- dovecot - dovecot.org

Native ext4 fs quotas
by aris fesarlis 29 Oct '25

29 Oct '25

It seems that quota mechanism in newer linux (eg alma10) has changed. Now there are no quota files (aquota.user), but instead quotas must be enabled (ext4) using tune2fs. It seems that dovecot (in my case) cannot recognise this and still looks for quota files: error: Failed to get quota resource STORAGE: quota-fs: quotactl(Q_GETQUOTA, /dev/sda1) failed: No such file or directory Any way to overcome this? Have no time to change backends at the moment.

1 0

2.4.2 build failure in src/lib-regex
by Thomas Zajic 29 Oct '25

29 Oct '25

Hi, Building 2.4.2 fails due to a strange Makefile dependency regarding libpcre-32: > [zlatko@airframe:~/usrlocal/src/dovecot-2.4.2/src/lib-regex]$ make > make: *** No rule to make target '-L/usr/local/lib64', needed by 'test-regex'. Stop. > make: *** Waiting for unfinished jobs.... > CCLD libdregex.la This is because for some reason, $(test_regex_DEPENDENCIES) is part of the targets that need to be made before making test-regex$(EXEEXT): > test-regex$(EXEEXT): $(test_regex_OBJECTS) $(test_regex_DEPENDENCIES) $(EXTRA_test_regex_DEPENDENCIES). > @rm -f test-regex$(EXEEXT) > $(AM_V_CCLD)$(LINK) $(test_regex_OBJECTS) $(test_regex_LDADD) $(LIBS) And $(test_regex_DEPENDENCIES) contains, among other things, $(LIBPCRE_LIBS), which in turn is the output of `pkg-config --libs "libpcre2-32"`: > [zlatko@airframe:~/usrlocal/src/dovecot-2.4.2/src/lib-regex]$ pkg-config --libs "libpcre2-32" > -L/usr/local/lib64 -lpcre2-32 So, `make` thinks it needs to create two files "-L/usr/local/lib64" and "-lpcre2-32" before it can make `test-regex`, but of course it doesn't know *how* to make them, and stops. The fix is trivial, of course, just remove the incorrect requirements/targets part "$(test_regex_DEPENDENCIES) $(EXTRA_test_regex_DEPENDENCIES)" from the recipe for test-regex$(EXEEXT) so that it reads ... > test-regex$(EXEEXT): $(test_regex_OBJECTS) > @rm -f test-regex$(EXEEXT) > $(AM_V_CCLD)$(LINK) $(test_regex_OBJECTS) $(test_regex_LDADD) $(LIBS) ..., but of course the Makefile should already be generated properly in the first place. HAND Thomas

1 0

CVE-2025-30189 notification
by Aki Tuomi 29 Oct '25

29 Oct '25

Affected product: Dovecot IMAP Server Internal reference: DOV-7830 Vulnerability type: CWE-1250 (Improper Preservation of Consistency Between Independent Representations of Shared State) Vulnerable version: 2.4.0, 2.4.1 Vulnerable component: auth Report confidence: Confirmed Solution status: Fixed in 2.4.2 Researcher credits: Erik <erik(a)broadlux.com> Vendor notification: 2025-07-25 CVE reference: CVE-2025-30189 CVSS: 7.4 (CVSS3.1:AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N) Vulnerability Details: Using auth caching with oauth2 passdb, passwd passdb or userdb, or passwd userdb, causes the first lookup to be cached for all the lookups. This is because the cache key is "%u" which no longer actually expands to same as "%{user}". Workaround: Disabling auth cache will prevent the issue. Fix Install non-vulnerable version of Dovecot. Patch can be found at https://github.com/dovecot/core/compare/a70ce7d3e2f983979e971414c5892c4e301…

1 0

duplicates
by Kevin Kretz 27 Oct '25

27 Oct '25

Hi, We use Dovecot and Postfix for internal emails and keep aliases in an LDAP table. We have multiple sites, with some user mailboxes local to each. If user A and B are both in alias OurGroup, and a message is sent to [ mailto:ourgroup@domain.com | ourgroup(a)domain.com ] [ mailto:a@domain.com | a(a)domain.com ] and [ mailto:b@domain.com, | b(a)domain.com, ] a and b will receive two copies of the message. Should this be addressed with Postfix or Dovecot? thanks Hi, We use Dovecot and Postfix for internal emails and keep aliases in an LDAP table. We have multiple sites, with some user mailboxes local to each. If user A and B are both in alias OurGroup, and a message is sent to [1]ourgroup(a)domain.com [2]a(a)domain.com and [3]b(a)domain.com, a and b will receive two copies of the message. Should this be addressed with Postfix or Dovecot? thanks References Visible links 1. mailto:ourgroup@domain.com 2. mailto:a@domain.com 3. mailto:b@domain.com,

2 1

Can dovecot sieve query a database file?
by Hadmut Danisch 27 Oct '25

27 Oct '25

Hi, can dovecot sieve query any external database ( berkeley database file, rest api, whatever) to determine the target folder by sender address? Background: I have to migrate a mailbox from an old ubuntu system running with mailfilter as a local delivery agent, and dovecot just as an IMAP server. Since recent ubuntu versions do not have mailfilter anymore (abandoned for a decade) I need to substitute the mailfilter file with dovecot sieve. The old mailfilter script contained something like if (gdbmopen(".mailfilter.gdbm", "R") == 0) { if ( (box=gdbmfetch(tolower($FROM),"D")) ne "" ) to $box if ( /^From: .*<(.*)>/ ) { if ( (box=gdbmfetch(tolower($MATCH1),"D")) ne "" ) to $box } gdbmclose } which allowed to sort mails into mailboxes depending on the sender for hundreds of sender addresses in a fast end efficient way. It wouldn't make sense and be too slow to translate this into a sieve script with a thousand if header :matches ... elsif header :matches ... Is there a way to do this efficently in dovecot's sieve? regards Hadmut

5 7

No Sent Items folder created
by ville＠datsuncherry.com 27 Oct '25

27 Oct '25

Hello, before paying any effort, what could be the reason that in Postfix, Dovecot, Thunderbird client setup no Sent Items folder is created on the server as a first mail is sent on the newly created account. The mail is sent, but Thunderbird saves it instead in local sent items. Also when checking account settings the 'save copy setting' has changed from server to local and when setting it back to server same happens when a new mail is sent. For comparison the Apple Mail client creates a 'Sent Items' folder on the server, which afterwards can be selected manually in Thunderbird from that point on to store sent mails. Received mails are stored under /var/mail/vhosts/domain/user in either case. This issue appeared as I configured an existing server to use another domain name. and thought replacing the host names under /etc/postfix and /etc/dovecot would suffice, besides of course replacing the mail addresses in the mysql table. Any idea what causes this. As the mail is however sent correctly, what could make creating the sent items folder 'fail' as it somehow appears. Would logging the IMAP communication from the client to the server help finding the reason if it is at all possible or otherwise I would need to compile the code with printf's. Server is Ubuntu 22.

3 5

dsync between 2 instances on same machine (but different versions and different DNS hostnames) fails with "doveadm server sent invalid handshake"
by rmfuhrer＠optonline.net 26 Oct '25

26 Oct '25

I'm trying to use dsync to upgrade from an existing 2.3 server running native on MacOS to a 2.4.1 server running inside a Docker container on the same machine, using the official Dovecot 2.4.1 Docker image from DockerHub. For testing, I decided to set up a new hostname (CNAME) record in DNS pointing to the same IP, since both Dovecot instances are running on the same host. The new 2.4.1 Docker-containerized instance is working fine so far, which is to say I can connect to it from a mail client (the Mac Mail app) using TLS/SSL, and I'm able to move mail messages in, delete them, create folders, etc. For the next phase of testing, I want to migrate a single folder of a single user's email from the 2.3 instance to the new 2.4.1 Docker instance. I recently found out about dsync and thought I'd give it a try. The test Dockerized instance exposes its IMAPS port to a different port than the legacy instance (of course). I found that dsync seems to behave differently than the IMAP service wrt the certficate chain: Whereas the Mail client was able to negotiate the encrypted connection with the LetsEncrypt server cert alone in the dovecot cert file, with dsync, the 2.3 server seemed to require the entire cert chain to reside in the file. (?) After resolving that, the source dsync could at least get past the certificate validation phase, but then complained thusly: Oct 19 21:52:11 doveadm(myuser(a)mydomain.net): Error: doveadm server sent invalid handshake: * OK [CAPABILITY IMAP4rev1 LOGIN-REFERRALS ID ENABLE IDLE SASL-IR LITERAL+ AUTH=PLAIN AUTH=LOGIN] Dovecot ready. Oct 19 21:52:11 doveadm(myuser(a)mydomain.net): Error: Disconnected from remote: EOF Oct 19 21:52:11 doveadm(myuser(a)mydomain.net): Debug: auth-master: conn unix:/usr/local/var/run/dovecot/auth-userdb (uid=0): Disconnected: Connection closed (fd=8) I can't tell from that error message what the source dsync doesn't like about the destination dsync, or for that matter, whether it might be the destination dsync that doesn't like what the source dsync is saying?? Anyway, I'm invoking dsync like this, to sync just a single folder: $ sudo doveadm -D -v backup -u myuser(a)mydomain.net -m FolderName tcps:testserver.mydomain.net:31993 ALSO: I confess that I also don't understand how dsync can work without asking for user account passwords, if it's indeed running over the IMAPS service. How can the destination service trust the incoming dsync connection? I assume it's running over a normal IMAPS connection, since that's the only port that I've given to the source dsync command, but maybe that's not the case? The docs are pretty unclear about this aspect, but I'm no expert, so maybe this is just obvious to others. (?)

3 11

mdbox: double forward-slash in mail_path
by Edmund Lodewijks 23 Oct '25

23 Oct '25

Hello List! I am testing mdbox on Dovecot 2.4.1 (currently using Maildir, but thinking of converting). I created a test server with a test domain. Installed relevant software from default repos on Debian 13: - Postfix - Dovecot 2.4.1 - PostfixAdmin - MariaDB After I had created an email address, I checked the settings as follows: ``` # doveadm user mail@$REDACTED field value uid 5000 gid 5000 home /vhosts/$REDACTED/mail/ mail_path /vhosts/$REDACTED/mail//mdbox quota_rule *:bytes=1048576000 ``` As you can see, there is a double forward-slash in the mail_path line. From /etc/dovecot/local.d/10-mail.conf: ``` mail_driver = mdbox mail_path = ~/mdbox ``` This is based on the official Dovecot docs page (see at the very bottom): https://doc.dovecot.org/2.4.1/core/config/mailbox_formats/dbox.html Is this harmful, or just "cosmetic"? Have I made a mistake somewhere? I presume the mail_path line is not even required, as it is the default for that mail_driver. Thank you for your time and reply. Kind regards, Edmund Lodewijks -- Edmund Lodewijks <edmund(a)proteamail.com> TZ: UCT+2 / GMT+2

4 8

Connecting to multiple ldaps AD from Dovecot 2.4.1
by Grepl Zbynek 23 Oct '25

23 Oct '25

Hello List! I am testing auth-ldap.conf.ext on Dovecot 2.4.1 Debian 13 (trixie) Postfix 3.10.4 Dovecot 2.4.1-4 (7d8c0e5759) Everything works fine when I use only one ldap AD for authentication. I need to connect multiple ADs of our organizations which have separate ADs. The problem is that it always takes the last ldap_uris as working even if I put them in separate files. *configuration - auth-ldap.conf.ext* *### AD - ORG_ONE* ldap_uris = ldap://XX.YY.ZZ.CZ ldap_auth_dn = CN=ReaderAD,CN=Users,DC=domain1,DC=local ldap_auth_dn_password = secret_password_1 ldap_base = OU=ALFA,dc=domain1,dc=local ldap_version = 3 *### domena subdomain1.domain1.cz* passdb ldap { ldap_filter = (&(objectClass=user)(mail=%{user|username}@%{user|domain})) ldap_bind = yes result_internalfail = return-fail } userdb ldap { driver = ldap ldap_filter = (&(objectClass=user)(mail=%{user|username}@%{user|domain})) fields { mail_path=/home/vmail/%{user|domain}/%{ldap:mail}/Maildir mail_inbox_path=/home/vmail/%{user|domain}/%{ldap:mail}/Maildir/ } } *### AD - ORG_SECOND * ldap_uris = ldap://AXX.AYY.AZZ.ACZ ldap://BXX.BYY.BZZ.BCZ ldap_auth_dn = CN=ReaderAD,OU=ServiceAccount,OU=DELTA,OU=GAMA,OU=ALFA,OU=BETA,DC=domain2,DC=cz ldap_auth_dn_password = secret_password_2 ldap_base = OU=BETA,dc=domain2,dc=cz ldap_version = 3 *### domena subdomain2.domain1.cz* passdb ldap { ldap_filter = (&(objectClass=user)(mail=%{user|username}@%{user|domain})) ldap_bind = yes result_internalfail = return-fail } userdb ldap { driver = ldap ldap_filter = (&(objectClass=user)(mail=%{user|username}@%{user|domain})) fields { mail_path=/home/vmail/%{user|domain}/%{ldap:mail}/Maildir mail_inbox_path=/home/vmail/%{user|domain}/%{ldap:mail}/Maildir/ } } *--- doveadm auth test ---* root@SERVER:/etc/dovecot/conf.d# doveadm auth test name.surname(a)subdomain2.domain2.cz Password: passdb: name.surname(a)subdomain2.domain1.cz*auth succeeded* extra fields: user=name.surname(a)subdomain2.domain1.cz root@SERVER:/etc/dovecot/conf.d# doveadm auth test name.surname(a)subdomain1.domain1.cz Password: passdb: name.surname(a)subdomain2.domain2.cz*auth failed* extra fields: user=name.surname(a)subdomain2.domain2.cz ----- I couldn't find any solution in the 2.4.1 documentation or on the Internet. AI didn't help. Thank you for your time and reply. Kind regards, Zbynek Grepl Hello List! I am testing auth-ldap.conf.ext on Dovecot 2.4.1 Debian 13 (trixie) Postfix 3.10.4 Dovecot 2.4.1-4 (7d8c0e5759) Everything works fine when I use only one ldap AD for authentication. I need to connect multiple ADs of our organizations which have separate ADs. The problem is that it always takes the last ldap_uris as working even if I put them in separate files. configuration - auth-ldap.conf.ext ### AD - ORG_ONE ldap_uris = [1]ldap://XX.YY.ZZ.CZ ldap_auth_dn = CN=ReaderAD,CN=Users,DC=domain1,DC=local ldap_auth_dn_password = secret_password_1 ldap_base = OU=ALFA,dc=domain1,dc=local ldap_version = 3 ### domena subdomain1.domain1.cz passdb ldap { ldap_filter = (&(objectClass=user)(mail=%{user|username}@%{user|domain})) ldap_bind = yes result_internalfail = return-fail } userdb ldap { driver = ldap ldap_filter = (&(objectClass=user)(mail=%{user|username}@%{user|domain})) fields { mail_path=/home/vmail/%{user|domain}/%{[2]ldap:mail}/Maildir mail_inbox_path=/home/vmail/%{user|domain}/%{[3]ldap:mail}/Maildir/ } } ### AD - ORG_SECOND ldap_uris = [4]ldap://AXX.AYY.AZZ.ACZ [5]ldap://BXX.BYY.BZZ.BCZ ldap_auth_dn = CN=ReaderAD,OU=ServiceAccount,OU=DELTA,OU=GAMA,OU=ALFA,OU=BETA,DC=domain2,DC=cz ldap_auth_dn_password = secret_password_2 ldap_base = OU=BETA,dc=domain2,dc=cz ldap_version = 3 ### domena subdomain2.domain1.cz passdb ldap { ldap_filter = (&(objectClass=user)(mail=%{user|username}@%{user|domain})) ldap_bind = yes result_internalfail = return-fail } userdb ldap { driver = ldap ldap_filter = (&(objectClass=user)(mail=%{user|username}@%{user|domain})) fields { mail_path=/home/vmail/%{user|domain}/%{[6]ldap:mail}/Maildir mail_inbox_path=/home/vmail/%{user|domain}/%{[7]ldap:mail}/Maildir/ } } --- doveadm auth test --- [8]root@SERVER:/etc/dovecot/conf.d# doveadm auth test [9]name.surname(a)subdomain2.domain2.cz Password: passdb: [10]name.surname(a)subdomain2.domain1.cz auth succeeded extra fields: [11]user=name.surname(a)subdomain2.domain1.cz [12]root@SERVER:/etc/dovecot/conf.d# doveadm auth test [13]name.surname(a)subdomain1.domain1.cz Password: passdb: [14]name.surname(a)subdomain2.domain2.cz auth failed extra fields: [15]user=name.surname(a)subdomain2.domain2.cz ----- I couldn't find any solution in the 2.4.1 documentation or on the Internet. AI didn't help. Thank you for your time and reply. Kind regards, Zbynek Grepl References Visible links 1. file:///tmp/tmpy9tgc9z4/ldap:/XX.YY.ZZ.CZ 2. file:///tmp/tmpy9tgc9z4/ldap:mail 3. file:///tmp/tmpy9tgc9z4/ldap:mail 4. file:///tmp/tmpy9tgc9z4/ldap:/AXX.AYY.AZZ.ACZ 5. file:///tmp/tmpy9tgc9z4/ldap:/BXX.BYY.BZZ.BCZ 6. file:///tmp/tmpy9tgc9z4/ldap:mail 7. file:///tmp/tmpy9tgc9z4/ldap:mail 8. mailto:root@server/etc/dovecot/conf.d# 9. mailto:name.surname@subdomain2.domain2.cz 10. mailto:name.surname@subdomain2.domain1.cz 11. mailto:user=name.surname@subdomain2.domain1.cz 12. mailto:root@server/etc/dovecot/conf.d# 13. mailto:name.surname@subdomain1.domain1.cz 14. mailto:name.surname@subdomain2.domain2.cz 15. mailto:user=name.surname@subdomain2.domain2.cz

1 0

Pay Someone to Take My Online Course?
by xotawa2329＠hapincy.com 23 Oct '25

23 Oct '25

Pay Someone to Take My Online Course? Different understudies who battle with reworking school, work, and family obligations select online class tutors to assist them with finishing their tests and complete their coursework. In any case, some solicitation the ethicality of this planning. While <a href="https://onlineclassservices.com/nurs-fpx-4040-assessment-4-attempt-1-inform…">NURS FPX 4040 Assessment 4</a>  has every one of the reserves of being enticing, it goes with two or three serious dangers. This article will examine a piece of the things you ought to remember going before enlisting an online class help association. It's clearly a fact that online classes can be truly troublesome, particularly for working professionals who have a clamoring plan. Oftentimes they are searching for someone to take a whole course or individual tasks for them, to assist with managing their grades and moderate their strain. Nonetheless, be wary of affiliations that guarantee too wonderful to be authentic. They could charge you enormous totals for their associations and end up not conveying. The best technique for guaranteeing that you are getting anything that would be fair is to use an online class tutor who offers an inadequate responsibility. Additionally, review that different schools consider paying someone to take an online class to swindle. Therefore, whenever got, you could go facing silly outcomes like besieging the course, scholarly suspension or even send off. To this end picking a fair relationship with a showed history is crucial. The association is clear: present your mentioning and survey offers from qualified educated authorities. Then enlist the one that is reasonable for yourself and store maintains in <a href="https://onlineclassservices.com/nurs-fpx-4050-assessment-1-attempt-3-prelim…">NURS FPX 4050 Assessment 1</a>  scrow until your assignment is finished. Online classes are eminent among understudies who need to save time on education and spotlight more on work or other private issues. These merge understudies who are taking courses while working and attempting to change family and profession responsibilities, military understudies on sending, and understudies with genuine inadequacies or sickness that make it pursuing for them to go to classes. Unfortunately, there are many tricks that confirmation to take online courses for you. These affiliations charge ridiculous totals and don't complete their obligations. They may also hand you over to your school. Tolerating that they do, you could be killed from your underwriting project or even suspended or removed from school. This isn't the very thing that you truly need for your business and future. Therefore, you genuinely need to track down serious areas of strength for a that offers a fair cost and mind blowing results. To this end you ought to search for a <a href="https://onlineclassservices.com/nurs-fpx-4050-assessment-2-attempt-1-ethica…">NURS FPX 4050 Assessment 2</a>  affiliation that has an inadequate responsibility and splendid customer association. Various individuals decide to use a professional to take their online class since they need the opportunity to go to it very close. They could be working the whole day, supervising family issues, or fighting disease and disappointments that log jam their review tendencies. These professionals can assist you with fulfilling time necessities, stay away from imaginative theft, and set free your nights to zero in on work or other unwinding works out. They may comparatively have the decision to help you with beating any learning handicaps you have. Copyright infringement suggests utilizing someone else's words and thoughts without their endorsement. It is viewed as a kind of cheating and can accomplish a delicate grade or even send off from school. It is difficult to ensure that a used professional won't phony. This is on the grounds that educational foundations don't have <a href="https://onlineclassservices.com/nurs-fpx-4900-assessment-1-assessing-the-pr…">NURS FPX 4900 Assessment 1 Assessing the Problem</a>  assets for check whether understudies are authentic or not. This truly expects that tolerant you are gotten, you will probably lose the cash you paid to have someone take your class. There's no veritable strategy for remaining caution assuming the solitary you enroll to take your online course will tell the truth and dependable. They probably won't be in a tantamount state as you. Moreover, they apparently won't be as dedicated to finishing the class for you as you are. They may very well be doing the base extent of work expected to get reviewed and a brief time frame later vanish. MORE <a href="https://dev.gajim.org/gajim/website/-/issues/35#note_211778">Facebook is a powerful tool for business</a> <a href="https://xtremepape.rs/members/horridhenry7860.397211/about">Mobile Application Development Services</a> <a href="https://xtremepape.rs/members/samfarrid4563.397213/about">best digital marketing agencies</a>

5 5

doveadm search SENTSINCE and SENTBEFORE with timezone
by Philip Bondi 19 Oct '25

19 Oct '25

Hello to all: Would someone be able to comment on the correct method to specify timezone? [243] $ doveadm search -u user(a)domain.ca MAILBOX hover/INBOX-hover.mbx SENTSINCE "2024-01-01" SENTBEFORE "01-Jan-2025" fa6bc10562ee846855141f00d09efc50 4092 fa6bc10562ee846855141f00d09efc50 4093 fa6bc10562ee846855141f00d09efc50 4094 fa6bc10562ee846855141f00d09efc50 4095 fa6bc10562ee846855141f00d09efc50 4096 fa6bc10562ee846855141f00d09efc50 4097 [244] $ doveadm search -u user(a)domain.ca MAILBOX hover/INBOX-hover.mbx SENTSINCE "2024-01-01" SENTBEFORE "01-Jan-2025 00:00:00 -0400" Fatal: Invalid search date parameter: 01-Jan-2025 00:00:00 -0400

3 3

Missing imapc plugin
by scrivici＠winnbroker.it 17 Oct '25

17 Oct '25

Hi all, I have an installation (experimental, for now) of Dovecot CE 2.3.21 on Ubuntu and I'm trying to sync messages with an external IMAP server using doveadm sync, but I get the message "Plugin 'imapc' not found." It looks like the plugin isn't included in the version I'm using. Is that the case? Should I use a different version or download the plugin separately? Thank in advance for your help

2 7

Dovecot 2.4: dirsize removed - alternative for physical size quotas?
by jarland＠mxroute.com 16 Oct '25

16 Oct '25

We're upgrading our servers from Dovecot 2.3 to 2.4 and hit an issue with the dirsize driver removal. In 2.3, we switched from "maildir" to "dirsize" quota driver because maildir counts virtual (RFC822) sizes. This caused mailboxes to appear full before reaching actual disk limits - base64-encoded attachments make the virtual size larger than physical disk usage. For example, 8GB actual usage could show as 10GB+ in quota calculations. The dirsize driver solved this by calculating quota from actual file sizes on disk. In 2.4, dirsize is removed with the note "use quota-count instead." However, the count driver requires quota_vsizes=yes, which uses virtual sizes - the same problem we had with maildir. What's the intended solution in 2.4 for tracking quota based on physical disk usage rather than virtual message sizes? The available drivers seem to be: - count: requires virtual sizes - maildir: also uses virtual sizes via maildirsize - fs: requires OS-level per-user filesystem quotas Is there a way to configure count for physical sizes? Appreciate any guidance.

1 0

Feature request: allow Settings variables to be used in ldap_auth_dn
by Kristian 16 Oct '25

16 Oct '25

Hi, with the migration to 2.4 my setup for LDAP authentication stopped working. I used to have different LDAP config files for every virtual domain. Each domain has an domain-specific service user with read access, that is used by dovecot. There is no service user with access across domains. With the current 2.4 configuration I only see the possibility to configure one user in the variables ldap_auth_dn ldap_auth_dn_password In ldap_base I am able to use settings variables ldap_base = ou=people,dc=%{user | domain | ldap_dn} which allows me to select the right LDAP tree depending on the domain of the user. I would need this also in ldap_auth_dn to keep my current setup. I can see, that this is specific to my setup without an service user with access to all domains, and that this ignores the problem of having different passwords for different domain users, but it would at least keep some compatibility to working 2.3 setups. Kind regards Kristian

1 0

auth_cache_ttl and sieve_enabled
by Arkadiusz Miśkiewicz 14 Oct '25

14 Oct '25

Hi, auth_cache_ttl docs https://doc.dovecot.org/main/core/config/auth/caching.html say: " # We also try to handle password changes automatically: If user's previous # authentication was successful, but this one wasn't, the cache isn't used. " but seems that this doesn't work in such way for sieve_enabled flag changes. So changing sieve_enabled from 0 to 1 means user still has to wait until cache expires and new value is noticed by dovecot... which is not desired. Could sieve_enabled be also treated in similar way as incorrect authentication? -- Arkadiusz Miśkiewicz, arekm / ( maven.pl | pld-linux.org )

1 0

Ssl_cert keyword ?
by MellorCH 10 Oct '25

10 Oct '25

> V2.4.1 what’s the latest syntax for this please? Ssl_cert V2.4.1 what's the latest syntax for this please? Ssl_cert

3 2

SSL initialization error - Dovecot 2.4.1, Fedora 43 beta
by Jason J.G. White 09 Oct '25

09 Oct '25

I'm trying Dovecot 2.4.1 under Fedora 43 beta with all packages up to date. I've encountered several issues after attempting to update my configuration. The main problem is this: whenever a client attempts to connect, I get the following error Error: Failed to initialize SSL connection: Couldn't initialize SSL server context: Can't load SSL certificate (ssl_server_cert_file setting): error:0A00018F:SSL routines::ee key too small: I'm using a SECP384R1 key issued by letsencrypt.org, which should satisfy security checks. My Web searches have not identified a relevant bug report. Have others encountered this issue? If it's distribution-specific, I can visit the relevant bug tracker. Thank you for your consideration.

5 8

Does ldap_auth_sasl_mechanisms support GSSAPI?
by Fredrik Falk 08 Oct '25

08 Oct '25

I'm attempting to authenticate dovecot against an OpenLDAP server using GSSAPI. Setting `ldap_auth_sasl_mechanisms = gssapi` causes the server to fail to boot with the error `ldap_auth_sasl_mechanism set, but no SASL support compiled in`. I'm wondering if there's a dependency that I'm missing, or if there's no support for it with the deb packages provided at https://repo.dovecot.org/. For reference, I'm running Ubuntu 24.04 with the dovecot apt repository added. `dovecot --version` outputs `2.4.1-4+ubuntu24.04 (7d8c0e5759)`. `dovecot --build-options` yields ``` Build options: ioloop=epoll notify=inotify openssl io_block_size=8192 SQL driver plugins: mysql postgresql sqlite Passdb: ldap pam passwd passwd-file sql Userdb: ldap(plugin) passwd prefetch passwd-file sql ``` Do I need to compile my own version, or is there something I'm missing? The documentation doesn't provide a lot of answers unfortunately. Med vänlig hälsning, Fredrik Falk -- Fredrik Falk <freddo(a)ludd.ltu.se> Luleå Universitets Datorförening /LUDD/

1 0

Announcement: wormhole plugin, replication for Dovecot 2.4
by Patrick Cernko 07 Oct '25

07 Oct '25

Hello List, I am proud to announce my project "wormhole". This is an extension for Dovecot 2.4.1. It allows to continue the use of the replication feature of Dovecot that was removed with the 2.4 release. History: I started this project by forking the replication code of Dovecot 2.3.21.1 and porting it to 2.4. The first result was a patch for Dovecot 2.4.1. While working with the code, I realized that it is possible to provide the feature as a plugin / extension. In the first release of the plugin, I tried to integrate it with the existing dsync commands for doveadm. This required an API for access to the dsync commands, which I proposed to the Dovecot developers in https://github.com/dovecot/core/pull/249 . Unfortunately, my pull request was rejected, though I can understand the reasons for that. Without the required API, I had to switch to another approach: I forked the dsync code from doveadm to provide a new set of commands: "repl" and "repl-server". These commands work similar to "sync" and "dsync-server" but use additional functions required by the replication feature. This approach was released as version 0.3 of the plugin. With version 0.4 I renamed the project to wormhole. Before that it was just called dovecot-replication (see https://codeberg.org/errror/dovecot-replication) I thought that the project should have a more unique name. Currently I'm working on designing a test suite for wormhole. Doing unit tests of the components is not sufficient IMHO. The test suite should check the whole replication feature using two running dovecot instances that replicate the users' mailboxes. Having a sophisticated test suite will help in future development and bug tracking. The code can be found on my codeberg site at: https://codeberg.org/errror/wormhole There is also a web page on my personal homepage at: https://people.mpi-klsb.mpg.de/~pcernko/wormhole.shtml The project is still missing documentation. For the moment, configuration is similar to the existing Dovecot 2.3 documentation. Upgrading from 2.3: When using the included patch for Dovecot, the plugin should be 100% compatible with existing Dovecot 2.3 servers. This compatibility should allow uninterrupted upgrades of the service by replacing Dovecot on one server and then the other one. After the upgrade, the plugin can be reconfigured to work without the patch for Dovecot. Upgrading without the patch is also possible. During the upgrade (aka "while one server still runs 2.3") some aspects of the replication will not work or lack performance. Upgrading is not yet tested very well and missing documentation also. I will work on that soon. I hope to get some feedback, pull requests or bug reports via mail or at codeberg (preferred). -- Patrick Cernko <pcernko(a)mpi-klsb.mpg.de> +49 681 9325 5815 Joint Scientific IT and Technical Service Max-Planck-Institute für Informatik & Softwaresysteme

3 2

Quota plugin: "quota_storage_size" not recognized from userdb extra fields in dovecot 2.4.1
by Matthieu Schapranow 07 Oct '25

07 Oct '25

Dear Dovecot experts, I am in the process of planning migration from dovecot 2.3 to 2.4.1+dfsg1-6 on Debian Trixie, but userdb extra fields for quota_storage_size are ignored. All settings proved to work in 2.3; following per-user quota manual as outlined in [1]. Issue Cannot override setting quota_storage_size using userdb_quota_storage_size, but userdb_quota_storage_extra and userdb_quota_storage_percentage apparently work. Setup Configures multiple userdb using driver passwd combined for a) user information and b) user-specific extra fields; auth. via passdb using driver pam defined in auth-system.conf.ext included by 10-auth.conf Excerpt from doveconf -n: … passdb system_pam { driver = pam } userdb userdb_01_passwd { driver = passwd result_internalfail = return-fail result_success = continue-ok } userdb userdb_02_quota { passwd_file_path = /etc/dovecot/quota-user-settings driver = passwd-file result_internalfail = return-fail result_success = continue } … Excerpt from passwd file /etc/dovecot/quota-user-settings holding userdb extra fields: web1p1:::::::userdb_quota_storage_size=1200M Default quota config excerpt from doveconf -n: … quota user { storage_grace = 100M storage_size = 750M quota_warning warn-95 { quota_storage_percentage = 95 execute quota-warning { args = 95 %{user} } } quota_warning warn-85 { quota_storage_percentage = 85 execute quota-warning { args = 85 %{user} } } } … Result Userdb setting appear to work correctly as it combines both userdb files, see following output: # doveadm user web1p1 field value uid 644 gid 105 home /home/pop/web1p1 mail_path /home/pop/web1p1/mail system_groups_user web1p1 quota_storage_size 1200M However, querying the quota only shows the default value, but not the user-specific setting. # doveadm quota get -u web1p1 Quota name Type Value Limit % user STORAGE 798830 768000 104 user MESSAGE 5617 - 0 Expected behaviour Any user should report default user quota (here 750M), but user web1p1 having user-specific setting for userdb_quota_storage_size=1200M should report a higher quota limit overriding the default quota setting. I tried to specify user-specific values for userdb_quota_storage_extra and userdb_quota_storage_percentage, which worked; probably, because there were no default value specified in the config, yet? Setting userdb_quota_storage_extra to 200M works: web1p1:::::::userdb_quota_storage_extra=200M … # doveadm user web1p1 field value uid 644 gid 105 home /home/pop/web1p1 mail_path /home/pop/web1p1/mail system_groups_user web1p1 quota_storage_extra 200M … # doveadm quota get -u web1p1 Quota name Type Value Limit % user STORAGE 798830 972800 82 user MESSAGE 5617 - 0 Quota is reported as correctly as 750M+200M=950M. Same approach works when setting userdb_quota_storage_percentage, e.g. to a value above 100. [1] https://doc.dovecot.org/main/core/plugins/quota.html#per-user-quota Many thanks for your support! Matthieu Dear Dovecot experts, I am in the process of planning migration from dovecot 2.3 to 2.4.1+dfsg1-6 on Debian Trixie, but userdb extra fields for quota_storage_size are ignored. All settings proved to work in 2.3; following per-user quota manual as outlined in [1]. Issue Cannot override setting quota_storage_size using userdb_quota_storage_size, but userdb_quota_storage_extra and userdb_quota_storage_percentage apparently work. Setup Configures multiple userdb using driver passwd combined for a) user information and b) user-specific extra fields; auth. via passdb using driver pam defined in auth-system.conf.ext included by 10-auth.conf Excerpt from doveconf -n: ... passdb system_pam { driver = pam } userdb userdb_01_passwd { driver = passwd result_internalfail = return-fail result_success = continue-ok } userdb userdb_02_quota { passwd_file_path = /etc/dovecot/quota-user-settings driver = passwd-file result_internalfail = return-fail result_success = continue } ... Excerpt from passwd file /etc/dovecot/quota-user-settings holding userdb extra fields: web1p1:::::::userdb_quota_storage_size=1200M Default quota config excerpt from doveconf -n: ... quota user { storage_grace = 100M storage_size = 750M quota_warning warn-95 { quota_storage_percentage = 95 execute quota-warning { args = 95 %{user} } } quota_warning warn-85 { quota_storage_percentage = 85 execute quota-warning { args = 85 %{user} } } } ... Result Userdb setting appear to work correctly as it combines both userdb files, see following output: # doveadm user web1p1 field value uid 644 gid 105 home /home/pop/web1p1 mail_path /home/pop/web1p1/mail system_groups_user web1p1 quota_storage_size 1200M However, querying the quota only shows the default value, but not the user-specific setting. # doveadm quota get -u web1p1 Quota name Type Value Limit % user STORAGE 798830 768000 104 user MESSAGE 5617 - 0 Expected behaviour Any user should report default user quota (here 750M), but user web1p1 having user-specific setting for userdb_quota_storage_size=1200M should report a higher quota limit overriding the default quota setting. I tried to specify user-specific values for userdb_quota_storage_extra and userdb_quota_storage_percentage, which worked; probably, because there were no default value specified in the config, yet? Setting userdb_quota_storage_extra to 200M works: web1p1:::::::userdb_quota_storage_extra=200M ... # doveadm user web1p1 field value uid 644 gid 105 home /home/pop/web1p1 mail_path /home/pop/web1p1/mail system_groups_user web1p1 quota_storage_extra 200M ... # doveadm quota get -u web1p1 Quota name Type Value Limit % user STORAGE 798830 972800 82 user MESSAGE 5617 - 0 Quota is reported as correctly as 750M+200M=950M. Same approach works when setting userdb_quota_storage_percentage, e.g. to a value above 100. [1] [1]https://doc.dovecot.org/main/core/plugins/quota.html#per-user-quota Many thanks for your support! Matthieu References Visible links 1. https://doc.dovecot.org/main/core/plugins/quota.html#per-user-quota

2 2

Confusion about ACL Files in Shared Mailboxes
by fc26wuqa＠studserv.uni-leipzig.de 07 Oct '25

07 Oct '25

Hello, I have a shared mailbox which I want to set ACL permissions to. I already tried "doveadm acl set -u shared-user Shared/shared_mailbox group=somegroup lookup read write write-seen write-deleted insert post delete expunge create" My shared namespace is configured like this: "type = shared, prefix = Shared/%%u" I get "Error: Can't update acl object '': No local acl file path", "Error: Mailbox Shared/shared_mailbox: Failed to set ACL". When I do "* group=some_group kxeilprwts" in dovecot-acl in the shared Mailbox, all users in group some_group lose all access to their folders (shared and not shared) except INBOX. What am I doing wrong?

2 1

recipient_delimiter issue
by Benoit Panizzon 06 Oct '25

06 Oct '25

Hi Gang We use Postfix and Dovecot. To allow customers to use sub addressing we have configured postfix and dovecot with recipient_delimiter = + This allows email addresses of the form john+doe(a)example.com The way postfix processes the recipient_delimiter is by first looking up 'john+doe' and if this is not found, try again with 'john'. This allow both to work, email accounts which contain the + sign as part of the address and sub addressing. Collisions may happen! I am aware of this! The full email address with + wins. I recall dovecot also performed the same lookup in an earlier version but I might be wrong as now after some colleagues re-configured our email platform to use authentication caching and the dovecot proxy functionality, this does not work anymore. Dovecot takes + as hard delimiter and only performs a lookup for 'john' thus returns the account 'john' does not exist. Is there a way to configure dovecot to handle recipient_delimiter the same way postfix does by trying the full username first and only if that fails retry with the part in front of the delimiter? Mit freundlichen Grüssen -Benoît Panizzon- -- I m p r o W a r e A G - Leiter Commerce Kunden ______________________________________________________ Zurlindenstrasse 29 Tel +41 61 826 93 00 CH-4133 Pratteln Fax +41 61 826 93 01 Schweiz Web http://www.imp.ch ______________________________________________________

1 0

Lots of problems with Dovecot 2.4
by sev+dovecot＠sev.monster 06 Oct '25

06 Oct '25

Hello all, I am trying to get Dovecot 2.4 running on Alpine Edge x86-64. But a myriad of problems have occurred that make it impossible to do so. First of all was the recent off-by-one bug that was recently fixed, which caused an unavoidable segfault on start under musl libc, which Alpine uses: https://gitlab.alpinelinux.org/alpine/aports/-/issues/17050 Then, I saw that the shadow driver was removed, which necessitated the installation of PAM and my learning about it... I haven't needed it before, so I'd never used it. I guess I understand why the decision was made to use PAM, though I still don't like it. After resolving those issue, I've run into new ones: 1. The passwd userdb does not seem to work correctly. It is able to get the first user and its information correctly, but any attempts to look up any user after that will seemingly always use the information from the first matched user. Setting max auths to 1 so that the auth process is discarded afterwards does not seem to help. For example, if the first user to log in to Dovecot is bob, and then user joe logs in, the information returned from the passwd userdb will all be that of user bob, not joe. This continues for all subsequent userdb lookups until Dovecot is restarted, and a new userdb lookup is persisted. Changing to passwd-file instead works and does not experience this problem. 2. Why is the only available username field for the passwd driver %{passwd:system_groups_user}? I understand what the purpose of the field is based on the docs, but shouldn't more than this be exposed? The fields available through passwd are also not documented, and I had to read the source to find them out. This should either be documented or a more standard username field be additionally exposed as with other drivers. Can this field even be relied on to use as the username, if the driver otherwise worked? 3. It seems the Exim auth driver is no longer able to successfully authenticate with Dovecot 2.4 against Exim 4.98.2. It works fine in the last version of 2.3.21.1. Has the authentication framework changed along with the other modifications that 2.4 underwent? Has any effort been made with the Exim team to resolve any incompatibilities? Can I somehow diagnose this issue if it's otherwise supposed to work? 4. The ldap driver can no longer look up missing fields from LDAP users. Some (but not all) of my users have the rfc2307bis schema posixAccount supplemental objectClass, and as such contain the posixHome, uidNumber, and gidNumber attributes—but even if I specify a default value, if one of the attributes is not queryable for the returned user, the lookup errors out and the login fails. This is a regression/undocumented change from 2.3.x, where instead of erroring out, the default_fields value would be used. Based on my interpretation of the design goals for 2.4, I would imagine the default filter would ignore the missing attribute error and set the default value like default_fields used to, no? Or am I missing something? 5. passdb_ldap_filter is always required for the ldap passdb driver, even if passdb_ldap_bind is enabled. Not only does this go against the docs, but the value is unused and it doesn't matter what it's set to. This is a regression from 2.3.x. Overall I am very unimpressed by 2.4. It clearly needed a lot more time in the oven and much more thorough testing. Relevant minimal config from my working 2.3.21.1 install: auth_username_format = %Ln auth_mechanisms = plain login passdb { driver = shadow } userdb { driver = passwd override_fields = gid=mail home=/var/mail/%Ln } passdb { driver = ldap args = /etc/dovecot/ldap-passdb.conf.ext #uris = ldapi://%2frun%2fopenldap%2fslapd.sock #base = ou=accounts,dc=ldap #auth_bind = yes #auth_bind_userdn = uid=%Ln,ou=accounts,dc=ldap } userdb { driver = ldap default_fields = uid=mail gid=mail home=/var/mail/%Ln args = /etc/dovecot/ldap-userdb.conf.ext #uris = ldapi://%2frun%2fopenldap%2fslapd.sock #dn = cn=dovecot,dc=ldap #dnpass = "some pw" #base = ou=accounts,dc=ldap #iterate_filter = (objectClass=inetOrgPerson) #iterate_attrs = uid=username #user_filter = (&(objectClass=inetOrgPerson)(uid=%Ln)) #user_attrs = homeDirectory=home,uidNumber=uid,gidNumber=gid } mail_location = maildir:/var/mail/%Ln mail_plugins = $mail_plugins virtual namespace inbox { inbox = yes mailbox INBOX { auto = subscribe } } namespace virtual { type = private separator = . prefix = "Search Folders." location = virtual:/etc/dovecot/virtual:INDEX=~/dovecot-virtual.cache:CONTROL=~/dovecot-virtual.cache:VOLATILEDIR=~/dovecot-virtual.cache # virtual/All/dovecot-virtual: #!INBOX #* #-Junk #-Junk* #-Spam #-Spam* #-Trash #-Trash* #-Deleted #-Deleted* #-Deleted Items #-Deleted Items* # all hidden = yes list = children subscriptions = no mailbox All { auto = subscribe special_use = \All comment = All messages, excluding Junk and Trash } } namespace virtual-user { type = private separator = . prefix = "User Search Folders." location = virtual:~/.virtual:INDEX=~/dovecot-virtual-user.cache:CONTROL=~/dovecot-virtual-user.cache:VOLATILEDIR=~/dovecot-virtual-user.cache:LAYOUT=maildir++ hidden = yes list = children subscriptions = no } service auth { unix_listener auth-userdb { # restrict userdb to dovecot user/group only instead of world read/write mode = 0660 user = $default_internal_user group = $default_internal_group } unix_listener auth-client { # give Exim access to native authentication mode = 0660 group = exim } } service auth-worker { # no need to run as root user = $default_internal_user # allow pam passdb to read /etc/shadow group = shadow } !include_try /usr/share/dovecot/protocols.d/*.conf protocol imap { mail_max_userip_connections = 25 } protocol pop3 { mail_max_userip_connections = 25 } Converted config for 2.4: dovecot_config_version = 2.4.1 dovecot_storage_version = 2.4.1 mail_home = /var/mail/%{user | username | lower } mail_driver = maildir mail_path = $SET:mail_home mail_plugins = virtual auth_username_format = %{user | username | lower } auth_mechanisms = plain login passdb pam { failure_show_msg = yes max_requests = 1 } userdb passwd-file { passwd_file_path = /etc/passwd fields { gid = mail } } # BUG: doesn't work right #userdb passwd { # fields { # gid = mail # } #} passdb ldap { ldap_uris = ldapi://%2frun%2fopenldap%2fslapd.sock ldap_connection_group = login ldap_base = ou=accounts,dc=ldap ldap_bind = yes ldap_bind_userdn = uid=%{user | username | lower },ou=accounts,dc=ldap # XXX: thought this wasnt needed with bind? ldap_filter = z } userdb ldap { ldap_uris = ldapi://%2frun%2fopenldap%2fslapd.sock ldap_auth_dn = cn=dovecot,dc=ldap ldap_auth_dn_password = "some pw" ldap_base = ou=accounts,dc=ldap ldap_filter = (&(objectClass=inetOrgPerson)(uid=%{user | username | lower })) fields { username = %{ldap:uid} # BUG: causes errors if rfc2307bis posixAccount objectClass is not set home = %{ldap:homeDirectory | default($SET:mail_home)} uid = %{ldap:uidNumber | default(mail)} gid = %{ldap:gidNumber | default(mail)} } ldap_iterate_filter = (objectClass=inetOrgPerson) iterate_fields { username = %{ldap:uid} } } namespace inbox { inbox = yes mailbox INBOX { auto = subscribe } } namespace virtual { type = private separator = . prefix = "Search Folders." mail_driver = virtual mail_path = /etc/dovecot/virtual # virtual/All/dovecot-virtual: #!INBOX #* #-Junk #-Junk* #-Spam #-Spam* #-Trash #-Trash* #-Deleted #-Deleted* #-Deleted Items #-Deleted Items* # all mail_index_path = ~/dovecot-virtual.cache mail_control_path = ~/dovecot-virtual.cache mail_volatile_path = ~/dovecot-virtual.cache hidden = yes list = children subscriptions = no mailbox All { auto = subscribe special_use = \All comment = All messages, excluding Junk and Trash } } namespace virtual-user { type = private separator = . prefix = "User Search Folders." mail_driver = virtual mail_path = ~/dovecot-virtual-user mail_index_path = ~/dovecot-virtual-user.cache mail_control_path = ~/dovecot-virtual-user.cache mail_volatile_path = ~/dovecot-virtual-user.cache mailbox_list_layout = Maildir++ hidden = yes list = children subscriptions = no } service auth { unix_listener auth-userdb { # restrict userdb to dovecot user/group only instead of world read/write mode = 0660 } unix_listener auth-client { # give Exim access to native authentication mode = 0660 group = exim } } service auth-worker { # no need to run as root user = $SET:default_internal_user # allow pam passdb to read /etc/shadow group = shadow } protocols = imap pop3 protocol imap { mail_max_userip_connections = 25 } protocol pop3 { mail_max_userip_connections = 25 } In addition to help with the noted issues, I'd also love if anyone more knowledgeable on Dovecot 2.4 could give any pointers on my config and if I could improve the translation in any way, given I have been fumbling around with it for weeks and am not really sure if my various decisions are correct. Best regards.

9 11

A question about Debian
by Jean-Paul POZZI 06 Oct '25

06 Oct '25

Hello, I want to install Dovecot CE on a new machine fitted with a Debian Trixie and there is no Dovecot repository for Trixie. Is a Trixie-friendly version planned for the near future? Regards JPP Hello, I want to install Dovecot CE on a new machine fitted with a Debian Trixie and there is no Dovecot repository for Trixie. Is a Trixie-friendly version planned for the near future? Regards JPP

7 8

Message duplication in Sent folder after upgrade
by Oliver Welter 04 Oct '25

04 Oct '25

Hi All, I have migrated my mailserver (from dovecot 2.2 on debian 10 to dovecot 2.3 provided by the mailcow-dockerized project) by coping over the mailstorage directory "as is". There is now a single mailbox where I have an issue with duplicated mails - the "Sent" folder had approx 400 mails upon migration, it now has 4500 mails with each mail duplicated several times. Below are the header lines of one message, besides the Message-Id the header is exactly the same on all copies. I tried "doveadm force-resync" on the mailbox and the mailbox was removed and recreated from scratch on the mail app but we still get additional copies added - anybody has an idea what is going on here and how to fix this? Oliver From: "presse(a)example.com" <presse(a)example.com> Content-Type: multipart/alternative; boundary="Apple-Mail=_451F3D0B-155E-46EF-9BFB-B8034A7E2AE1" Mime-Version: 1.0 (Mac OS X Mail 16.0 $3826.300.87.4.3$) Subject: Re: EXTERN: Re: Example Mail X-Universally-Unique-Identifier: 6CD82CDA-138B-412E-8D4D-74C8C82B72ED Date: Mon, 13 Jan 2025 11:17:09 +0100 References: <DB3PR05MB100724231A87B9AE130C0EE0C853A2(a)DB3PR05MB10072.eurprd05.prod.outlook.com> <DB3PR05MB100725A1F1367C304AC417A9585002(a)DB3PR05MB10072.eurprd05.prod.outlook.com> <DB3PR05MB1007220945CC70CDACDDBA5D685022(a)DB3PR05MB10072.eurprd05.prod.outlook.com> <DB3PR05MB100724A5040FA029A29E625D1850D2(a)DB3PR05MB10072.eurprd05.prod.outlook.com> <09B63703-8BC4-484F-905A-899BA9A72139(a)example.com> <DB3PR05MB10072F836F9FCE2F9F626392D85142(a)DB3PR05MB10072.eurprd05.prod.outlook.com> <BA8A1660-FC7D-4478-9F5F-E8B062B39115(a)example.com> <005d01db659c$cf2a48c0$6d7eda40$@John.Doe@t-online.de> To: John Doe <John.Doe(a)t-online.de> In-Reply-To: <005d01db659c$cf2a48c0$6d7eda40$@Jon.Doe@t-online.de> Message-Id: <A03E3B7A-638A-4482-83D8-C5B297D9953E(a)example.com> -- Protect your environment - close windows and adopt a penguin! Hi All, I have migrated my mailserver (from dovecot 2.2 on debian 10 to dovecot 2.3 provided by the mailcow-dockerized project) by coping over the mailstorage directory "as is". There is now a single mailbox where I have an issue with duplicated mails - the "Sent" folder had approx 400 mails upon migration, it now has 4500 mails with each mail duplicated several times. Below are the header lines of one message, besides the Message-Id the header is exactly the same on all copies. I tried "doveadm force-resync" on the mailbox and the mailbox was removed and recreated from scratch on the mail app but we still get additional copies added - anybody has an idea what is going on here and how to fix this? Oliver From: [1]"presse(a)example.com" [2]<presse(a)example.com> Content-Type: multipart/alternative; boundary="Apple-Mail=_451F3D0B-155E-46EF-9BFB-B8034A7E2AE1" Mime-Version: 1.0 (Mac OS X Mail 16.0 $3826.300.87.4.3$) Subject: Re: EXTERN: Re: Example Mail X-Universally-Unique-Identifier: 6CD82CDA-138B-412E-8D4D-74C8C82B72ED Date: Mon, 13 Jan 2025 11:17:09 +0100 References: [3]<DB3PR05MB100724231A87B9AE130C0EE0C853A2(a)DB3PR05MB10072.eurprd05.prod.outlook.com> [4]<DB3PR05MB100725A1F1367C304AC417A9585002(a)DB3PR05MB10072.eurprd05.prod.outlook.com> [5]<DB3PR05MB1007220945CC70CDACDDBA5D685022(a)DB3PR05MB10072.eurprd05.prod.outlook.com> [6]<DB3PR05MB100724A5040FA029A29E625D1850D2(a)DB3PR05MB10072.eurprd05.prod.outlook.com> [7]<09B63703-8BC4-484F-905A-899BA9A72139(a)example.com> [8]<DB3PR05MB10072F836F9FCE2F9F626392D85142(a)DB3PR05MB10072.eurprd05.prod.outlook.com> [9]<BA8A1660-FC7D-4478-9F5F-E8B062B39115(a)example.com> [10]<005d01db659c$cf2a48c0$6d7eda40$@John.Doe@t-online.de> To: John Doe [11]<John.Doe(a)t-online.de> In-Reply-To: [12]<005d01db659c$cf2a48c0$6d7eda40$@Jon.Doe@t-online.de> Message-Id: [13]<A03E3B7A-638A-4482-83D8-C5B297D9953E(a)example.com> -- Protect your environment - close windows and adopt a penguin! References Visible links 1. mailto:presse@example.com 2. mailto:presse@example.com 3. mailto:DB3PR05MB100724231A87B9AE130C0EE0C853A2@db3pr05mb10072.eurprd05.prod.outlook.com 4. mailto:DB3PR05MB100725A1F1367C304AC417A9585002@db3pr05mb10072.eurprd05.prod.outlook.com 5. mailto:DB3PR05MB1007220945CC70CDACDDBA5D685022@db3pr05mb10072.eurprd05.prod.outlook.com 6. mailto:DB3PR05MB100724A5040FA029A29E625D1850D2@db3pr05mb10072.eurprd05.prod.outlook.com 7. mailto:09B63703-8BC4-484F-905A-899BA9A72139@example.com 8. mailto:DB3PR05MB10072F836F9FCE2F9F626392D85142@db3pr05mb10072.eurprd05.prod.outlook.com 9. mailto:BA8A1660-FC7D-4478-9F5F-E8B062B39115@example.com 10. mailto:005d01db659c$cf2a48c0$6d7eda40$@John.Doe@t-online.de 11. mailto:John.Doe@t-online.de 12. mailto:005d01db659c$cf2a48c0$6d7eda40$@Jon.Doe@t-online.de 13. mailto:A03E3B7A-638A-4482-83D8-C5B297D9953E@example.com

3 4

doveadm sync across versions
by Joel Mawhorter 04 Oct '25

04 Oct '25

Greetings, How close in versions do dovecot installations need to be in order to use doveadm sync? Exact same version? Same major version? thanks, Joel

3 3

help debugging a dsync panic
by Joel Mawhorter 04 Oct '25

04 Oct '25

Hello all, I'm trying to use deoveadm to sync from a dovecot server running version 2.3.21.1 to a version running 2.4.1. On the side initiating the "doveadm sync", I get the following error: dsync-remote(joel(a)zzzzz.org)<NRNIIBS132iEKgAAoT89Zw>: Panic: file dsync-mailbox-import.c: line 2188 (dsync_mailbox_import_handle_mail): assertion failed: (array_count(&wanted_uids) > 0) dsync-remote(joel(a)zzzzz.org)<NRNIIBS132iEKgAAoT89Zw>: Error: Raw backtrace: #1 [unw_get_proc_name() failed: -10] -> #2 default_fatal_handler[0xffffac4800a0] -> #3 i_panic[0xffffac3a3700] -> #4 [unw_get_proc_name() failed: -10] -> #5 dsync_mailbox_import_changes_finish[0xaaaadf53e804] -> #6 dsync_brain_sync_mails[0xaaaadf53ef4c] -> #7 [unw_get_proc_name() failed: -10] -> #8 [unw_get_proc_name() failed: -10] -> #9 [unw_get_proc_name() failed: -10] -> #10 io_loop_call_io[0xffffac4a1e30] -> #11 io_loop_handler_run_internal[0xffffac4a4420] -> #12 io_loop_handler_run[0xffffac4a4650] -> #13 io_loop_run[0xffffac4a4920] -> #14 [unw_get_proc_name() failed: -10] -> #15 [unw_get_proc_name() failed: -10] -> #16 doveadm_cmd_ver2_to_mail_cmd_wrapper[0xaaaadf518e90] -> #17 doveadm_cmdline_run[0xaaaadf52e824] -> #18 doveadm_cmdline_try_run[0xaaaadf52ef40] -> #19 main[0xaaaadf5051e0] -> #20 [unw_get_proc_name() failed: -10] -> #21 __libc_start_main[0xffffac0a22e0] dsync-local(joel(a)zzzzz.org)<RbkUCxO132hp0QAAVDKehA>: Error: read(mail2.zzzzz.org) failed: EOF (last sent=mail_request (EOL), last recv=mail_change (EOL)) dsync-local(joel(a)zzzzz.org)<RbkUCxO132hp0QAAVDKehA>: Error: Remote command returned error 255: ssh zz.zz.zz.zz doveadm dsync-server -ujoel(a)zzzzz.org Neither server has errors in the log corresponding to this error. Both servers are still running after this error. I'm looking for some help in how to debug this. The above error is entire and only changed to obfuscate domain names and IP addresses. Joel

2 1

IMAPSieve filters don't run on virtual mailboxes
by Ákos Szőts 03 Oct '25

03 Oct '25

Hi everyone, In the following configuration my IMAPSieve script doesn't run on the configured "copy" action when I assign it to a virtual mailbox. However, using the very same config snippet on a regular mailbox, the script suddenly starts to work. Move direction: from virtual to virtual (INBOX/Primary to INBOX/Notification). Do you know how to assign IMAPSieve to virtual mailboxes? Virtual config: namespace virtual-classification { prefix = "INBOX/" separator = / mail_driver = virtual mail_path = /var/lib/dovecot/virtual/classification/en mail_index_path = %{home}/index/virtual/classification/en namespace_subscriptions = no mailbox Notification { auto = subscribe sieve_script classification-move1 { type = before cause = copy append path = /var/lib/dovecot/sieve/imapsieve.d/classification-move.sieve } } mailbox Primary { [...] } } Sieve script: require ["vnd.dovecot.debug"]; debug_log "IMAPSIEVE SCRIPT WAS CALLED!"; Virtual file: virtual/classification/en/Notification/dovecot-virtual: !INBOX KEYWORD classification-notification The same result with "!INBOX" and "INBOX". Inbox namespace (working example): namespace inbox { separator = / inbox = yes mail_path = %{home}/mail mail_index_path = %{home}/index/inbox mailbox "Archive" { special_use = \Archive auto = subscribe sieve_script classification-move1 { type = before cause = copy append path = /var/lib/dovecot/sieve/imapsieve.d/classification-move.sieve } } } In the latter case the script is called properly and I see the debug message in info.log. But in the virtual case, the script doesn't run. Debug logs of failing case: Mailbox INBOX: Mailbox opened Mailbox INBOX/Primary: Mailbox opened Mailbox INBOX: Mailbox opened Namespace inbox: Using permissions from /var/spool/mail/[...]//mail: mode=0700 gid=default Mailbox INBOX: Mailbox opened Mailbox INBOX: imapsieve: MOVE event Mailbox INBOX: UID 2147: Expunge requested Mailbox INBOX/Primary: UID 47: Expunge requested dict(file): dict created (driver=file) dict(file): Looking up 'shared/90b3ed0066c4fe670a000000b7545530/imapsieve/script' dict(file): Lookup finished for 'shared/90b3ed0066c4fe670a000000b7545530/imapsieve/script': not found Mailbox INBOX: imapsieve: Mailbox attribute /shared/imapsieve/script not found dict(file): Looking up 'shared/90b3ed0066c4fe670a000000b7545530/vendor/vendor.dovecot/pvt/server/imapsieve/script' dict(file): Lookup finished for 'shared/90b3ed0066c4fe670a000000b7545530/vendor/vendor.dovecot/pvt/server/imapsieve/script': not found Mailbox INBOX: imapsieve: Server attribute /shared/imapsieve/script not found duplicate db: Initialize sieve: Pigeonhole version 2.4.1-4 (0a86619f) initializing Loading modules from directory: /usr/lib64/dovecot/modules/sieve Module loaded: /usr/lib64/dovecot/modules/sieve/lib90_sieve_extprograms_plugin.so Module loaded: /usr/lib64/dovecot/modules/sieve/lib90_sieve_imapsieve_plugin.so sieve: Sieve Extprograms plugin for Pigeonhole version 2.4.1-4 (0a86619f) loaded sieve: Sieve imapsieve plugin for Pigeonhole version 2.4.1-4 (0a86619f) loaded fts-flatcurve: fts-flatcurve(INBOX): Expunge uid=2147 fts-flatcurve: fts-flatcurve(INBOX): Opened DB (RO) messages=136 version=1 shards=2 fts-flatcurve: fts-flatcurve(INBOX): Opened DB (RW, current.1755771145431021) messages=48 version=1 Mailbox INBOX: UID 2147: Mail expunged fts-flatcurve: fts-flatcurve(INBOX): Committed 1 changes to DB (RW, current.1755771145431021) in 0.003 secs fts-flatcurve: fts-flatcurve: Update transaction completed in 0.004 secs Mailbox INBOX/Primary: Backend mailbox INBOX changed: UIDNEXT changed: 2277 -> 2278 IMAPSieve config seems to work (based on the successful regular mailbox example), so I don't paste the whole sieve config (but in case it's necessary, I'll do it). Ákos

2 1

Message duplication in Sent folder after upgrade
by Oliver Welter 03 Oct '25

03 Oct '25

Hi All, I have migrated my mailserver (from dovecot 2.2 on debian 10 to dovecot 2.3 provided by the mailcow-dockerized project) by coping over the mailstorage directory "as is". There is now a single mailbox where I have an issue with duplicated mails - the "Sent" folder had approx 400 mails upon migration, it now has 4500 mails with each mail duplicated several times. Below are the header lines of one message, besides the Message-Id the header is exactly the same on all copies. I tried "doveadm force-resync" on the mailbox and the mailbox was removed and recreated from scratch on the mail app but we still get additional copies added - anybody has an idea what is going on here and how to fix this? Oliver From: "presse(a)example.com" <presse(a)example.com> Content-Type: multipart/alternative; boundary="Apple-Mail=_451F3D0B-155E-46EF-9BFB-B8034A7E2AE1" Mime-Version: 1.0 (Mac OS X Mail 16.0 $3826.300.87.4.3$) Subject: Re: EXTERN: Re: Example Mail X-Universally-Unique-Identifier: 6CD82CDA-138B-412E-8D4D-74C8C82B72ED Date: Mon, 13 Jan 2025 11:17:09 +0100 References: <DB3PR05MB100724231A87B9AE130C0EE0C853A2(a)DB3PR05MB10072.eurprd05.prod.outlook.com> <DB3PR05MB100725A1F1367C304AC417A9585002(a)DB3PR05MB10072.eurprd05.prod.outlook.com> <DB3PR05MB1007220945CC70CDACDDBA5D685022(a)DB3PR05MB10072.eurprd05.prod.outlook.com> <DB3PR05MB100724A5040FA029A29E625D1850D2(a)DB3PR05MB10072.eurprd05.prod.outlook.com> <09B63703-8BC4-484F-905A-899BA9A72139(a)example.com> <DB3PR05MB10072F836F9FCE2F9F626392D85142(a)DB3PR05MB10072.eurprd05.prod.outlook.com> <BA8A1660-FC7D-4478-9F5F-E8B062B39115(a)example.com> <005d01db659c$cf2a48c0$6d7eda40$@John.Doe@t-online.de> To: John Doe <John.Doe(a)t-online.de> In-Reply-To: <005d01db659c$cf2a48c0$6d7eda40$@Jon.Doe@t-online.de> Message-Id: <A03E3B7A-638A-4482-83D8-C5B297D9953E(a)example.com> -- Protect your environment - close windows and adopt a penguin! Hi All, I have migrated my mailserver (from dovecot 2.2 on debian 10 to dovecot 2.3 provided by the mailcow-dockerized project) by coping over the mailstorage directory "as is". There is now a single mailbox where I have an issue with duplicated mails - the "Sent" folder had approx 400 mails upon migration, it now has 4500 mails with each mail duplicated several times. Below are the header lines of one message, besides the Message-Id the header is exactly the same on all copies. I tried "doveadm force-resync" on the mailbox and the mailbox was removed and recreated from scratch on the mail app but we still get additional copies added - anybody has an idea what is going on here and how to fix this? Oliver From: [1]"presse(a)example.com" [2]<presse(a)example.com> Content-Type: multipart/alternative; boundary="Apple-Mail=_451F3D0B-155E-46EF-9BFB-B8034A7E2AE1" Mime-Version: 1.0 (Mac OS X Mail 16.0 $3826.300.87.4.3$) Subject: Re: EXTERN: Re: Example Mail X-Universally-Unique-Identifier: 6CD82CDA-138B-412E-8D4D-74C8C82B72ED Date: Mon, 13 Jan 2025 11:17:09 +0100 References: [3]<DB3PR05MB100724231A87B9AE130C0EE0C853A2(a)DB3PR05MB10072.eurprd05.prod.outlook.com> [4]<DB3PR05MB100725A1F1367C304AC417A9585002(a)DB3PR05MB10072.eurprd05.prod.outlook.com> [5]<DB3PR05MB1007220945CC70CDACDDBA5D685022(a)DB3PR05MB10072.eurprd05.prod.outlook.com> [6]<DB3PR05MB100724A5040FA029A29E625D1850D2(a)DB3PR05MB10072.eurprd05.prod.outlook.com> [7]<09B63703-8BC4-484F-905A-899BA9A72139(a)example.com> [8]<DB3PR05MB10072F836F9FCE2F9F626392D85142(a)DB3PR05MB10072.eurprd05.prod.outlook.com> [9]<BA8A1660-FC7D-4478-9F5F-E8B062B39115(a)example.com> [10]<005d01db659c$cf2a48c0$6d7eda40$@John.Doe@t-online.de> To: John Doe [11]<John.Doe(a)t-online.de> In-Reply-To: [12]<005d01db659c$cf2a48c0$6d7eda40$@Jon.Doe@t-online.de> Message-Id: [13]<A03E3B7A-638A-4482-83D8-C5B297D9953E(a)example.com> -- Protect your environment - close windows and adopt a penguin! References Visible links 1. mailto:presse@example.com 2. mailto:presse@example.com 3. mailto:DB3PR05MB100724231A87B9AE130C0EE0C853A2@db3pr05mb10072.eurprd05.prod.outlook.com 4. mailto:DB3PR05MB100725A1F1367C304AC417A9585002@db3pr05mb10072.eurprd05.prod.outlook.com 5. mailto:DB3PR05MB1007220945CC70CDACDDBA5D685022@db3pr05mb10072.eurprd05.prod.outlook.com 6. mailto:DB3PR05MB100724A5040FA029A29E625D1850D2@db3pr05mb10072.eurprd05.prod.outlook.com 7. mailto:09B63703-8BC4-484F-905A-899BA9A72139@example.com 8. mailto:DB3PR05MB10072F836F9FCE2F9F626392D85142@db3pr05mb10072.eurprd05.prod.outlook.com 9. mailto:BA8A1660-FC7D-4478-9F5F-E8B062B39115@example.com 10. mailto:005d01db659c$cf2a48c0$6d7eda40$@John.Doe@t-online.de 11. mailto:John.Doe@t-online.de 12. mailto:005d01db659c$cf2a48c0$6d7eda40$@Jon.Doe@t-online.de 13. mailto:A03E3B7A-638A-4482-83D8-C5B297D9953E@example.com

1 0

Dovecot 2.3.21 Fallback MOVE to COPY on read-only namespaces
by Maciej Milaszewski 02 Oct '25

02 Oct '25

Hi I’m running Dovecot 2.3.21 with additional namespaces that point to read-only maildir snapshots. The setup works fine for browsing and copying messages, but when using Roundcube Webmail 1.5.3, there is a problem with the IMAP MOVE command. - If I try to move a message from a read-only namespace, Roundcube issues UID MOVE, which fails (as expected, since MOVE = COPY + DELETE, and DELETE is impossible). - What I would need is a way for Roundcube to fallback to COPY when the source/destination namespace is read-only ? I already tested: - `imap_move = false` in Roundcube config - Overriding capabilities in Dovecot (`imap_capability`) to remove MOVE, but this does not fully work. - Using INDEX=MEMORY / CONTROL outside snapshot for namespaces. What I’m looking for: - workaround in Dovecot to hide MOVE capability only for specific namespaces. - or Roundcube plugin or patch that intercepts MOVE and replaces it with COPY for read-only namespaces.

1 0

How to share ONE mailbox with a single user in, and configure auto ACL inheritance and Thunderbird SETACL support, in Dovecot 2.4.1?
by publists＠emailgroups.net 02 Oct '25

02 Oct '25

Hi, I’m working with Dovecot 2.4.1 and the acl plugin. I'm trying to get per-mailbox shared namespace+acl configured and working dynamically. One owner (owner(a)example.com) has a real Maildir folder "TEST_SHARE" at the top level cd /mail/path/example.com/owner/Maildir ls -1 cur/ dovecot-acl-list Drafts/ Junk/ new/ Queue/ Sent/ shared/ TEST_SHARE/ <------------------------ tmp/ Trash/ The goal is to share that TEST_SHARE/ folder with exactly one other user (user(a)example.com) not globally or using the global shared/ namespace. My current config includes It looks like in acl config you can hardwire access for a specific mailbox. Reading the 2.4 docs, using acl global file is deprecated and we're supposed to use acl config. namespace inbox { inbox = yes type = private prefix = separator = / hidden = no list = yes subscriptions = yes mailbox TEST_SHARE { acl owner { rights = lrwstipekxa } acl user=user(a)example.com { rights = lrwstipekx } } } namespace shared { type=shared; prefix=shared/$domain/$username/ } mail_plugin { acl = yes } acl_driver = vfile acl_sharing_map { dict file { path = /etc/dovecot/shared.db } } With that config "user" can see and use "owner’s" TEST_SHARE folder in Thunderbird client. But if "owner" changes the tree in their view, like creates a subfolder under TEST_SHARE in TBird, it does not appear for "user". No dovecot-acl file or acl_sharing_map entry is auto-created for the new subfolder. Reading the acl docs, I think that's because these ACLs are only STATIC configs that are merged with vfile ACLs at runtime? It looks to me like there's no automatic ACL inheritance from the parent to child mailboxes. And the acl.conf ACLs don't seem to cause dovecot-acl files or the acl_sharing_map db to be created or updated. I think "IMAP SETACL" would be needed on the client side. Reading https://support.mozilla.org/en-US/kb/imap-synchronization I can't figure out if Thunderbird does that or not. Can Dovecot server-side be configured to automatically create or update those shared acls/maps? I'm looking for any guidance how to do this, either in Thunderbird or Dovecot 2.4. So that any change to TEST_SHARE by either the owner or the authorized user is immediately pushed and sync'd between both owner and user. Dave

1 0

How to use redis as authentication database on dovecot 2.4.1
by 东山 02 Oct '25

02 Oct '25

How to use redis as authentication database on dovecot 2.4.1 Sir, dovecot is great, thanks. I want to use redis as authentication database on dovecot 2.4.1, but failed. Dict key-value database (Redis, memcached, etc.) is listed on v2.3, but was removed on 2.4.1. As https://doc.dovecot.org/2.4.1/core/config/auth/databases/lua.html , I was trying to auth via lua, like -- local redis = require('redis') -- on a lua file, but dovecot reported - module redis not found. I was trying to apt install dovecot-lua lua5.3 luarocks luaredis , but not work. Oct 02 11:02:54 debian dovecot[43745]: auth: Fatal: passdb-lua: script_init() failed: lua_pcall(/etc/dovecot/conf.d/auth_redis.lua) failed: /etc/dovecot/conf.d/auth_redis.lua:1: module 'redis' not found: Oct 02 11:02:54 debian dovecot[43745]: auth: Fatal: no field package.preload['redis'] Oct 02 11:02:54 debian dovecot[43745]: auth: Fatal: no file '/usr/local/share/lua/5.4/redis.lua' Oct 02 11:02:54 debian dovecot[43745]: auth: Fatal: no file '/usr/local/share/lua/5.4/redis/init.lua' Oct 02 11:02:54 debian dovecot[43745]: auth: Fatal: no file '/usr/local/lib/lua/5.4/redis.lua' Oct 02 11:02:54 debian dovecot[43745]: auth: Fatal: no file '/usr/local/lib/lua/5.4/redis/init.lua' Oct 02 11:02:54 debian dovecot[43745]: auth: Fatal: no file '/usr/share/lua/5.4/redis.lua' Oct 02 11:02:54 debian dovecot[43745]: auth: Fatal: no file '/usr/share/lua/5.4/redis/init.lua' Oct 02 11:02:54 debian dovecot[43745]: auth: Fatal: no file './redis.lua' Oct 02 11:02:54 debian dovecot[43745]: auth: Fatal: no file './redis/init.lua' Oct 02 11:02:54 debian dovecot[43745]: auth: Fatal: no file '/usr/local/lib/lua/5.4/redis.so' Oct 02 11:02:54 debian dovecot[43745]: auth: Fatal: no file '/usr/lib/x86_64-linux-gnu/lua/5.4/redis.so' Oct 02 11:02:54 debian dovecot[43745]: auth: Fatal: no file '/usr/lib/lua/5.4/redis.so' Oct 02 11:02:54 debian dovecot[43745]: auth: Fatal: no file '/usr/local/lib/lua/5.4/loadall.so' Oct 02 11:02:54 debian dovecot[43745]: auth: Fatal: no file './redis.so' Oct 02 11:02:54 debian dovecot[43745]: auth: Fatal: stack traceback: Oct 02 11:02:54 debian dovecot[43745]: auth: Fatal: [C]: in function 'require' Oct 02 11:02:54 debian dovecot[43745]: auth: Fatal: /etc/dovecot/conf.d/auth_redis.lua:1: in main chunk Oct 02 11:02:54 debian dovecot[43743]: master: Error: service(auth): command startup failed, throttling for 2.000 secs How to use redis as authentication database on dovecot 2.4.1? How to add redis.so to let dovecot's lua support redis connection? Thanks.

