- dovecot - dovecot.org

Deleted dovecot.index.*
by Odhiambo Washington 17 Jun '19

17 Jun '19

I'm using mdbox. What's the consequence of deleting dovecot.index.* from all folders? All mail gets lost or I can rebuild the indexes and get the mails?

3 6

mailbox encryption
by David Mehler 17 Jun '19

17 Jun '19

Hello, I've got dovecot 2.3 going, and I've got a file 10-mailcrypt.conf which is loading mail_crypt, thinking that that plugin would propagate through all the services, sieve, lmtp, and mailbox message storage. I'm not seeing anything in the logs indicating that the encryption is happening. I am using a file format dbox specifically sdbox format, and in my mailbox I am seeing files like u.5 and others, a file check on them reveals them as data. Should I be seeing encryption in the logs? Thanks. Dave.

2 3

LDA vs LMTP change in header
by ＠lbutlr 17 Jun '19

17 Jun '19

Switching to dovecot LMTP appears to have change the information in the received header, which appears to be causing my spam filter to wig out and mark local to local emails as spam. Here’s what the received header used to look like: Received: from [10.0.5.3] (c-71-229-144-93.hsd1.co.comcast.net [71.229.144.93]) by mail.covisp.net (Postfix) with ESMTPS id B67B8118AD59 for <kreme(a)kreme.com>; Sun, 16 Aug 2009 22:19:02 -0600 (MDT) As opposed to now: Received: from darth.lan (c-73-14.161.160.hsd1.co.comcast.net [73.14.161.160]) by mail.covisp.net(Postfix 3.4.5/8.13.0) with SMTP id unknown; Sun, 16 Jun 2019 15:26:32 -0600 (envelope-from <kreme(a)kreme.com>) The first has an ESMTPS id and the other has SMTP id unknown, which seems to be causing Spamass-milter to treat the LMTP emails as unauthenticated and then ding them for being from public IPs. -- Thanks to the human heart by which we live, Thanks to its tenderness, its joys, and fears, To me the meanest flower that blows can give Thoughts that do often lie too deep for tears

1 0

What does Solr index do and how to handle its high avaliablity?
by luckydog xf 17 Jun '19

17 Jun '19

Hi, guys, Can you give me an example of solr usage in dovecot? As far as I know, you can search email easily by MUA like outlook, so which role does solr play? And based on https://dovecot.org/pipermail/dovecot/2019-April/115575.html I'm going to use an VIP to host 2 mail servers. Currently, it works in fail over and fail back test except solr index, so how to resolve this? Is it possible to put dovecot index on shared storage like NFS? How to if it's a yes. It seems it's under /var/solr/data/dovecot/data/ How to rebuild if I don't put index data on shared storage in case of fail over? Thanks,

2 3

Dovecot, quota, warning, and issue with setup?
by David Mehler 16 Jun '19

16 Jun '19

Hello, I'm having an issue or two with my new Dovecot setup. I'm running version 2.3.6 new setup, and using sdbox as the mailbox format. I'm getting the following warning: Jun 16 13:57:16 mail dovecot[9583]: lmtp(59153): Warning: quota: Namespace '' is not Maildir, skipping for Maildir++ quota Jun 16 13:57:16 mail dovecot[9583]: lmtp(username(a)example.net)<59153><rjVgD/yCBl0R5wAATNUJJw>: Warning: quota: Namespace '' is not Maildir, skipping for Maildir++ quota I'm also having issue with the public folder, it's not showing up. Below is my doveconf -n output. Any suggestions welcome. Thanks. Dave. # 2.3.6 (7eab80676): /usr/local/etc/dovecot/dovecot.conf # Pigeonhole version 0.5.6 (92dc263a) # OS: FreeBSD 12.0-RELEASE-p4 amd64 # Hostname: mail.example.local auth_cache_size = 10 M auth_default_realm = example.net auth_mechanisms = plain login auth_realms = example.net example.com dict { acl = mysql:/usr/local/etc/dovecot/dovecot-dict-sql.conf.ext quota = mysql:/usr/local/etc/dovecot/dovecot-dict-sql.conf.ext } first_valid_gid = 2100 first_valid_uid = 2100 hostname = mail.example.net imap_client_workarounds = delay-newmail tb-extra-mailbox-sep tb-lsub-flags imap_idle_notify_interval = 29 mins last_valid_gid = 2100 last_valid_uid = 2100 lda_mailbox_autocreate = yes lda_mailbox_autosubscribe = yes lda_original_recipient_header = X-Original-To listen = 172.16.21.3 lmtp_rcpt_check_quota = yes log_timestamp = "%Y-%m-%d %H:%M:%S " mail_access_groups = vmail mail_fsync = never mail_gid = vmail mail_home = /var/vmail/mailboxes/%d/%n mail_location = dbox:~/sdbox mail_plugins = acl fts fts_lucene mail_log notify quota trash virtual welcome zlib mail_crypt mail_privileged_group = vmail mail_server_admin = mailto:postmaster@example.net mail_uid = vmail managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext spamtest spamtestplus virustest editheader imapflags notify imapsieve vnd.dovecot.imapsieve namespace { location = sdbox:/var/vmail/public/:CONTROL=~/sdbox/public:INDEX=~/sdbox/public prefix = Public/ separator = / subscriptions = yes type = public } namespace inbox { inbox = yes location = mailbox Drafts { auto = subscribe special_use = \Drafts } mailbox Sent { auto = subscribe special_use = \Sent } mailbox Spam { auto = subscribe autoexpunge = 30 days special_use = \Junk } mailbox Trash { auto = subscribe autoexpunge = 30 days special_use = \Trash } prefix = separator = / type = private } passdb { args = /usr/local/etc/dovecot/dovecot-sql.conf.ext driver = sql } plugin { acl = vfile acl_shared_dict = proxy::acl fts = lucene fts_autoindex = yes fts_autoindex_exclude = \Junk fts_autoindex_exclude2 = \Trash fts_autoindex_exclude3 = \Spam fts_autoindex_max_recent_msgs = 80 fts_index_timeout = 90 fts_lucene = whitespace_chars=@. normalize no_snowball imapsieve_mailbox1_before = file:/var/vmail/sieve/global/learn-spam.sieve imapsieve_mailbox1_causes = COPY imapsieve_mailbox1_name = Spam imapsieve_mailbox2_before = file:/var/vmail/sieve/global/learn-ham.sieve imapsieve_mailbox2_causes = COPY imapsieve_mailbox2_from = Spam imapsieve_mailbox2_name = * mail_crypt_curve = prime256v1 mail_crypt_global_private_key = # hidden, use -P to show it mail_crypt_global_public_key = # hidden, use -P to show it mail_crypt_save_version = 2 mail_log_events = delete undelete expunge copy mailbox_delete mailbox_rename mail_log_fields = uid box msgid size quota = maildir:User quota quota_exceeded_message = Storage quota for this account has been exceeded, please try again later. quota_grace = 10%% quota_rule2 = Trash:ignore quota_status_nouser = DUNNO quota_status_overquota = 552 5.2.2 Mailbox is full quota_status_success = DUNNO quota_vsizes = true quota_warning = storage=100%% quota-exceeded 100 %u quota_warning2 = storage=95%% quota-warning 95 %u quota_warning3 = storage=90%% quota-warning 90 %u quota_warning4 = storage=85%% quota-warning 85 %u quota_warning5 = storage=75%% quota-warning 75 %u sieve = file:/var/vmail/sieve/%d/%n/scripts;active=/var/vmail/sieve/%d/%n/active-script.sieve sieve_after = /home/vmail/sieve/after.d sieve_before = /var/vmail/sieve/global/spam-global.sieve sieve_extensions = +notify +imapflags +spamtest +spamtestplus +virustest +editheader sieve_global_dir = /home/vmail/sieve sieve_global_extensions = +vnd.dovecot.pipe +vnd.dovecot.execute +vnd.dovecot.environment sieve_max_redirects = 30 sieve_max_script_size = 1M sieve_pipe_bin_dir = /usr/bin sieve_plugins = sieve_imapsieve sieve_extprograms sieve_spamtest_max_header = X-Spamd-Result: default: [[:alnum:]]+ \[-?[[:digit:]]+\.[[:digit:]]+ / (-?[[:digit:]]+\.[[:digit:]]+)\] sieve_spamtest_status_header = X-Spamd-Result: default: [[:alnum:]]+ \[(-?[[:digit:]]+\.[[:digit:]]+) / -?[[:digit:]]+\.[[:digit:]]+\] sieve_spamtest_status_type = score sieve_user_log = /home/vmail/sieve/sieve_error.log sieve_virustest_status_header = X-Virus-Scan: Found to be (.+)\. sieve_virustest_status_type = text sieve_virustest_text_value1 = clean sieve_virustest_text_value5 = infected trash = /usr/local/etc/dovecot/trash.conf welcome_script = welcome %u postmaster@%d welcome_wait = yes } postmaster_address = postmaster(a)example.net protocols = imap lmtp sieve sendmail_path = /usr/local/sbin/sendmail service auth-worker { user = vmail } service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0660 user = postfix } unix_listener auth-userdb { group = vmail mode = 0666 user = vmail } } service dict { unix_listener dict { mode = 0600 user = vmail } user = root } service imap-login { inet_listener imap { port = 143 } inet_listener imaps { port = 993 ssl = yes } process_min_avail = 1 } service imap { executable = imap } service lmtp { executable = lmtp unix_listener /var/spool/postfix/private/dovecot-lmtp { group = postfix mode = 0660 user = postfix } } service managesieve-login { inet_listener sieve { address = 172.16.21.3 port = 4190 } } service quota-status { client_limit = 1 executable = quota-status -p postfix unix_listener /var/spool/postfix/private/dovecot-quota { group = postfix mode = 0660 user = postfix } } service quota-warning { executable = script /usr/local/etc/dovecot/quota-warning.sh unix_listener quota-warning { group = vmail mode = 0660 user = vmail } user = vmail } service welcome { executable = script /usr/local/etc/dovecot/welcome.sh unix_listener welcome { user = vmail } user = vmail } ssl = required ssl_cert = </usr/local/etc/ssl/acme.sh/example.net/fullchain.crt ssl_cipher_list = ECDH+AESGCM:ECDH+CHACHA20:ECDH+AES256:ECDH+AES128:!aNULL:!SHA1 ssl_curve_list = P-256 ssl_dh = # hidden, use -P to show it ssl_key = # hidden, use -P to show it ssl_min_protocol = TLSv1.2 ssl_options = no_ticket ssl_prefer_server_ciphers = yes userdb { args = /usr/local/etc/dovecot/dovecot-sql.conf.ext driver = sql } protocol lmtp { info_log_path = /var/log/dovecot/dovecot-lmtp.log log_path = /var/log/dovecot/dovecot-lmtp-errors.log mail_fsync = optimized mail_plugins = acl fts fts_lucene mail_log notify quota trash virtual welcome zlib mail_crypt sieve } protocol lda { mail_fsync = optimized mail_plugins = acl fts fts_lucene mail_log notify quota trash virtual welcome zlib mail_crypt sieve } protocol imap { mail_max_userip_connections = 20 mail_plugins = acl fts fts_lucene mail_log notify quota trash virtual welcome zlib mail_crypt imap_acl imap_quota imap_sieve imap_zlib last_login } protocol sieve { info_log_path = /var/log/dovecot/dovecot-sieve.log log_path = /var/log/dovecot/dovecot-sieve-errors.log }

2 1

Self-signed TLS client certificates
by Marvin Gülker 16 Jun '19

16 Jun '19

Dear List, I self-host my e-mail and run Dovecot since ever I do that. Dovecot version is 2.3.4.1 (f79e8e7e4), running on Debian testing. Now I am trying to configure Dovecot for client TLS certificates. I have a self-signed certificate whose private key resides on a smartcard (Yubikey, to be exact). I wanted Dovecot to accept that TLS client certificate instead of a password. So I searched and found this wiki page: <https://wiki2.dovecot.org/SSL/DovecotConfiguration#Client_certificate_verif…> But that Wiki page says: > The CA file should contain the certificate(s) followed by the matching > CRL(s). Note that the CRLs are required to exist. I have now messed three hours or so with OpenSSL to get a CRL generated for my self-signed certificate, but I can't get that to work (the problem appearently being that OpenSSL doesn't play well with private keys on smartcards). It doesn't make sense anyway, why does one need a CRL for a self-signed certificate? If the self-signed certificate's key gets compromised, the CRL does not help at all. So, here are my questions: 1. Is a CRL really a hard requirement? 2. If not: can I just use the self-signed certificate of my private key for the ssl_ca setting? 3. If yes: any idea how I can generate a CRL for my smartcard-bound self-signed certificate? Marvin -- Blog: https://mg.guelker.eu

2 3

failed to pipe to program sa-learn-spam.sh
by ＠lbutlr 16 Jun '19

16 Jun '19

Error: program `/usr/lib/dovecot/sieve/sa-learn-spam.sh' terminated abnormally, signal 11 Error: sieve: pipe action: failed to pipe message to program `sa-learn-spam.sh': refer to server log for more information. [2019-05-29 17:59:12] What server log? This is all that get logged. # pwd /usr/lib/dovecot/sieve # ls -lsa > total 96 > 8 drwxrwxrwx 3 root wheel 512 Jun 18 2018 . > 8 drwxr-xr-x 3 root wheel 512 May 17 17:54 .. > 8 -rw-r--r-- 1 root wheel 86 Jun 15 2018 default.sieve > 8 drwxr-xr-x 2 root wheel 512 Jun 13 2018 global > 8 -rw-r--r-- 1 root wheel 62 May 14 2018 mark-read.sieve > 8 -rw-r--r-- 1 kremels wheel 192 Jun 17 2018 mark-read.svbin > 8 -rwxr-xr-x 1 root wheel 314 Feb 12 2018 report-ham.sieve > 8 -rw-r--r-- 1 lbutler wheel 448 Jun 18 2018 report-ham.svbin > 8 -rwxr-xr-x 1 root wheel 199 Feb 12 2018 report-spam.sieve > 8 -rw-r--r-- 1 kreme wheel 354 Jun 15 2018 report-spam.svbin > 8 -rwxr-xr-x 1 root wheel 131 Jun 18 2018 sa-learn-ham.sh > 8 -rwxr-xr-x 1 root wheel 54 Feb 12 2018 sa-learn-spam.sh # cat sa-learn-spam.sh > #!/bin/sh > exec /usr/local/bin/sa-learn -u ${1} --spam # ls -ls /usr/local/bin/sa-learn > 96 -rwxr-xr-x 1 root wheel 45939 May 29 09:59 /usr/local/bin/sa-learn report-spam.sieve: > require ["vnd.dovecot.pipe", "copy", "imapsieve", "environment", "variables"]; > > if environment :matches "imap.user" "*" { > set "username" "${1}"; > } > > pipe :copy "sa-learn-spam.sh" [ "${username}" ]; in doveconf I have: > managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date ihave > > plugin { > imapsieve_mailbox1_before = file:/usr/lib/dovecot/sieve/report-spam.sieve > imapsieve_mailbox1_causes = COPY > imapsieve_mailbox1_name = Junk > … It WAS working. -- Women and cats will do as they please, and men and dogs should relax an get used to the idea.

3 6

NOTIFY: bug on mailbox renaming and deletion ?
by kael 16 Jun '19

16 Jun '19

Hello, Testing the NOTIFY extension on imap.vivaldi.net, seems there's a bug when a mailbox is renamed or deleted. Requesting events with: A1 NOTIFY SET (inboxes (SubscriptionChange MailboxName)) Here are the sent events: - mailbox creation with automatic subscription (ok): * LIST () "." foo * LIST (\Subscribed) "." foo - mailbox renaming (bug ?): * LIST () "." bar ("OLDNAME" (foo)) * LIST (\Subscribed) "." bar * LIST () "." foo - mailbox deletion (bug ?): * LIST (\NonExistent) "." Trash.bar * LIST () "." Trash.bar It seems that for the two latter cases, the last received event is incorrect, Dovecot notifying of mailbox unsubscription after the mailbox has been renamed or deleted. In that case a client would consider those two last events not as mailbox renaming or deletion, but as a mailbox creation, wouldn't it ? Am I missing something ? Cheers. -- kael

1 0

sdbox format, quota not maildir, and public folder
by David Mehler 16 Jun '19

16 Jun '19

Hello, I'm using Dovecot 2.3.x and using dbox as mailbox storage format, specifically sdbox. I'm getting an error from quota about namespace is not maildir is there a setting I have to use for quota to use the sdbox?

1 0

Dovecot 2.3 error, FreeBSD 12 in a jail
by David Mehler 15 Jun '19

15 Jun '19

Hello, I'm trying to get Dovecot going on my system. It's a FreeBSD 12.0-RELEASE system and it's running dovecot 2.3 via ports in a jail. I'm getting the same error message(s) as in this bug report, which has been marked as closed: https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=225078 Dovecot is not starting at all in this jail when starting with service dovecot start. A service dovecot status also reveals the error message about /var/run/dovecot/dovecot.conf file, but a doveconf -n does not reveal any configuration file issues. I did put a symlink in /var/run/dovecot to /usr/local/etc/dovecot/dovecot.conf, this did not correct the issue. Any suggestions welcome. Thanks. Dave.

2 1

LMTP doesn't save to +mailbox
by ＠lbutlr 14 Jun '19

14 Jun '19

Since switching to lmtp in dovecot, mail to user+mailboix(a)example.com does not get saved in ‘.mailbox’ as it did with LDA, instead it gets saved into the INBOX. If it matters, these are users who do NOT have a ~/.active_sieve file. I could understand (though it would bene a bit annoying) if the save overrode this mechanism. I did add lmtp_save_to_detail_mailbox = yes in the protocol lmtp block protocol lmtp { postmaster_address = postmaster(a)covisp.net # required mail_plugins = quota sieve info_log_path = /var/log/dovecot-lmtp.log lmtp_save_to_detail_mailbox = yes } This is the error I am getting when sending to luser+covisp(a)covisp.net lmtp(luser(a)covisp.net)<91193><EqkiJV70A105ZAEAIdGjjQ>: Error: sieve: msgid=<A3ED963A-97FB-4A1F-9F09-45F2AEA96CF6(a)kreme.com>: failed to store into mailbox 'covisp': Mailbox doesn't exist: covisp lmtp(luser(a)covisp.net)<91193><EqkiJV70A105ZAEAIdGjjQ>: Error: sieve: Execution of script /usr/lib/dovecot/sieve/default.sieve failed with unsuccessful implicit keep # cat /usr/lib/dovecot/sieve/default.sieve [13:32] [/var/log] require "fileinto"; if header :contains "X-spam-flag" "YES" { fileinto "Junk"; } (This file hasn’t changed in a year, so it worked fine with the lda instead of the lmtp setup. I mean, I can probably just write a sieve to do it. Let me think… if header :regex "to" “+(.*)@" { fileinto :create “${1}"; stop; } Seems like it should work. Should I add this to default.sieve? # 2.3.6 (7eab80676): /usr/local/etc/dovecot/dovecot.conf # Pigeonhole version 0.5.6 (92dc263a) # OS: FreeBSD 11.2-RELEASE-p10 i386 # Hostname: mail.covisp.net auth_failure_delay = 5 secs auth_mechanisms = PLAIN LOGIN default_client_limit = 4096 default_process_limit = 1024 default_vsz_limit = 768 M disable_plaintext_auth = no first_valid_uid = 89 imap_id_log = * login_log_format_elements = user=<%u> %r %m %c mail_location = maildir:~/Maildir mail_max_userip_connections = 90 managesieve_notify_capability = mailto managesieve_sieve_capability = editheader fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date ihave namespace inbox { inbox = yes location = mailbox Archive { auto = subscribe special_use = \Archive } mailbox Drafts { special_use = \Drafts } mailbox Junk { auto = subscribe special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } passdb { args = /usr/local/etc/dovecot/sql.conf driver = sql } plugin { imapsieve_mailbox1_before = file:/usr/lib/dovecot/sieve/report-spam.sieve imapsieve_mailbox1_causes = COPY imapsieve_mailbox1_name = Junk imapsieve_mailbox2_before = file:/usr/lib/dovecot/sieve/report-ham.sieve imapsieve_mailbox2_causes = COPY imapsieve_mailbox2_from = Junk imapsieve_mailbox2_name = * imapsieve_mailbox3_before = file:/usr/lib/dovecot/sieve/mark-read.sieve imapsieve_mailbox3_causes = COPY imapsieve_mailbox3_name = Archive quota_rule2 = .EXPUNGED:ignore sieve = file:~/.sieve;active=~/.active_sieve sieve_default = /usr/lib/dovecot/sieve/default.sieve sieve_default_name = spamassassin sieve_extensions = +editheader sieve_global_extensions = +vnd.dovecot.pipe +vnd.dovecot.environment sieve_pipe_bin_dir = /usr/lib/dovecot/sieve sieve_plugins = sieve_imapsieve sieve_extprograms sieve_user_log = ~/sieve.log } service auth { unix_listener /var/spool/postfix/private/auth { mode = 0666 } } service imap-login { inet_listener imaps { port = 993 ssl = yes } } service lmtp { unix_listener /var/spool/postfix/private/dovecot-lmtp { group = postfix mode = 0600 user = postfix } } service pop3-login { inet_listener pop3 { port = 0 } inet_listener pop3s { port = 995 ssl = yes } } service stats { unix_listener stats-reader { group = dovecot mode = 0666 user = } unix_listener stats-writer { group = dovecot mode = 0666 user = } } ssl_cert = </usr/local/etc/dehydrated/certs/covisp.net/fullchain.pem ssl_dh = # hidden, use -P to show it ssl_key = # hidden, use -P to show it ssl_min_protocol = TLSv1.1 userdb { args = /usr/local/etc/dovecot/sql.conf default_fields = uid=vpopmail gid=vchkpw mail_location=maildir:/usr/local/virtual/%u/Maildir mail=maildir:/usr/local/virtual/%u/Maildir driver = sql } protocol imap { mail_plugins = " imap_sieve" } protocol lmtp { info_log_path = /var/log/dovecot-lmtp.log lmtp_save_to_detail_mailbox = yes mail_plugins = quota sieve postmaster_address = postmaster(a)covisp.net }

1 2

Dovecot director: show user breakdown by director?
by Eirik Rye 14 Jun '19

14 Jun '19

Hi, We have recently started using the director in some tests. We are using the static passdb setup (proxy=y nopassword=y) for now, where authentication is done on the downstream IMAP servers. "dovecot director status" shows a breakdown of proxied connections per backend, but there does not seem to be a similar breakdown of user connections per director. The output of "doveadm who" is empty. I assume this is due to there being no local userdb/passdb on the directors? root@xxx:/etc/dovecot/conf.d# doveadm who username # proto (pids) (ips) Is there a way in Dovecot to see which (or even how many) users are connected to a specific director without having to count TCP connections? Best regards, Eirik Rye

2 2

Addheader specified field name `Reply-To:' is invalid.
by ＠lbutlr 14 Jun '19

14 Jun '19

Well, progress. At least now editheader loads. Sadly that brings up new errors. specified field name `Reply-To:' is invalid. if header :contains "List-id" "<users.spamassassin.apache.org>" { addheader "Reply-To:" "<users.spamassassin.apache.org>"; addheader "X-added-reply-To:" "True"; fileinto :create “spamassassin"; stop;} -- You only had to look into Teatime's mismatched eyes to know one thing, which was this: if Teatime wanted to find you he would not look everywhere. He'd look in only one place, which would be the place where you were hiding. —Hogfather

2 3

MultiMaster dsync (cluster1 cluster2 cluster3)
by Matthew Brown 14 Jun '19

14 Jun '19

Will MultiMaster dsync work fine or will be big problems ? I configured dovecot to dsync from serv1 to serv2 to serv3 and repeat to serv1 to serv2 to serv3 and repeat... When email received to serv2, it will be synced to serv3, and serv3 will sync it to serv1, and serv1 will sync it to serv2 and will stop here because emails matched. What problems can be with this kind of configuration ? (except that if one of server(cluster) will be stopped, sync will be stopped too until cluster is online again)

2 1

Sieve rewrite headers?
by ＠lbutlr 14 Jun '19

14 Jun '19

I’ve bene looking for examples on how to do this, but so far am coming up short. I want to check certain messages for a reply-ro header and if it is present, rewrite it to X-Reply-To: and then add my own reply-to header. I don’t see anything in the various sieve examples I’ve found on altering the actual message. There is the editheader extension, but I failed to find documentation or examples on how to use it. It appears that I can add a header and delete a header (addheader deleteheader?) but not rewrite one. So something like if header “Reply-to: foo(a)bar.xn--tld-9o0a { addheader "X-Reply-To: foo(a)bar.xn--tld-9o0a deleteheader “Reply-To:” addheader "X-Reply-To: bar(a)foo.xn--tld-9o0a } ?? Do I need to delete the header or will the add header overwrite the one that is there? Also, how do people manage different sieve files? Just cat them all into the active one, or is there a mechanism to import/switch/load other files?

