- dovecot - dovecot.org

dotlock causing crashes
by Ian Bobbitt 18 Aug '17

18 Aug '17

OS: CentOS 7 x86_64 Dovecot version: 2.2.31 (65cde28) (GhettoForge RPM) Filesystem: GlusterFS, but working on changing that. Only one server is receiving activity. Was getting messages about corrupt dovecot.map.index files. Changed to dotlock from fcntl to try to fix that. Reading symbols from /usr/libexec/dovecot/imap...(no debugging symbols found)...done. [New LWP 74012] Core was generated by `dovecot/imap'. Program terminated with signal 6, Aborted. #0 0x00007fa262c741d7 in __GI_raise (sig=sig@entry=6) at ../nptl/sysdeps/unix/sysv/linux/raise.c:56 56 return INLINE_SYSCALL (tgkill, 3, pid, selftid, sig); (gdb) bt full #0 0x00007fa262c741d7 in __GI_raise (sig=sig@entry=6) at ../nptl/sysdeps/unix/sysv/linux/raise.c:56 resultvar = 0 pid = 74012 selftid = 74012 #1 0x00007fa262c758c8 in __GI_abort () at abort.c:90 save_stage = 2 act = {__sigaction_handler = {sa_handler = 0x7ffd7009f401, sa_sigaction = 0x7ffd7009f401}, sa_mask = {__val = {0, 0, 140335431377968, 140335423109592, 140335422613219, 4246482, 140335418575669, 12278048, 4192326493288016896, 12278592, 140335423192931, 0, 0, 140335425698848, 12280232, 140726483153732}}, sa_flags = 1657305400, sa_restorer = 0x79a} sigs = {__val = {32, 0 <repeats 15 times>}} #2 0x00007fa26309eac6 in default_fatal_finish (type=<optimized out>, status=status@entry=0) at failures.c:201 backtrace = 0xbb5958 "/usr/lib64/dovecot/libdovecot.so.0(+0x9eace) [0x7fa26309eace] -> /usr/lib64/dovecot/libdovecot.so.0(+0x9ebae) [0x7fa26309ebae] -> /usr/lib64/dovecot/libdovecot.so.0(i_fatal+0) [0x7fa26303012c] -> /usr"... #3 0x00007fa26309ebae in i_internal_fatal_handler (ctx=0x7ffd7009f4d0, format=<optimized out>, args=<optimized out>) at failures.c:670 status = 0 #4 0x00007fa26303012c in i_panic (format=format@entry=0x7fa2630d11de "file %s: line %d: unreached") at failures.c:275 ctx = {type = LOG_TYPE_PANIC, exit_status = 0, timestamp = 0x0, timestamp_usecs = 0} args = {{gp_offset = 24, fp_offset = 48, overflow_arg_area = 0x7ffd7009f5d0, reg_save_area = 0x7ffd7009f510}} #5 0x00007fa2630a344f in file_lock_do (fd=fd@entry=20, path=path@entry=0xbb5868 "/gnoc/mail/home/bgeels/mail/mailboxes/Junk/dbox-Mails/.vsize.lock23f657caa43d8796", lock_type=lock_type@entry=1, lock_method=lock_method@entry=FILE_LOCK_METHOD_DOTLOCK, timeout_secs=0, error_r=error_r@entry=0x7ffd7009f768) at file-lock.c:285 lock_type_str = 0x7fa2630e6948 "write-lock" started = 1502905468 ret = <optimized out> __FUNCTION__ = "file_lock_do" #6 0x00007fa2630a3796 in file_wait_lock_error (fd=20, path=0xbb5868 "/gnoc/mail/home/bgeels/mail/mailboxes/Junk/dbox-Mails/.vsize.lock23f657caa43d8796", lock_type=1, lock_method=FILE_LOCK_METHOD_DOTLOCK, timeout_secs=<optimized out>, lock_r=0xc4ec10, error_r=0x7ffd7009f768) at file-lock.c:314 ret = <optimized out> #7 0x00007fa2630a3813 in file_try_lock_error (fd=<optimized out>, path=<optimized out>, lock_type=lock_type@entry=1, lock_method=lock_method@entry=FILE_LOCK_METHOD_DOTLOCK, lock_r=lock_r@entry=0xc4ec10, error_r=error_r@entry=0x7ffd7009f768) at file-lock.c:66 No locals. #8 0x00007fa2630a0955 in try_create_new (error_r=0x7ffd7009f768, lock_r=0xc4ec10, fd_r=0x7ffd7009f700, set=0x7ffd7009f770, path=0xc2f930 "/gnoc/mail/home/bgeels/mail/mailboxes/Junk/dbox-Mails/.vsize.lock") at file-create-locked.c:65 fd = 20 orig_errno = <optimized out> ret = -1 temp_path = 0xbb5830 mode = 0 uid = <optimized out> gid = 4294967295 #9 file_create_locked (path=0xc2f930 "/gnoc/mail/home/bgeels/mail/mailboxes/Junk/dbox-Mails/.vsize.lock", set=set@entry=0x7ffd7009f770, lock_r=lock_r@entry=0xc4ec10, created_r=created_r@entry=0x7ffd7009f767, error_r=error_r@entry=0x7ffd7009f768) at file-create-locked.c:118 i = 0 fd = <optimized out> ret = <optimized out> __FUNCTION__ = "file_create_locked" #10 0x00007fa2633e8f80 in vsize_update_lock_full (update=0xc4ebd0, lock_secs=lock_secs@entry=0) at index-mailbox-size.c:150 box = 0xc2e268 perm = 0xc2e440 set = {lock_timeout_secs = 0, lock_method = FILE_LOCK_METHOD_DOTLOCK, mode = 384, uid = 0, gid = 4294967295, gid_origin = 0xc2ea58 "/gnoc/mail/home/bgeels/mail/mailboxes/Junk"} error = 0x7fa2633f2062 <index_storage_get_status+66> "1\300[]A\\\303\017\037\200" created = false #11 0x00007fa2633e9057 in index_mailbox_vsize_update_try_lock (update=<optimized out>) at index-mailbox-size.c:167 No locals. #12 0x00007fa2633e9755 in index_mailbox_vsize_update_appends (box=<optimized out>) at index-mailbox-size.c:479 update = 0xc4ebd0 status = {messages = 1323, recent = 0, unseen = 0, uidvalidity = 1413091786, uidnext = 6750, first_unseen_seq = 0, first_recent_uid = 5886, last_cached_seq = 0, highest_modseq = 0, highest_pvt_modseq = 0, keywords = 0x0, permanent_flags = 0, flags = 0, permanent_keywords = 0, allow_new_keywords = 0, nonpermanent_modseqs = 0, no_modseq_tracking = 0, have_guids = 1, have_save_guids = 1, have_only_guid128 = 0} #13 0x00007fa2633f633c in index_mailbox_sync_deinit (_ctx=0xc4ece0, status_r=0x7ffd7009f900) at index-sync.c:346 ctx = 0xc4ece0 sync_rec = {seq1 = 0, seq2 = 0, type = (unknown: 0)} delayed_expunges = false ret = <optimized out> #14 0x00007fa2633784b2 in mailbox_sync_deinit (_ctx=_ctx@entry=0x7ffd7009f910, status_r=status_r@entry=0x7ffd7009f900) at mail-storage.c:1868 ctx = <optimized out> box = 0xc2e268 errormsg = <optimized out> error = MAIL_ERROR_NONE ret = <optimized out> #15 0x00007fa263378589 in mailbox_sync (box=<optimized out>, flags=<optimized out>, flags@entry=(unknown: 0)) at mail-storage.c:1894 ctx = 0x0 status = {sync_delayed_expunges = 0} #16 0x00007fa26221ae4f in imap_sieve_mailbox_transaction_run (changes=0x7ffd7009fb50, dest_box=0xc00a08, ismt=<optimized out>) at imap-sieve-storage.c:727 sbox = 0xc2e268 isrun = 0xc27580 cause = 0x7fa26221c447 "COPY" ret = <optimized out> isuser = <optimized out> mevent = <optimized out> headers_ctx = 0xbb53a0 st = 0x1 isrun_src = 0x0 siter = {array = 0xbb57f8, prev_n = 8, prev_idx = 0} script_name = 0x0 can_discard = true src_mail = 0x0 wanted_headers = {0x7fa26221c567 "From", 0x7fa26221c56c "To", 0x7fa26221c136 "Message-ID", 0x7fa26221c56f "Subject", 0x7fa26221c577 "Return-Path", 0x0} src_box = 0xbe2f78 user = <optimized out> mail = 0xbd7228 #17 imap_sieve_mailbox_transaction_commit (t=<optimized out>, changes_r=0x7ffd7009fb50) at imap-sieve-storage.c:808 box = 0xc00a08 user = <optimized out> ismt = <optimized out> lbox = <optimized out> isuser = 0xbd6d30 ret = 0 #18 0x00007fa2628337fa in acl_transaction_commit (ctx=0xc28060, changes_r=0x7ffd7009fb50) at acl-mailbox.c:460 abox = 0xc01018 at = <optimized out> ret = <optimized out> #19 0x00007fa2633789b1 in mailbox_transaction_commit_get_changes (_t=<optimized out>, changes_r=0x7ffd7009fb50) at mail-storage.c:2042 _data_stack_cur_id = 4 t = 0xc28060 box = 0xc00a08 save_count = 1 ret = <optimized out> __FUNCTION__ = "mailbox_transaction_commit_get_changes" #20 0x000000000040e94c in cmd_copy_full () No symbol table info available. #21 0x000000000041accc in command_exec () No symbol table info available. #22 0x000000000041932f in client_command_input () No symbol table info available. #23 0x00000000004193c1 in client_command_input () No symbol table info available. #24 0x0000000000419765 in client_handle_input () No symbol table info available. #25 0x0000000000419c42 in client_input () No symbol table info available. #26 0x00007fa2630b3782 in io_loop_call_io (io=0xbd1dc0) at ioloop.c:599 ioloop = 0xbbd9a0 t_id = 2 __FUNCTION__ = "io_loop_call_io" #27 0x00007fa2630b4e0f in io_loop_handler_run_internal (ioloop=ioloop@entry=0xbbd9a0) at ioloop-epoll.c:223 ctx = 0xbbf4c0 events = <optimized out> list = 0xbc0f20 io = <optimized out> tv = {tv_sec = 1799, tv_usec = 999317} events_count = <optimized out> msecs = <optimized out> ret = 1 i = 0 call = <optimized out> __FUNCTION__ = "io_loop_handler_run_internal" #28 0x00007fa2630b381c in io_loop_handler_run (ioloop=ioloop@entry=0xbbd9a0) at ioloop.c:648 No locals. #29 0x00007fa2630b39d8 in io_loop_run (ioloop=0xbbd9a0) at ioloop.c:623 __FUNCTION__ = "io_loop_run" #30 0x00007fa26303a6e3 in master_service_run (service=0xbbd840, callback=<optimized out>) at master-service.c:666 No locals. #31 0x000000000040cbd2 in main () No symbol table info available. # 2.2.31 (65cde28): /etc/dovecot/dovecot.conf # Pigeonhole version 0.4.19 (e5c7051) doveconf: Warning: service auth { client_limit=20480 } is lower than required under max. load (24576) # OS: Linux 3.10.0-514.21.2.el7.x86_64 x86_64 CentOS Linux release 7.3.1611 (Core) auth_cache_negative_ttl = 0 auth_cache_size = 10 M auth_master_user_separator = * auth_mechanisms = plain login auth_username_format = %Ln auth_verbose = yes auth_worker_max_count = 100 base_dir = /var/run/dovecot/ default_client_limit = 2048 default_process_limit = 4096 default_vsz_limit = 1 G dict { acl = mysql:/etc/dovecot/dovecot-sql-dict.conf.ext } first_valid_uid = 1000 lda_mailbox_autocreate = yes lda_mailbox_autosubscribe = yes lock_method = dotlock mail_attachment_dir = /gnoc/mail/attachments/ mail_attachment_fs = sis-queue /gnoc/mail/attachments/queue/:posix mail_attachment_hash = %{sha256} mail_fsync = always mail_gid = vmail mail_location = mdbox:~/mail mail_nfs_index = yes mail_nfs_storage = yes mail_plugins = " listescape acl" mail_uid = vmail managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext spamtest spamtestplus editheader vnd.dovecot.debug imapsieve vnd.dovecot.imapsieve mdbox_rotate_size = 20 M mmap_disable = yes namespace { list = children location = mdbox:%%h/mail:INDEXPVT=~/mail/shared/%%u prefix = shared/%%u/ separator = / subscriptions = no type = shared } namespace inbox { inbox = yes location = mailbox Archive { special_use = \Archive } mailbox Archives { special_use = \Archive } mailbox Drafts { auto = subscribe special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Spam { special_use = \Junk } mailbox Trash { auto = subscribe special_use = \Trash } mailbox sent-mail { special_use = \Sent } prefix = separator = / } passdb { args = /etc/dovecot/dovecot-sql-pass-sieve.conf.ext driver = sql } passdb { args = /etc/dovecot/dovecot-sql-pass-nologin.conf.ext driver = sql } passdb { args = /etc/dovecot/dovecot-ldap-proxy.conf.ext driver = ldap override_fields = proxy=Y host=mail1-new.grnoc.iu.edu starttls=any-cert noauthenticate=yes } passdb { args = /etc/dovecot/passwd.masterusers driver = passwd-file master = yes pass = yes } passdb { args = /etc/dovecot/dovecot-sql.conf.ext driver = sql } plugin { acl = vfile:/gnoc/mail/dict/acls:cache_secs=300 acl_shared_dict = proxy::acl imapsieve_mailbox1_before = file:/etc/dovecot/sieve/report-spam.sieve imapsieve_mailbox1_causes = COPY imapsieve_mailbox1_name = Spam imapsieve_mailbox2_before = file:/etc/dovecot/sieve/report-spam.sieve imapsieve_mailbox2_causes = COPY imapsieve_mailbox2_name = Junk imapsieve_mailbox3_before = file:/etc/dovecot/sieve/report-ham.sieve imapsieve_mailbox3_causes = COPY imapsieve_mailbox3_from = Spam imapsieve_mailbox3_name = * imapsieve_mailbox4_before = file:/etc/dovecot/sieve/report-ham.sieve imapsieve_mailbox4_causes = COPY imapsieve_mailbox4_from = Junk imapsieve_mailbox4_name = * sieve = ~/.dovecot.sieve sieve_before = /etc/dovecot/sieve/before sieve_before2 = /gnoc/mail/home/%Ln/sieve-before sieve_dir = ~/sieve sieve_extensions = +spamtest +spamtestplus +vnd.dovecot.debug +editheader sieve_global_dir = /etc/dovecot/sieve/global sieve_global_extensions = +vnd.dovecot.pipe sieve_pipe_bin_dir = /etc/dovecot/sieve/bin sieve_plugins = sieve_imapsieve sieve_extprograms sieve_spamtest_max_header = X-Spam-Status: \w+, score=-?[[:digit:]]+\.[[:digit:]]+ required=([[:digit:]]+\.[[:digit:]]+) sieve_spamtest_status_header = X-Spam-Status: \w+, score=(-?[[:digit:]]+\.[[:digit:]]) sieve_spamtest_status_type = score } protocols = imap pop3 lmtp sieve service anvil { client_limit = 16387 } service auth { client_limit = 20480 unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0666 user = postfix } } service dict { unix_listener dict { group = vmail mode = 0660 user = vmail } } service imap { process_limit = 4096 vsz_limit = 1 G } service lmtp { unix_listener /var/spool/postfix/private/dovecot-lmtp { group = postfix mode = 0600 user = postfix } vsz_limit = 1 G } service managesieve-login { inet_listener sieve { port = 4190 } } ssl = required ssl_ca = </etc/pki/tls/cert.pem ssl_cert = </var/lib/acme/live/mail.ctc.grnoc.iu.edu/fullchain ssl_cipher_list = ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA ssl_dh_parameters_length = 2048 ssl_key = # hidden, use -P to show it ssl_prefer_server_ciphers = yes ssl_protocols = !SSLv2 !SSLv3 ssl_require_crl = no userdb { args = /etc/dovecot/dovecot-sql.conf.ext driver = sql } protocol lmtp { mail_plugins = " listescape acl sieve" postmaster_address = postmaster(a)globalnoc.iu.edu } protocol lda { mail_plugins = " listescape acl sieve" } protocol imap { mail_max_userip_connections = 100 mail_plugins = " listescape acl imap_acl imap_sieve" }

2 1

is a self signed certificate always invalid the first time?
by Alef Veld 18 Aug '17

18 Aug '17

So i’m using dovecot, and i created a self signed certificate with mkcert.sh based on dovecot-openssl.cnf. The name in there matches my mail server. The first time it connects in mac mail however, it says the certificate is invalid and another server might pretend to be me etc. I then have the option of trusting it. Is this normal behaviour? Will it always be invalid if it’s not signed by a third party? Thank you.

14 35

Dovecot mail_location for fedora
by Randy Gordey 18 Aug '17

18 Aug '17

What is the syntax for dovecot mail_location when postfix delivers mail to /var/spool/mail/? These are the old unix style mbox, one file per user. Not setting mail_location in 10-mail.conf results in Auto not finding it. mbox: /var/spool/mail/%u said mbox root directory can't be a file. mbox: /var/spool/mail/ tries to make Sent and Deleted Folders, etc. maildir: /var/spool/mail/ closes the connection. I am using Outlook 2016 and Thunderbird are two imap clients I am trying. For Dovecot, 2.2.31 is the version. Postfix is version 3.2.2 and seems to be working. A vanilla Fedora 26 is the OS

3 3

Re: is a self signed certificate always invalid the first time
by Joseph Tam 18 Aug '17

18 Aug '17

> Obviously you do not use clustered environments with more than one node > per service. Else you would not call it "it just works", because in > fact the renewal is quite big bs as one node must do the job while all > the others must be _offline_. I'm not sure how you have set up your clustered service, but why do your nodes have to go offline? If these other nodes are using an older certificate, it should still work as the previous/renewed certificate usually have overlapping active begin/expiration dates. Joseph Tam <jtam.home(a)gmail.com>

1 0

Re: v2.2.32 release candidate released
by Joseph Tam 18 Aug '17

18 Aug '17

Timo Sirainen wrote: Thanks for the reply -- I think I can now write a new config to test these tasty features out. >>> + mail_location can now include NO-NOSELECT parameter. This >>> automatically deletes any \NoSelect mailboxes that have no children. >>> These mailboxes are sometimes confusing to users. >> >> Sorry for my IMAP ignorance, but how can this situation come about? > > a CREATE noselectbox/ > --> With this change it's the same as CREATE "noselectbox" = will become selectable. > > or > > a CREATE noselectbox/childbox > b DELETE noselectbox/childbox > --> noselectbox is left behind. With this change it will be auto-deleted. So, does that mean empty folders will be auto-deleted, or this wouldn't affect them? > I think already even with mailbox_list_index=yes it won't notice > external changes done to the mailboxes when doing STATUS calls, so > better to avoid that. It does get fixed automatically once the folder > is selected though. I'm running it this way now (concurrent file and dovecot access) and most users are blithe to it, so I guess it won't be too much worse. I'll try aggressive caching and back off if it causes confusion. Thanks. Joseph Tam <jtam.home(a)gmail.com>

2 1

Released Pigeonhole v0.4.20.rc1 for Dovecot v2.2.32.rc1.
by Stephan Bosch 18 Aug '17

18 Aug '17

Hello Dovecot users, Here's a release candidate for a quick Pigeonhole release, mostly containing fixes. One fix addresses a problem caused by the previous release. Changelog v0.4.20: + Made the retention period for redirect duplicate identifiers configurable. For accounts that perform many redirects, the lda-dupes database could grow to impractical sizes. Changed the default retention period from 24 to 12 hours. - sieve-filter: Fixed memory leak: forgot to clean up script binary at end of execution. Normally, this would merely be an inconsequential memory leak. However, when the script comes from an LDAP storage, this would cause io leak warnings. - managesieve-login: Fixed handling of AUTHENTICATE command. A second authenticate command would be parsed wrong. This problem was caused by changes in the previous release. - LDA Sieve plugin: Fixed minor memory leak caused by not cleaning up the sieve_discard script. The release is available as follows: http://pigeonhole.dovecot.org/releases/2.2/rc/dovecot-2.2-pigeonhole-0.4.20… http://pigeonhole.dovecot.org/releases/2.2/rc/dovecot-2.2-pigeonhole-0.4.20… Refer to http://pigeonhole.dovecot.org and the Dovecot v2.x wiki for more information. Have fun testing this release candidate and don't hesitate to notify me when there are any problems. Regards, -- Stephan Bosch stephan(a)rename-it.nl

1 0

weakforced
by Mark Moseley 17 Aug '17

17 Aug '17

I've been playing with weakforced, so it fills in the 'fail2ban across a cluster' niche (not to mention RBLs). It seems to work well, once you've actually read the docs :) I was curious if anyone had played with it and was *very* curious if anyone was using it in high traffic production. Getting things to 'work' versus getting them to work *and* handle a couple hundred dovecot servers is a very wide margin. I realize this is not a weakforced mailing list (there doesn't appear to be one anyway), but the users here are some of the likeliest candidates for having tried it out. Mainly I'm curious if weakforced can handle serious concurrency and whether the cluster really works under load.

4 5

Ubuntu 16.04 dovecot-core requires deprecated ntpdate
by Michael Fox 17 Aug '17

17 Aug '17

I'm building a new Ubuntu 16.04 machine, including Dovecot. When I select the dovecot-core package in Synaptic, it also wants to install ntpdate. Problem: ntpdate has been replaced in Ubuntu with timedatectl. In fact, if ntpdate exists on the machine, ntpd will not work properly. See: https://help.ubuntu.com/lts/serverguide/NTP.html See: https://askubuntu.com/questions/769651/ntp-failed-to-synchronize-time See: https://ubuntu101.co.za/ubuntu/fix-ntp-on-ubuntu-16-starting-crashing/ http://www.ubuntugeek.com/install-and-configure-network-time-protocol-ntp-se rverclients-on-ubuntu-16-04-server.html . and more Indeed, I had to remove ntpdate in order to make ntpd work. I don't want to break ntpd. Now the dovecot-core package evidently requires ntpdate. I can't imagine why this dependency would exist. And I presume this dependency will prevent me from removing ntpdate after I install dovecot-core. Is the Debian package maintainer on the list? I don't know what to do. Any suggestions? Thanks in advance, Michael

3 4

Can't recursively delete mailboxes
by Murray T. | Dreamscape 17 Aug '17

17 Aug '17

Hi, This appears to be some sort of dovecot bug. When I use the -r option to recursively delete a mailbox and sub-folders, it removes the sub-folders but not the inbox. It gives me the error below: doveadm mailbox delete -u denise(a)lifelinetechnique.com.au -r -s inbox doveadm(denise(a)lifelinetechnique.com.au): Error: Can't delete mailbox inbox: INBOX can't be deleted. Our user database is in ldap and I am using dovecot-ee v2:2.2.31.2-1. Could you please acknowledge that this is a bug or let me know the correct way of recursively deleting a mailbox as there is nothing in the man page about the -r option. Thanks Murray Regards, Murray T. Level 3 Project Manager P: +61 8 9422 0894 F: +61 8 9422 0801 www.DreamscapeNetworks.com<http://www.dreamscapenetworks.com/> [dreamscape]<http://www.dreamscapenetworks.com/> DISCLAIMER: This e-mail and/or attachments are confidential and may also be privileged. If you are not the named recipient, please notify the sender immediately and do not disclose the contents to other persons or use it for any purpose or store or copy the information in any medium. Any views expressed in this message are those of the individual sender, except where the sender specifically states them to be the views of Dreamscape Networks. Copyright (c) 2017 www.DreamscapeNetworks.com<http://www.dreamscapenetworks.com/>, All rights reserved.

