verbose_proctitle = no # Should all processes be killed when Dovecot master process shuts down. # Setting this to "no" means that Dovecot can be upgraded without # forcing existing client connections to close (although that could also be # a problem if the upgrade is e.g. because of a security fix). #shutdown_clients = yes # If non-zero, run mail commands via this many connections to doveadm server, # instead of running them directly in the same process. #doveadm_worker_count = 0 # UNIX socket or host:port used for connecting to doveadm server #doveadm_socket_path = doveadm-server # Space separated list of environment variables that are preserved on Dovecot # startup and passed down to all of its child processes. You can also give # key=value pairs to always set specific settings. #import_environment = TZ ## ## Dictionary server settings ## # Dictionary can be used to store key=value lists. This is used by several # plugins. The dictionary can be accessed either directly or though a # dictionary server. The following dict block maps dictionary names to URIs # when the server is used. These can then be referenced using URIs in format # "proxy::<name>". dict { #quota = mysql:/etc/dovecot/dovecot-dict-sql.conf.ext #expire = sqlite:/etc/dovecot/dovecot-dict-sql.conf.ext quota = ldap:/etc/dovecot/dovecot-ldap.conf.ext expire = ldap:/etc/dovecot/dovecot-ldap.conf.ext } # Most of the actual configuration gets included below. The filenames are # first sorted by their ASCII value and parsed in that order. The 00-prefixes # in filenames are intended to make it easier to understand the ordering. !include conf.d/*.conf # A config file can also tried to be included without giving an error if # it's not found: !include_try local.conf # Added by Elias protocols = pop3 imap #ssl_cert = </etc/ssl/certs/server.crt #ssl_key = </etc/ssl/private/server.key ssl_cert = </etc/ssl/certs/ssl-cert-snakeoil.pem ssl_key = </etc/ssl/private/ssl-cert-snakeoil.key log_path = /var/log/dovecote info_log_path = /var/log/dovecote_info log_timestamp = "%Y-%m-%d %H:%M:%S " #syslog_facility = mail_dovecote #ssl = no #mail_location = mbox:~/:INBOX=/var/mail/%u #namespace { # type = private # separator = . # inbox = yes #} mail_privileged_group = mail mail_full_filesystem_access = yes mail_debug = yes mmap_disable = yes mail_nfs_storage = yes mail_nfs_index = yes mail_fsync = always mbox_read_locks = dotlock mbox_write_locks = dotlock passdb ldap { driver = ldap # Path for LDAP configuration file args = /etc/dovecot/dovecot-ldap.conf.ext } userdb { driver=passwd } userdb ldap { driver = ldap # Path for LDAP configuration file args = /etc/dovecot/dovecot-ldap.conf.ext } And our /etc/dovecot/dovecot-ldap.conf.ext has this: # This file is commonly accessed via passdb {} or userdb {} section in # conf.d/auth-ldap.conf.ext # This file is opened as root, so it should be owned by root and mode 0600. # # http://wiki2.dovecot.org/AuthDatabase/LDAP # # NOTE: If you're not using authentication binds, you'll need to give # dovecot-auth read access to userPassword field in the LDAP server. # With OpenLDAP this is done by modifying /etc/ldap/slapd.conf. There should # already be something like this: # access to attribute=userPassword # by dn="<dovecot's dn>" read # add this # by anonymous auth # by self write # by * none # Space separated list of LDAP hosts to use. host:port is allowed too. hosts = 139.147.9.135 # LDAP URIs to use. You can use this instead of hosts list. Note that this # setting isn't supported by all LDAP libraries. #uris = ldaps://139.147.9.135 # Distinguished Name - the username used to login to the LDAP server. # Leave it commented out to bind anonymously (useful with auth_bind=yes). dn = cn=admin,dc=cs,dc=lafayette,dc=edu # Password for LDAP server, if dn is specified. dnpass = blahblah123 # Use SASL binding instead of the simple binding. Note that this changes # ldap_version automatically to be 3 if it's lower. Also note that SASL binds # and auth_bind=yes don't work together. #sasl_bind = no # SASL mechanism name to use. #sasl_mech = # SASL realm to use. #sasl_realm = # SASL authorization ID, ie. the dnpass is for this "master user", but the # dn is still the logged in user. Normally you want to keep this empty. #sasl_authz_id = # Use TLS to connect to the LDAP server. tls = yes # TLS options, currently supported only with OpenLDAP: #tls_ca_cert_file =/etc/ssl/certs/ldap.crt tls_ca_cert_file =/etc/ssl/certs/ldap6_cacert.pem #tls_ca_cert_dir =/etc/ssl/certs/ #tls_cipher_suite = # TLS cert/key is used only if LDAP server requires a client certificate. #tls_cert_file = /etc/ssl/certs/ldap01_slapd_cert.pem #tls_key_file = /etc/ssl/private/ldap01_slapd_key.pem # Valid values: never, hard, demand, allow, try #tls_require_cert = demand # Use the given ldaprc path. #ldaprc_path = # LDAP library debug level as specified by LDAP_DEBUG_* in ldap_log.h. # -1 = everything. You may need to recompile OpenLDAP with debugging enabled # to get enough output. #debug_level = 0 # Use authentication binding for verifying password's validity. This works by # logging into LDAP server using the username and password given by client. # The pass_filter is used to find the DN for the user. Note that the pass_attrs # is still used, only the password field is ignored in it. Before doing any # search, the binding is switched back to the default DN. auth_bind = yes # If authentication binding is used, you can save one LDAP request per login # if users' DN can be specified with a common template. The template can use # the standard %variables (see user_filter). Note that you can't # use any pass_attrs if you use this setting. # # If you use this setting, it's a good idea to use a different # dovecot-ldap.conf.ext for userdb (it can even be a symlink, just as long as # the filename is different in userdb's args). That way one connection is used # only for LDAP binds and another connection is used for user lookups. # Otherwise the binding is changed to the default DN before each user lookup. # # For example: # auth_bind_userdn = cn=%u,ou=people,o=org # #auth_bind_userdn = # LDAP protocol version to use. Likely 2 or 3. ldap_version = 3 # LDAP base. %variables can be used here. # For example: dc=mail, dc=example, dc=org base = ou=People,dc=cs,dc=lafayette,dc=edu # Dereference: never, searching, finding, always deref = never # Search scope: base, onelevel, subtree scope = subtree # User attributes are given in LDAP-name=dovecot-internal-name list. The # internal names are: # uid - System UID # gid - System GID # home - Home directory # mail - Mail location # # There are also other special fields which can be returned, see # http://wiki2.dovecot.org/UserDatabase/ExtraFields user_attrs = homeDirectory=home,uidNumber=uid,gidNumber=gid # Filter for user lookup. Some variables can be used (see # http://wiki2.dovecot.org/Variables for full list): # %u - username # %n - user part in user@domain, same as %u if there's no domain # %d - domain part in user@domain, empty if user there's no domain user_filter = (&(objectClass=posixAccount)(uid=%u)) # Password checking attributes: # user: Virtual user name (user@domain), if you wish to change the # user-given username to something else # password: Password, may optionally start with {type}, eg. {crypt} # There are also other special fields which can be returned, see # http://wiki2.dovecot.org/PasswordDatabase/ExtraFields pass_attrs = uid=user,userPassword=password # If you wish to avoid two LDAP lookups (passdb + userdb), you can use # userdb prefetch instead of userdb ldap in dovecot.conf. In that case you'll # also have to include user_attrs in pass_attrs field prefixed with "userdb_" # string. For example: #pass_attrs = uid=user,userPassword=password,\ # homeDirectory=userdb_home,uidNumber=userdb_uid,gidNumber=userdb_gid # Filter for password lookups pass_filter = (&(objectClass=posixAccount)(uid=%u)) # Attributes and filter to get a list of all users #iterate_attrs = uid=user #iterate_filter = (objectClass=posixAccount) # Default password scheme. "{scheme}" before password overrides this. # List of supported schemes is in: http://wiki2.dovecot.org/Authentication #default_pass_scheme = CRYPT What do you suppose could be the problem? Thanks, Elias

3 2

imap failing
by ＠lbutlr 16 May '19

16 May '19

mail kernel: pid 59433 (imap-login), uid 0: exited on signal 11 (core dumped) master: Error: service(imap-login): command startup failed, throttling for 16 secs May 15 17:21:37 imap-login: Fatal: master: service(imap-login): child 92934 killed with signal 11 (core dumped) I also get a password error for a user unknown, but if I connect to the database with the credentials dovecot uses, I get a password. MariaDB [postfix]> select password FROM mailbox where username ='sample(a)domain.munged'; +-------------------------------------------------------------------------------+ | password | +-------------------------------------------------------------------------------+ | {SHA256-CRYPT}$5$042......................................................... | +-------------------------------------------------------------------------------+ MariaDB [postfix]> select 89 as uid, 89 as gid, concat('/usr/local/virtual/', maildir) as home FROM mailbox where username = 'sample(a)domain.munged'; +-----+-----+------------------------------------------+ | uid | gid | home | +-----+-----+------------------------------------------+ | 89 | 89 | /usr/local/virtual/sample(a)domain.munged/ | +-----+-----+------------------------------------------+ 1 row in set (0.00 sec) I updated my system to openssl111 and rebuilt dovecot and postfix (and a hundred other packages). <y configuration files have not changed. I've looked through he logs for other info, but I don't see anything. Trying to connect via openssl gives me: # openssl s_client -connect mail.covisp.net:993 -starttls imap CONNECTED(00000003)

3 5

Setting up individual encrypted user keys using mail-crypt-plugin
by emordin 16 May '19

16 May '19

Hi, I have setup up a simple mail server using the ISPMail tutorial and I'm trying to learn how to create email encryption at rest. I'm having a tough time understanding how to set this up... So say a user logins thru roundcube and they type in their password...so the password authenticates to the mysql database which is storing their encrypted private key?? And once they access that private key, how do they use that private key to unencrypt their mailbox? I'm a super noob at this, and I may be off, but I don't know where to start when it comes to setting this up... if I'm way off could you just recommend some tutorials or other basics I should learn first before moving on to setting this up? Sent with [ProtonMail](https://protonmail.com) Secure Email.

2 1

Mutual auth and MS Outlook
by dovecot＠scottsavarese.com 16 May '19

16 May '19

I am trying to get Dovecot IMAP and Outlook to talk to each other with SSL and client certificates enabled. In Dovecot, I have the following options enabled: ssl_ca = ... ssl_verify_client_cert = yes auth_ssl_require_client_cert = yes auth_ssl_username_from_cert = yes when I try to connect with Outlook, I get: May 12 08:07:50 mail dovecot: imap-login: Disconnected (client didn't send a cert): user=<>, method=PLAIN, rip=192.168.1.245, lip=192.168.2.5, TLS: Disconnected, session=<is7gpa+Im97AqAH1> But when I use openssl directly with the same certificates it seems to pass the certificate in just fine. Does anybody have any ideas? Thanks in advance.

2 1

Permissions fix
by Lefteris Tsintjelis 16 May '19

16 May '19

Is there a fast way for dovecot to set and/or fix its directory permissions?

2 2

Anyone using object storage ceph?
by Marc Roos 15 May '19

15 May '19

Just curious if there are already people actively using object storage? https://github.com/ceph-dovecot/dovecot-ceph-plugin https://docplayer.net/docs-images/40/9935441/images/page_13.jpg

2 1

Re: weakforced and GeoIP lookups
by Neil Cook 15 May '19

15 May '19

Hi Tobi, This looks like you haven’t included the libmaxmind libraries before running configure. GeoIP support is only compiled in if it finds the right libs. This would be libmaxminddb-dev on Ubuntu for example. Neil >> Hi list >> >> hope it's okay to ask weakforced questions here as well, but I could not >> find a dedicated mailinglist for wforce. >> >> I want to enable GeoIP lookups in my wforce daemon. In a first step I >> installed luarocks and lua-compat53 to install mmdblua module. >> Then I added >> >> newGeoIP2DB("country", "/usr/local/share/GeoIP/GeoLite2-Country.mmdb") >> local mygeodb = getGeoIP2DB("country") >> if(mygeodb:lookupCountry(lt.remote) == 'XX') >> then >> return -1, "country blocked", "country blocked", { country="XX" } >> end >> >> to wforce.conf and tried to restart wforce but that ends up in a >> >> > Fatal Lua error: [string "chunk"]:28: attempt to call global >> > 'newGeoIP2DB' (a nil value) >> >> Any ideas what I could be missing here? >> >> Cheers >> >> tobi > > > Neil Cook > neil.cook(a)open-xchange.com <mailto:neil.cook@open-xchange.com> > > ------------------------------------------------------------------------------------- > Open-Xchange AG, Rollnerstr. 14, 90408 Nuremberg, District Court Nuremberg HRB 24738 > Managing Board: Rafael Laguna de la Vera, Carsten Dirks, Michael Knapstein, Stephan Martin > Chairman of the Board: Richard Seibt > > European Office: > Open-Xchange GmbH, Olper Huette 5f, D-57462 Olpe, Germany, District Court Siegen, HRB 8718 > Managing Director: Frank Hoberg > > US Office: > Open-Xchange. Inc., 530 Lytton Avenue, Palo Alto, CA 94301, USA > ------------------------------------------------------------------------------------- > Neil Cook neil.cook(a)open-xchange.com <mailto:neil.cook@open-xchange.com> ------------------------------------------------------------------------------------- Open-Xchange AG, Rollnerstr. 14, 90408 Nuremberg, District Court Nuremberg HRB 24738 Managing Board: Rafael Laguna de la Vera, Carsten Dirks, Michael Knapstein, Stephan Martin Chairman of the Board: Richard Seibt European Office: Open-Xchange GmbH, Olper Huette 5f, D-57462 Olpe, Germany, District Court Siegen, HRB 8718 Managing Director: Frank Hoberg US Office: Open-Xchange. Inc., 530 Lytton Avenue, Palo Alto, CA 94301, USA -------------------------------------------------------------------------------------

2 4

LDA-based vacation responses bouncing
by micah anderson 14 May '19

14 May '19

I've got dovecot vacataion auto-responses working via sieve, but when the responses are sent, they are sent as if they are to be locally delivered, which causes them to bounce for domains that I am not local for. How can I get dovecot's sieve vacation response to check the domain is local or not? Here is an example of what happens: The LDA notices it needs to send a vacation response: 2019-05-14T10:50:47.827466-07:00 brant dovecot: lda(user(a)example.org)<14817><xL6LL/f/2lzhOQAAh856Uw>: sieve: msgid=<20190514135045.012486@localhost>: sent vacation response to <someone(a)somewhere.org> but that response was sent via the postfix pipe through the dovecot lda transport... because that is local, and the domain it is sending to is not local, it bounces: 2019-05-14T10:50:47.923333-07:00 brant postfix/pipe[14821]: C998381539: to=<someone(a)somewhere.org>, relay=dovecot, delay=0.11, delays=0.04/0.01/0/0.06, dsn=5.1.1, status=bounced (user unknown) Postfix is set to do this: dovecot unix - n n - - pipe flags=DRhu user=mail argv=/usr/bin/spamc --connect-retries=1 -H -d 10.0.1.92 -s 10240000 -t 100 -u ${recipient} -e /usr/lib/dovecot/dovecot-lda -f ${sender} -d ${recipient} require ["fileinto", "vacation"]; vacation :days 2 :subject "Helllo" "Hi"; Here is my doveconf -n: # 2.3.4.1 (f79e8e7e4): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.4 () # OS: Linux 4.9.0-8-amd64 x86_64 Debian 9.8 auth_worker_max_count = 120 default_client_limit = 6144 default_process_limit = 256 default_vsz_limit = 512 M dict { expire = mysql:/etc/dovecot/dovecot-dict-sql.conf quota = mysql:/etc/dovecot/dovecot-dict-sql.conf } disable_plaintext_auth = no first_valid_gid = 8 first_valid_uid = 8 last_valid_gid = 8 last_valid_uid = 8 listen = * login_greeting = howdy, ready. login_log_format_elements = user=<%u> method=%m rip=%r lip=%l mpid=%e %c %k mail_location = mdbox:~/mdbox mail_plugins = expire quota zlib maildir_very_dirty_syncs = yes namespace { inbox = yes location = prefix = separator = . } namespace { alias_for = hidden = yes inbox = no list = no location = prefix = INBOX. separator = . } passdb { args = /etc/dovecot/dovecot-sql.conf driver = sql } plugin { expire = Trash expire2 = Trash/* expire3 = Spam expire_dict = proxy::expire quota = dict:Your mail quota::proxy::quota quota_rule = *:bytes=100663296 quota_rule2 = Trash:bytes=+20%% quota_rule3 = Spam:bytes=+10%% quota_rule4 = INBOX.Trash:bytes=+20%% quota_rule5 = INBOX.Spam:bytes=+10%% quota_rule6 = INBOX.restored_from_backups:bytes=+500%% sieve = ~/.dovecot.sieve sieve_after = /var/lib/dovecot/sieve/after.sieve sieve_before = /var/lib/dovecot/sieve/default.sieve sieve_dir = ~/sieve zlib_save = gz zlib_save_level = 6 } protocols = " imap pop3" service anvil { unix_listener anvil { group = dovecot mode = 0660 user = root } } service auth { client_limit = 6144 unix_listener auth-userdb { group = mail mode = 0600 user = mail } } service dict { unix_listener dict { group = mail mode = 0600 user = mail } } service imap-login { process_min_avail = 10 service_count = 0 vsz_limit = 512 M } service imap-postlogin { executable = script-login /usr/local/sbin/postlogin_imap } service imap { executable = imap imap-postlogin process_limit = 6144 } service pop3-login { process_min_avail = 10 service_count = 0 vsz_limit = 512 M } service pop3-postlogin { executable = script-login /usr/local/sbin/postlogin_pop } service pop3 { executable = pop3 pop3-postlogin } service stats { unix_listener stats-writer { group = mail mode = 0660 } } ssl_cert = </etc/certs/wildcard/cert.pem ssl_cipher_list = ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA ssl_dh = # hidden, use -P to show it ssl_key = # hidden, use -P to show it ssl_prefer_server_ciphers = yes userdb { args = /etc/dovecot/dovecot-sql.conf driver = sql } verbose_proctitle = yes verbose_ssl = yes protocol lda { mail_plugins = expire quota trees zlib sieve plugin { quota_exceeded_message = Sorry, your message cannot be delivered to that person because their mailbox is full. If you can contact them another way, you may wish to tell them of this problem. quota_rule7 = INBOX:bytes=+10%% } } protocol imap { imap_client_workarounds = delay-newmail tb-extra-mailbox-sep mail_plugins = expire quota trees zlib imap_quota imap_zlib plugin { quota_exceeded_message = You are over quota. To avoid losing mail, immediately empty your Trash and Sent folders and delete emails with large attachments. } } protocol pop3 { mail_plugins = expire quota trees zlib pop3_client_workarounds = outlook-no-nuls oe-ns-eoh pop3_uidl_format = %g } remote 127.0.0.1 { mail_max_userip_connections = 60 } Thanks for any suggestions, micah

