- dovecot - dovecot.org

question about Mailcrypt plugin
by Daniel Niewerth 14 Sep '19

14 Sep '19

Hi everybody, I have a question about the Dovecot Mailcrypt Plugin. I'm trying to understand what the security of this plugin is based on. The encryption with private and public key and elliptic curves is basically a good thing. But the keys are in the file system together with the encrypted mails. The passwords for the private keys are in the user database. I guess the passwords have to be in plaintext for it to work. Is that true, or did I misunderstand something? Then the encryption would make no sense at all, right? For what purpose was the plugin developed? Can anyone explain this to me? Best regards Daniel

2 2

New to dovecot admin, question about using LDAP for user-specific values
by Gerben Wierda 13 Sep '19

13 Sep '19

I am new to dovecot administration. I’ve read the Wiki but that hasn’t given me the understanding I need. When I query my LDAP (on macOS) on a value for user ‘gerben’, I can get that: dumbledore:~ gerben$ dscl /LDAPv3/127.0.0.1 -read /users/gerben GeneratedUID GeneratedUID: 780D870E-6B00-478E-AB70-3D3307215A82 I would like to use that value in dovecot settings, e.g. something like user_attrs = \ =mail=maildir://Library/Server/Mail/Data/mail/%{ldap:GeneratedUID} Is this possible and if so what do I exactly need to do to get this working? Gerben Wierda Chess and the Art of Enterprise Architecture <https://ea.rna.nl/the-book/> Mastering ArchiMate <https://ea.rna.nl/the-book-edition-iii/> Architecture for Real Enterprises <https://www.infoworld.com/blog/architecture-for-real-enterprises/> at InfoWorld On Slippery Ice <https://eapj.org/on-slippery-ice/> at EAPJ

2 4

Multiple certificate option
by remo＠Mattei.org 13 Sep '19

13 Sep '19

What is the best way to adopt multiple certs? Thanks.

8 9

keywords lost when moving a message in a folder
by wouldsmina 13 Sep '19

13 Sep '19

Hi, I migrate my dovecot server from Debian 9 to Debian 10 (Dovecot 2.3.4.1), since when I move a message in a folder, keywords systematically disappear. I'm using Thunderbird 60.8. Would an option have escaped me? or is there a bug on this version of dovecot? Dovecot 2.3.4.1 OS : Debian 10.0 x64 FS : Ext4 dovecot -n result : # 2.3.4.1 (f79e8e7e4): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.4 () # OS: Linux 4.19.0-5-amd64 x86_64 Debian 10.0 # Hostname: suzuki.domain.tld auth_cache_size = 1 k auth_failure_delay = 3 secs base_dir = /var/run/dovecot/ default_vsz_limit = 4 G first_valid_uid = 100 lda_mailbox_autocreate = yes lda_mailbox_autosubscribe = yes login_greeting = mail system ready. login_trusted_networks = 172.16.0.0/12 192.168.0.0/16 mail_fsync = always mail_location = mbox:~/mail:INBOX=/var/mail/%u mail_prefetch_count = 20 mail_privileged_group = mail mailbox_idle_check_interval = 1 mins mmap_disable = yes namespace inbox { inbox = yes location = maildir:~/Maildir mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = INBOX. separator = . subscriptions = yes type = private } passdb { driver = pam } plugin { acl_shared_dict = file:/var/lib/dovecot/shared-mailboxes sieve = ~/sieve/.dovecot.sieve sieve_after = /etc/dovecot/sieve.after sieve_before = /etc/dovecot/sieve.before sieve_before2 = ~/sieve/.dovecot.vacation.sieve sieve_dir = ~/sieve sieve_editheader_forbid_add = X-Verified sieve_editheader_forbid_delete = X-Verified X-Seen sieve_editheader_max_header_size = 1k sieve_extensions = +editheader sieve_max_script_size = 2M } postmaster_address = postmaster(a)domain.tld protocols = " imap lmtp pop3" service auth-worker { process_min_avail = 6 service_count = 0 } service imap-login { process_min_avail = 10 service_count = 0 vsz_limit = 4 G } service imap { process_limit = 4096 vsz_limit = 4 G } service pop3 { process_limit = 1024 } ssl_cert = </etc/ssl/certs/suzuki.crt ssl_dh = # hidden, use -P to show it ssl_key = # hidden, use -P to show it userdb { driver = passwd } verbose_proctitle = yes protocol imap { mail_max_userip_connections = 25 } thanks.

2 2

Outlook 2019 and IMAP
by John Regan 12 Sep '19

12 Sep '19

Hi, We've just upgraded a few of our desktops to use Outlook 2019, and the configuration is different from previous versions. There doesn't appear to be any ability to specify a username in addition to the user's email address. The username is different than the username specified in the email address. I had read about setting auth_username_format, but the user login name is "user" while the email address is user.name(a)company.com. I've included below my dovecot -n config. # 2.3.7.2 (3c910f64b): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.7.2 (7372921a) # OS: Linux 5.1.16-300.fc30.x86_64 x86_64 Fedora release 30 (Thirty) # Hostname: orion.inside.example.com mail_gid = mail mail_home = mail/ mail_location = mbox:~/mail:INBOX=/var/spool/mail/%u mail_max_userip_connections = 500 mail_plugins = " listescape" mail_privileged_group = mail managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational rege x imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext mbox_write_locks = fcntl namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } passdb { driver = pam } passdb { driver = pam } protocols = imap pop3 service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0660 user = postfix } } service imap-login { inet_listener imap { port = 0 } inet_listener imaps { port = 993 } process_min_avail = 6 service_count = 0 vsz_limit = 512 M } service pop3-login { inet_listener pop3 { port = 0 } inet_listener pop3s { address = 192.168.1.100 port = 995 } } ssl_cert = </etc/letsencrypt/fullchain.pem ssl_cipher_list = ALL:!LOW:!EXP:!aNULL:!RC4::!eNULL:!LOW:!3DES:!MD5:!EXP:!PSK:!SRP:!DSS ssl_dh = # hidden, use -P to show it ssl_key = # hidden, use -P to show it ssl_prefer_server_ciphers = yes userdb { driver = passwd } userdb { driver = passwd }

2 1

Re: Gnu sieve vs Dovecot sieve-filter - sieve-filter extremely slow at lda (writing emails to local mbox files)
by Zenaan Harkness 12 Sep '19

12 Sep '19

I am wondering why sieve-filter is so slow compared to gnu sieve. I run mpop (like getmail) to download from a pop3 server to a local mbox file: ~/mail/email-incoming-unsorted This step is very fast. The next step, I throw the email-incoming-unsorted mbox file at a sieve processor, to sort the emails from that mbox, into other mboxes, according to the sieve rules file. Up until a couple days ago I was using Gnu sieve. Gnu sieve balks on emails which have no x-message-id (?? something like this) header field, so after a few years, I finally decided to switch "up" to Dovecot/Pigeonhole's "sieve-filter" command. Using Gnu sieve, this mbox sorting step was even faster than mpop (/ getmail) - and mpop and getmail are really fast (compared with fetchmail), since they pipeline the email downloads. Even with 100s of emails, Gnu sieve would take only 10 to 20 seconds at most. Super fast. Using sieve-filter, all emails are being processed - including those without "message id header". This is good. But also, using sieve filter, is really slower - slower than the download step by an order of magnitude or two. See below for details, any ideas appreciated. To add to the below, I added: mbox_very_dirty_syncs = yes to the sieve-filter config, which slightly improves performance, but not by much (in comparison with Gnu sieve). TIA, ----- Forwarded message from Zenaan Harkness <zenaan(a)freedbms.net> ----- From: Zenaan Harkness <zenaan(a)freedbms.net> To: debian-user(a)lists.debian.org Date: Thu, 12 Sep 2019 08:06:12 +1000 Subject: Re: Gnu sieve vs Dovecot sieve-filter - sieve-filter extremely slow at lda (writing emails to local mbox files) On Thu, Sep 12, 2019 at 07:55:23AM +1000, Zenaan Harkness wrote: > Why is Gnu sieve so extremely fast to batch process an mbox file, but > while Dovecot's sieve-filter is an order of magnitude slower? > > Sequence: > > - mpop or getmail to pipeline download emails into temp mbox file > - filter that file > > Gnu sieve just flies through a local mbox file and saving emails to > other local mbox files. > > Gnu sieve rejects too many emails with "malformed" errors, so after a > few years I bit the bullet and upgraded to Dovecot's sieve-filter. > > Dovecot's sieve-filter, at present, is an order of magnitude slower. > > Here's my filter command (one line): > > /usr/bin/sieve-filter -veW -c $HOME/etc/email/sieve-dovecot-config.conf -o mail_location=mbox:~/mail:INBOX=~/mail/Inbox:INDEX=:UTF-8:VOLATILEDIR=/tmp/dovecot-volatile/%2.256Nu/%u:SUBSCRIPTIONS=dovecot_subscriptions ~/etc/email/sieve.rc email-incoming-unsorted > > The sieve script is fine now that I have the correct "require" > clauses (hint: "capability strings"). > > File ~/etc/email/sieve-dovecot-config.conf: > > protocols = pop > lda_mailbox_autocreate = yes > lda_mailbox_autosubscribe = yes > mail_fsync = never > > There's no re-sending of emails into my local Postfix SMTP server - I > checked the system logs and confirmed this (journalctl -f). > > I suspect that Gnu sieve was directly writing each email to the > appropriate sieve-determined mbox file (perhaps with only a sync at > the end of a single batch process - what I've attempted to achieve > above with sieve-filter), and that sieve-filter is instead passing > each email through some (dovecot) lda? > > Here's the output for a sieve-filter batch processing of 11 emails: > > $ /usr/bin/sieve-filter -veW -c /home/zen/etc/email/sieve-dovecot-config.conf -o mail_location=mbox:/home/zen/mail:INBOX=/home/zen/mail/Inbox:INDEX=:UTF-8:VOLATILEDIR=/tmp/dovecot-volatile/%2.256Nu/%u:SUBSCRIPTIONS=dovecot_subscriptions /home/zen/etc/email/sieve.rc email-incoming-unsorted > # PS0 Timestamp: 20190912@07:02:23 > info: filtering: [Tue, 3 Sep 2019 05:17:16 -0500; 10240 bytes] `Re: VentureBeat: The death of disk? H...'. > info: msgid=<CAMjeLr91T9R7APsuxQVuM3WbqDsxAfwn4=OYDeDX4FMcoRdGdQ(a)mail.gmail.com>: stored mail into mailbox 'l/cp/cp'. > info: message expunged from source mailbox upon successful move. > info: filtering: [Tue, 3 Sep 2019 07:29:53 -0400; 12968 bytes] `[zfs-devel] xattr naming format in Zo...'. > info: msgid=<15675101930.d5ba2E.12322(a)composer.zfsonlinux.topicbox.com>: stored mail into mailbox 'l/z/zdev'. > info: message expunged from source mailbox upon successful move. > info: filtering: [Tue, 03 Sep 2019 15:29:09 +0300; 20461 bytes] `Re: [zfs-devel] xattr naming format i...'. > info: msgid=<23955051567513749(a)sas1-02732547ccc0.qloud-c.yandex.net>: stored mail into mailbox 'l/z/zdev'. > info: message expunged from source mailbox upon successful move. > info: filtering: [Tue, 3 Sep 2019 18:20:42 +0530; 18065 bytes] `Re: [Gluster-users] Issues with Geo-r...'. > info: msgid=<CADmkyZMxrfOANrAP+_URAHJcMqCqh=iGdajTSzkfQ5PCZsUfyg(a)mail.gmail.com>: stored mail into mailbox 'l/gl/user'. > info: message expunged from source mailbox upon successful move. > info: filtering: [Tue, 3 Sep 2019 09:34:20 -0400; 13342 bytes] `Re: tasksel'. > info: msgid=<20190903133420.GS6166(a)eeg.ccf.org>: stored mail into mailbox 'l/deb/user'. > info: message expunged from source mailbox upon successful move. > info: filtering: [Tue, 3 Sep 2019 06:56:07 -0700 (PDT); 12390 bytes] `[awx-project] Re: AWX on Kubernetes m...'. > info: msgid=<0715adb7-540f-4cff-9282-e1252c53c2e8(a)googlegroups.com>: stored mail into mailbox 'l/ansible/awx'. > info: message expunged from source mailbox upon successful move. > info: filtering: [Tue, 3 Sep 2019 07:01:27 -0700 (PDT); 12220 bytes] `[awx-project] Re: AWX on Kubernetes m...'. > info: msgid=<949b2c17-4254-49f1-83b4-cd54d15aa17d(a)googlegroups.com>: stored mail into mailbox 'l/ansible/awx'. > info: message expunged from source mailbox upon successful move. > info: filtering: [Tue, 3 Sep 2019 10:14:58 -0400; 25313 bytes] `Re: [zfs-devel] xattr naming format i...'. > info: msgid=<CAB5c7xpHCdFx1w3yA9FyRL-KQ8BUiCr4JbiDQRuFJj9nOgKxTg(a)mail.gmail.com>: stored mail into mailbox 'l/z/zdev'. > info: message expunged from source mailbox upon successful move. > info: filtering: [Tue, 3 Sep 2019 17:10:22 +0200; 7567 bytes] `Re: [asterisk-users] Playing MP3's in...'. > info: msgid=<20190903151022.354xpe6ds2vglher(a)red.localdomain>: stored mail into mailbox 'l/as/users'. > info: message expunged from source mailbox upon successful move. > info: filtering: [Wed, 4 Sep 2019 01:04:49 +0900; 14858 bytes] `Re: [Hyperledger Fabric] a primitive ...'. > info: msgid=<160901d8-b903-9e9a-91ac-267571b0e24d(a)gmx.com>: stored mail into mailbox 'l/hl/fabric'. > info: message expunged from source mailbox upon successful move. > info: filtering: [Tue, 3 Sep 2019 09:55:22 -0700 (PDT); 13337 bytes] `[awx-project] Re: AWX on Kubernetes m...'. > info: msgid=<f9bc4e6a-8445-4b34-927a-35f577ffcc07(a)googlegroups.com>: stored mail into mailbox 'l/ansible/awx'. > info: message expunged from source mailbox upon successful move. > 2 ▶︎️ zen@eye 20190912@07:02:30 ~ $ > > > So about 3/4 of a second is spent by dovecot's sieve-filter, on each > email that it processes - watching it is painful given how fast Gnu > sieve has been for the last few years - it's almost (but not quite) > as slow as my previous fetchmail email download per-email time. > > Attached is a -D debug run of sieve-filter on 20 emails - slightly > longer than the above, and took roughly 15 seconds to run. > > Any help appreciated... On another test run of ~600 emails, sieve-filter is consistently running ~100% of one CPU (for about 4 minutes) to process these emails, which leads to the conclusion that despite what looks like should be a batch process, sieve-filter is perhaps reloading the rules for every single email that it processes, even though I gave it a whole mbox, and not a single email, to process. Can sieve-filter work the way it should / the way I want it / batch process a whole mbox - without reloading the sieve rules for every email? ----- End forwarded message -----

3 2

Re: [Bug] Sieve vacation :addresses match only,> case-sensitive?
by Klaus Steinberger 12 Sep '19

12 Sep '19

> I want to have it case-insensitive again, like in Pigeonhole version 0.4.24 i would also plea for making it case-insensitive again! We were hit by this too, and I never saw any mail system in which the local Part ist Case sensitive! Sincerly, Klaus Steinberger -- Rechnerbetriebsgruppe / IT, Fakultät für Physik Klaus Steinberger FAX: +49 89 28914280 Tel: +49 89 28914287

6 5

WARNING: using attachment_dir with plugin zlib can corrupt mails
by Patrick Cernko 12 Sep '19

12 Sep '19

Hello list, hello Dovecot developers, this week, I discovered a serious bug in Dovecot, that lead to several broken mails on our servers. The bug corrupts the first few characters of the mail header during saving. On our setup, it was almost always only the very first line of text, that was corrupted. Depending on the IMAP client (they seem to request different header fields, ... during mail access), the bug causes the imap process to hang up the TCP connection and log errors like this: > imap(USERNAME)<4767><TeQP4ASOTK5/AAAB>: Error: Corrupted record in index cache file /IMAP/mail/mailboxes/USERNAME/mdbox/mailboxes/Trash/dbox-Mails/dovecot.index.cache: UID 489113: Broken fields in mailbox Trash: read(attachments-connector(zlib(/IMAP/mail/mailboxes/USERNAME/mdbox/storage/m.813))): FETCH BODY[HEADER.FIELDS (RETURN-PATH SUBJECT)] got too little data: 2 vs 122 In our case that finally grabbed my attention, the client was the users iphone that did not display any new messages but his Thunderbird did. The bug seems to be triggered by a bad "interaction" of attachment_dir option and zlib plugin. If you use both, you most likely are affected, too, except you only use zlib plugin for reading previously compressed stored mails. That's also the workaround we use now: zlib plugin only enabled in mail_plugins but no plugin/zlib_save set. The bug occurs on very specific mails. Due to privacy reasons I could not provide sample mails here. Storing such mails seems to trigger the bug reproducible. I attached a very minimal doveconf -n config, that can be used to trigger the bug. If one of the developers is interested, I can try to generate an "anonymized" version of such a specific mail that still causes the issue. I discovered the bug on our productive systems, running latest Dovecot 2.2 release, but the latest 2.3 I used during debugging is affected, too. During debugging, I also found one hint, that might help find the bug: If you store a problematic mail with zlib_save=gz (or zlib_save=bz2) and then disable the zlib plugin in mail_plugins, you can call doveadm fetch -u test hdr all | grep -v ^hdr: | gzip --decompress on test's mailbox with only that one broken mail. This will display the beginning of the rfc822 mail text until gzip terminates with "gzip: stdin: unexpected end of file", approximately after twice the length of the mail HEADER. This might indicate, that dovecot stores the uncompressed size of the header in it's data structures although the mail is stored compressed. I also found a very efficient way to find all affected mails in our setup: doveadm -f flow fetch -A 'user guid mailbox uid seq flags hdr' all | \ grep -a "^[^ ]+ user=" | \ grep -avF ' hdr=Return-path: ' | \ grep -av '.* hdr=[[:print:][:space:]]*$' (runtime for ~6M mails on our servers was 20-30min) This can be even more optimized if you have a powerful storage system with GNU parallel: > doveadm user '*' | parallel "doveadm -f flow fetch -u '{}' 'user guid mailbox uid seq flags hdr' all | grep -a '^user=' | grep -avF ' hdr=Return-path: ' | grep -av '.* hdr=[[:print:][:space:]]*$' || true" (runtime for ~6M mails on our servers was ~4min) The command will give you a list of mails that possibly are affected, check the full output of doveadm fetch -u USERNAME hdr guid GUID | less to verify that the header is really broken. On our systems I found 39 mails within ~12M mails. I was able to recover these mails "manually" by reconstructing the Return-Path header line, importing the fixed mails and expunging the corrupt ones. Before importing, I had to disable zlib_save option obviously. Best regards, -- Patrick Cernko <pcernko(a)mpi-klsb.mpg.de> +49 681 9325 5815 Joint Administration: Information Services and Technology Max-Planck-Institute fuer Informatik & Softwaresysteme

4 4

pigeonhole/lda accessing -m folder
by matthias lay 12 Sep '19

12 Sep '19

Hi all, anybody knows, if there is a way to acces the folder from a call like this deovecot-lda -m destfolder from within a sieve script? thx in advance matze

5 9

Re: Gnu sieve vs Dovecot sieve-filter - sieve-filter extremely slow at lda (writing emails to local mbox files)
by Zenaan Harkness 12 Sep '19

12 Sep '19

(I did subscribe to this mailing list, albeit with zen at freedbms.net, so either way I'm getting all your emails - thank you -so- much for replying...) MUA is mutt, reading email in a terminal (sorry, forgot to mention this before). For many years now my email folder (mbox files) collection has grown to many GiB, mostly mailing lists. If I am to change email storage format, it should be mutt compatible; looking at https://wiki2.dovecot.org/MailboxFormat I see that only DJB's Maildir is compatible with both Dovecot ("a reliable choice" says the wiki), and mutt. I can imagine that sdbox or mdbox could be made "mutt compatible" so to speak, by running some sort of local IMAP server, and accessing my email from mutt that way; this is undesirable to my mind because this would require: 1) a new learning curve wrt mutt and reading email on IMAP servers 2) a new learning curve to set up a local IMAP server (securely) 3) the inability to use mutt without a local IMAP server to read my local email but such a setup would also have some quite desirable benefits: 1) once set up, multiple MUAs could be used, and I'd have a beginning grasp on setting up an IMAP server and front ends (this is something on my bucket list, to assist my local church with) 2) simpler remote "online" access to my local "offline" email store (e.g. using my mobile phone when on the road) by setting up a webmail server (much simpler (read "possible" to use on a mobile phone) than using a vpn and mutt...), thus freeing me up from the behemoth web email providers... Next, I do not know how to "pipe the messages to the dovecot lda". After downloading from my POP3 provider into a local mbox file (this is my step 1), then I sort the emails (this is my step 2): the following should be on a single line: /usr/bin/sieve-filter -veW -c $HOME/etc/email/sieve-dovecot-config.conf -o mail_location=mbox:~/mail:INBOX=~/mail/Inbox:INDEX=:UTF-8:VOLATILEDIR=/tmp/dovecot-volatile/%2.256Nu/%u:SUBSCRIPTIONS=dovecot_subscriptions ~/etc/email/sieve.rc email-incoming-unsorted As you can see from the above command, sieve-filter is given the name of the mbox ("mail folder") to sort, as its very last argument on the command line - so in this instance, sieve-filter really has no excuse, and should be not be re-reading the sieve rules script for each email - now perhaps that's not happening, I only made an assumption because of a CPU hitting 100% for a minute or two just to process a few 100 emails... What could also be happening (again, an assumption), is that sieve-filter is written to assume dovecot index files to be in existence. I disabled those with the "INDEX=" clause you see in the command above, which obviously has been given no value. The reason I figured out how to disable the creation of the indexes in the .imap directories, is that for my setup, Gnu sieve has proven that I should not need such indexes - with mbox files, just append each email to the end of the target "mailbox folder" mbox file, and we're done! This literally should not cost 100% CPU, even for one millisecond! But more importantly, because my working email folder is ~30GiB, without disabling this index creation step, sieve-filter forced the creation of indexes, which "took so long I gave up and hit CTRL-C, which did not work, so I kill -9'ed the sieve-filter and whatever other process was not stopping". Last year someone on debian-user recommended I upgrade to using Dovecot/Pigeonhole's sieve-filter (rather than Gnu sieve) due to the issues with Gnu sieve. I am starting to think that I should perhaps try to figure out if it's possible to (re)process the emails Gnu sieve has a problem with, to massage them into a shape that Gnu sieve accepts - then my immediate problem would certainly be solved... Thank you all again.. Zenaan