3 3

Re: v2.2.32 release candidate released
by Joseph Tam 17 Aug '17

17 Aug '17

Timo Sirainen wrote: > There are various changes in this release that can be used to significantly reduce disk IO with: > 1) NFS storage especially, but I guess also other remote filesystems and even some with local disks > 2) When mail storage and INDEX storage are separated Thanks for these changes! Big win for my setup. My servers are not overly stressed, but how much performance gain (using any metric you choose) can one expect from these changes? > + mail_location can now include VOLATILEDIR=<path> parameter. This > is used for creating lock files and in future potentially other > files that don't need to exist permanently. The path could point to > tmpfs for example. This is especially useful to avoid creating lock > files to NFS or other remote filesystems. For example: > mail_location=sdbox:~/sdbox:VOLATILEDIR=/tmp/volatile/%2.256Nu/%u Is "/tmp/volatile" auto-created, or must be pre-created? > + mail_location's LISTINDEX=<path> can now contain a full path. > This allows storing mailbox list index to a different storage > than the rest of the indexes, for example to tmpfs. Is this in any way related to VOLATILEDIR? Can they be set to the same value without problems? > + mail_location can now include NO-NOSELECT parameter. This > automatically deletes any \NoSelect mailboxes that have no children. > These mailboxes are sometimes confusing to users. Sorry for my IMAP ignorance, but how can this situation come about? > + mail_location can now include ITERINDEX parameter. This tells Dovecot > to perform mailbox listing from the INDEX path instead of from the > mail root path. It's mainly useful when the INDEX storage is on a > faster storage. > + If mailbox_list_index_very_dirty_syncs=yes, the list index is no > longer refreshed against filesystem when listing mailboxes. This > allows the mailbox listing to be done entirely by only reading the > mailbox list index. > + Added mailbox_list_index_include_inbox setting to control whether > INBOX's STATUS information should be cached in the mailbox list > index. The default is "no", but it may be useful to change it to > "yes", especially if LISTINDEX points to tmpfs. So as I understand it, the optimzation comes about from segregating mail data information into 3 parts: raw mail, indices, and volatile components, putting them into increasingly better performing storage media. How do these I/O optimizations affect the client's view of a mailbox if their mailbox is subject to modification outside the dovecot system (e.g. procmail, mail readers directly modifies mailbox files)? Is there a trade-off between metadata consistency and performance, or it's a win-win all around? (I just saw your previous response to someone else, which I'll read more closely.) Joseph Tam <jtam.home(a)gmail.com>

2 1

v2.2.32 release candidate released
by Timo Sirainen 17 Aug '17

17 Aug '17

https://dovecot.org/releases/2.2/rc/dovecot-2.2.32.rc1.tar.gz https://dovecot.org/releases/2.2/rc/dovecot-2.2.32.rc1.tar.gz.sig There are various changes in this release that can be used to significantly reduce disk IO with: 1) NFS storage especially, but I guess also other remote filesystems and even some with local disks 2) When mail storage and INDEX storage are separated * imapc: Info-level line is logged every time when successfully connected to the remote server. This includes local/remote IP/port, which can be useful for matching against external logs. * config: Log a warning if plugin { key=no } is used explicitly. v2.3 will support "no" properly in plugin settings, but for now any value at all for a boolean plugin setting is treated as "yes", even if it's written as explicit "no". This change will now warn that it most likely won't work as intended. + Various optimizations to avoid accessing files/directories when it's not necessary. Especially avoid accessing mail root directories when INDEX directories point to a different filesystem. + mail_location can now include ITERINDEX parameter. This tells Dovecot to perform mailbox listing from the INDEX path instead of from the mail root path. It's mainly useful when the INDEX storage is on a faster storage. + mail_location can now include VOLATILEDIR=<path> parameter. This is used for creating lock files and in future potentially other files that don't need to exist permanently. The path could point to tmpfs for example. This is especially useful to avoid creating lock files to NFS or other remote filesystems. For example: mail_location=sdbox:~/sdbox:VOLATILEDIR=/tmp/volatile/%2.256Nu/%u + mail_location's LISTINDEX=<path> can now contain a full path. This allows storing mailbox list index to a different storage than the rest of the indexes, for example to tmpfs. + mail_location can now include NO-NOSELECT parameter. This automatically deletes any \NoSelect mailboxes that have no children. These mailboxes are sometimes confusing to users. + mail_location can now include BROKENCHAR=<char> parameter. This can be useful with imapc to access mailbox names that aren't valid mUTF-7 charset from remote servers. + If mailbox_list_index_very_dirty_syncs=yes, the list index is no longer refreshed against filesystem when listing mailboxes. This allows the mailbox listing to be done entirely by only reading the mailbox list index. + Added mailbox_list_index_include_inbox setting to control whether INBOX's STATUS information should be cached in the mailbox list index. The default is "no", but it may be useful to change it to "yes", especially if LISTINDEX points to tmpfs. + userdb can return chdir=<path>, which override mail_home for the chdir location. This can be useful to avoid accessing home directory on login. + userdb can return postlogin=<socket> to specify per-user imap/pop3 postlogin socket path. + cassandra: Add support for result paging by adding page_size=<n> parameter to the connect setting. + dsync/imapc, pop3-migration plugin: Strip also trailing tabs from headers when matching mails. This helps with migrations from Zimbra. + imap_logout_format supports now %{appended} and %{autoexpunged} + virtual plugin: Optimize IDLE to use mailbox list index for finding out when something has changed. - virtual plugin: A lot of fixes. In many cases it was also working very inefficiently or even incorrectly. - imap: NOTIFY parameter parsing was incorrectly "fixed" in v2.2.31. It was actually (mostly) working in previous versions, but broken in v2.2.31. - Modseq tracking didn't always work correctly. This could have caused imap unhibernation to fail or IMAP QRESYNC/CONDSTORE extensions to not work perfectly. - mdbox: "Inconsistency in map index" wasn't fixed automatically - dict-ldap: %variable values used in the LDAP filter weren't escaped. - quota=count: quota_warning = -storage=.. was never executed (try #2). v2.2.31 fixed it for -messages, but not for -storage. - imapc: >= 32 kB mail bodies were supposed to be cached for subsequent FETCHes, but weren't. - quota-status service didn't support recipient_delimiter - acl: Don't access dovecot-acl-list files with acl_globals_only=yes - mail_location: If INDEX dir is set, mailbox deletion deletes its childrens' indexes. For example if "box" is deleted, "box/child" index directory was deleted as well (but mails were preserved).

4 5

autocreate deprecated q
by voytek＠sbt.net.au 17 Aug '17

17 Aug '17

I'm getting "autocreate plugin is deprecated" I've removed 1) but still see error am I correct I don't need default IMAP folders in dovecot.conf as they come from 15-mailboxes.conf ? # grep autocreate dovecot.conf lda_mailbox_autocreate = yes mail_plugins = quota sieve autocreate mail_plugins = quota imap_quota autocreate do I just remove BOTH 'mail_plugin ... autocreate' ? 1) removed autocreate = INBOX autocreate2 = Sent autocreate3 = Trash autocreate4 = Drafts autocreate5 = Junk autosubscribe = INBOX autosubscribe2 = Sent autosubscribe3 = Trash autosubscribe4 = Drafts autosubscribe5 = Junk

2 3

Cannot login with method=GSSAPI
by Erik Haller 17 Aug '17

17 Aug '17

I am migrating an existing dovecot server to a new server. The existing server uses pam_krb5 and works with the plain and gssapi methods. The new server plain/pam_krb5 normal password authentication works. However, the gssapi (tickets) authentication is producing the following error: === Begin Error ==== imap-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=192.168.7.61, lip=192.168.7.97, TLS, session=<SPnD7NhWWtrAqAc9> === End Error === What is causing the "user=<>"? It should be "user=<erik>". I have been using Thunderbird SSL GSSAPI from a Debian Linux testing/buster XFCE desktop to connect to the existing server for years. When I point it to the new server, I receive the above error. ssh kerberos gssapi authentication is working fine on the new server. Most of the doveconf setting between the existing and new servers are the same. The existing server is 32 bit. The new server is 64 bit running in an LXC container. The existing server dovecot version is the same as the new server. Notes: dovecot version: 2.2.31 (65cde28) OS: Debian Linux testing/buster Arch: amd64 Client: Mozilla Thunderbird 52.2.1 (latest)

2 2

correct permissions /etc/dovecot ?
by voytek＠sbt.net.au 17 Aug '17

17 Aug '17

what permissions/ownership should /etc/dovecot/files have? keep seeing this error below, I can correct as per log, BUT, wanted first to check what it should be, rather than me 'fiddling' thanks, V SQL user is vmail first_valid_uid = 2000 last_valid_uid = 2000 # ls -al total 60 drwxr-xr-x 5 root root 4096 Aug 16 14:45 . drwxr-xr-x 82 root root 4096 Aug 16 08:34 .. drwxr-xr-x 2 root root 4096 Aug 12 21:22 conf.d -rw------- 1 vmail dovecot 0 Nov 5 2013 dovecot-master-users-password -rw------- 1 vmail dovecot 735 Aug 16 14:45 dovecot-mysql.conf -rw------- 1 vmail dovecot 491 Aug 15 23:09 dovecot-share-folder.conf -rw------- 1 vmail dovecot 320 Aug 15 23:09 dovecot-used-quota.conf -rw-r--r-- 1 root root 3414 Aug 16 14:43 dovecot.conf Aug 16 16:28:01 auth: Error: passwd-file: open(/etc/dovecot/dovecot-master-users-password) failed: Permission denied (euid=97(dovecot) egid=97(dovecot) missing +r perm: /etc/dovecot/dovecot-master-users-password, dir owned by 0:0 mode=0755) Aug 16 16:29:16 auth: Error: passwd-file: open(/etc/dovecot/dovecot-master-users-password) failed: Permission denied (euid=97(dovecot) egid=97(dovecot) missing +r perm: /etc/dovecot/dovecot-master-users-password, dir owned by 0:0 mode=0755)

3 2

Question (haven't tried yet)
by Ivan Warren 16 Aug '17

16 Aug '17

Hello, I have a question : if I have multiple servers sharing a single disk space (NFS... cluster), and a message is delivered via say LMTP or LDA to a mailbox, and an IMAP client is in IDLE mode on another server, Will it get notified of the arrival of the new message (and if yes, how ?) Thanks, --Ivan

1 0

FTS Lucene Search by Word Parts
by Webert de Souza Lima 16 Aug '17

16 Aug '17

Hello, as the dovecot documentation is only trivial for FTS Search options, I can't find information on advanced options. I have enabled it but it seems I can only search for entire words, i.e. the word Dovecot can be found by searching "dovecot", but not "dove". Is it possible to achieve this using FTS Lucene? I know that using Solr that achievable setting n-gram. Regards, Webert Lima DevOps Engineer at MAV Tecnologia *Belo Horizonte - Brasil*

1 0

Compiling problem on Debian Jessie with dovecot-2-2-32.rc1
by Ralf Zimmermann 16 Aug '17

16 Aug '17

I cant' do ./configure && make && make install on a Debian Jessie. How can I fix this? #make CDPATH="${ZSH_VERSION+.}:" && cd . && /bin/bash /usr/local/src/dovecot-2.2.32.rc1/missing aclocal-1.15 -I . -I m4 /usr/local/src/dovecot-2.2.32.rc1/missing: line 81: aclocal-1.15: command not found WARNING: 'aclocal-1.15' is missing on your system. You should only need it if you modified 'acinclude.m4' or 'configure.ac' or m4 files included by 'configure.ac'. The 'aclocal' program is part of the GNU Automake package: <http://www.gnu.org/software/automake> It also requires GNU Autoconf, GNU m4 and Perl in order to run: <http://www.gnu.org/software/autoconf> <http://www.gnu.org/software/m4/> <http://www.perl.org/> Makefile:497: recipe for target 'aclocal.m4' failed make: *** [aclocal.m4] Error 127 # aclocal --version aclocal (GNU automake) 1.14.1 Copyright (C) 2013 Free Software Foundation, Inc. License GPLv2+: GNU GPL version 2 or later <http://gnu.org/licenses/gpl-2.0.html> This is free software: you are free to change and redistribute it. There is NO WARRANTY, to the extent permitted by law. Written by Tom Tromey <tromey(a)redhat.com> and Alexandre Duret-Lutz <adl(a)gnu.org>. # aclocal configure.ac:319: warning: macro 'AM_ICONV' not found in library # autoconf configure.ac:319: error: possibly undefined macro: AM_ICONV If this token and others are legitimate, please use m4_pattern_allow. See the Autoconf documentation. # autoreconf -i -f aclocal: error: couldn't open directory 'm4': No such file or directory autoreconf: aclocal failed with exit status: 1 Greets Ralf Zimmermann

1 0

Failback mailboxes?
by Dag Nygren 16 Aug '17

16 Aug '17

Hi! Have been using Fedora as my dovecot server for some time and am struggling with systemd at every update. Fedora insists on setting ProtectSystem=full in both dovecot.service and postfix.service at every update of the packages. This makes my mailstore which is in /usr/local/var/mail Read-only. And this makes the incoming emails delivered through dovecot-lda disappear into /dev/null until I notice the problem and we lose incoming emails. My question is: Is there any way to set up a failback mailstore for these occasions? PS! I really hate systemd - Destroys the UNIX way of doing things with a heavy axe.... Best Dag

5 10

Question about mail_location
by Laura Steynes 16 Aug '17

16 Aug '17

In using mysql, in the configuration file we need to specify, in the user query, '/path/ as home, yet but in dovecot.conf, we also are setting mail_location, the same thing is it not, so unless I've missed something, do we still need to use the path as home in the user query? Do we only need set that if it differs from mail_location? Thanks

3 2

Re: migrating 2.1 to 3.x, sql pass scheme, pass value?
by voytek＠sbt.net.au 16 Aug '17

16 Aug '17

On Wed, August 16, 2017 7:50 am, Noel Butler wrote: > On 15/08/2017 22:58, voytek(a)sbt.net.au wrote: > Use: CRYPT > This allows you to use whatever your system supports in your database > password fields, with modern OS's thats anything from md5 (shudder the > thought) to salted sha512 and probably more these days depending on what > other goodies your distro adds, dovecot will send it to the underlying OS > crypt function that does all the hard work. Noel, thanks again for help and explanations. (what went wrong for me, I thought I knew actual password, seeing the long random string in dovecot_mysql file, then assumed it must be hashed version of what I knew as password, anyhow, that part working now) V

1 0

namespace configuration error
by Jeff Ross 16 Aug '17

16 Aug '17

I've got a few errors I'm trying to track down, probably all related... Aug 15 14:03:14 xyzzy dovecot: imap-login: Login: user=<jeff>, method=PLAIN, rip=100.8.22.62, lip=132.238.254.34, mpid=4803, TLS, session=<fLvfl85WntFkCBY+> Aug 15 14:03:14 xyzzy dovecot: imap(jeff): Error: namespace configuration error: Duplicate namespace prefix: "" Aug 15 14:03:14 xyzzy dovecot: imap(jeff): namespace configuration error: Duplicate namespace prefix: "" in=0 out=357 Aug 15 14:03:15 xyzzy dovecot: imap-login: Login: user=<jeff>, method=PLAIN, rip=100.8.22.62, lip=132.238.254.34, mpid=4806, TLS, session=<j/3hl85WoNFkCBY+> Aug 15 14:03:15 xyzzy dovecot: imap(jeff): Error: namespace configuration error: Duplicate namespace prefix: "" Aug 15 14:03:15 xyzzy dovecot: imap(jeff): namespace configuration error: Duplicate namespace prefix: "" in=0 out=357 Aug 15 14:04:51 xyzzy dovecot: lda(jeff): Error: User initialization failed: namespace configuration error: Duplicate namespace prefix: "" Aug 15 14:04:51 xyzzy dovecot: lda: Fatal: Invalid user settings. Refer to server log for more information. # dovecot -n # 2.2.31 (65cde28): /etc/dovecot/dovecot.conf # OS: Linux 4.12.5-300.fc26.x86_64 x86_64 Fedora release 26 (Twenty Six) ext4 mail_location = mbox:/home/%u/mail:INBOX=/home/%u/mbox mail_plugins = snarf zlib mbox_write_locks = fcntl namespace Snarf { hidden = yes list = no location = mbox:/home/%u/mbox:INBOX=/var/spool/mail/%u:INDEX=MEMORY prefix = ~~Snarfbox/ separator = / } namespace default { inbox = yes location = prefix = separator = / } namespace inbox { location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } passdb { driver = pam } plugin { mail_log_events = delete undelete expunge copy mailbox_delete mailbox_rename mbox_snarf = /home/%u/mbox snarf = ~~Snarfbox/INBOX } protocols = imap pop3 service imap-login { inet_listener imap { address = localhost } } service pop3-login { inet_listener pop3 { address = localhost } } service postlogin { executable = script-login -d rawlog } ssl_cert = </etc/letsencrypt/live/www.bubble.org/fullchain.pem ssl_key = # hidden, use -P to show it userdb { driver = passwd } protocol imap { mail_max_userip_connections = 15 mail_plugins = snarf zlib imap_zlib }

2 1

migrating 2.1 to 3.x, sql pass scheme, pass value?
by voytek＠sbt.net.au 16 Aug '17

16 Aug '17

I'm trying to migrate from Centos 6/dovecot 2.1.17/mysql to new server on Centos 7/dovecot 2.2.31 (65cde28)/mariadb I've dumped on oldserver 'dovecot.conf' and used it on newserver doveconf -n > dovecot.conf also, transferred /etc/doveconf/*.conf I've also dumped MySQL 'vmail' and imported database, created user vmail, vmailadmin dumb question: should the password hash from oldserver work 'as is' on newserver..? (different machine, different SQL..) I've tried 'as is', then, attepmted to change both "default_pass_scheme" and 'password=' values, but, no luck postfixadmin works, I can login and see domains/mailboxes what default_pass_scheme should I use ? where/how do I take password= value ? when I attempt to login to pop, I see this: # doveadm stop # dovecot # telnet 127.0.0.1 110 Trying 127.0.0.1... Connected to 127.0.0.1. Escape character is '^]'. +OK Dovecot ready. USER voytek(a)sbt.net.au +OK PASS mypass -ERR [SYS/TEMP] Temporary authentication failure. [voytek-web01:2017-08-14 22:06:33] -ERR Unknown command. -ERR Disconnected for inactivity. Connection closed by foreign host. log has: Aug 15 08:04:33 master: Warning: Killed with signal 15 (by pid=9743 uid=0 code=kill) Aug 15 08:04:44 master: Info: Dovecot v2.2.31 (65cde28) starting up for pop3, imap, sieve (core dumps disabled) Aug 15 08:05:31 auth-worker(9763): Error: mysql(127.0.0.1): Connect failed to database (vmail): Access denied for user 'vmail'@'localhost' (using password: YES) - waiting for 1 seconds before retry Aug 15 08:05:31 auth-worker(9763): Error: mysql(127.0.0.1): Connect failed to database (vmail): Access denied for user 'vmail'@'localhost' (using password: YES) - waiting for 1 seconds before retry //6 more repeats// Aug 15 08:06:31 auth: Error: auth worker: Aborted PASSV request for voytek(a)sbt.net.au: Lookup timed out Aug 15 08:06:31 auth-worker(9763): Error: sql(voytek(a)sbt.net.au,127.0.0.1,<9/h93L1WqLt/AAAB>): Password query failed: Not connected to database Aug 15 08:06:31 auth-worker(9763): Warning: Auth master disconnected us while handling request for voytek(a)sbt.net.au for 60 secs (result=FAIL) Aug 15 08:06:31 auth-worker(9780): Error: mysql(127.0.0.1): Connect failed to database (vmail): Access denied for user 'vmail'@'localhost' (using password: YES) - waiting for 1 seconds before retry Aug 15 08:06:32 auth-worker(9780): Error: mysql(127.0.0.1): Connect failed to database (vmail): Access denied for user 'vmail'@'localhost' (using password: YES) - waiting for 5 seconds before retry //2 more repeats// oldserver & newserver # cat dovecot-mysql.conf driver = mysql default_pass_scheme = CRYPT connect = host=127.0.0.1 dbname=vmail user=vmail password=etXwz...trimmmed........... # Required by 'doveadm mailbox ...'. iterate_query = SELECT username AS user FROM mailbox password_query = SELECT password FROM mailbox WHERE username='%u' AND active='1' user_query = SELECT \ '%u' AS master_user, \ CONCAT(mailbox.storagebasedirectory, '/', mailbox.storagenode, '/', mailbox.maildir) AS home, \ CONCAT('*:bytes=', mailbox.quota*1048576) AS quota_rule \ FROM mailbox,domain \ WHERE mailbox.username='%u' \ AND mailbox.domain='%d' \ AND mailbox.`enable%Ls%Lc`=1 \ AND mailbox.domain=domain.domain \ AND domain.backupmx=0 \ AND domain.active=1 \ AND mailbox.active=1 # newserver # cat dovecot.conf # 2.1.17: /etc/dovecot/dovecot.conf # OS: Linux 2.6.32-642.15.1.el6.x86_64 x86_64 CentOS release 6.8 (Final) auth_master_user_separator = * auth_mechanisms = PLAIN LOGIN dict { acl = mysql:/etc/dovecot/dovecot-share-folder.conf quotadict = mysql:/etc/dovecot/dovecot-used-quota.conf } first_valid_uid = 2000 last_valid_uid = 2000 listen = * log_path = /var/log/dovecot.log mail_gid = 2000 mail_location = maildir:/%Lh/Maildir/:INDEX=/%Lh/Maildir/ mail_plugins = quota mail_log notify mail_uid = 2000 managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date ihave namespace { inbox = yes location = prefix = separator = / type = private } namespace { list = children location = maildir:/%%Lh/Maildir/:INDEX=/%%Lh/Maildir/Shared/%%u prefix = Shared/%%u/ separator = / subscriptions = yes type = shared } passdb { args = /etc/dovecot/dovecot-mysql.conf driver = sql } passdb { args = /etc/dovecot/dovecot-master-users-password driver = passwd-file master = yes } plugin { acl = vfile acl_shared_dict = proxy::acl auth_socket_path = /var/run/dovecot/auth-master autocreate = INBOX autocreate2 = Sent autocreate3 = Trash autocreate4 = Drafts autocreate5 = Junk autosubscribe = INBOX autosubscribe2 = Sent autosubscribe3 = Trash autosubscribe4 = Drafts autosubscribe5 = Junk mail_log_events = delete undelete expunge copy mailbox_delete mailbox_rename mail_log_fields = uid box msgid size quota = dict:user::proxy::quotadict quota_rule = *:storage=1G quota_warning = storage=85%% quota-warning 85 %u quota_warning2 = storage=90%% quota-warning 90 %u quota_warning3 = storage=95%% quota-warning 95 %u sieve = /%Lh/sieve/dovecot.sieve sieve_dir = /%Lh/sieve sieve_global_dir = /var/vmail/sieve sieve_global_path = /var/vmail/sieve/dovecot.sieve } protocols = pop3 imap sieve service auth { unix_listener /var/spool/postfix/dovecot-auth { group = postfix mode = 0666 user = postfix } unix_listener auth-master { group = vmail mode = 0666 user = vmail } unix_listener auth-userdb { group = vmail mode = 0660 user = vmail } } service dict { unix_listener dict { group = vmail mode = 0660 user = vmail } } service imap-login { process_limit = 500 service_count = 1 } service pop3-login { service_count = 1 } service quota-warning { executable = script /usr/local/bin/dovecot-quota-warning.sh unix_listener quota-warning { group = vmail mode = 0660 user = vmail } } ssl = required ssl_cert = </etc/pki/dovecot/certs/dovecot.pem ssl_key = </etc/pki/dovecot/private/dovecot.pem userdb { args = /etc/dovecot/dovecot-mysql.conf driver = sql } protocol lda { auth_socket_path = /var/run/dovecot/auth-master lda_mailbox_autocreate = yes log_path = /var/log/sieve.log mail_plugins = quota sieve autocreate postmaster_address = root } protocol imap { imap_client_workarounds = tb-extra-mailbox-sep mail_max_userip_connections = 60 mail_plugins = quota imap_quota autocreate } protocol pop3 { mail_plugins = quota pop3_client_workarounds = outlook-no-nuls oe-ns-eoh pop3_uidl_format = %08Xu%08Xv }

3 10

Re: migrating 2.1 to 3.x, sql pass scheme, pass value?
by voytek＠sbt.net.au 15 Aug '17

15 Aug '17

On Tue, August 15, 2017 9:31 pm, Ivan Warren wrote: > MariaDB [test]> GRANT SELECT on test to 'test'@'127.0.0.1' identified by > >> pasword('test1234'); ERROR 1064 (42000): You have an error in your SQL >> syntax; check the manual that corresponds to your MariaDB server version >> for the right syntax to use near 'pasword('test1234')' at line 1 MariaDB >> [test]> >> > A bit OT but... > > > It's either identified by 'YourPassword'; > or Identified by password 'YourPasswordHash'; > > > https://dev.mysql.com/doc/refman/5.7/en/create-user.html Ivan, thanks! syntax fixed, I'll try as root MariaDB [test]> GRANT SELECT on test to 'test'@'127.0.0.1' identified by 'test1234'; ERROR 1142 (42000): GRANT command denied to user 'test'@'localhost' for table 'test' MariaDB [test]> GRANT SELECT on test to 'test'@'127.0.0.1' identified by password'*3D3B92F242033365AE5BC6A8E6FC3E1679F4140A'; ERROR 1142 (42000): GRANT command denied to user 'test'@'localhost' for table 'test'

1 0

Metrics service
by Aki Tuomi 15 Aug '17

15 Aug '17

Hi! All of you running dovecot v2.2.27 or later, are now able to take advantage of our free metrics service at https://metrics.dovecot.org. To use it, set auth_stats=yes mail_plugins = $mail_plugins stats stats_carbon_server = 94.237.81.63 # or stats_carbon_server = [2a04:3542:1000:910:acc1:5bff:fe5e:8c2] stats_carbon_name = some-fancy-identifier-without-a-dot plugin { stats_refresh = 30s } And your server should become listed once someone logs in. Note that it will only work from backends today, it will not work from proxies or directors. This service is provided for free, and we might add or remove metrics from it. Please do not spam it (keep refresh and stats_carbon_interval *AT LEAST* 30 seconds). Also note that since this is a public service, all stats are viewable by anyone. We are open for any feedback, questions or comments for this service. Regards, Aki Tuomi Dovecot oy

3 2

Mailbox Alias
by zyrixx 15 Aug '17

15 Aug '17

Hello, I have dovecot with Outlook and Roundcube in the employment and with me the Mailboxaliase does not work. The folders are still different and each client creates its own. I thought that the aliases then fell away. Even on a new test system is not. local.conf: namespace inbox { mailbox Sent { auto = create # or subscribe special_use = \Sent } mailbox Trash { auto = create special_use = \Trash } } mail_plugins = $mail_plugins mailbox_alias plugin { mailbox_alias_old = Trash mailbox_alias_new = Deleted mailbox_alias_old2 = Sent mailbox_alias_new2 = Sendet mailbox_alias_old3 = Trash mailbox_alias_new3 = Gel&APY-schte Elemente mailbox_alias_old4 = Sent mailbox_alias_new4 = Gesendete Elemente mailbox_alias_old5 = Trash mailbox_alias_new5 = Trasher mailbox_alias_old6 = Sent mailbox_alias_new6 = Sender } Does somebody has any idea? Tanks for all.