1 1

Graceful dovecot reload for LE certificate renewals
by Sidsel Jensen 14 May '19

14 May '19

Hi Dovecot-gurus With the introduction of LE certificates the certificate renewal cycle is a lot faster, unfortunately even a "dovecot reload" cuts the existing connections when doing the cert updates, which is quite frustrating - and yes most clients automatically reconnect but still... Is any work going into implementing a more “graceful reload” for dovecot like the one for nginx where existing connections are preserved with the old cert and new connections get the new cert? Kind Regards, Sidsel Jensen Systems Engineer @ One.com <http://one.com/>

2 1

Graceful dovecot reload for LE certificate renewals
by Sidsel Jensen 14 May '19

14 May '19

Hi Dovecot-gurus With the introduction of LE certificates the certificate renewal cycle is a lot faster, unfortunately even a "dovecot reload" cuts the existing connections when doing the cert updates, which is quite frustrating - and yes most clients automatically reconnect but still... Is any work going into implementing a more “graceful reload” for dovecot like the one for nginx where existing connections are preserved with the old cert and new connections get the new cert? Kind Regards, Sidsel Jensen Systems Engineer @ One.com <http://one.com/>

1 0

weakforced and GeoIP lookups
by Tobi 14 May '19

14 May '19

Hi list hope it's okay to ask weakforced questions here as well, but I could not find a dedicated mailinglist for wforce. I want to enable GeoIP lookups in my wforce daemon. In a first step I installed luarocks and lua-compat53 to install mmdblua module. Then I added newGeoIP2DB("country", "/usr/local/share/GeoIP/GeoLite2-Country.mmdb") local mygeodb = getGeoIP2DB("country") if(mygeodb:lookupCountry(lt.remote) == 'XX') then return -1, "country blocked", "country blocked", { country="XX" } end to wforce.conf and tried to restart wforce but that ends up in a > Fatal Lua error: [string "chunk"]:28: attempt to call global > 'newGeoIP2DB' (a nil value) Any ideas what I could be missing here? Cheers tobi

1 0

Is it possible to (re)direct only 1 imap user to the new server
by Marc Roos 14 May '19

14 May '19

I haven't used dovecot proxy or director. If I have a setup where all my users are connecting to HOSTNAMEOLD, is it possible to have 1 imap user that is connecting to HOSTNAMEOLD directed/forwarded to HOSTNAMENEW? Without changing my dns settings and preferably without creating any new servers. I think I can route one users mail to HOSTNAMENEW with sendmail ldap routing. So the only thing I need to be able to do is have the incoming imap requests on HOSTNAMEOLD been handled by HOSTNAMENEW. HOSTNAMEOLD HOSTNAMENEW +--------------+ +--------------+ | SENDMAIL | | SENDMAIL | | | | | | | | | | | V | | V | |--------------| |--------------| | lmtp | | NS /INBOX | | | | | mbox on | | V | | block device | |--------------| | | | NS /INBOX | |--------------| | mdbox on | | NS /ARCHIVE | | block device | | mdbox on | | | | clustered fs | |--------------| | | | NS /ARCHIVE | +--------------+ | mdbox on | | clustered fs | | | +--------------+

1 0

email notification regression between 2.2 and 2.3
by Thomas Capricelli 14 May '19

14 May '19

Hi, Hello. For the last year, each time i've tried updating dovecot from 2.2.x to 2.3.x, I had to rollback because of the following problem: Users don't "see" new emails arriving in subdirs. To be specific * we mostly use/tested thunderbird client * we use maildrop for delivery * this is using imap, not pop3 * when a new email arrives, thunderbird renders the dir name in blue and appends a "(1)" (or more..). That's what we call 'see' * this happens only on 'subdirs', not the main directory. * the server is a typical linux amd64, using the gentoo distribution More testing shows that * if we switch delivery to dovecot-lda, it works ok. But we can't commit that change, or at least not now/easily. Our users heavily use .mailfilter * if the user is currently viewing the subdir, then email notification is working * better : if the user went on the subdir and then in another dir, it keeps on working. It seems we need to 'open' it at least once for notification to work * "maildir_very_dirty_syncs = no" doesn't help (we had =yes) * "mailbox_list_index = no" doesn't help * i can confirm inotify was detected/used in autoconf when installed (anyway it works well with 2.2) I'm always on freenode (orzel). I'll be in #dovecot the next days at least. greetings, -- Thomas Capricelli

1 0

Userdb userdb_mail=, error Mailbox list driver maildir++: maildir_name not supported by this driver
by Marc Roos 14 May '19

14 May '19

I have this default configuration [0], when use the userdb_mail to point to the mdbox location, the inbox subfolders show differently in a firebird client. So I decided to copy the whole default mail_location into the userdb_mail configuration [2]. But then I get errors [3]. Should I change the namespace configuration here, how? My default namespaces are inbox and 4archives [0] [@ ]# doveconf | grep mail_loc mail_location = mbox:~/mail:INBOX=/var/spool/mail/%u:CONTROL=~/mail/control:INDEX=/var/d ovecot/%u/index:LAYOUT=maildir++ [1] [@dovecot]# cat special-userdb test:x:8267:231:Account with special settings for dovecot:/home/popusers/test:/bin/false:userdb_mail=mdbox:~/mdbox [2] [@dovecot]# cat special-userdb test:x:8267:231:Account with special settings for dovecot:/home/popusers/test:/bin/false:userdb_mail=mdbox:~/mdbox:INBOX=/ var/spool/mail/%u:CONTROL=~/mail/control:INDEX=/var/dovecot/%u/index:LAY OUT=maildir++ [3] May 13 22:41:32 mail04 dovecot: imap-login: Login: user=<test>, method=PLAIN, rip=192.168.10.219, lip=192.168.10.44, mpid=1138, TLS, session=<Gk4K8cqIkdHAqArb> May 13 22:41:32 mail04 dovecot: imap(test): Debug: Loading modules from directory: /usr/lib64/dovecot May 13 22:41:32 mail04 dovecot: imap(test): Debug: Module loaded: /usr/lib64/dovecot/lib15_notify_plugin.so May 13 22:41:32 mail04 dovecot: imap(test): Debug: Module loaded: /usr/lib64/dovecot/lib20_listescape_plugin.so May 13 22:41:32 mail04 dovecot: imap(test): Debug: Added userdb setting: mail=mdbox:~/mdbox:INBOX=/var/spool/mail/test:CONTROL=~/mail/control:IND EX=/var/dovecot/test/index:LAYOUT=maildir++ May 13 22:41:32 mail04 dovecot: imap(test): Debug: Effective uid=8267, gid=231, home=/home/popusers/test May 13 22:41:32 mail04 dovecot: imap(test): Debug: Namespace inbox: type=private, prefix=, sep=/, inbox=yes, hidden=no, list=yes, subscriptions=yes location=mdbox:~/mdbox:INBOX=/var/spool/mail/test:CONTROL=~/mail/control :INDEX=/var/dovecot/test/index:LAYOUT=maildir++ May 13 22:41:32 mail04 dovecot: imap(test): Error: Namespace '': Mailbox list driver maildir++: maildir_name not supported by this driver May 13 22:41:32 mail04 dovecot: imap(test): Namespace '': Mailbox list driver maildir++: maildir_name not supported by this driver in=0 out=378

2 5

doveadm 2.2.36-3.el7.x86_64 mailbox list -u test, does not use symlinked mailboxes
by Marc Roos 14 May '19

14 May '19

Maybe this has been already fixed, but symlinked mailboxes are not shown by [@ dovecot]# doveadm mailbox list -u test | sort Archive Archive/2018 Archive/2019 Archive/2019old Archive/Archive Drafts INBOX INBOX/test1 INBOX/test2 INBOX/test3 Junk Sent test testing-folder-home testing-folder-home/another folder Trash dovecot-2.2.36-3.el7.x86_64 CentOS Linux release 7.6.1810 (Core)

1 0

Sieve scripting
by Lefteris Tsintjelis 14 May '19

14 May '19

I want to monitor a special folder and execute a shell script each time I put an email to it. I would like to automate that way the process of SPAM reporting (SPAMCop). Is that possible with sieve? Lefteris

2 3

Doveadm sync, Error: read(remote) failed: EOF, Error: read(remote) failed: EOF
by Marc Roos 13 May '19

13 May '19

In the manual page this command is used for converting a mailbox doveadm sync -u test mdbox:~/mdbox -x INBOX -x INBOX/* Yet I am getting this error and the mdbox folder is not created. dsync-local(test): (version not received) doveadm(test): Fatal: execvp(mdbox:~/mdbox) failed: No such file or directory [@ dovecot]# doveconf | grep mail_locat mail_location = mbox:~/mail:INBOX=/var/spool/mail/%u:CONTROL=~/mail/control:INDEX=/var/d ovecot/%u/index:LAYOUT=maildir++ Users are not having shell access so something like su test -c '' will also not work. What would be a work-around for this?

2 2

dovecot 2.2.36 and wforce
by Tobi 13 May '19

13 May '19

Hi list I'm trying to setup dovecot 2.2.36 on a Centos6 to communicate with a wforce daemon on the remote side. wforce is latest released from git repo. Daemon part is working and I can successfully send queries from remote systems to wforce via curl For dovecot I configured in /etc/dovecot/conf.d/95-wforce.conf > auth_policy_server_url = http://REMOTE_IP:8084/ > auth_policy_hash_nonce = my_random > auth_policy_server_api_header = Authorization: Basic <BASE64 of wforce:my_password> > auth_policy_request_attributes = login=%{requested_username} pwhash=%{hashed_password} remote=%{rip} device_id=%{client_id} protocol=%s restarted dovecot without errors, but upon testing via imap I cannot see just one single tcp paket leaving direction REMOTE_IP on port 8084. It looks like auth policy in not involved at all. Thanks for any idea tobi

2 2

Re: Re: Dovecot not surviving OpenLDAP restart
by Dag Nygren 12 May '19

12 May '19

One more obvious line from the log: dovecot[26621]: auth: Error: LDAP: Connection lost to LDAP server, reconnecting Where it claims to reconnect, but after that there is no LDAP authentication. And the same configuration has worked fine since at least 10 years ago up to some recent update of dovecot or openldap. Best Dag

2 1

IMAPSieve message marked as HAM should go through full sieve script of user
by Matthias Fechner 10 May '19

10 May '19

Dear all, I use the IMAPSieve implementation described here: https://wiki.dovecot.org/HowTo/AntispamWithSieve It is working really great! Thanks a lot for this. The problem I have now is: A message was by accident marked by rspamd as spam, so a false-positive and is moved to the Junk folder. If I click in my email program now on `Not Spam` it is learn as HAM but moved to the INBOX. I would like that the email is not moved to INBOX but it should be moved through the sieve script of the user again, as it is a new email. Currently I have to mark all false-positives as not spam and have then to manually move it to the correct subfolder which is a bit annoying. Is this possible? Thanks a lot! -- Gruß Matthias

4 3

smtputf8
by Jerry 10 May '19

10 May '19

I am trying to find out if Dovecot supports "smtputf8". Obviously, I am looking in the wrong places, but I just cannot find a definitive answer. Thanks! -- Jerry

4 5

New WebSite
by Jorge Bastos 10 May '19

10 May '19

Hi There, The new website is cute, but I miss one thing, and I believe other also. In the releases, the date of the release, for example when 2.3.6 was out :P Maybe under the release version: Jorge,

1 0

doveadm sync issues (revised)
by Sven Strickroth 10 May '19

10 May '19

Hi, I'm experiencing serious issues using doveadm sync; mails are not replicating and/or mails are duplicating. I wanted to use this for migrating external mailboxes to my server (in order to overcome the time when some servers/clients still use the old server and some already my server, as described on <https://wiki2.dovecot.org/Tools/Doveadm/Sync>). Finally I was able to reproduce this with the 2.3 branch (cf. <https://dovecot.org/pipermail/dovecot/2019-April/115600.html>). I'm sorry that I can only test the version 2.3.4.1, but according to the changelog I think this is still an issue with the latest version. I tried to find a few steps in order to replicate this easily: For testing purposes I simulate both the remote and local server on my Dovecot instance. I created remote(a)DOMAIN.TLD and local(a)DOMAIN.TLD accounts and both use mdbox and are empty. First, send two mails to remote(a)DOMAIL.TLD (Subjects: Test1 and Test2). Start backup remote IMAP account (remote(a)DOMAIN.TLD) to local account (local(a)DOMAIN.TLD) $ doveadm -o imapc_user="remote(a)DOMAIN.TLD" -o imapc_password="PW" -o imapc_host="localhost" backup -R -u local(a)DOMAIN.TLD imapc: Both mailboxes are in sync now (containing Test1 und Test2). Now send two messages to remote(a)DOMAIN.TLD (Subjects Test3 and Test4) and two messages to local(a)DOMAIN.TLD (Subjects Test5 and Test6). Run sync: $ doveadm -o imapc_user="remote(a)DOMAIN.TLD" -o imapc_password="PW" -o imapc_host="localhost" sync -R -u local(a)DOMAIN.TLD imapc: See that syncing fails: remote(a)DOMAIN.TLD contains: Test1,2,3,4,5,6 (as expected) local(a)DOMAIN.TLD contains: Test1,2,5,6,4 (Test3 is missing here) When not using the "-R" parameter it seems to work. Running sync again: $ doveadm -o imapc_user="remote(a)DOMAIN.TLD" -o imapc_password="PW" -o imapc_host="localhost" sync -R -u local(a)DOMAIN.TLD imapc: causes messages to duplicate: remote(a)DOMAIN.TLD contains: Test1,2,6,5,4,3,5,6,4,6,5,4,3,5,6 local(a)DOMAIN.TLD contains: Test1,2,5,4,6,4,5,6 (3 is still missing) This is independent of the "-R" parameter. I could also experience this issue when using one-way sync, however, the first one-way sync is still ok, but then messages start duplicating as for the two-way sync without "-R": $ doveadm -o imapc_user="remote(a)DOMAIN.TLD" -o imapc_password="PW" -o imapc_host="localhost" sync -R -1 -u local(a)DOMAIN.TLD imapc: Hope you can replicate this, too, and finally fix the issue. -- Best regards, Sven Strickroth PGP key id F5A9D4C4 @ any key-server