1 0

Re: Using MongoDB as a custom message store via plugin
by Andy Balholm 01 Oct '25

01 Oct '25

I wouldn't be surprised if it would actually be easier to write an IMAP server than to write a Dovecot plugin, especially if you have a good IMAP library to work with. You can do it in the language of your choice, and not need to worry about Dovecot's internals. The server you make can be pretty bare-bones, if you plan to run Dovecot in front of it as an "IMAPC" proxy to add more features. Dovecot lets you turn off a lot of IMAP features in the IMAPC configuration; if Dovecot will be your only client, you don't need to implement the ones that you turn off. (But note that IMAPC works a lot better if you implement the UIDPLUS IMAP extension.) Andy

1 0

[Dovecot] auth: Error: net_connect_unix(anvil-auth-penalty) failed: Permission denied
by mailing＠securitylabs.it 01 Oct '25

01 Oct '25

Hello, just upgraded one of my testing machine from dovecot 1.2.15 to 2.0.7. After some trouble with permissions now all seems working, but when I stop dovecot I have these errors in log: Nov 9 17:08:07 in dovecot: master: Warning: Killed with signal 15 (by pid=20362 uid=0 code=kill) Nov 9 17:08:07 in dovecot: pop3-login: Error: read(anvil) failed: EOF Nov 9 17:08:07 in dovecot: imap-login: Error: read(anvil) failed: EOF Nov 9 17:08:07 in dovecot: imap(mailing(a)securitylabs.it): Server shutting down. bytes=410/59361 Nov 9 17:08:07 in dovecot: imap(mailing(a)securitylabs.it): Server shutting down. bytes=79/26605 Nov 9 17:08:07 in dovecot: imap(mailing(a)securitylabs.it): Server shutting down. bytes=802/55708 Nov 9 17:08:07 in dovecot: imap(mailing(a)securitylabs.it): Server shutting down. bytes=258/1242 Nov 9 17:08:07 in dovecot: auth: Error: read(anvil-auth-penalty) failed: EOF Nov 9 17:08:07 in dovecot: auth: Error: net_connect_unix(anvil-auth-penalty) failed: Permission denied dovecot -n: # 2.0.7: /usr/local/etc/dovecot/dovecot.conf # OS: Linux 2.6.32-5-xen-686 i686 Debian squeeze/sid auth_cache_negative_ttl = 2 mins auth_cache_size = 1000 M auth_cache_ttl = 2 mins auth_master_user_separator = * auth_username_chars = abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ01234567890.-_@& disable_plaintext_auth = no dotlock_use_excl = yes first_valid_uid = 100 last_valid_uid = 105 lock_method = dotlock log_timestamp = "%Y-%m-%d %H:%M:%S " login_greeting = Server ready. mail_fsync = never mail_gid = Debian-exim mail_location = maildir:~/Maildir:INDEX=/var/indexes/%d/%n mail_privileged_group = Debian-exim mail_uid = Debian-exim managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date namespace { inbox = yes location = prefix = separator = / type = private } namespace { location = maildir:~/Maildir/expunged prefix = EXPUNGED/ separator = / type = private } namespace { location = maildir:~/Maildir/deleted prefix = DELETED/ separator = / type = private } namespace { location = maildir:~/Maildir/deleted/expunged prefix = DELETED/EXPUNGED/ separator = / type = private } passdb { args = /usr/local/etc/dovecot-sql.conf driver = sql } passdb { args = /usr/local/etc/passwd.masterusers driver = passwd-file master = yes pass = yes } plugin { lazy_expunge = EXPUNGED/ DELETED/ DELETED/EXPUNGED/ mail_log_events = delete expunge mail_log_group_events = quota = maildir quota_warning = storage=80%% /usr/local/bin/dovecot-quota-warning.sh 80 quota_warning2 = storage=90%% /usr/local/bin/dovecot-quota-warning.sh 90 sieve = ~/.dovecot.sieve } pop3_no_flag_updates = yes protocols = imap pop3 service auth { unix_listener auth-userdb { group = Debian-exim mode = 0600 user = Debian-exim } } service imap-login { client_limit = 256 process_limit = 128 process_min_avail = 3 service_count = 1 } service imap { drop_priv_before_exec = yes process_limit = 256 vsz_limit = 256 B } service pop3-login { client_limit = 256 process_limit = 128 process_min_avail = 3 service_count = 1 } service pop3 { drop_priv_before_exec = yes process_limit = 256 vsz_limit = 256 B } ssl_cert = </usr/local/etc/dovecot.crt ssl_key = </usr/local/etc/dovecot.key userdb { args = /usr/local/etc/dovecot-sql.conf driver = sql } protocol imap { mail_max_userip_connections = 10 mail_plugins = " notify quota imap_quota mail_log lazy_expunge" } protocol pop3 { mail_max_userip_connections = 3 mail_plugins = " notify quota mail_log" pop3_uidl_format = %08Xu%08Xv } protocol lda { mail_plugins = quota sieve postmaster_address = postmaster(a)securitylabs.it } My /usr/local/var/run/dovecot directory: 4 drwxr-sr-x 4 root staff 4096 Nov 9 17:08 . 4 drwxrwsrwx 3 root staff 4096 Nov 9 17:05 .. 0 srw------- 1 root staff 0 Nov 9 17:05 anvil 0 srw------- 1 root staff 0 Nov 9 17:05 anvil-auth-penalty 0 srw------- 1 root staff 0 Nov 9 17:05 auth-client 0 srw------- 1 dovecot staff 0 Nov 9 17:05 auth-login 0 srw------- 1 root staff 0 Nov 9 17:05 auth-master 0 srw------- 1 Debian-exim Debian-exim 0 Nov 9 17:05 auth-userdb 0 srw------- 1 dovecot staff 0 Nov 9 17:05 auth-worker 0 srw------- 1 root staff 0 Nov 9 17:05 config 0 srw------- 1 root staff 0 Nov 9 17:05 dict 0 srw------- 1 root staff 0 Nov 9 17:05 director-admin 0 srw-rw-rw- 1 root staff 0 Nov 9 17:05 dns-client 0 srw------- 1 root staff 0 Nov 9 17:05 doveadm-server 0 lrwxrwxrwx 1 root staff 35 Nov 9 17:05 dovecot.conf -> /usr/local/etc/dovecot/dovecot.conf 4 drwxr-xr-x 2 root root 4096 Nov 9 17:05 empty 4 drwxr-x--- 2 root dovenull 4096 Nov 9 17:05 login My emails are delivered as user Debian-exim and users are virtual in a MySQL DB. This system is behind a proxy (so the master user)

7 7

Dovecot 2.3 to 2.4 invalid Maildir settings
by User 01 Oct '25

01 Oct '25

Greetings, I am unable to completely migrate my Dovecot 2.3 config to 2.4.1 as I'm unable to get past the following error: Error: Namespace inbox: maildir: maildir settings: Failed to parse configuration: Failed to override configuration from userdb: Invalid maildir=${domain}/${user}/: Setting is a named filter, use 'maildir {' I found a similar encounter at https://www.mail-archive.com/dovecot@dovecot.org/msg90843.html that points to https://doc.dovecot.org/2.4.0/core/config/mailbox/mail_location.html#per-us… yet I still can't get my config to work. I've attached my doveconf at the end, including the ported 2.3 settings that used to work for me (commented out). I would appreciate any advise. # /etc/dovecot/dovecot.conf dovecot_config_version = 2.4.1 dovecot_storage_version = 2.4.1 sql_driver = mysql mysql /run/mysqld/mysqld.sock { user = mail password = mail dbname = mail } passdb sql { query = SELECT username AS user, \ password FROM mailbox WHERE username = '%{user}' AND active='1' default_password_scheme = ARGON2I } userdb sql { query = SELECT maildir, \ 600 AS uid, \ 600 AS gid \ FROM mailbox WHERE username = '%{user}' AND active='1' iterate_query = SELECT username AS user FROM mailbox } # previously: # passdb { # driver = sql # args = /etc/dovecot/dovecot-sql.conf.ext # } # userdb { # driver = sql # args = /etc/dovecot/dovecot-sql.conf.ext # } # disable_plaintext_auth = yes auth_username_format = %{user | lower} # previously: "auth_username_format = %Lu" auth_mechanisms = plain login auth_default_domain = mail.com # previously: "auth_default_realm = mail.com" auth_debug = yes auth_debug_passwords = yes mail_privileged_group = mail # previously: "mail_location = maildir:~/Maildir" mail_driver = maildir mail_path = %{home}/Maildir mail_home = /var/vmail/%{user | domain}/%{user | username} # previously: "mail_home = /var/vmail/%d/%n/" service lmtp { unix_listener /var/spool/postfix/private/dovecot-lmtp { mode = 0600 user = postfix group = postfix } } service auth { unix_listener /var/spool/postfix/private/auth { mode = 0660 user = postfix group = postfix } } service stats { unix_listener stats-reader { user = nginx group = nginx mode = 0660 } unix_listener stats-writer { user = nginx group = nginx mode = 0660 } } ssl = required ssl_min_protocol = TLSv1.2 ssl_server_prefer_ciphers = server # previously: "ssl_prefer_server_ciphers = yes" ssl_server { dh_file = /etc/ssl/dovecot/dh.pem cert_file = /etc/ssl/dovecot/tls.pem key_file = /etc/ssl/dovecot/tls.key } # previously: # ssl_dh = </etc/ssl/dovecot/dh.pem # ssl_cert = </etc/ssl/dovecot/tls.pem # ssl_key = </etc/ssl/dovecot/tls.key namespace inbox { inbox = yes mailbox Archive { auto = subscribe special_use = \Archive } mailbox Drafts { auto = subscribe special_use = \Drafts } mailbox Junk { auto = subscribe special_use = \Junk } mailbox Trash { auto = subscribe special_use = \Trash } mailbox Sent { auto = subscribe special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } } protocols = imap lmtp # previously: /etc/dovecot/dovecot-sql.conf.ext driver = mysql connect = host=localhost dbname=mail user=mail password=mail default_pass_scheme = ARGON2I password_query = SELECT username AS user,password FROM mailbox WHERE username = '%u' AND active='1' user_query = SELECT maildir, 600 AS uid, 600 AS gid FROM mailbox WHERE username = '%u' AND active='1' iterate_query = SELECT username AS user FROM mailbox

5 7

Repository origin
by Christian Celler 01 Oct '25

01 Oct '25

Hi there, maybe this has been discussed on the list before, but a quick search found nothing on this topic. It would be really nice to have an "Origin" (and maybe a Label?) in the InRelease-file for the apt-repositories. Would it be possible to add this to the repositories on repo.dovecot.org, for easier, more comprehensive pinning and stuff? Best regards Christian Celler

1 0

2.3 to 2.4 /proc/self/io) failed: Permission denied
by Don Bowman 01 Oct '25

01 Oct '25

I have a dovecot system running in my kubernetes cluster that i use to gateway some emails to imap that are in turn used by systems that poll for email. No people are involved. Its been running for sometime on 2.3, i've now updated the base container to 2.4 and i have two problems, perhaps related, perhaps not. I'm assuming its related to my config changes for 2.4, but I'm kind of at my wits end. The first issue: Sep 06 15:05:31 imap(support)<443><YIobSSM+MMoKIAIr>: Debug: open(/proc/self/io) failed: Permission denied (euid=1001(support) egid=1001(support) missing +r perm: /proc/self/io) I am seeing errors like this. I can't figure why. I tried "doveadm force-resync -u support /home/support/Maildir/" and it returns no errors. The 2nd error, again, perhaps related, the user doing the poll for new email doesn't see it (despite I see the email delivered to the 'new' dir, it doesn't get picked up and moved to 'cur'). Below is my config file. In /home/support/Maildir i have the new, cur, tmp etc. There's no mention of 'INBOX', which i think my previous had (mail_location = maildir:/home/%u/Maildir:INBOX=/var/mail/%u/Maildir was previous) Any advice? I'm not sure where to go from here. dovecot_config_version = 2.4.1 dovecot_storage_version = 2.4.1 auth_mechanisms = plain login auth_allow_cleartext = yes #disable_plaintext_auth = no mail_privileged_group = mail #mail_location = maildir:/home/%u/Maildir:INBOX=/var/mail/%u/Maildir mail_driver = maildir mail_path = /var/mail/%{user | username}/Maildir mail_inbox_path = /var/mail/%{user | username}/Maildir userdb passwd { fields { home = /home/{%user | username} mail_driver = maildir mail_path = /var/mail/{%user | username}/Maildir mail_inbox_path = /var/mail/%{user | username}/Maildir } } passdb pam { service_name = dovecot } protocols = " imap" namespace inbox { inbox = yes mailbox Trash { auto = subscribe # autocreate and autosubscribe the Trash mailbox special_use = \Trash } mailbox Sent { auto = subscribe # autocreate and autosubscribe the Sent mailbox special_use = \Sent } } service imap-login { inet_listener imap { port = 143 } inet_listener imaps { port = 993 } } service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0660 user = postfix } } ssl=yes ssl_server_cert_file = /run/ca/tls.crt ssl_server_key_file = /run/ca/tls.key log_path = /tmp/dc.log mail_debug = yes ssl_min_protocol = TLSv1.2 log_debug = category=email # verbose_ssl=yes #auth_verbose=yes #auth_debug=yes I have a dovecot system running in my kubernetes cluster that i use to gateway some emails to imap that are in turn used by systems that poll for email. No people are involved. Its been running for sometime on 2.3, i've now updated the base container to 2.4 and i have two problems, perhaps related, perhaps not. I'm assuming its related to my config changes for 2.4, but I'm kind of at my wits end. The first issue: Sep 06 15:05:31 imap(support)<443><YIobSSM+MMoKIAIr>: Debug: open(/proc/self/io) failed: Permission denied (euid=1001(support) egid=1001(support) missing +r perm: /proc/self/io) I am seeing errors like this. I can't figure why. I tried "doveadm force-resync -u support /home/support/Maildir/" and it returns no errors. The 2nd error, again, perhaps related, the user doing the poll for new email doesn't see it (despite I see the email delivered to the 'new' dir, it doesn't get picked up and moved to 'cur'). Below is my config file. In /home/support/Maildir i have the new, cur, tmp etc. There's no mention of 'INBOX', which i think my previous had (mail_location = maildir:/home/%u/Maildir:INBOX=/var/mail/%u/Maildir was previous) Any advice? I'm not sure where to go from here. dovecot_config_version = 2.4.1 dovecot_storage_version = 2.4.1 auth_mechanisms = plain login auth_allow_cleartext = yes #disable_plaintext_auth = no mail_privileged_group = mail #mail_location = maildir:/home/%u/Maildir:INBOX=/var/mail/%u/Maildir mail_driver = maildir mail_path = /var/mail/%{user | username}/Maildir mail_inbox_path = /var/mail/%{user | username}/Maildir userdb passwd { fields { home = /home/{%user | username} mail_driver = maildir mail_path = /var/mail/{%user | username}/Maildir mail_inbox_path = /var/mail/%{user | username}/Maildir } } passdb pam { service_name = dovecot } protocols = " imap" namespace inbox { inbox = yes mailbox Trash { auto = subscribe # autocreate and autosubscribe the Trash mailbox special_use = \Trash } mailbox Sent { auto = subscribe # autocreate and autosubscribe the Sent mailbox special_use = \Sent } } service imap-login { inet_listener imap { port = 143 } inet_listener imaps { port = 993 } } service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0660 user = postfix } } ssl=yes ssl_server_cert_file = /run/ca/tls.crt ssl_server_key_file = /run/ca/tls.key log_path = /tmp/dc.log mail_debug = yes ssl_min_protocol = TLSv1.2 log_debug = category=email # verbose_ssl=yes #auth_verbose=yes #auth_debug=yes

4 3

Public namespace - configuration help (new to Dovecot) - version 2.3.x
by daniel.botting＠codethink.co.uk 01 Oct '25

01 Oct '25

Hi all, I'm configuring a public namespace for an existing Dovecot install, I have the public namespace configured and working in a basic manner (it can be subscribed to in an MUA and mail can be moved into it for a specified user named in the dovecot-acl file). I've followed the official docs: - https://doc.dovecot.org/2.3/configuration_manual/shared_mailboxes/public_sh… When I configure the MUA (Thunderbird) I can see the public namespace and a subfolder that I've manually created underneath (with new/cur/tmp folders, parent public folders also has a new tmp cur directories, mail cannot be moved into public top level folder), but it is displayed as below when subscribed to: public^subfolder I've resolved this by changing the separator to a / , however as per my doveconf -n below I then received a separator conflict, which I resolved by changing the separator for the default namespace to also be a / . As the default namespace is already using period ( . ) on the production servers, I'd like to continue using this separator and not / separator. The existing install of a couple of hundred mailboxes and I'm concerned I'll break the mailboxes /any existing sieve filters. I would like the public folder to display with an empty prefix as below, but I understand you cannot have two 'prefix =' (empty prefixes) : subfolder doveconf -n output below: # 2.3.21.1 (d492236fa0): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.21.1 (49005e73) # OS: Linux 5.10.0-35-cloud-amd64 x86_64 Debian 11.11 # Hostname: imap-server.hostname.co.uk auth_verbose = yes default_vsz_limit = 0 doveadm_password = # hidden, use -P to show it first_valid_gid = 8 first_valid_uid = 8 last_valid_gid = 8 last_valid_uid = 8 lda_mailbox_autocreate = yes lda_mailbox_autosubscribe = yes mail_gid = 8 mail_location = maildir:~/Maildir mail_plugins = " notify replication acl" mail_uid = 8 managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext editheader imapflags namespace { list = no location = maildir:/srv/vmail/public:INDEXPVT=~/Maildir/public prefix = Public/ separator = / subscriptions = no type = public } namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = separator = / <--- I'd like this to be a . instead } namespace subscriptions { hidden = yes list = no location = prefix = subscriptions/ <--- had to put something here because inbox namespace was empty subscriptions = yes } passdb { args = /etc/dovecot/dovecot-ldap.conf.ext driver = ldap } plugin { acl = vfile mail_replica = tcps:other-replica.domain.co.uk:port number sieve = ~/.dovecot.sieve sieve_before = /etc/dovecot/common.sieve sieve_dir = ~/sieve sieve_extensions = +editheader +imapflags } postmaster_address = postmaster(a)domain.co.uk protocols = " imap sieve pop3" replication_dsync_parameters = -d -N -l 15 -U -T 10 replication_max_conns = 24 service aggregator { fifo_listener replication-notify-fifo { user = mail } unix_listener replication-notify { user = mail } } service auth { unix_listener /var/run/dovecot-exim-bridge { mode = 0660 user = Debian-exim } } service doveadm { inet_listener { port = <replica port number> ssl = yes } } service imap-login { inet_listener imap { port = 143 } inet_listener imaps { port = 993 ssl = yes } process_limit = 512 process_min_avail = 4 service_count = 1 } service imap { process_limit = 1024 } service managesieve-login { inet_listener sieve { port = <port number> } process_min_avail = 1 service_count = 8 vsz_limit = 256 M } service managesieve { process_limit = 1024 } service replicator { process_min_avail = 1 unix_listener replicator-doveadm { mode = 0666 } } ssl = required ssl_cert = <path/to/fullchain.pem ssl_cipher_list = ALL:!LOW:!SSLv2:!EXP:!aNULL ssl_client_ca_dir = /etc/ssl/certs ssl_key = # hidden, use -P to show it userdb { args = /etc/dovecot/dovecot-ldap.conf.ext driver = ldap override_fields = home=/var/mail/%u uid=mail gid=mail } protocol lda { mail_plugins = " notify replication acl sieve" } protocol imap { mail_max_userip_connections = 32 mail_plugins = " notify replication acl acl" } protocol sieve { mail_max_userip_connections = 10 managesieve_logout_format = bytes=%i/%o managesieve_max_line_length = 64 k } Also the public folder is not displayed in Roundcube webmail in folder sections to be subscribed to. doveadm mailbox list -u <username> I appreciate that replication does not work with public mailboxes, I'll have to look at that further. Many thanks Dan

2 6

Using MongoDB as a custom message store via plugin
by The Sixth Serpent 30 Sep '25

30 Sep '25

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Hello Dovecot Community! I have recently written a NodeJS-based mail system that I hope to eventually open-source. The SMTP daemon (accepting inbound for delivery/relay) and queue processor (handing off messages to remote MTAs for relay messages) both use MongoDB (utilizing Mongoose Schema) to store/queue the messages (emails). All of this is in-place and working. Now, I turn my attention to making the emails accessible to the end user (i.e., webmail, POP3, and/or IMAP). I already have a working POP3+TLS daemon (NodeJS + Mongoose), though it is unlikely that I'll make the POP3 service available to my users. I'm hoping to make use of RoundCube or other open-source webmail clients. IMAP provides the interface between my message store and webmail/user's clients. I've chosen Dovecot (yay!) to provide this interface (as opposed to the nightmare of writing one from scratch) given that it's open source and it's extensibility via plugins. Does the idea of providing a MongoDB-based message store sound like something that can be done sole via plugins - or might this require modification of the actual Dovecot core? Is support for a MongoDB message store interesting to anyone beyond myself? I'd be happy to share my Mongoose schema (as the intent is to open source the entire project once I get it together). I'll also need Dovecot to authenticate against my MongoDB instance. I have a collection, called "mailboxes" that defines the username and password (hashed with ARGON2), among other things. I'm imagining that custom authentication is something that can be achieved via plugins alone? What does everyone think to be simpler/more appropriate: 1. authentication plugin that connects directly to MongoDB, fetches the authen creds, and verifies the password via ARGON2 2. authentication plugin that accesses a NodeJS-express API endpoint that provides a boolean result From my perspective, option (a) makes the most sense. I consider option (b) in case the plugin system doesn't support MongoDB, or doesn't support ARGON2, or .... Can anyone recommend any good docs/howtos on writing Dovecot plugins? Any plugins' whose source might be of interest to me (i.e., custom message store, custom auth, etc)? Thank you for taking the time to consider these questions! I appreciate any responses. I'll make available, or describe further, any aspect of my system if it will help. Regards, TJ Easter II -- "The Information Age offers much to mankind, and I would like to think that we will rise to the challenges it presents. But it is vital to remember that information - in the sense of raw data - is not knowledge; that knowledge is not wisdom; and that wisdom is not foresight. But information is the first essential step to all of these." -- Arthur C. Clarke; 12/2003 Sent with Proton Mail secure email. -----BEGIN PGP SIGNATURE----- Version: ProtonMail wsC5BAEBCgBtBYJo209sCRDKQ0X/3WTf3EUUAAAAAAAcACBzYWx0QG5vdGF0 aW9ucy5vcGVucGdwanMub3JnOD2KL5NSk5rYX75gCW+d8bYmHLJNP8m5nkVy wnHpCHMWIQTQAEbAbK1F7TqiE2jKQ0X/3WTf3AAAChQH/iXWnG3kBM3oQpfe Yd4Hv2TkN/iduzaXfOwWDBcUCP4Dc2YDnYR2W/6OI6hcFLaPw+RvEWe6FMvu aik7s5wypDdQv8bNugO7FkyyooA4UYDLoffRDNIHv+vTXviAmByjywU64Qor hNwajt+vXCuJZY21+vElXhk0Nnea62DrBhRjrVWjxEQAmj9dNSP0HG5woqcX mCYC/PufJLbQatcortFZV5Eiq0OQCfe7C7AEtPjA+isbx2lzqTpMhcmJ87qn 95FwmMoEUuQPoLiUfrzkbBcFECFRi9EZsMhPr4vwuZLlGr49vIyzzqMgI/gX /XJq4cu6mZ1j0Hp+N2zq1iDG55I= =6CWa -----END PGP SIGNATURE-----

1 0

ENV var expansions work mostly in 2.4, but not in some locations
by publists＠emailgroups.net 29 Sep '25

29 Sep '25

Hi, I'm trying to clean up my migrated v2.4 config. I'm still having a hard time with environment variable expansions :-( They work in most places. But so far for me not in mail_plugin_dir ssl_client_* or ssl_server_* listen= For example, this config using literal file paths works great ssl_server { ca_file = /path/to/CA.crt.pem ... } ssl_client { ca_file = /path/to/CA.crt.pem ... } protocol doveadm { ssl_server { ca_file = /path/to/CA.crt.pem ... } ... } protocol imap { ssl_server { ca_file = /path/to/CA.crt.pem ... } ... } protocol lmtp { ssl_server { ca_file = /path/to/CA.crt.pem ... } ... } protocol sieve { ssl_server { ca_file = /path/to/CA.crt.pem ... } ... } protocol submission { ssl_server { ca_file = /path/to/CA.crt.pem ... } ... } When I add an env var import_environment { CA_FILE=/path/to/CA.crt.pem } and change any of those /path/to/CA.crt.pem instances to this %{env:CA_FILE} OR this $ENV:CA_FILE I get errors os startup like dovecot[13660]: doveconf: Fatal: Error in configuration file /etc/dovecot/dovecot.conf: ssl_server_request_client_cert=yes, but ssl_server_ca_file not provided If I go back to literal paths, everything works OK. I've read these https://doc.dovecot.org/main/core/settings/variables.html https://doc.dovecot.org/main/core/settings/syntax.html#environment-variables https://doc.dovecot.org/main/core/settings/types.html#file and as far as I can tell this should work. Something's different about these that I'm not understanding. Or there's a list of keys that can't use these vars in values. How do you use ENV var expansion in ssl file paths, listen addresses, etc? Dave

1 0

Enforce LMTP auth with client certs
by rhi＠pengutronix.de 29 Sep '25

29 Sep '25

Hello, I'm trying to get TLS client cert authentication to work on the LMTP socket via TCP port 24 with Dovecot 2.4. I was already able to get TLS working on the LMTP socket, but if I connect to it via 'openssl s_client' from another machine, and type in a few LMTP commands, Dovecot accepts all mail without requesting a client cert from me. The server running Dovecot is behind a firewall, so LMTP connections should only be possible from the SMTP server in the same local network, not from the whole internet. However I want to guard against possible firewall misconfigs by enforcing client certs between the incoming SMTP server and Dovecot for mail delivery. Is there a way to do this in Dovecot? My /etc/dovecot/conf.d/20-lmtp.conf effectively looks like this: lmtp_save_to_detail_mailbox = yes lmtp_add_received_header = yes protocol lmtp { mail_plugins { sieve = yes } ssl = required ssl_server_ca_file = /etc/lmtp-ca/ca.crt ssl_server_cert_file = /etc/lmtp-ca/local.crt ssl_server_key_file = /etc/lmtp-ca/private/local.key ssl_server_request_client_cert = yes # TODO: this should enforce client certs, but it does not work... auth_ssl_require_client_cert = yes ssl_server_require_crl = no log_debug = category=ssl OR category=auth } … and /etc/dovecot/conf.d/10-master.conf has: service lmtp { #unix_listener lmtp { # mode = 0666 #} inet_listener lmtp { # Accept connections from anywhere, but 20-lmtp.conf configures LMTP to require client certs listen = * :: port = 24 inet_listener_ssl = yes # TODO: this should enforce client certs, but it does not work... auth_ssl_require_client_cert = yes } } I also tried enabling ssl_server_request_client_cert = yes and auth_ssl_require_client_cert = yes globally, but this did not make a difference. I already tried looking at the Dovecot source code, but didn't find anything yet. I'm happy for any pointers in the right direction. Thanks, - Roland

2 2

postfix alias and dovecot quota
by Alexandre Ellert 28 Sep '25

28 Sep '25

Hello, Can someone tell me if it’s possible to configure dovecot to answer quota information about real mailbox when I query a postfix alias mailbox (this information is actually in a mysql database) ? Example : doveadm quota get - u alias(a)domain.com doveadm(alias(a)domain.com): Fatal: User doesn't exist doveadm quota get - u realmailbox(a)domain.com Quota name Type Value Limit % user STORAGE 2048853 2048000 100 user MESSAGE 6783 - 0 I’d like to have this result : doveadm quota get - u alias(a)domain.com Quota name Type Value Limit % user STORAGE 2048853 2048000 100 user MESSAGE 6783 - 0 doveadm quota get - u realmailbox(a)domain.com Quota name Type Value Limit % user STORAGE 2048853 2048000 100 user MESSAGE 6783 - 0 Thanks for your help. Alexandre.

6 9

Dovecot 2.4.1 sieve
by Martin Brampton 28 Sep '25

28 Sep '25

Just upgraded mail server from Debian 12 to 13. Fixed a number of issues with changed Dovecot, but stuck getting sieve working. The server uses LMTP. I’ll post some configuration if it helps. But the messages in the log saying the plugin sieve_lmtpsieve is missing seems fundamental and relevant. I can’t find anything called that in the Debian repository. How is it installed? Or am I doing something fundamentally wrong? Martin Just upgraded mail server from Debian 12 to 13. Fixed a number of issues with changed Dovecot, but stuck getting sieve working. The server uses LMTP. I'll post some configuration if it helps. But the messages in the log saying the plugin sieve_lmtpsieve is missing seems fundamental and relevant. I can't find anything called that in the Debian repository. How is it installed? Or am I doing something fundamentally wrong? Martin

7 21

2.4.1 Config woes
by Anthony Mellor 27 Sep '25

27 Sep '25

Hi, greetings Do sing out please if this is the wrong place or style for this mailing list, please - and there's a community somewhere isn't there? spent days not succeeding with these configs. I'm a new install on Trixie and Dovecot 2.4.1 and going round in many circles with nano /etc/dovecot/dovecot.conf nano /etc/dovecot/conf.d/10-auth.conf nano /etc/dovecot/conf.d/auth-sql.conf.ext nano /etc/dovecot/conf.d/10-master.conf MariaDB having tried one million variations of this, so this is just one, being the latest suggestion # Declare named instances of passdb/userdb using the SQL driver passdb sql { } userdb sql { } # Passdb (authentication) SQL settings passdb_sql_driver = mysql # MariaDB uses "mysql" passdb_sql_host = 127.0.0.1 # or: /run/mysqld/mysqld.sock passdb_sql_port = 3306 passdb_sql_dbname = maildb passdb_sql_user = dovecot passdb_sql_password = CHANGEME # Choose the scheme to match your DB: # - MD5-CRYPT for $1$... hashes or {MD5-CRYPT} prefix # - PLAIN-MD5 for 32-hex unsalted MD5 passdb_sql_default_pass_scheme = MD5-CRYPT passdb_sql_password_query = \ SELECT username AS user, password \ FROM users \ WHERE username = '%u' (thought this is now changed) # Userdb (user lookup) SQL settings userdb_sql_driver = mysql userdb_sql_host = 127.0.0.1 userdb_sql_port = 3306 userdb_sql_dbname = maildb userdb_sql_user = dovecot userdb_sql_password = CHANGEME # Must return at least uid, gid and home or mail userdb_sql_user_query = \ SELECT \ 5000 AS uid, 5000 AS gid, \ home, \ CONCAT('maildir:', maildir) AS mail \ FROM users \ WHERE username = '%u' (thought this is now changed) I have never used Dovecot before this install ten days ago - any example files that work will be forever gratefully appreciated to give me a basic starting point. Very frustratingly at one 3am morning I did get it working and the lost it. a t b Anthony _______________________________________________ dovecot mailing list -- dovecot(a)dovecot.org To unsubscribe send an email to dovecot-leave(a)dovecot.org

1 0

2.4.1 Config woes
by Anthony Mellor 27 Sep '25

27 Sep '25

Hi, greetings Do sing out please if this is the wrong place or style for this mailing list, please - and there's a community somewhere isn't there? spent days not succeeding with these configs. I'm a new install on Trixie and Dovecot 2.4.1 and going round in many circles with nano /etc/dovecot/dovecot.conf nano /etc/dovecot/conf.d/10-auth.conf nano /etc/dovecot/conf.d/auth-sql.conf.ext nano /etc/dovecot/conf.d/10-master.conf MariaDB having tried one million variations of this, so this is just one, being the latest suggestion # Declare named instances of passdb/userdb using the SQL driver passdb sql { } userdb sql { } # Passdb (authentication) SQL settings passdb_sql_driver = mysql # MariaDB uses "mysql" passdb_sql_host = 127.0.0.1 # or: /run/mysqld/mysqld.sock passdb_sql_port = 3306 passdb_sql_dbname = maildb passdb_sql_user = dovecot passdb_sql_password = CHANGEME # Choose the scheme to match your DB: # - MD5-CRYPT for $1$... hashes or {MD5-CRYPT} prefix # - PLAIN-MD5 for 32-hex unsalted MD5 passdb_sql_default_pass_scheme = MD5-CRYPT passdb_sql_password_query = \ SELECT username AS user, password \ FROM users \ WHERE username = '%u' (thought this is now changed) # Userdb (user lookup) SQL settings userdb_sql_driver = mysql userdb_sql_host = 127.0.0.1 userdb_sql_port = 3306 userdb_sql_dbname = maildb userdb_sql_user = dovecot userdb_sql_password = CHANGEME # Must return at least uid, gid and home or mail userdb_sql_user_query = \ SELECT \ 5000 AS uid, 5000 AS gid, \ home, \ CONCAT('maildir:', maildir) AS mail \ FROM users \ WHERE username = '%u' (thought this is now changed) I have never used Dovecot before this install ten days ago - any example files that work will be forever gratefully appreciated to give me a basic starting point. Very frustratingly at one 3am morning I did get it working and the lost it. a t b Anthony

1 0

Slow inbox
by Rupert Gallagher 26 Sep '25

26 Sep '25

Hello, I note the following problem. If the inbox holds many subfolders with mail, thunderbird spends a lot of time on startup. To mitigate the problem, I asked users to keep the inbox clear of subfolders. However, a user keeps ignoring the local policy while also lamenting the mail is slow. Please write instructions to enforce this local policy in dovecot, so that when users try to create an inbox subfolder, dovecot refuses the action. Thank you

6 12

Dovecot and iOS 26 Mail.app
by Florian Effenberger 25 Sep '25

25 Sep '25

Hello, with the release of iOS 26, I had a look again at the infamous issue regarding Apple‘s Mail.app with Dovecot, when folder content does not reliably sync or mail content is not fully loaded. Some made a workaround by disabling pipelining (I didn‘t), and some pointed out Stalwart implemented some changes to work around the issue. A year ago, this was also prominently featured at Heise at least. I am not sure this is still a recent issue, but I wanted to share my findings. I have two different mail accounts on two different servers which have also different configurations. At least with iOS 26 I discovered that once the secondary mail account is added, both accounts suffer from the same problem again. The mere fact that I have two accounts is not the issue, because the secondary account also doesn’t work when the primary is disabled, but the other way round things have been working fine for at least a few days now. I assume that hiccups on one account affect both somehow. I did not yet get to compare the system configuration as to why the secondary account has hiccups, but maybe it helps those who debug the issue to reproduce it. Florian

1 0

Permissions Issues with shared Mailboxes, Unix Permissions and ACL
by fc26wuqa＠studserv.uni-leipzig.de 24 Sep '25

24 Sep '25

Hi, I use pam_ldap.so to use LDAP to authenticate my users. I don't use virtual accounts, but every account is a unix account. I use a post login script to export the `ACL_GROUPS` variable to hold all unix groups the user belongs to. Each group corresponds to a shared mailbox, where UNIX group permission handle which user gets access to the mailbox. Recently I added acl files to the shared mailboxes that look like: `group=some_group kxeilprwts` The Permissions of the user Mailboxes are generally 0700 and 0770 for shared mailboxes. The namespace of the shared Mailboxes looks something like: `type=shared, prefix=Shared/%%u/ location= maildir:/somewhere/'%%d/%%n/Maildir:INDEX=/srv/mails/%d/%n/Maildir/shared/%%u` Everything works fine, except my log gets flooded with messages saying: `open(/path/to/shared/mailbox) failed: Permission denied` and `opendir(/path/to/shared) failed: Permission denied, missing +x perm, we're not in group`. The user should also not be in the group. This is also reproducible when I do `doveadm mailbox list -u some_unix_user`, where dovecot tries to list all of the mailboxes, even though the user does not have permissions to do so. Referenced here: https://doc.dovecot.org/main/core/config/shared_mailboxes.html it says "Dovecot assumes that it can access the other users' mailboxes". So should I just ignore the messages/write a syslog filter for them? How can I prevent dovecot from checking every shared mailbox, even though they don't have access to it?

2 1

lib-sieve segfaults
by Alexander Gerasiov 23 Sep '25

23 Sep '25

Hi there, Just found wrong error handling (null pointer dereference) in lib-sieve How to reproduce: Enable global storage and try to check (via manage sieve api) require ["include"]; include :global "non exist script"; Here is a fix: https://github.com/dovecot/pigeonhole/pull/17 -- Best regards, Alexander Gerasiov Contacts: e-mail: a(a)gerasiov.net WWW: https://gerasiov.net TG/Skype: gerasiov PGP fingerprint: 04B5 9D90 DF7C C2AB CD49 BAEA CA87 E9E8 2AAC 33F1

1 0

2.3 to 2.4 unusual config
by Laura Steynes 22 Sep '25

22 Sep '25

We have two main mail server system, our broadband users on one, and, our hosting clients on another, because of the large number of customers on both, we use the following formats, I am looking at adding one dovecot 2.4 front end to the farm to see how it will perform, but with a such a complete rewrite requiring variable entry like we are all C programmers who understand code, which we are not and do not, I'm having headaches getting my head around how to convert these to this new weird format Broadband Users: jcitizen(a)example.net = /vmail/example.net/j/c/i/jcitizen mail_location = maildir:/vmail/%Ld/%1Ln/%1.1Ln/%2.1Ln/%Ln/Maildir Hosting Clients: jcitizen(a)example.net = /vmail/e/x/a/example.net/jcitizen mail_location = maildir:/vmail/%1Ld/%1.1Ld/%2.1Ld/%Ld/%Ln/Maildir Any help appreciated, we have no intentions of moving from 2.3.x in any foreseeable future, but if the time comes we must, we want to be able to have a plan to enact. -Loz We have two main mail server system, our broadband users on one, and, our hosting clients on another, because of the large number of customers on both, we use the following formats, I am looking at adding one dovecot 2.4 front end to the farm to see how it will perform, but with a such a complete rewrite requiring variable entry like we are all C programmers who understand code, which we are not and do not, I'm having headaches getting my head around how to convert these to this new weird format Broadband Users: [1]jcitizen(a)example.net = /vmail/[2]example.net/j/c/i/jcitizen mail_location = maildir:/vmail/%Ld/%1Ln/%1.1Ln/%2.1Ln/%Ln/Maildir Hosting Clients: [3]jcitizen(a)example.net = /vmail/e/x/a/[4]example.net/jcitizen mail_location = maildir:/vmail/%1Ld/%1.1Ld/%2.1Ld/%Ld/%Ln/Maildir Any help appreciated, we have no intentions of moving from 2.3.x in any foreseeable future, but if the time comes we must, we want to be able to have a plan to enact. -Loz References Visible links 1. mailto:jcitizen@example.net 2. http://example.net/j/c/i/jcitizen 3. mailto:jcitizen@example.net 4. http://example.net/jcitizen

2 1

variable expansion allowed in 'listen' config not working
by publists＠emailgroups.net 20 Sep '25

20 Sep '25

Hi, In a new dovecot 2.4 config I'm setting up a inet_listener for a service. I want to use an env var in `listen` expansion, like service imap-login { inet_listener imaps { listen = %{env:LAN_IPv4}, 127.0.0.1 } } This https://doc.dovecot.org/2.4.1/core/settings/variables.html says "You can use special variables in several places: All settings, except of type String without variables." Reading https://doc.dovecot.org/2.4.1/core/summaries/settings.html#listen `listen` directive allows listen Default *, :: Value IP addresses Unlike, for example deliver_log_format Default msgid=%{msgid}: %{message} Value String without variables which would be disallowed for "String without variables" I CAN use env vars across almost all of my config. But launch systemctl start dovecot fails with dovecot[17358]: Fatal: service(imap-login) Can't resolve address %{env:LAN_IPv4}: Name or service not known OTOH replacing - listen = %{env:LAN_IPv4}, 127.0.0.1 + listen = 10.1.1.1, 127.0.0.1 solves the launch issue. Like I said it works in other stanzas. Am I configuring this right for `listen`? Thanks, Dave

2 4

dovecot and oauth2 on fedora42
by Alex 20 Sep '25

20 Sep '25

Hi, I have a fedora42 system with dovecot-2.3.21 and trying to configure oauth2 support for a client application called acymailing as part of joomla. I'm trying to follow the instructions here, but I don't understand why I would need to involve google as the provider. How do I create my own provider? I don't want to authenticate against google, but against my own user database inside of joomla. I can create a local user, if that makes it possible, but not sure how to create the local provider it seems to require. https://doc.dovecot.org/2.3/configuration_manual/authentication/oauth2/ Thanks, Alex Hi, I have a fedora42 system with dovecot-2.3.21 and trying to configure oauth2 support for a client application called acymailing as part of joomla. I'm trying to follow the instructions here, but I don't understand why I would need to involve google as the provider. How do I create my own provider? I don't want to authenticate against google, but against my own user database inside of joomla. I can create a local user, if that makes it possible, but not sure how to create the local provider it seems to require. [1]https://doc.dovecot.org/2.3/configuration_manual/authentication/oauth2/ Thanks, Alex References Visible links 1. https://doc.dovecot.org/2.3/configuration_manual/authentication/oauth2/

2 1

library error
by Mihai Badici 20 Sep '25

20 Sep '25

I try to configure a public folder with acl on debian trixie . 2.4.1-4 (7d8c0e5759): /etc/dovecot/dovecot.conf # Pigeonhole version 2.4.1-4 (0a86619f) # OS: Linux 6.12.41+deb13-amd64 x86_64 Debian 13.1 If I don't enable imap_acl there are no acl's which seems legit. After enabling imap_acl ( mail_plugins = acl quota imap_acl) I can set acl's but I have this error: Fatal: Couldn't load required plugin /usr/lib/dovecot/modules/lib02_imap_acl_plugin.so: dlopen() failed: /usr/lib/dovecot/modules/lib02_imap_acl_plugin.so: undefined symbol: imap_list_return_flag_unregister I'm not sure if this can be a packaging error with the wrong version as it looks, a missing library or a bug... or maybe a missing parameter? If i run ldd on this .so there is no library missing: ldd /usr/lib/dovecot/modules/lib02_imap_acl_plugin.so linux-vdso.so.1 (0x00007fcfbfab3000) lib01_acl_plugin.so => /usr/lib/dovecot/modules/lib01_acl_plugin.so (0x00007fcfbfa8a000) libc.so.6 => /lib/x86_64-linux-gnu/libc.so.6 (0x00007fcfbf88b000) /lib64/ld-linux-x86-64.so.2 (0x00007fcfbfab5000) Thanks, Mihai Bădici I try to configure a public folder with acl on debian trixie . 2.4.1-4 (7d8c0e5759): /etc/dovecot/dovecot.conf # Pigeonhole version 2.4.1-4 (0a86619f) # OS: Linux 6.12.41+deb13-amd64 x86_64 Debian 13.1 If I don't enable imap_acl there are no acl's which seems legit. After enabling imap_acl ( mail_plugins = acl quota imap_acl) I can set acl's but I have this error: Fatal: Couldn't load required plugin /usr/lib/dovecot/modules/lib02_imap_acl_plugin.so: dlopen() failed: /usr/lib/dovecot/modules/lib02_imap_acl_plugin.so: undefined symbol: imap_list_return_flag_unregister I'm not sure if this can be a packaging error with the wrong version as it looks, a missing library or a bug... or maybe a missing parameter? If i run ldd on this .so there is no library missing: ldd /usr/lib/dovecot/modules/lib02_imap_acl_plugin.so linux-vdso.so.1 (0x00007fcfbfab3000) lib01_acl_plugin.so => /usr/lib/dovecot/modules/lib01_acl_plugin.so (0x00007fcfbfa8a000) libc.so.6 => /lib/x86_64-linux-gnu/libc.so.6 (0x00007fcfbf88b000) /lib64/ld-linux-x86-64.so.2 (0x00007fcfbfab5000) Thanks, Mihai Badici

1 1

Re: [Dovecot] output of doveconf in conflict with order of settings in conf.d/*-*.conf files
by Marcos José Texeira 20 Sep '25

20 Sep '25

2 1

Mail not getting deleted physically
by Support Team 19 Sep '25

19 Sep '25

I am clearing the mail using roundcube and also deleting mail from trash and thus permenently deleting the mail. The mail quota changes. But mail is still present in INBOX.EXPUNGED.Trash and also with refcount 1. The physical disk usage remains the same and purge not deleting the mail physically, prob due to refcount. 1. Initial stage. 2 mails in inbox and around 14MB of usage. --- doveadm -f table quota get -u u.demo1(a)mydomain.net Quota name Type Value Limit % mdbox quota STORAGE 14017 512000 2 mdbox quota MESSAGE 2 10000 0 doveadm -f table mailbox status -u u.demo1(a)mydomain.net all INBOX mailbox messages recent uidnext uidvalidity unseen highestmodseq vsize guid firstsaved INBOX 2 0 3 1758288242 0 5 14352516 c61ef0307259cd684d18000079f6831d 1758288243 doveadm -f table mailbox status -u u.demo1(a)mydomain.net all INBOX.* mailbox messages recent uidnext uidvalidity unseen highestmodseq vsize guid firstsaved INBOX.Drafts 0 0 1 1758288245 0 1 0 c91ef0307259cd684d18000079f6831d never INBOX.Spam 0 0 1 1758288244 0 1 0 c81ef0307259cd684d18000079f6831d never INBOX.Trash 0 0 1 1758288243 0 1 0 c71ef0307259cd684d18000079f6831d never doveadm -f table mailbox status -u u.demo1(a)mydomain.net all INBOX.*.* mailbox messages recent uidnext uidvalidity unseen highestmodseq vsize guid firstsaved doveadm -f table fetch -u u.demo1(a)mydomain.net "mailbox refcount user" mailbox INBOX all mailbox refcount user INBOX 1 u.demo1(a)mydomain.net INBOX 1 u.demo1(a)mydomain.net doveadm -f table fetch -u u.demo1(a)mydomain.net "mailbox refcount user" mailbox INBOX.* all mailbox refcount user doveadm -f table fetch -u u.demo1(a)mydomain.net "mailbox refcount user" mailbox INBOX.*.* all mailbox refcount user --- 2. Deleted mail from Inbox and also from Trash. Mail quota got reduced. But mail exist in INBOX.EXPUNGED.Trash with refcount 1 and using disk storage. --- doveadm -f table quota get -u u.demo1(a)mydomain.net Quota name Type Value Limit % mdbox quota STORAGE 0 512000 0 mdbox quota MESSAGE 0 10000 0 doveadm -f table mailbox status -u u.demo1(a)mydomain.net all INBOX mailbox messages recent uidnext uidvalidity unseen highestmodseq vsize guid firstsaved INBOX 0 0 3 1758288242 0 7 0 c61ef0307259cd684d18000079f6831d never doveadm -f table mailbox status -u u.demo1(a)mydomain.net all INBOX.* mailbox messages recent uidnext uidvalidity unseen highestmodseq vsize guid firstsaved INBOX.Drafts 0 0 1 1758288245 0 1 0 c91ef0307259cd684d18000079f6831d never INBOX.Spam 0 0 1 1758288244 0 1 0 c81ef0307259cd684d18000079f6831d never INBOX.Trash 0 0 3 1758288243 0 7 0 c71ef0307259cd684d18000079f6831d never doveadm -f table mailbox status -u u.demo1(a)mydomain.net all INBOX.*.* mailbox messages recent uidnext uidvalidity unseen highestmodseq vsize guid firstsaved INBOX.EXPUNGED.Trash 2 2 3 1758288246 0 3 14352516 c80d5b1f075ecd68eb4c000079f6831d 1758289415 doveadm -f table fetch -u u.demo1(a)mydomain.net "mailbox refcount user" mailbox INBOX all mailbox refcount user doveadm -f table fetch -u u.demo1(a)mydomain.net "mailbox refcount user" mailbox INBOX.* all mailbox refcount user doveadm -f table fetch -u u.demo1(a)mydomain.net "mailbox refcount user" mailbox INBOX.*.* all mailbox refcount user INBOX.EXPUNGED.Trash 1 u.demo1(a)mydomain.net INBOX.EXPUNGED.Trash 1 u.demo1(a)mydomain.net --- The following options are checked in roundcube. Maintenance Clear Trash on logout Compact Inbox on logout Is there anything missing in roundcube settings? Why refcount still shows as 1? I am clearing the mail using roundcube and also deleting mail from trash and thus permenently deleting the mail. The mail quota changes. But mail is still present in INBOX.EXPUNGED.Trash and also with refcount 1. The physical disk usage remains the same and purge not deleting the mail physically, prob due to refcount. 1. Initial stage. 2 mails in inbox and around 14MB of usage. --- doveadm -f table quota get -u [1]u.demo1(a)mydomain.net Quota name Type Value Limit % mdbox quota STORAGE 14017 512000 2 mdbox quota MESSAGE 2 10000 0 doveadm -f table mailbox status -u [2]u.demo1(a)mydomain.net all INBOX mailbox messages recent uidnext uidvalidity unseen highestmodseq vsize guid firstsaved INBOX 2 0 3 1758288242 0 5 14352516 c61ef0307259cd684d18000079f6831d 1758288243 doveadm -f table mailbox status -u [3]u.demo1(a)mydomain.net all INBOX.* mailbox messages recent uidnext uidvalidity unseen highestmodseq vsize guid firstsaved INBOX.Drafts 0 0 1 1758288245 0 1 0 c91ef0307259cd684d18000079f6831d never INBOX.Spam 0 0 1 1758288244 0 1 0 c81ef0307259cd684d18000079f6831d never INBOX.Trash 0 0 1 1758288243 0 1 0 c71ef0307259cd684d18000079f6831d never doveadm -f table mailbox status -u [4]u.demo1(a)mydomain.net all INBOX.*.* mailbox messages recent uidnext uidvalidity unseen highestmodseq vsize guid firstsaved doveadm -f table fetch -u [5]u.demo1(a)mydomain.net "mailbox refcount user" mailbox INBOX all mailbox refcount user INBOX 1 [6]u.demo1(a)mydomain.net INBOX 1 [7]u.demo1(a)mydomain.net doveadm -f table fetch -u [8]u.demo1(a)mydomain.net "mailbox refcount user" mailbox INBOX.* all mailbox refcount user doveadm -f table fetch -u [9]u.demo1(a)mydomain.net "mailbox refcount user" mailbox INBOX.*.* all mailbox refcount user --- 2. Deleted mail from Inbox and also from Trash. Mail quota got reduced. But mail exist in INBOX.EXPUNGED.Trash with refcount 1 and using disk storage. --- doveadm -f table quota get -u [10]u.demo1(a)mydomain.net Quota name Type Value Limit % mdbox quota STORAGE 0 512000 0 mdbox quota MESSAGE 0 10000 0 doveadm -f table mailbox status -u [11]u.demo1(a)mydomain.net all INBOX mailbox messages recent uidnext uidvalidity unseen highestmodseq vsize guid firstsaved INBOX 0 0 3 1758288242 0 7 0 c61ef0307259cd684d18000079f6831d never doveadm -f table mailbox status -u [12]u.demo1(a)mydomain.net all INBOX.* mailbox messages recent uidnext uidvalidity unseen highestmodseq vsize guid firstsaved INBOX.Drafts 0 0 1 1758288245 0 1 0 c91ef0307259cd684d18000079f6831d never INBOX.Spam 0 0 1 1758288244 0 1 0 c81ef0307259cd684d18000079f6831d never INBOX.Trash 0 0 3 1758288243 0 7 0 c71ef0307259cd684d18000079f6831d never doveadm -f table mailbox status -u [13]u.demo1(a)mydomain.net all INBOX.*.* mailbox messages recent uidnext uidvalidity unseen highestmodseq vsize guid firstsaved INBOX.EXPUNGED.Trash 2 2 3 1758288246 0 3 14352516 c80d5b1f075ecd68eb4c000079f6831d 1758289415 doveadm -f table fetch -u [14]u.demo1(a)mydomain.net "mailbox refcount user" mailbox INBOX all mailbox refcount user doveadm -f table fetch -u [15]u.demo1(a)mydomain.net "mailbox refcount user" mailbox INBOX.* all mailbox refcount user doveadm -f table fetch -u [16]u.demo1(a)mydomain.net "mailbox refcount user" mailbox INBOX.*.* all mailbox refcount user INBOX.EXPUNGED.Trash 1 [17]u.demo1(a)mydomain.net INBOX.EXPUNGED.Trash 1 [18]u.demo1(a)mydomain.net --- The following options are checked in roundcube. Maintenance Clear Trash on logout Compact Inbox on logout Is there anything missing in roundcube settings? Why refcount still shows as 1? References Visible links 1. mailto:u.demo1@mydomain.net 2. mailto:u.demo1@mydomain.net 3. mailto:u.demo1@mydomain.net 4. mailto:u.demo1@mydomain.net 5. mailto:u.demo1@mydomain.net 6. mailto:u.demo1@mydomain.net 7. mailto:u.demo1@mydomain.net 8. mailto:u.demo1@mydomain.net 9. mailto:u.demo1@mydomain.net 10. mailto:u.demo1@mydomain.net 11. mailto:u.demo1@mydomain.net 12. mailto:u.demo1@mydomain.net 13. mailto:u.demo1@mydomain.net 14. mailto:u.demo1@mydomain.net 15. mailto:u.demo1@mydomain.net 16. mailto:u.demo1@mydomain.net 17. mailto:u.demo1@mydomain.net 18. mailto:u.demo1@mydomain.net

1 0

fts_flatcurve max_term_size config missing or broken in v2.4
by publists＠emailgroups.net 17 Sep '25

17 Sep '25

Hi, I'm working on migrating my v2.3 -> v2.4 configuration. From my 2.3 config I have ... fts flatcurve { commit_limit = 2000 29 max_term_size = 60 min_term_size = 3 substring_search = yes } ... From reading the current docs' "Configuration Example" https://doc.dovecot.org/2.4.1/core/plugins/fts_flatcurve.html#configuration… that looks OK for v2.4.1 too. But a config check fails, doveconf: Fatal: Error in configuration file /etc/dovecot/conf.d/50-fts.conf line 29: max_term_size: Unknown setting: max_term_size (fts_max_term_size or fts_flatcurve_max_term_size not found either.) There's no mention of "max_term_size" in https://doc.dovecot.org/2.4.1/installation/upgrade/2.3-to-2.4.html as a change. It's also NOT listed as a current setting at https://doc.dovecot.org/2.4.1/core/summaries/settings.html Checking in code sources cd dovecot git checkout release-2.4.1 Switched to branch 'release-2.4.1' Your branch is up to date with 'origin/release-2.4.1'. "min_term_size" is in use grep "min_term_size" * fts-backend-flatcurve.c: if (size < ctx->backend->fuser->set->min_term_size) fts-backend-flatcurve-xapian.cc: * smaller than min_term_size. Requires libicu in order to correctly handle fts-backend-flatcurve-xapian.cc: if (len < fuser->set->min_term_size) fts-backend-flatcurve-xapian.cc: if (len < fuser->set->min_term_size) fts-flatcurve-settings.c: DEF(UINT, min_term_size), fts-flatcurve-settings.c: .min_term_size = 2, fts-flatcurve-settings.h: unsigned int min_term_size; But no trace of "max_term_size" at all from grep "max_term_size" * Is "max_term_size" still valid config? Does code or documentation, or both, need to change? Or am I misreading the usage? Thanks, Dave

2 1

hidden / alias_for / sieve
by Erick Calder 12 Sep '25

12 Sep '25

hi. I'm running on Fedora 42 and want to hide the Deleted Messages folder (because I want to use Trash instead). unfortunately this fails: mailbox "Deleted Messages" { hidden = yes } which I understand depends on the "mailbox" plugin. however, when I look in /var/lib64/dovecot, I don't see any such plugin. I also cannot find in the repositories any RPM that provides it. I understand it may be baked into the core binary but if so, enabling it should work, and yet if I do enable it, I get the error below: Sep 11 10:06:01 mail dovecot[739762]: imap(ekkis): Error: Plugin 'mailbox' not found from directory /usr/lib64/dovecot I would also like to use the alias_for but that also fails. sigh. I'm also struggling to make Sieve work. I've produced a sysreport (see: https://arix.com/tmp/dovecot-sysreport-mail.arix.com-1757611127.tar.gz) and you'll find my config file below: please help? # 2.3.21.1 (d492236fa0): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.21.1 (49005e73) # OS: Linux 6.15.9-201.fc42.x86_64 x86_64 Fedora release 42 (Adams) # Hostname: mail.arix.com first_valid_uid = 1000 mail_debug = yes mail_location = maildir:~/mail:LAYOUT=fs managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;asc ii-numeric relational regex imap4flags copy include body enotify environment mailbox date index ihave duplicat e mime foreverypart extracttext mbox_write_locks = fcntl namespace inbox { inbox = yes location = mailbox "Deleted Messages" { special_use = \Trash } mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } prefix = INBOX/ separator = / } passdb { driver = pam } plugin { sieve = file:~/sieve;active=~/.dovecot.sieve sieve_before = /var/lib/dovecot/sieve/global sieve_execute_bin_dir = /usr/lib/dovecot/sieve-execute sieve_global_extensions = +vnd.dovecot.execute +vnd.dovecot.environment +variables sieve_plugins = sieve_extprograms sieve_trace_debug = yes sieve_trace_dir = /tmp/sieve sieve_trace_level = matching } protocols = imap pop3 lmtp sieve service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0660 user = postfix } } service lmtp { inet_listener lmtp { address = localhost port = 24 } ssl = required ssl_cert = </etc/letsencrypt/live/mail.arix.com/fullchain.pem ssl_cipher_list = PROFILE=SYSTEM ssl_key = # hidden, use -P to show it userdb { driver = passwd } protocol sieve { mail_plugins = " sieve" } > On Sep 11, 2025, at 10:45, dovecot-request(a)dovecot.org wrote: > > Welcome to the "dovecot" mailing list! > > To post to this list, send your message to: > > dovecot(a)dovecot.org > > You can unsubscribe or make adjustments to your options via email by > sending a message to: > > dovecot-request(a)dovecot.org > > with the word 'help' in the subject or body (don't include the > quotes), and you will get back a message with instructions. You will > need your password to change your options, but for security purposes, > this password is not included here. If you have forgotten your > password you will need to reset it via the web UI. hi. I'm running on Fedora 42 and want to hide the Deleted Messages folder (because I want to use Trash instead). unfortunately this fails: mailbox "Deleted Messages" { hidden = yes } which I understand depends on the "mailbox" plugin. however, when I look in /var/lib64/dovecot, I don't see any such plugin. I also cannot find in the repositories any RPM that provides it. I understand it may be baked into the core binary but if so, enabling it should work, and yet if I do enable it, I get the error below: Sep 11 10:06:01 mail dovecot[739762]: imap(ekkis): Error: Plugin 'mailbox' not found from directory /usr/lib64/dovecot I would also like to use the alias_for but that also fails. sigh. I'm also struggling to make Sieve work. I've produced a sysreport (see: https://arix.com/tmp/dovecot-sysreport-mail.arix.com-1757611127.tar.gz) and you'll find my config file below: please help? # 2.3.21.1 (d492236fa0): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.21.1 (49005e73) # OS: Linux 6.15.9-201.fc42.x86_64 x86_64 Fedora release 42 (Adams) # Hostname: mail.arix.com first_valid_uid = 1000 mail_debug = yes mail_location = maildir:~/mail:LAYOUT=fs managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;asc ii-numeric relational regex imap4flags copy include body enotify environment mailbox date index ihave duplicat e mime foreverypart extracttext mbox_write_locks = fcntl namespace inbox { inbox = yes location = mailbox "Deleted Messages" { special_use = \Trash } mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } prefix = INBOX/ separator = / } passdb { driver = pam } plugin { sieve = file:~/sieve;active=~/.dovecot.sieve sieve_before = /var/lib/dovecot/sieve/global sieve_execute_bin_dir = /usr/lib/dovecot/sieve-execute sieve_global_extensions = +vnd.dovecot.execute +vnd.dovecot.environment +variables sieve_plugins = sieve_extprograms sieve_trace_debug = yes sieve_trace_dir = /tmp/sieve sieve_trace_level = matching } protocols = imap pop3 lmtp sieve service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0660 user = postfix } } service lmtp { inet_listener lmtp { address = localhost port = 24 } ssl = required ssl_cert = </etc/letsencrypt/live/mail.arix.com/fullchain.pem ssl_cipher_list = PROFILE=SYSTEM ssl_key = # hidden, use -P to show it userdb { driver = passwd } protocol sieve { mail_plugins = " sieve" } On Sep 11, 2025, at 10:45, dovecot-request(a)dovecot.org wrote: Welcome to the "dovecot" mailing list! To post to this list, send your message to: dovecot(a)dovecot.org You can unsubscribe or make adjustments to your options via email by sending a message to: dovecot-request(a)dovecot.org with the word 'help' in the subject or body (don't include the quotes), and you will get back a message with instructions. You will need your password to change your options, but for security purposes, this password is not included here. If you have forgotten your password you will need to reset it via the web UI.

2 2

SMTPUTF8 - what's the status?
by Kamil Jońca 11 Sep '25

11 Sep '25

Does dovecot LMTP can process SMTPUTF8 emails? I guess not, but I want to confirm. KJ -- http://wolnelektury.pl/wesprzyj/teraz/ <kira> is a surgical war where you go give the foreign troops nose jobs?

2 1

Re: SMTPUTF8 - what's the status?
by Michael Slusarz 11 Sep '25

11 Sep '25

> On 09/11/2025 10:53 AM MDT Kamil Jońca via dovecot <dovecot(a)dovecot.org> wrote: > > Does dovecot LMTP can process SMTPUTF8 emails? > I guess not, but I want to confirm. https://doc.dovecot.org/2.4.1/core/summaries/settings.html#mail_utf8_extens… Requires --enable-experimental-mail-utf8 when compiling. michael

1 0

Sieve Scripts via SQL Dicts in Dovecot 2.4 not working?
by Niklas Meyer 11 Sep '25

11 Sep '25

Hello everyone, I am currently working on porting the Dovecot 2.4 configuration from the latest 2.3 version. During this process, I encountered issues with the Sieve filters, particularly those related to SQL dict mappings. The previous (2.3) configuration looked like this and worked: |map { pattern = priv/sieve/name/$script_nametable = sieve_before username_field = username value_field = idfields { script_name = $script_name} } map { pattern = priv/sieve/data/$idtable = sieve_before username_field = username value_field = script_data fields { id= $id} } | This resulted in the following SQL queries on the MySQL server: |2025-08-1511:01:29.237511SELECTid FROMsieve_after WHEREscript_name ='active'ANDusername ='frittenjonas(a)derlinkman.de'2025-08-1511:01:29.236416SELECTid FROMsieve_before WHEREscript_name ='active'ANDusername ='frittenjonas(a)derlinkman.de'| As you can see, there are SQL mappings for |sieve_before| and |sieve_after|, alongside a local file loaded prior to the SQL settings, as they are user-based. In Dovecot 2.3, everything worked and the scripts were executed. In 2.4, however, they no longer run. I adapted the configuration for dict SQL mapping for Sieve filters according to the documentation: |dict_mappriv/sieve/name/$script_name{ sql_table= sieve_before username_field = username value_field id { } # The script name field in the table to querykey_fieldscript_name { value= $script_name} } dict_map priv/sieve/data/$id{ sql_table= sieve_before username_field = username value_field script_data { } key_fieldid { value= $id} } | This also results in the dict proxy querying the database with the same pattern as before: |2025-08-1511:11:47.175184SELECTid FROMsieve_after WHEREscript_name ='active'ANDusername ='frittenjonas(a)derlinkman.de'2025-08-1511:11:47.172952SELECTid FROMsieve_before WHEREscript_name ='active'ANDusername ='frittenjonas(a)derlinkman.de'2025-08-1511:11:47.155786SELECTid FROMsieve_after WHEREscript_name ='active'ANDusername ='frittenjonas(a)derlinkman.de'2025-08-1511:11:47.136030SELECTid FROMsieve_before WHEREscript_name ='active'ANDusername ='frittenjonas(a)derlinkman.de'| However, unlike in 2.3, it now queries the DB twice. In the Sieve debug logs, I see the following: https://pastebin.com/PTKkLsDQ Notably: |Aug 1512:22:2443664c142e0a dovecot: lmtp(frittenjonas(a)derlinkman.de)<2407><mPFNN2AKn2hnCQAAhwrv7A>: Debug: Localdelivery failed: Temporarily unable toaccessnecessary Sieve scripts | This line concerns me. Here are the current Sieve script declarations: |sieve_script before{ type= beforedriver = file path= /var/vmail/sieve/global_sieve_before.sieve } sieve_script before2 { type= beforedriver = dict name= active dict proxy { name= sieve_before sieve_script_bin_path = /var/vmail/sieve_before_bindir } } sieve_script after{ type= afterdriver = file path= /var/vmail/sieve/global_sieve_after.sieve } sieve_script after2 { type= afterdriver = dict name= active dict proxy { name= sieve_after sieve_script_bin_path = /var/vmail/sieve_after_bindir } } # Personal scripts sieve_script personal { type= personal driver = file path= ~/sieve active_path = ~/.dovecot.sieve } | The dict proxy configuration, pointing to the dict_map SQL query above, looks like this: |dict sieve_after { driver = sql!include/etc/dovecot/sql/dovecot-dict-sql-sieve_after.conf } dict sieve_before { driver = sql!include/etc/dovecot/sql/dovecot-dict-sql-sieve_before.conf } | Thanks for your guidance. Kind regards Niklas Meyer Maintainer of the mailcow project Hello everyone, I am currently working on porting the Dovecot 2.4 configuration from the latest 2.3 version. During this process, I encountered issues with the Sieve filters, particularly those related to SQL dict mappings. The previous (2.3) configuration looked like this and worked: map { pattern = priv/sieve/name/$script_name table = sieve_before username_field = username value_field = id fields { script_name = $script_name } } map { pattern = priv/sieve/data/$id table = sieve_before username_field = username value_field = script_data fields { id = $id } } This resulted in the following SQL queries on the MySQL server: 2025-08-15 11:01:29.237511 SELECT id FROM sieve_after WHERE script_name = 'active' AND username = '[1]frittenjonas(a)derlinkman.de' 2025-08-15 11:01:29.236416 SELECT id FROM sieve_before WHERE script_name = 'active' AND username = '[2]frittenjonas(a)derlinkman.de' As you can see, there are SQL mappings for sieve_before and sieve_after, alongside a local file loaded prior to the SQL settings, as they are user-based. In Dovecot 2.3, everything worked and the scripts were executed. In 2.4, however, they no longer run. I adapted the configuration for dict SQL mapping for Sieve filters according to the documentation: dict_map priv/sieve/name/$script_name { sql_table = sieve_before username_field = username value_field id { } # The script name field in the table to query key_field script_name { value = $script_name } } dict_map priv/sieve/data/$id { sql_table = sieve_before username_field = username value_field script_data { } key_field id { value = $id } } This also results in the dict proxy querying the database with the same pattern as before: 2025-08-15 11:11:47.175184 SELECT id FROM sieve_after WHERE script_name = 'active' AND username = '[3]frittenjonas(a)derlinkman.de' 2025-08-15 11:11:47.172952 SELECT id FROM sieve_before WHERE script_name = 'active' AND username = '[4]frittenjonas(a)derlinkman.de' 2025-08-15 11:11:47.155786 SELECT id FROM sieve_after WHERE script_name = 'active' AND username = '[5]frittenjonas(a)derlinkman.de' 2025-08-15 11:11:47.136030 SELECT id FROM sieve_before WHERE script_name = 'active' AND username = '[6]frittenjonas(a)derlinkman.de' However, unlike in 2.3, it now queries the DB twice. In the Sieve debug logs, I see the following: [7]https://pastebin.com/PTKkLsDQ Notably: Aug 15 12:22:24 43664c142e0a dovecot: lmtp([8]frittenjonas(a)derlinkman.de)<2407><mPFNN2AKn2hnCQAAhwrv7A>: Debug: Local delivery failed: Temporarily unable to access necessary Sieve scripts This line concerns me. Here are the current Sieve script declarations: sieve_script before { type = before driver = file path = /var/vmail/sieve/global_sieve_before.sieve } sieve_script before2 { type = before driver = dict name = active dict proxy { name = sieve_before sieve_script_bin_path = /var/vmail/sieve_before_bindir } } sieve_script after { type = after driver = file path = /var/vmail/sieve/global_sieve_after.sieve } sieve_script after2 { type = after driver = dict name = active dict proxy { name = sieve_after sieve_script_bin_path = /var/vmail/sieve_after_bindir } } # Personal scripts sieve_script personal { type = personal driver = file path = ~/sieve active_path = ~/.dovecot.sieve } The dict proxy configuration, pointing to the dict_map SQL query above, looks like this: dict sieve_after { driver = sql !include /etc/dovecot/sql/dovecot-dict-sql-sieve_after.conf } dict sieve_before { driver = sql !include /etc/dovecot/sql/dovecot-dict-sql-sieve_before.conf } Thanks for your guidance. Kind regards Niklas Meyer Maintainer of the mailcow project References Visible links 1. mailto:frittenjonas@derlinkman.de 2. mailto:frittenjonas@derlinkman.de 3. mailto:frittenjonas@derlinkman.de 4. mailto:frittenjonas@derlinkman.de 5. mailto:frittenjonas@derlinkman.de 6. mailto:frittenjonas@derlinkman.de 7. https://pastebin.com/PTKkLsDQ 8. mailto:frittenjonas@derlinkman.de

4 8

Sample with spool file: .mbsyncrc, Isync, Information Lifecycle Management, dovecot, GMail, IMAP
by Philip Bondi 10 Sep '25

10 Sep '25

Hello to all: I wanted to offer my working .mbsyncrc to the community. I also have a spool file to share. In my opinion, 15 Gb on our Google accounts is no longer enough. Google Photos keeps prompting to enable backup. Most people are going to exceed this quota. In my opinion, this is manifestation of serious "platform decay". This is starting to affect all my immediate family members. In my opinion, one should have methodology to move GMail away of Google for Information Lifecycle Management. To achieve, I have setup Debian 12 virtual machine on QNAP running Dovecot. This setup is beyond the scope of this article. I setup Isync to sync gmail to my Debian 12 virtual machine. Then I wrote a script to move the gmail to local mbox. Isync will then purge the email from Gmail. https://www.snbforums.com/threads/sample-with-spool-file-mbsyncrc-isync-inf…

1 0

Red Hat Enterprise Linux 8 packages
by Aki Tuomi 08 Sep '25

08 Sep '25

Hi! Due to algorithm limitations, we have signed the RHEL8 packages for 2.4.1 with Dovecot 2.3 signing key. This should make it verifiable on RHEL8. Regards, Aki Tuomi Open-Xchange oy

1 0

RHEL 8 key import error
by Gioele Pannetto 08 Sep '25

08 Sep '25

Hi, I'm having issues while installing Dovecot 2.4 on a Rocky Linux 8.10 server. This server was running Dovecot 2.3 but I wanted to upgrade it to 2.4. This is my repo file: [dovecot-2.4-latest] name=Dovecot 2.4 RHEL $releasever - $basearch baseurl=https://repo.dovecot.org/ce-2.4-latest/rhel/$releasever/RPMS/$basea… gpgkey=https://repo.dovecot.org/DOVECOT-REPO-GPG-2.4 gpgcheck=1 enabled=1 When I run dnf update I get a GPG error: Problem opening package dovecot-2.4.1-4.x86_64.rpm Problem opening package dovecot-lua-2.4.1-4.x86_64.rpm Problem opening package dovecot-mysql-2.4.1-4.x86_64.rpm The downloaded packages were saved in cache until the next successful transaction. You can remove cached packages by executing 'dnf clean packages'. Error: GPG check FAILED If I try to import the key manually with rpm --import https://repo.dovecot.org/DOVECOT-REPO-GPG-2.4 I get: error: https://repo.dovecot.org/DOVECOT-REPO-GPG-2.4: key 1 import failed. I also tried it on a fresh Rocky Linux 8.10 installation and I get the same exact error, but running it on Rocky Linux 9.6 works just fine. This is my gpg --version on RHEL 8.10: gpg (GnuPG) 2.2.20 libgcrypt 1.8.5 Copyright (C) 2020 Free Software Foundation, Inc. License GPLv3+: GNU GPL version 3 or later <https://gnu.org/licenses/gpl.html> This is free software: you are free to change and redistribute it. There is NO WARRANTY, to the extent permitted by law. Home: /root/.gnupg Supported algorithms: Pubkey: RSA, ELG, DSA, ECDH, ECDSA, EDDSA Cipher: IDEA, 3DES, CAST5, BLOWFISH, AES, AES192, AES256, TWOFISH, CAMELLIA128, CAMELLIA192, CAMELLIA256 Hash: SHA1, RIPEMD160, SHA256, SHA384, SHA512, SHA224 Compression: Uncompressed, ZIP, ZLIB, BZIP2 Any help is appreciated. Thanks! -- Gioele Pannetto

6 8

Is it possible to use literal %2F inside a dovecot.http.client request url?
by hmmmz1000＠gmail.com 07 Sep '25

07 Sep '25

Hello, I'm using dovecot (2.3) lua with dovecot.http.client but I need the request url to have an url encoded slash (/) as %2F (or %2f) but if I enter for example https://test.com/%2F/test it looks like it changes it to a slash (https://test.com///test) in the http debug log (also the request fails as it's not %2F). I've also tried with %252F to encode the % but that doesn't change at all (keeps being %252F) & also tried with %%2F and \%2F but that gets the errors "Expecting hex digit after '%', but found '%'" for %%2F and "invalid escape sequence" for \%2F. Does anyone have an idea how to solve this or if it's even possible?