3 4

Latest Virtual Plugin changes seem to have broken flag changes: 2.2.devel (bf2fa36)
by Thomas Leuxner 14 Aug '17

14 Aug '17

Hi, I’m using several views like this: # cat Dovecot/dovecot-virtual :public/Archive/Mailing-Lists/Dovecot/* :public/Mailing-Lists/Dovecot all Before the recent changes read mail stayed in sync with the virtual folder. Now regardless whether mail is read in the original Folder or the virtual Folder, the flags are not synchronized anymore. Read mail is flagged unread in the corresponding folder. Regards Thomas

2 6

Postfix+PostfixAdmin+Dovecot
by Randy Gordey 14 Aug '17

14 Aug '17

I got postfix and PostfixAdmin working and I am trying to get Dovecot to use the same SQL databases. This is all it says when I telnet in: [root@fedora dovecot]# telnet 192.168.1.200 143 Trying 192.168.1.200... Connected to 192.168.1.200. Escape character is '^]'. * BYE Disconnected: Auth process broken Connection closed by foreign host. [root@fedora dovecot]# Please help me diagnose what is wrong? [root@fedora dovecot]# dovecot --version 2.2.31 (65cde28) [root@fedora dovecot]# [root@fedora dovecot]# dovecot -n # 2.2.31 (65cde28): /etc/dovecot/dovecot.conf doveconf: Warning: NOTE: You can get a new clean config file with: doveconf -n > dovecot-new.conf doveconf: Warning: Obsolete setting in /etc/dovecot/dovecot.conf:128: protocol { ssl_listen } has been replaced by service { inet_listener { address } } # OS: Linux 4.11.11-300.fc26.x86_64 x86_64 Fedora release 26 (Twenty Six) auth_default_realm = gordeys.com auth_mechanisms = plain login disable_plaintext_auth = no first_valid_uid = 2222 listen = * mail_location = maildir:/var/mail/vmail/%u/ mbox_write_locks = fcntl namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } passdb { driver = pam } passdb { args = /etc/dovecot/dovecot-sql.conf driver = sql } service imap-login { inet_listener imaps { address = * } } service pop3-login { inet_listener pop3s { address = * } } ssl_cert = </etc/pki/dovecot/certs/dovecot.pem ssl_cipher_list = PROFILE=SYSTEM ssl_key = # hidden, use -P to show it userdb { driver = passwd } userdb { args = /etc/dovecot/dovecot-sql.conf driver = sql } [root@fedora dovecot]# [root@fedora dovecot]# more dovecot-sql.conf connect = host=localhost dbname=postfix user=postfix password=postfix # Use either driver = mysql # Or # driver = pgsql # Default password scheme - change to match your Postfixadmin setting. # depends on your $CONF['encrypt'] setting: # md5crypt -> MD5-CRYPT # md5 -> PLAIN-MD5 # cleartext -> PLAIN default_pass_scheme = MD5-CRYPT # Query to retrieve password. user can be used to retrieve username in other # formats also. password_query = SELECT username AS user,password FROM mailbox WHERE username = '%u' AND active='1' # Query to retrieve password. user can be used to retrieve username in other # formats also. password_query = SELECT username AS user,password FROM mailbox WHERE username = '%u' AND active='1' # Query to retrieve user information, note uid matches dovecot.conf AND Postfix virtual_uid_maps param eter. user_query = SELECT maildir, 1001 AS uid, 1001 AS gid FROM mailbox WHERE username = '%u' AND active='1 ' # MYSQL : user_query = SELECT CONCAT('/var/vmail/mail/', maildir) AS home, 1001 AS uid, 1001 AS gid, CONCAT('*:bytes=', quota) AS quota_rule FROM mailbox WHERE username = '%u' AND active='1' # PostgreSQL : (no Quota though) : # user_query = SELECT '/var/vmail/mail/' || maildir AS home, 1001 as uid, 1001 as gid FROM mailbox WHE RE username = '%u' AND active = '1' [root@fedora dovecot]#

1 0

Re: Certificate cache on iOS with sending mail
by Alef Veld 14 Aug '17

14 Aug '17

Sent from my iPhone > On 14 Aug 2017, at 13:03, Alef Veld <alefveld(a)outlook.com> wrote: > > Hey Mike. > The iPhone and MacBook started working, but the two remaining iMacs still have problems. It's really weird. But if the first 2 are working it MUST be something local right? > > I removed the servers and re-added but no go. Maybe I'll need to remove the plist files. I'm just desperate as I have clients that are working. > > Sent from my iPhone > >> On 14 Aug 2017, at 07:48, Mike Bobkiewicz <netadmin(a)heinatz.hamburg> wrote: >> >> Hi Alef, >> >> most of the times the problem is with Apple´s Mail apps: best bet is to delete the smtp servers on both Mac and iOS and add them again. I´ve spend quite some time figuring out what might be wrong with serveral mail servers but sometimes the Mail apps just kill their prefs. >> >> If you´re still searching the certs on the Mac side: They´re stored in the key chain. >> >> Hope that helps, >> >> Mike >> >> >>> Am 11.08.2017 um 01:15 schrieb Alef Veld: >>> And iPhone just sits there for a long time, "sending". Sometimes it goes through sometimes it doesn't. >>> >>> It's super weird but it has to do with SSL_accept and not reading the message fully. >>> >>> I might restore my old certs see if that solves it. I'll try some other clients and ip addresses as well, outlook or something. >>> >>> Sent from my iPhone >>> >>>> On 11 Aug 2017, at 00:08, Alef Veld <alefveld(a)outlook.com> wrote: >>>> >>>> I deleted the certificate already, but I think it only uses that for imap/dovecot. I don't think it actually stores one for smtps (or am I not talking sense here). >>>> >>>> Sent from my iPhone >>>> >>>>> On 10 Aug 2017, at 23:25, Joseph Tam <jtam.home(a)gmail.com> wrote: >>>>> >>>>> >>>>>> On Thu, 10 Aug 2017, Larry Rosenman wrote: >>>>>> >>>>>> Which mail client on iOS? >>>>> Sorry, maybe not iOS, but definitely MacOSX Mail app. >>>>> >>>>> Joseph Tam <jtam.home(a)gmail.com> >> >> -- >> Mit freundlichen Grüßen >> >> Mike Bobkiewicz >> Heinatz GmbH >> >> Gutenbergring 9 >> 22848 Norderstedt >> >> 0049 40 527 20 30 >> 0049 40 527 86 49 >> >> e-mail: netadmin(a)heinatz.hamburg >> www.heinatz.hamburg >> >> Heinatz GmbH >> Firmensitz: Gutenbergring 9, 22848 Norderstedt >> Registergericht: Amtsgericht Kiel, HRB 4787 NO >> Geschäftsführer: Frank Heinatz >> >>

1 0

Puzzled about LIST "" * behaviour
by Benoit Panizzon 14 Aug '17

14 Aug '17

Hi there I'm preparing to copy emails from one dovecot to another dovecot server via imapsync. Now imapsync does not get the folder list. So I sniffed the connection and I am trying to reproduce via telnet. I do via different concurrent connections. . login user password . list "" * Now this is what completely puzzles me. sometimes I get the list of all folders, sometimes I only get the INBOX imapsync seems to only ever get the INBOX and no other folders. But I type in the very same commands! I have not yet figured out what sometimes causes me to get the full list and sometimes only a partial one. Is it some timing issue? Does it matter if the user is already logged in from another ip? Any hints welcome. -Benoît Panizzon- -- I m p r o W a r e A G - Leiter Commerce Kunden ______________________________________________________ Zurlindenstrasse 29 Tel +41 61 826 93 00 CH-4133 Pratteln Fax +41 61 826 93 01 Schweiz Web http://www.imp.ch ______________________________________________________

1 0

[Dovecot] [PATCH, RFC] add APOP authentication mechanism
by Andrey Panin 14 Aug '17

14 Aug '17

Hello all, this patch add APOP authentication mechanism to dovecot 1.0-test23. Please take a look. Best regards. -- Andrey Panin | Linux and UNIX system administrator pazke(a)donpac.ru | PGP key: wwwkeys.pgp.net

3 2

(Solved) Re: Upgrade path from MySQL to MariaDB broken? (Akonadi)
by Volker Wysk 14 Aug '17

14 Aug '17

Hello! I've found it out, how you can solve/work around the problem: Nextcloud needs MariaDB. It won't work (so it seems) with MySQL. So mariadb- server needs to be installed. This replaces MySQL (mysql-server-core-5.7 and mysql-client-core-5.7) with MariaDB. The problem is that after that, Akonadi won't start any longer. "aconadictl start" outputs a lot of messages. The problem can be repaired by doing this, after the installation of MariaDB: akonadictl stop rm -r ~/.local/share/akonadi akonadictl start Bye, Volker

1 1

2.1 to 2.2.31 on new server?
by voytek＠sbt.net.au 13 Aug '17

13 Aug '17

I have a Centos 6 server with Dovecot 2.1.17/mysql/virtual domains I'm setting a new Centos 7 server, and, aim to install 2.2.31 from Ghetoforge dumb question, can I install 2.3 on new server, then, copy old /etc/dovecot tree to new /etc/dovecot ? appreciate any tips and advice, V

3 2

new install on Centos 7
by voytek＠sbt.net.au 12 Aug '17

12 Aug '17

I currently have Postfix Dovecot MySQL on Centos 6, looking at migrating to new server new server is CentOS 7.3, but, the Centos repo version is dovecot x86_64 1:2.2.10-7.el7 what is the best way to install current release Dovecot on a new server ? tia, V

2 3

Re: new install on Centos 7
by Joseph Tam 11 Aug '17

11 Aug '17

>> Or consider compiling it yourself from source. It may be more work, but >> you get complete control over your versioning, your package dependencies, >> etc. If a bug that affects you gets fixed on a bleeding edge version >> (or is only available as a patch), you can fix it right away rather than >> waiting for the package maintainer to catch up to it. > > Or just ping me in #ghettoforge on Freenode and I'll generally get it > fixed quickly, if I haven't already seen it on the list and fixed it. Not all package maintainers are as responsive as you are. I've lost count of the number of problems reported here, where people could not move from version 1.x, because their repo did not have anything newer, or for reason out of their control, they can't update because it would/could break something else. > There are downsides to compiling yourself. To be sure. (Incidentally, auto-updates are sometimes *not* what people want -- stability of a working system is paramount over anything that might jeopardize that.) Compiling from source is not everybody's cup of tea, but it does allow complete control over the build. Repo-packages usually are built with kitchen-sink options, which may not suit everyone. Joseph Tam <jtam.home(a)gmail.com>

2 1

Re: Certificate cache on iOS with sending mail
by Joseph Tam 11 Aug '17

11 Aug '17

On Thu, 10 Aug 2017, Larry Rosenman wrote: > Which mail client on iOS? Sorry, maybe not iOS, but definitely MacOSX Mail app. Joseph Tam <jtam.home(a)gmail.com>

2 3

Re: Certificate cache on iOS with sending mail
by Joseph Tam 11 Aug '17

11 Aug '17

Alef Veld writes: >> I'm wondering if there is any cache for a certificate or something, my >> maillog shows up something like 10 bytes read, -1. So it returns an >> error. I deleted the accounts and created them again, still no go. >> >> Anyone had anything similar before? On top of the usual mail set up problems (and it appears to be some SSL/STARTLS port number mismatch), setting up a iPhone/MacOSX mail client can be an exercise in frustration as cause and effect may not be synchronous. What can happen is that after setting up parameters, if they don't work (owing to misconfiguration or transient network problem), your mail client will start varying the mail parameters (port #, TLS/SSL parameters, with/without domain, etc.) in hopes of finding something that works. Sort of auto-discovery/auto-correction. All of a sudden, without apparent cause, it will bump into the right settings (which may co-incide with your original settings) and it will start working. Uber confusing. I believe if you disable the "Automatically manage connection" feature, it will make your settings fixed. This may not be the cause of your original problem, but at least you won't be trying to troubleshoot a moving target. Joseph Tam <jtam.home(a)gmail.com>

2 1

Re: new install on Centos 7
by Joseph Tam 10 Aug '17

10 Aug '17

>> I currently have Postfix Dovecot MySQL on Centos 6, looking at migrating >> to new server >> >> new server is CentOS 7.3, but, the Centos repo version is >> >> dovecot x86_64 1:2.2.10-7.el7 >> >> what is the best way to install current release Dovecot on a new server ? > > GhettoForge has dovecot22 packages as well which provide the latest > stable version of Dovecot for CentOS 6 and 7. Or consider compiling it yourself from source. It may be more work, but you get complete control over your versioning, your package dependencies, etc. If a bug that affects you gets fixed on a bleeding edge version (or is only available as a patch), you can fix it right away rather than waiting for the package maintainer to catch up to it. Joseph Tam <jtam.home(a)gmail.com>

2 1

Certificate cache on iOS with sending mail
by Alef Veld 10 Aug '17

10 Aug '17

So I generated a new certificate for dovecot, and ever since I have this weird problem that my iPhone can still receive mail but cannot send using that mailserver. Same for my iMac. My laptop works fine still and can do both. Local issue you would say right. I'm wondering if there is any cache for a certificate or something, my maillog shows up something like 10 bytes read, -1. So it returns an error. I deleted the accounts and created them again, still no go. Anyone had anything similar before? Sent from my iPhone

2 2

dict client auth-worker service count not obeyed?
by Peter Mogensen 10 Aug '17

10 Aug '17

Hi, I've noticed that in recent dovecot versions at least since 2.2.29 and not in 2.2.12 a dovecot auth-worker will happily issue two Lshared/passdb... queries on the same dict socket. Not always, but sometimes. It used to be that the dict client always closed the socket (AFAIK) after 1 query. But now I see 2 queries issued on the same connection. How does this work wrt. the service_count limit of the auth worker process being default 1 ?? Is it not obeyed? /Peter

1 0

Virtual mailboxes, index update issues
by Stefan Hagen 09 Aug '17

09 Aug '17

Hello, I noticed a strange behavor, where I would like to ask for help. I have set up a few virtual mailboxes using the Virtual plugin. These mailboxes are: - Unread (all undread in all mailboxes) - LastDay (last 24h of all mailboxes) - LastWeek (last 7 days of all mailboxes) ... The virtual mailboxes in general are working great. However, there is one annoying behavior I would like to fix. If I define my virtual mailboxes like this: namespace inbox { inbox = yes prefix = "Virtual/" separator = / location = "virtual:~/.emails_virtual:LAYOUT=fs" list = yes subscriptions = yes } All programs can work with this mailbox. However, the index are not kept in sync. Let's say I mark some emails as "read" in the "Unread" mailbox, then they will still be in "unread"-state in the LastDay and LastWeek mailboxes. This is annoying. And there is a fix for it... location = "virtual:~/.emails_virtual:LAYOUT=fs:INDEX=MEMORY" Once I set INDEX=MEMORY, the mailbox refresh happens instantly. Marking an email as "read" in the "Unread" mailbox will instantly set it as "read" in the other mailboxes as well. However, many mail programs (mainly clients on OSX and iOS) have trouble and freak out with a refresh loop once I open these mailboxes. One client specifically complained about UID validity issues, which leads me to believe that UIDs are generated on the fly and are not stable when INDEX is set to MEMORY? How can I keep my virtual mailboxes in sync? Shouldn't they stay in sync even when INDEX=MEMORY is *not* set? I tried to set INDEX to a directory - it didn't help. Best Regards, Stefan Files: - 15-mailboxes.conf: https://gist.github.com/e54d458ece16ad6f29b536fa840e99ec - dovecot version: 2.2.31 (65cde28) - OS: FreeBSD 11.0-RELEASE-p11 -- Stefan Hagen @: post(a)herrhagen.de T: +49 (0) 151 623 456 01 PGP: 0x8B8BD6DB

2 2

Re: IMAP From sort uses only local-part
by Paul 08 Aug '17

08 Aug '17

On August 7, 2017, at 2:56pm, Michael Slusarz wrote: > This is the RFC 5256 compliant behavior.? From is sorted on addr-mailbox.? Interesting. I can't be the only person who's found this to be a limitation, right? It would be very useful to sort by actual sender, not just to group all the michael@'s together, then all the paul@'s, etc. I'm just a user looking for a workaround, not a protocol architect, but it looks like the RFC also specifies that SORT is extensible, so maybe the most correct, if not the easiest, solution would be to define a new sort key such as DOMAIN.

1 0

Re: Auth Policy Server/wforce/weakforced
by Daniel Miller 08 Aug '17

08 Aug '17

On 8/4/2017 12:48 PM, Daniel Miller wrote: > On 8/3/2017 6:11 AM, Teemu Huovila wrote: >> >> On 02.08.2017 23:35, Daniel Miller wrote: >>> Is there explicit documentation available for the (probably trivial) >>> configuration needed for Dovecot and Wforce? I'm probably missing >>> something that should be perfectly obvious... >>> >>> Wforce appears to start without errors. I added a file to dovecot's >>> conf.d: >>> >>> 95-policy.conf: >>> auth_policy_server_url = http://localhost:8084/ >>> auth_policy_hash_nonce = this_is_my_super_secret_something >>> >>> Looking at the Wforce console I see: >>> >>> WforceWebserver: HTTP Request "/" from 127.0.0.1:45108: Web >>> Authentication failed >>> >>> In wforce.conf I have the (default): >>> >>> webserver("0.0.0.0:8084", "--WEBPWD") >>> >>> Do I need to change the "--WEBPWD"? Do I need to specify something >>> in the Dovecot config? >> You could try putting an actual password, in plain text, where >> --WEBPWD is. Then add that base64 encoded to dovecot setting >> auth_policy_server_api_header. >> > I knew it would be something like that. I've made some changes but > I'm still not there. I presently have: > > webserver("0.0.0.0:8084", "--WEBPWD ultra-secret-secure-safe") > in wforce.conf (and I've tried with and without the --WEBPWD) > > and > > auth_policy_server_api_header = Authorization: Basic > dWx0cmEtc2VjcmV0LXNlY3VyZS1zYWZl > in 95-policy.conf for dovecot > > Obviously I'm still formatting something wrong. > I think I've got something working a little better. I'm using: webserver("0.0.0.0:8084", "ultra-secret-secure-safe") (so I remove the --WEBPWD - that's a placeholder, not a argument declaration) and for dovecot, the base64 encoding needs to be "wforce:password" instead of just the password. Now I have to see what else needs to be tweaked. Daniel

2 1

[master-2.2] 4118e86
by Armin Tüting 08 Aug '17

08 Aug '17

quota-status.c: In function ‘client_handle_request’: quota-status.c:98:10: warning: passing argument 4 of ‘message_detail_address_parse’ from incompatible pointer type [enabled by default] &detail); ^ In file included from quota-status.c:14:0: ../../../src/lib-mail/message-address.h:38:6: note: expected ‘const char **’ but argument is of type ‘char *’ void message_detail_address_parse(const char *delimiter_string, ^ quota-status.c:98:10: error: too many arguments to function ‘message_detail_address_parse’ &detail); ^ In file included from quota-status.c:14:0: ../../../src/lib-mail/message-address.h:38:6: note: declared here void message_detail_address_parse(const char *delimiter_string,

2 1

Dovecot infrastructure
by Simone Marx :: Edinet Srl 08 Aug '17

08 Aug '17

Hi, I would need some suggestion for a dovecot based mail infrastructure. Actually, only one server (with dovecot sendmail amavis spamassassin clamav etc etc) is no longer enouth, so I thought I would put on a more complex infrastructure on different servers. But I do not know a few things. I was thinking about partitioning users on 3-4 servers with dovecot (imap / pop3) and dovecot-lda (no networked filesystem between them) and then configuring 1-2 servers with dovecot director and 1-2 servers for SMTP with postfix. It is not clear how the director will map user -> server to be used and, in a user virtualization context (maybe on MySQL) what is the owner / permissions I should give to home folders where I will store mail Thank you. Simone.

3 3

IMAP From sort uses only local-part
by Paul 08 Aug '17

08 Aug '17

As far as I can tell, when I ask Dovecot to sort an IMAP mailbox by the >From address, it ignores the part of the address after the '@'. So, for instance, mails from info(a)abc.org, info(a)xyz.org, and info(a)ghi.org are all mingled together in arrival order. Is there a way to change this? Thanks!