2 1

unknown Sieve Capability `editheader'
by ＠lbutlr 14 Jun '19

14 Jun '19

I am getting "error: error: require command: unknown Sieve capability `editheader’.” In sieve.log: This is the start of .active_sieve ## Active require [ "editheader", "regex", "variables", "fileinto", "envelope", "mailbox", "imap4flags" ]; Editheader is also listed in dovecot.conf managesieve_sieve_capability = editheader fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date ihave

2 1

Re: Re: CASifying dovecot and webmail
by charli AGOSSOU 14 Jun '19

14 Jun '19

Hi. I have been trying for a long time to roundcube but I have trouble doing it. It may therefore be necessary to manage the casification of dovecot. Something that is not easy right now with the operating system version that I use. I am working with a kali 2019, and I have compilation errors when running the make on pam_cas. Any help will be useful to me. Thank you Charlie Harper Best regards,

1 0

Re: Migrated from maildir to sdbox: questions
by Daniel Betz 14 Jun '19

14 Jun '19

Hi Ranbir, i think youre just using the wrong quota backend. https://wiki2.dovecot.org/Quota You should switch from "quota = maildir...." to another one, like dict. Converting your Public mailbox you could try this ( no guarantee .. just guessing. make backup ! ): doveadm -o mail_location="maildir:/var/spool/mail/thesandhufamily.ca/public" sync sdbox:/target/folder Regards, Daniel > > Hi Everyone, > > I migrated my maildir mailboxes to sdbox without any show stopping errors, > but I did see this during the migration and now I'm also seeing it in the log: > > Warning: quota: Namespace '' is not Maildir, skipping for Maildir++ quota > > I'm not quite sure why this is happening. Any ideas? > > I am using a "public" namespace for several mailboxes to share emails: > > # public namespace configuration > namespace { > type = public > # the default separator for Maildir is ".", so that is what should be > # used automatically. > separator = . > prefix = Public. > location = maildir:/var/spool/mail/thesandhufamily.ca/public > subscriptions = no > } > > Under the "public" dir in the old maildir setup, I have folders configured for > various mail accounts. For example: > > .Ads > .Junk > .Bills > > etc. > > These "users" are setup in a passwd file so that I can use a different mail > storage location for them than the one they get from ldap (same as above). > > Using dsync to migrate my other mailboxes was easy, but I don't know how > to migrate these public mailboxes. I looked through the wiki and didn't see > anything about how to do it. Could someone explain how I can migrate the > public mailboxes? > > > -- > Ranbir >

3 2

Outlook renames Junk folder
by Cliff Hayes 13 Jun '19

13 Jun '19

Hello, Some versions of Outlook will randomly rename the Junk folder to Junk Email. This of course causes errors because Dovecot can no longer store junk. I go in to Outlook for each user and add another Junk folder, so now they have Junk and Junk Email. This fix action lasts a while until Outlook decides to do it again. Is there a way to tell Dovecot that if the Junk folder doesn't exist, try sending the email to Junk Email folder? Thanks in advance.

3 3

Sieve logging?
by ＠lbutlr 13 Jun '19

13 Jun '19

I am trying to create some sieve scripts to filter my mailing lists and am wondering if sieve logs anywhere, and it so where? I don’t see anything in mail.log beyond lines like: dovecot: lda(kremels(a)kreme.com)<39790><hNchChSkAV1umwAAIdGjjQ>: sieve: msgid=<267D5D71-D99C-4790-8706-C1A92BCC9F97(a)kreme.com>: stored mail into mailbox ‘INBOX' Which doesn’t really tell me anything other than that the script failed. -- If the #2 pencil is the most popular, why is it still #2?

3 6

Re: Sieve logging?
by Matt Anton 13 Jun '19

13 Jun '19

On 13 Jun 2019, at 14:47, @lbutlr wrote: > What sort of configuration change would I need to do to use LMTP instead of LDA? Regarding dovecot, all you need to do is following: <https://wiki.dovecot.org/LMTP> <https://wiki.dovecot.org/HowTo/PostfixDovecotLMTP> (if postfix is your MTA) <https://wiki.dovecot.org/LMTP/Exim> (if exim is your MTA) > And are there any downsides? Not that I’m aware of. Things remained the same as when I was using LDA but using LMTP over Dovecot’s LDA brings some advantages like better performances (no need to fire up new processes for deliveries) among others one. There were several threads on the list related to LDA vs LMTP, such as: <https://dovecot.org/pipermail/dovecot/2016-June/104670.html> <https://dovecot.org/list/dovecot/2013-July/091617.html> > What do I do about > > lda_mailbox_autocreate = yes > lda_mailbox_autosubscribe = yes > > ? They’re also used by LMTP so no need to worry when migrating from LDA to LMTP. You can check what LDA’s options are specifically also used by LMTP in examples/conf.d/15-lda.conf -- matt [at] lv223.org GPG key ID: 7D91A8CA

1 0

Migrated from maildir to sdbox: questions
by Ranbir 13 Jun '19

13 Jun '19

Hi Everyone, I migrated my maildir mailboxes to sdbox without any show stopping errors, but I did see this during the migration and now I'm also seeing it in the log: Warning: quota: Namespace '' is not Maildir, skipping for Maildir++ quota I'm not quite sure why this is happening. Any ideas? I am using a "public" namespace for several mailboxes to share emails: # public namespace configuration namespace { type = public # the default separator for Maildir is ".", so that is what should be # used automatically. separator = . prefix = Public. location = maildir:/var/spool/mail/thesandhufamily.ca/public subscriptions = no } Under the "public" dir in the old maildir setup, I have folders configured for various mail accounts. For example: .Ads .Junk .Bills etc. These "users" are setup in a passwd file so that I can use a different mail storage location for them than the one they get from ldap (same as above). Using dsync to migrate my other mailboxes was easy, but I don't know how to migrate these public mailboxes. I looked through the wiki and didn't see anything about how to do it. Could someone explain how I can migrate the public mailboxes? -- Ranbir

1 0

Sieve to strip html from multipart messages
by ＠lbutlr 13 Jun '19

13 Jun '19

Is is possible (I’m sure it is, so how) to strip multipart messages that are HTML and text of the HTML portion and leave the bare text message without also stripping other parts (like images or attached files). Or also to take messages that are only HTML and strip the HTML and replace it with a plain text version? I used to do this a long time ago with procmail and lynx, but it was never reliable since procmail doesn’t really understand MIME.

2 2

Updating passwords
by ＠lbutlr 12 Jun '19

12 Jun '19

I created some new users in my MySQL database using postfoxadmin. The passwords looked correct in the database and show the right prefix {SHA256-CRYPT} but logins were failing, so I manually created new passwords from the command line: doveadm pw -s SHA256-CRYPT -p “a password" -u kremels(a)kreme.com {SHA256-CRYPT}$5$ZKsovTv0Ddc9k4… I then went into the postfix database and manually updated the password field in the database. update mailbox set password = '$5$ZKsovTv0Ddc9k4…' where username like 'kremels(a)kreme.com'; SOME of the accounts can now login, but not all. I get a debug line like: dovecot: auth-worker(26599): Debug: sql(kremels(a)kreme.com,xx.xx.xx.xx,<rnadomlookingstuff>): SHA256-CRYPT(a password) != '$5$ZKsovTv0Ddc9k4… -- 'They've given us the answers,' he [Carrot] said. 'Perhaps we can find out what the questions should have been.' --Feet of Clay

1 1

Password issue
by Cerebus the Aardvark 12 Jun '19

12 Jun '19

I am using SHA-256 crypt for dovecot. I have added some new users vi postfoxadmin, which is also configured to use she-256 crypt. looking at the database: {SHA256-CRYPT}$5$lKfXOxua8j9FIFJt$r4rLmMFHUK/FcJ0c.sp.U4paTeE6Obp0t.mj.6eJQx9 # works {SHA256-CRYPT}$5$Gy.zyFNgYHgSsvmh$C/8Fv47Rjij6S73SwkfhCTwuqGgsmiRCjke6blbt1YD # does not work (I changed some random character in each line, but didn't change the length) Jun 12 12:43:09 mail dovecot: auth: Debug: policy(kremels,73.14.161.160,<0VjtyCSLluJJDqGg>): Policy check action is continue Jun 12 12:43:09 mail dovecot: auth-worker(57297): Debug: sql(kremels,73.14.161.160,<0VjtyCSLluJJDqGg>): query: select password FROM mailbox where username ='kremels' Jun 12 12:43:14 mail dovecot: auth: Debug: client passdb out: FAIL#0111#011user=kremel

1 0

LMTP and Sieve with <prefix><recipient_delimiter><user>
by Paul Muster 11 Jun '19

11 Jun '19

Hi there, Dovecot's LMTP implementation and Pigeonhole Sieve already do support the <user><delimiter><suffix> format. RfC 5233, the Sieve subaddress extension, also offers <prefix><delimiter><user>. Could Docecot's LMTP and Pigeonhole be extended to that effect? Thanks & greetings, Paul

1 2

Compile problem on Solaris
by Roderick Johnstone 11 Jun '19

11 Jun '19

Hi Compiling dovecot 2.2.36.1 with the native compiler on Solaris 10 is giving the error below. Can anyone advise a compiler option or code change to resolve this please. Thanks. Roderick Johnstone # make make all-recursive Making all in . /bin/bash ./update-version.sh . . Making all in src Making all in lib-test Making all in lib make all-am source='sha3.c' object='sha3.lo' libtool=yes \ DEPDIR=.deps depmode=none /bin/bash ../../depcomp \ /bin/bash ../../libtool --tag=CC --mode=compile cc -DHAVE_CONFIG_H -I. -I../.. -I/export/home/exim_build_20190605/build_local/include -m64 -c -o sha3.lo sha3.c libtool: compile: cc -DHAVE_CONFIG_H -I. -I../.. -I/export/home/exim_build_20190605/build_local/include -m64 -c sha3.c -KPIC -DPIC -o .libs/sha3.o "sha3.h", line 49: warning: unnamed struct member "sha3.c", line 142: improper member use: s "sha3.c", line 142: improper member use: s "sha3.c", line 166: improper member use: s "sha3.c", line 173: improper member use: s "sha3.c", line 197: improper member use: s "sha3.c", line 200: improper member use: s "sha3.c", line 227: improper member use: s "sha3.c", line 231: improper member use: s "sha3.c", line 233: improper member use: s "sha3.c", line 259: improper member use: sb "sha3.c", line 268: improper member use: sb cc: acomp failed for sha3.c *** Error code 1

2 2

Potfix+Dovecot with dsync replication problem
by Zeljko Dokman 10 Jun '19

10 Jun '19

Hi all, I am in need of some help. Straggling to make something work, trying to configure postfix and dovecote imap server with dovecote replication. Can’t figure out what is wrong with my configuration. Replication is working only for vmail user account, I am getting this error on my secondary server for all other users… dovecot: doveadm: Fatal: setgid(4015(zdokman) from userdb lookup) failed with euid=5000(vmail), gid=5000(vmail), egid=5000(vmail): Operation not permitted (This binary should probably be called with process group set to 4015(zdokman) instead of 5000(vmail)) primary server reports this error: dovecot: doveadm(zdokman): Error: doveadm server disconnected before handshake: EOF dovecot: doveadm(zdokman): Error: sync: Disconnected from remote: EOF doveadm replicator status '*' username priority fast sync full sync success sync failed vmail none 01:58:13 02:05:25 01:58:13 - zdokman none 00:00:25 02:55:26 - y test none 00:01:00 21:48:13 - y doveadm sync * doveadm(root): Fatal: execvp(Maildir) failed: Permission denied dsync-local(root): Error: read(remote) failed: EOF (version not received) I am attaching my dovecot.conf main.cf and master.cf. I think my problem is with permissions but I can figure out how to workaround it. Best regards

2 3

Sql user and maildirs
by ＠lbutlr 10 Jun '19

10 Jun '19

For many years I had the following in my dovecot.conf: userdb { args = /usr/local/etc/dovecot/dovecot-sql.conf.ext default_fields = uid=vpopmail gid=vchkpw mail_location=/usr/local/virtual/%u/Maildir mail=maildir:/usr/local/virtual/%u/Maildir driver = sql } Recently, I started having quite a lot of errors on one MySQL account (used as a bcc backup account) along the lines of Fatal: Namespace '': Ambiguous mail location setting, don't know what to do with it: /usr/local/virtual/backup@domain/Maildir (try prefixing it with mbox: or maildir: Messages were sitting in the mail and were also getting dumped into /usr/local/virtual/backup@domain/new and I ended up running a fun little awk to move them into the right folders: grep -r "<backup+" . |awk -F: '{t=tolower($2); f=tolower($1); gsub(/@.*/, "/", t); sub(/<backup\+/, "../Maildir/", t); sub(/\.\//, "",f); cmd="mv " f" “t; system(cmd); }’ So I changed my doevecot.conf to: userdb { args = /usr/local/etc/dovecot/dovecot-sql.conf.ext default_fields = uid=vpopmail gid=vchkpw mail_location=maildir:/usr/local/virtual/%u/Maildir mail=maildir:/usr/local/virtual/%u/Maildir driver = sql } And the errors went away. So, no problem here to solve, but I am curious why I haven’t been having issues until quite recently? Was there a change or have I stumbled into something where it only looks like I’ve fixed the issue? In case it matters? # cat dovecot-sql.conf.ex [7:57] [/etc/dovecot] driver = mysql connect = host=localhost dbname=postfixusers user=dovecot password=x default_pass_scheme = SHA256-CRYPT password_query = select password FROM mailbox where username ='%u' user_query = select 89 as uid, 89 as gid, concat('/usr/local/virtual/', maildir, 'Maildir') as home FROM mailbox where username = '%u' The only ‘recent’ change I’ve made to my configuration was creating the Maildir/ subfolder for all the virtual users instead of using the ‘mailder’ from the sql table (that is, I added “, ‘Maildir’” to the concat, but that was quite awhile ago. I’m pretty sure I’d have noticed this before. Is that user_query as it should be or should I set concat('/usr/local/virtual/', maildir) as home and also set concat(‘maildir:/usr/local/virtual/', maildir, 'Maildir') as mail here rather than in the userdb block? -- K is for KATE who was struck by an axe L is for Leo who swallowed some tacks

1 1

Re: doveconf complains No matches on !include conf.d/* line but still writes out contents in conf.d
by Ben Ma 10 Jun '19

10 Jun '19

Further investigation shows that `doveconf` called `/usr/lib/dovecot/managesieve` which in return calls `doveconf` again, but with another uid (possible? I'm not sure) and a few extra arguments, which causes a call to `glob` in `src/config/config-parser.c:settings_include` to fail with `GLOB_NOMATCH`. I'd be appreciate if anyone can provide information on suspicious permission-relating operation that `managesieve` does before calling `doveconf`. I just can't find a way to post reply on previous mails, so I decided to post a new one. The original text follows. On 2019/6/6 3:15, Ben Ma wrote: > I'm on dovecot 2.3.3 (dcead646b). Output of `dovecot -n`: > > # 2.3.3 (dcead646b): /etc/dovecot/dovecot.conf # Pigeonhole version > 0.5.3 (f018bbab) doveconf: Fatal: Error in configuration file > /etc/dovecot/dovecot.conf line 98: No matches doveconf: Error: > managesieve-login: dump-capability process returned 89 doveconf: > Fatal: Error in configuration file /etc/dovecot/dovecot.conf line 98: > No matches > > While line 98 of dovecot.conf is just "!include conf.d/*.conf". > > Output of `doveconf -n`: > > # 2.3.3 (dcead646b): /etc/dovecot/dovecot.conf # Pigeonhole version > 0.5.3 (f018bbab) doveconf: Fatal: Error in configuration file > /etc/dovecot/dovecot.conf line 98: No matches doveconf: Error: > managesieve-login: dump-capability process returned 89 # OS: Linux > 4.12.14-lp151.28.4-default x86_64 # Hostname: XXX doveconf: Error: > t_readlink(/var/run/dovecot/dovecot.conf) failed: readlink() failed: > No such file or directory namespace inbox { ............. (Removed for > simplicity) } ssl = required ssl_cert = > </etc/postfix/ssl/certs/phys.cer ssl_options = no_compression > ssl_prefer_server_ciphers = yes userdb { driver = passwd } > > It's strange that all the extra content (especially ssl conf) only > occurs in conf.d/10-ssl.conf. > > To dig on what's happening underneath I ran `strace doveconf -n 2>&1 > |egrep "\.conf|conf\.d"` and got: > > write(1, "# 2.3.3 (dcead646b): /etc/doveco"..., 47# 2.3.3 (dcead646b): > /etc/dovecot/dovecot.conf openat(AT_FDCWD, > "/etc/dovecot/dovecot.conf", O_RDONLY) = 7 wait4(-1, doveconf: Fatal: > Error in configuration file /etc/dovecot/dovecot.conf line 98: No > matches open("/etc/dovecot/conf.d", > O_RDONLY|O_NONBLOCK|O_DIRECTORY|O_CLOEXEC) = 8 openat(AT_FDCWD, > "/etc/dovecot/conf.d/90-sieve.conf", O_RDONLY) = 8 ............. > (Removed for simplicity) openat(AT_FDCWD, > "/etc/dovecot/conf.d/10-ssl.conf", O_RDONLY) = 20 openat(AT_FDCWD, > "/etc/dovecot/conf.d/10-auth.conf", O_RDONLY) = 25 > stat("/etc/dovecot/conf.d/auth-system.conf.ext", > {st_mode=S_IFREG|0644, st_size=2182, ...}) = 0 openat(AT_FDCWD, > "/etc/dovecot/conf.d/auth-system.conf.ext", O_RDONLY) = 26 > stat("/etc/dovecot/local.conf", 0x7ffd94664760) = -1 ENOENT (No such > file or directory) stat("/etc/resolv.conf", {st_mode=S_IFREG|0644, > st_size=709, ...}) = 0 open("/etc/host.conf", O_RDONLY|O_CLOEXEC) = 7 > read(7, "#\n# /etc/host.conf - resolver co"..., 4096) = 370 > open("/etc/resolv.conf", O_RDONLY|O_CLOEXEC) = 7 read(7, "### > /etc/resolv.conf is a symlin"..., 4096) = 709 > readlink("/var/run/dovecot/dovecot.conf", 0x5555db302598, 128) = -1 > ENOENT (No such file or directory) write(2, "doveconf: Error: > t_readlink(/var"..., 112doveconf: Error: > t_readlink(/var/run/dovecot/dovecot.conf) failed: readlink() failed: > No such file or directory > > It seems that files in conf.d is never read before doveconf's > complaint! I have totally no idea why this happens. Any help?