2 1

Help: Sharing IMAP folder from a mdbox mailbox to a maildir mailbox
by Zhang Huangbin 05 Sep '25

05 Sep '25

Dear all, I'm configuring Dovecot 2.4.1 with per-user mailbox format support, but cannot get user shared mailbox working between different mailbox formats. - Account mdbox(a)domain.com is a mdbox format mailbox, access with webmail is ok. - Account maildir(a)domain.com is a maildir format mailbox, access with webmail is ok. - mdbox@ shares its Sent folder to maildir@ with Roundcube webmail, grants all privileges (`akxeilprwts`). The result is maildir@ cannot see the shared folder. - No error reported in Dovecot log file. - mysql logs the queries performed to get user shared mailbox, i ran the query manually and it returns correct result like this: ``` MariaDB [vmail]> SELECT dummy,from_user FROM share_folder WHERE to_user = 'maildir(a)domain.com' \G *************************** 1. row *************************** dummy: 1 from_user: mdbox(a)domain.com ``` dovecot.conf snippet attached below. I think the "mail_*" parameters inside `namespace shared {}` block are incorrect to handle mixed mailbox formats because it hard-codes the mail_driver and mail_path, tried all possible parameters i can imagine, but failed. Thanks for helping. :) # ------------------------ mail_plugins { acl = yes ... } protocol imap { mail_plugins { imap_acl = yes ... } ... } mail_driver = %{userdb:mail_driver | default("maildir") | lower} mail_path = %{userdb:mail_path | default("~/Maildir")} sql_driver = mysql mysql 127.0.0.1 { port = ... dbname = ... user = ... password = ... } userdb sql { # ... omit other lines ... query = SELECT \ LOWER('%{user | lower}') AS master_user, \ LOWER(CONCAT(mailbox.storagebasedirectory, '/', mailbox.storagenode, '/', mailbox.maildir)) AS home, \ mailbox.mailboxformat AS mail_driver, \ CONCAT("~/", mailbox.mailboxfolder) AS mail_path, \ CONCAT('*:bytes=', mailbox.quota*1048576) AS quota_rule \ FROM ... } namespace shared { type = shared separator = / prefix = Shared/$user/ subscriptions = yes list = children mail_driver = maildir mail_path = %{owner_home}/Maildir mail_index_private_path = ~/Maildir/shared/%{owner_user} # not share the index files between users mail_index_path = ~/Maildir/shared/%{owner_user} } acl_driver = vfile acl_globals_only = no acl_sharing_map { dict proxy { name = acl } } dict_server { dict acl { driver = sql dict_map shared/shared-boxes/user/$to/$from { sql_table = share_folder value_field dummy { } key_field from_user { value = $from } key_field to_user { value = $to } } dict_map shared/shared-boxes/anyone/$from { sql_table = anyone_shares value_field dummy { } key_field from_user { value = $from } } } ... } # ------------------------

4 11

High Available (SoHo) dovecot setup using PVE+Ubuntu (+Docker)?
by Gerben Wierda 04 Sep '25

04 Sep '25

I currently run a HA postfix/dovecot setup that is failover behind a HAproxy. The two legs are a dovecot 2 on macOS (MacPorts) and a dovecot 2 on Ubuntu (PVE+Ubuntu+Docker), making the system somewhat antifragile. HA is realised via dovecot’s own syncing (which is not longer available in dovecot 3). This works OK. (In addition: there is rspamd as an important part of the setup, e.g. for DMARC). There are multiple virtual domains. Given that I have lost APNS (Apple Push Notification) as Apple has retired support for former Mac OS X Server users, there is not longer a reason to keep the macOS version running (apart from that antifragility thing, but that was more an added bonus). I am looking at moving to a different setup where the entire mail setup may move to a full Linux foundation. I am starting to look at future options (there is still time to actually create the setup somewhere the coming year or so. If I want to be future-dovecot proof, I need to move to HA for storage as dovecot syncing is deprecated. I wonder what my best way forward its, based on a 2 physical machine, PVE+Ubuntu+Docker setup. Build a HA NFSv4 cluster? Use Ceph? ZFS? Any tips, experiences, or ideas are welcome. Robustness/security/low-maintenance/own-your-own-data are my main objectives. I do not have high volumes, this is a setup for just a few users. G I currently run a HA postfix/dovecot setup that is failover behind a HAproxy. The two legs are a dovecot 2 on macOS (MacPorts) and a dovecot 2 on Ubuntu (PVE+Ubuntu+Docker), making the system somewhat antifragile. HA is realised via dovecot's own syncing (which is not longer available in dovecot 3). This works OK. (In addition: there is rspamd as an important part of the setup, e.g. for DMARC). There are multiple virtual domains. Given that I have lost APNS (Apple Push Notification) as Apple has retired support for former Mac OS X Server users, there is not longer a reason to keep the macOS version running (apart from that antifragility thing, but that was more an added bonus). I am looking at moving to a different setup where the entire mail setup may move to a full Linux foundation. I am starting to look at future options (there is still time to actually create the setup somewhere the coming year or so. If I want to be future-dovecot proof, I need to move to HA for storage as dovecot syncing is deprecated. I wonder what my best way forward its, based on a 2 physical machine, PVE+Ubuntu+Docker setup. Build a HA NFSv4 cluster? Use Ceph? ZFS? Any tips, experiences, or ideas are welcome. Robustness/security/low-maintenance/own-your-own-data are my main objectives. I do not have high volumes, this is a setup for just a few users. G

5 8

How to override mail_driver, mail_path, mail_index_path with SQL userdb
by Zhang Huangbin 04 Sep '25

04 Sep '25

Dear all, I'm migrating from Dovecot 2.3 to 2.4 on Debian 13, only one issue remains: How can i override global mail_driver, mail_path, mail_index_path parameters with a SQL userdb? I have these lines in dovecot.conf to use maildir format mailbox by default, also userdb and passdb with mariadb backend. We store mailbox format (e.g. "maildir", "mdbox", case insensitive) in SQL column `mailboxformat`, and mailbox folder name in `mailboxfolder` (e.g. "Maildir", "mdbox", case sensitive). I tried returning `mail_driver` + `mail_path`, or `userdb_mail_driver` + `userdb_mail_path`, neither works. So the question is, what should i return in userdb sql query to override global setting? Thanks for helping. :) # ------------------------------- mail_driver = maildir mail_path = ~/Maildir mail_index_path = ~/Maildir sql_driver = mysql mysql 127.0.0.1 { port = 3306 dbname = ... user = ... password = ... } userdb sql { iterate_query = ... query = SELECT \ LOWER('%{user | lower}') AS master_user, \ LOWER(CONCAT(mailbox.storagebasedirectory, '/', mailbox.storagenode, '/', mailbox.maildir)) AS home, \ LOWER(mailbox.mailboxformat) AS mail_driver, \ CONCAT("~/", mailbox.mailboxfolder) AS mail_path, \ CONCAT(LOWER(mailbox.mailboxformat), ":~/", mailbox.mailboxfolder) AS mail, \ CONCAT('*:bytes=', mailbox.quota*1048576) AS quota_rule \ FROM mailbox,domain \ WHERE ... } passdb sql { query = SELECT ... } # -------------------------------

1 1

Config Typos
by matthew1471＠matthew1471.co.uk 03 Sep '25

03 Sep '25

Hello, I submitted this issue to Debian with a patch https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1112667 But I since found a lot of them have actually come directly from Dovecot via https://github.com/dovecot/tools/blob/main/dovecot-2.4.0-example-config.tar… which itself is referenced via https://doc.dovecot.org/2.4.1/installation/upgrade/2.3-to-2.4.html I see on that page "It's not being kept up-to-date afterwards".. so is there any interest in receiving corrections and if so where best to provide (Patch file is on the Debian page)? These are just typos, nothing breaking (although "# auth_username_format=%u" in auth-passwdfile.conf.ext if uncommented is of course incorrect and only in the Dovecot tools version, it's not in the Debian version). As an aside, I found on my instance (Debian 2.4.1-4 (7d8c0e5759)): root@IMAP:~# doveconf -d | grep -i sieve "sieve_script_path =" But the docs (https://doc.dovecot.org/2.4.1/core/plugins/sieve.html#sieve_script_path) state the default should be "~/sieve" This led to some funky "Leaked settings" errors: Sep 01 00:06:54 IMAP dovecot[5112]: sieve(x(a)x.co.uk)<5123><GEGcT7E9lfnAqAAD>: Error: sieve: file storage: Storage path cannot be empty for write access Sep 01 00:06:54 IMAP dovecot[5112]: managesieve(5123): Error: Failed to open Sieve storage. Sep 01 00:06:54 IMAP dovecot[5112]: managesieve(5123): Warning: Leaked settings: ext-duplicate-common.c:36 Sep 01 00:06:54 IMAP dovecot[5112]: managesieve(5123): Warning: Leaked settings: ntfy-mailto.c:166 Sep 01 00:06:54 IMAP dovecot[5112]: managesieve(5123): Warning: Leaked settings: ext-variables-common.c:61 Sep 01 00:06:54 IMAP dovecot[5112]: managesieve(5123): Warning: Leaked settings: ext-include-common.c:87 Sep 01 00:06:54 IMAP dovecot[5112]: managesieve(5123): Warning: Leaked settings: ext-subaddress.c:75 Sep 01 00:06:54 IMAP dovecot[5112]: managesieve(5123): Warning: Leaked settings: ext-vacation-common.c:25 Sep 01 00:06:54 IMAP dovecot[5112]: managesieve(5123): Warning: Leaked settings: sieve.c:93 Sep 01 00:06:54 IMAP dovecot[5112]: managesieve(5123): Warning: Event 0x558e90507d38 leaked (parent=0x558e904ee688): sieve.c:84 Sep 01 00:06:54 IMAP dovecot[5112]: managesieve(5123): Warning: Event 0x558e904ee688 leaked (parent=0x558e904ed648): mail-user.c:90 Sep 01 00:06:54 IMAP dovecot[5112]: managesieve(5123): Warning: Event 0x558e904ed648 leaked (parent=0x558e904ec508): mail-storage-service.c:1088 Sep 01 00:06:54 IMAP dovecot[5112]: managesieve(5123): Warning: Event 0x558e904ec508 leaked (parent=(nil)): main.c:157 System is working well (and if the typos / inconsistencies aren't interesting then I completely understand), thank you for all your hard work. Kind Regards, Matthew

1 0

Segfault on dovecot reload
by Bogdan Vasilescu 03 Sep '25

03 Sep '25

Hi, While migrating my config from 2.3 to 2.4, I found out that if instance_name is set to any value (including the default 'dovecot') and I run "dovecot reload" twice, I get a segmentation fault. syslog: dovecot[18272]: segfault at 7fdd23b51442 ip 00007fdd237c4ac6 sp 00007ffd0420caa8 error 4 in libc-2.33.so[7fdd23742000+15e000] my config: # 2.4.1-4 (7d8c0e5759): /etc/dovecot/dovecot.conf # Pigeonhole version 2.4.1-4 (0a86619f) # OS: Linux 5.15.161-array x86_64 Slackware 15.0 # Hostname: my.host.name dovecot_config_version = 2.4.1 acl_defaults_from_inbox = yes acl_driver = vfile acl_globals_only = yes auth_cache_negative_ttl = 1 hour auth_cache_ttl = 1 hour auth_failure_delay = 3 secs auth_master_user_separator = * auth_mechanisms = plain login auth_socket_path = /var/run/dovecot/auth-userdb auth_username_chars = abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ01234567890.-_@* auth_verbose = yes base_dir = /var/run/dovecot/ debug_log_path = syslog default_client_limit = 640 default_process_limit = 128 default_vsz_limit = 256M deliver_log_format = %{message} [msgid=%{msgid}, size=%{size}] dovecot_storage_version = 2.4.1 first_valid_gid = 10000 first_valid_uid = 10000 imap_client_workarounds = delay-newmail tb-extra-mailbox-sep tb-lsub-flags imap_logout_format = [session=<%{session}>, in=%{input}, out=%{output}] imap_max_line_length = 64k info_log_path = syslog last_valid_gid = 10999 last_valid_uid = 10999 lda_mailbox_autocreate = yes lda_mailbox_autosubscribe = yes listen = * login_greeting = IMAP/POP3 daemon login_log_format = %{message} %{elements} login_log_format_elements = [user=<%{user}> rip=%{remote_ip} lip=%{local_ip} session=<%{session}> method=%{mechanism} %{secured}] mail_log_prefix = "%{service}(%{user}): " mail_temp_scan_interval = 1 week mailbox_list_index_very_dirty_syncs = yes pop3_client_workarounds = outlook-no-nuls oe-ns-eoh pop3_logout_format = [session=<%{session}>, in=%{input}, out=%{output}] pop3_uidl_duplicates = rename protocols = imap lmtp pop3 rejection_reason = Your message to <%t> was automatically rejected:%n%r rejection_subject = Rejected: %s sieve_execute_bin_dir = /var/lib/dovecot/sieve sieve_global_extensions { vnd.dovecot.pipe = yes vnd.dovecot.execute = yes } sieve_max_script_size = 1M sieve_pipe_bin_dir = /var/lib/dovecot/sieve sieve_plugins = sieve_imapsieve sieve_extprograms sieve_redirect_envelope_from = sender sql_driver = mysql ssl_min_protocol = TLSv1 verbose_proctitle = yes ssl_server { cert_file = /etc/ssl/certs/server.pem cert_username_field = commonName dh_file = /var/lib/dovecot/dh.pem key_file = /etc/ssl/private/server.key prefer_ciphers = client request_client_cert = no require_crl = yes } namespace inbox { mail_driver = maildir mail_inbox_path = /srv/vhosts/%{user | domain}/mail/%{user}/INBOX mail_path = /srv/vhosts/%{user | domain}/mail/%{user} mailbox_list_layout = fs hidden = no inbox = yes list = yes prefix = separator = / subscriptions = yes type = private mailbox INBOX/* { acl "user=sysadmin(a)my.host.name" { rights = lrwstipekxa } } } maildir { broken_filename_sizes = yes copy_with_hardlinks = yes empty_new = no stat_dirs = no very_dirty_syncs = no } mbox { dirty_syncs = yes dotlock_change_timeout = 2 mins lazy_writes = yes lock_timeout = 5 mins md5 = all min_index_size = 0 read_locks = fcntl very_dirty_syncs = no write_locks = dotlock fcntl } mdbox { preallocate_space = no rotate_interval = 0 rotate_size = 10M } service imap-login { process_min_avail = 0 restart_request_count = 1 user = $SET:default_login_user vsz_limit = 256M inet_listener imap { port = 143 listen = 127.0.0.1 } inet_listener imaps { port = 993 ssl = yes } } service pop3-login { process_min_avail = 0 restart_request_count = 1 user = $SET:default_login_user vsz_limit = 256M inet_listener pop3 { port = 110 listen = 127.0.0.1 } inet_listener pop3s { port = 995 ssl = yes } } service lmtp { unix_listener /var/spool/postfix/private/dovecot-lmtp { group = postfix mode = 0666 user = postfix } } service imap { process_limit = 256 vsz_limit = 256M } service pop3 { process_limit = 256 vsz_limit = 256M } service auth { client_limit = 640 user = $SET:default_internal_user unix_listener auth-userdb { mode = 0666 } unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0666 user = postfix } } service auth-worker { user = $SET:default_internal_user } mysql 127.0.0.1 { dbname = vhosts password = # hidden, use -P to show it user = services } passdb sql { default_password_scheme = CRYPT driver = sql query = SELECT `u`.`password` AS `password`, '/srv/vhosts/%{user | domain }/mail/%{user}' AS `userdb_home`, `u`.`domain` AS `userdb_uid`, `u`.`domain` AS `userdb_gid` FROM `users` AS `u` LEFT JOIN `domains` AS `d` ON `u`.`domain` = `d`.`id` WHERE `u`.`user` = '%{user}' AND `u`.`enabled` = '1' AND FIND_IN_SET('U_%{protocol}', `u`.`permissions`) AND `d`.`enabled` = '1' AND FIND_IN_SET('U_%{protocol}', `d`.`permissions`) } passdb passwd:backup { auth_username_format = %{user} default_password_scheme = CRYPT driver = passwd-file passwd_file_path = /etc/dovecot/auth/passwd:backup } passdb passwd:master { auth_username_format = %{user} default_password_scheme = CRYPT driver = passwd-file master = yes result_success = continue passwd_file_path = /etc/dovecot/auth/passwd:master } userdb sql { driver = prefetch } userdb passwd:backup { auth_username_format = %{user} passwd_file_path = /etc/dovecot/auth/passwd:backup driver = passwd-file } userdb passwd:master { auth_username_format = %{user} passwd_file_path = /etc/dovecot/auth/passwd:master driver = passwd-file fields { master_user = %{user} } } protocol imap { mail_max_userip_connections = 10 mail_plugins { acl = yes } } protocol pop3 { mail_max_userip_connections = 10 mail_plugins { acl = yes } } protocol lda { mail_plugins { sieve = yes } } protocol lmtp { mail_plugins { sieve = yes } } sieve_script backup { driver = file path = /var/lib/dovecot/sieve/backup_%{user | username }.sieve type = personal } mailbox INBOX/Spam { sieve_script spam { cause = copy path = /var/lib/dovecot/sieve/learn_spam.sieve type = before } } imapsieve_from INBOX/Spam { sieve_script ham { cause = copy path = /var/lib/dovecot/sieve/learn_ham.sieve type = before } } mailbox INBOX/Junk { sieve_script spam { cause = copy path = /var/lib/dovecot/sieve/learn_spam.sieve type = before } } imapsieve_from INBOX/Junk { sieve_script ham { cause = copy path = /var/lib/dovecot/sieve/learn_ham.sieve type = before } } auth_policy { check_after_auth = no check_before_auth = yes hash_mech = sha256 hash_nonce = # hidden, use -P to show it hash_truncate = 12 log_only = no reject_on_fail = no report_after_auth = no request_attributes { device_id = %{client_id} fail_type = %{fail_type} login = %{requested_username} protocol = %{protocol} pwhash = %{hashed_password} remote = %{remote_ip} session_id = %{session} } server_url = http://127.0.0.1/authpolicy/ } Thanks, Bogdan

3 2

update-apt-xapian-index on trixie fails
by Graham Eddy 03 Sep '25

03 Sep '25

update-apt-xapian-index relies upon module ‘imp’ that was removed from python 3.12 onwards, so fails with dovecot on trixie. updating /usr/lib/python3/dist-packages/axi/indexer.py by replacing imp.load_module per https://docs.python.org/3/whatsnew/3.12.html#whatsnew312-removed-imp, plus installing module ’six’, seems to fix it. i look forward to the proper fix to xapian-index. cheers ⊣GE⊢ update-apt-xapian-index relies upon module `imp' that was removed from python 3.12 onwards, so fails with dovecot on trixie. updating /usr/lib/python3/dist-packages/axi/indexer.py by replacing imp.load_module per [1]https://docs.python.org/3/whatsnew/3.12.html#whatsnew312-removed-imp, plus installing module 'six', seems to fix it. i look forward to the proper fix to xapian-index. cheers *GE* References Visible links 1. https://docs.python.org/3/whatsnew/3.12.html#whatsnew312-removed-imp

2 1

Crash in dovecot snippet when using imapc
by John van der Kamp 03 Sep '25

03 Sep '25

Hello, I've found a crash in a very specific setup. A dovecot server with imapc connection needs to receive an email with no body contents for the intent of generating a preview/snippet. It crashes somewhere deep in the jungle of istream and snapshots. I've included a script which sets up the systems to reproduce the crash. I've tested this with several versions. 2.3.16 doesn't seem to be affected, but 2.3.20 and 2.3.21 are affect. For me it produces a traceback like this, using the ubuntu version from here: https://packages.ubuntu.com/noble/dovecot-core (gdb) bt #0 __pthread_kill_implementation (no_tid=0, signo=6, threadid=140530132887360) at ./nptl/pthread_kill.c:44 #1 __pthread_kill_internal (signo=6, threadid=140530132887360) at ./nptl/pthread_kill.c:78 #2 __GI___pthread_kill (threadid=140530132887360, signo=signo@entry=6) at ./nptl/pthread_kill.c:89 #3 0x00007fcfb8842476 in __GI_raise (sig=sig@entry=6) at ../sysdeps/posix/raise.c:26 #4 0x00007fcfb88287f3 in __GI_abort () at ./stdlib/abort.c:79 #5 0x00007fcfb8b37fe5 in default_fatal_finish (status=0, type=LOG_TYPE_PANIC) at ../lib/failures.c:465 #6 fatal_handler_real (ctx=<optimized out>, format=<optimized out>, args=<optimized out>) at ../lib/failures.c:477 #7 0x00007fcfb8be50d7 in i_internal_fatal_handler (ctx=<optimized out>, format=<optimized out>, args=<optimized out>) at ../lib/failures.c:879 #8 0x00007fcfb8b37eea in i_panic (format=0x7fcfb8c29020 "file %s: line %d (%s): assertion failed: (%s)") at ../lib/failures.c:530 #9 0x00007fcfb8b3387b in i_stream_header_filter_snapshot_free (_snapshot=<optimized out>) at ../lib-mail/istream-header-filter.c:663 #10 i_stream_header_filter_snapshot_free (_snapshot=0x55dabe297a60) at ../lib-mail/istream-header-filter.c:655 #11 0x00007fcfb8bf25ac in i_stream_snapshot_free (_snapshot=_snapshot@entry=0x55dabe29b0d0) at ../lib/istream.c:253 #12 0x00007fcfb8bf2654 in i_stream_unref (stream=0x7ffc16cc7fa0) at ../lib/istream.c:66 #13 0x00007fcfb8d96baa in index_mail_write_body_snippet (mail=0x55dabe292058) at index/index-mail.c:1151 #14 0x00007fcfb8d97e48 in index_mail_parse_bodystructure (mail=0x55dabe292058, field=MAIL_CACHE_BODY_SNIPPET) at index/index-mail.c:1551 #15 0x00007fcfb8d97fe2 in index_mail_fetch_body_snippet (value_r=0x7ffc16cc8050, mail=0x55dabe292058) at index/index-mail.c:1602 #16 index_mail_get_special (_mail=0x55dabe292058, field=<optimized out>, value_r=0x7ffc16cc8050) at index/index-mail.c:1730 #17 0x00007fcfb8d16ffe in mail_get_special (mail=mail@entry=0x55dabe292058, field=field@entry=MAIL_FETCH_BODY_SNIPPET, value_r=value_r@entry=0x7ffc16cc8050) at /home/ubuntu/dovecot/new/dovecot-2.3.21+dfsg1/src/lib-storage/mail.c:418 #18 0x000055dabc52645c in fetch_snippet (ctx=0x55dabe26e050, mail=0x55dabe292058, preview=0x55dabe28f1f8) at ./src/imap/imap-fetch-body.c:615 #19 0x000055dabc52b5cc in imap_fetch_more_int (ctx=0x55dabe26e050, cancel=false) at ./src/imap/imap-fetch.c:562 #20 0x000055dabc52b8ad in imap_fetch_more (ctx=0x55dabe26e050, cmd=0x55dabe26de98) at ./src/imap/imap-fetch.c:617 #21 0x000055dabc51fd07 in cmd_fetch (cmd=0x55dabe26de98) at ./src/imap/cmd-fetch.c:382 #22 0x000055dabc528af4 in command_exec (cmd=0x55dabe26de98) at ./src/imap/imap-commands.c:201 #23 0x000055dabc52e9e2 in client_command_input (cmd=<optimized out>) at ./src/imap/imap-client.c:1237 #24 0x000055dabc52ea96 in client_command_input (cmd=<optimized out>) at ./src/imap/imap-client.c:1307 #25 0x000055dabc52eeed in client_handle_next_command (remove_io_r=<synthetic pointer>, client=0x55dabe26d2c8) at ./src/imap/imap-client.c:1349 #26 client_handle_input (client=0x55dabe26d2c8) at ./src/imap/imap-client.c:1363 #27 0x000055dabc52f2c4 in client_input (client=0x55dabe26d2c8) at ./src/imap/imap-client.c:1407 #28 0x00007fcfb8bfe27d in io_loop_call_io (io=0x55dabe26e660) at ../lib/ioloop.c:737 #29 0x00007fcfb8bff81a in io_loop_handler_run_internal (ioloop=0x55dabe243fd0) at ../lib/ioloop-epoll.c:222 #30 0x00007fcfb8bff8d4 in io_loop_handler_run (ioloop=0x55dabe243fd0) at ../lib/ioloop.c:789 #31 0x00007fcfb8bffa90 in io_loop_run (ioloop=0x55dabe243fd0) at ../lib/ioloop.c:762 #32 0x00007fcfb8b6ce57 in master_service_run (service=0x55dabe243e20, callback=callback@entry=0x55dabc533210 <client_connected>) at ../lib-master/master-service.c:878 #33 0x000055dabc51ad37 in main (argc=<optimized out>, argv=<optimized out>) at ./src/imap/main.c:575 John Hello, I've found a crash in a very specific setup. A dovecot server with imapc connection needs to receive an email with no body contents for the intent of generating a preview/snippet. It crashes somewhere deep in the jungle of istream and snapshots. I've included a script which sets up the systems to reproduce the crash. I've tested this with several versions. 2.3.16 doesn't seem to be affected, but 2.3.20 and 2.3.21 are affect. For me it produces a traceback like this, using the ubuntu version from here: https://packages.ubuntu.com/noble/dovecot-core (gdb) bt #0 __pthread_kill_implementation (no_tid=0, signo=6, threadid=140530132887360) at ./nptl/pthread_kill.c:44 #1 __pthread_kill_internal (signo=6, threadid=140530132887360) at ./nptl/ pthread_kill.c:78 #2 __GI___pthread_kill (threadid=140530132887360, signo=signo@entry=6) at ./ nptl/pthread_kill.c:89 #3 0x00007fcfb8842476 in __GI_raise (sig=sig@entry=6) at ../sysdeps/posix/ raise.c:26 #4 0x00007fcfb88287f3 in __GI_abort () at ./stdlib/abort.c:79 #5 0x00007fcfb8b37fe5 in default_fatal_finish (status=0, type=LOG_TYPE_PANIC) at ../lib/failures.c:465 #6 fatal_handler_real (ctx=<optimized out>, format=<optimized out>, args=<optimized out>) at ../lib/failures.c:477 #7 0x00007fcfb8be50d7 in i_internal_fatal_handler (ctx=<optimized out>, format=<optimized out>, args=<optimized out>) at ../lib/failures.c:879 #8 0x00007fcfb8b37eea in i_panic (format=0x7fcfb8c29020 "file %s: line %d (%s): assertion failed: (%s)") at ../lib/failures.c:530 #9 0x00007fcfb8b3387b in i_stream_header_filter_snapshot_free (_snapshot=<optimized out>) at ../lib-mail/istream-header-filter.c:663 #10 i_stream_header_filter_snapshot_free (_snapshot=0x55dabe297a60) at ../lib- mail/istream-header-filter.c:655 #11 0x00007fcfb8bf25ac in i_stream_snapshot_free (_snapshot=_snapshot@entry=0x55dabe29b0d0) at ../lib/istream.c:253 #12 0x00007fcfb8bf2654 in i_stream_unref (stream=0x7ffc16cc7fa0) at ../lib/ istream.c:66 #13 0x00007fcfb8d96baa in index_mail_write_body_snippet (mail=0x55dabe292058) at index/index-mail.c:1151 #14 0x00007fcfb8d97e48 in index_mail_parse_bodystructure (mail=0x55dabe292058, field=MAIL_CACHE_BODY_SNIPPET) at index/index-mail.c:1551 #15 0x00007fcfb8d97fe2 in index_mail_fetch_body_snippet (value_r=0x7ffc16cc8050, mail=0x55dabe292058) at index/index-mail.c:1602 #16 index_mail_get_special (_mail=0x55dabe292058, field=<optimized out>, value_r=0x7ffc16cc8050) at index/index-mail.c:1730 #17 0x00007fcfb8d16ffe in mail_get_special (mail=mail@entry=0x55dabe292058, field=field@entry=MAIL_FETCH_BODY_SNIPPET, value_r=value_r@entry=0x7ffc16cc8050) at /home/ubuntu/dovecot/new/dovecot-2.3.21+dfsg1/src/lib-storage/mail.c:418 #18 0x000055dabc52645c in fetch_snippet (ctx=0x55dabe26e050, mail=0x55dabe292058, preview=0x55dabe28f1f8) at ./src/imap/imap-fetch-body.c: 615 #19 0x000055dabc52b5cc in imap_fetch_more_int (ctx=0x55dabe26e050, cancel=false) at ./src/imap/imap-fetch.c:562 #20 0x000055dabc52b8ad in imap_fetch_more (ctx=0x55dabe26e050, cmd=0x55dabe26de98) at ./src/imap/imap-fetch.c:617 #21 0x000055dabc51fd07 in cmd_fetch (cmd=0x55dabe26de98) at ./src/imap/cmd- fetch.c:382 #22 0x000055dabc528af4 in command_exec (cmd=0x55dabe26de98) at ./src/imap/imap- commands.c:201 #23 0x000055dabc52e9e2 in client_command_input (cmd=<optimized out>) at ./src/ imap/imap-client.c:1237 #24 0x000055dabc52ea96 in client_command_input (cmd=<optimized out>) at ./src/ imap/imap-client.c:1307 #25 0x000055dabc52eeed in client_handle_next_command (remove_io_r=<synthetic pointer>, client=0x55dabe26d2c8) at ./src/imap/imap-client.c:1349 #26 client_handle_input (client=0x55dabe26d2c8) at ./src/imap/imap-client.c: 1363 #27 0x000055dabc52f2c4 in client_input (client=0x55dabe26d2c8) at ./src/imap/ imap-client.c:1407 #28 0x00007fcfb8bfe27d in io_loop_call_io (io=0x55dabe26e660) at ../lib/ ioloop.c:737 #29 0x00007fcfb8bff81a in io_loop_handler_run_internal (ioloop=0x55dabe243fd0) at ../lib/ioloop-epoll.c:222 #30 0x00007fcfb8bff8d4 in io_loop_handler_run (ioloop=0x55dabe243fd0) at ../ lib/ioloop.c:789 #31 0x00007fcfb8bffa90 in io_loop_run (ioloop=0x55dabe243fd0) at ../lib/ ioloop.c:762 #32 0x00007fcfb8b6ce57 in master_service_run (service=0x55dabe243e20, callback=callback@entry=0x55dabc533210 <client_connected>) at ../lib-master/ master-service.c:878 #33 0x000055dabc51ad37 in main (argc=<optimized out>, argv=<optimized out>) at ./src/imap/main.c:575 John

2 7

Re: "MitM" account to bypass quota
by Nick Howitt 03 Sep '25

03 Sep '25

Please can you reply to list rather than directly do me? I just know of the tool and not how to use it. It doesn't look like it supports continually running it in the background, but you can always put it in a loop in a shell script, perhaps with a delay between iterations. If you use cron, you have to be careful that it is not already running when it gets fires again. Nick On 02/09/2025 20:08, Carlos Mogas da Silva wrote: > Can doveadm-sync be configured to keep running on the background? > Can't seem to find anything related to this... > > > On 2 September 2025 20:00:01 WEST, Nick Howitt via dovecot > <dovecot(a)dovecot.org> wrote: > > How about doveadm-sync > (https://doc.dovecot.org/main/core/man/doveadm-sync.1.html) or > imapsync? On 02/09/2025 19:26, Carlos Mogas da Silva via dovecot > wrote: > > Hi list. I have an email address hosted on a server not > controlled by me which enforces quota on the accounts. No > issues there. What I want to know, is how can I use my mail > server, or in this case, dovecot, to act as a "client" to that > imap server and download all the messages from it storing them > locally (in my server) in effect, bypassing the quota > restriction. If you can point me to some documentation or give > a general idea on how I could accomplish this it would be > nice. Thanks in advance! Carlos Mogas da Silva > ------------------------------------------------------------------------ > dovecot mailing list --dovecot(a)dovecot.org To unsubscribe send > an email todovecot-leave(a)dovecot.org > Please can you reply to list rather than directly do me? I just know of the tool and not how to use it. It doesn't look like it supports continually running it in the background, but you can always put it in a loop in a shell script, perhaps with a delay between iterations. If you use cron, you have to be careful that it is not already running when it gets fires again. Nick On 02/09/2025 20:08, Carlos Mogas da Silva wrote: Can doveadm-sync be configured to keep running on the background? Can't seem to find anything related to this... On 2 September 2025 20:00:01 WEST, Nick Howitt via dovecot [1]<dovecot(a)dovecot.org> wrote: How about doveadm-sync ([2]https://doc.dovecot.org/main/core/man/doveadm-sync.1.html) or imapsync? On 02/09/2025 19:26, Carlos Mogas da Silva via dovecot wrote: Hi list. I have an email address hosted on a server not controlled by me which enforces quota on the accounts. No issues there. What I want to know, is how can I use my mail server, or in this case, dovecot, to act as a "client" to that imap server and download all the messages from it storing them locally (in my server) in effect, bypassing the quota restriction. If you can point me to some documentation or give a general idea on how I could accomplish this it would be nice. Thanks in advance! Carlos Mogas da Silva -------------------------------------------------------------------------- dovecot mailing list --dovecot(a)dovecot.org To unsubscribe send an email [3]todovecot-leave(a)dovecot.org References Visible links 1. mailto:dovecot@dovecot.org 2. https://doc.dovecot.org/main/core/man/doveadm-sync.1.html 3. mailto:todovecot-leave@dovecot.org

5 8

"MitM" account to bypass quota
by Carlos Mogas da Silva 02 Sep '25

02 Sep '25

Hi list. I have an email address hosted on a server not controlled by me which enforces quota on the accounts. No issues there. What I want to know, is how can I use my mail server, or in this case, dovecot, to act as a "client" to that imap server and download all the messages from it storing them locally (in my server) in effect, bypassing the quota restriction. If you can point me to some documentation or give a general idea on how I could accomplish this it would be nice. Thanks in advance! Carlos Mogas da Silva Hi list. I have an email address hosted on a server not controlled by me which enforces quota on the accounts. No issues there. What I want to know, is how can I use my mail server, or in this case, dovecot, to act as a "client" to that imap server and download all the messages from it storing them locally (in my server) in effect, bypassing the quota restriction. If you can point me to some documentation or give a general idea on how I could accomplish this it would be nice. Thanks in advance! Carlos Mogas da Silva

3 2

Dovecot 2.4.1: Domain part of user gets dropped in userdb_sql_query
by Robert Czechowski 01 Sep '25

01 Sep '25

Hi, I stumbled upon a problem where documentation and logs no longer help me. After upgrading to Debian Trixie / Dovecot 2.4.1-4 I have run into the following problem after fixing up most of my configuration. I'm using a vmail setup with user information in a mysql database and mailboxes in maildir format. Apparently %{user | domain} will not get set in my SQL query when looking up users for lmtp transport: With the setting userdb_sql_query = SELECT 150 AS uid, 8 AS gid FROM users WHERE username = '%{user | username}' AND domain = '%{user | domain}' I get the following debug log: dovecot: lmtp(118509): Connect from local dovecot: lmtp(robert(a)czecho.de)<118509><hXWpLOzOtGjtzgEAp35xQg>: Debug: auth-master: userdb lookup(robert(a)czecho.de): Started userdb lookup dovecot: lmtp(robert(a)czecho.de)<118509><hXWpLOzOtGjtzgEAp35xQg>: Debug: auth-master: conn unix:/var/run/dovecot//auth-userdb: Connecting dovecot: lmtp(robert(a)czecho.de)<118509><hXWpLOzOtGjtzgEAp35xQg>: Debug: auth-master: conn unix:/var/run/dovecot//auth-userdb (pid=115443,uid=0): Client connected (fd=14) dovecot: auth: Debug: conn unix:/var/run/dovecot/auth-userdb (pid=118509,uid=150): Server accepted connection (fd=23) dovecot: auth: Debug: master in: USER#0111#011robert(a)czecho.de#011protocol=lmtp dovecot: auth(robert): Debug: sql: Performing userdb lookup dovecot: auth-worker(115838): Debug: conn unix:auth-worker (pid=115833,uid=109): auth-worker<7>: Handling USER request dovecot: auth-worker(robert)<115838>: request [7]: Debug: sql: Performing userdb lookup dovecot: auth-worker(robert)<115838>: request [7]: Debug: sql: SELECT 150 AS uid, 8 AS gid FROM users WHERE username = 'robert' AND domain = '' dovecot: auth-worker(115838): Debug: mysql(127.0.0.1): Finished query 'SELECT 150 AS uid, 8 AS gid FROM users WHERE username = 'robert' AND domain = ''' in 0 msecs dovecot: auth-worker(robert)<115838>: request [7]: sql: unknown user dovecot: auth-worker(robert)<115838>: request [7]: Debug: sql: Finished userdb lookup dovecot: auth-worker(115838): Debug: conn unix:auth-worker (pid=115833,uid=109): auth-worker<7>: Finished: user_unknown dovecot: auth(robert): Debug: sql: Finished userdb lookup dovecot: auth: Debug: userdb out: NOTFOUND#0111 Note the SELECT 150 AS uid, 8 AS gid FROM users WHERE username = 'robert' AND domain = '' Resulting in poostfix/lmtp[118495]: A7D6F5A0350: to=<robert(a)czecho.de>, relay=alyx.czecho.de[private/dovecot-lmtp], delay=0.11, delays=0.03/0.04/0.02/0.02, dsn=5.1.1, status=bounced (host alyx.czecho.de[private/dovecot-lmtp] said: 550 5.1.1 <robert(a)czecho.de> User doesn't exist: robert(a)czecho.de (in reply to RCPT TO command)) Apparently, somewhere, the domain part of the users gets lost. My current workaround is to use the query without the domain part: userdb_sql_query = SELECT 150 AS uid, 8 AS gid FROM users WHERE username = '%{user | username}' However this places the mail in the wrong maildir directory. I've worked around that by creating symlinks for all users, but it seems a bit more effort than necessary. Also this will break as soon as two domains have the same username. :( For completeness: # dovecot -n # 2.4.1-4 (7d8c0e5759): /etc/dovecot/dovecot.conf # Pigeonhole version 2.4.1-4 (0a86619f) # OS: Linux 6.12.41+deb13-amd64 x86_64 Debian 13.0 # Hostname: alyx.czecho.de # 4 default setting changes since version 2.4.0 dovecot_config_version = 2.4.0 auth_debug = yes auth_mechanisms = plain login auth_verbose = yes base_dir = /var/run/dovecot/ dovecot_storage_version = 2.4.0 first_valid_uid = 150 fts_autoindex = yes fts_autoindex_max_recent_msgs = 999 fts_search_add_missing = yes language_filters = normalizer-icu snowball stopwords language_tokenizers = generic email-address listen = * :: mail_debug = yes mail_driver = maildir mail_gid = mail mail_home = /var/vmail/%{user | domain}/%{user | username} mail_path = ~/mail mail_plugins { fts = yes fts_flatcurve = yes } mail_privileged_group = mail mail_uid = vmail protocols = imap lmtp namespace inbox { inbox = yes mailbox Drafts { special_use = "\\Drafts" } mailbox Junk { special_use = "\\Junk" } mailbox Trash { special_use = "\\Trash" } mailbox Sent { special_use = "\\Sent" } mailbox "Sent Messages" { special_use = "\\Sent" } } service imap-login { inet_listener imap { port = 143 } inet_listener imaps { port = 993 ssl = yes } } service lmtp { user = vmail unix_listener /var/spool/postfix/private/dovecot-lmtp { group = postfix mode = 0660 user = postfix } } service imap { } service pop3 { } service auth { unix_listener auth-userdb { group = mail mode = 0600 user = vmail } unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0660 user = postfix } } service auth-worker { } service dict { unix_listener dict { } } ssl_server { cert_file = /etc/ssl/certs/letsencrypt/mail.scrt key_file = /etc/ssl/private/letsencrypt/mail.priv } protocol lmtp { auth_username_format = %{user | username} } language en { default = yes filters = lowercase snowball english-possessive stopwords } fts flatcurve { substring_search = yes } mysql 127.0.0.1 { dbname = vmail password = # hidden, use -P to show it user = vmail } passdb sql { default_password_scheme = SHA512-CRYPT query = SELECT username, domain, password FROM users WHERE username = '%{user | username}' AND domain = '%{user | domain}' sql_driver = mysql } userdb sql { sql_driver = mysql iterate_query = SELECT CONCAT(username, '@', domain) as user FROM users query = SELECT 150 AS uid, 8 AS gid FROM users WHERE username = '%{user | username}' }

2 2

dovecot-core: dovecot imap attempts to rmdir the configured mail_inbox_path
by pelzi＠feldner-bv.de 29 Aug '25

29 Aug '25

Package: dovecot-core Version: 1:2.4.1+dfsg1-6 Severity: important Dear Maintainer, after upgrading to trixie, I reconfigure dovecot - starting with the maintainer's config files due to the complete change of config syntax - and got it working again serving the existing mailboxes. I again configured /var/mail/%{user | username} as mail_inbox_path, at a separate location from all other mailboxes at some directory at user's home. All mailboxes remain in mbox format as before. When I set up a mail inbox path in shared namespace, dovecot is attempting to delete the lexicographically first user "someotheruser" who is sharing their mailboxes, whenever a user "someuser" with read access to that mailboxes is updating the mailbox list: journalctl output with mail_inbox_path setup for shared namespace ----------------------------------------------------------------- Aug 16 16:43:59 somehost systemd[1]: Started dovecot.service - Dovecot IMAP/POP3 email server. Aug 16 16:44:05 somehost dovecot[65636]: imap-login: Login aborted: Logged out (no auth attempts in 0 secs) (no_auth_attempts): user=<>, rip=some::ipv6, lip=some::ipv6, session=<xojHiXw8zKP95iU4WzA7U7on6//+m0as> Aug 16 16:44:14 somehost auth[65647]: pam_unix(dovecot:auth): authentication failure; logname= uid=0 euid=0 tty=dovecot ruser=someuser rhost=some::ipv6 user=someuser Aug 16 16:44:14 somehost dovecot[65636]: imap-login: Logged in: user=<someuser>, method=PLAIN, rip=some::ipv6, lip=some::ipv6, mpid=65651, TLS, session=<0klNinw8fJIqAgkIAbCIAAL////+ESJD> Aug 16 16:44:14 somehost dovecot[65636]: imap(someuser)<65651><0klNinw8fJIqAgkIAbCIAAL////+ESJD>: Disconnected: Logged out in=98 out=1253 deleted=0 expunged=0 trashed=0 hdr_count=0 hdr_bytes=0 body_count=0 body_bytes=0 Aug 16 16:44:14 somehost auth[65647]: pam_unix(dovecot:auth): authentication failure; logname= uid=0 euid=0 tty=dovecot ruser=someuser rhost=some::ipv6 user=someuser Aug 16 16:44:14 somehost dovecot[65636]: imap-login: Logged in: user=<someuser>, method=PLAIN, rip=some::ipv6, lip=some::ipv6, mpid=65656, TLS, session=<tE5Oinw8hpIqAgkIAbCIAAL////+ESJD> Aug 16 16:44:14 somehost dovecot[65636]: imap(someuser)<65656><tE5Oinw8hpIqAgkIAbCIAAL////+ESJD>: Error: rmdir(/var/mail/someotheruser) failed: Permission denied ----------------------------------------------------------------- (Note: the authentication failure listed here appears to come from a certain pam module that doesn't know someuser, but is cured by another pam module in the stack that can authenticate someuser) This otheruser's INBOX will _not_ be displayed in the folder list for someuser, whereas the INBOX of lexicographically following user is not attempted to rmdir, and _do_ show up for the authorized someuser. When, for testing purposes, I remove mail_inbox_path from the shared namespace's configuration, obviously all otheruser's INBOX'es disappear from the folder list of someuser. But now dovecat attempts to rmdir someuser's own inbox: journalctl output with no mail_inbox_path configured for shared namespace, but only for inbox namespace ---------------------------------------------------------------- Aug 16 16:34:48 mailserver systemd[1]: Started dovecot.service - Dovecot IMAP/POP3 email server. Aug 16 16:34:48 mailserver unix_chkpwd[65322]: password check failed for user (someuser) Aug 16 16:34:48 mailserver auth[65320]: pam_unix(dovecot:auth): authentication failure; logname= uid=0 euid=0 tty=dovecot ruser=someuser rhost=some::ipv6 user=someuser Aug 16 16:34:48 mailserver dovecot[65315]: imap-login: Logged in: user=<someuser>, method=PLAIN, rip=some::ipv6 lip=some::ipv6, mpid=65324, TLS, session=<uViUaHw8psgqAgkIAbCIAAL////+ESJD> Aug 16 16:34:48 mailserver dovecot[65315]: imap(someuser)<65324><uViUaHw8psgqAgkIAbCIAAL////+ESJD>: Error: rmdir(/var/mail/someuser) failed: Permission denied ---------------------------------------------------------------- In this case, however someuser's INBOX remains in the folder list. *** Reporter, please consider answering these questions, where appropriate *** * What led up to the situation? The upgrade to version 2.4.1 combined with a complete new configuration. -- Package-specific info: dovecot configuration --------------------- ... mail_driver = mbox mail_gid = familie mail_home = /home/%{user | username} mail_inbox_path = /var/mail/%{user | username} mail_path = ~/IMail mail_plugins { acl = yes fts = yes fts_solr = yes } mail_privileged_group = mail ... mail_shared_explicit_inbox = yes protocols { imap = yes sieve = yes } passdb pam { } userdb passwd { } namespace inbox { mail_driver = mbox mail_inbox_path = /var/mail/%{user | username} mail_path = ~/IMail inbox = yes subscriptions = yes type = private mailbox Drafts { special_use = "\\Drafts" } mailbox Junk { special_use = "\\Junk" } mailbox Trash { special_use = "\\Trash" } mailbox Sent { special_use = "\\Sent" } mailbox "Sent Messages" { special_use = "\\Sent" } } namespace shared { mail_driver = mbox # this following setting removed for 2nd test mail_inbox_path = /var/mail/%{owner_user | username } mail_index_private_path = ~/.dovecot-index/shared/%{owner_user} mail_path = %{owner_home}/IMail list = yes prefix = shared/$username/ separator = / subscriptions = no type = shared } acl_sharing_map { dict file { path = /var/lib/dovecot/db/shared-mailboxes.db } } protocol imap { mail_plugins { imap_acl = yes } } service imap-login { inet_listener imap { } inet_listener imaps { } } service lmtp { unix_listener lmtp { } } service imap { } service pop3 { } service auth { unix_listener auth-userdb { group = users mode = 0660 user = mail } unix_listener auth-exim { group = sasl mode = 0660 type = auth-legacy user = mail } } service auth-worker { } service dict { unix_listener dict { } } ssl_server { cert_file = /etc/letsencrypt/live/somedomain/fullchain.pem key_file = /etc/letsencrypt/live/somedomain/privkey.pem } service managesieve-login { inet_listener sieve { port = 4190 } inet_listener sieve_deprecated { port = 2000 } } service managesieve { } language de { default = yes } language en { } fts solr { url = http://localhost:8983/solr/dovecot/ } -- System Information: Debian Release: 13.0 APT prefers stable-security APT policy: (500, 'stable-security'), (500, 'stable') Architecture: amd64 (x86_64) Kernel: Linux 6.12.41+deb13-amd64 (SMP w/4 CPU threads; PREEMPT) Kernel taint flags: TAINT_FIRMWARE_WORKAROUND, TAINT_OOT_MODULE, TAINT_UNSIGNED_MODULE Locale: LANG=de_DE.UTF-8, LC_CTYPE=de_DE.UTF-8 (charmap=UTF-8), LANGUAGE not set Shell: /bin/sh linked to /usr/bin/dash Init: systemd (via /run/systemd/system) Versions of packages dovecot-core depends on: ii adduser 3.152 ii dovecot-sieve 1:2.4.1+dfsg1-6 ii init-system-helpers 1.68 ii libapparmor1 4.1.0-1 ii libbz2-1.0 1.0.8-6 ii libc6 2.41-12 ii libcap2 1:2.75-10+b1 ii libcrypt1 1:4.4.38-1 ii libexttextcat-2.0-0 3.4.7-1+b1 ii libicu76 76.1-4 ii liblua5.4-0 5.4.7-1+b2 ii liblz4-1 1.10.0-4 ii libpam-runtime 1.7.0-5 ii libpam0g 1.7.0-5 ii libsodium23 1.0.18-1+b2 ii libssl3t64 3.5.1-1 ii libstemmer0d 2.2.0-4+b2 ii libsystemd0 257.7-1 ii libtirpc3t64 1.3.6+ds-1 ii libunwind8 1.8.1-0.1 ii libzstd1 1.5.7+dfsg-1 ii openssl 3.5.1-1 ii ssl-cert 1.1.3 ii ucf 3.0052 ii zlib1g 1:1.3.dfsg+really1.3.1-1+b1 dovecot-core recommends no packages. Versions of packages dovecot-core suggests: pn dovecot-flatcurve <none> pn dovecot-gssapi <none> ii dovecot-imapd 1:2.4.1+dfsg1-6 pn dovecot-ldap <none> pn dovecot-lmtpd <none> ii dovecot-managesieved 1:2.4.1+dfsg1-6 pn dovecot-mysql <none> pn dovecot-pgsql <none> pn dovecot-pop3d <none> ii dovecot-solr 1:2.4.1+dfsg1-6 pn dovecot-sqlite <none> pn dovecot-submissiond <none> pn ntp <none> Versions of packages dovecot-core is related to: ii dovecot-core [dovecot-common] 1:2.4.1+dfsg1-6 pn dovecot-dev <none> pn dovecot-gssapi <none> ii dovecot-imapd 1:2.4.1+dfsg1-6 pn dovecot-ldap <none> pn dovecot-lmtpd <none> ii dovecot-managesieved 1:2.4.1+dfsg1-6 pn dovecot-mysql <none> pn dovecot-pgsql <none> pn dovecot-pop3d <none> ii dovecot-sieve 1:2.4.1+dfsg1-6 pn dovecot-sqlite <none> -- Configuration Files: /etc/default/dovecot changed: ENABLED=1 ALLOW_COREDUMPS=1 -- debconf information: dovecot-core/ssl-cert-name: localhost dovecot-core/create-ssl-cert: false * dovecot-core/ssl-cert-exists:

2 5

Debian 13 with Dovecot-2.3 from dovecot repos
by Stefan G. Weichinger 29 Aug '25

29 Aug '25

I have 2 servers with Debian, set up with postfixadmin back then. So far they ran on Debian-12.x (12.11) with this as external repo.list: https://repo.dovecot.org/ce-2.3-latest/debian/bullseye/ This gives me: dovecot-core 2.3.21.1-2+debian11 Fine. Now I upgraded one of these servers to debian-13 and did NOT remove or edit the repo.list. Now I have Debian-13.0.0 with still dovecot-core 2.3.21.1-2+debian11: apt-cache policy dovecot-core dovecot-core: Installed: 2:2.3.21.1-2+debian11 Candidate: 2:2.3.21.1-2+debian11 Version table: *** 2:2.3.21.1-2+debian11 500 500 https://repo.dovecot.org/ce-2.3-latest/debian/bullseye bullseye/main amd64 Packages 100 /var/lib/dpkg/status 1:2.4.1+dfsg1-6 500 500 http://ftp.at.debian.org/debian trixie/main amd64 Packages 500 http://deb.debian.org/debian trixie/main amd64 Packages I don't mind, it's OK for me, I still have to work through the config changes needed to upgrade to dovecot-2.4 Is this combination OK, is it problematic? (for me things work so far, I can mail quite fine) I consider doing it on a customer server this evening, and hope for a quick "it's fine!" from this ml ;-) thanks all, Stefan

5 10

Supporting both "username" to username@domain.com
by Alex 26 Aug '25

26 Aug '25

Hi, I'm using dovecot-2.3.21 on fedora40 and have configured it to use only usernames without domain when logging in. Now apparently the new Outlook (1.2025.617.000) no longer supports the ability to change username for IMAP. Now what? We have other users who are using older versions of Outlook and Thunderbird and webmail that still support this login method. How can I support both? Here is my dovecot info. # 2.3.21.1 (d492236fa0): /etc/dovecot/dovecot.conf # OS: Linux 6.12.6-100.fc40.x86_64 x86_64 Fedora release 40 (Forty) btrfs auth_mechanisms = plain login default_client_limit = 3000 default_process_limit = 4000 default_vsz_limit = 1 G dict { sql = mysql:/etc/dovecot/dovecot-dict-sql.conf.ext } disable_plaintext_auth = no lda_mailbox_autocreate = yes lda_mailbox_autosubscribe = yes listen = 209.216.XXX.60, 127.0.0.1 mail_gid = users mail_location = maildir:/home/%u/Maildir mail_max_userip_connections = 100 mail_plugins = " listescape last_login" mail_privileged_group = mail namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } passdb { driver = pam } plugin { last_login_dict = proxy::sql last_login_key = # hidden, use -P to show it last_login_precision = ms sieve = ~/.dovecot.sieve sieve_dir = ~/sieve } protocols = pop3 imap lmtp service anvil { client_limit = 12003 } service auth-worker { client_limit = 20000 } service auth { client_limit = 20000 unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0660 user = postfix } } service imap-login { inet_listener imaps { port = 993 ssl = yes } process_min_avail = 20 service_count = 0 vsz_limit = 1 G } service lmtp { executable = lmtp -L inet_listener lmtp { address = 127.0.0.1 port = 24 } process_min_avail = 5 unix_listener /var/spool/postfix/private/dovecot-lmtp { group = postfix mode = 0600 user = postfix } } ssl_ca = </var/www/example.com-443/ssl/DigiCertCA-2022.crt ssl_cert = </var/www/example.com-443/ssl/example-combined-2025.crt ssl_key = # hidden, use -P to show it userdb { driver = passwd } protocol lda { info_log_path = /var/log/dovecot-lda.log log_path = /var/log/dovecot-lda-errors.log } protocol imap { mail_max_userip_connections = 100 } protocol pop3 { pop3_uidl_format = %08Xu%08Xv } local_name example.com { ssl_cert = </var/www/example.com-443/ssl/example-combined-2025.crt ssl_key = # hidden, use -P to show it } local_name users.example1.com { ssl_cert = </etc/letsencrypt/example1-fullchain.pem ssl_key = # hidden, use -P to show it } We're also using postfix to support this basic sasl username when sending. smtpd_sasl_type = dovecot smtpd_sasl_path = private/auth smtpd_sasl_auth_enable = yes smtpd_sasl_local_domain = $myhostname broken_sasl_auth_clients = yes smtpd_sasl_authenticated_header = yes smtpd_sasl_security_options = noanonymous, noplaintext smtpd_sasl_tls_security_options = noanonymous Hi, I'm using dovecot-2.3.21 on fedora40 and have configured it to use only usernames without domain when logging in. Now apparently the new Outlook (1.2025.617.000) no longer supports the ability to change username for IMAP. Now what? We have other users who are using older versions of Outlook and Thunderbird and webmail that still support this login method. How can I support both? Here is my dovecot info. # 2.3.21.1 (d492236fa0): /etc/dovecot/dovecot.conf # OS: Linux 6.12.6-100.fc40.x86_64 x86_64 Fedora release 40 (Forty) btrfs auth_mechanisms = plain login default_client_limit = 3000 default_process_limit = 4000 default_vsz_limit = 1 G dict { sql = mysql:/etc/dovecot/dovecot-dict-sql.conf.ext } disable_plaintext_auth = no lda_mailbox_autocreate = yes lda_mailbox_autosubscribe = yes listen = 209.216.XXX.60, 127.0.0.1 mail_gid = users mail_location = maildir:/home/%u/Maildir mail_max_userip_connections = 100 mail_plugins = " listescape last_login" mail_privileged_group = mail namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } passdb { driver = pam } plugin { last_login_dict = proxy::sql last_login_key = # hidden, use -P to show it last_login_precision = ms sieve = ~/.dovecot.sieve sieve_dir = ~/sieve } protocols = pop3 imap lmtp service anvil { client_limit = 12003 } service auth-worker { client_limit = 20000 } service auth { client_limit = 20000 unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0660 user = postfix } } service imap-login { inet_listener imaps { port = 993 ssl = yes } process_min_avail = 20 service_count = 0 vsz_limit = 1 G } service lmtp { executable = lmtp -L inet_listener lmtp { address = 127.0.0.1 port = 24 } process_min_avail = 5 unix_listener /var/spool/postfix/private/dovecot-lmtp { group = postfix mode = 0600 user = postfix } } ssl_ca = </var/www/example.com-443/ssl/DigiCertCA-2022.crt ssl_cert = </var/www/example.com-443/ssl/example-combined-2025.crt ssl_key = # hidden, use -P to show it userdb { driver = passwd } protocol lda { info_log_path = /var/log/dovecot-lda.log log_path = /var/log/dovecot-lda-errors.log } protocol imap { mail_max_userip_connections = 100 } protocol pop3 { pop3_uidl_format = %08Xu%08Xv } local_name [1]example.com { ssl_cert = </var/www/example.com-443/ssl/example-combined-2025.crt ssl_key = # hidden, use -P to show it } local_name [2]users.example1.com { ssl_cert = </etc/letsencrypt/example1-fullchain.pem ssl_key = # hidden, use -P to show it } We're also using postfix to support this basic sasl username when sending. smtpd_sasl_type = dovecot smtpd_sasl_path = private/auth smtpd_sasl_auth_enable = yes smtpd_sasl_local_domain = $myhostname broken_sasl_auth_clients = yes smtpd_sasl_authenticated_header = yes smtpd_sasl_security_options = noanonymous, noplaintext smtpd_sasl_tls_security_options = noanonymous References Visible links 1. http://example.com/ 2. http://users.example1.com/

9 14

INBOX is not part of "*" in dovecot-virtual
by Ákos Szőts 26 Aug '25

26 Aug '25

Hi everyone, I noticed that if I specify the following pattern in dovecot-virtual for my Virtual/Unseen mailbox, mails in INBOX are excluded: * -Drafts -Trash -Junk -Sent -Virtual/* UNSEEN It returns with 23 mails: a EXAMINE Virtual/Unseen * 23 EXISTS * 23 RECENT * OK [UNSEEN 1] First unseen. But when I add INBOX additionally after "*", the number grows to 42: a EXAMINE Virtual/Unseen * 42 EXISTS * 42 RECENT * OK [UNSEEN 1] First unseen. Is it expected that "*" doesn't include INBOX by default? As I see, the rest of the mailboxes within the same root (/) namespace are included by default. Config: namespace inbox { separator = / inbox = yes mail_path = %{home}/mail mail_index_path = %{home}/index/inbox mailbox INBOX { auto = subscribe } mailbox Trash { special_use = \Trash auto = subscribe } [...] } Dovecot version: 2.4.1. Thank you, Ákos

2 1

What's the difference between "UNKEYWORD \Seen" and "UNSEEN"?
by Ákos Szőts 25 Aug '25

25 Aug '25

Hi everyone, These two IMAP search commands return different values: a SEARCH UNSEEN * SEARCH 38 61 62 63 65 69 74 75 76 82 86 87 102 120 121 141 142 143 144 145 146 158 159 160 a SEARCH UNKEYWORD \Seen * SEARCH [All email IDs in the mailbox] a SEARCH KEYWORD \Seen * SEARCH [Empty] According to RFC 3501 <https://datatracker.ietf.org/doc/html/rfc3501#section-6.4.4>, in my interpretation, these two should be equal: > UNSEEN > Messages that do not have the \Seen flag set. Can you tell me what is causing this difference? I also ran force-resync on all my mails, just to be sure. Ákos Hi everyone, These two IMAP search commands return different values: a SEARCH UNSEEN * SEARCH 38 61 62 63 65 69 74 75 76 82 86 87 102 120 121 141 142 143 144 145 146 158 159 160 a SEARCH UNKEYWORD \Seen * SEARCH [All email IDs in the mailbox] a SEARCH KEYWORD \Seen * SEARCH [Empty] According to [1]RFC 3501, in my interpretation, these two should be equal: > UNSEEN > Messages that do not have the \Seen flag set. Can you tell me what is causing this difference? I also ran force-resync on all my mails, just to be sure. Akos References Visible links 1. https://datatracker.ietf.org/doc/html/rfc3501#section-6.4.4

2 2

Dovecot 2.4.1-4: Server SSL cert loaded in ssl_server_settings_check but lost in openssl_iostream_use_certificate_error
by Louis Villedieu 25 Aug '25

25 Aug '25

Dear dovecot mailing list, Maybe you'll have an idea. I upgraded from Debian bookworm to trixie this morning. Along with this upgrade, dovecot went to 2.4.1 . I adapted the configuration files. The server starts but the clients cannot retrieve emails. The error message in the logs is: dovecot: pop3-login: Error: Failed to initialize SSL connection: Couldn't initialize SSL server context: Can't load SSL certificate (ssl_server_cert_file setting): The certificate is empty In iostream-openssl-context.c:ssl_iostream_context_set(), I adapted this error message to see whether a path could be found for this server cert file: t_strdup_printf( "Can't load SSL certificate (%s setting with path '%s'): %s", ctx->client_ctx ? "ssl_client_cert_file" : "ssl_server_cert_file", set->cert.cert.path, openssl_iostream_use_certificate_error(set->cert.cert.content) The outcome was that the path is empty as well:dovecot: pop3-login: Error: Failed to initialize SSL connection: Couldn't initialize SSL server context: Can't load SSL certificate (ssl_server_cert_file setting with path ''): The certificate is empty Then, I adapted ssl-settings.c:ssl_server_settings_check() to show the content of the server certificate file at that stage (with stdio):FILE *file_ptr;file_ptr=fopen("/tmp/output.txt","a");if(file_ptr!=NULL){fprintf(file_ptr,"server check %s\n",set->ssl_server_cert_file);fclose(file_ptr);} The outcome was that the file is not empty at this stage: server check /etc/letsencrypt/live/<MY_SERVER>/fullchain.pem -----BEGIN CERTIFICATE----- <MY_CERT> -----END CERTIFICATE----- -----BEGIN CERTIFICATE----- <MY_CERT> -----END CERTIFICATE----- Is there any potential reason for this disappearance between the calls? Thanks! Louis. Dear dovecot mailing list, Maybe you'll have an idea. I upgraded from Debian bookworm to trixie this morning. Along with this upgrade, dovecot went to 2.4.1 . I adapted the configuration files. The server starts but the clients cannot retrieve emails. The error message in the logs is: dovecot: pop3-login: Error: Failed to initialize SSL connection: Couldn't initialize SSL server context: Can't load SSL certificate (ssl_server_cert_file setting): The certificate is empty In iostream-openssl-context.c:ssl_iostream_context_set(), I adapted this error message to see whether a path could be found for this server cert file: t_strdup_printf( "Can't load SSL certificate (%s setting with path '%s'): %s", ctx->client_ctx ? "ssl_client_cert_file" : "ssl_server_cert_file", set->cert.cert.path, openssl_iostream_use_certificate_error(set->cert.cert.content) The outcome was that the path is empty as well: dovecot: pop3-login: Error: Failed to initialize SSL connection: Couldn't initialize SSL server context: Can't load SSL certificate (ssl_server_cert_file setting with path ''): The certificate is empty Then, I adapted ssl-settings.c:ssl_server_settings_check() to show the content of the server certificate file at that stage (with stdio): FILE *file_ptr;file_ptr=fopen("/tmp/output.txt","a");if(file_ptr!=NULL){fprintf(file_ptr,"server check %s\n",set->ssl_server_cert_file);fclose(file_ptr);} The outcome was that the file is not empty at this stage: server check /etc/letsencrypt/live/<MY_SERVER>/fullchain.pem -----BEGIN CERTIFICATE----- <MY_CERT> -----END CERTIFICATE----- -----BEGIN CERTIFICATE----- <MY_CERT> -----END CERTIFICATE----- Is there any potential reason for this disappearance between the calls? Thanks! Louis.

3 2

Re: Dovecot 2.4.1-4: Server SSL cert loaded in ssl_server_settings_check but lost in openssl_iostream_use_certificate_error
by Rory Campbell-Lange 24 Aug '25

24 Aug '25

On 24/08/25, louis.villedieu(a)yahoo.com (louis.villedieu(a)yahoo.com) wrote: > I tried yesterday all the options you proposed in terms of configuration. > > I don't think the configuration has an issue since the settings are loaded > successfully but not kept. > > I presume this can be due to an incompatibility of 2.4.1 with my system. That seems a bit odd. Are you sure you have cut out the "<" symbols relating to ssl certificate/key paths, and that the certificates are the full-chain certs? Anyhow, with reference to https://github.com/rorycl/dovecot-config, you can easily debug your issue with Dovecot 2.4.1's official docker image. Simply edit the provided dovecot.conf to include your ssl settings and the debugging log to stderr should quickly show you where your issue is in a safe environment. Be aware that if you run docker from the local directory with your dovecot.conf etc to load into docker you need to use the --volume/v or --mount options to put that directory at /etc/dovecot in the container: docker run -p 1143:143 -p 1993:993 \ -v ./:/etc/dovecot \ dovecot/dovecot:latest If you have specified ssl files at, for example, /etc/dovecot/ssl, you need to put your ssl certificates and keys in an ssl directory of the current directory, or make another -v / --mount mount.

1 0

Virtual inbox in imap with dovecot 2.4
by aholiveira＠gmail.com 24 Aug '25

24 Aug '25

Hello, I've recently upgraded to debian 13 (trixie), from debian 12 (bookworm). In bookworm I had the following setup working like perfection: - All mail is sorted to some mailbox folder through sieve (either a "specialized" one, or a generic folder under the inbox name like year.month - 2025.08). - No email whatsoever was ever reaching the inbox. - Then I had a virtual inbox which would get me all the "unread" or "flagged" messages This way I had all my email sorted out from the delivery and my inbox cleared itself once I had read an email. For this I was using the stock debian dovecot packages, and now, after the upgrade to debian 13 I'm also using the stock debian packages. However, this whole neat setup broke and I can't get it to work again. I've searched dovecot's manual, asked two different AIs, did a number of web searches and adapted the new configuration files to the new syntax but dovecot refuses to list the emails in my INBOX folder. I've spent already several hours around this, to no avail. Unfortunately I didn't keep a copy of the config files from debian 12 so now I can't really compare but I did manually change the dovecot config files after the upgrade so that what I had running in debian 12 should work as before (it was refusing to start after the upgrade). Here is the output of dovecot -n # 2.4.1-4 (7d8c0e5759): /etc/dovecot/dovecot.conf # Pigeonhole version 2.4.1-4 (0a86619f) # OS: Linux 6.12.41+deb13-amd64 x86_64 Debian 13.0 # Hostname: myhost # 4 default setting changes since version 2.4.0 dovecot_config_version = 2.4.0 auth_mechanisms = plain login dovecot_storage_version = 2.4.0 fts_autoindex = yes fts_autoindex_max_recent_msgs = 999 fts_search_add_missing = yes lda_mailbox_autocreate = yes lda_mailbox_autosubscribe = yes mail_driver = maildir mail_inbox_path = ~/Maildir mail_path = ~/Maildir mail_plugins { notify = yes mail_log = yes virtual = yes } mail_privileged_group = mail namespace_subscriptions = no protocols { imap = yes sieve = yes } passdb pam { } userdb passwd { } namespace inbox { inbox = yes prefix = separator = . subscriptions = yes mailbox Drafts { special_use = "\\Drafts" } mailbox Junk { special_use = "\\Junk" } mailbox Trash { special_use = "\\Trash" } mailbox Sent { special_use = "\\Sent" } mailbox "Sent Messages" { special_use = "\\Sent" } } service imap-login { inet_listener imap { } inet_listener imaps { } } service pop3-login { inet_listener pop3 { } inet_listener pop3s { } } service submission-login { inet_listener submission { port = 587 } inet_listener submissions { } } service lmtp { unix_listener lmtp { } } service imap { executable = imap imap-postlogin } service pop3 { } service submission { } service auth { unix_listener auth-userdb { } unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0660 user = postfix } } service auth-worker { } service dict { unix_listener dict { } } ssl_server { cert_file = /etc/dovecot/private/dovecot.pem dh_file = /usr/share/dovecot/dh.pem key_file = /etc/dovecot/private/dovecot.key } protocol lda { mail_plugins { sieve = yes } } protocol imap { mail_max_userip_connections = 40 } service managesieve-login { inet_listener sieve { port = 4190 } } namespace 00-virtual { mail_driver = virtual mail_path = ~/Maildir/virtual hidden = no inbox = no list = yes prefix = 00-virtual. separator = . } namespace virtual { mail_driver = virtual mail_path = ~/Maildir/virtual hidden = no inbox = no list = yes prefix = virtual. separator = . } namespace real { hidden = yes inbox = no list = no prefix = real. separator = . subscriptions = no } service imap-postlogin { executable = script-login /usr/local/bin/dovecot-postlogin.sh unix_listener imap-postlogin { } } passdb deny { deny = yes driver = passwd-file passwd_file_path = /etc/dovecot/deny-users } This is /usr/local/bin/dovecot-postlogin.sh #!/bin/sh VIRTUAL=$HOME/Maildir/virtual # AUTOMATICALLY VIRTUALIZE INBOX # # If the user creates a virtual/INBOX/dovecot-virtual, # switch the inbox to the virtual namespace. if [ -d "${VIRTUAL}/INBOX" ]; then export USERDB_KEYS="$USERDB_KEYS NAMESPACE/VIRTUAL/INBOX NAMESPACE/INBOX/INBOX" logger -p mail.debug "$USERDB_KEYS $VIRTUAL $@" /usr/bin/env USERDB_KEYS="$USERDB_KEYS" NAMESPACE/VIRTUAL/INBOX=yes NAMESPACE/INBOX/INBOX=no "$@" else exec "$@" fi This is the content of $HOME/Maildir/virtual/INBOX/dovecot-virtual real.* OR UNSEEN FLAGGED I'm also getting this message anytime that I login with a mail client: 2025-08-22T21:52:29.466584+01:00 ****** dovecot: imap(***)<316863><svBRYvo8+pXAqFoB>: Error: Mailbox INBOX: Failed to autocreate mailbox: Can't create virtual mailboxes Note that the 00-virtual namespace was added just as a temporary check and I want to delete it once this is working again. I have also a file under $HOME/Maildir/virtual/Flagged/dovecot-virtual with the exact same contents as the INBOX one above which get's me a virtual folder that works correctly (getting all my unread and flagged email in a single folder), so the filter works. Just changing the INBOX from the real to the virtual one fails and I can't understand what am I doing wrong or what am I missing. Can someone please help me? I'm completely lost and frustrated on this. Thank you very much.

4 5

2.4 config nightmares
by Dharma Mati 24 Aug '25

24 Aug '25

I have been trying for weeks to make it work.But I simply cant. Would you plz kindly tell me how it should be? : doveconf -n # 2.3.21.1 (d492236fa0): /etc/dovecot/dovecot.conf # OS: Linux 6.1.67-gentoo x86_64 Gentoo Base System release 2.17 ext4 # Hostname: .................. auth_mechanisms = cram-md5 plain login disable_plaintext_auth = no listen = * mail_location = maildir:/home/vmail/%d/%n/Maildir namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } passdb { args = * driver = pam } passdb { args = scheme=CRAM-MD5 username_format=%u /etc/dovecot/users driver = passwd-file } service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0666 user = postfix } } ssl_cert = </etc/ssl/private/server.crt ssl_key = # hidden, use -P to show it userdb { driver = passwd } userdb { args = scheme=CRAM-MD5 username_format=%u /etc/dovecot/users driver = passwd-file } userdb { args = uid=vmail gid=vmail home=/home/vmail/%d/%n driver = static } local_name asl.dynu.net { ssl_cert = </etc/letsencrypt/live/asl.dynu.net/fullchain.pem ssl_key = # hidden, use -P to show it } local_name { ssl_cert = </etc/letsencrypt/live//fullchain.pem ssl_key = # hidden, use -P to show it } etc. Plz help me.And kindly consider creating a migration tool.Thanks a lot Andreas I have been trying for weeks to make it work.But I simply cant. Would you plz kindly tell me how it should be? : doveconf -n # 2.3.21.1 (d492236fa0): /etc/dovecot/dovecot.conf # OS: Linux 6.1.67-gentoo x86_64 Gentoo Base System release 2.17 ext4 # Hostname: .................. auth_mechanisms = cram-md5 plain login disable_plaintext_auth = no listen = * mail_location = maildir:/home/vmail/%d/%n/Maildir namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } passdb { args = * driver = pam } passdb { args = scheme=CRAM-MD5 username_format=%u /etc/dovecot/users driver = passwd-file } service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0666 user = postfix } } ssl_cert = </etc/ssl/private/server.crt ssl_key = # hidden, use -P to show it userdb { driver = passwd } userdb { args = scheme=CRAM-MD5 username_format=%u /etc/dovecot/users driver = passwd-file } userdb { args = uid=vmail gid=vmail home=/home/vmail/%d/%n driver = static } local_name [1]asl.dynu.net { ssl_cert = </etc/letsencrypt/live/[2]asl.dynu.net/fullchain.pem ssl_key = # hidden, use -P to show it } local_name { ssl_cert = </etc/letsencrypt/live//fullchain.pem ssl_key = # hidden, use -P to show it } etc. Plz help me.And kindly consider creating a migration tool.Thanks a lot Andreas References Visible links 1. http://asl.dynu.net/ 2. http://asl.dynu.net/fullchain.pem

8 9

How to offer different translations for virtual namespaces with userdb?
by Ákos Szőts 23 Aug '25

23 Aug '25

Hi everyone, I'd like to configure a feature that, based on userdb locale settings, returns with differently translated string for the same virtual namespace mailbox name. This is where I ended up so far: group @namespaces virtual-virtual-english { mailbox All { auto = no special_use = \All } } group @namespaces virtual-virtual-hungarian { mailbox "Összes levél" { auto = no special_use = \All } } namespace virtual-virtual { prefix = Virtual/ separator = / mail_driver = virtual mail_path = /var/lib/dovecot/virtual/virtual mail_index_path = %{home}/index/virtual/virtual namespace_subscriptions = no list = children hidden = no } UserDB query works: Debug: Added setting via userdb: namespace/virtual-virtual/@namespaces=virtual-virtual-hungarian I had to create symlinks in the virtual/virtual directory (otherwise the Hungarian version wouldn't work): # virtual/virtual All &ANY-sszes lev&AOk-l -> All/ When I list the mailboxes, however, I get back all of them, not just the matching-language elements: * LIST (\Noselect \HasChildren) "/" Virtual * LIST (\HasNoChildren) "/" "Virtual/&ANY-sszes lev&AOk-l" * LIST (\HasNoChildren \All) "/" Virtual/All "list", "hidden", and "prefix" are seemingly not allowed within a group. How can I offer different translations for different users in my home setup? Is it possible to translate the namespace prefix? Dovecot version: 2.4.1. Thank you, Ákos

2 2

Missing IMAP METADATA Plugin
by Adam Miller 23 Aug '25

23 Aug '25

OS: Ubuntu 22.04.1 Dovecot: 2.3.16 (7e2e900c1a) When trying to enable the “imap_metadata” plugin, I get the following error: Plugin 'imap_metadata' not found from directory /usr/lib/dovecot/modules I have searched high and low via Google, StackOverflow and even ChatGPT (haha) but I cannot seem to find the package that provides the plugin. Does Dovecot have to be built from source for this plugin to be included? Any help is appreciated. Thank you!

8 8

getpwnam() failed: Resource temporarily unavailable
by Hauke Fath 22 Aug '25

22 Aug '25

Hi, I see a very peculiar Dovecot (2.3.21.1) authentication failure that concerns exactly one user: Aug 20 02:08:05 Bounce dovecot: auth-worker(13245): Debug: conn unix:auth-worker (pid=3029,uid=81): auth-worker<24>: Handling PASSV request Aug 20 02:08:05 Bounce dovecot: auth-worker(13245): Debug: conn unix:auth-worker (pid=3029,uid=81): auth-worker<24>: passwd(REDACTED_UID,84.136.89.217,<yZxQxMA8uL1UiFnZ>): Performing passdb lookup Aug 20 02:08:05 Bounce dovecot: auth-worker(13245): Debug: conn unix:auth-worker (pid=3029,uid=81): auth-worker<24>: passwd(REDACTED_UID,84.136.89.217,<yZxQxMA8uL1UiFnZ>): lookup Aug 20 02:08:05 Bounce dovecot: auth-worker(13245): Error: conn unix:auth-worker (pid=3029,uid=81): auth-worker<24>: passwd(REDACTED_UID,84.136.89.217,<yZxQxMA8uL1UiFnZ>): getpwnam() failed: Resource temporarily unavailable Aug 20 02:08:05 Bounce dovecot: auth-worker(13245): Debug: conn unix:auth-worker (pid=3029,uid=81): auth-worker<24>: passwd(REDACTED_UID,84.136.89.217,<yZxQxMA8uL1UiFnZ>): Finished passdb lookup Aug 20 02:08:05 Bounce dovecot: auth-worker(13245): Debug: conn unix:auth-worker (pid=3029,uid=81): auth-worker<24>: Finished: internal_failure This used to work, until a few months ago it stopped. The user can still authenticate to send mail through the same server. Changing the password didn't make a difference. Any ideas? Cheerio, Hauke -- The ASCII Ribbon Campaign Hauke Fath () No HTML/RTF in email Institut für Nachrichtentechnik /\ No Word docs in email TU Darmstadt Respect for open standards Ruf +49-6151-16-21344

3 3

How to remove non-existent virtual mailbox from index
by Ákos Szőts 21 Aug '25

21 Aug '25

Hi everyone, During experimentation I created a "Test1" mailbox under a virtual namespace: mailbox "Test1" { auto = no special_use = \All } I commented it out before restarting Dovecot, and it's never been subscribed to either. I see the Test1 directory is still within my "index" directory and there's a "dovecot.index.log" in it. When I try to force resync all my virtual mailboxes, doveadm complains about it: $ doveadm -D force-resync -A Virtual/* Debug: Namespace virtual-virtual: [...]/virtual/Test1 doesn't exist yet, using default permissions Debug: Namespace virtual-virtual: Using permissions from [...]/virtual: mode=0755 gid=default Error: Mailbox Virtual/Test1: mkdir_parents([...]/virtual/Virtual/Test1) failed: Permission denied Error: Mailbox Virtual/Test1: Failed to create path: [...]/virtual/Virtual/Test1 for mailbox Virtual/Test1: mkdir_parents([...]/virtual/Virtual/Test1) failed: Permission denied What is the proper command to remove it from the index? I tried "cache purge", but that fails, too. I can "rm -rf" the whole index directory and that solves this issue. However, I think there should be a more gentle solution. Thank you, Ákos

1 0

"imap-login" crashes at lib-ssl-iostream/iostream-ssl.c:55
by Ákos Szőts 21 Aug '25

21 Aug '25

Hi all, When I start "imap-login" without arguments, it crashes: gdb -ex run --args /usr/lib/dovecot/imap-login (gdb) thread apply all bt full Thread 1 (Thread 0x7f5bd50c6740 (LWP 625) "imap-login"): #0 0x00007f5bd545fe97in io_stream_ssl_global_init(set=0x56205ca355c8, error_r=0x7ffdf0e669a8) at ../lib-ssl-iostream/iostream-ssl.c:55 No locals. #1 0x00007f5bd558d15bin login_ssl_init() at /usr/src/debug/dovecot-2.4.1-4/src/login-common/main.c:343 ssl_set= 0x56205ca355c8 error= 0xc00000<error: Cannot access memory at address 0xc00000> #2 main_preinit() at /usr/src/debug/dovecot-2.4.1-4/src/login-common/main.c:355 max_fds= <optimized out> __func__= <optimized out> #3 login_binary_run(binary=<optimized out>, argc=<optimized out>, argv=<optimized out>) at /usr/src/debug/dovecot-2.4.1-4/src/login-common/main.c:528 service_flags= <optimized out> login_socket= 0x7f5bd5590b66"login" error= 0x1000000<error: Cannot access memory at address 0x1000000> c= <optimized out> input= {config_path= 0x0, config_fd= 0, preserve_environment= false, preserve_user= false, preserve_home= false, no_service_filter= false, check_full_config= false, hide_obsol ete_warnings= false, no_protocol_filter= false, no_key_validation= false, reload_config= false, never_exec= false, always_exec= false, return_config_fd= false, use_sysexits= false, pr otocol= 0x562033d837ac"imap"} output= {specific_protocols= 0x56205ca15398, config_fd= -1, permission_denied= false} #4 0x00007f5bd51662aein __libc_start_call_main() from /lib64/libc.so.6 No symbol table info available. #5 0x00007f5bd5166379in __libc_start_main_impl() from /lib64/libc.so.6 No symbol table info available. #6 0x0000562033d79885in _start() at ../sysdeps/x86_64/start.S:115 No locals. Probably "ssl_vfuncs->[...]" is a NULL dereference? I'm debugging a crash within Dovecot and this was one of my findings. Dovecot version: 2.4.1. Ákos

1 1

dovecot RHEL 10 packages
by burnzerog＠gmail.com 19 Aug '25

19 Aug '25

Hi, I see only RHEL 8 and 9 packages but not for RHEL 10 in repo.dovecot.org. Do you think it can be released soon? Thank you.