2 1

dovecot 2.2.28 password auth with openldap
by Markus Rosjat 07 Aug '17

07 Aug '17

Hi there, I desperatly trying to store a BLF-CRYPT password hash in an LDAP userPassword Attribute and get dovecot to authenticate against it. I use a thunderbird as client and send the password plain with starttls. what worked so far but is kinda problematic for my smtp authenticaton was to store the has with the prefix {CRYPT} or {BLF-CRYPT}. Is there a way to get dovecot to authenticate without storing the prefix in the LDAP attribute ? regards -- Markus Rosjat fon: +49 351 8107223 mail: rosjat(a)ghweb.de G+H Webservice GbR Gorzolla, Herrmann Königsbrücker Str. 70, 01099 Dresden http://www.ghweb.de fon: +49 351 8107220 fax: +49 351 8107227 Bitte prüfen Sie, ob diese Mail wirklich ausgedruckt werden muss! Before you print it, think about your responsibility and commitment to the ENVIRONMENT

3 2

Re: dovecot Digest, Vol 172, Issue 8
by Ken Zachreson 06 Aug '17

06 Aug '17

Help Thank You, Ken Zachreson On Aug 6, 2017 2:00 AM, dovecot-request(a)dovecot.org wrote: ATTENTION: This email was sent from someone outside of GCRC. Always use caution when opening attachments or clicking links, and when receiving unexpected emails. Send dovecot mailing list submissions to dovecot(a)dovecot.org To subscribe or unsubscribe via the World Wide Web, visit https://dovecot.org/mailman/listinfo/dovecot or, via email, send a message with subject or body 'help' to dovecot-request(a)dovecot.org You can reach the person managing the list at dovecot-owner(a)dovecot.org When replying, please edit your Subject line so it is more specific than "Re: Contents of dovecot digest..." Today's Topics: 1. Re: Corrupted SSL parameters file in state_dir: ssl-parameters.dat (Terry Jones) 2. Using Dovecot for IMAP/POP and SMTP (Kenneth Ulrich) 3. Re: Using Dovecot for IMAP/POP and SMTP (Larry Rosenman) 4. Re: Using Dovecot for IMAP/POP and SMTP (Randy Bush) ---------------------------------------------------------------------- Message: 1 Date: Sat, 5 Aug 2017 11:55:49 +0100 From: Terry Jones <r.a.n.domdev4+dovecot(a)gmail.com> To: Joseph Tam <jtam.home(a)gmail.com> Cc: dovecot(a)dovecot.org Subject: Re: Corrupted SSL parameters file in state_dir: ssl-parameters.dat Message-ID: <CA+HuS5GLWxSq6fxh8pg4RXsYOOUBa0gLqTQ-Pt0Xs-fC1pfmYQ(a)mail.gmail.com> Content-Type: text/plain; charset="UTF-8" > > > Your timestamps suggest you did this the other way around. > > Aki mentioned that issue is/will be fixed, but DH parameters can take a > *very* long time to generate if you're unlucky, so maybe it's a timing > issue (using the service before the DH parameters was ready.) > I think I would ask you to ignore the timestamps in this instance. I can tell you from fact that I deleted the old .dat file, restarted dovecot, and waited for it to regenerate the file (i.e. there was nothing there, and then there was ...). So I can guarantee you that the file there at the moment very much is a new file, and that I waited for that new file before testing again. ------------------------------ Message: 2 Date: Sat, 5 Aug 2017 20:14:57 -0500 From: Kenneth Ulrich <ulrichkenneth(a)gmail.com> To: dovecot(a)dovecot.org Subject: Using Dovecot for IMAP/POP and SMTP Message-ID: <CACSvXraiWV_JkJ=bZmnNV6Axs8ziWb_8ywN0beyB1fkRJ3RLSg(a)mail.gmail.com> Content-Type: text/plain; charset="UTF-8" All, I was wondering if it is possible to use Dovecot as both incoming and outgoing. I have a friend that I am helping build a server, and he plans on using Dovecot for POP/IMAP and Postfix for SMTP and mailbox storage. If I understand right, Dovecot can handle both services and that is the path I would like him to take for easier maintenance. Can someone confirm this? ------------------------------ Message: 3 Date: Sat, 5 Aug 2017 20:18:18 -0500 From: Larry Rosenman <larryrtx(a)gmail.com> To: Dovecot Mailing List <dovecot(a)dovecot.org> Subject: Re: Using Dovecot for IMAP/POP and SMTP Message-ID: <CA+S=X75hvJU+Y5tiUCcLAC9kDLsDQhOwqMu7Q7Em6oXD_sG8YQ(a)mail.gmail.com> Content-Type: text/plain; charset="UTF-8" No. Dovecot is JUST an IMAP/Pop3 server. SMTP *MUST* be handled via an MTA (Mail transport agent). Exim, Postfix, Sendmail, qmail, others are MTA's for SMTP. On 8/5/17, Kenneth Ulrich <ulrichkenneth(a)gmail.com> wrote: > All, > > I was wondering if it is possible to use Dovecot as both incoming and > outgoing. > > I have a friend that I am helping build a server, and he plans on using > Dovecot for POP/IMAP and Postfix for SMTP and mailbox storage. > > If I understand right, Dovecot can handle both services and that is the > path I would like him to take for easier maintenance. > > Can someone confirm this? > -- Larry Rosenman http://www.lerctr.org/~ler Phone: +1 214-642-9640 (c) E-Mail: larryrtx(a)gmail.com US Mail: 17716 Limpia Crk, Round Rock, TX 78664-7281 ------------------------------ Message: 4 Date: Sun, 06 Aug 2017 10:48:58 +0900 From: Randy Bush <randy(a)psg.com> To: Kenneth Ulrich <ulrichkenneth(a)gmail.com> Cc: dovecot(a)dovecot.org Subject: Re: Using Dovecot for IMAP/POP and SMTP Message-ID: <m2tw1lihyt.wl-randy(a)psg.com> Content-Type: text/plain; charset=US-ASCII > I was wondering if it is possible to use Dovecot as both incoming and > outgoing. no. but if it was systemd it would, and pick up the paper post too. randy ------------------------------ Subject: Digest Footer _______________________________________________ dovecot mailing list dovecot(a)dovecot.org https://dovecot.org/mailman/listinfo/dovecot ------------------------------ End of dovecot Digest, Vol 172, Issue 8 ***************************************

1 0

Using Dovecot for IMAP/POP and SMTP
by Kenneth Ulrich 06 Aug '17

06 Aug '17

All, I was wondering if it is possible to use Dovecot as both incoming and outgoing. I have a friend that I am helping build a server, and he plans on using Dovecot for POP/IMAP and Postfix for SMTP and mailbox storage. If I understand right, Dovecot can handle both services and that is the path I would like him to take for easier maintenance. Can someone confirm this?

3 2

Re: Corrupted SSL parameters file in state_dir: ssl-parameters.dat
by Joseph Tam 05 Aug '17

05 Aug '17

> But if I enable SSL, the doveadm backup on the remote machine hangs. > And the destination machine prints the following two massages in the > logs : > > Aug 4 17:10:31 bbb dovecot: doveadm: Error: Corrupted SSL parameters > file in state_dir: ssl-parameters.dat - disabling SSL 360 > Aug 4 17:10:31 bbb dovecot: doveadm: Error: Couldn't initialize SSL > parameters, disabling SSL > > > BUT : > > (1) /var/lib/dovecot/ssl-parameters.dat *DOES* exist. > and > (2) If I delete it and restart dovecot, it successully re-creates it, as per > Aug 4 17:02:32 bbb dovecot: ssl-params: Generating SSL parameters > Aug 4 17:06:58 bbb dovecot: ssl-params: SSL parameters regeneration completed Your timestamps suggest you did this the other way around. Aki mentioned that issue is/will be fixed, but DH parameters can take a *very* long time to generate if you're unlucky, so maybe it's a timing issue (using the service before the DH parameters was ready.) Joseph Tam <jtam.home(a)gmail.com>

2 1

Re: Doveadm-sync SSH practicalities
by Joseph Tam 05 Aug '17

05 Aug '17

Terry Jones wrote: > The documentation is somewhat silent on this subject. If you mean https://wiki.dovecot.org/Tools/Doveadm/Sync the answers seem implicit to what's been stated. > What permissions does the SSH user need ? To be able to run the doveadm executable (or a wrapper script that eventually runs doveadm) on the remote side. > How associated does it need to be with things like dovecot directory > ownership etc ? It will take uid/gid directly from the login privileges unless you use a wrapper script that changes UID/GID. This may be necessary if you use remote-prefix option for remapping virtual users and user@domain to another UID/GID. > Obviously my dovecot daemon processes are running as restricted users > with "nologin" shells etc., and I don't really want to go opening > them up if I don't have to. It doesn't seem possible: you'll need to be able to set up the other endpoint of communication. You may be able to lock down the shell by replacing it with a fixed doveadm and arguments, or perhaps by fiddling with keys and the forced command feature of ssh, after working out the security issues. Depending on your use-case, you might be better off using one of the other transport methods. Do you actually need per-user syncing? Joseph Tam <jtam.home(a)gmail.com>

2 2

Auth Policy Server/wforce/weakforced
by Daniel Miller 04 Aug '17

04 Aug '17

Is there explicit documentation available for the (probably trivial) configuration needed for Dovecot and Wforce? I'm probably missing something that should be perfectly obvious... Wforce appears to start without errors. I added a file to dovecot's conf.d: 95-policy.conf: auth_policy_server_url = http://localhost:8084/ auth_policy_hash_nonce = this_is_my_super_secret_something Looking at the Wforce console I see: WforceWebserver: HTTP Request "/" from 127.0.0.1:45108: Web Authentication failed In wforce.conf I have the (default): webserver("0.0.0.0:8084", "--WEBPWD") Do I need to change the "--WEBPWD"? Do I need to specify something in the Dovecot config? -- Daniel

2 2

Corrupted SSL parameters file in state_dir: ssl-parameters.dat
by Terry Jones 04 Aug '17

04 Aug '17

Dovecot 2.2.10 Centos 7 Linux 3.10.0-514.26.2.el7.x86_64 #1 SMP Tue Jul 4 15:04:05 UTC 2017 x86_64 x86_64 x86_64 GNU/Linux I have been experimenting with backup options to another server using dovadm and was trying to use the doveadm service as a workaround seeing as I couldn't decipher what the docs were saying about ssh. My doveadm stanza looks as follows: service doveadm { inet_listener { port = 10101 ssl = yes } } If "ssl=no", a pushed "doveadm backup" from the remote machine works OK. But if I enable SSL, the doveadm backup on the remote machine hangs. And the destination machine prints the following two massages in the logs : Aug 4 17:10:31 bbb dovecot: doveadm: Error: Corrupted SSL parameters file in state_dir: ssl-parameters.dat - disabling SSL 360 Aug 4 17:10:31 bbb dovecot: doveadm: Error: Couldn't initialize SSL parameters, disabling SSL BUT : (1) /var/lib/dovecot/ssl-parameters.dat *DOES* exist. and (2) If I delete it and restart dovecot, it successully re-creates it, as per Aug 4 17:02:32 bbb dovecot: ssl-params: Generating SSL parameters Aug 4 17:06:58 bbb dovecot: ssl-params: SSL parameters regeneration completed

2 1

Problem switching from LDA to LMTP (with Postfix)
by Nikolaos Milas 04 Aug '17

04 Aug '17

Hello, I am trying to switch from LDA to LMTP on a Postfix/Dovecot setup, but something is going wrong. I have followed the directions at: https://wiki.dovecot.org/HowTo/PostfixDovecotLMTP Here is a session from dovecot.log: Aug 4 12:19:42 vmail2 dovecot: lmtp(3152): Connect from local Aug 4 12:19:42 vmail2 dovecot: auth: ldap(imaptester(a)noa.gr): unknown user Aug 4 12:19:42 vmail2 dovecot: lmtp(3152): Disconnect from local: Successful quit Aug 4 12:19:42 vmail2 dovecot: lmtp(3152): Connect from local Aug 4 12:19:42 vmail2 dovecot: auth: ldap(nmilas(a)noa.gr): unknown user Aug 4 12:19:42 vmail2 dovecot: lmtp(3152): Disconnect from local: Successful quit Aug 4 12:19:42 vmail2 dovecot: imap(nmilas): save: box=Sent, uid=31, msgid=<c84ae059-854d-12bc-6aa2-9099cc2977b2(a)noa.gr>, size=445, vsize=459, from=Nikolaos Milas <nmilas(a)noa.gr>, subject=Test (12) - vmail2, flags=(\Seen) What is going wrong? It seems authentication is not working correctly with this setup. If understand right, dovecot is querying ldap with the whole mail address and not with the local part only (which is the username), as I would expect. What is the suggested course of action? With LDA it was working fine; here is a sample log entry: Aug 4 12:02:51 vmail2 dovecot: lda(imaptester): sieve: msgid=<768b056c-1d12-c9bd-0864-c3fc6a6dbeda(a)noa.gr>: stored mail into mailbox 'INBOX' Aug 4 12:02:51 vmail2 dovecot: imap(nmilas): save: box=Sent, uid=30, msgid=<768b056c-1d12-c9bd-0864-c3fc6a6dbeda(a)noa.gr>, size=445, vsize=459, from=Nikolaos Milas <nmilas(a)noa.gr>, subject=Test (11) - vmail2, flags=(\Seen) Aug 4 12:02:51 vmail2 dovecot: imap(nmilas): Connection closed (noop finished 0.372 secs ago) in=628 out=2145 Please help me to figure out how things should be. The config file follows: ----------------------------- CONFIG START -------------------------------- protocols = imap pop3 sieve lmtp login_greeting = NOA POP/IMAP Srv XAPITI XPICTOY mail_location = maildir:~/Maildir/ mail_gid = 500 mail_uid = 500 auth_mechanisms = plain login auth_username_format = %Lu auth_verbose = yes auth_debug = no mail_debug = no disable_plaintext_auth = no mail_plugins = quota mail_log notify protocol imap { imap_client_workarounds = "delay-newmail" mail_plugins = quota imap_quota mail_log notify mail_max_userip_connections = 400 } protocol pop3 { mail_max_userip_connections = 3 mail_plugins = quota notify pop3_client_workarounds = outlook-no-nuls oe-ns-eoh pop3_uidl_format = %08Xu%08Xv } protocol lda { auth_socket_path = /var/run/dovecot/auth-master info_log_path = log_path = mail_plugins = quota notify sieve postmaster_address = sysadmin(a)noa.gr sendmail_path = /usr/lib/sendmail } protocol lmtp { auth_socket_path = /var/run/dovecot/auth-master postmaster_address = sysadmin(a)noa.gr mail_plugins = quota notify sieve sendmail_path = /usr/lib/sendmail } protocol sieve { managesieve_max_line_length = 65536 mail_max_userip_connections = 10 managesieve_logout_format = bytes=%i/%o managesieve_max_compile_errors = 10 } userdb { args = /etc/dovecot/dovecot-usrdb-ldap.conf driver = ldap } passdb { args = /etc/dovecot/dovecot-passdb-ldap.conf driver = ldap } plugin { mail_log_events = delete undelete expunge copy mailbox_delete mailbox_rename flag_change save mailbox_create mail_log_fields = uid box msgid size flags vsize from subject } plugin { quota = maildir:User quota quota_rule = *:storage=5G quota_rule2 = Trash:storage=+3%% quota_warning = storage=75%% quota-warning 75 %u quota_warning2 = storage=90%% quota-warning 90 %u } plugin { sieve = file:~/sieve;active=~/.dovecot.sieve sieve_max_script_size = 0 sieve_max_actions = 0 sieve_max_redirects = 1 } service quota-warning { executable = script /opt/mail1.sh user = vmail unix_listener quota-warning { user = vmail } } service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0660 user = postfix } unix_listener auth-master { group = vmail mode = 0660 user = vmail } user = root } service imap-login { service_count = 1 vsz_limit = 64 M process_limit = 500 process_min_avail = 2 } service pop3-login { service_count = 1 vsz_limit = 64 M } service managesieve-login { inet_listener sieve { port = 4190 } service_count = 1 process_min_avail = 0 vsz_limit = 64M } service managesieve { process_limit = 1024 } service imap { executable = imap postlogin process_limit = 2048 } service pop3 { executable = pop3 postlogin } service postlogin { executable = script-login -d rawlog unix_listener postlogin { } } service lmtp { unix_listener /var/spool/postfix/private/dovecot-lmtp { group = postfix mode = 0600 user = postfix } } ssl_ca = </etc/pki/tls/certs/DigiCertCA.crt ssl_cert = </etc/pki/tls/certs/star_noa_gr-1243437.crt ssl_key = </etc/pki/tls/private/star_noa_gr-1243437.key ssl_protocols = !SSLv2 !SSLv3 syslog_facility = local1 ----------------------------- CONFIG END -------------------------------- FILE: /etc/dovecot/dovecot-usrdb-ldap.conf hosts = localhost tls = no base = ou=people, dc=noa, dc=gr scope = onelevel ldap_version = 3 dn = uid=auth,ou=Sys,dc=noa,dc=gr dnpass = secret auth_bind = yes user_filter = (uid=%u) pass_filter = (uid=%u) pass_attrs = uid=user,userPassword=password auth_bind_userdn = uid=%u,ou=people,dc=noa,dc=gr user_attrs = roomNumber=quota_rule=*:bytes=%$,uid=home=/home/vmail/%u iterate_filter = (objectClass=*) ---------------------------------------------------------------------------------------- Thanks in advance, Nick

2 2

proxy-dict with tcp connection
by Ralf Becker 04 Aug '17

04 Aug '17

I try to create a patch to allow (proxy-)dict to use tcp connections instead of a unix domain socket. I'm replacing connection_init_client_unix with connection_init_client_ip: --- ./src/lib-dict/dict-client.c.orig +++ ./src/lib-dict/dict-client.c @@ -721,6 +721,10 @@ client_dict_init(struct dict *driver, const char *uri, struct ioloop *old_ioloop = current_ioloop; struct client_dict *dict; const char *p, *dest_uri, *path; + const char *const *args; + unsigned int argc; + struct ip_addr ip; + in_port_t port=0; unsigned int idle_msecs = DICT_CLIENT_DEFAULT_TIMEOUT_MSECS; unsigned int warn_slow_msecs = DICT_CLIENT_DEFAULT_WARN_SLOW_MSECS; @@ -772,7 +776,21 @@ client_dict_init(struct dict *driver, const char *uri, dict->warn_slow_msecs = warn_slow_msecs; i_array_init(&dict->cmds, 32); - if (uri[0] == ':') { + args = t_strsplit(uri, ":"); + for(argc=0; args[argc] != NULL; argc++); + + if (argc == 3) { /* host:ip:somewhere --> argc == 3 */ + if (net_addr2ip(args[0], &ip) < 0) { + *error_r = t_strdup_printf("Invalid IP: %s in URI: %s", args[0], uri); + return -1; + } + if (net_str2port(args[1], &port) < 0) { + *error_r = t_strdup_printf("Invalid port: %s in URI: %s", args[1], uri); + return -1; + } + dest_uri = strrchr(uri, ':'); + } else if (uri[0] == ':') { /* default path */ path = t_strconcat(set->base_dir, "/"DEFAULT_DICT_SERVER_SOCKET_FNAME, NULL); @@ -784,7 +802,13 @@ client_dict_init(struct dict *driver, const char *uri, path = t_strconcat(set->base_dir, "/", t_strdup_until(uri, dest_uri), NULL); } - connection_init_client_unix(dict_connections, &dict->conn.conn, path); + if (port > 0) { + connection_init_client_ip(dict_connections, &dict->conn.conn, &ip, port); + } else { + connection_init_client_unix(dict_connections, &dict->conn.conn, path); + } dict->uri = i_strdup(dest_uri + 1); dict->ioloop = io_loop_create(); But unfortunately this crashes: Jul 28 13:20:04 auth: Error: auth worker: Aborted PASSL request for info(a)outdoor-training.de: Worker process died unexpectedly Jul 28 13:20:04 auth-worker(705): Fatal: master: service(auth-worker): child 705 killed with signal 11 (core dumped) Jul 28 13:20:04 doveadm(10.44.88.1,info(a)outdoor-training.de): Error: user info(a)outdoor-training.de: Auth PASS lookup failed It looks like the tcp connection gets opened non-blocking and the first write / dict lookup happens to early: 4303041 13:44:25.120398220 0 auth (29884) < connect res=-115(EINPROGRESS) tuple=172.18.0.2:47552->10.44.99.180:2001 Looking at dict-memcached-ascii.c I probably need to do something like: i_array_init(&dict->input_states, 4); i_array_init(&dict->replies, 4); dict->ioloop = io_loop_create(); io_loop_set_current(old_ioloop); *dict_r = &dict->dict; to wait until the socket is ready ... Any idea / tips? Ralf -- Ralf Becker EGroupware GmbH [www.egroupware.org] Handelsregister HRB Kaiserslautern 3587 Geschäftsführer Birgit und Ralf Becker Leibnizstr. 17, 67663 Kaiserslautern, Germany Telefon +49 631 31657-0

2 2

rawlog
by Matt Bryant 04 Aug '17

04 Aug '17

Hi, Trying to get rawlog working on dovecot 2.2.31 configured as per https://wiki2.dovecot.org/Debugging/Rawlog but a) it doesnt appear to be loggin anything b) rawlog_dir which is supposed to be v2.2.26+ seems no where in site .. in fact complains about unknown variable So does rawlog still do anything ???? Or am I missing something ... config is below .... # 2.2.19: /etc/dovecot/dovecot.conf # Pigeonhole version 0.4.9 (357ac0a0e68b+) doveconf: Warning: service auth { client_limit=30000 } is lower than required under max. load (150032) doveconf: Warning: service anvil { client_limit=22000 } is lower than required under max. load (50027) # OS: Linux 3.10.0-327.4.4.el7.x86_64 x86_64 CentOS Linux release 7.2.1511 (Core) auth_cache_negative_ttl = 2 mins auth_cache_size = 10 M auth_cache_ttl = 10 mins auth_master_user_separator = * auth_mechanisms = plain login auth_worker_max_count = 10000 default_client_limit = 50000 default_process_limit = 50000 disable_plaintext_auth = no doveadm_password = # hidden, use -P to show it imap_client_workarounds = delay-newmail tb-extra-mailbox-sep tb-lsub-flags imap_hibernate_timeout = 1 mins imap_idle_notify_interval = 1 mins login_greeting = IMAP/POP3 ready - dev-dh-ro-ms-001-b mail_attachment_dir = /var/lib/dovecot/attachments/%Ld mail_cache_min_mail_count = 5 mail_plugins = " notify replication quota virtual" mailbox_list_index = yes managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate vacation-seconds spamtest spamtestplus editheader mbox_write_locks = fcntl mmap_disable = yes namespace { inbox = yes list = yes location = mailbox Archive { auto = create special_use = \Archive } mailbox Drafts { auto = create special_use = \Drafts } mailbox Sent { auto = create special_use = \Sent } mailbox Spam { auto = create special_use = \Junk } mailbox Trash { auto = create special_use = \Trash } prefix = INBOX/ separator = / type = private } namespace { list = no location = virtual:/var/lib/dovecot/virtual:INDEXPVT=~/virtual prefix = virtual/ separator = / type = private } passdb { args = /etc/dovecot/sql_users.conf driver = sql } plugin { mail_log_events = delete expunge mail_log_fields = uid box msgid size mail_replica = tcp:dev-ms-001-a:4000 quota = dict:UserQuota::file:%h/dovecot-quota quota_rule2 = INBOX/Trash:storage=+10%% sieve = file:~/sieve/user;active=~/.dovecot.sieve sieve_default = file:/var/lib/dovecot/sieve/default.sieve sieve_default_name = default sieve_editheader_max_header_size = 1k sieve_extensions = +spamtest +spamtestplus +editheader +vacation-seconds sieve_global = file:/var/lib/dovecot/sieve sieve_quota_max_scripts = 5 sieve_spamtest_max_value = 200 sieve_spamtest_status_header = X-Spam-score-int: -?([[:digit:]]+) sieve_spamtest_status_type = score sieve_vacation_default_period = 10d sieve_vacation_max_period = 30d sieve_vacation_min_period = 1s } pop3_client_workarounds = outlook-no-nuls oe-ns-eoh pop3_fast_size_lookups = yes protocols = imap pop3 lmtp sieve replication_dsync_parameters = -d -n INBOX -l 30 -U service aggregator { fifo_listener replication-notify-fifo { user = vmail } unix_listener replication-notify { user = vmail } } service anvil { client_limit = 22000 } service auth-worker { user = $default_internal_user } service auth { client_limit = 30000 unix_listener auth_client { mode = 0660 user = exim } } service doveadm { client_limit = 1 inet_listener { address = * port = 4000 } process_limit = 80 process_min_avail = 8 service_count = 10 } service imap-hibernate { client_limit = 8000 process_limit = 8 process_min_avail = 8 service_count = 0 unix_listener imap-hibernate { group = vmail mode = 0660 } } service imap-login { client_limit = 8000 inet_listener imap { port = 143 } process_limit = 8 process_min_avail = 8 service_count = 0 } service imap { client_limit = 1 process_limit = 50000 service_count = 100 } service managesieve-login { client_limit = 1000 inet_listener sieve { port = 4190 } process_limit = 8 process_min_avail = 8 service_count = 0 } service managesieve { process_limit = 1024 } service pop3-login { client_limit = 1000 inet_listener pop3 { port = 110 } process_limit = 8 process_min_avail = 8 service_count = 0 } service pop3 { process_limit = 10000 } service postlogin { executable = script-login -d rawlog unix_listener postlogin { group = atmail mode = 0660 } } service replicator { process_min_avail = 1 unix_listener replicator-doveadm { group = atmail mode = 0660 } } shutdown_clients = no ssl_cert = </etc/pki/dovecot/certs/dovecot.pem ssl_key = </etc/pki/dovecot/private/dovecot.pem userdb { driver = prefetch } userdb { args = /etc/dovecot/sql_users.conf driver = sql } protocol imap { mail_max_userip_connections = 30000 mail_plugins = " notify replication quota virtual imap_quota" } protocol pop3 { mail_max_userip_connections = 30000 mail_plugins = " notify replication quota virtual" } protocol lmtp { auth_username_format = %Lu mail_plugins = " notify replication quota virtual sieve quota" postmaster_address = mailer-daemon }