2 1

Re: Dovecot does not recognize imported messages
by lty 10 May '19

10 May '19

I changed the user permissions, this is a must. Because an email is sent to this user, all emails are identified. > Did you do something like "chown -R vmail:vmail /var/mail" after copy messages? > > ср, 8 мая 2019 г. в 12:57, lty via dovecot <dovecot(a)dovecot.org>: > > Today I tried to import mail directly on the server's home directory on the server. I copied it directly. I didn't use the imap protocol. Dovcot didn't recognize these emails. I didn't display these imported emails on my page, recalculating disk quotas. It will not increase the used capacity. I try to send an email to this user, dovcot recognizes all the emails, and recalculates the disk cooperation, this time is correct. > Why can't I identify the mail I imported? > > [root@imap2 ~]# dovecot -n > # 2.2.36 (1f10bfa63): /etc/dovecot/dovecot.conf > # Pigeonhole version 0.4.24 (124e06aa) > # OS: Linux 2.6.32-431.el6.x86_64 x86_64 CentOS release 6.5 (Final) > # Hostname: imap > auth_master_user_separator = * > auth_mechanisms = PLAIN LOGIN > default_internal_user = vmail > default_vsz_limit = 2 G > deliver_log_format = msgid=%m, subject=%s, from=%f, %$ > dict { > acl = mysql:/etc/dovecot/dovecot-share-folder.conf > quotadict = mysql:/etc/dovecot/dovecot-used-quota.conf > } > disable_plaintext_auth = no > first_valid_uid = 2000 > last_valid_uid = 2000 > listen = * > mail_fsync = never > mail_gid = 2000 > mail_location = maildir:/%Lh/Maildir/:INDEX=/%Lh/Maildir/ > mail_plugins = quota lazy_expunge zlib fts fts_solr > mail_uid = 2000 > maildir_stat_dirs = yes > managesieve_notify_capability = mailto > managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext > mmap_disable = yes > namespace { > list = children > location = maildir:/%%Lh/Maildir/:INDEX=/%%Lh/Maildir/Shared/%%u > prefix = Shared/%%u/ > separator = / > subscriptions = yes > type = shared > } > namespace { > hidden = yes > list = no > location = maildir:/var/vmail/backup/expunged/%d/%n > prefix = .DELETED/ > separator = / > } > namespace inbox { > inbox = yes > location = > mailbox Drafts { > auto = subscribe > special_use = Drafts > } > mailbox Junk { > auto = subscribe > special_use = Junk > } > mailbox Sent { > auto = subscribe > special_use = Sent > } > mailbox Trash { > auto = subscribe > special_use = Trash > } > prefix = > separator = / > } > passdb { > args = /etc/dovecot/dovecot-mysql.conf > driver = sql > } > passdb { > args = /etc/dovecot/dovecot-fallback-password-mysql.conf > driver = sql > } > passdb { > args = /etc/dovecot/dovecot-fallback-mysql.conf > driver = sql > } > passdb { > args = /etc/dovecot/dovecot-master-users-password > driver = passwd-file > master = yes > } > plugin { > acl = vfile:/etc/dovecot/dovecot-acl > acl_globals_only = yes > auth_socket_path = /var/run/dovecot/auth-master > fts_autoindex_exclude = Junk > fts_autoindex_exclude2 = Trash > fts_autoindex_exclude3 = Sent > fts_autoindex_exclude4 = Drafts > fts_autoindex_max_recent_msgs = 20 > lazy_expunge = .DELETED/ > mail_replica = tcp:10.0.11.152:1111 [1] > quota = dict:user::proxy::quotadict > quota_grace = 0%% > quota_max_mail_size = 70M > quota_rule = *:storage=1G > quota_rule2 = *:messages=0 > quota_warning = storage=85%% quota-warning 85 %u > quota_warning2 = storage=90%% quota-warning 90 %u > quota_warning3 = storage=95%% quota-warning 95 %u > sieve = /%Lh/sieve/dovecot.sieve > sieve_default = /var/vmail/sieve/dovecot.sieve > sieve_default_name = managesieve > sieve_dir = /%Lh/sieve > } > protocols = pop3 imap sieve > service anvil { > client_limit = 20500 > } > service auth { > client_limit = 20500 > unix_listener /var/spool/postfix/private/auth { > group = postfix > mode = 0666 > user = postfix > } > unix_listener auth-master { > group = vmail > mode = 0666 > user = vmail > } > unix_listener auth-userdb { > group = vmail > mode = 0660 > user = vmail > } > } > service dict { > unix_listener dict { > group = vmail > mode = 0660 > user = vmail > } > } > service imap-login { > process_min_avail = 24 > service_count = 0 > vsz_limit = 2 G > } > service imap { > process_limit = 1024000 > process_min_avail = 24 > vsz_limit = 2 G > } > service pop3-login { > service_count = 0 > } > service quota-warning { > executable = script /usr/local/bin/dovecot-quota-warning.sh > unix_listener quota-warning { > group = vmail > mode = 0660 > user = vmail > } > } > ssl_ca = </etc/pki/tls/certs/c.cn.ca-bundle > ssl_cert = </etc/pki/tls/certs/c.cn.crt > ssl_key = # hidden, use -P to show it > syslog_facility = local6 > userdb { > args = /etc/dovecot/dovecot-mysql.conf > driver = sql > } > userdb { > args = /etc/dovecot/dovecot-fallback-user-mysql.conf > driver = sql > } > protocol lda { > auth_socket_path = /var/run/dovecot/auth-master > lda_mailbox_autocreate = yes > mail_fsync = optimized > mail_plugins = quota lazy_expunge zlib fts fts_solr sieve > syslog_facility = local6 > } > protocol imap { > imap_client_workarounds = tb-extra-mailbox-sep > imap_id_send = NAME dovecot VERSION 2.1.17 > mail_max_userip_connections = 20 > mail_plugins = quota lazy_expunge zlib fts fts_solr imap_quota mail_log imap_zlib notify > } > protocol pop3 { > mail_max_userip_connections = 20 > mail_plugins = quota lazy_expunge zlib fts fts_solr mail_log notify > pop3_client_workarounds = outlook-no-nuls oe-ns-eoh > pop3_uidl_format = %08Xu%08Xv > } -- С уважением, Рустам Багов. Links: ------ [1] http://10.0.11.152:1111

1 0

Dovecot not surviving OpenLDAP restart
by Dag Nygren 09 May '19

09 May '19

Hi! Running Dovecot 2.2.36 and authenticating against an OpenLDAP 2.4.45 server. Now since some update of dovecot it will not be able to authenticate your logins after a restart of the LDAP service is restarted without a reboot of the dovecot server. Anything new here that I should be aware of? Best Regards Dag

2 2

Re: Re: dict lookup too long time
by hfh＠cndns.com 09 May '19

09 May '19

logging some error,dict process is not dead. hfh(a)cndns.com From: Aki Tuomi via dovecot Date: 2019-05-09 14:21 To: hfh(a)cndns.com; dovecot Subject: Re: dict lookup too long time On 9.5.2019 8.00, hfh--- via dovecot wrote: hi, The following error message sometimes appears on my server log,it causes the mailbox to exceed the disk capacity limit. May 9 09:54:11 imap dovecot: imap(hfh(a)cndns.com): Error: dict-client: Lookup 'priv/quota/storage' failed: Connection closed: read(size=8192) failed: Connection reset by peer (reply took 2.728 secs (2.729 in dict wait, 0.000 in other ioloops, 0.000 in locks)) Is the dict process by chance dying or logging some error(s)? Aki

1 0

dovecot dict protocol
by Peter Hudec 09 May '19

09 May '19

Hi there is there any written specification for dovecot dict protocol instead of the code? Small example is in docs on https://wiki.dovecot.org/AuthDatabase/Dict and theere is link for all commands/reply in the code https://wiki.dovecot.org/AuthDatabase/Dict I’m writing small dict server and need some explanation for CMD: I, what does the flags means and how should the result looks like CMD: D, I thing this is the same as C, but coud be done later /async/ The reply codes are not very clear. I understand O, N, F. The rest is strange to me. Maybe this is good question do devel mailing list. regards Peter

1 0

UID to file?
by Carles Pina i Estany 09 May '19

09 May '19

Hello, In the past I was in a situation that given an email UID I wanted to know which file in the Maildir directory this UID was saved. I did a small parser for $HOME/Maildir/dovecot-uidlist where, if the file had: 1000 W1838 S1796 :1557351041.10447_1.example I would ask for the UID 1000 and would return :1557351041.10447_1.example (and I knew that it was in $HOME/Maildir/new) Is there any other way using dovecot tools to do the same, to avoid parsing an internal dovecot file? Thank you! -- Carles Pina i Estany GPG Key 0x8CD5C157

2 2

Push Notification clarification (MessageNew w/o LMTP or LDA)
by Christian Balzer 09 May '19

09 May '19

Hello, Both the examples on the Push Notification wiki page and the XAPS plugin docs seem to suggest or state that LMTP/LDA is required. However IMAP IDLE notifications work without either of these (please no religious discussion of why Dovecot LMTP is the best thing since sliced bread and that everybody should use it). The LUA part of the push notification docs however states that events other than MessageNew are supported. So my question is, when not using LMTP/LDA and a LUA script and of course the correct mail_plugins definition (either global or for IMAP), will a message delivery trigger MessageNew? Regards, Christian -- Christian Balzer Network/Systems Engineer chibi(a)gol.com Rakuten Communications

2 3

dict lookup too long time
by hfh＠cndns.com 09 May '19

09 May '19

hi, The following error message sometimes appears on my server log,it causes the mailbox to exceed the disk capacity limit. May 9 09:54:11 imap dovecot: imap(hfh(a)cndns.com): Error: dict-client: Lookup 'priv/quota/storage' failed: Connection closed: read(size=8192) failed: Connection reset by peer (reply took 2.728 secs (2.729 in dict wait, 0.000 in other ioloops, 0.000 in locks)) dovecot -n # 2.2.36 (1f10bfa63): /etc/dovecot/dovecot.conf # Pigeonhole version 0.4.24 (124e06aa) # OS: Linux 2.6.32-504.el6.x86_64 x86_64 CentOS release 6.6 (Final) # Hostname: imap3bak.sh.chengmail.me auth_master_user_separator = * auth_mechanisms = PLAIN LOGIN deliver_log_format = msgid=%m, subject=%s, from=%f, %$ dict { acl = mysql:/etc/dovecot/dovecot-share-folder.conf quotadict = mysql:/etc/dovecot/dovecot-used-quota.conf } disable_plaintext_auth = no first_valid_uid = 2000 last_valid_uid = 2000 listen = * mail_fsync = never mail_gid = 2000 mail_location = maildir:/%Lh/Maildir/:INDEX=/%Lh/Maildir/ mail_plugins = quota lazy_expunge zlib mail_uid = 2000 managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext mmap_disable = yes namespace { list = children location = maildir:/%%Lh/Maildir/:INDEX=/%%Lh/Maildir/Shared/%%u prefix = Shared/%%u/ separator = / subscriptions = yes type = shared } namespace { hidden = yes list = no location = maildir:/var/vmail/backup/expunged/%d/%n prefix = .DELETED/ separator = / } namespace inbox { inbox = yes location = mailbox Drafts { auto = subscribe special_use = \Drafts } mailbox Junk { auto = subscribe special_use = \Junk } mailbox Sent { auto = subscribe special_use = \Sent } mailbox Trash { auto = subscribe special_use = \Trash } prefix = separator = / } passdb { args = /etc/dovecot/dovecot-mysql.conf driver = sql } passdb { args = /etc/dovecot/dovecot-fallback-password-mysql.conf driver = sql } passdb { args = /etc/dovecot/dovecot-fallback-mysql.conf driver = sql } passdb { args = /etc/dovecot/dovecot-master-users-password driver = passwd-file master = yes } plugin { acl = vfile:/etc/dovecot/dovecot-acl acl_globals_only = yes auth_socket_path = /var/run/dovecot/auth-master lazy_expunge = .DELETED/ quota = dict:user::proxy::quotadict quota_grace = 0%% quota_max_mail_size = 70M quota_rule = *:storage=1G quota_rule2 = *:messages=0 quota_warning = storage=85%% quota-warning 85 %u quota_warning2 = storage=90%% quota-warning 90 %u quota_warning3 = storage=95%% quota-warning 95 %u sieve = /%Lh/sieve/dovecot.sieve sieve_default = /var/vmail/sieve/dovecot.sieve sieve_default_name = managesieve sieve_dir = /%Lh/sieve } protocols = pop3 imap sieve service anvil { client_limit = 20500 } service auth { client_limit = 20500 unix_listener /var/spool/postfix/dovecot-auth { group = postfix mode = 0666 user = postfix } unix_listener auth-master { group = vmail mode = 0666 user = vmail } unix_listener auth-userdb { group = vmail mode = 0660 user = vmail } } service dict { unix_listener dict { group = vmail mode = 0660 user = vmail } } service imap-login { process_min_avail = 24 service_count = 0 vsz_limit = 2 G } service imap { process_limit = 1024000 process_min_avail = 24 vsz_limit = 2 G } service pop3-login { service_count = 0 } service quota-warning { executable = script /usr/local/bin/dovecot-quota-warning.sh unix_listener quota-warning { group = vmail mode = 0660 user = vmail } } ssl_ca = </etc/pki/tls/certs/cndns.com.ca-bundle ssl_cert = </etc/pki/tls/certs/cndns.com.crt ssl_key = # hidden, use -P to show it syslog_facility = local6 userdb { args = /etc/dovecot/dovecot-mysql.conf driver = sql } userdb { args = /etc/dovecot/dovecot-fallback-user-mysql.conf driver = sql } protocol lda { auth_socket_path = /var/run/dovecot/auth-master lda_mailbox_autocreate = yes mail_fsync = optimized mail_plugins = quota lazy_expunge zlib sieve postmaster_address = root syslog_facility = local6 } protocol imap { imap_client_workarounds = tb-extra-mailbox-sep imap_id_send = NAME dovecot VERSION 2.1.17 mail_max_userip_connections = 20 mail_plugins = quota lazy_expunge zlib imap_quota mail_log imap_zlib notify } protocol pop3 { mail_max_userip_connections = 20 mail_plugins = quota lazy_expunge zlib mail_log notify pop3_client_workarounds = outlook-no-nuls oe-ns-eoh pop3_uidl_format = %08Xu%08Xv } hfh(a)cndns.com

2 1

How to auto-subscribe to virtual namespace/prefix?
by MRob 09 May '19

09 May '19

In virtual namespace I can have: namespace myvirt { location = blah prefix=Virtual/ separator=/ mailbox "My folder" { auto = subscribe } } And i see email clients successful display subscribed "My folder" but the top-level prefix "Virtual/" is not subscribed. I see the Virtual/ prefix available as a noselect folder in the list of unsubscribed folders and if I manual subscribe to it, folder tree display is perfect. So how can i also make auto-subscription to the "Virtual/" prefix noselect folder?

1 2

dsync to backup to directory?
by Felipe Gasper 08 May '19

08 May '19

Hello, We have a hosting operation and are interested in offloading mail for some of our machines to a separate machine. We want the ability, though, to migrate accounts between the “offloaded” and “unified” configurations. Toward that end, is it possible to “merge” two different mail directories (either maildir or mdbox) via doveadm? “doveadm backup” looks like the closest match, but it doesn’t appear to accept an arbitrary directory as its synchronization source. Thank you! -Felipe Gasper Mississauga, Ontario

1 0

Re: Dovecot does not recognize imported messages
by lty 08 May '19

08 May '19

I put it in the cur/ directory.

1 0

Dovecot does not recognize imported messages
by lty 08 May '19

08 May '19

Today I tried to import mail directly on the server's home directory on the server. I copied it directly. I didn't use the imap protocol. Dovcot didn't recognize these emails. I didn't display these imported emails on my page, recalculating disk quotas. It will not increase the used capacity. I try to send an email to this user, dovcot recognizes all the emails, and recalculates the disk cooperation, this time is correct. Why can't I identify the mail I imported? > [root@imap2 ~]# dovecot -n > # 2.2.36 (1f10bfa63): /etc/dovecot/dovecot.conf > # Pigeonhole version 0.4.24 (124e06aa) > # OS: Linux 2.6.32-431.el6.x86_64 x86_64 CentOS release 6.5 (Final) > # Hostname: imap > auth_master_user_separator = * > auth_mechanisms = PLAIN LOGIN > default_internal_user = vmail > default_vsz_limit = 2 G > deliver_log_format = msgid=%m, subject=%s, from=%f, %$ > dict { > acl = mysql:/etc/dovecot/dovecot-share-folder.conf > quotadict = mysql:/etc/dovecot/dovecot-used-quota.conf > } > disable_plaintext_auth = no > first_valid_uid = 2000 > last_valid_uid = 2000 > listen = * > mail_fsync = never > mail_gid = 2000 > mail_location = maildir:/%Lh/Maildir/:INDEX=/%Lh/Maildir/ > mail_plugins = quota lazy_expunge zlib fts fts_solr > mail_uid = 2000 > maildir_stat_dirs = yes > managesieve_notify_capability = mailto > managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext > mmap_disable = yes > namespace { > list = children > location = maildir:/%%Lh/Maildir/:INDEX=/%%Lh/Maildir/Shared/%%u > prefix = Shared/%%u/ > separator = / > subscriptions = yes > type = shared > } > namespace { > hidden = yes > list = no > location = maildir:/var/vmail/backup/expunged/%d/%n > prefix = .DELETED/ > separator = / > } > namespace inbox { > inbox = yes > location = > mailbox Drafts { > auto = subscribe > special_use = Drafts > } > mailbox Junk { > auto = subscribe > special_use = Junk > } > mailbox Sent { > auto = subscribe > special_use = Sent > } > mailbox Trash { > auto = subscribe > special_use = Trash > } > prefix = > separator = / > } > passdb { > args = /etc/dovecot/dovecot-mysql.conf > driver = sql > } > passdb { > args = /etc/dovecot/dovecot-fallback-password-mysql.conf > driver = sql > } > passdb { > args = /etc/dovecot/dovecot-fallback-mysql.conf > driver = sql > } > passdb { > args = /etc/dovecot/dovecot-master-users-password > driver = passwd-file > master = yes > } > plugin { > acl = vfile:/etc/dovecot/dovecot-acl > acl_globals_only = yes > auth_socket_path = /var/run/dovecot/auth-master > fts_autoindex_exclude = Junk > fts_autoindex_exclude2 = Trash > fts_autoindex_exclude3 = Sent > fts_autoindex_exclude4 = Drafts > fts_autoindex_max_recent_msgs = 20 > lazy_expunge = .DELETED/ > mail_replica = tcp:10.0.11.152:1111 > quota = dict:user::proxy::quotadict > quota_grace = 0%% > quota_max_mail_size = 70M > quota_rule = *:storage=1G > quota_rule2 = *:messages=0 > quota_warning = storage=85%% quota-warning 85 %u > quota_warning2 = storage=90%% quota-warning 90 %u > quota_warning3 = storage=95%% quota-warning 95 %u > sieve = /%Lh/sieve/dovecot.sieve > sieve_default = /var/vmail/sieve/dovecot.sieve > sieve_default_name = managesieve > sieve_dir = /%Lh/sieve > } > protocols = pop3 imap sieve > service anvil { > client_limit = 20500 > } > service auth { > client_limit = 20500 > unix_listener /var/spool/postfix/private/auth { > group = postfix > mode = 0666 > user = postfix > } > unix_listener auth-master { > group = vmail > mode = 0666 > user = vmail > } > unix_listener auth-userdb { > group = vmail > mode = 0660 > user = vmail > } > } > service dict { > unix_listener dict { > group = vmail > mode = 0660 > user = vmail > } > } > service imap-login { > process_min_avail = 24 > service_count = 0 > vsz_limit = 2 G > } > service imap { > process_limit = 1024000 > process_min_avail = 24 > vsz_limit = 2 G > } > service pop3-login { > service_count = 0 > } > service quota-warning { > executable = script /usr/local/bin/dovecot-quota-warning.sh > unix_listener quota-warning { > group = vmail > mode = 0660 > user = vmail > } > } > ssl_ca = </etc/pki/tls/certs/c.cn.ca-bundle > ssl_cert = </etc/pki/tls/certs/c.cn.crt > ssl_key = # hidden, use -P to show it > syslog_facility = local6 > userdb { > args = /etc/dovecot/dovecot-mysql.conf > driver = sql > } > userdb { > args = /etc/dovecot/dovecot-fallback-user-mysql.conf > driver = sql > } > protocol lda { > auth_socket_path = /var/run/dovecot/auth-master > lda_mailbox_autocreate = yes > mail_fsync = optimized > mail_plugins = quota lazy_expunge zlib fts fts_solr sieve > syslog_facility = local6 > } > protocol imap { > imap_client_workarounds = tb-extra-mailbox-sep > imap_id_send = NAME dovecot VERSION 2.1.17 > mail_max_userip_connections = 20 > mail_plugins = quota lazy_expunge zlib fts fts_solr imap_quota mail_log imap_zlib notify > } > protocol pop3 { > mail_max_userip_connections = 20 > mail_plugins = quota lazy_expunge zlib fts fts_solr mail_log notify > pop3_client_workarounds = outlook-no-nuls oe-ns-eoh > pop3_uidl_format = %08Xu%08Xv > }