1 0

sieve setup. no svbin ?
by Voytek Eymont 09 Jun '19

09 Jun '19

since moving/upgrading system I've noticed I no longer get sieve script compiled, there is no dovecot.svbin created in /var/vmail/vmail1/sbt.net.au/voytek(a)tld.au/sieve what am I missing, how to check ? also, looking at sieve.log, I see a lot of May 31 06:32:50 lda(voytek(a)sbt.net.au)<1234><c4aVBfI98FzSBAAAyLbbsQ>: Error: sieve: Failed to initialize script execution: Invalid postmaster_address: invalid address `root' specified for the postmaster_address setting # grep root dovecot.conf postmaster_address = root what should I have ? # dovecot --version 2.3.6 (7eab80676)

2 5

FTS Xapian
by Daniel Miller 09 Jun '19

09 Jun '19

For my primary namespace this is working fine - thanks to the developers! It also appears to work great for shared folders as well. But my virtual folders aren't returning results - at least not to the client. The logs show FTS Xapian opening several DB files and getting results - but nothing is being returned to client. Is this a config issue on my side or is this a current limitation of the plugin? -- Daniel

2 5

Last Login Plugin Help
by Júlio Covolato 07 Jun '19

07 Jun '19

Hi, I'm configuring Last_Login plugin whith Mysql back end and all works fine. I just wonder to track besides time_stamp, user and domain, the remote IP and proto (imap or pop3) I tried in dovecot.conf: plugin { ... ... # Track last login time on imap and pop3 last_login_dict = proxy::lastlogin last_login_key = last-login/%u/%d/%r } dict { ... lastlogin = mysql:/etc/dovecot/dovecot-last-login.conf ... } protocol imap { mail_plugins = $mail_plugins ... last_login ... } protocol pop3 { mail_plugins = $mail_plugins last_login ... } And dovecot-last-login.conf: connect = host=127.0.0.1 port=3306 dbname=vmail user=vmailadmin password=xxxxxxxxxxxxxxxxxx map { pattern = shared/last-login/$user/$domain table = last_login value_field = last_login value_type = uint fields { username = $user domain = $domain rip = $rip } } And the table criated in mysql: CREATE TABLE IF NOT EXISTS `last_login` ( `username` VARCHAR(255) NOT NULL DEFAULT '', `domain` VARCHAR(255) NOT NULL DEFAULT '', `last_login` INT(11) DEFAULT NULL, `rip` VARCHAR(16) NOT NULL DEFAULT '', PRIMARY KEY (`username`), INDEX (`domain`), INDEX (`last_login`), INDEX (`rip`) ) ENGINE=InnoDB DEFAULT CHARSET=utf8; And got de error in dovecot log: Jun 06 13:56:59 dict(21157): Error: Failed to initialize dictionary 'lastlogin': dict mysql: Error in configuration file /etc/dovecot/dovecot-last-login.conf line 13: Unused variable: rip Thanks in any help. -- ---------------------------------- _ Engº Julio Cesar Covolato 0v0 <julio(a)psi.com.br> /(_)\ F: +55 11 99175-9260 ^ ^ PSI INTERNET ---------------------------------- --- Este email foi escaneado pelo Avast antivírus. https://www.avast.com/antivirus

2 3

doveconf complains No matches on !include conf.d/* line but still writes out contents in conf.d
by runappz 05 Jun '19

05 Jun '19

I'm on dovecot 2.3.3 (dcead646b). Output of `dovecot -n`: # 2.3.3 (dcead646b): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.3 (f018bbab) doveconf: Fatal: Error in configuration file /etc/dovecot/dovecot.conf line 98: No matches doveconf: Error: managesieve-login: dump-capability process returned 89 doveconf: Fatal: Error in configuration file /etc/dovecot/dovecot.conf line 98: No matches While line 98 of dovecot.conf is just "!include conf.d/*.conf". Output of `doveconf -n`: # 2.3.3 (dcead646b): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.3 (f018bbab) doveconf: Fatal: Error in configuration file /etc/dovecot/dovecot.conf line 98: No matches doveconf: Error: managesieve-login: dump-capability process returned 89 # OS: Linux 4.12.14-lp151.28.4-default x86_64 # Hostname: XXX doveconf: Error: t_readlink(/var/run/dovecot/dovecot.conf) failed: readlink() failed: No such file or directory namespace inbox { ............. (Removed for simplicity) } ssl = required ssl_cert = </etc/postfix/ssl/certs/phys.cer ssl_options = no_compression ssl_prefer_server_ciphers = yes userdb { driver = passwd } It's strange that all the extra content (especially ssl conf) only occurs in conf.d/10-ssl.conf. To dig on what's happening underneath I ran `strace doveconf -n 2>&1 |egrep "\.conf|conf\.d"` and got: write(1, "# 2.3.3 (dcead646b): /etc/doveco"..., 47# 2.3.3 (dcead646b): /etc/dovecot/dovecot.conf openat(AT_FDCWD, "/etc/dovecot/dovecot.conf", O_RDONLY) = 7 wait4(-1, doveconf: Fatal: Error in configuration file /etc/dovecot/dovecot.conf line 98: No matches open("/etc/dovecot/conf.d", O_RDONLY|O_NONBLOCK|O_DIRECTORY|O_CLOEXEC) = 8 openat(AT_FDCWD, "/etc/dovecot/conf.d/90-sieve.conf", O_RDONLY) = 8 ............. (Removed for simplicity) openat(AT_FDCWD, "/etc/dovecot/conf.d/10-ssl.conf", O_RDONLY) = 20 openat(AT_FDCWD, "/etc/dovecot/conf.d/10-auth.conf", O_RDONLY) = 25 stat("/etc/dovecot/conf.d/auth-system.conf.ext", {st_mode=S_IFREG|0644, st_size=2182, ...}) = 0 openat(AT_FDCWD, "/etc/dovecot/conf.d/auth-system.conf.ext", O_RDONLY) = 26 stat("/etc/dovecot/local.conf", 0x7ffd94664760) = -1 ENOENT (No such file or directory) stat("/etc/resolv.conf", {st_mode=S_IFREG|0644, st_size=709, ...}) = 0 open("/etc/host.conf", O_RDONLY|O_CLOEXEC) = 7 read(7, "#\n# /etc/host.conf - resolver co"..., 4096) = 370 open("/etc/resolv.conf", O_RDONLY|O_CLOEXEC) = 7 read(7, "### /etc/resolv.conf is a symlin"..., 4096) = 709 readlink("/var/run/dovecot/dovecot.conf", 0x5555db302598, 128) = -1 ENOENT (No such file or directory) write(2, "doveconf: Error: t_readlink(/var"..., 112doveconf: Error: t_readlink(/var/run/dovecot/dovecot.conf) failed: readlink() failed: No such file or directory It seems that files in conf.d is never read before doveconf's complaint! I have totally no idea why this happens. Any help?

1 0

Re: Potfix+Dovecot with dsync replication problem
by Zeljko Dokman 05 Jun '19

05 Jun '19

Hi all, I am still struggling with this issue. I scraped my previous configuration and started from beginning. Thanks to Aki Tuomi and his suggestion I changed the users in my configurations from vmail --> root and that helped. Now I have a working replication but with some problems and strange behavior. Replication works only when I manually execute a command: "doveadm sync -A tcp:secundary:server:12345" Automatic fast and full sync do not work: doveadm replicator status "*" username priority fast sync full sync success sync failed zdokman none 01:46:14 01:46:14 01:46:14 - doveadm replicator status Queued 'sync' requests 0 Queued 'high' requests 0 Queued 'low' requests 0 Queued 'failed' requests 0 Queued 'full resync' requests 0 Waiting 'failed' requests 0 Total number of known users 1 doveadm replicator dsync-status username type status - Not connected maillog has no error entries. my conf files are attached. I don't understand why is this happening and how to fix it, any help is much appreciated. Best regards, On Mon, 13 May 2019 at 15:23, Zeljko Dokman <zdokman(a)gmail.com> wrote: > Hi, > Thank you for your reply Aki. > I changed my configuration and substituted vmail user with root user. > > Now I have no error massages in maillog but replication is not working, > mails are not visible on second server. > > BR > > > > > > On Mon, 13 May 2019 at 10:50, Aki Tuomi <aki.tuomi(a)open-xchange.com> > wrote: > >> Your problem is that you are running service doveadm as vmail, but you >> are using real uids. You need to start doveadm server as root to be able to >> switch into the correct target user. >> >> Aki >> >> >> On 13.5.2019 11.26, Zeljko Dokman via dovecot wrote: >> >> Hi all, >> >> Any suggestion? >> >> BR >> >> On Mon, 6 May 2019 at 14:22, Zeljko Dokman <zdokman(a)gmail.com> wrote: >> >>> Hi all, >>> >>> I am in need of some help. >>> >>> Straggling to make something work, trying to configure postfix and >>> dovecote imap server with dovecote replication. >>> >>> Can’t figure out what is wrong with my configuration. >>> >>> >>> >>> Replication is working only for vmail user account, I am getting this >>> error on my secondary server for all other users… >>> >>> >>> >>> dovecot: doveadm: Fatal: setgid(4015(zdokman) from userdb lookup) failed >>> with euid=5000(vmail), gid=5000(vmail), egid=5000(vmail): Operation not >>> permitted (This binary should probably be called with process group set to >>> 4015(zdokman) instead of 5000(vmail)) >>> >>> >>> >>> primary server reports this error: >>> >>> >>> >>> dovecot: doveadm(zdokman): Error: doveadm server disconnected before >>> handshake: EOF >>> >>> dovecot: doveadm(zdokman): Error: sync: Disconnected from remote: EOF >>> >>> >>> >>> >>> >>> doveadm replicator status '*' >>> >>> username >>> priority fast sync full sync success sync failed >>> >>> vmail >>> none 01:58:13 02:05:25 01:58:13 - >>> >>> zdokman >>> none 00:00:25 02:55:26 - y >>> >>> test >>> none 00:01:00 21:48:13 - y >>> >>> >>> >>> doveadm sync * >>> >>> doveadm(root): Fatal: execvp(Maildir) failed: Permission denied >>> >>> dsync-local(root): Error: read(remote) failed: EOF (version not received) >>> >>> >>> >>> I am attaching my dovecot.conf main.cf and master.cf. >>> >>> >>> >>> I think my problem is with permissions but I can figure out how to >>> workaround it. >>> >>> >>> >>> Best regards >>> >> >> >> -- >> >> >> >> >> >> > > -- > > > > > --

1 1

Stats/Metrics in 2.3
by Nikolai Lusan 03 Jun '19

03 Jun '19

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Greetings, So the changes to the stats modules between v2.2 and v2.3 have broken some of my monitoring. I am attempting to use the new method of gathering "metrics" from "events" - but the details in the documentation are a bit thin. I started with the examples provided at https://wiki2.dovecot.org/Statistics and tried to build from there with only moderate success. What I am trying to achieve is the monitoring of login attempts (with successes and failures as separate modules - as well as aborted attempts), user sessions an bytes transferred. All this for multiple virtual domains and users. I have attached my current /etc/dovecot/conf.d/10-stats.conf so people can see what I have attempted so far. Based on that file the output I get is: # doveadm stats dump metric_name field count sum min max avg median stddev %95 imap_login_attempt_lusan.id.au duration 0 0 0 0 0.00 0 0.00 0 imap_login_lusan.id.au_failed duration 0 0 0 0 0.00 0 0.00 0 imap_login_lusan.id.au_success duration 0 0 0 0 0.00 0 0.00 0 imap_select_no duration 702 197998 89 13942 282.05 133 1247.14 278 imap_select_no_notfound duration 702 197998 89 13942 282.05 133 1330.67 285 imap_command_list duration 14 287397 17595 25823 20528.36 20060 2194.36 25823 imap_command_select duration 1593 2354698 355 81662 1478.15 743 4583.03 4460 imap_command_search duration 0 0 0 0 0.00 0 0.00 0 imap_command_fetch_ok duration 0 0 0 0 0.00 0 0.00 0 storage_http_gets duration 0 0 0 0 0.00 0 0.00 0 Based on the metrics I have set I would expect to see entries in the first 2 lines at least, given that there are multiple users logged into the server from the monitored domain (or at least the domain I am trying to monitor to begin with). I am also not sure how to get the session and data transfer information out of the metrics/stats system. If anyone can help me I would appreciate it. Thanks - -- Nikolai Lusan <nikolai(a)lusan.id.au> -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEVfd4GW6z4nsBxdLo4ZaDRV2VL6QFAlzz29EACgkQ4ZaDRV2V L6QnIg/8CcB4V/69QSn+zqNhGNX2sHApoaGK0zCt7ITthOlDDVsdVKNT48hxJ3AR uEtoDQL9g3jcDJOQplsobDXmcs/Z6Po275T++8+CY0Bl5iqWO0/6g5LSvNDi6VlS VZzdLyDvAT0+oemaeTHgT/zPwx2waCrs84ZVwMCnuNVQKlE8l05gV2r6aLpgkRFf /Pc6zBwNEXGdthTcnowV2yPiYZkp87jaEl6+4RcHQcYQO1/Q/JEl38/iYlPWdVFZ NVOHpmzZdY9tGRhN0lqiUgivPLZu7gYyfzBeO6JHDOajLUNFW1NR7aKKhyALEOgM GZmjgSODzLjLw8CYx8iGnyMGRsEBDk+NLrJ1zjDqN+xIZkoUcnjkqwpNzurMIW4c kAkFDaPjquXu9eFy4T6V+r23p9E0z0IcWqTFfUyHkdctQApvkjLBFxoc35Abp1Yy I6LzGlGRmiV2Z2HNQYNM3n0w2O+tl4lDpLDN1UCialzfFO81fbHfopk/f9+RHt7b LHy1gTNrUwnLS+3Lobt5p179zNw3C9gtDMdgq355WC/B8jYYJGrw4Y0Jwh7WoyMF w1lPPEByeGTEl/P4zxegKz7oHL+DDBw9BdRdREJ3praUYAVtnMrZgJCJTS0qGh3Z 3m2wCF6yRSwGG8QkwsmoeIF2A6HwjnXcDWHWbOwkkDwh705BUXo= =QfOl -----END PGP SIGNATURE-----

4 6

Mailman option "Set Reply-To header to list" unavailable
by Ralph Seichter 01 Jun '19

01 Jun '19

Looking at https://dovecot.org/mailman/options/dovecot I see that the option "Set Reply-To header to list?" does not accept any changes from me. I assume this might be related to DMARC related header mangling that was discussed at length before. While I do not want to open that particular can of worms again, I would like to force Reply-To: dovecot(a)dovecot.org for my own (!) postings to this mailing list. I actually set this header in my MUA when I post to the Dovecot ML, but it gets overwritten to include my own sender address in Reply-To, which is not what I want. Is there something I can do on my end to ensure that replies get sent to the list only? If not, Is this something the list owners can set for me? Thanks, Ralph

2 1

[mail-crypt-plugin] Private key location in Folder Key Mode
by emordin 01 Jun '19

01 Jun '19

Nice. It worked but I think there is a little output error (probably not a big issue): When I type the following command I get this output: user'@'host:~$ doveadm -o plugin/mail_crypt_private_private_password=1234 mailbox cryptokey export -u username -U /var/vmail/domain/username/Maildir/dovecot-attributes Folder: Public ID: <Public key ID> Error: -----BEGIN PRIVATE KEY----- <private_key> -----END PRIVATE KEY----- And when I type the following command I get this output: user'@'host:~$ doveadm mailbox cryptokey export -u username -U /var/vmail/domain/username/Maildir/dovecot-attributes Folder: Public ID: <Public key ID> Error: ERROR: error:03070068:bignum routines:BN_mpi2bn:encoding error Key: So in the first command the private key shows but it's under Error, and I believe it should be under Key. Thanks again. Sent with [ProtonMail](https://protonmail.com) Secure Email.

1 0

macOS Notes.app IMAP Syncing Not Working
by Steven Smith 01 Jun '19

01 Jun '19

I’m requesting help getting macOS’s Notes.app to sync notes with a new dovecot IMAP server. Thanks to dovecot’s excellent online documentation and help from this list, I have a new perfectly functioning IMAP server. The issue is that macOS Note.app does not sync with this server. However, iOS Notes.app *does* sync and work well with this IMAP server, and the differences between macOS and iOS Notes apps are well known. (Thanks, Apple.) https://apple.stackexchange.com/questions/265579/notes-wont-sync-via-imap-i… <https://apple.stackexchange.com/questions/265579/notes-wont-sync-via-imap-i…> https://jpmens.net/2015/09/28/experiments-using-imap-for-notes/ <https://jpmens.net/2015/09/28/experiments-using-imap-for-notes/> … I am migrating from a working Server.app system in which Notes.app syncing does work across all devices, and therefore have a working dovecot configuration from Server.app, although it does not contain an explicit configuration for the “Notes” mailbox. I would greatly appreciate any help or pointers for these questions: Does anyone have a working template for dovecot that works with macOS Notes.app? I’ve posted doveconf -n of both the new server and the old Server.app server below. Would you all be able to provide advice on TO-DO’s and NOT-TO-DO’s for mailbox/name-space reconfiguration as I try to muck around with a nicely working, deployed IMAP server? I believe that the solution has something to do with name spaces and separators, and I’ve already changed the separator from the original ‘/’ to ‘.’ on the working server without success or obvious changes. All the mail boxes on the new IMAP server look like this, *without* a prefix ‘.’: > ls -1 /var/mail/tld.domain.mail/username/mdbox/mailboxes/ > Archive/ > Deleted Messages/ > Drafts/ > INBOX/ > Junk/ > Notes/ > Sent/ > Trash/ All the mailboxes on the working Server.app mailserver look like this, *with* a prefix ‘.’: > $ sudo ls -1 /Library/Server/Mail/Data/mail/users/username > .Archive > .Deleted Messages > .Drafts > .Junk > .Notes > .Sent Messages > cur > … > new > subscriptions > tmp Here are the `doveconf -n` of the new server that doesn’t sync macOS Notes.app, and the old Server.app IMAP server that does: New server `dovecot -n` [Note: original separator was set to ‘/’, now changed to ‘.’ in config.d/10-mail.conf]: > # 2.3.6 (): /opt/local/etc/dovecot/dovecot.conf > # Pigeonhole version 0.5.6 () > # OS: Darwin 18.6.0 x86_64 apfs > # Hostname: newhost.domain.tld > auth_cache_size = 10 M > auth_gssapi_hostname = $ALL > auth_krb5_keytab = /opt/local/etc/dovecot/imap.keytab > auth_mechanisms = plain gssapi > auth_realms = newhost.domain.tld > auth_socket_path = /opt/local/var/run/dovecot/auth-userdb > auth_username_format = %Ln > debug_log_path = /opt/local/var/log/mail/mail-debug.log > disable_plaintext_auth = no > first_valid_gid = 6 > first_valid_uid = 6 > imap_id_log = * > imap_id_send = "name" * "version" * > imap_idle_notify_interval = 29 mins > imap_urlauth_submit_user = submit > info_log_path = /opt/local/var/log/mail/mail-info.log > last_valid_gid = 100 > lda_mailbox_autocreate = yes > log_path = /opt/local/var/log/mail/mail-err.log > login_log_format_elements = user=<%u> method=%m rip=%r lip=%l mpid=%e %c > mail_access_groups = mail > mail_attachment_dir = /private/var/mail/tld.domain.mail/attachments > mail_attachment_fs = sis posix:mode=0666 > mail_debug = yes > mail_gid = mail > mail_home = /private/var/mail/tld.domain.mail > mail_location = mdbox:/private/var/mail/tld.domain.mail/%Ln/mdbox > mail_log_prefix = "%s(pid %p user %u): " > mail_plugins = quota zlib acl fts fts_solr fts_lucene > mail_privileged_group = mail > mail_uid = _dovecot > managesieve_notify_capability = mailto > managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext imapsieve vnd.dovecot.imapsieve > mdbox_rotate_size = 200 M > namespace inbox { > inbox = yes > location = > mailbox Archive { > auto = subscribe > special_use = \Archive > } > mailbox Drafts { > auto = subscribe > special_use = \Drafts > } > mailbox Junk { > auto = create > special_use = \Junk > } > mailbox Notspam_train { > auto = create > special_use = \Junk > } > mailbox Sent { > auto = subscribe > special_use = \Sent > } > mailbox "Sent Messages" { > special_use = \Sent > } > mailbox Spam_train { > auto = create > special_use = \Junk > } > mailbox Trash { > auto = create > special_use = \Trash > } > prefix = > separator = . > } > passdb { > driver = pam > name = pam > } > plugin { > fts = solr > fts_autoindex = yes > fts_autoindex_exclude = \Junk > fts_solr = url=http://127.0.0.1:8983/solr/dovecot/ > imapsieve_mailbox1_before = file:/opt/local/etc/dovecot/sieve/report-spam.sieve > imapsieve_mailbox1_causes = COPY APPEND > imapsieve_mailbox1_name = Spam_train > imapsieve_mailbox2_before = file:/opt/local/etc/dovecot/sieve/report-ham.sieve > imapsieve_mailbox2_causes = COPY APPEND > imapsieve_mailbox2_name = Notspam_train > mail_log_events = delete undelete expunge copy mailbox_delete mailbox_rename > mail_log_fields = uid box msgid from subject size flags > quota_grace = 10%% > quota_rule = *:storage=16G > quota_rule2 = Trash:storage=+256M > quota_warning = storage=100%% quota-exceeded %u > quota_warning2 = storage=80%% quota-warning %u > recipient_delimiter = + > sieve = /private/var/mail/tld.domain.mail/rules/%Ln/dovecot.sieve > sieve_after = /opt/local/etc/dovecot/sieve-after.d > sieve_before = /opt/local/etc/dovecot/sieve-before.d > sieve_dir = /private/var/mail/tld.domain.mail/rules/%Ln/%u > sieve_global_extensions = +vnd.dovecot.pipe +vnd.dovecot.environment > sieve_pipe_bin_dir = /opt/local/etc/dovecot/sieve > sieve_plugins = sieve_imapsieve sieve_extprograms > sieve_quota_max_storage = 50M > } > postmaster_address = postmaster(a)domain.tld > protocols = imap lmtp sieve > quota_full_tempfail = yes > sendmail_path = /opt/local/sbin/sendmail > service auth-worker { > group = mail > user = root > } > service auth { > extra_groups = _keytabusers > idle_kill = 15 mins > unix_listener /opt/local/var/spool/postfix/private/auth { > group = mail > mode = 0660 > user = _postfix > } > } > service imap-login { > inet_listener imap { > address = 127.0.0.1, ::1 > port = 143 > } > inet_listener imaps { > port = 993 > ssl = yes > } > process_min_avail = 6 > service_count = 0 > vsz_limit = 2 G > } > service imap { > process_limit = 200 > process_min_avail = 6 > } > service lmtp { > unix_listener /opt/local/var/spool/postfix/private/dovecot-lmtp { > group = mail > mode = 0660 > user = _postfix > } > } > ssl = required > ssl_ca = </etc/certificates/newhost.domain.tld.SHA1.chain.pem > ssl_cert = </etc/certificates/newhost.domain.tld.SHA1.cert.pem > ssl_cipher_list = ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256 > ssl_dh = # hidden, use -P to show it > ssl_key = # hidden, use -P to show it > ssl_min_protocol = TLSv1.2 > ssl_prefer_server_ciphers = yes > userdb { > driver = passwd > name = passwd > } > verbose_proctitle = yes > protocol lda { > mail_fsync = optimized > mail_plugins = quota zlib acl fts fts_solr fts_lucene sieve > } > protocol imap { > mail_max_userip_connections = 50 > mail_plugins = quota zlib acl fts fts_solr fts_lucene imap_acl imap_quota imap_zlib imap_sieve > } > protocol lmtp { > mail_fsync = optimized > mail_plugins = quota zlib acl fts fts_solr fts_lucene sieve > } Old Server.app server `dovecot -n`: > # 2.2.30.2 (c0c463e): /Library/Server/Mail/Config/dovecot/dovecot.conf > # Pigeonhole version 0.4.18 (29cc74d) > # OS: Darwin 17.7.0 x86_64 apfs > aps_topic = com.apple.mail.XServer.d7d6581e-37ed-4a8a-8775-92c4c5a4bf28 > auth_gssapi_hostname = $ALL > auth_mechanisms = cram-md5 plain login gssapi > auth_realms = host.domain.tld > auth_socket_path = /var/run/dovecot/auth-userdb > auth_username_format = %n > debug_log_path = /Library/Logs/Mail/mail-debug.log > default_internal_user = _dovecot > default_login_user = _dovenull > disable_plaintext_auth = no > first_valid_gid = 6 > first_valid_uid = 6 > imap_id_log = * > imap_id_send = "name" * "version" * > imap_urlauth_submit_user = submit > info_log_path = /Library/Logs/Mail/mail-info.log > log_path = /Library/Logs/Mail/mail-err.log > login_log_format_elements = user=<%u> method=%m rip=%r lip=%l mpid=%e %c > mail_access_groups = mail > mail_attribute_dict = file:/Library/Server/Mail/Data/attributes/attributes.dict > mail_location = maildir:/Library/Server/Mail/Data/mail/%u > mail_log_prefix = "%s(pid %p user %u): " > mail_plugins = quota zlib acl fts fts_sk > managesieve_notify_capability = mailto > managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext > mdbox_rotate_size = 200 M > namespace acl-mailboxes { > list = children > location = maildir:/Library/Server/Mail/Data/mail/users/%%u:INDEX=/Library/Server/Mail/Data/mail/shared/%%u > prefix = shared.%%u. > separator = . > subscriptions = no > type = shared > } > namespace inbox { > inbox = yes > location = > mailbox Drafts { > special_use = \Drafts > } > mailbox Junk { > special_use = \Junk > } > mailbox Sent { > special_use = \Sent > } > mailbox "Sent Messages" { > special_use = \Sent > } > mailbox Trash { > special_use = \Trash > } > prefix = > } > namespace list-archives { > list = children > location = maildir:/Library/Server/Mail/Data/listserver/messages/archive/lists/%%u:INDEX=/Library/Server/Mail/Data/listserver/messages/archive/shared/%%u > prefix = archives.%%u. > separator = . > subscriptions = no > type = shared > } > passdb { > driver = od > } > passdb { > args = /Library/Server/Mail/Config/dovecot/submit.passdb > driver = passwd-file > } > plugin { > acl = vfile:/Library/Server/Mail/Config/dovecot/global-acls:cache_secs=300 > acl_shared_dict = file:/Library/Server/Mail/Data/shared/shared-mailboxes > fts = sk > quota = maildir:User quota > quota_warning = storage=100%% quota-exceeded %u > quota_warning2 = storage=80%% quota-warning %u > sieve = /Library/Server/Mail/Data/rules/%u/dovecot.sieve > sieve_dir = /Library/Server/Mail/Data/rules/%u > stats_refresh = 30 secs > stats_track_cmds = yes > } > postmaster_address = postmaster(a)host.domain.tld > protocols = imap pop3 lmtp sieve > quota_full_tempfail = yes > service auth { > extra_groups = _keytabusers > idle_kill = 15 mins > unix_listener auth-userdb { > user = _dovecot > } > } > service dns_client { > unix_listener dns-client { > mode = 0600 > } > } > service imap-login { > inet_listener imap { > port = 143 > } > inet_listener imaps { > port = 993 > ssl = yes > } > service_count = 0 > } > service imap { > client_limit = 5 > process_limit = 200 > service_count = 0 > } > service indexer-worker { > user = _dovecot > } > service lmtp { > unix_listener lmtp { > mode = 0600 > } > } > service managesieve-login { > inet_listener sieve { > port = 4190 > } > } > service pop3-login { > inet_listener pop3 { > port = 110 > } > inet_listener pop3s { > port = 995 > ssl = yes > } > } > service pop3 { > client_limit = 5 > process_limit = 200 > service_count = 0 > } > service quota-exceeded { > executable = script /Applications/Server.app/Contents/ServerRoot/usr/libexec/dovecot/quota-exceeded.sh > unix_listener quota-exceeded { > group = mail > mode = 0660 > user = _dovecot > } > user = _dovecot > } > service quota-warning { > executable = script /Applications/Server.app/Contents/ServerRoot/usr/libexec/dovecot/quota-warning.sh > unix_listener quota-warning { > group = mail > mode = 0660 > user = _dovecot > } > user = _dovecot > } > service stats { > fifo_listener stats-mail { > mode = 0600 > user = _dovecot > } > } > ssl = required > ssl_ca = </etc/certificates/host.domain.tld.SHA1.chain.pem > ssl_cert = </etc/certificates/host.domain.tld.SHA1.cert.pem > ssl_cipher_list = ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA > ssl_key = # hidden, use -P to show it > ssl_key_path = # hidden, use -P to show it > ssl_protocols = !SSLv2 !SSLv3 > userdb { > args = partition=/Library/Server/Mail/Config/dovecot/partition_map.conf global_quota=8192 enforce_quotas=yes > driver = od > } > userdb { > args = /Library/Server/Mail/Config/dovecot/submit.passdb > driver = passwd-file > } > verbose_proctitle = yes > protocol lmtp { > mail_plugins = quota zlib acl fts fts_sk sieve push_notify > } > protocol lda { > mail_plugins = quota zlib acl fts fts_sk sieve push_notify > } > protocol imap { > mail_max_userip_connections = 20 > mail_plugins = quota zlib acl fts fts_sk imap_acl imap_quota imap_zlib > } > protocol pop3 { > mail_max_userip_connections = 6 > }