3 3

Re: rawlog
by Joseph Tam 04 Aug '17

04 Aug '17

Matt Bryant wrote: > a) it doesnt appear to be loggin anything > b) rawlog_dir which is supposed to be v2.2.26+ seems no where in site .. > in fact complains about unknown variable > ... > service postlogin { > executable = script-login -d rawlog > unix_listener postlogin { > group = atmail > mode = 0660 > } > } In my test setup, I use the first option protocol imap { ... rawlog_dir = /data/rawlogs/%u } You may also want it into your protocol pop3 section. Joseph Tam <jtam.home(a)gmail.com>

1 0

pam auth problem
by Randy Bush 03 Aug '17

03 Aug '17

# dovecot --version 2.2.31 (65cde28) on freebsd 64 10.3 system converted to dovecot 2 against my will and consuming a lot of time sorting it out. i am glad google does not charge. have spent two hours on this one alone; and undoubtedly it is my st00pidity. so excuse my desperate posting to lazynet. cram-md5 works, pam not so much Aug 3 06:06:35 psg auth: in openpam_parse_chain(): /etc/pam.d/dovecot(1): missing or invalid facility Aug 3 06:06:35 psg dovecot: auth-worker(48815): Error: pam(elb,2604:6000:130d:c31b:d250:99ff:fe90:14dd,<Lyh6LtNVMq8mBGAAEw3DG9JQmf/+kBTd>): pam_start() failed: system error Aug 3 06:06:35 psg auth: in openpam_parse_chain(): /etc/pam.d/dovecot(1): missing or invalid facility Aug 3 06:06:35 psg dovecot: auth-worker(48815): Error: pam(elb,2604:6000:130d:c31b:d250:99ff:fe90:14dd,<Lyh6LtNVMq8mBGAAEw3DG9JQmf/+kBTd>): pam_start() failed: system error # 2.2.31 (65cde28): /usr/local/etc/dovecot/dovecot.conf # OS: FreeBSD 10.3-RELEASE-p20 amd64 auth_mechanisms = plain login cram-md5 first_valid_gid = 0 mail_location = mbox:~/mail/:INBOX=/var/mail/%u mail_privileged_group = mail namespace inbox { inbox = yes location = prefix = } passdb { args = scheme=cram-md5 /usr/local/etc/dovecot.cram-md5 driver = passwd-file name = passwd-file } passdb { driver = pam } passdb { driver = pam name = pam } pop3_client_workarounds = outlook-no-nuls oe-ns-eoh protocols = imap pop3 service auth { unix_listener auth-userdb { group = mail } } service imap-login { inet_listener imaps { port = 993 ssl = yes } } service pop3-login { inet_listener pop3 { port = 110 } inet_listener pop3s { port = 995 ssl = yes } } ssl_cert = </etc/ssl/certs/dovecot.pem ssl_key = # hidden, use -P to show it userdb { driver = passwd } # cat /etc/pam.d/dovecot passdb { driver = pam args = failure_show_msg=yes args = %s }

5 10

Replication and public folders with private (seen) flags
by Ralf Becker 03 Aug '17

03 Aug '17

We started using Dovecot replication between two nodes and noticed that our configured private flags (INDEXPVT) in public/shared mailboxes are not replicated. We are only replicating INBOX namespace, as we dont want to replicate content of shared mailboxes for every user again. Is there a way to replicate the INDEXPVT or is that not (yet) implemented? Dovecot versions: # 2.2.31 (65cde28): /etc/dovecot/dovecot.conf # Pigeonhole version 0.4.19 (e5c7051) # OS: Linux 4.4.0-87-generic x86_64 Using following namespaces: namespace inboxes { inbox = yes location = mailbox Drafts { auto = subscribe special_use = \Drafts } mailbox Junk { auto = subscribe special_use = \Junk } mailbox Sent { auto = subscribe special_use = \Sent } mailbox Templates { auto = subscribe } mailbox Trash { auto = subscribe special_use = \Trash } prefix = INBOX/ separator = / subscriptions = no } namespace subs { hidden = yes list = no location = prefix = separator = / } namespace users { location = mdbox:%%h/mdbox:INDEXPVT=~/shared/%%u prefix = user/%%n/ separator = / subscriptions = no type = shared } And the following replication config: root@ka-nfs-mail:~# cat /etc/dovecot/replication.conf service aggregator { fifo_listener replication-notify-fifo { user = dovecot } unix_listener replication-notify { user = dovecot } } service replicator { process_min_avail = 1 unix_listener replicator-doveadm { group = dovecot user = dovecot mode = 0660 } } service doveadm { inet_listener { port = 12345 #ssl = yes } } doveadm_port = 12345 doveadm_password = ******* plugin { #mail_replica = tcp:10.44.99.1 # use doveadm_port mail_replica = tcp:10.44.88.1 # use doveadm_port } replication_dsync_parameters = -d -n INBOX -l 30 -U -- Ralf Becker EGroupware GmbH [www.egroupware.org] Handelsregister HRB Kaiserslautern 3587 Geschäftsführer Birgit und Ralf Becker Leibnizstr. 17, 67663 Kaiserslautern, Germany Telefon +49 631 31657-0

1 0

Doveadm-sync SSH practicalities
by Terry Jones 02 Aug '17

02 Aug '17

Hi, The documentation is somewhat silent on this subject. What permissions does the SSH user need ? How associated does it need to be with things like dovecot directory ownership etc ? Obviously my dovecot daemon processes are running as restricted users with "nologin" shells etc., and I don't really want to go opening them up if I don't have to. So could someone kindly please expand a little on how exactly doveadm-sync is supposed to work with SSH ? Thanks Terry

1 0

result of uid sort by subject
by TACHIBANA Masashi 02 Aug '17

02 Aug '17

Result of uid sort by subject is not expected. for example: Japanese => English => Japanese => English I'm now using Dovecot 2.2.31. command example: HNKK6 UID SORT (REVERSE SUBJECT) utf-7 ALL * SORT 3 1 7 2 4 10 11 8 12 HNKK6 OK Sort completed (0.002 + 0.041 + 0.001 secs). Any hint? -- Masashi Astro TACHIBANA QUALITIA CO., LTD. mailto:tachibana@qualitia.co.jp

2 2

Corrupt index files
by Bruce Guenter 02 Aug '17

02 Aug '17

I am running Dovecot IMAP on Linux, on a LizardFS storage cluster with Maildir storage. This has worked well for most of the accounts for several months. However in the last couple of weeks we are seeing increasing errors regarding corrupted index files. Some of the accounts affected are unable to retrieve messages due to timeouts. It appeared the problems were due to the accounts being accessed from multiple servers simultaneously, so I forced them all to access one server, but the errors remained. It looks like it has something to do with file locking, but LizardFS supports advisory file locking and I do have it enabled. Deleting the corrupted indexes fixes the problem for a while, but it eventually returns, particularly for some accounts. Here are some errors I'm seeing (just a random grab). Actual home directories are munged for confidentiality. imap[25157]: (clientes.standby) Error: Failed to fix view for HOME/clientes:standby/dovecot.index: Missing middle file seq=1 (between 1..1, we have seqs 8): File is already open imap[5565]: (stadiumchair) Error: Transaction log file HOME/stadiumchair/.Drafts/dovecot.index.log: marked corrupted imap[5005]: (stadiumchair) Error: Corrupted transaction log file HOME/stadiumchair/.Drafts/dovecot.index.log seq 2: indexid changed 1418941056 -> 1500658549 (sync_offset=0) imap[20243]: (martha) Error: Transaction log HOME/martha/dovecot.index.log: duplicate transaction log sequence (539) imap[4665]: (emsspam) Error: Index file HOME/emsspam/dovecot.index: indexid changed: 1500658479 -> 1297175382 imap[4665]: (emsspam) Error: Corrupted transaction log file HOME/emsspam/dovecot.index.log seq 3: indexid changed: 1500658479 -> 1297175382 (sync_offset=316) imap[22985]: (emsspam) Error: Corrupted transaction log file HOME/emsspam/dovecot.index.log seq 10742: Invalid transaction log size (9296 vs 9296): HOME/emsspam/dovecot.index.log (sync_offset=9296) imap[3267]: (emsspam) Error: Failed to map view for HOME/emsspam/dovecot.index: Failed to map file seq=10742 offset=9052..18446744073709551615 (ret=0): corrupted, indexid=0 imap[3267]: (emsspam) Error: HOME/emsspam/dovecot.index view is inconsistent: uid=3062271 inserted in the middle of mailbox The output of dovecot -n is pasted in below. Note that some of the boxes are running 4.9, some running 4.4, all have the same problems. Also note that I am using a custom authentication front end for our virtual mailboxes, but it just sets up the minimal environment variables and runs imap. Is there anything I can change to eliminate these problems? Are there any other diagnostics I can provide to shed light on this? # 2.2.31 (65cde28): /etc/dovecot/dovecot.conf # OS: Linux 4.4.66 x86_64 Gentoo Base System release 2.3 log_path = /dev/stderr mail_debug = yes mail_fsync = always mail_location = maildir:~/.maildir mail_log_prefix = "%s[%p]: (%u) " mmap_disable = yes namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = INBOX separator = type = private } passdb { args = * driver = pam } passdb { args = /etc/dovecot/dovecot-sql.conf.ext driver = sql } plugin { mail_log_events = delete undelete expunge copy mailbox_delete mailbox_rename } ssl_cert = </etc/ssl/dovecot/server.pem ssl_key = # hidden, use -P to show it userdb { driver = passwd } userdb { args = /etc/dovecot/dovecot-sql.conf.ext driver = sql } -- Bruce Guenter <bruce(a)untroubled.org> http://untroubled.org/

5 11

under another kind of attack
by Olaf Hopp 31 Jul '17

31 Jul '17

Hi folks, "somehow" similar to the thread "under some kind oof attack" started by "MJ": I have dovecot shielded by fail2ban which works fine. But since a few days I see many many IPs per day knocking on my doors with wron password and/or users. But the rate at which they are knocking is very very low. So fail2ban will never catch them. For example one IP: Jul 25 14:03:17 irams1 dovecot: auth-worker(2212): pam(eurodisc,101.231.247.210,<gAulHSNVsNZl5/fS>): unknown user Jul 25 15:16:36 irams1 dovecot: auth-worker(11047): pam(gergei,101.231.247.210,<dPzYIyRVtOpl5/fS>): pam_authenticate() failed: Authentication failure (password mismatch?) Jul 25 16:08:51 irams1 dovecot: auth-worker(3379): pam(icpe,101.231.247.210,<Ws6t3iRVkOhl5/fS>): unknown user Jul 25 16:10:47 irams1 dovecot: auth-worker(4250): pam(endsulei,101.231.247.210,<dceL5SRVGZVl5/fS>): unknown user Note the timestamps. If I look the other way round (tries to one account) I'll get Jul 25 01:30:48 irams1 dovecot: auth-worker(11276): pam(endsulei,60.166.12.117,<slp6mhhViI48pgx1>): unknown user Jul 25 01:31:26 irams1 dovecot: auth-worker(11276): pam(endsulei,222.243.211.200,<s0+6nBhVabHe89PI>): unknown user Jul 25 13:29:22 irams1 dovecot: auth-worker(4745): pam(endsulei,60.2.50.114,<4elhpCJVtcw8AjJy>): unknown user Jul 25 13:30:27 irams1 dovecot: auth-worker(4747): pam(endsulei,222.84.118.83,<kaE1qCJVn7neVHZT>): unknown user Jul 25 16:10:47 irams1 dovecot: auth-worker(4250): pam(endsulei,101.231.247.210,<dceL5SRVGZVl5/fS>): unknown user Jul 25 16:11:45 irams1 dovecot: auth-worker(5933): pam(endsulei,206.214.0.120,<R5H56CRVdJfO1gB4>): unknown user Also note the timestamps! And I see many many distinct IPs per day (a few hundred) trying many many existing and non-existings accounts. As you see in the timestamps in my examples, this can not be handled by fail2ban without affecting regular users with typos. Is anybody observing something similar ? Anybody an idea against this ? Many of these observed IPs are chinese mobile IPs, if this matters. But we have also chinese students and researchers all abroad. Regards, Olaf -- Karlsruher Institut für Technologie (KIT) ATIS - Abt. Technische Infrastruktur, Fakultät für Informatik Dipl.-Geophys. Olaf Hopp - Leitung IT-Dienste - Am Fasanengarten 5, Gebäude 50.34, Raum 009 76131 Karlsruhe Telefon: +49 721 608-43973 Fax: +49 721 608-46699 E-Mail: Olaf.Hopp(a)kit.edu atis.informatik.kit.edu www.kit.edu KIT – Die Forschungsuniversität in der Helmholtz-Gemeinschaft Das KIT ist seit 2010 als familiengerechte Hochschule zertifiziert.

11 16

Re: under another kind of attack
by Davide Marchi 31 Jul '17

31 Jul '17

> From: Olaf Hopp <Olaf.Hopp(a)kit.edu> > Davide, > yours is all postfix and thus has got no overlap with dovecot. > So no interference. > Olaf Yes, I know, but I preferred not to give anything for granted ;-) Many Thanks Olaf!

1 0

Large Scale Cluster using dsync and tagged director
by Matt Bryant 31 Jul '17

31 Jul '17

Just been reading up on some of dovecot features and was wondering if anyone had played around with large scale systems made up from mutliple small dsync clusters and using tagged director to split users between nodes of a sync'd cluster (rather than nfs). I know traditionally its been shared storage and multiple nodes and dovecots own doco suggest dsync for several thousands rather than millions but given the cloud seems to be all about replication what about many smaller nodes using dsync and scaling horizontally ? The only issue is how does director scale when there are serveral(or rather lots of) 'tags' ... in fact what are the limitations with director ? Matt -- <https://www.postbox-inc.com/?utm_source=email&utm_medium=siglink&utm_campai…>

1 0

dovecot auth errors for a new user
by Ruben Safir 31 Jul '17

31 Jul '17

I've been running dovecott without trouble for quite a why and now when I added a new user, it is not accepting the user and I can not track the problem. It says find more information in the server log, but it is not in /var/log/messages or /var/log/mail.err and nothing with lsof dovecot|grep log show anything to tail www:~ # dovecot -n # 2.2.13: /etc/dovecot/dovecot.conf # OS: Linux 3.16.7-53-pae i686 openSUSE 13.2 (i586) base_dir = /var/run/dovecot/ managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date ihave namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } passdb { driver = pam } plugin { sieve = ~/.dovecot.sieve sieve_dir = ~/sieve } protocols = pop3 ssl_cert = </etc/ssl/certs/dovecot.pem ssl_key = </etc/ssl/private/dovecot.key userdb { driver = passwd } www:/etc/dovecot # dovecot --version 2.2.13 Sending of password for user facebook did not succeed. Mail server mrbrklyn.com responded: Internal error occurred. Refer to server log for more information. 2017-07-30T15:41:58.803006-04:00 www dovecot: pop3-login: Login: user=<facebook>, method=PLAIN, rip=10.0.0.62, lip=96.57.23.82, mpid=25269, TLS, session=<D5J/G45VQgAKAAA+> 2017-07-30T15:41:58.812827-04:00 www dovecot: pop3(facebook): Error: user facebook: Initialization failed: Namespace '': Mail storage autodetection failed with home=/home/facebook 2017-07-30T15:41:58.816903-04:00 www dovecot: pop3(facebook): Error: Invalid user settings. Refer to server log for more information. -- So many immigrant groups have swept through our town that Brooklyn, like Atlantis, reaches mythological proportions in the mind of the world - RI Safir 1998 http://www.mrbrklyn.com DRM is THEFT - We are the STAKEHOLDERS - RI Safir 2002 http://www.nylxs.com - Leadership Development in Free Software http://www2.mrbrklyn.com/resources - Unpublished Archive http://www.coinhangout.com - coins! http://www.brooklyn-living.com Being so tracked is for FARM ANIMALS and and extermination camps, but incompatible with living as a free human being. -RI Safir 2013

2 4

Re: under another kind of attack
by Davide Marchi 30 Jul '17

30 Jul '17

Hi to all, @Olaf Hopp I've this filter enabled for fail2ban, my question is: could my filters overlap or interfere with those suggested by you? this is my filter: Contents of /etc/fail2ban/jail.conf: [postfix] # Ban for 10 minutes if it fails 6 times within 10 minutes enabled = true port = smtp,ssmtp filter = postfix logpath = /var/log/mail.log maxretry = 6 bantime = 600 findtime = 600 Contents of /etc/fail2ban/filter.d/postfix.conf: # Fail2Ban configuration file # Author: Cyril Jaquier # $Revision$ [Definition] # Option: failregex # Notes.: regex to match the password failures messages in the logfile. The # host must be matched by a group named "host". The tag "<HOST>" can # be used for standard IP/hostname matching and is only an alias for # (?:::f{4,6}:)?(?P<host>[\w\-.^_]+) # Values: TEXT # # Jul 11 02:35:08 mail postfix/smtpd[16299]: lost connection after AUTH from unknown[196.12.178.73] failregex = lost connection after AUTH from unknown\[<HOST>\] # Option: ignoreregex # Notes.: regex to ignore. If this regex matches, the line is ignored. # Values: TEXT # ignoreregex = Many thanks!

2 1

Re: under another kind of attack
by Joseph Tam 28 Jul '17

28 Jul '17

(I think I am testing other readers' patience, so if you want to follow-up, you can Email me directly.) > but how often do you have to type your username ? Not often, but I'm not talking the typical case. The larger the population you serve, the more circumstances you'll have to cover. > Only on the initial config of your mailer. After that you are done. Mail reader setups by users is often an error prone process, judging from the number of times I have to correct a setup. This is especially true for an educational institution that typically has a large turnover of accounts. If a user gets it initially wrong, then fixes their mistake, they can't get it to work despite trying all sorts of config variations, not realizing it can't be resolved anymore. Result: trouble call. If someone blows it setting on a multi-user workstation, other users with a working setups can't log in. Result: trouble call. If a student flubs their credentials, all the roommates behind their residential NAT gateway suffer. Result: trouble call. If a user screws up using an external service that slurps their mail (e.g. Gmail, Yahoo, uniboxapp, etc.), or worse, someone malicious does it on puropse, all other users of this service will be DoS'd. Result: trouble call(s). If a user acquires a DHCP address in a polluted network ..., well you get the idea. Not to mention ex-users who forget to remove their mail accounts from their smartphones, leaving a trail of blacklist entries in their wake as they travel from coffee shops to other public WiFi hotspots. > So this is why I decided to use two distinct jails with > different policies. It seems to work reasonable well. Until it doesn't. If it works for you, more power to you. The cost/benefit of a hair-trigger blacklist policy is that it saves you a few log entries showing futile attempts at finding weak passwords (because you have strong passwords, don't you?) at the risk of dealing with any of the above situations. Joseph Tam <jtam.home(a)gmail.com>

1 0

Re: under another kind of attack
by Joseph Tam 27 Jul '17

27 Jul '17

Olaf Hopp <Olaf.Hopp(a)kit.edu> wrote: > And I have a new one just for "unknown user" and here my bantime and findtime > are much bigger and the retries are just '2'. So here I'm much harsher. > I'll keep an eye on my logs and maybe some more twaeking is necessary. Just be careful about typos (like twaeking!): users could simply misspell their username, or get mixed up with some another account or alias. This is why I favour targetting known bad accounts, not merely accounts that don't exist. Joseph Tam <jtam.home(a)gmail.com>

2 1

Re: failed to store into mailbox 'INBOX/Junk': Permission
by Davide Marchi 26 Jul '17

26 Jul '17

> From: Thomas Leuxner <tlx(a)leuxner.net> >> cat /etc/dovecot/dovecot-acl >> * user=booking(a)hotelsangiorgioriccione.com lrwsi >> * user=info(a)hotelsangiorgioriccione.com lrwsi > Hi Davide, > > For LMTP to file the mails you need to add the p flag (POST). Well, I've added the "p" flag and now I will monitor the situation ;-) PS Just as an additional note, just after making this change and reload Dovecot I have detected (oneshot) this error message: Jul 26 22:09:53 server dovecot: imap-login: Error: read(anvil) failed: EOF Jul 26 22:09:53 server dovecot: imap-login: Error: read(anvil) failed: EOF Jul 26 22:09:53 server dovecot: imap-login: Error: read(anvil) failed: EOF Jul 26 22:09:53 server dovecot: auth: Error: read(anvil-auth-penalty) failed: EOF Jul 26 22:09:53 server dovecot: auth: Error: net_connect_unix(anvil-auth-penalty) failed: Permission denied Jul 26 22:09:53 server dovecot: imap-login: Error: read(anvil) failed: EOF Jul 26 22:09:53 server dovecot: imap-login: Error: read(anvil) failed: EOF Jul 26 22:09:53 server dovecot: imap-login: Error: read(anvil) failed: EOF Jul 26 22:09:53 server dovecot: imap-login: Error: read(anvil) failed: EOF But now everything seems to work well (let's hope) ;-) Many thanks Thomas!