2 1

Question about GIT repository
by Juan C. Blanco 07 May '19

07 May '19

Hello, just a question, I can't see a core "release-2.3.6" branch, nor a pigeonhole "release-0.5.6" branch on the GIT repository, it is outdated? or do you have changed your policy to create a new branch for each new release of dovecot and pigeonhole? Thanks and regards -- +-------------------------------------------------------------------+ | Juan C. Blanco | | | | Centro de Calculo | | | E.T.S. Ingenieros Informáticos | E-mail: jcblanco(a)fi.upm.es | | Universidad Politécnica de Madrid | | | Campus de Montegancedo | | | Boadilla del Monte | Tel.: (+34) 91 067 2771 | | 28660 MADRID (Spain) | Fax : (+34) 91 336 7412 | +-------------------------------------------------------------------+

4 6

Symlinked mailboxes and dovecot-uidlist.lock
by Dave 07 May '19

07 May '19

I have a scenario where I have two users, one account (user1) with it's own Maildir account, and another account (user2) (which I wish to see the same messages) with a symlinked Maildir to user1's Maildir. I.E.: /home/user1/Maildir /home/user2/Maildir (where this Maildir is symlinked to /home/user1/Maildir) Both users are in a group together (usergroup), and so all of the permissions on the Maildir, new, cur, etc folders are rwxrwx--- or rw-rw----. All mail gets created and delivered correctly, both users can move and create files, and everything generally seems to be working fine. However, I did notice one error showing up in the system logs: May 2 11:35:13 userserver dovecot: imap(user1): Error: inotify_add_watch(/home/user1/Maildir/dovecot-uidlist.lock) failed: Permission denied May 2 11:36:27 userserver dovecot: imap(user2): Error: inotify_add_watch(/home/user2/Maildir/dovecot-uidlist.lock) failed: Permission denied May 3 10:10:11 userserver dovecot: imap(user2): Error: inotify_add_watch(/home/user2/Maildir/.Folder1/dovecot-uidlist.lock) failed: Permission denied I've managed to catch a glimpse of a lock file, as it comes and goes very quickly, and it is permissioned as so: -rw-rw---- 1 user1 usergroup 10 May 5 11:39 dovecot-uidlist.lock So I'm not sure what exactly the permissions issue is then? The file seems to have the appropriate group permissions for each user to read from and write to it. Again, this is the only error I'm getting, and everything has been working fine. I did read the Dovecot wiki talking about symlinking mailboxes, and it refers to symlinking each box/folder individually and not the entire Maildir folder as I've done, but since each individual box/folder has its own dovecot-uidlist I imagine I might run into this same issue anyway? Anyway, I'd like to squelch the error if I can, so are there any thoughts as to why the lock files are having trouble with inotify_add_watch? -Dave

1 0

doveadm - mailbox to filesystem directory?
by Joaquin F 07 May '19

07 May '19

Is it possible to get the filesystem location (directory name) for a given mailbox? The closest I found was parsing the output of "doveadm -D mailbox create", but this only works if the mailbox doesn't exist yet and prone to failure if the debug output changes in future versions. Using "doveadm mailbox mutf7" helps, but there's some ASCII characters which are encoded. So far I've found "\" turns in to "\5c", "." into "\2e" and "/" to "\2f" and the separator to ".". But maybe there are others. Thanks in advance. Version: dovecot 2.2.36 (1f10bfa63) Relevant config: mail_location = maildir:~/Maildir protocols = imap namespace inbox { separator = "$" }

1 0

2.3.6 lib-smtp test failure in CentOS 6
by Peter 07 May '19

07 May '19

After applying the patches in my previous message... I'm getting the following when building dovecot for CentOS 6 (but not for CentOS 7): lmtp payload - normal: parallel pipelining ssl ....................... : ok CLIENT: Panic: file smtp-client-connection.c: line 1309 (smtp_client_connection_established): assertion failed: (!conn->connect_succeeded) CLIENT: Error: Raw backtrace: /builddir/build/BUILD/dovecot-2.3.6/src/lib-smtp/.libs/lt-test-smtp-payload() [0x4547ea] -> /builddir/build/BUILD/dovecot-2.3.6/src/lib-smtp/.libs/lt-test-smtp-payload() [0x454891] -> /builddir/build/BUILD/dovecot-2.3.6/src/lib-smtp/.libs/lt-test-smtp-payload(_start+0) [0x4193f8] -> /builddir/build/BUILD/dovecot-2.3.6/src/lib-smtp/.libs/lt-test-smtp-payload() [0x41fb95] -> /builddir/build/BUILD/dovecot-2.3.6/src/lib-smtp/.libs/lt-test-smtp-payload() [0x4203f0] -> /builddir/build/BUILD/dovecot-2.3.6/src/lib-smtp/.libs/lt-test-smtp-payload() [0x421d77] -> /builddir/build/BUILD/dovecot-2.3.6/src/lib-smtp/.libs/lt-test-smtp-payload(smtp_client_command_input_reply+0x17d) [0x42ffdd] -> /builddir/build/BUILD/dovecot-2.3.6/src/lib-smtp/.libs/lt-test-smtp-payload() [0x42145b] -> /builddir/build/BUILD/dovecot-2.3.6/src/lib-smtp/.libs/lt-test-smtp-payload(io_loop_call_io+0x61) [0x461d81] -> /builddir/build/BUILD/dovecot-2.3.6/src/lib-smtp/.libs/lt-test-smtp-payload(io_loop_handler_run_internal+0xd6) [0x463c16] -> /builddir/build/BUILD/dovecot-2.3.6/src/lib-smtp/.libs/lt-test-smtp-payload(io_loop_handler_run+0x59) [0x461e79] -> /builddir/build/BUILD/dovecot-2.3.6/src/lib-smtp/.libs/lt-test-smtp-payload(io_loop_run+0x38) [0x4620a8] -> /builddir/build/BUILD/dovecot-2.3.6/src/lib-smtp/.libs/lt-test-smtp-payload() [0x41a619] -> /builddir/build/BUILD/dovecot-2.3.6/src/lib-smtp/.libs/lt-test-smtp-payload() [0x41aaa8] -> /builddir/build/BUILD/dovecot-2.3.6/src/lib-smtp/.libs/lt-test-smtp-payload() [0x41ab7d] -> /builddir/build/BUILD/dovecot-2.3.6/src/lib-smtp/.libs/lt-test-smtp-payload() [0x44beae] -> /builddir/build/BUILD/dovecot-2.3.6/src/lib-smtp/.libs/lt-test-smtp-payload(test_run+0x11) [0x44c011] -> /builddir/build/BUILD/dovecot-2.3.6/src/lib-smtp/.libs/lt-test-smtp-payload(main+0x115) [0x419d65] -> /lib64/libc.so.6(__libc_start_main+0x100) [0x7f3850d4ad20] -> /builddir/build/BUILD/dovecot-2.3.6/src/lib-smtp/.libs/lt-test-smtp-payload() [0x419421] /bin/sh: line 1: 28384 Aborted ./$bin make[3]: Leaving directory `/builddir/build/BUILD/dovecot-2.3.6/src/lib-smtp' make[3]: *** [check-local] Error 1 make[2]: *** [check-am] Error 2 make[2]: Leaving directory `/builddir/build/BUILD/dovecot-2.3.6/src/lib-smtp' make[1]: *** [check-recursive] Error 1 make[1]: Leaving directory `/builddir/build/BUILD/dovecot-2.3.6/src' make: *** [check-recursive] Error 1 error: Bad exit status from /var/tmp/rpm-tmp.9PlfRJ (%check) Peter

2 4

regression with lmtp_hdr_delivery_address in 2.3
by dovecot-ffe7＠ryanc.org 07 May '19

07 May '19

Hi, In my LMTP config, I have lmtp_hdr_delivery_address = none. Under 2.2, Received headers looked like this: Received: from smtp.example.com by lmtp.example.com with LMTP id +IVdKS81cFwWagAAGhmRSA ; Fri, 22 Feb 2019 17:45:19 +0000 After the update to 2.3, they look like this: Received: from smtp.example.com by lmtp.example.com with LMTP id MJbKAMFEclyKCQAAGhmRSA (envelope-from <yyy(a)example.net>) for <xxx(a)example.com>; Sun, 24 Feb 2019 07:16:17 +0000 In both cases I *do not* have a "Delivered-To" header I do see a check for rcpt_to == NULL in the smtp_server_transaction_write_trace_record function, but it looks like the lmtp_local_add_headers function does not update the transaction, so it doesn't get pulled in. Also, the LMTP settings struct isn't exposed in that function currently, and I'm not sure how to add it. In 2.2, both the "Delivered-To" and "Received" headers were handled by client_get_added_headers. Please CC me in replies, as I am not subscribed to the list. Thanks, Ryan

2 1

http-lib test failures when building dovecot-2.3.5 and later in mock builder
by Tuomo Soini 07 May '19

07 May '19

There is random failure in test-http-payload when building rpm package from 2.3.6. I couldn't reproduce that in normal system but that happens something like every second try in mock chroot build envirnoment. Other tests don't have issues so it looks like test is not very reliable. Building 2.3.4 didn't yet have this issue. ./test-http-payload -D output attached. -- Tuomo Soini <tis(a)foobar.fi> Foobar Linux services +358 40 5240030 Foobar Oy <https://foobar.fi/>

2 1

dynamic virtual mailboxes?
by MRob 06 May '19

06 May '19

hi, I spent time learning about virtual mailboxes. Is there some way to create dynamic virtual mailboxes? I mean, when I look at a mailbox, I want to see only unread messages or flagged messages in that mailbox.

2 5

Understanding virtual mailboxes (examples in 15-mailboxes.conf)
by MRob 05 May '19

05 May '19

The examples in 15-mailboxes.conf # If you have a virtual "All messages" mailbox: #mailbox virtual/All { # special_use = \All # comment = All my messages #} # If you have a virtual "Flagged" mailbox: #mailbox virtual/Flagged { # special_use = \Flagged # comment = All my flagged messages #} They seem to reference some kind of virtual mailbox setup that doesn't compare to the docs for the "virtual" plugin. That plugin says we should create a separate namespace instead, like "namespace virtual" and put files representing the virtual folders into user maildirs. What if we use mdbox? add the files to user/mailboxes director I will guess. Is there a way to use the mailbox examples in the inbox namespace in the default config? Does it use some other method different from the virtual plugin? maybe more config hints for those examples would be helpful. Thank you.

2 3

Feature request - blacklistd interaction
by Lefteris Tsintjelis 04 May '19

04 May '19

Would be really really REALLY nice to have dovecot interact directly with blacklistd! Makes a huge difference on busy systems and beats log parsing by far. Thank you

2 2

Feature request: additional commands for doveadm HTTP API
by Peter Kubica 04 May '19

04 May '19

Hi, I hope this is correct way of making a feature request. I like doveadm HTTP API very much and use it for Zabbix monitoring. Would be possible to add "replicator status" and "auth test" doveadm commands to HTTP API? Thanks. Kind regards, Peter

1 0

2.3.6 lib-http assert failure
by Peter 02 May '19

02 May '19

connection lost after 100-continue ................................... : ok test-http-client-errors.c:1319: Assert failed: resp->status == 200 /bin/sh: line 1: 25431 Segmentation fault ./$bin make[3]: Leaving directory `/builddir/build/BUILD/dovecot-2.3.6/src/lib-http' make[3]: *** [check-local] Error 1 make[2]: Leaving directory `/builddir/build/BUILD/dovecot-2.3.6/src/lib-http' make[2]: *** [check-am] Error 2 make[1]: *** [check-recursive] Error 1make[1]: Leaving directory `/builddir/build/BUILD/dovecot-2.3.6/src' I tried applying the following patches: https://github.com/dovecot/core/commit/82e3ba00ef449dcead8af1885c2d323fd8cf… https://github.com/dovecot/core/commit/7debc474f2b4f5e24a9ba27a6b8adb4d5f78… ...which seem to fix the issue at least for CentOS 7 (CentOS 6 then errors out in the lib-smtp tests, see next post for details). It looks like there are some bug fix patches that didn't make it to the 2.3 branch. Peter

1 0

Re: v2.3.6 Configure fail 'libssl not found' macOS
by James Brown 01 May '19

01 May '19

> On 1 May 2019, at 4:38 pm, James Brown via dovecot <dovecot(a)dovecot.org <mailto:dovecot@dovecot.org>> wrote: > > No problems with 2.3.5, but when I try to compile 2.3.6 with: > > ./configure --with-mysql --with-ssl=openssl > > I get: > > checking for dlopen... yes > checking for SSL_read in -lssl... no > configure: error: Can't build with OpenSSL: libssl not found > > $ locate libssl > /Applications/BBEdit.app/Contents/XPCServices/GitIgnoreXPCService.xpc/Contents/Frameworks/libssl.dylib > /Applications/Navicat for MySQL.app/Contents/Frameworks/libssl.1.0.0.dylib > /Applications/assp/assp.mod/bin/libssl32.dll > /usr/lib/libssl.0.9.7.dylib > /usr/lib/libssl.0.9.8.dylib > /usr/lib/libssl.35.dylib > /usr/lib/libssl.43.dylib > /usr/lib/libssl.44.dylib > /usr/lib/libssl.dylib > /usr/local/Cellar/openssl/1.0.2r/lib/libssl.1.0.0.dylib > /usr/local/Cellar/openssl/1.0.2r/lib/libssl.a > /usr/local/Cellar/openssl/1.0.2r/lib/libssl.dylib > /usr/local/Cellar/openssl/1.0.2r/lib/pkgconfig/libssl.pc > /usr/local/Cellar/openssl(a)1.1/1.1.1b/lib/libssl.1.1.dylib > /usr/local/Cellar/openssl(a)1.1/1.1.1b/lib/libssl.a > /usr/local/Cellar/openssl(a)1.1/1.1.1b/lib/libssl.dylib > /usr/local/Cellar/openssl(a)1.1/1.1.1b/lib/pkgconfig/libssl.pc > /usr/local/lib/dovecot/libssl_iostream_openssl.a > /usr/local/lib/dovecot/libssl_iostream_openssl.la <http://libssl_iostream_openssl.la/> > /usr/local/lib/dovecot/libssl_iostream_openssl.so > > Any suggestions? > > Thanks, > > James. Sorry for the noise. export CPPFLAGS="-I/usr/local/opt/mysql(a)5.7/include/mysql -I/usr/local/Cellar/openssl(a)1.1/1.1.1b/include" export LDFLAGS="-L/usr/local/opt/mysql(a)5.7/lib -L/usr/local/opt/openssl(a)1.1/lib" ./configure --with-mysql --with-ssl=openssl Worked. James.

1 0

Feature request: exclude IP/network in allow_nets extra field
by Zhang Huangbin 01 May '19

01 May '19

Dear all, We use `allow_nets`[1] to restrict login clients, it works fine. Recently we need to allow some users to login from everywhere except some IP/networks, how can we accomplish this with "allow_nets"? Tried allow_nets="!a.b.c.d", but Dovecot reports error "allow_nets: Invalid network '!a.b.c.d'". Can we have this feature? i guess it should be done in function "auth_request_validate_networks"[2] in file src/auth/auth-request.c. [1] allow_nets: https://wiki.dovecot.org/PasswordDatabase/ExtraFields/AllowNets [2] https://github.com/dovecot/core/blob/fbc3ccc4a9a02b82073585a33254eacedc6a99…

6 11

v2.3.6 Configure fail 'libssl not found' macOS
by James Brown 01 May '19

01 May '19

No problems with 2.3.5, but when I try to compile 2.3.6 with: ./configure --with-mysql --with-ssl=openssl I get: checking for dlopen... yes checking for SSL_read in -lssl... no configure: error: Can't build with OpenSSL: libssl not found $ locate libssl /Applications/BBEdit.app/Contents/XPCServices/GitIgnoreXPCService.xpc/Contents/Frameworks/libssl.dylib /Applications/Navicat for MySQL.app/Contents/Frameworks/libssl.1.0.0.dylib /Applications/assp/assp.mod/bin/libssl32.dll /usr/lib/libssl.0.9.7.dylib /usr/lib/libssl.0.9.8.dylib /usr/lib/libssl.35.dylib /usr/lib/libssl.43.dylib /usr/lib/libssl.44.dylib /usr/lib/libssl.dylib /usr/local/Cellar/openssl/1.0.2r/lib/libssl.1.0.0.dylib /usr/local/Cellar/openssl/1.0.2r/lib/libssl.a /usr/local/Cellar/openssl/1.0.2r/lib/libssl.dylib /usr/local/Cellar/openssl/1.0.2r/lib/pkgconfig/libssl.pc /usr/local/Cellar/openssl(a)1.1/1.1.1b/lib/libssl.1.1.dylib /usr/local/Cellar/openssl(a)1.1/1.1.1b/lib/libssl.a /usr/local/Cellar/openssl(a)1.1/1.1.1b/lib/libssl.dylib /usr/local/Cellar/openssl(a)1.1/1.1.1b/lib/pkgconfig/libssl.pc /usr/local/lib/dovecot/libssl_iostream_openssl.a /usr/local/lib/dovecot/libssl_iostream_openssl.la <http://libssl_iostream_openssl.la/> /usr/local/lib/dovecot/libssl_iostream_openssl.so Any suggestions? Thanks, James.