1 1

Subscribe to a fileinto :create mailbox?
by Larry Rosenman 11 Sep '19

11 Sep '19

Is it possible in pigeonhole? I.E. I do a fileinto :create "some/mail/box" How can I make it autosubscribe? doveconf -n: # 2.3.7.2 (3c910f64b): /usr/local/etc/dovecot/dovecot.conf # Pigeonhole version 0.5.7.2 (7372921a) # OS: FreeBSD 12.0-STABLE amd64 # Hostname: thebighonker.lerctr.org auth_default_realm = lerctr.org auth_mechanisms = plain login auth_realms = lerctr.org thebighonker.lerctr.org tbh.lerctr.org thejonesonair.com thejonesonair.net why.net default_vsz_limit = 1 G deliver_log_format = msgid=%m: %$ (subject=%s from=%f size=%w) doveadm_password = # hidden, use -P to show it first_valid_gid = 0 first_valid_uid = 0 lda_mailbox_autocreate = yes listen = 192.147.25.65, :: login_access_sockets = tcpwrap mail_attribute_dict = file:%h/mail/.imap/dovecot-mail-attributes mail_location = mbox:~/mail:INBOX=~/mail/INBOX mail_log_prefix = "%s(%u/%p): " mail_plugins = " fts fts_solr notify virtual" mail_privileged_group = mail mail_server_admin = mailto:ler@lerctr.org mail_server_comment = LERCTR Mail Server managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext vacation-seconds editheader mboxmetadata servermetadata vnd.dovecot.debug imapsieve vnd.dovecot.imapsieve namespace archive { hidden = no list = no location = mbox:~/MAIL-ARCHIVE prefix = ARCHIVE/ separator = / } namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox INBOX { auto = create } mailbox SENT { special_use = \Sent } mailbox SPAM { special_use = \Junk } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } mailbox virtual/Flagged { special_use = \Flagged } mailbox virtual/all { special_use = \All } prefix = separator = / } namespace virtual { hidden = no list = yes location = virtual:~/MAIL-VIRTUAL prefix = Virtual/ separator = / } passdb { args = /usr/local/etc/dovecot/dovecot-sql.conf.ext driver = sql } passdb { args = user=%Ln noauthenticate driver = static skip = authenticated } passdb { args = failure_show_msg=yes session=yes max_requests=20 driver = pam override_fields = domain=lerctr.org skip = authenticated } plugin { fts = solr fts_autoindex = yes fts_solr = url=http://thebighonker.lerctr.org:8983/solr/dovecot/ fts_tika = http://localhost:9998/tika/ imapsieve_mailbox1_before = file:/usr/local/share/dovecot-pigeonhole/sieve/report-spam.sieve imapsieve_mailbox1_causes = COPY imapsieve_mailbox1_name = SPAM imapsieve_mailbox2_before = file:/usr/local/share/dovecot-pigeonhole/sieve/report-ham.sieve imapsieve_mailbox2_causes = COPY imapsieve_mailbox2_from = SPAM imapsieve_mailbox2_name = * imapsieve_url = sieve://thebighonker.lerctr.org mail_log_events = delete undelete expunge copy mailbox_delete mailbox_rename flag_change append mail_log_fields = uid box msgid size from subject vsize flags recipient_delimiter = +-_ sieve = ~/.dovecot.sieve sieve_dir = ~/sieve sieve_execute_bin_dir = /usr/local/share/dovecot-pigeonhole/sieve sieve_extensions = +editheader +vacation-seconds +mboxmetadata +servermetadata +vnd.dovecot.debug sieve_global_extensions = +vnd.dovecot.pipe +vnd.dovecot.execute sieve_pipe_bin_dir = /usr/local/share/dovecot-pigeonhole/sieve sieve_plugins = sieve_imapsieve sieve_extprograms } postmaster_address = postmaster(a)lerctr.org protocols = imap pop3 lmtp sieve recipient_delimiter = +-_ service anvil { unix_listener anvil { group = mail mode = 0666 } } service auth { unix_listener auth-client { mode = 0666 } unix_listener auth-master { mode = 0666 } } service doveadm { inet_listener http { port = 8080 ssl = yes } } service indexer-worker { drop_priv_before_exec = yes } service lmtp { inet_listener lmtp { address = 127.0.0.1 port = 24 } } service managesieve-login { inet_listener sieve { port = 4190 } inet_listener sieve_deprecated { port = 2000 } } service stats { unix_listener stats-reader { group = mail mode = 0666 user = } unix_listener stats-writer { group = mail mode = 0666 user = } } service tcpwrap { unix_listener login/tcpwrap { group = $default_login_user mode = 0600 user = $default_login_user } } ssl_cert = </home/ler/letsencrypt-home/*.lerctr.org/fullchain.cer ssl_cipher_list = EECDH+ECDSA+AESGCM:EECDH+aRSA+AESGCM:EECDH+ECDSA+SHA384:EECDH+ECDSA+SHA256:EECDH+aRSA+SHA384:EECDH+aRSA+SHA256:EECDH+AESGCM:EECDH:EDH+AESGCM:EDH+aRSA:HIGH:!MEDIUM:!LOW:!aNULL:!eNULL:!LOW:!RC4:!MD5:!EXP:!PSK:!SRP:!DSS ssl_dh = # hidden, use -P to show it ssl_key = # hidden, use -P to show it userdb { args = /usr/local/etc/dovecot/dovecot-sql.conf.ext driver = sql } userdb { args = username_format=%Ln /etc/passwd driver = passwd-file override_fields = domain=lerctr.org } verbose_proctitle = yes protocol lmtp { mail_plugins = " fts fts_solr notify virtual sieve mail_log" } protocol lda { mail_plugins = " fts fts_solr notify virtual sieve mail_log" } protocol pop3 { mail_plugins = " fts fts_solr notify virtual mail_log" } protocol !doveadm { mail_plugins = " fts fts_solr notify virtual mail_log" } protocol imap { imap_capability = +SPECIAL-USE imap_client_workarounds = tb-extra-mailbox-sep tb-lsub-flags imap_logout_format = in=%i out=%o fhc=%{fetch_hdr_count} fhb=%{fetch_hdr_bytes} fbc=%{fetch_body_count} fbb=%{fetch_body_bytes} del=%{deleted} exp=%{expunged} trash=%{trashed} imap_metadata = yes mail_max_userip_connections = 50 mail_plugins = " fts fts_solr notify virtual mail_log imap_sieve imap_zlib" } -- Larry Rosenman http://www.lerctr.org/~ler Phone: +1 214-642-9640 (c) E-Mail: larryrtx(a)gmail.com US Mail: 5708 Sabbia Dr, Round Rock, TX 78665-2106

2 1

Case sensitive problem for vacation with dovecot lmtp pigeonhole
by kadafax＠gmail.com 11 Sep '19

11 Sep '19

Hi list, This issue was raised here by John Fawcett on 12/02/19 but got no response. So, as I'm facing the same issue, I would like to try again: When using the vacation sieve extension, if I send an email to user.name(a)mydomain.com it will work, but not to User.Name(a)mydomain.com. Is there a way to make the user part case insensitive so that the vacation auto-reply is fired whatever the way user part is written ? doveconf -n output: # 2.3.5.1 (7ec6d0ade): /usr/local/etc/dovecot/dovecot.conf # Pigeonhole version 0.5.5 (2483b085) # OS: Linux 3.10.0-957.5.1.el7.x86_64 x86_64 CentOS Linux release 7.6.1810 (Core) ext4 # Hostname: myserver.mydomain.com auth_master_user_separator = * auth_username_chars = abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ01234567890.-_@* auth_verbose = yes debug_log_path = /var/log/dovecot-debug.log default_client_limit = 10640 default_process_limit = 2128 default_vsz_limit = 0 hostname = mydomain.com info_log_path = /var/log/dovecot.log lda_mailbox_autocreate = yes lda_mailbox_autosubscribe = yes listen = * log_path = /var/log/dovecot-error.log login_greeting = Welcome mail_gid = vmail mail_location = maildir:/var/vmail/%Ln mail_plugins = quota fts fts_lucene mail_uid = vmail managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext namespace inbox { inbox = yes location = maildir:/var/vmail/%Ln mailbox Drafts { auto = subscribe special_use = \Drafts } mailbox Sent { auto = subscribe special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { auto = subscribe special_use = \Trash } prefix = type = private } passdb { args = /usr/local/etc/dovecot/deny-users deny = yes driver = passwd-file } passdb { args = /usr/local/etc/dovecot/master-users driver = passwd-file master = yes pass = yes } passdb { args = /usr/local/etc/dovecot/dovecot-ldap.conf.ext driver = ldap } plugin { fts = lucene fts_autoindex = yes fts_lucene = whitespace_chars=@. quota = maildir:User quota quota_rule = *:storage=30GB quota_rule2 = Trash:storage=+200M quota_warning = storage=95%% quota-warning 95 %u quota_warning2 = storage=80%% quota-warning 80 %u sieve = /var/sieve-scripts/%Ln.sieve sieve_dir = /var/vmail/%Ln/home/sieve } postmaster_address = postmaster(a)mydomain.com protocols = imap pop3 lmtp sieve sieve quota_full_tempfail = yes service auth-worker { user = $default_internal_user } service auth { unix_listener /var/spool/postfix/private/auth { mode = 0777 user = vmail } } service imap-login { inet_listener imaps { port = 993 ssl = yes } process_min_avail = 10 } service imap { process_limit = 2128 } service lmtp { executable = lmtp -L process_min_avail = 15 unix_listener /var/spool/postfix/private/dovecot-lmtp { group = postfix mode = 0600 user = postfix } } service managesieve-login { inet_listener sieve { port = 4190 } } service pop3-login { inet_listener pop3s { port = 995 ssl = yes } } service quota-warning { executable = script /usr/local/bin/quota-warning.sh user = nobody } ssl_cert = </etc/letsencrypt/live/myserver.mydomain.com/fullchain.pem ssl_dh = # hidden, use -P to show it ssl_key = # hidden, use -P to show it userdb { args = /usr/local/etc/dovecot/dovecot-ldap-userdb.conf.ext driver = ldap override_fields = uid=vmail gid=vmail home=/var/vmail/%Ln/home } protocol imap { mail_max_userip_connections = 30 mail_plugins = quota fts fts_lucene imap_quota } protocol lmtp { info_log_path = /var/log/dovecot-lmtp.log log_path = /var/log/dovecot-lmtp-errors.log mail_plugins = quota fts fts_lucene sieve } protocol sieve { mail_max_userip_connections = 20 }

2 2

Quota and maildir does not work with subfolders of INBOX
by Niels Kobschätzki 11 Sep '19

11 Sep '19

Hi, we just upgraded on FreeBSD (11.2-p14) from Dovecot 2.2 to Dovecot 2.3.7.2 and now we have kind of a big problem: the quota-plugin does not work correctly anymore. If a user has a subfolder of the INBOX (like .INBOX.foobar) the quota-calculation does not work anymore. It seems to be arbitrary but users get counted like double and more than they actually have in mails (the number of mails is correct, but the size gets calculated wrongly). The moment I remove those folders, the size gets calculated correctly. Unfortunately those folders are generated by some clients automatically afaik (like .INBOX.Trash) What can we do about that? There were already messages to the list about this in July 2018 but I didn't find any solution https://dovecot.org/pipermail/dovecot/2018-July/112439.html https://dovecot.org/pipermail/dovecot/2018-July/112440.html Niels

3 4

Off-site cloud backup (eg Amazon S3, Wasabi)
by James Brown 11 Sep '19

11 Sep '19

I’d like to synchronise our mail store to an Amazon S3 bucket or similar, for protection from ransomware. Server is running on macOS with maildir. Should I use a Dovecot process, rsync, a Mac app like Arq or Jungle Disk, or something else? Anyone have experience or opinions on this? Thanks, James.

3 2

Random duplicated emails
by Francis 11 Sep '19

11 Sep '19

Hello, I migrated our mail infrastructure to Dovecot on Ubuntu 18.04 some months ago. It works fine, but recently some users told me that they sometime receive duplicated emails. Same email content, same headers including message-id. I'm using two dovecot servers on two sites. Both server are in cluster. We don't use shared folders. All users that reported this issue so far are using the same server instance. The problematic emails are coming from local users on that instance too. The examples they given to me was emails with many recipients (To/CC). A specific message can be received twice (or more) by recipient A but only once by recipient B. I didn't see anything in the logs about sieve rules that redirect emails to others recipients. Where should I look to diagnostic this issue? Thanks. Server config: # 2.2.33.2 (d6601f4ec): /etc/dovecot/dovecot.conf # Pigeonhole version 0.4.21 (92477967) doveconf: Warning: service auth { client_limit=1000 } is lower than required under max. load (2500) doveconf: Warning: service anvil { client_limit=1000 } is lower than required under max. load (1503) # OS: Linux 4.15.0-60-generic x86_64 Ubuntu 18.04.3 LTS auth_default_realm = **edited** auth_master_user_separator = * auth_mechanisms = plain login default_process_limit = 500 first_valid_uid = 200 last_valid_uid = 200 mail_location = mbox:~/mail:INBOX=/var/mail/%u mail_plugins = " notify replication zlib quota" mail_privileged_group = mail managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext vnd.dovecot.debug mdbox_rotate_size = 10 M namespace inbox { inbox = yes location = mailbox "Éléments envoyés" { special_use = \Sent } mailbox "Éléments supprimés" { special_use = \Trash } mailbox Brouillon { special_use = \Drafts } mailbox "Courrier indésirable" { special_use = \Junk } mailbox Drafts { auto = subscribe special_use = \Drafts } mailbox Junk { auto = subscribe special_use = \Junk } mailbox Sent { auto = subscribe special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { auto = subscribe special_use = \Trash } prefix = INBOX/ separator = / } passdb { args = /etc/dovecot/dovecot-ldap.conf.ext driver = ldap } passdb { args = /etc/dovecot/passwd.masterusers driver = passwd-file master = yes } plugin { mail_replica = tcps:**edited**:53683 quota = count:User quota quota_grace = 10%% quota_rule = *:storage=10G quota_rule2 = INBOX/Trash:storage=+100M quota_status_nouser = DUNNO quota_status_overquota = 552 5.2.2 La boite courriel du destinataire est pleine - Mailbox is full quota_status_success = DUNNO quota_vsizes = yes quota_warning = storage=100%% quota-warning 100 %u quota_warning2 = storage=95%% quota-warning 95 %u quota_warning3 = storage=90%% quota-warning 90 %u quota_warning4 = storage=85%% quota-warning 85 %u quota_warning5 = storage=75%% quota-warning 75 %u quota_warning6 = -storage=80%% quota-warning '-80' %u quota_warning7 = -storage=100%% quota-warning '-100' %u sieve = /var/vmail/domains/%Ld/%Ln/.dovecot.sieve sieve_before = /var/vmail/sieve/before.sieve sieve_default = /var/vmail/sieve/default.sieve sieve_extensions = +vnd.dovecot.debug sieve_global = /var/vmail/sieve/global zlib_save = lz4 } protocols = " imap lmtp sieve" service auth { unix_listener /var/spool/postfix/private/auth { mode = 0666 } unix_listener auth-userdb { group = vmail mode = 0666 user = vmail } } service imap-login { inet_listener imap { port = 0 } process_min_avail = 10 } service lmtp { unix_listener /var/spool/postfix/private/dovecot-lmtp { group = postfix mode = 0660 user = postfix } } service quota-status { client_limit = 1 executable = quota-status -p postfix inet_listener { address = **edited** port = 53684 } } service quota-warning { executable = script /usr/local/bin/quota-warning.sh unix_listener quota-warning { user = vmail } } ssl = required ssl_cert = </etc/ssl/**edited**/**edited**.crtbundle ssl_client_ca_dir = /etc/ssl/certs ssl_key = # hidden, use -P to show it userdb { args = /etc/dovecot/dovecot-ldap.conf.ext driver = ldap } protocol lmtp { mail_plugins = " notify replication zlib quota sieve" postmaster_address = postmaster@**edited** } protocol imap { mail_plugins = " notify replication zlib quota imap_zlib imap_quota" } -- Francis

4 4

Dovecot Director upgrade from 2.2 to 2.3
by Alessio Cecchi 10 Sep '19

10 Sep '19

Hi, I have a setup with 3 Dovecot Director v2.2.36 and director_consistent_hashing = yes ;-) Now I would like to upgrade to 2.3.7, first only Director and after also Backend. Can works fine a ring of director with mixed 2.2 and 2.3 version? Mi idea is to setup a new Director server with 2.3, stop one server with 2.2 and insert the new 2.3 in the current ring to check if works fine. If all works fine I will replace all Director 2.2 with 2.3 version. Thanks -- Alessio Cecchi Postmaster @ http://www.qboxmail.it https://www.linkedin.com/in/alessice

2 6

dovecot duplicate emails
by Битус Павел 10 Sep '19

10 Sep '19

Hello. I have problems with duplicate emails when using replication and configured message filters on the client. Looks like when letter comes, it processed by replication and immediately after this processed by filter on client and moved to another folder. When it arrives to slave server into INBOX, it replicated back to master into INBOX and only after that - slave receives MOVE command. The only thing I see in the log is that the letter comes 2 times with same msgid: Sep 10 15:01:31 lmtp(USERNAME(a)DOMAIN.com.ua)<9306><UD3fJJuQd11aJAAA8J4ONg>: Info: sieve: msgid=<f3701949-360e-e15d-3d76-7465f23fb0ba(a)DOMAIN.com.ua>: stored mail into mailbox 'INBOX' Sep 10 15:01:31 indexer-worker(USERNAME(a)DOMAIN.com.ua)<12248><UD3fJJuQd11aJAAA8J4ONg:GEsdNJuQd13YLwAA8J4ONg>: Info: Indexed 1 messages in INBOX (UIDs 55963..55963) Sep 10 15:01:32 imap(USERNAME(a)DOMAIN.com.ua)<9674><zqysnTGSU8tYUeJ+>: Info: copy from INBOX: box=INBOX.Jira, uid=5034, msgid=<f3701949-360e-e15d-3d76-7465f23fb0ba(a)DOMAIN.com.ua>, size=23393 Sep 10 15:01:32 imap(USERNAME(a)DOMAIN.com.ua)<9674><zqysnTGSU8tYUeJ+>: Info: expunge: box=INBOX, uid=55963, msgid=<f3701949-360e-e15d-3d76-7465f23fb0ba(a)DOMAIN.com.ua>, size=23393 Sep 10 15:01:32 indexer-worker(USERNAME(a)DOMAIN.com.ua)<12248><zqysnTGSU8tYUeJ+:oC6vHZyQd13YLwAA8J4ONg>: Info: Indexed 1 messages in INBOX.Jira (UIDs 5034..5034) Sep 10 15:01:33 indexer-worker(USERNAME(a)DOMAIN.com.ua)<12248><pQBKNpuQd13/OgAA8J4ONg:WIrkC52Qd13YLwAA8J4ONg>: Info: Indexed 1 messages in INBOX (UIDs 55964..55964) Sep 10 15:01:33 imap(USERNAME(a)DOMAIN.com.ua)<9674><zqysnTGSU8tYUeJ+>: Info: copy from INBOX: box=INBOX.Jira, uid=5035, msgid=<f3701949-360e-e15d-3d76-7465f23fb0ba(a)DOMAIN.com.ua>, size=23393 Sep 10 15:01:33 imap(USERNAME(a)DOMAIN.com.ua)<9674><zqysnTGSU8tYUeJ+>: Info: expunge: box=INBOX, uid=55964, msgid=<f3701949-360e-e15d-3d76-7465f23fb0ba(a)DOMAIN.com.ua>, size=23393 Sep 10 15:01:34 indexer-worker(USERNAME(a)DOMAIN.com.ua)<9417><zqysnTGSU8tYUeJ+:gKqSOJ2Qd13JJAAA8J4ONg>: Info: Indexed 1 messages in INBOX.Jira (UIDs 5035..5035) Can you help me with this problem? dovecot --version 2.3.7.2 (3c910f64b) dovecot -n # 2.3.7.2 (3c910f64b): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.7.2 (7372921a) # OS: Linux 4.19.66-gentoo x86_64 Gentoo Base System release 2.6 # Hostname: leon.DOMAIN.com.ua auth_cache_negative_ttl = 30 secs auth_cache_size = 256 M auth_cache_verify_password_with_worker = yes auth_gssapi_hostname = $ALL auth_krb5_keytab = /etc/krb5.keytab auth_mechanisms = gssapi ntlm plain login cram-md5 digest-md5 auth_worker_max_count = 2048 debug_log_path = /var/log/dovecot/dovecot_debug.log default_client_limit = 8492 default_vsz_limit = 2 G dict { lastlogin = mysql:/etc/dovecot/dovecot-dict-sql-lastlogin.conf } doveadm_password = # hidden, use -P to show it first_valid_uid = 8 imap_client_workarounds = delay-newmail tb-extra-mailbox-sep tb-lsub-flags listen = * log_path = /var/log/dovecot/dovecot.log mail_attribute_dict = file:%h/Maildir/dovecot-attributes mail_fsync = never mail_gid = mail mail_location = maildir:%h mail_max_keyword_length = 4096 mail_plugins = " notify replication zlib fts fts_solr mail_log notify" mail_uid = mail maildir_stat_dirs = yes managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext mbox_lazy_writes = no metric imap_commands { event_name = imap_command_finished } namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { auto = subscribe special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } passdb { args = /etc/dovecot/dovecot-sql.conf.ext driver = sql } passdb { args = /etc/dovecot/dovecot-ldap-people.conf.ext driver = ldap } passdb { args = /etc/dovecot/dovecot-ldap-calendar.conf.ext driver = ldap } plugin { fts = solr fts_autoindex = yes fts_autoindex_max_recent_msgs = 100 fts_solr = url=http://SOLR_IP_ADDRESS:8983/solr/dovecot/ last_login_dict = proxy::lastlogin mail_log_cached_only = yes mail_log_events = delete undelete expunge copy mailbox_delete mailbox_rename mail_log_fields = uid box msgid size mail_replica = tcp:REPLICATE.DOMAIN.com.ua:4092 replication_dsync_parameters = -d -N -l 30 -U replication_full_sync_interval = 7 days sieve = file:~/sieve;active=~/.dovecot.sieve sieve_before = /etc/dovecot/sieve/default.sieve sieve_before2 = /etc/dovecot/sieve/default_spam.sieve zlib_save = gz zlib_save_level = 9 } postmaster_address = root(a)DOMAIN.com.ua protocols = imap pop3 lmtp sieve replication_max_conns = 50 service aggregator { fifo_listener replication-notify-fifo { user = mail } unix_listener replication-notify { user = mail } } service auth { unix_listener auth-client { mode = 0660 user = mail } unix_listener auth-master { mode = 0600 user = mail } unix_listener auth-userdb { mode = 0600 user = mail } } service config { unix_listener config { mode = 0600 user = mail } } service dict { unix_listener dict { group = mail mode = 0600 user = mail } } service doveadm { inet_listener { port = 4092 } } service imap-login { process_min_avail = 8 service_count = 0 vsz_limit = 256 M } service imap { client_limit = 10 process_limit = 4096 process_min_avail = 50 service_count = 100 } service lmtp { process_limit = 70 process_min_avail = 20 } service managesieve-login { inet_listener sieve { port = 4190 } } service pop3-login { inet_listener pop3 { port = 0 } inet_listener pop3s { port = 0 } } service replicator { process_min_avail = 1 unix_listener replicator-doveadm { group = mail mode = 0660 } vsz_limit = 20 G } ssl_cert = </etc/ssl/my_certs/fullchain1.pem ssl_dh = # hidden, use -P to show it ssl_key = # hidden, use -P to show it userdb { args = /etc/dovecot/dovecot-sql.conf.ext driver = sql } userdb { args = /etc/dovecot/dovecot-ldap-people.conf.ext driver = ldap } userdb { args = uid=mail gid=mail home=/home/DOMAIN.com.ua/%Ln username_format=%Ln(a)DOMAIN.com.ua mail=maildir:/home/DOMAIN.com.ua/%Ln:UTF-8 driver = static } protocol lmtp { auth_username_format = %Lu mail_fsync = optimized mail_plugins = " notify replication zlib fts fts_solr mail_log notify sieve" } protocol lda { mail_fsync = optimized } protocol imap { imap_idle_notify_interval = 5 mins imap_max_line_length = 4 M imap_metadata = yes mail_max_userip_connections = 2048 mail_plugins = " notify replication zlib fts fts_solr mail_log notify fts fts_solr last_login" } protocol sieve { managesieve_max_line_length = 65536 }

1 0

New to dovecot admin, question about testing a dovecot configuration
by Gerben Wierda 10 Sep '19

10 Sep '19

I am new to dovecot administration, not new to postfix administration. When setting up a new postfix/dovecot combo from scratch, can I start with dovecot alone and still be able to test it? E.g. can I address the local delivery agent with some sort of test email? If so, how? I haven’t been able to find it in the wiki. Gerben Wierda Chess and the Art of Enterprise Architecture <https://ea.rna.nl/the-book/> Mastering ArchiMate <https://ea.rna.nl/the-book-edition-iii/> Architecture for Real Enterprises <https://www.infoworld.com/blog/architecture-for-real-enterprises/> at InfoWorld On Slippery Ice <https://eapj.org/on-slippery-ice/> at EAPJ

1 0

Force dovecot-uidlist reset
by Tom Sommer 09 Sep '19

09 Sep '19

Is there a way to force Dovecot to rebuild dovecot-uidlist from zero? It seems deleting all indexes and dovecot-* files followed by "doveadm force-resync" is not enough? It just gets the same UIDs? Perhaps from Maildir filenames? But I would like to reset the uid of all mails. Thanks -- Tom