1 0

Return extra fields from passwd userdb
by Michele Petrella 26 Jul '17

26 Jul '17

Hi all. I use dovecot 2.2.29.1. Output of dovecot -n: # 2.2.29.1 (e0b76e3): /var/etc/dovecot/dovecot.conf # Pigeonhole version 0.4.18 (29cc74d) # OS: Linux 3.10.55-gentoo i686 SuSE Linux 7.1 (i386) debug_log_path = /var/log/dovecot/dovecot_debug.log disable_plaintext_auth = no info_log_path = /var/log/state.mail/dovecot.pipe log_path = /var/log/dovecot/dovecot.log mail_debug = yes mail_gid = users mail_location = maildir:~/.maildir mail_plugins = acl quota mail_shared_explicit_inbox = yes mail_uid = vmail managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext namespace { list = yes location = maildir:/data/home/vmail/public prefix = Public/ separator = / subscriptions = no type = public } namespace { list = children location = maildir:/data/home/%%n/.maildir:INDEX=~/.maildir/shared/%%u prefix = Shared/%%u/ separator = / subscriptions = no type = shared } namespace inbox { inbox = yes list = yes location = mailbox Cestino { special_use = \Trash } mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox "Posta inviata" { special_use = \Sent } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = separator = / subscriptions = yes type = private } passdb { args = /etc/dovecot/passwd.masterusers driver = passwd-file master = yes } passdb { driver = pam } plugin { acl = vfile:/etc/dovecot/acl:cache_secs=300 acl_shared_dict = file:/var/lib/dovecot-dict/shared-mailboxes quota = maildir:User quota quota_rule = *:storage=5M quota_rule2 = Trash:storage=+100M quota_rule3 = SPAM:ignore sieve = ~/.dovecot.sieve sieve_before = /var/etc/dovecot/sieve/general/ sieve_dir = ~/sieve sieve_execute_bin_dir = /usr/local/bin/dovecot/sieve-execute sieve_filter_bin_dir = /usr/local/bin/dovecot/sieve-filter sieve_global_dir = /var/etc/dovecot/sieve/global/ sieve_global_extensions = +vnd.dovecot.execute +vnd.dovecot.filter +vnd.dovecot.pipe +editheader sieve_pipe_bin_dir = /usr/local/bin/dovecot/sieve-pipe sieve_plugins = sieve_extprograms } protocols = imap pop3 lmtp sieve service auth { unix_listener auth-userdb { group = users } } service imap-postlogin { executable = script-login /usr/local/bin/imap-postlogin.sh user = $default_internal_user } service imap { executable = imap imap-postlogin } ssl = no ssl_cert = </conf/etc/cert/certs/services/imap_pop/majornet.crt ssl_key = # hidden, use -P to show it userdb { default_fields = quota_rule=*:bytes=%$ driver = passwd } protocol lda { info_log_path = /var/log/dovecot/dovecot-lda.log log_path = /var/log/dovecot/dovecot-lda.log mail_plugins = acl quota sieve } protocol imap { mail_max_userip_connections = 20 mail_plugins = acl quota imap_acl imap_quota } I have problems in return extra fields from passwd userdb. My users are partially in passwd files and partially in LDAP. Users who use mail are in LDAP db. If I use "default_fields = quota_rule=*:bytes=100M" in userdb, Output of "doveadm -D quota get -u afasystems" is: Debug: Loading modules from directory: /usr/lib/dovecot Debug: Module loaded: /usr/lib/dovecot/lib01_acl_plugin.so Debug: Module loaded: /usr/lib/dovecot/lib10_quota_plugin.so Debug: Loading modules from directory: /usr/lib/dovecot/doveadm Debug: Module loaded: /usr/lib/dovecot/doveadm/lib10_doveadm_acl_plugin.so Debug: Skipping module doveadm_expire_plugin, because dlopen() failed: /usr/lib/dovecot/doveadm/lib10_doveadm_expire_plugin.so: undefined symbol: expire_set_deinit (this is usually intentional, so just ignore this message) Debug: Module loaded: /usr/lib/dovecot/doveadm/lib10_doveadm_quota_plugin.so Debug: Module loaded: /usr/lib/dovecot/doveadm/lib10_doveadm_sieve_plugin.so Debug: Skipping module doveadm_fts_lucene_plugin, because dlopen() failed: /usr/lib/dovecot/doveadm/lib20_doveadm_fts_lucene_plugin.so: undefined symbol: lucene_index_iter_deinit (this is usually intentional, so just ignore this message) Debug: Skipping module doveadm_fts_plugin, because dlopen() failed: /usr/lib/dovecot/doveadm/lib20_doveadm_fts_plugin.so: undefined symbol: fts_user_get_language_list (this is usually intentional, so just ignore this message) Debug: Skipping module doveadm_mail_crypt_plugin, because dlopen() failed: /usr/lib/dovecot/doveadm/libdoveadm_mail_crypt_plugin.so: undefined symbol: mail_crypt_box_get_pvt_digests (this is usually intentional, so just ignore this message) doveadm(afasystems): Debug: auth USER input: afasystems quota_rule=*:bytes=100M system_groups_user=afasystems uid=1002 gid=100 home=/data/home/afasystems doveadm(afasystems): Debug: Added userdb setting: plugin/quota_rule=*:bytes=100M doveadm(afasystems): Debug: Effective uid=1002, gid=100, home=/data/home/afasystems doveadm(afasystems): Debug: Quota root: name=User quota backend=maildir args= doveadm(afasystems): Debug: Quota rule: root=User quota mailbox=* bytes=104857600 messages=0 doveadm(afasystems): Debug: Quota rule: root=User quota mailbox=Trash bytes=+104857600 messages=0 doveadm(afasystems): Debug: Quota rule: root=User quota mailbox=SPAM ignored doveadm(afasystems): Debug: Quota grace: root=User quota bytes=10485760 (10%) doveadm(afasystems): Debug: Namespace inbox: type=private, prefix=, sep=/, inbox=yes, hidden=no, list=yes, subscriptions=yes location=maildir:~/.maildir doveadm(afasystems): Debug: maildir++: root=/data/home/afasystems/.maildir, index=, indexpvt=, control=, inbox=/data/home/afasystems/.maildir, alt= doveadm(afasystems): Debug: acl: initializing backend with data: vfile:/etc/dovecot/acl:cache_secs=300 doveadm(afasystems): Debug: acl: acl username = afasystems doveadm(afasystems): Debug: acl: owner = 1 doveadm(afasystems): Debug: acl vfile: Global ACL legacy directory: /etc/dovecot/acl doveadm(afasystems): Debug: Namespace : type=public, prefix=Public/, sep=/, inbox=no, hidden=no, list=yes, subscriptions=no location=maildir:/data/home/vmail/public doveadm(afasystems): Debug: maildir++: root=/data/home/vmail/public, index=, indexpvt=, control=, inbox=, alt= doveadm(afasystems): Debug: acl: initializing backend with data: vfile:/etc/dovecot/acl:cache_secs=300 doveadm(afasystems): Debug: acl: acl username = afasystems doveadm(afasystems): Debug: acl: owner = 0 doveadm(afasystems): Debug: acl vfile: Global ACL legacy directory: /etc/dovecot/acl doveadm(afasystems): Debug: Namespace : type=shared, prefix=Shared/%u/, sep=/, inbox=no, hidden=no, list=children, subscriptions=no location=maildir:/data/home/%n/.maildir:INDEX=~/.maildir/shared/%u doveadm(afasystems): Debug: shared: root=/var/run/dovecot, index=, indexpvt=, control=, inbox=, alt= doveadm(afasystems): Debug: acl: initializing backend with data: vfile:/etc/dovecot/acl:cache_secs=300 doveadm(afasystems): Debug: acl: acl username = afasystems doveadm(afasystems): Debug: acl: owner = 0 doveadm(afasystems): Debug: acl vfile: Global ACL legacy directory: /etc/dovecot/acl doveadm(afasystems): Debug: quota: quota_over_flag check: quota_over_script unset - skipping doveadm(afasystems): Debug: Namespace : Using permissions from /data/home/afasystems/.maildir: mode=0700 gid=default Quota name Type Value Limit % User quota STORAGE 469 102400 0 User quota MESSAGE 6 - 0 That's ok, but i want to return quota from quotaBytes userdb parameter But if I use "default_fields = quota_rule=*:bytes=%$" in userdb, Output of "doveadm -D quota get -u afasystems" is: Debug: Loading modules from directory: /usr/lib/dovecot Debug: Module loaded: /usr/lib/dovecot/lib01_acl_plugin.so Debug: Module loaded: /usr/lib/dovecot/lib10_quota_plugin.so Debug: Loading modules from directory: /usr/lib/dovecot/doveadm Debug: Module loaded: /usr/lib/dovecot/doveadm/lib10_doveadm_acl_plugin.so Debug: Skipping module doveadm_expire_plugin, because dlopen() failed: /usr/lib/dovecot/doveadm/lib10_doveadm_expire_plugin.so: undefined symbol: expire_set_deinit (this is usually intentional, so just ignore this message) Debug: Module loaded: /usr/lib/dovecot/doveadm/lib10_doveadm_quota_plugin.so Debug: Module loaded: /usr/lib/dovecot/doveadm/lib10_doveadm_sieve_plugin.so Debug: Skipping module doveadm_fts_lucene_plugin, because dlopen() failed: /usr/lib/dovecot/doveadm/lib20_doveadm_fts_lucene_plugin.so: undefined symbol: lucene_index_iter_deinit (this is usually intentional, so just ignore this message) Debug: Skipping module doveadm_fts_plugin, because dlopen() failed: /usr/lib/dovecot/doveadm/lib20_doveadm_fts_plugin.so: undefined symbol: fts_user_get_language_list (this is usually intentional, so just ignore this message) Debug: Skipping module doveadm_mail_crypt_plugin, because dlopen() failed: /usr/lib/dovecot/doveadm/libdoveadm_mail_crypt_plugin.so: undefined symbol: mail_crypt_box_get_pvt_digests (this is usually intentional, so just ignore this message) doveadm(afasystems): Debug: auth USER input: afasystems quota_rule=*:bytes= system_groups_user=afasystems uid=1002 gid=100 home=/data/home/afasystems doveadm(afasystems): Debug: Added userdb setting: plugin/quota_rule=*:bytes= doveadm(afasystems): Debug: Effective uid=1002, gid=100, home=/data/home/afasystems doveadm(afasystems): Debug: Quota root: name=User quota backend=maildir args= doveadm(afasystems): Debug: Quota rule: root=User quota mailbox=* bytes=0 messages=0 doveadm(afasystems): Error: User initialization failed: Failed to initialize quota: Invalid quota root quota: Invalid rule *:bytes=: Invalid bytes limit: doveadm(afasystems): Error: User init failed Quota name Type Value Limit if I use "default_fields = quota_rule=*:bytes=%{userdb:quotabytes}" in userdb, Output of "doveadm -D quota get -u afasystems" is: Debug: Loading modules from directory: /usr/lib/dovecot Debug: Module loaded: /usr/lib/dovecot/lib01_acl_plugin.so Debug: Module loaded: /usr/lib/dovecot/lib10_quota_plugin.so Debug: Loading modules from directory: /usr/lib/dovecot/doveadm Debug: Module loaded: /usr/lib/dovecot/doveadm/lib10_doveadm_acl_plugin.so Debug: Skipping module doveadm_expire_plugin, because dlopen() failed: /usr/lib/dovecot/doveadm/lib10_doveadm_expire_plugin.so: undefined symbol: expire_set_deinit (this is usually intentional, so just ignore this message) Debug: Module loaded: /usr/lib/dovecot/doveadm/lib10_doveadm_quota_plugin.so Debug: Module loaded: /usr/lib/dovecot/doveadm/lib10_doveadm_sieve_plugin.so Debug: Skipping module doveadm_fts_lucene_plugin, because dlopen() failed: /usr/lib/dovecot/doveadm/lib20_doveadm_fts_lucene_plugin.so: undefined symbol: lucene_index_iter_deinit (this is usually intentional, so just ignore this message) Debug: Skipping module doveadm_fts_plugin, because dlopen() failed: /usr/lib/dovecot/doveadm/lib20_doveadm_fts_plugin.so: undefined symbol: fts_user_get_language_list (this is usually intentional, so just ignore this message) Debug: Skipping module doveadm_mail_crypt_plugin, because dlopen() failed: /usr/lib/dovecot/doveadm/libdoveadm_mail_crypt_plugin.so: undefined symbol: mail_crypt_box_get_pvt_digests (this is usually intentional, so just ignore this message) doveadm(afasystems): Debug: auth USER input: afasystems quota_rule=*:bytes= system_groups_user=afasystems uid=1002 gid=100 home=/data/home/afasystems doveadm(afasystems): Debug: Added userdb setting: plugin/quota_rule=*:bytes= doveadm(afasystems): Debug: Effective uid=1002, gid=100, home=/data/home/afasystems doveadm(afasystems): Debug: Quota root: name=User quota backend=maildir args= doveadm(afasystems): Debug: Quota rule: root=User quota mailbox=* bytes=0 messages=0 doveadm(afasystems): Error: User initialization failed: Failed to initialize quota: Invalid quota root quota: Invalid rule *:bytes=: Invalid bytes limit: doveadm(afasystems): Error: User init failed Quota name Type Value Limit if I use "default_fields = quota_rule=*:bytes=%{ldap:quotabytes}" in userdb, Output of "doveadm -D quota get -u afasystems" is: Debug: Loading modules from directory: /usr/lib/dovecot Debug: Module loaded: /usr/lib/dovecot/lib01_acl_plugin.so Debug: Module loaded: /usr/lib/dovecot/lib10_quota_plugin.so Debug: Loading modules from directory: /usr/lib/dovecot/doveadm Debug: Module loaded: /usr/lib/dovecot/doveadm/lib10_doveadm_acl_plugin.so Debug: Skipping module doveadm_expire_plugin, because dlopen() failed: /usr/lib/dovecot/doveadm/lib10_doveadm_expire_plugin.so: undefined symbol: expire_set_deinit (this is usually intentional, so just ignore this message) Debug: Module loaded: /usr/lib/dovecot/doveadm/lib10_doveadm_quota_plugin.so Debug: Module loaded: /usr/lib/dovecot/doveadm/lib10_doveadm_sieve_plugin.so Debug: Skipping module doveadm_fts_lucene_plugin, because dlopen() failed: /usr/lib/dovecot/doveadm/lib20_doveadm_fts_lucene_plugin.so: undefined symbol: lucene_index_iter_deinit (this is usually intentional, so just ignore this message) Debug: Skipping module doveadm_fts_plugin, because dlopen() failed: /usr/lib/dovecot/doveadm/lib20_doveadm_fts_plugin.so: undefined symbol: fts_user_get_language_list (this is usually intentional, so just ignore this message) Debug: Skipping module doveadm_mail_crypt_plugin, because dlopen() failed: /usr/lib/dovecot/doveadm/libdoveadm_mail_crypt_plugin.so: undefined symbol: mail_crypt_box_get_pvt_digests (this is usually intentional, so just ignore this message) doveadm(afasystems): Debug: auth USER input: afasystems quota_rule=*:bytes=UNSUPPORTED_VARIABLE_ldap system_groups_user=afasystems uid=1002 gid=100 home=/data/home/afasystems doveadm(afasystems): Debug: Added userdb setting: plugin/quota_rule=*:bytes=UNSUPPORTED_VARIABLE_ldap doveadm(afasystems): Debug: Effective uid=1002, gid=100, home=/data/home/afasystems doveadm(afasystems): Debug: Quota root: name=User quota backend=maildir args= doveadm(afasystems): Debug: Quota rule: root=User quota mailbox=* bytes=0 messages=0 doveadm(afasystems): Error: User initialization failed: Failed to initialize quota: Invalid quota root quota: Invalid rule *:bytes=UNSUPPORTED_VARIABLE_ldap: Invalid bytes limit: UNSUPPORTED_VARIABLE_ldap doveadm(afasystems): Error: User init failed Quota name Type Value Limit Where I am wrong? What is the correct configuration? Thanks in advance -- AFA Systems Srl Via G.Pastore Zona Industriale B 86039 Termoli (CB) - Italia tel.: +39 0875 724104 fax.: +39 0875 726084 www.afasystems.it

5 7

Re: failed to store into mailbox 'INBOX/Junk': Permission denied
by Davide Marchi 26 Jul '17

26 Jul '17

Steffen Kaiser ha scritto: > Does INBOX/Junk already exists? Yes, (but empty): find /var/vmail/hotelsangiorgioriccione.com/info/ |grep INBOX /var/vmail/hotelsangiorgioriccione.com/info/Maildir/.INBOX /var/vmail/hotelsangiorgioriccione.com/info/Maildir/.INBOX/Trash /var/vmail/hotelsangiorgioriccione.com/info/Maildir/.INBOX/Trash/new /var/vmail/hotelsangiorgioriccione.com/info/Maildir/.INBOX/Trash/tmp /var/vmail/hotelsangiorgioriccione.com/info/Maildir/.INBOX/Trash/cur /var/vmail/hotelsangiorgioriccione.com/info/Maildir/.INBOX/Trash/maildirfolder /var/vmail/hotelsangiorgioriccione.com/info/Maildir/.INBOX/Trash/dovecot.index.log /var/vmail/hotelsangiorgioriccione.com/info/Maildir/.INBOX/Junk /var/vmail/hotelsangiorgioriccione.com/info/Maildir/.INBOX/Junk/new /var/vmail/hotelsangiorgioriccione.com/info/Maildir/.INBOX/Junk/tmp /var/vmail/hotelsangiorgioriccione.com/info/Maildir/.INBOX/Junk/cur /var/vmail/hotelsangiorgioriccione.com/info/Maildir/.INBOX/Junk/maildirfolder /var/vmail/hotelsangiorgioriccione.com/info/Maildir/.INBOX/Junk/dovecot.index.log and same for other v-user "booking" > What's in your ACL file? cat /etc/dovecot/dovecot-acl * user=booking(a)hotelsangiorgioriccione.com lrwsi * user=info(a)hotelsangiorgioriccione.com lrwsi > What does these commands return? > doveadm acl debug -u info(a)hotelsangiorgioriccione.com INBOX > doveadm acl debug -u info(a)hotelsangiorgioriccione.com INBOX/Junk doveadm acl debug -u info(a)hotelsangiorgioriccione.com INBOX doveadm(info(a)hotelsangiorgioriccione.com): Info: Mailbox 'INBOX' is in namespace '' doveadm(info(a)hotelsangiorgioriccione.com): Info: Mailbox path: /var/vmail/hotelsangiorgioriccione.com/info/Maildir doveadm(info(a)hotelsangiorgioriccione.com): Info: All message flags are shared across users in mailbox doveadm(info(a)hotelsangiorgioriccione.com): Info: User info(a)hotelsangiorgioriccione.com has rights: lookup read write write-seen insert doveadm(info(a)hotelsangiorgioriccione.com): Info: Mailbox in user's private namespace doveadm(info(a)hotelsangiorgioriccione.com): Info: Mailbox INBOX is visible in LIST doveadm acl debug -u info(a)hotelsangiorgioriccione.com INBOX/Junk doveadm(info(a)hotelsangiorgioriccione.com): Info: Mailbox 'INBOX/Junk' is in namespace '' doveadm(info(a)hotelsangiorgioriccione.com): Info: Mailbox path: /var/vmail/hotelsangiorgioriccione.com/info/Maildir/.INBOX/Junk doveadm(info(a)hotelsangiorgioriccione.com): Info: All message flags are shared across users in mailbox doveadm(info(a)hotelsangiorgioriccione.com): Info: User info(a)hotelsangiorgioriccione.com has rights: lookup read write write-seen insert doveadm(info(a)hotelsangiorgioriccione.com): Info: Mailbox in user's private namespace doveadm(info(a)hotelsangiorgioriccione.com): Info: Mailbox INBOX/Junk is visible in LIST Many thanks Steffen!

2 1

Re: failed to store into mailbox 'INBOX/Junk': Permission denied
by Davide Marchi 26 Jul '17

26 Jul '17

I add a clarification: Now that I've commented out sieve Junk/Trash on "/etc/dovecot/conf.d/15-mailboxes.conf" > mailbox Junk > { special_use = \Junk > } > mailbox Trash > { special_use = \Trash > } remains a single account with permission issues, only one with write permissions controlled by the ACL plugin: > plugin { > acl = vfile:/etc/dovecot/dovecot-acl > sieve = ~/.dovecot.sieve > sieve_after = /etc/dovecot/sieve-after > sieve_dir = ~/sieve > } Many thanks again!

2 1

Issue on install - file mbox-sync.c: line 1371 (mbox_sync_handle_eof_updates): assertion failed: (trailer_size <= 2)
by Ian Turley 26 Jul '17

26 Jul '17

First of all apologies for using such an old version - I am trying to upgrade slowly and have had to go through this version first. As you can see I am getting an error in the log file as : file mbox-sync.c: line 1371 (mbox_sync_handle_eof_updates): assertion failed: (trailer_size <= 2) Raw backtrace: imap [0x80acdc1] -> imap [0x80accdc] -> imap(mbox_sync+0x14e9) [0x8079a29] -> imap(mbox_storage_sync_init+0x3e) [0x8079d8e] -> imap(imap_sync_nonselected+0x1c) [0x806183c] -> imap(_cmd_select_full+0xc3) [0x8059983] -> imap(cmd_select+0x19) [0x8059b49] -> imap [0x805afb8] -> imap [0x805b03c] -> imap(_client_input+0x6c) [0x805b71c] -> imap(io_loop_handler_run+0x110) [0x80b2a50] -> imap(io_loop_run+0x1c) [0x80b1f8c] -> imap(main+0x4c0) [0x8063640] -> /lib/libc.so.6(__libc_start_main+0xdc) [0xdd4edc] -> imap [0x80561a1] Is this some setting missing or corrupt mailbox? I only have very basic set up at this time to test. Version 1.0.7 # 1.0.7: /etc/dovecot.conf ssl_cert_file: /etc/postfix/certs/emma.turls.co.uk.crt ssl_key_file: /etc/postfix/certs/turls_csr.key login_dir: /var/run/dovecot/login login_executable(default): /usr/libexec/dovecot/imap-login login_executable(imap): /usr/libexec/dovecot/imap-login login_executable(pop3): /usr/libexec/dovecot/pop3-login mail_location: mbox:~/mail/:INBOX=/var/spool/mail mail_executable(default): /usr/libexec/dovecot/imap mail_executable(imap): /usr/libexec/dovecot/imap mail_executable(pop3): /usr/libexec/dovecot/pop3 mail_plugin_dir(default): /usr/lib/dovecot/imap mail_plugin_dir(imap): /usr/lib/dovecot/imap mail_plugin_dir(pop3): /usr/lib/dovecot/pop3 auth default: passdb: driver: pam userdb: driver: passwd Regards Ian -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean.

1 0

Re: under another kind of attack
by Joseph Tam 25 Jul '17

25 Jul '17

Olaf Hopp <Olaf.Hopp(a)kit.edu> writes: > I have dovecot shielded by fail2ban which works fine. But since a few > days I see many many IPs per day knocking on my doors with wron > password and/or users. But the rate at which they are knocking is very > very low. So fail2ban will never catch them. Slow roll distributed attacks. Really hard to stop. > And I see many many distinct IPs per day (a few hundred) trying many > many existing and non-existings accounts. As you see in the timestamps > in my examples, this can not be handled by fail2ban without affecting > regular users with typos. Is anybody observing something similar ? All the time, and to many services. If you need to be fault tolerant, you'll either have to set tolerant limits (allow reasonable number of failures), or timeout features. You could also track successful logins as whitelisting entries for future logins. > Anybody an idea against this ? Many of these observed IPs are chinese > mobile IPs, if this matters. But we have also chinese students and > researchers all abroad. Nearly an intractable problem, especially since your users are embedded in a notoriously infested network (as someone quipped, "like picking marshmallows out from a pile of sh*t"). Some ideas: - pre-emption (using third party RBLs that targets BFD) - immediate blacklisting of known bad users/passwords (e.g. "admin", "support", extinct users, etc.) - persistent tracking storage: tracking in SQL, or or large LRU list that can reach far enough back in time. (I think Aki mentioned weakforced which you can use instead if fail2ban to implement some of these things.) There are other solutions like alternate ports, port knocking, certificate authentication, or VPN, but they are hard/impossible to do with a large userbase, or have high setup/amortization costs. If you have a enforced strong password policy, these brute forcers have little chance of succeeding, so maybe the easiest cheapest policy is to ignore it. Joseph Tam <jtam.home(a)gmail.com>

1 0

Re: under another kind of attack
by Joseph Tam 25 Jul '17

25 Jul '17

"mourik jan c heupink" <lists(a)merit.unu.edu> writes: > On 07/24/2017 04:51 AM, Joseph Tam wrote:> You are essentially writing your own backend by taking over >> authentication. You'll be accepting user/password inputs into your >> checkpassword executable, then use the LDAP API (or some other system...snip >> and source address, which will be adversely affect performance on a >> busy server as authentication data cannot be cached. > > While this sounds awesome, it can do much more than what I was/am after, and appears lot more complicated to setup than what I had figured myself. > > Shouldn't I be able to do something like this: > > passdb { > driver = passwd-file > # application specific passwd-file should work from anywhere > # (so: no allow_nets) > args = /etc/dovecot/dovecot-application-specific > } > passdb { > # only allowed to use this from within local 192.168.1.0/24 > args = /etc/dovecot/dovecot-ldap.conf.ext allow_nets=192.168.1.0/24 > driver = ldap > } Yes, that would take care of *one* of the items on your wishlist (network specific passwords). You also wanted time specific passwords. And intelligent brute force detection. And blacklist lookups. Rather than cobbling together fail2ban, utility scripts, multiple passdbs, firewall rules and whatever other system you'll need to recruit, I'm suggesting you amortize the effort and pack it into one place, then you can extend this to incorporate whatever your heart desires. The complexity of implementing this reflects the complexity of your requirements. If you only had generic authentication needs, then the dovecot supplied facilities would be perfect. But you don't. > Where I would generate lines in dovecot-application-specific using a > script or some webpage, and generate lines like: > > username1:randomONE:vmail:vmail::/var/vmail/username1: > username1:randomTWO:vmail:vmail::/var/vmail/username1: > username2:randomTHREE:vmail:vmail::/var/vmail/username2: > username2:randomFOUR:vmail:vmail::/var/vmail/username2: > > And the result would be: username1 can login from anywhere, using > passwords "randomONE" & "randomTWO", plus the password in ldap when > coming from the internal network. You'll probably need 3 passdb, LDAP and 2 fallback passwd-file dbs. Joseph Tam <jtam.home(a)gmail.com>

1 0

SIEVE: handling of lineending in fields
by Ingo Thierack 25 Jul '17

25 Jul '17

Hello, migrated von the mailserver from centos to alpine linux. Most parts are run well. dovecot 2.2.31 sieve: 0.4.19 But i fight with on behavior. I have an sieve script which pipes a few fields to an external script which send this data to an telegram-bot. the part of the sieve-script. if header :matches "Subject" "*" { set "subject" "${1}"; } if header :matches "from" "*" { set "from" "${1}"; } if header :matches "to" "*" { set "to" "${1}"; } foreverypart { if header :mime :type :is "Content-Type" "text" { extracttext :first 30 "msgcontent"; break; } } pipe :copy :try "notify.sh" [ "", "(${from})#${to}#${subject}", "\"${msgcontent}\"" ]; What i get now is an error about looks like encoding of the linefeeds. default: line 107: error: specified :args item `"test 4??"' is invalid. Here is sent a mail which contains in subject "test 4". or default: line 107: error: specified :args item `"?? ?? ??? ??? Oracle Magazine "' is invalid. Here is sent a mail which contains in subject "test 4". On centos this was never an problem. With alpine-linux this process is complete broken. Any hints, where to look and maybee fix thie behavior? Mybe its ab problem with the libmusl which used in alpine. Regards Ingo

