- dovecot - dovecot.org

fast sync vs. full sync
by Patrick Westenberg 20 Mar '15

20 Mar '15

Hi everyone, can anybody explain the difference between Dovecots fast sync and full sync in replication mode? Regards Patrick

2 1

indexer-worker panics with latest mercurial
by Laeeth Isharc 20 Mar '15

20 Mar '15

Hi. I am seeing the following in my logs. Happy to downgrade to an earlier version if you think this might be the problem, but dovecot.org is extremely slow (and has been for months) so I found it easier just to pull the latest from mercurial. Thanks. Laeeth Mar 12 20:48:39 indexer: Error: Indexer worker disconnected, discarding 1 reques ts for laeeth(a)laeeth.com Mar 12 20:48:39 indexer-worker(laeeth(a)laeeth.com): Fatal: master: service(indexe r-worker): child 24003 killed with signal 6 (core dumps disabled) Mar 12 20:49:01 dsync-local(laeeth(a)laeeth.com): Error: Couldn't lock /home/mail/ laeeth_laeeth_com/.dovecot-sync.lock: Timed out after 30 seconds Mar 12 20:49:16 indexer-worker(laeeth(a)laeeth.com): Error: fts_tika: PUT http://l ocalhost:9997/tika/ failed: 500 Server Error Mar 12 20:49:17 indexer-worker(rosie(a)kaleidicassociates.com): Warning: I/O leak: 0x7fc47d60fcf0 (line 127, fd 25) Mar 12 20:49:17 indexer-worker(rosie(a)kaleidicassociates.com): Panic: file ioloop .c: line 39 (io_add_file): assertion failed: (callback != NULL) Mar 12 20:49:17 indexer-worker(rosie(a)kaleidicassociates.com): Error: Raw backtrace: /usr/lib64/dovecot/libdovecot.so.0(+0x76c40) [0x7fc47d63fc40] -> /usr/lib64/dovecot/libdovecot.so.0(+0x76d1e) [0x7fc47d63fd1e] -> /usr/lib64/dovecot/libdovecot.so.0(i_fatal+0) [0x7fc47d5f02e5] -> /usr/lib64/dovecot/libdovecot.so.0(+0x87bd0) [0x7fc47d650bd0] -> /usr/lib64/dovecot/libdovecot.so.0(io_loop_move_io+0x3e) [0x7fc47d65183e] -> /usr/lib64/dovecot/libdovecot.so.0(connection_switch_ioloop+0x14) [0x7fc47d63db14] -> /usr/lib64/dovecot/libdovecot.so.0(http_client_switch_ioloop+0x28) [0x7fc47d614448] -> /usr/lib64/dovecot/libdovecot.so.0(+0x43876) [0x7fc47d60c876] -> /usr/lib64/dovecot/lib21_fts_solr_plugin.so(solr_connection_post_more+0x29) [0x7fc47c733159] -> /usr/lib64/dovecot/lib21_fts_solr_plugin.so(+0x3637) [0x7fc47c72f637] -> /usr/lib64/dovecot/lib20_fts_plugin.so(+0x6d83) [0x7fc47cf5dd83] -> /usr/lib64/dovecot/lib20_fts_plugin.so(fts_build_mail+0x614) [0x7fc47cf5e3c4] -> /usr/lib64/dovecot/lib20_fts_plugin.so(+0xc14e) [0x7fc47cf6314e] -> /usr/lib64/dovecot/libdovecot-storage.so.0(mail_precache+0x19) [0x7fc47d8ef429] -> dovecot/indexer-worker() [0x40237c] -> /usr/lib64/dovecot/libdovecot.so.0(io_loop_call_io+0x4c) [0x7fc47d65155c] -> /usr/lib64/dovecot/libdovecot.so.0(io_loop_handler_run_internal+0xbb) [0x7fc47d65249b] -> /usr/lib64/dovecot/libdovecot.so.0(io_loop_handler_run+0x9) [0x7fc47d6515c9] -> /usr/lib64/dovecot/libdovecot.so.0(io_loop_run+0x38) [0x7fc47d651648] -> /usr/lib64/dovecot/libdovecot.so.0(master_service_run+0x13) [0x7fc47d5f5703] -> dovecot/indexer-worker(main+0xcb) [0x401e7b] -> /lib64/libc.so.6(__libc_start_main+0xf5) [0x32c6021d65] -> dovecot/indexer-worker() [0x401f25] Mar 12 20:49:17 indexer: Error: Indexer worker disconnected, discarding 15 reque sts for rosie(a)kaleidicassociates.com Mar 12 20:49:17 indexer-worker(rosie(a)kaleidicassociates.com): Fatal: master: service(indexer-worker): child 24022 killed with signal 6 (core dumps disabled) Mar 12 20:49:17 indexer-worker(laeeth(a)kaleidicassociates.com): Warning: I/O leak: 0x7f22c4d4dcf0 (line 127, fd 23) Mar 12 20:49:17 indexer-worker(laeeth(a)kaleidicassociates.com): Panic: file ioloop.c: line 829 (io_loop_move_io): assertion failed: ((old_io->condition & IO_NOTIFY) == 0) Mar 12 20:49:17 indexer-worker(laeeth(a)kaleidicassociates.com): Error: Raw backtrace: /usr/lib64/dovecot/libdovecot.so.0(+0x76c40) [0x7f22c4d7dc40] -> /usr/lib64/dovecot/libdovecot.so.0(+0x76d1e) [0x7f22c4d7dd1e] -> /usr/lib64/dovecot/libdovecot.so.0(i_fatal+0) [0x7f22c4d2e2e5] -> /usr/lib64/dovecot/libdovecot.so.0(+0x888ba) [0x7f22c4d8f8ba] -> /usr/lib64/dovecot/libdovecot.so.0(connection_switch_ioloop+0x14) [0x7f22c4d7bb14] -> /usr/lib64/dovecot/libdovecot.so.0(http_client_switch_ioloop+0x28) [0x7f22c4d52448] -> /usr/lib64/dovecot/libdovecot.so.0(+0x43876) [0x7f22c4d4a876] -> /usr/lib64/dovecot/lib21_fts_solr_plugin.so(solr_connection_post_more+0x29) [0x7f22c3e71159] -> /usr/lib64/dovecot/lib21_fts_solr_plugin.so(+0x3637) [0x7f22c3e6d637] -> /usr/lib64/dovecot/lib20_fts_plugin.so(+0x6d83) [0x7f22c469bd83] -> /usr/lib64/dovecot/lib20_fts_plugin.so(fts_build_mail+0x123) [0x7f22c469bed3] -> /usr/lib64/dovecot/lib20_fts_plugin.so(+0xc14e) [0x7f22c46a114e] -> /usr/lib64/dovecot/libdovecot-storage.so.0(mail_precache+0x19) [0x7f22c502d429] -> dovecot/indexer-worker() [0x40237c] -> /usr/lib64/dovecot/libdovecot.so.0(io _loop_call_io+0x4c) [0x7f22c4d8f55c] -> /usr/lib64/dovecot/libdovecot.s o.0(io_loop_handler_run_internal+0xbb) [0x7f22c4d9049b] -> /usr/lib64/dovecot/libdovecot.so.0(io_loop_handler_run+0x9) [0x7f22c4d8f5c9] -> /usr/lib64/dovecot/libdovecot.so.0(io_loop_run+0x38) [0x7f22c4d8f648] -> /usr/lib64/dovecot/libdovecot.so.0(master_service_run+0x13) [0x7f22c4d33703] -> dovecot/indexer-worker(main+0xcb) [0x401e7b] -> /lib64/libc.so.6(__libc_start_main+0xf5) [0x32c6021d65] -> dovecot/indexer-worker() [0x401f25] Mar 12 20:49:17 indexer: Error: Indexer worker disconnected, discarding 6 requests for laeeth(a)kaleidicassociates.com Mar 12 20:49:17 indexer-worker(laeeth(a)kaleidicassociates.com): Fatal: master: service(indexer-worker): child 24020 killed with signal 6 (core dumps disabled) Mar 12 20:49:26 indexer-worker(laeeth(a)laeeth.com): Warning: I/O leak: 0x7f0d5aa00cf0 (line 127, fd 23) Mar 12 20:49:26 indexer-worker(laeeth(a)laeeth.com): Panic: file ioloop-iolist.c: line 22: unreached Mar 12 20:49:26 indexer-worker(laeeth(a)laeeth.com): Error: Raw backtrace: /usr/lib64/dovecot/libdovecot.so.0(+0x76c40) [0x7f0d5aa30c40] -> /usr/lib64/dovecot/libdovecot.so.0(+0x76d1e) [0x7f0d5aa30d1e] -> /usr/lib64/dovecot/libdovecot.so.0(i_fatal+0) [0x7f0d5a9e12e5] -> /usr/lib64/dovecot/libdovecot.so.0(+0x88a0d) [0x7f0d5aa42a0d] -> /usr/lib64/dovecot/libdovecot.so.0(io_loop_handle_add+0x3b) [0x7f0d5aa4319b] -> /usr/lib64/dovecot/libdovecot.so.0(+0x87b61) [0x7f0d5aa41b61] -> /usr/lib64/dovecot/libdovecot.so.0(io_loop_move_io+0x3e) [0x7f0d5aa4283e] -> /usr/lib64/dovecot/libdovecot.so.0(connection_switch_ioloop+0x14) [0x7f0d5aa2eb14] -> /usr/lib64/dovecot/libdovecot.so.0(http_client_switch_ioloop+0x28) [0x7f0d5aa0

2 1

[Dovecot] imapc - different settings for different namespaces
by Timo Sirainen 20 Mar '15

20 Mar '15

Originally I was planning on allowing all kinds of mail settings inside namespace {}, including imapc_* settings. But that's a bit difficult to implement (although I think it will happen some day). So for now I was thinking: imapc foo { host = imap.foo.com master_user = foomaster password = foopass } imapc bar { host = imap.bar.com ... } namespace { prefix = foo/ location = imapc:foo } namespace { prefix = bar/ location = imapc:bar } So basically if the path after imapc isn't absolute (/path or ~/path), then treat the path as the imapc section name and use its settings. Anyone have any improvement suggestions? I was planning on adding this to v2.2.3. I'm not sure if the section names should be "imapc" or something else (e.g. imap_remote {}).

2 2

core not dumped
by James 20 Mar '15

20 Mar '15

There is some underlying problem with imap-login but in order to debug it I'd like to see a core file. On error dovecot reports "core not dumped". If I put "abort()" in the code at the point it is reporting then a core file is written, so there is no OS reason why a core can not be written. It appears to be dovecot's choice to control the child. In an attempt to obtain a core file I have: service imap-login { chroot = drop_priv_before_exec = yes user = dovecot } How can I make imap-login to produce a core file? Syslog error report: Mar 18 09:22:28 MAILHOST dovecot: [ID 583609 mail.crit] imap-login: Fatal: master: service(imap-login): child 10812 killed with signal 11 (core not dumped) [last ip=111.222.333.444] Should anyone care at this point (before I've looked at a core file) the error is related to; imap-login: Disconnected (no auth attempts in 0 secs): user=<>, James.

3 4

Re: fast doveadm search results
by Joseph Tam 20 Mar '15

20 Mar '15

Vu Ngoc VU <vvu(a)mcra.fr> writes: > My goal is to be able to find mails quickly with "doveadm search". > We are using dovecot in a corporate. And some managers, sometimes ask to delete some messages. > These messages are "unwanted" ones: mistakenly sent, defamatory... > > So, that situations appear rarely, but when asked, they expected me to > deleted quickly these messages from few to thousands of users > mailboxes. > > Is that possible to change behaviour of Dovecot, some headers like > sender, message-id, date are stored in cache for at least 48h? (7 days > would be better). So is this a fair summary of what you are asking: you want to load dovecot's caches with searchable items (i.e. specified headers) *and* have them expire and removed from caches after a preset amount of time? Caches are persistent: once an item is cached, it stays in the cache. I can't think of a good way to purge them without a lot of bother, but maybe you don't really need this. If you want to preload the cache with searchable items, you can periodically run a search/fetch command, which will load the cache with headers you want. http://www.dovecot.org/list/dovecot/2010-October/053521.html Maybe you can even add these items into the cache upon delivery, but someone more knowlegable than I would have to help you with that. The FTS/Solr plugin might also help. You seem to be optimizing the wrong problem. Reading between the lines of your message, your management wants a technical solution to a human problem (someone did an oops). Joseph Tam <jtam.home(a)gmail.com>

1 0

Released Pigeonhole v0.4.7 for Dovecot v2.2.16
by Stephan Bosch 20 Mar '15

20 Mar '15

Hello Dovecot users, Here is the final 0.4.7 release. No changes were committed since the last release candidate. Changelog v0.4.7: * editheader extension: Made protection against addition and deletion of headers configurable separately. Also, the `Received' and `Auto-Submitted' headers are no longer protected against addition by default. * Turned message envelope address parse errors into warnings. * The interpreter now accepts non-standard domain names, e.g. containing '_'. + Implemented the Sieve index extension (RFC 5260). + Implemented support for the mboxmetadata and servermetadata extensions (RFC 5490). + Implemented new sieve commands for the doveadm command line utility. These commands are currently limited to ManageSieve operations, but the other current sieve tools will be migrated to doveadm in the near future as well. + Added more debug output about binary up-to-date checking. + Added script metadata to binary dump output. - Fixed Sieve script binary up-to-date checking by normalizing the script location. - The Sieve interpreter now flushes the duplicate database during start phase of result execution rather than commit phase. This makes sure locks on the duplicate database are released as soon as possible, preventing contention. - Performed a few optimizations in the lexical scanner of the language. - Fixed bug in `:matches' match-type that made a pattern without wildcards match as if there were a '*' at the beginning. - Fixed crash in validation of the string parameter of the comparator tag. - extprograms extension: Made sure supplemental group privileges are also dropped. This was a problem reported by Debian lintian. - Fixed bug in handling of binary errors for action side-effects and message overrides. - file script storage: Restructured storage initialization to address backwards compatibility issues. - dict script storage: Fixed small memory allocation bug. The release is available as follows: http://pigeonhole.dovecot.org/releases/2.2/dovecot-2.2-pigeonhole-0.4.7.tar… http://pigeonhole.dovecot.org/releases/2.2/dovecot-2.2-pigeonhole-0.4.7.tar… Refer to http://pigeonhole.dovecot.org and the Dovecot v2.x wiki for more information. Have fun testing this new release and don't hesitate to notify me when there are any problems. Regards, -- Stephan Bosch stephan(a)rename-it.nl

1 0

check if anvil is working
by Leonardo Rodrigues 19 Mar '15

19 Mar '15

Hi, Is there any way of making sure the anvil service, used to penalty login fails, is working ? I dont see anything on the logs regarding it neither have it configured. It's not on my configuration files, but it can be seen on a 'dovecot -a' dump. Should it be logging something ? Should i have enabled it somehow ? Thanks for the answers. [root@correio log]# dovecot --version 2.2.13 (from dovecot -a dump) service anvil { chroot = empty client_limit = 0 drop_priv_before_exec = no executable = anvil extra_groups = group = idle_kill = 4294967295 secs privileged_group = process_limit = 1 process_min_avail = 1 protocol = service_count = 0 type = anvil unix_listener anvil-auth-penalty { group = mode = 0600 user = } unix_listener anvil { group = mode = 0600 user = } user = $default_internal_user vsz_limit = 18446744073709551615 B } -- Atenciosamente / Sincerily, Leonardo Rodrigues Solutti Tecnologia http://www.solutti.com.br Minha armadilha de SPAM, NÃO mandem email gertrudes(a)solutti.com.br My SPAMTRAP, do not email it

1 0

fast doveadm search results
by Vu Ngoc VU 19 Mar '15

19 Mar '15

hello, I've posted same question here months ago. But obtaine no answer, even not a "you question is stupid". So I don't know what to think about that. My goal is to be able to find mails quickly with "doveadm search". We are using dovecot in a corporate. And some managers, sometimes ask to delete some messages. These messages are "unwanted" ones: mistakenly sent, defamatory... So, that situations appear rarely, but when asked, they expected me to deleted quickly these messages from few to thousands of users mailboxes. Is that possible to change behaviour of Dovecot, some headers like sender, message-id, date are stored in cache for at least 48h? (7 days would be better). I've read this page : http://wiki2.dovecot.org/Design/Indexes/Cache but cannot understand every parts. "A specific decision can be forced by ORing it with MAIL_CACHE_DECISION_FORCED." Is OR in this sentence like AND/OR comparators? Where to put "MAIL_CACHE_DECISION_FORCED"? "mail-cache-decisions.c file contains the rules how Dovecot changes the decisions." <-- is it in this file? My setup is 2.2.9 on Ubuntu 14.04 running on OpenVZ containers with 2 Director and 2 imap/pop3 backends. The storage is shared via NFS. Is this the performance problem? If dovecot has metadata I want in its cache, I cannot see how this is a problem. Can these settings be useful for my case? mail_always_cache_fields = mail_cache_fields = flags mail_cache_min_mail_count = 0 mail_never_cache_fields = imap.envelope Thanks.

2 2

Support for multiple passwords?
by Conrad Kostecki 18 Mar '15

18 Mar '15

Hi! Currently, the passwords are stored in plaintext for my dovecot, as I am still using cram-md5 AND digest-md5. I have still to offer that, as I have some deprecated clients, therefore, I am unable to hash at least those passwords for that accounts. I've found on the Wiki: > In future it's possible that Dovecot could support multiple passwords > in different schemes for a single user. Is there any news about this? Are there still any plans to support this maybe in future? For my understanding, that would solve my problem, that I could define a password in both schemes (cram and digest) and don't have to use plaintext password? Cheers Conrad

3 6

passwd file for quota
by Cliff Hayes 18 Mar '15

18 Mar '15

I need to implement quota. I read as much as I could including http://wiki2.dovecot.org/HowTo/SimpleVirtualInstall But my current /etc/passwd file does not have the password in it as shown in dovecot docs ... there is an x where the password should be. I created a program that creates a passwd file in the proper format with the proper extra quota fields for all users (except it has an x where the password should be). I plan to store it in /etc/dovecot How do I get dovecot to stop looking at /etc/passwd and start looking at /etc/dovecot/passwd? And hopefully that will not affect how it gets the password (pam) because when users change their password from webmail of course dovecot will need to be looking in the same place. # dovecot -n output # 2.0.9: /etc/dovecot/dovecot.conf # OS: Linux 2.6.32-431.29.2.el6.x86_64 x86_64 Scientific Linux release 6.5 (Carbon) auth_failure_delay = 5 secs auth_username_format = %Ln auth_verbose_passwords = plain first_valid_uid = 9 mail_access_groups = mail mail_location = maildir:~/Maildir managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date mbox_write_locks = fcntl passdb { driver = pam } plugin { sieve = ~/.dovecot.sieve sieve_after = /dovecotSieveAfter/ sieve_dir = ~/sieve } protocols = imap lmtp sieve service managesieve-login { inet_listener sieve { port = 4190 } } ssl_ca = </etc/pki/dovecot/certs/intermediate20150202.crt ssl_cert = </etc/pki/dovecot/certs/avalon20150202.crt ssl_key = </etc/pki/dovecot/private/avalon20150129.key ssl_verify_client_cert = yes userdb { driver = passwd } protocol lmtp { log_path = /var/log/dovecot-lmtp.log mail_plugins = " sieve" } protocol lda { log_path = /var/log/dovecot-lda.log mail_plugins = " sieve" }

2 4

Roundcubemail problem with Dovecot
by Robert Moskowitz 18 Mar '15

18 Mar '15

I am getting "Connection to storage server failed." in roundcubemail. On doing a google search If find: http://help.directadmin.com/item.php?id=473 Which puts the problem at dovecot. I did get a dovecot update back on 3-5 and that would match to my one roundcube mail user complaining and the delays I am seeing with thunderbird and outlook users. So with my setup, I am trying to figure what are the index files to delete. Say for myself, I am seeing: /home/vmail/htt-consult.com/rgm/dovecot.index /home/vmail/htt-consult.com/rgm/dovecot.index.cache /home/vmail/htt-consult.com/rgm/dovecot.index.log /home/vmail/htt-consult.com/rgm/.Drafts/dovecot.index /home/vmail/htt-consult.com/rgm/.Drafts/dovecot.index.cache /home/vmail/htt-consult.com/rgm/.Drafts/dovecot.index.log /home/vmail/htt-consult.com/rgm/.Sent/dovecot.index /home/vmail/htt-consult.com/rgm/.Sent/dovecot.index.cache /home/vmail/htt-consult.com/rgm/.Sent/dovecot.index.log /home/vmail/htt-consult.com/rgm/.Spam/dovecot.index /home/vmail/htt-consult.com/rgm/.Spam/dovecot.index.cache /home/vmail/htt-consult.com/rgm/.Spam/dovecot.index.log /home/vmail/htt-consult.com/rgm/.Trash/dovecot.index /home/vmail/htt-consult.com/rgm/.Trash/dovecot.index.cache /home/vmail/htt-consult.com/rgm/.Trash/dovecot.index.log Do I delete all of these? The index.cache files are quite large.

1 1

Re: Dovecot current number of connections being used.
by Joseph Tam 18 Mar '15

18 Mar '15

Jaime Ventura writes: > Is there an easy way to get how many connections are being handled at a > moment? This works: doveadm who -1 2>/dev/null | wc -l If yopu only want to coutn IMAP connections (not POP3), doveadm who -1 2>/dev/null | grep -Fc imap Joseph Tam <jtam.home(a)gmail.com>

2 1

Proxying of non "plain" SASL mechnisms.
by Peter Mogensen 18 Mar '15

18 Mar '15

Hi, I understand from earlier discussions that the reason dovecot doesn't support proxying of other SASL mechanisms than those which supply the plaintext password is that in general it would be possible to proxy any SASL mechanism since it might protect against man-in-the-middle attacks (which would prevent proxying). However, that has led to choice between letting users use PLAIN (or equivalent), or to have the proxy access the target hosts by "master" password. Of course, having the plaintext password the proxy could in principle do other challenge/response SASL handshakes with the target backend, but right now only LOGIN and PLAIN is implemented. So I wondered about the rationale for not just forward the SASL handshake. - First, blindly forwardning will not do, since the mech data has to be decoded anyway to do any per/user passdb lookup (to, say, find the target host). But you don't need authentication to actually succeed to do that. You only need AuthZ-id or AuthN-id. - Secondly, the design of the interaction between imap-login processes and the auth-service in general prevent in general to forward multi-handshake SASL mechanisms, since the authentication must be done before the proxying can be started. But it doesn't prevent forwarding of single handshake SASL mechanisms which use SASL-IR. - Thirdly, while it's correct that some SASL mechanisms protect against man-in-the-middle attacks, that doesn't apply for most single-handshake SASL-IR mechanisms unless they do some kind of channel-binding. (like SASL EXTERNAL) For example, the GS2-KRB5 SASL mech would be perfectly forwarded if just the Kerberos ticket doesn't put restrictions on the client IP-address. So, why not just extend the support for proxy authentication forwarding to any single-handskake SASL-IR mechanism, which doesn't use channel-binding? (which includes PLAIN, but also GS2-KRB5, and possibly others). /Peter

2 2

Dovecot 2.2.15 issues with global ACL
by Ovidiu Moldovan 18 Mar '15

18 Mar '15

Hello, We have upgraded from Dovecot 2.2.13 to 2.2.15 and we are using global ACL file. The content of the ACL file is as following: * owner r INBOX owner lrwstipekxa INBOX/* owner lrwstipekxa user owner rwstipekxa user/* owner rwstipekxa This worked fine but after update any user cannot see any folders from under the INBOX, also they cannot create any new folders. Error into the logs are like this: Debug: acl: Mailbox not in dovecot-acl-list: INBOX Debug: acl: Mailbox not in dovecot-acl-list: INBOX/Chats Debug: acl: Mailbox not in dovecot-acl-list: INBOX/Draft Debug: acl: Mailbox not in dovecot-acl-list: INBOX/INBOX .... I can only see one acl change log at version 2.2.14: http://www.dovecot.org/list/dovecot-news/2014-October/000276.html acl: Global ACL file now supports "quotes" around patterns. But I could not find the reason why the global acl file does not work anymore? Br, Ova

2 2

http://xi.rename-it.nl 2.2.16-1~auto+10/11/12/13: segfault /var/lib/dovecot/auth OR (db_ldap_connect_delayed):
by Denny Fuchs 17 Mar '15