3 6

[mail-crypt-plugin] Private key location in Folder Key Mode
by emordin 01 Jun '19

01 Jun '19

Hi, So I am trying to locate the private key in dovecot-attributes but I can't seem to find it. I have went thru the strings in the file with the lib-dcrypt document as a guide but the private key doesn't seem to be in there. I'm guessing the private key is an internal attribute located here '/private/vendor/vendor.dovecot/pvt' , but according to the mail-attribute.h file that location is not accessible. Is this true? Or is there a way to see the private key? Thanks. Sent with [ProtonMail](https://protonmail.com) Secure Email.

2 1

[mail-crypt-plugin] Password Query for Folder Keys questions
by emordin 31 May '19

31 May '19

> Can you try rm dovecot-attributes file? Okay it worked. I kinda did that by 'rm -rf' the entire /var/vmail/domain, and then I ran the following: doveadm -o plugin/mail_crypt_private_password=desired_password mailbox cryptokey generate -u user -UR And I got the check mark and the ID string of characters. I sent a new email to the server, and was able to open and read the email =) I got confused on the docs... So only if using unencrypted folder keys, could I open a CRYPTED email and read it right away. But if using encrypted folder keys, first I would have to set a password for the key before I could open the CRYPTED email ? I thought logging in to the mailbox would connect the password to the key automatically. Thanks again. Sent with [ProtonMail](https://protonmail.com) Secure Email.

1 0

[mail-crypt-plugin] Password Query for Folder Keys questions
by emordin 31 May '19

31 May '19

So when I tried this way I got the following output: user'@'host:~$ doveadm -o plugin/mail_crypt_private_password=desired_password mailbox > cryptokey generate -u user -UR user'@'host:~$ And when I tried this way I got the following output: user'@'host:~$doveadm -o plugin/mail_crypt_private_password=desired_password mailbox cryptokey generate -u user -UR Folder Public ID user'@'host:~$ In both cases I sent a new email to the server, and I got errors stating the mailbox can't be opened Sent with [ProtonMail](https://protonmail.com) Secure Email.

2 1

(4) [mail-crypt-plugin] Password Query for Folder Keys questions
by emordin 31 May '19

31 May '19

>> Can you try >> >> doveadm -o plugin/mail_crypt_private_password=desired_password mailbox > cryptokey generate -u user -UR >> >> Aki > > I tried that and got the following: > > [user at host](https://dovecot.org/mailman/listinfo/dovecot) :~$ doveadm -o plugin/mail_crypt_private_password=desired_password mailbox > cryptokey generate -u user -UR > > Folder Public ID > > [user at host](https://dovecot.org/mailman/listinfo/dovecot) :~$ > > Then I sent a new email to the mail server, and I checked it with mutt but got 'Internal Error' 'error opening mailbox' and I > > checked the email with Roundcube and I can see the subject header but when I open the email its just blank. I apologize I forgot to add the '>', in the last one, so I added it and got this output: [user at host](https://dovecot.org/mailman/listinfo/dovecot):~$ doveadm -o plugin/mail_crypt_private_password=desired_password mailbox > cryptokey generate -u user -UR [user at host](https://dovecot.org/mailman/listinfo/dovecot):~$ However it still didn't work. I sent a new email and tried to access it with mutt and Roundcube and I still can't access the body message. Sent with [ProtonMail](https://protonmail.com) Secure Email.

1 0

[mail-crypt-plugin] Password Query for Folder Keys questions
by emordin 31 May '19

31 May '19

> Can you try > > doveadm -o plugin/mail_crypt_private_password=desired_password mailbox > cryptokey generate -u user -UR > > Aki I tried that and got the following: user@host:~$ doveadm -o plugin/mail_crypt_private_password=desired_password mailbox > cryptokey generate -u user -UR Folder Public ID user@host:~$ Then I sent a new email to the mail server, and I checked it with mutt but got 'Internal Error' 'error opening mailbox' and I checked the email with Roundcube and I can see the subject header but when I open the email its just blank. Sent with [ProtonMail](https://protonmail.com) Secure Email.

2 1

[mail-crypt-plugin] Password Query for Folder Keys questions
by emordin 31 May '19

31 May '19

So I believe I generated a key successfully with: 'doveadm mailbox cryptokey generate -u user -UR' because I got the output with the check mark and the Public ID string of characters. However I still can't read the CRYPTED emails when logging in with IMAP.. i'm still getting the following error in the mail log: Error: read() failed: read(/var/vmail/[domain . com/user/Maildir/cur/](http://domain.com/user/Maildir/cur/)<email_index>) failed: Private key not available: Cannot decrypt key ... : error:03070068:big num routines:BN_mpi2bn:encoding error I've tried to list the key with 'doveadm mailbox cryptokey list -u user' but I'm only getting the following output: Folder Active Public ID And I've tried to create a password with 'doveadm mailbox cryptokey password -u user -n Password1' and I'm getting the following output: result: dcrypt_key_load_private(...) failed: password missing Also my settings in conf.d: 10-mail.conf - mail_attribute_dict = file:%h/Maildir/dovecot-attributes mail_plugins = $mail_plugins mail_crypt plugins{ mail_crypt_curve = secp512r1 mail_crypt_save_version = 2 mail_crypt_require_encrypted_user_key = yes } 20-lmtp.conf - protocol lmtp{ mail_plugins = $mail_plugins sieve } And my settings in dovecot-sql.conf.ext: driver = mysql connect = host=127.0.0.1 dbname=mailserver user=mailuser password=1234 password_query = SELECT email as user,password, '%w' AS userdb_mail_crypt_private_password FROM virtual_users WHERE email='%u'; In the virtual_users table I have: id, domain_id, email, password Any ideas what the issue may be? Also am I suppose to add the 'userdb_mail_crypt_private_password' into the table and put the virtual users email login password in there? Or is it suppose to be a temporary query? Thanks. Sent with [ProtonMail](https://protonmail.com) Secure Email.

2 1

Problem SSL entrust certificate
by Il Neofita 31 May '19

31 May '19

Hi I have compiled dovecot 2.3.6 on RH 8, and I copied the configuration from dovecot 2.0.9 however, when I try to connect the new machine the certificate is not recognized The same certificate is working with apache CONNECTED(00000004) depth=0 ... verify error:num=20:unable to get local issuer certificate verify return:1 depth=0 ... verify error:num=21:unable to verify the first certificate verify return:1 ... --- No client certificate CA names sent Peer signing digest: SHA256 Peer signature type: RSA-PSS Server Temp Key: X25519, 253 bits --- SSL handshake has read 2311 bytes and written 404 bytes Verification error: unable to verify the first certificate

1 0

[mail-crypt-plugin] Password Query for Folder Keys questions
by emordin 31 May '19

31 May '19

Please disregard the previous question. But I have another... I have set up Folder Key encryption, and have sent an email to my mail server which is CRYPTED, however when I try to login to read the email I'm getting a 'Private key not available: Cannot decrypt <...>: error:03070068:bignum routines:BN_mpi2bn:encoding error'. I've tried to list the user key and generate a new keypair two different ways and have gotten the following output: doveadm mailbox cryptokey list -U user output: Folder Active Public ID doveadm mailbox cryptokey generate -u user -U output: Folder Public ID doveadm mailbox cryptokey generate -u user -Uf output: Panic: file doveadm-mail.c: line 405 (doveadm_mail_next_user): assertion failed: (ctx->exit_code !=0) Error: Raw backtrace: ............. Aborted Any advice? Sent with [ProtonMail](https://protonmail.com) Secure Email.

1 0

SIGABRT on fetching mail
by Peter Nabbefeld 30 May '19

30 May '19

Good Morning, I tried using gdb, but that doesn't work for me: $ ulimit -c unlimited $ sudo systemctl restart dovecot $ sudo -E getmail getmail version 5.13 Copyright (C) 1998-2019 Charles Cazabon. Licensed under the GNU GPL version 2. SimpleIMAPSSLRetriever:peter.nabbefeld@gmx.de@imap.gmx.net:993: getmailrc: operation error (child pid 19702 killed by signal 6) 1 messages (12551 bytes) retrieved, 0 skipped $ gdb bt 19702 GNU gdb (GDB) 8.3 Copyright (C) 2019 Free Software Foundation, Inc. License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html> This is free software: you are free to change and redistribute it. There is NO WARRANTY, to the extent permitted by law. Type "show copying" and "show warranty" for details. This GDB was configured as "x86_64-pc-linux-gnu". Type "show configuration" for configuration details. For bug reporting instructions, please see: <http://www.gnu.org/software/gdb/bugs/>. Find the GDB manual and other documentation resources online at: <http://www.gnu.org/software/gdb/documentation/>. For help, type "help". Type "apropos word" to search for commands related to "word"... bt: Datei oder Verzeichnis nicht gefunden. Attaching to process 19702 ptrace: Kein passender Prozess gefunden. /home/peter/NetBeansProjects/19702: Datei oder Verzeichnis nicht gefunden. (gdb) Finally, I could find a file in /var/lib/systemd/coredump: -rw-r-----+ 1 root root 710416 30. Mai 08:54 core.deliver.1003.d14b28050b8343f5a60c5998ef3947df.19702.1559199286000000.lz4 This is obviously the required dump. However, I'd not attach such a file to a post to the mailing list, so where can I put that? Send it directly to You? Kind regards Peter PS: I'm using Arch Linux - probably the hint above could be added to https://www.dovecot.org/bugreport-mail as a hint for other Arch users, as it's much easier than using gdb for those not using it?

1 0

[mail-crypt-plugin] Password Query for Folder Keys questions
by emordin 29 May '19

29 May '19

In Folder key plugin operation mode, using the following password query: password_query = SELECT \ email as user, password, \ '%w' AS userdb_mail_crypt_private_password \ FROM virtual_users WHERE email='%u'; Say I have two 'email' users...will each 'email' have a 'userdb_mail_crypt_private_password' field with a plaintext password (%w) in it? And is the 'userdb_mail_crypt_private_password' used automatically to decrypt the user private key which is stored in 'mail_attribute_dict' ? Sent with [ProtonMail](https://protonmail.com) Secure Email.

1 0

Convert Maildir to Dbox?
by David Mehler 29 May '19

29 May '19

Hello, I've got a Dovecot 2.3.x setup. Currently it's running Maildir storage. I'd like to convert that to Dbox specifically Sdbox safely. I'm also looking to at the same time or shortly thereafter encrypt the email storage with mail_crypt. Any help appreciated. Thanks. Dave.

6 8

Changes in sieve Dovecot 2.2
by Gter Marcelo 29 May '19

29 May '19

Hi People, I'm use dovecot in my mailbox system, until last month i used the dovecot version 2.0 and now i use version 2.2, version 2.2 works well for me, but i have one small problem, in sieve. In version 2.0 i had rules in sieve similiar to rule bellow: if allof (true){ keep; fileinto "INBOX"; redirect "xxxxxx"xxxxxx.com.br"; stop; } In the new version 2.2 this rules above, i have one problem duplicate messages in account from my clients, in paste INBOX, therefore, i changed rule to bellow ( with remove fileinto inbox) if allof (true){ keep; redirect "xxxxxx"xxxxxx.com.br"; stop; } Dovecot really changed your behavor, i did right to fix this ? Thanks a Lot, Marcelo

2 1

JMAP support in Dovecot
by Andrew Jones 29 May '19

29 May '19

Hi there, I understand there were discussions to try and develop JMAP support for Dovecot. Is this still in the pipeline for Dovecot 2.5? Regards Andrew Sent from my iPhone

10 18

mail_max_userip_connections
by hfh＠cndns.com 29 May '19

29 May '19

mail_max_userip_connections Can I set up an ip whitelist list, and the ip in this whitelist is unrestricted? thanks!!! hfh(a)cndns.com

2 1

Dict issue with PostgreSQL for last_login plugin (duplicate key)
by mabi 29 May '19

29 May '19

Hello, I am trying to setup the last_login plugin on Dovecot 2.3 in order to log a user's last IMAP login into a separate PostgreSQL table called last_login. I am actually following that guide: https://docs.iredmail.org/track.user.last.login.html with the exception that I use PostgreSQL instead of MySQL. So far it works at least for the very first login of a user but it looks like Dict always want to add a new record into my last_login table instead of updating the existing record for a specific user. Here is the error message from Dovecot: May 19 12:45:14-mbox1 dovecot: imap(user(a)domain.tld)<51915><if6KTzuJMZ25D+Vc>: Error: last_login_dict: Failed to write value: dict-server returned failure: sql dict: commit failed: ERROR: duplicate key value violates unique constraint "last_logins_pkey" It looks like Dict with PostgreSQL does not support UPDATEing an already existing record in the table. Or am I missing something? or it does not work with PostgreSQL? Which does not make much sense to me... Regards, Mabi

5 22

SIGABRT on fetching mail
by Peter Nabbefeld 29 May '19

29 May '19

Hello, I've never used gdb, so I don't know why I'm running into problems using "gdb bt". Usually, I'm fetching my mail using "sudo -E getmail", but this doesn't seem to work with backtrace. :-/ Output from "dovecot -n" attached. Kind regards, Peter