2 2

last_logon SQL mapping
by viper 25 Jul '17

25 Jul '17

Hi I have been attempting to do a mapping on the last_logon plugin. I have been reading the documentation on mapping. is there any way to customise a little more and create a individual SQL query for each of the functions SELECT and UPDATE, my current SQL setup has the username and domain in separate tables and my user_query and password_query are concat which I do not believe can be defined in the dictionary map process, I was also wanting to use datatime as the saved field but it seems only the unix timestamp is used. If there is any way to create a fully custom query that can be executed I believe this would allow me to preform the action am looking for in the same manner as the user_query and password_query If anyone has any suggestions please let me know Regards Craig

2 1

Core dumped when authenticating to managesieve
by Kristjan Eentsalu 25 Jul '17

25 Jul '17

Hey, I'm getting "Error in MANAGESIEVE command received by server." and service(managesieve-login) killed with signal 11 (core dumped) when doing two line autenticate(sogo) to managesieve(). # telnet localhost 4190 Trying 127.0.0.1... Connected to localhost. Escape character is '^]'. "IMPLEMENTATION" "Dovecot Pigeonhole" "SIEVE" "fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext editheader" "NOTIFY" "mailto" "SASL" "PLAIN" "VERSION" "1.0" OK "Dovecot ready." AUTHENTICATE "PLAIN" {52+} XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX== NO "Error in MANAGESIEVE command received by server." AUTHENTICATE "PLAIN" {52+} <---- trying again Connection closed by foreign host. and after that in logs there is "dovecot: managesieve-login: Fatal: master: service(managesieve-login): child 38748 killed with signal 11 (core dumped)" One line autenticate works. # telnet localhost 4190 Trying 127.0.0.1... Connected to localhost. Escape character is '^]'. "IMPLEMENTATION" "Dovecot Pigeonhole" "SIEVE" "fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext editheader" "NOTIFY" "mailto" "SASL" "PLAIN" "VERSION" "1.0" OK "Dovecot ready." AUTHENTICATE "PLAIN" "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX==" OK "Logged in." OS: FreeBSD 11.1-RC3 Dovecot 2.2.31 , pigeonhole 0.4.19 Trace below GNU gdb 6.1.1 [FreeBSD] Copyright 2004 Free Software Foundation, Inc. GDB is free software, covered by the GNU General Public License, and you are welcome to change it and/or distribute copies of it under certain conditions. Type "show copying" to see the conditions. There is absolutely no warranty for GDB. Type "show warranty" for details. This GDB was configured as "amd64-marcel-freebsd"...(no debugging symbols found)... warning: core file may not match specified executable file. Core was generated by `dovecot/managesieve-login'. Program terminated with signal 11, Segmentation fault. Reading symbols from /usr/local/lib/dovecot/libdovecot-login.so.0...done. Loaded symbols for /usr/local/lib/dovecot/libdovecot-login.so.0 Reading symbols from /usr/lib/libssl.so.8...done. Loaded symbols for /usr/lib/libssl.so.8 Reading symbols from /lib/libcrypto.so.8...done. Loaded symbols for /lib/libcrypto.so.8 Reading symbols from /usr/local/lib/dovecot/libdovecot.so.0...done. Loaded symbols for /usr/local/lib/dovecot/libdovecot.so.0 Reading symbols from /usr/lib/libkrb5.so.11...done. Loaded symbols for /usr/lib/libkrb5.so.11 Reading symbols from /usr/lib/libgssapi.so.10...done. Loaded symbols for /usr/lib/libgssapi.so.10 Reading symbols from /usr/lib/libgssapi_krb5.so.10...done. Loaded symbols for /usr/lib/libgssapi_krb5.so.10 Reading symbols from /lib/libc.so.7...done. Loaded symbols for /lib/libc.so.7 Reading symbols from /usr/lib/libasn1.so.11...done. Loaded symbols for /usr/lib/libasn1.so.11 Reading symbols from /usr/lib/libcom_err.so.5...done. Loaded symbols for /usr/lib/libcom_err.so.5 Reading symbols from /lib/libcrypt.so.5...done. Loaded symbols for /lib/libcrypt.so.5 Reading symbols from /usr/lib/libhx509.so.11...done. Loaded symbols for /usr/lib/libhx509.so.11 Reading symbols from /usr/lib/libroken.so.11...done. Loaded symbols for /usr/lib/libroken.so.11 Reading symbols from /usr/lib/libwind.so.11...done. Loaded symbols for /usr/lib/libwind.so.11 Reading symbols from /usr/lib/libheimbase.so.11...done. Loaded symbols for /usr/lib/libheimbase.so.11 Reading symbols from /usr/lib/libprivateheimipcc.so.11...done. Loaded symbols for /usr/lib/libprivateheimipcc.so.11 Reading symbols from /lib/libthr.so.3...done. Loaded symbols for /lib/libthr.so.3 Reading symbols from /libexec/ld-elf.so.1...done. Loaded symbols for /libexec/ld-elf.so.1 #0 i_stream_seek (stream=0x0, v_offset=80) at istream.c:296 296 istream.c: No such file or directory. in istream.c (gdb) bt full #0 i_stream_seek (stream=0x0, v_offset=80) at istream.c:296 _stream = (struct istream_private *) 0x5385e16 #1 0x000000000536937a in i_stream_limit_read (stream=0x767d540) at istream-limit.c:34 lstream = (struct limit_istream *) 0x767d540 left = 123848760 ret = 1 pos = 119265200 #2 0x000000000535f340 in i_stream_read (stream=0x767d5b0) at istream.c:174 _stream = (struct istream_private *) 0x767d540 old_size = 0 ret = 124244864 #3 0x00000000053607ae in i_stream_read_data (stream=0x767d5b0, data_r=0x7fffffffe868, size_r=0x7fffffffe878, threshold=0) at istream.c:569 ret = 0 read_more = false #4 0x00000000004038d1 in ?? () No symbol table info available. #5 0x0000000000403c1a in ?? () No symbol table info available. #6 0x00000000004030ad in ?? () No symbol table info available. #7 0x0000000000402eaa in ?? () No symbol table info available. #8 0x0000000004838435 in client_input (client=0x76c0c10) at client-common.c:920 No locals. #9 0x000000000537028d in io_loop_call_io (io=0x76a4300) at ioloop.c:599 ioloop = (struct ioloop *) 0x763a000 t_id = 2 #10 0x0000000005372f74 in io_loop_handler_run_internal (ioloop=0x763a000) at ioloop-poll.c:209 ctx = (struct ioloop_handler_context *) 0x76340e0 pollfd = (struct pollfd *) 0x7673840 tv = {tv_sec = 0, tv_usec = 895835} io = (struct io_file *) 0x76a4300 msecs = 896 ret = 0 call = true #11 0x00000000053707f8 in io_loop_handler_run (ioloop=0x763a000) at ioloop.c:648 No locals. #12 0x0000000005370621 in io_loop_run (ioloop=0x763a000) at ioloop.c:623 No locals. #13 0x00000000052ad15b in master_service_run (service=0x7635000, callback=0x4840630 <client_connected>) at master-service.c:666 No locals. #14 0x00000000048402f7 in login_binary_run (binary=0x4061b8, argc=1, argv=0x7fffffffeb40) at main.c:506 service_flags = 1608 set_pool = 0x7646020 login_socket = 0x48494c6 "login" c = -1 #15 0x000000000040288f in ?? () No symbol table info available. #16 0x000000000462c000 in ?? () No symbol table info available. #17 0x0000000000000000 in ?? () No symbol table info available. Current language: auto; currently minimal dovecot -n # 2.2.31 (65cde28): /usr/local/etc/dovecot/dovecot.conf # Pigeonhole version 0.4.19 (e5c7051) # OS: FreeBSD 11.1-RC3 amd64 auth_master_user_separator = * auth_verbose_passwords = plain disable_plaintext_auth = no lmtp_save_to_detail_mailbox = yes mail_access_groups = imapmail mail_debug = yes mail_gid = imapmail mail_plugins = acl quota mail_uid = imapmail mailbox_list_index = yes managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext editheader namespace { hidden = no inbox = no list = no location = prefix = separator = / subscriptions = yes type = private } namespace public { hidden = no list = children location = maildir:/mail/imap/ localnet.net/shared:INDEXPVT=%h/public:LAYOUT=fs:DIRNAME=DlkfdewDSD prefix = shared/ separator = / subscriptions = no type = public } namespace inbox { alias_for = hidden = no inbox = yes list = yes location = mailbox Drafts { special_use = \Drafts } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Spam { special_use = \Junk } mailbox Trash { special_use = \Trash } prefix = INBOX/ separator = / subscriptions = no type = private } namespace user { list = children location = maildir:%%h/Maildir:LAYOUT=fs:DIRNAME=DlkfdewDSD:INDEXPVT=%h/shared/%%n prefix = user/%%n/ separator = / subscriptions = no type = shared } passdb { args = /usr/local/etc/dovecot/master-users driver = passwd-file master = yes pass = yes } passdb { args = /usr/local/etc/dovecot/dovecot-ldap.conf.ext driver = ldap } plugin { acl = vfile:/mail/dovecot/db/global-acls:cache_secs=300 acl_shared_dict = file:/mail/dovecot/db/shared-mailboxes quota = maildir:INBOX user/%u quota2 = maildir:Public quota:ns=shared/ quota2_rule = *:storage=100G quota_grace = 10%% quota_rule = *:storage=5G quota_rule2 = INBOX/Trash:storage=+100M quota_status_nouser = DUNNO quota_status_overquota = 552 5.2.2 Mailbox is full quota_status_success = DUNNO quota_vsizes = yes recipient_delimiter = + sieve = file:~/sieve;active=~/.dovecot.sieve sieve_extensions = +editheader } protocols = imap lmtp sieve service lmtp { unix_listener /var/spool/postfix/private/dovecot-lmtp { group = postfix mode = 0600 user = postfix } } service managesieve-login { chroot = drop_priv_before_exec = yes inet_listener sieve { port = 4190 } inet_listener sieve_deprecated { port = 2000 } service_count = 0 vsz_limit = 64 M } ssl = no ssl_cert = </etc/ssl/servercerts/cert.crt ssl_key = # hidden, use -P to show it userdb { args = /usr/local/etc/dovecot/dovecot-ldap.conf.ext driver = ldap } protocol lmtp { mail_plugins = acl quota sieve postmaster_address = postmaster(a)localnet.net } protocol imap { mail_plugins = acl quota imap_acl imap_quota }

3 2

Re: failed to store into mailbox 'INBOX/Junk': Permission denied
by Davide Marchi 25 Jul '17

25 Jul '17

> For more clarity I also attach the content of > "/etc/dovecot/conf.d/15-mailboxes.conf" > > > # mailbox Junk { > # special_use = \Junk > # } > # mailbox Trash { > # special_use = \Trash > # } > mailbox INBOX/Junk { > auto = subscribe > special_use = \Junk > } > mailbox INBOX/Trash { > auto = subscribe > special_use = \Trash > } > > Date: Mon, 24 Jul 2017 18:06:29 +0200 > From: Christian Kivalo <ml+dovecot(a)valo.at> > > Please also provide your doveconf -n Here my Dovecot configuration (I've commented out "mailbox Junk" and "mailbox Trash" above) # 2.2.13: /etc/dovecot/dovecot.conf # OS: Linux 3.16.0-4-amd64 x86_64 Debian 8.5 ext4 auth_mechanisms = plain login cram-md5 mail_location = maildir:/var/vmail/%d/%n/Maildir mail_plugins = acl managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date ihave namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox INBOX/Junk { auto = subscribe special_use = \Junk } mailbox INBOX/Trash { auto = subscribe special_use = \Trash } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } passdb { args = /etc/dovecot/dovecot-sql.conf.ext driver = sql } plugin { acl = vfile:/etc/dovecot/dovecot-acl sieve = ~/.dovecot.sieve sieve_after = /etc/dovecot/sieve-after sieve_dir = ~/sieve } protocols = " imap lmtp sieve pop3" service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0660 user = postfix } } service lmtp { unix_listener /var/spool/postfix/private/dovecot-lmtp { group = postfix mode = 0600 user = postfix } } ssl_cert = </etc/letsencrypt/live/server.sio4.org/fullchain.pem ssl_cipher_list = ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA ssl_dh_parameters_length = 2048 ssl_key = </etc/letsencrypt/live/server.sio4.org/privkey.pem ssl_prefer_server_ciphers = yes userdb { args = uid=vmail gid=vmail home=/var/vmail/%d/%n driver = static } protocol imap { mail_plugins = acl imap_acl mail_log notify } protocol lmtp { mail_plugins = acl sieve } Many thanks Christian!

1 0

Strange Error: Password data is not valid for scheme SHA256. Please help me resolve it.
by david.madman2＠vfemail.net 24 Jul '17

24 Jul '17

Hello, I am using version 2.2.31 (65cde28) on an Ubuntu 16.04 VPS. I am attempting to setup a mail server using a flat file system as an experiment. I am able to send e-mail from external domain names and the messages land in my /var/mail/vmail/domain/user/ directories. I am trying to setup Thunderbird as an MUA using the information I generated on my VPS namely the IMAP server, username(a)domain.com, password, and SMTP server. IMAP server - www.domain.com SMTP server - www.domain.com Username - created in /etc/postfix/virtual-mailbox-users.db and /etc/dovecot/passwd.db Password - created by dovadm pw -s SHA256 and entered (along with the username) in /etc/dovecot/passwd.db I enter this information into "new accounts" in Thunderbird and select STARTTLS with ports 143 (IMAP) and 587 (SMTP). (I have experimented with a variety of other combinations too). I click "Done" which transmits the information to the domain server to verify the details. My /var/log/mail.log shows: Jul 22 18:40:48 www dovecot: auth: Error: passwd-file(test(a)domain.com,46.xxx.xxx.xxx,<wZoHUuxU6IAu9j4y>): Password data is not valid for scheme SHA256: Input length isn't valid (0 instead of 32) Jul 22 18:41:00 www dovecot: message repeated 2 times: [ auth: Error: passwd-file(test(a)domain.com,46.xxx.xxx.xxx,<fGoHUuxU6IAu9j4y>): Password data is not valid for scheme SHA256: Input length isn't valid (0 instead of 32)] Jul 22 18:41:02 www dovecot: imap-login: Disconnected (auth failed, 3 attempts in 14 secs): user=<test(a)domain.com>, method=PLAIN, rip=46.xxx.xxx.xxx, lip=139.xxx.xxx.xxx, TLS, session=<fGoHUuxU6IAu9j4y> What does "Password data is not valid for scheme SHA256: Input length isn't valid (0 instead of 32)]" mean? I assume that there is some kind of a mismatch between the way I generated the password with doveadm and entered it in passwd.db and the way I entered the non-hashed password into the password field in the new account section of Thunderbird. Is there a way to resolve this issue? My dovecot -n is below. You will note that the passdb section does have the scheme as SHA256. Many thanks. # 2.2.31 (65cde28): /etc/dovecot/dovecot.conf # Pigeonhole version 0.4.19 (e5c7051) # OS: Linux 4.4.0-83-generic x86_64 Ubuntu 16.04.2 LTS ext4 auth_mechanisms = plain login auth_verbose = yes mail_home = /var/mail/vmail/%d/%n mail_location = maildir:/var/mail/vmail/%d/%n/mail:LAYOUT=fs managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext namespace inbox { inbox = yes location = mailbox Drafts { auto = subscribe special_use = \Drafts } mailbox Junk { auto = subscribe special_use = \Junk } mailbox Sent { auto = subscribe special_use = \Sent } mailbox Trash { auto = subscribe special_use = \Trash } prefix = } passdb { args = username_format=%u scheme=SHA256 /etc/dovecot/passwd.db driver = passwd-file } plugin { sieve = file:~/sieve;active=~/.dovecot.sieve sieve_dir = ~/sieve } protocols = imap pop3 sieve service auth { unix_listener /var/spool/postfix/private/dovecot-auth { group = postfix mode = 0660 user = postfix } } ssl_cert = </etc/letsencrypt/live/www.domain.com/fullchain.pem ssl_cipher_list = ALL:!LOW:!SSLv2:ALL:!aNULL:!ADH:!eNULL:!EXP:RC4+RSA:+HIGH:+MEDIUM ssl_key = # hidden, use -P to show it userdb { args = uid=5000 gid=5000 home=/var/mail/vmail/%d/%n driver = static } protocol imap { imap_client_workarounds = delay-newmail tb-extra-mailbox-sep mail_max_userip_connections = 10 } protocol pop3 { mail_max_userip_connections = 10 pop3_client_workarounds = outlook-no-nuls oe-ns-eoh } protocol lda { deliver_log_format = msgid=%m: %$ mail_plugins = sieve postmaster_address = postmaster(a)domain.com quota_full_tempfail = yes rejection_reason = Your message to <%t> was automatically rejected:%n%r } ------------------------------------------------- ONLY AT VFEmail! - Use our Metadata Mitigator to keep your email out of the NSA's hands! $24.95 ONETIME Lifetime accounts with Privacy Features! 15GB disk! No bandwidth quotas! Commercial and Bulk Mail Options!

2 4

Re: under some kind of attack
by Joseph Tam 24 Jul '17

24 Jul '17

>> As per my post: checkpassword. You can then use one password on Mondays, >> Wednesdays, and Fridays, alternate passwords on Tuesdays and Thursday >> fetched from a rot-13 database, and only from prime numbered IP addresses >> on weekends, if that's what you want. > > Having read the wiki page on checkpassword, I am unsure how this would > work with an ldap backend. > > Could you elaborate on that? You are essentially writing your own backend by taking over authentication. You'll be accepting user/password inputs into your checkpassword executable, then use the LDAP API (or some other system that will do it for you) to authenticate. (You can Google around for code snippets.) You'll have direct control over all aspects of authentication (if/when/where/etc) that a generic backend can't provide. You can choose do implement using shell/PERL/etc script, or compile to executable from C sources. It's more work, but if you need to do everything on your wish list, I can't see any eaiser option. One of the drawbacks is that a working password depends on both time and source address, which will be adversely affect performance on a busy server as authentication data cannot be cached. Joseph Tam <jtam.home(a)gmail.com>

2 1

Re: failed to store into mailbox 'INBOX/Junk': Permission denied
by Davide Marchi 24 Jul '17

24 Jul '17

For more clarity I also attach the content of "/etc/dovecot/conf.d/15-mailboxes.conf" # mailbox Junk { # special_use = \Junk # } # mailbox Trash { # special_use = \Trash # } mailbox INBOX/Junk { auto = subscribe special_use = \Junk } mailbox INBOX/Trash { auto = subscribe special_use = \Trash } Thanks again

2 1

failed to store into mailbox 'INBOX/Junk': Permission denied
by Davide Marchi 24 Jul '17

24 Jul '17

Hello to everyone, On Debian Jessie (no SElinux) and "dovecot-sieve 1:2.2.13-12~deb8u1" I've changed the sieve (sieve_after) Junk and Trash path, from: "INBOX.Junk" to "INBOX/Junk" compiled it: sievec /etc/dovecot/sieve-after/spam-to-folder.sieve but now if i look into mail.err log, found this: Jul 24 07:22:01 server dovecot: lmtp(6823, info(a)hotelsangiorgioriccione.com) Error: p/3kL/mDdVmnGgAAS3B7vQ: sieve: msgid=<887291195.6699.1500873334921.JavaMail.trend@backend-prod-003>: failed to store into mailbox 'INBOX/Junk': Permission denied Jul 24 07:22:02 server dovecot: lmtp(6823, info(a)hotelsangiorgioriccione.com) Error: p/3kL/mDdVmnGgAAS3B7vQ: sieve: execution of script /etc/dovecot/sieve-after/spam-to-folder.sieve failed, but implicit keep was successful and many others.. This is the "spam-to-folder.sieve content": require ["fileinto","mailbox"]; if header :contains "X-Spam-Flag" "YES" { fileinto :create "INBOX/Junk"; stop; } where I'm wrong? many thanks!

1 0

dovecot/pigeonhole and sogo
by Thomas Robers 24 Jul '17

24 Jul '17

Hello, I have two systems one with dovecot 2.2.31/Pigeonhole 0.4.19 selfcompiled through the src.rpms from ghettoforge on a CentOS 6.9 server and a second system of SOGo (3.2.9, nightly) on CentOS 7. Everything worked together until I made the update to Dovecot 2.2.31 Pigeonhole 0.4.19. Since then I get an error message when I try to upload a sieve-script. SOGo shows a message popup that "the service is temporarily not available" and in the log file of Dovecot i get: > Jul 12 15:26:41 mail2 dovecot: managesieve-login: Disconnected (no auth attempts in 0 secs): user=<>, method=PLAIN, rip=192.168.1.138, lip=192.168.1.135, TLS: Disconnected, session=<25U/xB5U/KLCw8GK> > Jul 12 15:26:41 mail2 dovecot: auth: Debug: auth client connected (pid=12182) > Jul 12 15:26:41 mail2 dovecot: managesieve-login: Disconnected (no auth attempts in 0 secs): user=<>, method=PLAIN, rip=192.168.1.138, lip=192.168.1.135, TLS: Disconnected, session=<4zxBxB5U/qLCw8GK> > Jul 12 15:34:35 mail2 dovecot: auth: Debug: auth client connected (pid=12263) > Jul 12 15:34:35 mail2 dovecot: managesieve-login: Disconnected (no auth attempts in 0 secs): user=<>, method=PLAIN, rip=192.168.1.138, lip=192.168.1.135, TLS: Disconnected, session=<uiR64B5UDKPCw8GK> > Jul 12 15:34:35 mail2 dovecot: auth: Debug: auth client connected (pid=12264) > Jul 12 15:34:35 mail2 dovecot: managesieve-login: Disconnected (no auth attempts in 0 secs): user=<>, method=PLAIN, rip=192.168.1.138, lip=1192.168.1.135, TLS: Disconnected, session=<LeJ74B5UDqPCw8GK> Does this mean that managesieve-login doesn't get authentication data from SOGo? SOGo logs for this error: > S[0x7f368f2bab60]: "IMPLEMENTATION" "Dovecot Pigeonhole" > S[0x7f368f2bab60]: "SIEVE" "fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext" > S[0x7f368f2bab60]: "NOTIFY" "mailto" > S[0x7f368f2bab60]: "SASL" "PLAIN" > S[0x7f368f2bab60]: "VERSION" "1.0" > S[0x7f368f2bab60]: OK "Dovecot ready." > C: AUTHENTICATE "PLAIN" {%d+} > LOGIN:PASSWORD > > S[0x7f368f2bab60]: NO "Error in MANAGESIEVE command received by server." > C: AUTHENTICATE "PLAIN" {%d+} > LOGIN:PASSWORD Than I compiled Dovecot 2.2.31 together with Pigeonhole 0.4.18 and than everything works again as expected. I can upload and activate sieve-scripts from the SOGo webinterface. After that I tried to disable TLS for sieve with ssl = no in the 20-managesieve.conf: [...] protocol sieve { ssl = no [...] to capture the traffic between SOGo and Dovecot/Pigeonhole but then the managesieve-login process crashes: > Jul 12 16:28:32 mail2 dovecot: managesieve-login: Fatal: master: service(managesieve-login): child 12941 killed with signal 11 (core dumps disabled) [last ip=192.168.1.138] Why isn't it possible to disable TLS for sieve and what changes between Pigeonhole 0.4.19 and 0.4.18 could be responsible for the disharmony between SOGo and Pigeonhole. I looked for 'changes' but could not find any hints regarding this problem. Is there a chance to get both work together again? And is it possible to disable TLS for sieve or why crashes the managesieve-login daemon? Any help would be welcome. TIA Thomas Robers

2 2

Modify stored mail contents?
by Evan Martin 23 Jul '17

23 Jul '17

Is there a safe way to modify the contents of emails stored by Dovecot? I'll probably only want to change the message bodies, not the headers, if that matters. Looking for ways to do this both for existing emails and new emails as they are received (though anything that works for existing emails can probably just be run again for new emails.) My mail storage is currently mdbox, but I could migrate to another format if that helps.