17 Mar '15

hi, I testing around with Kolab with LDAP and have some strange problems, with the auto generated packages for Wheezy. On my first test VM, I have 2:2.2.16~rc1-1~auto+4 installed, and everything works as expected. On a new VM I have 2.2.16-1~auto+13_amd64.deb packages and if I include LDAP backend, I get a segmentation fault on /usr/lib/dovecot/auth: root@kolab:/etc/dovecot/conf.d# /usr/lib/dovecot/auth Segmentation fault with auto+12 and auto+13 If I downgrade to auto+11 or auto+10 I get: Mar 17 14:42:59 kolab dovecot: auth: Panic: file db-ldap.c: line 1228 (db_ldap_connect_delayed): assertion failed: (conn->to == NULL) Mar 17 14:42:59 kolab dovecot: auth: Error: Raw backtrace: /usr/lib/dovecot/libdovecot.so.0(+0x7b5ef) [0x7f57d815c5ef] -> /usr/lib/dovecot/libdovecot.so.0(+0x7b64e) [0x7f57d815c64e] -> /usr/lib/dovecot/libdovecot.so.0(i_fatal+0) [0x7f57d810b0d5] -> /usr/lib/dovecot/modules/auth/libauthdb_ldap.so(+0x5455) [0x7f57d70e2455] -> dovecot/auth(userdb_init+0x1a) [0x42765a] -> dovecot/auth(auths_init+0xc9) [0x40d979] -> dovecot/auth(main+0x2b5) [0x40cc85] -> /lib/x86_64-linux-gnu/libc.so.6(__libc_start_main+0xfd) [0x7f57d7523ead] -> dovecot/auth() [0x40cee9] Mar 17 14:42:59 kolab dovecot: auth: Fatal: master: service(auth): child 1161 killed with signal 6 (core dumps disabled) Mar 17 14:42:59 kolab dovecot: master: Error: service(auth): command startup failed, throttling for 2 secs Mar 17 14:42:59 kolab dovecot: pop3-login: Disconnected: Auth process broken (disconnected before auth was ready, waited 0 secs): user=<>, rip=::1, lip=::1, secured, session=<1QMUJXwRTQAAAAAAAAAAAAAAAAAAAAAB> ii dovecot-sieve 2:2.2.16~rc1-1~auto+4 amd64 secure POP3/IMAP server - Sieve filters support root@kolab:/# ldd /usr/lib/dovecot/modules/auth/libauthdb_ldap.so linux-vdso.so.1 => (0x00007ffc4a1c6000) libldap_r-2.4.so.2 => /usr/lib/x86_64-linux-gnu/libldap_r-2.4.so.2 (0x00007effe2d1a000) librt.so.1 => /lib/x86_64-linux-gnu/librt.so.1 (0x00007effe2b12000) libc.so.6 => /lib/x86_64-linux-gnu/libc.so.6 (0x00007effe2786000) liblber-2.4.so.2 => /usr/lib/x86_64-linux-gnu/liblber-2.4.so.2 (0x00007effe2577000) libresolv.so.2 => /lib/x86_64-linux-gnu/libresolv.so.2 (0x00007effe2361000) libsasl2.so.2 => /usr/lib/x86_64-linux-gnu/libsasl2.so.2 (0x00007effe2145000) libgnutls.so.26 => /usr/lib/x86_64-linux-gnu/libgnutls.so.26 (0x00007effe1e85000) libgcrypt.so.11 => /lib/x86_64-linux-gnu/libgcrypt.so.11 (0x00007effe1c06000) libpthread.so.0 => /lib/x86_64-linux-gnu/libpthread.so.0 (0x00007effe19e9000) /lib64/ld-linux-x86-64.so.2 (0x00007effe3180000) libdl.so.2 => /lib/x86_64-linux-gnu/libdl.so.2 (0x00007effe17e5000) libtasn1.so.3 => /usr/lib/x86_64-linux-gnu/libtasn1.so.3 (0x00007effe15d3000) libz.so.1 => /lib/x86_64-linux-gnu/libz.so.1 (0x00007effe13bc000) libp11-kit.so.0 => /usr/lib/x86_64-linux-gnu/libp11-kit.so.0 (0x00007effe11aa000) libgpg-error.so.0 => /lib/x86_64-linux-gnu/libgpg-error.so.0 (0x00007effe0fa6000) Then I copied from my first VM the libauthdb_ldap.so file on the new test VM to /usr/lib/dovecot/modules/auth/libauthdb_ldap.so (remember: ~rc1-1~auto+4) and the result: root@kolab:/etc/dovecot/conf.d# /usr/lib/dovecot/auth Error: LDAP: binding failed (dn cn=Directory Manager): Invalid credentials and, it works again ... linux-vdso.so.1 => (0x00007fffa00c6000) libldap_r-2.4.so.2 => /usr/lib/x86_64-linux-gnu/libldap_r-2.4.so.2 (0x00007f94b7ec3000) librt.so.1 => /lib/x86_64-linux-gnu/librt.so.1 (0x00007f94b7cbb000) libc.so.6 => /lib/x86_64-linux-gnu/libc.so.6 (0x00007f94b792f000) liblber-2.4.so.2 => /usr/lib/x86_64-linux-gnu/liblber-2.4.so.2 (0x00007f94b7720000) libresolv.so.2 => /lib/x86_64-linux-gnu/libresolv.so.2 (0x00007f94b750a000) libsasl2.so.2 => /usr/lib/x86_64-linux-gnu/libsasl2.so.2 (0x00007f94b72ee000) libgnutls.so.26 => /usr/lib/x86_64-linux-gnu/libgnutls.so.26 (0x00007f94b702e000) libgcrypt.so.11 => /lib/x86_64-linux-gnu/libgcrypt.so.11 (0x00007f94b6daf000) libpthread.so.0 => /lib/x86_64-linux-gnu/libpthread.so.0 (0x00007f94b6b92000) /lib64/ld-linux-x86-64.so.2 (0x00007f94b8328000) libdl.so.2 => /lib/x86_64-linux-gnu/libdl.so.2 (0x00007f94b698e000) libtasn1.so.3 => /usr/lib/x86_64-linux-gnu/libtasn1.so.3 (0x00007f94b677c000) libz.so.1 => /lib/x86_64-linux-gnu/libz.so.1 (0x00007f94b6565000) libp11-kit.so.0 => /usr/lib/x86_64-linux-gnu/libp11-kit.so.0 (0x00007f94b6353000) libgpg-error.so.0 => /lib/x86_64-linux-gnu/libgpg-error.so.0 (0x00007f94b614f000) So, it seems, that there is something broken with the autogenerated packages, or with my fresh installed Wheey VM (KVM AMD64) in combination with LDAP. any suggestions? cu denny

2 1

Dovecot current number of connections being used.
by Jaime Ventura 17 Mar '15

17 Mar '15

Hey, Is there an easy way to get how many connections are being handled at a moment? I wanted to have that number over the time and see: - Trends on usage during the day - how close is it from reaching the maximum number of connections. - ... I'm searching for a solution without recurring to something like netstat | grep imap | wc -l. Thanks, Jaime

2 1

Patch SERVICE_FIRST_STATUS_TIMEOUT
by Andre Helwig 17 Mar '15

17 Mar '15

Hi list, we had a lot of trouble with our Dovecot Replicating-Cluster installation authenticating against LDAP Service. We ran in a timeout and what happened was that we got more and more search requests running against on our ldap server. And on the dovecot site the process got killed after a couple of seconds. So we ran into a race condition and our LDAP Server was under heavy load. We got a log entry like this: "Initial status notification not received in 30 seconds, killing the process" So we had to apply the attached patch to our Source based Dovecot Cluster. Could you please make a configurable Parameter for our Patched value? That would be great to get this parameter Configurable. Thanks Andre Helwig -- Heinlein Support GmbH Schwedter Str. 8/9b, 10119 Berlin http://www.heinlein-support.de Tel: 030 / 405051-0 Fax: 030 / 405051-19 Zwangsangaben lt. §35a GmbHG: HRB 93818 B / Amtsgericht Berlin-Charlottenburg, Geschäftsführer: Peer Heinlein -- Sitz: Berlin

2 3

Dovecot 2.1.7 still accepting SSLv3 though disabled?
by Thomas Preissler 17 Mar '15

17 Mar '15

Hello, I came across a strange problem with my Dovecot 2.1.7 installation (updated Debian Wheezy) in regards to SSL/TLS connections. My configuration is as follows: $ dovecot -n | grep ssl service imap-login { ssl = yes ... } ssl_cert = <...... ssl_cipher_list = EDH+CAMELLIA:EDH+aRSA:EECDH+aRSA+AESGCM:EECDH+aRSA+SHA384:EECDH+aRSA+SHA256:EECDH:+CAMELLIA256:+AES256:+CAMELLIA128:+AES128:+SSLv3:!aNULL:!eNULL:!LOW:!3DES:!MD5:!EXP:!PSK:!DSS:!RC4:!SEED:!ECDSA:CAMELLIA256-SHA:AES256-SHA:CAMELLIA128-SHA:AES128-SHA ssl_key = <...... ssl_protocols = !SSLv3 !SSLv2 This cipherstring has been taken from https://bettercrypto.org/static/applied-crypto-hardening.pdf. But this is not the problem, when I comment it out, Dovecot still behaves the same way. When I enable verbose_ssl I get this: 2015-03-15 08:27:39 imap-login: Warning: SSL: where=0x10, ret=1: before/accept initialization [$CLIENTIP] 2015-03-15 08:27:39 imap-login: Warning: SSL: where=0x2001, ret=1: before/accept initialization [$CLIENTIP] 2015-03-15 08:27:39 imap-login: Warning: SSL: where=0x2002, ret=-1: unknown state [$CLIENTIP] 2015-03-15 08:27:39 imap-login: Warning: SSL: where=0x2001, ret=1: SSLv3 read client hello A [$CLIENTIP] 2015-03-15 08:27:39 imap-login: Warning: SSL: where=0x2001, ret=1: SSLv3 write server hello A [$CLIENTIP] 2015-03-15 08:27:39 imap-login: Warning: SSL: where=0x2001, ret=1: SSLv3 write certificate A [$CLIENTIP] 2015-03-15 08:27:39 imap-login: Warning: SSL: where=0x2001, ret=1: SSLv3 write server done A [$CLIENTIP] 2015-03-15 08:27:39 imap-login: Warning: SSL: where=0x2001, ret=1: SSLv3 flush data [$CLIENTIP] 2015-03-15 08:27:39 imap-login: Warning: SSL: where=0x2002, ret=-1: SSLv3 read client certificate A [$CLIENTIP] 2015-03-15 08:27:39 imap-login: Warning: SSL: where=0x2002, ret=-1: SSLv3 read client certificate A [$CLIENTIP] 2015-03-15 08:27:39 imap-login: Warning: SSL: where=0x2001, ret=1: SSLv3 read client key exchange A [$CLIENTIP] 2015-03-15 08:27:39 imap-login: Warning: SSL: where=0x2001, ret=1: SSLv3 read finished A [$CLIENTIP] 2015-03-15 08:27:39 imap-login: Warning: SSL: where=0x2001, ret=1: SSLv3 write change cipher spec A [$CLIENTIP] 2015-03-15 08:27:39 imap-login: Warning: SSL: where=0x2001, ret=1: SSLv3 write finished A [$CLIENTIP] 2015-03-15 08:27:39 imap-login: Warning: SSL: where=0x2001, ret=1: SSLv3 flush data [$CLIENTIP] 2015-03-15 08:27:39 imap-login: Warning: SSL: where=0x20, ret=1: SSL negotiation finished successfully [$CLIENTIP] 2015-03-15 08:27:39 imap-login: Warning: SSL: where=0x2002, ret=1: SSL negotiation finished successfully [$CLIENTIP] Is this right? Is SSLv3 used on this connection? But when I explicitely test for SSLv3 support I get $ openssl s_client -connect $SERVERIP:993 -ssl3 CONNECTED(00000003) 140683835029160:error:14094410:SSL routines:SSL3_READ_BYTES:sslv3 alert handshake failure:s3_pkt.c:1260:SSL alert number 40 140683835029160:error:1409E0E5:SSL routines:SSL3_WRITE_BYTES:ssl handshake failure:s3_pkt.c:598: --- no peer certificate available --- No client certificate CA names sent --- SSL handshake has read 7 bytes and written 0 bytes --- New, (NONE), Cipher is (NONE) Secure Renegotiation IS NOT supported Compression: NONE Expansion: NONE SSL-Session: Protocol : SSLv3 Cipher : 0000 Session-ID: Session-ID-ctx: Master-Key: Key-Arg : None PSK identity: None PSK identity hint: None SRP username: None Start Time: 1426411304 Timeout : 7200 (sec) Verify return code: 0 (ok) --- Where I got this from says "if you you get a handshake failure, then you don't support SSLv3". But in my case the following output kinda says, that I do support it - with a ciphers of (NONE)? In regards to libraries $ ldd /usr/lib/dovecot/imap-login | grep ssl libssl.so.1.0.0 => /usr/lib/x86_64-linux-gnu/libssl.so.1.0.0 (0x00007f1f55025000) $ dpkg -l | grep ssl ii libcrypt-openssl-bignum-perl 0.04-3 amd64 Access OpenSSL multiprecision integer arithmetic libraries ii libcrypt-openssl-dsa-perl 0.13-6 amd64 module which implements the DSA signature verification system ii libcrypt-openssl-rsa-perl 0.28-1 amd64 module for RSA encryption using OpenSSL ii libcrypt-ssleay-perl 0.58-1 amd64 OpenSSL support for LWP ii libio-socket-ssl-perl 1.76-2 all Perl module implementing object oriented interface to SSL sockets ii libnet-ssleay-perl 1.48-1+b1 amd64 Perl module for Secure Sockets Layer (SSL) rc libssl0.9.8 0.9.8o-4squeeze14 amd64 SSL shared libraries ii libssl1.0.0:amd64 1.0.1e-2+deb7u14 amd64 SSL shared libraries ii openssl 1.0.1e-2+deb7u14 amd64 Secure Socket Layer (SSL) binary and related cryptographic tools ii openssl-blacklist 0.5-3 all Blacklists for OpenSSL RSA keys and tools ii python-openssl 0.13-2+deb7u1 amd64 Python 2 wrapper around the OpenSSL library ii ssl-cert 1.0.32 all simple debconf wrapper for OpenSSL ii ssl-cert-check 3.22-1 all proactively handling X.509 certificate expiration ii sslmate 0.6.2-1 all Buy and manage SSL certificates from the command line My NginX is using the same library, and this does indeed support TLSv2, so what I am doing wrong in my Dovecot configuration? Any clues? Regards Thomas -- www.preissler.co.uk | Twitter: @module0x90 | PGP-Key: 75889415 GPG Fingerprint: CCBD 153A D257 CA7E A217 FDF7 5928 03D1 7588 9415

3 2

Released Pigeonhole v0.4.7.rc3 for Dovecot v2.2.16
by Stephan Bosch 17 Mar '15

17 Mar '15

Hello Dovecot users, The rc2 release had a couple of new, rather small, but very annoying bugs. First of all, the path for a file storage wasn't actually normalized, due to a stupid last-minute change before the release. This caused the personal script to be skipped with a warning when there were e.g. duplicate slashes in the path. Second, due to recent changes, the file storage would complain with a temporary error if the directory where the active script symlink would be located was missing. Changelog v0.4.7 (unchanged): * editheader extension: Made protection against addition and deletion of headers configurable separately. Also, the `Received' and `Auto-Submitted' headers are no longer protected against addition by default. * Turned message envelope address parse errors into warnings. * The interpreter now accepts non-standard domain names, e.g. containing '_'. + Implemented the Sieve index extension (RFC 5260). + Implemented support for the mboxmetadata and servermetadata extensions (RFC 5490). + Implemented new sieve commands for the doveadm command line utility. These commands are currently limited to ManageSieve operations, but the other current sieve tools will be migrated to doveadm in the near future as well. + Added more debug output about binary up-to-date checking. + Added script metadata to binary dump output. - Fixed Sieve script binary up-to-date checking by normalizing the script location. - The Sieve interpreter now flushes the duplicate database during start phase of result execution rather than commit phase. This makes sure locks on the duplicate database are released as soon as possible, preventing contention. - Performed a few optimizations in the lexical scanner of the language. - Fixed bug in `:matches' match-type that made a pattern without wildcards match as if there were a '*' at the beginning. - Fixed crash in validation of the string parameter of the comparator tag. - extprograms extension: Made sure supplemental group privileges are also dropped. This was a problem reported by Debian lintian. - Fixed bug in handling of binary errors for action side-effects and message overrides. - file script storage: Restructured storage initialization to address backwards compatibility issues. - dict script storage: Fixed small memory allocation bug. The release is available as follows: http://pigeonhole.dovecot.org/releases/2.2/dovecot-2.2-pigeonhole-0.4.7.rc3… http://pigeonhole.dovecot.org/releases/2.2/dovecot-2.2-pigeonhole-0.4.7.rc3… Refer to http://pigeonhole.dovecot.org and the Dovecot v2.x wiki for more information. Have fun testing this new release and don't hesitate to notify me when there are any problems. Regards, -- Stephan Bosch stephan(a)rename-it.nl

1 0

Released Pigeonhole v0.4.7.rc2 for Dovecot v2.2.16
by Stephan Bosch 16 Mar '15

16 Mar '15

Hello Dovecot users, The rc1 release showed a few problems with the up-to-date checking of on-disk binary files. The binary files contain some metadata about the script these were compiled from. If this doesn't match the current script anymore, the script is recompiled. One of these metadata items is the script location. However, this location wasn't normalized, so when the binary would be compiled with sievec it depended on the path provided at the command line. When dumping a script binary, the metadata is now printed as well. Also, I added more debug log lines about up-to-date checking. I improved backwards compatibility for the file script storage a bit relative to the last version. It now properly recognizes a regular file at the symlink path, even when the storage path itself doesn't exist. Changelog v0.4.7 (updated): * editheader extension: Made protection against addition and deletion of headers configurable separately. Also, the `Received' and `Auto-Submitted' headers are no longer protected against addition by default. * Turned message envelope address parse errors into warnings. * The interpreter now accepts non-standard domain names, e.g. containing '_'. + Implemented the Sieve index extension (RFC 5260). + Implemented support for the mboxmetadata and servermetadata extensions (RFC 5490). + Implemented new sieve commands for the doveadm command line utility. These commands are currently limited to ManageSieve operations, but the other current sieve tools will be migrated to doveadm in the near future as well. + Added more debug output about binary up-to-date checking. + Added script metadata to binary dump output. - Fixed Sieve script binary up-to-date checking by normalizing the script location. - The Sieve interpreter now flushes the duplicate database during start phase of result execution rather than commit phase. This makes sure locks on the duplicate database are released as soon as possible, preventing contention. - Performed a few optimizations in the lexical scanner of the language. - Fixed bug in `:matches' match-type that made a pattern without wildcards match as if there were a '*' at the beginning. - Fixed crash in validation of the string parameter of the comparator tag. - extprograms extension: Made sure supplemental group privileges are also dropped. This was a problem reported by Debian lintian. - Fixed bug in handling of binary errors for action side-effects and message overrides. - file script storage: Restructured storage initialization to address backwards compatibility issues. - dict script storage: Fixed small memory allocation bug. The release is available as follows: http://pigeonhole.dovecot.org/releases/2.2/dovecot-2.2-pigeonhole-0.4.7.rc2… http://pigeonhole.dovecot.org/releases/2.2/dovecot-2.2-pigeonhole-0.4.7.rc2… Refer to http://pigeonhole.dovecot.org and the Dovecot v2.x wiki for more information. Have fun testing this new release and don't hesitate to notify me when there are any problems. Regards, -- Stephan Bosch stephan(a)rename-it.nl

2 2

Warning: sieve: file storage: Active sieve script symlink is broken: Invalid/unknown path to storage
by Василий Севостьянов 16 Mar '15

16 Mar '15

dovecot version: 2.2.16 (3d8a054a93a9) sieve configuration: plugin { sieve = ~/.dovecot.sieve sieve_dir = ~/sieve } For each of the users, ~/.dovecot.sieve is a symlink to ~/sieve/roundcube.sieve Until yesterday, everything was working find. But starting from yesterday's update, the log is filling up with messages like: Mar 16 19:12:32 cs12986 dovecot: lda(postmaster(a)contoso.com <postmaster(a)euro-contact.ru>): Warning: sieve: file storage: Active sieve script symlink /home/virtualmail/contoso.com/it/.dovecot.sieve <http://euct.ru/it/.dovecot.sieve> is broken: Invalid/unknown path to storage (points to /home/virtualmail/contoso.com/it/sieve <http://euct.ru/it/sieve>). Nothing was changed in the config files. What might have gone wrong?

3 4

Configuring Shared Mailbox Dictionaries
by james＠lottspot.com 16 Mar '15

16 Mar '15

Hello, list! I am in the midst of configuring a new Dovecot IMAP server, and I'm preparing to setup shard mailboxes as part of the ocnfiguration. In order to get these setup the way I want, I've figured out that I'm going to have to setup an acl_shared_dict. This is where things start to get confusing for me, as I have had difficulty finding thorough explanations of dictionary configuration. My primary concern is that all my user details are stored in a sqlite database in which the '%n' and '%d' components of username/email addresses are stored in separate columns. The SQL dictionary example in the Shared Mailboxes document [http://wiki2.dovecot.org/SharedMailboxes/Shared] assumes that the username is stored as a singular '%n@%d' key. In my authdb lookups, I use sqlite syntax to concatenate the '%n' and '%d' columns around a '@' character to find the user. Is it possible to implement an acl_shared_dict in some similar fashion? My second question, which is completely unrelated and more out of morbid curiosity than anything (although it could affect my configuration decisions) is that I noticed every dictionary which shows up in the documentation has a "pattern" field. In the case of the acl_shared_dict example, the pattern is 'shared/shared-boxes/user/$to/$from'. I couldn't figure out by studying the example where this value was derived from, or indeed where it is derived from in any example dictionaries which are documented. Can anyone explain the meaning of the "pattern" field and what exactly its value means? Thanks in advance for all your helpful answers! :)

1 1

Problem with replication ("Fatal: -N parameter requires syncing with remote host")
by Casey Stone 16 Mar '15

16 Mar '15

Switching to official dovecot-ee version solved my sync/backup issues, also on Ubuntu. The 12.04 package works on 14.04. It's free and should update fine. Backup your config files first (dovecot and postfix if you use that)! http://shop.dovecot.fi/home/8-dovecot-ee-repository-access.html

1 0

Problem with replication ("Fatal: -N parameter requires syncing with remote host")
by Vanja 16 Mar '15

16 Mar '15

I have been fighting, for 2 days, with a Dovecot setup and I now officially need help :) Basically, I am trying to setup replication between 2 identical Dovecot servers, on different physical servers (different hostnames/etc, of course), and although I've managed to solve many problems I can't overcome the final hurdle. When a mail comes in to one of the servers, replication over TCP should kick in and mail should be replicated, but instead I get this in the mail log: ------------------------------------------------------------------------------------------------- dovecot2 dovecot: doveadm(user1(a)test1.int): Fatal: -N parameter requires syncing with remote host ------------------------------------------------------------------------------------------------- Mail is delivered to dovecot2 server, Postfix delivers it via LMTP, and everything seems to work ok. However, I can't figure out the cause for the error that I am seeing. I have looked into source code and found where this error is triggered (line 834 in doveadm/dsync/doveadm-dsync.c, inside Dovecot 2.2.9 source code), but I am afraid that I don't understand the context (ctx->run_type == DSYNC_RUN_TYPE_LOCAL) and it would take me a lot of time to debug the whole thing from the scratch. I've never looked into Dovecot internals before, so it's all a mystery to me at this point. I've tried stracing the process but the flow does not make sense to me, I can't understand what exactly happens before error is displayed. Also, there is no traffic to port 12345 on other node, so execution fails before syncing even starts (and error message is not related with remote node config/setup/etc). Triggering replication manually, from command line, works as expected: # doveadm sync -A tcp:192.168.1.100 (at this point user1's mail folder is properly updated on remote server) I've tried searching around, but it appears that noone else has this problem(or isn't complaining about it :). I am not sure if I am doing something wrong (apart from replication). I will need to support multiple virtual domains and I am basically using passwd-file for authentication, so I am using a single passwd file for all virtual domain users which allows user lookup (doveadm user '*') to work, which is required by replication. This is configuration file from dovecot2 server (which I use for testing and delivering mails): --- config start --- # 2.2.9: /etc/dovecot/dovecot.conf # OS: Linux 3.16.0-30-generic x86_64 Ubuntu 14.04.2 LTS ext4 debug_log_path = /var/log/dovecot_debug.log doveadm_password = 67890 doveadm_port = 12345 mail_debug = yes mail_location = maildir:/vmail/mail/%d/%n/Maildir mail_plugins = " notify replication" namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } passdb { args = username_format=%u /vmail/auth/passwd driver = passwd-file } plugin { mail_replica = 192.168.1.100 } protocols = imap lmtp service aggregator { fifo_listener replication-notify-fifo { user = vmail } unix_listener replication-notify { user = vmail } } service auth-worker { unix_listener auth-worker { user = dovecot-auth } } service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0660 user = postfix } user = dovecot-auth } service doveadm { inet_listener { port = 12345 } } service imap-login { inet_listener imap { port = 0 } } service lmtp { inet_listener lmtp { address = 127.0.0.1 port = 10024 } process_min_avail = 3 unix_listener /var/spool/postfix/private/dovecot-lmtp { group = postfix mode = 0660 user = postfix } user = vmail } service replicator { process_min_avail = 1 unix_listener replicator-doveadm { mode = 0666 } } ssl_cert = </etc/dovecot/dovecot.pem ssl_key = </etc/dovecot/private/dovecot.pem userdb { args = username_format=%u /vmail/auth/passwd default_fields = uid=vmail gid=vmail home=/vmail/mail/%d/%n driver = passwd-file } protocol lmtp { postmaster_address = root@localhost } --- config end --- Configuration file on other node is exactly the same, except different IP address in mail_replica statement. Any help is much appreciated. Thank you.