1 1

doveadm mailbox list
by Daniel Miller 08 Sep '19

08 Sep '19

It's quite likely I'm doing it wrong, but... Given a valid mailbox... doveadm mailbox list -u <username> realmb returns "realmb" doveadm mailbox list -u <username> real* returns "realmb" Seems reasonable. Now, with a non-existent mailbox... doveadm mailbox list -u <username> bogus returns "bogus" doveadm mailbox list -u <username> bogus* returns "" Is this a bug or correct behavior? -- Daniel

2 1

TLS not working with iOS beta?
by Henrik Johansson 08 Sep '19

08 Sep '19

Hi, Have anyone else experienced problems using Dovecot with the mail app in beta releases of iOS/iPadOS 13? TLS is failing for my, it have worked fine for years and I am on the latest Dovecot version now, it works fine with older clients but not with the ones upgraded: Sep 04 19:49:16 imap-login: Debug: SSL: where=0x10, ret=1: before/accept initialization Sep 04 19:49:16 imap-login: Debug: SSL: where=0x2001, ret=1: before/accept initialization Sep 04 19:49:16 imap-login: Debug: SSL: where=0x2002, ret=-1: SSLv2/v3 read client hello A Sep 04 19:49:16 imap-login: Debug: SSL alert: where=0x4008, ret=552: fatal handshake failure Sep 04 19:49:16 imap-login: Debug: SSL: where=0x2002, ret=-1: error Sep 04 19:49:16 imap-login: Debug: SSL: where=0x2002, ret=-1: error Sep 04 19:49:16 imap-login: Debug: SSL error: SSL_accept() failed: error:1408A0C1:SSL routines:ssl3_get_client_hello:no shared cipher Sep 04 19:49:16 imap-login: Debug: SSL: where=0x2002, ret=-1: error Sep 04 19:49:16 imap-login: Debug: SSL error: SSL_accept() failed: error:140800FF:SSL routines:ssl3_accept:unknown state Sep 04 19:49:16 imap-login: Info: Disconnected (no auth attempts in 0 secs): user=<>, rip=11.22.33.44, lip=11.22.33.44, TLS handshaking: SSL_accept() failed: error:140800FF:SSL routines:ssl3_accept:unknown state, session=<lz7m2r2rjPouOvrk> Working client: Sep 04 19:57:58 imap-login: Debug: SSL: where=0x10, ret=1: before/accept initialization Sep 04 19:57:58 imap-login: Debug: SSL: where=0x2001, ret=1: before/accept initialization Sep 04 19:57:58 imap-login: Debug: SSL: where=0x2002, ret=-1: SSLv2/v3 read client hello A Sep 04 19:57:58 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 read client hello A Sep 04 19:57:58 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 write server hello A Sep 04 19:57:58 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 write certificate A Sep 04 19:58:01 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 write key exchange A Sep 04 19:58:01 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 write server done A Sep 04 19:58:01 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 flush data Sep 04 19:58:01 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 read client certificate A Sep 04 19:58:01 imap-login: Debug: SSL: where=0x2002, ret=-1: SSLv3 read client key exchange A Sep 04 19:58:01 imap-login: Debug: SSL: where=0x2002, ret=-1: SSLv3 read client key exchange A Sep 04 19:58:01 imap-login: Debug: SSL: where=0x2002, ret=-1: SSLv3 read client key exchange A Sep 04 19:58:01 imap-login: Debug: SSL: where=0x2002, ret=-1: SSLv3 read client key exchange A Sep 04 19:58:03 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 read client key exchange A Sep 04 19:58:03 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 read certificate verify A Sep 04 19:58:03 imap-login: Debug: SSL: where=0x2002, ret=-1: SSLv3 read finished A Sep 04 19:58:03 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 read finished A Sep 04 19:58:03 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 write change cipher spec A Sep 04 19:58:03 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 write finished A Sep 04 19:58:03 imap-login: Debug: SSL: where=0x2001, ret=1: SSLv3 flush data Sep 04 19:58:03 imap-login: Debug: SSL: where=0x20, ret=1: SSL negotiation finished successfully Sep 04 19:58:03 imap-login: Debug: SSL: where=0x2002, ret=1: SSL negotiation finished successfully Sep 04 19:58:03 imap-login: Info: Login: user=<username>, method=LOGIN, rip=11.22.33.44, lip=11.22.33.44, mpid=28781, TLS, TLSv1.2 with cipher DHE-RSA-AES256-GCM-SHA384 (256/256 bits), session=<LklR9r2Vtb4uOzra> Config: # egrep -v "^#|^$" 10-ssl.conf 10-auth.conf 10-ssl.conf:ssl = required 10-ssl.conf:ssl_cert = </path/to/fullchain.pem 10-ssl.conf:ssl_key = </path/to/privkey.pem 10-ssl.conf:ssl_dh = </path/to/dh.pem 10-ssl.conf:ssl_min_protocol = TLSv1.1 10-ssl.conf:ssl_cipher_list = ALL:!kRSA:!SRP:!kDHd:!DSS:!aNULL:!eNULL:!EXPORT:!DES:!3DES:!MD5:!PSK:!RC4:!ADH:!LOW@STRENGTH 10-auth.conf:disable_plaintext_auth = yes 10-auth.conf:auth_mechanisms = login 10-auth.conf:!include auth-system.conf.ext # dovecot --version 2.3.7.2 (3c910f64b) Anyone seeing something similar and/or have suggestions on how to proceed? Regards Henrik

4 7

intermittent failures when reuse_port is enabled
by Imre Rad 08 Sep '19

08 Sep '19

I'm encountering connection issues to Dovecot when reuse_port is activated. Some of the connections work fine, but about every 3rd of them does not receive the banner after the TCP connection has established: # nc -v 10.6.7.133 143 Connection to 10.6.7.133 143 port [tcp/imap2] succeeded! * OK [CAPABILITY IMAP4rev1 LITERAL+ SASL-IR LOGIN-REFERRALS ID ENABLE IDLE STARTTLS AUTH=PLAIN AUTH=LOGIN] Hello. ^C # nc -v 10.6.7.133 143 Connection to 10.6.7.133 143 port [tcp/imap2] succeeded! * OK [CAPABILITY IMAP4rev1 LITERAL+ SASL-IR LOGIN-REFERRALS ID ENABLE IDLE STARTTLS AUTH=PLAIN AUTH=LOGIN] Hello. ^C # nc -v 10.6.7.133 143 Connection to 10.6.7.133 143 port [tcp/imap2] succeeded! ^C The relevant processes listening on this port: # netstat -nap|grep 143 tcp 0 0 0.0.0.0:143 0.0.0.0:* LISTEN 15110/dovecot/imap- tcp 0 0 0.0.0.0:143 0.0.0.0:* LISTEN 15103/dovecot/imap- tcp 5 0 0.0.0.0:143 0.0.0.0:* LISTEN 15100/dovecot After removing the reuse_port = yes configuration directive there is only one single process listening (and the service is running without any issues): # netstat -nap|grep 143 tcp 0 0 0.0.0.0:143 0.0.0.0:* LISTEN 15292/dovecot The test config was Linux 4.9.0-4-amd64 on debian-stretch and dovecot-2.2.36.4 (compiled by me) running on a VM with 1 CPU core. If that matters, dovecot was started in a docker container but using the hosts's network namespace. What am I missing? Thanks, Imre

1 0

configure: error: fd passing is required for Dovecot to work
by zahn 06 Sep '19

06 Sep '19

Hello I changed our old gcc compiler from the version: gcc-4.1.2-13.fc6 to the newer one: gcc version 8.3.0 (GCC). Then I wanted to compile: Dovecot 2.3.7 and I get the following error with ./configure CPPFLAGS="-I/usr/local/openssl/include" \ LDFLAGS="-L/usr/local/openssl/lib" \ ./configure --prefix=/usr/local/dovecot \ --disable-static \ --with-ssl=openssl checking whether fd passing works... no configure: error: fd passing is required for Dovecot to work With the old Compiler configure works well. I couldn't find a solution on the Internet - can you help me ? -- Schöne Grüsse aus Oberdiessbach Martin Zahn Akadia AG Martin Zahn Software Ing. HTL Oracle Certificate Professional Information Technology Fichtenweg 10 CH-3672 Oberdiessbach Tel: +41 79 410 27 87 Web: www.akadia.com E-Mail: martin.zahn(a)akadia.com

3 2

Namespace structure
by Daniel Miller 06 Sep '19

06 Sep '19

Is the following "legal" for Dovecot? And...is this separation recommended or a bad idea? Particularly I'm asking about the "archives" namespace - I haven't actually implemented this yet and I'm checking before I break something. 10-mail.conf # Primary private namespace # Using sdbox for storage namespace inbox { type = private separator = / prefix = location = sdbox:/var/mail/%d/%n/sdbox inbox = yes hidden = no list = yes subscriptions = yes } # For long-term archival namespace archives { type = private separator = / prefix = Archives/ location = mdbox:/var/mail/%d/%n/Archives/mdbox subscriptions = no list = children } # Shared mailboxes mail_shared_explicit_inbox = yes namespace usershares { type = shared separator = / prefix = shared/%%n/ location = sdbox:/var/mail/%%d/%%n/sdbox subscriptions = no list = children } # Virtual mailboxes - for server-side searches namespace virtual { prefix = virtual/ separator = / location = virtual:/var/mail/%d/%n/virtual subscriptions = no list = children } -- Daniel

1 0

login failure after upgrade to dovecot 2.3.7.2
by MK 05 Sep '19

05 Sep '19

Hi List, after upgrading dovecot from version 2.2.33.2 to 2.3.7.2 I got a lot of error messages like the following if the process count of imap processes reaches nearly 1000 (~950 (there are a few pop-connections)). Sep 5 11:27:32 mailbox1 dovecot: imap-login: Internal login failure (pid=27728 id=116): user=<xxxx(a)xxxx.xx>, method=PLAIN, rip=x.x.x.x, lip=x.x.x.x, session=<qETa7cqRzpZV3IEw> Sep 5 11:27:33 mailbox1 dovecot: imap-login: Error: master(imap): net_connect_unix(imap) failed: Resource temporarily unavailable - http://wiki2.dovecot.org/SocketUnavailable (client-pid=27704, client-id=79, rip=x.x.x.x, created 511 msecs ago, received 0/4 bytes) Our setup consists of some servers with dovecot as proxy/redirector as frontend servers, redirecting the logged in users to the backend servers storing the mailboxes. OS is CentOS 6 on both server types. The backend server in question has usually ~ 2500 simultaneous imap connections. Before the update there where no problems. During the update I merged the old 2.2 config into the new 2.3 from the fresh installed binary (Repo from dovecot.org) As I found the failure above in the logfile I testet a lot, to figure out how to fix this, because for me it seemed to be some limit around 1000 connections/processes anywhere in the config. In the end I changed the default value of "default_client_limit" from ist default 1000 to 8192 and the problem was fixed for the moment. Now I'm trying to understand why this fixes the problem and what the difference is between 2.2 and 2.3. For me it seems like something changed in the architecture during the release change, but I didn't find anything. I looked into the release notes and also checked the differences beween the 2.2 and 2.3 default config values (using doveconf -d). Can anyone help? Here is the output of doveconf -n # 2.3.7.2 (3c910f64b): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.7.2 (7372921a) # OS: Linux 2.6.32-696.23.1.el6.x86_64 x86_64 CentOS release 6.10 (Final) auth_mechanisms = plain login default_client_limit = 8192 disable_plaintext_auth = no mail_location = mdbox:%h mail_plugins = quota zlib managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } passdb { args = /etc/dovecot/dovecot-sql.conf.ext driver = sql } plugin { quota = dict:User quota::file:%h/dovecot-quota quota_warning = storage=90%% quota-warning 90 %u sieve = file:~/sieve;active=~/.dovecot.sieve zlib_save = gz zlib_save_level = 6 } pop3_client_workarounds = outlook-no-nuls oe-ns-eoh protocols = imap pop3 lmtp sieve service imap-login { process_min_avail = 12 service_count = 0 } service imap { process_limit = 8192 } service lmtp { inet_listener lmtp { address = * port = 24 } } service pop3-login { process_min_avail = 12 service_count = 0 } service pop3 { process_limit = 1024 } service quota-warning { executable = script /scripts/quota.sh unix_listener quota-warning { user = vmail } user = vmail } ssl = no userdb { args = /etc/dovecot/dovecot-sql.conf.ext driver = sql } verbose_proctitle = yes protocol lmtp { mail_plugins = quota zlib sieve } protocol imap { mail_max_userip_connections = 30 mail_plugins = quota zlib imap_quota } protocol pop3 { mail_plugins = quota zlib } greetings, Oliver

1 0

dsync and altpath on shared storage.
by Peter Mogensen 05 Sep '19

05 Sep '19

Hi, I was wondering... If one had mdbox ALT path set to a shared storage mount (say, on NFS) and one wanted to move a mailbox to a different host... I guess it in principle wouldn't be necessary to copy all the ALT storage through dsync, when the volume could just be mounted on the new host. Is there anyway for dsync to avoid moving Gigabytes of data for could just be "moved" by moving the mount? /Peter

2 6

Different passdb backends for different services
by lists＠mlserv.org 05 Sep '19

05 Sep '19

Hi, as Dovecot supports submission, which is the sending direction, I am interested to know, if I can configure a separate passdb backend just for submission. I habe LDAP attributes that differ sending or receiving permissions. It would be nice, if I had a second passdb backend just for submission, which has a LDAP filter for locking this service. Example for IMAP, POP3, Sieve: (&(mail=%s)(mailAllowIncoming=TRUE)) Example for Submission: (&(mail=%s)(mailAllowOutgoing=TRUE)) Use case is to lock compromised accounts that send spam. An operator can notify the account owner by placing a warning messegae into his/her mailbox. Is this possible? Thanks in advance Christian

3 9

Global ACL in SQL or LDAP possible?
by lists＠mlserv.org 04 Sep '19

04 Sep '19

Hi, Can global ACLs for public folders be stored in SQL or LDAP instead of a dovecot-acl file? I could only find something for shared folders, but not for public folders? Thanks in advance Christian

1 1

Server administration
by Aleksandr Mette 04 Sep '19

04 Sep '19

Dear Sirs, There is Postfix+Dovecot+Sogo installation in our company. I have attentively red Installation and Configuration Guide. However, I could not find some information. Could you give me an advise how to: 1. Add/remove e-mail address 2. Change user e-mail address password 3. Add user e-mail address into mail alias 4. Forward e-mail 5. List all users e-mails What is the best GUI interface for Dovecot administration? With kind regards, Alex

9 14

How are imap images supposed to be stored
by d.gentner＠m4ever.de 04 Sep '19

04 Sep '19

Hello. This is a question about the imap protocol, since I am having a hard time finding these things out, so I hope you guys can help me. We are using Dovecot to receive mails and having an issue with Thunderbird. Basically, we are running into this bug with a lot of people: https://bugzilla.mozilla.org/show_bug.cgi?id=216308. <https://bugzilla.mozilla.org/show_bug.cgi?id=216308> The gist of it is, that sometimes, when there is an image linked with the imap:// protocol in the mail, then Thunderbird wants to subscribe to the folder that contains this mail, but fails. If I pull the mail off the server, it also has that link in the raw mail. However, most mails store the images as a base64 code block. I have actually seen mails getting changed over night, from imap:// links to base64 code blocks, but I can't reproduce that. All computers are supposed to have the same Thunderbird version and they do. My questions right now are: * Speaking about the general imap/mail protocol, do mails store images as base64 or imap:// links. What is the standard here? * Is there anything we can do to prevent Thunderbird from running into this bug? We are using Dovecot 2.2.36.4 * What can cause an email getting changed over night or getting synced back with the base64 blocks? It was already read, when we ran into the issue. With best regards, Domeniko Gentner

2 1

Mailcrypt plugin private password
by info＠unkn0wn3d.com 04 Sep '19

04 Sep '19

Hello there, is there a way to make the mailcrypt plugin use the user's password or at least store it in a hashed value? I'm using a passwd file for authentication. I feel uncomfortable saving the private password in plaintext in that file. Regards

2 5

plugin for IMAP protocol to modifie any email
by Matthew Brown 04 Sep '19

04 Sep '19

is there a plugin or anyway I can modifie any email content ? I would like to change body text, headers, attachments

3 3

CVE-2019-11500: Critical vulnerability in Dovecot and Pigeonhole
by Aki Tuomi 04 Sep '19

04 Sep '19

Dear subscribers, we have been made aware of critical vulnerability in Dovecot and Pigeonhole. --- Open-Xchange Security Advisory 2019-08-14 Product: Dovecot Vendor: OX Software GmbH Internal reference: DOV-3278 Vulnerability type: Improper input validation (CWE-20) Vulnerable version: All versions prior to 2.3.7.2 and 2.2.36.4 Vulnerable component: IMAP and ManageSieve protocol parsers (before and after login) Report confidence: Confirmed Solution status: Fixed by Vendor Fixed version: 2.3.7.2, 2.2.36.4 Researcher credits: Nick Roessler and Rafi Rubin, University of Pennsylvania Vendor notification: 2019-04-13 Solution date: 2019-06-05 Public disclosure: 2019-08-28 CVE reference: CVE-2019-11500 CVSS: 8.1 (CVSS3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vulnerability Details: IMAP and ManageSieve protocol parsers do not properly handle NUL byte when scanning data in quoted strings, leading to out of bounds heap memory writes. Risk: This vulnerability allows for out-of-bounds writes to objects stored on the heap up to 8096 bytes in pre-login phase, and 65536 bytes post-login phase, allowing sufficiently skilled attacker to perform complicated attacks that can lead to leaking private information or remote code execution. Abuse of this bug is very difficult to observe, as it does not necessarily cause a crash. Attempts to abuse this bug are not directly evident from logs. Steps to reproduce: This bug is best observed using valgrind to see the out of bounds read with following snippet: perl -e 'print "a id (\"foo\" \"".("x"x1021)."\\A\" \"bar\" \"\000".("x"x1020)."\\A\")\n"' | nc localhost 143 Solution: Operators should update to the latest Patch Release. There is no workaround for the issue. --- Aki Tuomi Open-Xchange oy

8 14

Dovecot and Apple's Mail.app not playing nicely?
by Coy Hile 03 Sep '19

03 Sep '19

Hi all, Is there anything cute one has to take into account when using Dovecot with users of Apple’s Mail.app? Behavior I’m seeing is that if I delete or move messages via Webmail (Roundcube, Horde, or even ActiveSync via Mail.app on my phone), they do get moved or deleted. However, if I take the same actions in the desktop mail client, when logging in to the Webmail (or phone) app, I see the messages still seeming to be in the Inbox. Is this known behavior? A peculiarity in Apple Mail? -- Coy Hile coy.hile(a)coyhile.com

4 5

Re: Re: Quota count and clone questions
by Bratislav ILIC 03 Sep '19

03 Sep '19

Hi, I presume you figured this out after all this time, but in any case. Since quota_clone is not cumulative, it always inserts new record with actual quota, to be able to get correct results in postfixadmin one must: DROP TRIGGER mergequota2 ON quota2; And to prevent ERROR: duplicate key value violates unique constraint "quota2_pkey": CREATE FUNCTION public.clone_quota2() RETURNS trigger LANGUAGE plpgsql AS $$ BEGIN UPDATE quota2 SET bytes = NEW.bytes, messages = NEW.messages WHERE username = NEW.username; IF found THEN RETURN NULL; ELSE RETURN NEW; END IF; END; $$; And then: CREATE TRIGGER clonequota2 BEFORE INSERT ON quota2 FOR EACH ROW EXECUTE PROCEDURE public.clone_quota2() ; And finally just put: quota_clone_dict = proxy::sqlquota Hope this helps somebody trying to figure out this too. > I figured out that I can't just drop maintaining quota2 if I want > postfixadmin to report the quota status. > > I also figured out a way to run a test on my config guesses. I will try > to fit it in today, or tomorrow. But any advise to the questions below > are welcomed! > >>On 2/13/19 8:53 PM, Robert Moskowitz via dovecot wrote: >> all this almost reads like I can drop maintaining the quota2 table? >> >> From https://wiki.dovecot.org/Quota/Count >> >> mailbox_list_index = yes >> # Avoid spending excessive time waiting for the quota calculation to >> finish when >> # mails' vsizes aren't already cached. If this many mails are opened, >> finish the >> # quota calculation on background in indexer-worker process. Mail >> deliveries will >> # be assumed to succeed, and explicit quota lookups will return >> internal error. >> mail_vsize_bg_after_count = 100 >> >> seems to belong in 10-mail.conf. That is where those var are shown. >> >> But: >> >> >> plugin { >> # 10MB quota limit >> quota = count:User quota >> quota_rule = *:storage=10M >> >> # This is required - it uses "virtual sizes" rather than "physical >> sizes" for quota counting: >> quota_vsizes = yes >> } >> >> I am having problems with. Right now for quota I have: >> >> plugin { >> quota = dict:user::proxy::sqlquota >> trash = /etc/dovecot/dovecot-trash.conf.ext >> } >> >> How do I reconcile these two? >> >> Then for clone: https://wiki.dovecot.org/Plugins/QuotaClone >> >> how does: >> >> mail_plugins = $mail_plugins quota quota_clone >> plugin { >> quota_clone_dict = redis:host=127.0.0.1:port=6379 >> } >> >> get replaced with something for mysql? >> >> dovecot-sql.conf.ext: >> >> driver = mysql >> connect = host=/var/lib/mysql/mysql.sock dbname=postfix user=postfix >> password=$Postfix_Database_Password >> default_pass_scheme = $cryptsha-CRYPT >> # following should all be on one line. >> password_query = SELECT username as user, password, >> concat('/home/vmail/', maildir) as userdb_home, >> concat('maildir:/home/vmail/', maildir) as userdb_mail, 101 as >> userdb_uid, 12 as userdb_gid FROM mailbox WHERE username = '%u' AND >> active = '1' >> # following should all be on one line >> user_query = SELECT concat('/home/vmail/', maildir) as home, >> concat('maildir:/home/vmail/', maildir) as mail, 101 AS uid, 12 AS >> gid, CONCAT('*:messages=30000:bytes=', quota) as quota_rule FROM >> mailbox WHERE username = '%u' AND active = '1' >> >> and >> >> dovecot-dict-sql.conf.ext: >> >> connect = host=/var/lib/mysql/mysql.sock dbname=postfix user=postfix >> password=$Postfix_Database_Password >> map { >> pattern = priv/quota/storage >> table = quota2 >> username_field = username >> value_field = bytes >> } >> map { >> pattern = priv/quota/messages >> table = quota2 >> username_field = username >> value_field = messages >> } >> >> >> >> thanks

1 0

Dovecot 2.3.7 - char "-" missing
by Domenico Pastore 03 Sep '19

03 Sep '19

Hello, i have update dovecot from version 2.2.15 to 2.3.7.2. I have a problem with mine java software because there is a different response when open connection to doveadm. I need open socket to doveadm for get imap quota of a mailbox. With version 2.2.15: # telnet 192.160.10.4 924 Trying 192.160.10.4... Connected to 192.160.10.4. Escape character is '^]'. - With version 2.3.7.2: # telnet 192.160.10.3 924 Trying 192.160.10.3... Connected to 192.160.10.3. Escape character is '^]'. The difference is "-" character. The version 2.3.7 not respond with "-" character after opening the connection. Is it possible to add the character again with a parameter? Why did doveadm's answer change? Br Domenico