3 2

quota_clone + dict_file_path wound up being somewhat cumbersome on 2.4
by Andy Baugh 19 Aug '25

19 Aug '25

The quota_clone syntax is rather cumbersome in comparison to 2.3 when using a flat file dictionary. I found I needed to make a "bogus" config block first: quota_clone { dict file { path = ${userdb:mail_path}/dovecot-quota } } Bogus, as the code path which actually deals with that doesn't have the ${userdb:*} vars available (visible by stracing the dovecot process, and seeing it fail to make /dovecotquota for obvious reasons). That said, if you don't include *some* value, it will explode even when you provide the *correct* value via userdb unless you initialize quota clone earlier there in the config. In this case for the 'luser' user: quota_clone/dict/file/path: /home/luser/mail/dovecot-quota wound up being the param I needed in order to get that logged in the right place for that specific user. None of how to format this properly was remotely clear to me from the documentation when looking at the quota_clone page: https://doc.dovecot.org/main/core/config/dict.html#flat-files As such I made an educated guess after reading the quota_clone code and testing a few things out. This actually works, so I'm happy with it for now. Not sure what this means RE the documentation, as even though it's not exactly obvious, I clearly was able to piece it together for the most part just by reading other documentation pages which mentioned things like separating namespaces by slashes, etc. I don't know how to properly convey "hey here's the list of where all these vars are actually able to be set and not set," as there's clearly some context there that's missing unless you go digging in the code. Cheers, -- Thomas "Andy" Baugh | Software Development Engineer IV 713-384-8831 andy.baugh(a)webpros.com www.webpros.com

1 0

On Dovecot 2.4, auth-legacy setting for the auth service appears to be no-op when using lua passdb
by Andy Baugh 19 Aug '25

19 Aug '25

So, I used https://doc.dovecot.org/main/installation/upgrade/2.3-to-2.4.html#exim-auth… to ensure exim still worked. Unfortunately, that doesn't seem to be the case. Sender verification, auth, etc. *will* fail until you specifically start sending back those old params as well as the updated ones. I am using lua for the passdb/userdb however, so presumably it's just not documented that this is an "exercise for the reader" when using lua. In particular you need to deliver the 'mail' and 'quota' fields as they previously existed (colon separated) alongside the new dovecot params. Hope this helps someone else out there. Cheers, -- Thomas "Andy" Baugh | Software Development Engineer IV andy.baugh(a)webpros.com www.webpros.com

2 2

'duplicate listener' on port 465
by William David Edwards 17 Aug '25

17 Aug '25

Hi, When configuring SMTPS as described on https://doc.dovecot.org/main/core/config/submission.html#smtps, Dovecot says there is a 'duplicate listener'. MRE: ``` root@dovecot24-test:/etc/dovecot/conf.d# doveconf -n # 2.4.1-4+debian12 (7d8c0e5759): /etc/dovecot/dovecot.conf # Pigeonhole version 2.4.1-4+debian12 (0a86619f) # OS: Linux 6.1.0-29-amd64 x86_64 Debian 12.11 # Hostname: dovecot24-test.cyberfusion.nl # 4 default setting changes since version 2.4.0 dovecot_config_version = 2.4.0 dovecot_storage_version = 2.4.0 protocols = submission service submission-login { inet_listener submission_465 { port = 465 } } doveconf: Error: duplicate listener: 465:* doveconf: Fatal: Error in configuration file /etc/dovecot/dovecot.conf: duplicate listener: 465:* ``` Can anyone help me understand why this listener would be 'duplicate'? This setup worked on 2.3.21.1. Thanks! William David Edwards

2 1

github: minimal dovecot 2.4 setup for testing in docker
by Rory Campbell-Lange 15 Aug '25

15 Aug '25

Hi Everyone I've made a simple dovecot.conf and accompanying users.db file suitable for running in Docker. At the moment this simply shows how to force the default domain using the "auth_default_domain" setting. I'm hoping this will be a helpful jumping off point if you need to upgrade your Dovecot config ... and want to test outside of production. Instructions and the minimal conf and db file are here: https://github.com/rorycl/dovecot-config Feel free to improve the setup by submitting a PR. If you'd like to add some other scenarios please also submit PRs. My suggested arrangement for that is in a directory named by feature, with a README.md, minimal conf file, support files (only if necessary) and log.txt showing the expected output. Cheers Rory

1 0

function 'dovecot_lua_notify_event_message_new' in my lua script when I use push_notification_lua_driver
by 3825634＠qq.com 14 Aug '25

14 Aug '25

I need to push a message notification to external system when they receive new emails from their mailbox，so I used the push_notification_lua plugin. My dovecot configuration file is as follows： plugin {     ....     push_notification_driver = dlog     push_notification_driver2 = lua:file=/etc/dovecot/custom-lua/push-notification.lua     push_lua_url = http://localhost:10421/internal/dovecot/email-notification/receive } protocol lda {     mail_plugins = $mail_plugins sieve last_login push_notification mail_lua push_notification_lua     .... } ============= I print the 'event' param's value log in function 'dovecot_lua_notify_event_message_new' in my lua script: function dovecot_lua_notify_event_message_new(ctx, event)   dovecot.i_info("lua-push: event=" .. cjson.encode(event)) end However, when I send a mail with multiple recivers, the notification event info seems to work abnormally. Sender: wangzx(a)hxtmailtest.avicnet.cn Receivers: zhaoqb(a)hxtmailtest.avicnet.cn , wangzx7110(a)hxtmailtest.avicnet.cn I found the two event object's field 'to_address' and 'to_display_name' value are same in /var/log/dovecot/lda.log. Please help me confirm if this is a bug? The log in /var/log/dovecot/lda.log like bellow: 2025-08-06T09:38:11.383536+08:00 hxtmailtest-server dovecot: lda(wangzx7110(a)hxtmailtest.avicnet.cn)<548522><EkAeFgOykmiqXggAfhwsfQ>: lua-push: event={"snippet":"test!!","date":1754444290,"keywords":{},"to_display_name":"Zhaoqb","uid":19,"subject":"test","from_display_name":"","to_address":"zhaoqb(a)hxtmailtest.avicnet.cn","tz":480,"mailbox":"INBOX","to":"Zhaoqb <zhaoqb(a)hxtmailtest.avicnet.cn>, Wangzx7110\n <wangzx7110(a)hxtmailtest.avicnet.cn>","from":"wangzx(a)hxtmailtest.avicnet.cn","message_id":"<6e3a1265476c8197372afb7a1ac5ebbb(a)hxtmailtest.avicnet.cn>","uid_validity":1752827738,"flags":{},"from_address":"wangzx(a)hxtmailtest.avicnet.cn","name":"MessageNew"} 2025-08-06T09:38:11.423272+08:00 hxtmailtest-server dovecot: lda(zhaoqb(a)hxtmailtest.avicnet.cn)<548524><znZfFwOykmisXggAfhwsfQ>: lua-push: event={"subject":"test","mailbox":"INBOX","flags":{},"snippet":"test!!","from":"wangzx(a)hxtmailtest.avicnet.cn","date":1754444290,"from_address":"wangzx(a)hxtmailtest.avicnet.cn","keywords":{},"uid_validity":1752634929,"to_display_name":"Zhaoqb","to":"Zhaoqb <zhaoqb(a)hxtmailtest.avicnet.cn>, Wangzx7110\n <wangzx7110(a)hxtmailtest.avicnet.cn>","name":"MessageNew","from_display_name":"","tz":480,"to_address":"zhaoqb(a)hxtmailtest.avicnet.cn","uid":39,"message_id":"<6e3a1265476c8197372afb7a1ac5ebbb(a)hxtmailtest.avicnet.cn>"} Thanks! 3825634(a)qq.com 3825634(a)qq.com I need to push a message notification to external system when they receive new emails from their mailbox**so I used the push_notification_lua plugin. My dovecot configuration file is as follows** plugin { .... push_notification_driver = dlog push_notification_driver2 = lua:file=/etc/dovecot/custom-lua/push-notification.lua push_lua_url = http://localhost:10421/internal/dovecot/email-notification/receive } protocol lda { mail_plugins = $mail_plugins sieve last_login push_notification mail_lua push_notification_lua .... } ============= I print the 'event' param's value log in function 'dovecot_lua_notify_event_message_new' in my lua script: function dovecot_lua_notify_event_message_new(ctx, event) dovecot.i_info("lua-push: event=" .. cjson.encode(event)) end However, when I send a mail with multiple recivers, the notification event info seems to work abnormally. Sender: wangzx(a)hxtmailtest.avicnet.cn Receivers: zhaoqb(a)hxtmailtest.avicnet.cn , wangzx7110(a)hxtmailtest.avicnet.cn I found the two event object's field 'to_address' and 'to_display_name' value are same in /var/log/dovecot/lda.log. Please help me confirm if this is a bug? The log in /var/log/dovecot/lda.log like bellow: 2025-08-06T09:38:11.383536+08:00 hxtmailtest-server dovecot: lda(wangzx7110(a)hxtmailtest.avicnet.cn)<548522><EkAeFgOykmiqXggAfhwsfQ>: lua-push: event={"snippet":"test!!","date":1754444290,"keywords":{},"to_display_name":"Zhaoqb","uid":19,"subject":"test","from_display_name":"","to_address":"zhaoqb(a)hxtmailtest.avicnet.cn","tz":480,"mailbox":"INBOX","to":"Zhaoqb <zhaoqb(a)hxtmailtest.avicnet.cn>, Wangzx7110\n <wangzx7110(a)hxtmailtest.avicnet.cn>","from":"wangzx(a)hxtmailtest.avicnet.cn","message_id":"<6e3a1265476c8197372afb7a1ac5ebbb(a)hxtmailtest.avicnet.cn>","uid_validity":1752827738,"flags":{},"from_address":"wangzx(a)hxtmailtest.avicnet.cn","name":"MessageNew"} 2025-08-06T09:38:11.423272+08:00 hxtmailtest-server dovecot: lda(zhaoqb(a)hxtmailtest.avicnet.cn)<548524><znZfFwOykmisXggAfhwsfQ>: lua-push: event={"subject":"test","mailbox":"INBOX","flags":{},"snippet":"test!!","from":"wangzx(a)hxtmailtest.avicnet.cn","date":1754444290,"from_address":"wangzx(a)hxtmailtest.avicnet.cn","keywords":{},"uid_validity":1752634929,"to_display_name":"Zhaoqb","to":"Zhaoqb <zhaoqb(a)hxtmailtest.avicnet.cn>, Wangzx7110\n <wangzx7110(a)hxtmailtest.avicnet.cn>","name":"MessageNew","from_display_name":"","tz":480,"to_address":"zhaoqb(a)hxtmailtest.avicnet.cn","uid":39,"message_id":"<6e3a1265476c8197372afb7a1ac5ebbb(a)hxtmailtest.avicnet.cn>"} Thanks! [1][IMG] [2]3825634(a)qq.com 3825634(a)qq.com References Visible links 1. https://wx.mail.qq.com/home/index?t=readmail_businesscard_midpage&nocheck=t… 2. https://wx.mail.qq.com/home/index?t=readmail_businesscard_midpage&nocheck=t…

2 4

Re: Fw: upgrade mail paths (Debian 1:2.4.1)
by Rory Campbell-Lange 12 Aug '25

12 Aug '25

On 12/08/25, Andy Baugh (andy.baugh(a)webpros.com) wrote: > Colon separated vars need to be exploded into different params, sadly. This gets more complicated when dealing with things that are not mail opts. > > In your case you'll want to break down what used to be positional args thusly: > > mail_driver:mail_path:mail_inbox_path:mail_index_path > > Of course the "INBOX="/"INDEX=" part is assumed by the named param now, so can be left off the value. > > For example, with what used to be dsync or with quotas, things become rather painful to convert: ... Thank you very much for the confirmation, Andy. Exploding the configuration as you suggest works fine, although I had to quickly change my SQL table to suit. Fortunately I don't use quotas or dsync. I'm very grateful for your research into the configuration changes (which sound extensive) -- thanks again for sharing your insights. Let's hope the Debian stable upgrade doesn't cause too much pain. Best wishes, Rory

1 0

upgrade mail paths (Debian 1:2.4.1)
by rory＠campbell-lange.net 12 Aug '25

12 Aug '25

Dear Dovecot Users I guess there may be a storm of questions from users of Dovecot on Debian who are upgrading to the latest Debian stable, which uses Dovecot 1:2.4.1 [1] with the concomitant configuration changes. The issue I have encountered a problem translating my previous configuration for "mail_location" to "mail_path". The mail_location string returned from my database was mbox:/home/<user>/Mail/:INBOX=/var/mail/<user>:INDEX=/home/<domain>/Mailindexes/<user> Reading the mail location docs [2] I'm unclear if the colon separated configuration still works or if the configuration items should be separated into separate fields, presumably: mail_path mail_inbox_path mail_index_path Thanks for any insight. Regards, Rory [1] https://packages.debian.org/trixie/dovecot-core [2] https://doc.dovecot.org/main/core/config/mail_location.html

1 0

dovecot-sieve failed large mail
by Benoît PELISSIER 12 Aug '25

12 Aug '25

Hi, I noticed errors in the incoming emails with large attachments (>10MB). Its only with sieve filters enables. I use dovecot-lda and exim. Logs error : Error: program exec:/usr/sbin/sendmail (1295385): Execution timed out (> 30000 msecs) Error: program exec:/usr/sbin/sendmail (1295385): Failed to send SIGTERM signal to program Error: sieve: msgid=<**@**>: redirect action: failed to redirect message to <**@**>: Failed to execute sendmail (temporary failure) Error: sieve: Execution of script **/.dovecot.sieve was aborted due to temporary failure (user logfile **/.dovecot.sieve.log may reveal additional details) * i replaced private data by ** Regards, Benoît dovecot --version 2.3.13 (89f716dc2)

4 7

[Patch] Allow sieve redirects to specified domains only
by Kadlecsik József 10 Aug '25

10 Aug '25

Hello, The use case is simple: we have to forbid sieve redirects to outside, but should be able to redirect inside. The patch below adds a new sieve configuration option sieve_allowed_redirects to list the domains to which redirects are permitted and otherwise are not allowed. Please consider it. diff --git a/pigeonhole/doc/example-config/conf.d/90-sieve.conf b/pigeonhole/doc/example-config/conf.d/90-sieve.conf index 238bcf4..3b4ac65 100644 --- a/pigeonhole/doc/example-config/conf.d/90-sieve.conf +++ b/pigeonhole/doc/example-config/conf.d/90-sieve.conf @@ -126,6 +126,10 @@ plugin { # script execution. If set to 0, no redirect actions are allowed. #sieve_max_redirects = 4 + # The comma/space separated list of email domains where redirection is allowed. + # If the list is empty, there is no restriction. + sieve_allowed_redirects = + # The maximum number of personal Sieve scripts a single user can have. If set # to 0, no limit on the number of scripts is enforced. # (Currently only relevant for ManageSieve) diff --git a/pigeonhole/src/lib-sieve/cmd-redirect.c b/pigeonhole/src/lib-sieve/cmd-redirect.c index 6a3b0a4..17e9031 100644 --- a/pigeonhole/src/lib-sieve/cmd-redirect.c +++ b/pigeonhole/src/lib-sieve/cmd-redirect.c @@ -107,6 +107,24 @@ const struct sieve_action_def act_redirect = { .commit = act_redirect_commit, }; +static bool +cmd_redirect_allowed(struct sieve_instance *svinst, + const struct smtp_address *to_address) +{ + const char **domain; + bool result = TRUE; + + if (!svinst->allowed_redirects) + return TRUE; + for (domain = svinst->allowed_redirects; *domain != NULL; ++domain) { + if (strcasecmp(*domain, to_address->domain) == 0) { + return TRUE; + } + result = FALSE; + } + return result; +} + /* * Validation */ @@ -127,6 +145,12 @@ cmd_redirect_validate(struct sieve_validator *validator, if (!sieve_validator_argument_activate(validator, cmd, arg, FALSE)) return FALSE; + if (svinst->max_redirects == 0) { + sieve_command_validate_error(validator, cmd, + "local policy prohibits the use of a redirect action"); + return FALSE; + } + /* We can only assess the validity of the outgoing address when it is * a string literal. For runtime-generated strings this needs to be * done at runtime. @@ -148,14 +172,17 @@ cmd_redirect_validate(struct sieve_validator *validator, } } T_END; + if (!result && + !cmd_redirect_allowed(svinst, + sieve_address_parse_str(raw_address, &error))) { + sieve_command_validate_error(validator, cmd, + "local policy prohibits the use of a redirect action"); + return FALSE; + } + return result; } - if (svinst->max_redirects == 0) { - sieve_command_validate_error(validator, cmd, - "local policy prohibits the use of a redirect action"); - return FALSE; - } return TRUE; } @@ -238,6 +265,11 @@ cmd_redirect_operation_execute(const struct sieve_runtime_env *renv, "local policy prohibits the use of a redirect action"); return SIEVE_EXEC_FAILURE; } + if (!cmd_redirect_allowed(svinst, to_address)) { + sieve_runtime_error(renv, NULL, + "local policy prohibits the use of a redirect action"); + return SIEVE_EXEC_FAILURE; + } if (sieve_runtime_trace_active(renv, SIEVE_TRLVL_ACTIONS)) { sieve_runtime_trace(renv, 0, "redirect action"); diff --git a/pigeonhole/src/lib-sieve/sieve-common.h b/pigeonhole/src/lib-sieve/sieve-common.h index e79fb4d..d980c9d 100644 --- a/pigeonhole/src/lib-sieve/sieve-common.h +++ b/pigeonhole/src/lib-sieve/sieve-common.h @@ -209,6 +209,7 @@ struct sieve_instance { const struct smtp_address *user_email, *user_email_implicit; struct sieve_address_source redirect_from; unsigned int redirect_duplicate_period; + const char **allowed_redirects; }; /* diff --git a/pigeonhole/src/lib-sieve/sieve-settings.c b/pigeonhole/src/lib-sieve/sieve-settings.c index 47f70da..70addc7 100644 --- a/pigeonhole/src/lib-sieve/sieve-settings.c +++ b/pigeonhole/src/lib-sieve/sieve-settings.c @@ -267,4 +267,10 @@ void sieve_settings_load(struct sieve_instance *svinst) svinst->user_email = address; } } + svinst->allowed_redirects = NULL; + str_setting = sieve_setting_get(svinst, "sieve_allowed_redirects"); + if (str_setting != NULL && *str_setting != '\0') { + svinst->allowed_redirects = + (const char **)p_strsplit_spaces(svinst->pool, str_setting, ", "); + } } Best regards, Jozsef -- E-mail : kadlecsik.jozsef(a)wigner.hun-ren.hu PGP key: https://wigner.hu/~kadlec/pgp_public_key.txt Address: Wigner Research Centre for Physics H-1525 Budapest 114, POB. 49, Hungary

2 1

Empty "from:" on certain sieve rule
by Ciprian M. Vizitiu [FDT] 10 Aug '25

10 Aug '25

Hello everyone, Running a Dovecot 2.3.13 (Debian 11 native package) configured to deliver to Postfix lmtp and using dovecot-sieve. Setting-up a simple vacation responder works as expected but trying to catch a missing header e.g. if allof (not exists "X-GitLab-NotificationReason") { vacation :days 1 :addresses"SOME-NOTIFICATION(a)example.com" :subject "Message sent to an automated address " :from"some-sender(a)example.com" text: Hello, This is an automated reply to let you know thatSOME-NOTIFICATION(a)example.com is an automated address and is not read by a human operator. If you're trying to contact EXAMPLECOM please send your emails toexample(a)example.com . ; } ... will result in an empty "from:" field instead of the required "some-sender(a)example.com" e.g. Aug 06 09:41:45 email-001.example.com postfix/smtpd[1974551]: disconnect from localhost[127.0.0.1] ehlo=1 mail=1 rcpt=1 data=1 quit=1 commands=5 Aug 06 09:41:45 email-001.example.com dovecot[1174421]: lmtp(some-notification(a)email.example.com)<1974562><uTh/ITkHk2giIR4AdMz+wA>: sieve: msgid=<941c2ff0-56f1-493f-973e-871f446e060b(a)anotherexample.com>: vacation action: sent vacation response to <some.user(a)anotherexample.com> Aug 06 09:41:45 email-001.example.com postfix/pickup[1956559]: B7BF8207C9: uid=18018 from=<> Aug 06 09:41:45 email-001.example.com postfix/cleanup[1974554]: B7BF8207C9: message-id=<dovecot-sieve-1754466105-562992-0(a)email-001.example.com> Aug 06 09:41:45 email-001.example.com postfix/qmgr[1171599]: B7BF8207C9: from=<>, size=979, nrcpt=2 (queue active) Aug 06 09:41:45 email-001.example.com postfix/smtp[1974565]: B7BF8207C9: to=<some.user(a)anotherexample.com>, relay=smtpconnector.upper.relay[192.168.2.14]:25, delay=0.12, delays=0.06/0.01/0.03/0.02, dsn=5.7.1, status=bounced (host smtpconnector.upper.relay[192.168.2.14] said: 554 5.7.1 <>: Sender address rejected: Access denied (in reply to RCPT TO command)) I tried forcing sieve_user_email = some-sender(a)example.com ... but to no avail. I'm well aware that I could try and fix the problem at Postfix level but blindly catching ALL mails with an empty "from:" field feels bad: one miss-configured daemon and we spam everyone plus we already do some intricate rewriting. Any ideas? Hello everyone, Running a Dovecot 2.3.13 (Debian 11 native package) configured to deliver to Postfix lmtp and using dovecot-sieve. Setting-up a simple vacation responder works as expected but trying to catch a missing header e.g. if allof (not exists "X-GitLab-NotificationReason") { vacation :days 1 :addresses [1]"SOME-NOTIFICATION(a)example.com" :subject "Message sent to an automated address " :from [2]"some-sender(a)example.com" text: Hello, This is an automated reply to let you know that [3]SOME-NOTIFICATION(a)example.com is an automated address and is not read by a human operator. If you're trying to contact EXAMPLECOM please send your emails to [4]example(a)example.com . ; } ... will result in an empty "from:" field instead of the required [5]"some-sender(a)example.com" e.g. Aug 06 09:41:45 email-001.example.com postfix/smtpd[1974551]: disconnect from localhost[127.0.0.1] ehlo=1 mail=1 rcpt=1 data=1 quit=1 commands=5 Aug 06 09:41:45 email-001.example.com dovecot[1174421]: lmtp([6]some-notification(a)email.example.com)<1974562><uTh/ITkHk2giIR4AdMz+wA>: sieve: msgid=[7]<941c2ff0-56f1-493f-973e-871f446e060b(a)anotherexample.com>: vacation action: sent vacation response to [8]<some.user(a)anotherexample.com> Aug 06 09:41:45 email-001.example.com postfix/pickup[1956559]: B7BF8207C9: uid=18018 from=<> Aug 06 09:41:45 email-001.example.com postfix/cleanup[1974554]: B7BF8207C9: message-id=[9]<dovecot-sieve-1754466105-562992-0(a)email-001.example.com> Aug 06 09:41:45 email-001.example.com postfix/qmgr[1171599]: B7BF8207C9: from=<>, size=979, nrcpt=2 (queue active) Aug 06 09:41:45 email-001.example.com postfix/smtp[1974565]: B7BF8207C9: to=[10]<some.user(a)anotherexample.com>, relay=smtpconnector.upper.relay[192.168.2.14]:25, delay=0.12, delays=0.06/0.01/0.03/0.02, dsn=5.7.1, status=bounced (host smtpconnector.upper.relay[192.168.2.14] said: 554 5.7.1 <>: Sender address rejected: Access denied (in reply to RCPT TO command)) I tried forcing sieve_user_email = [11]some-sender(a)example.com ... but to no avail. I'm well aware that I could try and fix the problem at Postfix level but blindly catching ALL mails with an empty "from:" field feels bad: one miss-configured daemon and we spam everyone plus we already do some intricate rewriting. Any ideas? References Visible links 1. mailto:SOME-NOTIFICATION@example.com 2. mailto:some-sender@example.com 3. mailto:SOME-NOTIFICATION@example.com 4. mailto:example@example.com 5. mailto:some-sender@example.com 6. mailto:some-notification@email.example.com 7. mailto:941c2ff0-56f1-493f-973e-871f446e060b@anotherexample.com 8. mailto:some.user@anotherexample.com 9. mailto:dovecot-sieve-1754466105-562992-0@email-001.example.com 10. mailto:some.user@anotherexample.com 11. mailto:some-sender@example.com

2 1

Unable to specify home directory for mail_location
by jrmu＠ircnow.org 05 Aug '25

05 Aug '25

Greetings Dovecot team/users, I am trying to use Dovecot to serve Maildir files. The users' email is located in ~/Maildir (in each user's home directory). I tried specifying mail_location = maildir:~/Maildir but I get this error: Aug 4 00:06:34 ch dovecot: imap(username): Error: Relative home directory paths not supported: 0 Are relative home directory paths not supported? Here is the output of dovecot -n: # dovecot -n # 2.3.21.1 (d492236fa0): /etc/dovecot/dovecot.conf # OS: OpenBSD 7.7 amd64 # Hostname: ch.ircnow.org auth_debug = yes auth_debug_passwords = yes auth_verbose = yes auth_verbose_passwords = sha1 first_valid_uid = 1000 listen = 104.244.78.185, 2605:6400:c8b7::1 mail_debug = yes mail_location = maildir:~/Maildir mbox_write_locks = fcntl mmap_disable = yes namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } passdb { args = scheme=blf-crypt username_format=%u /etc/dovecot/passwd driver = passwd-file } ssl_cert = </etc/ssl/ch.ircnow.org.crt ssl_key = # hidden, use -P to show it userdb { args = username_format=%u /etc/dovecot/passwd default_fields = quota_rule=*:storage=1G driver = passwd-file } verbose_ssl = yes 1375 bytes received in 0.00 seconds (5.18 MB/s) -- Aaron Lin jrmu(a)ircnow.org IRCNow (https://ircnow.org)

3 5

Dovecot fails to "initialize SSL server context"
by jaap＠jbril.net 04 Aug '25

04 Aug '25

I am configuring a new mailserver. Postfix works and is getting configured according to our wishes. Dovecot is more stubborn: for some reason I'm not able to understand, it refuses to "initialize SSL server context". complaining that "Can't load SSl Certificate". I believe I have configured the same certificate (and accompanying key) for imap-login that I use for https. But dovecot does not agree. I looked at error:14187180. All I found were errors on the configuration for the Certs cq Keys which I think I am avoiding . Two questions: Please correct me if I'm wrong. Can you clarify dovecot's error message? Jaap Server: * Rocky Linux 9.6 kernel 5.14.0-570.28.1 * Dovecot 2.3.21.1 * Openssl 3.2.2 * Certbot 3.1.0 Https is functioning as expected: ssl-config: * Include /etc/letsencrypt/options-ssl-apache.conf * SSLCertificateFile /etc/letsencrypt/live/radicale.camelopardus.nl/fullchain.pem * SSLCertificateKeyFile /etc/letsencrypt/live/radicale.camelopardus.nl/privkey.pem * ssl_cert = </etc/letsencrypt/live/iris.camelopardus.nl/fullchain.pem test from client: openssl s_client -connect radicale.camelopardus.nl:https reply: *CONNECTED(00000003)* *depth=2 C = US, O = Internet Security Research Group, CN = ISRG Root X1* *verify return:1* *depth=1 C = US, O = Let’s Encrypt, CN = E6* *verify return:1* *depth=0 CN = radicale.camelopardus.nl* *verify return:1* Dovecot responds differently (for Thunderbird as well as) for openssl: conf.d/10-ssl.conf: * ssl_cert = </etc/letsencrypt/live/radicale.camelopardus.nl/fullchain.pem * ssl_key = </etc/letsencrypt/live/radicale.camelopardus.nl/privkey.pem test: openssl s_client -connect radicale.camelopardus.nl:imaps reply: CONNECTED(00000003) write:errno=104 no peer certificate available For both there is the same error in dovecot's log: imap-login: Error: Failed to initialize SSL server context: Can't load SSL certificate (ssl_cert setting): error:14187180: SSL routines:ssl_do_config:bad value: section=system_default, cmd=Groups, arg=X25519:secp256r1:X448:secp521r1:secp384r1:ffdhe2048:ffdhe3072:ffdhe4096:ffdhe6144:ffdhe8192: user=<>, rip=2a10:3781:5ab:1:ff51:cbd1:4d54:fb7b, lip=2a10:3781:5ab:10::aaf,

4 4

migrate to virtual mailboxes before upgrading to 2.4
by roughnecks 04 Aug '25

04 Aug '25

Hello, I was thinking about, maybe, migrating my postfix/dovecot server to virtual mailboxes, before upgrading Debian to Trixie. So, atm, I have system users with ~/Maildir but it's not so convenient anymore. I am looking for some documentation/guide on how to migrate everything to virtual mailboxes. Of course I searched by myself, but didn't find many results. Thanks -- roughnecks

2 1

sieve script is not exescuted
by Kamil Jońca 30 Jul '25

30 Jul '25

I have scripts in 2 places: sieve_script personal { path = ~/.dovecot.sieve } sieve_script before { path = /etc/dovecot/sieve } /etc/dovecot/sieve is directory with (currently) one script. This script add header to message. And it seems, that "before" script is not executed. Any hints? KJ -- http://wolnelektury.pl/wesprzyj/teraz/ "Linux: the operating system with a CLUE... Command Line User Environment". (seen in a posting in comp.software.testing)

6 11

doveadm force-resync crashes at list/mailbox-list-fs-iter.c:507
by Ákos Szőts 29 Jul '25

29 Jul '25

Hi All, In Dovecot 2.4.1 if I start doveadm force-resync with a non-existent mailbox that ends in a slash, the command crashes: gdb -ex run --args doveadm force-resync -A test/ Thread 1 (Thread 0x7f9e5cc4a980 (LWP 442) "doveadm"): #0 fs_list_next_root(ctx=ctx@entry=0x55d248df6898) at list/mailbox-list-fs-iter.c:507 roots= <error reading variable roots (Cannot access memory at address 0x0)> count= <error reading variable count (Cannot access memory at address 0x8)> __func__= "fs_list_next_root" #1 0x00007f9e5dc417c2in fs_list_iter_reset(ctx=0x55d248df6898) at list/mailbox-list-fs-iter.c:830 __func__= <optimized out> #2 fs_list_iter_next(_ctx=0x55d248df6898) at list/mailbox-list-fs-iter.c:912 ctx= <optimized out> ret= 0 __func__= "fs_list_iter_next" #3 0x00007f9e5dc4f8ddin mailbox_list_iter_next_call(ctx=0x55d248df6898) at list/mailbox-list-iter.c:1009 info= <optimized out> set= 0x148d86ee0 ret= <optimized out> #4 mailbox_list_iter_next(ctx=0x55d248df6898) at list/mailbox-list-iter.c:1098 _data_stack_cur_id= 5 info= <optimized out> #5 0x00007f9e5dc50899in mailbox_list_ns_iter_try_next(_ctx=0x55d248df6488, info_r=<synthetic pointer>) at list/mailbox-list-iter.c:616 ctx= 0x55d248df6488 ns= <optimized out> info= <optimized out> suffix= <optimized out> has_children= <optimized out> __func__= <optimized out> #6 mailbox_list_ns_iter_next(_ctx=0x55d248df6488) at list/mailbox-list-iter.c:678 info= 0x0 #7 0x00007f9e5dc4f8ddin mailbox_list_iter_next_call(ctx=0x55d248df6488) at list/mailbox-list-iter.c:1009 info= <optimized out> set= 0x2fffffffd0 ret= <optimized out> #8 mailbox_list_iter_next(ctx=0x55d248df6488) at list/mailbox-list-iter.c:1098 _data_stack_cur_id= 4 info= <optimized out> #9 0x000055d20bc81a20in cmd_force_resync_run(_ctx=0x55d248db57a8, user=0x55d248dc6318) at /usr/src/debug/dovecot-2.4.1-4/src/doveadm/doveadm-mail.c:369 ctx= 0x55d248db57a8 iter_flags= (MAILBOX_LIST_ITER_RAW_LIST| MAILBOX_LIST_ITER_NO_AUTO_BOXES| MAILBOX_LIST_ITER_STAR_WITHIN_NS| MAILBOX_LIST_ITER_RETURN_NO_FLAGS| MAILBOX_LIST_ITER_FORCE_RESYNC) ns_mask= (MAIL_NAMESPACE_TYPE_PRIVATE| MAIL_NAMESPACE_TYPE_SHARED| MAIL_NAMESPACE_TYPE_PUBLIC) iter= 0x55d248df6488 info= <optimized out> ret= <optimized out> patterns= {0x55d248db5300"test/", 0x0} #10 0x000055d20bc856c2in doveadm_mail_next_user(ctx=ctx@entry=0x55d248db57a8, error_r=error_r@entry=0x7ffdbc3f0778) at /usr/src/debug/dovecot-2.4.1-4/src/doveadm/doveadm-mail.c:506 _data_stack_cur_id= 3 cctx= 0x55d248db39b8 input= {event_parent= 0x0, service= 0x55d20bcbd810"doveadm", protocol= 0x0, username= 0x55d248db81a0"akos(a)szots.dev", session_id= 0x0, session_id_prefix= 0x0, session_create_ time= 0, local_ip= {family= 0, u= {ip6= {__in6_u= {__u6_addr8= '\000' <repeats 15 times>, __u6_addr16= {0, 0, 0, 0, 0, 0, 0, 0}, __u6_addr32= {0, 0, 0, 0}}}, ip4= {s_addr= 0}}, sco pe_id= 0}, remote_ip= {family= 0, u= {ip6= {__in6_u= {__u6_addr8= '\000' <repeats 15 times>, __u6_addr16= {0, 0, 0, 0, 0, 0, 0, 0}, __u6_addr32= {0, 0, 0, 0}}}, ip4= {s_addr= 0}}, scope_id= 0}, local_port= 0, remote_port= 0, local_name= 0x0, userdb_fields= 0x0, code_override_fields= 0x0, forward_fields= 0x0, set_instance= 0x0, flags_override_add= 0, flags_over ride_remove= 0, no_userdb_lookup= false, debug= false, end_client_tls_secured= false, autocreated= false, no_free_init_failure= false} error= 0x0 ip= <optimized out> ret= <optimized out> dropping_privs= true cur_uid= 0 cur_cwd= 0x55d248d86df8"/" cur_ctx= 0x55d248dc2c80 reason= 0x55d248df57f0 __func__= "doveadm_mail_next_user" #11 0x000055d20bc87525in doveadm_mail_all_users(ctx=0x55d248db57a8, wildcard_user=0x55d20bcc015d "*") at /usr/src/debug/dovecot-2.4.1-4/src/doveadm/doveadm-mail.c:584 _data_stack_cur_id= 2 cctx= 0x55d248db39b8 user_idx= 0 ip= <optimized out> user= 0x55d248db81a0"akos(a)szots.dev" error= 0x55d248d8e7d8"\t\350\330H\322U" ret= 1 #12 doveadm_mail_cmd_exec(ctx=0x55d248db57a8, wildcard_user=0x55d20bcc015d "*") at /usr/src/debug/dovecot-2.4.1-4/src/doveadm/doveadm-mail.c:721 cctx= <optimized out> cli= <optimized out> ret= <optimized out> error= 0x55d248d8e7d8"\t\350\330H\322U" #13 doveadm_cmd_ver2_to_mail_cmd_wrapper(cctx=<optimized out>) at /usr/src/debug/dovecot-2.4.1-4/src/doveadm/doveadm-mail.c:1039 mctx= 0x55d248db57a8 mail_cmd= {alloc= 0x55d20bc803f0<cmd_force_resync_alloc>, name= 0x55d20bcbe92d"force-resync", usage_args= 0x55d20bcc5008"[-u <user>|-A] [-S <socket_path>] [-f] <mailbox mask>"} wildcard_user= 0x55d20bcc015d"*" #14 0x000055d20bc9ba77in doveadm_cmdline_run(argc=<optimized out>, argv=0x55d248d8e7c8, cctx=cctx@entry=0x55d248db39b8) at /usr/src/debug/dovecot-2.4.1-4/src/doveadm/doveadm-cmd-parse.c:451 prefix= <optimized out> pargv= {arr= {buffer= 0x55d248db4388, element_size= 112}, v= 0x55d248db4388, v_modifiable= 0x55d248db4388} pargc= 8 pool= 0x55d248db4350 ptr_count= <optimized out> ptr= <optimized out> ptr_end= <optimized out> ptr_last_non_kv= <optimized out> #15 0x000055d20bc9bc2cin doveadm_cmdline_try_run(cmd_name=cmd_name@entry=0x55d248d8e7f9 "force-resync", argc=<optimized out>, argv=<optimized out>, cctx=cctx@entry=0x55d248db39b8) at /usr/s rc/debug/dovecot-2.4.1-4/src/doveadm/doveadm-cmd.c:160 cmd= <optimized out> #16 0x000055d20bc74fdein main(argc=<optimized out>, argv=<optimized out>) at /usr/src/debug/dovecot-2.4.1-4/src/doveadm/doveadm.c:386 service_flags= <optimized out> cmd_name= 0x55d248d8e7f9"force-resync" i= <optimized out> quick_init= false c= <optimized out> longopts= {{name= 0x7f9e5dadb7a8"help", has_arg= 0, flag= 0x0, val= 0}, {name= 0x0, has_arg= 0, flag= 0x0, val= 0}} help_requested= <optimized out> longopt= 0x0 cctx= 0x55d248db39b8 Ákos Hi All, In Dovecot 2.4.1 if I start doveadm force-resync with a non-existent mailbox that ends in a slash, the command crashes: gdb -ex run --args doveadm force-resync -A test/ Thread 1 (Thread 0x7f9e5cc4a980 (LWP 442) "doveadm"): #0 fs_list_next_root (ctx=ctx@entry=0x55d248df6898) at list/mailbox-list-fs-iter.c:507 roots = <error reading variable roots (Cannot access memory at address 0x0)> count = <error reading variable count (Cannot access memory at address 0x8)> __func__ = "fs_list_next_root" #1 0x00007f9e5dc417c2 in fs_list_iter_reset (ctx=0x55d248df6898) at list/mailbox-list-fs-iter.c:830 __func__ = <optimized out> #2 fs_list_iter_next (_ctx=0x55d248df6898) at list/mailbox-list-fs-iter.c:912 ctx = <optimized out> ret = 0 __func__ = "fs_list_iter_next" #3 0x00007f9e5dc4f8dd in mailbox_list_iter_next_call (ctx=0x55d248df6898) at list/mailbox-list-iter.c:1009 info = <optimized out> set = 0x148d86ee0 ret = <optimized out> #4 mailbox_list_iter_next (ctx=0x55d248df6898) at list/mailbox-list-iter.c:1098 _data_stack_cur_id = 5 info = <optimized out> #5 0x00007f9e5dc50899 in mailbox_list_ns_iter_try_next (_ctx=0x55d248df6488, info_r=<synthetic pointer>) at list/mailbox-list-iter.c:616 ctx = 0x55d248df6488 ns = <optimized out> info = <optimized out> suffix = <optimized out> has_children = <optimized out> __func__ = <optimized out> #6 mailbox_list_ns_iter_next (_ctx=0x55d248df6488) at list/mailbox-list-iter.c:678 info = 0x0 #7 0x00007f9e5dc4f8dd in mailbox_list_iter_next_call (ctx=0x55d248df6488) at list/mailbox-list-iter.c:1009 info = <optimized out> set = 0x2fffffffd0 ret = <optimized out> #8 mailbox_list_iter_next (ctx=0x55d248df6488) at list/mailbox-list-iter.c:1098 _data_stack_cur_id = 4 info = <optimized out> #9 0x000055d20bc81a20 in cmd_force_resync_run (_ctx=0x55d248db57a8, user=0x55d248dc6318) at /usr/src/debug/dovecot-2.4.1-4/src/doveadm/doveadm-mail.c:369 ctx = 0x55d248db57a8 iter_flags = (MAILBOX_LIST_ITER_RAW_LIST | MAILBOX_LIST_ITER_NO_AUTO_BOXES | MAILBOX_LIST_ITER_STAR_WITHIN_NS | MAILBOX_LIST_ITER_RETURN_NO_FLAGS | MAILBOX_LIST_ITER_FORCE_RESYNC) ns_mask = (MAIL_NAMESPACE_TYPE_PRIVATE | MAIL_NAMESPACE_TYPE_SHARED | MAIL_NAMESPACE_TYPE_PUBLIC) iter = 0x55d248df6488 info = <optimized out> ret = <optimized out> patterns = {0x55d248db5300 "test/", 0x0} #10 0x000055d20bc856c2 in doveadm_mail_next_user (ctx=ctx@entry=0x55d248db57a8, error_r=error_r@entry=0x7ffdbc3f0778) at /usr/src/debug/dovecot-2.4.1-4/src/doveadm/doveadm-mail.c:506 _data_stack_cur_id = 3 cctx = 0x55d248db39b8 input = {event_parent = 0x0, service = 0x55d20bcbd810 "doveadm", protocol = 0x0, username = 0x55d248db81a0 [1]"akos(a)szots.dev", session_id = 0x0, session_id_prefix = 0x0, session_create_ time = 0, local_ip = {family = 0, u = {ip6 = {__in6_u = {__u6_addr8 = '\000' <repeats 15 times>, __u6_addr16 = {0, 0, 0, 0, 0, 0, 0, 0}, __u6_addr32 = {0, 0, 0, 0}}}, ip4 = {s_addr = 0}}, sco pe_id = 0}, remote_ip = {family = 0, u = {ip6 = {__in6_u = {__u6_addr8 = '\000' <repeats 15 times>, __u6_addr16 = {0, 0, 0, 0, 0, 0, 0, 0}, __u6_addr32 = {0, 0, 0, 0}}}, ip4 = {s_addr = 0}}, scope_id = 0}, local_port = 0, remote_port = 0, local_name = 0x0, userdb_fields = 0x0, code_override_fields = 0x0, forward_fields = 0x0, set_instance = 0x0, flags_override_add = 0, flags_over ride_remove = 0, no_userdb_lookup = false, debug = false, end_client_tls_secured = false, autocreated = false, no_free_init_failure = false} error = 0x0 ip = <optimized out> ret = <optimized out> dropping_privs = true cur_uid = 0 cur_cwd = 0x55d248d86df8 "/" cur_ctx = 0x55d248dc2c80 reason = 0x55d248df57f0 __func__ = "doveadm_mail_next_user" #11 0x000055d20bc87525 in doveadm_mail_all_users (ctx=0x55d248db57a8, wildcard_user=0x55d20bcc015d "*") at /usr/src/debug/dovecot-2.4.1-4/src/doveadm/doveadm-mail.c:584 _data_stack_cur_id = 2 cctx = 0x55d248db39b8 user_idx = 0 ip = <optimized out> user = 0x55d248db81a0 [2]"akos(a)szots.dev" error = 0x55d248d8e7d8 "\t\350\330H\322U" ret = 1 #12 doveadm_mail_cmd_exec (ctx=0x55d248db57a8, wildcard_user=0x55d20bcc015d "*") at /usr/src/debug/dovecot-2.4.1-4/src/doveadm/doveadm-mail.c:721 cctx = <optimized out> cli = <optimized out> ret = <optimized out> error = 0x55d248d8e7d8 "\t\350\330H\322U" #13 doveadm_cmd_ver2_to_mail_cmd_wrapper (cctx=<optimized out>) at /usr/src/debug/dovecot-2.4.1-4/src/doveadm/doveadm-mail.c:1039 mctx = 0x55d248db57a8 mail_cmd = {alloc = 0x55d20bc803f0 <cmd_force_resync_alloc>, name = 0x55d20bcbe92d "force-resync", usage_args = 0x55d20bcc5008 "[-u <user>|-A] [-S <socket_path>] [-f] <mailbox mask>"} wildcard_user = 0x55d20bcc015d "*" #14 0x000055d20bc9ba77 in doveadm_cmdline_run (argc=<optimized out>, argv=0x55d248d8e7c8, cctx=cctx@entry=0x55d248db39b8) at /usr/src/debug/dovecot-2.4.1-4/src/doveadm/doveadm-cmd-parse.c:451 prefix = <optimized out> pargv = {arr = {buffer = 0x55d248db4388, element_size = 112}, v = 0x55d248db4388, v_modifiable = 0x55d248db4388} pargc = 8 pool = 0x55d248db4350 ptr_count = <optimized out> ptr = <optimized out> ptr_end = <optimized out> ptr_last_non_kv = <optimized out> #15 0x000055d20bc9bc2c in doveadm_cmdline_try_run (cmd_name=cmd_name@entry=0x55d248d8e7f9 "force-resync", argc=<optimized out>, argv=<optimized out>, cctx=cctx@entry=0x55d248db39b8) at /usr/s rc/debug/dovecot-2.4.1-4/src/doveadm/doveadm-cmd.c:160 cmd = <optimized out> #16 0x000055d20bc74fde in main (argc=<optimized out>, argv=<optimized out>) at /usr/src/debug/dovecot-2.4.1-4/src/doveadm/doveadm.c:386 service_flags = <optimized out> cmd_name = 0x55d248d8e7f9 "force-resync" i = <optimized out> quick_init = false c = <optimized out> longopts = {{name = 0x7f9e5dadb7a8 "help", has_arg = 0, flag = 0x0, val = 0}, {name = 0x0, has_arg = 0, flag = 0x0, val = 0}} help_requested = <optimized out> longopt = 0x0 cctx = 0x55d248db39b8 Akos References Visible links 1. mailto:akos@szots.dev 2. mailto:akos@szots.dev

2 2

"lock/disable" user's mailbox
by roughnecks 29 Jul '25

29 Jul '25

Hello, not sure if relevant here, but I'm in need of disabling or locking down an user's mailbox, without completely removing the related system account. It would be nice if said account was not able to receive emails anymore, or "better", until it was re-enabled. Would also be cool if the sender received a warning back, upon the failed dispatch. Does that even make sense? :D I'm running postfix and dovecot on a debian bookworm VPS. Thanks -- roughnecks

2 2

When does dovecot use sendmail_path?
by Joseph Tam 29 Jul '25

29 Jul '25

I'm trying to plug up all the holes where local mail leaves our mail system without a DKIM signature. One avenue is bounce messages. I wrote a small sendmail wrapper to add DKIM signatures, and defined it as the value for dovecot's sendmail_path. I presume Dovecot invokes this executable when it has to send a send message. Under what circumstances does this happen? I tried to provoke a mailout by sending messages to recipients with full quotas and permission locked mailbox files, but could not generate any mail back. Joseph Tam <jtam.home(a)gmail.com>

2 2

'doveadm' error
by Andreas Kossack 28 Jul '25

28 Jul '25

Hi, are there anywhere recommendations or 'best practices' for compiling dovecot-2.4.x at IBMs AIX7.3? With some own patches i can compile it, but one unexpected result is # /usr/local/bin/doveadm mailbox list -u <user> /usr/local/bin/doveconf: invalid option -- u What's wrong? -- Mit freundlichen Grüßen / Best regards / Salutations / Cordialmente ___________________________________________________________________ Brandenburgische Technische Universität Cottbus – Senftenberg E Andreas.Kossack(a)B-TU.De

1 0

one-off doveadm commands broken in 2.4.1 when using docker
by jlh 28 Jul '25

28 Jul '25

Hi all In 2.3, I could use doveadm from the docker image as a standalone tool, but this no longer works in 2.4: $ docker run --rm -ti dovecot/dovecot:2.3-latest doveadm usage: doveadm [-Dv] [-f <formatter>] <command> [<args>] altmove [-u <user>|-A] [-S <socket_path>] [-r] <search query> [...snip...] $ docker run --rm -ti dovecot/dovecot:latest-2.4 doveadm doveconf: Fatal: Cannot expand variable %{env:USER_PASSWORD This was useful for hashing passwords with "doveadm pw". I assume this wasn't an intentional change in how doveadm works. For now I'll just use the old image when hashing passwords. Thank you! Jean-Luc

2 1

siebe settings in 2.4.0
by Helmut K. C. Tessarek 23 Jul '25

23 Jul '25

I've been reading the docs and the migration docs for hours, but the sieve config is a mess. In 2.3.x I am using: plugin { sieve = ~/.sieve sieve_dir = ~/.sieve_storage } and this is how it looks in my home dir: $ ls -la .sie* lrwxrwxrwx 32 a b c d .sieve -> .sieve_storage/MailFilters.sieve .rw------- 0 a b c d .sieve.log .rw------- 17,414 a b c d 2025-07-08 03:00 .sieve.svbin So How do I do the same in 2.4.x? I've come so far as: sieve_script personal { driver = file } But then there are path, bin_path, active_path, name, and a bunch of other settings. Sorry to be a little bit frustrated, but my old settings are not out of the ordinary (2 freaking parameters), but there is no documentation on how to migrate these 2 very simple settings to the new format. The upgrade docs explain the new var expansion and a matrix with old and new parameters. But this info is completely missing for sieve. The doc only points to "script storage". Really? You couldn't have added these 2 parameters to the old-new matrix? I am not asking you to do this for every single sieve parameter, but at least for the 2 or 3 most used ones. Sorry for my rant, but I had to get it out there to not go insane. Cheers, K. C. -- regards Helmut K. C. Tessarek KeyID 0x172380A011EF4944 Key fingerprint = 8A55 70C1 BD85 D34E ADBC 386C 1723 80A0 11EF 4944 /* Thou shalt not follow the NULL pointer for chaos and madness await thee at its end. */

4 6

discarded vacation reply to own address <xxxx> (as specified using :addresses argument)
by Marc 23 Jul '25

23 Jul '25

Did I configure this? Or is this default behaviour of dovecot? How can I turn this off if this is a standard config?

2 1

Re: Strange mailq errors
by Xavier Humbert 23 Jul '25

23 Jul '25

Le 22/07/2025 16:28, Odhiambo Washington a écrit : > > > On Tue, Jul 22, 2025 at 4:42 PM Xavier Humbert via dovecot > <dovecot(a)dovecot.org> wrote: > > Hi, > > I recently experienced strange errors in mailq : > > [root@numenor ~]# mailq > -Queue ID- --Size-- ----Arrival Time---- -Sender/Recipient------- > 56BF31C9391 2320 Fri Jul 18 03:42:33 info(a)quora.com > (temporary failure. Command output: lda(postfix): Error: > net_connect_unix(/var/run/dovecot/stats-writer) failed: Permission > denied) > postfix(a)groumpf.org > > All other messages are getting in without error. > Furthermore these are probably spam which shouldn't get in, since > postfix@ is not in the authorized recipients > > When it happens, it is always spam for postfix@ > > Any idea ? > > > Check your dovecot config for the permissions: Postfix user needs > access to /var/run/dovecot/stats-writer > > V2.4: > service stats { > unix_listener stats-writer { > mode = 0660 > user = ?? > } > } > > v2.3 > unix_listener stats-writer { > user = ?? > group = ?? > mode = 0660 > } > } > > > -- > Best regards, > Odhiambo WASHINGTON, > Nairobi,KE > +254 7 3200 0004/+254 7 2274 3223 > In an Internet failure case, the #1 suspect is a constant: DNS. > "Oh, the cruft.", egrep -v '^$|^.*#' ¯\_(ツ)_/¯ :-) > [How to ask smart questions: > http://www.catb.org/~esr/faqs/smart-questions.html] Here is the relevant part of dovecot config : service stats { unix_listener stats-reader { user = $default_internal_user group = $default_internal_user mode = 0660 } unix_listener stats-writer { user = $default_internal_user group = $default_internal_user mode = 0660 } } All other mails get in without problem. I suspect it gets in, then confuses the mail system because of proxy:unix:passwd.byname in postfix config local_recipient_maps I don't need this btw. Xavier -- Xavier HUMBERT - Unix/Win/MacOSX Sysadmin/Network Engineer https://www.amdh.fr Le 22/07/2025 16:28, Odhiambo Washington a ecrit : On Tue, Jul 22, 2025 at 4:42PM Xavier Humbert via dovecot <[1]dovecot(a)dovecot.org> wrote: Hi, I recently experienced strange errors in mailq : [root@numenor ~]# mailq -Queue ID- --Size-- ----Arrival Time---- -Sender/Recipient------- 56BF31C9391 2320 Fri Jul 18 03:42:33 [2]info(a)quora.com (temporary failure. Command output: lda(postfix): Error: net_connect_unix(/var/run/dovecot/stats-writer) failed: Permission denied) [3]postfix(a)groumpf.org All other messages are getting in without error. Furthermore these are probably spam which shouldn't get in, since postfix@ is not in the authorized recipients When it happens, it is always spam for postfix@ Any idea ? Check your dovecot config for the permissions: Postfix user needs access to /var/run/dovecot/stats-writer V2.4: service stats { unix_listener stats-writer { mode = 0660 user = ?? } } v2.3 unix_listener stats-writer { user = ?? group = ?? mode = 0660 } } -- Best regards, Odhiambo WASHINGTON, Nairobi,KE +254 7 3200 0004/+254 7 2274 3223 In an Internet failure case, the #1 suspect is a constant: DNS. "Oh, the cruft.", egrep -v '^$|^.*#' -\_(Tu)_/- :-) [How to ask smart questions: [4]http://www.catb.org/~esr/faqs/smart-questions.html] Here is the relevant part of dovecot config : service stats { unix_listener stats-reader { user = $default_internal_user group = $default_internal_user mode = 0660 } unix_listener stats-writer { user = $default_internal_user group = $default_internal_user mode = 0660 } } All other mails get in without problem. I suspect it gets in, then confuses the mail system because of proxy:unix:passwd.byname in postfix config local_recipient_maps I don't need this btw. Xavier -- Xavier HUMBERT - Unix/Win/MacOSX Sysadmin/Network Engineer [5]https://www.amdh.fr References Visible links 1. mailto:dovecot@dovecot.org 2. mailto:info@quora.com 3. mailto:postfix@groumpf.org 4. http://www.catb.org/~esr/faqs/smart-questions.html 5. https://www.amdh.fr/

2 1

Anyone have working examples of how one might go about *debugging* a userdb/passdb LUA script for authentication?
by Andy Baugh 22 Jul '25

22 Jul '25

Howdy, I've been working on upgrading the version cPanel ships to Dovecot 2.4. It appears that the "dict" driver for passdb/authdb has been removed per your documentation, with a recommendation to use a lua script instead. As such I've followed the online documentation to do so and wound up with a userdb/passdb section that looks like so: passdb cpauthd { driver = lua lua_file = /usr/local/cpanel/etc/dovecot/cpauthd.lua lua_settings { socket = /usr/local/cpanel/var/cpdoveauthd.sock } result_internalfail = continue result_failure = return-fail } userdb cpauthd { driver = lua lua_file = /usr/local/cpanel/etc/dovecot/cpauthd.lua } My prospective lua script only takes from the socket arg passed in and reads from the socket, delivering back the same kind of answer we would have previously got from the auth dict driver (converting password_key/user_key to auth_passdb/userdb_get_cache_key in script as appears to be suggested). Unfortunately, I'm thinking that this entire setup is being ignored, as when I do: doveadm -D -o auth_debug=yes auth lookup for a user I know to be valid on the system with the previous 2.3 setup, I don't even see any indication that the lua authentication database is even consulted. Jul 18 12:32:30 Debug: auth-master: passdb lookup(zippy(a)cptest.local): Started passdb lookup Jul 18 12:32:30 Debug: auth-master: conn unix:/var/run/dovecot/auth-userdb: Connecting Jul 18 12:32:30 Debug: auth-master: conn unix:/var/run/dovecot/auth-userdb (pid=800187,uid=0): Client connected (fd=9) Jul 18 12:32:30 Debug: auth-master: conn unix:/var/run/dovecot/auth-userdb (pid=800187,uid=0): auth input: Jul 18 12:32:30 Error: auth-master: passdb lookup(zippy(a)cptest.local): Auth PASS lookup failed Jul 18 12:32:30 Debug: auth-master: passdb lookup(zippy(a)cptest.local): auth PASS input: Jul 18 12:32:30 Debug: auth-master: passdb lookup(zippy(a)cptest.local): Passdb lookup failed Jul 18 12:32:30 Error: cmd auth lookup: passdb lookup failed for zippy(a)cptest.local Jul 18 12:32:30 Debug: auth-master: conn unix:/var/run/dovecot/auth-userdb (pid=800187,uid=0): Disconnected: Connection closed (fd=9) Similarly, in my lua script, I try to use the "dovecot.auth.log_debug/log_info" etc. functions in documentation within the scope of auth_passdb_lookup or auth_userdb_lookup, yet I never see any debug prints even if I add a debug line to the start of the function to indicate entry. What I would like to know is whether there is some debug flag I'm missing to see the routing from config -> lua script. Does this actually exist? I didn't see anything enlightening in the man pages or online documentation. Hopefully I'm just missing something simple. Cheers, -- Thomas "Andy" Baugh | Software Development Engineer IV andy.baugh(a)webpros.com www.webpros.com

1 1

Strange mailq errors
by Xavier Humbert 22 Jul '25

22 Jul '25

Hi, I recently experienced strange errors in mailq : [root@numenor ~]# mailq -Queue ID- --Size-- ----Arrival Time---- -Sender/Recipient------- 56BF31C9391 2320 Fri Jul 18 03:42:33 info(a)quora.com (temporary failure. Command output: lda(postfix): Error: net_connect_unix(/var/run/dovecot/stats-writer) failed: Permission denied) postfix(a)groumpf.org All other messages are getting in without error. Furthermore these are probably spam which shouldn't get in, since postfix@ is not in the authorized recipients When it happens, it is always spam for postfix@ Any idea ? Regards, Xavier -- Xavier HUMBERT - Unix/Win/MacOSX Sysadmin/Network Engineer https://www.amdh.fr

1 0

dovecot internal auth cache expires soon
by Burn Zero 21 Jul '25

21 Jul '25

Hi, I am new to dovecot and I am trying to prepare a POC environment. I have dovecot installed with postfix to perform SASL authentication. I'm using postgresql as auth backend which is working fine. But I am facing an issue with dovecot's internal auth cache. The internal auth cache just expires in 5 minutes. There is only one login (it's me testing) and there are no other logins. OS version: Almalinux 10 Postfix: postfix-3.8.5-8.el10.x86_64 system memory: 4 GB CPU: 2 auth_cache_size = 10M auth_cache_ttl = 1800secs auth_cache_negative_ttl = 300secs ( I have tried this setting to 0 but it does not change anything ) Here's the dovecot -n: # 2.3.21 (47349e2482): /etc/dovecot/dovecot.conf # OS: Linux 6.12.0-55.9.1.el10_0.x86_64 x86_64 AlmaLinux release 10.0 (Purple Lion) # Hostname: localhostvm auth_cache_size = 10 M auth_cache_verify_password_with_worker = yes auth_debug = yes auth_mechanisms = plain login auth_verbose = yes login_log_format = %$: %s %f passdb { args = /etc/dovecot/conf.d/dovecot-sql.conf.ext driver = sql } protocols = service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0666 user = postfix } } ssl = required ssl_cert = </etc/pki/dovecot/certs/dovecot.pem ssl_cipher_list = PROFILE=SYSTEM ssl_key = # hidden, use -P to show it userdb { driver = prefetch } Here's the cache hit log: Jul 14 11:53:35 localhostvm postfix/submission/smtpd[107852]: connect from remote-server Jul 14 11:53:36 localhostvm dovecot[107739]: auth: Debug: client in: AUTH#0112#011LOGIN#011service=smtp#011nologin#011lip=192.168.100.12#011rip=192.168.100.25 Jul 14 11:53:36 localhostvm dovecot[107739]: auth: Debug: client passdb out: CONT#0112#011VXNlcm5hbWU6 Jul 14 11:53:36 localhostvm dovecot[107739]: auth: Debug: client in: CONT<hidden> Jul 14 11:53:36 localhostvm dovecot[107739]: auth: Debug: client passdb out: CONT#0112#011UGFzc3dvcmQ6 Jul 14 11:53:36 localhostvm dovecot[107739]: auth: Debug: client in: CONT<hidden> Jul 14 11:53:36 localhostvm dovecot[107739]: auth: Debug: sql(user(a)tld,192.168.100.25): Performing passdb lookup Jul 14 11:53:36 localhostvm dovecot[107739]: auth: Debug: sql(user(a)tld,192.168.100.25): cache hit: <hidden>#011user=user@tld Jul 14 11:53:36 localhostvm dovecot[107739]: auth: Debug: sql(user(a)tld,192.168.100.25): cache: validating password on worker Jul 14 11:53:36 localhostvm dovecot[107739]: auth-worker(107886): Debug: Loading modules from directory: /usr/lib64/dovecot/auth Jul 14 11:53:36 localhostvm dovecot[107739]: auth-worker(107886): Debug: Module loaded: /usr/lib64/dovecot/auth/lib20_auth_var_expand_crypt.so Jul 14 11:53:36 localhostvm dovecot[107739]: auth-worker(107886): Debug: Module loaded: /usr/lib64/dovecot/auth/libdriver_pgsql.so Jul 14 11:53:36 localhostvm dovecot[107739]: auth-worker(107886): Debug: Module loaded: /usr/lib64/dovecot/auth/libdriver_sqlite.so Jul 14 11:53:36 localhostvm dovecot[107739]: auth-worker(107886): Debug: sqlpool(pgsql): Creating new connection Jul 14 11:53:36 localhostvm dovecot[107739]: auth-worker(107886): Debug: sqlpool(pgsql): Creating new connection Jul 14 11:53:36 localhostvm dovecot[107739]: auth-worker(107886): Debug: conn unix:auth-worker (pid=107856,uid=97): Server accepted connection (fd=15) Jul 14 11:53:36 localhostvm dovecot[107739]: auth-worker(107886): Debug: conn unix:auth-worker (pid=107856,uid=97): Sending version handshake Jul 14 11:53:36 localhostvm dovecot[107739]: auth-worker(107886): Debug: conn unix:auth-worker (pid=107856,uid=97): auth-worker<1>: Handling PASSW request Jul 14 11:53:36 localhostvm dovecot[107739]: auth-worker(107886): Debug: conn unix:auth-worker (pid=107856,uid=97): auth-worker<1>: Finished Jul 14 11:53:36 localhostvm dovecot[107739]: auth: Debug: sql(user(a)tld,192.168.100.25): Finished passdb lookup Jul 14 11:53:36 localhostvm dovecot[107739]: auth: Debug: auth(user(a)tld,192.168.100.25): Auth request finished Jul 14 11:53:36 localhostvm dovecot[107739]: auth: Debug: client passdb out: OK#0112#011user=user@tld Jul 14 11:53:37 localhostvm postfix/submission/smtpd[107852]: 81GFE2083CH9: client=remote-server[192.168.100.25], sasl_method=LOGIN, sasl_username=user@tld I am not sure what is causing the cache to disappear in 5 min although I have set it to 1800s. Thank you.

3 2

GhettoForge is Moving
by Peter 20 Jul '25

20 Jul '25

For those of you who get dovecot from the GhettoForge repository please note that GhettoForge is moving to a new domain, GhettoForge.net. You will need to take some action in order to continue to receive dovecot updates from GhetttoForge. For further information please see: http://www.ghettoforge.net/index.php/Moving Peter

1 0

Building failures with 2.4.0 and 2.4.1 on MacOS: var_expand_crypt
by rmfuhrer＠optonline.net 18 Jul '25

18 Jul '25

I'm trying to build dovecot, both at tags 2.4.0 and 2.4.1, both failing with the same undefined-symbols link error. I've pulled the source from GitHub onto an Apple M2 Ultra Mac Studio running Sonoma 14.6.1. FWIW, I'm picking up various dependencies as packages from Homebrew via the CFLAGS and LDFLAGS args below. The prep steps before "make": $ ./autogen.sh $ CFLAGS="-I/opt/homebrew/include" LDFLAGS="-L/opt/homebrew/lib" ./configure --prefix=/opt/homebrew --with-bzlib --with-ldap --with-mysql --with-pam --with-sqlite --without-icu $ PATH="/opt/homebrew/opt/bison/bin:$PATH" make ... N.B.: The PATH tweak is solely intended to pick up a usable version (3.8.2) of bison, since the Xcode-supplied binary is too old (v2.3), and doesn't recognize certain cmdline flags. Also, getting even this far with 2.4.0 requires the "touch build-aux/config.rpath" workaround, and the 2-line patch to src/lib-http/http-server.h suggested on this thread: https://dovecot.org/mailman3/archives/list/dovecot@dovecot.org/thread/MFHSI…. Anyway, here's an excerpt of the build stdout/stderr. $ PATH="/opt/homebrew/opt/bison/bin:$PATH" make ... CCLD var_expand_crypt.la Undefined symbols for architecture arm64: "_binary_to_hex_append", referenced from: _var_expand_encrypt in var-expand-crypt.o _var_expand_encrypt in var-expand-crypt.o "_buffer_append", referenced from: _var_expand_crypt_settings in var-expand-crypt.o _var_expand_crypt_settings in var-expand-crypt.o "_buffer_append_c", referenced from: _str_append_c in var-expand-crypt.o ... ld: symbol(s) not found for architecture arm64 clang: error: linker command failed with exit code 1 (use -v to see invocation) make[3]: *** [var_expand_crypt.la] Error 1 make[2]: *** [all-recursive] Error 1 make[1]: *** [all-recursive] Error 1 make: *** [all] Error 2 $ Hopefully this is enough info to go on, but LMK if not.