1 0

Dovecot release v2.3.6
by Aki Tuomi 30 Apr '19

30 Apr '19

Hi! We are pleased to release Dovecot v2.3.6. Tarball is available at https://dovecot.org/releases/2.3/dovecot-2.3.6.tar.gz https://dovecot.org/releases/2.3/dovecot-2.3.6.tar.gz.sig Binary packages are available at https://repo.dovecot.org/ Changes ------- * CVE-2019-11494: Submission-login crashed with signal 11 due to null pointer access when authentication was aborted by disconnecting. * CVE-2019-11499: Submission-login crashed when authentication was started over TLS secured channel and invalid authentication message was sent. * auth: Support password grant with passdb oauth2. + Use system default CAs for outbound TLS connections. + Simplify array handling with new helper macros. + fts_solr: Enable configuring batch_size and soft_commit features. - lmtp/submission: Fixed various bugs in XCLIENT handling, including a hang when XCLIENT commands were sent infinitely to the remote server. - lmtp/submission: Forwarded multi-line replies were erroneously sent as two replies to the client. - lib-smtp: client: Message was not guaranteed to contain CRLF consistently when CHUNKING was used. - fts_solr: Plugin was no longer compatible with Solr 7. - Make it possible to disable certificate checking without setting ssl_client_ca_* settings. - pop3c: SSL support was broken. - mysql: Closing connection twice lead to crash on some systems. - auth: Multiple oauth2 passdbs crashed auth process on deinit. - HTTP client connection errors infrequently triggered a segmentation fault when the connection was idle and not used for a particular client instance. --- Aki Tuomi Open-Xchange oy

4 6

Pigeonhole release 0.5.6
by Aki Tuomi 30 Apr '19

30 Apr '19

Hi! We are pleased to release Pigeonhole 0.5.6 for Dovecot 2.3.6. Tarball https://pigeonhole.dovecot.org/releases/2.3/dovecot-2.3-pigeonhole-0.5.6.ta… https://pigeonhole.dovecot.org/releases/2.3/dovecot-2.3-pigeonhole-0.5.6.ta… Binary packages can be found from https://repo.dovecot.org/ Changes + sieve: Redirect loop prevention is sometimes ineffective. Improve existing loop detection by also recognizing the X-Sieve-Redirected-From header in incoming messages and dropping redirect actions when it points to the sending account. This header is already added by the redirect action, so this improvement only adds an additional use of this header. - sieve: Prevent execution of implicit keep upon temporary failure occurring at runtime. --- Aki Tuomi Open-Xchange oy

1 0

CVE-2019-11499: Submission-login crashes when authentication is started over TLS secured channel and invalid authentication message is sent
by Aki Tuomi 30 Apr '19

30 Apr '19

Open-Xchange Security Advisory 2019-04-30 Product: Dovecot Vendor: OX Software GmbH Internal reference: DOV-3223 (Bug ID) Vulnerability type: CWE-617 Vulnerable version: 2.3.0 - 2.3.5.2 Vulnerable component: submission-login Report confidence: Confirmed Solution status: Fixed by Vendor Fixed version: 2.3.6 Vendor notification: 2019-03-11 Solution date: 2019-04-23 Public disclosure: 2019-04-30 CVE reference: CVE-2019-11499 CVSS: 7.5 (CVSS3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vulnerability Details: Submission-login crashes when authentication is started over TLS secured channel and invalid authentication message is sent. This can lead to denial-of-service attack by persistent attacker(s). Workaround: Authentication crash can be avoided if authentication is done without TLS. Solution: Operators should upgrade to a fixed version.

1 0

CVE-2019-11494: Submission-login crashes with signal 11 due to null pointer access when authentication is aborted by disconnecting.
by Aki Tuomi 30 Apr '19

30 Apr '19

Open-Xchange Security Advisory 2019-04-30 Product: Dovecot Vendor: OX Software GmbH Internal reference: DOV-3212 (Bug ID) Vulnerability type: CWE-476 Vulnerable version: 2.3.0 - 2.3.5.2 Vulnerable component: submission-login Report confidence: Confirmed Researcher credits: Marcelo Coelho Solution status: Fixed by Vendor Fixed version: 2.3.6 Vendor notificatio: 2019-03-11 Solution date: 2019-04-23 Public disclosure: 2019-04-30 CVE reference: CVE-2019-11494 CVSS: 7.5 (CVSS3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vulnerability Details: Submission-login crashes with signal 11 due to null pointer access when authentication is aborted by disconnecting. This can lead to denial-of-service attack by persistent attacker(s). Workaround: There is no available workaround for this issue. Solution: Operators should upgrade to a fixed version.

1 0

Re: Sis to deduplicate attachments does not work?
by Daniel Miller 29 Apr '19

29 Apr '19

On April 23, 2019 10:54:38 PM luckydog xf <luckydogxf(a)gmail.com> wrote: > Is it worthwile to use dbox? seeing from > http://www.linuxmail.info/mbox-maildir-mail-storage-formats/ it may cause > file lock and easy to corrupt. As with everything - it depends. You're asking me so these are *my* opinions - and I do not claim to be anything more than a hobbyist/tinkerer when the comes to this. mbox has potential use for long term read-only archives - I see no reason to use it for live mailboxes. maildir is undoubtedly the least susceptible to corruption. It's also the slowest format for reading. How slow is "slow" depends on your hardware - it may be imperceptible with enough RAM and SSD's - or it may result in user complaints with large mailboxes. dbox is Dovecot's preferred format. I know Timo has put a lot of effort into it. sdbox is similar to maildir in that each mail is a separate file. mdbox significantly reduces the number of files which can make file-based backups faster. Both dbox formats are dependent on their index files. If you've got good hardware, including a proper UPS, I'd recommend dbox (my server is presently using sdbox). With large mailboxes and file-based backups you'll benefit from mdbox. When reliability is the #1 concern above anything else - use maildir. Depending on your use SIS can have significant impact on storage requirements - but storage these days is relatively cheap. I haven't seen much feedback from users actively using SIS - I'd love to hear from high traffic sites with SIS experience to know if the corruption issues have been resolved. In my case there was at least a 30% reduction in space but I had too many errors - admittedly it's been a couple years since I last tried it. -- Daniel

3 3

Using lmtp to authenticate email users
by Patrick Mahan 29 Apr '19

29 Apr '19

FreeBSD 11.2 Postfix 3.3.2 Dovecot 2.3.4 I am trying to use dovecot lmtp with postfix to verify authentication of incoming email and to avoid being a spam relay (an issue I was having using sendmail as my MTA). I am getting the following log message in /var/log/maillog: Mar 30 20:31:38 ns postfix/smtpd[40373]: NOQUEUE: reject: RCPT from mail-eopbgr750091.outbound.protection.outlook.com[40.107.75.91]: 450 4.1.1 < mahan(a)mahan.org>: Recipient address rejected: unverified address: host ns.mahan.org[private/dovecot-lmtp] said: 550 5.1.1 <mahan(a)mahan.org> User doesn't exist: mahan(a)mahan.org (in reply to RCPT TO command); from=< pmahan(a)silver-peak.com> to=<mahan(a)mahan.org> proto=ESMTP helo=< NAM02-BL2-obe.outbound.protection.outlook.com> 'mahan' does exist on ns.mahan.org. So I am confused to why lmtp is failing to find this username. Thanks, Patrick

4 5

used Lazyexpunge
by lty 28 Apr '19

28 Apr '19

I used Lazyexpunge. I tried to create .DELETED without any hints and see that the creation was successful. I want to prevent users from creating .DELETED, what should I do? My settings > plugin { > lazy_expunge = .DELETED/ > } > # > > namespace { > prefix = .DELETED/ > hidden = yes > list = no > separator = / > location = maildir:/var/vmail/backup/expunged/%d/%n > }

2 1

Auto rebuilding of Solr indexes on settings change?
by Peter Mogensen 25 Apr '19

25 Apr '19

Hi, Looking at the source, it doesn't seem like fts-solr checks for settings changes using fts_index_have_compatible_settings() like fts-lucene does. Is there any special reason for why fts-solr shouldn't also rebuild indexes if settings has changed? /Peter

2 1

msg header has bad magic value
by 김태용 25 Apr '19

25 Apr '19

There was an error saving the message. 'Error: Corrupted dbox file /storage/m.1 (around offset = 21589): msg header has bad magic value' Why do I get an error? How can I fix it?

1 0

haproxy + submission services -> postfix failure
by Chris Thomas 24 Apr '19

24 Apr '19

Hi, I have a nginx server which is using the proxy protocol to forward tcp connections to dovecot. Dovecot is configured to be a submission service for email to be sent. Then postfix should send the email itself which is also using the ha proxy protocol. There are a few moving parts in this problem so I'm not sure where the problem is. But I want to ask if somebody can validate my dovecot configuration somehow so I can start to tick off some things from the list. Sending email fails, seems to get to postfix, then die Receiving emails succeeds and I don't have any problem to pick them up. I've figured out some stuff, like lmtp shouldn't use haproxy when talking between postfix -> dovecot for receiving emails. If I enable the protocol on lmtp, I can't receive any emails at all. In order to get postfix to accept emails, I enabled haproxy protocol and enabled postscreen and then postfix could access the source ip and stop my server from being an open relay. I've got tls certificates installed on dovecot and postfix, all created by letsencrypt and I don't appear to have any problems with them. I will try to give as much information about the config as I can, I'm not sure what other parts are good to have, but let me know if you are missing something or want to check a value. >> 10-master.conf: service submission-login { inet_listener submission { port = 587 haproxy = yes } } service lmtp { inet_listener lmtp { port = 24 haproxy = no } } >> 20-submission.conf submission_relay_host = postfix.mail-server submission_relay_port = 25 submission_relay_ssl = starttls submission_relay_ssl_verify = yes Then because it might help to give the other side of the connection configuration for postfix, here is the relevant information: >> master.cf: smtp inet n - - - 1 postscreen smtpd pass - - - - - smtpd >> main.cf postscreen_upstream_proxy_protocol = haproxy postscreen_upstream_proxy_timeout = 10s That's it. I don't know what other information could be useful. There are some logs, they are like this (I've got logging turned on for pretty much every option I have: Dovecot logs: Apr 19 17:54:47 submission(__EMAIL__)<497><KUGA0OWG8XlfW/Q8>: Debug: Added userdb setting: plugin/quota_rule=*:bytes=0 Apr 19 17:54:47 submission(__EMAIL__)<497><KUGA0OWG8XlfW/Q8>: Debug: Effective uid=8, gid=8, home=/mail/__DOMAIN_COM__/__USER__ Apr 19 17:54:47 submission(__EMAIL__)<497><KUGA0OWG8XlfW/Q8>: Debug: Namespace inbox: type=private, prefix=, sep=, inbox=yes, hidden=no, list=yes, subscriptions=yes location=maildir:/mail/__DOMAIN_COM__/__USER__ Apr 19 17:54:47 submission(__EMAIL__)<497><KUGA0OWG8XlfW/Q8>: Debug: maildir++: root=/mail/__DOMAIN_COM__/__USER__, index=, indexpvt=, control=, inbox=/mail/__DOMAIN_COM__/__USER__, alt= Apr 19 17:54:47 submission(__EMAIL__)<497><KUGA0OWG8XlfW/Q8>: Debug: smtp-server: conn __IP_ADDR_1__:31217 [0]: Connection created Apr 19 17:54:47 submission(__EMAIL__)<497><KUGA0OWG8XlfW/Q8>: Debug: smtp-client: conn postfix.mail-server:25 [0]: Connection created Apr 19 17:54:47 submission(__EMAIL__)<497><KUGA0OWG8XlfW/Q8>: Debug: smtp-client: conn postfix.mail-server:25 [0]: Looking up IP address Apr 19 17:54:47 submission(__EMAIL__)<497><KUGA0OWG8XlfW/Q8>: Debug: smtp-client: conn postfix.mail-server:25 [0]: DNS lookup successful; got 1 IPs Apr 19 17:54:47 submission(__EMAIL__)<497><KUGA0OWG8XlfW/Q8>: Debug: smtp-client: conn postfix.mail-server:25 [0]: Connecting to 10.104.211.161:25 Apr 19 17:54:47 submission(__EMAIL__)<497><KUGA0OWG8XlfW/Q8>: Debug: smtp-client: conn postfix.mail-server:25 [0]: Connected Apr 19 17:54:57 submission(__EMAIL__)<497><KUGA0OWG8XlfW/Q8>: Debug: smtp-client: conn postfix.mail-server:25 [0]: Received greeting from server: 421 4.3.2 No system resources Apr 19 17:54:57 submission(__EMAIL__)<497><KUGA0OWG8XlfW/Q8>: Debug: smtp-client: conn postfix.mail-server:25 [0]: Connection failed: 421 4.3.2 No system resources Apr 19 17:54:57 submission(__EMAIL__)<497><KUGA0OWG8XlfW/Q8>: Error: Failed to establish relay connection: 421 4.3.2 No system resources Apr 19 17:54:57 submission(__EMAIL__)<497><KUGA0OWG8XlfW/Q8>: Debug: smtp-client: conn postfix.mail-server:25 [0]: Disconnected Apr 19 17:54:57 submission(__EMAIL__)<497><KUGA0OWG8XlfW/Q8>: Info: Disconnect from __IP_ADDR_1__: Failed to establish relay connection in=0 out=22 (state=GREETING) Apr 19 17:54:57 submission(__EMAIL__)<497><KUGA0OWG8XlfW/Q8>: Debug: smtp-server: conn __IP_ADDR_1__:31217 [0]: Disconnected: Failed to establish relay connection Postfix Logs: postfix/postscreen[525]: warning: haproxy read: time limit exceeded If anybody could help out, I'd be grateful because I just can't see what the problem is. Chris

2 1

lmtp_save_to_detail_mailbox override
by Andreas Thienemann 24 Apr '19

24 Apr '19

Hi, I have a dovecot 2.3.2.1 instance running here that is getting userdb and passdb data from a SQL database. This was a cyrus server migrated over and all users are happy. All users except one: Said user asked if it would be possible to disable subaddressing (localuser+folder(a)example.com) again. The setting controlling that is AFAIK the lmtp_save_to_detail_mailbox item. My idea was to override that setting for the specific user. I changed the user_query to return no for the user in question and all seems well: # doveadm user test field value user test(a)example.com uid vmail gid vmail home /var/lib/imap/example.com/test mail mdbox:/var/spool/imap/user/example.com/test lmtp_save_to_detail_mailbox no # Looks good, doesn't work though. Mail is still delivered to the +folder. Is this per user setting not taken into account? I could probably provide the user in question with a sieve script that files everything into the INBOX again but I wonder if there's a better way? cheers, Andreas

3 3

pigeonhole tests crashing in deleteheader.svtest
by Michal Hlavinka 24 Apr '19

24 Apr '19

Hi, when trying to build dovecot 2.3.5.1 pigeonhole testsuite crashes in Test case: ./tests/extensions/editheader/deleteheader.svtest: 1: Test 'Deleteheader - nonexistent' SUCCEEDED 2: Test 'Deleteheader - nonexistent (match)' SUCCEEDED 3: Test 'Deleteheader - one' SUCCEEDED 4: Test 'Deleteheader - two (first)' SUCCEEDED 5: Test 'Deleteheader - two (last)' SUCCEEDED 6: Test 'Deleteheader - :index' SUCCEEDED 7: Test 'Deleteheader - :index :last' SUCCEEDED 8: Test 'Deleteheader - implicit keep' SUCCEEDED make: *** [Makefile:1190: tests/extensions/editheader/deleteheader.svtest] Segmentation fault (core dumped) Let me know if you need more debug information. Cheers Michal Hlavinka #0 0x00007f9924faea8a in __strlen_sse2 () from /lib64/libc.so.6 #1 0x00007f992514fdd2 in smtp_address_clone (pool=0x7f992528dce0 <static_system_pool>, src=src@entry=0x7ffd30eace10) at smtp-address.c:632 #2 0x000055f7330916b3 in testsuite_message_set_data (mail=0x55f73486f848) at testsuite-message.c:96 #3 0x000055f7330918b9 in testsuite_message_set_file (renv=renv@entry=0x55f734856ac0, file_path=<optimized out>) at testsuite-message.c:139 #4 0x000055f7330931cc in testsuite_smtp_get (renv=renv@entry=0x55f734856ac0, index=<optimized out>) at testsuite-smtp.c:171 #5 0x000055f73309566c in cmd_test_message_smtp_operation_execute (renv=0x55f734856ac0, address=<optimized out>) at cmd-test-message.c:404 #6 0x00007f992543f371 in sieve_interpreter_operation_execute (interp=0x55f734856a68) at sieve-interpreter.c:911 #7 sieve_interpreter_continue (interp=0x55f734856a68, interrupted=0x0) at sieve-interpreter.c:949 #8 0x00007f992543f5d1 in sieve_interpreter_run (interp=0x55f734856a68, result=<optimized out>) at sieve-interpreter.c:999 #9 0x000055f73308f670 in testsuite_run (msgdata=<optimized out>, ehandler=<optimized out>, senv=0x7ffd30eacfa0, sbin=<optimized out>) at testsuite.c:73 #10 main (argc=<optimized out>, argv=<optimized out>) at testsuite.c:203 (gdb) up #1 0x00007f992514fdd2 in smtp_address_clone (pool=0x7f992528dce0 <static_system_pool>, src=src@entry=0x7ffd30eace10) at smtp-address.c:632 632 dsize = strlen(src->domain) + 1; (gdb) p *src $4 = {localpart = 0x55f73480cdc8 "/tmp/dsieve-testsuite.1553794316.30960/smtp/0.eml", domain = 0x1 <error: Cannot access memory at address 0x1>}