3 2

Segfault with error 4 in doveadm-server
by holger＠dehnhardt.org 03 Sep '19

03 Sep '19

I set up dovecot on two servers with replication enabled. The replication is over a vpn connection. I get massive segfaults from doveadm-server every few minutes. dmesg: doveadm-server[30030]: segfault at 0 ip 0000557fa16d2e62 sp 00007ffdcaafec50 error 4 in doveadm-server[557fa16a3000+41000] [486397.225636] Code: 40 03 4c 8d 3c c3 48 8d 44 24 18 48 89 44 24 08 0f 1f 84 00 00 00 00 00 49 8b bc 24 60 01 00 00 e8 e3 2a 00 00 48 89 44 24 18 <48> 8b 13 48 8d 35 c4 8d 00 00 48 89 c7 e8 2c 2b 00 00 31 c0 c6 45 mail.err dovecot: doveadm: Fatal: master: service(doveadm): child 29507 killed with signal 11 (core dumps disabled) I am absolutely unaware of how I can come to the cause of this error. Can anyone give me a hint? ----------------------------- Configuration: # 2.2.13: /etc/dovecot/dovecot.conf # OS: Linux 5.1.14-xen x86_64 Debian 8.11 auth_debug = yes disable_plaintext_auth = no doveadm_password = xxxx doveadm_port = 4711 listen = * mail_access_groups = vmail mail_gid = vmail mail_home = /var/vmail/%d/%n mail_location = maildir:~/mail mail_plugins = " notify replication" mail_uid = vmail managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date ihave namespace inbox { inbox = yes location = mailbox Drafts { auto = subscribe special_use = \Drafts } mailbox Junk { auto = subscribe special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox Trash { auto = subscribe special_use = \Trash } prefix = } passdb { args = /etc/dovecot/dovecot-ldap.conf.ext driver = ldap } plugin { mail_log_events = delete undelete expunge copy mailbox_delete mailbox_rename mail_log_fields = uid box msgid size mail_replica = tcp:backup-vpn.local:12345 sieve = ~/.dovecot.sieve sieve_after = ~/sieve/after sieve_before = ~/sieve/before sieve_default = /var/vmail/%d/default.sieve sieve_dir = ~/sieve } protocols = " imap sieve pop3" service aggregator { fifo_listener replication-notify-fifo { mode = 0666 user = vmail } unix_listener replication-notify { mode = 0666 user = vmail } } service auth { unix_listener auth-client { group = vmail mode = 0660 user = vmail } unix_listener auth-userdb { mode = 0666 user = vmail } } service config { unix_listener config { user = vmail } } service doveadm { client_limit = 1 idle_kill = 0 inet_listener { address = master-vpn.local port = 12345 } process_limit = 0 process_min_avail = 0 user = vmail } service replicator { client_limit = 0 drop_priv_before_exec = no idle_kill = 4294967295 secs process_limit = 1 process_min_avail = 0 service_count = 0 unix_listener replicator-doveadm { group = vmail mode = 0666 user = dovecot } vsz_limit = 8 G } ssl_cert = </etc/ssl/certs/xxx.cert ssl_key = </etc/ssl/private/xxx.key userdb { args = /etc/dovecot/dovecot-ldap.conf.ext driver = ldap } protocol sieve { managesieve_implementation_string = Dovecot Pigeonhole managesieve_max_line_length = 65536 } protocol lda { mail_plugins = " notify replication acl sieve" } protocol imap { mail_plugins = " notify replication acl" }

3 6

LMTP Post login script for acl_groups
by lists＠mlserv.org 03 Sep '19

03 Sep '19

Hi, I use a post login script for imap, to fetch acl groups from LDAP. Because Dovecot can only deal with a single value, which must be a comma seperated list of groups, I decided to use a post login script do deal with multi values in LDAP: This looks like this in LDAP: rnsMSACLGroup: admin rnsMSACLGroup: automx rnsMSACLGroup: amavis rnsMSACLGroup: postfix rnsMSACLGroup: dovecot rnsMSACLGroup: rspamd rnsMSACLGroup: powerdns rnsMSACLGroup: sogo rnsMSACLGroup: zabbix rnsMSACLGroup: dane-users rnsMSACLGroup: gentoo rnsMSACLGroup: openbsd My post login script looks like this: --------------------------------------------------------- #!/bin/sh BINDDN='cn=dovecot-postlogin,ou=people,ou=it,dc=roessner-net,dc=de' BINDPWFILE='/etc/dovecot/ldap-postlogin.secret' BASE='ou=people,ou=it,dc=roessner-net,dc=de' LDAPSEARCH="/usr/bin/ldapsearch" AWK="/usr/bin/awk" test -x ${LDAPSEARCH} || exec "$@" test -x ${AWK} || exec "$@" ACL_GROUPS=$( ${LDAPSEARCH} -LLL -ZZ -y ${BINDPWFILE} -xD ${BINDDN} -b ${BASE} "(rnsMSDovecotUser=${USER})" rnsMSACLGroup | \ grep rnsMSACLGroup | \ ${AWK} -vORS=, '{ print $2 }' | \ sed 's/,$/\n/' ) export ACL_GROUPS export USERDB_KEYS="${USERDB_KEYS} acl_groups" exec "$@" --------------------------------------------------------- This script is included in imap-postlogin executables and works for logged in users. But it does not work for LMTP. LMTP itself seems not to have any permissions to access the folders associated with these groups. I thought, I simply could add the imap-postlogin block to lmtp-postlogin and that would work, but it doesn't. So here is the question: What am I missing in Dovecot that LMTP can also have ACL_GROUPS like the imap service? Here is my config (non-defaults): --------------------------------------------------------- doveconf -n # 2.3.7.1 (0152c8b10): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.7.1 (db5c74be) # OS: Linux 4.19.44-gentoo x86_64 Gentoo Base System release 2.6 # Hostname: mx.roessner-net.de auth_cache_size = 64 M auth_master_user_separator = * auth_mechanisms = plain login auth_ssl_username_from_cert = yes auth_verbose = yes default_client_limit = 5000 default_process_limit = 500 default_vsz_limit = 512 M disable_plaintext_auth = no hostname = mail.roessner-net.de imap_client_workarounds = tb-extra-mailbox-sep tb-lsub-flags imap_max_line_length = 4 M lda_mailbox_autocreate = yes lda_mailbox_autosubscribe = yes lmtp_rcpt_check_quota = yes login_log_format_elements = user=<%u> method=%m rip=%r lip=%l mpid=%e %c %k mail_access_groups = vmail mail_attachment_dir = /var/mail/virtual/copymail/attachments mail_gid = vmail mail_location = sdbox:~/sdbox mail_max_keyword_length = 4096 mail_plugins = quota acl fts fts_lucene zlib mail_log notify mail_privileged_group = mail mail_save_crlf = yes mail_uid = vmail managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext vacation-seconds imapsieve vnd.dovecot.imapsieve mdbox_preallocate_space = yes mdbox_rotate_size = 128 M namespace { list = children location = sdbox:%%h/sdbox prefix = Shared/%%u/ separator = / subscriptions = no type = shared } namespace { hidden = no list = children location = maildir:/var/mail/virtual/public:INDEXPVT=~/Maildir/public prefix = Public/ separator = / subscriptions = no type = public } namespace inbox { inbox = yes location = mailbox Archive { auto = subscribe special_use = \Archive } mailbox "Deleted Messages" { special_use = \Trash } mailbox Drafts { auto = subscribe special_use = \Drafts } mailbox Junk-E-Mail { special_use = \Junk } mailbox Junk { auto = subscribe special_use = \Junk } mailbox Sent { auto = subscribe special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { auto = subscribe special_use = \Trash } prefix = separator = / type = private } passdb { args = /etc/dovecot/master-users driver = passwd-file master = yes pass = yes } passdb { args = /etc/dovecot/dovecot-ldap.conf.ext driver = ldap } plugin { acl = vfile:/etc/dovecot/dovecot-acl:cache_secs=300 acl_shared_dict = file:/var/mail/virtual/shared-mailboxes.db fts = lucene fts_autoindex = yes fts_lucene = whitespace_chars=@. imapsieve_mailbox1_before = file:/etc/dovecot/sieve/rspamd.d/report-spam.sieve imapsieve_mailbox1_causes = COPY FLAG imapsieve_mailbox1_name = Junk imapsieve_mailbox2_before = file:/etc/dovecot/sieve/rspamd.d/report-ham.sieve imapsieve_mailbox2_causes = COPY imapsieve_mailbox2_from = Junk imapsieve_mailbox2_name = * mail_log_events = delete undelete expunge copy save mailbox_create mailbox_delete mailbox_rename mail_log_fields = box msgid quota = count:User quota quota_grace = 10%% quota_rule = *:storage=300M:messages=20000 quota_rule2 = Trash:storage=+500M quota_rule3 = Sent:storage=+2G quota_rule4 = Archive:storage=+2G quota_status_nouser = DUNNO quota_status_overquota = 552 5.2.2 Mailbox is full quota_status_success = DUNNO quota_vsizes = yes quota_warning = storage=95%% quota-warning 95 %u quota_warning2 = storage=80%% quota-warning 80 %u quota_warning3 = -storage=100%% quota-warning below %u sieve = file:~/sieve;active=~/.dovecot.sieve sieve_after = /etc/dovecot/sieve/after sieve_before = /etc/dovecot/sieve/before sieve_extensions = +vacation-seconds sieve_global_extensions = +vnd.dovecot.pipe +vnd.dovecot.execute +vnd.dovecot.debug sieve_pipe_bin_dir = /usr/bin sieve_plugins = sieve_imapsieve sieve_extprograms sieve_vacation_default_period = 10d sieve_vacation_max_period = 30d sieve_vacation_min_period = 1h zlib_save = gz zlib_save_level = 6 } protocols = imap pop3 lmtp submission sieve service auth-worker { extra_groups = ssl-cert unix_listener auth-worker { mode = 0600 user = vmail } user = vmail } service auth { extra_groups = ssl-cert unix_listener /var/spool/postfix-submission/private/auth { group = postfix mode = 0666 user = postfix } unix_listener auth-userdb { mode = 0600 user = vmail } user = vmail } service config { unix_listener config { mode = 0600 user = vmail } } service dict { unix_listener dict { mode = 0600 user = vmail } } service imap-login { inet_listener imap { address = 127.0.0.1 134.255.226.248 ::1 2a05:bec0:28:1:134:255:226:248 } inet_listener imaps { port = 0 } } service imap-postlogin { executable = script-login /usr/local/bin/dovecot-masteruser.sh /usr/local/bin/dovecot-lastlogin.sh /usr/local/bin/dovecot-aclgroups.sh user = vmail } service imap { executable = imap imap-postlogin } service lmtp-postlogin { executable = script-login /usr/local/bin/dovecot-aclgroups.sh user = vmail } service lmtp { executable = lmtp lmtp-postlogin inet_listener lmtp { address = 127.0.0.1 port = 24 } unix_listener /var/spool/postfix/private/lmtp-dovecot { group = postfix mode = 0660 user = postfix } } service managesieve-login { inet_listener sieve { address = 127.0.0.1 134.255.226.248 ::1 2a05:bec0:28:1:134:255:226:248 } } service pop3-login { inet_listener pop3 { address = 127.0.0.1 134.255.226.248 ::1 2a05:bec0:28:1:134:255:226:248 } inet_listener pop3s { port = 0 } } service quota-status { client_limit = 1 executable = quota-status -p postfix inet_listener { address = 127.0.0.1 port = 12340 } } service quota-warning { executable = script /usr/local/bin/quota-warning.sh extra_groups = mail unix_listener quota-warning { group = vmail mode = 0600 user = vmail } user = vmail } ssl_cert = </etc/ssl/mail.roessner-net.de/cert/fullchain.pem ssl_cipher_list = ALL:!DH:!kRSA:!SRP:!kDHd:!DSS:!aNULL:!eNULL:!EXPORT:!DES:!3DES:!MD5:!PSK:!RC4:!ADH:!LOW@STRENGTH ssl_client_cert = </etc/ssl/mail.roessner-net.de/cert/fullchain.pem ssl_client_key = # hidden, use -P to show it ssl_dh = # hidden, use -P to show it ssl_key = # hidden, use -P to show it ssl_min_protocol = TLSv1.2 ssl_prefer_server_ciphers = yes submission_client_workarounds = whitespace-before-path submission_relay_host = mail.roessner-net.de submission_relay_port = 5870 submission_relay_ssl = starttls submission_relay_trusted = yes userdb { args = /etc/dovecot/dovecot-ldap-userdb.conf.ext driver = ldap } verbose_proctitle = yes protocol lmtp { mail_plugins = quota acl fts fts_lucene zlib mail_log notify sieve } protocol lda { mail_plugins = quota acl fts fts_lucene zlib mail_log notify sieve } protocol imap { mail_max_userip_connections = 50 mail_plugins = quota acl fts fts_lucene zlib mail_log notify imap_quota imap_acl imap_zlib imap_sieve } protocol submission { login_greeting = ESMTP } --------------------------------------------------------- Thanks for any help in advance Christian

3 15

dovecot 2.2 repo
by Bas van Rooijen 02 Sep '19

02 Sep '19

Hi, >From the v2.2.36.4 announcement message: "Binary packages are available at https://repo.dovecot.org/" My question is, where exactly? There's an instruction at repo.dovecot.org that tells you to replace 'ce-latest-2.3' with 'ce-<version>' but the given url doesn't even contain 'ce-latest-2.3' and http://repo.dovecot.org/ce-2.2.36 returns a 404. Thanks in advance! bvr.

4 3

Experimental docker images
by aki.tuomi＠dovecot.fi 02 Sep '19

02 Sep '19

Hi, you can now find experimental Docker images for dovecot CE releases (starting from 2.3.7.2) from https://hub.docker.com/r/dovecot/dovecot You can find instructions and more details on the repository page. ---- Aki

1 0

Re: Message delivered twice caused by an LMTP error "Got unexpected reply" during upgrade to 2.3
by Gabriele Nencioni 02 Sep '19

02 Sep '19

>>> On 08/09/2018 09:12 AM, Stephan Bosch wrote >>>>>> Can you make a pcap log of the LMTP communication between the two >>>>>> Dovecot hosts? That may give me a clue on which side of the >>>>>> communication is causing the issue. >>>>> Yes sure, where I can send it? >>>>> Here on list or at your address? >>>> >>>> Just send it to me. On 08/16/2018 10:21 AM, Stephan Bosch wrote: > Op 16/08/2018 om 09:46 schreef Gabriele Nencioni: >> On 08/15/2018 06:39 PM, Stephan Bosch wrote: >>> Op 15-8-2018 om 17:19 schreef Stephan Bosch: >>>> >>>> Op 13-8-2018 om 15:50 schreef Gabriele Nencioni: >>>>> So the scenario seems to be: >>>>> the error occurs between old directors and new backends >>>>> and between the new backends and the smtp submission_host (for >>>>> redirection) >>>>> and using the pipeline capability and attaching a file >>>>> >>>>> Let me know if you need more info >>>> In this case it is possible to obtain a debug log by enabling >>>> mail_debug=yes. Can you obtain a full debug log for such a failing >>>> submission session? >> Ok! It is attached. > > That is just weird. Dovecot reports that it cannot fully send the last > bits of the message and right thereafter the reply is received, which > Dovecot then interprets as out-of-sequence. The PCAP files tell me the > final CRLF.CRLF is actually sent to the other side, but somehow Dovecot > thinks it couldn't do that yet. > > Is this problem occurring for any and all SMTP client interactions, or > just every once in a while? Unfortunately it occurs just every once in a while and it is weird because at the second attempt the message is successful delivered or redirected. >>> Also, I don't see anything weird in the PCAP files: the command-reply >>> sequence is OK. This means that this is likely a bug in the current >>> Dovecot version. Those debug logs should tell me more. >> Ok! Which version of dovecot do you suggest to install? >> On debian current stable (stretch) repository there is the version >> number 2.2.27, have we to install it? > > If you're facing big trouble it is usually best to revert to the > previous version that worked I guess. Ok I'm agree! So, about you, which version can I try to install the 2.2.27 or the previous release of the 2.3 version such as v2.3.2 2018-06-29 or v2.3.1 2018-02-29? Regards, -- Gabriele Nencioni System Administrator eml gabriele.nencioni(a)register.it

2 6

purge causing reappearing mails?
by sch tel 02 Sep '19

02 Sep '19

3 3

flags not synced correctly with dovecot sync (dsync)
by Dan Christensen 31 Aug '19

31 Aug '19

I'm running dovecot 2.3.4.1 from https://repo.dovecot.org/ on Ubuntu 18.04 on three machines that I'll call server, laptop1 and laptop2. Both laptop1 and laptop2 run dovecot sync against server to keep local copies of my imap folders. Even when I initially had only two machines, laptop1 and server, I occasionally noticed that flags were lost, usually custom flags used by Gnus, but I couldn't reliably reproduce the problem. Now that I have two laptops syncing against the server, the problem has gotten worse and I figured out a way to reproduce it: - on server: create new IMAP folder test, and put two read messages in it - on laptop1: doveadm sync -u user -l 10 -m test -f user@server - on laptop2: doveadm sync -u user -l 10 -m test -f user@server At this point, all three machines show the two messages M1 and M2 as being read. - on laptop1: mark message M1 unread - on laptop2: mark message M2 unread - on laptop1: doveadm sync -u user -l 10 -m test -f user@server Both laptop1 and server have M1 unread, M2 read, as expected. - on laptop2: doveadm sync -u user -l 10 -m test -f user@server Now laptop2 and server have M1 *read*, M2 unread. - on laptop1: doveadm sync -u user -l 10 -m test -f user@server Now laptop1 and the server have both M1 and M2 *read*. - on laptop2: doveadm sync -u user -l 10 -m test -f user@server Now laptop2 has both read as well. The two lines that say "*read*" are wrong in my opinion. dsync propagated a read mark to an unread message, even though that message was marked unread more recently than it was marked read. I usually use stateful sync, and get many related problems. I just did a test in which M1 and M2 started out read, and I started with empty files named dstate.test on laptop1 and laptop2. Then I did the above procedure, using the command doveadm sync -u user -l 10 -m test -s "`cat dstate.test`" user@server > dstate.test At the end, laptop2 and server had both messages unread (which is good), but laptop1 had only M1 unread, and repeated runs of the sync command did not correct this. So the stateful sync failed to detect a change. Are these bugs in dovecot? Is there more information that I can provide? The output of doveconf -n on one machine is below, and the others are almost identical. Thanks for any help! Dan # 2.3.4.1 (3c0b8769e): /etc/dovecot/dovecot.conf # OS: Linux 4.15.0-45-generic x86_64 Ubuntu 18.04.1 LTS # Hostname: laptop2 auth_mechanisms = plain login listen = 127.0.0.1 mail_index_log2_max_age = 10 days mail_index_log_rotate_min_age = 1 days mail_index_log_rotate_min_size = 300 k mail_location = maildir:~/Maildir namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } passdb { args = scheme=CRYPT username_format=%u /etc/dovecot/users driver = passwd-file } protocols = imap service imap-login { inet_listener imap { address = * port = 143 } inet_listener imaps { address = * port = 943 ssl = yes } } service imap { process_limit = 25 } ssl_cert = </etc/dovecot/private/dovecot.pem ssl_client_ca_dir = /etc/ssl/certs ssl_dh = # hidden, use -P to show it ssl_key = # hidden, use -P to show it userdb { args = username_format=%u /etc/dovecot/users driver = passwd-file } protocol lda { postmaster_address = [elided] } protocol imap { mail_max_userip_connections = 20 }

3 8

Sieve Header question.
by Larry Rosenman 31 Aug '19

31 Aug '19

I'm trying to make my github processing better, but I'm missing something. I have the following: if address :all :contains "from" ["github.com"] { addflag "github"; addflag "MyFlags" "github"; set "mailbox" "GitHub"; if address :matches :user "to" "*" { set "GHUser" "${1}"; addflag "${GHUser}"; addflag "MyFlags" "${GHuser}"; } if header :matches "List-ID" "(.*/.*) <(.*)>" { set "mailbox" "github-lists/${1}"; } fileinto :flags "${MyFlags}" :create "${mailbox}"; stop; } I'm trying to match the apache-incubator-superset part of: List-ID: apache/incubator-superset <incubator-superset.apache.github.com> What am I missing? -- Larry Rosenman http://www.lerctr.org/~ler Phone: +1 214-642-9640 (c) E-Mail: larryrtx(a)gmail.com US Mail: 5708 Sabbia Dr, Round Rock, TX 78665-2106

1 1

problems witch quota working
by Bartłomiej Solarz-Niesłuchowski 30 Aug '19

30 Aug '19

Good evening! Dear list I have problem with quota-fs (rquota) support with dovecot. I use dovecot version: dovecot --version 2.3.7.1 (0152c8b10) build options: dovecot --build-options Build options: ioloop=epoll notify=inotify openssl io_block_size=8192 SQL driver plugins: mysql postgresql sqlite Passdb: checkpassword ldap pam passwd passwd-file shadow sql Userdb: checkpassword ldap(plugin) passwd prefetch passwd-file sql the privatedevices is in service set as no: systemctl show -p PrivateDevices dovecot PrivateDevices=no but quota (rquota on nfsv4) does not work: doveadm quota get -u solarz \doveadm(solarz): Error: Failed to get quota resource STORAGE: quota-fs: quotactl(Q_GETQUOTA, oceanic:/home) failed: No such file or directory Quota name Type Value Limit % User quota STORAGE error error error quota from os works: quota solarz Disk quotas for user solarz (uid 1761): Filesystem blocks quota limit grace files quota limit grace /dev/mapper/vg01-lvol00 1588264 40480000 40480000 12383 0 0 oceanic:/home 76318340 86284030 87416830 561911 1190000 1650000 configuration: # OS: Linux 5.2.9-200.fc30.x86_64 x86_64 Fedora release 30 (Thirty) # Hostname: dervish.wsisiz.edu.pl auth_cache_size = 8 k mail_access_groups = mail mail_fsync = always mail_location = maildir:~/Maildir:INBOX=/var/spool/mail/%u mail_max_userip_connections = 500 mail_nfs_index = yes mail_nfs_storage = yes mail_plugins = acl quota zlib trash mail_privileged_group = mail managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext mbox_write_locks = fcntl mmap_disable = yes namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } passdb { args = /etc/dovecot/deny-users deny = yes driver = passwd-file } passdb { args = cache_key=#hidden_use-P_to_show# max_requests=256 driver = pam } passdb { args = cache_key=#hidden_use-P_to_show# max_requests=256 driver = pam } plugin { quota = fs:User quota quota_grace = 10%% quota_status_nouser = DUNNO quota_status_overquota = 552 5.2.2 Mailbox is full quota_status_success = DUNNO quota_warning = storage=95%% quota-warning 95 %u quota_warning2 = storage=80%% quota-warning 80 %u sieve = file:~/sieve;active=~/.dovecot.sieve } postmaster_address = postmaster(a)wit.edu.pl protocols = imap pop3 service anvil { client_limit = 1155 } service auth { client_limit = 5248 user = root } service imap-login { client_limit = 1024 inet_listener imap { port = 0 } inet_listener imaps { address = [::], * port = 993 } process_limit = 1024 service_count = 0 } service imap { process_limit = 2048 vsz_limit = 512 M } service pop3-login { client_limit = 1024 inet_listener pop3 { port = 0 } inet_listener pop3s { address = [::], * port = 995 } process_limit = 128 service_count = 0 } service pop3 { process_limit = 2048 } service quota-warning { executable = script /usr/local/bin/quota-warning.sh user = dovenull } ssl = required ssl_cert = </etc/pki/tls/certs/ipop3d.pem ssl_cipher_list = PROFILE=SYSTEM ssl_dh = # hidden, use -P to show it ssl_key = # hidden, use -P to show it userdb { driver = passwd } userdb { driver = passwd } protocol imap { imap_client_workarounds = " tb-extra-mailbox-sep" mail_max_userip_connections = 200 mail_plugins = acl quota zlib trash imap_quota ssl_cert = </etc/pki/tls/certs/imapd.pem ssl_key = # hidden, use -P to show it } protocol pop3 { mail_max_userip_connections = 200 pop3_client_workarounds = outlook-no-nuls oe-ns-eoh pop3_uidl_format = %08Xu%08Xv ssl_cert = </etc/pki/tls/certs/ipop3d.pem ssl_key = # hidden, use -P to show it } Thank for any clues. Best Regards -- Bartłomiej Solarz-Niesłuchowski, Administrator WSISiZ e-mail: Bartlomiej.Solarz-Niesluchowski(a)wit.edu.pl tel. 223486547, fax 223486501 JID: solarz(a)jabber.wit.edu.pl 01-447 Warszawa, ul. Newelska 6, pokój 421, pon.-pt. 8-16 Motto - Jak sobie pościelisz tak sie wyśpisz

1 0

doveadm backup mdbox - initial copy slow
by Gerald Galster 30 Aug '19

30 Aug '19

Hello, when calling doveadm backup like in the following example, it seems to flush every email to disk maxing out harddrives (iops) and resulting in very poor performance: Calling doveadm -o plugin/quota= backup -u "statusmails(a)domain.com" "mdbox:/backup/vmail/domain.com/statusmails" finished in 212 secs [changes:1800 copy:1800 delete:0 expunge:0] The source mdbox holds 1800 small emails and uses about 20 MB disk space only. I've tried -f (full sync) and -l 30 (locking the mailbox) which did not get faster, nor did doveadm sync -1. When using doveadm import all mails are copied in less than 3 seconds: time doveadm -o mail=mdbox:/backup/vmail/domain.com/statusmails import mdbox:/var/vmail/domain.com/statusmails "" all real 0m2.605s Are there any other options I could try to speed up doveadm backup, avoiding the flush after each email? This is doveadm from dovecot 2.2 (>= 2.2.33). Does anyone get better results with 2.3 tree? Best regards Gerald

2 2

User / Pass SQL queries
by Michael Hallager 29 Aug '19

29 Aug '19

Hi all, Is there any reason Dovecot shows the 'user' variable (ie: user(a)domain.tld) being obtained in the password query and not the (more logical) user query? Thanks, Michael

2 1

permission issue after yum update
by Voytek Eymont 29 Aug '19

29 Aug '19

I've just updated my dovecot on centos, after 'yum update' dovecot failed to work, with manual restart it worked fine, just giving a warning: # dovecot Warning: Corrected permissions for login directory /var/run/dovecot/token-login dovecot --version 2.3.7.2 (3c910f64b) all's good, just reporting in case this is relevant to rpm maintainers thanks, V

1 0

download Dovecot
by Miquel Demur 29 Aug '19

29 Aug '19

I have downloaded in MacMini MacOS X applications directory the Dovecot.tzr.gz file from Dovecot v2.3.7.2 in https://www.dovecot.org/download I have clicked on dovecot-2.3.7.2 tar.gz and it creates a dovecot-2.3.7.2 directory containung 35 files. https://wiki2.dovecot.org/FrontPage?action=show&redirect=PageD%27Accueil#Do… https://wiki2.dovecot.org/FrontPage?action=show&redirect=PageD%27Accueil#Do… I have to compile to install in Terminal Application? ./configure make sudo make install in https://wiki2.dovecot.org/CompilingSource#Compiling_Dovecot_From_Sources without reference for dovecot.