3 6

Endless cycle of delete/expunge Outlook flagged messages.
by Mart Pirita 18 Jul '25

18 Jul '25

Hi, Suddenly I have a strange problem with the latest Outlook 365 (version 2506, build 16.0.1.18925.20076 64-bit) clients. When a user flags a message, they cannot remove the flag because Outlook gives an error message "The action cannot be performed because the message has been modified". One solution is to make the message unread and then remove the flag. However, since the moment a user flags a message for the first time, the maillog contains delete/expunge loop endlessly, for example: Jul 18 09:50:25 server dovecot: imap(user): delete: box=INBOX.Euro Brand, uid=2108, msgid=<GV1P195MB16414FAC3D4BAC6326F956048351A(a)GV1P195MB1641.EURP195.PROD.OUTLOOK.COM>, size=7597602, vsize=7698181, from="Masked User" <masked.user(a)somedomain.com>, subject=testing Jul 18 09:50:25 server dovecot: imap(user): expunge: box=INBOX.Euro Brand, uid=2108, msgid=<GV1P195MB16414FAC3D4BAC6326F956048351A(a)GV1P195MB1641.EURP195.PROD.OUTLOOK.COM>, size=7597602, vsize=7698181, from="Masked User" <masked.user(a)somedomain.com>, subject=testing Jul 18 09:50:27 server dovecot: imap(user): delete: box=INBOX.Euro Brand, uid=2109, msgid=<GV1P195MB16414FAC3D4BAC6326F956048351A(a)GV1P195MB1641.EURP195.PROD.OUTLOOK.COM>, size=7597628, vsize=7698214, from="Masked User" <masked.user(a)somedomain.com>, subject=testing Jul 18 09:50:27 server dovecot: imap(user): expunge: box=INBOX.Euro Brand, uid=2109, msgid=<GV1P195MB16414FAC3D4BAC6326F956048351A(a)GV1P195MB1641.EURP195.PROD.OUTLOOK.COM>, size=7597628, vsize=7698214, from="Masked User" <masked.user(a)somedomain.com>, subject=testing Jul 18 09:50:28 server dovecot: imap(user): delete: box=INBOX.Euro Brand, uid=2110, msgid=<GV1P195MB16414FAC3D4BAC6326F956048351A(a)GV1P195MB1641.EURP195.PROD.OUTLOOK.COM>, size=7597654, vsize=7698247, from="Masked User" <masked.user(a)somedomain.com>, subject=testing Jul 18 09:50:28 server dovecot: imap(user): expunge: box=INBOX.Euro Brand, uid=2110, msgid=<GV1P195MB16414FAC3D4BAC6326F956048351A(a)GV1P195MB1641.EURP195.PROD.OUTLOOK.COM>, size=7597654, vsize=7698247, from="Masked User" <masked.user(a)somedomain.com>, subject=testing ... So the message UID will change indefinitely forever. Is there any way to fix this with dovecot configuration? ### dovecot -n # 2.3.21.1 (d492236fa0): /etc/dovecot/dovecot.conf auth_cache_size = 1 k auth_failure_delay = 1 mins auth_mechanisms = plain login base_dir = /var/run/dovecot/ default_client_limit = 2000 default_process_limit = 500 disable_plaintext_auth = no dsync_features = no-header-hashes import_environment = TZ CORE_OUTOFMEM CORE_ERROR TZ=:/etc/localtime MALLOC_MMAP_THRESHOLD_=131072 listen = * login_greeting = login_log_format_elements = %u %r %m %c %k mail_location = maildir:~/Maildir mail_log_prefix = "%s(%u): " mail_plugins = " mail_log notify" mail_sort_max_read_count = 100 mailbox_list_index_very_dirty_syncs = yes maildir_very_dirty_syncs = yes passdb { args = dovecot driver = pam } plugin { autocreate2 = Sent Items autosubscribe2 = Sent Items mail_log_events = delete undelete expunge copy mailbox_delete mailbox_rename mail_log_fields = uid box msgid size from subject vsize } protocols = imap service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0666 user = postfix } } service imap-login { inet_listener imap { port = 0 } inet_listener imaps { port = 993 ssl = yes } process_min_avail = 1 } service imap { process_limit = 2048 vsz_limit = 1 G } ssl_ca = </etc/ssl/certs/mail.ca.crt ssl_cert = </etc/ssl/certs/mail.fullchain.cer ssl_cipher_list = kEECDH:+kEECDH+SHA:kEDH:+kEDH+SHA:+kEDH+CAMELLIA:kECDH:+kECDH+SHA:kRSA:+kRSA+SHA:+kRSA+CAMELLIA:!aNULL:!eNULL:!SSLv2:!RC4:!MD5:!DES:!EXP:!SEED:!IDEA:!3DES ssl_dh = # hidden, use -P to show it ssl_key = # hidden, use -P to show it ssl_min_protocol = TLSv1 ssl_prefer_server_ciphers = yes state_dir = /var/run/dovecot userdb { driver = passwd } protocol imap { imap_client_workarounds = tb-extra-mailbox-sep tb-lsub-flags delay-newmail imap_idle_notify_interval = 15 mins imap_logout_format = %{rip}, bytes=%i/%o, del=%{deleted} mail_max_userip_connections = 500 } -- Mart

1 0

Message Duplication
by Doug Hardie 17 Jul '25

17 Jul '25

I have a persistent, but infrequent situation where a message from a mail list will appear in the list of messages twice. The IDs are identical between the copies. There is only one copy of the email in the mailbox. It appears that there are two entries in some index. Apple's mail gets confused by this. If I delete the first entry, the second remains but is tagged as found in mailbox NULL. It cannot easily be deleted. My first thought was that sieve was saving two copies. So I pulled a copy of the original email and ran sieve-test on it. It is only saved once to the proper mailbox. I have not been able to determine if the problem is in Dovecot or Apple's mail app. From what I see, it could be either. I would appreciate any ideas on how to diagnose this further. Thanks, -- Doug

1 0

Unknown section name: sieve_script
by Odhiambo Washington 16 Jul '25

16 Jul '25

I have manually compiled and installed Dovecot from git on Ubuntu 24.04 server. I have then brought in a config from a running server - basically I copied the /etc/dovecot to this server and customized the params necessary. Now I am getting this error and I am not sure why: root@lists:/home/wash# doveconf -n # 0.0.0-35284+9240e3a438 (9240e3a438): /usr/local/etc/dovecot/dovecot.conf doveconf: Fatal: Error in configuration file /usr/local/etc/dovecot/dovecot.conf line 71: Unknown section name: sieve_script -- Best regards, Odhiambo WASHINGTON, Nairobi,KE +254 7 3200 0004/+254 7 2274 3223 In an Internet failure case, the #1 suspect is a constant: DNS. "Oh, the cruft.", egrep -v '^$|^.*#' ¯\_(ツ)_/¯ :-) [How to ask smart questions: http://www.catb.org/~esr/faqs/smart-questions.html] I have manually compiled and installed Dovecot from git on Ubuntu 24.04 server. I have then brought in a config from a running server - basically I copied the /etc/dovecot to this server and customized the params necessary. Now I am getting this error and I am not sure why: root@lists:/home/wash# doveconf -n # 0.0.0-35284+9240e3a438 (9240e3a438): /usr/local/etc/dovecot/dovecot.conf doveconf: Fatal: Error in configuration file /usr/local/etc/dovecot/dovecot.conf line 71: Unknown section name: sieve_script -- Best regards, Odhiambo WASHINGTON, Nairobi,KE +254 7 3200 0004/+254 7 2274 3223 In an Internet failure case, the #1 suspect is a constant: DNS. "Oh, the cruft.", egrep -v '^$|^.*#' -\_(Tu)_/- :-) [How to ask smart questions: [1]http://www.catb.org/~esr/faqs/smart-questions.html] References Visible links 1. http://www.catb.org/~esr/faqs/smart-questions.html

1 1

dovecot reload 2.4.1 => core dump
by Genes Lists 16 Jul '25

16 Jul '25

"systemctl reload docecot" crashed. systemctl start and restart work fine before and after the reload crash. Running on archlinux (using the arch dovecot 2.4.1 package). Probably about 15-20 connected clients at time of crash . Is this a known issue I wonder? thanks gene All I have at this point is systemd reported trace of the crash: Process 1381 (dovecot) of user 0 dumped core. Stack trace of thread 1381: #0 0x00007e78fad7ed1d n/a (libc.so.6 + 0x16ed1d) #1 0x00007e78fac758d8 n/a (libc.so.6 + 0x658d8) #2 0x00007e78fac99e2e n/a (libc.so.6 + 0x89e2e) #3 0x00007e78fac705d6 snprintf (libc.so.6 + 0x605d6) #4 0x00007e78fad271e1 n/a (libc.so.6 + 0x1171e1) #5 0x00007e78fad27943 __syslog_chk (libc.so.6 + 0x117943) #6 0x00007e78faf38ce5 n/a (libdovecot.so.0 + 0x138ce5) #7 0x00007e78faf36d4d n/a (libdovecot.so.0 + 0x136d4d) #8 0x00007e78faf3701e i_syslog_error_handler (libdovecot.so.0 + 0x13701e) #9 0x000058ca208bd7bf n/a (/usr/bin/dovecot + 0x87bf) #10 0x00007e78faf355e6 i_warning (libdovecot.so.0 + 0x1355e6) #11 0x000058ca208c79fa n/a (/usr/bin/dovecot + 0x129fa) #12 0x00007e78faf5b698 n/a (libdovecot.so.0 + 0x15b698) #13 0x00007e78faf536e4 io_loop_call_io (libdovecot.so.0 + 0x1536e4) #14 0x00007e78faf54c8b io_loop_handler_run_internal (libdovecot.so.0 + 0x154c8b) #15 0x00007e78faf54d47 io_loop_handler_run (libdovecot.so.0 + 0x154d47) #16 0x00007e78faf54f49 io_loop_run (libdovecot.so.0 + 0x154f49) #17 0x00007e78fae9fc00 master_service_run (libdovecot.so.0 + 0x9fc00) #18 0x000058ca208bd017 main (/usr/bin/dovecot + 0x8017) #19 0x00007e78fac376b5 n/a (libc.so.6 + 0x276b5) #20 0x00007e78fac37769 __libc_start_main (libc.so.6 + 0x27769) #21 0x000058ca208bd605 _start (/usr/bin/dovecot + 0x8605) ELF object binary architecture: AMD x86-64 -- Gene "systemctl reload docecot" crashed. systemctl start and restart work fine before and after the reload crash. Running on archlinux (using the arch dovecot 2.4.1 package). Probably about 15-20 connected clients at time of crash . Is this a known issue I wonder? thanks gene All I have at this point is systemd reported trace of the crash: Process 1381 (dovecot) of user 0 dumped core. Stack trace of thread 1381: #0 0x00007e78fad7ed1d n/a (libc.so.6 + 0x16ed1d) #1 0x00007e78fac758d8 n/a (libc.so.6 + 0x658d8) #2 0x00007e78fac99e2e n/a (libc.so.6 + 0x89e2e) #3 0x00007e78fac705d6 snprintf (libc.so.6 + 0x605d6) #4 0x00007e78fad271e1 n/a (libc.so.6 + 0x1171e1) #5 0x00007e78fad27943 __syslog_chk (libc.so.6 + 0x117943) #6 0x00007e78faf38ce5 n/a (libdovecot.so.0 + 0x138ce5) #7 0x00007e78faf36d4d n/a (libdovecot.so.0 + 0x136d4d) #8 0x00007e78faf3701e i_syslog_error_handler (libdovecot.so.0 + 0x13701e) #9 0x000058ca208bd7bf n/a (/usr/bin/dovecot + 0x87bf) #10 0x00007e78faf355e6 i_warning (libdovecot.so.0 + 0x1355e6) #11 0x000058ca208c79fa n/a (/usr/bin/dovecot + 0x129fa) #12 0x00007e78faf5b698 n/a (libdovecot.so.0 + 0x15b698) #13 0x00007e78faf536e4 io_loop_call_io (libdovecot.so.0 + 0x1536e4) #14 0x00007e78faf54c8b io_loop_handler_run_internal (libdovecot.so.0 + 0x154c8b) #15 0x00007e78faf54d47 io_loop_handler_run (libdovecot.so.0 + 0x154d47) #16 0x00007e78faf54f49 io_loop_run (libdovecot.so.0 + 0x154f49) #17 0x00007e78fae9fc00 master_service_run (libdovecot.so.0 + 0x9fc00) #18 0x000058ca208bd017 main (/usr/bin/dovecot + 0x8017) #19 0x00007e78fac376b5 n/a (libc.so.6 + 0x276b5) #20 0x00007e78fac37769 __libc_start_main (libc.so.6 + 0x27769) #21 0x000058ca208bd605 _start (/usr/bin/dovecot + 0x8605) ELF object binary architecture: AMD x86-64 -- Gene

2 3

Any planned 2.4.2 release date
by Andreas Haerter 14 Jul '25

14 Jul '25

Hi, I am currently planning the migration from Dovecot 2.3 to 2.4 and was wondering if version 2.4.2 is just around the corner (and it therefore might make sense to wait a few more days). Is there any planned schedule or does it still make sense to migrate to 2.4.1 within the next ~14 days? -- Regards, Andreas Haerter foundata GmbH Steinhäuserstr. 20 76135 Karlsruhe Sitz der Gesellschaft: Karlsruhe Registergericht: Amtsgericht Mannheim, HRB 714807 Geschäftsführung: Andreas Haerter USt-IdNr.: DE284122682

10 20

Access to deleted emails
by Kamil Jońca 14 Jul '25

14 Jul '25

Some time ago I mistakenly delete a lot of emails (mdbox storage) I was able to recover them with command like: --8<---------------cut here---------------start------------->8--- doveadm import mdbox_deleted:~/Mail/0 "" ALL --8<---------------cut here---------------end--------------->8--- But now, with I get: --8<---------------cut here---------------start------------->8--- %doveadm import -u kjonca mdbox_deleted:~/Mail/0 "" ALL doveadm(kjonca): Fatal: Import namespace initialization failed: mdbox_deleted: mdbox: mailbox_root_directory_name must not be empty --8<---------------cut here---------------end--------------->8--- How can I restore mails? KJ -- http://wolnelektury.pl/wesprzyj/teraz/ Hartley's First Law: You can lead a horse to water, but if you can get him to float on his back, you've got something.

1 0

Better 2.4.x docs?
by Steve Litt 13 Jul '25

13 Jul '25

Are you planning to improve your Dovecot 2.4.x documentation? The current 2.4.x documentation has: * Non-obvious links between 2.4.x and 2.3.x * Some 2.3.x specific grammar * Almost no examples * 2.4.x material is scattered across many pages * Contains a few inaccuracies * Contains some contradictions 2.4.x is such a huge change that it should have its own, standalone documentation tree exclusively for 2.4.x. This tree should have a different color scheme than your other docs so people know at a glance exactly what they're looking at. You could have a page devoted to often used dovecot.conf content, with numerous examples, documented as if there had never been an earlier version. You could have a page devoted to conversion of 2.3.x dovecot.conf to 2.4.x, once again, with numerous examples. Another page with more exotic dovecot.conf content, with numerous examples. Another page discussing the 2.3.x features that don't appear in 2.4.x, what capabilities that takes away, and how best to cobble together those capabilities for those who don't want Dovecot Professional. Another page for brand new capabilities of 2.4.x. Thanks, SteveT Steve Litt http://444domains.com

4 5

Dovecot 2.4 migration / passwd authentication
by John 12 Jul '25

12 Jul '25

Hello, I have problem getting passwd/userdb to work on 2.4. Debian 13 Trixie, Exim4, Dovecot 2.4.0. pop3, lmtp On a 2.3 system I could use: passdb { driver=passwd-file args = /etc/dovecot/passwd } userdb { driver=static args = uid=vmail gid=vmail home=/home/vmail/%u } service lmtp { unix_listener lmtp { } } passwd looks like this: test@onedomain.tlda:{BLF-CRYPT}$2y$05$[encoded] test@domain.tld:{ARGON2ID}$argon2id$v=19$m=65536,t=3,p=1$[encoded] test@two-domain.tldb:{ARGON2ID}$argon2id$v=19$m=65536,t=3,p=1$[encoded] I want to keep the passwd file as is, no extra fields. mail_uid = vmail mail_gid = vmail mail_home = /var/vmail/%{user} mail_driver = maildir mail_path = /home/vmail/%{user}/Maildir pop3_uidl_format = %{guid} passdb passwd-file { driver=passwd-file } userdb static { driver=static } Directory /var/vmail/test(a)domain.tld exists (empty). This doesn't work. Error messages: Exim log - attempt to deliver message: ** test(a)domain.tld R=dovecot_myrouter_lmtp T=dovecot_transport_lmtp: LMTP error after RCPT TO:<test(a)domain.tld>: 550 5.1.1 <test(a)domain.tld> User doesn't exist: test(a)domain.tld Dovecot debug log: master: Info: Dovecot v2.4.1-4 (7d8c0e5759) starting up for pop3, lmtp (core dumps disabled) auth(info): Info: passwd-file: unknown user - trying the next passdb lmtp(16933): Debug: Effective uid=0, gid=0, home=/run/dovecot/empty lmtp(16933): Debug: none: root=/home/vmail/raw-mail-user/Maildir, index=, indexpvt=, control=, inbox=, alt= lmtp(test(a)domain.tld)<16933><[some_string]>: Debug: auth-master: userdb lookup(test(a)domain.tld): Started userdb lookup lmtp(test(a)domain.tld)<16933><[some_string]>: Debug: auth-master: conn unix:/run/dovecot/auth-userdb: Connecting lmtp(test(a)domain.tld)<16933><[some_string]>: Debug: auth-master: conn unix:/run/dovecot/auth-userdb (pid=16922,uid=0): Client connected (fd=16) lmtp(test(a)domain.tld)<16933><[some_string]>: Debug: auth-master: conn unix:/run/dovecot/auth-userdb (pid=16922,uid=0): auth input: lmtp(test(a)domain.tld)<16933><[some_string]>: Debug: auth-master: userdb lookup(test(a)domain.tld): auth USER input: lmtp(test(a)domain.tld)<16933><[some_string]>: Debug: auth-master: userdb lookup(test(a)domain.tld): Userdb lookup failed lmtp(16933): Debug: User session is finished # doveadm user test(a)domain.tld field value uid vmail gid vmail home /home/vmail/test(a)domain.tld mail_path /home/vmail/test(a)domain.tld/Maildir How can this be fixed? Thank you for any help! John Sent with Proton Mail secure email.

2 3

Doveadm HTTP API authCacheFlush error
by Ricardo Machini 08 Jul '25

08 Jul '25

Hello, I'm getting a fatal error when I try to run the authCacheFlush command via the doveadm HTTP API. Example of the call: curl -u user:password -X POST http://localhost:9010/doveadm/v1 -H "Content-Type: application/json" -d '[["authCacheFlush",{"user":"username"},"tag1"]]' Fatal error: doveadm(::1): Panic: file doveadm-cmd-parse.c: line 120 (doveadm_cmd_param_str): assertion failed: (param->type == CMD_PARAM_STR) doveadm(::1): Error: Raw backtrace: #0 test_subprocess_fork[0x7fc5fd934a70] -> #1 backtrace_append[0x7fc5fd934d10] -> #2 backtrace_get[0x7fc5fd934eb0] -> #3 event_filter_register_cmp[0x7fc5fd93ea50] -> #4 i_syslog_fatal_handler[0x7fc5fd93eb80] -> #5 i_panic[0x7fc5fd86eca3] -> #6 [unw_get_proc_name() failed: -10] -> #7 http_server_connection_shut_down[0x7fc5fd8dd1b0] -> #8 io_loop_call_io[0x7fc5fd959a40] -> #9 io_loop_handler_run_internal[0x7fc5fd95ad80] -> #10 io_loop_handler_run[0x7fc5fd95af20] -> #11 io_loop_run[0x7fc5fd95b110] -> #12 master_service_run[0x7fc5fd8af640] -> #13 main[0x5593ce2ab3d0] -> #14 __libc_start_call_main[0x7fc5fd429550] -> #15 __libc_start_main[0x7fc5fd429600] -> #16 _start[0x5593ce2ab5c0] doveadm(::1): Fatal: master: service(doveadm): child 168532 killed with signal 6 (core dumped) Regards, Ricardo Hello, I'm getting a fatal error when I try to run the authCacheFlush command via the doveadm HTTP API. Example of the call: curl -u user:password -X POST [1]http://localhost:9010/doveadm/v1 -H "Content-Type: application/json" -d '[["authCacheFlush",{"user":"username"},"tag1"]]' Fatal error: doveadm(::1): Panic: file doveadm-cmd-parse.c: line 120 (doveadm_cmd_param_str): assertion failed: (param->type == CMD_PARAM_STR) doveadm(::1): Error: Raw backtrace: #0 test_subprocess_fork[0x7fc5fd934a70] -> #1 backtrace_append[0x7fc5fd934d10] -> #2 backtrace_get[0x7fc5fd934eb0] -> #3 event_filter_register_cmp[0x7fc5fd93ea50] -> #4 i_syslog_fatal_handler[0x7fc5fd93eb80] -> #5 i_panic[0x7fc5fd86eca3] -> #6 [unw_get_proc_name() failed: -10] -> #7 http_server_connection_shut_down[0x7fc5fd8dd1b0] -> #8 io_loop_call_io[0x7fc5fd959a40] -> #9 io_loop_handler_run_internal[0x7fc5fd95ad80] -> #10 io_loop_handler_run[0x7fc5fd95af20] -> #11 io_loop_run[0x7fc5fd95b110] -> #12 master_service_run[0x7fc5fd8af640] -> #13 main[0x5593ce2ab3d0] -> #14 __libc_start_call_main[0x7fc5fd429550] -> #15 __libc_start_main[0x7fc5fd429600] -> #16 _start[0x5593ce2ab5c0] doveadm(::1): Fatal: master: service(doveadm): child 168532 killed with signal 6 (core dumped) Regards, Ricardo References Visible links 1. http://localhost:9010/doveadm/v1

1 0

Re: How to require client SSL certificate, except for local connections
by Nikolaos Chatzikonstantinou 08 Jul '25

08 Jul '25

Hello all, Is there a solution to this message: <https://dovecot.org/list/dovecot/2017-October/109576.html>? Regards, Nikolaos Chatzikonstantinou

1 0

Access issue with public/shared mailboxes after migrating to v2.4.x
by Juergen Edner 08 Jul '25

08 Jul '25

Hi all, I'm currently trying to get my public/shared mailbox access working again after migration to 2.4.1. I thought I would have done all required changes, but Dovecot 2.4.1 seems to act slightly different than 2.3.x. I've tried to understand what is wrong, read the documentation multiple times and searched the internet for a solution, but unfortunately without final success. I hope you can shed some light on how to get the original behavior back. Let me explain my original setup, which worked for years without any issues. I've setup the following shared folders as an adminstrator and set the access right on a directly level, e.g. /home/imapshared imapshared:users 0770 /home/imapshared/.Parents imapshared:parents 0770 /home/imapshared/.Kids imapshared:kids 0770 This was my working Dovecot 2.3 configuration: namespace { type = shared separator = / prefix = '#Shared/' location = maildir:/home/imapshared:INDEXPVT=~/.imapmail/shared subscriptions = no } User, who were allowed to access the folder, got e.g. the 'parents' or 'kids' group assigned as secondary group, the primary one is 'users'. Based on the documentation I've modified the Dovecot 2.4 configuration as follows: namespace shared { type = shared mail_driver = maildir separator = / prefix = '#Shared/' mail_path = /home/imapshared mail_index_private_path = ~/.imapmail/shared subscriptions = no } This is what I already found out or tried to adjust: - I found out that the shared folder can be accessed if the shared folder system group is set to 'users' (primary group), but by default not if a system group is used which is the secondary group of a user (e.g. parents or kids) - In the documentation I found a hint, that Dovecot by default would now only accept the primary group. By setting the following parameter additional groups should also be accepted: mail_access_groups = yes Unfortunately, that doesn't restore the orinal functionality. - In the documentation I found a hint, that all folders which have been created by an administrator, should now be of type 'public' but changing that setting doesn't work either. "It's important that the namespace type is "public" regardless of whether you set the namespace prefix to "shared." or something else." This is the error which is logged, which is not true: Error: maildir: stat(/home/imapshared/.Parents/tmp) failed: Permission denied (euid=2000(father) egid=100(users) missing +x perm: /home/imapshared/.Parents, we're not in group 203(parents), dir owned by 2226:203 mode=0770) This is the user used to access the folder: uid=2000(father) gid=100(users) groups=100(users), ..., 203(parents), ... Do you have any idea or hint how to solve this issue and provide an example what needs to be modified in my configuration to get the original functionality back? Thanks Juergen -- Mail: juergen.edner(a)telejeck.de GPG Key available -- Mail: juergen(a)eisfair.org

1 0

Pigeonhole releases
by Aleksandr Mezin 07 Jul '25

07 Jul '25

Hi. I've been using https://pigeonhole.dovecot.org/releases/2.4/ to monitor when new releases are published. Now that URL suddenly returns 403. Was it an intentional change? Why? Also, https://pigeonhole.dovecot.org/download.html still points to v2.4.0 https://pigeonhole.dovecot.org/releases/2.4/dovecot-pigeonhole-2.4.0.tar.gz as the latest release. Even though a newer v2.4.1-4 https://pigeonhole.dovecot.org/releases/2.4/dovecot-pigeonhole-2.4.1-4.tar.… was published more than 2 months ago. Also, is it v2.4.1-4 or v2.4.1? The Git tag is `2.4.1` https://github.com/dovecot/pigeonhole/releases/tag/2.4.1 but the attached tarball name ends with `-2.4.1-4` (as well as the name of the tarball on https://pigeonhole.dovecot.org/releases/) What does the `-4` suffix mean? Will it be present in future versions?

2 1

Re: USERDB/LDAP fails if attribute doesn't exist
by ricardomachini＠gmail.com 06 Jul '25

06 Jul '25

Same problem here. I would like to set some default value when attribute is not found on LDAP. Luis, did you find out how to solve it? Regards, Ricardo Same problem = here. I would like = to set some default value when attribute is not found on = LDAP. Luis, did you find out how to solve = it? Regards, Ricardo

1 0

pigeonhole permission errors regarding bin_path
by jasper＠jappie.dev 06 Jul '25

06 Jul '25

Hi, While trying to use the `sieve_script_bin_path` option to have Pigeonhole auto-create directories for compiled sieve scripts, I ran into some permission issues: "Error: sieve: binary /run/dovecot2/sieve/jasper/84lkfddk8d88ib7zh3zh6hmy5lrvn54x-after.svbin: save: failed to create temporary file: open(/run/dovecot2/sieve/jasper/84lkfddk8d88ib7zh3zh6hmy5lrvn54x-after.svbin.) failed: Permission denied (euid=986(dovemail) egid=985(dovemail) missing +w perm: /run/dovecot2/sieve/jasper, dir owner missing perms)" I'm using `bin_path` like this: `sieve_script_bin_path = "/run/dovecot2/sieve/%{user|username|lower}";` and the permissions of the `sieve` directory are as follows: ``` $ ls -lah sieve total 0 drwxr-xrwx 3 root root 60 Jul 5 13:01 . drwxr-xr-x 10 root root 780 Jul 5 13:00 .. dr-xr-xr-x 2 dovemail dovemail 40 Jul 5 13:01 jasper ``` `strace`ing Dovecot shows that it uses `0555` when creating this directory (but not before setting `umask` to `000`?): ``` 260940 newfstatat(AT_FDCWD</var/vmail/jappie.dev/jasper>, "/run/dovecot2/sieve/jasper", 0x7fff4306af00, 0) = -1 ENOENT (No such file or directory) 260940 umask(000) = 077 260940 mkdir("/run/dovecot2/sieve/jasper", 0555) = 0 260940 umask(077) = 000 ``` I also tried patching Pigeonhole's source to log the value of `mode`: ``` diff --git a/src/lib-sieve/sieve-storage.c b/src/lib-sieve/sieve-storage.c index e68fe39f..4c7a081f 100644 --- a/src/lib-sieve/sieve-storage.c +++ b/src/lib-sieve/sieve-storage.c @@ -887,6 +887,6 @@ int sieve_storage_setup_bin_path(struct sieve_storage *storage, mode_t mode) if (mkdir_parents(bin_path, mode) == 0) { e_debug(storage->event, - "Created directory for binaries: %s", bin_path); + "Created directory for binaries: %s %u", bin_path, mode); return 1; } ``` and this logged `365`, which - if I understand `mode_t` correctly - corresponds to `-wxrw-r-x`: ``` Debug: sieve: storage after: file: Created directory for binaries: /run/dovecot2/sieve/jasper 365 ``` Needless to say, I'm a little confused as to what's going on here - am I missing something or does this look like a Pigeonhole / Dovecot bug? Kind regards, - Jasper Full log: ``` dovecot[260506]: lmtp(260940): Connect from local dovecot[260506]: lmtp(260940): Debug: auth-master: passdb lookup(jasper(a)jappie.dev): Started passdb lookup dovecot[260506]: lmtp(260940): Debug: auth-master: conn unix:/run/dovecot2/auth-userdb: Connecting dovecot[260506]: lmtp(260940): Debug: auth-master: conn unix:/run/dovecot2/auth-userdb (pid=260501,uid=0): Client connected (fd=14) dovecot[260506]: lmtp(260940): Debug: auth-master: conn unix:/run/dovecot2/auth-userdb (pid=260501,uid=0): auth input: user=jasper(a)jappie.dev dovecot[260506]: lmtp(260940): Debug: auth-master: passdb lookup(jasper(a)jappie.dev): auth PASS input: user=jasper(a)jappie.dev dovecot[260506]: lmtp(260940): Debug: auth-master: passdb lookup(jasper(a)jappie.dev): Finished passdb lookup (user=jasper(a)jappie.dev) dovecot[260506]: lmtp(jasper(a)jappie.dev)<260940><3P0ZDyQGaWhM+wMAbxW+ag>: Debug: auth-master: userdb lookup(jasper(a)jappie.dev): Started userdb lookup dovecot[260506]: lmtp(jasper(a)jappie.dev)<260940><3P0ZDyQGaWhM+wMAbxW+ag>: Debug: auth-master: conn unix:/run/dovecot2/auth-userdb (pid=260501,uid=0): auth input: jasper(a)jappie.dev dovecot[260506]: lmtp(jasper(a)jappie.dev)<260940><3P0ZDyQGaWhM+wMAbxW+ag>: Debug: auth-master: userdb lookup(jasper(a)jappie.dev): auth USER input: jasper(a)jappie.dev dovecot[260506]: lmtp(jasper(a)jappie.dev)<260940><3P0ZDyQGaWhM+wMAbxW+ag>: Debug: auth-master: userdb lookup(jasper(a)jappie.dev): Finished userdb lookup (username=jasper(a)jappie.dev ) dovecot[260506]: lmtp(260940): Debug: Mailbox <lmtp DATA local>: Mailbox opened dovecot[260506]: lmtp(jasper(a)jappie.dev)<260940><3P0ZDyQGaWhM+wMAbxW+ag>: Debug: Effective uid=986, gid=985, home=/var/vmail/jappie.dev/jasper dovecot[260506]: lmtp(jasper(a)jappie.dev)<260940><3P0ZDyQGaWhM+wMAbxW+ag>: Debug: open(/proc/self/io) failed: Permission denied (euid=986(dovemail) egid=985(dovemail) missing +r perm: /proc/self/io) dovecot[260506]: lmtp(jasper(a)jappie.dev)<260940><3P0ZDyQGaWhM+wMAbxW+ag>: Debug: Namespace inbox: type=private, prefix=, sep=, inbox=yes, hidden=no, list=yes, subscriptions=yes dovecot[260506]: lmtp(jasper(a)jappie.dev)<260940><3P0ZDyQGaWhM+wMAbxW+ag>: Debug: maildir++: root=/var/vmail/jappie.dev/jasper/mail, index=, indexpvt=, control=, inbox=/var/vmail/jappie.dev/jasper/mail, alt= dovecot[260506]: lmtp(jasper(a)jappie.dev)<260940><3P0ZDyQGaWhM+wMAbxW+ag>: Debug: Mailbox <lmtp DATA local>: Adding field hdr.From to cache for the first time (uid=1) dovecot[260506]: lmtp(jasper(a)jappie.dev)<260940><3P0ZDyQGaWhM+wMAbxW+ag>: Debug: Mailbox <lmtp DATA local>: Adding field hdr.Message-ID to cache for the first time (uid=1) dovecot[260506]: lmtp(jasper(a)jappie.dev)<260940><3P0ZDyQGaWhM+wMAbxW+ag>: Debug: Mailbox <lmtp DATA local>: Adding field hdr.Return-Path to cache for the first time (uid=1) dovecot[260506]: lmtp(jasper(a)jappie.dev)<260940><3P0ZDyQGaWhM+wMAbxW+ag>: Debug: Mailbox <lmtp DATA local>: Adding field hdr.Subject to cache for the first time (uid=1) dovecot[260506]: lmtp(jasper(a)jappie.dev)<260940><3P0ZDyQGaWhM+wMAbxW+ag>: Debug: Mailbox <lmtp DATA local>: Adding field hdr.To to cache for the first time (uid=1) dovecot[260506]: lmtp(jasper(a)jappie.dev)<260940><3P0ZDyQGaWhM+wMAbxW+ag>: Debug: Local delivery started dovecot[260506]: lmtp(jasper(a)jappie.dev)<260940><3P0ZDyQGaWhM+wMAbxW+ag>: Debug: duplicate db: Initialize dovecot[260506]: lmtp(jasper(a)jappie.dev)<260940><3P0ZDyQGaWhM+wMAbxW+ag>: Debug: sieve: Pigeonhole version 2.4.0 (1b2d5bb9) initializing dovecot[260506]: lmtp(jasper(a)jappie.dev)<260940><3P0ZDyQGaWhM+wMAbxW+ag>: Debug: sieve: storage after: file: Directory for binaries: /run/dovecot2/sieve/jasper dovecot[260506]: lmtp(jasper(a)jappie.dev)<260940><3P0ZDyQGaWhM+wMAbxW+ag>: Debug: sieve: storage after: file: Using Sieve script path: /nix/store/84lkfddk8d88ib7zh3zh6hmy5lrvn54x-after.sieve dovecot[260506]: lmtp(jasper(a)jappie.dev)<260940><3P0ZDyQGaWhM+wMAbxW+ag>: Debug: sieve: storage after: file: script '84lkfddk8d88ib7zh3zh6hmy5lrvn54x-after': Opened from 'after' dovecot[260506]: lmtp(jasper(a)jappie.dev)<260940><3P0ZDyQGaWhM+wMAbxW+ag>: Debug: sieve: Using the following personal Sieve script: after/84lkfddk8d88ib7zh3zh6hmy5lrvn54x-after dovecot[260506]: lmtp(jasper(a)jappie.dev)<260940><3P0ZDyQGaWhM+wMAbxW+ag>: Debug: sieve: multi-script: Start execute sequence dovecot[260506]: lmtp(jasper(a)jappie.dev)<260940><3P0ZDyQGaWhM+wMAbxW+ag>: Debug: sieve: Opening script 1 of 1 from 'after/84lkfddk8d88ib7zh3zh6hmy5lrvn54x-after' dovecot[260506]: lmtp(jasper(a)jappie.dev)<260940><3P0ZDyQGaWhM+wMAbxW+ag>: Debug: sieve: Loading script after/84lkfddk8d88ib7zh3zh6hmy5lrvn54x-after dovecot[260506]: lmtp(jasper(a)jappie.dev)<260940><3P0ZDyQGaWhM+wMAbxW+ag>: Debug: sieve: storage after: file: script '84lkfddk8d88ib7zh3zh6hmy5lrvn54x-after': Opened script for reading dovecot[260506]: lmtp(jasper(a)jappie.dev)<260940><3P0ZDyQGaWhM+wMAbxW+ag>: Debug: sieve: Script 'after/84lkfddk8d88ib7zh3zh6hmy5lrvn54x-after' successfully compiled dovecot[260506]: lmtp(jasper(a)jappie.dev)<260940><3P0ZDyQGaWhM+wMAbxW+ag>: Debug: sieve: storage after: file: Created directory for binaries: /run/dovecot2/sieve/jasper 365 dovecot[260506]: lmtp(jasper(a)jappie.dev)<260940><3P0ZDyQGaWhM+wMAbxW+ag>: Debug: sieve: storage after: file: script '84lkfddk8d88ib7zh3zh6hmy5lrvn54x-after': Saving binary to '/run/dovecot2/sieve/jasper/84lkfddk8d88ib7zh3zh6hmy5lrvn54x-after.svbin' dovecot[260506]: lmtp(jasper(a)jappie.dev)<260940><3P0ZDyQGaWhM+wMAbxW+ag>: Error: sieve: binary /run/dovecot2/sieve/jasper/84lkfddk8d88ib7zh3zh6hmy5lrvn54x-after.svbin: save: failed to create temporary file: open(/run/dovecot2/sieve/jasper/84lkfddk8d88ib7zh3zh6hmy5lrvn54x-after.svbin.) failed: Permission denied (euid=986(dovemail) egid=985(dovemail) missing +w perm: /run/dovecot2/sieve/jasper, dir owner missing perms) dovecot[260506]: lmtp(jasper(a)jappie.dev)<260940><3P0ZDyQGaWhM+wMAbxW+ag>: Debug: sieve: Executing script from 'after/84lkfddk8d88ib7zh3zh6hmy5lrvn54x-after' dovecot[260506]: lmtp(jasper(a)jappie.dev)<260940><3P0ZDyQGaWhM+wMAbxW+ag>: Debug: sieve: multi-script: Run script 'after/84lkfddk8d88ib7zh3zh6hmy5lrvn54x-after' dovecot[260506]: lmtp(jasper(a)jappie.dev)<260940><3P0ZDyQGaWhM+wMAbxW+ag>: Debug: sieve: Started running script 'after/84lkfddk8d88ib7zh3zh6hmy5lrvn54x-after' dovecot[260506]: lmtp(jasper(a)jappie.dev)<260940><3P0ZDyQGaWhM+wMAbxW+ag>: Debug: sieve: Finished running script 'after/84lkfddk8d88ib7zh3zh6hmy5lrvn54x-after' (status=ok, resource usage: no usage recorded) dovecot[260506]: lmtp(jasper(a)jappie.dev)<260940><3P0ZDyQGaWhM+wMAbxW+ag>: Debug: sieve: multi-script: Execute result dovecot[260506]: lmtp(jasper(a)jappie.dev)<260940><3P0ZDyQGaWhM+wMAbxW+ag>: Debug: sieve: msgid=<E62D66EA-D095-4EBC-AFFE-640FB6824F45(a)jappie.dev>: Executing result (status=ok, commit=no) dovecot[260506]: lmtp(jasper(a)jappie.dev)<260940><3P0ZDyQGaWhM+wMAbxW+ag>: Debug: sieve: msgid=<E62D66EA-D095-4EBC-AFFE-640FB6824F45(a)jappie.dev>: Starting execution of actions dovecot[260506]: lmtp(jasper(a)jappie.dev)<260940><3P0ZDyQGaWhM+wMAbxW+ag>: Debug: sieve: msgid=<E62D66EA-D095-4EBC-AFFE-640FB6824F45(a)jappie.dev>: Executing actions dovecot[260506]: lmtp(jasper(a)jappie.dev)<260940><3P0ZDyQGaWhM+wMAbxW+ag>: Debug: sieve: msgid=<E62D66EA-D095-4EBC-AFFE-640FB6824F45(a)jappie.dev>: Executed explicit keep dovecot[260506]: lmtp(jasper(a)jappie.dev)<260940><3P0ZDyQGaWhM+wMAbxW+ag>: Debug: sieve: msgid=<E62D66EA-D095-4EBC-AFFE-640FB6824F45(a)jappie.dev>: Finished executing actions (status=ok, keep=explicit, executed=no) dovecot[260506]: lmtp(jasper(a)jappie.dev)<260940><3P0ZDyQGaWhM+wMAbxW+ag>: Debug: sieve: msgid=<E62D66EA-D095-4EBC-AFFE-640FB6824F45(a)jappie.dev>: Finished executing result (no commit, status=ok, keep=yes) dovecot[260506]: lmtp(jasper(a)jappie.dev)<260940><3P0ZDyQGaWhM+wMAbxW+ag>: Debug: sieve: multi-script: Sequence active dovecot[260506]: lmtp(jasper(a)jappie.dev)<260940><3P0ZDyQGaWhM+wMAbxW+ag>: Debug: sieve: multi-script: Finishing sequence (status=ok) dovecot[260506]: lmtp(jasper(a)jappie.dev)<260940><3P0ZDyQGaWhM+wMAbxW+ag>: Debug: sieve: msgid=<E62D66EA-D095-4EBC-AFFE-640FB6824F45(a)jappie.dev>: Executing result (status=ok, commit=yes) dovecot[260506]: lmtp(jasper(a)jappie.dev)<260940><3P0ZDyQGaWhM+wMAbxW+ag>: Debug: sieve: msgid=<E62D66EA-D095-4EBC-AFFE-640FB6824F45(a)jappie.dev>: Starting execution of actions dovecot[260506]: lmtp(jasper(a)jappie.dev)<260940><3P0ZDyQGaWhM+wMAbxW+ag>: Debug: sieve: msgid=<E62D66EA-D095-4EBC-AFFE-640FB6824F45(a)jappie.dev>: Executing actions dovecot[260506]: lmtp(jasper(a)jappie.dev)<260940><3P0ZDyQGaWhM+wMAbxW+ag>: Debug: sieve: msgid=<E62D66EA-D095-4EBC-AFFE-640FB6824F45(a)jappie.dev>: Finished executing actions (status=ok, keep=implicit, executed=no) dovecot[260506]: lmtp(jasper(a)jappie.dev)<260940><3P0ZDyQGaWhM+wMAbxW+ag>: Debug: sieve: msgid=<E62D66EA-D095-4EBC-AFFE-640FB6824F45(a)jappie.dev>: Found deferred keep action dovecot[260506]: lmtp(jasper(a)jappie.dev)<260940><3P0ZDyQGaWhM+wMAbxW+ag>: Debug: sieve: msgid=<E62D66EA-D095-4EBC-AFFE-640FB6824F45(a)jappie.dev>: Execute implicit keep (status=ok) dovecot[260506]: lmtp(jasper(a)jappie.dev)<260940><3P0ZDyQGaWhM+wMAbxW+ag>: Debug: sieve: msgid=<E62D66EA-D095-4EBC-AFFE-640FB6824F45(a)jappie.dev>: Start storing into mailbox INBOX dovecot[260506]: lmtp(jasper(a)jappie.dev)<260940><3P0ZDyQGaWhM+wMAbxW+ag>: Debug: sieve: msgid=<E62D66EA-D095-4EBC-AFFE-640FB6824F45(a)jappie.dev>: Executing implicit keep action dovecot[260506]: lmtp(jasper(a)jappie.dev)<260940><3P0ZDyQGaWhM+wMAbxW+ag>: Debug: sieve: msgid=<E62D66EA-D095-4EBC-AFFE-640FB6824F45(a)jappie.dev>: Execute storing into mailbox 'INBOX' dovecot[260506]: lmtp(jasper(a)jappie.dev)<260940><3P0ZDyQGaWhM+wMAbxW+ag>: Debug: Mailbox INBOX: Mailbox opened dovecot[260506]: lmtp(jasper(a)jappie.dev)<260940><3P0ZDyQGaWhM+wMAbxW+ag>: Debug: sieve: msgid=<E62D66EA-D095-4EBC-AFFE-640FB6824F45(a)jappie.dev>: Saving to mailbox 'INBOX' successful so far dovecot[260506]: lmtp(jasper(a)jappie.dev)<260940><3P0ZDyQGaWhM+wMAbxW+ag>: Debug: sieve: msgid=<E62D66EA-D095-4EBC-AFFE-640FB6824F45(a)jappie.dev>: Finished executing implicit keep action (status=ok) dovecot[260506]: lmtp(jasper(a)jappie.dev)<260940><3P0ZDyQGaWhM+wMAbxW+ag>: Debug: sieve: msgid=<E62D66EA-D095-4EBC-AFFE-640FB6824F45(a)jappie.dev>: Finalizing actions dovecot[260506]: lmtp(jasper(a)jappie.dev)<260940><3P0ZDyQGaWhM+wMAbxW+ag>: Debug: sieve: msgid=<E62D66EA-D095-4EBC-AFFE-640FB6824F45(a)jappie.dev>: Finished finalizing actions (status=ok, keep=implicit, committed=no) dovecot[260506]: lmtp(jasper(a)jappie.dev)<260940><3P0ZDyQGaWhM+wMAbxW+ag>: Debug: sieve: msgid=<E62D66EA-D095-4EBC-AFFE-640FB6824F45(a)jappie.dev>: Finalize implicit keep (status=ok) dovecot[260506]: lmtp(jasper(a)jappie.dev)<260940><3P0ZDyQGaWhM+wMAbxW+ag>: Debug: sieve: msgid=<E62D66EA-D095-4EBC-AFFE-640FB6824F45(a)jappie.dev>: Finalize implicit keep action(status=ok, action_status=ok, commit_status=ok) dovecot[260506]: lmtp(jasper(a)jappie.dev)<260940><3P0ZDyQGaWhM+wMAbxW+ag>: Debug: sieve: msgid=<E62D66EA-D095-4EBC-AFFE-640FB6824F45(a)jappie.dev>: Commit implicit keep action dovecot[260506]: lmtp(jasper(a)jappie.dev)<260940><3P0ZDyQGaWhM+wMAbxW+ag>: Debug: sieve: msgid=<E62D66EA-D095-4EBC-AFFE-640FB6824F45(a)jappie.dev>: Commit storing into mailbox 'INBOX' dovecot[260506]: lmtp(jasper(a)jappie.dev)<260940><3P0ZDyQGaWhM+wMAbxW+ag>: sieve: msgid=<E62D66EA-D095-4EBC-AFFE-640FB6824F45(a)jappie.dev>: stored mail into mailbox 'INBOX' dovecot[260506]: lmtp(jasper(a)jappie.dev)<260940><3P0ZDyQGaWhM+wMAbxW+ag>: Debug: sieve: msgid=<E62D66EA-D095-4EBC-AFFE-640FB6824F45(a)jappie.dev>: Finish implicit keep action dovecot[260506]: lmtp(jasper(a)jappie.dev)<260940><3P0ZDyQGaWhM+wMAbxW+ag>: Debug: sieve: msgid=<E62D66EA-D095-4EBC-AFFE-640FB6824F45(a)jappie.dev>: Finishing actions dovecot[260506]: lmtp(jasper(a)jappie.dev)<260940><3P0ZDyQGaWhM+wMAbxW+ag>: Debug: sieve: msgid=<E62D66EA-D095-4EBC-AFFE-640FB6824F45(a)jappie.dev>: Finished executing result (final, status=ok, keep=yes) dovecot[260506]: lmtp(jasper(a)jappie.dev)<260940><3P0ZDyQGaWhM+wMAbxW+ag>: Debug: sieve: multi-script: Sequence finished (status=ok, keep=yes) dovecot[260506]: lmtp(jasper(a)jappie.dev)<260940><3P0ZDyQGaWhM+wMAbxW+ag>: Debug: sieve: multi-script: Destroy dovecot[260506]: lmtp(jasper(a)jappie.dev)<260940><3P0ZDyQGaWhM+wMAbxW+ag>: Debug: sieve: storage after: file: script '84lkfddk8d88ib7zh3zh6hmy5lrvn54x-after': Closed script dovecot[260506]: lmtp(jasper(a)jappie.dev)<260940><3P0ZDyQGaWhM+wMAbxW+ag>: Debug: duplicate db: Cleanup dovecot[260506]: lmtp(jasper(a)jappie.dev)<260940><3P0ZDyQGaWhM+wMAbxW+ag>: Debug: Local delivery finished successfully dovecot[260506]: lmtp(jasper(a)jappie.dev)<260940><3P0ZDyQGaWhM+wMAbxW+ag>: Debug: User session is finished dovecot[260506]: lmtp(260940): Disconnect from local: Logged out (state=READY) dovecot[260506]: lmtp(260940): Debug: User session is finished ``` Hi, While trying to use the `sieve_script_bin_path` option to have Pigeonhole auto- create directories for compiled sieve scripts, I ran into some permission issues: "Error: sieve: binary /run/dovecot2/sieve/jasper/ 84lkfddk8d88ib7zh3zh6hmy5lrvn54x-after.svbin: save: failed to create temporary file: open(/run/dovecot2/sieve/jasper/84lkfddk8d88ib7zh3zh6hmy5lrvn54x- after.svbin.) failed: Permission denied (euid=986(dovemail) egid=985(dovemail) missing +w perm: /run/dovecot2/sieve/jasper, dir owner missing perms)" I'm using `bin_path` like this: `sieve_script_bin_path = "/run/dovecot2/sieve/% {user|username|lower}";` and the permissions of the `sieve` directory are as follows: ``` $ ls -lah sieve total 0 drwxr-xrwx 3 root root 60 Jul 5 13:01 . drwxr-xr-x 10 root root 780 Jul 5 13:00 .. dr-xr-xr-x 2 dovemail dovemail 40 Jul 5 13:01 jasper ``` `strace`ing Dovecot shows that it uses `0555` when creating this directory (but not before setting `umask` to `000`?): ``` 260940 newfstatat(AT_FDCWD</var/vmail/jappie.dev/jasper>, "/run/dovecot2/sieve/ jasper", 0x7fff4306af00, 0) = -1 ENOENT (No such file or directory) 260940 umask(000) = 077 260940 mkdir("/run/dovecot2/sieve/jasper", 0555) = 0 260940 umask(077) = 000 ``` I also tried patching Pigeonhole's source to log the value of `mode`: ``` diff --git a/src/lib-sieve/sieve-storage.c b/src/lib-sieve/sieve-storage.c index e68fe39f..4c7a081f 100644 --- a/src/lib-sieve/sieve-storage.c +++ b/src/lib-sieve/sieve-storage.c @@ -887,6 +887,6 @@ int sieve_storage_setup_bin_path(struct sieve_storage *storage, mode_t mode) if (mkdir_parents(bin_path, mode) == 0) { e_debug(storage->event, - "Created directory for binaries: %s", bin_path); + "Created directory for binaries: %s %u", bin_path, mode); return 1; } ``` and this logged `365`, which - if I understand `mode_t` correctly - corresponds to `-wxrw-r-x`: ``` Debug: sieve: storage after: file: Created directory for binaries: /run/ dovecot2/sieve/jasper 365 ``` Needless to say, I'm a little confused as to what's going on here - am I missing something or does this look like a Pigeonhole / Dovecot bug? Kind regards, - Jasper Full log: ``` dovecot[260506]: lmtp(260940): Connect from local dovecot[260506]: lmtp(260940): Debug: auth-master: passdb lookup (jasper(a)jappie.dev) Started passdb lookup dovecot[260506]: lmtp(260940): Debug: auth-master: conn unix:/run/dovecot2/ auth-userdb: Connecting dovecot[260506]: lmtp(260940): Debug: auth-master: conn unix:/run/dovecot2/ auth-userdb (pid=260501,uid=0): Client connected (fd=14) dovecot[260506]: lmtp(260940): Debug: auth-master: conn unix:/run/dovecot2/ auth-userdb (pid=260501,uid=0): auth input: user=jasper(a)jappie.dev dovecot[260506]: lmtp(260940): Debug: auth-master: passdb lookup (jasper(a)jappie.dev) auth PASS input: user=jasper(a)jappie.dev dovecot[260506]: lmtp(260940): Debug: auth-master: passdb lookup (jasper(a)jappie.dev) Finished passdb lookup (user=jasper(a)jappie.dev) dovecot[260506]: lmtp(jasper(a)jappie.dev)<260940><3P0ZDyQGaWhM+wMAbxW+ag>: Debug: auth-master: userdb lookup(jasper(a)jappie.dev): Started userdb lookup dovecot[260506]: lmtp(jasper(a)jappie.dev)<260940><3P0ZDyQGaWhM+wMAbxW+ag>: Debug: auth-master: conn unix:/run/dovecot2/auth-userdb (pid=260501,uid=0): auth input: jasper(a)jappie.dev dovecot[260506]: lmtp(jasper(a)jappie.dev)<260940><3P0ZDyQGaWhM+wMAbxW+ag>: Debug: auth-master: userdb lookup(jasper(a)jappie.dev): auth USER input: jasper(a)jappie.dev dovecot[260506]: lmtp(jasper(a)jappie.dev)<260940><3P0ZDyQGaWhM+wMAbxW+ag>: Debug: auth-master: userdb lookup(jasper(a)jappie.dev): Finished userdb lookup (username=jasper(a)jappie.dev ) dovecot[260506]: lmtp(260940): Debug: Mailbox <lmtp DATA local>: Mailbox opened dovecot[260506]: lmtp(jasper(a)jappie.dev)<260940><3P0ZDyQGaWhM+wMAbxW+ag>: Debug: Effective uid=986, gid=985, home=/var/vmail/jappie.dev/jasper dovecot[260506]: lmtp(jasper(a)jappie.dev)<260940><3P0ZDyQGaWhM+wMAbxW+ag>: Debug: open(/proc/self/io) failed: Permission denied (euid=986(dovemail) egid=985(dovemail) missing +r perm: /proc/self/io) dovecot[260506]: lmtp(jasper(a)jappie.dev)<260940><3P0ZDyQGaWhM+wMAbxW+ag>: Debug: Namespace inbox: type=private, prefix=, sep=, inbox=yes, hidden=no, list=yes, subscriptions=yes dovecot[260506]: lmtp(jasper(a)jappie.dev)<260940><3P0ZDyQGaWhM+wMAbxW+ag>: Debug: maildir++: root=/var/vmail/jappie.dev/jasper/mail, index=, indexpvt=, control=, inbox=/var/vmail/jappie.dev/jasper/mail, alt= dovecot[260506]: lmtp(jasper(a)jappie.dev)<260940><3P0ZDyQGaWhM+wMAbxW+ag>: Debug: Mailbox <lmtp DATA local>: Adding field hdr.From to cache for the first time (uid=1) dovecot[260506]: lmtp(jasper(a)jappie.dev)<260940><3P0ZDyQGaWhM+wMAbxW+ag>: Debug: Mailbox <lmtp DATA local>: Adding field hdr.Message-ID to cache for the first time (uid=1) dovecot[260506]: lmtp(jasper(a)jappie.dev)<260940><3P0ZDyQGaWhM+wMAbxW+ag>: Debug: Mailbox <lmtp DATA local>: Adding field hdr.Return-Path to cache for the first time (uid=1) dovecot[260506]: lmtp(jasper(a)jappie.dev)<260940><3P0ZDyQGaWhM+wMAbxW+ag>: Debug: Mailbox <lmtp DATA local>: Adding field hdr.Subject to cache for the first time (uid=1) dovecot[260506]: lmtp(jasper(a)jappie.dev)<260940><3P0ZDyQGaWhM+wMAbxW+ag>: Debug: Mailbox <lmtp DATA local>: Adding field hdr.To to cache for the first time (uid=1) dovecot[260506]: lmtp(jasper(a)jappie.dev)<260940><3P0ZDyQGaWhM+wMAbxW+ag>: Debug: Local delivery started dovecot[260506]: lmtp(jasper(a)jappie.dev)<260940><3P0ZDyQGaWhM+wMAbxW+ag>: Debug: duplicate db: Initialize dovecot[260506]: lmtp(jasper(a)jappie.dev)<260940><3P0ZDyQGaWhM+wMAbxW+ag>: Debug: sieve: Pigeonhole version 2.4.0 (1b2d5bb9) initializing dovecot[260506]: lmtp(jasper(a)jappie.dev)<260940><3P0ZDyQGaWhM+wMAbxW+ag>: Debug: sieve: storage after: file: Directory for binaries: /run/dovecot2/sieve/ jasper dovecot[260506]: lmtp(jasper(a)jappie.dev)<260940><3P0ZDyQGaWhM+wMAbxW+ag>: Debug: sieve: storage after: file: Using Sieve script path: /nix/store/ 84lkfddk8d88ib7zh3zh6hmy5lrvn54x-after.sieve dovecot[260506]: lmtp(jasper(a)jappie.dev)<260940><3P0ZDyQGaWhM+wMAbxW+ag>: Debug: sieve: storage after: file: script '84lkfddk8d88ib7zh3zh6hmy5lrvn54x- after': Opened from 'after' dovecot[260506]: lmtp(jasper(a)jappie.dev)<260940><3P0ZDyQGaWhM+wMAbxW+ag>: Debug: sieve: Using the following personal Sieve script: after/ 84lkfddk8d88ib7zh3zh6hmy5lrvn54x-after dovecot[260506]: lmtp(jasper(a)jappie.dev)<260940><3P0ZDyQGaWhM+wMAbxW+ag>: Debug: sieve: multi-script: Start execute sequence dovecot[260506]: lmtp(jasper(a)jappie.dev)<260940><3P0ZDyQGaWhM+wMAbxW+ag>: Debug: sieve: Opening script 1 of 1 from 'after/ 84lkfddk8d88ib7zh3zh6hmy5lrvn54x-after' dovecot[260506]: lmtp(jasper(a)jappie.dev)<260940><3P0ZDyQGaWhM+wMAbxW+ag>: Debug: sieve: Loading script after/84lkfddk8d88ib7zh3zh6hmy5lrvn54x-after dovecot[260506]: lmtp(jasper(a)jappie.dev)<260940><3P0ZDyQGaWhM+wMAbxW+ag>: Debug: sieve: storage after: file: script '84lkfddk8d88ib7zh3zh6hmy5lrvn54x- after': Opened script for reading dovecot[260506]: lmtp(jasper(a)jappie.dev)<260940><3P0ZDyQGaWhM+wMAbxW+ag>: Debug: sieve: Script 'after/84lkfddk8d88ib7zh3zh6hmy5lrvn54x-after' successfully compiled dovecot[260506]: lmtp(jasper(a)jappie.dev)<260940><3P0ZDyQGaWhM+wMAbxW+ag>: Debug: sieve: storage after: file: Created directory for binaries: /run/ dovecot2/sieve/jasper 365 dovecot[260506]: lmtp(jasper(a)jappie.dev)<260940><3P0ZDyQGaWhM+wMAbxW+ag>: Debug: sieve: storage after: file: script '84lkfddk8d88ib7zh3zh6hmy5lrvn54x- after': Saving binary to '/run/dovecot2/sieve/jasper/ 84lkfddk8d88ib7zh3zh6hmy5lrvn54x-after.svbin' dovecot[260506]: lmtp(jasper(a)jappie.dev)<260940><3P0ZDyQGaWhM+wMAbxW+ag>: Error: sieve: binary /run/dovecot2/sieve/jasper/ 84lkfddk8d88ib7zh3zh6hmy5lrvn54x-after.svbin: save: failed to create temporary file: open(/run/dovecot2/sieve/jasper/84lkfddk8d88ib7zh3zh6hmy5lrvn54x- after.svbin.) failed: Permission denied (euid=986(dovemail) egid=985(dovemail) missing +w perm: /run/dovecot2/sieve/jasper, dir owner missing perms) dovecot[260506]: lmtp(jasper(a)jappie.dev)<260940><3P0ZDyQGaWhM+wMAbxW+ag>: Debug: sieve: Executing script from 'after/84lkfddk8d88ib7zh3zh6hmy5lrvn54x- after' dovecot[260506]: lmtp(jasper(a)jappie.dev)<260940><3P0ZDyQGaWhM+wMAbxW+ag>: Debug: sieve: multi-script: Run script 'after/84lkfddk8d88ib7zh3zh6hmy5lrvn54x- after' dovecot[260506]: lmtp(jasper(a)jappie.dev)<260940><3P0ZDyQGaWhM+wMAbxW+ag>: Debug: sieve: Started running script 'after/84lkfddk8d88ib7zh3zh6hmy5lrvn54x- after' dovecot[260506]: lmtp(jasper(a)jappie.dev)<260940><3P0ZDyQGaWhM+wMAbxW+ag>: Debug: sieve: Finished running script 'after/84lkfddk8d88ib7zh3zh6hmy5lrvn54x- after' (status=ok, resource usage: no usage recorded) dovecot[260506]: lmtp(jasper(a)jappie.dev)<260940><3P0ZDyQGaWhM+wMAbxW+ag>: Debug: sieve: multi-script: Execute result dovecot[260506]: lmtp(jasper(a)jappie.dev)<260940><3P0ZDyQGaWhM+wMAbxW+ag>: Debug: sieve: msgid=<E62D66EA-D095-4EBC-AFFE-640FB6824F45(a)jappie.dev>: Executing result (status=ok, commit=no) dovecot[260506]: lmtp(jasper(a)jappie.dev)<260940><3P0ZDyQGaWhM+wMAbxW+ag>: Debug: sieve: msgid=<E62D66EA-D095-4EBC-AFFE-640FB6824F45(a)jappie.dev>: Starting execution of actions dovecot[260506]: lmtp(jasper(a)jappie.dev)<260940><3P0ZDyQGaWhM+wMAbxW+ag>: Debug: sieve: msgid=<E62D66EA-D095-4EBC-AFFE-640FB6824F45(a)jappie.dev>: Executing actions dovecot[260506]: lmtp(jasper(a)jappie.dev)<260940><3P0ZDyQGaWhM+wMAbxW+ag>: Debug: sieve: msgid=<E62D66EA-D095-4EBC-AFFE-640FB6824F45(a)jappie.dev>: Executed explicit keep dovecot[260506]: lmtp(jasper(a)jappie.dev)<260940><3P0ZDyQGaWhM+wMAbxW+ag>: Debug: sieve: msgid=<E62D66EA-D095-4EBC-AFFE-640FB6824F45(a)jappie.dev>: Finished executing actions (status=ok, keep=explicit, executed=no) dovecot[260506]: lmtp(jasper(a)jappie.dev)<260940><3P0ZDyQGaWhM+wMAbxW+ag>: Debug: sieve: msgid=<E62D66EA-D095-4EBC-AFFE-640FB6824F45(a)jappie.dev>: Finished executing result (no commit, status=ok, keep=yes) dovecot[260506]: lmtp(jasper(a)jappie.dev)<260940><3P0ZDyQGaWhM+wMAbxW+ag>: Debug: sieve: multi-script: Sequence active dovecot[260506]: lmtp(jasper(a)jappie.dev)<260940><3P0ZDyQGaWhM+wMAbxW+ag>: Debug: sieve: multi-script: Finishing sequence (status=ok) dovecot[260506]: lmtp(jasper(a)jappie.dev)<260940><3P0ZDyQGaWhM+wMAbxW+ag>: Debug: sieve: msgid=<E62D66EA-D095-4EBC-AFFE-640FB6824F45(a)jappie.dev>: Executing result (status=ok, commit=yes) dovecot[260506]: lmtp(jasper(a)jappie.dev)<260940><3P0ZDyQGaWhM+wMAbxW+ag>: Debug: sieve: msgid=<E62D66EA-D095-4EBC-AFFE-640FB6824F45(a)jappie.dev>: Starting execution of actions dovecot[260506]: lmtp(jasper(a)jappie.dev)<260940><3P0ZDyQGaWhM+wMAbxW+ag>: Debug: sieve: msgid=<E62D66EA-D095-4EBC-AFFE-640FB6824F45(a)jappie.dev>: Executing actions dovecot[260506]: lmtp(jasper(a)jappie.dev)<260940><3P0ZDyQGaWhM+wMAbxW+ag>: Debug: sieve: msgid=<E62D66EA-D095-4EBC-AFFE-640FB6824F45(a)jappie.dev>: Finished executing actions (status=ok, keep=implicit, executed=no) dovecot[260506]: lmtp(jasper(a)jappie.dev)<260940><3P0ZDyQGaWhM+wMAbxW+ag>: Debug: sieve: msgid=<E62D66EA-D095-4EBC-AFFE-640FB6824F45(a)jappie.dev>: Found deferred keep action dovecot[260506]: lmtp(jasper(a)jappie.dev)<260940><3P0ZDyQGaWhM+wMAbxW+ag>: Debug: sieve: msgid=<E62D66EA-D095-4EBC-AFFE-640FB6824F45(a)jappie.dev>: Execute implicit keep (status=ok) dovecot[260506]: lmtp(jasper(a)jappie.dev)<260940><3P0ZDyQGaWhM+wMAbxW+ag>: Debug: sieve: msgid=<E62D66EA-D095-4EBC-AFFE-640FB6824F45(a)jappie.dev>: Start storing into mailbox INBOX dovecot[260506]: lmtp(jasper(a)jappie.dev)<260940><3P0ZDyQGaWhM+wMAbxW+ag>: Debug: sieve: msgid=<E62D66EA-D095-4EBC-AFFE-640FB6824F45(a)jappie.dev>: Executing implicit keep action dovecot[260506]: lmtp(jasper(a)jappie.dev)<260940><3P0ZDyQGaWhM+wMAbxW+ag>: Debug: sieve: msgid=<E62D66EA-D095-4EBC-AFFE-640FB6824F45(a)jappie.dev>: Execute storing into mailbox 'INBOX' dovecot[260506]: lmtp(jasper(a)jappie.dev)<260940><3P0ZDyQGaWhM+wMAbxW+ag>: Debug: Mailbox INBOX: Mailbox opened dovecot[260506]: lmtp(jasper(a)jappie.dev)<260940><3P0ZDyQGaWhM+wMAbxW+ag>: Debug: sieve: msgid=<E62D66EA-D095-4EBC-AFFE-640FB6824F45(a)jappie.dev>: Saving to mailbox 'INBOX' successful so far dovecot[260506]: lmtp(jasper(a)jappie.dev)<260940><3P0ZDyQGaWhM+wMAbxW+ag>: Debug: sieve: msgid=<E62D66EA-D095-4EBC-AFFE-640FB6824F45(a)jappie.dev>: Finished executing implicit keep action (status=ok) dovecot[260506]: lmtp(jasper(a)jappie.dev)<260940><3P0ZDyQGaWhM+wMAbxW+ag>: Debug: sieve: msgid=<E62D66EA-D095-4EBC-AFFE-640FB6824F45(a)jappie.dev>: Finalizing actions dovecot[260506]: lmtp(jasper(a)jappie.dev)<260940><3P0ZDyQGaWhM+wMAbxW+ag>: Debug: sieve: msgid=<E62D66EA-D095-4EBC-AFFE-640FB6824F45(a)jappie.dev>: Finished finalizing actions (status=ok, keep=implicit, committed=no) dovecot[260506]: lmtp(jasper(a)jappie.dev)<260940><3P0ZDyQGaWhM+wMAbxW+ag>: Debug: sieve: msgid=<E62D66EA-D095-4EBC-AFFE-640FB6824F45(a)jappie.dev>: Finalize implicit keep (status=ok) dovecot[260506]: lmtp(jasper(a)jappie.dev)<260940><3P0ZDyQGaWhM+wMAbxW+ag>: Debug: sieve: msgid=<E62D66EA-D095-4EBC-AFFE-640FB6824F45(a)jappie.dev>: Finalize implicit keep action(status=ok, action_status=ok, commit_status=ok) dovecot[260506]: lmtp(jasper(a)jappie.dev)<260940><3P0ZDyQGaWhM+wMAbxW+ag>: Debug: sieve: msgid=<E62D66EA-D095-4EBC-AFFE-640FB6824F45(a)jappie.dev>: Commit implicit keep action dovecot[260506]: lmtp(jasper(a)jappie.dev)<260940><3P0ZDyQGaWhM+wMAbxW+ag>: Debug: sieve: msgid=<E62D66EA-D095-4EBC-AFFE-640FB6824F45(a)jappie.dev>: Commit storing into mailbox 'INBOX' dovecot[260506]: lmtp(jasper(a)jappie.dev)<260940><3P0ZDyQGaWhM+wMAbxW+ag>: sieve: msgid=<E62D66EA-D095-4EBC-AFFE-640FB6824F45(a)jappie.dev>: stored mail into mailbox 'INBOX' dovecot[260506]: lmtp(jasper(a)jappie.dev)<260940><3P0ZDyQGaWhM+wMAbxW+ag>: Debug: sieve: msgid=<E62D66EA-D095-4EBC-AFFE-640FB6824F45(a)jappie.dev>: Finish implicit keep action dovecot[260506]: lmtp(jasper(a)jappie.dev)<260940><3P0ZDyQGaWhM+wMAbxW+ag>: Debug: sieve: msgid=<E62D66EA-D095-4EBC-AFFE-640FB6824F45(a)jappie.dev>: Finishing actions dovecot[260506]: lmtp(jasper(a)jappie.dev)<260940><3P0ZDyQGaWhM+wMAbxW+ag>: Debug: sieve: msgid=<E62D66EA-D095-4EBC-AFFE-640FB6824F45(a)jappie.dev>: Finished executing result (final, status=ok, keep=yes) dovecot[260506]: lmtp(jasper(a)jappie.dev)<260940><3P0ZDyQGaWhM+wMAbxW+ag>: Debug: sieve: multi-script: Sequence finished (status=ok, keep=yes) dovecot[260506]: lmtp(jasper(a)jappie.dev)<260940><3P0ZDyQGaWhM+wMAbxW+ag>: Debug: sieve: multi-script: Destroy dovecot[260506]: lmtp(jasper(a)jappie.dev)<260940><3P0ZDyQGaWhM+wMAbxW+ag>: Debug: sieve: storage after: file: script '84lkfddk8d88ib7zh3zh6hmy5lrvn54x- after': Closed script dovecot[260506]: lmtp(jasper(a)jappie.dev)<260940><3P0ZDyQGaWhM+wMAbxW+ag>: Debug: duplicate db: Cleanup dovecot[260506]: lmtp(jasper(a)jappie.dev)<260940><3P0ZDyQGaWhM+wMAbxW+ag>: Debug: Local delivery finished successfully dovecot[260506]: lmtp(jasper(a)jappie.dev)<260940><3P0ZDyQGaWhM+wMAbxW+ag>: Debug: User session is finished dovecot[260506]: lmtp(260940): Disconnect from local: Logged out (state=READY) dovecot[260506]: lmtp(260940): Debug: User session is finished ```

2 1

how to disable services on the docker image?
by Felix Rubio 06 Jul '25

06 Jul '25

Hi everybody! I am trying to find the cleanest way to disable services (like pop3-login, pop3, etc.) in the docker image, if possible extending the existing configuration with conf.d files. Is this possible? I have tried using the protocol keyword on those services, after setting the protocols to that ones I want, and the services still get instantiated (thus consuming resources as well). Thank you! Felix

2 4

null pointer crash in lib11_trash_plugin.so
by Nik Soggia 02 Jul '25

02 Jul '25

dovecot crashes if you don't explicitly set "trash_priority" on all namespace mailboxes. Program terminated with signal SIGSEGV, Segmentation fault. #0 0x00007f6af06b4563 in trash_try_mailbox (error_r=0x7ffcf37077b8, box_name=0x56384813f980 "Drafts", ns=0x5638481423b0) at trash-plugin.c:582 (gdb) print trash_set $1 = (const struct trash_settings *) 0x0 unsigned int trash_priority = trash_set->trash_priority; // ^^^^^^^^^ SIGSEGV if NULL here is my configuration, to stop it from crashing uncomment the two "trash_priority = 0". cheers # 2.4.1-4 (7d8c0e5759): /etc/dovecot/dovecot.conf # Pigeonhole version 2.4.0 (1b2d5bb9) # OS: Linux 6.12.32 x86_64 Slackware 15.0 ext4 # Hostname: niksoggia.it # 4 default setting changes since version 2.4.0 dovecot_config_version = 2.4.0 auth_master_user_separator = * dovecot_storage_version = 2.4.0 mail_driver = maildir mail_home = /var/spool/mail/%{user} mail_path = /var/spool/mail/%{user}/dovecot protocols { imap = yes lmtp = yes pop3 = yes } protocol imap { mail_plugins { quota = yes trash = yes imap_quota = yes } } protocol lda { mail_plugins { quota = yes sieve = yes } } protocol lmtp { mail_plugins { quota = yes sieve = yes } } protocol pop3 { mail_plugins { quota = yes } } service imap-login { inet_listener imap { port = 143 listen = 127.0.0.1 } inet_listener imaps { port = 993 listen = 127.0.0.1 } } service managesieve-login { inet_listener sieve { listen = 127.0.0.1 } } service pop3-login { inet_listener pop3 { port = 110 listen = 127.0.0.1 } inet_listener pop3s { port = 995 listen = 127.0.0.1 } } sieve_script personal { path = /var/spool/mail/%{user}/sieve/dovecot.sieve } namespace inbox { inbox = yes prefix = separator = / trash_priority = 0 mailbox Drafts { auto = subscribe special_use = "\\Drafts" # trash_priority = 0 } mailbox Junk { auto = subscribe special_use = "\\Junk" trash_priority = 1 } mailbox Sent { auto = subscribe special_use = "\\Sent" # trash_priority = 0 } mailbox Trash { auto = subscribe special_use = "\\Trash" trash_priority = 2 } } ssl_server { cert_file = /etc/dovecot/fullchain.pem key_file = /etc/dovecot/privkey.pem } passdb pam { driver = pam } userdb passwd { driver = passwd } userdb prefetch { driver = prefetch }

1 0

how to fix this
by Marc 01 Jul '25

01 Jul '25

doveadm force-resync -u $account INBOX doveadm(): Warning: fscking index file /.../index/storage/dovecot.map.index doveadm(): Warning: mdbox /.../mdbox/storage: rebuilding indexes doveadm(): Error: Couldn't open mailbox 'foldertest1751045732429': Mailbox doesn't exist: foldertest1751045732429 doveadm(): Error: Couldn't open mailbox 'foldertest1751045732429/foldertest': Mailbox doesn't exist: foldertest1751045732429/foldertest doveadm(): Error: Couldn't open mailbox 'foldertest17485243507278': Mailbox doesn't exist: foldertest17485243507278 doveadm(): Error: Couldn't open mailbox 'foldertest17485243507278/foldertest': Mailbox doesn't exist: foldertest17485243507278/foldertest doveadm(): Error: Couldn't open mailbox 'Trash/test': Mailbox doesn't exist: Trash/test doveadm(): Error: Couldn't open mailbox 'INBOX/test-files': Mailbox doesn't exist: INBOX/test-files doveadm(): Warning: fscking index file /.../index/storage/dovecot.map.index

2 5

sievec fails when run as non-root - bug?
by Genes Lists 30 Jun '25

30 Jun '25

1) With 2.4.1, when a non-root user runs sievec on their own sieve scripts it fails to run due to permission denied on the dovecot certificate key (which is only readable by root). Specifically: sievec active.sieve doveconf: Fatal: Error in configuration file /etc/dovecot/conf.d/10- ssl.conf line 10: cert_file: open(/etc/.../fullchain.pem) failed: Permission denied What is recommended way to deal with this? 2) Separate question: Might this explain why users sieve scripts are not running? I assume not as there are no 'sieve' items reported by lmtp in the logs. Config has: protocol lmtp { postmaster_address = postmaster@<domain>.com mail_plugins { sieve = yes } hostname = imap.<domain>.com } sieve_script before { driver = file path = /etc/dovecot/sieve/global active_path = remove_dup.sieve } sieve_script personal { driver = file path = ~/sieve active_path = ~/.dovecot.sieve } sieve_script after { driver = file path = /etc/dovecot/sieve active_path = default.sieve } thanks. -- Gene

2 5

Identifying spamd problems
by Francis Augusto Medeiros-Logeay 27 Jun '25

27 Jun '25

Hi, I have use Dovecot, Spamassassin and Roundcube. My spam assassin is configured to use SQL. I have noticed that when I move a message to the junk folder, it increases the number of spam on the database. But when I move it out of the junk folder, it doesn’t increase the ham nor decreases the spam count. When running sa-learn manually, it does everything right. Here’s now 90-sieve.conf is configured; ieve_plugins = sieve_imapsieve sieve_extprograms sieve_before = /var/mail/vmail/mail/sieve/global/spam-global.sieve sieve = file:/var/mail/vmail/mail/sieve/%d/%n/scripts;active=/var/mail/vmail/mail/sieve/%d/%n/active-script.sieve imapsieve_mailbox1_name = Spam imapsieve_mailbox1_causes = COPY imapsieve_mailbox1_before = file:/var/mail/vmail/mail/sieve/global/report-spam.sieve imapsieve_mailbox2_name = * imapsieve_mailbox2_from = Spam imapsieve_mailbox2_causes = COPY imapsieve_mailbox2_before = file:/var/mail/vmail/mail/sieve/global/report-ham.sieve imapsieve_mailbox2_name = Archive imapsieve_mailbox2_from = * imapsieve_mailbox2_causes = COPY imapsieve_mailbox2_before = file:/var/mail/vmail/mail/sieve/global/report-ham.sieve sieve_execute_bin_dir = /usr/bin sieve_pipe_bin_dir = /var/mail/vmail/mail/sieve/global/scripts sieve_global_extensions = +vnd.dovecot.pipe +vnd.dovecot.execute And here’s hoe my scripts are: /var/mail/vmail/mail/sieve/global/report-spam.sieve^C root@9c8c309ee769:/# cat /var/mail/vmail/mail/sieve/global/report-spam.sieve require ["vnd.dovecot.pipe", "copy", "imapsieve", "environment", "variables", "vnd.dovecot.execute" ]; if environment :matches "imap.user" "*" { set "username" "${1}"; } pipe :copy "sa-learn-spam.sh" [ "${username}" ]; /var/mail/vmail/mail/sieve/global/report-ham.sieve require ["vnd.dovecot.pipe", "copy", "imapsieve", "environment", "variables"]; if environment :matches "imap.mailbox" "*" { set "mailbox" "${1}"; } if string "${mailbox}" "Trash" { stop; } if environment :matches "imap.user" "*" { set "username" "${1}"; } pipe :copy "sa-learn-ham.sh" [ "${username}" ]; sa-learn-ham.sh: #!/bin/sh export PATH="/usr/sbin:/usr/bin:/usr/local/bin:/usr/local/sbin:$PATH" exec /usr/bin/spamc -u ${1} -L ham exit 0 sa-learn-spam.sh #!/bin/sh export PATH="/usr/sbin;/usr/bin;/usr/local/bin;/usr/local/sbin;" exec /usr/bin/spamc -u ${1} -L spam Should I change for example: exec /usr/bin/spamc -u ${1} -L ham to exec /usr/bin/sa-learn -u ${1} —ham ? Best, Francis Hi, I have use Dovecot, Spamassassin and Roundcube. My spam assassin is configured to use SQL. I have noticed that when I move a message to the junk folder, it increases the number of spam on the database. But when I move it out of the junk folder, it doesn’t increase the ham nor decreases the spam count. When running sa-learn manually, it does everything right. Here’s now 90-sieve.conf is configured; ieve_plugins = sieve_imapsieve sieve_extprograms sieve_before = /var/mail/vmail/mail/sieve/global/spam-global.sieve sieve = file:/var/mail/vmail/mail/sieve/%d/%n/scripts;active=/var/mail/ vmail/mail/sieve/%d/%n/active-script.sieve imapsieve_mailbox1_name = Spam imapsieve_mailbox1_causes = COPY imapsieve_mailbox1_before = file:/var/mail/vmail/mail/sieve/global/report- spam.sieve imapsieve_mailbox2_name = * imapsieve_mailbox2_from = Spam imapsieve_mailbox2_causes = COPY imapsieve_mailbox2_before = file:/var/mail/vmail/mail/sieve/global/report- ham.sieve imapsieve_mailbox2_name = Archive imapsieve_mailbox2_from = * imapsieve_mailbox2_causes = COPY imapsieve_mailbox2_before = file:/var/mail/vmail/mail/sieve/global/report- ham.sieve sieve_execute_bin_dir = /usr/bin sieve_pipe_bin_dir = /var/mail/vmail/mail/sieve/global/scripts sieve_global_extensions = +vnd.dovecot.pipe +vnd.dovecot.execute And here’s hoe my scripts are: /var/mail/vmail/mail/sieve/global/report-spam.sieve^C root@9c8c309ee769:/# cat /var/mail/vmail/mail/sieve/global/report-spam.sieve require ["vnd.dovecot.pipe", "copy", "imapsieve", "environment", "variables", "vnd.dovecot.execute" ]; if environment :matches "imap.user" "*" { set "username" "${1}"; } pipe :copy "sa-learn-spam.sh" [ "${username}" ]; /var/mail/vmail/mail/sieve/global/report-ham.sieve require ["vnd.dovecot.pipe", "copy", "imapsieve", "environment", "variables"]; if environment :matches "imap.mailbox" "*" { set "mailbox" "${1}"; } if string "${mailbox}" "Trash" { stop; } if environment :matches "imap.user" "*" { set "username" "${1}"; } pipe :copy "sa-learn-ham.sh" [ "${username}" ]; sa-learn-ham.sh: #!/bin/sh export PATH="/usr/sbin:/usr/bin:/usr/local/bin:/usr/local/sbin:$PATH" exec /usr/bin/spamc -u ${1} -L ham exit 0 sa-learn-spam.sh #!/bin/sh export PATH="/usr/sbin;/usr/bin;/usr/local/bin;/usr/local/sbin;" exec /usr/bin/spamc -u ${1} -L spam Should I change for example: exec /usr/bin/spamc -u ${1} -L ham to exec /usr/bin/sa-learn -u ${1} —ham ? Best, Francis

1 0

SASL authentication against LDAP w/ client certs, supposed to work?
by Bruno Hertz 26 Jun '25

26 Jun '25

Hi all I'm currently testing Dovecot 2.4, considering a migration from 2.3, and all works fine except authentication against LDAP (openldap slapd) with client certificates. Which I had no problem with on 2.3 for seven years or so. Versions: Linux Alpine 3.22 Dovecot 2.4.1-4 (7d8c0e5759) Alpine package, but patched with https://github.com/dovecot/core/commit/431e328b3b035ddb187526cd13bccf29833a… Now, first a Dovecot configuration that does work, unencrypted simple bind against Unix domain socket: ldap_version = 3 ldap_uris = ldapi:/// ldap_base = ou=users,dc=mydomain,dc=internal ldap_auth_dn = cn=dovecot,dc=mydomain,dc=internal ldap_auth_dn_password = secret passdb ldap { bind = no default_password_scheme = SSHA ldap_filter = (&(objectClass=posixAccount)(uid=%{user})) fields { user = %{ldap:uid} password = %{ldap:userPassword} } } Meaning I'm doing password lookups, IMAP users can authenticate against Dovecot, Postfix correctly delivers incoming emails, everything works flawlessly. Now the setup I'm talking about, which does not work: ldap_version = 3 ldap_uris = ldaps://localhost.mydomain.internal ldap_base = ou=users,dc=mydomain,dc=internal ldap_auth_sasl_mechanisms = external ssl_client_cert_file = /etc/ssl/ldap/dovecot.crt ssl_client_key_file = /etc/ssl/ldap/dovecot.key # this just as a precaution during testing, validation *does* work ssl_client_require_valid_cert = no ssl_client_ca_dir = /etc/ssl/certs passdb ldap { bind = no default_password_scheme = SSHA ldap_filter = (&(objectClass=posixAccount)(uid=%{user})) fields { user = %{ldap:uid} password = %{ldap:userPassword} } } What happens here, as far as I can see, is Dovecot connects to slapd, initiates a SASL session but then fails to send the client certificate. slapd realizes the cert isn't coming, asserts there's no other SASL "external" method to fall back to and disconnects Dovecot. Game over. Now, before somebody thinks 'maybe something wrong with the certs or so', the very same setup on the very same machine works perfectly with two other client types, namely - openldap standard utils - postfix (recipient lookup) With the utils I have this setup, with the same client cert URI ldaps://localhost.mydomain.internal BASE ou=users,dc=mydomain,dc=internal SASL_MECH external TLS_REQCERT demand TLS_CACERT /root/ssl/ca.crt TLS_CERT /etc/ssl/ldap/dovecot.crt TLS_KEY /etc/ssl/ldap/dovecot.key and ldapwhoami connects without problem, and with ldapsearch I can perform the very same searches Dovecot is supposed to do. Postfix, for recipient lookups, I have configured like this: version = 3 server_host = ldaps://localhost.mydomain.internal search_base = ou=users,dc=mydomain,dc=internal query_filter = (&(mail=%s)) result_attribute = uid bind = sasl sasl_mechs = external tls_require_cert = demand tls_ca_cert_dir = /etc/ssl/certs tls_cert = /etc/ssl/ldap/dovecot.crt tls_key = /etc/ssl/ldap/dovecot.key Again, no problem to authenticate agains LDAP with the very same client certificate. The CA is correctly installed into /etc/ssl/certs , by the way, with update-ca-certificates. So out of 3 client types with the very same setup only Dovecot fails to successfully negotiate the client cert SASL session, while, after a good look through the docs, I really don't see any other settings I could tweak. Thoughts? Greetings, Bruno

2 6

Dovecot quota and IMAP MOVE
by marekstefanka＠duck.com 26 Jun '25

26 Jun '25

Hello, I would like to kindly ask, if there is some recommendation for dovecot quota configuration, to prevent quota-warning triggering when IMAP MOVE command is executed close to some thresholds. Problem seems to be this: Jun 10 11:08:20 srv1 dovecot[39677]: imap(box1(a)domain.com)<48726><0aCoCTQ3TC8KHgcC>: Debug: quota: Executing warning: quota-warning box1(a)domain.com (because bytes=3713971 -> 7301217 over limit 4096000) Jun 10 11:08:20 srv1 dovecot[39677]: imap(box1(a)domain.com)<48726><0aCoCTQ3TC8KHgcC>: Debug: quota: Executing warning: quota-warning box1(a)domain.com (because bytes=7301217 -> 3713971 below limit 4096000) So during any IMAP MOVE, which is copy-then-delete process, quota goes over and then below limit, triggering closest threshold. Quota config: quota = count:User quota quota_vsizes = yes # default, we specific user limits via sql quota_rule = *:storage=0 quota_grace = 50M quota_warning = storage=100%% quota-warning %u quota_warning2 = -storage=100%% quota-warning %u quota_warning3 = storage=90%% quota-warning %u quota_warning4 = storage=80%% quota-warning %u Recommended fix does not seems to work (tried multiple namespaces): quota_rule = Folder:storage=+100M Dovecot version is 2.3.21.1 Thank you for any help with this.