3 5

Sis to deduplicate attachments does not work?
by luckydog xf 23 Apr '19

23 Apr '19

Hi, I use sis to deduplicate attachments, here is my `doveconf -n` ------------ auth_cache_size = 10 M auth_failure_delay = 5 secs auth_mechanisms = plain login auth_socket_path = /var/run/dovecot/auth-userdb auth_ssl_username_from_cert = yes auth_username_format = %Ln default_vsz_limit = 512 M lmtp_rcpt_check_quota = yes mail_attachment_detection_options = add-flags-on-save mail_attachment_dir = /var/mail/mail_attachment/ mail_debug = yes mail_gid = vmail mail_location = maildir:/var/mail/%n/Maildir mail_plugins = quota fts fts_solr mail_privileged_group = vmail mail_uid = vmail managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { auto = subscribe special_use = \Junk } mailbox Sent { auto = subscribe special_use = \Sent } mailbox Trash { auto = subscribe special_use = \Trash } prefix = } passdb { args = /etc/dovecot/dovecot-ldap.conf.ext driver = ldap } plugin { fts = solr fts_autoindex = yes fts_autoindex_exclude = \Junk fts_autoindex_exclude2 = \Trash fts_solr = break-imap-search url=http://localhost:8983/solr/dovecot/ quota = maildir:User quota quota_grace = 10%% quota_max_mail_size = 5M quota_over_flag_lazy_check = yes quota_over_flag_value = TRUE quota_rule = *:storage=100M quota_warning = storage=65%% quota-warning 65 %u quota_warning2 = storage=60%% quota-warning 60 %u sieve = file:~/sieve;active=~/.dovecot.sieve } protocols = imap lmtp sieve service auth-worker { user = $default_internal_user } service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0640 user = postfix } unix_listener auth-userdb { mode = 0777 user = $default_internal_user } user = $default_internal_user } service imap-login { inet_listener imap { port = 0 } inet_listener imaps { port = 993 ssl = yes } } service managesieve-login { inet_listener sieve { port = 4190 } process_min_avail = 0 service_count = 1 vsz_limit = 128 M } service pop3-login { inet_listener pop3 { port = 0 } inet_listener pop3s { port = 0 } } service quota-warning { executable = script /usr/local/bin/quota-warning.sh unix_listener quota-warning { user = vmail } user = vmail } service stats { unix_listener stats-writer { mode = 0666 } } service submission-login { inet_listener submission { port = 0 } } ssl = required ssl_cert = </etc/ssl/certs/dovecot.pem ssl_dh = # hidden, use -P to show it ssl_key = # hidden, use -P to show it userdb { driver = prefetch } userdb { args = /etc/dovecot/dovecot-ldap.conf.ext default_fields = home=/var/mail/%u driver = ldap } protocol !indexer-worker { mail_vsize_bg_after_count = 0 } protocol lda { mail_plugins = quota fts fts_solr sieve } protocol imap { mail_max_userip_connections = 5 mail_plugins = quota fts fts_solr imap_quota } protocol lmtp { mail_plugins = quota fts fts_solr } --------- I try to send an email and then forward this email to another recipient. No attachment is generated in `mail_attachment_dir`. Anything wrong ?

2 1

making selected accounts read-only
by Wojciech Puchar 23 Apr '19

23 Apr '19

how to make selected few accounts readonly by pop3/imap?

3 2

SolrCore 'dovecot' is not available due to init failure: fieldType 'text_general' not found in the schema
by luckydog xf 23 Apr '19

23 Apr '19

Hello, it seems an mismatch of schema file provided by dovecot-2.3.5.2 [root@mail conf]# pwd /var/solr/data/dovecot/conf # Below solrconfig.xml is from Solr-8.0.0. [root@mail conf]# grep text_general solrconfig.xml <str name="queryAnalyzerFieldType">text_general</str> field types. Text content will be indexed as "text_general" as <str name="fieldType">text_general</str> # schema is from /usr/share/doc/dovecot/solr-schema.xml dovecot-2.3.5.2 and the latest solr-8.0.0. It seems XMLs do not match each other. How can I fix this problem？ Thanks.

3 5

mbsync updating new emails but dovecot not reading them ? [2.3.3]
by Kunal A. 21 Apr '19

21 Apr '19

Hi, Once again sincere apologies for emailing here. My dovecot isn't reading the newly updated e-mails from the mbsync. I have tried running doveadm -D -v force-resync -u email1(a)example.com "Inbox/Public/Other Users/user1(a)example.com" Plese help if possible. Highly appreciate if someone could help here... Below is the debug log :- Debug: Loading modules from directory: /usr/lib64/dovecot Debug: Module loaded: /usr/lib64/dovecot/lib01_acl_plugin.so Debug: Module loaded: /usr/lib64/dovecot/lib10_quota_plugin.so Debug: Loading modules from directory: /usr/lib64/dovecot/doveadm Debug: Module loaded: /usr/lib64/dovecot/doveadm/lib10_doveadm_acl_plugin.so Debug: Skipping module doveadm_expire_plugin, because dlopen() failed: /usr/lib64/dovecot/doveadm/lib10_doveadm_expire_plugin.so: undefined symbol: expire_set_deinit (this is usually intentional, so just ignore this message) Debug: Module loaded: /usr/lib64/dovecot/doveadm/lib10_doveadm_quota_plugin.so Debug: Skipping module doveadm_fts_lucene_plugin, because dlopen() failed: /usr/lib64/dovecot/doveadm/lib20_doveadm_fts_lucene_plugin.so: undefined symbol: lucene_index_iter_deinit (this is usually intentional, so just ignore this message) Debug: Skipping module doveadm_fts_plugin, because dlopen() failed: /usr/lib64/dovecot/doveadm/lib20_doveadm_fts_plugin.so: undefined symbol: fts_user_get_language_list (this is usually intentional, so just ignore this message) Debug: Skipping module doveadm_mail_crypt_plugin, because dlopen() failed: /usr/lib64/dovecot/doveadm/libdoveadm_mail_crypt_plugin.so: undefined symbol: mail_crypt_box_get_pvt_digests (this is usually intentional, so just ignore this message) doveadm(email1(a)example.com)<20402><>: Debug: auth USER input: email1(a)example.com uid=5000 gid=5000 home=/var/mail/vhosts/ example.com/email1 doveadm(email1(a)example.com): Debug: Effective uid=5000, gid=5000, home=/var/mail/vhosts/example.com/email1 doveadm(email1(a)example.com): Debug: quota: No quota setting - plugin disabled doveadm(email1(a)example.com): Debug: Namespace inbox: type=private, prefix=INBOX/, sep=/, inbox=yes, hidden=no, list=yes, subscriptions=yes location=maildir:~/Maildir doveadm(email1(a)example.com): Debug: maildir++: root=/var/mail/vhosts/ example.com/email1/Maildir, index=, indexpvt=, control=, inbox=/var/mail/vhosts/example.com/email1/Maildir, alt= doveadm(email1(a)example.com): Debug: acl: initializing backend with data: vfile doveadm(email1(a)example.com): Debug: acl: acl username = email1(a)example.com doveadm(email1(a)example.com): Debug: acl: owner = 1 doveadm(email1(a)example.com): Debug: acl vfile: Global ACLs disabled doveadm(email1(a)example.com): Debug: Namespace : type=public, prefix=Public/, sep=/, inbox=no, hidden=no, list=children, subscriptions=yes location=maildir:/mnt/5ea86261-cfae-4e17-b21f-3a6c1a03d795/Email/fastmail:LAYOUT=fs doveadm(email1(a)example.com): Debug: fs: root=/mnt/5ea86261-cfae-4e17-b21f-3a6c1a03d795/Email/fastmail, index=, indexpvt=, control=, inbox=, alt= doveadm(email1(a)example.com): Debug: acl: initializing backend with data: vfile doveadm(email1(a)example.com): Debug: acl: acl username = email1(a)example.com doveadm(email1(a)example.com): Debug: acl: owner = 0 doveadm(email1(a)example.com): Debug: acl vfile: Global ACLs disabled doveadm(email1(a)example.com): Debug: Namespace : type=private, prefix=, sep=, inbox=no, hidden=yes, list=no, subscriptions=no location=fail::LAYOUT=none doveadm(email1(a)example.com): Debug: none: root=, index=, indexpvt=, control=, inbox=, alt= doveadm(email1(a)example.com): Debug: acl vfile: file /var/mail/vhosts/ example.com/email1/Maildir/dovecot-acl not found Doveconf output :- # 2.3.5 (513208660): /etc/dovecot/dovecot.conf # OS: Linux 5.0.7-200.fc29.x86_64 x86_64 Fedora release 29 (Twenty Nine) # Hostname: machine auth_mechanisms = plain login mail_debug = yes mail_gid = vmail mail_location = maildir:~/Maildir mail_plugins = acl quota mail_privileged_group = mail mail_uid = vmail mbox_write_locks = fcntl namespace { list = children location = maildir:/mnt/5ea86261-cfae-4e17-b21f-3a6c1a03d795/Email/fastmail:LAYOUT=fs prefix = Public/ separator = / subscriptions = yes type = public } namespace inbox { inbox = yes list = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = INBOX/ separator = / } passdb { driver = pam } passdb { args = /etc/dovecot/dovecot-sql.conf.ext driver = sql } plugin { acl = vfile acl_shared_dict = file:/var/mail/vhosts/example.com/Sharedbox } postmaster_address = postmaster at example.com protocols = imap pop3 service auth-worker { user = vmail } service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0666 user = postfix } unix_listener auth-userdb { mode = 0600 user = vmail } user = dovecot } service imap-login { inet_listener imap { port = 143 } inet_listener imaps { port = 993 ssl = yes } } service lmtp { unix_listener /var/spool/postfix/private/dovecot-lmtp { group = postfix mode = 0600 user = postfix } } service pop3-login { inet_listener pop3 { port = 0 } inet_listener pop3s { port = 995 ssl = yes } } ssl = required ssl_cert = </etc/pki/dovecot/certs/dovecot.pem ssl_cipher_list = PROFILE=SYSTEM ssl_key = # hidden, use -P to show it userdb { driver = passwd } userdb { args = uid=vmail gid=vmail home=/var/mail/vhosts/%d/%n driver = static } protocol lmtp { mail_plugins = quota acl sieve quota } protocol lda { mail_plugins = quota acl sieve } protocol imap { mail_plugins = acl quota imap_acl quota acl imap_quota }

1 1

FTS delays
by Joan Moreau 21 Apr '19

21 Apr '19

Hi When I do a FTS search (using Xapian plugin) in the BODY part, the plugins returns the matching IDs within few milliseconds (as seen in the log). However, roundcube (connected on dovecot) takes ages to show (headers only vie IMAP) the few results (I tested with a matching requests of 9 emails) What could be the root cause ? Thank you

6 24

maildirlock fails
by Martynas Bendorius 21 Apr '19

21 Apr '19

Hello, Maildirlock seems to panic on locking: [root@centos7 home]# /usr/libexec/dovecot/maildirlock "/home/user/imap/domain.com/email/Maildir" 10 Panic: BUG: No IOs or timeouts set. Not waiting for infinity. Error: Raw backtrace: /usr/lib/dovecot/libdovecot.so.0(+0xd90ee) [0x7f5bf02f10ee] -> /usr/lib/dovecot/libdovecot.so.0(+0xd9131) [0x7f5bf02f1131] -> /usr/lib/dovecot/libdovecot.so.0(i_fatal+0) [0x7f5bf0256efd] -> /usr/lib/dovecot/libdovecot.so.0(+0xf078c) [0x7f5bf030878c] -> /usr/lib/dovecot/libdovecot.so.0(io_loop_handler_run_internal+0x36) [0x7f5bf030b1f6] -> /usr/lib/dovecot/libdovecot.so.0(io_loop_handler_run+0x56) [0x7f5bf03099c6] -> /usr/lib/dovecot/libdovecot.so.0(io_loop_run+0x38) [0x7f5bf0309be8] -> /usr/libexec/dovecot/maildirlock(main+0x24a) [0x558ae0e032ca] -> /lib64/libc.so.6(__libc_start_main+0xf5) [0x7f5befe6d3d5] -> /usr/libexec/dovecot/maildirlock(+0x13a2) [0x558ae0e033a2] Is this a known issue? Thank you! -- Best regards, Martynas Bendorius

2 3

stats-writer error is back
by unknown＠example.com 20 Apr '19

20 Apr '19

Afer a reboot (and installation of postfix-3.4.5) I am getting the stat-writer permission denied error again. from doveconf -n service stats { unix_listener stats-reader { user = dovecot } unix_listener stats-writer { user = dovecot } } # ls -ls /var/run/dovecot/stats-writer 0 srw-rw---- 1 dovecot dovecot 0 Apr 20 04:34 /var/run/dovecot/stats-writer Apr 20 04:45:00 mail postfix/pipe[80136]: 44mTxm3Mblzc3Td: to=<munged>, relay=dovecot, delay=0.06, delays=0.02/0.02/0/0.02, dsn=2.0.0, status=sent (delivered via dovecot service (lda(,munged,)Error: net_connect_unix(/var/run/dovecot/stats-writer) failed: Permiss)) -- W is for WINNIE embedded in ice X is for XERXES devoured by mice

3 6

Extended logging / moved mails jumping back
by Martin Müller 20 Apr '19

20 Apr '19

Hi! About 4-6 MUA Thunderbird 60.6.1 are going to connect with dovecot 2.2.13/IMAP (debian 8) and are using the same user/password. This setup works for years flawless (updated clients and serversoftware). Since a few weeks there is one major trouble: I one of the client moves a mail from the inbox to a another IMAP-Folder, most of the moved mail are moved for the moment. But an unstable period later, the mails are moved back to the inbox. In rarely cases, the moved mail is copied (one in the inbox, one in the destinationfolder). Now I have to check, if this a Thunderbird-Issue or is this a dovecot-issue. For that reason, I will activate the extended logging of dovecot. ### ### ### ### dovecot -n # 2.2.13: /etc/dovecot/dovecot.conf # OS: Linux 3.16.0-6-amd64 x86_64 Debian 8.11 auth_mechanisms = plain login debug_log_path = /var/log/mail.dovecot-debug disable_plaintext_auth = no info_log_path = /var/log/mail.dovecot-info listen = *,[::] log_path = /var/log/mail.dovecot-error log_timestamp = "%Y-%m-%d %H:%M:%S " mail_debug = yes mail_max_userip_connections = 100 mail_privileged_group = vmail passdb { args = /etc/dovecot/dovecot-sql.conf driver = sql } plugin { mail_log_events = delete undelete expunge copy mailbox_delete mailbox_rename mail_log_fields = uid box msgid size quota = dict:user::file:/var/vmail/%d/%n/.quotausage sieve = /var/vmail/%d/%n/.sieve sieve_max_redirects = 25 } protocols = imap pop3 service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0660 user = postfix } unix_listener auth-userdb { group = vmail mode = 0600 user = vmail } user = root } service imap-login { client_limit = 1000 process_limit = 512 } service lmtp { unix_listener /var/spool/postfix/private/dovecot-lmtp { group = postfix mode = 0600 user = postfix } } ssl_cert = </etc/postfix/smtpd.cert ssl_key = </etc/postfix/smtpd.key ssl_protocols = !SSLv3 userdb { driver = prefetch } userdb { args = /etc/dovecot/dovecot-sql.conf driver = sql } protocol imap { mail_plugins = quota imap_quota } protocol pop3 { mail_plugins = quota pop3_uidl_format = %08Xu%08Xv } protocol lda { mail_plugins = sieve quota postmaster_address = postmaster(a)monarch.products4more.at } protocol lmtp { mail_plugins = quota sieve postmaster_address = postmaster(a)monarch.products4more.at } ### ### ### ### ### ### ### ### It works: dovecot logs to three differnt logfiles /var/log/mail.dovecot-* It doesnt work: plugin { mail_log_events = delete undelete expunge copy mailbox_delete mailbox_rename mail_log_fields = uid box msgid size } I cant see such events in the logfiles. Which switch is to turn on to log all events? Or do anyone know the reason for the annoying "copy/move-the-mail-back"-issue? Thank you in advance for all inputs. regards, martin

4 5

[Dovecot] Dovecot LDA/LMTP vs postfix virtual delivery agent and the x-original-to header
by Charles Marcus 19 Apr '19