1 1

Re: Problem with replication ("Fatal: -N parameter requires syncing with remote host")
by Vanja 16 Mar '15

16 Mar '15

Sorry to post to the list again, but just to confirm that I am seeing same problem with 2.2.16 that I compiled from sources. Same error message appears in the log, can't figure out what in the setup makes replication break. Philipp, can you tell me which auth backend are you using? passwd-file, SQL database or something else? Would you consider posting your 'sanitized' config file here, or emailing it to me privately? Thanks. Vanja On 03/16/2015 03:23 PM, Philipp wrote: > Am 16.03.2015 09:12 schrieb Vanja: >> doveadm_port = 12345 > >> plugin { >> mail_replica = 192.168.1.100 >> } > > would you try: > mail_replica = tcp:192.168.1.100:12345 > which works for me. > > check for firewall settings (both ways) anyway - and I can only advise > to go for 2.2.16; there have been > numerous fixes after 2.2.9 to the whole dsync/replica parts.

1 0

Re: Problem with replication ("Fatal: -N parameter requires syncing with remote host")
by Vanja 16 Mar '15

16 Mar '15

Philipp, I already tried explicitly specifying port, it does not make any difference. I tried quite many 'obvious' (to put it this way) configuration changes and tried changing many things in setup, but it would be too much to list all of them in a post. Basically, I was hoping that someone would know what exactly triggers this behavior, so I could fix it. At this point in time, I would like to see whether I can make this work with 2.2.9 that comes with Ubuntu 14.04, to avoid having to compile anything from sources (for easier maintenance, later on, since I probably won't be the one maintaining this). I am also not sure whether there is a reliable (semi-official?) PPA with latest Dovecot. I saw this one ( https://launchpad.net/~mamarley/+archive/ubuntu/updates ) but I am not sure whether I can rely on it not breaking anything at some point. Thanks. On 03/16/2015 03:23 PM, Philipp wrote: > Am 16.03.2015 09:12 schrieb Vanja: >> doveadm_port = 12345 > >> plugin { >> mail_replica = 192.168.1.100 >> } > > would you try: > mail_replica = tcp:192.168.1.100:12345 > which works for me. > > check for firewall settings (both ways) anyway - and I can only advise > to go for 2.2.16; there have been > numerous fixes after 2.2.9 to the whole dsync/replica parts.

1 0

Overriding dovecot.conf from Userdb Extras
by E.B. 16 Mar '15

16 Mar '15

Hi, I thought I read that anything from dovecot.conf can be overridden in a userdb lookup. Or a passdb lookup with "userdb_" prefix. But I tried for fun change log_path but it never worked. Is that because logging is special, already started logging before it comes to the passdb/userdb lookups? So are there some dovecot.conf settings that cannot be overridden? Thanks!

3 4

Re: How to detect out-of-sync condition
by Joseph Tam 16 Mar '15

16 Mar '15

> I tried to look at a dovecot.index.log and it was unreadable in a text > editor. I didn't see anything in the wiki link about how to view the log. It's not supposed to be human readable -- the point of this exercise was to check whether your indices are really out of date. You can perhaps compare the mtime of the index files and the mailbox. If they're close or the same, then your indices are not out of sync and don't require sync'ing. > So I guess I'll just be guilty of excessive optimizing. > Should I run a daily doveadm index or resync? You've skipped over the first 3 steps (is it really out of sync, is there a better way to avoid it, does the un-sync really cause probems) and went right to a solution for a possibly non-existent problem. Be that as it may, the frequency of re-syncing is up to you. I have no idea how large your userbase is or how intensive this operation will be. If it takes only a minute, you could run it more frequently. If you're going through terabytes of data, less frequently. I'm not quite convince you need it at all: I never had to do a global re-indexing except for a one-time dovecot initializing, or dealing with the odd crash that left indices in a unfixable state (which is more a bug than an unsync problem). Joseph Tam <jtam.home(a)gmail.com>

1 0

Why is Sieve trying to re-compile global scripts?
by E.B. 16 Mar '15

16 Mar '15

I have some global scripts that were running nicely. Then I opened one in an editor and (probably, but not 100% sure) mindlessly saved the file, even though I hadn't made any changes. Shortly after, Sieve errors started showing in the log: Error: 4k5JA74R/1TlIwABG/SpMA: sieve: binary save: failed to create temporary file: open(/usr/local/var/dovecot/sieve/script2.svbin.example.com.4139.) failed: Permission denied... Error: 4k5JA74R/1TlIwABG/SpMA: sieve: The LDA Sieve plugin does not have permission to save global Sieve script binaries; global Sieve scripts like `/usr/local/var/dovecot/sieve/script2.sieve' need to be pre-compiled using the sievec tool Well, OK, is it going by the timestamp on the files? Fine. I recompiled it by hand. Yet, I STILL got these errors! I triple and quadruple checked that the timestamp on the svbin files was more recent. And Sieve was only complaining about one of the two scripts in the directory. I restarted dovecot. No change. So I removed read permission on the .sieve files and only left read permission on the .svbin files. THIS WORKED. No more error. I can live with that, but why was it not complaining before, why was it only complaining about one of my scripts and why would it complain at all when the timestamps on the svbin should have indicated on compilation is needed?

3 14

sieve script not applied
by Joan Aymà 15 Mar '15

15 Mar '15

Hi everyone, I installed all-new server postfix+amavis+dovecot and pigeonhole. Clients, thunderbird and roundcube creates sieve scripts ok and changed ones are seen by eatch other, so server at 4190 accepts the scripts and ensure they are created. But filters onto new mail isn't applied. Example: # rule:[guifinet] if header :contains :comparator "i;octet" "subject" "[guifi-" { fileinto "INBOX.guifinet"; } Isn't the rule correct? Didn't find any troubleshooting on this topic. Any ideas? Thanks.

1 0

Re: How to detect out-of-sync condition
by Joseph Tam 14 Mar '15

14 Mar '15

On Fri, 13 Mar 2015, Cliff Hayes writes: >> By closing off other avenues other than dovecot imap/pop/lda/etc., >> the indices will stay sync'd. > > I use dovecot's lda and dovecot's sieve filter. Then I'm not sure how mailboxes ever get out of sync. > So it looks like I need to compare the index/mailbox mtimes as you suggest. > > What am I looking for? > I see that the indexes are updated when I run the resync. > > I checked my mailbox (that was not resynced) and noticed that > dovecot.index last update was 16 days ago. Just to be clear, you're talking "doveadm index ...", yes? You might have to check dovecot.index.log* as well as they could contain the latest changes that have yet to propagate to the main index file. http://wiki2.dovecot.org/Design/Indexes/TransactionLog > So am I resyncing if the gap is over x days? > If so, is there a way to resync just those mailboxes with a doveadm > command or do I have to write a program look for that condition and run > doveadm when matched? It's possible that "doveadm index" checks modification times as an optimization measure. My recommended game plan: 1) Are your indices *really* out of date (checks logs as Steffen recommends)? 2) If so, how do they get out of date and can you avoid it? 3) If you can't avoid it, does it cause real problems? Most of the time, dovecot will seemlessly rebuild it and it's transparent to the user. 4) If you got this far, run a trial "doveadm index -A INBOX" (assuming you're just concerned about INBOXs) to see if it's really such a bad operation. As Knuth (hallowed be thy name!) said, "premature optimization is the root of all evil." Only after all these steps are found to be unsatisfactory would I consider writing your own scan and fix tool. Joseph Tam <jtam.home(a)gmail.com>

2 1

Re: How to detect out-of-sync condition
by Joseph Tam 14 Mar '15

14 Mar '15

Cliff Hayes writes: > I didn't see anything but the log is huge and I could have easily missed > it. > Is there a certain error or phrase I should look for? > If so please advise. In my setup using mbox, typical log entries would be like (Common) Warning: UIDVALIDITY changed ({int} -> {int}) in mbox file ... Error: Next message unexpectedly corrupted in mbox file ... (Rare) Error: Corrupted index cache file {cache-file}: Broken physical size for mail UID ... Error: read({file}) failed: Next message unexpectedly lost from mbox file ... Error: read({file}) failed: Cached message size larger than expected ... Joseph Tam <jtam.home(a)gmail.com>

1 0

JMAP support
by List 13 Mar '15

13 Mar '15

Just found http://jmap.io/ which is a JSON based RPC protocol for synchronizing messages/contacts/calendars. Any plans to support this protocol in Dovecot?

1 0

How to detect out-of-sync condition
by Cliff Hayes 13 Mar '15

13 Mar '15

Hello list, I recently had a user whose mailbox had gone out of sync. Webmail and client inbox totals had become vastly different and response times had become unacceptable. A doveadm force-resync fixed the problem nicely. This will no doubt happen again as we grow the service and I would like to have some type of indication at the server level so I can run a resync on a per-user basis as required. However, I don't know what to look for. I did not see any signs of the problem on the server - but perhaps I did not know what to look for. The only other alternative is for me to do a global resync in the cron.daily but my fear is that this won't scale well for thousands of users. Please advise. Thanks in advance.

3 6

Different realm for different listeners?
by Chris Adams 13 Mar '15

13 Mar '15

I see this has been asked a few times over the years (but not in several years), and the response was along the lines of "maybe someday", so I figured I'd see if someday was here yet... I have a need to have a different default realm for different listeners. Basically, I've a bunch of different domains, and a few of them insist their users not be required to authenticate with "user@domain" and just use "user", and I'm trying to make this work without separate daemons and/or VMs. I'll be using Dovecot 2.2 (most likely 2.2.10 as provided by RHEL/CentOS 7). Thanks. If there's not a way to do this directly in Dovecot, does anybody have any suggestion that doesn't require several different VMs? -- Chris Adams <cma(a)cmadams.net>

3 4

Active directory bind and quota stuff
by Fran 13 Mar '15

13 Mar '15

Hi list, first of all, please excuse me for any grammar mistake on my text, I'm still learning english. I'm making a Dovecot installation using my Active Directory like pass and user DB. I'm setting the per-user quota from an AD field (Initials) and everything seems to work fine, but I would like to know if you could help me to improve a couple of things. --------------------------------------------------------------------------- --------------------------------------------------------------------------- I'm using CentOS 7, this is my Dovecot build: --------------------------------------------------------------------------- # dovecot --build-options Build options: ioloop=epoll notify=inotify ipv6 openssl io_block_size=8192 Mail storages: shared mdbox sdbox maildir mbox cydir imapc pop3c raw fail SQL driver plugins: mysql postgresql sqlite Passdb: checkpassword ldap pam passwd passwd-file shadow sql Userdb: checkpassword ldap(plugin) nss passwd prefetch passwd-file sql # dovecot --version 2.2.10 And this is my /etc/dovecot/dovecot-ldap.conf.ext file: --------------------------------------------------------------------------- hosts = adserver1.dom, adserver2.dom base = DC=dom ldap_version = 3 auth_bind = yes auth_bind_userdn = dom\%u dn = cn=imapUser,cn=Users,dc=dom dnpass = ******** user_filter = (&(samaccountname=%u)(objectClass=person)(|(mail=%u@dom.com)(othermailbox=%u@dom.com))) pass_filter = (&(samaccountname=%u)(objectClass=person)(|(mail=%u@dom.com)(othermailbox=%u@dom.com))) pass_attrs = userPassword=password user_attrs = Initials=quota_rule=*:storage=%$MB --------------------------------------------------------------------------- --------------------------------------------------------------------------- My questions: 1) My AD doesn't allow anonymous searches and I was thinking in a way to avoid the need of have a specific user account with his password stored in a configuration file to do the bind. And I don't know if this is posible, but, does it exist a way to use the same user you are trying to validate to do bind with the AD server? 2) As you can see (user_attrs = Initials=quota_rule=*:storage=%$MB), to set the per-user quota value, I require a numeric value in "Initials" field of my AD. I've realized that if some wrong value is introduced in that field, Dovecot throws an error when you try to validate the user, and hence, imap logon fails. Does it exist any way to bypass that and to use the default quota value if something is wrong with the per-user quota set? Error log with wrong quota values (I wrote the value e34 in the Initials field of user1 in AD, instead of a valid numeric value): * quota refresh command: [root@dmail02 dovecot]# doveadm quota recalc -u user1 doveadm(user1): Error: user user1: Initialization failed: Failed to initialize quota: Invalid quota root quota: Invalid rule *:storage=e34MB: Invalid rule limit value 'storage=e34MB': Unknown unit: e34MB * imap login: Mar 13 14:12:10 dmail02 dovecot: imap(user1): Error: user user1: Initialization failed: Failed to initialize quota: Invalid quota root quota: Invalid rule *:storage=e34MB: Invalid rule limit value 'storage=e34MB': Unknown unit: e34MB Mar 13 14:12:10 dmail02 dovecot: imap(user1): Error: Invalid user settings. Refer to server log for more information. Thank you very much in advance, Fran

1 0

Dovecot fails to compile --with-cdb (and attempted fix)
by Jeffrey 'jf' Lim 13 Mar '15

13 Mar '15

Dovecot version: 2.2.15 Tinycdb: 0.78 I'm attempting to compile dovecot --with-cdb, but keep getting into a problem with cdb: ======================== libtool: link: gcc -std=gnu99 -g -O2 -Wall -W -Wmissing-prototypes -Wmissing-declarations -Wpointer-arith -Wchar-subscripts -Wformat=2 -Wbad-function-cast -fno-builtin-strftime -Wstrict-aliasing=2 -Wl,--as-needed -o .libs/anvil main.o anvil-connection.o anvil-settings.o connect-limit.o penalty.o -Wl,--export-dynamic ../../src/lib-dovecot/.libs/libdovecot.so -ldl -lrt -Wl,-rpath -Wl,/usr/local/lib/dovecot ../../src/lib-dovecot/.libs/libdovecot.so: undefined reference to `cdb_read' ../../src/lib-dovecot/.libs/libdovecot.so: undefined reference to `cdb_find' ../../src/lib-dovecot/.libs/libdovecot.so: undefined reference to `cdb_free' ../../src/lib-dovecot/.libs/libdovecot.so: undefined reference to `cdb_init' collect2: ld returned 1 exit status make[3]: *** [anvil] Error 1 make[3]: Leaving directory `/home/jf/dovecot-2.2.15/src/anvil' ========================== After some troubleshooting, I've finally managed to get dovecot to compile, albeit with a hack: --- src/lib-dovecot/Makefile.old 2015-03-09 17:36:15.690179802 +0000 +++ src/lib-dovecot/Makefile 2015-03-09 18:01:43.075719700 +0000 @@ -230,7 +230,7 @@ LIBDOVECOT_STORAGE_DEPS = $(top_builddir)/src/lib-storage/ libdovecot-storage.la $(top_builddir)/src/lib-imap-storage/ libimap-storage.la LIBICONV = LIBOBJS = -LIBS = -lrt +LIBS = -lrt -lcdb LIBTOOL = $(SHELL) $(top_builddir)/libtool LIBWRAP_LIBS = LINKED_STORAGE_LDADD = This isn't the best fix, admittedly (I wish I were more familiar with autotools), but I'll say that the configure process isn't right yet for cdb. Can anybody produce a better fix? Would love to learn more. thanks, -jf -- He who settles on the idea of the intelligent man as a static entity only shows himself to be a fool. Mensan / Full-Stack Technical Polymath / System Administrator 12 years over the entire web stack: Performance, Sysadmin, Ruby and Frontend

2 6

doveadm sync subscribed folders only
by Jernej Porenta 13 Mar '15

13 Mar '15

Heya, is there a simple way to use "doveadm sync" for subscribed folders only? Since the migration from UW-IMAP, our users can actually subscribe to non-mbox files and now, when we are pushing new servers out, we are migrating our mboxes to dbox format and we would like to migrate only subscribed folders. I know, there is a -m switch which can be used to transfer subscribed folders for each user, but it makes it quite unusable with escaping and all other problems with such volume, so just wondering if there is a simple way to migrate subscribed folders only. Thank you in advance, cheers, Jernej

1 0

Re: How to detect out-of-sync condition
by Cliff Hayes 13 Mar '15

13 Mar '15

Thanks. I use dovecot's lda and dovecot's sieve filter. So it looks like I need to compare the index/mailbox mtimes as you suggest. What am I looking for? I see that the indexes are updated when I run the resync. I checked my mailbox (that was not resynced) and noticed that dovecot.index last update was 16 days ago. So am I resyncing if the gap is over x days? If so, is there a way to resync just those mailboxes with a doveadm command or do I have to write a program look for that condition and run doveadm when matched? Cliff Hayes <chayes(a)afo.net> writes: > I recently had a user whose mailbox had gone out of sync. > Webmail and client inbox totals had become vastly different and response > times had become unacceptable. > A doveadm force-resync fixed the problem nicely. > > This will no doubt happen again as we grow the service and I would like to have some type of indication at the server level so I can run a resync on a per-user basis as required. Perhaps what you ought to look for is how are they getting out of sync in the first place. Assuming your webmail is a IMAP/POP client, I would look at ways that your user's INBOX can be modified out of Dovecot's sight. For example, does your LDA use dovecot's lda/lmtp, or do your users run mail clients that directly manipulate mailbox files, or do you use procmail/mail filters? By closing off other avenues other than dovecot imap/pop/lda/etc., the indices will stay sync'd. If you really have to do manual resyncing, comparing index/mailbox mtimes might be one way to do it. Joseph Tam <jtam.home(a)gmail.com>

1 0

Re: How to detect out-of-sync condition
by Joseph Tam 13 Mar '15

13 Mar '15

Cliff Hayes <chayes(a)afo.net> writes: > I recently had a user whose mailbox had gone out of sync. > Webmail and client inbox totals had become vastly different and response > times had become unacceptable. > A doveadm force-resync fixed the problem nicely. > > This will no doubt happen again as we grow the service and I would like > to have some type of indication at the server level so I can run a > resync on a per-user basis as required. Perhaps what you ought to look for is how are they getting out of sync in the first place. Assuming your webmail is a IMAP/POP client, I would look at ways that your user's INBOX can be modified out of Dovecot's sight. For example, does your LDA use dovecot's lda/lmtp, or do your users run mail clients that directly manipulate mailbox files, or do you use procmail/mail filters? By closing off other avenues other than dovecot imap/pop/lda/etc., the indices will stay sync'd. If you really have to do manual resyncing, comparing index/mailbox mtimes might be one way to do it. Joseph Tam <jtam.home(a)gmail.com>

1 0

doveconf -a Segmentation Fault
by Dan LaSota 13 Mar '15

13 Mar '15

Getting "Segmentation Fault" When I run doveconf -a Dan LaSota Instructional Designer, UAF eLearning (907) 451-4067 dan.lasota(a)alaska.edu http://elearning.uaf.edu

3 3

looks like a repeat of this problem
by Laeeth Isharc 12 Mar '15

12 Mar '15

http://permalink.gmane.org/gmane.mail.imap.dovecot/80062

1 0

location of dovecot.rawlog-directory
by Hardy Flor 12 Mar '15

12 Mar '15

How is it possible to have the dovecot.rawlog-directory outside the mail_location? A link to another directory is not because it is checked in rawlog.c S_ISDIR to directory.

3 4

rawlog with -i not worked
by Hardy Flor 12 Mar '15

12 Mar '15

Hello, I have the rawlog enabled according to the manual:http://wiki2.dovecot.org/Debugging/Rawlog Without -i everything is wonderful, a coredump is with the -i parameter created **************************************** service imap-postlogin { executable = script-login -d rawlog -i user = vmail } **************************************** GNU gdb (GDB) 7.4.1-debian Copyright (C) 2012 Free Software Foundation, Inc. License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html> This is free software: you are free to change and redistribute it. There is NO WARRANTY, to the extent permitted by law. Type "show copying" and "show warranty" for details. This GDB was configured as "x86_64-linux-gnu". For bug reporting instructions, please see: <http://www.gnu.org/software/gdb/bugs/>... Reading symbols from /usr/lib/dovecot/rawlog...(no debugging symbols found)...done. [New LWP 29312] warning: Can't read pathname for load map: Eingabe-/Ausgabefehler. [Thread debugging using libthread_db enabled] Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1". Core was generated by `/usr/lib/dovecot/rawlog -i /usr/lib/dovecot/script-login'. Program terminated with signal 11, Segmentation fault. #0 0x00007f66bd2fe6c7 in master_instance_list_find_by_name () from /usr/lib/dovecot/libdovecot.so.0 (gdb) bt full #0 0x00007f66bd2fe6c7 in master_instance_list_find_by_name () from /usr/lib/dovecot/libdovecot.so.0 No symbol table info available. #1 0x00007f66bd300ea5 in master_service_parse_option () from /usr/lib/dovecot/libdovecot.so.0 No symbol table info available. #2 0x00007f66bd300fd4 in master_getopt () from /usr/lib/dovecot/libdovecot.so.0 No symbol table info available. #3 0x0000000000401e15 in main () No symbol table info available. (gdb)

3 4

v2.2.16 release candidate released
by Timo Sirainen 12 Mar '15

12 Mar '15

http://dovecot.org/releases/2.2/rc/dovecot-2.2.16.rc1.tar.gz http://dovecot.org/releases/2.2/rc/dovecot-2.2.16.rc1.tar.gz.sig Looks like it's been a long time since v2.2.15. There have been a ton of changes since it was released though, so here's a release candidate first to find out if somebody can find any bugs before the final v2.2.16. Unfortunately I haven't had time/energy to read Dovecot mailing list for a while now. I'm hoping this will change, but I don't really expect it to happen anytime soon. On the positive side for Dovecot, it's now becoming used in more and more multi-million user installations, which brings all kinds of nice new improvements. The largest changes since v2.2.15: * dbox: Resyncing (e.g. doveadm force-resync) no longer deletes dovecot.index.cache file. The cache file was rarely the problem so this just caused unnecessary slowness. * Mailbox name limits changed during mailbox creation: Each part of a hierarchical name (e.g. "x" or "y" in "x/y") can now be up to 255 chars long (instead of 200). This also reduces the max number of hierarchical levels to 16 (instead of 20) to keep the maximum name length 4096 (a common PATH_MAX limit). The 255 char limit is hopefully large enough for migrations from all existing systems. It's also the limit on many filesystems. + director: Added director_consistent_hashing setting to enable consistent hashing (instead of the mostly-random MD5 hashing). This causes fewer user moves between backends when backend counts are changed, which may improve performance (mainly due to caching). + director: Added support for "tags", which allows one director ring to serve multiple backend clusters with different sets of users. + LMTP server: Added lmtp_user_concurrency_limit setting to limit how many LMTP deliveries can be done concurrently for a single user. + LMTP server: Added support for STARTTLS command. + If logging data is generated faster than it can be written, log a warning about it and show information about it in log process's process title in ps output. Also don't allow a single service to flood too long at the cost of delaying other services' logging. + stats: Added support for getting global statistics. + stats: Use the same session IDs as the rest of Dovecot. + stats: Plugins can now create their own statistics fields + doveadm server: Non-mail related commands can now also be used via doveadm server (TCP socket). + doveadm proxying: passdb lookup can now override doveadm_port and change the username. + doveadm: Search query supports now "oldestonly" parameter to stop immediately on the first non-match. This can be used to optimize: doveadm expunge mailbox Trash savedbefore 30d oldestonly + doveadm: Added "save" command to directly save mails to specified mailbox (bypassing Sieve). + doveadm fetch: Added body.snippet field, which returns the first 100 chars of a message without whitespace or HTML tags. The result is stored into dovecot.index.cache, so it can be fetched efficiently. + dsync: Added -t <timestamp> parameter to sync only mails newer than the given received-timestamp. + dsync: Added -F [-]<flag> parameter to sync only mails with[out] the given flag/keyword. + dsync: Added -a <mailbox> parameter to specify the virtual mailbox containing user's all mails. If this mailbox is already found to contain the wanted mail (by its GUID), the message is copied from there instead of being re-saved. (This isn't efficient enough yet for incremental replication.) + dsync: -m parameter can now specify \Special-use names for mailboxes. + imapc: Added imapc_features=gmail-migration to help migrations from GMail. See http://wiki2.dovecot.org/Migration/Gmail + imapc: Added imapc_features=search to support IMAP SEARCH command. (Currently requires ESEARCH support from remote server.) + expire plugin: Added expire_cache=yes setting to cache most of the database lookups in dovecot index files. + quota: If overquota-flag in userdb doesn't match the current quota usage, execute a configured script. + redis dict: Added support for expiring keys (:expire_secs=n) and specifying the database number (:db=n) - auth: Don't crash if master user login is attempted without any configured master=yes passdbs - Parsing UTF-8 text for mails could have caused broken results sometimes if buffering was split in the middle of a UTF-8 character. This affected at least searching messages. - String sanitization for some logged output wasn't done properly: UTF-8 text could have been truncated wrongly or the truncation may not have happened at all. - fts-lucene: Lookups from virtual mailbox consisting of over 32 physical mailboxes could have caused crashes.