2 1

imap userdb Fatal setuid errors
by Steven Smith 28 May '19

28 May '19

I’m trying to configure dovecot lmtp in multi-user mode. My error logs are filled with messages saying that an imap process cannot do a setuid to another user: > May 21 22:28:46 imap(pid 17441 user myuser): Fatal: setuid(512(myuser) from userdb lookup) failed with euid=501(adminuser): Operation not permitted (This binary should probably be called with process user set to 512(myuser) instead of 501(adminuser)) I see that others have had similar issues, but I am not able to apply any of the fixes or workarounds to solve this issue (e.g. setting libexec/dovecot/imap as setuid-root). I’ve also tried other fixes like setting the permissions to 0777 on the userdb auth for postfix smtpd. According to the code (restrict-access.c, linked below), it appears that when a user authenticates, an imap worker process is launched that has the bid of the authenticator. When another user authenticates, this last process is used, but it does not have the permissions to perform a setuid to the new user, resulting in the Fatal error that appears in the logs. Is this a bug, or a configuration issue? I’ve posted my doveconf below. Any pointers would be greatly appreciated. Steve Related: https://serverfault.com/questions/930245/dovecot-operation-not-permitted <https://serverfault.com/questions/930245/dovecot-operation-not-permitted> https://dovecot.org/list/dovecot/2012-May/135549.html <https://dovecot.org/list/dovecot/2012-May/135549.html> https://trac.macports.org/ticket/58506 <https://trac.macports.org/ticket/58506> Code at https://github.com/dovecot/core/blob/master/src/lib/restrict-access.c <https://github.com/dovecot/core/blob/master/src/lib/restrict-access.c>: https://github.com/dovecot/core/blob/863887d4272f962926ab279ac4cf37855dd200… <https://github.com/dovecot/core/blob/863887d4272f962926ab279ac4cf37855dd200…> https://github.com/dovecot/core/blob/863887d4272f962926ab279ac4cf37855dd200… <https://github.com/dovecot/core/blob/863887d4272f962926ab279ac4cf37855dd200…> doveconf -n: > # 2.3.0.1 (ffd8a29): /opt/local/etc/dovecot/dovecot.conf > # Pigeonhole version 0.5.0.1 (d33dca20) > # OS: Darwin 18.6.0 x86_64 apfs > auth_cache_size = 10 M > auth_gssapi_hostname = $ALL > auth_krb5_keytab = /opt/local/etc/dovecot/imap.keytab > auth_mechanisms = plain gssapi > auth_realms = host.domain.tld > auth_socket_path = /opt/local/var/run/dovecot/auth-userdb > auth_username_format = %Ln > debug_log_path = /opt/local/var/log/mail/mail-debug.log > default_internal_user = _dovecot > default_login_user = _dovenull > disable_plaintext_auth = no > first_valid_gid = 6 > first_valid_uid = 6 > imap_id_log = * > imap_id_send = "name" * "version" * > imap_idle_notify_interval = 29 mins > imap_urlauth_submit_user = submit > info_log_path = /opt/local/var/log/mail/mail-info.log > last_valid_gid = 100 > lda_mailbox_autocreate = yes > log_path = /opt/local/var/log/mail/mail-err.log > login_log_format_elements = user=<%u> method=%m rip=%r lip=%l mpid=%e %c > mail_access_groups = mail > mail_attachment_dir = /private/var/mail/tld.domain.mail/attachments > mail_attachment_fs = sis posix:mode=0666 > mail_debug = yes > mail_gid = mail > mail_home = /private/var/mail/tld.domain.mail > mail_location = mdbox:/private/var/mail/tld.domain.mail/%Ln/mdbox > mail_log_prefix = "%s(pid %p user %u): " > mail_plugins = quota zlib acl fts fts_solr fts_lucene > mail_privileged_group = mail > mail_uid = _dovecot > managesieve_notify_capability = mailto > managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext imapsieve vnd.dovecot.imapsieve > mdbox_rotate_size = 200 M > namespace inbox { > inbox = yes > location = > mailbox Archive { > auto = subscribe > special_use = \Archive > } > mailbox Drafts { > auto = subscribe > special_use = \Drafts > } > mailbox Junk { > auto = create > special_use = \Junk > } > mailbox Notspam_train { > auto = create > special_use = \Junk > } > mailbox Sent { > auto = subscribe > special_use = \Sent > } > mailbox Spam_train { > auto = create > special_use = \Junk > } > mailbox Trash { > auto = create > special_use = \Trash > } > prefix = > separator = / > } > passdb { > driver = pam > name = pam > } > plugin { > fts = solr > fts_autoindex = yes > fts_autoindex_exclude = \Junk > fts_solr = url=http://127.0.0.1:8983/solr/dovecot/ > imapsieve_mailbox1_before = file:/opt/local/etc/dovecot/sieve/report-spam.sieve > imapsieve_mailbox1_causes = COPY APPEND > imapsieve_mailbox1_name = Spam_train > imapsieve_mailbox2_before = file:/opt/local/etc/dovecot/sieve/report-ham.sieve > imapsieve_mailbox2_causes = COPY APPEND > imapsieve_mailbox2_name = Notspam_train > mail_log_events = delete undelete expunge copy mailbox_delete mailbox_rename > mail_log_fields = uid box msgid from subject size flags > quota_grace = 10%% > quota_rule = *:storage=16G > quota_rule2 = Trash:storage=+256M > quota_warning = storage=100%% quota-exceeded %u > quota_warning2 = storage=80%% quota-warning %u > recipient_delimiter = + > sieve = /private/var/mail/tld.domain.mail/rules/%Ln/dovecot.sieve > sieve_after = /opt/local/etc/dovecot/sieve-after.d > sieve_before = /opt/local/etc/dovecot/sieve-before.d > sieve_dir = /private/var/mail/tld.domain.mail/rules/%Ln/%u > sieve_global_extensions = +vnd.dovecot.pipe +vnd.dovecot.environment > sieve_pipe_bin_dir = /opt/local/etc/dovecot/sieve > sieve_plugins = sieve_imapsieve sieve_extprograms > sieve_quota_max_storage = 50M > } > postmaster_address = postmaster(a)domain.tld > protocols = imap lmtp sieve > quota_full_tempfail = yes > sendmail_path = /opt/local/sbin/sendmail > service auth-worker { > user = root > } > service auth { > extra_groups = _keytabusers > idle_kill = 15 mins > unix_listener /opt/local/var/spool/postfix/private/auth { > group = mail > mode = 0660 > user = _postfix > } > } > service imap-login { > inet_listener imap { > address = 127.0.0.1, ::1 > port = 143 > } > inet_listener imaps { > port = 993 > ssl = yes > } > process_min_avail = 6 > service_count = 0 > vsz_limit = 2 G > } > service imap { > client_limit = 16 > process_limit = 200 > process_min_avail = 6 > service_count = 0 > } > service lmtp { > unix_listener /opt/local/var/spool/postfix/private/dovecot-lmtp { > group = mail > mode = 0660 > user = _postfix > } > } > ssl = required > ssl_ca = </etc/certificates/chain.pem > ssl_cert = </etc/certificates/cert.pem > ssl_cipher_list = ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256 > ssl_dh = # hidden, use -P to show it > ssl_key = # hidden, use -P to show it > ssl_min_protocol = TLSv1.2 > ssl_prefer_server_ciphers = yes > userdb { > driver = passwd > name = passwd > } > verbose_proctitle = yes > protocol lda { > mail_fsync = optimized > mail_plugins = quota zlib acl fts fts_solr fts_lucene sieve > } > protocol imap { > mail_max_userip_connections = 50 > mail_plugins = quota zlib acl fts fts_solr fts_lucene imap_acl imap_quota imap_zlib imap_sieve > } > protocol lmtp { > mail_fsync = optimized > mail_plugins = quota zlib acl fts fts_solr fts_lucene sieve > }

2 2

ssl_dh
by ＠lbutlr 28 May '19

28 May '19

Does ssl_dh need to be manually updated each time the underlying certificate renews? -- 2+2=5 for sufficiently large values of 2.

2 1

Hello some help on login users saying it's disabled
by Remo Mattei 28 May '19

28 May '19

Hello I am experiencing some strange issue with the dovecot, the web round cube works fine but when I try to connect with an iPhone over IMAP IMAPs it tells me that the account is disabled. Please advice here is what I see in the logs: May 25 14:30:32 imap-login: Info: Aborted login (no auth attempts in 0 secs): user=<>, rip=172.10.163.251, lip=208.53.44.237, session=<4AZjBr2J2cisCqP7> May 25 14:30:32 imap-login: Info: Aborted login (no auth attempts in 0 secs): user=<>, rip=172.10.163.251, lip=208.53.44.237, session=<fFVkBr2J2sisCqP7> May 25 14:30:32 imap-login: Info: Aborted login (no auth attempts in 0 secs): user=<>, rip=172.10.163.251, lip=208.53.44.237, session=<TnpkBr2J28isCqP7> May 25 14:30:32 imap-login: Info: Aborted login (no auth attempts in 0 secs): user=<>, rip=172.10.163.251, lip=208.53.44.237, session=<KcplBr2J3MisCqP7> May 25 14:30:34 imap-login: Info: Aborted login (no auth attempts in 0 secs): user=<>, rip=172.10.163.251, lip=208.53.44.237, session=<wPiABr2J3cisCqP7> May 25 14:30:34 imap-login: Info: Aborted login (no auth attempts in 0 secs): user=<>, rip=172.10.163.251, lip=208.53.44.237, session=<gDSCBr2J3sisCqP7> May 25 14:30:37 imap-login: Info: Aborted login (no auth attempts in 0 secs): user=<>, rip=172.10.163.251, lip=208.53.44.237, session=<byuzBr2J4MisCqP7> May 25 14:30:37 imap-login: Info: Aborted login (no auth attempts in 0 secs): user=<>, rip=172.10.163.251, lip=208.53.44.237, session=<ob20Br2J4cisCqP7> May 25 14:30:39 imap-login: Info: Aborted login (no auth attempts in 0 secs): user=<>, rip=172.10.163.251, lip=208.53.44.237, session=<bUfQBr2J4sisCqP7> May 25 14:30:39 imap-login: Info: Aborted login (no auth attempts in 0 secs): user=<>, rip=172.10.163.251, lip=208.53.44.237, session=<tsbRBr2J48isCqP7> And the account does not show any mail whereas the Web shows the mail just fine. Thanks

4 3

pam authentication error?
by unknown＠example.com 28 May '19

28 May '19

Getting this: auth-worker(5045): Error: pam(kremels,xxx.xxx.xxx.xxx: pam_authenticate() failed: authentication error (/etc/pam.d/dovecot missing?) # cat /etc/pam.d/dovcot auth required pam_unix.so nullok account required pam_unix.so (file was last updated in April of 2018) passdb { username_filter = "!*@*" driver = pam } userdb { driver = passwd } service auth { unix_listener auth-userdb { } unix_listener /var/spool/postfix/private/auth { mode = 0666 } } # ls -ls /var/spool/postfix/private/auth 0 srw-rw-rw- 1 root wheel 0 May 27 13:57 /var/spool/postfix/private/auth postfix/main.cf: smtpd_sasl_authenticated_header = yes smtpd_sasl_path = private/auth smtpd_sasl_type = dovecot smtpd_starttls_timeout = 20s smtpd_tls_cert_file = /usr/local/etc/dehydrated/certs/covisp.net/fullchain.pem smtpd_tls_key_file = /usr/local/etc/dehydrated/certs/covisp.net/privkey.pem smtpd_tls_loglevel = 1 smtpd_tls_received_header = yes smtpd_tls_security_level = may 16 -rw------- 1 root 443 4152 May 20 21:08 fullchain-1558408117.pem 0 lrwx------ 1 root 443 24 May 20 21:08 fullchain.pem -> fullchain-1558408117.pem 8 -rw------- 1 root 443 3243 May 20 21:08 privkey-1558408117.pem 0 lrwx------ 1 root 443 22 May 20 21:08 privkey.pem -> privkey-1558408117.pem

2 1

Re: Hello some help on login users saying it's disabled
by Joseph Tam 27 May '19

27 May '19

> Hello I am experiencing some strange issue with the dovecot, the web > round cube works fine but when I try to connect with an iPhone over > IMAP IMAPs it tells me that the account is disabled. > > May 25 14:30:32 imap-login: Info: Aborted login (no auth attempts in 0 secs): user=<>, rip=... > ... It's probably the iPhone mail app trying to be clever and auto-configuring the settings for IMAP (and getting it wrong). To stop this behaviour, hardwire the iPhone IMAP parameters, then disable "Automatic manage connection". If you use SSL/TLS, this will also secure you from plaintext MITM attacks. Other oddities I've seen from Apple mail readers: 1) If you don't disable "Automatic manage connection", it will also hunt around for outgoing mail settings. 2) Once in a while, it initiates an idle authenticated SMTP session (i.e. authenticates, but does nothing). 3) Roofs your user IMAP connection limit when the client does global mail searches. Joseph Tam <jtam.home(a)gmail.com>

1 0

SIGABRT on fetching mail
by Peter Nabbefeld 27 May '19

27 May '19

Hello, I still cannot fetch my mails, relying on my smartphone (which makes it a burden to read my mails ...) - could probably somebody help me? Kind regards, Peter

2 2

Error suggestions please
by Remo Mattei 27 May '19

27 May '19

May 25 15:01:27 imap(xxxxx(a)italy1.com)<10256><LsrOdL2J3uisCqP7>: Error: Mailbox INBOX: UID=208: read(/home/vpopmail/domains/italy1.com/xxxxx/Maildir/cur/1154731221.9257.az… failed: Cached message size smaller than expected (26421 < 26511, box=INBOX, UID=208) (read reason=mail stream) May 25 15:01:27 imap(xxxxxx(a)italy1.com)<10256><LsrOdL2J3uisCqP7>: Error: Corrupted record in index cache file /home/vpopmail/domains/italy1.com/xxxxx/Maildir/dovecot.index.cache: UID 208: Broken physical size in mailbox INBOX: read(/home/vpopmail/domains/italy1.com/xxxxx/Maildir/cur/1154731221.9257.az… failed: Cached message size smaller than expected (26421 < 26511, box=INBOX, UID=208) May 25 15:01:27 imap(xxxxxx(a)italy1.com)<10256><LsrOdL2J3uisCqP7>: Panic: file istream.c: line 315 (i_stream_read_memarea): assertion failed: (old_size <= _stream->pos - _stream->skip) Can someone tell help on how to fix this issue. Thanks

3 3

Unknown error message
by Jerry 26 May '19

26 May '19

dovecot 2.3.6 (7eab80676) FreeBSD 12.0-RELEASE-p5 amd64 I have recently been finding error messages similar to the following in my Dovecot log file: May 26 06:58:32 imap(gerard(a)seibercom.net)<87791><WvXT+LyJHBCubeH6>: Error: stat(/var/mail/vmail/seibercom.net/gerard/.dovecot.sieve/tmp) failed: Not a directory The message is correct as there is no such directory. The question is why has it suddenly started appearing? I checked my maillog file, and there are no messages being transmitted to Dovecot when that error message is created. Neither is there any mail with that ID number either. Could this be someone attempting to hack into my system? Thanks! -- Jerry

2 1

Automatically subscribe to the INBOX folder
by glts 26 May '19

26 May '19

Hello, I am using the ‘auto = subscribe’ feature in the mailbox configuration section in the usual fashion (as shown in conf.d/15-mailboxes.conf): namespace inbox { inbox = yes mailbox Drafts { special_use = \Drafts auto = subscribe } ... } When I connect to an account with the Thunderbird mail client, those mailboxes/folders get autocreated and autosubscribed. Good! INBOX, however, does not get subscribed to automatically. When I look at the account’s subscriptions in Thunderbird, all folders are subscribed, except INBOX. How can I enable autosubscribe for the INBOX folder (like the other folders)? Is there an option for this? This is in Dovecot 2.2.22. Cheers, David

2 1

Workaround for infinite loop in XCLIENT command bug
by mabi 26 May '19

26 May '19

Hello, I am running Dovecot 2.3.5 package on OpenBSD 6.5 and it looks like this bug which has been fixed in 2.3.6 is hitting me: lib-smtp: client: Fix infinite loop in XCLIENT command interaction with server https://github.com/dovecot/core/commit/5d03f39b345127b80d145ee90772739baa7a… so I was wondering if there is any workarounds? Maybe like disabling the XCLIENT command from the config file or something similar? My original post regarding this issue is here: https://www.mail-archive.com/misc@opensmtpd.org/msg04362.html I first thought this was an OpenSMTPD issue but it seems to be that Dovecot bug. Cheers, Mabi

3 6

Dovecot multiple passdb and fail2ban
by Joaquin F 26 May '19

26 May '19

Objective: different password for remote and local imap login Version: 2.2.36 (1f10bfa63) on CentOS 7 Users are from Active Directory, mapped to local users via sssd After much experimentation, I have configured this way: doveconf -n passdb userdb passdb { args = username_format=%Ln /etc/dovecot/remote driver = passwd-file skip = authenticated username_filter = user01 user02 } passdb { driver = pam override_fields = allow_nets=127.0.0.0/8,192.168.1.0/24 skip = authenticated } userdb { driver = passwd } If I put the passdb's in the reverse order, I would get failure messages (when logging in remotely) in /var/log/secure, such as: auth: pam_sss(dovecot:auth): authentication failure; logname= uid=0 euid=0 tty=dovecot ruser=user02 rhost=xx.xx.xx.xx user=user02 Which caused fail2ban to ban that ip /etc/fail2ban/jail.local [dovecot] enabled = true port = imap,imaps If I set "auth_verbose = yes", then I can see messages in (when logging in locally) in /var/log/maillog dovecot: auth: passwd-file(user02,192.168.1.20,<Na/7f8WJC8HAqAEU>): Password mismatch which is probably not a big deal... but seems inefficient? Question: is there a more elegant way to use different passdb depending on ip? Thanks in advance.

1 0

Imap reverse / proxy in front of our clients machines.
by Brent Clark 25 May '19

25 May '19

Good day Guys I have a user story have an imap reverse / proxy in front of our clients servers. Im currently using the following sources for information. https://wiki.failover.de/Email/Dovecot/IMAP/Proxy/ https://gist.github.com/rplessl/dd56d05c84f988706418 https://wiki2.dovecot.org/PasswordDatabase/ExtraFields/Proxy In my vagrant instance, dovecot can connect to the the remote server You can see my debugging and conf: https://pastebin.com/raw/H2AL53Fz https://pastebin.com/raw/hZHSHvcu If anyone can assist it would be greatly appreciated. Many thanks Regards Brent

1 0

Race condition in IMAP NOTIFY for events received NOTIFY_DELAY_MSECS apart
by Guilhem Moulin 25 May '19

25 May '19

Hi there, There seem to be a race condition in IMAP NOTIFY: when two events for the SELECTED mailbox are received soon after one another, sometimes only the first one is being reported to clients that enabled IMAP NOTIFY. On closer look it seems like this is most often reproducible when the delay between the two events is NOTIFY_DELAY_MSECS (500ms). This is with 2.3.4.1 from Debian sid. $ sed -r 's/^\s*//; s/\s+/ /g' >/tmp/dovecot.conf <<-EOF log_path = /tmp/dovecot.log mailbox_list_index = yes mail_home = /dev/shm/dovecot-test/%u mail_location = dbox:~/mail ssl = no EOF (`doveconf -c /tmp/dovecot.conf -n` output enclosed.) $ rm -rf /dev/shm/dovecot-test && mkdir -m0700 /dev/shm/dovecot-test $ env -i USER=user HOME=/dev/shm/dovecot-test/user PATH=/usr/bin:/bin \ doveadm -c /tmp/dovecot.conf exec imap S: * PREAUTH [CAPABILITY IMAP4rev1 … NOTIFY] Logged in as user C: a NOTIFY SET STATUS (SELECTED (MessageNew MessageExpunge FlagChange)) (MAILBOXES (INBOX test) (MessageNew MessageExpunge FlagChange)) S: * STATUS INBOX (MESSAGES 0 UIDNEXT 1 UIDVALIDITY 1558785754 UNSEEN 0 HIGHESTMODSEQ 1) S: a OK NOTIFY completed (0.004 + 0.000 + 0.003 secs). S: * STATUS INBOX (MESSAGES 0 UIDNEXT 1 UIDVALIDITY 1558785754 UNSEEN 0 HIGHESTMODSEQ 1) C: b SELECT INBOX […] S: b OK [READ-WRITE] Select completed (0.001 + 0.000 secs). Now deliver two messages to INBOX with ~500ms in between: $ env -i USER=user HOME=/dev/shm/dovecot-test/user PATH=/usr/bin:/bin sh -c \ 'echo -n . | doveadm -c /tmp/dovecot.conf exec dovecot-lda -e -m INBOX; \ sleep 0.500; \ echo -n . | doveadm -c /tmp/dovecot.conf exec dovecot-lda -e -m INBOX' Only the the first message is reported in the above IMAP session: S: * 1 EXISTS S: * 1 RECENT An UNSELECT doesn't trigger the notification, but (of course) a NOOP does: C: c NOOP S: * 2 EXISTS S: * 2 RECENT S: c OK NOOP completed (0.001 + 0.000 secs). Similarly, for two flag changes within 0.5s only the first is recorded: $ env -i USER=user HOME=/dev/shm/dovecot-test/user PATH=/usr/bin:/bin sh -c \ 'doveadm -c /tmp/dovecot.conf flags add "\\Seen" mailbox INBOX 1; \ sleep 0.500; \ doveadm -c /tmp/dovecot.conf flags add "\\Answered" mailbox INBOX 2' yields a single unsolicited FETCH response: S: * 1 FETCH (MODSEQ (4) FLAGS (\Seen \Recent)) AFAICT this is only reproducible in the ‘SELECTED’ mailbox specifier: after creating a mailbox "test", $ env -i USER=user HOME=/dev/shm/dovecot-test/user PATH=/usr/bin:/bin sh -c \ 'echo -n . | doveadm -c /tmp/dovecot.conf exec dovecot-lda -e -m test; \ sleep 0.500; \ echo -n . | doveadm -c /tmp/dovecot.conf exec dovecot-lda -e -m test' yields two unsolicited STATUS responses as expected: * STATUS test (MESSAGES 1 UIDNEXT 2 UIDVALIDITY 1558787038 UNSEEN 1 HIGHESTMODSEQ 2) * STATUS test (MESSAGES 2 UIDNEXT 3 UIDVALIDITY 1558787038 UNSEEN 2 HIGHESTMODSEQ 3) (And same thing for two flag updates in the "test" mailbox.) This is not specific to INBOX as once "test" is selected the same problem arises. AFAICT the race is in ‘src/lib-storage/list/mailbox-list-index-notify.c’ which for some reason doesn't acknowledge ST_CHANGED() after inotify_rm_watch(), but I couldn't get my head around that file. Cheers, -- Guilhem.