2 1

Re: no longer able to delete emails
by Michael Slusarz 25 Jun '25

25 Jun '25

"Jun 23 07:30:58 email-001 dovecot: imap (steven)<120035><W910Ii44SNgAAAAAAAAAAAAAAAAAAAAB>: Error: Mailbox Trash: ftruncate() failed with mbox: Structure needs cleaning" There's corruption in your filesystem. Dovecot can't do anything about this - it is the system call that's failing when trying to access the data. michael

1 0

doveconf terminated with signal SIGSEGV, Segmentation fault on ppc64le
by Peter Varkoly 24 Jun '25

24 Jun '25

doveconf -d # 2.4.1-4 (7d8c0e5759): /etc/dovecot/dovecot.conf # Pigeonhole version 2.4.1-4 (0a86619f) Segmentation fault (core dumped) The same source works fine on other architectures. The trace of gdb: Core was generated by `/usr/bin/doveconf -c /etc/dovecot/dovecot.conf -C -F /usr/sbin/dovecot -F'. Program terminated with signal SIGSEGV, Segmentation fault. #0 str_hash (p=0xf <error: Cannot access memory at address 0xf>) at ../lib/hash.c:529 --Type <RET> for more, q to quit, c to continue without paging-- 529 while (*s != '\0') { Function(s) ^std::(move|forward|as_const|(__)?addressof) will be skipped when stepping. Function(s) ^std::(shared|unique)_ptr<.*>::(get|operator) will be skipped when stepping. Function(s) ^std::(basic_string|vector|array|deque|(forward_)?list|(unordered_|flat_)?(multi)?(map|set)|span)<.*>::(c?r?(begin|end)|front|back|data|size|empty) will be skipped when stepping. Function(s) ^std::(basic_string|vector|array|deque|span)<.*>::operator.] will be skipped when stepping. (gdb) bt full #0 str_hash (p=0xf <error: Cannot access memory at address 0xf>) at ../lib/hash.c:529 s = 0xf <error: Cannot access memory at address 0xf> g = <optimized out> h = 0 #1 0x00007fff9ffa427c in hash_table_lookup_full (table=0x156052d80, lookup_key=<optimized out>, orig_key=<optimized out>, orig_key@entry=0x7fffc158a690, value=<optimized out>, value@entry=0x7fffc158a670) at ../lib/hash.c:204 node = <optimized out> #2 0x000000012b7145ec in config_parser_add_info (info_idx=3, ctx=0x7fffc158a6b0) at config-parser.c:2812 def = 0x12b73c148 <auth_lua_default_settings_keyvalue+40> i = 2 info = 0x12b73e168 <auth_oauth2_post_setting_parser_info> config_key = <optimized out> old_config_key = 0x0 name = 0x7fff9faa2790 <dlsym_doit> "\032" info = <optimized out> config_key = <optimized out> old_config_key = <optimized out> name = <optimized out> __func__ = <optimized out> i = <optimized out> def = <optimized out> valuep = <optimized out> old_info = <optimized out> old_def = <optimized out> #3 config_parse_file (path=0x156049550 "/etc/dovecot/dovecot.conf", flags=<optimized out>, dump_filter=0x0, config_r=0x12b741e18 <config>, error_r=0x7fffc158a9b8) at config-parser.c:2917 root = {prev = 0x7fffc158a6a0, input = 0x7fffa0180a08 <_rtld_local+2568>, path = 0x0, linenum = 1443176896} internal = {prev = 0x1560542b7, input = 0x156054280, path = 0x156054280 "undefined symbol: pigeonhole_settings_service_settings", linenum = 2685949488} ctx = {pool = 0x7fff9eaa0030, path = 0x156049550 "/etc/dovecot/dovecot.conf", all_keys = {_table = 0x156052d80, _key = 0x156052d80 "0", _keyp = 0x156052d80, _const_key = 0x156052d80 "0", _value = 0x156052d80, _valuep = 0x156052d80}, all_filter_parsers = {arr = {buffer = 0x0, element_size = 0}, v = 0x0, v_modifiable = 0x0}, all_filter_parsers_hash = {_table = 0x0, _key = 0x0, _keyp = 0x0, _const_key = 0x0, _value = 0x0, _valuep = 0x0}, root_module_parsers = 0x7fff9eaa0068, cur_section = 0x0, cur_input = 0x0, change_counter = 1 '\001', create_order_counter = 0, value = 0x0, error = 0x0, dovecot_config_version = 0x0, filter_name_prefixes = 0x0, filter_name_prefixes_count = 0, old = 0x0, seen_settings = {_table = 0x0, _key = 0x0, _keyp = 0x0, _const_key = 0x0, _value = 0x0, _valuep = 0x0}, filter = 0x0, dump_defaults = false, expand_values = false, hide_errors = false, delay_errors = false, hide_obsolete_warnings = false, ignore_unknown = false} i = 3 count = 143 full_line = 0x64656e696665646e line = <optimized out> fd = 7 ret = 0 dump_defaults = <optimized out> service_info_idx = 4294967295 root_filter = {parent = 0x1560691d0, protocol = 0x1 <error: Cannot access memory at address 0x1>, local_name = 0x156054200 "T`\025", local_host = 0x7fffc158a8a0 "", remote_host = 0x0, local_net = {family = 0, u = {ip6 = {__in6_u = {__u6_addr8 = '\000' <repeats 15 times>, __u6_addr16 = {0, 0, 0, 0, 0, 0, 0, 0}, __u6_addr32 = {0, 0, 0, 0}}}, ip4 = {s_addr = 0}}, scope_id = 0}, remote_net = {family = 10384, u = {ip6 = {__in6_u = {__u6_addr8 = "\001\000\000\000ШX\301\377\177\000\000\360\031r+", __u6_addr16 = {1, 0, 43216, 49496, 32767, 0, 6640, 11122}, __u6_addr32 = {1, 3243813072, 32767, 728898032}}}, ip4 = {s_addr = 1}}, scope_id = 1}, local_bits = 0, remote_bits = 0, filter_name = 0x0, filter_name_array = false, default_settings = false} root_filter_parser = <optimized out> root_default_filter = {parent = 0x7fffc158a7f8, protocol = 0x156052430 "", local_name = 0x0, local_host = 0x12b7404c0 <config_all_services> "\340(\005V\001", remote_host = 0x19 <error: Cannot access memory at address 0x19>, local_net = {family = 42896, u = {ip6 = {__in6_u = { __u6_addr8 = "\377\177\000\000\000\000\000\000\000\000\000\000\300\004t+", __u6_addr16 = {32767, 0, 0, 0, 0, 0, 1216, 11124}, __u6_addr32 = {32767, 0, 0, 729023680}}}, ip4 = {s_addr = 32767}}, scope_id = 1}, remote_net = {family = 30208, u = {ip6 = {__in6_u = {__u6_addr8 = "\377\177\000\000@\251X\301\377\177\000\000p\211\004V", __u6_addr16 = {32767, 0, 43328, 49496, 32767, 0, 35184, 22020}, __u6_addr32 = {32767, 3243813184, 32767, 1443137904}}}, ip4 = {s_addr = 32767}}, scope_id = 1}, local_bits = 728816924, remote_bits = 1, filter_name = 0x12b747f00 "", filter_name_array = 128, default_settings = 168} prevfile = <optimized out> __func__ = "config_parse_file" #4 0x000000012b6f9690 in main (argc=<optimized out>, argv=<optimized out>) at doveconf.c:1238 _data_stack_cur_id = 2 master_service_flags = (MASTER_SERVICE_FLAG_STANDALONE | MASTER_SERVICE_FLAG_NO_INIT_DATASTACK_FRAME | MASTER_SERVICE_FLAG_DONT_SEND_STATS) scope = CONFIG_DUMP_SCOPE_ALL_WITHOUT_HIDDEN orig_config_path = <optimized out> config_path = 0x156049550 "/etc/dovecot/dovecot.conf" import_environment = 0x2 <error: Cannot access memory at address 0x2> error = 0x0 exec_args = <optimized out> setting_name_filters = <optimized out> i = <optimized out> c = <optimized out> ret = <optimized out> ret2 = <optimized out> dump_filter_parent = {parent = 0x0, protocol = 0x0, local_name = 0x0, local_host = 0x0, remote_host = 0x0, local_net = {family = 0, u = {ip6 = {__in6_u = { __u6_addr8 = '\000' <repeats 15 times>, __u6_addr16 = {0, 0, 0, 0, 0, 0, 0, 0}, __u6_addr32 = {0, 0, 0, 0}}}, ip4 = {s_addr = 0}}, scope_id = 0}, remote_net = { --Type <RET> for more, q to quit, c to continue without paging-- family = 0, u = {ip6 = {__in6_u = {__u6_addr8 = '\000' <repeats 15 times>, __u6_addr16 = {0, 0, 0, 0, 0, 0, 0, 0}, __u6_addr32 = {0, 0, 0, 0}}}, ip4 = {s_addr = 0}}, scope_id = 0}, local_bits = 0, remote_bits = 0, filter_name = 0x0, filter_name_array = false, default_settings = false} dump_filter = {parent = 0x7fffc158aa50, protocol = 0x0, local_name = 0x0, local_host = 0x0, remote_host = 0x0, local_net = {family = 0, u = {ip6 = {__in6_u = { __u6_addr8 = '\000' <repeats 15 times>, __u6_addr16 = {0, 0, 0, 0, 0, 0, 0, 0}, __u6_addr32 = {0, 0, 0, 0}}}, ip4 = {s_addr = 0}}, scope_id = 0}, remote_net = { family = 0, u = {ip6 = {__in6_u = {__u6_addr8 = '\000' <repeats 15 times>, __u6_addr16 = {0, 0, 0, 0, 0, 0, 0, 0}, __u6_addr32 = {0, 0, 0, 0}}}, ip4 = {s_addr = 0}}, scope_id = 0}, local_bits = 0, remote_bits = 0, filter_name = 0x0, filter_name_array = false, default_settings = false} config_path_specified = false hide_key = <optimized out> have_dump_filter = <optimized out> simple_output = <optimized out> check_full_config = <optimized out> dump_defaults = <optimized out> host_verify = <optimized out> dump_full = <optimized out> print_banners = <optimized out> hide_passwords = <optimized out> flags = (CONFIG_PARSE_FLAG_EXPAND_VALUES | CONFIG_PARSE_FLAG_RETURN_BROKEN_CONFIG) dump_config_import = <optimized out> -- Peter Varkoly SW Engineering(Systems) SUSE Software Solutions Germany GmbH Frankenstraße 146 D-90461 Nürnberg T +49-(0)911-740 53 0 E <varkoly(a)suse.com> https://www.suse.com/ (HRB 36809, AG Nürnberg) Geschäftsführer: Felix Imendörffer doveconf -d # 2.4.1-4 (7d8c0e5759): /etc/dovecot/dovecot.conf # Pigeonhole version 2.4.1-4 (0a86619f) Segmentation fault (core dumped) The same source works fine on other architectures. The trace of gdb: Core was generated by `/usr/bin/doveconf -c /etc/dovecot/dovecot.conf -C -F / usr/sbin/dovecot -F'. Program terminated with signal SIGSEGV, Segmentation fault. #0 str_hash (p=0xf <error: Cannot access memory at address 0xf>) at ../lib/ hash.c:529 --Type <RET> for more, q to quit, c to continue without paging-- 529 while (*s != '\0') { Function(s) ^std::(move|forward|as_const|(__)?addressof) will be skipped when stepping. Function(s) ^std::(shared|unique)_ptr<.*>::(get|operator) will be skipped when stepping. Function(s) ^std::(basic_string|vector|array|deque|(forward_)?list| (unordered_|flat_)?(multi)?(map|set)|span)<.*>::(c?r? (begin|end)|front|back|data|size|empty) will be skipped when stepping. Function(s) ^std::(basic_string|vector|array|deque|span)<.*>::operator.] will be skipped when stepping. (gdb) bt full #0 str_hash (p=0xf <error: Cannot access memory at address 0xf>) at ../lib/ hash.c:529 s = 0xf <error: Cannot access memory at address 0xf> g = <optimized out> h = 0 #1 0x00007fff9ffa427c in hash_table_lookup_full (table=0x156052d80, lookup_key=<optimized out>, orig_key=<optimized out>, orig_key@entry=0x7fffc158a690, value=<optimized out>, value@entry=0x7fffc158a670) at ../lib/hash.c:204 node = <optimized out> #2 0x000000012b7145ec in config_parser_add_info (info_idx=3, ctx=0x7fffc158a6b0) at config-parser.c:2812 def = 0x12b73c148 <auth_lua_default_settings_keyvalue+40> i = 2 info = 0x12b73e168 <auth_oauth2_post_setting_parser_info> config_key = <optimized out> old_config_key = 0x0 name = 0x7fff9faa2790 <dlsym_doit> "\032" info = <optimized out> config_key = <optimized out> old_config_key = <optimized out> name = <optimized out> __func__ = <optimized out> i = <optimized out> def = <optimized out> valuep = <optimized out> old_info = <optimized out> old_def = <optimized out> #3 config_parse_file (path=0x156049550 "/etc/dovecot/dovecot.conf", flags=<optimized out>, dump_filter=0x0, config_r=0x12b741e18 <config>, error_r=0x7fffc158a9b8) at config-parser.c:2917 root = {prev = 0x7fffc158a6a0, input = 0x7fffa0180a08 <_rtld_local+2568>, path = 0x0, linenum = 1443176896} internal = {prev = 0x1560542b7, input = 0x156054280, path = 0x156054280 "undefined symbol: pigeonhole_settings_service_settings", linenum = 2685949488} ctx = {pool = 0x7fff9eaa0030, path = 0x156049550 "/etc/dovecot/ dovecot.conf", all_keys = {_table = 0x156052d80, _key = 0x156052d80 "0", _keyp = 0x156052d80, _const_key = 0x156052d80 "0", _value = 0x156052d80, _valuep = 0x156052d80}, all_filter_parsers = {arr = {buffer = 0x0, element_size = 0}, v = 0x0, v_modifiable = 0x0}, all_filter_parsers_hash = {_table = 0x0, _key = 0x0, _keyp = 0x0, _const_key = 0x0, _value = 0x0, _valuep = 0x0}, root_module_parsers = 0x7fff9eaa0068, cur_section = 0x0, cur_input = 0x0, change_counter = 1 '\001', create_order_counter = 0, value = 0x0, error = 0x0, dovecot_config_version = 0x0, filter_name_prefixes = 0x0, filter_name_prefixes_count = 0, old = 0x0, seen_settings = {_table = 0x0, _key = 0x0, _keyp = 0x0, _const_key = 0x0, _value = 0x0, _valuep = 0x0}, filter = 0x0, dump_defaults = false, expand_values = false, hide_errors = false, delay_errors = false, hide_obsolete_warnings = false, ignore_unknown = false} i = 3 count = 143 full_line = 0x64656e696665646e line = <optimized out> fd = 7 ret = 0 dump_defaults = <optimized out> service_info_idx = 4294967295 root_filter = {parent = 0x1560691d0, protocol = 0x1 <error: Cannot access memory at address 0x1>, local_name = 0x156054200 "T`\025", local_host = 0x7fffc158a8a0 "", remote_host = 0x0, local_net = {family = 0, u = {ip6 = {__in6_u = {__u6_addr8 = '\000' <repeats 15 times>, __u6_addr16 = {0, 0, 0, 0, 0, 0, 0, 0}, __u6_addr32 = {0, 0, 0, 0}}}, ip4 = {s_addr = 0}}, scope_id = 0}, remote_net = {family = 10384, u = {ip6 = {__in6_u = {__u6_addr8 = "\001\000\000\000ШX\301\377\177\000\000\360\031r+", __u6_addr16 = {1, 0, 43216, 49496, 32767, 0, 6640, 11122}, __u6_addr32 = {1, 3243813072, 32767, 728898032}}}, ip4 = {s_addr = 1}}, scope_id = 1}, local_bits = 0, remote_bits = 0, filter_name = 0x0, filter_name_array = false, default_settings = false} root_filter_parser = <optimized out> root_default_filter = {parent = 0x7fffc158a7f8, protocol = 0x156052430 "", local_name = 0x0, local_host = 0x12b7404c0 <config_all_services> "\340 (\005V\001", remote_host = 0x19 <error: Cannot access memory at address 0x19>, local_net = {family = 42896, u = {ip6 = {__in6_u = { __u6_addr8 = "\377\177\000\000\000\000\000\000\000\000\000\000\300\004t+", __u6_addr16 = {32767, 0, 0, 0, 0, 0, 1216, 11124}, __u6_addr32 = {32767, 0, 0, 729023680}}}, ip4 = {s_addr = 32767}}, scope_id = 1}, remote_net = {family = 30208, u = {ip6 = {__in6_u = {__u6_addr8 = "\377\177\000\000@\251X\301\377\177\000\000p\211\004V", __u6_addr16 = {32767, 0, 43328, 49496, 32767, 0, 35184, 22020}, __u6_addr32 = {32767, 3243813184, 32767, 1443137904}}}, ip4 = {s_addr = 32767}}, scope_id = 1}, local_bits = 728816924, remote_bits = 1, filter_name = 0x12b747f00 "", filter_name_array = 128, default_settings = 168} prevfile = <optimized out> __func__ = "config_parse_file" #4 0x000000012b6f9690 in main (argc=<optimized out>, argv=<optimized out>) at doveconf.c:1238 _data_stack_cur_id = 2 master_service_flags = (MASTER_SERVICE_FLAG_STANDALONE | MASTER_SERVICE_FLAG_NO_INIT_DATASTACK_FRAME | MASTER_SERVICE_FLAG_DONT_SEND_STATS) scope = CONFIG_DUMP_SCOPE_ALL_WITHOUT_HIDDEN orig_config_path = <optimized out> config_path = 0x156049550 "/etc/dovecot/dovecot.conf" import_environment = 0x2 <error: Cannot access memory at address 0x2> error = 0x0 exec_args = <optimized out> setting_name_filters = <optimized out> i = <optimized out> c = <optimized out> ret = <optimized out> ret2 = <optimized out> dump_filter_parent = {parent = 0x0, protocol = 0x0, local_name = 0x0, local_host = 0x0, remote_host = 0x0, local_net = {family = 0, u = {ip6 = {__in6_u = { __u6_addr8 = '\000' <repeats 15 times>, __u6_addr16 = {0, 0, 0, 0, 0, 0, 0, 0}, __u6_addr32 = {0, 0, 0, 0}}}, ip4 = {s_addr = 0}}, scope_id = 0}, remote_net = { --Type <RET> for more, q to quit, c to continue without paging-- family = 0, u = {ip6 = {__in6_u = {__u6_addr8 = '\000' <repeats 15 times>, __u6_addr16 = {0, 0, 0, 0, 0, 0, 0, 0}, __u6_addr32 = {0, 0, 0, 0}}}, ip4 = {s_addr = 0}}, scope_id = 0}, local_bits = 0, remote_bits = 0, filter_name = 0x0, filter_name_array = false, default_settings = false} dump_filter = {parent = 0x7fffc158aa50, protocol = 0x0, local_name = 0x0, local_host = 0x0, remote_host = 0x0, local_net = {family = 0, u = {ip6 = {__in6_u = { __u6_addr8 = '\000' <repeats 15 times>, __u6_addr16 = {0, 0, 0, 0, 0, 0, 0, 0}, __u6_addr32 = {0, 0, 0, 0}}}, ip4 = {s_addr = 0}}, scope_id = 0}, remote_net = { family = 0, u = {ip6 = {__in6_u = {__u6_addr8 = '\000' <repeats 15 times>, __u6_addr16 = {0, 0, 0, 0, 0, 0, 0, 0}, __u6_addr32 = {0, 0, 0, 0}}}, ip4 = {s_addr = 0}}, scope_id = 0}, local_bits = 0, remote_bits = 0, filter_name = 0x0, filter_name_array = false, default_settings = false} config_path_specified = false hide_key = <optimized out> have_dump_filter = <optimized out> simple_output = <optimized out> check_full_config = <optimized out> dump_defaults = <optimized out> host_verify = <optimized out> dump_full = <optimized out> print_banners = <optimized out> hide_passwords = <optimized out> flags = (CONFIG_PARSE_FLAG_EXPAND_VALUES | CONFIG_PARSE_FLAG_RETURN_BROKEN_CONFIG) dump_config_import = <optimized out> -- Peter Varkoly SW Engineering(Systems) SUSE Software Solutions Germany GmbH Frankenstraße 146 D-90461 Nürnberg T +49-(0)911-740 53 0 E <varkoly(a)suse.com> https://www.suse.com/ (HRB 36809, AG Nürnberg) Geschäftsführer: Felix Imendörffer

2 1

no longer able to delete emails
by Thing 24 Jun '25

24 Jun '25

Hi, I am getting this error in Dovecot, Server Error: UID MOVE: (0.012 + 0.000 + 0.011 secs) and seem unable to send to trash *I think) In the logs i am seeing, 8><---- <W910Ii44SNgAAAAAAAAAAAAAAAAAAAAB>: Error: Mailbox Trash: read() failed with mbox: Input/output error Jun 23 07:30:58 email-001 dovecot: imap(steven)<120035><W910Ii44SNgAAAAAAAAAAAAAAAAAAAAB>: Error: Mailbox Trash: ftruncate() failed with mbox: Structure needs cleaning Jun 23 07:30:58 email-001 dovecot: imap(steven)<120035><W910Ii44SNgAAAAAAAAAAAAAAAAAAAAB>: Logged out in=165 out=1189 deleted=0 expunged=0 trashed=0 hdr_count=0 hdr_bytes=0 body_count=0 body_bytes=0 Jun 23 07:30:58 email-001 dovecot: imap-login: Login: user=<steven>, method=PLAIN, rip=::1, lip=::1, mpid=120067, secured, session=<WNR1Ii44TNgAAAAAAAAAAAAAAAAAAAAB> Jun 23 07:30:58 email-001 dovecot: imap(steven)<120067> 8><---- I doubt it is Dovecot but I have no idea as Google isnt helping much, any ideas please? I suspect it was a power loss issue as a CB failed on me. regards Steven Hi, I am getting this error in Dovecot, Server Error: UID MOVE: (0.012 + 0.000 + 0.011 secs) and seem unable to send to trash *I think) In the logs i am seeing, 8><---- <W910Ii44SNgAAAAAAAAAAAAAAAAAAAAB>: Error: Mailbox Trash: read() failed with mbox: Input/output error Jun 23 07:30:58 email-001 dovecot: imap (steven)<120035><W910Ii44SNgAAAAAAAAAAAAAAAAAAAAB>: Error: Mailbox Trash: ftruncate() failed with mbox: Structure needs cleaning Jun 23 07:30:58 email-001 dovecot: imap (steven)<120035><W910Ii44SNgAAAAAAAAAAAAAAAAAAAAB>: Logged out in=165 out=1189 deleted=0 expunged=0 trashed=0 hdr_count=0 hdr_bytes=0 body_count=0 body_bytes=0 Jun 23 07:30:58 email-001 dovecot: imap-login: Login: user=<steven>, method=PLAIN, rip=::1, lip=::1, mpid=120067, secured, session=<WNR1Ii44TNgAAAAAAAAAAAAAAAAAAAAB> Jun 23 07:30:58 email-001 dovecot: imap(steven)<120067> 8><---- I doubt it is Dovecot but I have no idea as Google isnt helping much, any ideas please? I suspect it was a power loss issue as a CB failed on me. regards Steven

2 3

Re: Problem email client iPhone ios18.2
by Michael Slusarz 17 Jun '25

17 Jun '25

Timo confirmed this type of message (see below) breaks iOS mail clients regardless of the IMAP server used. So it is almost certainly a client issue. We are in contact with the Apple Mail developers and have provided this debug information to them. michael > On 02/10/2025 7:19 AM MST Timo Sirainen via dovecot <dovecot(a)dovecot.org> wrote: > > > On 10. Feb 2025, at 15.24, Florian Effenberger via dovecot <dovecot(a)dovecot.org> wrote: > > > > Hello, > > > > frido--- via dovecot wrote on 10.02.25 at 14:07: > >> The problem as described at the start of this thread is not solved in iOS 18.3. A bit more testing shows that it only appears to happen with attachments around 1MB and bigger. > > > > there seem to be two kind of problems, at least on my devices. > > I'm also wondering if there are multiple issues. I have one way of easily reproducing, but it has nothing to do with IMAP IDLE. Here's a test email which causes the hang - snipped it a bit in the middle which you can fill out yourself with: > > dd if=/dev/urandom bs=1024 count=3432 | base64 -w76 > > If you want to test multiple times, change Message-Id for every delivery. This mail can be simply saved to INBOX, e.g. with doveadm save: > > To: <user(a)example.com> > Subject: testing > Content-Type: multipart/mixed; boundary="foo" > Date: Tue, 17 Dec 2024 06:46:17 +0000 > From: <user(a)example.com> > Message-Id: <fooab(a)example.com> > > > > --foo > Content-Type: multipart/alternative; boundary="bar" > > --bar > Content-Transfer-Encoding: quoted-printable > Content-Type: text/html; charset=UTF-8 > > asdf > --bar-- > > --foo > Content-Description: test.pdf > Content-Disposition: attachment; filename="test.pdf" > Content-Transfer-Encoding: base64 > Content-Type: application/octet-stream; name="test.pdf" > > > lBjZO0luFuyUiOqQ8KPTTpMyPoNhlSTPPJauDuCVSwbZgaNyhnObul5qrdyPKo0NGiQKA3Kha34A > <61642 lines of random> > 4cNyk39T2wMsnQavfl8LXwG1vNQylpgmSN4p6fOpmGqQ > > --foo-- > > _______________________________________________ > dovecot mailing list -- dovecot(a)dovecot.org > To unsubscribe send an email to dovecot-leave(a)dovecot.org

3 3

Re: (solved) Dovecot 2.4.1 last-login configuration pattern: Unknown setting: pattern (dict_map_key_field_pattern or dict_map_key_field_service_pattern not found either.)
by Michael Borgelt 16 Jun '25

16 Jun '25

Zitat von Michael Borgelt via dovecot <dovecot(a)dovecot.org>: > Hello, > I am trying to configure last-login plugin for dovecot 2.4.1 and > getting the following error. > > doveconf -n > # 2.4.1-4 (7d8c0e5759): /etc/dovecot/dovecot.conf > # Pigeonhole version 2.4.1-4 (0a86619f) > doveconf: Fatal: Error in configuration file > /etc/dovecot/conf.d/30-lastlogin.conf line 24: pattern: Unknown > setting: pattern (dict_map_key_field_pattern or > dict_map_key_field_service_pattern not found either.) > > I am using the example config from the dovecot 2.4 documentation. > https://doc.dovecot.org/2.4.0/core/plugins/last_login.html#mysql-example > > Is this a bug in the config parser or in the example config? > > doveconf -n output with pattern lines in 30-lastlogin.conf commented: > > # 2.4.1-4 (7d8c0e5759): /etc/dovecot/dovecot.conf > # Pigeonhole version 2.4.1-4 (0a86619f) > # OS: Linux 6.12.27-amd64 x86_64 Debian 13.0 > # Hostname: debian.dg4yfa.org > # 4 default setting changes since version 2.4.0 > dovecot_config_version = 2.4.0 > auth_mechanisms = plain login > auth_username_format = %{user|username|lower} > dovecot_storage_version = 2.4.0 > first_valid_uid = 1000 > fts_autoindex = yes > fts_autoindex_max_recent_msgs = 999 > fts_search_add_missing = yes > imapsieve_url = sieve://127.0.0.1:4190 > language_filters = normalizer-icu snowball stopwords > language_tokenizers = generic email-address > last_valid_uid = 65530 > lda_mailbox_autocreate = yes > mail_driver = maildir > mail_inbox_path = ~/Maildir/.INBOX > mail_path = ~/Maildir > mail_plugins { > virtual = yes > fts = yes > fts_flatcurve = yes > quota = yes > } > mail_privileged_group = mail > protocols { > imap = yes > lmtp = yes > sieve = yes > pop3 = yes > } > quota_storage_size = 1G > sieve_execute_bin_dir = /usr/share/dovecot-pigeonhole/sieve > sieve_global_extensions { > vnd.dovecot.pipe = yes > vnd.dovecot.execute = yes > } > sieve_pipe_bin_dir = /usr/share/dovecot-pigeonhole/sieve > sieve_plugins = sieve_imapsieve sieve_extprograms > passdb pam { > } > userdb passwd { > result_failure = return-fail > result_success = continue > } > userdb passwd-file { > auth_username_format = %{user | username} > passwd_file_path = /etc/dovecot/users > driver = passwd-file > result_failure = return-ok > result_internalfail = continue > } > namespace inbox { > inbox = yes > mailbox Drafts { > special_use = "\\Drafts" > } > mailbox Entw&APw-rfe { > special_use = "\\Drafts" > } > mailbox Junk { > special_use = "\\Junk" > } > mailbox Spam { > special_use = "\\Junk" > } > mailbox Trash { > special_use = "\\Trash" > quota_storage_extra = 100M > } > mailbox Sent { > special_use = "\\Sent" > } > mailbox "Sent Messages" { > special_use = "\\Sent" > } > } > service imap-login { > inet_listener imap { > } > inet_listener imaps { > } > } > service pop3-login { > inet_listener pop3 { > } > inet_listener pop3s { > } > } > service submission-login { > inet_listener submission { > } > inet_listener submissions { > } > } > service lmtp { > unix_listener lmtp { > } > } > service imap { > } > service pop3 { > } > service submission { > } > service auth { > unix_listener auth-userdb { > } > } > service auth-worker { > } > service dict { > unix_listener dict { > } > } > ssl_server { > cert_file = /etc/dovecot/private/dovecot.pem > key_file = /etc/dovecot/private/dovecot.key > } > protocol lda { > mail_plugins { > sieve = yes > } > } > namespace virtual { > mail_driver = virtual > mail_path = ~/Maildir/virtual > prefix = virtual. > separator = . > } > protocol imap { > mail_plugins { > imap_sieve = yes > virtual = yes > imap_quota = yes > last_login = yes > } > } > protocol lmtp { > auth_username_format = %{user | username | lower} > mail_plugins { > sieve = yes > } > } > service managesieve-login { > inet_listener sieve { > port = 4190 > } > inet_listener sieve_deprecated { > port = 2000 > } > } > service managesieve { > } > last_login { > key = # hidden, use -P to show it > precision = ms > dict proxy { > name = sql > } > } > dict_server { > dict sql { > sql_driver = mysql > mysql localhost { > dbname = vmail > password = # hidden, use -P to show it > user = vmail > } > dict_map "shared/last-login/$service/$user/$remote_ip" { > sql_table = last_login > dict_map_value_field last_access { > type = uint > } > dict_map_key_field service { > } > dict_map_key_field userid { > } > dict_map_key_field last_ip { > } > } > } > } > language de { > filters = lowercase snowball > } > language en { > default = yes > filters = lowercase snowball english-possessive stopwords > } > fts flatcurve { > substring_search = yes > } > quota "User quota" { > driver = count > quota_warning warn-95 { > quota_storage_percentage = 95 > execute quota-warning { > args = 95 %{user} > } > } > quota_warning warn-80 { > quota_storage_percentage = 80 > execute quota-warning { > args = 80 %{user} > } > } > } > service quota-warning { > executable = script /usr/local/bin/quota-warning.sh > user = dovecot > unix_listener quota-warning { > user = Debian-exim > } > } > sieve_script personal { > active_path = ~/.dovecot.sieve > driver = file > path = ~/sieve > } > sieve_script default { > driver = file > name = default > path = /etc/dovecot/sieve/default/ > type = default > } > mailbox Spam { > sieve_script report-spam { > cause = copy > path = /usr/lib/dovecot/sieve/report-spam.sieve > type = before > } > } > imapsieve_from Spam { > sieve_script report-ham { > cause = copy > path = /usr/lib/dovecot/sieve/report-ham.sieve > type = before > } > } > > Thank you, > Michael > > > -- > Michael Borgelt > Email: mborgelt(a)borgelt.org > > _______________________________________________ > dovecot mailing list -- dovecot(a)dovecot.org > To unsubscribe send an email to dovecot-leave(a)dovecot.org Hello. I was able to solve the problem by replacing 'pattern' in 'dict_map' configuration with 'value'. With the following config the last_login table in mysql is getting filled as expected: last_login { dict proxy { name = sql } key = last-login/%{service}/%{user}/%{remote_ip} precision = ms } dict_server { dict sql { sql_driver = mysql mysql sql.example.com { dbname = mails user = dovecot password = pass } dict_map shared/last-login/$service/$user/$remote_ip { sql_table = last_login value_field last_access { type = uint } key_field userid { value = $user } key_field service { value = $service } key_field last_ip { value = $remote_ip } } } } The example in the dovecot documentation should be updated accordingly. Regards Michael. -- Michael Borgelt Email: michael(a)borgelt.org -- Michael Borgelt Email: mborgelt(a)borgelt.org

1 0

How do I enable the CDB backend in Dovecot 2.4.1? → “auth: Fatal: Unknown passdb driver ‘cdb’”
by Brent Clark 16 Jun '25

16 Jun '25

Good day everyone, I’m trying to authenticate against a constant database (CDB) file. After reading the /cdb_path/ description in the 2.4.1 manual (⟨https://doc.dovecot.org/2.4.1/core/summaries/settings.html#cdb_path⟩ <https://doc.dovecot.org/2.4.1/core/summaries/settings.html#cdb_path%E2%9F%A9>) I added the following to the conf file.: |passdb cdb { cdb_path = /srv/mail/passwd.cdb } userdb cdb { cdb_path = /srv/mail/passwd.cdb } | But dovecot says |auth: Fatal: Unknownpassdb driver 'cdb'| dovecot --version 2.4.1-4+debian11 (7d8c0e5759) I cant see anything in the changelogs. Is the “cdb” driver still available in 2.4.1, or was it renamed/removed? Any pointers (or a minimal working example) would be greatly appreciated. Kind Regards Brent Clark Good day everyone, I’m trying to authenticate against a constant database (CDB) file. After reading the cdb_path description in the 2.4.1 manual (⟨https:// doc.dovecot.org/2.4.1/core/summaries/settings.html#cdb_path⟩) I added the following to the conf file.: passdb cdb { cdb_path = /srv/mail/passwd.cdb } userdb cdb { cdb_path = /srv/mail/passwd.cdb } But dovecot says auth: Fatal: Unknown passdb driver 'cdb' dovecot --version 2.4.1-4+debian11 (7d8c0e5759) I cant see anything in the changelogs. Is the “cdb” driver still available in 2.4.1, or was it renamed/removed? Any pointers (or a minimal working example) would be greatly appreciated. Kind Regards Brent Clark

3 3

Why would "doveadm mailbox" check certificate file access?
by Ralph Seichter 15 Jun '25

15 Jun '25

The following came as a nasty surprise while testing Dovecot 2.4.1-4: alice@host $ doveadm mailbox list -u $(whoami) doveconf: Fatal: Error in configuration file /etc/dovecot/dovecot.conf line 61: cert_file: open(/path/to/cert.pem) failed: Permission denied Unprivileged user Alice does not have access to cert.pem, nor does she need it. Calling "doveadm flags ..." causes the same error. I suspect other subcommands are affected as well, but did not test it. The technical reason might be that dovecot.conf is parsed for each doveadm invocation? In any case, the certificate access check for subcommands like "flags" or "mailbox" seems like a bug to me. -Ralph

3 4

Migrating to Docker 2.4.1 not show Mailbox elements
by alberto 15 Jun '25

15 Jun '25

Hi, I'm migrating my physical Dovecot Server 2.2.33.2 to a new 2.4.1 (latest) on Docker container installation. I've got auth process successfully (Mariadb + Wforce included), but I cannot see their Maildir mailbox structure and elements, and logging debug not show errors related. I detected in my probe account that when I make logging with the new installation, a new "Maildir" directory into Mailbox structure disk is created, as unique difference that I noted, and perhaps would be a symptom, but I'm not sure. ... imap(probe@mydomain)<20><BpSIoIY3GIpYDjFl>: Info: Mailbox INBOX: Mailbox created ... --- "probe@mydomain" account disk structure --- drwxrwsr-x 7 mail dovecot 4096 dic 19 09:33 .. drwx--S--- 3 dovecot dovecot 4096 jun 14 13:40 Maildir drwxrwsr-x 2 dovecot dovecot 4096 jun 13 20:12 tmp drwxrwsr-x 2 dovecot dovecot 4096 jun 14 12:42 new drwxrwsr-x 2 dovecot dovecot 16384 jun 14 12:47 cur drwx--S--- 3 dovecot dovecot 4096 jun 3 16:02 sieve drwxrwsr-x 5 dovecot dovecot 4096 jun 14 12:57 .Sent drwxrwsr-x 5 dovecot dovecot 4096 nov 9 2020 .spam drwxrwsr-x 5 dovecot dovecot 4096 abr 30 2019 .Drafts drwxrwsr-x 5 dovecot dovecot 4096 jun 14 12:47 .Trash -rw------- 1 dovecot dovecot 212 jul 28 2019 .dovecot.svbin -rw-rw-r-- 1 dovecot dovecot 656 feb 11 02:09 dovecot.index -rw-rw-r-- 1 dovecot dovecot 31832 jun 14 12:47 dovecot.index.cache -rw-rw-r-- 1 dovecot dovecot 26252 jun 14 12:57 dovecot.index.log -rw-rw-r-- 1 dovecot dovecot 7420 ene 16 14:32 dovecot.list.index.log -rw-rw-r-- 1 dovecot dovecot 29 may 4 2019 dovecot-acl-list -rw-rw-r-- 1 dovecot dovecot 10 oct 31 2020 dovecot-keywords -rw------- 1 dovecot dovecot 240 dic 26 16:37 dovecot.mailbox.log -rw------- 1 dovecot dovecot 8 dic 26 16:37 dovecot-uidvalidity -r--r--r-- 1 dovecot dovecot 0 abr 19 2019 dovecot-uidvalidity.5cb9d075 -rw-rw-r-- 1 dovecot dovecot 909 jun 13 20:12 dovecot-uidlist -rw-rw-r-- 1 dovecot dovecot 87 dic 26 16:37 subscriptions --- old other account disk structure --- drwxrwsr-x 7 mail dovecot 4096 dic 19 09:33 .. drwxrwsr-x 2 dovecot dovecot 4096 oct 8 2024 tmp drwxrwsr-x 2 dovecot dovecot 4096 oct 8 2024 new drwxrwsr-x 2 dovecot dovecot 4096 oct 8 2024 cur drwx--S--- 3 dovecot dovecot 4096 may 27 23:38 sieve drwxrwsr-x 5 dovecot dovecot 4096 abr 2 15:37 .Sent drwxrwsr-x 5 dovecot dovecot 4096 may 26 17:03 .spam drwxrwsr-x 5 dovecot dovecot 4096 abr 30 2019 .Drafts drwxrwsr-x 5 dovecot dovecot 4096 sep 4 2020 .Trash lrwxrwxrwx 1 dovecot dovecot 23 may 4 2019 .dovecot.sieve -> sieve/managesieve.sieve -rw------- 1 dovecot dovecot 264 may 5 2019 .dovecot.svbin -rw-rw-r-- 1 dovecot dovecot 816 oct 17 2019 dovecot.index -rw-rw-r-- 1 dovecot dovecot 30152 abr 2 15:35 dovecot.index.log -rw-rw-r-- 1 dovecot dovecot 30884 abr 2 15:35 dovecot.index.cache -rw-rw-r-- 1 dovecot dovecot 146 may 3 2019 dovecot.index.thread -rw-rw-r-- 1 dovecot dovecot 13 may 2 2019 dovecot-keywords -rw-rw-r-- 1 dovecot dovecot 240 oct 17 2019 dovecot.mailbox.log -rw------- 1 dovecot dovecot 8 oct 17 2019 dovecot-uidvalidity -rw-rw-r-- 1 dovecot dovecot 1773 oct 8 2024 dovecot-uidlist -rw-rw-r-- 1 dovecot dovecot 54 oct 17 2019 subscriptions This is my new Docker installation config: # 2.4.1 (7d8c0e5759): /etc/dovecot/dovecot.conf # Pigeonhole version 2.4.1 (0a86619f) # OS: Linux 4.15.0 x86_64 Debian 12.11 # Hostname: midovecot # 4 default setting changes since version 2.4.0 dovecot_config_version = 2.4.0 auth_allow_weak_schemes = yes auth_debug_passwords = yes auth_mechanisms = plain login cram-md5 auth_verbose_passwords = yes debug_log_path = /dev/stdout default_internal_group = vmail default_internal_user = vmail default_login_user = vmail deliver_log_format = msgid=%{msgid}: %{message} (subject=%{subject} from=%{from} To=%{to_envelope} size=%{size}) dovecot_storage_version = 2.4.0 first_valid_gid = 119 first_valid_uid = 108 import_environment { CORE_ERROR = %{env:CORE_ERROR} CORE_OUTOFMEM = %{env:CORE_OUTOFMEM} MALLOC_MMAP_THRESHOLD_ = 131072 PATH = %{env:PATH} TZ = %{env:TZ} } instance_name = midovecot last_valid_gid = 119 last_valid_uid = 108 log_debug = category=mail log_path = /dev/stdout mail_driver = maildir mail_gid = vmail mail_home = /var/mail/%{user|lower} mail_log_events = delete undelete expunge copy mailbox_create mailbox_delete mailbox_rename flag_change append mail_plugins { notify = yes mail_log = yes acl = yes quota = yes } mail_uid = vmail mail_utf8_extensions = yes mailbox_list_layout = index mailbox_list_utf8 = yes protocols = imap lmtp sql_driver = mysql state_dir = /run/dovecot service imap-login { client_limit = 100 process_min_avail = 1 inet_listener imap { port = 0 } inet_listener imaps { port = 31993 ssl = yes } } service imap { } service pop3-login { inet_listener pop3 { port = 0 } inet_listener pop3s { port = 0 ssl = yes } } service pop3 { } service submission-login { inet_listener submission { port = 31587 } inet_listener submissions { port = 31465 } } service submission { } service managesieve-login { client_limit = 100 process_min_avail = 1 inet_listener sieve { port = 34190 } inet_listener sieve_deprecated { port = 2000 } } service managesieve { } service lmtp { unix_listener lmtp { } } service auth { unix_listener auth-userdb { } } service auth-worker { } service dict { unix_listener dict { } } service stats { process_min_avail = 1 inet_listener http { port = 9090 } } service doveadm { inet_listener http { port = 8080 ssl = yes } } mysql mimariadb { dbname = xxxxxx password = # hidden, use -P to show it user = xxxxxxx } passdb sql { default_password_scheme = CRYPT query = SELECT username, domain, home AS userdb_home, uid AS userdb_uid, gid AS userdb_gid, (CASE WHEN '%{mechanism}' = 'CRAM-MD5' THEN crampassword ELSE password END) AS password, concat('*:bytes=', quota) AS userdb_quota_rule, concat('*:messages=', quotamsgs) AS userdb_quota_rule3 FROM users WHERE username = '%{user|username}' AND domain = '%{user|domain}' AND active = 'Y' } userdb sql { iterate_query = SELECT username,domain AS user FROM users query = SELECT home, uid, gid, concat('*:bytes=', quota) AS quota_rule, concat('*:messages=', quotamsgs) AS quota_rule3 FROM users WHERE username = '%{ user | username | lower }' AND domain = '%{ user | domain | lower }' } auth_policy { hash_nonce = # hidden, use -P to show it server_api_header = Authorization: Basic d2ZvcmNlOmllcGE server_url = http://miwforce:8084 } ssl_server { cert_file = /dovecot/albertocerts/fullchain.pem key_file = /dovecot/albertocerts/privkey.pem key_password = # hidden, use -P to show it } namespace inbox { inbox = yes separator = / type = private mailbox Drafts { special_use = "\\Drafts" } mailbox Junk { special_use = "\\Junk" } mailbox Trash { auto = subscribe autoexpunge = 10d special_use = "\\Trash" quota_storage_extra = 100M } mailbox Sent { special_use = "\\Sent" } mailbox "Sent Messages" { special_use = "\\Sent" } } namespace shared { prefix = shared/$user/ type = shared } protocol imap { mail_plugins { imap_filter_sieve = yes imap_acl = yes imap_quota = yes } } protocol lmtp { mail_plugins { sieve = yes } } quota "User quota" { storage_size = 1G quota_warning warn-95 { quota_storage_percentage = 95 execute quota-warning { args = 95 %{user} } } quota_warning warn-80 { quota_storage_percentage = 80 execute quota-warning { args = 80 %{user} } } } service quota-warning { executable = script /dovecot/albertobin/quota-warning.sh user = vmail unix_listener quota-warning { user = vmail } } Best Regards, Alberto

2 8

BUG: extra_groups doesn't accept multiple values
by m＠sacha.pl 14 Jun '25

14 Jun '25

Hello, I'm reporting a bug in the config processor/parser. The option extra_groups does not accept multiple (list) values. If you put a section like: service auth-worker { user = $default_internal_user group = $default_internal_group extra_groups = shadow mail } you will get the error message like: dovecotFatal: service(auth-worker) Group doesn't exist: shadow mail (See service auth-worker { extra_groups } setting) It is trivial to reproduce - just try to run the dovecot with the section like above, and you will get the error. Best regards, Marcin

2 1

Dovecot and xoauth2: oauth2 active_attribute check failed
by Markus Grandpré 14 Jun '25

14 Jun '25

Dear dovecot list members, I am currently working on the task of implementing an MFA solution with OpenID for our SOGo server v5.12.1.20250612-1 and our Dovecot server v2.3.21.1. For this purpose, we are using a Shibboleth IDP v5.1.4 with the appropriate OpenID extension via XOAUTH2. In my opinion, authentication and autorization requests and responses between SOGo and the IDP are working flawlessly, and with: SOGoSMTPAuthenticationType = xoauth2; NGImap4AuthMechanism = xoauth2; the SOGo server forwards the received access token to the Dovecot server. On the Dovecot side, I have configured the server as follows: /etc/dovecot/conf.d/10-auth.conf: disable_plaintext_auth = yes auth_username_format = %Ln auth_master_user_separator = * auth_mechanisms = plain login auth_verbose = yes auth_verbose_passwords = no auth_debug = yes auth_debug_passwords = yes mail_debug = yes verbose_ssl = yes !include auth-master.conf.ext !include auth-oauth2.conf.ext /etc/dovecot/conf.d/auth-oauth2.conf.ext auth_mechanisms = $auth_mechanisms plain xoauth2 oauthbearer passdb { driver = oauth2 mechanisms = xoauth2 oauthbearer args = /etc/dovecot/dovecot-oauth2.conf.ext } userdb { driver = static args = uid=vmail gid=vmail home=/var/vmail/%u } service auth { unix_listener /var/spool/postfix/private/auth { mode = 0660 # Assuming the default Postfix user and group user = postfix group = postfix } } /etc/dovecot/dovecot-oauth2.conf.ext introspection_mode = post introspection_url = https://<ID>>:<SECRET>@idp-test.uni-konstanz.de/idp/profile/oauth2/introspection username_attribute = mail tls_ca_cert_file = /etc/ssl/certs/ca-certificates.crt active_attribute = active active_value = true As soon as the SOGo server contacts the Dovecot server, and the latter contacts the IDP server, I see the following error message in the Dovecot server logs: Jun 13 11:44:47 bamenda dovecot: auth: Debug: http-client[1]: request [Req7: POST https://idp-test.uni-konstanz.de/idp/profile/oauth2/introspection] Free (requests lef t=1) Jun 13 11:44:47 bamenda dovecot: auth: Debug: oauth2(pop519315,134.34.240.55,<kMaO5XA3FrWGIvA3>): Introspection succeeded Jun 13 11:44:47 bamenda dovecot: auth: Debug: oauth2(pop519315,134.34.240.55,<kMaO5XA3FrWGIvA3>): Processing field active Jun 13 11:44:47 bamenda dovecot: auth: Debug: oauth2(pop519315,134.34.240.55,<kMaO5XA3FrWGIvA3>): oauth2 active_attribute check failed: expected active="true" but got "false" Jun 13 11:44:47 bamenda dovecot: auth: oauth2(pop519315,134.34.240.55,<kMaO5XA3FrWGIvA3>): oauth2 failed: Introspection failed: Provided token is not valid Jun 13 11:44:47 bamenda dovecot: auth: Debug: oauth2(pop519315,134.34.240.55,<kMaO5XA3FrWGIvA3>): Finished passdb lookup Jun 13 11:44:47 bamenda dovecot: auth: Debug: auth(pop519315,134.34.240.55,<kMaO5XA3FrWGIvA3>): Auth request finished Is the error on the IDP side, or is there something wrong with my Dovecot configuration, or both? How can I make Dovecot more verbose the way I could see all the tokens exchanged with SOGo and IDP? I would greatly appreciate your help. Best regards, Markus Grandpré -- Markus Ludwig Grandpré Universität Konstanz Kommunikations-, Informations-, Medienzentrum (KIM) Abteilung IT-Dienste Forschung und Lehre, B803, Tel: +49 7531 88 4342

2 1

dovecot-2.4 problems with uid/gid and mbox settings
by "Tóth Attila" 14 Jun '25

14 Jun '25

1. I have a disturbing uid/gid issue: up until dovecot-2.3, dovecot changed its uid/gid to the user it is delivering the mail for. I'm the first user on the system with uid 1000 and the users gid is 100. Therefore I kept first_valid_uid = 1000 and first_valid_gid = 100. Now that I've upgraded to dovecot-2.4, it immediately started to complain about unable to change uid/gid, because it tries to write in user's directory as mail:mail. Mail directories and files in it are accessible only by the owner, not even by the group. So even after lowering first_valid_uid/gid, the operation fails. Are there any configuration options to restore dovecot-2.3 behavior to change uid:gid to the actual user Jun 8 21:40:52 server dovecot: imap(user)<48978><1LgipBQ3LO1/AAAB>: Error: mkdir(/home/user/mail/.imap) failed: Permission denied (euid=8(mail) egid=12(mail) missing +x perm: /home/user/mail, dir owned by 1000:100 mode=0700) Jun 8 21:40:52 server dovecot: imap(user)<48978><1LgipBQ3LO1/AAAB>: Error: mkdir(/home/user/mail/.imap) failed: Permission denied (euid=8(mail) egid=12(mail) missing +x perm: /home/user/mail, dir owned by 1000:100 mode=0700) 2. I know, that mbox is deprecated as of dovecot-2.4 - or that it has been long superseded by more modern formats, but I have a setup for 20+ years (without any problems and less files) and before I would convert it to Maildir, I'd rather provide a transition period and keep using mbox for a little while. During dovecot-2.3 times this was my mail_location setting: mail_location = mbox:~/mail/:INBOX=/var/spool/mail/%u Mails get delivered into /var/spool/mail/user and when dovecot reads them, they get copied under /home/user/mail. Now for dovecot-2.4 I'm forced to came up with this: mail_driver = mbox mail_path = /home/%{user}/mail mail_inbox_path = /var/spool/mail/%{user} #mail_home Are there anyone else with a setup like this struggling with dovecot-2.4? Thanks: Dw. -- dr Tóth Attila, Radiológus, 06-20-825-8057 Attila Toth MD, Radiologist, +36-20-825-8057

2 1

Verifying LDAP configuration from command line ?
by BuzzSaw Code 14 Jun '25

14 Jun '25

Dovecot version : 2.3.x - using RedHat build Years ago I had a Dovecot install that was setup to perform certificate based authentication for clients that worked well - part of that setup was creating a passdb that pointed to a flat file that contained entries like this: cool.joe.c:{PLAIN}::::::username=cooljc and the passdb definition looked like this: passdb { driver = passwd-file args = scheme=plain /etc/dovecot/users.external skip = authenticated mechanisms = EXTERNAL default_fields = uid=vmail gid=vmail nopassword=1 } That worked and we had a cron job that would build that users.external file and keep it up to date. Now, a few years down the road, I've setup a new Dovecot server that is working wonderfully but I'd like to add the same functionality but also use a direct LDAP query instead of managing a flat file to maintain the list of users. I have another passdb entry that is using LDAP that works great for username/password auth, but I'd like to test what I think is a proper LDAP configuration specific for this passdb, But for the life of me I can't find out how to test the configuration file without having to actually update my dovecot configuration to use it. I'm looking for something like the Postfix 'postmap' tool that I can provide my configuration file for the LDAP lookup, give a username input to and it will show me the results from the configuration, including the return values. Is there such a tool ? Or do I have to setup a test server, add it to the config, and debug it ? Sorry if this is FAQ or dumb question - I've been reading documentation on the official Dovecot site looking for the answer but I'm either missing it or I'm reading the wrong docs.

4 3

FreeBSD deployment
by Eugene R 07 Jun '25

07 Jun '25

Hello! I am planning a migration of the Postfix/Dovecot mail system to a new FreeBSD server. In recent years, I have come to prefer the official ports/packages installations; however, the FreeBSD port of Dovecot is still at 2.3.21 which is substantially different from the current upstream 2.4.1. I have no problems with installing from sources (have been doing that for a long time) but I wonder what is the recommended approach with regard to the installation and configuration paths. I would prefer to follow the standard conventions and eventually switch to the ports-based install once it catches up, with minimal disruption and reconfiguration. Thank you in advance Eugene

4 4

GSSAPI authentication for sieve
by Paul Zirnik 05 Jun '25

05 Jun '25

Hi all, I try to get GSSAPI working for sieve. I already found there was an issue with GSSAPI in dovecot 2.4 and applied the patch from this thread https://dovecot.org/mailman3/archives/list/dovecot@dovecot.org/thread/MWCLQ… With the patch GSSAPI now works for imap. I do test this with "imtest" from cyrus tools imat@speedy:~> imtest -v -p 143 -u imat -m GSSAPI manitou.disconnected.homeip.net S: * OK [CAPABILITY IMAP4rev1 LOGIN-REFERRALS ID ENABLE IDLE SASL-IR LITERAL+ STARTTLS LOGINDISABLED AUTH=GSSAPI] Dovecot ready. C: A01 AUTHENTICATE GSSAPI YIIDIgYJKoZIhvcSAQICAQBuggMRMIIDDaADAgEFoQMCAQ6iBwMFACAAAACjggIaYYICFjCCAhKgAwIBBaEZGxdESVNDT05ORUNURUQuSE9NRUlQLk5FVKIyMDCgAwIBA6EpMCcbBGltYXAbH21hbml0b3UuZGlzY29ubmVjdGVkLmhvbWVpcC5uZXSjggG6MIIBtqADAgESoQMCAQKiggGoBIIBpFcei+vGql9tb5TpNjKFgdKAo7p1IiSW8DXPJR2GkCrHVrm0LdtsUaky4zOCskwEQkLURA8CuxM5HGmXT38O56434VTStpRHWZx7Xu43UHHJpOjdf76YYqnIA7WEk76QQyUpnO3hQWCEwyAPf1GhQKGDWCosHEuvn3jNE8t8fWmnRtWSgr35w5GD9OHsYKwca14yUruNU/qfVL9I41bjiFcJ1FFjMyVa/+ogghBm4jDoiFTV7vB8WYpx8Vuuev0d48TZDqv7Kf5/G8TgH3bc59VLjCemLAzTjOQ4mZxTXBEh9OpibKPUozRd266ao7dAD4OHMWNORXKqWl/Ch0iC7q/QEg/qY7E0dm7wqMDROrzmaxWW8p5+y69AbjwylsgivknVcTmbQjVnGGvniDLTke8O6CvqeIum/uUli2FyBmSUt8kVju1GIfoysFP8BEu6gDXdbcsG2XbuoTvfzLyJNT7eomILhF9nZI1vFariqF3TJLo14/L4OCG05RrAH3o8kHTkUMz8rrZj5y0yzfQqlME66yBRezRRSccrrD5AWdHzRMvw26SB2TCB1qADAgESooHOBIHLTo7UMx+G8Q+Ly+Mmj35JBfLm+SWeCV1YGcJQ8O1hI6F3pKh4fMjx5L9v4v4NzbDWpZ8YlQtSBcDgyebiZjHaeqGf4bIcOaGyzfor3DhAn0q0n0Zx/SKJiTJuT9eT0pHwb/yaT9MzOZTP6C5HuXgxUN/2Po2qNwkzaU5gOH+sOYu6Y0AKoKGlkIQHejzns70FehWRn8wBbu8T9+8zKRU0qmBQXnqg/C10pSW7EUVD37VPhY0kLY6SB77KS/8aguWWC3OVAfw6bcAXVVM= S: + YIGZBgkqhkiG9xIBAgICAG+BiTCBhqADAgEFoQMCAQ+iejB4oAMCARKicQRvzFWfR5FTOl77CqiMZ7qWR4I6JqXdi0JbIG4xTYJNYvQSsvxAxyfEiGINTMW5QytlcMvfiJpTj0U2Fd3Hr/MzLcCeCRwJ9jTg8m2E1ZgpmzmpXzl7xGq+MRIvetu3Wdgxum+ZQ8jPS1obTnI1Vh7I C: S: + BQQF/wAMAAAAAAAAHJz31AH///+2dWHfKNY/6f01FUw= C: BQQE/wAMAAAAAAAABI42iwEAAABpbWF0C53m6npnJwjAfaEu S: A01 OK [CAPABILITY IMAP4rev1 SASL-IR LOGIN-REFERRALS ID ENABLE IDLE SORT SORT=DISPLAY THREAD=REFERENCES THREAD=REFS THREAD=ORDEREDSUBJECT MULTIAPPEND URL-PARTIAL CATENATE UNSELECT CHILDREN NAMESPACE UIDPLUS LIST-EXTENDED I18NLEVEL=1 CONDSTORE QRESYNC ESEARCH ESORT SEARCHRES WITHIN CONTEXT=SEARCH LIST-STATUS BINARY MOVE REPLACE SNIPPET=FUZZY PREVIEW=FUZZY PREVIEW SPECIAL-USE STATUS=SIZE SAVEDATE COMPRESS=DEFLATE INPROGRESS NOTIFY LITERAL+] Logged in Authenticated. Security strength factor: 0 C: Q01 LOGOUT * BYE Logging out Q01 OK Logout completed (0.001 + 0.000 secs). Connection closed. When i try to use "sivtest" from cyrus tools, this does hang and it looks like sievtest is still waiting for some data imat@speedy:~> sivtest -v -p 4190 -u imat -m GSSAPI manitou.disconnected.homeip.net S: "IMPLEMENTATION" "Dovecot Pigeonhole" S: "SIEVE" "fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include body variables enotify environment mailbox date index ihave duplicate mime foreverypart extracttext" S: "NOTIFY" "mailto" S: "SASL" "GSSAPI" S: "STARTTLS" S: "VERSION" "1.0" S: OK "Dovecot ready." C: AUTHENTICATE "GSSAPI" {1076+} YIIDIwYJKoZIhvcSAQICAQBuggMSMIIDDqADAgEFoQMCAQ6iBwMFACAAAACjggIbYYICFzCCAhOgAwIBBaEZGxdESVNDT05ORUNURUQuSE9NRUlQLk5FVKIzMDGgAwIBA6EqMCgbBXNpZXZlGx9tYW5pdG91LmRpc2Nvbm5lY3RlZC5ob21laXAubmV0o4IBujCCAbagAwIBEqEDAgECooIBqASCAaTS89GNFHQk6FCilKJkEP8Xl27g/A8b1T0pxGwipjYBug0+bprqG0xJucYaULvqi1PnTI+A6WJesi2434B+L0WAv1sdWhI60SpmmfnsZPD8uqbJmZEFMj9bQnS4VbNgduhEA+pgYp85q0PcP3I5DcMeypIC7rk2hv15qYnVSYhND/P3tOANikXc5JB3cWnnPc79gRW+Ozi75waihMIv7C3UvllUtb2tTUKqdGwz2D9/BT3e1ZfcueaWznhXmzieh4dHZyqvbm4UVVUuc4paI1QMUrImy6zEfXjEH0O8dbZN3FbiKjCdP7E/zFtd6PkWaI0lgk8qGP1JqaFtGgqo+EcDEgyh4DoTRuNGGJp7n1zmQGkgIHzsUNR+SydUhWijdWJSegeIrGsZ4/s8YZupdxpC8g1qComP0+holawe9/iAnCxmRNGrNXDSRnL8wMaVAgm7t0SrBUSOm/YHKZSlHpMIWw438Dp/FdWwuCm2jA5pTksRbzmpS9fguMwp65bX0xh/a0NkI2VWJfwUmgqws3LRv1WHsn2FB/k+w55oOMboOtO3SCCkgdkwgdagAwIBEqKBzgSBy9PZObV0yc813IAR4TwEzPtKepfhzLvT0vFekCieE0sCu7jig2m+bpKt1IbIngs+hiztVx4TXYJu/UjH8UKNYct7xFWAOamuh/Fp4AnTBQXxieMM9TGZsiot7NzH75kRUY6SifNYYbz579wBAMbPzId5n2NVdp2blEpaCDKhMdZf/AQqUj3eFbafs5ociy4cOfmQSNuW7hY4KpQ0JU0cdWQyh0+Xl+fE9tz1ctmRoTA4WIF3U1UcwB0CPxlFxlw6cW+OAP0mlWqJE5Yx S: "YIGZBgkqhkiG9xIBAgICAG+BiTCBhqADAgEFoQMCAQ+iejB4oAMCARKicQRvEb5fwEVTKq3wm3xJawxEVD9Ngdz3tmzW5a8wJAh9lSRYSE0aJS97LvUtT1mWqZTFx5AZMJGfM7KpcbmJc3cOkVhe5lTUQDir58n1RywkyWYM6RvKd1Vzeonxt/AyJi7rN1CMR9VIh2KZUItIsz1y" here it hangs until timeout. May 24 10:10:36 manitou dovecot[45007]: auth(imat@disconnected.homeip.net,192.168.42.24,sasl:gssapi)<mh73Nt01+OHAqCoY>: Request timed out waiting for client to continue authentication (150 secs) May 24 10:11:06 manitou dovecot[45007]: managesieve-login: Login aborted: Inactivity during authentication (client didn't finish SASL auth, 1 attempts in 180 secs) (auth_waiting_client): user=<>, method=GSSAPI, rip=192.168.42.24, lip=192.168.42.42, session=<mh73Nt01+OHAqCoY> and sievtest does end with this S: BYE "Disconnected for inactivity during authentication." base64 decoding error Authentication failed. generic failure Security strength factor: 0 Connection closed. The "base64 decoding error" probably is unrelated as it does try to decode the "S: BYE .....". I also tested with other sieve clients, none does work (however different issues reported), while all tested imap clients do work. My guess is some small fix like the one from above is also needed for dovecot-pigeonhole. This is my used config manitou:~ # dovecot -n # 2.4.1-4 (7d8c0e5759): /etc/dovecot/dovecot.conf # Pigeonhole version 2.4.1-4 (0a86619f) # OS: Linux 6.14.6-1-default x86_64 # Hostname: manitou.disconnected.homeip.net # 4 default setting changes since version 2.4.0 dovecot_config_version = 2.4.0 auth_debug = yes auth_debug_passwords = yes auth_gssapi_hostname = manitou.disconnected.homeip.net auth_krb5_keytab = /etc/dovecot/dovecot.keytab auth_mechanisms = plain login gssapi dovecot_storage_version = 2.4.0 protocols { imap = yes lmtp = yes sieve = yes } protocol lmtp { auth_username_format = %{user | username} mail_plugins = sieve } service lmtp { unix_listener /var/spool/postfix/private/dovecot-lmtp { group = postfix mode = 0600 user = postfix } } service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0660 user = postfix } unix_listener auth-userdb { } } namespace inbox { mail_driver = maildir mail_inbox_path = ~/Maildir/.INBOX mail_path = ~/Maildir inbox = yes separator = / } passdb pam { service_name = dovecot } userdb passwd { use_worker = yes } ssl_server { cert_file = /etc/ssl/servercerts/servercert.pem key_file = /etc/ssl/servercerts/serverkey.pem } service managesieve-login { } service managesieve { } sieve_script personal { active_path = ~/.dovecot.sieve path = ~/.sieve } What logs/infos are needed to dig into it ? thanks and regards, Tami

1 1

Dovecot 2.4. field lookup for sqlite_path?
by Brent Clark 04 Jun '25

04 Jun '25

Good day Guys Reading: https://doc.dovecot.org/2.4.1/core/config/auth/databases/sql.html#sqlite Im trying to do a field look up but I get the following error message Failed to parse configuration: Failed to expand sqlite_path setting variables: dom ain: No value to get domain from This is what I have passdb sql { query = SELECT name AS username, password FROM mailboxes WHERE name = '%{user | username}' sqlite_path = /usr/home/.mail/%{domain}/mailconf.sq3 } If I hard code the path, then the error message goes away Regards Brent Clark

2 2

Fatal: Couldn't load required plugin /usr/lib/dovecot/lib90_sieve_plugin.so: dlopen() failed: Error relocating /usr/lib/dovecot/lib90_sieve_plugin.so: mail_deliver_get_return_address: symbol not found
by paradoor 04 Jun '25

04 Jun '25

Hi there, I have a Postfix/Dovecot server which today I upgraded from Alpine Linux 3.21 to 3.22. In the process, Dovecot updated from 2.3.21 to 2.4.1, and I updated my Dovecot config accordingly. At least `doveconf -n` runs without any error, and I'm able to start and run Dovecot. For context, I am using a passwd file where I enter usernames and argon2id passwords manually, since it's just a small mail server where I am the only user. The setup was working fine with Dovecot 2.3.x, and I've sent and received lots of mail before the update. However, I noticed that I'm no longer able to authenticate to the server since doing all the updates. I thought, maybe I should make sure the passwd file is correct with my password, so I tried running `doveadm pw -s argon2id`. I then got the error: `Fatal: Couldn't load required plugin /usr/lib/dovecot/lib90_sieve_plugin.so: dlopen() failed: Error relocating /usr/lib/dovecot/lib90_sieve_plugin.so: mail_deliver_get_return_address: symbol not found` I assume this is the cause of the problem, ie Dovecot isn't able to authenticate as this error occurs when a login attempt is made (I think?). I am not sure if this is an Alpine packaging issue or a Dovecot user issue, but just in case it's a user issue that I can fix myself, I thought to post here and ask if people know if there's something I can do to resolve this. I'm also posting to the Alpine mailing list in the case of it being an Alpine packaging issue. I've attached the output of `doveconf -n`; let me know if it's preferable to put this in the body of the email and I can send a reply with it in the body. `dovecot --version` is `2.4.1-4 (7d8c0e5759)`. Example `/var/log/dovecot.conf` authentication attempt: May 31 21:50:41 auth: Debug: conn unix:login (pid=21015,uid=91) [1]: client in: AUTH 4 PLAIN protocol=imap final-resp-ok secured=tls session=ElBsg3U25ou51Zrs lip=93.113.25.226 rip=185.213.154.236 lport=993 rport=35814 ssl_ja3_hash=422b5eb1ed3e9bdf65e87a42ed96ba1f local_name=mail.revsuine.xyz resp=<hidden> May 31 21:50:41 auth(${user | username},185.213.154.236,sasl:plain)<ElBsg3U25ou51Zrs>: Debug: passwd-file: Performing passdb lookup May 31 21:50:41 auth(${user | username},185.213.154.236,sasl:plain)<ElBsg3U25ou51Zrs>: Debug: passwd-file: lookup: user=${user | username} file=/etc/dovecot/passwd May 31 21:50:41 auth(${user | username},185.213.154.236,sasl:plain)<ElBsg3U25ou51Zrs>: Info: passwd-file: unknown user May 31 21:50:41 auth(${user | username},185.213.154.236,sasl:plain)<ElBsg3U25ou51Zrs>: Debug: passwd-file: Finished passdb lookup May 31 21:50:41 auth(${user | username},185.213.154.236,sasl:plain)<ElBsg3U25ou51Zrs>: Debug: Auth request finished May 31 21:50:41 auth(${user | username},185.213.154.236,sasl:plain)<ElBsg3U25ou51Zrs>: Debug: delaying auth failure May 31 21:50:43 auth: Debug: conn unix:login (pid=21015,uid=91) [1]: client passdb out: FAIL 4 user=${user | username} original_user=pid1 (The IP addresses are my public server IP address and a Mullvad VPN IP address, so not sensitive.) I'm using the same credentials and passwd file as before the update. Thanks in advance, appreciate any responses.