4 7

Released Pigeonhole v0.4.7.rc1 for Dovecot v2.2.16.rc1
by Stephan Bosch 12 Mar '15

12 Mar '15

Hello Dovecot users, Last time I had a few stupid problems in the releases, so I'll follow Timo's example and I release an RC first. The highlights include the implementation of the index and metadata extensions. Quite a few bugs are fixed as well. Changelog v0.4.7: * editheader extension: Made protection against addition and deletion of headers configurable separately. Also, the `Received' and `Auto-Submitted' headers are no longer protected against addition by default. * Turned message envelope address parse errors into warnings. * The interpreter now accepts non-standard domain names, e.g. containing '_'. + Implemented the Sieve index extension (RFC 5260). + Implemented support for the mboxmetadata and servermetadata extensions (RFC 5490). + Implemented new sieve commands for the doveadm command line utility. These commands are currently limited to ManageSieve operations, but the other current sieve tools will be migrated to doveadm in the near future as well. + Added more debug output to binary up-to-date checking. - The Sieve interpreter now flushes duplicate database during start phase of result execution rather than commit phase. This makes sure locks on the duplicate database are released as soon as possible, preventing contention. - Performed a few optimizations in the lexical scanner of the language. - Fixed bug in `:matches' match-type that made a pattern without wildcards match as if there were a '*' at the beginning. - file storage: Restructured storage initialization to address backwards compatibility issues. - Fixed crash in validation of the string parameter of the comparator tag. - extprograms extension: Made sure supplemental group privileges are also dropped. This was a problem reported by Debian lintian. - Fixed bug in handling of binary errors for action side-effects and message overrides. The release is available as follows: http://pigeonhole.dovecot.org/releases/2.2/dovecot-2.2-pigeonhole-0.4.7.rc1… http://pigeonhole.dovecot.org/releases/2.2/dovecot-2.2-pigeonhole-0.4.7.rc1… Refer to http://pigeonhole.dovecot.org and the Dovecot v2.x wiki for more information. Have fun testing this new release and don't hesitate to notify me when there are any problems. Regards, -- Stephan Bosch stephan(a)rename-it.nl

5 12

Expunge (?)
by Muzaffer Tolga Ozses 12 Mar '15

12 Mar '15

Hi, I don't know if this is the correct term. Let me elaborate. From time to time, I want to expunge (?) the mail folder so that users' Trash'd mails don't occupy space. So, here are my questions: 1. Is this the correct term? 2. Is it a Good Idea™ to do it? Thanks, -- mto

2 2

Sieve security: Any way to protect credentials used in extprograms?
by E.B. 11 Mar '15

11 Mar '15

I need to connect to a database in a script called using Sieve extprograms plugin. When delivering mail, Sieve is running as the mail recipient user, which means any files, either the sieve script or the extprograms it invokes, are run under that user's permissions. What would be a way to hide the database credentials in a more restricted file? I can think of... * Store the credentials in the database itself, return them from a DICT lookup that is fed to the sieve script. The credentials would have to be duplicated for every user record in the database. * Somehow put the value in the Sieve environment, but I'm not sure how to get a value into the environment (just return it in a userdb lookup?) and then how to get at that value once I'm executing the sieve script (can I retrieve it with the "environment" extension?) Are there better ways? [Of course, if I could do more elaborate things like call a stored procedure from Dovecot DICT then I could avoid this situation]

2 1

Sieve reject with ORIG-TO vs TO
by E.B. 11 Mar '15

11 Mar '15

Hi, The bounce message generated by the reject extension has what looks like a hard coded message prefix that comes before the configurable reason text: "Your message to <username> was automatically rejected:" In some cases, the <username> is NOT the original-to address, which can cause confusion to the sender or expose private aliasing data that some people might want to hide. Is there a way to make the reject extension use the original-to address in that hard-coded message prefix? Is there a way to completely customize the FULL message? Is there a way to customize the headers for such messages?

2 1

FTS search with CLucene giving odd results/exposing config issue
by David Gessel 11 Mar '15

11 Mar '15

I recently got FTS search with Clucene working on FreeBSD 10.1 (I had some trouble with 9.3, postponed solving it, then restarted with 10.1 by manually installing libtextcat, a listed dependency on http://wiki2.dovecot.org/Plugins/FTS/Lucene, but not part of the FreeBSD makefile: maybe that helped, maybe it was irrelevant). However, I now get some anomalous results. I'm putting them together as they may be related. Or, maybe not. 1) Searching from Thunderbird returns 35x as many results for the same term as searching from the command line. I'm not sure if the indexes are created or enumerable. 2) There seems to be a glitch in the maildir naming structure that results in a double slash (//) which doesn't seem to impact IMAP serving or Sieve, but maybe is causing the problem above with Clucene. Any hints? If I run a search from Thunderbird and "run search on server" for a somewhat infrequently used term like "titanium," I get results in more or less every archive folder one by one over about 20 minutes of searching and get about 516 results. It seems to run a little faster without the "run search on server" checkbox selected, but Thunderbird on Windows is abandonware and the only useful datapoint is 516 results. Maybe it is time for Claws. Anyway, if I run: # doveadm search -u user(a)domain.com mailbox '*' body titanium doveadm(user(a)domain.com): Error: stat(/mail/domain.com/user//.dovecot.sieve/tmp) failed: Not a directory doveadm(user(a)domain.com): Error: Syncing mailbox dovecot.sieve failed: Internal error occurred. Refer to server log for more information. [2015-03-11 09:11:16] bcadc922ba26b953a25701002812f29a 812478 bcadc922ba26b953a25701002812f29a 9338037 bcadc922ba26b953a25701002812f29a 9342918 bcadc922ba26b953a25701002812f29a 9343205 bcadc922ba26b953a25701002812f29a 9346096 bcadc922ba26b953a25701002812f29a 9350977 bcadc922ba26b953a25701002812f29a 9351379 bcadc922ba26b953a25701002812f29a 9352318 bcadc922ba26b953a25701002812f29a 9352441 bcadc922ba26b953a25701002812f29a 9352501 3d5d982e3a89b853c12c01002812f29a 1901940 3d5d982e3a89b853c12c01002812f29a 1908073 3d5d982e3a89b853c12c01002812f29a 1941453 3d5d982e3a89b853c12c01002812f29a 2036962 3d5d982e3a89b853c12c01002812f29a 2038360 I get 15 results. # doveadm fetch -u user(a)domain.com "mailbox" mailbox-guid 3d5d982e3a89b853c12c01002812f29a uid 1908073 mailbox: INBOX All are from the inbox. This takes roughly 30 seconds (much faster, that's good, though still not super fast) and in the logs I see promising messages like: Mar 11 09:27:52 host dovecot: indexer-worker(user(a)domain.com): Indexed 3708 messages in Commerce but also slightly less promising messages like: Mar 11 09:27:52 host dovecot: indexer-worker(user(a)domain.com): Warning: Maildir /mail/domain.com/user//.Bulkmail: Expunged message reappeared, giving a new UID (old uid=9335155, file=1426089637.M350915P91305.host,S=23845,W=24282:2,) If I execute # doveadm index -A '*' I get doveadm(user(a)domain.com): Error: stat(/mail/domain.com/user//.dovecot.sieve/tmp) failed: Not a directory doveadm(user(a)domain.com): Error: Syncing mailbox dovecot.sieve failed: Internal error occurred. Refer to server log for more information. [2015-03-11 09:51:26] (there's nothing in the server log) But note in both previous results a double slash (//) in the directory structure. I don't think that's right. So: Does # doveadm search search subfolders? The internets say either '*' or INBOX should search the hierarchy and the search command does set off indexing operations on every subfolder as indicated by the logs, but the results are only from the top level folder.... perhaps that is related to... Why do some errors report a double slash (//) in directory names? I don't seem to be having any other symptoms (if, indeed, this is one) of incompatibilities. My sieve filters work just fine and are accessible from the managesieve plugin in Thunderbird. My config file is below: # 2.2.15: /usr/local/etc/dovecot/dovecot.conf # Pigeonhole version 0.4.6 (3e924b1b6c5c+) # OS: FreeBSD 10.1-RELEASE amd64 auth_default_realm = domain.com auth_mechanisms = plain login auth_realms = domain.com domain2.org disable_plaintext_auth = no first_valid_gid = 5000 first_valid_uid = 5000 hostname = domain.com imap_idle_notify_interval = 29 mins last_valid_gid = 5000 last_valid_uid = 5000 lda_mailbox_autocreate = yes listen = * mail_gid = 5000 mail_location = maildir:~:CONTROL=/var/no-quota/%u mail_plugins = quota mail_log notify fts fts_lucene mail_temp_dir = /var/tmp mail_uid = 5000 maildir_broken_filename_sizes = yes managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date ihave duplicate spamtest spamtestplus editheader mbox_lazy_writes = no namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } passdb { args = /usr/local/etc/dovecot/dovecot-sql.conf.ext driver = sql } plugin { expire = Trash fts = lucene fts_autoindex = yes fts_lucene = whitespace_chars=@. mime_parts mail_log_events = delete undelete expunge copy mailbox_delete mailbox_rename mail_log_fields = uid box msgid size quota = maildir:User quota quota_exceeded_message = Storage quota for this account has been exceeded, please try again later. quota_rule = *:storage=50G quota_rule2 = Trash:storage=+30%% quota_rule3 = Sent:storage=+30%% quota_warning = storage=90%% quota-warning 90 %u quota_warning2 = storage=75%% quota-warning 75 %u sieve = ~/.dovecot.sieve sieve_before = /usr/local/etc/dovecot/sieve/ sieve_dir = ~/sieve sieve_extensions = +spamtest +spamtestplus +relational +comparator-i;ascii-numeric +editheader sieve_global_dir = /usr/local/etc/dovecot/sieve } postmaster_address = user(a)domain.com protocols = imap lmtp sieve sieve sendmail_path = /usr/local/sbin/sendmail service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0666 user = postfix } unix_listener auth-userdb { group = vmail mode = 0600 user = vmail } } service managesieve-login { inet_listener sieve { port = 4190 } service_count = 1 vsz_limit = 128 M } service quota-warning { executable = script /usr/local/bin/quota-warning.sh unix_listener quota-warning { user = vmail } user = vmail } ssl = required ssl_cert = </usr/local/etc/ca/host-cert.pem ssl_key = </usr/local/etc/ca/host-unencrypted-key.pem ssl_prefer_server_ciphers = yes userdb { driver = prefetch } userdb { args = /usr/local/etc/dovecot/dovecot-sql.conf.ext driver = sql } protocol lda { mail_plugins = quota mail_log notify fts fts_lucene sieve } protocol imap { mail_max_userip_connections = 20 mail_plugins = quota mail_log notify fts fts_lucene imap_quota imap_zlib } protocol lmtp { mail_plugins = quota mail_log notify fts fts_lucene sieve } (END)

1 0

libdriver_msql.so
by kaniggl 11 Mar '15

11 Mar '15

Hello, i installed dovecot 2.11.1 on ubuntu Linux dadd3041 3.16.0-30-generic #40-Ubuntu SMP Mon Jan 12 22:07:11 UTC 2015 ppc64le ppc64le ppc64le GNU/Linux To make it clear, architecture is PowerPC 64bit Then i installed dovecot via apt-get. But the file /usr/lib/dovecot/modules/auth/libdriver_mysql.so is missing. So i compiled dovecot myself on this system and got a file /usr/lib/dovecot/modules/auth/libdriver_mysql.so Then i restartetd the server and try to do a login via a webmailer (roundcube), but i get no connection to the database server. This is found in /var/log/mail.log Mar 11 15:19:04 dadd3041 dovecot: master: Dovecot v2.2.9 starting up (core dumps disabled) Mar 11 15:19:04 dadd3041 postfix/master[3367]: reload -- version 2.11.1, configuration /etc/postfix Mar 11 15:19:04 dadd3041 postfix/master[3367]: terminating on signal 15 Mar 11 15:19:04 dadd3041 postfix/master[3597]: daemon started -- version 2.11.1, configuration /etc/postfix Mar 11 15:19:25 dadd3041 dovecot: auth: Error: dlopen(/usr/lib/dovecot/modules/auth/libdriver_mysql.so) failed: /usr/lib/dovecot/modules/auth/libdriver_mysql.so: wrong ELF class: ELFCLASS32 Mar 11 15:19:25 dadd3041 dovecot: auth: Fatal: Unknown database driver 'mysql' Mar 11 15:19:25 dadd3041 dovecot: master: Error: service(auth): command startup failed, throttling for 2 secs Mar 11 15:19:25 dadd3041 dovecot: imap-login: Disconnected: Auth process broken (disconnected before auth was ready, waited 0 secs): user=<>, rip=::1, lip=::1, TLS handshaking, session=<rJpS9AMR9wAAAAAAAAAAAAAAAAAAAAAB> I know this means it is not a 64bit object but how could i achieve to get right one? best regards, kaniggl

3 4

dec2str ...
by Hardy Flor 11 Mar '15

11 Mar '15

a very stupid question: What reason is there for an output with printf until dec2str to convert the numeric value to a string and not to use the format identifier "%d" or "u%"?

2 1

full text index "per user"?
by Ralf Hildebrandt 11 Mar '15

11 Mar '15

Is there any way of disabling the creation of a full text index on a per user basis? -- [*] sys4 AG http://sys4.de, +49 (89) 30 90 46 64 Franziskanerstraße 15, 81669 München Sitz der Gesellschaft: München, Amtsgericht München: HRB 199263 Vorstand: Patrick Ben Koetter, Marc Schiffbauer Aufsichtsratsvorsitzender: Florian Kirstein

1 1

Deduplicate Public Folder
by Bobber 11 Mar '15

11 Mar '15

How do you perform the doveadm deduplicate command on public folders? If I specify a user, nothing is found. Using -A also doesn't seem to work. -- *Bob Wooldridge* Blog: http://kc0dxf.net/blog/

2 1

Sieve extprograms socket vs. direct execution
by E.B. 11 Mar '15

11 Mar '15

Hi, I'm hoping to get some clarification of the differences between calling a script using the Sieve extprograms plugin execute method via direct execution or using the socket feature. Being naive, I see the socket option and think that way you tell Dovecot to spawn a daemon and I think that's going to be far superior in performance. But if that really was the difference, why would direct execution even be an option? (And doesn't the daemon still have to spawn a new shell every time if the target is a shell script? Does that defeat the purpose of having a daemon?) So I don't really know what the difference is, and under what circumstances you'd want to use one or the other. Can someone please help clarify?

1 0

Extending dict lookups (SQL)?
by E.B. 11 Mar '15

11 Mar '15

Hi, How difficult would it be to try to hack some extension to the Dovecot dict mechanism for someone unfamiliar with the code? I'm using SQL as a backend and am looking for, at a minimum, the ability to specify a WHERE clause in addition to the built-in one that feeds the current username. The field name to test the additional value against would be necessary as well of course. Naturally, full query customization would be great to have. Perhaps providing a mechanism for the caller to pass data for the extra WHERE clause is the hardest part, not sure... but it can't hurt to ask. Don't take this as lack of gratitude - I can work with what's there and greatly appreciate it.

1 0

Re: Outlook 2013/2010 nightmare #2
by Joseph Tam 11 Mar '15

11 Mar '15

"David.M.Clark" <david(a)davrom.com> writes: > So the bottom line for this particular site is: > > Set the "Root Folder" for IMAP in outlook to "mail". This is messy from > my beloved Linux command line perspective in that you end up with > ${HOME}/login_name/mail/mail. But it does work and stops the Outlook > crashes. If "root folder" is Outlook's parlance for IMAP prefix, you might find it helpful to configure a namespace alias. For examples, see http://wiki2.dovecot.org/Namespaces (Section Backwards Compatibility: UW-IMAP) It will map different npamespaces to the same folder so you don't have this mail/mail/ goofiness. > If you want to share a single e-mail account across multiple PCs running > Outlook 2013, you _cannot_ use the "Root Folder" of "mail" as I have > indicated above. The workaround is to create each subsequent PC with a > "mail2", "mail3" etc folder (without the quote marks of course). If you > set up two PCs with the same Root Folder, the new PC crashes out of > Outlook and eventually so does the original PC. The only way around this > is to delete the identity and PST files in Outlook and strictly set them > up again to different "mail" something folders. Almost reminds me of the > old MS "Share Violation" issue :-) > > So after the user is set to the mail2/mail3 folder and it appears under > the user's original "mail" folder, you then have to blow away the > mail2/mail3 folder and then do a symbolic link to the mail folder: > > ln -s mail mail2 Again, namespace aliases might help: you can configure as many as you like. It's a kludge though -- the behaviour you report is really bizarre. Joseph Tam <jtam.home(a)gmail.com>

1 0

Migrating from NetApp to ZFS
by Frido Otten 10 Mar '15

10 Mar '15

Hi All, We're currently in the process of migrating from a NetApp storage to a ZFS storage, both shared over NFS. We've ran into some problems which were solved by switching to dotlocks instead of flock. But now there's one problem left with the dotlock method. When connecting to Dovecot/IMAP, and moving messages from one folder to another, it is very slow and I'm suspecting this has all to do with the dotlock method. During this process of moving mail, the dotlock file is created and stays there for about 90 seconds. The mail client is unresponsive in this time period. This happens also when a new message is delivered to the mailbox. The dovecot example config talks about that dotlocking is using some tricks which may create more disk I/O than other locking methods. What are these tricks and can it be the cause of the slowness? We've tested it on different ZFS storages and the problem seems to only exist on ZFS storages which have their ZIL on SSD's Just creating and removing a file from the CLI is fast though. Regards, Frido

1 0

Re: Outlook 2013/2010 nightmare #2
by David.M.Clark 10 Mar '15

10 Mar '15

Yes Eric, Outlook also has a declaration that as of either version 2010 or 2013, they no longer download IMAP headers, they download the whole message - thank God for faster Internet connections these days - could you imagine that in the older dialup days? Still it is a waste of bandwidth and disk space to do this. I am so tired of how they claim to use the RFC and indicate they are 'compatible' with a certain protocol/procedure, but really just move the goal posts so you can only talk to M$ stuff at the back end using their enforcements. All part of locking people into the "perpetual upgrade" path I guess. On 03/10/2015 10:22 AM, Eric Broch wrote: > Not only does M$ Outlook not work well with others, it strips headers I > use for training spam filters. > > On 3/9/2015 5:48 PM, David.M.Clark wrote: >> Hi All and my sincere thanks to Jakob and Joseph for your responses. >> >> I got around the nightmare for this site but it is far from >> satisfactory and given both Thunderbird, Roundcube and the Android >> e-mail client work perfectly as expected, this following links >> comments enforce what I experienced over the weekend: >> >> http://comments.gmane.org/gmane.mail.imap.dovecot/79231 >> >> I have not struck this for other sites using Outlook 2013 (though I >> continually banter that Outlook version 'anything' is designed for MS >> Exchange and nothing else), but then again I have not had Outlook >> needing to share the same e-mail accounts across PCs. >> >> So the bottom line for this particular site is: >> >> Set the "Root Folder" for IMAP in outlook to "mail". This is messy >> from my beloved Linux command line perspective in that you end up with >> ${HOME}/login_name/mail/mail. But it does work and stops the Outlook >> crashes. >> >> If you set it to the Outlook recommended "INBOX" or "Inbox", you can't >> see or access subfolders. >> >> Now here comes the ugly part of Outlook 2013 using IMAP to Linux (at >> least for this site): >> >> If you want to share a single e-mail account across multiple PCs >> running Outlook 2013, you _cannot_ use the "Root Folder" of "mail" as >> I have indicated above. The workaround is to create each subsequent PC >> with a "mail2", "mail3" etc folder (without the quote marks of >> course). If you set up two PCs with the same Root Folder, the new PC >> crashes out of Outlook and eventually so does the original PC. The >> only way around this is to delete the identity and PST files in >> Outlook and strictly set them up again to different "mail" something >> folders. Almost reminds me of the old MS "Share Violation" issue :-) >> >> So after the user is set to the mail2/mail3 folder and it appears >> under the user's original "mail" folder, you then have to blow away >> the mail2/mail3 folder and then do a symbolic link to the mail folder: >> >> ln -s mail mail2 >> >> In this way, both users on the PCs will be seeing the same IMAP >> folders, being mail and mail2 on two different PCs. Naturally to add a >> third PC to this would be "mail3" etc. >> >> Now the other ugly part of this is you also need to update their >> .subscriptions file in ${HOME}/login_name/mail to show folders like: >> >> mail/Sent Items >> mail/Junk E-mails >> mail2/Sent Items >> mail2/Junk E-mails >> >> Given you would need to manually do this above, and is just not >> suitable, I have written two scripts to automate this process and it >> works cleanly so far. >> >> The first script does the automatic removal of the mail2/mail3 etc >> directory and creates the symbolic link, the second script is used to >> redo the .subscriptions file if the contents of the 'mail' directory >> change. >> >> You may need to mod these but I have a cron running as root to do this. >> >> Script 1 (mail_root_enforce): >> >> =----------------------------------------------------------------------------------= >> >> COMPLETE_HOME=/u/home >> cd ${COMPLETE_HOME} >> >> for USERHOME in * >> do >> ls -d ${USERHOME}/mail/mail? | while read CHECKME >> do >> JUST_CHECKME=`basename ${CHECKME}` >> if [ -d ${CHECKME} -a -L ${CHECKME} ] >> then >> #echo "${CHECKME} is ok" >> : >> else >> echo "${CHECKME} is _not_ ok" >> cd ${USERHOME}/mail >> rm -rf ${COMPLETE_HOME}/${CHECKME} >> ln -s mail ${JUST_CHECKME} >> fi >> done >> cd ${COMPLETE_HOME} >> done >> =----------------------------------------------------------------------------------= >> >> >> Script 2 (mail_multi_users): >> >> =----------------------------------------------------------------------------------= >> >> cd /u/home >> >> for THIS_USER in * >> do >> MORE_THAN_1=`ls -d ${THIS_USER}/mail/mail* | wc -l` >> if [ "${MORE_THAN_1}" -gt "1" ] >> then >> # echo "${THIS_USER} has more than one" >> ls ${THIS_USER}/mail/mail >${THIS_USER}/subcount >> if [ ! -f ${THIS_USER}/subcount_last ] >> then >> >${THIS_USER}/subcount_last >> fi >> ISDIFF=`diff ${THIS_USER}/subcount ${THIS_USER}/subcount_last | >> wc -l | awk '{print $1}'` >> if [ "${ISDIFF}" -gt "0" ] >> then >> # echo "Is Different" >> ls ${THIS_USER}/mail/mail >${THIS_USER}/subscription_tmp >> >${THIS_USER}/subscription_new >> for ROOT_MAIL_DIR in ${THIS_USER}/mail/mail* >> do >> MAIL_BASE_NAME=`basename ${ROOT_MAIL_DIR}` >> cat ${THIS_USER}/subscription_tmp | sed >> "s:^:$MAIL_BASE_NAME/:g" >>${THIS_USER}/subscription_new >> done >> cp ${THIS_USER}/subscription_new >> ${THIS_USER}/mail/.subscriptions >> chown ${THIS_USER}:popusers ${THIS_USER}/mail/.subscriptions >> cp ${THIS_USER}/subcount ${THIS_USER}/subcount_last >> fi >> fi >> done >> =----------------------------------------------------------------------------------= >> >> >> You will note the ${HOME} directories are all under /u/home so if you >> do sadly need to use these scripts, please change the /u/home to suite >> the ${HOME} location set on your server. I prefer to run this as root >> to enforce things and not have any funny permission errors, and also >> to save needing to run multiple instances for multiples users. >> >> One annoying caveat that the site will have to get used to: the mail2, >> mail3 folders do show up when using good e-mail clients like >> Thunderbird, SOGo, Roundcube or Android e-mail client. This is because >> they are seeing the contents of the .subscriptions file. I haven't >> looked into Dovecot doco for possible multiple .subscription files to >> make the folders bit look 'nicer'. I will look at something like >> 'namespace' to see if this might help. Please bear in mind this was in >> an emergency to get things at least 'working' so the users were happy >> when they hit the office on Monday. >> >> A documented story for your perusal and use if you are 'stuck' like I >> was. I will continue to try and see if there is a more elegant >> work-around but for now, this is all I can come up with. >> >> PS: I notice everyone suppresses their e-mail footer so doing the same >> here :-) >> -- As always, I remain at your service. Kindest Regards, David.M.Clark