1 0

SIGABRT on fetching mail
by Peter Nabbefeld 24 May '19

24 May '19

Hello, I'm running dovecot with getmail for several months already, but today it's always crashing: "getmailrc: operation error (child pid 2995 killed by signal 6)". The deliver process aborts due to an unknown reason. > tail /var/log/dovecot-info.log May 24 12:10:28 imap-login: Info: Login: user=<peter.nabbefeld(a)gmx.de>, method=PLAIN, rip=::1, lip=::1, mpid=2970, secured, session=<n/dfaJ+JuIMAAAAAAAAAAAAAAAAAAAAB> May 24 12:10:49 lda(peter.nabbefeld(a)gmx.de)<2994><kCP3FifD51yyCwAA7IIYzw>: Info: sieve: msgid=<318D121B-37FC-4E8C-B4B8-93C87E0692B8(a)gmx.de>: stored mail into mailbox 'Gesendet' May 24 15:14:30 imap-login: Info: Login: user=<peter.nabbefeld(a)gmx.de>, method=PLAIN, rip=::1, lip=::1, mpid=6304, secured, session=<+Rae+qGJ4IUAAAAAAAAAAAAAAAAAAAAB> May 24 15:14:31 imap(peter.nabbefeld(a)gmx.de)<6304><+Rae+qGJ4IUAAAAAAAAAAAAAAAAAAAAB>: Info: Connection closed (append finished 0.562 secs ago) in=157758 out=520 deleted=0 expunged=0 trashed=0 hdr_count=0 hdr_bytes=0 body_count=0 body_bytes=0 May 24 15:14:37 imap-login: Info: Login: user=<peter.nabbefeld(a)gmx.de>, method=PLAIN, rip=::1, lip=::1, mpid=6307, secured, session=<MjwD+6GJ4oUAAAAAAAAAAAAAAAAAAAAB> May 24 15:55:28 imap-login: Info: Login: user=<peter.nabbefeld(a)gmx.de>, method=PLAIN, rip=::1, lip=::1, mpid=7205, secured, session=<T9ofjaKJgIYAAAAAAAAAAAAAAAAAAAAB> May 24 15:57:00 imap-login: Info: Login: user=<peter.nabbefeld(a)gmx.de>, method=PLAIN, rip=::1, lip=::1, mpid=7254, secured, session=<nT6XkqKJhIYAAAAAAAAAAAAAAAAAAAAB> May 24 16:08:22 imap-login: Info: Login: user=<peter.nabbefeld(a)gmx.de>, method=PLAIN, rip=::1, lip=::1, mpid=7507, secured, session=<LI40u6KJJIcAAAAAAAAAAAAAAAAAAAAB> May 24 16:16:40 imap(peter.nabbefeld(a)gmx.de)<6307><MjwD+6GJ4oUAAAAAAAAAAAAAAAAAAAAB>: Info: Connection closed (IDLE running for 0.001 + waiting input for 0.001 secs, 2 B in + 10 B out, state=wait-input) in=4251 out=137885 deleted=0 expunged=0 trashed=0 hdr_count=1 hdr_bytes=661 body_count=0 body_bytes=0 May 24 16:16:54 imap-login: Info: Login: user=<peter.nabbefeld(a)gmx.de>, method=PLAIN, rip=::1, lip=::1, mpid=7662, secured, session=<zV++2aKJOIcAAAAAAAAAAAAAAAAAAAAB> > tail /var/log/dovecot.log May 24 11:25:33 master: Warning: Killed with signal 15 (by pid=12275 uid=0 code=kill) May 24 11:25:35 log(660): Warning: Killed with signal 15 (by pid=1 uid=0 code=kill) May 24 12:10:47 lda(peter.nabbefeld(a)gmx.de)<2994><kCP3FifD51yyCwAA7IIYzw>: Warning: Failed to parse return-path header May 24 12:10:50 lda(peter.nabbefeld(a)gmx.de)<2995><hco1BirD51yzCwAA7IIYzw>: Panic: file istream-crlf.c: line 24 (i_stream_crlf_read_common): assertion failed: (ret != -2) May 24 12:10:50 lda(peter.nabbefeld(a)gmx.de)<2995><hco1BirD51yzCwAA7IIYzw>: Error: Raw backtrace: /usr/lib/dovecot/libdovecot.so.0(+0xeee14) [0x7fd668defe14] -> /usr/lib/dovecot/libdovecot.so.0(+0xeee51) [0x7fd668defe51] -> /usr/lib/dovecot/libdovecot.so.0(+0x46268) [0x7fd668d47268] -> /usr/lib/dovecot/libdovecot.so.0(+0x4892e) [0x7fd668d4992e] -> /usr/lib/dovecot/libdovecot.so.0(+0x1004e6) [0x7fd668e014e6] -> /usr/lib/dovecot/libdovecot.so.0(i_stream_read_memarea+0x81) [0x7fd668dfd681] -> /usr/lib/dovecot/libdovecot.so.0(i_stream_read+0x36) [0x7fd668dfd8a6] -> /usr/lib/dovecot/libdovecot.so.0(+0x1058f8) [0x7fd668e068f8] -> /usr/lib/dovecot/libdovecot.so.0(i_stream_read_memarea+0x81) [0x7fd668dfd681] -> /usr/lib/dovecot/libdovecot.so.0(i_stream_read+0x36) [0x7fd668dfd8a6] -> /usr/lib/dovecot/libdovecot.so.0(i_stream_read_data+0x4c) [0x7fd668dfe33c] -> /usr/lib/dovecot/libdovecot.so.0(io_stream_copy+0x8a) [0x7fd668e18aba] -> /usr/lib/dovecot/libdovecot.so.0(+0x119ac2) [0x7fd668e1aac2] -> /usr/lib/dovecot/libdovecot.so.0(o_stream_send_istream+0x4f) [0x7fd668e1874f] -> /usr/lib/dovecot/libdovecot-storage.so.0(index_storage_save_continue+0x2e) [0x7fd668f981ee] -> /usr/lib/dovecot/libdovecot-storage.so.0(maildir_save_continue+0x27) [0x7fd668f36887] -> /usr/lib/dovecot/libdovecot-storage.so.0(mailbox_save_continue+0x44) [0x7fd668f083f4] -> /usr/lib/dovecot/libdovecot-storage.so.0(mail_storage_copy+0xf8) [0x7fd668ef9828] -> /usr/lib/dovecot/libdovecot-storage.so.0(maildir_copy+0x59) [0x7fd668f32639] -> /usr/lib/dovecot/libdovecot-lda.so.0(+0x3d5c) [0x7fd66902ad5c] -> /usr/lib/dovecot/modules/lib20_fts_plugin.so(+0x10eec) [0x7fd668a90eec] -> /usr/lib/dovecot/libdovecot-storage.so.0(+0x58981) [0x7fd668f08981] -> /usr/lib/dovecot/libdovecot-sieve.so.0(+0x4e6df) [0x7fd66676e6df] -> /usr/lib/dovecot/libdovecot-sieve.so.0(sieve_result_execute+0x4e5) [0x7fd666764065] -> /usr/lib/dovecot/libdovecot-sieve.so.0(+0x57259) [0x7fd666777259] -> /usr/lib/dovecot/libdovecot-sieve.so.0(sieve_multiscript_run+0xa2) [0x7fd6667783f2] -> /usr/lib/dovecot/modules/lib90_sieve_plugin.so(+0x3d45) [0x7fd668cecd45] -> /usr/lib/dovecot/libdovecot-lda.so.0(mail_deliver+0xf9) [0x7fd66902c229] How can I find out which message is causing the crash? It would be very helpful, if the message's subject and receipt time could be logged in case of an abort or anything else that could help identify the corrupt message. This would also enable me to send You the message for further investigation (if appropriate). Kind regards Peter

1 0

Panic: file mail-index-util.c: line 10 (mail_index_uint32_to_offset): assertion failed: (offset < 0x40000000)
by Ralf Hildebrandt 24 May '19

24 May '19

I'm encountering a crash which this command: % doveadm import -u restore(a)backup.invalid mdbox:/home/copymail2/mdbox '' mailbox INBOX header X-Spam Yes SAVEDBEFORE 2019-05-23 doveadm(restore(a)backup.invalid): Panic: file mail-index-util.c: line 10 (mail_index_uint32_to_offset): assertion failed: (offset < 0x40000000) doveadm(restore(a)backup.invalid): Error: Raw backtrace: /usr/lib/dovecot/libdovecot.so.0(+0xd9f9e) [0x7fbc52ba7f9e] -> /usr/lib/dovecot/libdovecot.so.0(+0xd9fe1) [0x7fbc52ba7fe1] -> /usr/lib/dovecot/libdovecot.so.0(i_fatal+0) [0x7fbc52b0cc54] -> /usr/lib/dovecot/libdovecot-storage.so.0(mail_index_uint32_to_offset+0x78)[0x7fbc52f525e8] -> /usr/lib/dovecot/libdovecot-storage.so.0(mail_cache_add+0x83b)[0x7fbc52f3ac2b] -> /usr/lib/dovecot/libdovecot-storage.so.0(index_mail_parse_header+0x449)[0x7fbc52f1c969] -> /usr/lib/dovecot/libdovecot.so.0(+0xb6af9) [0x7fbc52b84af9] -> /usr/lib/dovecot/libdovecot.so.0(i_stream_read_memarea+0x7a) [0x7fbc52bb531a] -> /usr/lib/dovecot/libdovecot.so.0(i_stream_read+0x2f) [0x7fbc52bb565f] -> /usr/lib/dovecot/libdovecot.so.0(i_stream_read_data+0x3d)[0x7fbc52bb604d] -> /usr/lib/dovecot/libdovecot.so.0(message_parse_header_next+0x68)[0x7fbc52b8b3f8] -> /usr/lib/dovecot/libdovecot.so.0(message_parse_header+0x52)[0x7fbc52b8bdd2] -> /usr/lib/dovecot/libdovecot-storage.so.0(+0xcadae) [0x7fbc52f26dae] -> /usr/lib/dovecot/libdovecot-storage.so.0(+0xcc0ac) [0x7fbc52f280ac] -> /usr/lib/dovecot/libdovecot-storage.so.0(index_storage_search_next_nonblock+0x11d)[0x7fbc52f288bd] -> /usr/lib/dovecot/libdovecot-storage.so.0(mailbox_search_next_nonblock+0x28)[0x7fbc52ea92e8] -> /usr/lib/dovecot/libdovecot-storage.so.0(mailbox_search_next+0x3d)[0x7fbc52ea934d] -> doveadm(+0x31443) [0x5635b4760443] -> doveadm(+0x2bdb1) [0x5635b475adb1] -> doveadm(+0x2caf9) [0x5635b475baf9] -> doveadm(doveadm_cmd_ver2_to_mail_cmd_wrapper+0x20e) [0x5635b475c9ce] -> doveadm(doveadm_cmd_run_ver2+0x55e) [0x5635b476db7e] -> doveadm(doveadm_cmd_try_run_ver2+0x37) [0x5635b476dbd7] -> doveadm(main+0x1d1) [0x5635b474aec1] -> /lib/x86_64-linux-gnu/libc.so.6(__libc_start_main+0xe7) [0x7fbc5210fb97] -> doveadm(_start+0x2a) [0x5635b474b39a] Version info: ii dovecot-core 2:2.3.6-2~bionic amd64 secure POP3/IMAP server - core files ii dovecot-dbg 2:2.3.6-2~bionic amd64 secure POP3/IMAP server - debug symbols ii dovecot-imapd 2:2.3.6-2~bionic amd64 secure POP3/IMAP server - IMAP daemon ii dovecot-lmtpd 2:2.3.6-2~bionic amd64 secure POP3/IMAP server - LMTP server Backtrace: Program received signal SIGABRT, Aborted. __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:51 51../sysdeps/unix/sysv/linux/raise.c: No such file or directory. (gdb) bt #0 __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:51 #1 0x00007ffff68fa801 in __GI_abort () at abort.c:79 #2 0x00007ffff7373f51 in default_fatal_finish (status=0, type=LOG_TYPE_PANIC) at failures.c:459 #3 fatal_handler_real (ctx=<optimized out>, format=<optimized out>, args=<optimized out>) at failures.c:471 #4 0x00007ffff7373fe1 in default_fatal_handler (ctx=<optimized out>, format=<optimized out>, args=<optimized out>) at failures.c:479 #5 0x00007ffff72d8c54 in i_panic (format=format@entry=0x7ffff772e440 "file %s: line %d (%s): assertion failed: (%s)") at failures.c:523 #6 0x00007ffff771e5e8 in mail_index_uint32_to_offset (offset=<optimized out>) at mail-index-util.c:10 #7 0x00007ffff7706c2b in mail_cache_header_fields_write (ctx=0x55555583d960, buffer=<optimized out>, buffer=<optimized out>) at mail-cache-transaction.c:609 #8 mail_cache_header_add_field (field_idx=15, ctx=0x55555583d960) at mail-cache-transaction.c:690 #9 mail_cache_add (ctx=0x55555583d960, seq=1, field_idx=field_idx@entry=15, data=0x7ffff773ba56, data_size=0) at mail-cache-transaction.c:739 #10 0x00007ffff76eafdc in index_mail_cache_add_idx (mail=mail@entry=0x55555583e2f8, field_idx=field_idx@entry=15, data=data@entry=0x7ffff773ba56, data_size=data_size@entry=0) at index-mail.c:621 #11 0x00007ffff76e8969 in index_mail_parse_header_finish (mail=<optimized out>) at index-mail-headers.c:132 #12 index_mail_parse_header (part=<optimized out>, hdr=<optimized out>, mail=<optimized out>) at index-mail-headers.c:312 #13 0x00007ffff7350af9 in read_header (mstream=0x55555584b7f0) at istream-header-filter.c:357 #14 i_stream_header_filter_read (stream=0x55555584b7f0) at istream-header-filter.c:447 #15 0x00007ffff738131a in i_stream_read_memarea (stream=stream@entry=0x55555584b870) at istream.c:313 #16 0x00007ffff738165f in i_stream_read (stream=stream@entry=0x55555584b870) at istream.c:271 #17 0x00007ffff738204d in i_stream_read_data (stream=0x55555584b870, data_r=data_r@entry=0x7fffffffdbe8, size_r=size_r@entry=0x7fffffffdbf0, threshold=threshold@entry=1) at istream.c:745 #18 0x00007ffff73573f8 in i_stream_read_bytes (wanted=2, size_r=0x7fffffffdbf0, data_r=0x7fffffffdbe8, stream=<optimized out>) at ../../src/lib/istream.h:217 #19 message_parse_header_next (ctx=0x55555584ca70, hdr_r=hdr_r@entry=0x7fffffffdc50) at message-header-parser.c:85 #20 0x00007ffff7357dd2 in message_parse_header (input=<optimized out>, hdr_size=hdr_size@entry=0x0,flags=flags@entry=MESSAGE_HEADER_PARSER_FLAG_CLEAN_ONELINE, callback=callback@entry=0x7ffff76f2310 <search_header>, context=context@entry=0x7fffffffdcc0) at message-header-parser.c:392 #21 0x00007ffff76f2dae in search_arg_match_text (ctx=0x55555583dd20, args=0x555555809690) at index-search.c:760 #22 search_match_once (ctx=0x55555583dd20) at index-search.c:1400 #23 0x00007ffff76f40ac in search_match_next (ctx=0x55555583dd20) at index-search.c:1507 #24 search_more_with_mail (mail=<optimized out>, ctx=0x55555583dd20) at index-search.c:1624 #25 search_more_with_prefetching (mail_r=<optimized out>, ctx=<optimized out>) at index-search.c:1706 #26 search_more (ctx=ctx@entry=0x55555583dd20, mail_r=mail_r@entry=0x7fffffffddf0) at index-search.c:1780 #27 0x00007ffff76f48bd in index_storage_search_next_nonblock(_ctx=0x55555583dd20, mail_r=0x7fffffffdec0, tryagain_r=0x7fffffffde57) at index-search.c:1808 #28 0x00007ffff76752e8 in mailbox_search_next_nonblock (ctx=0x55555583dd20, mail_r=0x7fffffffdec0, tryagain_r=<optimized out>) at mail-storage.c:2141 #29 0x00007ffff767534d in mailbox_search_next (ctx=0x55555583dd20, mail_r=mail_r@entry=0x7fffffffdec0) at mail-storage.c:2126 #30 0x0000555555586682 in doveadm_mail_iter_next (iter=<optimized out>, mail_r=mail_r@entry=0x7fffffffdec0) at doveadm-mail-iter.c:160 #31 0x0000555555585443 in cmd_import_box (search_args=<optimized out>, info=0x555555832118, dest_user=<optimized out>, ctx=0x555555807d78) at doveadm-mail-import.c:142 #32 cmd_import_run (_ctx=0x555555807d78, user=0x55555581c688) at doveadm-mail-import.c:202 #33 0x000055555557fdb1 in doveadm_mail_next_user (ctx=ctx@entry=0x555555807d78, error_r=error_r@entry=0x7fffffffe0a0) at doveadm-mail.c:462 #34 0x0000555555580a0b in doveadm_mail_single_user (ctx=ctx@entry=0x555555807d78, error_r=error_r@entry=0x7fffffffe0a0) at doveadm-mail.c:492 #35 0x0000555555580af9 in doveadm_mail_cmd_exec (ctx=ctx@entry=0x555555807d78, wildcard_user=wildcard_user@entry=0x0) at doveadm-mail.c:653 #36 0x00005555555819ce in doveadm_cmd_ver2_to_mail_cmd_wrapper (cctx=<optimized out>) at doveadm-mail.c:1144 #37 0x0000555555592b7e in doveadm_cmd_run_ver2 (argc=12, argv=0x5555557f5ae8, cctx=cctx@entry=0x7fffffffe290) at doveadm-cmd.c:574 #38 0x0000555555592bd7 in doveadm_cmd_try_run_ver2 (cmd_name=<optimized out>, argc=<optimized out>, argv=<optimized out>, cctx=0x7fffffffe290) at doveadm-cmd.c:496 #39 0x000055555556fec1 in main (argc=<optimized out>, argv=<optimized out>) at doveadm.c:391 -- Ralf Hildebrandt Geschäftsbereich IT | Abteilung Netzwerk Charité - Universitätsmedizin Berlin Campus Benjamin Franklin Hindenburgdamm 30 | D-12203 Berlin Tel. +49 30 450 570 155 | Fax: +49 30 450 570 962 ralf.hildebrandt(a)charite.de | https://www.charite.de

2 2

MailCrypt plugin questions
by MRob 24 May '19

24 May '19

I read the mailcrypt plugin document on the wiki and had couple questions. 1. If I want per-user encryption am I correct I should configure global keys with all related settings override in the userdb lookup? 2. If I do not want to encrypt some user accounts, is it enough to omit the mail_crypt_global_private_key from the userdb lookup? In other word, mail_plugins still active with mail_crypt, will that cause user account to be encrypted unexpectedly if no private key is given? 3. Example command to create EC key does not ask for password, openssl ecparam command does not seem to have password arg. If I want password-protection should I use RSA key which the doc tell to be discouraged?

1 1

Re: Catch all for dovecot authentication?
by Joseph Tam 24 May '19

24 May '19

> as stated by Aki > > > passdb { > > driver = static > > args = nopassword > >} > > works fine and does what I want: accept any SMTP AUTH :-) (Brings back memories of good fun I had with patched Qpopper snare feeding custom messages to the hacker.) Another alternative is to use the checkpassword hook that will accept any username/password. The advantage is you can do post-analysis of credentials as the script has access to them. Joseph Tam <jtam.home(a)gmail.com>

1 0

Catch all for dovecot authentication?
by Tobi 23 May '19

23 May '19

Hi I'm aware that there are several good reasons not to do what I want, but in my use-case it would be an interesting feature. So please no discussions about the reasonableness I have some spamtrap SMTP servers (postfix). Currently SMTP AUTH is disabled. But as I daily have thousands of AUTH tries I thought it would be nice to be able to accept any AUTH request from postfix in dovecot. Is something like this possible with dovecot? If so any good description available on how to achieve? Thanks -- tobi

4 5

How to get original recipient from Postfix when using LMTP?
by MRob 22 May '19

22 May '19

Many people prefer to use LMTP for delivery from postfix for better efficiency but X-Original-to header support still missing after many years. One affect of this is need to set sieve_vacation_dont_check_recipient = yes which violate Sieve standard and cause auto-replyies sent to messages that should not happen. Or abandon LMTP. or abandon postfix?? So while feature request is stalled are there any realistic workarounds?

3 3

weakforced: Possible to access the ip address of report/allow?
by Tobi 22 May '19

22 May '19

Hi I wonder if the information about the origin of report or allow can be accessed somehow. lt.remote gives the IP of the client trying to login but is there anything in lt which gives the ip of the system that connects to wforced? Thanks and have a good one -- tobi

2 3

lmtp report permission denied on delivery to multiple recipients
by Patrick Cernko 22 May '19

22 May '19

Hello, when receiving mails for multiple recipients via LMTP, I often see the following messages on our servers: > May 22 11:06:10 sinon dovecot[44304]: lmtp(119718): Connect from $IP$ > May 22 11:06:11 sinon dovecot[44304]: lmtp($USER1$)<119718><2HnmOgIR5Vym0wEA22L5Rg>: msgid=<$MSGID$>: saved mail to INBOX > May 22 11:06:11 sinon dovecot[44304]: lmtp($USER2$)<119718><2HnmOgIR5Vym0wEA22L5Rg:2>: Error: stat(/IMAP/mail/mailboxes/$USER1$/mdbox/mailboxes/INBOX/dbox-Mails/dovecot.index.cache) failed: Permission denied (euid=$UID2$($USER2$) egid=$GID2$(rbg) missing +x perm: /IMAP/mail/mailboxes/$USER1$, dir owned by $UID1$:$GID2$ mode=0700) > May 22 11:06:11 sinon dovecot[44304]: lmtp($USER2$)<119718><2HnmOgIR5Vym0wEA22L5Rg:2>: Error: open(/IMAP/mail/mailboxes/$USER1$/mdbox/mailboxes/INBOX/dbox-Mails/dovecot.index.cache) failed: Permission denied (euid=$UID2$($USER2$) egid=$GID2$(rbg) missing +x perm: /IMAP/mail/mailboxes/$USER1$, dir owned by $UID1$:$GID2$ mode=0700) > May 22 11:06:11 sinon dovecot[44304]: lmtp($USER2$)<119718><2HnmOgIR5Vym0wEA22L5Rg:2>: Error: lstat(/IMAP/mail/mailboxes/$USER1$/mdbox/mailboxes/INBOX/dbox-Mails/dovecot.index.cache.lock) failed: Permission denied > May 22 11:06:11 sinon dovecot[44304]: lmtp($USER2$)<119718><2HnmOgIR5Vym0wEA22L5Rg:2>: Error: file_dotlock_open(/IMAP/mail/mailboxes/$USER1$/mdbox/mailboxes/INBOX/dbox-Mails/dovecot.index.cache) failed: Permission denied (euid=$UID2$($USER2$) egid=$GID2$(rbg) missing +x perm: /IMAP/mail/mailboxes/$USER1$, dir owned by $UID1$:$GID2$ mode=0700) > May 22 11:06:11 sinon dovecot[44304]: lmtp($USER2$)<119718><2HnmOgIR5Vym0wEA22L5Rg:2>: Error: open(/IMAP/mail/mailboxes/$USER1$/mdbox/mailboxes/INBOX/dbox-Mails/dovecot.index.cache) failed: Permission denied (euid=$UID2$($USER2$) egid=$GID2$(rbg) missing +x perm: /IMAP/mail/mailboxes/$USER1$, dir owned by $UID1$:$GID2$ mode=0700) > May 22 11:06:11 sinon dovecot[44304]: lmtp($USER2$)<119718><2HnmOgIR5Vym0wEA22L5Rg:2>: 2HnmOgIR5Vym0wEA22L5Rg:2: sieve: msgid=<$MSGID$>: stored mail into mailbox 'INBOX' > May 22 11:06:11 sinon dovecot[44304]: lmtp(119718): Disconnect from $IP$: Successful quit (usernames, uids, gids and IP addresses anonymized) So far, I was not able to reproduce this issue on a simple test setup, but I have the strong impression, that is has something to do with the fact, if some of the affected users have a active sieve script and others do not use sieve. In the example above $USER1$ did not have a sieve script configured but $USER2$ had one, as you can see. As a workaround, I configured an empty sieve script for all users with out sieve configured. This seems to work but actually I do not want to have users with empty sieve scripts. This bug seems to be related to https://dovecot.org/list/dovecot/2013-February/088540.html where Timo stated: "LMTP always delivers the mail to the first user. Then it tries to copy the first mail to the second user, because in some setups this can be done using hard links. With mbox that of course doesn't work, but looks like instead of failing silently it logs an error. So everything is working as it should, except there are these unnecessary errors logged. I'll see about getting rid of them." Is it possible to get rid of these error messages, either by a config setting that prevents if they do not lead to a real problem or by changing the code to avoid the behaviour described by Timo? Attached you can find doveconf -n output and the used ldap.conf (both anonymized), the referenced /etc/dovecot/passdb.deny and /etc/dovecot/userdb.overrides are usually empty files and only used during mailbox migrations. Best regards, -- Patrick Cernko <pcernko(a)mpi-klsb.mpg.de> +49 681 9325 5815 Joint Administration: Information Services and Technology Max-Planck-Institute fuer Informatik & Softwaresysteme

1 0

Integrity check mdbox?
by Marc Roos 22 May '19

22 May '19

Is it possible to do some sort of integrity check on mdbox's

2 1

Converting user mailboxes from maildir to sdbox
by David Mehler 22 May '19

22 May '19

Hello, I've got a Postfix/Dovecot server setup. Currently Dovecot is version 2.3.6, and it's using Maildir storage. The mailbox is: mail_home = /home/vmail/mailboxes/%d/%n mail_location = maildir:~/mail:LAYOUT=fs I'm wanting to convert from Maildir to sdbox. I looked at: https://wiki2.dovecot.org/MailboxFormat I was initially thinking mdbox but that's multiple messages per file, which I do not believe is what I want. Am I correct that in the sdbox format if a single message file is corrupted only that message is corrupt and not the rest of the messages as would be the case in a mdbox setup? On the page: https://wiki2.dovecot.org/Migration/MailFormat " maildir -> sdbox migration. Set mail_location=sdbox:~/sdbox and run dsync -u username mirror maildir:~/Maildir " If I set mail_location=sdbox:~/sdbox will that put the user mailboxes in mail_home/sdbox? So it would be: /home/vmail/mailboxes/example.com/username/sdbox I am needing to do this migration, but am paranoid about loosing mail or corrupting mailboxes. All of my users are virtual users and they are stored in a mysql database. Thanks. Dave.