3 6

Crash in imapd
by Peter Chubb 02 Jun '25

02 Jun '25

Hi Folks, I'm seeing imapd crash when an evolution user accesses her primary mailbox. She can see the mailbox perfectly well using thunderbird or Apple Mail on an iPad; just not from her evolution instance. Version is 2.4.1-4 (7d8c0e5759) The error is an assertion failure: Panic: file istream-header-filter.c: line 665 (i_stream_header_filter_snapshot_free): assertion failed: (snapshot->mstream->snapshot_pending) I'm running on Debian unstable in an LXC container, using the Debian packaged version of dovecot. Filesystem for INBOX (mbox format) is XFS; home directories are mounted via NFS. The backtrace in gdb is: #0 0x00007f996709e95c in ?? () from /lib/x86_64-linux-gnu/libc.so.6 #1 0x00007f9967049cc2 in raise () from /lib/x86_64-linux-gnu/libc.so.6 #2 0x00007f99670324ac in abort () from /lib/x86_64-linux-gnu/libc.so.6 #3 0x00007f9967265964 in ?? () from /usr/lib/dovecot/libdovecot.so.0 #4 0x00007f9967333cb7 in ?? () from /usr/lib/dovecot/libdovecot.so.0 #5 0x00007f99672656c0 in i_panic () from /usr/lib/dovecot/libdovecot.so.0 #6 0x00007f996725eab1 in ?? () from /usr/lib/dovecot/libdovecot.so.0 #7 0x00007f9967345bdc in i_stream_snapshot_free () from /usr/lib/dovecot/libdovecot.so.0 #8 0x00007f9967345bdc in i_stream_snapshot_free () from /usr/lib/dovecot/libdovecot.so.0 #9 0x00007f9967345c6c in i_stream_unref () from /usr/lib/dovecot/libdovecot.so.0 #10 0x00007f996752bf99 in ?? () from /usr/lib/dovecot/libdovecot-storage.so.0 #11 0x00007f996752c391 in ?? () from /usr/lib/dovecot/libdovecot-storage.so.0 #12 0x00007f996752c64c in index_mail_get_special () from /usr/lib/dovecot/libdovecot-storage.so.0 #13 0x00007f99674a570e in mail_get_special () from /usr/lib/dovecot/libdovecot-storage.so.0 #14 0x000055fb1f1b298a in fetch_snippet (ctx=0x55fb4c044168, mail=0x55fb4c070e88, preview=0x55fb4c070230) at ./src/imap/imap-fetch-body.c:610 #15 0x000055fb1f1b7ce3 in imap_fetch_more_int (ctx=ctx@entry=0x55fb4c044168, cancel=false) at ./src/imap/imap-fetch.c:562 #16 0x000055fb1f1b7fbd in imap_fetch_more (ctx=0x55fb4c044168, cmd=0x55fb4c043e98) at ./src/imap/imap-fetch.c:617 #17 0x000055fb1f1ac1c8 in cmd_fetch (cmd=0x55fb4c043e98) at ./src/imap/cmd-fetch.c:382 #18 0x000055fb1f1b5124 in command_exec (cmd=cmd@entry=0x55fb4c043e98) at ./src/imap/imap-commands.c:208 #19 0x000055fb1f1bb650 in client_command_input (cmd=<optimized out>, cmd@entry=0x55fb4c043e98) at ./src/imap/imap-client.c:1271 #20 0x000055fb1f1bb6e6 in client_command_input (cmd=<optimized out>, cmd@entry=0x55fb4c043e98) at ./src/imap/imap-client.c:1341 #21 0x000055fb1f1bb97d in client_command_input (cmd=<optimized out>) at ./src/imap/imap-client.c:1305 #22 0x000055fb1f1bbb55 in client_handle_next_command (client=0x55fb4c042a68, remove_io_r=<synthetic pointer>) at ./src/imap/imap-client.c:1383 #23 client_handle_input (client=client@entry=0x55fb4c042a68) at ./src/imap/imap-client.c:1397 #24 0x000055fb1f1bbf47 in client_input (client=0x55fb4c042a68) at ./src/imap/imap-client.c:1441 #25 0x00007f996735177b in io_loop_call_io () from /usr/lib/dovecot/libdovecot.so.0 #26 0x00007f99673535ea in io_loop_handler_run_internal () from /usr/lib/dovecot/libdovecot.so.0 #27 0x00007f9967353694 in io_loop_handler_run () from /usr/lib/dovecot/libdovecot.so.0 #28 0x00007f9967353868 in io_loop_run () from /usr/lib/dovecot/libdovecot.so.0 #29 0x00007f99672a6347 in master_service_run () from /usr/lib/dovecot/libdovecot.so.0 #30 0x000055fb1f1a6e27 in main (argc=<optimized out>, argv=<optimized out>) at ./src/imap/main.c:601 dovecot -n === # 2.4.1-4 (7d8c0e5759): /etc/dovecot/dovecot.conf # Pigeonhole version 2.4.1-4 (0a86619f) # OS: Linux 6.12.16-amd64 x86_64 Debian 13.0 # Hostname: wombat.chubb.wattle.id.au # 4 default setting changes since version 2.4.0 dovecot_config_version = 2.4.0 dovecot_storage_version = 2.4.0 first_valid_uid = 130 fts_autoindex = yes fts_autoindex_max_recent_msgs = 999 fts_search_add_missing = yes mail_access_groups = mail mail_driver = mbox mail_full_filesystem_access = yes mail_home = /home/%{user|username} mail_inbox_path = /var/mail/%{user} mail_index_path = /var/indices/%{user} mail_nfs_storage = yes mail_path = ~/Mail/ mail_privileged_group = mail protocols { imap = yes } ssl_cipher_list = EDH+CAMELLIA:EDH+aRSA:EECDH+aRSA+AESGCM:EECDH+aRSA+SHA384:EECDH+aRSA+SHA256:EECDH:+CAMELLIA256:+ECDHE-RSA-AES256-GCM-SHA384:+AES256:+CAMELLIA128:+AES128:+SSLv3:DES-CBC3-SHA:!aNULL:!eNULL:!LOW:!3DES:!MD5:!EXP:!PSK:!DSS:RC4:!SEED:!ECDSA:CAMELLIA256-SHA:AES256-SHA:CAMELLIA128-SHA:AES128-SHA ssl_min_protocol = TLSv1 passdb pam { } userdb passwd { } namespace inbox { inbox = yes mailbox Drafts { special_use = "\\Drafts" } mailbox Junk { special_use = "\\Junk" } mailbox Trash { special_use = "\\Trash" } mailbox Sent { special_use = "\\Sent" } mailbox "Sent Messages" { special_use = "\\Sent" } mailbox Spam { special_use = "\\Junk" } } service imap-login { inet_listener imap { } inet_listener imaps { } } service pop3-login { inet_listener pop3 { } inet_listener pop3s { } } service submission-login { inet_listener submission { } inet_listener submissions { } } service lmtp { unix_listener lmtp { } } service imap { } service submission { } service auth { unix_listener auth-userdb { } } service auth-worker { } service dict { unix_listener dict { } } ssl_server { cert_file = /etc/dovecot/private/dovecot.pem key_file = /etc/dovecot/private/dovecot.key } passdb local { driver = pam } userdb local { driver = passwd } ---

2 1

Question about OSS-Fuzz
by 0xdeadtofu 01 Jun '25

01 Jun '25

Hello, I have been looking at the dovecot project in oss-fuzz [1] and I have noticed that the different fuzzers that are being built for dovecot do not have any sanitizer but UBSAN enabled. Normally, it's the default to fuzz with Address Sanitizer or Memory Sanitizer, so I was wondering, what is the reason for not enabling it? Kind Regards, Patrick Detering [1] https://github.com/google/oss-fuzz/tree/master/projects/dovecot

1 0

Help Translating Dovecot 2.3 Proxy Configuration to 2.4
by Brent Clark 31 May '25

31 May '25

Hi all, I'm in the process of upgrading from Dovecot 2.3 to 2.4 and would appreciate some help translating an existing configuration that uses a proxy lookup for user and password databases. Here's the relevant 2.3 configuration: |passdb { driver =dict args =/etc/dovecot/dovecot-dict-auth.conf.ext } userdb { driver =dict args =/etc/dovecot/dovecot-dict-auth.conf.ext } uri= proxy:/var/run/mail_directory_service/socket:somewhere password_key= passdb/%u user_key= userdb/%u iterate_disable= yes | This configuration was working fine in 2.3 to proxy user and password lookups to an external service via a Unix socket. However, Dovecot 2.4 has reworked configuration parsing, and this syntax no longer appears valid. I couldn’t find a direct equivalent in the 2.4 documentation. Could someone advise how this should be adapted for 2.4? What’s the correct way to specify the proxy: URI in 2.4? Are password_key and user_key still supported, or should I be using a different mechanism? Is iterate_disable = yes still relevant or required in this context? Any guidance, examples, or pointers to migration resources would be very helpful. Thanks in advance, Brent Clark Hi all, I'm in the process of upgrading from Dovecot 2.3 to 2.4 and would appreciate some help translating an existing configuration that uses a proxy lookup for user and password databases. Here's the relevant 2.3 configuration: passdb { driver =dict args =/etc/dovecot/dovecot-dict-auth.conf.ext } userdb { driver =dict args =/etc/dovecot/dovecot-dict-auth.conf.ext } uri = proxy:/var/run/mail_directory_service/socket:somewhere password_key = passdb/%u user_key = userdb/%u iterate_disable = yes This configuration was working fine in 2.3 to proxy user and password lookups to an external service via a Unix socket. However, Dovecot 2.4 has reworked configuration parsing, and this syntax no longer appears valid. I couldn’t find a direct equivalent in the 2.4 documentation. Could someone advise how this should be adapted for 2.4? What’s the correct way to specify the proxy: URI in 2.4? Are password_key and user_key still supported, or should I be using a different mechanism? Is iterate_disable = yes still relevant or required in this context? Any guidance, examples, or pointers to migration resources would be very helpful. Thanks in advance, Brent Clark

6 11

RE: dragging files into mail folders
by Marc 30 May '25

30 May '25

If I drag files in imap folders in outlook they will show up in eg roundcube/thunderbird as winmail.dat. So I guess this is just a microsoft thing. Would be nice if there were plugins that would add functionality that unwrapped these winmail.dat files. > > > If i Understood correctly you are looking for a software like > > roundcube or something right ?. > > Not necessarily, but would be a good start. Question is if the imap > allows to store these files directly. > > > > that offers ajax based GUI that allows > > you to drap and drop mails into folders. > > Files not mails. .jpg, .odt, .txt etc > > > > > > > > With exchange and outlook I was always used to sometimes drag files > > into mail folders. Is something like this available for imap? Or maybe > a > > dovecot extension? > > > > > > (obviously I am not looking for a solution to store them as > > attachments to mails) > > > _______________________________________________ > > > dovecot mailing list -- dovecot(a)dovecot.org > > > To unsubscribe send an email to dovecot-leave(a)dovecot.org

2 2

dragging files into mail folders
by Marc 28 May '25

28 May '25

With exchange and outlook I was always used to sometimes drag files into mail folders. Is something like this available for imap? Or maybe a dovecot extension? (obviously I am not looking for a solution to store them as attachments to mails)

1 0

Re: NAMESPACE empty when logging via haproxy but populated properly when logging directly
by dk+lists.dovecot.org＠7ns.eu 27 May '25

27 May '25

On 2025-05-22 17:41, dk+lists.dovecot.org(a)7ns.eu wrote: > > On 2025-05-22 16:55, Aki Tuomi via dovecot wrote: >>> >>> I see you a local 10.20.20.20 statement there, which changes how the >>> inbox prefix behaves, and I'm guessing (?) you are testing from >>> 10.20.20.20 as it's local, not remote. >>> >>> Which would explain why. >> >> Also to add a bit that the "local_ip" (not real_local_ip) gets updated >> with haproxy proxy protocol (when enabled), so it will remote >> haproxy's local IP. >> >> Aki >> > Wow. Thank you. It works. I mangled a IPs little bit before I send them > to mailist. All machines are in the same network. Client, Proxy, Server. > All in the same subnet. This is first time I see such problem with > server software and reverse proxy. Never seen similar problem. What > exactly this "local" statement do? Mail client is in the same network as > server, so after PROXY header is stripped, my mail client IP should be > seen by dovecot exactly the same, so shouldn't dovecot treat those > connections equally? oO > > Thank you again for tip Aki. > DK Hmm, now I am struggling with "local_name" filtering in haproxy environment. According to dovecot docs [1] it could potentially work with "send-proxy-v2-ssl" configured on proxy backend. However my dovecot filter does not work. Have the same problem I had with "local" filter. Dovecot does not recognize this connection and does not filter config for it properly. I tried "send-proxy-v2-ssl-cn". Still the same. I even enabled ssl on dovecot globally with "ssl=required" to be sure dovecot does not disable some ssl logic when "ssl=no". Still no go. Seems like dovecot does not get or use TLS/SNI info from haproxy. Does it even work in such environment? Is it supported? Or is this a bug or maybe my error? Any clues please? DK [1] https://doc.dovecot.org/2.4.1/core/config/haproxy.html#tls-forwarding

4 10

Sieve vnd.dovecot.config extension does not work when mail is delivered to lmtp inet_listener but works when delivered to lmtp unix_listener
by DK 27 May '25

27 May '25

Hello. I have a strange problem with sieve scripts vnd.dovecot.config extension processing on newest dovecot 2.3 and 2.4. When I deliver mail via lmtp unix_listener sieve script can get sieve_env_* variable with no problem. However when I deliver mail via lmtp inet_listener sieve script can not get the same sieve_env_* variable. I deliver mails from postfix to lmtp inet_listener directly (not via haproxy). The same postfix is used when testing lmtp unix_listener mail delivery which works. Any clues what could be the cause of such problem? DK

1 2

Thunderbird and Dovecot 2.4.0 Incompatibility
by Amit Chaudhari 27 May '25

27 May '25

I'm trying to setup a dovecot 2.4.0 imap server and have it work with Thunderbird. I'm able to connect/auth fine, however trying to save a message to a mailbox causes the connection to close. ``` Info: Disconnected: Too many invalid IMAP commands. in=744 out=2559 deleted=0 expunged=0 trashed=0 hdr_count=0 hdr_bytes=0 body_count=0 body_bytes=0 ``` It appears thunderbird's imap APPEND command is using syntax which dovecot doesn't like? I enabled raw logs and pasted them below: Downgrading to 2.3 resolves the issue, so it’s either a regression, or some config issue I’m not able to pinpoint. ``` 1738942430.025029 5 ID ("name" "Thunderbird" "version" "128.7.0") 1738942430.029320 6 ENABLE UTF8=ACCEPT 1738942430.033907 7 select "Drafts" 1738942430.039796 8 append "Drafts" (\Draft) UTF8 (~{726+} 1738942430.039796 Message-ID: <ea714f62-7186-4bcb-b709-007e39c6a9d6(a)example.com <mailto:ea714f62-7186-4bcb-b709-007e39c6a9d6@example.com>> 1738942430.039796 Date: Fri, 7 Feb 2025 10:33:49 -0500 1738942430.039796 MIME-Version: 1.0 1738942430.039796 User-Agent: Mozilla Thunderbird 1738942430.039796 Content-Language: en-US 1738942430.039796 To: sender(a)example.com <mailto:sender@example.com> 1738942430.039796 From: User Name <user(a)example.com <mailto:user@example.com>> 1738942430.039796 Subject: test 1738942430.039796 X-Mozilla-Draft-Info: internal/draft; vcard=0; receipt=0; DSN=0; uuencode=0; 1738942430.039796 attachmentreminder=0; deliveryformat=0 1738942430.039796 X-Identity-Key: id2 1738942430.039796 Fcc: imap://user%40example.com@192.168.115.203/Sent 1738942430.039796 Content-Type: text/html; charset=UTF-8 1738942430.039796 Content-Transfer-Encoding: 7bit 1738942430.039796 1738942430.039796 <!DOCTYPE html> 1738942430.039796 <html> 1738942430.039796 <head> 1738942430.039796 1738942430.039796 <meta http-equiv="content-type" content="text/html; charset=UTF-8"> 1738942430.039796 </head> 1738942430.039796 <body> 1738942430.039796 1738942430.039796 1738942430.039796 </body> 1738942430.039796 </html> 1738942430.039796 ) ``` ``` 1738942430.025188 * ID ("name" "Dovecot") 1738942430.025234 5 OK ID completed (0.001 + 0.000 secs). 1738942430.029390 * ENABLED UTF8=ACCEPT 1738942430.029418 6 OK Enabled (0.001 + 0.000 secs). 1738942430.035478 * FLAGS (\Answered \Flagged \Deleted \Seen \Draft) 1738942430.035531 * OK [PERMANENTFLAGS (\Answered \Flagged \Deleted \Seen \Draft \*)] Flags permitted. 1738942430.035559 * 0 EXISTS 1738942430.035585 * 0 RECENT 1738942430.035611 * OK [UIDVALIDITY 1738898190] UIDs valid 1738942430.035638 * OK [UIDNEXT 1] Predicted next UID 1738942430.035693 7 OK [READ-WRITE] Select completed (0.002 + 0.000 + 0.001 secs). 1738942430.040007 8 BAD Error in IMAP command APPEND: Missing ')' (0.001 + 0.000 secs). 1738942430.040140 * BAD Error in IMAP tag: Invalid tag (0.001 + 0.000 secs). 1738942430.040172 Date: BAD Error in IMAP command FRI,: Unknown command (0.001 + 0.000 secs). 1738942430.040233 MIME-Version: BAD Error in IMAP command 1.0: Unknown command (0.001 + 0.000 secs). 1738942430.040291 User-Agent: BAD Error in IMAP command MOZILLA: Unknown command (0.001 + 0.000 secs). 1738942430.040356 Content-Language: BAD Error in IMAP command EN-US: Unknown command (0.001 + 0.000 secs). 1738942430.040409 To: BAD Error in IMAP command sender(a)example.com <mailto:sender@example.com>: Unknown command (0.001 + 0.000 secs). 1738942430.040467 From: BAD Error in IMAP command USER: Unknown command (0.001 + 0.000 secs). 1738942430.040521 Subject: BAD Error in IMAP command TEST: Unknown command (0.001 + 0.000 secs). 1738942430.040574 X-Mozilla-Draft-Info: BAD Error in IMAP command INTERNAL/DRAFT;: Unknown command (0.001 + 0.000 secs). 1738942430.040638 * BAD Error in IMAP tag: Invalid tag (0.001 + 0.000 secs). 1738942430.040666 X-Identity-Key: BAD Error in IMAP command ID2: Unknown command (0.001 + 0.000 secs). 1738942430.040720 Fcc: BAD Error in IMAP command: Invalid command name (0.001 + 0.000 secs). 1738942430.040746 Content-Type: BAD Error in IMAP command TEXT/HTML;: Unknown command (0.001 + 0.000 secs). 1738942430.040802 Content-Transfer-Encoding: BAD Error in IMAP command 7BIT: Unknown command (0.001 + 0.000 secs). 1738942430.040862 * BAD Error in IMAP tag: Invalid tag (0.001 + 0.000 secs). 1738942430.040889 <!DOCTYPE BAD Error in IMAP command HTML>: Unknown command (0.001 + 0.000 secs). 1738942430.040966 <html> BAD Error in IMAP command: Invalid command name (0.001 + 0.000 secs). 1738942430.040991 * BAD Error in IMAP tag: Invalid tag (0.001 + 0.000 secs). 1738942430.041015 * BAD Error in IMAP tag: Invalid tag (0.001 + 0.000 secs). 1738942430.041032 * BYE Too many invalid IMAP commands. ```

5 7

Dovecot and pigeonhole/sieve without ldap
by ppn＠parhuet.fr 26 May '25

26 May '25

Hi, First of all, thanks for your work on this software overall. Since 2.4 dovecot/pigeonhole (2.4.1 gentoo here), it fails to build without ldap support. I've seen nothing that justifies this requirement so it seems like a bug/issue? Configure for dovecot : ./configure --prefix=/usr --build=x86_64-pc-linux-gnu --host=x86_64-pc-linux-gnu --mandir=/usr/share/man --infodir=/usr/share/info --datadir=/usr/share --sysconfdir=/etc --localstatedir=/var/lib --datarootdir=/usr/share --disable-dependency-tracking --disable-silent-rules --disable-static --docdir=/usr/share/doc/dovecot-2.4.1-r1 --htmldir=/usr/share/doc/dovecot-2.4.1-r1/html --with-sysroot=/ --libdir=/usr/lib64 --with-rundir=/run/dovecot --with-statedir=/var/lib/dovecot --with-moduledir=/usr/lib64/dovecot --disable-hardening --disable-rpath --with-bzlib --without-libbsd --with-libcap --with-icu --enable-experimental-mail-utf8 --without-sodium --without-cdb --without-gssapi --without-lua --without-ldap --without-flatcurve --without-lz4 --without-mysql --with-pam --without-pgsql --without-sqlite --without-solr --without-stemmer --without-systemd --without-textcat --without-libunwind --without-zstd --disable-static userdbs ........ : static prefetch passwd passwd-file : -ldap -sql Configure for pigeonhole : ./configure --prefix=/usr --build=x86_64-pc-linux-gnu --host=x86_64-pc-linux-gnu --mandir=/usr/share/man --infodir=/usr/share/info --datadir=/usr/share --sysconfdir=/etc --localstatedir=/var/lib --datarootdir=/usr/share --disable-dependency-tracking --disable-silent-rules --disable-static --docdir=/usr/share/doc/dovecot-2.4.1-r1 --htmldir=/usr/share/doc/dovecot-2.4.1-r1/html --with-sysroot=/ --libdir=/usr/lib64 --disable-static --localstatedir=/var --enable-shared --disable-hardening --with-dovecot=/var/tmp/portage/net-mail/dovecot-2.4.1-r1/work/dovecot-2.4.1-4 --without-ldap --without-managesieve script drivers . : file dict : -ldap Error : age/net-mail/dovecot-2.4.1-r1/work/dovecot-2.4.1-4/src/lib-sasl -I/var/tmp/portage/net-mail/dovecot-2.4.1-r1/work/dovecot-2.4.1-4/src/li b-dcrypt -I/var/tmp/portage/net-mail/dovecot-2.4.1-r1/work/dovecot-2.4.1-4/src/lib-program-client -I/var/tmp/portage/net-mail/dovecot-2. 4.1-r1/work/dovecot-2.4.1-4/src/lib-oauth2 -I/var/tmp/portage/net-mail/dovecot-2.4.1-r1/work/dovecot-2.4.1-4/src/lib-var-expand -I/var/t mp/portage/net-mail/dovecot-2.4.1-r1/work/dovecot-2.4.1-4/src/lib-index -I/var/tmp/portage/net-mail/dovecot-2.4.1-r1/work/dovecot-2.4.1- 4/src/lib-storage -I/var/tmp/portage/net-mail/dovecot-2.4.1-r1/work/dovecot-2.4.1-4/src/lib-storage/list -I/var/tmp/portage/net-mail/dov ecot-2.4.1-r1/work/dovecot-2.4.1-4/src/lib-storage/index -I/var/tmp/portage/net-mail/dovecot-2.4.1-r1/work/dovecot-2.4.1-4/src/lib-stora ge/index/raw -I/var/tmp/portage/net-mail/dovecot-2.4.1-r1/work/dovecot-2.4.1-4/src/lib-imap-storage -I/var/tmp/portage/net-mail/dovecot- 2.4.1-r1/work/dovecot-2.4.1-4/src/plugins/quota -I/var/tmp/portage/net-mail/dovecot-2.4.1-r1/work/dovecot-2.4.1-4/src/lib-ldap -I../../. ./.. -I../../../../src/lib-sieve -O2 -pipe -frecord-gcc-switches -flto -Werror=odr -Werror=lto-type-mismatch -Werror=strict-aliasing -fa synchronous-unwind-tables -c sieve-ldap-storage.c -fPIC -DPIC -o .libs/sieve-ldap-storage.o In file included from sieve-ldap-storage.c:6: /var/tmp/portage/net-mail/dovecot-2.4.1-r1/work/dovecot-2.4.1-4/src/lib-ldap/ldap-utils.h:4:10: fatal error: ldap.h: No such file or dir ectory 4 | #include <ldap.h> | ^~~~~~~~ compilation terminated. make[5]: *** [Makefile:607: sieve-ldap-storage.lo] Error 1 Regards, NicoP

3 12

lmtp user verification
by Christian H. Kuhn 26 May '25

26 May '25

Hi, after a new install and avoiding a lot of simple faults, i try to run my system postfix as smtpd, smtpds, and submission, and dovecot as imap and lmtp server. I can login to imap, and i can send via 587 with sasl authentification. So i think that most things are ok :-) What does NOT work is the local transport to my maildir. christian.kuhn(a)qno.de is not resolved to qno(a)qno.de but to qno(a)bywater.qno.de, and lmtp rejects that unverified user: 2025-05-25T18:13:25.431342+02:00 bywater postfix/smtpd[987726]: NOQUEUE: reject: RCPT from mail-lj1-f176.google.com[209.85.208.176]: 450 4.1.1 <qno(a)bywater.qno.de>: Recipient address rejected: unverified address: host bywater.qno.de[private/dovecot-lmtp] said: 550 5.1.1 <qno(a)bywater.qno.de> User doesn't exist: qno(a)bywater.qno.de (in reply to RCPT TO command) also mails to qno-anyextension(a)qno.de are rejected. I set recipient_delimiter to -, but it seems to be ignored by lmtp: 2025-05-25T15:24:10.147369+02:00 bywater postfix/smtpd[985952]: NOQUEUE: reject: RCPT from higher.littydate.com[104.244.79.41]: 450 4.1.1 <qno-planets(a)qno.de>: Recipient address rejected: unverified address: host bywater.qno.de[private/dovecot-lmtp] said: 550 5.1.1 <qno-planets(a)qno.de> User doesn't exist: qno-planets(a)qno.de (in reply to RCPT TO command); from=<webmaster(a)littydate.com> to=<qno-planets(a)qno.de> proto=ESMTP helo=<higher.littydate.com> postconf -n: (postfix 3.8.6) broken_sasl_auth_clients = yes compatibility_level = 3.6 content_filter = amavis:[127.0.0.1]:10024 default_database_type = cdb indexed = ${default_database_type}:${tabledir} inet_interfaces = 127.0.0.1, 65.21.136.15, [::1], [2a01:4f9:3b:25b0:9:6:1:e01] local_recipient_maps = mailbox_transport = lmtp:unix:private/dovecot-lmtp mydestination = $myhostname mydomain = qno.de myhostname = bywater.qno.de mynetworks = 127.0.0.0/8 65.21.136.15/32 [::1]/128 [2a01:4f9:3b:25b0:9:6:1:e01]/128 [2a01:4f8:171:b85:9:6:1:e01]/128 136.243.102.134/32 myorigin = $mydomain policyd-spf_time_limit = 3600 postscreen_access_list = permit_mynetworks postscreen_bare_newline_action = enforce postscreen_bare_newline_enable = no postscreen_dnsbl_action = enforce postscreen_dnsbl_reply_map = ${indexed}dnsbl_reply postscreen_dnsbl_sites = zusbyxqsairu6mu6ayyhstc3ua.zen.dq.spamhaus.net postscreen_dnsbl_threshold = 1 postscreen_non_smtp_command_action = enforce postscreen_non_smtp_command_enable = no postscreen_pipelining_action = enforce postscreen_pipelining_enable = no receive_override_options = no_address_mappings recipient_delimiter = - smtp_bind_address = 65.21.136.15 smtp_bind_address6 = 2a01:4f9:3b:25b0:9:6:1:e01 smtp_generic_maps = ${indexed}generic smtp_tls_exclude_ciphers = aNULL smtp_tls_loglevel = 1 smtp_tls_mandatory_ciphers = medium smtp_tls_mandatory_exclude_ciphers = RC4, MD5, SHA1 smtp_tls_security_level = may smtpd_data_restrictions = reject_unauth_pipelining smtpd_helo_required = yes smtpd_helo_restrictions = reject_unknown_helo_hostname smtpd_recipient_restrictions = permit_mynetworks, permit_sasl_authenticated, reject_unauth_destination, reject_unverified_recipient, check_policy_service unix:private/policyd-spf, reject_rbl_client zusbyxqsairu6mu6ayyhstc3ua.zen.dq.spamhaus.net, reject_rhsbl_reverse_client zusbyxqsairu6mu6ayyhstc3ua.dbl.dq.spamhaus.net, reject_rhsbl_helo zusbyxqsairu6mu6ayyhstc3ua.dbl.dq.spamhaus.net, reject_rhsbl_sender zusbyxqsairu6mu6ayyhstc3ua.dbl.dq.spamhaus.net smtpd_sasl_auth_enable = yes smtpd_sasl_local_domain = smtpd_sasl_path = private/auth smtpd_sasl_security_options = noanonymous smtpd_sasl_tls_security_options = $smtpd_sasl_security_options smtpd_sasl_type = dovecot smtpd_sender_restrictions = reject_unknown_sender_domain smtpd_tls_auth_only = yes smtpd_tls_eccert_file = /etc/letsencrypt/live/mail.qno.de/fullchain.pem smtpd_tls_eckey_file = /etc/letsencrypt/live/mail.qno.de/privkey.pem smtpd_tls_mandatory_ciphers = high smtpd_tls_mandatory_exclude_ciphers = aNULL, MD5, SHA1 smtpd_tls_mandatory_protocols = >=TLSv1.2 smtpd_tls_received_header = yes smtpd_tls_security_level = may tabledir = ${config_directory}/tables.d/ virtual_alias_domains = $mydomain virtual_alias_maps = ${indexed}virtual virtual_gid_maps = static:5000 virtual_mailbox_base = /var/mail/vhosts virtual_mailbox_domains = sk-koenig-tegel.de virtual_mailbox_maps = mysql:${tabledir}virtual_mailbox_maps.cf virtual_minimum_uid = 10000 virtual_transport = lmtp:unix:private/dovecot-lmtp virtual_uid_maps = static:5000 doveconf -n: # 2.3.21 (47349e2482): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.21 (f6cd4b8e) # OS: Linux 6.8.0-60-generic x86_64 Ubuntu 24.04.2 LTS # Hostname: bywater.qno.de auth_debug = yes auth_debug_passwords = yes auth_mechanisms = plain login auth_username_format = %Ln auth_verbose = yes auth_verbose_passwords = yes listen = 65.21.136.15, 2a01:4f9:3b:25b0:9:6:1:c01 mail_debug = yes mail_location = maildir:~/Maildir mail_privileged_group = mail managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } passdb { driver = pam } plugin { sieve = file:~/sieve;active=~/.dovecot.sieve } protocols = " imap lmtp sieve" service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0660 user = postfix } } service imap-login { inet_listener imap { port = 0 } inet_listener imaps { port = 993 ssl = yes } } service lmtp { unix_listener /var/spool/postfix/private/dovecot-lmtp { group = postfix mode = 0600 user = postfix } } ssl_cert = </etc/letsencrypt/live/imap2.qno.de/fullchain.pem ssl_cipher_list = ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-CHACHA20-POLY1305 ssl_dh = # hidden, use -P to show it ssl_key = # hidden, use -P to show it syslog_facility = local0 userdb { driver = passwd } verbose_proctitle = yes verbose_ssl = yes TIA QNo

2 3

Two instances on one machine — can they share indexes?
by dove＠redir.desz.cz 24 May '25

24 May '25

Hello, I (think I) need to run two instances of Dovecot on one machine (rationale below, if someone's interested). They access the same mail share (NFS, maildir), but the indexes are kept on local storage. One of them would also provide lmtp service to local MTA. For now I set the instances to keep indexes separate, in different directories, but I wonder, if they can share the indexes, to avoid unnecessary duplication? Of course, mmap_disable = yes, but would locking suffice? The platform is Linux (Devuan chimaera ATM, equivalet of Debian 11), filesystem - ext4, Dovecot version 2.3.13 (from distribution packages). Why? I have to provide different authentication methods to external IMAP clients and locally-running webmail; at first I hoped to make it via remote filter, but docs state that “auth settings currently only support the protocol filter”, so I had to come with some other idea. It _is_ possible that users would be logged in both via external mail client and webmail at the same time – and even if not, there's also lmtp, that can run at any moment. Sincerely, Bartosz Stępień

1 0

Guidance re doveadm sync full (-f) and stateful (-s)
by Georgios Kontaxis 24 May '25

24 May '25

Hi, I’m looking for guidance on how to use doveadm sync with flags -f (full synchronization) and -s. (stateful synchronization) After reading the doveadm-sync man page it seems one should do the following: (omitting -u -l -N flags for clarity) 1. First sync: doveadm sync -f 2. Second sync: doveadm sync -s “" > state 3. Subsequent infrequent syncs: doveadm sync -f 4. Subsequent frequent syncs: doveadm sync -s “$(<state)” > state (I’m assuming that before the first sync replica A has all the mailboxes and replica B has no mailboxes. I’m also assuming that the above commands are executed from replica A. The goal is to do master/master sync continuously.) Can you help me answer the following questions? a. Each time we execute (4) stateful sync after (3) full sync, is it correct to include previous state? b. What happens if we do: doveadm sync -f -s “” or doveadm sync -f -s “$(<state)” I think the replicator code does (b) in https://github.com/dovecot/core/blob/47349e24828be3ec7f591570e02c0b15ae26c6… and I’m not sure why. Overall, it would be good to have more examples in the man page demonstrating the various synchronization modes. Thanks, Georgios

1 0

Dovecot 2.4.1 userdb override for autoexpunge on specific mailbox
by Thomas Leuxner 24 May '25

24 May '25

Hi, I'm trying to override the autoexpunge setting for the "Deleted Messages" mailbox in the INBOX namespace. [...] mailbox "Deleted Messages" { autoexpunge = 2d special_use = "\\Trash" } doveconf -nF # mail_namespace :FILTER settings_filter_name="namespace/inbox" namespace_name=inbox namespace_type=private namespace_separator=/ namespace_prefix= namespace_inbox=yes namespace_hidden=no mailbox=INBOX Drafts Junk Deleted\_Messages Spam Sent Sent\_Messages The setting seems to be pulled from the userdb and matches the escaping above. It doesn't seem to alter the global "autoexpunge = 2d" setting for this user though. doveadm user -u tlx(a)leuxner.net userdb: tlx(a)leuxner.net user : tlx(a)leuxner.net home : /var/vmail/domains/leuxner.net/tlx uid : 5000 gid : 5000 quota_storage_size: 5G acl_groups: PublicMailboxAdmins namespace/inbox/mailbox/Deleted\_Messages/autoexpunge: 6h Regards Thomas

1 1

NAMESPACE empty when logging via haproxy but populated properly when logging directly
by dk+lists.dovecot.org＠7ns.eu 23 May '25

23 May '25

Hello there. I have a problem with newest dovecots (2.3 and 2.4). Dovecot server for some reason is not providing NAMESPACE via IMAP commands when logging via haproxy (rawlog provided below). Server config: inet_listener imap { port = 143 haproxy = yes } inet_listener imap0 { port = 1143 haproxy = no } When I login directly to dovecot server on port 1143 I get this response from server: 1747853284.039953 * NAMESPACE (("INBOX/" "/")) (("Shared/" "/")) (("Public/" "/")) 1747853284.039986 52 OK Namespace completed (0.001 + 0.000 secs). However when I login to the exact same dovecot server but via haproxy host on port 143 I get this response from server: 1747853284.076121 * NAMESPACE (("" "/")) NIL NIL 1747853284.076160 27 OK Namespace completed (0.001 + 0.000 secs). Tested on: - debian dovecot 2.3.21.1+dfsg1-1+b2 - debian dovecot 2.4.1+dfsg1-4 Could some dev look into it please? Clearly something is broken with dovecot haproxy listener. I just deployed dovecot 2.4 to check if it was fixed but the same problem exists there. Greets. dk Hello there. I have a problem with newest dovecots (2.3 and 2.4). Dovecot server for some reason is not providing NAMESPACE via IMAP commands when logging via haproxy (rawlog provided below). Server config: inet_listener imap { port = 143 haproxy = yes } inet_listener imap0 { port = 1143 haproxy = no } When I login directly to dovecot server on port 1143 I get this response from server: 1747853284.039953 * NAMESPACE (("INBOX/" "/")) (("Shared/" "/")) (("Public/" "/ ")) 1747853284.039986 52 OK Namespace completed (0.001 + 0.000 secs). However when I login to the exact same dovecot server but via haproxy host on port 143 I get this response from server: 1747853284.076121 * NAMESPACE (("" "/")) NIL NIL 1747853284.076160 27 OK Namespace completed (0.001 + 0.000 secs). Tested on: - debian dovecot 2.3.21.1+dfsg1-1+b2 - debian dovecot 2.4.1+dfsg1-4 Could some dev look into it please? Clearly something is broken with dovecot haproxy listener. I just deployed dovecot 2.4 to check if it was fixed but the same problem exists there. Greets. dk

4 6

Upgrade 2.3 to 2.4 - Dovecot cannot find user mailbox
by Cam Ellison 22 May '25

22 May '25

The system in question primarily sends emails to group members but also has a few virtual email accounts for officers. Usernames and passwords are looked up from a mysql (MariaDB) database. After the upgrade incoming mail now goes to a vmail account that Dovecot creates because it cannot match the email to the user for whom it is intended (there is no user 'vmail' in the system). Users can log in and read their mail and send mail, but any emails received since the change to 2.4 are understandably inaccessible. Below is the output from doveconf -n. Can anyone see what is wrong? # 2.4.1-4 (7d8c0e5759): /etc/dovecot/dovecot.conf # Pigeonhole version 2.4.1-4 (0a86619f) # OS: Linux 6.1.0-20-rt-686-pae i686 Debian 13.0 ext4 # Hostname: football.scasl.ca # 4 default setting changes since version 2.4.0 dovecot_config_version = 2.4.0 auth_debug = yes auth_debug_passwords = yes auth_mechanisms = plain login base_dir = /var/run/dovecot/ dovecot_storage_version = 2.4.0 first_valid_gid = 5000 first_valid_uid = 5000 fts_autoindex = yes fts_autoindex_max_recent_msgs = 999 fts_search_add_missing = yes hostname = scasl.ca listen = * :: login_trusted_networks = 209.121.143.10/32 mail_debug = yes mail_driver = maildir mail_gid = 5000 mail_home = /var/vmail/%{user|username} mail_inbox_path = /var/vmail/%{user|username}/Maildir/INBOX mail_path = /var/vmail/%{user|username}/Maildir mail_privileged_group = vmail mail_uid = 5000 postmaster_address = postmaster(a)scasl.ca protocols { imap = yes } sql_driver = mysql dict quota { } mysql scasl.ca { dbname = scasl host = localhost password = # hidden, use -P to show it port = 3306 user = scasl } userdb sql { iterate_query = SELECT email_username AS username, domain FROM league query = SELECT CONCAT('/var/vmail/',email_username) AS home, 5000 AS uid, 5000 AS gid FROM league WHERE email_username = '%{user|username}' } passdb sql { default_password_scheme = BLF-CRYPT query = SELECT password FROM login WHERE ID IN (SELECT ID FROM league WHERE email_username='%{user|username}') } maildir { very_dirty_syncs = yes } namespace inbox { mail_driver = maildir mail_home = /var/vmail/%{user|username} mail_inbox_path = /var/vmail/%{user|username}/Maildir/INBOX mail_path = /var/vmail/%{user|username}/Maildir inbox = yes separator = / mailbox Drafts { auto = subscribe special_use = "\\Drafts" } mailbox Junk { special_use = "\\Junk" } mailbox Trash { special_use = "\\Trash" } mailbox Sent { special_use = "\\Sent" } mailbox "Sent Messages" { special_use = "\\Sent" } } service imap-login { inet_listener imap { } inet_listener imaps { } } service submission-login { inet_listener submission { } } service lmtp { unix_listener lmtp { mode = 0666 } } service imap { } service pop3 { } service submission { } service auth { unix_listener auth-userdb { mode = 0666 } unix_listener auth-client { mode = 0666 } } service auth-worker { } service dict { unix_listener dict { } } service stats { unix_listener stats-reader { group = vmail mode = 0666 } unix_listener stats-writer { group = vmail mode = 0666 } } ssl_server { cert_file = /etc/letsencrypt/live/scasl.ca/fullchain.pem key_file = /etc/letsencrypt/live/scasl.ca/privkey.pem } Cheers Cam The system in question primarily sends emails to group members but also has a few virtual email accounts for officers. Usernames and passwords are looked up from a mysql (MariaDB) database. After the upgrade incoming mail now goes to a vmail account that Dovecot creates because it cannot match the email to the user for whom it is intended (there is no user 'vmail' in the system). Users can log in and read their mail and send mail, but any emails received since the change to 2.4 are understandably inaccessible. Below is the output from doveconf -n. Can anyone see what is wrong? # 2.4.1-4 (7d8c0e5759): /etc/dovecot/dovecot.conf # Pigeonhole version 2.4.1-4 (0a86619f) # OS: Linux 6.1.0-20-rt-686-pae i686 Debian 13.0 ext4 # Hostname: football.scasl.ca # 4 default setting changes since version 2.4.0 dovecot_config_version = 2.4.0 auth_debug = yes auth_debug_passwords = yes auth_mechanisms = plain login base_dir = /var/run/dovecot/ dovecot_storage_version = 2.4.0 first_valid_gid = 5000 first_valid_uid = 5000 fts_autoindex = yes fts_autoindex_max_recent_msgs = 999 fts_search_add_missing = yes hostname = scasl.ca listen = * :: login_trusted_networks = 209.121.143.10/32 mail_debug = yes mail_driver = maildir mail_gid = 5000 mail_home = /var/vmail/%{user|username} mail_inbox_path = /var/vmail/%{user|username}/Maildir/INBOX mail_path = /var/vmail/%{user|username}/Maildir mail_privileged_group = vmail mail_uid = 5000 postmaster_address = postmaster(a)scasl.ca protocols { imap = yes } sql_driver = mysql dict quota { } mysql scasl.ca { dbname = scasl host = localhost password = # hidden, use -P to show it port = 3306 user = scasl } userdb sql { iterate_query = SELECT email_username AS username, domain FROM league query = SELECT CONCAT('/var/vmail/',email_username) AS home, 5000 AS uid, 5000 AS gid FROM league WHERE email_username = '%{user|username}' } passdb sql { default_password_scheme = BLF-CRYPT query = SELECT password FROM login WHERE ID IN (SELECT ID FROM league WHERE email_username='%{user|username}') } maildir { very_dirty_syncs = yes } namespace inbox { mail_driver = maildir mail_home = /var/vmail/%{user|username} mail_inbox_path = /var/vmail/%{user|username}/Maildir/INBOX mail_path = /var/vmail/%{user|username}/Maildir inbox = yes separator = / mailbox Drafts { auto = subscribe special_use = "\\Drafts" } mailbox Junk { special_use = "\\Junk" } mailbox Trash { special_use = "\\Trash" } mailbox Sent { special_use = "\\Sent" } mailbox "Sent Messages" { special_use = "\\Sent" } } service imap-login { inet_listener imap { } inet_listener imaps { } } service submission-login { inet_listener submission { } } service lmtp { unix_listener lmtp { mode = 0666 } } service imap { } service pop3 { } service submission { } service auth { unix_listener auth-userdb { mode = 0666 } unix_listener auth-client { mode = 0666 } } service auth-worker { } service dict { unix_listener dict { } } service stats { unix_listener stats-reader { group = vmail mode = 0666 } unix_listener stats-writer { group = vmail mode = 0666 } } ssl_server { cert_file = /etc/letsencrypt/live/scasl.ca/fullchain.pem key_file = /etc/letsencrypt/live/scasl.ca/privkey.pem } Cheers Cam

2 2

Upgrade 2.3 to 2.4 - virtual mail - dovecot-lda flags ignored
by Cam Ellison 22 May '25

22 May '25

When running v2.3, Dovecot correctly identifies both recipient and domain when receiving mail from Debian exim4 via dovecot-lda, with no flags set. With v2.4, whether the flags are set or not, Dovecot throws error 75. If lda_mailbox_autocreate is set to yes, it creates the mailuser vmail and delivers to /var/vmail/vmail/INBOX. Users are able to log in and read email as before. doveadm user admin(a)example.ca output is: field value uid 5000 gid 5000 home /var/vmail/admin mail_path /var/vmail/admin/Maildir Here is the full printout of doveconf -n. # 2.4.1-4 (7d8c0e5759): /etc/dovecot/dovecot.conf # Pigeonhole version 2.4.1-4 (0a86619f) # OS: Linux 6.1.0-20-rt-686-pae i686 Debian 13.0 ext4 # Hostname: football.scasl.ca # 4 default setting changes since version 2.4.0 dovecot_config_version = 2.4.0 auth_debug = yes auth_debug_passwords = yes auth_mechanisms = plain login base_dir = /var/run/dovecot/ dovecot_storage_version = 2.4.0 first_valid_gid = 5000 first_valid_uid = 5000 fts_autoindex = yes fts_autoindex_max_recent_msgs = 999 fts_search_add_missing = yes hostname = scasl.ca listen = * :: login_trusted_networks = 209.121.143.10/32 mail_debug = yes mail_driver = maildir mail_gid = 5000 mail_home = /var/vmail/%{user|username} mail_inbox_path = /var/vmail/%{user|username}/Maildir/INBOX mail_path = /var/vmail/%{user|username}/Maildir mail_privileged_group = vmail mail_uid = 5000 postmaster_address = postmaster(a)scasl.ca protocols { imap = yes } sql_driver = mysql mysql scasl.ca { dbname = scasl host = localhost password = # port = 3306 user = scasl } userdb sql { iterate_query = SELECT email_username AS username, domain FROM league query = SELECT CONCAT('/var/vmail/',email_username) AS home, 5000 AS uid, 5000 AS gid FROM league WHERE email_username = '%{user|username}' } passdb sql { default_password_scheme = BLF-CRYPT query = SELECT password FROM login WHERE ID IN (SELECT ID FROM league WHERE email_username='%{user|username}') } maildir { very_dirty_syncs = yes } namespace inbox { mail_driver = maildir mail_home = /var/vmail/%{user|username} mail_inbox_path = /var/vmail/%{user|username}/Maildir/INBOX mail_path = /var/vmail/%{user|username}/Maildir inbox = yes separator = / type = private mailbox Drafts { auto = subscribe special_use = "\\Drafts" } mailbox Junk { special_use = "\\Junk" } mailbox Trash { special_use = "\\Trash" } mailbox Sent { special_use = "\\Sent" } mailbox "Sent Messages" { special_use = "\\Sent" } } service imap-login { inet_listener imap { } inet_listener imaps { } } service submission-login { inet_listener submission { } } service lmtp { unix_listener lmtp { mode = 0666 } } service imap { } service pop3 { } service submission { } service auth { unix_listener auth-userdb { mode = 0666 } unix_listener auth-client { mode = 0666 } } service auth-worker { } service dict { unix_listener dict { } } service stats { unix_listener stats-reader { group = vmail mode = 0666 } unix_listener stats-writer { group = vmail mode = 0666 } } ssl_server { cert_file = /etc/letsencrypt/live/scasl.ca/fullchain.pem key_file = /etc/letsencrypt/live/scasl.ca/privkey.pem } protocol lda { mail_plugins = $mail_plugins } I assume I am missing a parameter that needs setting. Is it that, do I have something set incorrectly, or is it really a bug? Cheers Cam When running v2.3, Dovecot correctly identifies both recipient and domain when receiving mail from Debian exim4 via dovecot-lda, with no flags set. With v2.4, whether the flags are set or not, Dovecot throws error 75. If lda_mailbox_autocreate is set to yes, it creates the mailuser vmail and delivers to /var/vmail/vmail/INBOX. Users are able to log in and read email as before. doveadm user admin(a)example.ca output is: field value uid 5000 gid 5000 home /var/vmail/admin mail_path /var/vmail/admin/Maildir Here is the full printout of doveconf -n. # 2.4.1-4 (7d8c0e5759): /etc/dovecot/dovecot.conf # Pigeonhole version 2.4.1-4 (0a86619f) # OS: Linux 6.1.0-20-rt-686-pae i686 Debian 13.0 ext4 # Hostname: football.scasl.ca # 4 default setting changes since version 2.4.0 dovecot_config_version = 2.4.0 auth_debug = yes auth_debug_passwords = yes auth_mechanisms = plain login base_dir = /var/run/dovecot/ dovecot_storage_version = 2.4.0 first_valid_gid = 5000 first_valid_uid = 5000 fts_autoindex = yes fts_autoindex_max_recent_msgs = 999 fts_search_add_missing = yes hostname = scasl.ca listen = * :: login_trusted_networks = 209.121.143.10/32 mail_debug = yes mail_driver = maildir mail_gid = 5000 mail_home = /var/vmail/%{user|username} mail_inbox_path = /var/vmail/%{user|username}/Maildir/INBOX mail_path = /var/vmail/%{user|username}/Maildir mail_privileged_group = vmail mail_uid = 5000 postmaster_address = postmaster(a)scasl.ca protocols { imap = yes } sql_driver = mysql mysql scasl.ca { dbname = scasl host = localhost password = # port = 3306 user = scasl } userdb sql { iterate_query = SELECT email_username AS username, domain FROM league query = SELECT CONCAT('/var/vmail/',email_username) AS home, 5000 AS uid, 5000 AS gid FROM league WHERE email_username = '%{user|username}' } passdb sql { default_password_scheme = BLF-CRYPT query = SELECT password FROM login WHERE ID IN (SELECT ID FROM league WHERE email_username='%{user|username}') } maildir { very_dirty_syncs = yes } namespace inbox { mail_driver = maildir mail_home = /var/vmail/%{user|username} mail_inbox_path = /var/vmail/%{user|username}/Maildir/INBOX mail_path = /var/vmail/%{user|username}/Maildir inbox = yes separator = / type = private mailbox Drafts { auto = subscribe special_use = "\\Drafts" } mailbox Junk { special_use = "\\Junk" } mailbox Trash { special_use = "\\Trash" } mailbox Sent { special_use = "\\Sent" } mailbox "Sent Messages" { special_use = "\\Sent" } } service imap-login { inet_listener imap { } inet_listener imaps { } } service submission-login { inet_listener submission { } } service lmtp { unix_listener lmtp { mode = 0666 } } service imap { } service pop3 { } service submission { } service auth { unix_listener auth-userdb { mode = 0666 } unix_listener auth-client { mode = 0666 } } service auth-worker { } service dict { unix_listener dict { } } service stats { unix_listener stats-reader { group = vmail mode = 0666 } unix_listener stats-writer { group = vmail mode = 0666 } } ssl_server { cert_file = /etc/letsencrypt/live/scasl.ca/fullchain.pem key_file = /etc/letsencrypt/live/scasl.ca/privkey.pem } protocol lda { mail_plugins = $mail_plugins } I assume I am missing a parameter that needs setting. Is it that, do I have something set incorrectly, or is it really a bug? Cheers Cam

2 2

Re: Upgrade 2.3 to 2.4 - virtual mail - dovecot-lda flags ignored
by Cam Ellison 22 May '25

22 May '25

On 2025-05-21 14:11, Odhiambo Washington wrote: > Hi Cam, > > I suffered something similar during my migration and an old post > somewhere saved the day for me: https://skeletor.org.ua/?p=2497 > I hope it helps you too. > It was worth a try, and at least has changed the focus to Exim from Dovecot: the existing lookups for identifying user@domain in Exim are not working. What he has is not significantly different from my own setup. Thank you for the link Cam

1 1

Large Server with Dovecot
by Odhiambo Washington 21 May '25

21 May '25

Hello Admins, I have at hand a task to setup Dovecot (2.4.1) to handle about 10,000 mailboxes using IMAP/POP3. It's a migration from another system. The current total storage for the mailboxes is 350GB. I believe several Mail admins are managing such systems, and bigger. What do you recommend as the baseline for the optimization Dovecot engine itself? Assuming the storage is on SSD, is there something you recommend I add to the dovecot.configuration for fast access? Indexing? Anything else? How about the system specs - CPU/RAM? Thank you in advance. -- Best regards, Odhiambo WASHINGTON, Nairobi,KE +254 7 3200 0004/+254 7 2274 3223 In an Internet failure case, the #1 suspect is a constant: DNS. "Oh, the cruft.", egrep -v '^$|^.*#' ¯\_(ツ)_/¯ :-) [How to ask smart questions: http://www.catb.org/~esr/faqs/smart-questions.html] Hello Admins, I have at hand a task to setup Dovecot (2.4.1) to handle about 10,000 mailboxes using IMAP/POP3. It's a migration from another system. The current total storage for the mailboxes is 350GB. I believe several Mail admins are managing such systems, and bigger. What do you recommend as the baseline for the optimization Dovecot engine itself? Assuming the storage is on SSD, is there something you recommend I add to the dovecot.configuration for fast access? Indexing? Anything else? How about the system specs - CPU/RAM? Thank you in advance. -- Best regards, Odhiambo WASHINGTON, Nairobi,KE +254 7 3200 0004/+254 7 2274 3223 In an Internet failure case, the #1 suspect is a constant: DNS. "Oh, the cruft.", egrep -v '^$|^.*#' ¯\_(ツ)_/¯ :-) [How to ask smart questions: http://www.catb.org/~esr/faqs/smart- questions.html]

1 0

prohibit subfolders under INBOX
by dentar＠fnsheppard.com 20 May '25

20 May '25

I know this is a n00b question but I've done my diligence... Is there a way (Maildir not MBOX) to ONLY prohibit creation of folders under INBOX e.g. no INBOX.Fred allowed, but the user MAY create subfolders under other folders, e.g. Fred.Barney? We've discovered that when people create INBOX.anything it causes Outlook to go insane.

1 0

bug report: "Corrupted transaction log file" PLUS request for improvement of the documentation about mmap_disable
by Patrick Cernko 20 May '25

20 May '25

Hello Dovecot developers, hello list, since more than two years we had occasional log messages like this: Error: Mailbox INBOX: Corrupted transaction log file /IMAP/mail/mailboxes/USER/mdbox/mailboxes/INBOX/dbox-Mails/dovecot.index.log seq 45532: Unexpected garbage at EOF (sync_offset=4856) Mostly I had to repair the affected mailbox manually after such events. Luckily I could prevent any data corruptions by using the healthy mailbox from the replication partner. Those errors occurred rather seldom (once a month) but started get more often. At the end of last year, they occurred about once a week for 800 users with up to 200 folders. The reporting process was always different, like the indexer, imapd, lmtpd, replicator or doveadm (on cmdline). It was obviously some sort of race-condition between the different processes accessing the index. I did not see any hints how to reproduce it. At the beginning of this year I started to debug this issue by adding debugging log output to our productive system, mostly in lib-index. I was hoping to find the cause of the issue and maybe even provide a patch to fix this. But about 5 weeks ago, I discovered, that the error can be simply avoided by setting mmap_disable=yes. Since this change, the error did not occur again even with specific tests, that previously likely triggered the bug. That's where I stopped to debug further. We are running Dovecot in master-master mode using replication plugin behind a Dovecot director setup. The storage on the backends is provided by local disks on Linux with newest ZFS filesystem. We use mdbox storage and FTS. While testing I also checked ext4 instead of ZFS and different FTS backends without success. I can provide more information for the developers if you are interested! --------------------------------- About mmap_disable: The documentation only mentions, that you should set this to "yes" for SHARED filesystems (I don't think local ZFS or ext4 qualify for that). https://doc.dovecot.org/2.3/settings/core/#core_setting-mmap_disable On another page (https://doc.dovecot.org/2.3/admin_manual/mailbox_formats/#memory-mapping) it is mentioned, that "If mmap() is supported by your filesystem, it’s still not certain that it gives better performance. Try benchmarking to make sure." I also found an old mail from Timo (https://dovecot.org/list/dovecot/2011-December/079975.html) which lists 3 cases, where mmap_disable=yes is required or at least suggested. In only one case, he wrote "With local filesystems mmap_disable=no _should_ be faster." I did not do extensive benchmarks but I did not see any performance issues since we disabled mmap on our IMAP backends. So, I wonder, if it would not be better to switch the default for mmap_disable to YES: 1. There are configurations, where the current default might cause data corruption! 2. There are configurations, where disabling mmap is suggested. 3. Even on local storage, the performance benefits are unsure. 4. According to my observations, even on local storage, enabling mmap can cause data corruption. Changing the default to NO would protect users from accidental data corruption. Users that aim for maximum performance can still enable mmap and test if it improves performance. IMHO the documentation should mention, that even for local disks, mmap CAN cause data corruption (until the above mentioned bug is found and fixed). Best regards, -- Patrick Cernko <pcernko(a)mpi-klsb.mpg.de> +49 681 9325 5815 Joint Scientific IT and Technical Service Max-Planck-Institute für Informatik & Softwaresysteme

1 0

Change the way folders are displayed via IMAP protocol
by Lafiel 19 May '25

19 May '25

Hi. How can I patch the source code so that the server forces the list of all folders to be displayed in quotes? Or add the corresponding parameter to the configuration file? -- Best regards, Lafiel mailto:lafiel@elven.pw

1 0

Dovecot 3.21.1 -> 2.4.0 SegFault
by Cata S 19 May '25

19 May '25

Hi guys, There seems to be some issue with Dovecot deployed on alpine. More specifically, the dovecot.config file is not properly read. I have run some debugging and the SegFault is returned in the function below: #0 0x000055555556779b in config_parsed_get_setting () No symbol table info available. #1 0x0000555555563708 in config_dump_full () No symbol table info available. #2 0x000055555555c814 in main () No symbol table info available. This was also addressed by alpine here: https://gitlab.alpinelinux.org/alpine/aports/-/issues/17050 Any idea what could be causing this? Thanks for looking into it, Cata

3 2

Users losing mail from their mailboxes
by Nikolaos Milas 18 May '25

18 May '25

Hello, We are on Dovecot 2.3.18. Some users are occasionally complaining that all mail vanishes from their inbox. However, we cannot find any indication of deletions or expunge in the log. One explanation could be that mail files are deleted externally (at the file system level), but I can't imagine what could cause such deletions. How would you suggest us to troubleshoot this further? We could enable "mail_debug = yes", but this would flood the logs and cause performance drop, and the issue is happening rarely. Any other ideas to troubleshoot these cases in the past (through logs) or monitor (whatever) for the future? (The config is listed at the end.) Thanks in advance. Best regards, Nick The config follows: ======================================================================= protocols = imap pop3 sieve lmtp login_greeting = Dovecot OUR ORG log_path = /var/log/dove.log mail_location = maildir:~/Maildir/ mail_gid = 500 mail_uid = 500 auth_mechanisms = plain login auth_username_format = %Ln auth_verbose = no auth_debug = no mail_debug = no disable_plaintext_auth = no mail_plugins = quota mail_log notify protocol imap { imap_client_workarounds = "delay-newmail" mail_plugins = quota imap_quota mail_log notify mail_max_userip_connections = 400 namespace inbox { mailbox Trash { autoexpunge = 15d } } } protocol pop3 { mail_max_userip_connections = 3 mail_plugins = quota notify pop3_client_workarounds = outlook-no-nuls oe-ns-eoh pop3_uidl_format = %08Xu%08Xv namespace inbox { mailbox Trash { autoexpunge = 15d } } } protocol lda { auth_socket_path = /var/run/dovecot/auth-master mail_plugins = quota notify sieve postmaster_address = sysadmin(a)noa.gr sendmail_path = /usr/lib/sendmail } protocol lmtp { auth_socket_path = /var/run/dovecot/auth-master postmaster_address = sysadmin(a)noa.gr mail_plugins = quota notify sieve sendmail_path = /usr/lib/sendmail } protocol sieve { managesieve_max_line_length = 65536 mail_max_userip_connections = 10 managesieve_logout_format = bytes=%i/%o managesieve_max_compile_errors = 10 } userdb { args = /etc/dovecot/dovecot-usrdb-ldap.conf driver = ldap } passdb { args = /etc/dovecot/dovecot-passdb-ldap.conf driver = ldap } plugin { mail_log_events = delete undelete expunge copy mailbox_delete mailbox_rename flag_change save mailbox_create mail_log_fields = uid box msgid size flags vsize from subject quota = maildir:User quota quota_rule = *:storage=15G quota_rule2 = Trash:storage=+3%% quota_warning = storage=75%% quota-warning 75 %u quota_warning2 = storage=90%% quota-warning 90 %u # Used by both the Sieve plugin and the ManageSieve protocol sieve = file:~/sieve;active=~/.dovecot.sieve sieve_max_script_size = 0 sieve_max_actions = 0 sieve_max_redirects = 2 } service quota-warning { executable = script /opt/mail1.sh user = vmail unix_listener quota-warning { user = vmail } } service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0660 user = postfix } unix_listener auth-master { group = vmail mode = 0660 user = vmail } user = root } service imap-login { service_count = 100 vsz_limit = 64 M process_limit = 500 } service pop3-login { service_count = 100 vsz_limit = 64 M } service managesieve-login { inet_listener sieve { port = 4190 } service_count = 100 process_min_avail = 0 vsz_limit = 64M } service managesieve { process_limit = 1024 } service imap { executable = imap postlogin process_limit = 2048 } service pop3 { executable = pop3 postlogin } service postlogin { executable = script-login -d rawlog unix_listener postlogin { } } service lmtp { unix_listener /var/spool/postfix/private/dovecot-lmtp { group = postfix mode = 0600 user = postfix } } ssl = yes ssl_cert = </etc/pki/tls/certs/servercert.crt ssl_key = </etc/pki/tls/private/serverkey.key namespace inbox { separator = . prefix = inbox = yes mailbox Drafts { special_use = \Drafts auto = subscribe } mailbox Junk { special_use = \Junk auto = subscribe } mailbox Trash { special_use = \Trash auto = subscribe } mailbox Sent { special_use = \Sent auto = subscribe } } ======================================================================= Hello, We are on Dovecot 2.3.18. Some users are occasionally complaining that all mail vanishes from their inbox. However, we cannot find any indication of deletions or expunge in the log. One explanation could be that mail files are deleted externally (at the file system level), but I can't imagine what could cause such deletions. How would you suggest us to troubleshoot this further? We could enable "mail_debug = yes", but this would flood the logs and cause performance drop, and the issue is happening rarely. Any other ideas to troubleshoot these cases in the past (through logs) or monitor (whatever) for the future? (The config is listed at the end.) Thanks in advance. Best regards, Nick The config follows: ======================================================================= protocols = imap pop3 sieve lmtp login_greeting = Dovecot OUR ORG log_path = /var/log/dove.log mail_location = maildir:~/Maildir/ mail_gid = 500 mail_uid = 500 auth_mechanisms = plain login auth_username_format = %Ln auth_verbose = no auth_debug = no mail_debug = no disable_plaintext_auth = no mail_plugins = quota mail_log notify protocol imap { imap_client_workarounds = "delay-newmail" mail_plugins = quota imap_quota mail_log notify mail_max_userip_connections = 400 namespace inbox { mailbox Trash { autoexpunge = 15d } } } protocol pop3 { mail_max_userip_connections = 3 mail_plugins = quota notify pop3_client_workarounds = outlook-no-nuls oe-ns-eoh pop3_uidl_format = %08Xu%08Xv namespace inbox { mailbox Trash { autoexpunge = 15d } } } protocol lda { auth_socket_path = /var/run/dovecot/auth-master mail_plugins = quota notify sieve postmaster_address = sysadmin(a)noa.gr sendmail_path = /usr/lib/sendmail } protocol lmtp { auth_socket_path = /var/run/dovecot/auth-master postmaster_address = sysadmin(a)noa.gr mail_plugins = quota notify sieve sendmail_path = /usr/lib/sendmail } protocol sieve { managesieve_max_line_length = 65536 mail_max_userip_connections = 10 managesieve_logout_format = bytes=%i/%o managesieve_max_compile_errors = 10 } userdb { args = /etc/dovecot/dovecot-usrdb-ldap.conf driver = ldap } passdb { args = /etc/dovecot/dovecot-passdb-ldap.conf driver = ldap } plugin { mail_log_events = delete undelete expunge copy mailbox_delete mailbox_rename flag_change save mailbox_create mail_log_fields = uid box msgid size flags vsize from subject quota = maildir:User quota quota_rule = *:storage=15G quota_rule2 = Trash:storage=+3%% quota_warning = storage=75%% quota-warning 75 %u quota_warning2 = storage=90%% quota-warning 90 %u # Used by both the Sieve plugin and the ManageSieve protocol sieve = file:~/sieve;active=~/.dovecot.sieve sieve_max_script_size = 0 sieve_max_actions = 0 sieve_max_redirects = 2 } service quota-warning { executable = script /opt/mail1.sh user = vmail unix_listener quota-warning { user = vmail } } service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0660 user = postfix } unix_listener auth-master { group = vmail mode = 0660 user = vmail } user = root } service imap-login { service_count = 100 vsz_limit = 64 M process_limit = 500 } service pop3-login { service_count = 100 vsz_limit = 64 M } service managesieve-login { inet_listener sieve { port = 4190 } service_count = 100 process_min_avail = 0 vsz_limit = 64M } service managesieve { process_limit = 1024 } service imap { executable = imap postlogin process_limit = 2048 } service pop3 { executable = pop3 postlogin } service postlogin { executable = script-login -d rawlog unix_listener postlogin { } } service lmtp { unix_listener /var/spool/postfix/private/dovecot-lmtp { group = postfix mode = 0600 user = postfix } } ssl = yes ssl_cert = </etc/pki/tls/certs/servercert.crt ssl_key = </etc/pki/tls/private/serverkey.key namespace inbox { separator = . prefix = inbox = yes mailbox Drafts { special_use = \Drafts auto = subscribe } mailbox Junk { special_use = \Junk auto = subscribe } mailbox Trash { special_use = \Trash auto = subscribe } mailbox Sent { special_use = \Sent auto = subscribe } } =======================================================================

5 8

Problem with Dovecot on a FIPS enabled system
by Eric Berry 16 May '25

16 May '25

This bug was submitted on an Ubuntu Jammy system with FIPS enabled. Here is the Ubuntu bug report: https://bugs.launchpad.net/ubuntu/+source/openssl/+bug/2107773 Pull Request submitted: https://github.com/dovecot/core/pull/241 [ Impact ] - When one enables FIPS mode on a Jammy system and then attempts to use Dovecot to create an encrypted mailbox, the module returns a invalid salt length error. - FIPS mode requires a 16 byte salt for PBEKDF2 and Dovecot is only requesting 8 bytes of salt. The solution is to modify Dovecot to request 16 bytes of salt. [ Test Plan ] - Install Dovecot on the system - sudo apt install dovecot-auth-lua dovecot-core dovecot-gssapi dovecot-imapd dovecot-ldap dovecot-lmtpd dovecot-managesieved dovecot-mysql dovecot-pgsql dovecot-pop3d dovecot-sieve dovecot-solr dovecot-sqlite dovecot-submissiond - Enable mailbox encryption. - Add /etc/dovecot/conf.d//mail-crypt.conf to enable mailbox encryption: mail_location = mbox:~/mail:INBOX=/var/mail/%u listen = * mbox_write_locks = fcntl namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } passdb { driver = pam } userdb { driver = passwd } mail_plugins = $mail_plugins mail_crypt plugin { mail_crypt_curve = secp521r1 mail_crypt_save_version=2 } mail_attribute_dict = file:%h/Maildir/dovecot-attributes imap_metadata = yes - Issue the following command to create an encrypted mailbox: - sudo doveadm -o plugin/mail_crypt_private_password=e32f1f174d7576716d5df899e7d5cb6b64cdb33584c71882e9f7e1f79f2e695e mailbox cryptokey generate -u - Verify that no error occurs. - Enable FIPS on a Jammy system. - sudo pro attach - sudo pro enable fips-updates - sudo reboot - Reboot - Delete the mailbox - rm -rf ~/mail - Issue the following command to create an encrypted mailbox: - sudo doveadm -o plugin/mail_crypt_private_password=e32f1f174d7576716d5df899e7d5cb6b64cdb33584c71882e9f7e1f79f2e695e mailbox cryptokey generate -u <username> - Verify that an error occurs. - Update Dovecot to the fixed version. - Repeat the commands to delete the mailbox and to create an encrypted mailbox. - After installing the fix, verify that no error occurs. [ Where problems could occur ] - The increased salt size of 16 bytes could potentially cause issues in allocated data structures, but I've attempted to mitigate this by increasing the size of potentially problematic data structures. [ Other Info ] This is really only needed on systems where FIPS is supported, i.e. Jammy and Noble and 26.04. This bug was submitted on an Ubuntu Jammy system with FIPS enabled. Here is the Ubuntu bug report: https://bugs.launchpad.net/ubuntu/+source/openssl/+bug/2107773 Pull Request submitted: https://github.com/dovecot/core/pull/241 [ Impact ] * When one enables FIPS mode on a Jammy system and then attempts to use Dovecot to create an encrypted mailbox, the module returns a invalid salt length error. * FIPS mode requires a 16 byte salt for PBEKDF2 and Dovecot is only requesting 8 bytes of salt. The solution is to modify Dovecot to request 16 bytes of salt. [ Test Plan ] * Install Dovecot on the system o sudo apt install dovecot-auth-lua dovecot-core dovecot-gssapi dovecot-imapd dovecot-ldap dovecot-lmtpd dovecot-managesieved dovecot-mysql dovecot-pgsql dovecot-pop3d dovecot-sieve dovecot- solr dovecot-sqlite dovecot-submissiond * Enable mailbox encryption. o Add /etc/dovecot/conf.d//mail-crypt.conf to enable mailbox encryption: mail_location = mbox:~/mail:INBOX=/var/mail/%u listen = * mbox_write_locks = fcntl namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } passdb { driver = pam } userdb { driver = passwd } mail_plugins = $mail_plugins mail_crypt plugin { mail_crypt_curve = secp521r1 mail_crypt_save_version=2 } mail_attribute_dict = file:%h/Maildir/dovecot-attributes imap_metadata = yes * Issue the following command to create an encrypted mailbox: o sudo doveadm -o plugin/ mail_crypt_private_password=e32f1f174d7576716d5df899e7d5cb6b64cdb33584c71882e9f7e1f79f2e695e mailbox cryptokey generate -u * Verify that no error occurs. * Enable FIPS on a Jammy system. o sudo pro attach o sudo pro enable fips-updates o sudo reboot * Reboot * Delete the mailbox o rm -rf ~/mail * Issue the following command to create an encrypted mailbox: o sudo doveadm -o plugin/ mail_crypt_private_password=e32f1f174d7576716d5df899e7d5cb6b64cdb33584c71882e9f7e1f79f2e695e mailbox cryptokey generate -u <username> * Verify that an error occurs. * Update Dovecot to the fixed version. * Repeat the commands to delete the mailbox and to create an encrypted mailbox. * After installing the fix, verify that no error occurs. [ Where problems could occur ] * The increased salt size of 16 bytes could potentially cause issues in allocated data structures, but I've attempted to mitigate this by increasing the size of potentially problematic data structures. [ Other Info ] This is really only needed on systems where FIPS is supported, i.e. Jammy and Noble and 26.04.

1 0

For additional modules, the mail_plugin_dir parameter is ignored
by Lafiel 14 May '25

14 May '25

Hi. The NixOS distribution for Dovecot uses a patch that hardcodes the path to the plugins in `/etc/dovecot/modules`. The modules themselves are located at `/nix/store/z9kf4ri8sq9f3r510qsm59g1n6kfc7q6-dovecot-2.3.21.1/lib/dovecot`, the script creates symlinks in the `/etc/dovecot/modules` directory. The additional modules are loaded normally. Now I want to remove the patch. I added the parameter `“--with-moduledir=$(out)/etc/dovecot/modules”`, and the modules are located at path `/nix/store/wb885d6w5dfchg9v481f55zj4a2p3r89-dovecot-2.3.21.1/etc/dovecot/modules`. In the configuration I added the parameter `mail_plugin_dir = /etc/dovecot/modules`. The main modules load fine, but the optional modules don't want to load: ``` Error: Plugin 'imap_sieve' not found from directory /nix/store/wb885d6w5dfchg9v481f55zj4a2p3r89-dovecot-2.3.21.1/etc/dovecot/modules ``` For additional modules, the mail_plugin_dir parameter is ignored. Temporary solution - in src/config/config-parser.h file I replaced the line ``` #define CONFIG_MODULE_DIR MODULEDIR"/settings” ``` by ``` #define CONFIG_MODULE_DIR “/etc/dovecot/modules/settings” ``` -- Best regards, Lafiel mailto:lafiel@elven.pw

3 9

Dovecot 2.4.1 last-login configuration pattern: Unknown setting: pattern (dict_map_key_field_pattern or dict_map_key_field_service_pattern not found either.)
by Michael Borgelt 13 May '25

13 May '25

Hello, I am trying to configure last-login plugin for dovecot 2.4.1 and getting the following error. doveconf -n # 2.4.1-4 (7d8c0e5759): /etc/dovecot/dovecot.conf # Pigeonhole version 2.4.1-4 (0a86619f) doveconf: Fatal: Error in configuration file /etc/dovecot/conf.d/30-lastlogin.conf line 24: pattern: Unknown setting: pattern (dict_map_key_field_pattern or dict_map_key_field_service_pattern not found either.) I am using the example config from the dovecot 2.4 documentation. https://doc.dovecot.org/2.4.0/core/plugins/last_login.html#mysql-example Is this a bug in the config parser or in the example config? doveconf -n output with pattern lines in 30-lastlogin.conf commented: # 2.4.1-4 (7d8c0e5759): /etc/dovecot/dovecot.conf # Pigeonhole version 2.4.1-4 (0a86619f) # OS: Linux 6.12.27-amd64 x86_64 Debian 13.0 # Hostname: debian.dg4yfa.org # 4 default setting changes since version 2.4.0 dovecot_config_version = 2.4.0 auth_mechanisms = plain login auth_username_format = %{user|username|lower} dovecot_storage_version = 2.4.0 first_valid_uid = 1000 fts_autoindex = yes fts_autoindex_max_recent_msgs = 999 fts_search_add_missing = yes imapsieve_url = sieve://127.0.0.1:4190 language_filters = normalizer-icu snowball stopwords language_tokenizers = generic email-address last_valid_uid = 65530 lda_mailbox_autocreate = yes mail_driver = maildir mail_inbox_path = ~/Maildir/.INBOX mail_path = ~/Maildir mail_plugins { virtual = yes fts = yes fts_flatcurve = yes quota = yes } mail_privileged_group = mail protocols { imap = yes lmtp = yes sieve = yes pop3 = yes } quota_storage_size = 1G sieve_execute_bin_dir = /usr/share/dovecot-pigeonhole/sieve sieve_global_extensions { vnd.dovecot.pipe = yes vnd.dovecot.execute = yes } sieve_pipe_bin_dir = /usr/share/dovecot-pigeonhole/sieve sieve_plugins = sieve_imapsieve sieve_extprograms passdb pam { } userdb passwd { result_failure = return-fail result_success = continue } userdb passwd-file { auth_username_format = %{user | username} passwd_file_path = /etc/dovecot/users driver = passwd-file result_failure = return-ok result_internalfail = continue } namespace inbox { inbox = yes mailbox Drafts { special_use = "\\Drafts" } mailbox Entw&APw-rfe { special_use = "\\Drafts" } mailbox Junk { special_use = "\\Junk" } mailbox Spam { special_use = "\\Junk" } mailbox Trash { special_use = "\\Trash" quota_storage_extra = 100M } mailbox Sent { special_use = "\\Sent" } mailbox "Sent Messages" { special_use = "\\Sent" } } service imap-login { inet_listener imap { } inet_listener imaps { } } service pop3-login { inet_listener pop3 { } inet_listener pop3s { } } service submission-login { inet_listener submission { } inet_listener submissions { } } service lmtp { unix_listener lmtp { } } service imap { } service pop3 { } service submission { } service auth { unix_listener auth-userdb { } } service auth-worker { } service dict { unix_listener dict { } } ssl_server { cert_file = /etc/dovecot/private/dovecot.pem key_file = /etc/dovecot/private/dovecot.key } protocol lda { mail_plugins { sieve = yes } } namespace virtual { mail_driver = virtual mail_path = ~/Maildir/virtual prefix = virtual. separator = . } protocol imap { mail_plugins { imap_sieve = yes virtual = yes imap_quota = yes last_login = yes } } protocol lmtp { auth_username_format = %{user | username | lower} mail_plugins { sieve = yes } } service managesieve-login { inet_listener sieve { port = 4190 } inet_listener sieve_deprecated { port = 2000 } } service managesieve { } last_login { key = # hidden, use -P to show it precision = ms dict proxy { name = sql } } dict_server { dict sql { sql_driver = mysql mysql localhost { dbname = vmail password = # hidden, use -P to show it user = vmail } dict_map "shared/last-login/$service/$user/$remote_ip" { sql_table = last_login dict_map_value_field last_access { type = uint } dict_map_key_field service { } dict_map_key_field userid { } dict_map_key_field last_ip { } } } } language de { filters = lowercase snowball } language en { default = yes filters = lowercase snowball english-possessive stopwords } fts flatcurve { substring_search = yes } quota "User quota" { driver = count quota_warning warn-95 { quota_storage_percentage = 95 execute quota-warning { args = 95 %{user} } } quota_warning warn-80 { quota_storage_percentage = 80 execute quota-warning { args = 80 %{user} } } } service quota-warning { executable = script /usr/local/bin/quota-warning.sh user = dovecot unix_listener quota-warning { user = Debian-exim } } sieve_script personal { active_path = ~/.dovecot.sieve driver = file path = ~/sieve } sieve_script default { driver = file name = default path = /etc/dovecot/sieve/default/ type = default } mailbox Spam { sieve_script report-spam { cause = copy path = /usr/lib/dovecot/sieve/report-spam.sieve type = before } } imapsieve_from Spam { sieve_script report-ham { cause = copy path = /usr/lib/dovecot/sieve/report-ham.sieve type = before } } Thank you, Michael -- Michael Borgelt Email: mborgelt(a)borgelt.org

1 0

error building with gettext 0.24.1
by Genes Lists 12 May '25

12 May '25

After updating gettext to 0.24.1 our daily build of git head is now generating this error: ---------------------------------------- autoreconf -fiv .... configure.ac:266: warning: macro 'AM_ICONV' not found in library autoreconf: running: /usr/bin/autoconf --force configure.ac:266: error: possibly undefined macro: AM_ICONV If this token and others are legitimate, please use m4_pattern_allow. See the Autoconf documentation. autoreconf: error: /usr/bin/autoconf failed with exit status: 1 Indeed running 'aclocal' generates the same error: ---------------------------------------- gettext does include the file : /usr/share/gettext/m4/iconv.m4 Any help appreciated. I scanned the gettex mail lists but didn't spot anything that seemed relevant. Thanks for any guidance. -- Gene

2 6

crypt_private_key_file retrived from userdb/ldap doesn't work
by luis.neapolis＠gmail.com 12 May '25

12 May '25

Hello, if I try to retrieve crypt_private_key_file from userdb/ldap doesn't work, infact if I have: crypt_global_private_key main{ crypt_private_key_password=secret crypt_private_key_file=/path/to/file } all is ok. If I want to have: crypt_global_private_key main{ crypt_private_key_password=secret crypt_private_key_file= } userdb ldap { driver = ldap ..... fields { mail_crypt_global_private_key/main/crypt_private_key_file=inline:%{ldap:key} } } I have into logs: lmtp(134879): Fatal: Raw user initialization failed: mail_crypt_plugin: nuovo: Couldn't parse private key : Unknown key format I am sure that the key is correctly base64 encoded, infact if I pick the ldap value of %{ldap:key} and I decode base64 I have the pkey crypted key. Any suggestion?