3 2

Re: Outlook 2013/2010 nightmare #3
by David.M.Clark 10 Mar '15

10 Mar '15

Hi All, Sorry for the extra e-mail. Given I am helping roll out this identical setup again I am thinking I will test another approach which I am hoping will work but given having two or more PCs trying to access the 'mail' folder crashed at this site on the weekend, I went away from this. But in my thinking perhaps it 'might' work if same login ID is not used to access the exact same area. Example: 1. Setup user "accounts" and open the permissions of its folders. (${HOME} = /u/home/accounts) 2. Create "accounts2" but have its ${HOME} directory set to the same as "accounts". (${HOME} = /u/home/accounts) Make sure accounts2 can fully access everything - perhaps I will need to enforce a central GID (group ID) for each user to belong to (eg., accounts). 3. See if the same crash issue happens if using a different login name. This is using the reverse approach of not having separate Root Folder paths for the same Linux login ID. If this does work I can then reverse engineer the issue at the site over the weekend as well. Will keep you posted. -- As always, I remain at your service. Kindest Regards, David.M.Clark

1 0

Re: Outlook 2013/2010 nightmare #2
by David.M.Clark 10 Mar '15

10 Mar '15

Hi All and my sincere thanks to Jakob and Joseph for your responses. I got around the nightmare for this site but it is far from satisfactory and given both Thunderbird, Roundcube and the Android e-mail client work perfectly as expected, this following links comments enforce what I experienced over the weekend: http://comments.gmane.org/gmane.mail.imap.dovecot/79231 I have not struck this for other sites using Outlook 2013 (though I continually banter that Outlook version 'anything' is designed for MS Exchange and nothing else), but then again I have not had Outlook needing to share the same e-mail accounts across PCs. So the bottom line for this particular site is: Set the "Root Folder" for IMAP in outlook to "mail". This is messy from my beloved Linux command line perspective in that you end up with ${HOME}/login_name/mail/mail. But it does work and stops the Outlook crashes. If you set it to the Outlook recommended "INBOX" or "Inbox", you can't see or access subfolders. Now here comes the ugly part of Outlook 2013 using IMAP to Linux (at least for this site): If you want to share a single e-mail account across multiple PCs running Outlook 2013, you _cannot_ use the "Root Folder" of "mail" as I have indicated above. The workaround is to create each subsequent PC with a "mail2", "mail3" etc folder (without the quote marks of course). If you set up two PCs with the same Root Folder, the new PC crashes out of Outlook and eventually so does the original PC. The only way around this is to delete the identity and PST files in Outlook and strictly set them up again to different "mail" something folders. Almost reminds me of the old MS "Share Violation" issue :-) So after the user is set to the mail2/mail3 folder and it appears under the user's original "mail" folder, you then have to blow away the mail2/mail3 folder and then do a symbolic link to the mail folder: ln -s mail mail2 In this way, both users on the PCs will be seeing the same IMAP folders, being mail and mail2 on two different PCs. Naturally to add a third PC to this would be "mail3" etc. Now the other ugly part of this is you also need to update their .subscriptions file in ${HOME}/login_name/mail to show folders like: mail/Sent Items mail/Junk E-mails mail2/Sent Items mail2/Junk E-mails Given you would need to manually do this above, and is just not suitable, I have written two scripts to automate this process and it works cleanly so far. The first script does the automatic removal of the mail2/mail3 etc directory and creates the symbolic link, the second script is used to redo the .subscriptions file if the contents of the 'mail' directory change. You may need to mod these but I have a cron running as root to do this. Script 1 (mail_root_enforce): =----------------------------------------------------------------------------------= COMPLETE_HOME=/u/home cd ${COMPLETE_HOME} for USERHOME in * do ls -d ${USERHOME}/mail/mail? | while read CHECKME do JUST_CHECKME=`basename ${CHECKME}` if [ -d ${CHECKME} -a -L ${CHECKME} ] then #echo "${CHECKME} is ok" : else echo "${CHECKME} is _not_ ok" cd ${USERHOME}/mail rm -rf ${COMPLETE_HOME}/${CHECKME} ln -s mail ${JUST_CHECKME} fi done cd ${COMPLETE_HOME} done =----------------------------------------------------------------------------------= Script 2 (mail_multi_users): =----------------------------------------------------------------------------------= cd /u/home for THIS_USER in * do MORE_THAN_1=`ls -d ${THIS_USER}/mail/mail* | wc -l` if [ "${MORE_THAN_1}" -gt "1" ] then # echo "${THIS_USER} has more than one" ls ${THIS_USER}/mail/mail >${THIS_USER}/subcount if [ ! -f ${THIS_USER}/subcount_last ] then >${THIS_USER}/subcount_last fi ISDIFF=`diff ${THIS_USER}/subcount ${THIS_USER}/subcount_last | wc -l | awk '{print $1}'` if [ "${ISDIFF}" -gt "0" ] then # echo "Is Different" ls ${THIS_USER}/mail/mail >${THIS_USER}/subscription_tmp >${THIS_USER}/subscription_new for ROOT_MAIL_DIR in ${THIS_USER}/mail/mail* do MAIL_BASE_NAME=`basename ${ROOT_MAIL_DIR}` cat ${THIS_USER}/subscription_tmp | sed "s:^:$MAIL_BASE_NAME/:g" >>${THIS_USER}/subscription_new done cp ${THIS_USER}/subscription_new ${THIS_USER}/mail/.subscriptions chown ${THIS_USER}:popusers ${THIS_USER}/mail/.subscriptions cp ${THIS_USER}/subcount ${THIS_USER}/subcount_last fi fi done =----------------------------------------------------------------------------------= You will note the ${HOME} directories are all under /u/home so if you do sadly need to use these scripts, please change the /u/home to suite the ${HOME} location set on your server. I prefer to run this as root to enforce things and not have any funny permission errors, and also to save needing to run multiple instances for multiples users. One annoying caveat that the site will have to get used to: the mail2, mail3 folders do show up when using good e-mail clients like Thunderbird, SOGo, Roundcube or Android e-mail client. This is because they are seeing the contents of the .subscriptions file. I haven't looked into Dovecot doco for possible multiple .subscription files to make the folders bit look 'nicer'. I will look at something like 'namespace' to see if this might help. Please bear in mind this was in an emergency to get things at least 'working' so the users were happy when they hit the office on Monday. A documented story for your perusal and use if you are 'stuck' like I was. I will continue to try and see if there is a more elegant work-around but for now, this is all I can come up with. PS: I notice everyone suppresses their e-mail footer so doing the same here :-) -- As always, I remain at your service. Kindest Regards, David.M.Clark

1 0

Outlook 2013/2010 nightmare
by David.M.Clark 09 Mar '15

09 Mar '15

Hi All, This is my first post so forgive me if this hits the wrong list. I have been using dovecot for years happily with SendMail on mainly CentOS servers, and my customers are starting to more and more use Thunderbird, so my perfect model is: Linux --> Dovecot --> SendMail --> Thunderbird (or mobile phone e-mail app). I do have some customers using Outlook or Windows Live Mail, and these are for the most part working fine with IMAP - I don't do POP. My mod to the dovecot.conf file: disable_plaintext_auth=no My mod to conf.d/10-mail.conf: #mail_location = mail_location = mbox:~/mail:INBOX=/var/spool/mail/%u My mod to conf.d/10-master.conf: #default_internal_user = dovecot service imap-login { inet_listener imap { port = 143 } inet_listener imap_second { port = 10143 } inet_listener imaps { #port = 993 #ssl = yes } - I do the 10143 bit so I can pseudo hide port 143 for clients with devices that access both internally and externally - port forwarded on MikroTik routers for my customers. All goes well for many years with the above configs, and continues to be awesome as always. Under the user's ${HOME} directory they end up with a lovely 'mail' directory and all of the e-mail client folders live in harmony under there. This weekend I am helping a customer cut over his customer from legacy POP based e-mail uses with splatterings of Outlook 2010 and 2013 throughout the company, to using Linux with IMAP in the setup as described above as per my standard configs. The issue starts when you add an IMAP user to the Outlook client and upon opening it, initially, it tries to find a "Sent" Items folder under IMAP to send from. To this end I have traditionally gone into the dialogue box that opens, click on the IMAP account to receive a list of possible folders, but it now immediately crashes indicating Outlook has had an error, and it all goes to hell from there. Outlook then cannot open but keeps crashing with its "unknown error". Up to last week at another site with Windows Live Mail, this was not an issue. By modifying the e-mail account via Control Panel, I can delete or modify the account and try again. Here is what I found: If I don't specify a 'root' folder under the "Advanced" tab which also contains the port selections for 143 and 25, it fails. If I follow the MS recommended root folder example from Microsoft and use INBOX, or Inbox, it 'does' stop the error but you can't create subfolders - I am assuming as this is picking up the .imap/INBOX folder or something and makes sense that it can't create folders under INBOX/Inbox, particularly if this is a file rather than a directory that dovecot/Outlook are pointing to. What I have found is I can 'lie' to Outlook and put in a 'mail' folder. This results in a ${HOME}/login_name/mail/mail folder, but I don't care, as it happily puts files under mail/mail. Now here is something totally strange: If I try to put this same account on another PC so users can 'share' the same e-mail account, even with my 'mail' root folder work-around, it crashes again. All through this, Thuderbird works fine and so does RoundCube - SOGo will be up and working a bit later once I get the initial part up and going... but I digress but good to know it is only Outlook doing this. To share multiple accounts I am currently getting the subsequent PCs that need to share a universal account to select a root folder mail2, mail3 etc. I then delete these folders and symbolic link the mail2, mail3 etc to the mail directory - yucky fix, but kind of works with some auto scripting of .subscriptions to follow so all of the Outlook clients sync to the one 'real' root folder. I have never seen this before and have customers running all kinds of IMAP e-mail clients to dovecot on Linux. I saw an MS posted bug on something for IMAP and they recommend rolling back MS updates to fix it - but I am not sure the client can or will do that. This kind of random issue that only affects this site at present is why I only recommend people use e-mail clients like Thunderbird because it just 'works'. The users at this site would not switch and will cite they have been working in a POP situation on their other Linux box since Adam was a boy. Any help would be very much appreciated. I like to think I can do this with my eyes shut by now, but this one has got me stumped. -- As always, I remain at your service. Kindest Regards, David.M.Clark (Director - Senior Linux/UNIX Consultant) =----------------------------------------------------------------------= Davrom Consulting Pty Ltd E-mail : david(a)davrom.com PO Box 1644, Sunnybank Hills, 4109 Twitter: @DavidClark1961 ABN: 81 096 990 804 MSN: david(a)davrom.com Phone/Fax: 61-7-32720267 Skype: dmc1961 Mobile: 0418-763124 Google: dmc1961(a)gmail.com Podcast: http://www.davrom.com/ldup/ldup_rss.xml =---------------------- http://www.davrom.com -------------------------= Specialising in: Linux (Fedora/RedHat/CentOS), UNIX, SCO, MikroTik, Networking/Internet, E-mail/Web Technologies =----------------------------------------------------------------------= Please note: Any e-mail communication bearing this signature is for the exclusive purpose of the sender and is not for publication without the expressed permission of the sender or respective sender's organisation. =----------------------------------------------------------------------=

2 1

Expunge messages older than
by absolutely_free＠libero.it 09 Mar '15

09 Mar '15

Hi, I am using Dovecot 2.2.13 on cPanel server. Is there a way to delete messages older than some date for a number of users (in every subfolder)? Thank you

3 2

Re: Outlook 2013/2010 nightmare
by Joseph Tam 09 Mar '15

09 Mar '15

"David.M.Clark" <david(a)davrom.com> writes: > I do have some customers using Outlook or Windows Live Mail, and these > are for the most part working fine with IMAP - I don't do POP. > ... > The issue starts when you add an IMAP user to the Outlook client and > upon opening it, initially, it tries to find a "Sent" Items folder under > IMAP to send from. To this end I have traditionally gone into the > dialogue box that opens, click on the IMAP account to receive a list of > possible folders, but it now immediately crashes indicating Outlook has > had an error, and it all goes to hell from there. Outlook then cannot > open but keeps crashing with its "unknown error". > Up to last week at another site with Windows Live Mail, this was not an > issue. Just a shot in the dark, but have you enabled the workarounds? http://wiki2.dovecot.org/Clients Some clients like, like Outlook, have known problems which dovecot can dance around. in 20-imap.conf # Workarounds for various client bugs: # delay-newmail: # Send EXISTS/RECENT new mail notifications only when replying to NOOP # and CHECK commands. Some clients ignore them otherwise, for example OSX # Mail (<v2.1). Outlook Express breaks more badly though, without this it # may show user "Message no longer in server" errors. Note that OE6 still # breaks even with this workaround if synchronization is set to # "Headers Only". # tb-extra-mailbox-sep: # Thunderbird gets somehow confused with LAYOUT=fs (mbox and dbox) and # adds extra '/' suffixes to mailbox names. This option causes Dovecot to # ignore the extra '/' instead of treating it as invalid mailbox name. # tb-lsub-flags: # Show \Noselect flags for LSUB replies with LAYOUT=fs (e.g. mbox). # This makes Thunderbird realize they aren't selectable and show them # greyed out, instead of only later giving "not selectable" popup error. # # The list is space-separated. imap_client_workarounds = delay-newmail Joseph Tam <jtam.home(a)gmail.com>

1 0

dovecot auth-worker error happens when I enabled the dovecot to consider both the system account and the MySQL virtual mailbox databases.
by Emmanuel Chanel 08 Mar '15

08 Mar '15

Version: 2.2.9 & 2.2.15 ( http://ppa.launchpad.net/malte.swart/dovecot-2.2/ubuntu ) OS: Ubuntu 14.04 Server LTS I installed Ubuntu 14.04.2 LTS newly on my new server... And I try to configure the mail server considering both my system account and the virtual mailboxes, by seeing https://www.exratione.com/2014/05/a-mailserver-on-ubuntu-1404-postfix-dovec… But when I configured by uncommenting #!include auth-sql.conf.ext , it doesn't auth... Possibly, it's a trouble with the configurations of postfix and of dovecot. But I don't understand why... When I enable either auth-system.conf.ext or auth-sql.conf.ext , it works... My doveconf -n http://pastebin.com/MU1LL63d dovecot-sql.conf.ext http://pastebin.com/PJkTnPB3 tail /var/log/mail.log by debug mode / dovecot 2.2.15 http://pastebin.com/1TRQL49d Mar 6 07:45:12 gateway dovecot: auth: Debug: client in: AUTH#0114#011PLAIN#011service=imap#011secured#011session=xS6uSpIQvQDAqAAC#011lip=192.168.0.1#011rip=192.168.0.2#011lport=143#011rport=38333 Mar 6 07:45:12 gateway dovecot: auth: Debug: client passdb out: CONT#0114#011 Mar 6 07:45:12 gateway dovecot: auth: Debug: client in: CONT<hidden> Mar 6 07:45:12 gateway dovecot: auth-worker(22933): Debug: pam(emmanuel,192.168.0.2): lookup service=dovecot Mar 6 07:45:12 gateway dovecot: auth: Error: auth worker: Aborted PASSV request for emmanuel: Worker process died unexpectedly Mar 6 07:45:12 gateway dovecot: auth-worker(22936): Debug: sql(emmanuel,192.168.0.2): query: SELECT username as user, password, '/home/vmail//emmanuel' as userdb_home, 'maildir:/home/vmail//emmanuel' as userdb_mail, 65000 as userdb_uid, 8 as userdb_gid FROM mailbox WHERE username = 'emmanuel' AND active = '1' Mar 6 07:45:12 gateway dovecot: auth-worker(22933): Fatal: master: service(auth-worker): child 22933 killed with signal 11 (core dumped) Mar 6 07:45:12 gateway dovecot: auth-worker(22936): sql(emmanuel,192.168.0.2): unknown user Mar 6 07:45:12 gateway dovecot: auth-worker(23755): Debug: Loading modules from directory: /usr/lib/dovecot/modules/auth Mar 6 07:45:12 gateway dovecot: auth-worker(23755): Debug: Module loaded: /usr/lib/dovecot/modules/auth/libdriver_mysql.so Mar 6 07:45:14 gateway dovecot: auth: Debug: client passdb out: FAIL#0114#011user=emmanuel#011temp Mar 6 07:45:14 gateway dovecot: auth: Debug: client in: AUTH#0115#011LOGIN#011service=imap#011secured#011session=xS6uSpIQvQDAqAAC#011lip=192.168.0.1#011rip=192.168.0.2#011lport=143#011rport=38333 Mar 6 07:45:14 gateway dovecot: auth: Debug: client passdb out: CONT#0115#011VXNlcm5hbWU6 Mar 6 07:45:14 gateway dovecot: auth: Debug: client in: CONT<hidden> Mar 6 07:45:14 gateway dovecot: auth: Debug: client passdb out: CONT#0115#011UGFzc3dvcmQ6 Mar 6 07:45:14 gateway dovecot: auth: Debug: client in: CONT<hidden> Mar 6 07:45:14 gateway dovecot: auth-worker(22936): Debug: pam(emmanuel,192.168.0.2): lookup service=dovecot Mar 6 07:45:14 gateway dovecot: auth: Error: auth worker: Aborted PASSV request for emmanuel: Worker process died unexpectedly Mar 6 07:45:14 gateway dovecot: auth-worker(23755): Debug: sql(emmanuel,192.168.0.2): query: SELECT username as user, password, '/home/vmail//emmanuel' as userdb_home, 'maildir:/home/vmail//emmanuel' as userdb_mail, 65000 as userdb_uid, 8 as userdb_gid FROM mailbox WHERE username = 'emmanuel' AND active = '1' Mar 6 07:45:14 gateway dovecot: auth-worker(22936): Fatal: master: service(auth-worker): child 22936 killed with signal 11 (core dumped) Mar 6 07:45:14 gateway dovecot: auth-worker(23755): sql(emmanuel,192.168.0.2): unknown user Mar 6 07:45:14 gateway dovecot: auth-worker(23764): Debug: Loading modules from directory: /usr/lib/dovecot/modules/auth Mar 6 07:45:14 gateway dovecot: auth-worker(23764): Debug: Module loaded: /usr/lib/dovecot/modules/auth/libdriver_mysql.so Mar 6 07:45:16 gateway dovecot: auth: Debug: client passdb out: FAIL#0115#011user=emmanuel#011temp Mar 6 07:45:16 gateway dovecot: auth: Debug: client in: AUTH#0116#011PLAIN#011service=imap#011secured#011session=xS6uSpIQvQDAqAAC#011lip=192.168.0.1#011rip=192.168.0.2#011lport=143#011rport=38333#011resp=<hidden> Mar 6 07:45:16 gateway dovecot: auth-worker(23755): Debug: pam(emmanuel,192.168.0.2): lookup service=dovecot Mar 6 07:45:16 gateway dovecot: auth: Error: auth worker: Aborted PASSV request for emmanuel: Worker process died unexpectedly Mar 6 07:45:16 gateway dovecot: auth-worker(23764): Debug: sql(emmanuel,192.168.0.2): query: SELECT username as user, password, '/home/vmail//emmanuel' as userdb_home, 'maildir:/home/vmail//emmanuel' as userdb_mail, 65000 as userdb_uid, 8 as userdb_gid FROM mailbox WHERE username = 'emmanuel' AND active = '1' Mar 6 07:45:16 gateway dovecot: auth-worker(23755): Fatal: master: service(auth-worker): child 23755 killed with signal 11 (core dumped) Mar 6 07:45:16 gateway dovecot: auth-worker(23764): sql(emmanuel,192.168.0.2): unknown user Mar 6 07:45:16 gateway dovecot: auth-worker(23767): Debug: Loading modules from directory: /usr/lib/dovecot/modules/auth Mar 6 07:45:16 gateway dovecot: auth-worker(23767): Debug: Module loaded: /usr/lib/dovecot/modules/auth/libdriver_mysql.so Mar 6 07:45:18 gateway dovecot: auth: Debug: client passdb out: FAIL#0116#011user=emmanuel#011temp -- Emmanuel Chanel( emmanuelchanel(a)gmail.com )

1 3

Sieve can't find Extprograms or Extdata
by E.B. 08 Mar '15

08 Mar '15

Hi, On a new install-from-source with Dovecot 2.2.16rc1, Piegeonhole 0.4.6 and a grab of the newest Extdata code, I confirmed basic Sieve functionality is working (made a simple sieve script with a test on message subject resulting in a fileinto action). But I cannot get Sieve to see Extdata or Extprograms. sievec reports "Warning: sieve: ignored unknown extension 'vnd.dovecot.filter' while configuring available extensions" and the same for vnd.dovecot.extdata. And of course for the user script, "error: require command: unknown Sieve capability `vnd.dovecot.filter'" (same with extdata) I'm pretty sure this is a library path problem, but I've tried symlinking and restarting dovecot with as many iterations of library paths as I can think of but still same problem. The lib90_sieve_extdata_plugin.so and lib90_sieve_extprograms_plugin.so are in /usr/local/lib/dovecot/sieve and all the rest of the normal dovecot libraries are one level above in /usr/local/lib/dovecot. I tried creating symlinks for a "modules" directory and a "modules/sieve" directory, I tried symlinking these two librarie files themselves into the top level dovecot library directory, and a few other ideas, but no luck. Is there a way I can tell where Sieve expects its libraries to reside? To see where it is looking? I didn't provide any arguments to the configure command for pigeonhole as well as extdata and it seems like the libs got placed somewhere sensible, but I don't know what else to do.

2 3

[PATCH] Fix dovecot 1.2 build with LibreSSL
by Bernard Spil 07 Mar '15

07 Mar '15

Hi All, mail/dovecot build fails when linked against LibreSSL. This is due to LibreSSL no longer including comp.h from ssl.h/ssl3.h. See https://wiki.freebsd.org/LibreSSL as well. This patch fixes the build failure. Build log attached as well (not any more, too large! Get it via link just above). Please commit this fix to the 1.2 branch (2.1 branch is not affected) Kind regards, Bernard Spil.

1 0

Identify mail for attachment hash
by Daniel Miller 06 Mar '15

06 Mar '15

How can I find the message associated with a given attachment hash? For example, if I know that: /ff/23/ff23873c712474ad0f48cbd81485eaeaba3d8468-e1b4513a2eb8eb53b16400009db5accb is missing, I want to find the message associated with it so I can determine if it's critical and I need to recover it from another source, or if I can simply delete the old message. -- Daniel

1 0

Sieve editheader should support adding Received and Auto-Submitted headers
by Lee Maguire 06 Mar '15

06 Mar '15

In order to simplify auto-response suppression and other filtering, I want to synthesise an Auto-Submitted header on notification mails that should have them but do not. In a sieve file I add the following: if anyof ( header :contains ["From","Sender"] “info(a)example.com" ) { if header :contains "Subject" [" just joined "," just left "] { if not exists "Auto-Submitted" { addheader "Auto-Submitted" "auto-generated (via sieve)"; } } However this doesn’t work and results in the following error > main script: line 205: warning: addheader action: specified header field `Auto-Submitted' is protected; modification denied. (Workaround for this specific issue would probably be to use a List-* header instead.) Looking at http://hg.rename-it.nl/dovecot-2.2-pigeonhole/file/c8edece267cd/src/lib-sie… I can see that "Auto-Submitted” and “Received” are hardcoded to be blocked without reference to whether they are to be added or removed. However, the hard restriction in RFC 5293 on Auto-Submitted and Received only applies to the use of deleteheader and not addheader. https://tools.ietf.org/html/rfc5293#section-6 > As a matter of local policy, implementations MAY limit which header > fields may be deleted and which header fields may be added. However, > implementations MUST NOT permit attempts to delete "Received" and > "Auto-Submitted" header fields and MUST permit both addition and > deletion of the "Subject" header field. Using Dovecot version 2.1.7 but I assume it’s not version specific issue.

2 1

LMTP error: Too many concurrent deliveries for user (in reply to end of DATA command)
by Ralf Hildebrandt 06 Mar '15

06 Mar '15

I updated dovecot today and all over a sudden I'm getting: Mar 6 14:40:46 mail postfix/lmtp[3150]: 3kz95y3nX3zCtTS: to=<recipient(a)backup.invalid>, relay=127.0.0.1[private/dovecot-lmtp], delay=88, delays=87/0.94/0.01/0.01, dsn=4.3.0, status=deferred (host 127.0.0.1[private/dovecot-lmtp] said: 451 4.3.0 <recipient(a)backup.invalid> Too many concurrent deliveries for user (in reply to end of DATA command)) Why is that? Which setting must I tweak? -- [*] sys4 AG http://sys4.de, +49 (89) 30 90 46 64 Franziskanerstraße 15, 81669 München Sitz der Gesellschaft: München, Amtsgericht München: HRB 199263 Vorstand: Patrick Ben Koetter, Marc Schiffbauer Aufsichtsratsvorsitzender: Florian Kirstein

3 6

IP drop list
by Jim Pazarena 05 Mar '15

05 Mar '15

I wonder if there is an easy way to provide dovecot a flat text file of ipv4 #'s which should be ignored or dropped? I have accumulated 45,000+ IPs which routinely try dictionary and 12345678 password attempts. The file is too big to create firewall drops, and I don't want to compile with wrappers *if* dovecot has an easy ability to do this. If dovecot could parse a flat text file of IPs and drop connections it would sure put a dent in these attempts. Thanks.