2 1

[mail-crypt-plugin] How to decrypt mailbox?
by emordin 22 May '19

22 May '19

How do I enable the mail-crypt-plugin globally? Do I have to place 'mail_plugins = $mail_plugins mail_crypt' inside ever conf.d file where there is a protocol code block? Like for example the protocol lda codeblock in 15-lda.conf and the protocol imap codeblock in 20-imap.conf I placed 'mail_plugins = $mail_plugins mail_crypt' in 20-lmtp.conf inside the protocol lmtp code block, and the actual plugin settings are inside 90-plugin.conf inside the plugin codeblock. And I was able to get CRYPTED mail with this config. If I place 'mail_plugins = $mail_plugins mail_crypt' inside 90-plugin.conf, I get an error telling me to put 'mail_plugins = $mail_plugins mail_crypt' in 20-lmtp.conf Sent with [ProtonMail](https://protonmail.com) Secure Email.

2 1

Problems after upgrade from 2.2 to 2.3
by Lampa 21 May '19

21 May '19

Hello, i was using dovecot version 2.2 on debian server. After upgrade to debian version 2.3 i have problems. After some time imap doesn't work. There are lot of messages in log 2019-05-21T10:27:49.186373+02:00 hermes dovecot: imap-login: Error: master(imap): net_connect_unix(imap) failed: Resource temporarily unavailable - http://wiki2.dovecot.org/SocketUnavailable (client-pid=24810, client-id=148, rip=2.2.2.2, created 551 msecs ago, received 0/4 bytes) 2019-05-21T10:27:50.808136+02:00 hermes dovecot: imap-login: Error: master(imap): net_connect_unix(imap) failed: Resource temporarily unavailable - http://wiki2.dovecot.org/SocketUnavailable (client-pid=24810, client-id=169, rip=2.2.2.2, created 531 msecs ago, received 0/4 bytes) Tried client_limit set to 1 , service_count to 1 or 0 , still same results. It's imap server for 3k users. Any suggestions, please let me know. Thank you very much. Regards -- Lampa

1 0

Dovecot with LDAP Proxy
by Federico Bartolucci 21 May '19

21 May '19

Hello, configuring Dovecot with LDAP authentication, adding the parameter in ther sql config file: pass_attrs = \ =proxy=y I see then backend connections always addressed to localhot port 143: /user=utente1(a)domanin.com proxy lip=127.0.0.1 lport=143 / while I expect that connections would be managed by the director and then addressed to my backend IPs and specific port. Is there a way to configure ldap proxy to get that behavior? Thanks in advance. -federico

2 3

Dovecot documentation
by ＠lbutlr 21 May '19

21 May '19

the make config options for dovecot on FreeBSD list list [x] ICU Use libicu for FTS unicode normalization but https://wiki2.dovecot.org/Plugins/FTS makes no mention of libicu (nor of icu at all). is linicu simply in addition to the four options of Solar, Lucene, fts-xapian, and fts-dovecot? Also, the link to fts-dovecot goes to https://wiki2.dovecot.org/Plugins/FTS/Dovecot which is a 404. -- Man is born free, but is everywhere in chains.

1 0

[mail-crypt-plugin] How to decrypt mailbox?
by emordin 21 May '19

21 May '19

Hi, So I am able to encrypt email using the crypt plugin, but when I try to access the email by logging in thru mutt or roundcube the email is still encrypted. Is the decryption process automatic or do I have to create a custom program with the decrypt.rb code? Thanks. Sent with [ProtonMail](https://protonmail.com) Secure Email.

2 1

Further issues on FTS engine
by Joan Moreau 20 May '19

20 May '19

Hi, Additionally to the long list of problem on the FTS previously discussed, here a new: WHen I reset the indexes, the indexer-worker seems paralelleizing the indexing (which is good), however, the number available in "ps aux | grep dove" shows that it does not move: dovecot 28549 0.0 0.0 8620 3920 ? S 06:20 0:00 dovecot/indexer [0 clients, 3 requests] mailuse+ 28550 98.6 0.1 167412 86916 ? R 06:20 5:28 dovecot/indexer-worker [jom(a)grosjo.net XXXX - 800/37755] Looking further, if I put a tracer in teh backend, it treats the *same* message several times in parallel, and therefore does not move very fast on the global indexing of the box ANy clue ? THanks

2 1

enforcing multiple per-mailbox quotas for shared mailboxes
by Jost-Philip Matysik 20 May '19

20 May '19

Hi! I'm trying to get quotas for shared mailboxes set up on my server. It's not working, and I fail to understand why. Documentation for setup of this complexity is rather scarce on the web, and the discussions I found either don't directly apply or terminate with "I got it working" but no explanation. Can someone please help? The setup is rather lengthy and complicated, so I'll try to give a summary first for easier understanding. All help is appreciated! Please respond if you need more info! Thanks! Best regards, Jost Basic setup (where am I coming from?): ====================================== - This is a Debian 9 system with a more recent version of dovecot installed from https://repo.dovecot.org/ce-2.3-latest/debian/stretch - users have individual mailboxes with individual quotas -- this works great! - users can share mailboxes with other users through ACLs. To achieve this, there exists a wildcarded namespace with prefix="ZZZ_Freigaben/%%u" --this also works great! ==> up to here it's pretty much following the examples from the Wiki to the letter. Configuration goal (what do I want to achieve?): ================================================ - attach quotas to mailboxes, not logins - when copying/moving mails across shared mailboxes during imap sessions, enforce quota based on target mailbox, not logged-in user doing the copying. To clarify: ==> so if Bob has a quota of 500MB, all messages in Bob's mailbox should count against (and only against!) Bob's quota, regardless of who put them there. ==> if Alice has access to her own mailbox (directly), as well as Bob's mailbox and Dave's mailbox (through sharing), she should see 3 individual quotas when logging in: her own quota (200MB) for everything in her mailbox, bob's quota (300MB) for everything in Bob's mailbox, and Dave's quota (10GB) for everything in Dave's mailbox. These 3 quotas should be completely independant and neither block, nor override each other. Setup Idea (how I tried to get there): ====================================== - "quota=..." "quota_rule" and "quota_rule2" always refer to the user's own mailbox (with an additional rule for Trash). Everyone has those, so these are loaded statically from dovecot config file. - "quota_rule" is overwritten from userdb with the user's individual mailbox quota (the more I like you, the more space you get...) - since the number of different additional quotas required per user depends on how many mailboxes are shared with that user, individual "quota2=...", "quota3=...", "quotaN=..." fields are dynamically generated by the MySQL backend and loaded from userdb upon login. - consequently, for each "quotaN=..." entry, a corresponding "quotaN_rule=*:storage=XXX" is generated and returned from userdb (substitute N=1,2,3,4,... accordingly) Observations: ============= 1. enforcing quota for the user's personal mailbox works as expected, both through IMAP and when delivering incoming mail 2. overriding "quota_rule=..." from userdb for the user's personal mailbox works great. Individual quota is recognized and enforced both through IMAP and when delivering incoming mail. 3. dynamically loading "quota2=...", "quota3=..." etc. from userdb doesn't seem to work at all! I can see them being added as extra fields in the logs upon user login, but the quota-plugin seems to completely ignore them. They are not enforces, and tools like 'doveadm quota' list the userdb fields in the debug messages, but do not interpret them in any way. They do not throw errors either, the additional quota roots are just silently ignored. 4. the end result is that in an IMAP session the logged-in user's quota is enforced for their individual mailbox, but as soon as they write to someone else's mailbox (move a mail to /ZZZFreigaben/bob/Some-Subfolder), no quota is enforced at all! Additional debugging done: ========================== if I hardcode a "quota2=" and/or "quota3=" in the config file, I can observe the following: - If I hardcode "quota2=count:some_name:ns=ZZZ_Freigaben/", dovecot and doveadm will recognize the additional quota root. But since the folder "ZZZ_Freigaben/" on its own isn't a mailbox (it's just a path CONTAINING mailboxes), the quota is neither displayed in clients, nor enforced. It has no real-word effect, other than 'doveadm quota' showing an additional line. - If I hardcode "quota2=count:other_name:ns=ZZZ_Freigaben/postmaster/" in the config file (with that path being the real IMAP path to a shared mailbox), dovecot will complain in the log saying Error: quota: Unknown namespace: ZZZ_Freigaben/postmaster/ dovecot will start and work for the most part, but again completely ignore settings for the additional quota. - additionally, trying to override "quota2_rule=..." from userdb doesn't work as it does with "quota_rule=..."! If I have both "quota_rule=..." and "quota2_rule=..." in the config file as well as returned from userdb (with different values), dovecot will use "quota_rule" from userdb, but "quota2_rule" from config file. This behavior seems inconsistent! - I tried both maildir and count backends (seperately or mixed). Both show the same behavior. - I tried appending or removing an empty "ns=" to the first "quota=..." entry (the wiki shows some examples with it, some without). Makes no difference... Configuration Dumps below (slightly redacted to remove complete email addresses or IPs) ========================== output of dovecot -n: # 2.3.6 (7eab80676): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.6 (92dc263a) # OS: Linux 4.9.0-9-amd64 x86_64 Debian 9.9 # Hostname: [censored] auth_failure_delay = 10 secs auth_mechanisms = plain login default_vsz_limit = 512 M dict { acl = mysql:/etc/dovecot/dovecot-dict-sql.conf.ext } listen = * lmtp_rcpt_check_quota = yes login_greeting = Mail system ready. mail_gid = vmail mail_location = maildir:~/Maildir mail_plugins = " quota acl" mail_uid = vmail managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext imapsieve vnd.dovecot.imapsieve namespace Freigaben { list = children location = maildir:%%h/Maildir:INDEXPVT=%h/Maildir/Freigaben/%%u prefix = ZZZ_Freigaben/%%u/ separator = / subscriptions = no type = shared } namespace inbox { inbox = yes location = mailbox Drafts { auto = subscribe special_use = \Drafts } mailbox Junk { auto = subscribe autoexpunge = 61 days special_use = \Junk } mailbox Sent { auto = subscribe special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { auto = subscribe autoexpunge = 61 days special_use = \Trash } prefix = separator = / subscriptions = yes type = private } passdb { args = /etc/dovecot/dovecot-sql.conf.username driver = sql } plugin { acl = vfile:/etc/dovecot/dovecot-acl acl_defaults_from_inbox = yes acl_shared_dict = proxy::acl imapsieve_mailbox1_before = file:/etc/dovecot/sieve/learn-spam.sieve imapsieve_mailbox1_causes = COPY imapsieve_mailbox1_name = Junk imapsieve_mailbox2_before = file:/etc/dovecot/sieve/learn-ham.sieve imapsieve_mailbox2_causes = COPY imapsieve_mailbox2_from = Junk imapsieve_mailbox2_name = * quota = count:User quota:ns= quota_grace = 1%% quota_rule = *:storage=5G quota_rule2 = Trash:storage=+100M quota_status_nouser = DUNNO quota_status_overquota = 552 5.2.2 Mailbox is full quota_status_success = DUNNO quota_vsizes = yes sieve = file:~/sieve;active=~/.dovecot.sieve sieve_after = /etc/dovecot/sieve-after sieve_global_extensions = +vnd.dovecot.pipe +vnd.dovecot.environment sieve_max_script_size = 10M sieve_pipe_bin_dir = /etc/dovecot/sieve sieve_plugins = sieve_imapsieve sieve_extprograms sieve_quota_max_storage = 50M } postmaster_address = postmaster(a)matysik-ingenieurwesen.de protocols = " imap lmtp sieve" service auth-worker { user = vmail } service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0660 user = postfix } unix_listener auth-userdb { mode = 0666 } } service dict { unix_listener dict { group = vmail mode = 0660 user = dovecot } } service imap-login { inet_listener imap { port = 0 } inet_listener imaps { address = [censored] port = 993 ssl = yes } } service imap { process_limit = 1024 } service lmtp { unix_listener /var/spool/postfix/private/dovecot-lmtp { group = postfix mode = 0600 user = postfix } } service managesieve-login { inet_listener sieve { address = [censored] port = 4190 } service_count = 1 } service managesieve { process_limit = 64 } ssl_cert = </etc/letsencrypt/live/fullchain.pem ssl_cipher_list = ECDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:ECDH+3DES:DH+3DES:RSA+AESGCM:RSA+AES:RSA+3DES:!aNULL:!MD5:!DSS ssl_dh = # hidden, use -P to show it ssl_key = # hidden, use -P to show it ssl_min_protocol = TLSv1.2 ssl_options = no_compression ssl_prefer_server_ciphers = yes # comment: since imap logins differ from email-addresses I have 2 # userdb queries. One will return fields for %u='login', the other will # return fields for %u='email(a)domain.tld'. # no %u will ever make BOTH userdbs return rows (they are mutually exclusive) userdb { args = /etc/dovecot/dovecot-sql.conf.email driver = sql } userdb { args = /etc/dovecot/dovecot-sql.conf.username driver = sql } protocol lmtp { mail_plugins = " quota acl sieve" } protocol imap { mail_plugins = " quota acl imap_sieve imap_quota imap_acl" } example userdb output: ======================= root@server:/# doveadm -Dv user jost Debug: Loading modules from directory: /usr/lib/dovecot/modules Debug: Module loaded: /usr/lib/dovecot/modules/lib01_acl_plugin.so Debug: Module loaded: /usr/lib/dovecot/modules/lib10_quota_plugin.so Debug: Loading modules from directory: /usr/lib/dovecot/modules/doveadm Debug: Module loaded: /usr/lib/dovecot/modules/doveadm/lib10_doveadm_acl_plugin.so Debug: Skipping module doveadm_expire_plugin, because dlopen() failed: /usr/lib/dovecot/modules/doveadm/lib10_doveadm_expire_plugin.so: undefined symbol: expire_set_deinit (this is usually intentional, so just ignore this message) Debug: Module loaded: /usr/lib/dovecot/modules/doveadm/lib10_doveadm_quota_plugin.so Debug: Module loaded: /usr/lib/dovecot/modules/doveadm/lib10_doveadm_sieve_plugin.so Debug: Skipping module doveadm_fts_lucene_plugin, because dlopen() failed: /usr/lib/dovecot/modules/doveadm/lib20_doveadm_fts_lucene_plugin.so: undefined symbol: lucene_index_iter_deinit (this is usually intentional, so just ignore this message) Debug: Skipping module doveadm_fts_plugin, because dlopen() failed: /usr/lib/dovecot/modules/doveadm/lib20_doveadm_fts_plugin.so: undefined symbol: fts_user_get_language_list (this is usually intentional, so just ignore this message) Debug: Skipping module doveadm_mail_crypt_plugin, because dlopen() failed: /usr/lib/dovecot/modules/doveadm/libdoveadm_mail_crypt_plugin.so: undefined symbol: mail_crypt_box_get_pvt_digests (this is usually intentional, so just ignore this message) field valuedoveadm(jost)<25290><>: Debug: auth USER input: jost home=/var/vmail/matysik.it/jost-philip uid=5000 gid=5000 acl_groups=matysik,admin quota_rule=*:storage=10G quota_rule2 = Trash:storage=+100M quota2 = count:shared quota for maschinen:ns=ZZZ_Freigaben/maschinen/ quota2_rule = *:storage=500M quota3 = count:shared quota for matysik:ns=ZZZ_Freigaben/matysik/ quota3_rule = *:storage=10G quota4 = count:shared quota for postmaster:ns=ZZZ_Freigaben/postmaster/ quota4_rule = *:storage=1G uid 5000 gid 5000 home /var/vmail/matysik.it/jost-philip mail maildir:~/Maildir acl_groups matysik,admin quota_rule *:storage=10G quota_rule2 Trash:storage=+100M quota2 count:shared quota for maschinen:ns=ZZZ_Freigaben/maschinen/ quota2_rule *:storage=500M quota3 count:shared quota for matysik:ns=ZZZ_Freigaben/matysik/ quota3_rule *:storage=10G quota4 count:shared quota for postmaster:ns=ZZZ_Freigaben/postmaster/ quota4_rule *:storage=1G

1 0

Create a malicious directory
by lty 20 May '19

20 May '19

Use scripts to create some malicious directories. Here is my creation process. How can I prevent the creation of these directories? I used the python imapclient script to create a directory. There may be no big threat to dovecot, but it is dangerous for doveadm.

4 3

Directory name have some malicious characters.
by hfh＠cndns.com 20 May '19

20 May '19

Directory name have some malicious characters, is it safe?How can I exclude some characters,thanks!

1 0

Plugins/Mailcrypt: mail_crypt_private_password not assigned by password_query
by Max Kostikov 20 May '19

20 May '19

I try to use Mailcrypt encrypted user keys with conjustion with dbsync replication(Dovecot 2.3.6 in FreeBSD 12.0 enviroment) but was unsuccessful. If I provide a password in mail_crypt_private_password variable directly in Dovecot config all things works as expected plugin { mail_crypt_curve = prime256v1 mail_crypt_save_version = 2 mail_crypt_require_encrypted_user_key = yes mail_crypt_private_password = 12345 } but when I remove this and trying to get the same user password in password_query it seems password doesn't assigned password_query = SELECT username AS user, password, \ '%w' AS userdb_mail_crypt_private_password \ FROM mailbox WHERE username = LCASE('%u') \ AND active = '1' with errors like this in log at server where message was accepted from remote system May 20 00:40:31 server1 dovecot[35417]: dsync-local(foo(a)example.com)<Y51qBF/b4VyHigAAJQnBKg>: Error: dsync(server1.example.com): read() failed: read(/var/mail/example.com/foo/new/1558305609.M674400P35456.server1.example… failed: Private key not available: Cannot decrypt key a4ceb2df0287c0c0ccb0d76e31d91824e1f13e9ffe63d1e04a9a233a073d8a64: Cannot decrypt key 5d19a9246ddce2759a21462974add562dd90f2cb2aa3ff6a5af1af1e3e9b58e6: Password not available (last sent=mail, last recv=mail_request (EOL)) and errors at replica server May 20 00:40:31 server2 dovecot[63985]: dsync-local(foo(a)example.com)<MpW+HV/b4VwD+wAAfP91Tw>: Error: dsync(server2.example.com): read() failed: read() failed: dot-input stream ends without '.' line (last sent=mail_request (EOL), last recv=mail) The question is it possible to have password encrypted user keys with Dovecot dbsync replication or we found a new bug? -- With best regards, Max Kostikov W: https://kostikov.co | DeltaChat: mk(a)eprove.net

1 0

Permission denied
by ＠lbutlr 19 May '19

19 May '19

mail dovecot: lda(user@domain)<955><rPK3B2Gr4Vy7AwAAIdGjjQ>: msgid=<4562Sm6YyYzvmrD(a)mail.covisp.net>: save failed to INBOX: Mailbox INBOX: open(/usr/local/virtual/user(a)domain/tmp/1558293345.M130062P955.mail.covisp.net) failed: Permission denied The permissions on /usr/local/virual have not changed and are still owed by user/group 89/89 dovecot-sql.conf.ext: user_query = select 89 as uid, 89 as gid, concat('/usr/local/virtual/', maildir) as home FROM mailbox where username = '%u' dovecot.conf: first_valid_uid = 89 # ls -lsdn /usr/local/virtual/ 8 drwx------ 29 89 89 1536 Mar 12 23:30 /usr/local/virtual/ # ls -lsdn /usr/local/virtual/backup\(a)southgaylord.com 184 drwx------ 2056 89 89 92672 May 19 12:43 /usr/local/virtual/user@domain Do I need to compile dovecot with vpopmail support? -- I WILL NOT DO THE DIRTY BIRD Bart chalkboard Ep. AABF08

1 0

Repo for RHEL8
by TG Servers 19 May '19

19 May '19

2 2

Merging existing mailboxes to aliases
by Lefteris Tsintjelis 19 May '19

19 May '19

I am trying to merge all, existing or not, different mailboxes in one with the mailbox alias plugin. If I add the following lines, will the existing mailboxes automatically merge in one mailbox and corresponding links auto create? If not, do I have to do this manually? mailbox_alias_new = Spam mailbox_alias_new2 = Junk E-mail mailbox_alias_new3 = Sent Items mailbox_alias_new4 = Sent Messages mailbox_alias_new5 = Deleted Items mailbox_alias_old = Junk mailbox_alias_old2 = Junk mailbox_alias_old3 = Sent mailbox_alias_old4 = Sent mailbox_alias_old5 = Trash Lefteris

3 4

Do we need ssl_dh_parameters_length in version 2.3
by MRob 19 May '19

19 May '19

Hi, I couldn't really find documentation about ssl_dh_parameters_length except for mention in passing on the page https://wiki2.dovecot.org/SSL/DovecotConfiguration For version 2.3 and above is that setting necessary? If so what are the values I can use, is setting it high like 4096 beneficial or make any problems for clients? Thanks for assistance.