5 8

10-ssl ssl = no but dovecot still reads certs
by lists＠lazygranch.com 22 Jul '17

22 Jul '17

I'm bringing up a new email server starting without TLS initially. In 10-ssl.conf I set ssl = no, but the default ssl_cert and ssl_key lines are not commented out. I got the obvious error message: ------------------------------ doveconf: Fatal: Error in configuration file /usr/local/etc/dovecot/conf.d/10-ssl.conf line 12: ssl_cert: Can't open file /etc/ssl/certs/dovecot.pem: No such file or directory /usr/local/etc/rc.d/dovecot: WARNING: failed to start dovecot -------------------------- No big deal, but I don't remember this being an issue the last time I set up a server. You would think if ssl=no, the ssl_cert and ssl_key files would not be opened.

3 2

Re: under some kind of attack
by Joseph Tam 22 Jul '17

22 Jul '17

mj <lists(a)merit.unu.edu> wrote: > - for external users, to ONLY be allowed to use an application specific > password. (or username and password, fine as well) > > Step one: making ldap password authentication valid only from our > internal network. I though: using allow_nets=192.168.1.0/24 for that passdb > > But I can't get that to work. :-( Unsure where exactly to define the > allow_nets, tried many variations on the theme already. > > Perhaps someone can help with the step one, and also tell me if the > approach outlined above is smart, valid and do-able in dovecot. As per my post: checkpassword. You can then use one password on Mondays, Wednesdays, and Fridays, alternate passwords on Tuesdays and Thursday fetched from a rot-13 database, and only from prime numbered IP addresses on weekends, if that's what you want. Gary Sellani <lists(a)lazygranch.com> writes: > Not applicable to most installations, but I use geographical filtering > on all ports other than 25. Fine if you are the only user of the email > system. If you're the only user, moving the IMAP/POP service to a nonstandard port will do most of that with much less bother, and you won't lock yourself out, requiring a ssh/edit firewall/reconnect. Been there, done that. > I get one hacker a week trying to guess passwords, and always from Digital Ocean VPS. abuse(a)digitalocean.com is fairly responsive. They usually nuke them pretty quickly. > I would like to see statistics on the success of such brute force > attacks. They can't be very successful these days. Even if the success rate is 0.00001%, you can do the arithmetic to see that's still a huge number of accounts. But you're right, if you have anything resembling a sensible password policy, they're just a log bloating nuisance. Joseph Tam <jtam.home(a)gmail.com>

2 1

FTS error Unknown user
by azurit＠pobox.sk 21 Jul '17

21 Jul '17

Hi, sorry for previous message, i accidentaly send it before it was complete. Recently, i was configuring a setup with one proxy, which is doing authentication and multiple backends, which doesn't have access to user database (see https://www.mail-archive.com/dovecot@dovecot.org/msg70123.html ). Now i wanted to use FTS (solr) on backends but i'm getting this error everytime a email is received (and FTS is not working, of course): dovecot: indexer-worker: Error: User [censored] lookup failed: Unknown user I don't fully understand why FTS needs to do any user lookup during indexing but, anyway, how can i workaround it? This is relevant config: passdb { driver = static args = password=[censored] allow_nets=[censored] } userdb { driver = static args = home=/var/mail/vhosts/%d/%n/home master_user=%u } plugin { fts = solr fts_solr = url=http://[censored]:8080/solr/ fts_autoindex = yes fts_autoindex_max_recent_msgs = 1000 } FTS is fully configured and working on proxy side (which is, currently, also a backend for most of the users - i will split it in stages, just wanted to say that i have FTS already working). azur

1 1

FTS
by azurit＠pobox.sk 21 Jul '17

21 Jul '17

Hi, recently, i was configuring a setup with one proxy, which is doing authentication and multiple backends, which doesn't have access to user database (see https://www.mail-archive.com/dovecot@dovecot.org/msg70123.html ). Now i wanted to use FTS (solr) on backends but i'm getting this error after every email is received:

1 0

Problem compiling dovecot 2.2.31 on Solaris
by Luciano Mannucci 21 Jul '17

21 Jul '17

I'm trying to compile under SunOS 5.8 Generic_117350-28 sun4u sparc SUNW,Ultra-5_10 (I know it's a bit oldish :-) and I get this error: /bin/bash ../../libtool --tag=CC --mode=compile gcc -DHAVE_CONFIG_H -I. -I../.. -std=gnu99 -g -O2 -Wall -W -Wmissing-prototypes -Wmissing-declarations -Wpointer-arith -Wchar-subscripts -Wformat=2 -Wbad-function-cast -fno-builtin-strftime -Wstrict-aliasing=2 -MT pkcs5.lo -MD -MP -MF .deps/pkcs5.Tpo -c -o pkcs5.lo pkcs5.c libtool: compile: gcc -DHAVE_CONFIG_H -I. -I../.. -std=gnu99 -g -O2 -Wall -W -Wmissing-prototypes -Wmissing-declarations -Wpointer-arith -Wchar-subscripts -Wformat=2 -Wbad-function-cast -fno-builtin-strftime -Wstrict-aliasing=2 -MT pkcs5.lo -MD -MP -MF .deps/pkcs5.Tpo -c pkcs5.c -fPIC -DPIC -o .libs/pkcs5.o pkcs5.c:9:20: error: stdint.h: No such file or directory make[4]: *** [pkcs5.lo] Error 1 What have I missed? I did: ./configure --prefix=/usr --sysconfdir=/etc --localstatedir=/var\ --mandir=/usr/share/man --docdir=/usr/share/doc/packages/dovecot\ --disable-ipv6 --enable-header-install\ make Is it reasonable? Thanks in advance, Luciano. -- /"\ /Via A. Salaino, 7 - 20144 Milano (Italy) \ / ASCII RIBBON CAMPAIGN / PHONE : +39 2 485781 FAX: +39 2 48578250 X AGAINST HTML MAIL / E-MAIL: posthamster(a)sublink.sublink.ORG / \ AND POSTINGS / WWW: http://www.lesassaie.IT/

4 6

under some kind of attack
by mj 21 Jul '17

21 Jul '17

Hi all, It seems we are under some kind of password guessing attack: > Jul 18 21:33:33 auth: Info: ldap(username1,103.6.223.61,<W7wLl5xUfABnBt89>): invalid credentials (given password: 1q2w3e4r5t) > Jul 18 21:34:16 auth: Info: ldap(username1,221.4.61.180,<89WnmZxUrADdBD20>): invalid credentials (given password: 1q2w3e4r5t) > Jul 18 21:36:13 auth: Info: ldap(username2,117.243.180.225,<ESWBoJxUdQB187Th>): invalid credentials (given password: 1q2w3e4r) > Jul 18 21:36:50 auth: Info: ldap(username2,58.59.103.230,<j7fQopxUNgA6O2fm>): invalid credentials (given password: 1q2w3e4r) > Jul 18 21:36:56 auth: Info: ldap(username4,58.215.13.154,<gtY5o5xUlQA61w2a>): invalid credentials (given password: 1q2w3e4r5t) > Jul 18 21:37:18 auth: Info: ldap(username3,220.175.154.205,<lFxppJxUFADcr5rN>): invalid credentials (given password: 1q2w3e4r) > Jul 18 21:37:25 auth: Info: ldap(username5,14.142.29.142,<40zopJxUSgAOjh2O>): invalid credentials (given password: 1q2w3e4r) > Jul 18 21:37:27 auth: Info: ldap(username4,119.1.98.121,<JDQOpZxUCwB3AWJ5>): invalid credentials (given password: 1q2w3e4r5t) > Jul 18 21:37:54 auth: Info: ldap(username3,218.76.156.11,<OMqtppxUMADaTJwL>): invalid credentials (given password: 1q2w3e4r) Different IPs, different usernames, but all (almost) the same password. Any idea what we can do about this?? Any advice you could give us would be very much appreciated. MJ

7 18

application specific passwords
by mj 21 Jul '17

21 Jul '17

Hi, Further to the other thread about password guessing activities against our dovecot, I would like to implement application specific passwords on our dovecot. Googling results in some documents, but they are all a bit older: > https://www.happyassassin.net/2014/08/26/adding-application-specific-passwo… > https://www.dgsiegel.net/news/2013_05_21-application_specific_passwords_for… > http://www.justinbuchanan.com/blog/category/RoundCube > http://www.justinbuchanan.com/blog/post/2012/12/02/Application-Specific-Pas… Those articles are interesting, but also rather old. (I realse that this does not neccesarily mean: irrelevant or bad) Is there anone here with some additional notes, ideas, tips, trics on setting up application specific passwords with dovecot with virtual users? We are using samba AD as an authentication backend. MJ

3 5

Re: under some kind of attack
by Joseph Tam 21 Jul '17

21 Jul '17

> I would like to create a fail2ban filer, that scans for these lines: > >> Jul 20 11:10:09 auth: Info: ldap(user1,60.166.35.162,<cDFXHbxUQgA8piOi>): invalid credentials (given password: password) >> Jul 20 11:10:19 auth: Info: ldap(user2,61.53.66.4,<V+nyHbxU+wA9NUIE>): invalid credentials (given password: password) > > (as you can see, I have enabled auth_verbose_passwords to do this, > making me very uncomfortable...) > > Anyway: since there are only a few password variations, I would like to > block anyone using those passwords. With all the constraints and processing, I'll offer yet another option: use the checkpassword password authentication scheme. This will bypass post-authentcation log-sniffing and allow you direct access to username, password and client IP (the last I'm not positive about) at authentication time. Now you'll have everything you need to do any wild and crazy auth processing, including database searches and triggering firewall blocking based on whatever crietria you want (including common password use). As to how to integrate it into your dovecot, I'm not sure whether it's best to supplant the LDAP method and authenticate within the checkpassword script, or to put it as the first authentication method (ahead of LDAP) to get first crack at inspect at authentication data, or the fallback authentication method (after LDAP) to pick up all the failures. However, after running honeypots, I can tell you that although BFD attackers will common use passwords, any static list of abused passwords will miss a lot. (A common one they use is $password=variations($user) or variation($domain)). Number of auth failure limits should also be a criteria for banning. Extinct users are also good candidates for instant banning. Joseph Tam <jtam.home(a)gmail.com>

2 1

2.2.devel (0bee280) crashdump virtual plugin
by Thomas Leuxner 20 Jul '17

20 Jul '17

#0 0x00007f497ecdb067 in __GI_raise (sig=sig@entry=6) at ../nptl/sysdeps/unix/sysv/linux/raise.c:56 resultvar = 0 pid = 10092 selftid = 10092 #1 0x00007f497ecdc448 in __GI_abort () at abort.c:89 save_stage = 2 act = {__sigaction_handler = {sa_handler = 0xfffe, sa_sigaction = 0xfffe}, sa_mask = {__val = {1024, 140722499998576, 94791001010256, 513, 139953641023651, 140722499998368, 94791001010256, 513, 11573297580199803136, 139953644744448, 139953641204307, 94791001010256, 140722499998464, 0, 139953641204665, 94791001010256}}, sa_flags = 2131669786, sa_restorer = 0x7ffc829fd301} sigs = {__val = {32, 0 <repeats 15 times>}} #2 0x00007f497f0f05b6 in default_fatal_finish (type=<optimized out>, status=status@entry=0) at failures.c:201 backtrace = 0x56363ff17088 "/usr/lib/dovecot/libdovecot.so.0(+0x9f5be) [0x7f497f0f05be] -> /usr/lib/dovecot/libdovecot.so.0(+0x9f6ac) [0x7f497f0f06ac] -> /usr/lib/dovecot/libdovecot.so.0(i_fatal+0) [0x7f497f080fde] -> /usr/lib/d"... #3 0x00007f497f0f06ac in i_internal_fatal_handler (ctx=0x7ffc829fd350, format=<optimized out>, args=<optimized out>) at failures.c:670 status = 0 #4 0x00007f497f080fde in i_panic (format=format@entry=0x7f497f47af00 "file %s: line %d (%s): assertion failed: (%s)") at failures.c:275 ctx = {type = LOG_TYPE_PANIC, exit_status = 0, timestamp = 0x0, timestamp_usecs = 0} args = {{gp_offset = 40, fp_offset = 48, overflow_arg_area = 0x7ffc829fd450, reg_save_area = 0x7ffc829fd390}} #5 0x00007f497f3cb6dc in mailbox_notify_changes_stop (box=<optimized out>) at mail-storage.c:1950 __FUNCTION__ = "mailbox_notify_changes_stop" #6 0x00007f497dc5aa6f in virtual_notify_changes (box=0x5636400cdbd8) at virtual-storage.c:696 bboxp_end = 0x563640015708 mbox = 0x5636400cdbd8 bboxp = 0x563640015180 #7 0x000056363f5e2652 in idle_finish (ctx=ctx@entry=0x56363ff64160, done_ok=<optimized out>, free_cmd=free_cmd@entry=true) at cmd-idle.c:46 client = 0x56363ff39e68 #8 0x000056363f5e2783 in idle_client_handle_input (ctx=ctx@entry=0x56363ff64160, free_cmd=free_cmd@entry=true) at cmd-idle.c:67 line = <optimized out> #9 0x000056363f5e284d in idle_client_input_more (ctx=0x56363ff64160) at cmd-idle.c:100 client = 0x56363ff39e68 #10 idle_client_input (ctx=0x56363ff64160) at cmd-idle.c:107 client = 0x56363ff39e68 #11 0x00007f497f105b22 in io_loop_call_io (io=0x56363ffae400) at ioloop.c:599 ioloop = 0x56363ff1f9b0 t_id = 2 __FUNCTION__ = "io_loop_call_io" #12 0x00007f497f10717a in io_loop_handler_run_internal (ioloop=ioloop@entry=0x56363ff1f9b0) at ioloop-epoll.c:223 ctx = 0x56363ff214d0 io = <optimized out> tv = {tv_sec = 3, tv_usec = 496715} events_count = <optimized out> msecs = <optimized out> ret = 1 i = 0 j = <optimized out> call = <optimized out> __FUNCTION__ = "io_loop_handler_run_internal" #13 0x00007f497f105bbc in io_loop_handler_run (ioloop=ioloop@entry=0x56363ff1f9b0) at ioloop.c:648 No locals. #14 0x00007f497f105d68 in io_loop_run (ioloop=0x56363ff1f9b0) at ioloop.c:623 __FUNCTION__ = "io_loop_run" #15 0x00007f497f08b6d3 in master_service_run (service=0x56363ff1f850, callback=<optimized out>) at master-service.c:666 No locals. #16 0x000056363f5de1d3 in main (argc=1, argv=0x56363ff1f5e0) at main.c:491 set_roots = {0x56363f8096c0 <imap_setting_parser_info>, 0x7f497f8d5540 <lda_setting_parser_info>, 0x0} login_set = {auth_socket_path = 0x56363ff17048 "\001", postlogin_socket_path = 0x0, postlogin_timeout_secs = 60, callback = 0x56363f5f92b0 <login_client_connected>, failure_callback = 0x56363f5f8bf0 <login_client_failed>, request_auth_token = 1} service_flags = <optimized out> storage_service_flags = <optimized out> username = 0x0 auth_socket_path = 0x56363f602074 "auth-master" c = <optimized out>

2 13

SRS and vacation message
by Kacper Guzik 20 Jul '17

20 Jul '17

Hi i have similiar problem like here: http://www.iredmail.org/forum/topic11833-iredmail-support-vocation-respone-… email send : from : web123(a)gmail.com to : jacka(a)mail.com vocation sent back from : jacka(a)mail.com to : srs0=hmc8=v7=gmail.com=web123(a)mail.com postsrsd changing return-path from web123(a)gmail.com to srs0=hmc8=v7= gmail.com=web123(a)mail.com this is no problem for me but sieve: Vacation's messages are always addressed to the Return-Path address it is possible some how change this ugly to header to normal? dovecot --version 2.2.29.1 (e0b76e3) # 2.2.29.1 (e0b76e3): /usr/local/etc/dovecot/dovecot.conf # Pigeonhole version 0.4.18 (29cc74d) doveconf: Warning: service auth { client_limit=125000 } is lower than required under max. load (150000) # OS: Linux 3.10.0-514.16.1.el7.x86_64 x86_64 CentOS Linux release 7.3.1611 (Core) auth_master_user_separator = * auth_mechanisms = plain login auth_worker_max_count = 60 default_client_limit = 125000 default_process_limit = 25000 dict { quotadict = mysql:/etc/dovecot/dovecot-used-quota.conf } disable_plaintext_auth = no listen = * log_path = /var/log/dovecot.log login_trusted_networks = xxx mail_fsync = never mail_gid = 2000 mail_location = maildir:/%Lh/Maildir/:INDEX=/%Lh/Maildir/ mail_max_userip_connections = 128 mail_plugins = quota zlib expire mail_uid = 2000 maildir_broken_filename_sizes = yes managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date ihave namespace inbox { inbox = yes location = mailbox Drafts { auto = subscribe special_use = \Drafts } mailbox Junk { auto = subscribe autoexpunge = 30 days special_use = \Junk } mailbox Sent { auto = subscribe special_use = \Sent } mailbox Trash { auto = subscribe autoexpunge = 30 days special_use = \Trash } prefix = } passdb { args = /etc/dovecot/dovecot-mysql.conf driver = sql } plugin { acl = vfile acl_shared_dict = proxy::acl auth_socket_path = /var/run/dovecot/auth-master quota = dict:user::proxy::quotadict sieve = /home/sieve/%Ld/%Ln/dovecot.sieve sieve_after = /home/sieve/dovecot.sieve sieve_default = /home/sieve/dovecot.sieve sieve_dir = /home/sieve/%Ld/%Ln sieve_global_dir = /home/sieve sieve_global_path = /home/sieve/dovecot.sieve sieve_max_redirects = 25 zlib_save = gz zlib_save_level = 9 } protocols = pop3 imap sieve lmtp service auth { service_count = 0 unix_listener auth-master { group = vmail mode = 0666 user = vmail } unix_listener auth-userdb { group = vmail mode = 0660 user = vmail } } service dict { unix_listener dict { group = vmail mode = 0777 user = vmail } } service imap-login { process_min_avail = 16 service_count = 0 vsz_limit = 64 M } service imap { process_limit = 4096 } service lmtp { executable = lmtp -L inet_listener lmtp { port = 24 } user = vmail } service pop3-login { process_min_avail = 16 service_count = 0 } service quota-warning { executable = script /usr/local/bin/dovecot-quota-warning.sh unix_listener quota-warning { group = root mode = 0666 user = root } user = root } ssl_ca = </etc/ssl/ca-bundle.crt ssl_cert = </etc/ssl/xxx.crt ssl_key = # hidden, use -P to show it submission_host = xxx userdb { args = /etc/dovecot/dovecot-mysql.conf driver = sql } protocol imap { imap_client_workarounds = tb-extra-mailbox-sep mail_plugins = quota imap_quota mail_log notify zlib } protocol pop3 { mail_plugins = quota zlib expire pop3_client_workarounds = outlook-no-nuls oe-ns-eoh pop3_uidl_format = %08Xu%08Xv } protocol lmtp { info_log_path = /var/log/dovecot-lmtp.log mail_fsync = optimized mail_plugins = quota sieve zlib postmaster_address = xxx } remote xxx { mail_max_userip_connections = 51200 }

1 0

Dovecot imap
by nlekkas＠gmail.com 20 Jul '17

20 Jul '17

Hello there to all ! Here is the doveconf - a as asked by Aki Tuomi.. Do you see anything wrong..? I would appreciate mush in anyone could help ... # OS: Linux 2.6.32-696.1.1.el6.x86_64 x86_64 CentOS release 6.9 (Final) auth_mechanisms = plain login disable_plaintext_auth = no mail_location = maildir:~/Maildir mail_plugins = " quota" mbox_write_locks = fcntl passdb { driver = pam } plugin { quota = fs:User quota quota_grace = 10%% quota_status_nouser = DUNNO quota_status_overquota = 552 5.2.2 Mailbox is full quota_status_success = DUNNO } protocols = imap pop3 userdb { driver = passwd } protocol imap { mail_plugins = " quota imap_quota" } protocol pop3 { pop3_uidl_format = %08Xu%08Xv }

2 1

Re: under some kind of attack
by Joseph Tam 20 Jul '17

20 Jul '17

mj <lists(a)merit.unu.edu> writes: >>> However, it seems almost all IPs are different, and I don't think I can >>> keep the above settings permanently. >> >> Why not? Limited by firewall rules overload? You could probably use >> a persistent DB, can't you? > > I meant: keep the "block after the first failed attempt" setting. People > need the chance to change their password, so I have increased it to two. A timeout feature is handy here; even though you allow attackers several kicks at the can, it will allow your users to eventually gain control to their accounts again after a suitable penalty period. >> You can also use a third party RBL that specialized in brute forcers like >> blocklist.de. You can also feed back fail2ban data and crowdsource BFD >> data to them. > > Yes, I will look into that now. > ... > > Anyone aware of other blocklists that are worth bocking? Because the > list.blocklist.de/lists/all.txt blocks some, but not anywhere near all. There are other RBLs that overlap with this (like CBL), but they include entries will produce false positives. There was OpenBL but that is defunct. The different lists at blocklist.de have varying efficacy: the ssh and smtp BFD detection are fairly good (they have a 90+% hit rate at my site), but the IMAP/POP BFD detection not as good (maybe 20%). However, if people start feeding IMAP/POP fail2ban data back to blocklist.de, that will get better. > I now know how to block large lists of ips, so if anyone has additional > lists to block? Yeah, all of ChinaNet. May produce false positives. Joseph Tam <jtam.home(a)gmail.com>

1 0

Dovecot imap
by Nick Lekkas 19 Jul '17

19 Jul '17

Hello there ! Is there anything wrong in the config i have sent earlier ..? __________ Information from ESET Endpoint Antivirus, version of detection engine 15774 (20170719) __________ The message was checked by ESET Endpoint Antivirus. Email message - is OK http://www.eset.com

1 0

Re: under some kind of attack
by Joseph Tam 19 Jul '17

19 Jul '17

On Tue, 18 Jul 2017, dovecot-request(a)dovecot.org wrote: > Thanks for the quick follow-ups! Much appreciated. After posting this, I > immediately started working on fail2ban. And between my initial posting > and now, fail2ban already blocked 114 IPs. > > I have fail2ban with maxretry=1 and bantime=1800 > > However, it seems almost all IPs are different, and I don't think I can > keep the above settings permanently. Why not? Limited by firewall rules overload? You could probably use a persistent DB, can't you? You can also use a third party RBL that specialized in brute forcers like blocklist.de. You can also feed back fail2ban data and crowdsource BFD data to them. Joseph Tam <jtam.home(a)gmail.com>

2 1

Dovecot imap
by Nick Lekkas 19 Jul '17

19 Jul '17

Hello to all !!! I have some issues with some users that login to the same account through imap from many devices like: mobile,desktop/tablet !!! Issues like: 1. When a new email is arrived is not appearing to all devices... 2. New email is arriving to some other devices after a long period of time ... Generally issues like that .... Does anyone have an idea of how to solve this ..? thanks in advance for your time ... __________ Information from ESET Endpoint Antivirus, version of virus signature database 14893 (20170206) __________ The message was checked by ESET Endpoint Antivirus. Email message - is OK http://www.eset.com __________ Information from ESET Endpoint Antivirus, version of virus signature database 14911 (20170209) __________ The message was checked by ESET Endpoint Antivirus. Email message - is OK http://www.eset.com __________ Information from ESET Endpoint Antivirus, version of virus signature database 14939 (20170215) __________ The message was checked by ESET Endpoint Antivirus. Email message - is OK http://www.eset.com __________ Information from ESET Endpoint Antivirus, version of virus signature database 14964 (20170220) __________ The message was checked by ESET Endpoint Antivirus. Email message - is OK http://www.eset.com __________ Information from ESET Endpoint Antivirus, version of virus signature database 15008 (20170228) __________ The message was checked by ESET Endpoint Antivirus. Email message - is OK http://www.eset.com __________ Information from ESET Endpoint Antivirus, version of virus signature database 15037 (20170305) __________ The message was checked by ESET Endpoint Antivirus. Email message - is OK http://www.eset.com __________ Information from ESET Endpoint Antivirus, version of detection engine 15767 (20170718) __________ The message was checked by ESET Endpoint Antivirus. Email message - is OK http://www.eset.com __________ Information from ESET Endpoint Antivirus, version of detection engine 15767 (20170718) __________ The message was checked by ESET Endpoint Antivirus. Email message - is OK http://www.eset.com

4 9