15 28

Fwd: Re: IP drop list
by Jim Pazarena 05 Mar '15

05 Mar '15

On 2015-03-02 2:02 AM, Jochen Bern wrote: > On 03/01/2015 08:53 AM, Jim Pazarena wrote: >> I wonder if there is an easy way to provide dovecot a flat text file of >> ipv4 #'s which should be ignored or dropped? >> >> I have accumulated 45,000+ IPs which routinely try dictionary and >> 12345678 password attempts. The file is too big to create firewall >> drops [...] > > The inherent assumption here is that dovecot, using a "flat file", will > be able to process the block list more effectively than the firewall, > which is a tool written for the *purpose* but supposedly unable to even > *try* due to the list's size. That sounds ... counterintuitive. I am the original poster and just came back to this thread. When the first couple replies were "fail2ban" I lost interest. The reason I contemplated a flat text scan by dovecot is because, for the most part, my dovecot is low volume. So even if parsing a flat text file is less 'efficient' than a firewall insertion, it WOULD serve to defeat dictionary attacks rather readily. I already have a routine which scans my dovecot logs for goofy attacks such as dictionary or 12345 attempts. And since the attacks are pop/IMAP only, that is the only avenue which I wanted to defeat. This question garnered lots and lots of responses and I appreciate them all and read them all. And out of all the responses I think I will pursue the ipset routine. It seems easy enough and can act at the firewall level. The DNS RBL would be cool. I am also cognizant that 45,000 SHOULD have a TTL. However, these were IPs attempting to fetch email with obviously hacker type passwords. If, later, a given IP is re-assigned to a 'legitimate' person, they would still be able to send an email to me ' postmaster@ ' asking about an inability to fetch email. But parsing the flat text file would STILL be my preference. I'll look at the source and see if I can figure out where to inject such code. Like I said, my dovecot is low volume, so a fraction of a second at connection time is low impact. Considering that the flat text file may hang around in the memory cache it could even be less impact than low.

4 3

Receiving emails problem
by Gintare Ragaisiene 05 Mar '15

05 Mar '15

Hello, I have DirectAdmin system installed with CentOS OS. I created a user and a user email account. Then I tried to send email from my website (which is written on PHP5) to my mailbox. Everything seemed ok, but I did not received letter on the mailbox. The same is wehen I am trying to send through webmail SquirrelMail. I got a record on var/log/mailog: Mar 5 17:07:15 432282 dovecot[535]: imap-login: Login: user=<gintare>, method=PLAIN, rip=127.0.0.1, lip=127.0.0.1, mpid=7134, secured, session=<Rdpd7IsQhgB/AAAB> Mar 5 17:07:15 432282 dovecot[535]: imap(gintare): Disconnected: Logged out in=79 out=766 Please, help me. Versions: DirectAdmin - 1.4 CentOS - 6.6 Dovecot - 2.2.15 SquirrelMail (wbmail) - 1.4.23 Thanks, Gintare

2 1

Dovecot Full Text Search: HTTP 500 : Unknown fieldType 'text_general' specified on field text. [SERIOUS]
by Kevin Laurie 05 Mar '15

05 Mar '15

Hi Muzzafer, I get the error as specified below when i try to added it in as a field:- I dont think text_general is a valid field? HTTP ERROR 500 Problem accessing /solr/. Reason: {msg=SolrCore 'collection1' is not available due to init failure: Could not load conf for core collection1: Unknown fieldType 'text_general' specified on field text. Schema file is /opt/solr/solr/collection1/conf/schema.xml,trace=org.apache.solr.common.SolrException: SolrCore 'collection1' is not available due to init failure: Could not load conf for core collection1: Unknown fieldType 'text_general' specified on field text. Schema file is /opt/solr/solr/collection1/conf/schema.xml at org.apache.solr.core.CoreContainer.getCore(CoreContainer.java:745) at org.apache.solr.servlet.SolrDispatchFilter.doFilter(SolrDispatchFilter.java:307) at org.apache.solr.servlet.SolrDispatchFilter.doFilter(SolrDispatchFilter.java:207) at org.eclipse.jetty.servlet.ServletHandler$CachedChain.doFilter(ServletHandler.java:1419) at org.eclipse.jetty.servlet.ServletHandler.doHandle(ServletHandler.java:455) at org.eclipse.jetty.server.handler.ScopedHandler.handle(ScopedHandler.java:137) at org.eclipse.jetty.security.SecurityHandler.handle(SecurityHandler.java:557) at org.eclipse.jetty.server.session.SessionHandler.doHandle(SessionHandler.java:231) at org.eclipse.jetty.server.handler.ContextHandler.doHandle(ContextHandler.java:1075) at org.eclipse.jetty.servlet.ServletHandler.doScope(ServletHandler.java:384) at org.eclipse.jetty.server.session.SessionHandler.doScope(SessionHandler.java:193) at org.eclipse.jetty.server.handler.ContextHandler.doScope(ContextHandler.java:1009) at org.eclipse.jetty.server.handler.ScopedHandler.handle(ScopedHandler.java:135) at org.eclipse.jetty.server.handler.ContextHandlerCollection.handle(ContextHandlerCollection.java:255) at org.eclipse.jetty.server.handler.HandlerCollection.handle(HandlerCollection.java:154) at org.eclipse.jetty.server.handler.HandlerWrapper.handle(HandlerWrapper.java:116) at org.eclipse.jetty.server.Server.handle(Server.java:368) at org.eclipse.jetty.server.AbstractHttpConnection.handleRequest(AbstractHttpConnection.java:489) at org.eclipse.jetty.server.BlockingHttpConnection.handleRequest(BlockingHttpConnection.java:53) at org.eclipse.jetty.server.AbstractHttpConnection.headerComplete(AbstractHttpConnection.java:942) at org.eclipse.jetty.server.AbstractHttpConnection$RequestHandler.headerComplete(AbstractHttpConnection.java:1004) at org.eclipse.jetty.http.HttpParser.parseNext(HttpParser.java:640) at org.eclipse.jetty.http.HttpParser.parseAvailable(HttpParser.java:235) at org.eclipse.jetty.server.BlockingHttpConnection.handle(BlockingHttpConnection.java:72) at org.eclipse.jetty.server.bio.SocketConnector$ConnectorEndPoint.run(SocketConnector.java:264) at org.eclipse.jetty.util.thread.QueuedThreadPool.runJob(QueuedThreadPool.java:608) at org.eclipse.jetty.util.thread.QueuedThreadPool$3.run(QueuedThreadPool.java:543) at java.lang.Thread.run(Thread.java:745) Caused by: org.apache.solr.common.SolrException: Could not load conf for core collection1: Unknown fieldType 'text_general' specified on field text. Schema file is /opt/solr/solr/collection1/conf/schema.xml at org.apache.solr.core.ConfigSetService.getConfig(ConfigSetService.java:66) at org.apache.solr.core.CoreContainer.create(CoreContainer.java:489) at org.apache.solr.core.CoreContainer$1.call(CoreContainer.java:255) at org.apache.solr.core.CoreContainer$1.call(CoreContainer.java:249) at java.util.concurrent.FutureTask.run(FutureTask.java:262) at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1145) at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:615) ... 1 more Caused by: org.apache.solr.common.SolrException: Unknown fieldType 'text_general' specified on field text. Schema file is /opt/solr/solr/collection1/conf/schema.xml at org.apache.solr.schema.IndexSchema.readSchema(IndexSchema.java:595) at org.apache.solr.schema.IndexSchema.<init>(IndexSchema.java:166) at org.apache.solr.schema.IndexSchemaFactory.create(IndexSchemaFactory.java:55) at org.apache.solr.schema.IndexSchemaFactory.buildIndexSchema(IndexSchemaFactory.java:69) at org.apache.solr.core.ConfigSetService.createIndexSchema(ConfigSetService.java:90) at org.apache.solr.core.ConfigSetService.getConfig(ConfigSetService.java:62) ... 7 more Caused by: org.apache.solr.common.SolrException: Unknown fieldType 'text_general' specified on field text at org.apache.solr.schema.IndexSchema.loadFields(IndexSchema.java:638) at org.apache.solr.schema.IndexSchema.readSchema(IndexSchema.java:489) ... 12 more ,code=500} On Thu, Mar 5, 2015 at 5:04 PM, Muzaffer Tolga Ozses <tolga(a)ozses.net> wrote: > Sure thing > > On 5 March 2015 at 11:52, Kevin Laurie <superinterstellar(a)gmail.com> wrote: >> >> No i dont have it. >> there is body field though. I think text is needed. Let me add it in and >> see. >> Thanks >> >> >> On Thu, Mar 5, 2015 at 4:42 PM, Muzaffer Tolga Ozses <tolga(a)ozses.net> >> wrote: >> > Leon gave you the answer. Check if you have it, define if you don't, and >> > restart the service. >> > >> > On 5 March 2015 at 11:24, Kevin Laurie <superinterstellar(a)gmail.com> >> > wrote: >> >> >> >> Hi Muzaffer, >> >> Could you help by checking this? Should I provide my solrconfig.xml >> >> too? >> >> Please advise urgently. I really need this to work man.Thanks! >> >> >> >> >> >> >> >> >> >>  >> >> <schema name="dovecot" version="1.5"> >> >> >> >> <field name="_version_" type="long" indexed="true" stored="true"/> >> >> <field name="_root_" type="string" indexed="true" stored="false"/> >> >> >> >> <types> >> >>  >> >> <fieldType name="string" class="solr.StrField" omitNorms="true"/> >> >> <fieldType name="long" class="solr.LongField" omitNorms="true"/> >> >> <fieldType name="slong" class="solr.SortableLongField" >> >> omitNorms="true"/> >> >> <fieldType name="float" class="solr.FloatField" omitNorms="true"/> >> >> <fieldType name="boolean" class="solr.BoolField" omitNorms="true"/> >> >> >> >> <fieldType name="text" class="solr.TextField" >> >> positionIncrementGap="100"> >> >> <analyzer type="index"> >> >> <tokenizer class="solr.WhitespaceTokenizerFactory"/> >> >> <filter class="solr.StopFilterFactory" ignoreCase="true" >> >> words="stopwords.txt"/> >> >> <filter class="solr.WordDelimiterFilterFactory" >> >> generateWordParts="1" generateNumberParts="1" catenateWords="1" >> >> catenateNumbers="1" catenateAll="0"/> >> >> <filter class="solr.LowerCaseFilterFactory"/> >> >>  >> >> <filter class="solr.SnowballPorterFilterFactory" >> >> protected="protwords.txt"/> >> >> <filter class="solr.NGramFilterFactory" minGramSize="3" >> >> maxGramSize="15"/> >> >> <filter class="solr.RemoveDuplicatesTokenFilterFactory"/> >> >> </analyzer> >> >> <analyzer type="query"> >> >> <tokenizer class="solr.WhitespaceTokenizerFactory"/> >> >> <filter class="solr.SynonymFilterFactory" >> >> synonyms="synonyms.txt" ignoreCase="true" expand="true"/> >> >> <filter class="solr.StopFilterFactory" ignoreCase="true" >> >> words="stopwords.txt"/> >> >> <filter class="solr.WordDelimiterFilterFactory" >> >> generateWordParts="1" generateNumberParts="1" catenateWords="0" >> >> catenateNumbers="0" catenateAll="0"/> >> >> <filter class="solr.LowerCaseFilterFactory"/> >> >>  >> >> <filter class="solr.SnowballPorterFilterFactory" >> >> protected="protwords.txt"/> >> >> <filter class="solr.RemoveDuplicatesTokenFilterFactory"/> >> >> </analyzer> >> >> </fieldType> >> >> </types> >> >> >> >> >> >> <fields> >> >> <field name="id" type="string" indexed="true" stored="true" >> >> required="true" /> >> >> <field name="uid" type="slong" indexed="true" stored="true" >> >> required="true" /> >> >> <field name="box" type="string" indexed="true" stored="true" >> >> required="true" /> >> >> <field name="user" type="string" indexed="true" stored="true" >> >> required="true" /> >> >> >> >> <field name="hdr" type="text" indexed="true" stored="false" /> >> >> <field name="body" type="text" indexed="true" stored="false" /> >> >> >> >> <field name="from" type="text" indexed="true" stored="false" /> >> >> <field name="to" type="text" indexed="true" stored="false" /> >> >> <field name="cc" type="text" indexed="true" stored="false" /> >> >> <field name="bcc" type="text" indexed="true" stored="false" /> >> >> <field name="subject" type="text" indexed="true" stored="false" /> >> >> </fields> >> >> >> >> <uniqueKey>id</uniqueKey> >> >> <defaultSearchField>body</defaultSearchField> >> >> <solrQueryParser defaultOperator="AND" /> >> >> </schema> >> >> >> >> >> >> On Thu, Mar 5, 2015 at 3:48 PM, Leon Kyneur <leon(a)dexterous.org> wrote: >> >> > In your schema.XML check you have defined: >> >> > >> >> > <field name="text" type="text_general" indexed="true" stored="false" >> >> > multiValued="true"/> >> >> > >> >> > On 05/03/2015 7:11 PM, "Kevin Laurie" <superinterstellar(a)gmail.com> >> >> > wrote: >> >> >> >> >> >> Hello, >> >> >> My dovecot constantly runs into this error. >> >> >> I want to fix this one last time, I am tired of troubleshooting so >> >> >> please someone give me a lasting and proper solution for this error. >> >> >> I >> >> >> think its a problem with the dovecot-solr module. >> >> >> >> >> >> Please tell me how do I find the root of this problem with Dovecot. >> >> >> There is a problem with the body search text field. It always >> >> >> fails(with no result), other searches work(ie. search date, subject >> >> >> etc, ) The field-text I believe is missing. Please help. Desperate >> >> >> here! >> >> >> >> >> >> >> >> >> >> >> >> >> >> >> 2/25/2015, 11:32:30 PM ERROR SolrCore >> >> >> org.apache.solr.common. >> >> >> SolrException: undefined field text >> >> >> >> >> >> org.apache.solr.common.SolrException: undefined field text >> >> >> at >> >> >> >> >> >> >> >> >> org.apache.solr.schema.IndexSchema.getDynamicFieldType(IndexSchema.java:1269) >> >> >> at >> >> >> >> >> >> >> >> >> org.apache.solr.schema.IndexSchema$SolrQueryAnalyzer.getWrappedAnalyzer(IndexSchema.java:434) >> >> >> at >> >> >> >> >> >> >> >> >> org.apache.lucene.analysis.DelegatingAnalyzerWrapper$DelegatingReuseStrategy.getReusableComponents(DelegatingAnalyzerWrapper.java:74) >> >> >> at >> >> >> org.apache.lucene.analysis.Analyzer.tokenStream(Analyzer.java:175) >> >> >> at >> >> >> >> >> >> >> >> >> org.apache.lucene.util.QueryBuilder.createFieldQuery(QueryBuilder.java:207) >> >> >> at >> >> >> >> >> >> >> >> >> org.apache.solr.parser.SolrQueryParserBase.newFieldQuery(SolrQueryParserBase.java:374) >> >> >> at >> >> >> >> >> >> >> >> >> org.apache.solr.parser.SolrQueryParserBase.getFieldQuery(SolrQueryParserBase.java:742) >> >> >> at >> >> >> >> >> >> >> >> >> org.apache.solr.parser.SolrQueryParserBase.handleBareTokenQuery(SolrQueryParserBase.java:541) >> >> >> at org.apache.solr.parser.QueryParser.Term(QueryParser.java:299) >> >> >> at org.apache.solr.parser.QueryParser.Clause(QueryParser.java:185) >> >> >> at org.apache.solr.parser.QueryParser.Query(QueryParser.java:107) >> >> >> at >> >> >> >> >> >> org.apache.solr.parser.QueryParser.TopLevelQuery(QueryParser.java:96) >> >> >> at >> >> >> >> >> >> >> >> >> org.apache.solr.parser.SolrQueryParserBase.parse(SolrQueryParserBase.java:151) >> >> >> at org.apache.solr.search.LuceneQParser.parse(LuceneQParser.java:50) >> >> >> at org.apache.solr.search.QParser.getQuery(QParser.java:141) >> >> >> at >> >> >> >> >> >> >> >> >> org.apache.solr.handler.component.QueryComponent.prepare(QueryComponent.java:148) >> >> >> at >> >> >> >> >> >> >> >> >> org.apache.solr.handler.component.SearchHandler.handleRequestBody(SearchHandler.java:197) >> >> >> at >> >> >> >> >> >> >> >> >> org.apache.solr.handler.RequestHandlerBase.handleRequest(RequestHandlerBase.java:135) >> >> >> at org.apache.solr.core.SolrCore.execute(SolrCore.java:1967) >> >> >> at >> >> >> >> >> >> >> >> >> org.apache.solr.core.QuerySenderListener.newSearcher(QuerySenderListener.java:64) >> >> >> at org.apache.solr.core.SolrCore$5.call(SolrCore.java:1739) >> >> >> at java.util.concurrent.FutureTask.run(FutureTask.java:262) >> >> >> at >> >> >> >> >> >> >> >> >> java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1145) >> >> >> at >> >> >> >> >> >> >> >> >> java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:615) >> >> >> at java.lang.Thread.run(Thread.java:745) >> > >> > >> > >> > >> > -- >> > mto > > > > > -- > mto

2 2

Weird sub-folder error
by Christian Theune 05 Mar '15

05 Mar '15

Hi, I’m running dovecot 2.2.13 and I ran into a weird problem. A user migrated his mailboxes by letting users copy them from their old server to the new one through their MUA. All that went fine except for one very weird instance. The user is running Outlook 2010. The user has a sub-folder structure which dovecot places as dotted names beneath the Inbox. (E.g. Maildir/.my.sub.folders). After copying all data, that user came back to us and complained about missing mails in their folders. Apparently 3 of her folders disappeared. I found folders with similar (but different!) names in the dovecot storage but with no mails in them. After a while I noticed that something made dovecot create another level of nesting, like this: Maildir/.My.Folder/Subfolder In this case the Original folder structure was INBOX - My - Folder - Subfolder. When the user visited the subscription settings in her MUA she found the INBOX - My - Folder mailbox which was empty. The Subfolder was nowhere to be found. This appeared weird to me. I moved the Subfolder back directly under the Maildir directory and named it “.My.Folder.Subfolder”. doveadm now lists this folder correctly. I could not find whether this is a known bug - so I’m letting you know. Maybe you can help understand what happened. Sounds like a weird server-side bug to me - this shouldn’t happen, right? Cheers, Christian — Christian Theune · ct(a)flyingcircus.io · +49 345 219401 0 Flying Circus Internet Operations GmbH · http://flyingcircus.io Forsterstraße 29 · 06112 Halle (Saale) · Deutschland HR Stendal HRB 21169 · Geschäftsführer: Christian. Theune, Christian. Zagrodnick

2 4

Dovecot Full Text Search results in SolrException: undefined field text [SERIOUS]
by Kevin Laurie 05 Mar '15

05 Mar '15

Hello, My dovecot constantly runs into this error. I want to fix this one last time, I am tired of troubleshooting so please someone give me a lasting and proper solution for this error. I think its a problem with the dovecot-solr module. Please tell me how do I find the root of this problem with Dovecot. There is a problem with the body search text field. It always fails(with no result), other searches work(ie. search date, subject etc, ) The field-text I believe is missing. Please help. Desperate here! 2/25/2015, 11:32:30 PM ERROR SolrCore org.apache.solr.common. SolrException: undefined field text org.apache.solr.common.SolrException: undefined field text at org.apache.solr.schema.IndexSchema.getDynamicFieldType(IndexSchema.java:1269) at org.apache.solr.schema.IndexSchema$SolrQueryAnalyzer.getWrappedAnalyzer(IndexSchema.java:434) at org.apache.lucene.analysis.DelegatingAnalyzerWrapper$DelegatingReuseStrategy.getReusableComponents(DelegatingAnalyzerWrapper.java:74) at org.apache.lucene.analysis.Analyzer.tokenStream(Analyzer.java:175) at org.apache.lucene.util.QueryBuilder.createFieldQuery(QueryBuilder.java:207) at org.apache.solr.parser.SolrQueryParserBase.newFieldQuery(SolrQueryParserBase.java:374) at org.apache.solr.parser.SolrQueryParserBase.getFieldQuery(SolrQueryParserBase.java:742) at org.apache.solr.parser.SolrQueryParserBase.handleBareTokenQuery(SolrQueryParserBase.java:541) at org.apache.solr.parser.QueryParser.Term(QueryParser.java:299) at org.apache.solr.parser.QueryParser.Clause(QueryParser.java:185) at org.apache.solr.parser.QueryParser.Query(QueryParser.java:107) at org.apache.solr.parser.QueryParser.TopLevelQuery(QueryParser.java:96) at org.apache.solr.parser.SolrQueryParserBase.parse(SolrQueryParserBase.java:151) at org.apache.solr.search.LuceneQParser.parse(LuceneQParser.java:50) at org.apache.solr.search.QParser.getQuery(QParser.java:141) at org.apache.solr.handler.component.QueryComponent.prepare(QueryComponent.java:148) at org.apache.solr.handler.component.SearchHandler.handleRequestBody(SearchHandler.java:197) at org.apache.solr.handler.RequestHandlerBase.handleRequest(RequestHandlerBase.java:135) at org.apache.solr.core.SolrCore.execute(SolrCore.java:1967) at org.apache.solr.core.QuerySenderListener.newSearcher(QuerySenderListener.java:64) at org.apache.solr.core.SolrCore$5.call(SolrCore.java:1739) at java.util.concurrent.FutureTask.run(FutureTask.java:262) at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1145) at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:615) at java.lang.Thread.run(Thread.java:745)

3 3

Re: Re: IP drop list
by Joseph Tam 05 Mar '15

05 Mar '15

Nick Edwards writes: > I thought Timo once said dovecot had tarpitting, its useless if it is > there, and if it is, it needs user configurable timings, or maybe its > one of those things thats been in the gunna happen list > for a long time, like other stuff If I remember correctly, I think this was the "auth_failure_delay" feature. However, these delays are only inserted into the same session -- no IP tracking is done so a BFD attacking host can just keep opening up new connections. Dave McGuire writes: >>>> Please add this support to iptables instead of Dovecot. It's a >>>> waste of effort to code it into every application that listens on >>>> the network. >>> >>> <head explodes> >>> >>> Would you care to integrate it into IOS on my Cisco as well? >>> >>> There are things connected to the Internet that aren't PCs running >>> Linux, you know. It may be hard to accept, but that's the way it is. >>> >> I assume your dovecot runs on some kind of *nix > > Of course. I run it under Solaris. Oddly enough, if you run some versions of Solaris, it uses IPFilter as the native firewall, and it *does* have userland hooks so that you can make pass/block decisions based on userland executable. Not well documented though (see auth rules). You would need a firewall rule like auth in proto tcp from any to any port = 143 flags S/SA keep state then write a program that does ioctl(ipauth) calls to inspect and accept/reject packets; not for the faint of heart. However, you can use whatever weird and wonderful methods you want to determine IMAP/POP/SMTP network access policy, including DNSRBL or parsing a text file. This thread seems to be spinning into non-dovecot subjects, and I'm not helping, so I'll stop. Joseph Tam <jtam.home(a)gmail.com>

1 0

Re: IP drop list
by Joseph Tam 05 Mar '15

05 Mar '15

Dave McGuire writes: >> http://wiki2.dovecot.org/PasswordDatabase/ExtraFields/AllowNets >> >> then setup fail2ban to manage extrafields > > Now that's a very interesting idea, thank you! I will investigate this. If you don't expect yor firewall to handle 45K+ IPs, I'm not how you expect dovecot will handle a comma separated string with 45K+ entries any better. If you want to turn your global backlist into a per-user whitelist, that would be perfectly doable though. Joseph Tam <jtam.home(a)gmail.com>

14 31

Rebuilding SIS attachment links from log
by Daniel Miller 04 Mar '15

04 Mar '15

This seems simple enough...I'm just not script wizard. If someone can throw together a starting point I can test and tweak it from there. It seems to me: 1. Read /var/mail/mail.err or specified logfile 2. For each "failed: read(/var/mail/attachments/aa/bb/attachmentHash-userHash" line, a. Confirm /var/mail/attachments/aa/bb/hashes/attachmentHash exists i. If attachmentHash is missing display such for possible backup searching. b. create link attachmentHash-userHash to hashes/attachmentHash 3. Continue to end of file Can this be done via "pure" BASH? Need sed/awk as well? -- Daniel

3 3

[OT] Extdata / Extprograms Plugins on CentOS 7?
by E.B. 04 Mar '15

04 Mar '15

Hello, I want to install Dovecot Pigeonhole and use the Extdata and Extprograms plugins on CentOS 7. I prefer to install software via yum, and a reasonably new version of Dovecot is available in the CentOS repo. But according to the dovecot documentation, these plugins need to be compiled, so I don't know if yum is out of the question? * Does anyone know if either of these plugins built into the Pigeonhole that is available in the CentOS 7 extras repo? OR if there is a version of Pigeonhole available in a different 3rd party repo with what I want? (like EPEL, DAG, etc) * Is it possible to use these plugins with Pigeonhole installed from yum? Does the compilation requirement mean that I have to remove not only Pigeonhole, but also Dovecot itself from my system and build everything by hand? :-( THANK YOU!!!!!!