3 7

Unable to save message in shared mailbox
by Markus Bach 12 May '25

12 May '25

Hello, I have a curious problem. We are running a Debian bookworm server with dovecot 2.3.19.1. We have a lot of shared mailboxes and most of them are behaving just fine. But we have a problem with one shared mailbox: Users aren't able to save messages in it even though they have the right to. This issue popped up, when a user This mailbox is set up like every other shared-mailbox, so I don't think it's a permission problem. We tried it with several users giving them the same access rights and always got an error when trying to save a mail in the shared mailbox. I didn't find anything that could help in the log files. Even after turning on `mail_debug` I can't even see the try to save a message in the logs. Some of the things I've tried so far without any success: * doveadm force-resync * increasing the quota for the shared-mailbox * disabling the quote for the shared-mailbox * recreating the Sent folder in the shared-maiblox. Does anybody have any idea how I can debug this further or where the issue could be? Mit freundlichen Grüßen Markus Bach IT-Administration -- Telefon: +49 (30) 31 98 31 200 E-Mail: support(a)pegasusgmbh.de PEGASUS GmbH Gesellschaft für soziale/gesundheitliche Innovation IT-Systemleistungen Brunowstr. 52 13507 Berlin Datenschutzhinweise: https://www.pegasusgmbh.de/datenschutz Internet: http://www.pegasusgmbh.de Sitz der Gesellschaft: PEGASUS GmbH Gesellschaft für soziale/gesundheitliche Innovation Potsdamer Str. 98 10785 Berlin Geschäftsführer: Friedrich Kiesinger Registergericht: Amtsgericht Berlin Charlottenburg Registernummer: HRB 69935 B

2 5

Dovecot lifecycle announcement
by Aki Tuomi 12 May '25

12 May '25

We are announcing these Dovecot end-of-life (EOL) decisions: 1. All Dovecot versions before 2.3 are now fully EOL. We will not provide any additional patches, including security issues, for these releases. 2. For Dovecot CE 2.3 we will provide critical security bug fixes. Thus, if you are experiencing a non-security issue with Dovecot, we need you to upgrade into latest 2.4 CE release and reproduce the problem there in order for the team to debug. The Dovecot team will no longer debug non-security related issues for 2.3 releases. If the issue can occur with the latest 2.4 release, please file a bug report and we will take a look! If you are using a 2.3.x version packaged from an Operating System Vendor, please open a bug against them for fixing it. We do not provide patches or bug fixes against these OS Vendor specific releases. Dovecot CE 2.4.x is the current main release, which will continue to receive feature, bug and security patches. We accept bug reports against latest 2.4 version or "main" branch of Dovecot. Packages for Dovecot CE 2.4 can be found at https://repo.dovecot.org. Thank you for using Dovecot! Note: Users with a commercial agreement with Open-Xchange (Dovecot Pro) have a separate extended EOL policy, so this announcement does not apply to them. Regards, Aki Tuomi Open-Xchange oy

1 0

MySQL Auth Troubles during Migration to 2.4.1
by Odhiambo Washington 07 May '25

07 May '25

I am between a rock and a hard place while doing my migration from 2.3.19.1 to 2.4.1 I have setup a clean system to test the running before I import my database of virtual users. I haven't changed much from the config examples provided at My auth-sql.conf.ext: sql_driver = mysql mysql /var/run/mysqld/mysqld.sock { user = db_user password = XXXXX dbname = dbname } passdb sql { default_password_scheme = SHA512 query = SELECT crypt AS password FROM users,domains WHERE users.username = '%{user}' AND users.enabled = '1' AND users.type='local' and domains.enabled='1' and domains.domain_id = users.domain_id } userdb sql { query = SELECT pop as home, uid, gid FROM users WHERE username = '%{user}' iterate_query = SELECT username AS user FROM users } dovecot -n: ``` root@mail:/etc/dovecot/conf.d# doveconf -n # 2.4.1-4+debian12 (7d8c0e5759): /etc/dovecot/dovecot.conf # Pigeonhole version 2.4.1-4+debian12 (0a86619f) # OS: Linux 6.1.0-34-amd64 x86_64 Debian 12.10 # Hostname: mail.domain.name dovecot_config_version = 2.4.1 auth_debug_passwords = yes auth_verbose = yes auth_verbose_passwords = yes dovecot_storage_version = 2.4.1 fts_autoindex = yes fts_autoindex_max_recent_msgs = 999 fts_search_add_missing = yes info_log_path = /var/log/dovecot.log log_debug = category=auth mail_plugins { notify = yes mail_log = yes } protocols = imap pop3 lmtp sieve sql_driver = mysql mysql /var/run/mysqld/mysqld.sock { dbname = exim4u password = # hidden, use -P to show it user = exim4u } passdb sql { default_password_scheme = SHA512 query = SELECT crypt AS password FROM users,domains WHERE users.username = '%{user}' AND users.enabled = '1' AND users.type='local' and domains.enabled='1' and domains.domain_id = users.domain_id } userdb sql { iterate_query = SELECT username AS user FROM users query = SELECT pop as home, uid, gid FROM users WHERE username = '%{user}' } namespace inbox { inbox = yes mailbox Drafts { special_use = "\\Drafts" } mailbox Junk { special_use = "\\Junk" } mailbox Trash { special_use = "\\Trash" } mailbox Sent { special_use = "\\Sent" } mailbox "Sent Messages" { special_use = "\\Sent" } } service imap-login { inet_listener imap { } inet_listener imaps { } } service pop3-login { inet_listener pop3 { } inet_listener pop3s { } } service submission-login { inet_listener submission { } inet_listener submissions { } } service lmtp { unix_listener lmtp { } } service imap { } service pop3 { } service submission { } service auth { unix_listener auth-userdb { } } service auth-worker { } service dict { unix_listener dict { } } service managesieve-login { inet_listener sieve { port = 4190 } inet_listener sieve_deprecated { port = 2000 } } service managesieve { } ``` I ran a test against the POP3 daemon: ``` telnet 0 110 Trying 0.0.0.0... Connected to 0. Escape character is '^]'. +OK Dovecot ready. user 'joh(a)doe.com +OK pass XXXXXXX -ERR [SYS/TEMP] Temporary authentication failure. ``` And the debugging ends up in "pop3-login: Info: Login aborted: Logged out (auth service reported temporary failure". I am not sure where to look for this. May 04 13:08:46 auth: Debug: sqlpool(mysql): Creating new connection May 04 13:08:46 auth: Debug: Read auth token secret from /run/auth-token-secret.dat May 04 13:08:46 auth: Debug: mysql(/var/run/mysqld/mysqld.sock): Connecting May 04 13:08:46 auth: Debug: conn unix:login (pid=9061,uid=117) [1]: Server accepted connection (fd=19) May 04 13:08:46 auth: Debug: conn unix:login (pid=9061,uid=117) [1]: auth client connected (pid=9061) May 04 13:09:12 auth: Debug: conn unix:login (pid=9061,uid=117) [1]: client in: AUTH 1 PLAIN protocol=pop3 final-resp-ok secured session=0sexkUw07I1/AAAB lip=127.0.0.1 rip=127.0.0.1 lport=110 rport=36332 resp=AHdhc2hAbWFyYS5jbG91ZAB3YXNoQG1hcmEuY2xvdWQ= (previous base64 data may contain sensitive data) May 04 13:09:12 auth(joh@doe.com,127.0.0.1,sasl:plain)<0sexkUw07I1/AAAB>: Debug: sql: Performing passdb lookup May 04 13:09:12 auth: Debug: conn unix:auth-worker: Connecting May 04 13:09:12 auth: Debug: conn unix:auth-worker (pid=9055,uid=0): Client connected (fd=20) May 04 13:09:12 auth: Debug: conn unix:auth-worker (pid=9055,uid=0): Sending version handshake May 04 13:09:12 auth-worker(9138): Debug: Loading modules from directory: /usr/lib/dovecot/modules/auth May 04 13:09:12 auth-worker(9138): Debug: Module loaded: /usr/lib/dovecot/modules/auth/libdriver_mysql.so May 04 13:09:12 auth-worker(9138): Debug: Module loaded: /usr/lib/dovecot/modules/auth/libdriver_pgsql.so May 04 13:09:12 auth-worker(9138): Debug: Module loaded: /usr/lib/dovecot/modules/auth/libdriver_sqlite.so May 04 13:09:12 auth-worker(9138): Debug: sqlpool(mysql): Creating new connection May 04 13:09:12 auth-worker(9138): Debug: mysql(/var/run/mysqld/mysqld.sock): Connecting May 04 13:09:12 auth-worker(9138): Debug: conn unix:auth-worker (pid=9063,uid=116): Server accepted connection (fd=13) May 04 13:09:12 auth-worker(9138): Debug: conn unix:auth-worker (pid=9063,uid=116): Sending version handshake May 04 13:09:12 auth-worker(9138): Debug: conn unix:auth-worker (pid=9063,uid=116): auth-worker<1>: Handling PASSV request May 04 13:09:12 auth-worker(joh(a)doe.com,127.0.0.1)<9138><0sexkUw07I1/AAAB>: request [1]: Debug: sql: Performing passdb lookup May 04 13:09:12 auth: Debug: auth-worker: Worker sent process limit '30' May 04 13:09:12 auth-worker(joh(a)doe.com,127.0.0.1)<9138><0sexkUw07I1/AAAB>: request [1]: Debug: sql: query: SELECT crypt AS password FROM users,domains WHERE users.username = 'joh(a)doe.com' AND users.enabled = '1' AND users.type='local' and domains.enabled='1' and domains.domain_id = users.domain_id May 04 13:09:12 auth-worker(9138): Debug: mysql(/var/run/mysqld/mysqld.sock): Finished query 'SELECT crypt AS password FROM users,domains WHERE users.username = 'joh(a)doe.com' AND users.enabled = '1' AND users.type='local' and domains.enabled='1' and domains.domain_id = users.domain_id' in 0 msecs May 04 13:09:12 auth-worker(joh(a)doe.com,127.0.0.1)<9138><0sexkUw07I1/AAAB>: request [1]: Debug: sql: Finished passdb lookup May 04 13:09:12 auth-worker(9138): Debug: conn unix:auth-worker (pid=9063,uid=116): auth-worker<1>: Finished: internal_failure May 04 13:09:12 auth(joh@doe.com,127.0.0.1,sasl:plain)<0sexkUw07I1/AAAB>: Debug: sql: Finished passdb lookup May 04 13:09:14 auth(joh@doe.com,127.0.0.1,sasl:plain)<0sexkUw07I1/AAAB>: Debug: Auth request finished May 04 13:09:14 auth(joh@doe.com,127.0.0.1,sasl:plain)<0sexkUw07I1/AAAB>: Debug: immediate auth failure due to internal failure May 04 13:09:14 auth: Debug: conn unix:login (pid=9061,uid=117) [1]: client passdb out: FAIL 1 user=joh(a)doe.com code=temp_fail May 04 13:09:18 pop3-login: Info: Login aborted: Logged out (auth service reported temporary failure, 1 attempts in 6 secs) (temp_fail): user=< joh(a)doe.com>, method=PLAIN, rip=127.0.0.1, lip=127.0.0.1, secured, session=<0sexkUw07I1/AAAB> -- Best regards, Odhiambo WASHINGTON, Nairobi,KE +254 7 3200 0004/+254 7 2274 3223 In an Internet failure case, the #1 suspect is a constant: DNS. "Oh, the cruft.", egrep -v '^$|^.*#' ¯\_(ツ)_/¯ :-) [How to ask smart questions: http://www.catb.org/~esr/faqs/smart-questions.html] I am between a rock and a hard place while doing my migration from 2.3.19.1 to 2.4.1 I have setup a clean system to test the running before I import my database of virtual users. I haven't changed much from the config examples provided at My auth-sql.conf.ext: sql_driver = mysql mysql /var/run/mysqld/mysqld.sock { user = db_user password = XXXXX dbname = dbname } passdb sql { default_password_scheme = SHA512 query = SELECT crypt AS password FROM users,domains WHERE users.username = '% {user}' AND users.enabled = '1' AND users.type='local' and domains.enabled='1' and domains.domain_id = users.domain_id } userdb sql { query = SELECT pop as home, uid, gid FROM users WHERE username = '%{user}' iterate_query = SELECT username AS user FROM users } dovecot -n: ``` root@mail:/etc/dovecot/conf.d# doveconf -n # 2.4.1-4+debian12 (7d8c0e5759): /etc/dovecot/dovecot.conf # Pigeonhole version 2.4.1-4+debian12 (0a86619f) # OS: Linux 6.1.0-34-amd64 x86_64 Debian 12.10 # Hostname: mail.domain.name dovecot_config_version = 2.4.1 auth_debug_passwords = yes auth_verbose = yes auth_verbose_passwords = yes dovecot_storage_version = 2.4.1 fts_autoindex = yes fts_autoindex_max_recent_msgs = 999 fts_search_add_missing = yes info_log_path = /var/log/dovecot.log log_debug = category=auth mail_plugins { notify = yes mail_log = yes } protocols = imap pop3 lmtp sieve sql_driver = mysql mysql /var/run/mysqld/mysqld.sock { dbname = exim4u password = # hidden, use -P to show it user = exim4u } passdb sql { default_password_scheme = SHA512 query = SELECT crypt AS password FROM users,domains WHERE users.username = '% {user}' AND users.enabled = '1' AND users.type='local' and domains.enabled='1' and domains.domain_id = users.domain_id } userdb sql { iterate_query = SELECT username AS user FROM users query = SELECT pop as home, uid, gid FROM users WHERE username = '%{user}' } namespace inbox { inbox = yes mailbox Drafts { special_use = "\\Drafts" } mailbox Junk { special_use = "\\Junk" } mailbox Trash { special_use = "\\Trash" } mailbox Sent { special_use = "\\Sent" } mailbox "Sent Messages" { special_use = "\\Sent" } } service imap-login { inet_listener imap { } inet_listener imaps { } } service pop3-login { inet_listener pop3 { } inet_listener pop3s { } } service submission-login { inet_listener submission { } inet_listener submissions { } } service lmtp { unix_listener lmtp { } } service imap { } service pop3 { } service submission { } service auth { unix_listener auth-userdb { } } service auth-worker { } service dict { unix_listener dict { } } service managesieve-login { inet_listener sieve { port = 4190 } inet_listener sieve_deprecated { port = 2000 } } service managesieve { } ``` I ran a test against the POP3 daemon: ``` telnet 0 110 Trying 0.0.0.0... Connected to 0. Escape character is '^]'. +OK Dovecot ready. user 'joh(a)doe.com +OK pass XXXXXXX -ERR [SYS/TEMP] Temporary authentication failure. ``` And the debugging ends up in "pop3-login: Info: Login aborted: Logged out (auth service reported temporary failure". I am not sure where to look for this. May 04 13:08:46 auth: Debug: sqlpool(mysql): Creating new connection May 04 13:08:46 auth: Debug: Read auth token secret from /run/auth-token- secret.dat May 04 13:08:46 auth: Debug: mysql(/var/run/mysqld/mysqld.sock): Connecting May 04 13:08:46 auth: Debug: conn unix:login (pid=9061,uid=117) [1]: Server accepted connection (fd=19) May 04 13:08:46 auth: Debug: conn unix:login (pid=9061,uid=117) [1]: auth client connected (pid=9061) May 04 13:09:12 auth: Debug: conn unix:login (pid=9061,uid=117) [1]: client in: AUTH 1 PLAIN protocol=pop3 final-resp-ok secured session=0sexkUw07I1/AAAB lip=127.0.0.1 rip=127.0.0.1 lport=110 rport=36332 resp=AHdhc2hAbWFyYS5jbG91ZAB3YXNoQG1hcmEuY2xvdWQ= (previous base64 data may contain sensitive data) May 04 13:09:12 auth(joh@doe.com,127.0.0.1,sasl:plain)<0sexkUw07I1/AAAB>: Debug: sql: Performing passdb lookup May 04 13:09:12 auth: Debug: conn unix:auth-worker: Connecting May 04 13:09:12 auth: Debug: conn unix:auth-worker (pid=9055,uid=0): Client connected (fd=20) May 04 13:09:12 auth: Debug: conn unix:auth-worker (pid=9055,uid=0): Sending version handshake May 04 13:09:12 auth-worker(9138): Debug: Loading modules from directory: /usr/ lib/dovecot/modules/auth May 04 13:09:12 auth-worker(9138): Debug: Module loaded: /usr/lib/dovecot/ modules/auth/libdriver_mysql.so May 04 13:09:12 auth-worker(9138): Debug: Module loaded: /usr/lib/dovecot/ modules/auth/libdriver_pgsql.so May 04 13:09:12 auth-worker(9138): Debug: Module loaded: /usr/lib/dovecot/ modules/auth/libdriver_sqlite.so May 04 13:09:12 auth-worker(9138): Debug: sqlpool(mysql): Creating new connection May 04 13:09:12 auth-worker(9138): Debug: mysql(/var/run/mysqld/mysqld.sock): Connecting May 04 13:09:12 auth-worker(9138): Debug: conn unix:auth-worker (pid=9063,uid=116): Server accepted connection (fd=13) May 04 13:09:12 auth-worker(9138): Debug: conn unix:auth-worker (pid=9063,uid=116): Sending version handshake May 04 13:09:12 auth-worker(9138): Debug: conn unix:auth-worker (pid=9063,uid=116): auth-worker<1>: Handling PASSV request May 04 13:09:12 auth-worker(joh(a)doe.com,127.0.0.1)<9138><0sexkUw07I1/AAAB>: request [1]: Debug: sql: Performing passdb lookup May 04 13:09:12 auth: Debug: auth-worker: Worker sent process limit '30' May 04 13:09:12 auth-worker(joh(a)doe.com,127.0.0.1)<9138><0sexkUw07I1/AAAB>: request [1]: Debug: sql: query: SELECT crypt AS password FROM users,domains WHERE users.username = 'joh(a)doe.com' AND users.enabled = '1' AND users.type='local' and domains.enabled='1' and domains.domain_id = users.domain_id May 04 13:09:12 auth-worker(9138): Debug: mysql(/var/run/mysqld/mysqld.sock): Finished query 'SELECT crypt AS password FROM users,domains WHERE users.username = 'joh(a)doe.com' AND users.enabled = '1' AND users.type='local' and domains.enabled='1' and domains.domain_id = users.domain_id' in 0 msecs May 04 13:09:12 auth-worker(joh(a)doe.com,127.0.0.1)<9138><0sexkUw07I1/AAAB>: request [1]: Debug: sql: Finished passdb lookup May 04 13:09:12 auth-worker(9138): Debug: conn unix:auth-worker (pid=9063,uid=116): auth-worker<1>: Finished: internal_failure May 04 13:09:12 auth(joh@doe.com,127.0.0.1,sasl:plain)<0sexkUw07I1/AAAB>: Debug: sql: Finished passdb lookup May 04 13:09:14 auth(joh@doe.com,127.0.0.1,sasl:plain)<0sexkUw07I1/AAAB>: Debug: Auth request finished May 04 13:09:14 auth(joh@doe.com,127.0.0.1,sasl:plain)<0sexkUw07I1/AAAB>: Debug: immediate auth failure due to internal failure May 04 13:09:14 auth: Debug: conn unix:login (pid=9061,uid=117) [1]: client passdb out: FAIL 1 user=joh(a)doe.com code=temp_fail May 04 13:09:18 pop3-login: Info: Login aborted: Logged out (auth service reported temporary failure, 1 attempts in 6 secs) (temp_fail): user=<joh(a)doe.com>, method=PLAIN, rip=127.0.0.1, lip=127.0.0.1, secured, session=<0sexkUw07I1/AAAB> -- Best regards, Odhiambo WASHINGTON, Nairobi,KE +254 7 3200 0004/+254 7 2274 3223 In an Internet failure case, the #1 suspect is a constant: DNS. "Oh, the cruft.", egrep -v '^$|^.*#' ¯\_(ツ)_/¯ :-) [How to ask smart questions: http://www.catb.org/~esr/faqs/smart- questions.html]

2 4

Quota wrongfully reported as exceeded on shared mailbox
by adminkram＠tripelspark.de 07 May '25

07 May '25

Hi, I've been scratching my head without luck with the following problem: I've shared a mailbox from one user "COMPANY" to another user "JOE". Both users have quotas and both quotas are less than 50% used. When the user JOE tries to post a message into the shared folder, dovecot complains that the user would be over quota: bash# /usr/lib/dovecot/imap -u JOE 1 append shared/COMPANY/Sent/JOE {10} a NO [OVERQUOTA] Quota exceeded (mailbox for user is full) (0.057 + 0.000 + 0.057 secs). However, nobody is over quota: bash# doveadm quota get -u COMPANY Quota name Type Value Limit % User quota STORAGE 4754996 10485760 45 User quota MESSAGE 33695 - 0 bash# doveadm quota get -u JOE Quota name Type Value Limit % User quota STORAGE 14 1048576 0 User quota MESSAGE 3 - 0 Some more infos: 1. Dovecot-2.3.21 (+Debian updates) 2.3.21 (47349e2482) (NOTE: dovecot.org/mailing-lists says: Use dovecot –version to get it. The command is dovecot --version, though!) 2. I've performed "doveadm quota recalc" on both users, no change. 3. I've checked sharing ACL permissions, if I give just "l" permission, the response will be "NO [NOPERM] Permission denied". It does not seem to be an ACL permission reported wrongly. 4. I've tried increasing the quota size beyond reason (100 Gbytes for JOE), no change. 5. I've restarted dovecot after each change. 6. When trying to move a message into the shared Sent/joe folder in Thunderbird, same problem happens, Thunderbird displays the over quota message. Thunderbird cannot display the quota info for the shared folder, though. 7. I tried to enable rawlog (rawlog_dir in protocol imap). It does nothing helpful. It logs the manual commands from my pre-auth sessions (imap -u JOE) but it will stubbornly not log any commands issued by Thunderbird. ?! Any idea how to further debug this or what could be wrong? Thank you, Wolfgang

2 1

Dovecot 3.21.1 -> 2.4.0 SegFault
by Cata S 06 May '25

06 May '25

Hi guys, There seems to be some issue with Dovecot deployed on alpine. More specifically, the dovecot.config file is not properly read. I have run some debugging and the SegFault is returned in the function below: #0 0x000055555556779b in config_parsed_get_setting () No symbol table info available. #1 0x0000555555563708 in config_dump_full () No symbol table info available. #2 0x000055555555c814 in main () No symbol table info available. This was also addressed by alpine here: https://gitlab.alpinelinux.org/alpine/aports/-/issues/17050 Any idea what could be causing this? Thanks for looking into it, Cata

2 1

(2.4) weird doveadm behavior
by Kamil Jońca 06 May '25

06 May '25

debian package 2.4.1-4 (7d8c0e5759): /etc/dovecot/dovecot.conf I have namespace: namespace expunged { mail_driver = maildir mail_path = ~/Mail/expunged/ mailbox_list_layout = fs hidden = yes inbox = no list = no prefix = .EXPUNGED/ separator = / } %doveadm search -u kjonca mailbox .EXPUNGED|head -n 1 08ac303413c11168864d2a00a6f72b09 30802 %doveadm fetch -u kjonca text mailbox-guid 08ac303413c11168864d2a00a6f72b09 uid 30802 ...empty output... How can I fetch messages? KJ -- http://wolnelektury.pl/wesprzyj/teraz/ Now KEN and BARBIE are PERMANENTLY ADDICTED to MIND-ALTERING DRUGS ...

3 6

2.3 -> 2.4 migration problem(s)
by Kamil Jońca 06 May '25

06 May '25

Recently in debian sid version 2.4 appeared and I tried to migrate. it (mostly working) but Neither dovecot-lda nor doveadm does not see current system user context i.e. --8<---------------cut here---------------start------------->8--- %doveadm mailbox list Fatal: One of -u, -F, -A or --no-userdb-lookup must be provided --8<---------------cut here---------------end--------------->8--- from lda logs --8<---------------cut here---------------start------------->8--- Fatal: Namespace root: mail_storage settings: Failed to parse configuration: Invalid setting mail_path=~/Mail/0/: mail_path setting used home directory (~/) but there is no mail_home and userdb didn't return it --8<---------------cut here---------------end--------------->8--- for dovecot-lda setting "mail_home = /home/%{user|username}" helped but still ... doveadm mailbox list -u kjonca and "-d" option helped in both cases Moreover I found that doveadm does not work when dovecot is stoped (but used to work in 2.3.x) Another thing is: --8<---------------cut here---------------start------------->8--- deliver_log_format = msgid=%m: %$ --8<---------------cut here---------------end--------------->8--- in 2.3.x configuration it created line like this: --8<---------------cut here---------------start------------->8--- 2025-04-27T02:08:31.925845+02:00 alfa dovecot: LDA(kjonca): sieve: msgid=<fd248603-b186-4ee2-9e76-b9b9c0fe7a87@alfa>: fileinto action: stored mail into mailbox 'RSS' --8<---------------cut here---------------end--------------->8--- but now it does not work (what is strange I cannot find %$ description and %m is described as "mechanism" not message id ...) So how can I have old loggin and authentication mechanisms? KJ # 2.4.1-4 (7d8c0e5759): /etc/dovecot/dovecot.conf # Pigeonhole version 2.4.1-4 (0a86619f) # OS: Linux 6.12.22-amd64 x86_64 Debian trixie/sid # ... # 4 default setting change dovecot_config_version = 2.4.0 acl_driver = vfile auth_allow_cleartext = yes auth_debug = yes auth_mechanisms = plain digest-md5 cram-md5 login auth_username_format = %{user | username } auth_verbose = yes default_vsz_limit = 1024M dovecot_storage_version = 2.4.0 lazy_expunge_mailbox = .EXPUNGED/ lazy_expunge_only_last_instance = yes listen = alfa mail_driver = maildir mail_inbox_path = ~/Mail/0/INBOX mail_log_events = delete undelete expunge copy mailbox_delete mailbox_rename flag_change save mail_log_fields = uid box msgid size from subject flags mail_log_prefix = "%{protocol}(%{user}): " mail_path = ~/Mail/0/ mail_plugins { acl = yes lazy_expunge = yes } postmaster_address = root@localhost protocols { imap = yes } sieve_execute_bin_dir = %{home}/sieve/bin sieve_execute_exec_timeout = 86400s sieve_extensions { fileinto = yes reject = yes envelope = yes encoded-character = yes vacation = yes subaddress = yes comparator-i;ascii-numeric = yes relational = yes regex = yes imap4flags = yes copy = yes include = yes body = yes variables = yes enotify = yes environment = yes mailbox = yes date = yes index = yes ihave = yes duplicate = yes mime = yes foreverypart = yes extracttext = yes vnd.dovecot.pipe = yes vnd.dovecot.execute = yes vnd.dovecot.filter = yes vnd.dovecot.debug = yes editheader = yes } sieve_filter_bin_dir = %{home}/sieve/bin sieve_filter_exec_timeout = 86400s sieve_pipe_bin_dir = %{home}/sieve/bin sieve_pipe_exec_timeout = 86400s sieve_plugins { sieve_extprograms = yes } ssl = no service auth { user = root unix_listener auth-userdb { } } passdb alfa { default_password_scheme = PLAIN driver = passwd-file passwd_file_path = /etc/security/dovecot.pwd } userdb alfa { passwd_file_path = /etc/security/dovecot.pwd driver = passwd-file } namespace root { inbox = yes separator = / } namespace expunged { mail_driver = maildir mail_path = ~/Mail/expunged/ hidden = yes inbox = no list = no prefix = .EXPUNGED/ separator = / } service imap-login { inet_listener imap { } } service imap { } service auth-worker { user = dovecot } service dict { unix_listener dict { } } protocol lda { deliver_log_format = msgid=%m: %$ info_log_path = syslog log_path = syslog mail_plugins { sieve = yes } syslog_facility = mail } protocol imap { mail_max_userip_connections = 20 mail_plugins { mail_log = yes notify = yes acl = yes imap_acl = yes lazy_expunge = yes } } sieve_script personal { path = ~/.dovecot.sieve } sieve_script before { path = /etc/dovecot/sieve } -- http://wolnelektury.pl/wesprzyj/teraz/ The way I understand it, the Russians are sort of a combination of evil and incompetence... sort of like the Post Office with tanks. -- Emo Philips

3 2

Re: Authentication caching and password changes
by Michael Slusarz 04 May '25

04 May '25

> On 05/03/2025 5:31 AM MDT Diego Alvarez via dovecot <dovecot(a)dovecot.org> wrote: > > In Dovecot docs (https://doc.dovecot.org/2.3/configuration_manual/ > authentication/caching/) we see: > > 1. User logs in with password Y. The cached password X doesn’t match Y and the > previous authentication was unsuccessful, so Dovecot doesn’t bother doing > another backend passdb lookup (until cache TTL expires). The login fails. > > Anyone knows why they chose this design ? Why not simply do a passdb lookup > instead of waiting for cache TTL to expire ? You didn't copy and paste the whole context of this documentation comment: https://doc.dovecot.org/2.4.1/core/config/auth/caching.html#early-change When looking at the full context, this is a situation where a user is either using a password that isn't yet valid (= a bad password, so it's a valid denial), or the user did change their password but the Dovecot system doesn't see the change for some reason (= server/admin issue). In the above situation, doing a passdb lookup without waiting for cache TTL expiration is simply the same situation as not having a negative cache at all. So either don't use the negative cache or fix the password sync (and if you can't fix the authentication sync delay, you can't use a negative cache). An unlikely situation is that the user is using the wrong password originally, and then changes their password to this wrong password. You can always reduce the negative cache TTL if you want to catch this rare situation, at the cost of a lower cache hit rate more generally. michael

2 1

Re: (2.3->2.4) How to expunge with hierarhy saving?
by Michael Slusarz 04 May '25

04 May '25

> On 05/02/2025 10:17 PM MDT Kamil Jońca via dovecot <dovecot(a)dovecot.org> wrote: > > I have used lazy_expunge plugin with namespace (configuration convert): > > namespace expunged { > mail_driver = maildir > mail_path = ~/Mail/expunged/ > hidden = yes > inbox = no > list = no > prefix = .EXPUNGED/ > separator = / > } > > with > lazy_expunge_mailbox = .EXPUNGED > > this allowed me to keep hierarchy (i.e.mails from "admin" mailbox were > expunged to "~/Mail/expunged/admin" ) > this is no longer true - the best I can achieve is to have single > mailbox with all mails :( > Is it possible to get older behavior? > (lazy_expunge_mailbox = .EXPUNGED/ - ends with error) Namespace storage for lazy-expunge plugin was deprecated all the way back in 2.3.0, and was removed for 2.4. I've cleaned up the documentation page to remove all references to namespaces (https://github.com/dovecot/documentation/pull/1234) michael

1 0

Running dovecot 2.4
by Odhiambo Washington 04 May '25

04 May '25

Looking at https://doc.dovecot.org/2.4.1/core/admin/running.html, and comparing with a system where I have installed Dovecot 2.4.1: root@mail:/etc/dovecot/conf.d# ps auxw|grep "dovecot" root 9739 0.0 0.0 8872 4816 ? Ss 14:47 0:00 /usr/sbin/dovecot -F root 9741 0.0 0.0 5324 3280 ? S 14:47 0:00 dovecot/anvil root 9742 0.0 0.0 5428 3256 ? S 14:47 0:00 dovecot/log root 9743 0.0 0.1 51976 10248 ? S 14:47 0:00 dovecot/config Why are my other services not running? For example, the dovecot/auth service is not running. On an system running 2.3.21, I get: wash@eu:~$ ps auxw|grep "dovecot" root 181404 0.0 0.0 8240 4408 ? Ss 14:33 0:00 /usr/sbin/dovecot -F dovecot 181408 0.0 0.0 10668 6936 ? S 14:33 0:00 dovecot/managesieve-login Debian-+ 181409 0.0 0.0 12192 8880 ? S 14:33 0:00 dovecot/lmtp -L dovecot 181410 0.0 0.0 4760 1436 ? S 14:33 0:00 dovecot/anvil root 181411 0.0 0.0 5028 2960 ? S 14:33 0:00 dovecot/log Debian-+ 181412 0.0 0.0 12192 8848 ? S 14:33 0:00 dovecot/lmtp -L Debian-+ 181413 0.0 0.0 12192 9040 ? S 14:33 0:00 dovecot/lmtp -L Debian-+ 181414 0.0 0.0 12192 8908 ? S 14:33 0:00 dovecot/lmtp -L Debian-+ 181415 0.0 0.0 12192 8876 ? S 14:33 0:00 dovecot/lmtp -L root 181416 0.0 0.0 8096 5444 ? S 14:33 0:00 dovecot/config dovecot 181418 0.0 0.0 5964 3496 ? S 14:33 0:00 dovecot/stats dovecot 181419 0.0 0.0 12216 8456 ? S 14:33 0:00 dovecot/auth root@mail:/etc/dovecot/conf.d# doveconf -n # 2.4.1-4+debian12 (7d8c0e5759): /etc/dovecot/dovecot.conf # Pigeonhole version 2.4.1-4+debian12 (0a86619f) # OS: Linux 6.1.0-34-amd64 x86_64 Debian 12.10 # Hostname: mail.test,domain dovecot_config_version = 2.4.1 auth_debug_passwords = yes auth_mechanisms = plain login dovecot_storage_version = 2.4.1 fts_autoindex = yes fts_autoindex_max_recent_msgs = 999 fts_search_add_missing = yes info_log_path = /var/log/dovecot.log log_debug = category=auth mail_driver = Maildir mail_path = ~/Maildir protocols = imap pop3 lmtp sieve sql_driver = mysql mysql /var/run/mysqld/mysqld.sock { dbname = exim4u password = # hidden, use -P to show it user = exim4u } passdb sql { default_password_scheme = SHA512 query = SELECT crypt AS password FROM users,domains WHERE users.username = '%{user}' AND users.enabled = '1' AND users.type='local' and domains.enabled='1' and domains.domain_id = users.domain_id } userdb sql { iterate_query = SELECT username AS user FROM users query = SELECT pop as home, uid, gid FROM users WHERE username = '%{user}' } namespace inbox { inbox = yes mailbox Drafts { special_use = "\\Drafts" } mailbox Junk { special_use = "\\Junk" } mailbox Trash { special_use = "\\Trash" } mailbox Sent { special_use = "\\Sent" } mailbox "Sent Messages" { special_use = "\\Sent" } } service imap-login { inet_listener imap { } inet_listener imaps { } } service pop3-login { inet_listener pop3 { } inet_listener pop3s { } } service submission-login { inet_listener submission { } inet_listener submissions { } } service lmtp { unix_listener lmtp { } } service imap { } service pop3 { } service submission { } service auth { unix_listener auth-userdb { } } service auth-worker { } service dict { unix_listener dict { } } service managesieve-login { inet_listener sieve { port = 4190 } inet_listener sieve_deprecated { port = 2000 } } service managesieve { } -- Best regards, Odhiambo WASHINGTON, Nairobi,KE +254 7 3200 0004/+254 7 2274 3223 In an Internet failure case, the #1 suspect is a constant: DNS. "Oh, the cruft.", egrep -v '^$|^.*#' ¯\_(ツ)_/¯ :-) [How to ask smart questions: http://www.catb.org/~esr/faqs/smart-questions.html] Looking at https://doc.dovecot.org/2.4.1/core/admin/running.html, and comparing with a system where I have installed Dovecot 2.4.1: root@mail:/etc/dovecot/conf.d# ps auxw|grep "dovecot" root 9739 0.0 0.0 8872 4816 ? Ss 14:47 0:00 /usr/sbin/ dovecot -F root 9741 0.0 0.0 5324 3280 ? S 14:47 0:00 dovecot/ anvil root 9742 0.0 0.0 5428 3256 ? S 14:47 0:00 dovecot/log root 9743 0.0 0.1 51976 10248 ? S 14:47 0:00 dovecot/ config Why are my other services not running? For example, the dovecot/auth service is not running. On an system running 2.3.21, I get: wash@eu:~$ ps auxw|grep "dovecot" root 181404 0.0 0.0 8240 4408 ? Ss 14:33 0:00 /usr/sbin/ dovecot -F dovecot 181408 0.0 0.0 10668 6936 ? S 14:33 0:00 dovecot/ managesieve-login Debian-+ 181409 0.0 0.0 12192 8880 ? S 14:33 0:00 dovecot/lmtp -L dovecot 181410 0.0 0.0 4760 1436 ? S 14:33 0:00 dovecot/ anvil root 181411 0.0 0.0 5028 2960 ? S 14:33 0:00 dovecot/log Debian-+ 181412 0.0 0.0 12192 8848 ? S 14:33 0:00 dovecot/lmtp -L Debian-+ 181413 0.0 0.0 12192 9040 ? S 14:33 0:00 dovecot/lmtp -L Debian-+ 181414 0.0 0.0 12192 8908 ? S 14:33 0:00 dovecot/lmtp -L Debian-+ 181415 0.0 0.0 12192 8876 ? S 14:33 0:00 dovecot/lmtp -L root 181416 0.0 0.0 8096 5444 ? S 14:33 0:00 dovecot/ config dovecot 181418 0.0 0.0 5964 3496 ? S 14:33 0:00 dovecot/ stats dovecot 181419 0.0 0.0 12216 8456 ? S 14:33 0:00 dovecot/auth root@mail:/etc/dovecot/conf.d# doveconf -n # 2.4.1-4+debian12 (7d8c0e5759): /etc/dovecot/dovecot.conf # Pigeonhole version 2.4.1-4+debian12 (0a86619f) # OS: Linux 6.1.0-34-amd64 x86_64 Debian 12.10 # Hostname: mail.test,domain dovecot_config_version = 2.4.1 auth_debug_passwords = yes auth_mechanisms = plain login dovecot_storage_version = 2.4.1 fts_autoindex = yes fts_autoindex_max_recent_msgs = 999 fts_search_add_missing = yes info_log_path = /var/log/dovecot.log log_debug = category=auth mail_driver = Maildir mail_path = ~/Maildir protocols = imap pop3 lmtp sieve sql_driver = mysql mysql /var/run/mysqld/mysqld.sock { dbname = exim4u password = # hidden, use -P to show it user = exim4u } passdb sql { default_password_scheme = SHA512 query = SELECT crypt AS password FROM users,domains WHERE users.username = '% {user}' AND users.enabled = '1' AND users.type='local' and domains.enabled='1' and domains.domain_id = users.domain_id } userdb sql { iterate_query = SELECT username AS user FROM users query = SELECT pop as home, uid, gid FROM users WHERE username = '%{user}' } namespace inbox { inbox = yes mailbox Drafts { special_use = "\\Drafts" } mailbox Junk { special_use = "\\Junk" } mailbox Trash { special_use = "\\Trash" } mailbox Sent { special_use = "\\Sent" } mailbox "Sent Messages" { special_use = "\\Sent" } } service imap-login { inet_listener imap { } inet_listener imaps { } } service pop3-login { inet_listener pop3 { } inet_listener pop3s { } } service submission-login { inet_listener submission { } inet_listener submissions { } } service lmtp { unix_listener lmtp { } } service imap { } service pop3 { } service submission { } service auth { unix_listener auth-userdb { } } service auth-worker { } service dict { unix_listener dict { } } service managesieve-login { inet_listener sieve { port = 4190 } inet_listener sieve_deprecated { port = 2000 } } service managesieve { } -- Best regards, Odhiambo WASHINGTON, Nairobi,KE +254 7 3200 0004/+254 7 2274 3223 In an Internet failure case, the #1 suspect is a constant: DNS. "Oh, the cruft.", egrep -v '^$|^.*#' ¯\_(ツ)_/¯ :-) [How to ask smart questions: http://www.catb.org/~esr/faqs/smart- questions.html]

1 0

MySQL AUTH failing
by Odhiambo Washington 03 May '25

03 May '25

I am arriving late to begin the migration to 2.4. The following is my auth-sql.conf.ext: # MySQL Authentication sql_driver = mysql mysql /var/run/mysqld/mysqld.sock { user = user password = SECRET dbname = pass } passdb sql { default_password_scheme = MD5-CRYPT query = SELECT crypt AS password FROM users,domains WHERE users.username = '%u' AND users.enabled = '1' AND users.type='local' and domains.enabled='1' and domains.domain_id = users.domain_id } userdb sql { query = SELECT pop as home, uid, gid FROM users WHERE username = '%u' iterate_query = SELECT username AS user FROM users } The queries work for Dovecot 2.3, but fail for 2.4: May 03 20:46:44 auth-worker(john(a)doe.com,127.0.0.1)<4758><AAi/1z40rt9/AAAB>: request [1]: Debug: sql: query: SELECT crypt AS password FROM users,domains WHERE users.username = '%u' AND users.enabled = '1' AND users.type='local' and domains.enabled='1' and domains.domain_id = users.domain_id May 03 20:46:44 auth-worker(4758): Debug: mysql(/var/run/mysqld/mysqld.sock): Finished query 'SELECT crypt AS password FROM users,domains WHERE users.username = '%u' AND users.enabled = '1' AND users.type='local' and domains.enabled='1' and domains.domain_id = users.domain_id' in 1 msecs May 03 20:46:44 auth-worker(john(a)doe.com,127.0.0.1)<4758><AAi/1z40rt9/AAAB>: request [1]: Info: sql: unknown user May 03 20:46:44 auth-worker(john(a)doe.com,127.0.0.1)<4758><AAi/1z40rt9/AAAB>: request [1]: Debug: sql: Finished passdb lookup May 03 20:46:44 auth-worker(4758): Debug: conn unix:auth-worker (pid=4757,uid=116): auth-worker<1>: Finished: user_unknown May 03 20:46:44 auth(john@doe.com,127.0.0.1,sasl:plain)<AAi/1z40rt9/AAAB>: Debug: sql: Finished passdb lookup May 03 20:46:44 auth(john@doe.com,127.0.0.1,sasl:plain)<AAi/1z40rt9/AAAB>: Debug: Auth request finished May 03 20:46:44 auth(john@doe.com,127.0.0.1,sasl:plain)<AAi/1z40rt9/AAAB>: Debug: delaying auth failure May 03 20:46:46 auth: Debug: conn unix:login (pid=4755,uid=117) [1]: client passdb out: FAIL 1 user=john(a)doe.com -- Best regards, Odhiambo WASHINGTON, Nairobi,KE +254 7 3200 0004/+254 7 2274 3223 In an Internet failure case, the #1 suspect is a constant: DNS. "Oh, the cruft.", egrep -v '^$|^.*#' ¯\_(ツ)_/¯ :-) [How to ask smart questions: http://www.catb.org/~esr/faqs/smart-questions.html] I am arriving late to begin the migration to 2.4. The following is my auth-sql.conf.ext: # MySQL Authentication sql_driver = mysql mysql /var/run/mysqld/mysqld.sock { user = user password = SECRET dbname = pass } passdb sql { default_password_scheme = MD5-CRYPT query = SELECT crypt AS password FROM users,domains WHERE users.username = '%u' AND users.enabled = '1' AND users.type='local' and domains.enabled='1' and domains.domain_id = users.domain_id } userdb sql { query = SELECT pop as home, uid, gid FROM users WHERE username = '%u' iterate_query = SELECT username AS user FROM users } The queries work for Dovecot 2.3, but fail for 2.4: May 03 20:46:44 auth-worker(john(a)doe.com,127.0.0.1)<4758><AAi/1z40rt9/AAAB>: request [1]: Debug: sql: query: SELECT crypt AS password FROM users,domains WHERE users.username = '%u' AND users.enabled = '1' AND users.type='local' and domains.enabled='1' and domains.domain_id = users.domain_id May 03 20:46:44 auth-worker(4758): Debug: mysql(/var/run/mysqld/mysqld.sock): Finished query 'SELECT crypt AS password FROM users,domains WHERE users.username = '%u' AND users.enabled = '1' AND users.type='local' and domains.enabled='1' and domains.domain_id = users.domain_id' in 1 msecs May 03 20:46:44 auth-worker(john(a)doe.com,127.0.0.1)<4758><AAi/1z40rt9/AAAB>: request [1]: Info: sql: unknown user May 03 20:46:44 auth-worker(john(a)doe.com,127.0.0.1)<4758><AAi/1z40rt9/AAAB>: request [1]: Debug: sql: Finished passdb lookup May 03 20:46:44 auth-worker(4758): Debug: conn unix:auth-worker (pid=4757,uid=116): auth-worker<1>: Finished: user_unknown May 03 20:46:44 auth(john@doe.com,127.0.0.1,sasl:plain)<AAi/1z40rt9/AAAB>: Debug: sql: Finished passdb lookup May 03 20:46:44 auth(john@doe.com,127.0.0.1,sasl:plain)<AAi/1z40rt9/AAAB>: Debug: Auth request finished May 03 20:46:44 auth(john@doe.com,127.0.0.1,sasl:plain)<AAi/1z40rt9/AAAB>: Debug: delaying auth failure May 03 20:46:46 auth: Debug: conn unix:login (pid=4755,uid=117) [1]: client passdb out: FAIL 1 user=john(a)doe.com -- Best regards, Odhiambo WASHINGTON, Nairobi,KE +254 7 3200 0004/+254 7 2274 3223 In an Internet failure case, the #1 suspect is a constant: DNS. "Oh, the cruft.", egrep -v '^$|^.*#' ¯\_(ツ)_/¯ :-) [How to ask smart questions: http://www.catb.org/~esr/faqs/smart- questions.html]

1 0

Authentication caching and password changes
by Diego Alvarez 03 May '25

03 May '25

In Dovecot docs (https://doc.dovecot.org/2.3/configuration_manual/ authentication/caching/) we see: 1. User logs in with password Y. The cached password X doesn’t match Y and the previous authentication was unsuccessful, so Dovecot doesn’t bother doing another backend passdb lookup (until cache TTL expires). The login fails. Anyone knows why they chose this design ? Why not simply do a passdb lookup instead of waiting for cache TTL to expire ? In Dovecot docs (https://doc.dovecot.org/2.3/configuration_manual/ authentication/caching/) we see: 1. User logs in with password Y. The cached password X doesn’t match Y and the previous authentication was unsuccessful, so Dovecot doesn’t bother doing another backend passdb lookup (until cache TTL expires). The login fails. Anyone knows why they chose this design ? Why not simply do a passdb lookup instead of waiting for cache TTL to expire ?

1 0

(2.3->2.4) How to expunge with hierarhy saving?
by Kamil Jońca 03 May '25

03 May '25

I have used lazy_expunge plugin with namespace (configuration convert): namespace expunged { mail_driver = maildir mail_path = ~/Mail/expunged/ hidden = yes inbox = no list = no prefix = .EXPUNGED/ separator = / } with lazy_expunge_mailbox = .EXPUNGED this allowed me to keep hierarchy (i.e.mails from "admin" mailbox were expunged to "~/Mail/expunged/admin" ) this is no longer true - the best I can achieve is to have single mailbox with all mails :( Is it possible to get older behavior? (lazy_expunge_mailbox = .EXPUNGED/ - ends with error) KJ -- http://wolnelektury.pl/wesprzyj/teraz/ Zuzanka najwyraźniej pełni obowiązki Albina Siwaka w tej ekipie... (C) Slawek Kotynski w dyskusj nt. pl.whatewer.SETI@home...

1 0

GSSAPI authentication regression with 2.4.x
by Noah Meyerhans 02 May '25

02 May '25

While preparing the Debian packages of Dovecot 2.4.1, I encountered what appears to be a regression that impacts the ability of some clients to successfully negotiate gssapi/krb5 authentication. The regression has so far been observed in gsasl, which was able to successfully authenticate to 2.3.19 but cannot authenticate to 2.4.1. Mutt is able to successfully authenticate with 2.3.19 and 2.4.1. Doveconf output is attached. The debug logs for both failed (gsasl) and successful (mutt) authentications follow. Note that all logs are from an ephemeral debug environment, and sensitive data is not redacted. I can provide additional information as needed, and can test different code and/or configuration changes. Failed authentication dovecot debug log: Apr 30 13:40:09 auth: Debug: Loading modules from directory: /usr/lib/dovecot/modules/auth Apr 30 13:40:09 auth: Debug: Loading modules from directory: /usr/lib/dovecot/modules/auth Apr 30 13:40:09 auth: Debug: Module loaded: /usr/lib/dovecot/modules/auth/libmech_gssapi.so Apr 30 13:40:09 auth: Debug: Read auth token secret from /home/noahm/dovecot-root/b/auth-token-secret.dat Apr 30 13:40:09 auth: Debug: conn unix:login (pid=6791,uid=1000) [1]: Server accepted connection (fd=18) Apr 30 13:40:09 auth: Debug: conn unix:login (pid=6791,uid=1000) [1]: auth client connected (pid=6791) Apr 30 13:40:09 auth: Debug: conn unix:login (pid=6791,uid=1000) [1]: client in: AUTH 1 GSSAPI protocol=imap final-resp-ok session=FhRIDv8zdMzAqAHa lip=172.18.0.205 rip=192.168.1.218 lport=17436 rport=52340 Apr 30 13:40:09 auth(?,192.168.1.218,sasl:gssapi)<FhRIDv8zdMzAqAHa>: Debug: gssapi: Using all keytab entries Apr 30 13:40:09 auth: Debug: conn unix:login (pid=6791,uid=1000) [1]: client passdb out: CONT 1 # Apr 30 13:40:09 auth: Debug: conn unix:login (pid=6791,uid=1000) [1]: client in: CONT 1 # (previous base64 data may contain sensitive data) Apr 30 13:40:09 auth(?,192.168.1.218,sasl:gssapi)<FhRIDv8zdMzAqAHa>: Debug: gssapi: Processed incoming packet correctly, waiting for another. Apr 30 13:40:09 auth: Debug: conn unix:login (pid=6791,uid=1000) [1]: client passdb out: CONT 1 YEcGBisGAQUFAqA9MDugDTALBgkqhkiG9xIBAgKjKjAooCYbJG5vdF9kZWZpbmVkX2luX1JGQzQxNzhAcGxlYXNlX2lnbm9yZQ== Apr 30 13:40:09 auth: Debug: conn unix:login (pid=6791,uid=1000) [1]: client in: CONT 1 YIIDAAYJKoZIhvcSAQICAQBuggLvMIIC66ADAgEFoQMCAQ6iBwMFACAAAACjggIDYYIB/zCCAfugAwIBBaENGwtFWEFNUExFLkNPTaIfMB2gAwIBA6EWMBQbBGltYXAbDGRvdmVjb3QtdGVzdKOCAcIwggG+oAMCARKhAwIBAqKCAbAEggGsj4jD3VOwvfNdLxjc2hqxFsBYyCvjdOCX0R1So6ANZEYnEWddqZwMCuz7BxXv4z+cXaL6g6iGlVkU4RxQyJQHDFUQC8JroTlyMQ+XsIM4zuwn5N4/xRsgKa+SisK92UNMYyl9hVIPKvu/A54cU0zYTdDjYfDGnkurG2RgXDrKIzMpU2LtpoBEtwl3F1H+rzKFJAqe96e39C85GjK1D4s8/TOm3IcHJ5eofeHxI2GeUodysi+DlurRQTSnsUkGa1LXSgkY+4QdlMf+4goNRG5xNdZ8OA2CLY97TPAFqIeej1Amvb9uQBIKvWfbTjDdItBWOhuvAetlNfqnxlcCbnjbCmFTOIbVsHhNW8W1JIElL28mGydbMPimi9brc250E+ImO0Bxp3gMn5oXGV0tUJl5Y8W1lHlEUU7vKK0V7khUob0b3P3lCGQVJyWZEGNodgpr5zkTbR2M8orP4eI9SYoYp2UB0Ag+JkeYSNoQrKZNxSoKBYLVPGzwwGNPBKl7T0CdXlDAOhfZS/FSxdoy8LGRhuTdv7ghQAvstOllibSbjN3wos8ZC8wH2I5LFkekgc4wgcugAwIBEqKBwwSBwMCJkwg3LL7QqlEOunOjvQzpXmA/LMbdtEDyW9b0EQNFL9KFkNuRKDC3V8SFkmG1KlEEHFp2GQNij6AN89xvmEGvhj3tqC280awJs8ve3Bbr7GHRJoFO/sikSRsol1HD/K3sC9OMDufEEItsWf94uu8SmEBpB2OBOzedtfw+PRpoWyYUJYEfAL9T4w0KmBD26KVcehzIv8e3vOl52aT3x9Ovjnw8RfFkZa+t/iGhMpYpf8ApWExZDWBZ6uzVJxcAPg== (previous base64 data may contain sensitive data) Apr 30 13:40:09 auth(?,192.168.1.218,sasl:gssapi)<FhRIDv8zdMzAqAHa>: Debug: Auth request finished Apr 30 13:40:09 auth(?,192.168.1.218,sasl:gssapi)<FhRIDv8zdMzAqAHa>: Debug: delaying auth failure Apr 30 13:40:11 auth: Debug: conn unix:login (pid=6791,uid=1000) [1]: client passdb out: FAIL 1 Apr 30 13:40:11 auth: Debug: conn unix:login (pid=6791,uid=1000) [1]: Disconnected: Connection closed (fd=18) And the corresponding client log: noahm@42b23a0b5002:~$ gsasl -m GSSAPI -d --no-starttls --imap dovecot-test 17436 Trying 'dovecot-test'... * OK [CAPABILITY IMAP4rev1 LOGIN-REFERRALS ID ENABLE IDLE SASL-IR LITERAL+ STARTTLS AUTH=PLAIN AUTH=GSSAPI] Dovecot ready. . CAPABILITY * CAPABILITY IMAP4rev1 LOGIN-REFERRALS ID ENABLE IDLE SASL-IR LITERAL+ STARTTLS AUTH=PLAIN AUTH=GSSAPI . OK Pre-login capabilities listed, post-login capabilities have more. . AUTHENTICATE GSSAPI + YEcGBisGAQUFAqA9MDugDTALBgkqhkiG9xIBAgKjKjAooCYbJG5vdF9kZWZpbmVkX2luX1JGQzQxNzhAcGxlYXNlX2lnbm9yZQ== YIIDAAYJKoZIhvcSAQICAQBuggLvMIIC66ADAgEFoQMCAQ6iBwMFACAAAACjggIDYYIB/zCCAfugAwIBBaENGwtFWEFNUExFLkNPTaIfMB2gAwIBA6EWMBQbBGltYXAbDGRvdmVjb3QtdGVzdKOCAcIwggG+oAMCARKhAwIBAqKCAbAEggGsj4jD3VOwvfNdLxjc2hqxFsBYyCvjdOCX0R1So6ANZEYnEWddqZwMCuz7BxXv4z+cXaL6g6iGlVkU4RxQyJQHDFUQC8JroTlyMQ+XsIM4zuwn5N4/xRsgKa+SisK92UNMYyl9hVIPKvu/A54cU0zYTdDjYfDGnkurG2RgXDrKIzMpU2LtpoBEtwl3F1H+rzKFJAqe96e39C85GjK1D4s8/TOm3IcHJ5eofeHxI2GeUodysi+DlurRQTSnsUkGa1LXSgkY+4QdlMf+4goNRG5xNdZ8OA2CLY97TPAFqIeej1Amvb9uQBIKvWfbTjDdItBWOhuvAetlNfqnxlcCbnjbCmFTOIbVsHhNW8W1JIElL28mGydbMPimi9brc250E+ImO0Bxp3gMn5oXGV0tUJl5Y8W1lHlEUU7vKK0V7khUob0b3P3lCGQVJyWZEGNodgpr5zkTbR2M8orP4eI9SYoYp2UB0Ag+JkeYSNoQrKZNxSoKBYLVPGzwwGNPBKl7T0CdXlDAOhfZS/FSxdoy8LGRhuTdv7ghQAvstOllibSbjN3wos8ZC8wH2I5LFkekgc4wgcugAwIBEqKBwwSBwMCJkwg3LL7QqlEOunOjvQzpXmA/LMbdtEDyW9b0EQNFL9KFkNuRKDC3V8SFkmG1KlEEHFp2GQNij6AN89xvmEGvhj3tqC280awJs8ve3Bbr7GHRJoFO/sikSRsol1HD/K3sC9OMDufEEItsWf94uu8SmEBpB2OBOzedtfw+PRpoWyYUJYEfAL9T4w0KmBD26KVcehzIv8e3vOl52aT3x9Ovjnw8RfFkZa+t/iGhMpYpf8ApWExZDWBZ6uzVJxcAPg== . NO [AUTHENTICATIONFAILED] Authentication failed. gsasl: server error Successful authentication (mutt) dovecot debug log: Apr 30 13:32:30 auth: Debug: Loading modules from directory: /usr/lib/dovecot/modules/auth Apr 30 13:32:30 auth: Debug: Loading modules from directory: /usr/lib/dovecot/modules/auth Apr 30 13:32:30 auth: Debug: Module loaded: /usr/lib/dovecot/modules/auth/libmech_gssapi.so Apr 30 13:32:30 auth: Debug: Read auth token secret from /home/noahm/dovecot-root/b/auth-token-secret.dat Apr 30 13:32:30 auth: Debug: conn unix:login (pid=6788,uid=1000) [1]: Server accepted connection (fd=18) Apr 30 13:32:30 auth: Debug: conn unix:login (pid=6788,uid=1000) [1]: auth client connected (pid=6788) Apr 30 13:32:30 auth: Debug: conn unix:login (pid=6788,uid=1000) [1]: client in: AUTH 1 GSSAPI protocol=imap final-resp-ok session=4aLx8v4z8JPAqAHa lip=172.18.0.205 rip=192.168.1.218 lport=17436 rport=37872 resp=YIIDAAYJKoZIhvcSAQICAQBuggLvMIIC66ADAgEFoQMCAQ6iBwMFACAAAACjggIDYYIB/zCCAfugAwIBBaENGwtFWEFNUExFLkNPTaIfMB2gAwIBA6EWMBQbBGltYXAbDGRvdmVjb3QtdGVzdKOCAcIwggG+oAMCARKhAwIBAqKCAbAEggGsj4jD3VOwvfNdLxjc2hqxFsBYyCvjdOCX0R1So6ANZEYnEWddqZwMCuz7BxXv4z+cXaL6g6iGlVkU4RxQyJQHDFUQC8JroTlyMQ+XsIM4zuwn5N4/xRsgKa+SisK92UNMYyl9hVIPKvu/A54cU0zYTdDjYfDGnkurG2RgXDrKIzMpU2LtpoBEtwl3F1H+rzKFJAqe96e39C85GjK1D4s8/TOm3IcHJ5eofeHxI2GeUodysi+DlurRQTSnsUkGa1LXSgkY+4QdlMf+4goNRG5xNdZ8OA2CLY97TPAFqIeej1Amvb9uQBIKvWfbTjDdItBWOhuvAetlNfqnxlcCbnjbCmFTOIbVsHhNW8W1JIElL28mGydbMPimi9brc250E+ImO0Bxp3gMn5oXGV0tUJl5Y8W1lHlEUU7vKK0V7khUob0b3P3lCGQVJyWZEGNodgpr5zkTbR2M8orP4eI9SYoYp2UB0Ag+JkeYSNoQrKZNxSoKBYLVPGzwwGNPBKl7T0CdXlDAOhfZS/FSxdoy8LGRhuTdv7ghQAvstOllibSbjN3wos8ZC8wH2I5LFkekgc4wgcugAwIBEqKBwwSBwHCqBBzSB3g1k9BBC5M8XG5NpM35pvpLMHWjw0HIXloN2XjibgczTBt6l+q4DuWo6OWCuf5U+g+BrQ17y52AnCwUk/l722toAEhxwEKA/f3K+7i/lXBzjfCxGTmD2TTO6NUVZUM6TTa6CvwKgGwzGZLh/kQ90VnyzaOyTErL5oiNtl8ZKfguMt38yV8THESf8ZGjxUCKUUa1n3UNClhVk/0Kl88qGD1h11it0yFoNNK5/tbqI5e+sdi+pK4VHsvjPw== (previous base64 data may contain sensitive data) Apr 30 13:32:30 auth(?,192.168.1.218,sasl:gssapi)<4aLx8v4z8JPAqAHa>: Debug: gssapi: Using all keytab entries Apr 30 13:32:30 auth(noahm@example.com,192.168.1.218,sasl:gssapi)<4aLx8v4z8JPAqAHa>: Debug: gssapi: security context state completed. Apr 30 13:32:30 auth: Debug: conn unix:login (pid=6788,uid=1000) [1]: client passdb out: CONT 1 YIGZBgkqhkiG9xIBAgICAG+BiTCBhqADAgEFoQMCAQ+iejB4oAMCARKicQRvsiRFdcazky9GL2l//v2J+U606pbiLSCahGZ2wUxpp05eo9kGAl7j/UQfkzmlOWW7aMfMzPrJTveYBZiDpcfyeTt/wJfAHiEk5A24KYKTIt2ialxe6YOvrmz1e4B+mULZAghrfq5ftdUkQfh0CP/W Apr 30 13:32:30 auth: Debug: conn unix:login (pid=6788,uid=1000) [1]: client in: CONT 1 (previous base64 data may contain sensitive data) Apr 30 13:32:30 auth(noahm@example.com,192.168.1.218,sasl:gssapi)<4aLx8v4z8JPAqAHa>: Debug: gssapi: Negotiated security layer Apr 30 13:32:30 auth: Debug: conn unix:login (pid=6788,uid=1000) [1]: client passdb out: CONT 1 BQQF/wAMAAAAAAAAFUr00gH/////HIlwJEVFPtqhtCU= Apr 30 13:32:30 auth: Debug: conn unix:login (pid=6788,uid=1000) [1]: client in: CONT 1 BQQE/wAMAAAAAAAAIfpD4AH///9ub2FobalxyQ7OjgY973Gakw== (previous base64 data may contain sensitive data) Apr 30 13:32:30 auth(noahm,192.168.1.218,sasl:gssapi)<4aLx8v4z8JPAqAHa>: Debug: static: Performing passdb lookup Apr 30 13:32:30 auth(noahm,192.168.1.218,sasl:gssapi)<4aLx8v4z8JPAqAHa>: Debug: static: lookup Apr 30 13:32:30 auth(noahm,192.168.1.218,sasl:gssapi)<4aLx8v4z8JPAqAHa>: Debug: static: Finished passdb lookup Apr 30 13:32:30 auth(noahm,192.168.1.218,sasl:gssapi)<4aLx8v4z8JPAqAHa>: Debug: Credentials: 70656e63696c Apr 30 13:32:30 auth(noahm,192.168.1.218,sasl:gssapi)<4aLx8v4z8JPAqAHa>: Debug: Auth request finished Apr 30 13:32:30 auth: Debug: conn unix:login (pid=6788,uid=1000) [1]: client passdb out: OK 1 user=noahm original_user=noahm(a)EXAMPLE.COM Apr 30 13:32:30 auth: Debug: conn unix:/home/noahm/dovecot-root/b/auth-master (pid=6790,uid=0): Server accepted connection (fd=19) Apr 30 13:32:30 auth: Debug: master in: REQUEST 4221435905 6788 1 6b8a10b34adc8ace171603fc8d378730 session_pid=6790 request_auth_token Apr 30 13:32:30 auth(noahm,192.168.1.218,sasl:gssapi)<4aLx8v4z8JPAqAHa>: Debug: static: Performing userdb lookup Apr 30 13:32:30 auth(noahm,192.168.1.218,sasl:gssapi)<4aLx8v4z8JPAqAHa>: Debug: static: Finished userdb lookup Apr 30 13:32:30 auth: Debug: master userdb out: USER 4221435905 noahm uid=4711 gid=4711 home=/home/noahm/dovecot-root auth_mech=GSSAPI auth_token=705494201f3425a0145e2f7af1edca82fee2ee17 auth_user=noahm(a)EXAMPLE.COM The corresponding client-side logs generated by mutt are: [2025-04-30 13:32:30] Connecting to dovecot-test... [2025-04-30 13:32:30] Connected to dovecot-test:17436 on fd=4 [2025-04-30 13:32:30] 4< * OK [CAPABILITY IMAP4rev1 LOGIN-REFERRALS ID ENABLE IDLE SASL-IR LITERAL+ STARTTLS AUTH=PLAIN AUTH=GSSAPI] Dovecot ready. [2025-04-30 13:32:30] imap_authenticate: Trying method gssapi [2025-04-30 13:32:30] imap_auth_gsasl: using mech GSSAPI [2025-04-30 13:32:30] Authenticating (GSSAPI)... [2025-04-30 13:32:30] 4> a0000 AUTHENTICATE GSSAPI YIIDAAYJKoZIhvcSAQICAQBuggLvMIIC66ADAgEFoQMCAQ6iBwMFACAAAACjggIDYYIB/zCCAfugAwIBBaENGwtFWEFNUExFLkNPTaIfMB2gAwIBA6EWMBQbBGltYXAbDGRvdmVjb3QtdGVzdKOCAcIwggG+oAMCARKhAwIBAqKCAbAEggGsj4jD3VOwvfNdLxjc2hqxFsBYyCvjdOCX0R1So6ANZEYnEWddqZwMCuz7BxXv4z+cXaL6g6iGlVkU4RxQyJQHDFUQC8JroTlyMQ+XsIM4zuwn5N4/xRsgKa+SisK92UNMYyl9hVIPKvu/A54cU0zYTdDjYfDGnkurG2RgXDrKIzMpU2LtpoBEtwl3F1H+rzKFJAqe96e39C85GjK1D4s8/TOm3IcHJ5eofeHxI2GeUodysi+DlurRQTSnsUkGa1LXSgkY+4QdlMf+4goNRG5xNdZ8OA2CLY97TPAFqIeej1Amvb9uQBIKvWfbTjDdItBWOhuvAetlNfqnxlcCbnjbCmFTOIbVsHhNW8W1JIElL28mGydbMPimi9brc250E+ImO0Bxp3gMn5oXGV0tUJl5Y8W1lHlEUU7vKK0V7khUob0b3P3lCGQVJyWZEGNodgpr5zkTbR2M8orP4eI9SYoYp2UB0Ag+JkeYSNoQrKZNxSoKBYLVPGzwwGNPBKl7T0CdXlDAOhfZS/FSxdoy8LGRhuTdv7ghQAvstOllibSbjN3wos8ZC8wH2I5LFkekgc4wgcugAwIBEqKBwwSBwHCqBBzSB3g1k9BBC5M8XG5NpM35pvpLMHWjw0HIXloN2XjibgczTBt6l+q4DuWo6OWCuf5U+g+BrQ17y52AnCwUk/l722toAEhxwEKA/f3K+7i/lXBzjfCxGTmD2TTO6NUVZUM6TTa6CvwKgGwzGZLh/kQ90VnyzaOyTErL5oiNtl8ZKfguMt38yV8THESf8ZGjxUCKUUa1n3UNClhVk/0Kl88qGD1h11it0yFoNNK5/tbqI5e+sdi+pK4VHsvjPw== [2025-04-30 13:32:30] 4< + YIGZBgkqhkiG9xIBAgICAG+BiTCBhqADAgEFoQMCAQ+iejB4oAMCARKicQRvsiRFdcazky9GL2l//v2J+U606pbiLSCahGZ2wUxpp05eo9kGAl7j/UQfkzmlOWW7aMfMzPrJTveYBZiDpcfyeTt/wJfAHiEk5A24KYKTIt2ialxe6YOvrmz1e4B+mULZAghrfq5ftdUkQfh0CP/W [2025-04-30 13:32:30] 4> [2025-04-30 13:32:30] 4< + BQQF/wAMAAAAAAAAFUr00gH/////HIlwJEVFPtqhtCU= [2025-04-30 13:32:30] 4> BQQE/wAMAAAAAAAAIfpD4AH///9ub2FobalxyQ7OjgY973Gakw== [2025-04-30 13:32:30] 4< a0000 OK [CAPABILITY IMAP4rev1 SASL-IR LOGIN-REFERRALS ID ENABLE IDLE SORT SORT=DISPLAY THREAD=REFERENCES THREAD=REFS THREAD=ORDEREDSUBJECT MULTIAPPEND URL-PARTIAL CATENATE UNSELECT CHILDREN NAMESPACE UIDPLUS LIST-EXTENDED I18NLEVEL=1 CONDSTORE QRESYNC ESEARCH ESORT SEARCHRES WITHIN CONTEXT=SEARCH LIST-STATUS BINARY MOVE REPLACE SNIPPET=FUZZY PREVIEW=FUZZY PREVIEW SPECIAL-USE STATUS=SIZE SAVEDATE COMPRESS=DEFLATE INPROGRESS NOTIFY LITERAL+] Logged in

5 5

Dovecot 3.21.1 -> 2.4.0 SegFault
by Cata S 02 May '25

02 May '25

Hi guys, There seems to be some issue with Dovecot deployed on alpine. More specifically, the dovecot.config file is not properly read. I have run some debugging and the SegFault is returned in the function below: #0 0x000055555556779b in config_parsed_get_setting () No symbol table info available. #1 0x0000555555563708 in config_dump_full () No symbol table info available. #2 0x000055555555c814 in main () No symbol table info available. This was also addressed by alpine here: https://gitlab.alpinelinux.org/alpine/aports/-/issues/17050 Any idea what could be causing this? Thanks for looking into it, Cata

2 3

2.3 -> 2.4 sieve scripts
by Kamil Jońca 01 May '25

01 May '25

I have configured some sieve scripts to run when I append messages to one of mailbox: --8<---------------cut here---------------start------------->8--- imapsieve_mailbox1_name = Archives imapsieve_mailbox1_causes = APPEND imapsieve_mailbox1_before = file:/.../sieve/dovecot.sieve --8<---------------cut here---------------end--------------->8--- I tried to use this with 2.4 with no luck: # 2.4.1-4 (7d8c0e5759): /etc/dovecot/dovecot.conf # Pigeonhole version 2.4.1-4 (0a86619f) # OS: Linux 6.12.21-amd64 x86_64 Debian trixie/sid # Hostname: qqrq # 4 default setting changes since version 2.4.0 dovecot_config_version = 2.4.0 auth_mechanisms = plain digest-md5 cram-md5 login compress_zstd_level = 22 default_vsz_limit = 2048M dovecot_storage_version = 2.4.0 fts_autoindex = yes fts_autoindex_max_recent_msgs = 999 fts_search_add_missing = yes mail_compress_write_method = zstd mail_driver = mdbox mail_home = /home/%{user} mail_inbox_path = ~/Mail/0/INBOX mail_path = ~/Mail/0/ mail_plugins { mail_compress = yes acl = yes } mail_privileged_group = mail protocols { imap = yes } sieve_extensions { fileinto = yes reject = yes envelope = yes encoded-character = yes vacation = yes subaddress = yes comparator-i;ascii-numeric = yes relational = yes regex = yes imap4flags = yes copy = yes include = yes body = yes variables = yes enotify = yes environment = yes mailbox = yes date = yes index = yes ihave = yes duplicate = yes mime = yes foreverypart = yes extracttext = yes notify = yes imapflags = yes editheader = yes } sieve_plugins { sieve_imapsieve = yes sieve_extprograms = yes } sieve_redirect_envelope_from = recipient ssl = no passdb passwd-file { default_password_scheme = PLAIN passwd_file_path = /etc/dovecot/users } userdb passwd-file { passwd_file_path = /etc/dovecot/users } namespace inbox { inbox = yes separator = / mailbox Drafts { special_use = "\\Drafts" } mailbox Junk { special_use = "\\Junk" } mailbox Trash { special_use = "\\Trash" } mailbox Sent { special_use = "\\Sent" } mailbox "Sent Messages" { special_use = "\\Sent" } } service imap-login { inet_listener imap { } } service imap { } service pop3 { } service submission { } service auth { unix_listener auth-userdb { } } service auth-worker { } service dict { unix_listener dict { } } protocol imap { mail_plugins { mail_log = yes notify = yes acl = yes imap_acl = yes sieve = yes imap_sieve = yes lazy_expunge = yes } } sieve_script mailbox1 { imapsieve_from_name = Archives cause = append path = file:/.../sieve/dovecot.sieve type = before } When I add message to Archive, I can see in logs: imap(kjonca): Error: Couldn't load required plugin /usr/lib/dovecot/modules/lib90_sieve_plugin.so: dlopen() failed: /usr/lib/dovecot/modules/lib90_sieve_plugin.so: undefined symbol: mail_deliver_ctx_get_log_var_expand_table -- http://wolnelektury.pl/wesprzyj/teraz/ Never go to bed mad. Stay up and fight. -- Phyllis Diller, "Phyllis Diller's Housekeeping Hints"

1 1

How to backup mdbox
by lutz.niederer＠gmx.net 30 Apr '25

30 Apr '25

Hi, dovecot with mdbox on zfs running fine and robust since one year now. Zfs and mdbox seem to make sense. What we do for backup currently is stop dovecot, take a snapshot and restart dovecot. That only takes a few seconds to complete. After that we have time to do the backup. Is that the correct way, or is there a better, preferred way to get the backup done? Is there a way to freeze dovecot while still keeping the clients happy? Some are thrown off and don't recover (namely outlook, even if it takes a few seconds only). We can live with that, but better would be better. Thanks and cheers, -lutzn

1 0

sieve filter does not work
by Kamil Jońca 29 Apr '25

29 Apr '25

sieve-filter -e -W -D -C -v ~/.dovecot.sieve mailbox sieve-filter: Fatal: Couldn't load required plugin /usr/lib/dovecot/modules/lib90_sieve_plugin.so: dlopen() failed: /usr/lib/dovecot/modules/lib90_sieve_plugin.so: undefined symbol: mail_deliver_ctx_get_log_var_expand_table -- http://wolnelektury.pl/wesprzyj/teraz/ Even if you do learn to speak correct English, whom are you going to speak it to? -- Clarence Darrow

1 0

2025-04-28
by 村上寛 28 Apr '25

28 Apr '25

test222 test222

1 0