2 1

Pigeonhole release v0.4.24.2
by Aki Tuomi 29 Aug '19

29 Aug '19

Hi! We are pleased to release Pigeonhole release v0.4.24.2 Tarball is available at https://pigeonhole.dovecot.org/releases/2.2/dovecot-2.2-pigeonhole-0.4.24.2… https://pigeonhole.dovecot.org/releases/2.2/dovecot-2.2-pigeonhole-0.4.24.2… Changes ------- * CVE-2019-11500: ManageSieve protocol parser does not properly handle NUL byte when scanning data in quoted strings, leading to out of bounds heap memory writes. Found by Nick Roessler and Rafi Rubin. --- Aki Tuomi Open-Xchange oy

2 2

Feature wishlist: Allow to hide client IP/host in submission service
by Sebastian Krause 28 Aug '19

28 Aug '19

Hi, In many mail setups a required feature (for privacy reasons) is to hide the host and IP of clients (in the "Received" header) that use the authenticated submission over port 587. In Postfix that's possible (https://serverfault.com/q/413533/86332) but not very nice to configure especially if you only want want to strip the Received header for port 587 submissions, but not on port 25. As far as I can see this configuration is not possible at all in the Dovecot submission server because the function which adds the Received header with the client's IP address (smtp_server_transaction_write_trace_record) is always called in submission-commands.c. It would be very useful if the submission server could anonymize the client with a single configuration option, then all the Postfix configuration mess (and using SASL) could be skipped by simply using the Dovecot submission server instead. The anonymization would work by replacing the client's EHLO host with "submission" and the IP address with 127.0.0.1. In full the Received header would look something like this where the first line is always the same: Received: from submission (unknown [127.0.0.1]) by mail.example.com with ESMTPSA id 8bV9D+51Yl1FOwAA1ctoJQ (envelope-from <john(a)example.com>) for <jane(a)example.com>; Sun, 25 Aug 2019 13:50:06 +0200 Sebastian

4 6

Pigeonhole release v0.5.7.2
by Aki Tuomi 28 Aug '19

28 Aug '19

Hi! We are pleased to release Pigeonhole release v0.5.7.2 Tarball is available at https://pigeonhole.dovecot.org/releases/2.3/dovecot-2.3-pigeonhole-0.5.7.2.… https://pigeonhole.dovecot.org/releases/2.3/dovecot-2.3-pigeonhole-0.5.7.2.… Binary packages are available at https://repo.dovecot.org/ Changes ------- * CVE-2019-11500: ManageSieve protocol parser does not properly handle NUL byte when scanning data in quoted strings, leading to out of bounds heap memory writes. Found by Nick Roessler and Rafi Rubin. --- Aki Tuomi Open-Xchange oy

1 0

Dovecot release v2.2.36.4
by Aki Tuomi 28 Aug '19

28 Aug '19

Hi! We are pleased to release Dovecot release v2.2.36.4 Tarball is available at https://dovecot.org/releases/2.2/dovecot-2.2.36.4.tar.gz https://dovecot.org/releases/2.2/dovecot-2.2.36.4.tar.gz.sig Binary packages are available at https://repo.dovecot.org/ Changes ------- * CVE-2019-11500: IMAP protocol parser does not properly handle NUL byte when scanning data in quoted strings, leading to out of bounds heap memory writes. Found by Nick Roessler and Rafi Rubin. --- Aki Tuomi Open-Xchange oy

1 0

Dovecot release v2.3.7.2
by Aki Tuomi 28 Aug '19

28 Aug '19

Hi! We are pleased to release Dovecot release v2.3.7.2 Tarball is available at https://dovecot.org/releases/2.3/dovecot-2.3.7.2.tar.gz https://dovecot.org/releases/2.3/dovecot-2.3.7.2.tar.gz.sig Binary packages are available at https://repo.dovecot.org/ Changes ------- * CVE-2019-11500: IMAP protocol parser does not properly handle NUL byte when scanning data in quoted strings, leading to out of bounds heap memory writes. Found by Nick Roessler and Rafi Rubin. --- Aki Tuomi Open-Xchange oy

1 0

unsubscrib
by Carlos Xavier 27 Aug '19

27 Aug '19

1 0

Group emails based on custom header
by Giovanni Mancuso 27 Aug '19

27 Aug '19

Hi, Can i "group by" e-mails based on custom header in imap? According to my experience if i use "XX UID SEARCH INTHREAD REFS HEADER myheader myvalue" i receive emails UID gathers by HEADER+VALUE, but in this way i need to fetch all emails using several imap SEARCH. Has dovecot any features that would help me do this? Thank you!!

2 1

doveadm mailbox handling for directory only
by sch tel 27 Aug '19

27 Aug '19

1 1

non-terminating processes
by Randy Bush 26 Aug '19

26 Aug '19

FreeBSD psg.com 11.3-RELEASE-p3 FreeBSD 11.3-RELEASE-p3 dovecot 2.3.6 (7eab80676) (latest from binary package system) symptom: multiple imap4s users complain that they can not fetch mail stopping and restarting dovecot is a temporary workaround dovenull 3713 0.0 0.0 11036 6816 - I 02:27 0:00.17 dovecot/imap-login user19 3714 0.0 0.0 9464 4756 - S 02:27 0:00.46 dovecot/imap dovenull 6261 0.0 0.0 11036 6812 - I 02:47 0:00.12 dovecot/imap-login dovenull 6262 0.0 0.0 11036 6804 - I 02:47 0:00.09 dovecot/imap-login dovenull 6263 0.0 0.0 11036 6804 - I 02:47 0:00.08 dovecot/imap-login user00 6264 0.0 0.0 9476 4924 - S 02:47 0:00.27 dovecot/imap user00 6265 0.0 0.0 9464 5444 - S 02:47 0:00.91 dovecot/imap user1 6266 0.0 0.0 9484 4636 - S 02:47 0:00.16 dovecot/imap dovenull 6277 0.0 0.0 11036 6804 - I 02:47 0:00.08 dovecot/imap-login user1 6279 0.0 0.0 9940 5096 - S 02:47 0:00.69 dovecot/imap dovenull 54595 0.0 0.0 11036 6916 - I 09:24 0:00.04 dovecot/imap-login dovenull 54596 0.0 0.0 11036 6916 - I 09:24 0:00.04 dovecot/imap-login user19 54597 0.0 0.0 9464 4784 - S 09:24 0:00.06 dovecot/imap user19 54598 0.0 0.0 9468 4676 - S 09:24 0:00.05 dovecot/imap dovenull 67450 0.0 0.0 11036 6924 - I 11:13 0:00.05 dovecot/imap-login userid0 67453 0.0 0.0 9488 4844 - S 11:13 0:00.05 dovecot/imap dovecot 68853 0.0 0.0 11484 6920 - S 11:29 0:00.32 dovecot/auth dovenull 74048 0.0 0.0 11036 6916 - I 12:15 0:00.03 dovecot/imap-login user54 74050 0.0 0.0 9552 4944 - I 12:15 0:00.02 dovecot/imap dovenull 74054 0.0 0.0 11036 6916 - I 12:15 0:00.03 dovecot/imap-login user54 74056 0.0 0.0 9492 5152 - I 12:15 0:00.06 dovecot/imap dovenull 74582 0.0 0.0 11036 6932 - S 12:20 0:00.07 dovecot/imap-login user19 74586 0.0 0.0 13572 7632 - S 12:20 0:04.14 dovecot/imap dovenull 74670 0.0 0.0 11036 6932 - S 12:21 0:00.05 dovecot/imap-login user01 74674 0.0 0.0 16768 6500 - S 12:21 0:02.33 dovecot/imap dovenull 74770 0.0 0.0 11036 6932 - S 12:21 0:00.05 dovecot/imap-login user01 74772 0.0 0.0 11500 5756 - S 12:21 0:00.08 dovecot/imap dovenull 74782 0.0 0.0 11036 6932 - I 12:21 0:00.04 dovecot/imap-login user01 74786 0.0 0.0 9460 5516 - I 12:21 0:00.05 dovecot/imap dovenull 74893 0.0 0.0 11036 6936 - I 12:22 0:00.04 dovecot/imap-login id0 74894 0.0 0.0 10644 5552 - S 12:22 0:00.05 dovecot/imap dovenull 74952 0.0 0.0 11036 6928 - I 12:23 0:00.03 dovecot/imap-login id0en 74954 0.0 0.0 9480 4900 - S 12:23 0:00.05 dovecot/imap dovenull 74958 0.0 0.0 11036 6916 - I 12:23 0:00.03 dovecot/imap-login id002 74959 0.0 0.0 9452 4756 - S 12:23 0:00.04 dovecot/imap dovenull 74961 0.0 0.0 11036 6916 - I 12:23 0:00.03 dovecot/imap-login id0 74962 0.0 0.0 9572 5088 - S 12:23 0:00.05 dovecot/imap dovenull 74964 0.0 0.0 11036 6916 - I 12:23 0:00.03 dovecot/imap-login id0 74966 0.0 0.0 9528 4892 - S 12:23 0:00.02 dovecot/imap dovenull 76400 0.0 0.0 11036 6916 - I 12:35 0:00.03 dovecot/imap-login user19 76401 0.0 0.0 9468 4804 - I 12:35 0:00.01 dovecot/imap root 76686 0.0 0.0 11484 7072 - S 12:38 0:00.37 dovecot/auth -w dovenull 77507 0.0 0.0 11036 6940 - I 12:45 0:00.16 dovecot/imap-login user5 77511 0.0 0.1 69164 12120 - I 12:45 0:00.49 dovecot/imap dovenull 78745 0.0 0.0 11036 6932 - S 12:56 0:00.05 dovecot/imap-login dovenull 78748 0.0 0.0 11036 6932 - S 12:56 0:00.06 dovecot/imap-login user5 78761 0.0 0.0 9476 5268 - S 12:56 0:00.12 dovecot/imap user5 78766 0.0 0.0 9492 5212 - S 12:56 0:00.12 dovecot/imap dovenull 78776 0.0 0.0 11036 6916 - S 12:56 0:00.03 dovecot/imap-login usr4 78777 0.0 0.0 9452 4564 - I 12:56 0:00.01 dovecot/imap root 88537 0.0 0.0 7940 1648 - Ss 00:51 0:04.00 /usr/local/sbin/dovecot -c /usr/local/etc/dovecot/dovecot.conf dovecot 88538 0.0 0.0 7880 1832 - S 00:51 0:01.04 dovecot/anvil root 88539 0.0 0.0 7880 1820 - S 00:51 0:00.86 dovecot/log dovenull 88540 0.0 0.0 11036 3992 - S 00:51 0:00.10 dovecot/imap-login root 88541 0.0 0.0 8008 3176 - S 00:51 0:04.18 dovecot/config dovecot 88542 0.0 0.0 7880 2592 - S 00:51 0:01.57 dovecot/stats dovenull 88544 0.0 0.0 11036 4088 - S 00:51 0:00.16 dovecot/imap-login dovenull 88545 0.0 0.0 11036 4064 - S 00:51 0:00.17 dovecot/imap-login dovenull 88546 0.0 0.0 11036 4016 - I 00:51 0:00.11 dovecot/imap-login user00 88547 0.0 0.0 9476 4156 - S 00:51 0:00.45 dovecot/imap usr9 88548 0.0 0.0 9460 4168 - S 00:51 0:00.49 dovecot/imap user1 88551 0.0 0.0 9452 3148 - S 00:51 0:00.22 dovecot/imap dovenull 88557 0.0 0.0 11036 4024 - I 00:52 0:00.11 dovecot/imap-login user17 88561 0.0 0.0 9472 3128 - S 00:52 0:00.22 dovecot/imap user17 88565 0.0 0.0 9472 3120 - S 00:52 0:00.23 dovecot/imap dovenull 88576 0.0 0.0 11036 3776 - I 00:52 0:00.18 dovecot/imap-login user19 88579 0.0 0.0 9604 2872 - S 00:52 0:00.40 dovecot/imap clues? just installing 2.3.7 from source to see if that helps randy

2 2

sometimes no shared cipher after upgrade from 2.2 to 2.3
by Kristijan Savic - ratiokontakt GmbH 23 Aug '19

23 Aug '19

We recently upgraded from dovecot 2.2 to 2.3.7.1-1 Not many, but some users are experiencing difficulties. The dovecot directors log: Aug 21 14:28:49 director01 dovecot: pop3-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=redacted, lip=10.0.0.120, TLS handshaking: SSL_accept() failed: error:1408A0C1:SSL routines:ssl3_get_client_hello:no shared cipher, session=<EeoTt5+QXwVUl87W> Any ide what could be causing it? Thanks, Kristijan

4 6

Trying to install Mailcrypt, receive completely blank emails
by sewing 22 Aug '19

22 Aug '19

Hi - perhaps someone can help me. Starting from a good and well-functioning mailserver setup, I have installed MailCrypt as per the instructions (I think) to have the per-user passworded keys setup. dovecot.conf /Added:/ mail_attribute_dict = file:%h/Maildir/dovecot-attributes mail_plugins = $mail_plugins mail_crypt dovecot-sql.conf.ext /commented this/ #password_query = SELECT email as user, password FROM virtual_users WHERE email='%u'; /Added this/ password_query = SELECT \ email as user, password, \ '%w' AS userdb_mail_crypt_private_password \ FROM virtual_users WHERE email='%u'; 90-plugin.conf /Updated this section/ plugin { mail_crypt_curve = secp521r1 mail_crypt_save_version = 2 /Have also tried all configurations this option set /#mail_crypt_require_encrypted_user_key = yes } /The user is in the mailserver SQL database:/ | user | password | userdb_mail_crypt_private_password | +----------------------+------------------------------------------------------------------------------------------------------------+------------------------------------+ | user@domain | 4t63ttt36tttttt3rt6r763r76t8998t858t4y48ht4huu4hti.76876t847t47yt4ty478yt4wgwygfwffweggggggggggwy8yey83//FElgiApZU. | %w /I have reissued the keys as other problem resolutions have instructed to do, and I can see the new keys are active./ doveadm -o plugin/mail_crypt_private_password=(same password as user@domain when created in SQL) mailbox cryptokey generate -u user@domain -UR /I have restarted dovecot and postfix each time./ /I then send an email either from the user@domain > user@domain OR otheruser@otherdomain > user@domain from Outlook. Authentication is fine (POP and SMTP). No errors appear in any logs - the logs show the mail as being received and I can see the mail in the user@domain /cur folder. If I try to Postcat any of these messages I get:/ postcat '1*********2.M**********3.(host),S=633,W=649:2,S' *** ENVELOPE RECORDS 1*********2.M*********3.(host),S=633,W=649:2,S *** message_size: YPTED postcat: fatal: invalid size record: YPTED??? */Within a minute or so I receive the email in the Outlook Inbox - except it is completely empty of anything. There is no TO / FROM/ SUBJECT / Body or even Routing information. See screencaps from Outlook/* <http://dovecot.2317879.n4.nabble.com/file/t5785/message_list_view.jpg> <http://dovecot.2317879.n4.nabble.com/file/t5785/empty-emails.jpg> /This happens with existing user mailboxes and new test mailboxes I create. If I deactivate Mailcrypt all mailboxes/user-accounts work fine. Any ideas??? I would like to get the working - thanks in advance for your expertise and time!/ Graham -- Sent from: http://dovecot.2317879.n4.nabble.com/

1 0

imapsieve suddenly not working anymore
by Thomas Stein 21 Aug '19

21 Aug '19

Hello one and all. Dovecot version 2.3.7.1 I've configured imapsieve like https://wiki.dovecot.org/HowTo/AntispamWithSieve a while a go and it worked for years now. Suddenly i noticed moving mails to the spamfolder does not trigger the report-spam.sieve script anymore. sieve-test gives: ~/.maildir/.Spam/cur $ sieve-test /usr/share/dovecot/sieve/report-spam.sieve 1542388745.M99384P16720.meine-oma.de\,S\=8173\,W\=8373\:2\,S -D sieve-test(himbeere): Debug: sieve: Pigeonhole version 0.5.7.1 (db5c74be) initializing sieve-test(himbeere): Debug: sieve: include: sieve_global is not set; it is currently not possible to include `:global' scripts. sieve-test(himbeere): Debug: sieve: Sieve imapsieve plugin for Pigeonhole version 0.5.7.1 (db5c74be) loaded sieve-test(himbeere): Debug: sieve: Sieve Extprograms plugin for Pigeonhole version 0.5.7.1 (db5c74be) loaded debug: file storage: Using Sieve script path: /usr/share/dovecot/sieve/report-spam.sieve. debug: file script: Opened script `report-spam' from `/usr/share/dovecot/sieve/report-spam.sieve'. debug: Script binary /usr/share/dovecot/sieve/report-spam.svbin successfully loaded. debug: binary save: not saving binary /usr/share/dovecot/sieve/report-spam.svbin, because it is already stored. report-spam: error: the imapsieve extension cannot be used outside IMAP. sieve-test(himbeere): Info: final result: failed; resolved with successful implicit keep ~/.maildir/.Spam/cur $ I'm not sure the "the imapsieve extension cannot be used outside IMAP" is the error already or thats only because the sieve-test script. Any ideas on that? cheers, t.

1 3

maildir very dirty sync option
by Yousif Alkhateeb 20 Aug '19

20 Aug '19

Hello , I have an active passive dovecot setup with glusterfs as a mail storage and using maildirs, we used to have a problem when users with large mailboxes sync their folders. This caused the load average to increase in the server , after a while we have enabled the very_dirty_sync option in dovecot , things got better and the problem disappeared but we need to know if there is any thing else that we need to do or know about the very_dirty_sync option that may cause future problems . Thanks in advance

3 2

Dovecot and Oauth
by Michael Hallager 20 Aug '19

20 Aug '19

Hi all, I am considering expanding a mail server to support Oauth with Google. I have read through the following: https://wiki.dovecot.org/PasswordDatabase/oauth2 however, it doesn't work and appears to me to be missing important information, the least of which is API authorisation. Searching with Google, I can't find any more information beyond what amounts to C&P'ing of the above link. Has anyone successfully deployed Oauth with Google and could they please send me their config files? Thanks, Michael

2 1

Dovecot and hard links?
by ＠lbutlr 18 Aug '19

18 Aug '19

I was looking at a mail folder and I noted that a file in the inbox had a total of 11 hard links to it: 👹 # exa -lH cur/1564249738.M167990P53982.mail.covisp.net,S=8572,W=8738:2,Sgl .rw------- 11 8.6k vpopmail 19 Jul 19:59 cur/1564249738.M167990P53982.mail.covisp.net,S=8572,W=8738:2,Sgl 👹 # find . -samefile cur/1564249738.M167990P53982.mail.covisp.net,S=8572,W=8738:2,Sgl [6:59] [/usr/local/virtual/kreme(a)kreme.com/Maildir] ./.Junk/cur/1564253637.M808919P50422.mail.covisp.net,S=8572,W=8738:2,bc ./.Junk/cur/1564253637.M808920P50422.mail.covisp.net,S=8572,W=8738:2,bc ./.Junk/cur/1564253723.M977674P50422.mail.covisp.net,S=8572,W=8738:2,bc ./.Junk/cur/1564253723.M977675P50422.mail.covisp.net,S=8572,W=8738:2,bc ./.Junk/cur/1564253723.M977676P50422.mail.covisp.net,S=8572,W=8738:2,bc ./.Junk/cur/1563587951.M591499P47868.mail.covisp.net,S=8572,W=8738:2, ./.Junk/cur/1564851795.M381461P10380.mail.covisp.net,S=8572,W=8738:2,bc ./.Junk/cur/1564851795.M381462P10380.mail.covisp.net,S=8572,W=8738:2,bc ./.Junk/cur/1564852369.M760020P10380.mail.covisp.net,S=8572,W=8738:2,bc ./.Trash/cur/1563587951.M591499P47868.mail.covisp.net,S=8572,W=8738:2,S ./cur/1564249738.M167990P53982.mail.covisp.net,S=8572,W=8738:2,Sgl A bit of background: a few weeks ago I had thousands of files in the mail store that had hundreds of links, and I got that all cleaned up through juggling some grep and awk to delete all but one of the linked files. I figured this was caused by something I’d done when I moved local users into being virtual users and eliminated pam authentication in favor of sql. But this gives me pause. I think it’s normal for a file in the INBOX that is marked as junk or as deleted to have a single hard link (or at least it is since the default was set to maildir_copy_with_hardlinks), but 11? And when do these hard links get cleaned off? If I delete the trashed and junked messages, when does dovecot go through and removed the linked files in the cur/ folder? (It’s not immediate, I trashed those copies in Junk and Trash and the original file is still in the cur folder) -- There is nothing so stupid that some person somewhere will not, with earnestness, say it.