1 0

New FREAK SSL Attack CVE-2015-0204
by Adrian Minta 04 Mar '15

04 Mar '15

Hello, about the CVE-2015-0204, in apache the following config seems to disable this vulnerability: SSLProtocol All -SSLv2 -SSLv3 SSLCipherSuite HIGH:MEDIUM:!aNULL:!eNULL:!EXPORT:!CAMELLIA:!DES:!MD5:!PSK:!RC4 Is something similar possible with dovecot ? If yes, what are the implications with old mail clients ? -- Best regards, Adrian Minta

2 4

Re: Rebuilding SIS attachment links from log
by Daniel Miller 04 Mar '15

04 Mar '15

Well, with no guarantees or promises whatsoever...here's my first attempt. I'm certain someone else can come up with a much more robust solution but it's a starting point. Since I typically see a batch of the error messages during an FTS update, my current usage is: 1. doveadm fts rescan -u user-to-fix 2. Perform a fts search to do a full mailbox scan 3. Check the mail log to see the date/time of the errors (I usually have a window open with tail -f) 4. Something like "grep 'Mar 3 20:17' mail.log > mail.err" gives me a starting point execute dovesisfix and see if it helps. -- Daniel On 3/3/2015 1:08 PM, Daniel Miller wrote: > This seems simple enough...I'm just not script wizard. If someone can > throw together a starting point I can test and tweak it from there. > It seems to me: > > 1. Read /var/mail/mail.err or specified logfile > 2. For each "failed: > read(/var/mail/attachments/aa/bb/attachmentHash-userHash" line, > a. Confirm /var/mail/attachments/aa/bb/hashes/attachmentHash exists > i. If attachmentHash is missing display such for possible > backup searching. > b. create link attachmentHash-userHash to hashes/attachmentHash > 3. Continue to end of file > > Can this be done via "pure" BASH? Need sed/awk as well? >

1 0

ot: maildir has overdrawn his diskspace quota
by voytek＠sbt.net.au 04 Mar '15

04 Mar '15

I have Postfix/Dovecot with virtual domains, same setup unaltered since server was set up quite a while ago last month, added a new virtual domain, 'just like before'. but, today noticed this in the queue/log 'overdrawn his diskspace quota'[1]: user's Maildir cur has like 48,762,696 bytes (lot less than other users) tried some searches, found similar probs, but, no solution as yet any ideas ? after physically removing some emails from this user's 'cur', I re-queued 'stuck' message, it was then accepted # quota -g vmail # quota -u vmail # [1] # grep 719855FC42 /var/log/maillog Mar 3 15:20:58 emu postfix/smtpd[18535]: 719855FC42: client=mail-pa0-f51.google.com[209.85.220.51] Mar 3 15:20:58 emu postfix/cleanup[18631]: 719855FC42: message-id=<54f536ad.21da440a.6572.3c07(a)mx.google.com> Mar 3 15:21:01 emu postfix/qmgr[1906]: 719855FC42: from=<dsome1(a)gmail.com>, size=5487190, nrcpt=1 (queue active) Mar 3 15:21:01 emu postfix/virtual[20248]: 719855FC42: to=<anna(a)tld.com>, relay=virtual, delay=3.5, delays=3.4/0/0/0.08, dsn=4.2.2, status=deferred (maildir delivery failed: Sorry, the user's maildir has overdrawn his diskspace quota, please try again later.) Mar 3 15:27:53 emu postfix/qmgr[1906]: 719855FC42: from=<dsome1(a)gmail.com>, size=5487190, nrcpt=1 (queue active) Mar 3 15:27:53 emu postfix/virtual[23352]: 719855FC42: to=<anna(a)tld.com>, relay=virtual, delay=415, delays=415/0.01/0/0.07, dsn=4.2.2, status=deferred (maildir delivery failed: Sorry, the user's maildir has overdrawn his diskspace quota, please try again later.)

1 0

Re: IP drop list
by Joseph Tam 03 Mar '15

03 Mar '15

Dave McGuire writes: >>>> then setup fail2ban to manage extrafields >>> >>> Now that's a very interesting idea, thank you! I will investigate this. >> >> If you don't expect yor firewall to handle 45K+ IPs, I'm not how you >> expect dovecot will handle a comma separated string with 45K+ entries >> any better. > > My firewall can handle that without breaking a sweat. I just haven't > found a way (that I'm comfortable with) to automatically inject rules > into it from a machine on the network. > > Doing it via a DNSBL is an elegant solution to the problem, IMO. I'm agnostic as far as which method you want to use. All I'm saying is that using dovecot's allow_net facility is as difficult, if not more so, than letting your firewall handle it. Joseph Tam <jtam.home(a)gmail.com>

4 3

Connect failed to database
by Dan LaSota 03 Mar '15

03 Mar '15

I have dovecot version 2.2.10 dovecot -n output below I am seeing connection errors being written to my dovecot error log: Mar 1 19:51:15 mail dovecot: auth-worker(2224): Error: mysql(localhost): Connect failed to database (servermail): Access denied for user 'usermail'@'localhost' (using password: YES) - waiting for 5 seconds before retry My connection script located at /etc/dovecot/dovecot-sql.conf.ext is like (password edited): driver = mysql connect = host=localhost dbname=servermail user='usermail' password='MY_SUPER_SECRET_PASSWORD' default_pass_scheme = SHA512-CRYPT password_query = SELECT email as user, password FROM virtual_users WHERE email='%u'; I have verified that I can gain access to the SQL database with # mysql -u usermail -p I can make select statements on the 'servermail' database and all of its tables. I've searched for similar errors from users, but most of the questions are unanswered, or answered incorrectly. I did follow one thread's suggest of setting the MYSQL password for the 'usermail' with OLD_PASSWORD instead of PASSWORD. I did that. I could still login from the shell using mysql -u usermail -p But dovecot still wrote the same error. (I did a flush privileges, and restarted mysql, and dovecot) I then set the password in SQL back using PASSWORD. (flush'd priveleges and restarte mysql and dovecot). Still Errors. Looking for leads. Thanks, Dan LaSota Instructional Designer, UAF eLearning (907) 451-4067 dan.lasota(a)alaska.edu http://elearning.uaf.edu dovecot -n # 2.2.10: /etc/dovecot/dovecot.conf # OS: Linux 3.10.0-123.20.1.el7.x86_64 x86_64 CentOS Linux release 7.0.1406 (Core) xfs auth_debug = yes auth_mechanisms = plain login auth_verbose = yes auth_verbose_passwords = plain mail_debug = yes mail_location = maildir:/var/mail/vhosts/%d/%n mail_privileged_group = mail mbox_write_locks = fcntl namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } passdb { args = /etc/dovecot/dovecot-sql.conf.ext driver = sql } protocols = imap lmtp service auth-worker { user = vmail } service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0666 user = postfix } unix_listener auth-userdb { mode = 0600 user = vmail } user = dovecot } service imap-login { inet_listener imap { port = 0 } } service lmtp { unix_listener /var/spool/postfix/private/dovecot-lmtp { group = postfix mode = 0600 user = postfix } } ssl = required ssl_cert = </etc/ssl/certs/dovecot.pem ssl_key = </etc/ssl/private/dovecot.pem userdb { args = uid=vmail gid=vmail home=/var/mail/vhosts/%d/%n driver = static } verbose_ssl = yes

4 9

problem with dovecot/lmtp
by Dan LaSota 03 Mar '15

03 Mar '15

I am getting this in my errorlog for postfix/dovecot Mar 2 16:42:14 mail postfix/error[5074]: A689580F236: to=<root(a)mail.example.com>, relay=none, delay=21420, delays=21420/0.05/0/0, dsn=4.4.1, status=deferred (delivery temporarily suspended: connect to mail.example.com[private/dovecot-lmtp]: Connection refused) From my reading, I believe this has something to do with virtual_transport which I have set to: virtual_transport = lmtp:unix:private/dovecot-lmtp The socket file, exists: [root@mail ~]# ls -l /var/spool/postfix/private/dovecot-lmtp srw-------. 1 postfix postfix 0 Mar 2 09:14 /var/spool/postfix/private/dovecot-lmtp But I'm a little stumped as how to proceed. The only thing I think I understand is that postfix is trying to talk to dovecot-lmtp and dovecot-lmtp is refusing the connection. Am I reading that correct? What can I do about it? Thanks, Dan LaSota Instructional Designer, UAF eLearning (907) 451-4067 dan.lasota(a)alaska.edu http://elearning.uaf.edu

1 0

Quota and ldap
by Jean-François Sénéchal 02 Mar '15

02 Mar '15

Hello I try to install quota per usr, everything seems fine but the quota is not working Dovecot : 2.2.13 dovecot-ldap.conf.ext user_attrs = homeDirectory=home,uidNumber=uid,gidNumber=gid,gosaMailQuota=quota_rule=*:bytes=%$ 10-mail.conf mail_location = maildir:~/Maildir:LAYOUT=fs mail_plugins = $mail_plugins quota /10-master.conf service lmtp { unix_listener /var/spool/postfix/private/dovecot-lmtp { group = postfix mode = 0600 user = postfix } 20-imapd.conf protocol imap { mail_plugins = $mail_plugins imap_quota } 20-lmtp.conf protocol lmtp { mail_plugins = $mail_plugins quota } 90-quota.conf plugin { quota_rule = *:storage=150M quota_rule2 = Trash:storage=+100M quota_grace = 10%% } plugin { quota = maildir:User quota } Command doveadm quota recalc return nothing (no error) My log Mar 2 11:41:58 domaine dovecot: imap-login: Login: user=<siroco>, method=PLAIN, rip=::1, lip=::1, mpid=3695, secured, session=<X+Yi3ksQdAAAAAAAAAAAAAAAAAAAAAAB> Mar 2 11:41:58 domaine dovecot: imap: Debug: Loading modules from directory: /usr/lib/dovecot/modules Mar 2 11:41:58 domaine dovecot: imap: Debug: Module loaded: /usr/lib/dovecot/modules/lib10_quota_plugin.so Mar 2 11:41:58 domaine dovecot: imap: Debug: Module loaded: /usr/lib/dovecot/modules/lib11_imap_quota_plugin.so Mar 2 11:41:58 domaine dovecot: imap: Debug: Added userdb setting: plugin/quota_rule=*:bytes=0 Mar 2 11:41:58 domaine dovecot: imap(siroco): Debug: Effective uid=5000, gid=5000, home=/var/spool/dovecot/mail/s/siroco Mar 2 11:41:58 domaine dovecot: imap(siroco): Debug: Quota root: name=User quota backend=maildir args= Mar 2 11:41:58 domaine dovecot: imap(siroco): Debug: Quota rule: root=User quota mailbox=* bytes=0 messages=0 Mar 2 11:41:58 domaine dovecot: imap(siroco): Debug: Quota rule: root=User quota mailbox=Trash bytes=+104857600 messages=0 Mar 2 11:41:58 domaine dovecot: imap(siroco): Debug: Quota grace: root=User quota bytes=0 (10%) Mar 2 11:41:58 domaine dovecot: imap(siroco): Debug: Namespace inbox: type=private, prefix=, sep=, inbox=yes, hidden=no, list=yes, subscriptions=yes location=maildir:~/Maildir:LAYOUT=fs Mar 2 11:41:58 domaine dovecot: imap(siroco): Debug: fs: root=/var/spool/dovecot/mail/s/siroco/Maildir, index=, indexpvt=, control=, inbox=/var/spool/dovecot/mail/s/siroco/Maildir,

3 11

Postfix - dovecot-lda -> Permission denied
by Wöltje, Marcus 02 Mar '15

02 Mar '15

Hi erveryone! I'm trying to run Postix and Dovecot on a Mac OS X, but somehow, it doesn't work. I probably messed up the privileges or something else. Hopefully someone of you, can help me figure it out. So far, Postfix is delivering the mail into ~/Maildir. But as soon as I add the line: mailbox_command = /Applications/Server.app/Contents/ServerRoot/usr/libexec/dovecot/dovecot-lda in /etc/postfix/main.cf I get the following entry in the mail.log. Feb 27 16:08:02 Nils-iMac.local local[53237]: fatal: execvp /Applications/Server.app/Contents/ServerRoot/usr/libexec/dovecot/dovecot-lda: Permission denied Feb 27 16:08:02 Nils-iMac.local postfix/local[53236]: B246837BE40: to=<marc(a)localhost.local>, orig_to=<marc@localhost>, relay=local, delay=1185, delays=1185/0.01/0/0.01, dsn=4.3.0, status=deferred (temporary failure. Command output: local: fatal: execvp /Applications/Server.app/Contents/ServerRoot/usr/libexec/dovecot/dovecot-lda: Permission denied ) Here are the rights of dovecot-lda: -rwxrwx--- 1 root certusers 32144 Dec 5 04:41 /Applications/Server.app/Contents/ServerRoot/usr/libexec/dovecot/dovecot-lda Hope someone has an Idea. :) Bye, Marcus In case you need my doveconf: dsync_alt_char = _ dsync_remote_cmd = ssh -l%{login} %{host} doveadm dsync-server -u%u -U first_valid_gid = 6 first_valid_uid = 6 hostname = imap_capability = imap_client_workarounds = imap_id_log = * imap_id_send = "name" * "version" * imap_idle_notify_interval = 2 mins imap_logout_format = in=%i out=%o imap_max_line_length = 64 k imap_urlauth_host = imap_urlauth_logout_format = in=%i out=%o imap_urlauth_port = 143 imap_urlauth_submit_user = submit imapc_features = imapc_host = imapc_list_prefix = imapc_master_user = imapc_max_idle_time = 29 mins imapc_password = imapc_port = 143 imapc_rawlog_dir = imapc_ssl = no imapc_ssl_verify = yes imapc_user = import_environment = TZ info_log_path = /Library/Logs/Mail/mail-info.log instance_name = dovecot last_valid_gid = 0 last_valid_uid = 0 lda_mailbox_autocreate = no lda_mailbox_autosubscribe = no lda_mailbox_listid_autosave = no lda_original_recipient_header = libexec_dir = /Applications/Server.app/Contents/ServerRoot/usr/libexec/dovecot listen = *, :: lmtp_address_translate = lmtp_proxy = no lmtp_rcpt_check_quota = no lmtp_save_to_detail_mailbox = no lock_method = fcntl log_path = /Library/Logs/Mail/mail-err.log log_timestamp = "%b %d %H:%M:%S " login_access_sockets = login_greeting = Dovecot ready. login_log_format = %$: %s login_log_format_elements = user=<%u> method=%m rip=%r lip=%l mpid=%e %c login_trusted_networks = mail_access_groups = mail mail_always_cache_fields = mail_attachment_dir = mail_attachment_fs = sis posix mail_attachment_hash = %{sha1} mail_attachment_min_size = 128 k mail_attribute_dict = file:/Library/Server/Mail/Data/attributes/attributes.dict mail_cache_fields = flags mail_cache_min_mail_count = 0 mail_chroot = mail_debug = no mail_fsync = optimized mail_full_filesystem_access = no mail_gid = certusers mail_home = mail_location = maildir:~/Maildir:INBOX=~/Maildir mail_log_prefix = "%s(pid %p user %u): " mail_max_bad_commands = 20 mail_max_keyword_length = 50 mail_max_lock_timeout = 0 mail_max_userip_connections = 10 mail_never_cache_fields = imap.envelope mail_nfs_index = no mail_nfs_storage = no mail_plugin_dir = /Applications/Server.app/Contents/ServerRoot/usr/lib/dovecot mail_plugins = quota zlib acl fts fts_sk mail_prefetch_count = 0 mail_privileged_group = mail mail_save_crlf = no mail_shared_explicit_inbox = no mail_temp_dir = /tmp mail_temp_scan_interval = 1 weeks mail_uid = mailbox_idle_check_interval = 30 secs mailbox_list_index = no maildir_broken_filename_sizes = no maildir_copy_with_hardlinks = yes maildir_stat_dirs = no maildir_very_dirty_syncs = no managesieve_client_workarounds = managesieve_implementation_string = Dovecot Pigeonhole managesieve_logout_format = bytes=%i/%o managesieve_max_compile_errors = 5 managesieve_max_line_length = 65536 managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date ihave master_user_separator = mbox_dirty_syncs = yes mbox_dotlock_change_timeout = 2 mins mbox_lazy_writes = yes mbox_lock_timeout = 5 mins mbox_md5 = apop3d mbox_min_index_size = 0 mbox_read_locks = fcntl mbox_very_dirty_syncs = no mbox_write_locks = dotlock fcntl mdbox_preallocate_space = no mdbox_rotate_interval = 0 mdbox_rotate_size = 200 M mmap_disable = no namespace acl-mailboxes { disabled = no hidden = no ignore_on_failure = no inbox = no list = children location = maildir:/Users/%u/Maildir:INDEX=/Users%u/Maildi/shared/%%u prefix = shared.%%u. separator = . subscriptions = no type = shared } namespace inbox { disabled = no hidden = no ignore_on_failure = no inbox = yes list = yes location = mailbox Drafts { auto = no driver = special_use = \Drafts } mailbox Junk { auto = no driver = special_use = \Junk } mailbox Sent { auto = no driver = special_use = \Sent } mailbox "Sent Messages" { auto = no driver = special_use = \Sent } mailbox Trash { auto = no driver = special_use = \Trash } prefix = separator = subscriptions = yes type = private } namespace list-archives { disabled = no hidden = no ignore_on_failure = no inbox = no list = children location = maildir:/Library/Server/Mail/Data/listserver/messages/archive/lists/%%u:INDEX=/Library/Server/Mail/Data/listserver/messages/archive/shared/%%u prefix = archives.%%u. separator = . subscriptions = no type = shared } passdb { args = default_fields = deny = no driver = od master = no override_fields = pass = no result_failure = continue result_internalfail = continue result_success = return-ok skip = never } passdb { args = /Library/Server/Mail/Config/dovecot/submit.passdb default_fields = deny = no driver = passwd-file master = no override_fields = pass = no result_failure = continue result_internalfail = continue result_success = return-ok skip = never } plugin { acl = vfile:/Library/Server/Mail/Config/dovecot/global-acls:cache_secs=300 acl_shared_dict = file:/Library/Server/Mail/Data/shared/shared-mailboxes fts = sk quota = maildir:User quota quota_warning = storage=100%% quota-exceeded %u sieve = /Library/Server/Mail/Data/rules/%u/dovecot.sieve sieve_dir = /Library/Server/Mail/Data/rules/%u stats_refresh = 30 secs stats_track_cmds = yes } pop3_client_workarounds = pop3_deleted_flag = pop3_enable_last = no pop3_fast_size_lookups = no pop3_lock_session = no pop3_logout_format = top=%t/%p, retr=%r/%b, del=%d/%m, size=%s pop3_no_flag_updates = no pop3_reuse_xuidl = no pop3_save_uidl = no pop3_uidl_duplicates = allow pop3_uidl_format = %08Xu%08Xv pop3c_host = pop3c_master_user = pop3c_password = pop3c_port = 110 pop3c_rawlog_dir = pop3c_ssl = no pop3c_ssl_verify = yes pop3c_user = %u postmaster_address = postmaster@localhost protocols = imap pop3 lmtp sieve quota_full_tempfail = yes recipient_delimiter = + rejection_reason = Your message to <%t> was automatically rejected:%n%r rejection_subject = Rejected: %s replication_full_sync_interval = 1 days replication_max_conns = 10 replicator_host = replicator replicator_port = 0 sendmail_path = /usr/sbin/sendmail service aggregator { chroot = . client_limit = 0 drop_priv_before_exec = no executable = aggregator extra_groups = fifo_listener replication-notify-fifo { group = mode = 0600 user = } group = idle_kill = 0 privileged_group = process_limit = 0 process_min_avail = 0 protocol = service_count = 0 type = unix_listener replication-notify { group = mode = 0600 user = } user = $default_internal_user vsz_limit = 18446744073709551615 B } service anvil { chroot = empty client_limit = 0 drop_priv_before_exec = no executable = anvil extra_groups = group = idle_kill = 4294967295 secs privileged_group = process_limit = 1 process_min_avail = 1 protocol = service_count = 0 type = anvil unix_listener anvil-auth-penalty { group = mode = 0600 user = } unix_listener anvil { group = mode = 0600 user = } user = $default_internal_user vsz_limit = 18446744073709551615 B } service auth-worker { chroot = client_limit = 1 drop_priv_before_exec = no executable = auth -w extra_groups = group = idle_kill = 0 privileged_group = process_limit = 0 process_min_avail = 0 protocol = service_count = 1 type = unix_listener auth-worker { group = mode = 0600 user = $default_internal_user } user = vsz_limit = 18446744073709551615 B } service auth { chroot = client_limit = 0 drop_priv_before_exec = no executable = auth extra_groups = _keytabusers group = idle_kill = 15 mins privileged_group = process_limit = 1 process_min_avail = 0 protocol = service_count = 0 type = unix_listener auth-client { group = mode = 0600 user = } unix_listener auth-login { group = mode = 0600 user = $default_internal_user } unix_listener auth-master { group = mode = 0600 user = } unix_listener auth-userdb { group = mode = 0666 user = _dovecot } unix_listener login/login { group = mode = 0666 user = } unix_listener token-login/tokenlogin { group = mode = 0666 user = } user = $default_internal_user vsz_limit = 18446744073709551615 B } service config { chroot = client_limit = 0 drop_priv_before_exec = no executable = config extra_groups = group = idle_kill = 0 privileged_group = process_limit = 0 process_min_avail = 0 protocol = service_count = 0 type = config unix_listener config { group = mode = 0600 user = } user = vsz_limit = 18446744073709551615 B } service dict { chroot = client_limit = 1 drop_priv_before_exec = no executable = dict extra_groups = group = idle_kill = 0 privileged_group = process_limit = 0 process_min_avail = 0 protocol = service_count = 0 type = unix_listener dict { group = mode = 0600 user = } user = $default_internal_user vsz_limit = 18446744073709551615 B } service director { chroot = . client_limit = 0 drop_priv_before_exec = no executable = director extra_groups = fifo_listener login/proxy-notify { group = mode = 00 user = } group = idle_kill = 4294967295 secs inet_listener { address = port = 0 ssl = no } privileged_group = process_limit = 1 process_min_avail = 0 protocol = service_count = 0 type = unix_listener director-admin { group = mode = 0600 user = } unix_listener director-userdb { group = mode = 0600 user = } unix_listener login/director { group = mode = 00 user = } user = $default_internal_user vsz_limit = 18446744073709551615 B } service dns_client { chroot = client_limit = 1 drop_priv_before_exec = no executable = dns-client extra_groups = group = idle_kill = 0 privileged_group = process_limit = 0 process_min_avail = 0 protocol = service_count = 0 type = unix_listener dns-client { group = mode = 0600 user = } user = $default_internal_user vsz_limit = 18446744073709551615 B } service doveadm { chroot = client_limit = 1 drop_priv_before_exec = no executable = doveadm-server extra_groups = group = idle_kill = 0 privileged_group = process_limit = 0 process_min_avail = 0 protocol = service_count = 1 type = unix_listener doveadm-server { group = mode = 0600 user = } user = vsz_limit = 18446744073709551615 B } service imap-login { chroot = login client_limit = 0 drop_priv_before_exec = no executable = imap-login extra_groups = group = idle_kill = 0 inet_listener imap { address = port = 143 ssl = no } inet_listener imaps { address = port = 993 ssl = yes } privileged_group = process_limit = 0 process_min_avail = 0 protocol = imap service_count = 0 type = login user = $default_login_user vsz_limit = 18446744073709551615 B } service imap-urlauth-login { chroot = token-login client_limit = 0 drop_priv_before_exec = no executable = imap-urlauth-login extra_groups = group = idle_kill = 0 privileged_group = process_limit = 0 process_min_avail = 0 protocol = imap service_count = 1 type = login unix_listener imap-urlauth { group = mode = 0666 user = } user = $default_login_user vsz_limit = 18446744073709551615 B } service imap-urlauth-worker { chroot = client_limit = 1 drop_priv_before_exec = no executable = imap-urlauth-worker extra_groups = group = idle_kill = 0 privileged_group = process_limit = 1024 process_min_avail = 0 protocol = imap service_count = 1 type = unix_listener imap-urlauth-worker { group = mode = 0600 user = $default_internal_user } user = vsz_limit = 18446744073709551615 B } service imap-urlauth { chroot = client_limit = 1 drop_priv_before_exec = no executable = imap-urlauth extra_groups = group = idle_kill = 0 privileged_group = process_limit = 1024 process_min_avail = 0 protocol = imap service_count = 1 type = unix_listener token-login/imap-urlauth { group = mode = 0666 user = } user = $default_internal_user vsz_limit = 18446744073709551615 B } service imap { chroot = client_limit = 5 drop_priv_before_exec = no executable = imap extra_groups = group = idle_kill = 0 privileged_group = process_limit = 200 process_min_avail = 0 protocol = imap service_count = 0 type = unix_listener login/imap { group = mode = 0666 user = } user = vsz_limit = 18446744073709551615 B } service indexer-worker { chroot = client_limit = 1 drop_priv_before_exec = no executable = indexer-worker extra_groups = group = idle_kill = 0 privileged_group = process_limit = 10 process_min_avail = 0 protocol = service_count = 0 type = unix_listener indexer-worker { group = mode = 0600 user = $default_internal_user } user = _dovecot vsz_limit = 18446744073709551615 B } service indexer { chroot = client_limit = 0 drop_priv_before_exec = no executable = indexer extra_groups = group = idle_kill = 0 privileged_group = process_limit = 1 process_min_avail = 0 protocol = service_count = 0 type = unix_listener indexer { group = mode = 0666 user = } user = $default_internal_user vsz_limit = 18446744073709551615 B } service ipc { chroot = empty client_limit = 0 drop_priv_before_exec = no executable = ipc extra_groups = group = idle_kill = 0 privileged_group = process_limit = 1 process_min_avail = 0 protocol = service_count = 0 type = unix_listener ipc { group = mode = 0600 user = } unix_listener login/ipc-proxy { group = mode = 0600 user = $default_login_user } user = $default_internal_user vsz_limit = 18446744073709551615 B } service lmtp { chroot = client_limit = 1 drop_priv_before_exec = no executable = lmtp extra_groups = group = idle_kill = 0 privileged_group = process_limit = 0 process_min_avail = 0 protocol = lmtp service_count = 0 type = unix_listener lmtp { group = mode = 0600 user = } user = vsz_limit = 18446744073709551615 B } service log { chroot = client_limit = 0 drop_priv_before_exec = no executable = log extra_groups = group = idle_kill = 4294967295 secs privileged_group = process_limit = 1 process_min_avail = 0 protocol = service_count = 0 type = log unix_listener log-errors { group = mode = 0600 user = } user = vsz_limit = 18446744073709551615 B } service managesieve-login { chroot = login client_limit = 0 drop_priv_before_exec = no executable = managesieve-login extra_groups = group = idle_kill = 0 inet_listener sieve { address = port = 4190 ssl = no } privileged_group = process_limit = 0 process_min_avail = 0 protocol = sieve service_count = 1 type = login user = $default_login_user vsz_limit = 18446744073709551615 B } service managesieve { chroot = client_limit = 1 drop_priv_before_exec = no executable = managesieve extra_groups = group = idle_kill = 0 privileged_group = process_limit = 0 process_min_avail = 0 protocol = sieve service_count = 1 type = unix_listener login/sieve { group = mode = 0666 user = } user = vsz_limit = 18446744073709551615 B } service pop3-login { chroot = login client_limit = 0 drop_priv_before_exec = no executable = pop3-login extra_groups = group = idle_kill = 0 inet_listener pop3 { address = port = 110 ssl = no } inet_listener pop3s { address = port = 995 ssl = yes } privileged_group = process_limit = 0 process_min_avail = 0 protocol = pop3 service_count = 1 type = login user = $default_login_user vsz_limit = 18446744073709551615 B } service pop3 { chroot = client_limit = 5 drop_priv_before_exec = no executable = pop3 extra_groups = group = idle_kill = 0 privileged_group = process_limit = 200 process_min_avail = 0 protocol = pop3 service_count = 0 type = unix_listener login/pop3 { group = mode = 0666 user = } user = vsz_limit = 18446744073709551615 B } service quota-exceeded { chroot = client_limit = 0 drop_priv_before_exec = no executable = script /Applications/Server.app/Contents/ServerRoot/usr/libexec/dovecot/quota-exceeded.sh extra_groups = group = idle_kill = 0 privileged_group = process_limit = 0 process_min_avail = 0 protocol = service_count = 0 type = unix_listener quota-exceeded { group = mail mode = 0660 user = _dovecot } user = _dovecot vsz_limit = 18446744073709551615 B } service quota-warning { chroot = client_limit = 0 drop_priv_before_exec = no executable = script /Applications/Server.app/Contents/ServerRoot/usr/libexec/dovecot/quota-warning.sh extra_groups = group = idle_kill = 0 privileged_group = process_limit = 0 process_min_avail = 0 protocol = service_count = 0 type = unix_listener quota-warning { group = mail mode = 0660 user = _dovecot } user = _dovecot vsz_limit = 18446744073709551615 B } service replicator { chroot = client_limit = 0 drop_priv_before_exec = no executable = replicator extra_groups = group = idle_kill = 4294967295 secs privileged_group = process_limit = 1 process_min_avail = 0 protocol = service_count = 0 type = unix_listener replicator-doveadm { group = mode = 00 user = $default_internal_user } unix_listener replicator { group = mode = 0600 user = $default_internal_user } user = vsz_limit = 18446744073709551615 B } service ssl-params { chroot = client_limit = 0 drop_priv_before_exec = no executable = ssl-params extra_groups = group = idle_kill = 0 privileged_group = process_limit = 0 process_min_avail = 0 protocol = service_count = 0 type = startup unix_listener login/ssl-params { group = mode = 0666 user = } unix_listener ssl-params { group = mode = 0666 user = } user = vsz_limit = 18446744073709551615 B } service stats { chroot = empty client_limit = 0 drop_priv_before_exec = no executable = stats extra_groups = fifo_listener stats-mail { group = mode = 0600 user = _dovecot } group = idle_kill = 4294967295 secs privileged_group = process_limit = 1 process_min_avail = 0 protocol = service_count = 0 type = unix_listener stats { group = mode = 0600 user = } user = $default_internal_user vsz_limit = 18446744073709551615 B } # 2.2.5: /Library/Server/Mail/Config/dovecot/dovecot.conf # OS: Darwin 14.1.0 x86_64 # NOTE: Send doveconf -n output instead when asking for help. aps_topic = auth_anonymous_username = anonymous auth_cache_negative_ttl = 1 hours auth_cache_size = 0 auth_cache_ttl = 1 hours auth_debug = no auth_debug_passwords = no auth_default_realm = auth_failure_delay = 2 secs auth_gssapi_hostname = $ALL auth_krb5_keytab = auth_master_user_separator = auth_mechanisms = plain login apop digest-md5 gssapi auth_proxy_self = auth_realms = LAPPENBUSCH auth_socket_path = /var/run/dovecot/auth-userdb auth_ssl_require_client_cert = no auth_ssl_username_from_cert = no auth_use_winbind = no auth_username_chars = abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ01234567890.-_@ auth_username_format = %n auth_username_translation = auth_verbose = no auth_verbose_passwords = no auth_winbind_helper_path = /usr/bin/ntlm_auth auth_worker_max_count = 30 base_dir = /var/run/dovecot config_cache_size = 1 M debug_log_path = /Library/Logs/Mail/mail-debug.log default_client_limit = 1000 default_idle_kill = 1 mins default_internal_user = _dovecot default_login_user = _dovenull default_process_limit = 100 default_vsz_limit = 256 M deliver_log_format = msgid=%m: %$ dict_db_config = director_doveadm_port = 0 director_mail_servers = director_servers = director_user_expire = 15 mins director_username_hash = %u disable_plaintext_auth = no dotlock_use_excl = yes doveadm_allowed_commands = doveadm_password = doveadm_port = 0 doveadm_socket_path = doveadm-server doveadm_worker_count = 0 dsync_alt_char = _ dsync_remote_cmd = ssh -l%{login} %{host} doveadm dsync-server -u%u -U first_valid_gid = 6 first_valid_uid = 6 hostname = imap_capability = imap_client_workarounds = imap_id_log = *