19 Apr '19

On 2012-04-05 4:18 AM, Thomas Leuxner <tlx(a)leuxner.net> wrote: > Also with 2.x you may want to use LMTP rather than the LDA Piping. > > http://wiki2.dovecot.org/HowTo/PostfixDovecotLMTP I am preparing to convert my main client's postfix_courier-imap setup to dovecot 2.1, which currently just uses the postfix virtual delivery agent... Does anyone know if the use of LMTP (or even the dovecot LDA) still loses the x-original-to header that the postfix vda adds and that I rely heavily on (since I use a lot of aliases), and if it does, is there any solution to get the original recipient added back in before final delivery? Everything I'm reading says that LMTP is better, but I really do need this header (or one like it) to be there so I know who the original recipient was (for filtering and other purposes). Thanks, -- Best regards, Charles

8 16

OAuth Passdb Grant
by Tom 19 Apr '19

19 Apr '19

I'm trying to implement the password grant flow, as specified at https://wiki2.dovecot.org/PasswordDatabase/oauth2, but am getting an error message. Can you please help? auth: Fatal: oauth2 /etc/dovecot/dovecot-oauth2.token.conf.ext: Error in configuration file /etc/dovecot/dovecot-oauth2.token.conf.ext line 1: Unknown setting: grant_url $ dovecot -n # 2.3.5.2 (38c8f1daf): /etc/dovecot/dovecot.conf # OS: Linux 3.10.0-957.10.1.el7.x86_64 x86_64 CentOS Linux release 7.6.1810 (Core)

2 1

v2.3.5.2 released
by Aki Tuomi 18 Apr '19

18 Apr '19

Lets try again, put wrong changelog to the mail. Sorry about this. https://dovecot.org/releases/2.3/dovecot-2.3.5.2.tar.gz https://dovecot.org/releases/2.3/dovecot-2.3.5.2.tar.gz.sig Binary packages in https://repo.dovecot.org/ * CVE-2019-10691: Trying to login with 8bit username containing invalid UTF8 input causes auth process to crash if auth policy is enabled. This could be used rather easily to cause a DoS. Similar crash also happens during mail delivery when using invalid UTF8 in From or Subject header when OX push notification driver is used. --- Aki Tuomi Open-Xchange oy

2 2

Problems with auth connection
by Fernando Ortega 18 Apr '19

18 Apr '19

Hi, We are having some issues with the auth connection Version: 2.3.5.1, with MySQL and Postfix The server is working fine, and randomly after some days, Dovecot fails to auth: Apr 18 14:25:16 mail dovecot[25013]: auth: Warning: Event 0x126eba20 leaked (parent=0x126eb820): auth-request.c:89 Apr 18 14:25:16 mail dovecot[25013]: auth: Warning: Event 0x126eb420 leaked (parent=0x0): auth-client-connection.c:338 It's neccesary to restart dovecot, and once restarted the server start to work fine again and deliver emails What do you think i could do? Thank you, best regards Fernando

1 0

ssl_verify_server_cert against SAN?
by TG Servers 18 Apr '19

18 Apr '19

3 5

CVE-2019-10691: JSON encoder in Dovecot 2.3 incorrecty assert-crashes when encountering invalid UTF-8 characters.
by Aki Tuomi 18 Apr '19

18 Apr '19

Dear subscribers, we're sharing our latest advisory with you and would like to thank everyone who contributed in finding and solving those vulnerabilities. Feel free to join our bug bounty programs (open-xchange, dovecot, powerdns) at HackerOne. You can find binary packages at https://repo.dovecot.org/ Yours sincerely, Aki Tuomi Open-Xchange Oy Open-Xchange Security Advisory 2019-04-18 Product: Dovecot Vendor: OX Software GmbH Internal reference: DOV-3173 (Bug ID) Vulnerability type: CWE-176 Vulnerable version: 2.3.0 - 2.3.5.1 Vulnerable component: json encoder Report confidence: Confirmed Researcher credits: cPanel L.L.C. Solution status: Fixed by Vendor Fixed version: 2.3.5.2 Vendor notification: 2019-04-02 Solution date: 2019-04-11 Public disclosure: 2019-04-18 CVE reference: CVE-2019-10691 CVSS: 7.5 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vulnerability Details: JSON encoder in Dovecot 2.3 incorrecty assert-crashes when encountering invalid UTF-8 characters. This can be used to crash dovecot in two ways. Attacker can repeatedly crash Dovecot authentication process by logging in using invalid UTF-8 sequence in username. This requires that auth policy is enabled. Crash can also occur if OX push notification driver is enabled and an email is delivered with invalid UTF-8 sequence in From or Subject header. In 2.2, malformed UTF-8 sequences are forwarded "as-is", and thus do not cause problems in Dovecot itself. Target systems should be checked for possible problems in dealing with such sequences. See https://wiki.dovecot.org/Authentication/Policy for details on auth policy support. Risk: Determined attacker can prevent authentication process from staying up by keeping on attempting to log in with username containing invalid UTF-8 sequence. Steps to reproduce: Configure dovecot with auth_policy_server_url and auth_policy_hash_nonce set. Attempt to log in with username containing an invalid UTF-8 sequence Observe assert-crash in dovecot logs. Solution: Operators should update to the latest Patch Release or disable auth policy support.

1 0

v2.3.5.2 released
by Aki Tuomi 18 Apr '19

18 Apr '19

https://dovecot.org/releases/2.3/dovecot-2.3.5.2.tar.gz https://dovecot.org/releases/2.3/dovecot-2.3.5.2.tar.gz.sig Binary packages in https://repo.dovecot.org/ * CVE-2019-7524: Missing input buffer size validation leads into arbitrary buffer overflow when reading fts or pop3 uidl header from Dovecot index. Exploiting this requires direct write access to the index files. --- Aki Tuomi Open-Xchange oy

1 0

Problem with mysql backend and SSL ciphers
by TG Servers 18 Apr '19

18 Apr '19

3 3

Documentation update
by azurit＠pobox.sk 18 Apr '19

18 Apr '19

Hi guys, this page needs to be updated: https://wiki2.dovecot.org/MailLocation/Maildir#Control_files (link was from here: https://wiki2.dovecot.org/MailLocation) Section 'Control files' is mentioning only 2 files but, in fact, Dovecot will store some additional files in CONTROL location: dovecot-uidvalidity dovecot-uidvalidity.* subscriptions (anything more?) Even more, page https://wiki2.dovecot.org/MailLocation has missing note to CONTROL files location about storing files 'dovecot-uidlist' and 'dovecot-keywords' of INBOX inside .INBOX directory instead of root directory (as it's stored inside mailbox). Missing anything from above will cause re-downloading of all e-mails by e-mail clients! And finally, i'm attaching a Python script which will safely copy/move CONTROL files from mail_location to new location (btw, moving it on SSD storage caused quite high performance boost in our environment). azur

2 1

Full mail
by Yevgeny Kosarzhevsky 18 Apr '19

18 Apr '19

Hello, I am getting strange messages on logs and I cannot find any reason. Could someone point me on what's wrong with my dovecot configuration? ~# dovecot -n # 2.3.4.1 (f79e8e7e4): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.4 () # OS: Linux 4.9.0-8-amd64 x86_64 Debian 9 ext4 ~# grep 'full mail' //var/log/dovecot.log Apr 16 19:25:43 imap(phaoost(a)phaoost.net)<15956><bv4DlqqGQNC5LcCN>: Debug: Mailbox INBOX: UID 3: Opened mail because: full mail Apr 16 19:29:06 imap(phaoost(a)phaoost.net)<17588><U1oXyKqGKNG5LcCN>: Debug: Mailbox INBOX: UID 4: Opened mail because: full mail Apr 16 20:28:19 imap(phaoost(a)phaoost.net)<21808><pT01V6uGgtO5LcCN>: Debug: Mailbox INBOX: UID 6: Opened mail because: full mail Apr 16 22:22:38 imap(phaoost(a)phaoost.net)<32077><lQTltKyGItq5LcCN>: Debug: Mailbox INBOX: UID 7: Opened mail because: full mail Apr 16 22:55:57 imap(phaoost(a)phaoost.net)<3732><hw1UQ62GWt25LcCN>: Debug: Mailbox INBOX: UID 8: Opened mail because: full mail Apr 16 23:37:12 imap(phaoost(a)phaoost.net)<8139><+2dd262G3N+5LcCN>: Debug: Mailbox INBOX: UID 9: Opened mail because: full mail Apr 17 01:09:13 imap(phaoost(a)phaoost.net)<8041><BqWBiK+GAua5LcCN>: Debug: Mailbox Trash: UID 3: Opened mail because: full mail Apr 17 01:09:13 imap(phaoost(a)phaoost.net)<8041><BqWBiK+GAua5LcCN>: Debug: Mailbox Trash: UID 4: Opened mail because: full mail Apr 17 01:09:13 imap(phaoost(a)phaoost.net)<8041><BqWBiK+GAua5LcCN>: Debug: Mailbox Trash: UID 5: Opened mail because: full mail Apr 17 01:09:13 imap(phaoost(a)phaoost.net)<8041><BqWBiK+GAua5LcCN>: Debug: Mailbox Trash: UID 6: Opened mail because: full mail Apr 17 01:09:13 imap(phaoost(a)phaoost.net)<8041><BqWBiK+GAua5LcCN>: Debug: Mailbox Trash: UID 7: Opened mail because: full mail Apr 17 04:34:44 imap(phaoost(a)phaoost.net)<23874><PC06DLKGaoC5LcCN>: Debug: Mailbox INBOX: UID 10: Opened mail because: full mail Apr 17 05:45:21 imap(phaoost(a)phaoost.net)<17176><fcoRZLOGHIW5LcCN>: Debug: Mailbox INBOX: UID 11: Opened mail because: full mail Apr 17 07:00:10 imap(phaoost(a)phaoost.net)<5348><bG6Ub7SGKom5LcCN>: Debug: Mailbox INBOX: UID 12: Opened mail because: full mail Apr 17 07:35:58 imap(phaoost(a)phaoost.net)<8078><QsTyj7SGyom5LcCN>: Debug: Mailbox INBOX: UID 13: Opened mail because: full mail Apr 17 08:25:17 imap(phaoost(a)phaoost.net)<29005><Zyr3n7WGIJC5LcCN>: Debug: Mailbox INBOX: UID 14: Opened mail because: full mail Apr 17 10:36:54 imap(phaoost(a)phaoost.net)<31565><TcqvdreGwJi5LcCN>: Debug: Mailbox INBOX: UID 15: Opened mail because: full mail Apr 17 11:08:27 imap(phaoost(a)phaoost.net)<7864><0+xW57eGjJq5LcCN>: Debug: Mailbox INBOX/Spam: UID 1: Opened mail because: full mail Apr 17 11:09:11 imap(phaoost(a)phaoost.net)<7864><0+xW57eGjJq5LcCN>: Debug: Mailbox Spam: UID 27: Opened mail because: full mail Apr 17 11:09:11 imap(phaoost(a)phaoost.net)<7864><0+xW57eGjJq5LcCN>: Debug: Mailbox Spam: UID 28: Opened mail because: full mail Apr 17 12:09:12 imap(phaoost(a)phaoost.net)<25908><bXnRwLiGKJ+5LcCN>: Debug: Mailbox Spam: UID 33: Opened mail because: full mail Apr 17 13:19:38 imap(phaoost(a)phaoost.net)<20835><El6SvLmGEKG5LcCN>: Debug: Mailbox Spam: UID 34: Opened mail because: full mail Apr 17 16:50:57 imap(phaoost(a)phaoost.net)<14923><hkpHsLyGYKa5LcCN>: Debug: Mailbox Spam: UID 35: Opened mail because: full mail Apr 17 16:50:57 imap(phaoost(a)phaoost.net)<14923><hkpHsLyGYKa5LcCN>: Debug: Mailbox Spam: UID 36: Opened mail because: full mail Apr 17 18:50:56 imap(phaoost(a)phaoost.net)<14650><JJZsXb6GCq25LcCN>: Debug: Mailbox Spam: UID 37: Opened mail because: full mail Apr 17 18:50:56 imap(phaoost(a)phaoost.net)<14650><JJZsXb6GCq25LcCN>: Debug: Mailbox Spam: UID 38: Opened mail because: full mail -- Regards, Yevgeny

2 1

Sieve operation "send copy" not working since upgrade from dovecot 2.2.31-1 to 2.3.5.1-1
by Kristijan Savic - ratiokontakt GmbH 16 Apr '19

16 Apr '19

I hope that someone can help me here. Software: CentOS 7.6.1810, dovecot-2.3.5.1, dovecot-pigeonhole-2.3.5.1, exim 4.91-1 Example filter: # rule:[test] if header :contains "subject" "meow" { redirect :copy "ks(a)ratiokontakt.de"; } Mail log: Apr 16 11:29:02 frontend-17 dovecot: lmtp(testi(a)mrhoang.de)<25201><QPgZHF6gtVxxYgAARS1pjg>: sieve: msgid=<311099964.O2fbMfmo3K(a)ws-ks.intern.ratiokontakt.de>: failed to redirect message to <ks(a)ratiokontakt.de>: smtp(localhost): DATA failed: 552 Message header not CRLF terminated (permanent failure) Apr 16 11:29:02 frontend-17 dovecot: lmtp(testi(a)mrhoang.de)<25201><QPgZHF6gtVxxYgAARS1pjg>: sieve: msgid=<311099964.O2fbMfmo3K(a)ws-ks.intern.ratiokontakt.de>: stored mail into mailbox 'INBOX' Apr 16 11:29:02 frontend-17 dovecot: lmtp(testi(a)mrhoang.de)<25201><QPgZHF6gtVxxYgAARS1pjg>: sieve: Execution of script /usr/local/mail/0117/mrhoang.de/testi/.dovecot.sieve failed, but implicit keep was successful (user logfile /usr/local/mail/0117/mrhoang.de/ testi/.dovecot.sieve.log may reveal additional details) And in the: /.dovecot.sieve.log: sieve: info: started log at Apr 16 11:29:02. error: msgid=<311099964.O2fbMfmo3K(a)ws-ks.intern.ratiokontakt.de>: failed to redirect message to <ks(a)ratiokontakt.de>: smtp(localhost): DATA failed: 552 Message header not CRLF terminated (permanent failure) We are stumped. Any ideas? Regards, Kristijan Savic