3 5

Re: Submission and TLS client certificate
by Christian Rößner 18 Aug '19

18 Aug '19

Hi, > Am 18.08.2019 um 16:52 schrieb Stephan Bosch via dovecot <dovecot(a)dovecot.org>: > > > >>> On 18/08/2019 10:09, Christian Rößner via dovecot wrote: >> Hi, >> is there some configuration parameter in Dovecot, which sends a TLS client certificate to the SMTP server? I would need this to have XCLIENT enabled and TLS with Postfix. This way I could permit sending based on the certificates fingerprint. > > Can you elaborate? Are you talking about the submission relay service or submission of outgoing messages from e.g. Sieve? The submission relay service. I like the idea of this service. Currently I did not activate the relay trust option, because I have no idea on how I could give permissions on the Postfix side. If Dovecot would send the certificate as reply to the smtpd_ask_ccert option, I could turn on XCLIENT in Dovecot and give permission based on the certificate fingerprint. At the moment I do STARTTLS from Dovecot to Postfix and have added Dovecot‘s IP to mynetworks in Postfix. But I would prefer XCLIENT. Thanks in advance Christian > > Regards, > > Stephan. > >> Thanks in advance >> Christian >> Von unterwegs aus gesendet >> -- >> Rößner-Network-Solutions >> Karl-Bröger-Str. 10, 36304 Alsfeld <x-apple-data-detectors://0/0> >> Fax: +49 6631 78823409 <tel:+49%206631%2078823409>, Mobil: +49 171 9905345 <tel:+49%20171%209905345> >> USt-IdNr.: DE225643613, https://roessner.website <https://roessner.website/> >> PGP Fingerprint: 8FB3 132F 85D8 C9C7 A9F1 9A3F 5183 D46C B885 897E

1 0

Submission and TLS client certificate
by Christian Rößner 18 Aug '19

18 Aug '19

Hi, is there some configuration parameter in Dovecot, which sends a TLS client certificate to the SMTP server? I would need this to have XCLIENT enabled and TLS with Postfix. This way I could permit sending based on the certificates fingerprint. Thanks in advance Christian Von unterwegs aus gesendet -- Rößner-Network-Solutions Karl-Bröger-Str. 10, 36304 Alsfeld Fax: +49 6631 78823409, Mobil: +49 171 9905345 USt-IdNr.: DE225643613, https://roessner.website PGP Fingerprint: 8FB3 132F 85D8 C9C7 A9F1 9A3F 5183 D46C B885 897E

2 1

exim+dovecot+sieve issue
by JM 18 Aug '19

18 Aug '19

Hi, We have mail server in production, with Exim + Dovecot + Mailman + OpenLDAP + Roundcube webmail server. Openldap keeps mail accounts in db, exim uses lmtp transport to deliver messages to dovecot. Mailman is responsible for mailing lists, Roundcube webmail has managsieve module to create sieve filters. Exim router,transport for dovecot > localuser: > driver = accept > domains = +local_domains : +virt_domains > check_local_user > transport = dovecot_lmtp > cannot_route_message = Unknown account > no_more > dovecot_lmtp: > driver = lmtp > socket = /var/spool/dovecot/lmtp > batch_max = 500 > rcpt_include_affixes It worked perfectly, but after upgrade from Dovecot 2.2 to Dovecot 2.3 major version, I've found a lot of strange errors in exim panic.log > mail exim[7821] Failed to get user name for uid 1175 > mail exim[7880]: Failed to get user name for uid 1173 etc where uids are ldap accounts and recognized by system (id 1175 shows user's name and group) Even worse, some clients start to receive notify email with strange content, when sending email to mailing lists > user(a)domain.com > Delay reason: error in redirect data: malformed address: > someuser1(a)domain.com may not follow someuser2(a)domain.com in " > someuser3(a)domain.com ..some crap here.." , where someuser addresses are > not related to recipient address and unknown for sender. After some investigation,I've found out that dovecot's sieve produces these errors (I suspect sieve vacation, when user creates vacation via Roundcube webmail). If set "submission_host = exim ip" in dovecot.conf, exim doesn't produce errors in panic.log anymore, but clients still receive email with malformed address. Please help me to find the root of the problem (some broken sieve filter in user's maildir, misconfiguration or breaking changes in new Dovecot version?) Current software Gentoo with 4.14.90 kernel Dovecot-2.3.7.1 Exim-4.92.1 Mailman 2.1.29 Openldap-2.4.47 Roundcube-1.3.8 Dovecot.conf attached Regards, Juri

2 1

2.3.7 + stats
by Matt Bryant 17 Aug '19

17 Aug '19

Is there any additional documentation/information around the new stats module. Have added some metrics just to see what they produce ## ## Metrics ### metric imap { event_name = imap_command_finished #source_location = example.c:123 #categories = fields = name args running_usecs bytes_in bytes_out #filter { # field_key = wildcard #} } metric sql { event_name = sql_query_finished } metric auth { event_name = auth_request_finished fields = user transport error successful } and get the following [root@stargate dovecot]# doveadm stats dump metric_name field count sum min max avg median stddev %95 imap duration 370 2007904499 130 62955249 5426768.92 2068 16436817.37 60026465 imap name 370 0 0 0 0.00 0 0.00 0 imap args 0 0 0 0 0.00 0 0.00 0 imap running_usecs 370 2007865330 81 62955127 5426663.05 1991 16436816.76 60026329 imap bytes_in 370 5366 2 173 14.50 8 19.04 35 imap bytes_out 370 2119971 0 941517 5729.65 41 53760.89 2082 sql duration 18 28991 991 2305 1610.61 1660 377.36 2305 auth duration 12 26046980 8146 7079879 2170581.67 847730 2457811.23 7079879 auth user 12 0 0 0 0.00 0 0.00 0 auth transport 12 0 0 0 0.00 0 0.00 0 auth error 0 0 0 0 0.00 0 0.00 0 auth successful 0 0 0 0 0.00 0 0.00 0 the main wiki page on stats/events doesnt really hold much detail whats stores for each event the above fields dont make much sense and top no longer works out of the box [root@stargate dovecot]# doveadm stats top usage: doveadm [-Dv] [-f <formatter>] stats <command> [<args>] dump [-s <stats socket path>] [-r] [-f <fields>] has is been removed ? do you need to specify something additional now ??? rgds Matt

3 2

James spooling messages problem
by Adam Raszkiewicz 16 Aug '19

16 Aug '19

For some reason my James setup is creating some kind of spooling queue of sending messages. It will queue 3 of them and then forth “sent” message will make 1st one to be sent outside. Any thoughts? Thanks -- Adam

1 0

SASL: encoded packet size too big
by Eugene 16 Aug '19

16 Aug '19

Hello! Dovecot uses it's own SASL implementation, doesn't it? Aug 14 23:45:23 example.com auth[10428]: GSSAPI client step 1 Aug 14 23:45:23 example.com auth[10428]: encoded packet size too big (813804546 > 65536) Aug 14 23:45:23 example.com dovecot[10085]: auth-worker(10428): Error: LDAP: Can't connect to server: ldap://ipa2.example.com Aug 14 23:45:23 example.com dovecot[10085]: auth: Error: auth worker: Aborted USER request for eugene: Lookup timed out Aug 14 23:45:23 example.com dovecot[10085]: imap: Error: auth-master: login: request [3847225345]: Login auth request failed: Internal auth failure (auth connected 60000 msecs ago, request took 60000 msecs, client-pid=10362 client-id=1) Looks like cyrus-sasl encountered same problem earlier. https://lists.andrew.cmu.edu/pipermail/cyrus-sasl/2017-March/003001.html I never have such an issue with ldapsearch. So, I assume there is a similar problem in Dovecot SASL implementation. -- Eugene Bright IT engineer Tel: + 79257289622

3 6

Re: Dovecot - Microsoft Azure AD
by Aki Tuomi 15 Aug '19

15 Aug '19

Hi! Dovecot supports Lua userdb, which can be used to implement custom user databases, maybe this might work for you? See https://doc.dovecot.org/configuration_manual/authentication/lua_based_authe… for more details. Aki > On 15/08/2019 12:16 Lennart Boettcher <lennart.boettcher(a)secpoint.onmicrosoft.com> wrote: > > > Hello, > > Thank you for the quick reply. > > > > > > I have expressed myself wrongly. Our idea was to use the Azure-AD as userdb by doing the user lookup with the help of Microsoft's Graph API. OAuth2 would then of course only be the authorization procedure to access the user accounts using the Graph API. > > > > > > One would then implement a graph-userdb and no oauth-userdb. OAuth is, as you correctly mentioned, only an authorization mechanism. > > > > > > Here is a link to the GraphAPI: https://docs.microsoft.com/de-de/graph/api/overview?view=graph-rest-1.0 > > > And here is another link to the Graph Explorer, with which you can see how the GraphAPI works: https://developer.microsoft.com/en-us/graph/graph-explorer > > > > > We already use this procedure for the passdb lookup and it works very well. > > > > > Greetings > > Lennart Boettcher > > > > > ------------------------------ > > From: Aki Tuomi <aki.tuomi(a)open-xchange.com> > Sent: 14 August 2019 14:57 > To: Lennart Boettcher <lennart.boettcher(a)secpoint.onmicrosoft.com>; Lennart Boettcher via dovecot <dovecot(a)dovecot.org> > Subject: Re: Dovecot - Microsoft Azure AD > > > > On 14/08/2019 15:36 Lennart Boettcher via dovecot <dovecot(a)dovecot.org> wrote: > > > > > > > > Hello, > > > > I am currently trying to connect my Dovecot mail server to Microsoft's Azure-AD and use it as password and user database. I am using version 2.3.7.1. > > > > > > > > > > > > Using the Azure-AD as passdb already works. In this context I noticed that the scope implementation is not yet merged. > > > > > > > > > > > > Since I haven't found any hints for an OAuth2 userdb implementation yet, I wanted to ask if there are any plans for an implementation. > > > > > > > > > > Greetings > > > > Lennart Boettcher > > > > > > > > > > Dovecot 2.3 supports oauth2. I don't know how "oauth2 user database" would work, since oauth2 is an authentication mechanism. I suggest you use LDAP or static userdb, or set mail_* settings for user settings. > > Aki >

1 0

Dovecot not responding to external clients
by Edwin Humphries 15 Aug '19

15 Aug '19

Hi all I have Dovecot on my Linux-Mint workstation, running IMAP for the Thunderbird client thereon, but previously also for my phone and laptop clients as well. Since upgrading to Linux-Mint 19, however, although the Thunderbird client on the workstation works just fine, the other clients can't connect. I've disabled the firewall, and nmap shows the ports open, so it seems like some setting in the server. Can anyone help? > Dovecot version is 2.2.33.2 (d6601f4ec) > > dovecot -n output: > > # 2.2.33.2 (d6601f4ec): /etc/dovecot/dovecot.conf > # Pigeonhole version 0.4.21 (92477967) > # OS: Linux 4.15.0-55-generic x86_64 Linux Mint 19.1 Tessa > mail_location = mbox:~/mail:INBOX=/var/mail/%u > mail_privileged_group = mail > namespace inbox { > inbox = yes > location = > mailbox Drafts { > special_use = \Drafts > } > mailbox Junk { > special_use = \Junk > } > mailbox Sent { > special_use = \Sent > } > mailbox "Sent Messages" { > special_use = \Sent > } > mailbox Trash { > special_use = \Trash > } > prefix = > } > passdb { > driver = pam > } > protocols = " imap" > ssl_cert = </etc/dovecot/private/dovecot.pem > ssl_client_ca_dir = /etc/ssl/certs > ssl_key = # hidden, use -P to show it > userdb { > driver = passwd > } > -- Regards, Edwin Humphries

2 2

Autoexpunge not working for Junk?
by Amir Caspi 14 Aug '19

14 Aug '19

Hi all, I set up dovecot a couple of months ago and am having trouble getting autoexpunge=30d to work on my Trash and Junk mailboxes. Not sure why not because I'm not getting error messages in my log. Running "doveadm search -u <user> mailbox Junk savedbefore 30d" shows me many messages (I've got messages back to mid-May, and a couple of other users have them back to early April, although if this setting were working, there should be nothing earlier than June 24). Running a manual doveadm expunge works fine... it's just autoexpunge that seems to not be running at all. I'm using sendmail as the MTA and procmail as the LDA, so dovecot is running purely for IMAP/POP service. Any help is much appreciated. Thanks! doveconf -n: # 2.2.36 (1f10bfa63): /etc/dovecot/dovecot.conf # OS: Linux 3.10.0-957.21.3.el7.x86_64 x86_64 CentOS Linux release 7.6.1810 (Core) # Hostname: REDACTED auth_username_format = %Ln first_valid_uid = 1000 mail_location = mbox:~/mail:INBOX=/var/spool/mail/%u mailbox_list_index = yes mbox_write_locks = fcntl namespace compat1 { alias_for = hidden = yes list = no location = prefix = mail/ separator = / } namespace compat2 { alias_for = hidden = yes list = no location = prefix = ~/mail/ separator = / } namespace compat3 { alias_for = hidden = yes list = no location = prefix = ~%u/mail/ separator = / } namespace inbox { inbox = yes location = mailbox Archive { special_use = \Archive } mailbox "Deleted Messages" { autoexpunge = 30 days special_use = \Trash } mailbox Drafts { special_use = \Drafts } mailbox Junk { autoexpunge = 30 days special_use = \Junk } mailbox "Junk E-mail" { autoexpunge = 30 days special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Spam { autoexpunge = 30 days special_use = \Junk } mailbox Trash { autoexpunge = 30 days special_use = \Trash } prefix = separator = / } passdb { driver = pam } pop3_uidl_format = %08Xv%08Xu ssl_cert = # REDACTED ssl_cipher_list = # REDACTED ssl_dh_parameters_length = # REDACTED ssl_key = # hidden, use -P to show it ssl_prefer_server_ciphers = yes userdb { driver = passwd } --- Amir

7 14

segmentation fault in fs_list_get_path
by David M. Johnson 14 Aug '19

14 Aug '19

Hi, There seems to be a straightforward bug in src/lib-storage/list/mailbox-list-fs.c:79. set->index_dir is unchecked prior to dereferencing (unlike on line 126 in the same file, where it is properly checked). This manifested on a FreeBSD server running dovecot 2.3.6 when clients tried to retrieve mail with subscriptions like `~/bar/baz`. This caused the `imap` child to crash, e.g. (slightly anonymized) Core was generated by `imap: [foo w.x.y.z EXAMINE]'. Program terminated with signal SIGSEGV, Segmentation fault. #0 0x0000000011593af4 in fs_list_get_path (_list=0x12444848, name=0x12416880 "/home/foo/bar/baz", type=MAILBOX_LIST_PATH_TYPE_INDEX, path_r=0x7fffffffe150) at mailbox-list-fs.c:79 79 *set->index_dir == '\0') (gdb) bt #0 0x0000000011593af4 in fs_list_get_path (_list=0x12444848, name=0x12416880 "/home/foo/bar/baz", type=MAILBOX_LIST_PATH_TYPE_INDEX, path_r=0x7fffffffe150) at mailbox-list-fs.c:79 #1 0x0000000011559dd0 in mbox_list_get_path (list=0x12444848, name=0x124da410 "~/bar/baz", type=MAILBOX_LIST_PATH_TYPE_INDEX, path_r=0x7fffffffe2c8) at mbox-storage.c:96 #2 0x000000001150ed0b in mailbox_list_get_path (list=0x12444848, name=0x124da410 "~/bar/baz", type=MAILBOX_LIST_PATH_TYPE_INDEX, path_r=0x7fffffffe2c8) at mailbox-list.c:1387 #3 0x00000000114f8aaf in get_path_to (box=0x124da048, type=MAILBOX_LIST_PATH_TYPE_INDEX, internal_path=0x124da250, path_r=0x7fffffffe2c8) at mail-storage.c:2662 #4 0x00000000114f89e9 in mailbox_get_path_to (box=0x124da048, type=MAILBOX_LIST_PATH_TYPE_INDEX, path_r=0x7fffffffe2c8) at mail-storage.c:2678 #5 0x00000000114f928c in mailbox_create_missing_dir (box=0x124da048, type=MAILBOX_LIST_PATH_TYPE_INDEX) at mail-storage.c:2826 #6 0x00000000115cf049 in index_storage_mailbox_alloc_index (box=0x124da048) at index-storage.c:243 #7 0x00000000115cf43f in index_storage_mailbox_open (box=0x124da048, move_to_memory=false) at index-storage.c:297 #8 0x000000001155a715 in mbox_mailbox_open_finish (mbox=0x124da048, move_to_memory=false) at mbox-storage.c:413 #9 0x000000001155a94b in mbox_mailbox_open_existing (mbox=0x124da048) at mbox-storage.c:452 #10 0x0000000011559309 in mbox_mailbox_open (box=0x124da048) at mbox-storage.c:489 #11 0x00000000115a446e in mailbox_list_index_open_mailbox (box=0x124da048) at mailbox-list-index.c:720 #12 0x00000000114f43ed in mailbox_open_full (box=0x124da048, input=0x0) at mail-storage.c:1294 #13 0x00000000114f4117 in mailbox_open (box=0x124da048) at mail-storage.c:1350 #14 0x000000000103d788 in select_open (ctx=0x12443228, mailbox=0x12416810 "~/bar/baz", readonly=true) at cmd-select.c:287 #15 0x000000000103d307 in cmd_select_full (cmd=0x12443048, readonly=true) at cmd-select.c:415 #16 0x0000000001034afa in cmd_examine (cmd=0x12443048) at cmd-examine.c:8 #17 0x000000000104a520 in command_exec (cmd=0x12443048) at imap-commands.c:201 #18 0x000000000104804e in client_command_input (cmd=0x12443048) at imap-client.c:1164 #19 0x00000000010483cf in client_command_input (cmd=0x12443048) at imap-client.c:1227 #20 0x00000000010469fc in client_handle_next_command (client=0x12442848, remove_io_r=0x7fffffffe8c7) at imap-client.c:1269 #21 0x00000000010463c0 in client_handle_input (client=0x12442848) at imap-client.c:1283 #22 0x0000000001044134 in client_input (client=0x12442848) at imap-client.c:1329 #23 0x0000000011b6bd1c in io_loop_call_io (io=0x1244f240) at ioloop.c:703 #24 0x0000000011b6fc08 in io_loop_handler_run_internal (ioloop=0x1242b0a0) at ioloop-kqueue.c:160 #25 0x0000000011b6c37e in io_loop_handler_run (ioloop=0x1242b0a0) at ioloop.c:755 #26 0x0000000011b6c146 in io_loop_run (ioloop=0x1242b0a0) at ioloop.c:728 #27 0x0000000011a87dcb in master_service_run (service=0x12436000, callback=0x1060080 <client_connected>) at master-service.c:781 #28 0x000000000105f870 in main (argc=1, argv=0x7fffffffeb20) at main.c:523 (gdb) p set->index_dir $3 = 0x0 The following one-liner fixes the immediate problem (although I didn't look closely to see what set->index_dir means in the context of MAILBOX_LIST_PATH_TYPE_INDEX): --- src/lib-storage/list/mailbox-list-fs.c~ 2019-04-30 06:25:06.000000000 -0600 +++ src/lib-storage/list/mailbox-list-fs.c 2019-08-02 16:23:57.254087000 -0600 @@ -76,6 +76,7 @@ if (mailbox_list_try_get_absolute_path(_list, &name)) { if (type == MAILBOX_LIST_PATH_TYPE_INDEX && + set->index_dir != NULL && *set->index_dir == '\0') return 0; *path_r = name; David

2 1

auth module logging
by AP 14 Aug '19

14 Aug '19

Hi, As per my discussion with cmouse on irc, I'm currently just using dovecot for its auth mechanism, etc capabilities (alas, Exim does not support argon directly). Tis a fun little side project. :) I have the config pared down as far as I think is reasonable (see below) and all is working well except that dovecot is very silent. Errors hit the logs but I would appreciate seeing successful auths happen for the additional piece of mind. Cmouse and I couldn't find a way to do it on irc and it appears that the capability is missing. Successul /logins/ can be logged but auths, by themselves, cannot. I would appreciate if the ability was added. Dovecot 2.3.7.1 is in use. Thanks # Pigeonhole version 0.5.7.1 (db5c74be) # OS: Linux 5.2.4 x86_64 Debian 10.0 # Hostname: bob auth_mechanisms = plain login auth_verbose = yes auth_verbose_passwords = sha1:16 log_timestamp = "%Y-%m-%d %H:%M:%S %z " mail_log_prefix = "%{pid}<%{session}> %{service}(%{user}): " passdb { args = /etc/dovecot/dovecot-sql.conf.ext driver = sql } service anvil { unix_listener anvil-auth-penalty { mode = 00 } } service auth-worker { user = $default_internal_user } service auth { unix_listener auth-client { group = Debian-exim mode = 0660 } } ssl = no userdb { args = /etc/dovecot/dovecot-sql.conf.ext driver = sql } AP

3 3

dovecot-uidlist invalid data
by Király Balázs 14 Aug '19

14 Aug '19

Hi! I'm struggling with the following error: Aug 4 21:32:00 mx02 dovecot: imap(xxx(a)xxx.tld)<17693><w14vpU+PCCSwPxpo>: Error: Mailbox INBOX: Broken file /home/vmail/xxx.tld/xxx/dovecot-uidlist line 6246: Invalid data: Aug 4 21:49:22 mx02 dovecot: imap(xxx(a)xxx.tld)<21879><YNhW40+PLoBOGLlU>: Error: Mailbox INBOX: Broken file /home/vmail/xxx.tld/xxx/dovecot-uidlist line 6249: Invalid data: It seems the first part is not incremented properly and sometimes it has a jump in it, like the line 6246: 18810 :1564935891.M816284P8904.mx01.m.ininet.hu,S=12145,W=12409 18812 :1564947092.M542714P2651.mx01.m.ininet.hu,S=12275,W=12517 Even though I deleted all the dovecot* files the error comes back. I have the maildirs through NFS, but I set to store the INDEX files locally. I have failover configuration, that means when one of my servers die another one takes the active IP and start to serve dovecot users, so its always one server that serves all the users, no load balacing. Any idea what am I missing or how could I fixed this problem? uname -a Linux mx02.m.mydomain.tld 4.19.0-5-amd64 #1 SMP Debian 4.19.37-5 (2019-06-19) x86_64 GNU/Linux dovecot -n # 2.3.4.1 (f79e8e7e4): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.4 () # OS: Linux 4.19.0-5-amd64 x86_64 Debian 10.0 nfs # Hostname: mx02.m.mydomain.tld auth_mechanisms = plain login auth_verbose = yes default_client_limit = 10000 default_process_limit = 1000 dict { quota = mysql:/etc/dovecot/dovecot-dict-sql.conf.ext } disable_plaintext_auth = no mail_fsync = always mail_location = maildir:/home/vmail/%d/%n:INDEX=/var/indexes/%d/%n mail_plugins = " quota" mail_privileged_group = mail mmap_disable = yes namespace inbox { inbox = yes location = mailbox Drafts { auto = subscribe special_use = \Drafts } mailbox Sent { auto = subscribe special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Spam { auto = subscribe special_use = \Junk } mailbox Trash { auto = subscribe special_use = \Trash } prefix = INBOX. separator = . type = private } passdb { args = /etc/dovecot/dovecot-sql.conf.ext driver = sql } plugin { quota = dict:User quota::proxy::quota sieve = /home/vmail/default.sieve sieve_default = /home/vmail/default.sieve sieve_extensions = +editheader sieve_global_dir = /var/lib/dovecot/sieve } protocols = " imap pop3" service auth-worker { user = vmail } service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0660 user = postfix } unix_listener auth-userdb { mode = 0600 user = vmail } user = $default_internal_user } service dict { unix_listener dict { group = vmail mode = 0600 user = vmail } } service imap-login { inet_listener imaps { port = 993 ssl = yes } } service imap { process_limit = 1024 } service pop3 { process_limit = 1024 } service stats { unix_listener stats-reader { group = vmail mode = 0660 user = vmail } unix_listener stats-writer { group = vmail mode = 0660 user = vmail } } ssl_cert = </etc/postfix/ssl/mail.mydomain.tld-dovecot.crt ssl_client_ca_dir = /etc/ssl/certs ssl_dh = # hidden, use -P to show it ssl_key = # hidden, use -P to show it userdb { args = /etc/dovecot/dovecot-sql.conf.ext driver = sql } protocol lda { mail_plugins = " quota sieve" } protocol imap { mail_max_userip_connections = 20 mail_plugins = " quota quota imap_quota" } protocol pop3 { mail_max_userip_connections = 20 mail_plugins = " quota quota" } Thanks, Balazs