3 2

Re: Dovecot & LDAP Take #2: Authentication failed and logging
by Paolo Cravero 02 Mar '15

02 Mar '15

This is the user DN: > cn=Klara Fall,ou=People,dc=[domainname],dc=de According to your Dovecot configuration > auth_bind_userdn = cn=%u,ou=People,dc=**[domainname]**,dc=de if you login with "klarafall" it will be expanded into cn=klarafall,ou=People,dc=[domainname],dc=de which is not the correct DN for Mrs Klara. So if you login with "Klara Fall" it should work, but that will probably mess up the things on Dovecot filesystem. I am strongly against setting a static DN when dealing with LDAP authentication. LDAP servers are optimized to serve search requests, so let yours do the job. Allow Dovecot to lookup the correct DN based on the attribute you supply (uid) and then authenticate. This should be achieved if you comment out the auth_bind_userdn line. Paolo Cravero

3 2

mdbox attachment errors
by Daniel Miller 02 Mar '15

02 Mar '15

Getting some errors like: Feb 26 12:19:43 bubba dovecot: imap(dmiller(a)amfes.com): Error: read(attachments-connector(/var/mail/amfes.com/dmiller/mdbox/storage/m.7089… failed: read(/var/mail/attachments/f6/f4/f6f4f3b882bf3488af632389d4aaba8adc332b12-60ab750a1aa4b554da1600009db5accb[base64:18 b/l]) failed: open(/var/mail/attachments/f6/f4/f6f4f3b882bf3488af632389d4aaba8adc332b12-60ab750a1aa4b554da1600009db5accb) failed: No such file or directory (uid=19555, box=Sent) Feb 26 12:19:43 bubba dovecot: imap(dmiller(a)amfes.com): Disconnected: Internal error occurred. Refer to server log for more information. [2015-02-26 12:19:43] in=159 out=1003 Browsing to the ../attachments/f6/f4 folder, I find no files but a "hashes" folder, which has a f6f4f3b882bf3488af632389d4aaba8adc332b12 file of size that feels appropriate for the expected PDF attachment. -- Daniel

3 2

userdb passwd-file default_fields uid not expanding %variable
by Tim Jones 02 Mar '15

02 Mar '15

Hi all, I'm trying to set up a very simple shared mail server, where each 'domain' is a system user, i.e. 'example.com' is a real user with /home/example.com/, a uid of 5001 (and gid 'example.com' of 5001). Each domain\user has their own maildir inside their home, and a plain passwd-file with the virtual mail users associated with that domain. Version & config info: # dovecot -n # 2.2.13: /etc/dovecot/dovecot.conf # OS: Linux 3.2.0-4-amd64 x86_64 Debian 7.8 auth_mechanisms = plain login auth_verbose = yes disable_plaintext_auth = no mail_location = mbox:~/mail:INBOX=/var/mail/%u namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } passdb { args = username_format=%n /home/%d/mail_users driver = passwd-file } protocols = " imap lmtp pop3" ssl = no userdb { args = username_format=%n /home/%d/mail_users default_fields = uid=%d gid=%d home=/home/%d/mail/%n mail=maildir:/home/%d/mail/%n driver = passwd-file } Every time I try to authenticate via imap, I get the error > <timestamp> <host> dovecot: auth: Fatal: passwd-file userdb: Invalid uid: %d If I put fixed a uid and gid in the userdb default_fields line: > default_fields = uid=example.com gid=example.com home=/home/%d/mail/%n mail=maildir:/home/%d/mail/%n authentication passes without a problem, but of course, only for users of example.com. Checking the wiki (http://wiki2.dovecot.org/UserDatabase#Userdb_settings) clearly states that the default_fields values support %variables, so I'm not sure if I'm missing some other config required for this to work. Many thanks in advance, Tim Jones Software Development +34 612345678 C/ Quintanavides 15, Edificio 2, Planta 1ª Parque Empresarial Vía Norte de Metrovacesa Las Tablas 28050 Madrid Skype: tim.jones.fon All information in this email is confidential

2 3

Require certificate for external clients
by Karol Babioch 02 Mar '15

02 Mar '15

Hi list, I'm currently looking into ways of making use of client certificates. I want to force external clients (i.e. anything outside the local subnet) to use client certificates. It is my understanding that this in itself can be achieved with the "ssl_require_client_cert" setting. However, I also want local clients (i.e. anything from a specific subnet) to be able to authenticate by the usual means (i.e. password-based). As far as I know dovecot is not able to operate on multiple ports, as stated in the FAQ [1]. The redirect approach, which is also mentioned there, is of no help to me, because in my case I would need a different setup on both ports. Other suggestions [2] won't work in my case either. I probably could get away with using "imaps" for external clients, while using "imap" (without SSL) for internal ones. Having said this, I don't quite like the idea, especially since the traffic might pass through some potentially unsecure networks and I don't want to bother with VPN/SSH tunnels for that purpose. A native SSL/TLS solution would be very much appreciated. Is there a (recommended) way to do this? Thanks in advance. Best regards, Karol Babioch [1]: http://wiki.dovecot.org/QuestionsAndAnswers#Is_it_possible_to_have_Dovecot_… [2]: http://www.dovecot.org/list/dovecot/2010-November/054804.html

3 2

Re: Require certificate for external clients
by Joseph Tam 02 Mar '15

02 Mar '15

Karol Babioch <karol(a)babioch.de> writes: >> You can share libraries, binaries, >> log files, but use separate configuration files, specifying different >> ports/addresses/ssl-configs/auth/access parameters. Then you can fire >> them both up >> >> dovecot -c /dovecot/etc/dovecot-1.conf >> dovecot -c /dovecot/etc/dovecot-2.conf > > I will have to look into it. I'm afraid that I would have to fiddle > around with the default unit files. What are "unit files"? > Also I'm not completely sure how this would work with all of the > configuration files that have been split off into small chunks and get > included at some point. This is probably going to be messy rather > quickly :'(. I don't see why it would be messy. If the conf.d/* are the same, you can use the same config directory. If they differ, you can can copy those files to another config directory (e.g. conf-d/* -> conf-2.d/), modify the snippets that differ, then include this alternate set of configurations !include conf-2.d/* > Thanks for your suggestion. You're welcome. Joseph Tam <jtam.home(a)gmail.com>

1 0

dsync panic
by Greg Rivers 02 Mar '15

02 Mar '15

As per <http://wiki2.dovecot.org/Migration/Dsync>, I'm running the following command on a local dovecot server to replicate email for a single user from a remote IMAP server: doveadm -D \ -o imapc_host=remote.imap.server \ -o imapc_user=gcr \ -o imapc_password=XXXXXXXX \ -o imapc_list_prefix=IMAP \ -o imapc_features="rfc822.size fetch-headers" \ -o mail_prefetch_count=20 \ -o mail_fsync=never \ backup -R -u gcr imapc: This runs fine for a while and successfully copies quite a lot of mail, but always aborts before completion with the following error: dsync(gcr): Panic: file mail-transaction-log.c: line 271 (mail_transaction_log_rotate): assertion failed: (file->locked) The exit code is 262. Does anyone know why this might happen or how to fix it? -- Greg Rivers

1 0

Re: Require certificate for external clients
by Joseph Tam 01 Mar '15

01 Mar '15

Karol Babioch <karol(a)babioch.de> writes: > As far as I know dovecot is not able to operate on multiple ports, as > stated in the FAQ [1]. > > [1]: > http://wiki.dovecot.org/QuestionsAndAnswers#Is_it_possible_to_have_Dovecot_… That should be qualified as "Is it possible to have Dovecot imap/pop daemons listening on multiple ports for a single running instance." You can run two instances of dovecot, each on a different port or multi-homed listening address. You can share libraries, binaries, log files, but use separate configuration files, specifying different ports/addresses/ssl-configs/auth/access parameters. Then you can fire them both up dovecot -c /dovecot/etc/dovecot-1.conf dovecot -c /dovecot/etc/dovecot-2.conf That's the rough sketch of how to do it. Joseph Tam <jtam.home(a)gmail.com>

2 1

users of dbox format
by Andreas Kasenides 28 Feb '15

28 Feb '15

I am interested in finding out your experiences with using the dbox format (especially mdbox) if you use this format. I am contemplating changing my maildir setup to mdbox but I still need to make a case for it against maildir which has become a de-facto standard and provides sort of a secure basis in case of software changes. Your input will be appreciated. -- Andreas Kasenides Senior IT Officer Dept. of Computer Science, University of Cyprus Tel: 22892714, Fax: 22892701 (5B4ANK)

4 4

ACL Error
by Bobber 28 Feb '15

28 Feb '15

I'm trying to set up global ACLs. I have the following in the config file: > # acl > mail_plugins = acl > > protocol imap { > mail_plugins = $mail_plugins imap_acl > } > > plugin { > # Without global ACLs: > #acl = vfile > > # With global ACL files in /etc/dovecot/dovecot-acls file (v2.2.11+): > #acl = vfile:/etc/dovecot/dovecot-acl > acl = vfile:/usr/local/etc/dovecot/dovecot-acl > } And here is my dovecot-acl: > user=bobber lrwstipekxa > authenticated lr But when I restart dovecot and try to access folders, I get the following errors in the log file: > Error: Global ACL file /usr/local/etc/dovecot/dovecot-acl line 1: > Unknown ID 'lrwstipekxa' Any ideas what's causing this? -- *Bob Wooldridge* Blog: http://kc0dxf.net/blog/

2 1

userdb passwd-file default_fields uid not expanding %variable
by Tim Jones 27 Feb '15

27 Feb '15

Hi all, I'm trying to set up a very simple shared mail server, where each 'domain' is a system user, i.e. 'example.com' is a real user with /home/example.com/, a uid of 5001 (and gid 'example.com' of 5001). Each domain\user has their own maildir inside their home, and a plain passwd-file with the virtual mail users associated with that domain. Version & config info: > # dovecot -n > # 2.2.13: /etc/dovecot/dovecot.conf > # OS: Linux 3.2.0-4-amd64 x86_64 Debian 7.8 > auth_mechanisms = plain login > auth_verbose = yes > disable_plaintext_auth = no > mail_location = mbox:~/mail:INBOX=/var/mail/%u > namespace inbox { > inbox = yes > location = > mailbox Drafts { > special_use = \Drafts > } > mailbox Junk { > special_use = \Junk > } > mailbox Sent { > special_use = \Sent > } > mailbox "Sent Messages" { > special_use = \Sent > } > mailbox Trash { > special_use = \Trash > } > prefix = > } > passdb { > args = username_format=%n /home/%d/mail_users > driver = passwd-file > } > protocols = " imap lmtp pop3" > ssl = no > userdb { > args = username_format=%n /home/%d/mail_users > default_fields = uid=%d gid=%d home=/home/%d/mail/%n > mail=maildir:/home/%d/mail/%n > driver = passwd-file > } Every time I try to authenticate via imap, I get the error > <timestamp> <host> dovecot: auth: Fatal: passwd-file userdb: Invalid uid: > %d > If I put fixed a uid and gid in the userdb default_fields line: > default_fields = uid=example.com gid=example.com home=/home/%d/mail/%n > mail=maildir:/home/%d/mail/%n authentication passes without a problem, but of course, only for users of example.com. Checking the wiki (http://wiki2.dovecot.org/UserDatabase#Userdb_settings) clearly states that the default_fields values support %variables, so I'm not sure if I'm missing some other config required for this to work. Many thanks in advance, [image: Fon] <http://www.fon.com/>Tim JonesSoftware Development+34 612345678 C/ Quintanavides 15, Edificio 2, Planta 1ª Parque Empresarial Vía Norte de Metrovacesa Las Tablas 28050 MadridSkype: tim.jones.fonAll information in this email is confidential <http://corp.fon.com/legal/email-disclaimer>

1 0

Dovecot & LDAP Take #2: Authentication failed and logging
by David Scheele 27 Feb '15

27 Feb '15

Hi there, after banging my head against a wall for a bit I got more indepth with dovecot and am now much more knowledgeable about the system than before. But I still have two problems: 1.) For some reason my dovecot doesnt log correctly. I put debug_log to -1 and expected to see logs flooding in in my syslog. When I try to log in via telnet over imap and the login succeeds it loggs correctly. But when it fails there is no log entry. Any clue what might cause this? And now the big fish: 2.) Still hanging to log a user in over telnet via imap. I'm pretty sure i have misconfigured something. first of all: 2a.) Is the *passdb* and *userdb* ind the dovecot.conf still needed in the newest version? It appears to me that all authing runs over the *10-auth.conf*, *auth-ldap.conf.ext* and *dovecot-ldap.conf.ext *and the passdb and userdb settings might just be remnants of the past? or am i wrong here? 2b.) This is my config: *# 2.1.7: /etc/dovecot/dovecot.conf# OS: Linux 3.2.0-4-amd64 x86_64 Debian 7.8 ext4auth_mechanisms = plain logindefault_login_user = vmaildisable_plaintext_auth = nofirst_valid_gid = 2222first_valid_uid = 2222listen = *mail_access_groups = vmailmail_debug = yesmail_location = maildir:/var/vmail/%d/%npassdb { args = scheme=SHA1 /etc/dovecot/passwd driver = passwd-file}protocols = imapservice auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0660 user = postfix } user = root}service imap-login { process_min_avail = 1 user = vmail}ssl = nouserdb { args = uid=2222 gid=2222 home=/var/vmail/%d/%n allow_all_users=yes driver = static}* *hosts = [ <http://mailserver.realsecure.de/>hostname].[domainname].dedebug_level = -1auth_bind = yesauth_bind_userdn = cn=%u,ou=People,dc=**[domainname]* *,dc=debase = ou=People,dc=[domainname],dc=deuser_attrs = uidNumber=uiduser_filter = (&(objectClass=inetOrgPerson)(uid=%u))pass_attrs = uid=user,userPassword=passwordpass_filter = (&(objectClass=inetOrgPerson)(uid=%u))iterate_attrs = uid=useriterate_filter = (objectClass=inetOrgPerson)* The user I try to log in with is: *cn=Klara Fall,ou=People,dc=[domainname],dc=de* *objectclasses: inetOrgPerson, organizationalPerson, person, simpleSecurityObject,top* *sn=Fall* *userPassword is set* *mail: klara.fall(a)[domainname].de* *uid: klarafall* I want to try with auth bind because I think i understood whats going on with that. When i try to a login klarafall [password] it gives me a NO [AUTHENTICATIONFAILED] Authentication failed. Any clues? This would be much easier with logging... but see 1.) :) I feel I'm not far from the finish line. Best, David

2 2

postfix ldap unknown user
by Jean-François Sénéchal 27 Feb '15

27 Feb '15

Hi, My config dovecot 2.2.13 Postfix 2.9.6 Debian wheezy When I send a message to my user test (siroco) postfix said unknown user But the user exist : doveadm user siroco : field value uid 3002 gid 2000 home /var/spool/dovecot/mail/s/siroco mail maildir:~/Maildir:LAYOUT=fs postmap -vq siroco ldap:/etc/postfix/ldap_virtual_aliases.cf return siroco 2 questions : postfix search with siroco or with siroco(a)citoyens2015.marche.be ? postmap must return siroco or siroco(a)citoyen2015.marche.be ? And I don't know if I set for alias_maps, virtual_mailbox_maps, virtual_alias_maps ? My postconf alias_database = hash:/etc/aliases alias_maps = hash:/etc/aliases, ldap:/etc/postfix/ldap-citoyen.cf append_dot_mydomain = no biff = no config_directory = /etc/postfix inet_interfaces = 172.17.1.232, 127.0.0.1 mailbox_command = procmail -a "$EXTENSION" mailbox_size_limit = 0 mydestination = $myhostname, localhost.$mydomain, localhost mydomain = marche.be myhostname = citoyen2015.marche.be mynetworks = 127.0.0.0/8 [::ffff:127.0.0.0]/104 [::1]/128 myorigin = /etc/mailname readme_directory = no recipient_delimiter = + relayhost = gatekeeper.marche.be smtpd_banner = $myhostname ESMTP $mail_name (Debian/GNU) virtual_alias_maps = proxy:ldap:/etc/postfix/ldap_virtual_aliases.cf virtual_mailbox_domains = hash:/etc/postfix/virtual_domains virtual_mailbox_maps = proxy:ldap:/etc/postfix/ldap_virtual_recipients.cf virtual_transport = dovecot My ldap_virtual_recipients.cf (same in ldap-citoyen.cf and in ldap_virtual_aliases.cf) server_host = ldap.marche.be search_base = ou=Users,ou=Citoyens,dc=marche,dc=be scope = sub bind = no version = 3 #query_filter = (&(|(mail=%s)(gosaMailAlternateAddress=%s))(objectClass=gosaMailAccount)) query_filter = (|(gosaMailAlternateAddress=%s)(mail=%s)(uid=%s)) #result_attribute = uid result_attribute = gosaMailForwardingAddress *Error log * Feb 27 14:16:13 citoyen2015 postfix/trivial-rewrite[4917]: warning: do not list domain citoyen2015.marche.be in BOTH mydestination and virtual_mailbox_domains Feb 27 14:16:13 citoyen2015 postfix/local[4919]: E8C3920A: to=<siroco(a)citoyen2015.marche.be>, relay=local, delay=0.23, delays=0.13/0.01/0/0.1, dsn=5.1.1, status=bounced (unknown user: "siroco") Feb 27 14:16:13 citoyen2015 postfix/cleanup[4918]: 2C28A20C: message-id=<20150227131613.2C28A20C(a)citoyen2015.marche.be> Thanks

2 1