2 2

Fwd: SOLR/Index?
by Larry Rosenman 15 Apr '19

15 Apr '19

forgot to reply all. ---------- Forwarded message --------- From: Larry Rosenman <larryrtx(a)gmail.com> Date: Mon, Apr 15, 2019 at 5:58 AM Subject: Re: SOLR/Index? To: John Fawcett <john(a)voipsupport.it> the local users (myself, my wife, a friend) can authenticate EITHER as <username> or <username>@lerctr.org. switching to all virtual users is NOT going to happen. If I login to roundcube with <user>@lerctr.org it finds the autoindexed mail. So, if I make everyone always authenticate as <user>@lerctr.org we should be fine. and change my script to do doveadm -u <user>@<domain> instead of depending on the local user running the cron job. question: Is there some way to have dovecot change what it sees to be <user>@lerctr.org when they login as <user>? On Mon, Apr 15, 2019 at 5:54 AM John Fawcett via dovecot < dovecot(a)dovecot.org> wrote: > On 15/04/2019 11:38, Larry Rosenman via dovecot wrote: > > ⌂63% [ler@thebighonker.lerctr.org:~] $ grep fts1970 mail/INBOX > ⌂67% [ler@thebighonker.lerctr.org:~] 1 $ mail -s "test fts1970" > ler(a)lerctr.org > test fts1970 > > test fts1970 > . > EOT > [ler@thebighonker.lerctr.org:~] $ mailq > [ler@thebighonker.lerctr.org:~] $ grep fts1970 mail/INBOX > Subject: test fts1970 > test fts1970 > test fts1970 > > > Apr 15 04:29:03 thebighonker exim[49528]: 1hFxvD-000Csq-P6 <= > ler(a)lerctr.org U=ler P=local S=388 > Apr 15 04:29:03 thebighonker dovecot[2507]: lmtp(49364): Connect from local > Apr 15 04:29:03 thebighonker dovecot[2507]: lmtp(ler(a)lerctr.org/49364): > save: box=INBOX, uid=175402, msgid=< > E1hFxvD-000Csq-P6(a)thebighonker.lerctr.org>, size=640, vsize=660, > from=Larry Rosenman <ler(a)lerctr.org>, subject=test fts1970, flags=() > Apr 15 04:29:03 thebighonker dovecot[2507]: lmtp(ler(a)lerctr.org/49364): > sieve: msgid=<E1hFxvD-000Csq-P6(a)thebighonker.lerctr.org>: stored mail > into mailbox 'INBOX' (subject=test fts1970 from=ler(a)lerctr.org size=660) > Apr 15 04:29:03 thebighonker dovecot[2507]: lmtp(49364): Disconnect from > local: Client has quit the connection (state=READY) > Apr 15 04:29:03 thebighonker exim[49535]: 1hFxvD-000Csq-P6 => ler < > ler(a)lerctr.org> R=localuser T=dovecot_lmtp S=404 C="250 2.0.0 < > ler(a)lerctr.org> 6ACWMN9OtFzUwAAAu+mOrA Saved" QT=0s DT=0s > Apr 15 04:29:03 thebighonker exim[49535]: 1hFxvD-000Csq-P6 Completed QT=0s > Apr 15 04:29:03 thebighonker dovecot[2507]: indexer-worker( > ler(a)lerctr.org/49366) Indexed 1 messages in INBOX (UIDs 175402..175402) > > > ⌂81% [ler@thebighonker.lerctr.org:~] $ doveadm search mailbox INBOX body > 'fts1970' > ⌂83% [ler@thebighonker.lerctr.org:~] $ > > > ⌂65% [ler@thebighonker.lerctr.org:~] 75 $ doveadm search -u ler(a)lerctr.org > mailbox INBOX body 'fts1970' > a53a143be44bda5bd4830000bbe98eac 175402 > [ler@thebighonker.lerctr.org:~] $ doveadm index -q INBOX > [ler@thebighonker.lerctr.org:~] $ doveadm search mailbox INBOX body > 'fts1970' > [ler@thebighonker.lerctr.org:~] $ doveadm fts rescan > [ler@thebighonker.lerctr.org:~] $ doveadm index -q INBOX > [ler@thebighonker.lerctr.org:~] $ doveadm search mailbox INBOX body > 'fts1970' > a53a143be44bda5bd4830000bbe98eac 175402 > [ler@thebighonker.lerctr.org:~] $ doveadm search -u ler(a)lerctr.org > mailbox INBOX body 'fts1970' > a53a143be44bda5bd4830000bbe98eac 175402 > [ler@thebighonker.lerctr.org:~] $ > > So, yes, your hypothesis is correct. > > Question: How can I make it consistent? > > I have a script that runs on the first of the month that does archiving, > and I have similar issues in that namespace: > ⌂67% [ler@thebighonker.lerctr.org:~] $ cat bin/archive-mail > #!/bin/sh > PATH=$PATH:/usr/local/bin > #Expects to be run after midnight on the first of the month > # to archive all the previous months mail > #Date Run: > TODAY=`date "+%Y-%m-%d"` > #last month in YYYY/MM > YEAR_LAST_MONTH=`date -v-1d "+%Y/%m"` > #1st of last month as 01-Mon-YYYY > FIRST_LAST_MONTH=`date -v-1d "+01-%b-%Y"` > echo 'TODAY=' ${TODAY} > echo 'YEAR_LAST_MONTH=' ${YEAR_LAST_MONTH} > echo 'FIRST_LAST_MONTH=' ${FIRST_LAST_MONTH} > # get a list of all the mailboxes with at least one real message > doveadm -f tab mailbox status vsize \* 2>/dev/null | > sed -e 1d | sort -k 1,1 | > awk 'BEGIN {FS="\t"} {if ($2 > 0) print $1}' | > while read i > do > echo `date` start ${i} > doveadm mailbox create "ARCHIVE/${YEAR_LAST_MONTH}/${i}" > doveadm -f tab mailbox status messages "${i}" > doveadm move "ARCHIVE/${YEAR_LAST_MONTH}/${i}" mailbox \ > "${i}" BEFORE ${TODAY} SINCE ${FIRST_LAST_MONTH} > doveadm -f tab mailbox status messages "${i}" > echo `date` done ${i} > done > ⌂64% [ler@thebighonker.lerctr.org:~] $ > > > The Exim config can be provided as well if necessary. > > ler & ler(a)lerctr.org *ARE THE SAME MAILBOX* > > At the moment it looks as though you have two sets of emails indexed in > solr. One is indexed under username (the one you are running mannually and > apparently the one used by roundcube too, but that's to be verified) and > another set being indexed by autoindex = yes option using the full email > address. Once you've got it working as you require, then you may want to > clean out solr and reindex with just one of them just to reduce volumes. > > Your setup seems to have a mix of users from mysql and from /etc/passwd. > Not sure if your mysql users are all mapped to real users or they have > their own mailboxes with domain included. Your solution will depend on what > you really need and if the setup is working correctly you may not want to > tweak it too much or other things may start breaking. > > The simplest thing that comes to mind (providing your manually indexed > mails show up in roundcube searches) is just to turn off autoindex and > schedule indexing from cron. As things stand I believe autoindex works well > with virtual users username@domain. You'll probably need to start off > with a rescan if you do this. > > If you can swith to all virtual users without local users then probably > you can use autoindex, but I can understand that may not be possible. For > sure I'd recommend doing it in a test environment first so you can be sure > of the configuration and then look at migrating your existing mailboxes > over to virtual users. > > John > > > > -- Larry Rosenman http://www.lerctr.org/~ler Phone: +1 214-642-9640 (c) E-Mail: larryrtx(a)gmail.com US Mail: 5708 Sabbia Dr, Round Rock, TX 78665-2106 -- Larry Rosenman http://www.lerctr.org/~ler Phone: +1 214-642-9640 (c) E-Mail: larryrtx(a)gmail.com US Mail: 5708 Sabbia Dr, Round Rock, TX 78665-2106

4 11

No CRLF in Pigeonhole's header?
by Wojciech Sychut 15 Apr '19

15 Apr '19

Hello, I have been told on Freenode's #dovecot to ask here. I have Exim 4.92 complaining about "Non-CRLF-terminated header, under CHUNKING: message abandoned" with redirects made by Pigeonhole 0.5.5 (with Dovecot 2.3.5.1). Please find relevant part of the traffic below, and help me determine whether Exim is correct on this. 0x0000: 4500 0954 0000 4000 8006 0000 7f00 0001 E..T..@......... 0x0010: 7f00 0001 6ea2 0019 8982 e279 d090 b820 ....n......y.... 0x0020: 8018 021e 0749 0000 0101 080a c345 2b51 .....I.......E+Q 0x0030: b382 853c 4d41 494c 2046 524f 4d3a 3c72 ...<MAIL.FROM:<r 0x0040: 4073 3066 2e6d 642e 6465 7664 6576 6465 @sxf.md.devdevde 0x0050: 762e 6e65 743e 0d0a 5243 5054 2054 4f3a v.net>..RCPT.TO: 0x0060: 3c63 6f6e 7461 6374 4072 6567 6973 2e74 <contact(a)regis.t 0x0070: 6563 683e 0d0a 4244 4154 2032 3235 3420 ech>..BDAT.2254. 0x0080: 4c41 5354 0d0a 582d 5369 6576 653a 2050 LAST..X-Sieve:.P 0x0090: 6967 656f 6e68 6f6c 6520 5369 6576 6520 igeonhole.Sieve. 0x00a0: 302e 352e 3520 2832 3438 3362 3038 3529 0.5.5.(2483b085) 0x00b0: 0a58 2d53 6965 7665 2d52 6564 6972 6563 .X-Sieve-Redirec 0x00c0: 7465 642d 4672 6f6d 3a20 7240 7330 662e ted-From:.r@sxf. With Dovecot 2.2.36 + Pigeonhole 0.4.24.1 and required minimum of version-related configuration changes - redirection works properly. Related Exim code fragment: https://github.com/Exim/exim/blob/master/src/src/receive.c#L2222 Thank you, -- Wojtek Sychut

2 1

rsync sdbox, no new mails?
by Jakob Curdes 15 Apr '19

15 Apr '19

Hello, I had to restore a mailserver from a backup to replace a system with problems that is still live. I did a 1:1 restore as far as possible from a backup, then rsynced the /var/vmail/ directory, where we have all the mailboxes, in sdbox format. So both directories should be the same. After syncing, I started dovecot. I can see the mails until to the point of the backup, but not the newer ones ,although they seem to be present in the "cur" directory. I thought with sdbox it is all in the index files that have been transferred with the mails? Or am I missing a place that has to be synced? Thank you for hints, Jakob

2 2

LDAP iterate (dovecoc 2.2.27)
by Debreczeni Attila 15 Apr '19

15 Apr '19

Dear Dovecot Team, We would like to use the LDAP iterate for dovecot replication, but I got this error: dovecot: auth-worker(10149): Error: ldap(*): ldap_search(base=ou=mail,o=asd,c=TLD filter=(objectClass=inetMailUser) failed: Size limit exceeded dovecot: replicator: Error: User listing returned failure dovecot: replicator: Error: listing users failed, can't replicate existing data When I check the "doveadm replicator status": ... Total number of known users 1200 But we have more than 10.000 users. When I run the ldapsearch manually, I get the full list of the mail addresses. Who can I fix it? Thank you, Attila # dovecot --version 2.2.27 (c0f36b0) # dovecot -n | filtered # 2.2.27 (c0f36b0): /etc/dovecot/dovecot.conf # Pigeonhole version 0.4.16 (fed8554) # OS: Linux 4.9.0-6-amd64 x86_64 Debian 9.8 auth_worker_max_count = 150 default_vsz_limit = 512 M doveadm_password = # hidden, use -P to show it doveadm_port = *** mail_gid = vmail mail_plugins = " quota notify replication" namespace inbox { ... } passdb { args = /etc/dovecot/dovecot-ldap.conf.ext driver = ldap } plugin { mail_replica = tcp:REMOTE_IP } replication_dsync_parameters = -d -N -1 -l 30 -U service aggregator { fifo_listener replication-notify-fifo { user = vmail } unix_listener replication-notify { user = vmail } } service auth { inet_listener { address = LOCAL_IP port = LOCAL_PORT } unix_listener auth-userdb { group = vmail mode = 0600 user = vmail } } service dict { unix_listener dict { group = vmail mode = 0600 user = vmail } } service lmtp { inet_listener lmtp { address = LOCAL_IP port = LOCAL_PORT } } service replicator { process_min_avail = 1 unix_listener replicator-doveadm { mode = 0600 } } userdb { args = /etc/dovecot/dovecot-domain-ldap.conf.ext driver = ldap result_success = continue-ok } userdb { args = /etc/dovecot/dovecot-ldap.conf.ext driver = ldap result_failure = return-fail } protocol imap { ... } protocol pop3 { ... } # grep -v '^ *$#.*$\?$' dovecot-ldap.conf.ext uris = ldaps://ldap.URL dn = uid=auth,o=domain,c=TLD dnpass = **** sasl_bind = no tls_ca_cert_dir = /etc/ssl/certs tls_require_cert = demand ldap_version = 3 base = ou=mail,o=asd,c=TLD deref = never scope = subtree user_attrs = =home=/dev/null/%Ld/%L{ldap:uid}, mailQuota=quota_rule=*:bytes=%$ user_filter = (objectClass=inetMailUser) pass_attrs = userPassword=password pass_filter = (objectClass=inetMailUser) iterate_attrs = mail=user iterate_filter = (objectClass=inetMailUser) default_pass_scheme = PLAIN

1 0

LDAP iterate (dovecoc 2.2.27)
by Debreczeni Attila 15 Apr '19

15 Apr '19

Dear Dovecot Team, We would like to use the LDAP iterate for dovecot replication, but I got this error: dovecot: auth-worker(10149): Error: ldap(*): ldap_search(base=ou=mail,o=asd,c=TLD filter=(objectClass=inetMailUser) failed: Size limit exceeded dovecot: replicator: Error: User listing returned failure dovecot: replicator: Error: listing users failed, can't replicate existing data When I check the "doveadm replicator status": ... Total number of known users 1200 But we have more than 10.000 users. When I run the ldapsearch manually, I get the full list of the mail addresses. Who can I fix it? Thank you, Attila # dovecot --version 2.2.27 (c0f36b0) # dovecot -n | filtered # 2.2.27 (c0f36b0): /etc/dovecot/dovecot.conf # Pigeonhole version 0.4.16 (fed8554) # OS: Linux 4.9.0-6-amd64 x86_64 Debian 9.8 auth_worker_max_count = 150 default_vsz_limit = 512 M doveadm_password = # hidden, use -P to show it doveadm_port = *** mail_gid = vmail mail_plugins = " quota notify replication" namespace inbox { ... } passdb { args = /etc/dovecot/dovecot-ldap.conf.ext driver = ldap } plugin { mail_replica = tcp:REMOTE_IP } replication_dsync_parameters = -d -N -1 -l 30 -U service aggregator { fifo_listener replication-notify-fifo { user = vmail } unix_listener replication-notify { user = vmail } } service auth { inet_listener { address = LOCAL_IP port = LOCAL_PORT } unix_listener auth-userdb { group = vmail mode = 0600 user = vmail } } service dict { unix_listener dict { group = vmail mode = 0600 user = vmail } } service lmtp { inet_listener lmtp { address = LOCAL_IP port = LOCAL_PORT } } service replicator { process_min_avail = 1 unix_listener replicator-doveadm { mode = 0600 } } userdb { args = /etc/dovecot/dovecot-domain-ldap.conf.ext driver = ldap result_success = continue-ok } userdb { args = /etc/dovecot/dovecot-ldap.conf.ext driver = ldap result_failure = return-fail } protocol imap { ... } protocol pop3 { ... } # grep -v '^ *$#.*$\?$' dovecot-ldap.conf.ext uris = ldaps://ldap.URL dn = uid=auth,o=domain,c=TLD dnpass = **** sasl_bind = no tls_ca_cert_dir = /etc/ssl/certs tls_require_cert = demand ldap_version = 3 base = ou=mail,o=asd,c=TLD deref = never scope = subtree user_attrs = =home=/dev/null/%Ld/%L{ldap:uid}, mailQuota=quota_rule=*:bytes=%$ user_filter = (objectClass=inetMailUser) pass_attrs = userPassword=password pass_filter = (objectClass=inetMailUser) iterate_attrs = mail=user iterate_filter = (objectClass=inetMailUser) default_pass_scheme = PLAIN

1 0

Re: SOLR/Index?
by Larry Rosenman 15 Apr '19

15 Apr '19

full solr.log at: https://www.lerctr.org/~ler/solr.log The search DOES make it to SOLR: ⌂77% [ler@thebighonker.lerctr.org:~] 130 $ grep sysutils /var/log/solr/solr.log 2019-04-14 18:31:34.749 INFO (qtp349420578-7538) [ x:dovecot] o.a.s.c.S.Request [dovecot] webapp=/solr path=/select params={q={!lucene+q.op%3DAND}(hdr:sysutils\/+OR+body:sysutils\/)&fl=uid,score&sort=uid+asc&fq=%2Bbox:8097632f69627b5b58950000bbe98eac+%2Buser:ler&rows=22644&wt=xml} hits=0 status=0 QTime=460 Pick showing subjects: https://www.lerctr.org/~ler/sysutils_mail.png What else? I'm happy to provide access. -- Larry Rosenman http://www.lerctr.org/~ler Phone: +1 214-642-9640 (c) E-Mail: larryrtx(a)gmail.com US Mail: 5708 Sabbia Dr, Round Rock, TX 78665-2106

3 11

SOLR/Index?
by Larry Rosenman 15 Apr '19

15 Apr '19

Given all the discussion on FTS/Solr, etc, I have a question: I have autoindex set, and searching in roundcube most of the time does NOT find things, HOWEVER if I do: doveadm fts rescan doveadm index I can find things in the mailboxes. WHY? (doveconf -n attached). -- Larry Rosenman http://www.lerctr.org/~ler Phone: +1 214-642-9640 (c) E-Mail: larryrtx(a)gmail.com US Mail: 5708 Sabbia Dr, Round Rock, TX 78665-2106

2 1

Re: dovecot Digest, Vol 192, Issue 52
by Peter Mogensen 15 Apr '19

15 Apr '19

On 4/14/19 4:04 PM, dovecot-request(a)dovecot.org wrote: >> Solr ships with autoCommit set to 15 seconds and openSearcher set to >> false on the autoCommit.? The autoSoftCommit setting is not enabled by >> default, but depending on how the index was created, Solr might try to >> set autoSoftCommit to 3 seconds ... which is WAY too short. I just run with the default. 15s autoCommit and no autoSoftCommit >> This thread says that dovecot is sending explicit commits.? I see explicit /update req. with softCommit and waitSearcer=true in a tcpdump. >> One thing >> that might be happening to exceed 60 seconds is an extremely long >> commit, which is usually caused by excessive cache autowarming, but >> might be related to insufficient memory.? The max heap setting on an >> out-of-the-box Solr install (5.0 and later) is 512MB.? That's VERY >> small, and it doesn't take much index data before a much larger heap >> is required. I run with SOLR_JAVA_MEM="-Xmx8g -Xms2g" > I looked into the code (version 2.3.5.1): This is 2.2.35. I haven't checked the source difference to 2.3.x I must admit. > I immagine that one of the reasons dovecot sends softCommits is because > without autoindex active and even if mailboxes are periodically indexed > from cron, the last emails received with be indexed at the moment of the > search.? I expect that dovecot has to because of it's default behavior by only bringing the index up-to-date just before search. So it has towait for the index result to be available if there's been any new mails indexed. > 1) a configurable batch size would enable to tune the number of emails > per request and help stay under the 60 seconds hard coded http request > timeout. A configurable http timeout would be less useful, since this > will potentially run into other timeouts on solr side. Being able to configure it is great. But I don't think it solves much. I recompiled with 100 as batch size and it still ended in timeouts. Then I recompiled with 10min timeout and now I see all the batches completing and their processesing time is mostly between 1 and 2 minutes (so all would have failed). To me it looks like Solr just takes too long time to index. This is no small machine. It's a 20 core Intel(R) Xeon(R) Silver 4114 CPU @ 2.20GHz and for this test it's not doing anything else, so I'm a bit surprised that even with only a few users this takes so long time. /Peter

2 1

Re: Solr connection timeout hardwired to 60s
by Peter Mogensen 15 Apr '19

15 Apr '19

On 4/4/19 6:47 PM, dovecot-request(a)dovecot.org wrote: > For a typical Solr index, 60 seconds is an eternity. Most people aim > for query times of 100 milliseconds or less, and they often achieve > that goal. I'm pretty sure I get these while indexing, not querying. Apr 04 16:44:50 host dovecot[114690]: indexer-worker(me(a)example.com): Error: fts_solr: Indexing failed: Request timed out (Request queued 66.015 secs ago, 1 attempts in 66.005 secs, 63.146 in http ioloop, 0.000 in other ioloops, connected 94.903 secs ago) /Peter

5 8