2 1

Emails not visible after renaming folders
by Aleksandr 14 Aug '19

14 Aug '19

Hello, I have strange problem with "losing" emails after rename mail folder(s) (via imap client: thunderbird, roundcude, etc..) How to reproduce: 1. Create some folder name, like TEST 2. Create sub-folder under TEST (like SUBTEST) Structure: TEST |--SUBTEST # doveadm mailbox list -u postmaster@testmailbox Spam Trash Sent Drafts INBOX TEST TEST/SUBTEST 3. Move (or copy) mails from INBOX to SUBTEST (all looks fine, and mails visible under SUBTEST) 4. Rename TEST folder to any new name, NEWTEST Let`s try to view mails in mail client in NEWTEST-SUBTEST, folder have no emails :( mailsrv# doveadm -f table mailbox status -u postmaster@testmailbox "messages vsize" NEWTEST* mailbox messages vsize NEWTEST 0 0 NEWTEST/SUBTEST 0 0 If doveadm force-resync postmaster@testmailbox, mails will be visible in INBOX mailsrv# doveadm -f table mailbox status -u postmaster@testmailbox "messages vsize" INBOX* mailbox messages vsize INBOX 2 28 Dovecot installation: CentOS x86_64 Linux 7.5.1804 Storage: HDD Local Partition - XFS filesystem / multi-dbox (mdbox) as mail_storage (this problem is not reproduced with the settings as Maildir storage !) somthing wrong with mapping indices. ---- [start] ---- # dovecot -n # 2.2.36 (1f10bfa63): /etc/dovecot/dovecot.conf # Pigeonhole version 0.4.21 (92477967) # OS: Linux 3.10.0-862.2.3.el7.x86_64 x86_64 CentOS Linux release 7.5.1804 (Core) # Hostname: xxxx auth_mechanisms = plain login digest-md5 cram-md5 base_dir = /var/run/dovecot/ default_client_limit = 20000 default_login_user = dovecot default_process_limit = 10000 dict { quota = redis:host=127.0.0.1:prefix=user/:timeout_msecs=1000 } disable_plaintext_auth = no first_valid_gid = 90 first_valid_uid = 90 imapc_features = rfc822.size fetch-headers imapc_host = xxxx imapc_user = %u lda_mailbox_autocreate = yes lda_mailbox_autosubscribe = yes login_greeting = xxxx. login_log_format_elements = user=<%u> method=%m rip=%r lip=%l %c login_trusted_networks = 10.0.1.0/24 mail_access_groups = mail mail_debug = yes mail_fsync = never mail_gid = 97 mail_location = mdbox:~/mail/mailboxes:FULLDIRNAME=mBoX-MeSsAgEs:INDEX=~/mail/index:CONTROL=~/mail/control:INBOX=~/mail/mailboxes/inbox mail_log_prefix = "%{session} %Us(%u): " mail_max_lock_timeout = 30 secs mail_plugins = quota zlib mail_prefetch_count = 20 mail_privileged_group = mail mail_uid = 97 managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables enotify environment mailbox date index ihave duplicate mime foreverypart extracttext vacation-seconds editheader mbox_lock_timeout = 30 secs mbox_very_dirty_syncs = yes mbox_write_locks = fcntl namespace inbox { inbox = yes list = yes location = mailbox Drafts { auto = subscribe special_use = \Drafts } mailbox Sent { auto = subscribe special_use = \Sent } mailbox Spam { auto = subscribe } mailbox Trash { auto = subscribe special_use = \Trash } prefix = separator = / type = private } passdb { args = /etc/dovecot/dovecot-ldap.conf driver = ldap } plugin { cgroup_basedir = /usr/sys/cgroup hostingAccount = default quota = dict:User quota::proxy::quota quota_grace = 0%% quota_over_flag_value = TRUE quota_over_script = account-quota mismatch %u quota_rule = *:storage=4T quota_warning = storage=101%% account-quota block %u quota_warning1 = -storage=100%% account-quota unblock %u sieve = file:~/sieve;active=~/.dovecot.sieve sieve_before = /home/sieve/%d/ sieve_extensions = +editheader +vacation-seconds -body sieve_max_redirects = 200 sieve_vacation_min_period = 1s trash_folder = Trash zlib_save = lz4 zlib_save_level = 6 } pop3_delete_type = expunge protocols = imap pop3 sieve service account-quota { executable = script /usr/local/scripts/account-quota unix_listener account-quota { mode = 0666 user = dovecot } user = dovecot } service anvil { chroot = /var/empty client_limit = 0 drop_priv_before_exec = no executable = anvil extra_groups = group = $default_internal_user idle_kill = 4294967295 secs privileged_group = process_limit = 1 process_min_avail = 1 protocol = service_count = 0 type = anvil unix_listener anvil-auth-penalty { group = $default_internal_user mode = 0660 user = dovecot } unix_listener anvil { group = $default_internal_user mode = 0660 user = dovecot } user = $default_internal_user vsz_limit = 18446744073709551615 B } service auth-worker { chroot = /var/empty user = $default_internal_user } service auth { chroot = /var/empty executable = /usr/libexec/dovecot/auth unix_listener auth-client { mode = 0660 } unix_listener auth-master { mode = 0666 } unix_listener auth-userdb { mode = 0777 } user = $default_internal_user } service dict { executable = /usr/libexec/dovecot/dict unix_listener dict { mode = 0600 user = $default_internal_user } } service imap-login { executable = /usr/libexec/dovecot/imap-login inet_listener imap { address = xxxxxxx port = 143 } process_limit = 10000 process_min_avail = 1 service_count = 0 user = dovecot } service imap { executable = /usr/libexec/dovecot/imap process_limit = 18000 process_min_avail = 1 service_count = 0 vsz_limit = 256 M } service lmtp { process_limit = 10 } service pop3-login { executable = /usr/libexec/dovecot/pop3-login inet_listener pop3 { address = xxxxxx port = 110 } process_limit = 1000 process_min_avail = 1 service_count = 0 user = dovecot vsz_limit = 256 M } service pop3 { executable = /usr/libexec/dovecot/pop3 process_limit = 1000 process_min_avail = 1 service_count = 0 } service send-warning { executable = script /usr/local/scripts/send-warning unix_listener send-warning { mode = 0666 user = dovecot } user = dovecot } shutdown_clients = no ssl_cert = </etc/dovecot/xxxx.crt ssl_key = # hidden, use -P to show it userdb { args = /etc/dovecot/dovecot-ldap.conf driver = ldap } verbose_proctitle = yes protocol lda { mail_plugins = sieve quota cgroups zlib } protocol imap { imap_client_workarounds = delay-newmail tb-extra-mailbox-sep mail_max_userip_connections = 50 mail_plugins = quota imap_quota mail_log notify cgroups zlib } protocol pop3 { mail_max_userip_connections = 20 mail_plugins = quota cgroups zlib pop3_client_workarounds = outlook-no-nuls oe-ns-eoh pop3_enable_last = no pop3_no_flag_updates = yes pop3_uidl_format = %08Xu%08Xv } ---- [end] ---- Regards, Aleksandr.

3 4

Auth driver
by Riccardo Paolo Bestetti 14 Aug '19

14 Aug '19

(resending to the list; I apologize, I'm not using my usual email client) Hello, That's actually great news. The perspective of working in-tree didn't make me particularly happy. Could you point me to any documentation or examples? While I can find many plugins in the repo and around the Internet, I could find none which add authdb drivers. Best Regards, Riccardo P. Bestetti Da: Aki Tuomi <aki.tuomi(a)open-xchange.com> Inviato: venerdì 9 agosto 2019 13:56 A: Riccardo Paolo Bestetti <riccardo.kyogre(a)live.it>; dovecot(a)dovecot.org <dovecot(a)dovecot.org> Oggetto: Re: Auth driver On 9.8.2019 14.51, Riccardo Paolo Bestetti via dovecot wrote: > Greetings! > > I'm planning to implement a new auth driver. It's going to be, in concept, similar to the Lua and CheckPassword drivers, in that it allows an user program to carry out the authentication and user enumeration steps. If you do this, please make it as 3rd party repository. Dovecot auth supports plugins. Aki

3 2

Should dovecot not be using different logging facility and severity levels?
by Marc Roos 14 Aug '19

14 Aug '19

Should dovecot not be using different severity levels like auth.warn? On my system everything goes to loglevel info: lev_info:Aug 9 16:18:24 mail03 dovecot: imap-login: Aborted login (auth failed, 1 attempts in 2 secs): user=<xxxxx>, method=PLAIN, rip=x.x.x.x, lip=x.x.x.x, TLS, session=<UBXJ2K+PYh68zmjw> lev_info:Aug 9 16:18:29 mail03 dovecot: auth-worker(28656): pam(krinfo,188.206.104.240,<LOLx2K+PYx68zmjw>): unknown user lev_info:Aug 9 16:18:50 mail03 dovecot: imap-login: Aborted login (auth failed, 1 attempts in 25 secs): user=<xxxxx>, method=PLAIN, rip=x.x.x.x, lip=x.x.x.x, TLS: Disconnected, session=<LOLx2K+PYx68zmjw> lev_info:Aug 9 16:18:53 mail03 dovecot: auth-worker(28656): pam(krinfo,188.206.104.240,<qJOm2q+Pax68zmjw>): unknown user lev_info:Aug 9 16:19:01 mail03 dovecot: imap-login: Aborted login (auth failed, 1 attempts in 8 secs): user=<xxxxx>, method=PLAIN, rip=x.x.x.x, lip=x.x.x.x, TLS, session=<qJOm2q+Pax68zmjw> lev_info:Aug 9 16:19:13 mail03 dovecot: auth-worker(28656): pam(krinfo,188.206.104.240,<k8/X26+Pch68zmjw>): unknown user lev_info:Aug 9 16:19:15 mail03 dovecot: imap-login: Aborted login (auth failed, 1 attempts in 2 secs): user=<xxxxx>, method=PLAIN, rip=x.x.x.x, lip=x.x.x.x, TLS, session=<k8/X26+Pch68zmjw> lev_info:Aug 9 16:19:24 mail03 dovecot: auth-worker(28656): pam(krinfo,188.206.104.240,<MjBy3K+Pfh68zmjw>): unknown user lev_info:Aug 9 16:19:26 mail03 dovecot: imap-login: Aborted login (auth failed, 1 attempts in 2 secs): user=<xxxxx>, method=PLAIN, rip=x.x.x.x, lip=x.x.x.x, TLS, session=<MjBy3K+Pfh68zmjw> lev_info:Aug 9 16:19:27 mail03 dovecot: auth-worker(28656): pam(krinfo,188.206.104.240,<oRmo3K+Pfx68zmjw>): unknown user lev_info:Aug 9 16:19:29 mail03 dovecot: imap-login: Aborted login (auth failed, 1 attempts in 2 secs): user=<xxxxx>, method=PLAIN, rip=x.x.x.x, lip=x.x.x.x, TLS, session=<oRmo3K+Pfx68zmjw> lev_info:Aug 9 16:19:47 mail03 dovecot: auth-worker(29664): pam(krinfo,188.206.104.240,<14Pb3a+Pih68zmjw>): unknown user lev_info:Aug 9 16:19:49 mail03 dovecot: imap-login: Aborted login (auth failed, 1 attempts in 2 secs): user=<xxxxx>, method=PLAIN, rip=x.x.x.x, lip=x.x.x.x, TLS, session=<14Pb3a+Pih68zmjw> lev_info:Aug 9 16:19:51 mail03 dovecot: auth-worker(29664): pam(krinfo,188.206.104.240,<99cO3q+Pix68zmjw>): unknown user lev_info:Aug 9 16:19:53 mail03 dovecot: imap-login: Aborted login (auth failed, 1 attempts in 2 secs): user=<xxxxx>, method=PLAIN, rip=x.x.x.x, lip=x.x.x.x, TLS, session=<99cO3q+Pix68zmjw> This is how failed attempts are logged by vsftpd fac_authpriv:Aug 9 16:24:42 web01 vsftpd[7255]: pam_ldap(vsftpd:auth): Authentication failure; user=xxxxx fac_authpriv:Aug 9 16:24:42 web01 vsftpd[7255]: pam_unix(vsftpd:auth): authentication failure; logname= uid=0 euid=0 tty=ftp ruser=xxxxx rhost=xxxxx user=xxxxx fac_ftp:Aug 9 16:24:44 web01 vsftpd[7255]: [xxxxx] FAIL LOGIN: Client "x.x.x.x" lev_notice:Aug 9 16:24:42 web01 vsftpd[7255]: pam_ldap(vsftpd:auth): Authentication failure; user=xxxxx lev_notice:Aug 9 16:24:42 web01 vsftpd[7255]: pam_unix(vsftpd:auth): authentication failure; logname= uid=0 euid=0 tty=ftp ruser=xxxxx rhost=xxxxx user=xxxxx lev_warn:Aug 9 16:24:44 web01 vsftpd[7255]: [xxxxx] FAIL LOGIN: Client "x.x.x.x" Using dovecot-2.2.36-3.el7.x86_64 on CentOS7

4 4

ACL ignored for master users
by Philip Iezzi 14 Aug '19

14 Aug '19

Hi there! I can't get ACL working for master users. Login as master user works fine though, and I am able to access any mailbox using the auth_master_user_separator "*", tested e.g. via Python's imaplib: import imaplib imap = imaplib.IMAP4_SSL('imap.example.com') imap.login('foo(a)example.com*admin-acldemo', '**********') ('OK', [b'Logged in']) My /etc/dovecot/dovecot-acl looks like this: * user=admin lr bar(a)example.com user=admin-acldemo lr So, if I didn't misunderstand https://wiki.dovecot.org/Authentication/MasterUsers and https://wiki.dovecot.org/ACL documentation, this should only give "admin" master user access to all mailaccounts and limiting "admin-acldemo" master user to only a single mailaccount. That's what I would like to accomplish. But no matter what I put into dovecot-acl (it could even be empty), master users always have access to all existing mailaccounts. The whole dovecot-acl seems to be ignored and there are no logs pointing to any problem (syntax, access permissions) with that file. In mail.log I am getting a successful login message: dovecot: imap-login: Login: user=<foo(a)example.com>, method=PLAIN, ... So the login with "foo(a)example.com*admin-acldemo" seems to get resolved to a regular "foo(a)example.com" user login. My current setup (relevant config options): # 2.3.7.1 (0152c8b10): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.7.1 (db5c74be) # OS: Linux 4.15.18-18-pve x86_64 Debian 9.9 auth_master_user_separator = * mail_plugins = quota acl passdb { args = /etc/dovecot/passwd.masterusers driver = passwd-file master = yes pass = yes } plugin { acl = vfile:/etc/dovecot/dovecot-acl acl_user = %u master_user = %u } protocol lmtp { mail_plugins = quota acl sieve } protocol lda { mail_plugins = quota acl sieve } protocol imap { mail_plugins = quota acl imap_acl imap_quota } On ACL documentation it says: > Note that master users have their own ACLs. They're not the the mailbox owners, so by default they have no permissions to any of the mailboxes and on Authentication/MasterUsers documentation: > If ACL plugin is enabled, the Master user is still subject to ACLs just like any other user, which means that by default the master user has no access to any mailboxes of the user. So it must be somehow possible to limit master users to specific mailbox(es) via ACL. I could allow master users to be able to log in as themselves, by adding two passdb sections (one with `master = yes`, the other `master = no`), but then I see no way to do a user context switch (where ACLs would get respected...) after logging in with "admin". Any help greatly appreciated! Thanks in advance. Cheers, Philip

1 1

Dovecot - Microsoft Azure AD
by Lennart Boettcher 14 Aug '19

14 Aug '19

Hello, I am currently trying to connect my Dovecot mail server to Microsoft's Azure-AD and use it as password and user database. I am using version 2.3.7.1. Using the Azure-AD as passdb already works. In this context I noticed that the scope implementation is not yet merged. Since I haven't found any hints for an OAuth2 userdb implementation yet, I wanted to ask if there are any plans for an implementation. Greetings Lennart Boettcher

2 1

Solr, Dovecot & macOS / iOS
by James Brown 14 Aug '19

14 Aug '19

I’m thinking of getting Solr working with my Dovecot server. Server is new 6-core Mac Mini, mail store of over 1/2 TB. Mailboxes with 100s of thousands of messages. But I’m not sure if: a) it will make enough of a difference and b) does Mail.app and other mail clients on Macs or iOS devices perform searches on their local copy of mail or does it just send a search request to the server? I’m guessing the searches are done locally so no point in Solr? Does anyone know? Thanks, James.

4 5

Dovecot Sieve doesn't move spam to Junk folder in maildir
by Nagy Tibor 13 Aug '19

13 Aug '19

I have an *Ubuntu 16.04* mail server with postfix/spamassassin/*dovecot-2.2.2**2* with virtual mailboxes in maildir format. The whole process is working excellently since a year. Spams are marked with "*****SPAM*****" in subject and with "X-Spam-Flag: YES" in email header. I tried now to add sieve to dovecot to move the SPAM messages into the Junk folder without any success, I don't see any sign that sieve does something at all. The output of "dovecot -n": # 2.2.22 (fe789d2): /etc/dovecot/dovecot.conf # Pigeonhole version 0.4.13 (7b14904) # OS: Linux 4.4.0-72-generic x86_64 Ubuntu 16.04.2 LTS ext4 auth_mechanisms = cram-md5 auth_verbose = yes base_dir = /var/run/dovecot/ info_log_path = /var/log/dovecot.info log_path = /var/log/dovecot log_timestamp = "%Y-%m-%d %H:%M:%S " mail_location = maildir:/home/vmail/%d/%n managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext namespace { inbox = yes location = prefix = separator = / } passdb { args = /etc/dovecot/passwd driver = passwd-file } plugin { sieve = /etc/dovecot/sieve/default.sieve } protocols = imap pop3 service auth { executable = /usr/lib/dovecot/auth unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0666 user = postfix } user = root } service imap-login { chroot = login executable = /usr/lib/dovecot/imap-login inet_listener imap { port = 0 } user = dovecot } service imap { executable = /usr/lib/dovecot/imap } service pop3-login { chroot = login executable = /usr/lib/dovecot/pop3-login inet_listener pop3 { port = 0 } inet_listener pop3s { port = 0 } user = dovecot } service pop3 { executable = /usr/lib/dovecot/pop3 } ssl_cert = </etc/ssl/certs/dovecot.pem ssl_key = </etc/ssl/private/dovecot.pem userdb { args = /etc/dovecot/users driver = passwd-file } valid_chroot_dirs = /var/spool/vmail protocol pop3 { pop3_uidl_format = %08Xu%08Xv } protocol lda { mail_plugins = " sieve" } I've added only plugin and protocol lda now. The content of the file default.sieve: require "fileinto"; if header :contains "X-Spam-Flag" "YES" { fileinto "Junk"; } The test SPAM message is marked as SPAM, but not moved to the folder Junk. I don't see anything in mail.log that is associated to sieve.: ul 30 20:05:12 zg-3 postfix/smtpd[4446]: connect from smtp4.enternet.hu[62.112.192.37] Jul 30 20:05:13 zg-3 postfix/smtpd[4446]: 3C4CC9F570: client=smtp4.enternet.hu[62.112.192.37] Jul 30 20:05:13 zg-3 postfix/cleanup[4450]: 3C4CC9F570: message-id=<c6b3bca5-ece3-9e69-8e30-28173abc2ec6(a)hu.inter.net> Jul 30 20:05:13 zg-3 postfix/qmgr[1557]: 3C4CC9F570: from=<nagyt(a)hu.inter.net>, size=918, nrcpt=1 (queue active) Jul 30 20:05:13 zg-3 postfix/smtpd[4446]: disconnect from smtp4.enternet.hu[62.112.192.37] ehlo=2 starttls=1 mail=1 rcpt=1 data=1 quit=1 commands=7 Jul 30 20:05:13 zg-3 postfix/pickup[3949]: 5F7FEA3CBC: uid=1003 from=<nagyt(a)hu.inter.net> Jul 30 20:05:13 zg-3 postfix/pipe[4451]: 3C4CC9F570: to=<tibor(a)softxs.ch>, relay=spamassassin, delay=0.15, delays=0.05/0.01/0/0.1, dsn=2.0.0, status=sent (delivered via spamassassin service) Jul 30 20:05:13 zg-3 postfix/qmgr[1557]: 3C4CC9F570: removed Jul 30 20:05:13 zg-3 postfix/cleanup[4450]: 5F7FEA3CBC: message-id=<c6b3bca5-ece3-9e69-8e30-28173abc2ec6(a)hu.inter.net> Jul 30 20:05:13 zg-3 postfix/qmgr[1557]: 5F7FEA3CBC: from=<nagyt(a)hu.inter.net>, size=3304, nrcpt=1 (queue active) Jul 30 20:05:13 zg-3 postfix/virtual[4455]: 5F7FEA3CBC: to=<tibor(a)softxs.ch>, relay=virtual, delay=0.02, delays=0.01/0.01/0/0, dsn=2.0.0, status=sent (delivered to maildir) Jul 30 20:05:13 zg-3 postfix/qmgr[1557]: 5F7FEA3CBC: removed What can be wrong?

2 2

dovecot acl delete messages questions
by hfh＠cndns.com 13 Aug '19

13 Aug '19

Dovecot's acl plugin can prevent deletion of messages,it works very well! I want: Some ips can delete messages, other ips can not delete messages,can anyone help me? hfh(a)cndns.com

1 0

LastLogin update
by Jorge Bastos 13 Aug '19

13 Aug '19

Howdy, I'd like an adive on what to use. I have sql users, and i want to have the lastlogin of them, what is the native option for this: * Using last_login plugin which will give me the last login? * Use postlogin for imap and pop3n which will give me besides lastlogin the IP and protocol? Thanks in advanced,

8 13

ACL ignored for master users
by Philip Iezzi 12 Aug '19

12 Aug '19

Hi there! I can't get ACL working for master users. Login as master user works fine though, and I am able to access any mailbox using the auth_master_user_separator "*", tested e.g. via Python's imaplib: >>> import imaplib >>> imap = imaplib.IMAP4_SSL('imap.example.com') >>> imap.login('foo(a)example.com*admin-acldemo', '**********') ('OK', [b'Logged in']) My /etc/dovecot/dovecot-acl looks like this: * user=admin lr bar(a)example.com user=admin-acldemo lr So, if I didn't misunderstand https://wiki.dovecot.org/Authentication/MasterUsers and https://wiki.dovecot.org/ACL documentation, this should only give "admin" master user access to all mailaccounts and limiting "admin-acldemo" master user to only a single mailaccount. But no matter what I put into dovecot-acl (it could even be empty), master users always have access to all existing mailaccounts. The whole dovecot-acl seems to be ignored and there are no logs pointing to any problem (syntax, access permissions) with that file. In mail.log I am getting a successful login message: dovecot: imap-login: Login: user=<foo(a)example.com>, method=PLAIN, rip=..., lip=..., mpid=42371, TLS, session=<T9GKEuyPKGxRPtGS> My current setup (relevant config options): # 2.3.7.1 (0152c8b10): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.7.1 (db5c74be) # OS: Linux 4.15.18-18-pve x86_64 Debian 9.9 auth_master_user_separator = * mail_plugins = quota acl passdb { args = /etc/dovecot/passwd.masterusers driver = passwd-file master = yes pass = yes } plugin { acl = vfile:/etc/dovecot/dovecot-acl acl_user = %u master_user = %u } protocol lmtp { mail_plugins = quota acl sieve } protocol lda { mail_plugins = quota acl sieve } protocol imap { mail_plugins = quota acl imap_acl imap_quota } On ACL documentation it says: > Note that master users have their own ACLs. They're not the the mailbox owners, so by default they have no permissions to any of the mailboxes and on Authentication/MasterUsers documentation: > If ACL plugin is enabled, the Master user is still subject to ACLs just like any other user, which means that by default the master user has no access to any mailboxes of the user. So it must be somehow possible to limit master users to specific mailbox(es) via ACL. If I disable `master = yes` master users won't be able to login at all. Any help greatly appreciated! Thanks in advance. Cheers, Philip

1 0

dovecot-lmtp and postfix
by Coy Hile 12 Aug '19

12 Aug '19

Hi all, I’ve got postfix setup to use dovecot-lmtp for (virtual) user delivery, and things to users or aliases that Dovecot knows about now get delivered correctly. However, I’ve done something wrong with postfix and/or the LMTP configuration because upon RCPT TO, instead of forwarding the mail off to the configured smartest, somehow dovecot-lmtp is ending up in the mix. (Perhaps this is more a postfix question than a dovecot one, but, I’ll start here.) Relevant postfix config: [root@81716ec5-bca4-6d53-ed81-bd1a55d46b4f /opt/local/etc/postfix]# postconf -n canonical_maps = hash:/opt/local/etc/postfix/canonical command_directory = /opt/local/sbin compatibility_level = 2 daemon_directory = /opt/local/libexec/postfix data_directory = /var/db/postfix debug_peer_level = 2 debugger_command = PATH=/bin:/usr/bin:/usr/local/bin:/usr/X11R6/bin ddd $daemon_directory/$process_name $process_id & sleep 5 default_database_type = hash home_mailbox = Maildir/ html_directory = no inet_interfaces = all inet_protocols = all mail_owner = postfix mailbox_size_limit = 102400000 mailq_path = /opt/local/bin/mailq manpage_directory = /opt/local/man message_size_limit = 51200000 meta_directory = /opt/local/libexec/postfix mynetworks = $myhostname, 127.0.0.0/8, 10.0.0.0/8, 172.16.0.0/12 192.168.0.0/16 newaliases_path = /opt/local/bin/newaliases owner_request_special = no queue_directory = /var/spool/postfix queue_minfree = 76800000 readme_directory = /opt/local/share/doc/postfix recipient_canonical_maps = hash:/opt/local/etc/postfix/recipient_canonical recipient_delimiter = + relayhost = relay.svc.a4b01392-e48d-4cdf-cacf-f850d1800d45.basement.cns.coyhile.com sample_directory = /opt/local/share/examples/postfix sender_canonical_maps = hash:/opt/local/etc/postfix/sender_canonical sendmail_path = /opt/local/sbin/sendmail setgid_group = maildrop shlib_directory = /opt/local/lib/postfix smtpd_banner = $myhostname ESMTP smtpd_client_restrictions = permit_mynetworks, permit_sasl_authenticated, reject_unknown_reverse_client_hostname smtpd_data_restrictions = permit_mynetworks, reject_unauth_pipelining, permit_sasl_authenticated smtpd_helo_required = yes smtpd_helo_restrictions = permit_mynetworks, permit_sasl_authenticated, reject_invalid_helo_hostname, reject_non_fqdn_helo_hostname smtpd_recipient_restrictions = permit_mynetworks, permit_sasl_authenticated, reject_unlisted_recipient, reject_non_fqdn_recipient, reject_unauth_destination, reject_unknown_recipient_domain, check_recipient_access hash:/opt/local/etc/postfix/filtered_domains smtpd_sasl_auth_enable = yes smtpd_sasl_path = private/auth smtpd_sasl_type = dovecot smtpd_sender_restrictions = permit_mynetworks, permit_sasl_authenticated, reject_unlisted_sender, reject_non_fqdn_sender, reject_unknown_sender_domain smtputf8_enable = no strict_rfc821_envelopes = yes unknown_local_recipient_reject_code = 550 virtual_alias_maps = pgsql:/opt/local/etc/postfix/postfix_virtual_aliases.cf virtual_mailbox_domains = pgsql:/opt/local/etc/postfix/postfix_virtual_domains.cf virtual_transport = lmtp:unix:private/dovecot-lmtp [root@81716ec5-bca4-6d53-ed81-bd1a55d46b4f /opt/local/etc/postfix]# And the dovecot config: doveconf -n # 2.3.6 (7eab80676): /opt/local/etc/dovecot/dovecot.conf # Pigeonhole version 0.5.6 (92dc263a) doveconf: Warning: NOTE: You can get a new clean config file with: doveconf -Pn > dovecot-new.conf doveconf: Warning: Obsolete setting in /opt/local/etc/dovecot/conf.d/10-ssl.conf:80: ssl_dh_parameters_length is no longer needed doveconf: Warning: Obsolete setting in /opt/local/etc/dovecot/conf.d/10-ssl.conf:81: ssl_protocols has been replaced by ssl_min_protocol doveconf: Warning: NOTE: You can get a new clean config file with: doveconf -Pn > dovecot-new.conf doveconf: Warning: Obsolete setting in /opt/local/etc/dovecot/conf.d/10-ssl.conf:80: ssl_dh_parameters_length is no longer needed doveconf: Warning: Obsolete setting in /opt/local/etc/dovecot/conf.d/10-ssl.conf:81: ssl_protocols has been replaced by ssl_min_protocol doveconf: Warning: service auth { client_limit=840 } is lower than required under max. load (1524) # OS: SunOS 5.11 i86pc # Hostname: 81716ec5-bca4-6d53-ed81-bd1a55d46b4f.coyhile.com auth_mechanisms = plain login auth_socket_path = /var/run/dovecot/auth-userdb imap_idle_notify_interval = 29 mins lda_mailbox_autocreate = yes lda_mailbox_autosubscribe = yes mail_attachment_dir = /var/mail/attachments mail_fsync = never mail_location = mdbox:~/mdbox mail_plugins = " acl" mail_privileged_group = vmail managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext imapsieve vnd.dovecot.imapsieve namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } passdb { args = /opt/local/etc/dovecot/dovecot-sql.conf.ext driver = sql } plugin { acl_defaults_from_inbox = yes imapsieve_mailbox1_before = file:/etc/dovecot/sieve/report-spam.sieve imapsieve_mailbox1_causes = COPY imapsieve_mailbox1_name = Junk imapsieve_mailbox2_before = file:/etc/dovecot/sieve/report-ham.sieve imapsieve_mailbox2_causes = COPY imapsieve_mailbox2_from = Junk imapsieve_mailbox2_name = * sieve = file:~/sieve;active=~/.dovecot.sieve sieve_global_extensions = +vnd.dovecot.pipe sieve_pipe_bin_dir = /etc/dovecot/sieve sieve_plugins = sieve_imapsieve sieve_extprograms } protocols = imap pop3 lmtp submission service auth-worker { user = vmail } service auth { client_limit = 840 inet_listener { port = 2222 } unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0666 user = postfix } unix_listener auth-userdb { group = vmail mode = 0666 user = vmail } } service imap-login { inet_listener imaps { port = 993 ssl = yes } process_min_avail = 3 service_count = 0 vsz_limit = 1 G } service imap { process_min_avail = 3 service_count = 256 } service lmtp { unix_listener /var/spool/postfix/private/dovecot-lmtp { group = postfix mode = 0600 user = postfix } } service pop3-login { inet_listener pop3 { port = 0 } inet_listener pop3s { port = 0 } } ssl_cert = </opt/local/etc/dovecot/certs/dovecot.pem ssl_cipher_list = ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256 ssl_key = # hidden, use -P to show it ssl_min_protocol = TLSv1.2 ssl_prefer_server_ciphers = yes userdb { args = /opt/local/etc/dovecot/dovecot-sql.conf.ext driver = sql } protocol lmtp { mail_plugins = " acl sieve" } protocol lda { mail_plugins = " acl sieve" } protocol imap { mail_max_userip_connections = 50 mail_plugins = " acl imap_acl imap_sieve” } And in syslog I see: 2019-08-11T15:37:57+00:00 81716ec5-bca4-6d53-ed81-bd1a55d46b4f postfix/smtpd[56103]: [ID 197553 mail.info] 12327F13D: client=ns1.coyhile.com[172.17.64.25] 2019-08-11T15:38:40+00:00 81716ec5-bca4-6d53-ed81-bd1a55d46b4f postfix/cleanup[56365]: [ID 197553 mail.info] 12327F13D: message-id=<> 2019-08-11T15:38:40+00:00 81716ec5-bca4-6d53-ed81-bd1a55d46b4f postfix/qmgr[56018]: [ID 197553 mail.info] 12327F13D: from=<coy.hile(a)coyhile.com>, size=354, nrcpt=1 (queue active) 2019-08-11T15:38:40+00:00 81716ec5-bca4-6d53-ed81-bd1a55d46b4f dovecot: [ID 702911 mail.info] lmtp(50179): Connect from local 2019-08-11T15:38:40+00:00 81716ec5-bca4-6d53-ed81-bd1a55d46b4f postfix/lmtp[56821]: [ID 197553 mail.info] 12327F13D: to=<coyhile(a)gmail.com>, relay=81716ec5-bca4-6d53-ed81-bd1a55d46b4f.localdomain[private/dovecot-lmtp], delay=55, delays=55/0.01/0/0.03, dsn=5.1.1, status=bounced (host 81716ec5-bca4-6d53-ed81-bd1a55d46b4f.localdomain[private/dovecot-lmtp] said: 550 5.1.1 <coyhile(a)gmail.com> User doesn't exist: coyhile(a)gmail.com (in reply to RCPT TO command)) Given both of those configurations, shouldn’t it see that gmail address and send it off to the relay host? -Coy

2 2

Gmail to Dovecot migration
by Yuri 12 Aug '19

12 Aug '19

Hi everyone, I'm trying to migrate my gmail to dovecot following instructions at https://wiki.dovecot.org/Migration/Gmail Using -a 'virtual/All' option does not seem to work because the gmail folder with that name does not exist, but -a '[Gmail]/All Mail' seem to work. I'm using the following command: sudo doveadm \ -o imapc_host=imap.gmail.com \ -o imapc_user=user(a)gmail.com \ -o imapc_password=gmailpassword \ -o imapc_features="rfc822.size gmail-migration" \ -o imapc_port=993 \ -o imapc_ssl=imaps \ -o ssl_client_ca_dir=/etc/ssl/certs \ -o imapc_ssl_verify=yes \ backup -a '[Gmail]/All Mail' -O '-$GmailHaveLabels' -R -u user(a)exmaple.com imapc: The problem is this command only migrates approximately 25% of my emails by size. Google Takeout exports 4 times more data in mbox format, the size of exported mboxes aligns with what Google tells me a the bottom of gmail settings page. I experimented with other options of 'doveadm backup' command, but they all resulted in less data being migrated. The above options are the best I was able to achive so far. Another option I was considering is to convert Google Takeout mboxes to dovecot format. I tried using 'doveadm import' command, but got confused with various user and search query options of the command. The best I was able to achive was to output a folder under /Takeout which mimics my mbox structure, but with no imported messages. A third option I'm considering is to convert Google Takeout mboxes using mb2md command. Conversion seems to work fine, but the output is in the traditional (dotted) format, and for historical reasons I use 'LAYOUT=fs' option. So I need to do some extra work to convert folder names. And even if I do so, I'm still not sure if I can import Maildir to dovecot because dovecot's Maildir has other information, such as indices, logs, etc., not just email folders. I'll keep investigating the second and the third option because it seems that Google Takeout gives me all my emails, but I'm not sure if those are the right paths. I wanted to ask the experts about the best option to migrate gmail to dovecot. Has anyone being able to successfully migrate all their emails from gmail and what steps have been used for that? My Dovecot version: 2.3.4.1 Thank you, Yuri

1 1

What does `iterate_query` for SQL want as output?
by Coy Hile 10 Aug '19

10 Aug '19

Hi all, In an earlier thread, https://dovecot.org/pipermail/dovecot/2019-August/116694.html I got a lot of useful help about migration. On my older host, everything was static; on the newer host, I’m storing user information in Postgres. usernames are of the form <login@REALM>, say ‘hile(a)coyhile.xn--com-to0a as basically a Kerberos principal, and authentication and individual lookups work. My `users` table looks thus: mail=> \d users Table "public.users" Column | Type | Modifiers ----------+------+----------- username | text | not null domain | text | not null password | text | not null mail=> and contains, as an example: username | domain | password ------------------+-------------+------------------------------------------------------------------------------------------------------- hile(a)coyhile.com | coyhile.com | [REDACTED] (1 row) Naively, I’d expect something this to work for the iteration query: iterate_query = SELECT username, domain FROM users But, when I do that, I end up doveadm backup -D -A -R -f ssh -i id_rsa.dsync imap01.coyhile.com /opt/local/bin/doveadm dsync-server -A doveadm(hile@coyhile.com@coyhile.com): Info: User no longer exists, skipping [root@81716ec5-bca4-6d53-ed81-bd1a55d46b4f /tmp]# Note the extra “(a)coyhile.xn--com-9o0a in there. Thanks, — Coy Hile coy.hile(a)coyhile.com

2 6

Auth driver
by Riccardo Paolo Bestetti 09 Aug '19

09 Aug '19

Greetings! I'm planning to implement a new auth driver. It's going to be, in concept, similar to the Lua and CheckPassword drivers, in that it allows an user program to carry out the authentication and user enumeration steps. The rationale is that such a solution would provide better decoupling between Dovecot and the user authentication and enumeration logic. Existing integrated logic (auth/ directory in the source tree) is, even encompassing a great number of common use cases, ultimately inflexible. Writing custom drivers implementing logic, while being a solution to the inflexibility problem, is clearly not what drivers were engineered for: for one they don't support dynamic loading, making it necessary to recompile Dovecot to make changes, which is unacceptable in many situations, e.g. when using a packaged or containerized version of the software. In this email, I intend to explain what characteristics my driver will have and why it solves the proposed problem better than existing code (such as CheckPassword, Lua and proxy), in the hope to get useful feedback and I will pose some technical questions to which I could not find definitive answers by myself yet. These are going to be the characteristics of my driver (with particular emphasis to the differences to the existing drivers): - It is going to be a completely generic mechanism exposing all funcionality of Dovecot's interface, both password check and enumeration, and will fully support authentication methods with continuations. - It is going to be performant, communicating with external programs through sockets (unix or inet). - It is going to communicate using a simple, dynamic-schema, well-understood protocol, which is probably going to be JSON, being very easy to generate and parse. This is why the existing drivers do not already provide what I described: - CheckPassword is heavy (fork & 2*exec), and it's generally a mess, having initially been provided as a compatibility feature and having then been hacked to support additional functionality; it's architecturally unfeasable to support continuations with it and anyway any further extension will probably make it explode :) - Lua works but it's limited, in that it dictates a language and also dictates that the auth logic should run on the same server as Dovecot (and under Dovecot's control). It also doesn't seem to support plain password checks, but only user-password enumeration, making it non-generic (at least this is what can be inferred from the documentation and examples.) - Other possible solutions, such as (mis)using the proxy driver to communicate with an external program are not well documented and nothing guarantees the proxy protocol will not change anyway, being an internal feature. And now, the technical questions. I know these could be answered by reading the code, which is something I'm doing, but I'm finding some architectural details quite difficult to grasp due to their complexity: - From what I gather from [1], auth-worker processes only process a single request before being killed from auth. Would setting service_count to something different cause auth-workers to be reused or would it just leak the auth-workers? In the first case, is the preinit of the auth driver repeated, or is the existing instance of the auth driver reused? You could also point me to the relevant code sections which start, keep track of and initialize auth-workers. - How does a driver specify what to run in an auth-worker as opposed to in the auth process? (This is strongly related to the first question, and maybe it is more general, so you may want to answer this one first.) Please, feel free to only answer parts of my email. Any input on any of the matters is very welcome. Best regards, Riccardo P. Bestetti [1] https://wiki.dovecot.org/Services#auth-worker

2 1

Re: Upgrading to v2.3.X breaks ssl san?
by Aki Tuomi 09 Aug '19

09 Aug '19

> On 07/08/2019 14:28 telsch <telsch(a)gmx.de> wrote: > > > with v2.2.34 i can use: > > ssl_ca = </etc/ssl/ca-bundle.pem > ssl_cert = </etc/ssl-imap.pem > > after upgrade to v2.3.X it doesn't work like before. > > it's working if i manual cat ca-bundle.pem and ssl-imap.pem into one > file and using only: > > ssl_cert = </etc/ssl-imap.pem > > i thought ssl_ca is where to put the intermediate cert? (Sorry for duplicate mail, keyboard acted up...) No, that has always been a mistake and it was fixed in 2.3. Our SSL pages in documentation & wiki have always recommended concatenating the intermediates with the cert. Aki

3 3

IMAP folders showing no messages in Office 365 Outlook
by Andrew Bernard 08 Aug '19

08 Aug '19

I'm new to Dovecot. Using Dovecot IMAP with Postfix, everything works fine using Thunderbird. But with the same setup, no messages show in IMAP folders for user accounts created in Outlook, accessing exactly the same server as the accounts in Thunderbird. Dovecot version 2.3.7.1. Is there any configuration required that is special to support Office 365 Outlook clients? How to debug this? Andrew

3 3

Re: How to make the client tool only display emails within 30 days?
by hfh＠cndns.com 08 Aug '19

08 Aug '19

Thank you so much, I tried it！ hfh(a)cndns.com 发件人： Aki Tuomi via dovecot 发送时间： 2019-08-08 15:47 收件人： hfh(a)cndns.com; dovecot 主题： Re: How to make the client tool only display emails within 30 days? On 8.8.2019 10.46, hfh--- via dovecot wrote: doveadm search -u matt mailbox "*" savedbefore 30d Dovecot's configuration or plugin can do similar effects like the above？ Outlook uses pop or imap to receive mail within 30 days. Virtual plugin can be used to do these kind of configurations. Aki

1 0

How to make the client tool only display emails within 30 days?
by hfh＠cndns.com 08 Aug '19

08 Aug '19

doveadm search -u matt mailbox "*" savedbefore 30d Dovecot's configuration or plugin can do similar effects like the above？ Outlook uses pop or imap to receive mail within 30 days.

2 1

How to make the client tool only display emails within 30 days?
by hfh＠cndns.com 08 Aug '19

08 Aug '19

How to make the client tool only display emails within 30 days? thanks！！！ hfh(a)cndns.com

2 1

Upgrading to v2.3.X breaks ssl san?
by telsch 07 Aug '19

07 Aug '19

3 5

Problem Solr and centos 7
by HTMLServices.it 07 Aug '19

07 Aug '19

Hi everyone Given that I am not an expert, I am doing tests with Solr, I installed following the guide but I have no benefits on the search, the search on the body on 28000 mails takes a few minutes and then goes to timeout. I had installed version 8.2.0 of solr then I thought that there is something not compatible with centos 7 so I installed version 7.7.0 as an example on the guide https://wiki2.dovecot.org/Plugins/FTS/Solr. I did several tests but I can't get it to work, this is the test server link: http://5.39.2.59:8987/solr/#/ I only changed the door because the 8983 is busy even making a query from the panel it seems to me not working .... thanks to all Bic

2 3

auth-policy crashing
by James 07 Aug '19

07 Aug '19

My auth process is dumping core. This happens several times per day but dovecot can operate normally for hours between errors. The crash occurs in src/auth/auth-policy.c, line 356: t@1 (l@1) program terminated by signal SEGV (no mapping at the fault address) Current function is auth_policy_parse_response 356 context->request->policy_refusal = FALSE; ...context->request is null. Add markers to the code... } if (context->request == NULL) fprintf(stderr, "2222222222222222222222222222 context->request == NULL\n"); i_stream_unref(&context->payload); if (context->request == NULL) fprintf(stderr, "1111111111111111111111111111 context->request == NULL\n"); if (context->parse_error) { context->result = (context->set->policy_reject_on_fail ? -1 : 0); } if (context->request == NULL) fprintf(stderr, "AAAAAAAAAAAAAAAAAAAAAAAAAAAA context->request == NULL\n"); context->request->policy_refusal = FALSE; if (context->result < 0) { ...gives at the time of the crash... Aug 1 14:25:44 mailhost dovecot: [ID 702911 mail.error] auth: Error: 1111111111111111111111111111 context->request == NULL Aug 1 14:25:44 mailhost dovecot: [ID 702911 mail.error] auth: Error: AAAAAAAAAAAAAAAAAAAAAAAAAAAA context->request == NULL ...so context->result is not null before the call (no 222) to i_stream_unref but is after. dovecot.conf has: auth_policy_server_url = http://policyserver.lan/ auth_policy_server_timeout_msecs = 3000 auth_policy_hash_nonce = Ohr9phaeSeip2Pahaez2raiGohxoo5Ia auth_policy_request_attributes = remote=%{rip} auth_policy_check_before_auth = yes auth_policy_check_after_auth = yes auth_policy_report_after_auth = yes To simplify the problem I used a dummy policy server, in nginx.conf: location / { default_type application/json; return 200 "{\"status\":0,\"msg\":\"accepted\"}"; } however no matter what rubbish a policy server sends back it should not cause dovecot to crash. I've tried 32 and 64 bit and two compilers (gcc and SunStudio), all result in crashes. Adding: keepalive_timeout 0; ...to nginx.conf appears to reduce the crashes. It happens with a variety of users and with debug output I see no pattern. James.

2 6

[BUG?] Double quota calulation when special folder is present
by Mark Moseley 07 Aug '19

07 Aug '19

Just hoping to get some dev eyes on this. I'm incredibly reluctant to throw the word 'bug' around (since 99 times out of 100, it's not -- it's almost always the config), but I can't think of any way that this could be a config issue, esp when the pre-2.2.34 version works as expected. I noticed during troubleshooting that dovecot errors out if I try to create a subfolder called 'INBOX' but it'll happily create a subfolder called INBOX.SomethingElse (i.e. a folder called INBOX.INBOX.SomethingElse - resulting in a directory called .INBOX.SomethingElse on the filesystem, and leading to the problem described below). Is that sub-subfolder creation (where the top level subfolder matches the namespace name) supposed to be allowed? It seems odd that 'INBOX' (as a subfolder of INBOX) would be blocked but INBOX.SomethingElse (as a subfolder of INBOX) would be allowed. I'd expect INBOX.SomethingElse (i.e. INBOX.INBOX.SomethingElse) would be blocked as well. On Wed, Mar 13, 2019 at 4:46 AM Bernd Wurst via dovecot <dovecot(a)dovecot.org> wrote: > Hello, > > we're operating dovecot on a small server. Some years ago, we migrated > from courier IMAP to dovecot. Therefore, we defined our default > Namespace "inbox" with prefix "INBOX." to have this compatible. I found > this in some migration docs those days. Generally, everything worked as > expected. > > Our only namespace is configured like this: > > namespace inbox { > separator = . > prefix = INBOX. > inbox = yes > } > > Regularly, there is no folder named INBOX or .INBOX in the file system, > I suppose this is correct. But I found a special corner case today when > it comes to quota calculation. > > When - for whatever reason - a folder .INBOX.foo (for arbitrary values > of foo) exists, the whole mailbox is counted twice in quota > recalculation. Just creating .INBOX does nothing but a subfolder > triggers the problem. > > This is my shell view (replaced username and file path and deleted > unnecessary debug output) > > $ cat maildirsize > 268435456S > 14697 17 > $ maildirmake .INBOX.foo > $ sudo doveadm -D quota recalc -u <user> > [...] > doveadm(<user>): Debug: Namespace inbox: type=private, prefix=INBOX., > sep=., inbox=yes, hidden=no, list=yes, subscriptions=yes > location=maildir:/home/.../test > doveadm(<user>): Debug: maildir++: root=/home/.../test, index=, > indexpvt=, control=, inbox=/home/.../test, alt= > doveadm(<user>): Debug: Namespace : type=private, prefix=, sep=, > inbox=no, hidden=yes, list=no, subscriptions=no location=fail::LAYOUT=none > doveadm(<user>): Debug: none: root=, index=, indexpvt=, control=, > inbox=, alt= > doveadm(<user>): Debug: quota: quota_over_flag check: quota_over_script > unset - skipping > doveadm(<user>): Debug: Quota root User quota: Recalculated relative > rules with bytes=268435456 count=0. Now grace=26843545 > doveadm(<user>): Debug: Namespace INBOX.: Using permissions from > /home/.../test: mode=0700 gid=default > > $ cat maildirsize > 268435456S > 29394 34 > > > So the used quota has exactly been doubled by just creating an empty > subfolder. > > Do you have any pointers for fixing my configuration or is this a bug in > dovecot? > > I coincidentally resurrected a months-old thread with this same issue a few days ago. I'm seeing the exact same after upgrading from 2.2.32 to 2.2.36. The original poster (who also narrowed it down to something in 2.2.34) mentioned a workaround that does indeed work, namely setting mailbox_list_index=no: > doveadm -o 'mailbox_list_index=no' quota recalc -u myuser I've been staring at diffs of 2.2.33 and 2.2.34 without anything jumping out at me (not a C guy, sadly). Maybe src/lib-storage/index/index-storage.c or src/lib-storage/list/mailbox-list-fs-iter.c or src/lib-storage/list/mailbox-list-index-iter.c or src/lib-storage/list/mailbox-list-index.c? The latter few have some added strcmp's against "INBOX". Then again, there's a lot of new code in the diffs under src/lib-storage that references INBOX specifically.

3 5

Dovecot replication and userdb "noreplicate".
by Reio Remma 07 Aug '19

07 Aug '19

Hello! I finally took the time and spent two days to set up replication for my server and now I have a question or two. I initially set noreplicate userdb field to 1 for all but a test user, but I could still see in the logs that all mailboxes were trying to connect to the other server via SSH. Is that normal? Jun 22 16:55:22 host dovecot: dsync-local(user(a)host.ee)<>: Error: Remote command returned error 84: ssh -i /home/vmail/.ssh/vmail.pem -l vmail backup.host.ee doveadm dsync-server -D -u user(a)host.ee Then I ended up setting mail_replica in userdb for only my test user, but I could still see in the logs that it was trying to sync the others as well, despite mail_replica being 0 for the rest. Jun 22 20:52:59 host dovecot: doveadm(user(a)host.ee): Fatal: -N parameter requires syncing with remote host I also notice (and read from recent posts) that sieve script replication doesn't work at all. Dovecot v2.3.6 and Pigeonhole from the official Dovecot CentOS repo. Thanks, Reio PS: Getting SSH for Dovecot to work with SELinux on CentOS 7 was fun as usual. :)

3 6