2 1

Re: imap failing
by LuKreme 18 May '19

18 May '19

Ugh. Sorry about this, using gmail and it’s weird and annoying meant to send to list On Thu, May 16, 2019 at 00:46 LuKreme <kremels(a)kreme.com> wrote: > One more bit of info. After leaving s_client up for a bit, I got another > line > > CONNECTED(00000003) > 675481056:error:140790E5:SSL routines:ssl23_write:ssl handshake > failure:/usr/src/crypto/openssl/ssl/s23_lib.c:177: > --- > no peer certificate available > --- > No client certificate CA names sent > --- > SSL handshake has read 0 bytes and written 307 bytes > --- > New, (NONE), Cipher is (NONE) > Secure Renegotiation IS NOT supported > Compression: NONE > Expansion: NONE > No ALPN negotiated > SSL-Session: > Protocol : TLSv1.2 > Cipher : 0000 > Session-ID: > Session-ID-ctx: > Master-Key: > Key-Arg : None > PSK identity: None > PSK identity hint: None > SRP username: None > Start Time: 1557988789 > Timeout : 300 (sec) > Verify return code: 0 (ok) > --- > > I guess I wasn't patient enough before. But the certs are in the exact > same place as they've been all along and are working fine with apache. > I can also send mail, if that is at all relevant. (postconf -n is in > another post in this thread) > -- Sent from Gmail Mobile

3 3

Find last day of login
by Lefteris Tsintjelis 18 May '19

18 May '19

I am using dovecot virtual maildir accounts. Is it possible to find last day of login for an account by checking the last modification time of the maildir files? Lefteris

3 4

How to continuously gather statistics?
by Roel van Duijnhoven 17 May '19

17 May '19

Hello, I recently upgraded to the latest version of Dovecot, and want to use the newly introduced logging / event system. I want to fetch the statistics every couple of seconds, and push those to our logging platform. Metrics such as: number of IMAP commands, average time they took, etc. However the metrics as reported by Dovecot continously increment. So I see two solutions: - Our solution could keep track of the previous values. But that could also break if the statistics are reset for some reason (e.g. threshold reached). - My second thought was to use "stats -r". That *should* clear the statistics directly after fetching them. And thus, give a better picture. However I am not sure if this gives me actual useful results. Or is there maybe a better approach to fetch statistics that I overlooked? Thanks a lot. Best, Roel van Duijnhoven

2 1

Dovecot Separator change
by Oliver Werner 16 May '19

16 May '19

Hi community, actually we are using dovecot 2.2.27 without shares mailboxes. Now we would like to implement it. So the problem is that our separator is dot „.“ and the username like „firstname.surname“. That’s doesn’t works with shared mailboxes. Are there a migration guide for changing „.“ to „/„ or it's not possible? kind regards Oliver

1 0

File-dictionary based quotas and SETQUOTA
by Ganael Laplanche 16 May '19

16 May '19

Hello, I am trying to set up file-dictionary based quotas while supporting the SETQUOTA IMAP command. I am using the following configuration : ---- plugin { quota = dict:User quota::file:%h/Maildir/dovecot-quota quota_set = dict:file:%h/Maildir/dovecot-quota } ---- which enables correct quota accounting + setting through SETQUOTA. A user's dovecot-quota file ends with the following contents : ---- priv/quota/limit/storage 5242880 priv/quota/limit/messages 20 priv/quota/messages 1 priv/quota/storage 8506282 ---- which shows a correct accounting (1 mail received, ~8MB used) and correct setting after having used the following IMAP command through a master user : A2 SETQUOTA "User quota" (STORAGE 5242880 MESSAGE 20) *But* the problem is that I am unable to fetch the limits and consume them from userdb (as a consequence, the limits are never applied). On the consuming side, I am using a dictionary userdb to try to fetch the 'priv/quota/limit/storage' value from the file but it does not work because the key is never found. Here is my configuration : ---- userdb { driver = dict args = /etc/dovecot/dovecot-dict-quota.conf.ext } ---- and my dovecot-dict-quota.conf.ext file : ---- uri = file:%h/Maildir/dovecot-quota iterate_disable = yes key quota { key = priv/quota/limit/storage default_value = 100 } userdb_fields { quota_rule = *:storage=%{dict:quota} } ---- If I try to fetch the quota for that user : # doveadm quota get -u ganael.laplanche(a)centralesupelec.fr Quota name Type Value Limit % User quota STORAGE 8307 100 8307 User quota MESSAGE 1 - 0 the default rule is returned (100). The logs show : May 16 12:02:45 mailhost1-saclay dovecot: auth-worker(12899): Debug: dict(Ganael.Laplanche(a)centralesupelec.fr): Lookup: shared/priv/quota/limit/ storage not found, using default value 100 We can see that the default quota rule has been applied because the key is not found. The problem is that a "shared/" prefix is always prepended when looking for the key I configured (priv/quota/limit/storage). If I test the dictionary manually, the key is found : # doveadm dict get -u ganael.laplanche(a)centralesupelec.fr "file:/var/vmail/l/ laplanche_gan/Maildir/dovecot-quota" priv/quota/limit/storage 5242880 Does anyone know how to prevent Dovecot from adding that prefix and make it fetch the correct value from userdb ? Best regards, -- Ganael Laplanche <ganael.laplanche(a)centralesupelec.fr> Unix Systems Engineer @CentraleSupelec Rennes

1 0

Password database - external verification
by Richard Hector 16 May '19

16 May '19

Hi all, I'm currently using a PostgreSQL database for my user/password db, directly from dovecot. The trouble with that is that I'm stuck with whatever hash algorithms dovecot supports - which IIRC means (a subset of?) what libc has been compiled with, which can be a bit restrictive. So I'd like to use an external tool, which would also let me integrate other applications (eg web apps). PAM seems to be most suited to sharing accounts with the OS, which isn't what I want. BSDAuth likewise, but I'm not using BSD. CheckPassword looks like a somewhat convoluted protocol, but maybe the best bet? IMAP - well, that's circular :-) OAuth2 looks possible, but seems to be focused on http? Any suggestions? And recommended implementations? How hard is it to add extra methods? Thanks, Richard

2 2

Dovecot not connecting to OpenLDAP
by Elias Falconi 16 May '19

16 May '19

Hi, We recently shutdown our old LDAP server and repointed our mail server (dovecot + postfix) to our new LDAP server and ever since we've been unable to fetch mail. Mail is getting delivered, but we just can't pop it. We're using Ubuntu 16.04, btw. We keep on getting the following error messages in /var/log/dovecote: 2019-05-15 16:27:43 auth: Error: LDAP /etc/dovecot/dovecot-ldap.conf.ext: ldap_start_tls_s() failed: Can't contact LDAP server 2019-05-15 16:39:36 auth: Error: LDAP /etc/dovecot/dovecot-ldap.conf.ext: ldap_start_tls_s() failed: Connect error 2019-05-15 16:39:43 auth: Error: LDAP /etc/dovecot/dovecot-ldap.conf.ext: ldap_start_tls_s() failed: Local error However, our server is finding our LDAP users and postfix doesn't seem to have a problem, just Dovecot. Also, when we try to connect via Dovecot, we get the following message: -ERR [SYS/TEMP] Temporary authentication failure. [mail:2019-05-15 21:40:06] Our /etc/dovecot/dovecot.conf contains the following: ## Dovecot configuration file # If you're in a hurry, see http://wiki2.dovecot.org/QuickConfiguration # "doveconf -n" command gives a clean output of the changed settings. Use it # instead of copy&pasting files when posting to the Dovecot mailing list. # '#' character and everything after it is treated as comments. Extra spaces # and tabs are ignored. If you want to use either of these explicitly, put the # value inside quotes, eg.: key = "# char and trailing whitespace " # Most (but not all) settings can be overridden by different protocols and/or # source/destination IPs by placing the settings inside sections, for example: # protocol imap { }, local 127.0.0.1 { }, remote 10.0.0.0/8 { } # Default values are shown for each setting, it's not required to uncomment # those. These are exceptions to this though: No sections (e.g. namespace {}) # or plugin settings are added by default, they're listed only as examples. # Paths are also just examples with the real defaults being based on configure # options. The paths listed here are for configure --prefix=/usr # --sysconfdir=/etc --localstatedir=/var # Enable installed protocols !include_try /usr/share/dovecot/protocols.d/*.protocol # A comma separated list of IPs or hosts where to listen in for connections. # "*" listens in all IPv4 interfaces, "::" listens in all IPv6 interfaces. # If you want to specify non-default ports or anything more complex, # edit conf.d/master.conf. #listen = *, :: # Base directory where to store runtime data. #base_dir = /var/run/dovecot/ # Name of this instance. In multi-instance setup doveadm and other commands # can use -i <instance_name> to select which instance is used (an alternative # to -c <config_path>). The instance name is also added to Dovecot processes # in ps output. #instance_name = dovecot # Greeting message for clients. #login_greeting = Dovecot ready. # Space separated list of trusted network ranges. Connections from these # IPs are allowed to override their IP addresses and ports (for logging and # for authentication checks). disable_plaintext_auth is also ignored for # these networks. Typically you'd specify your IMAP proxy servers here. #login_trusted_networks = # Space separated list of login access check sockets (e.g. tcpwrap) #login_access_sockets = # With proxy_maybe=yes if proxy destination matches any of these IPs, don't do # proxying. This isn't necessary normally, but may be useful if the destination # IP is e.g. a load balancer's IP. #auth_proxy_self = # Show more verbose process titles (in ps). Currently shows user name and # IP address. Useful for seeing who are actually using the IMAP processes # (eg. shared mailboxes or if same uid is used for multiple accounts). #verbose_proctitle = no # Should all processes be killed when Dovecot master process shuts down. # Setting this to "no" means that Dovecot can be upgraded without # forcing existing client connections to close (although that could also be # a problem if the upgrade is e.g. because of a security fix). #shutdown_clients = yes # If non-zero, run mail commands via this many connections to doveadm server, # instead of running them directly in the same process. #doveadm_worker_count = 0 # UNIX socket or host:port used for connecting to doveadm server #doveadm_socket_path = doveadm-server # Space separated list of environment variables that are preserved on Dovecot # startup and passed down to all of its child processes. You can also give # key=value pairs to always set specific settings. #import_environment = TZ ## ## Dictionary server settings ## # Dictionary can be used to store key=value lists. This is used by several # plugins. The dictionary can be accessed either directly or though a # dictionary server. The following dict block maps dictionary names to URIs # when the server is used. These can then be referenced using URIs in format # "proxy::<name>". dict { #quota = mysql:/etc/dovecot/dovecot-dict-sql.conf.ext #expire = sqlite:/etc/dovecot/dovecot-dict-sql.conf.ext quota = ldap:/etc/dovecot/dovecot-ldap.conf.ext expire = ldap:/etc/dovecot/dovecot-ldap.conf.ext } # Most of the actual configuration gets included below. The filenames are # first sorted by their ASCII value and parsed in that order. The 00-prefixes # in filenames are intended to make it easier to understand the ordering. !include conf.d/*.conf # A config file can also tried to be included without giving an error if # it's not found: !include_try local.conf # Added by Elias protocols = pop3 imap #ssl_cert = </etc/ssl/certs/server.crt #ssl_key = </etc/ssl/private/server.key ssl_cert = </etc/ssl/certs/ssl-cert-snakeoil.pem ssl_key = </etc/ssl/private/ssl-cert-snakeoil.key log_path = /var/log/dovecote info_log_path = /var/log/dovecote_info log_timestamp = "%Y-%m-%d %H:%M:%S " #syslog_facility = mail_dovecote #ssl = no #mail_location = mbox:~/:INBOX=/var/mail/%u #namespace { # type = private # separator = . # inbox = yes #} mail_privileged_group = mail mail_full_filesystem_access = yes mail_debug = yes mmap_disable = yes mail_nfs_storage = yes mail_nfs_index = yes mail_fsync = always mbox_read_locks = dotlock mbox_write_locks = dotlock passdb ldap { driver = ldap # Path for LDAP configuration file args = /etc/dovecot/dovecot-ldap.conf.ext } userdb { driver=passwd } userdb ldap { driver = ldap # Path for LDAP configuration file args = /etc/dovecot/dovecot-ldap.conf.ext } And our /etc/dovecot/dovecot-ldap.conf.ext has this: # This file is commonly accessed via passdb {} or userdb {} section in # conf.d/auth-ldap.conf.ext # This file is opened as root, so it should be owned by root and mode 0600. # # http://wiki2.dovecot.org/AuthDatabase/LDAP # # NOTE: If you're not using authentication binds, you'll need to give # dovecot-auth read access to userPassword field in the LDAP server. # With OpenLDAP this is done by modifying /etc/ldap/slapd.conf. There should # already be something like this: # access to attribute=userPassword # by dn="<dovecot's dn>" read # add this # by anonymous auth # by self write # by * none # Space separated list of LDAP hosts to use. host:port is allowed too. hosts = 139.147.9.135 # LDAP URIs to use. You can use this instead of hosts list. Note that this # setting isn't supported by all LDAP libraries. #uris = ldaps://139.147.9.135 # Distinguished Name - the username used to login to the LDAP server. # Leave it commented out to bind anonymously (useful with auth_bind=yes). dn = cn=admin,dc=cs,dc=lafayette,dc=edu # Password for LDAP server, if dn is specified. dnpass = blahblah123 # Use SASL binding instead of the simple binding. Note that this changes # ldap_version automatically to be 3 if it's lower. Also note that SASL binds # and auth_bind=yes don't work together. #sasl_bind = no # SASL mechanism name to use. #sasl_mech = # SASL realm to use. #sasl_realm = # SASL authorization ID, ie. the dnpass is for this "master user", but the # dn is still the logged in user. Normally you want to keep this empty. #sasl_authz_id = # Use TLS to connect to the LDAP server. tls = yes # TLS options, currently supported only with OpenLDAP: #tls_ca_cert_file =/etc/ssl/certs/ldap.crt tls_ca_cert_file =/etc/ssl/certs/ldap6_cacert.pem #tls_ca_cert_dir =/etc/ssl/certs/ #tls_cipher_suite = # TLS cert/key is used only if LDAP server requires a client certificate. #tls_cert_file = /etc/ssl/certs/ldap01_slapd_cert.pem #tls_key_file = /etc/ssl/private/ldap01_slapd_key.pem # Valid values: never, hard, demand, allow, try #tls_require_cert = demand # Use the given ldaprc path. #ldaprc_path = # LDAP library debug level as specified by LDAP_DEBUG_* in ldap_log.h. # -1 = everything. You may need to recompile OpenLDAP with debugging enabled # to get enough output. #debug_level = 0 # Use authentication binding for verifying password's validity. This works by # logging into LDAP server using the username and password given by client. # The pass_filter is used to find the DN for the user. Note that the pass_attrs # is still used, only the password field is ignored in it. Before doing any # search, the binding is switched back to the default DN. auth_bind = yes # If authentication binding is used, you can save one LDAP request per login # if users' DN can be specified with a common template. The template can use # the standard %variables (see user_filter). Note that you can't # use any pass_attrs if you use this setting. # # If you use this setting, it's a good idea to use a different # dovecot-ldap.conf.ext for userdb (it can even be a symlink, just as long as # the filename is different in userdb's args). That way one connection is used # only for LDAP binds and another connection is used for user lookups. # Otherwise the binding is changed to the default DN before each user lookup. # # For example: # auth_bind_userdn = cn=%u,ou=people,o=org # #auth_bind_userdn = # LDAP protocol version to use. Likely 2 or 3. ldap_version = 3 # LDAP base. %variables can be used here. # For example: dc=mail, dc=example, dc=org base = ou=People,dc=cs,dc=lafayette,dc=edu # Dereference: never, searching, finding, always deref = never # Search scope: base, onelevel, subtree scope = subtree # User attributes are given in LDAP-name=dovecot-internal-name list. The # internal names are: # uid - System UID # gid - System GID # home - Home directory # mail - Mail location # # There are also other special fields which can be returned, see # http://wiki2.dovecot.org/UserDatabase/ExtraFields user_attrs = homeDirectory=home,uidNumber=uid,gidNumber=gid # Filter for user lookup. Some variables can be used (see # http://wiki2.dovecot.org/Variables for full list): # %u - username # %n - user part in user@domain, same as %u if there's no domain # %d - domain part in user@domain, empty if user there's no domain user_filter = (&(objectClass=posixAccount)(uid=%u)) # Password checking attributes: # user: Virtual user name (user@domain), if you wish to change the # user-given username to something else # password: Password, may optionally start with {type}, eg. {crypt} # There are also other special fields which can be returned, see # http://wiki2.dovecot.org/PasswordDatabase/ExtraFields pass_attrs = uid=user,userPassword=password # If you wish to avoid two LDAP lookups (passdb + userdb), you can use # userdb prefetch instead of userdb ldap in dovecot.conf. In that case you'll # also have to include user_attrs in pass_attrs field prefixed with "userdb_" # string. For example: #pass_attrs = uid=user,userPassword=password,\ # homeDirectory=userdb_home,uidNumber=userdb_uid,gidNumber=userdb_gid # Filter for password lookups pass_filter = (&(objectClass=posixAccount)(uid=%u)) # Attributes and filter to get a list of all users #iterate_attrs = uid=user #iterate_filter = (objectClass=posixAccount) # Default password scheme. "{scheme}" before password overrides this. # List of supported schemes is in: http://wiki2.dovecot.org/Authentication #default_pass_scheme = CRYPT What do you suppose could be the problem? Thanks, Elias

3 2

imap failing
by ＠lbutlr 16 May '19

16 May '19

mail kernel: pid 59433 (imap-login), uid 0: exited on signal 11 (core dumped) master: Error: service(imap-login): command startup failed, throttling for 16 secs May 15 17:21:37 imap-login: Fatal: master: service(imap-login): child 92934 killed with signal 11 (core dumped) I also get a password error for a user unknown, but if I connect to the database with the credentials dovecot uses, I get a password. MariaDB [postfix]> select password FROM mailbox where username ='sample(a)domain.munged'; +-------------------------------------------------------------------------------+ | password | +-------------------------------------------------------------------------------+ | {SHA256-CRYPT}$5$042......................................................... | +-------------------------------------------------------------------------------+ MariaDB [postfix]> select 89 as uid, 89 as gid, concat('/usr/local/virtual/', maildir) as home FROM mailbox where username = 'sample(a)domain.munged'; +-----+-----+------------------------------------------+ | uid | gid | home | +-----+-----+------------------------------------------+ | 89 | 89 | /usr/local/virtual/sample(a)domain.munged/ | +-----+-----+------------------------------------------+ 1 row in set (0.00 sec) I updated my system to openssl111 and rebuilt dovecot and postfix (and a hundred other packages). <y configuration files have not changed. I've looked through he logs for other info, but I don't see anything. Trying to connect via openssl gives me: # openssl s_client -connect mail.covisp.net:993 -starttls imap CONNECTED(00000003)

3 5

Setting up individual encrypted user keys using mail-crypt-plugin
by emordin 16 May '19

16 May '19

Hi, I have setup up a simple mail server using the ISPMail tutorial and I'm trying to learn how to create email encryption at rest. I'm having a tough time understanding how to set this up... So say a user logins thru roundcube and they type in their password...so the password authenticates to the mysql database which is storing their encrypted private key?? And once they access that private key, how do they use that private key to unencrypt their mailbox? I'm a super noob at this, and I may be off, but I don't know where to start when it comes to setting this up... if I'm way off could you just recommend some tutorials or other basics I should learn first before moving on to setting this up? Sent with [ProtonMail](https://protonmail.com) Secure Email.

2 1

Mutual auth and MS Outlook
by dovecot＠scottsavarese.com 16 May '19

16 May '19

I am trying to get Dovecot IMAP and Outlook to talk to each other with SSL and client certificates enabled. In Dovecot, I have the following options enabled: ssl_ca = ... ssl_verify_client_cert = yes auth_ssl_require_client_cert = yes auth_ssl_username_from_cert = yes when I try to connect with Outlook, I get: May 12 08:07:50 mail dovecot: imap-login: Disconnected (client didn't send a cert): user=<>, method=PLAIN, rip=192.168.1.245, lip=192.168.2.5, TLS: Disconnected, session=<is7gpa+Im97AqAH1> But when I use openssl directly with the same certificates it seems to pass the certificate in just fine. Does anybody have any ideas? Thanks in advance.

2 1

Permissions fix
by Lefteris Tsintjelis 16 May '19

16 May '19

Is there a fast way for dovecot to set and/or fix its directory permissions?

2 2

Anyone using object storage ceph?
by Marc Roos 15 May '19

15 May '19

Just curious if there are already people actively using object storage? https://github.com/ceph-dovecot/dovecot-ceph-plugin https://docplayer.net/docs-images/40/9935441/images/page_13.jpg

2 1

Re: weakforced and GeoIP lookups
by Neil Cook 15 May '19

15 May '19

Hi Tobi, This looks like you haven’t included the libmaxmind libraries before running configure. GeoIP support is only compiled in if it finds the right libs. This would be libmaxminddb-dev on Ubuntu for example. Neil >> Hi list >> >> hope it's okay to ask weakforced questions here as well, but I could not >> find a dedicated mailinglist for wforce. >> >> I want to enable GeoIP lookups in my wforce daemon. In a first step I >> installed luarocks and lua-compat53 to install mmdblua module. >> Then I added >> >> newGeoIP2DB("country", "/usr/local/share/GeoIP/GeoLite2-Country.mmdb") >> local mygeodb = getGeoIP2DB("country") >> if(mygeodb:lookupCountry(lt.remote) == 'XX') >> then >> return -1, "country blocked", "country blocked", { country="XX" } >> end >> >> to wforce.conf and tried to restart wforce but that ends up in a >> >> > Fatal Lua error: [string "chunk"]:28: attempt to call global >> > 'newGeoIP2DB' (a nil value) >> >> Any ideas what I could be missing here? >> >> Cheers >> >> tobi > > > Neil Cook > neil.cook(a)open-xchange.com <mailto:neil.cook@open-xchange.com> > > ------------------------------------------------------------------------------------- > Open-Xchange AG, Rollnerstr. 14, 90408 Nuremberg, District Court Nuremberg HRB 24738 > Managing Board: Rafael Laguna de la Vera, Carsten Dirks, Michael Knapstein, Stephan Martin > Chairman of the Board: Richard Seibt > > European Office: > Open-Xchange GmbH, Olper Huette 5f, D-57462 Olpe, Germany, District Court Siegen, HRB 8718 > Managing Director: Frank Hoberg > > US Office: > Open-Xchange. Inc., 530 Lytton Avenue, Palo Alto, CA 94301, USA > ------------------------------------------------------------------------------------- > Neil Cook neil.cook(a)open-xchange.com <mailto:neil.cook@open-xchange.com> ------------------------------------------------------------------------------------- Open-Xchange AG, Rollnerstr. 14, 90408 Nuremberg, District Court Nuremberg HRB 24738 Managing Board: Rafael Laguna de la Vera, Carsten Dirks, Michael Knapstein, Stephan Martin Chairman of the Board: Richard Seibt European Office: Open-Xchange GmbH, Olper Huette 5f, D-57462 Olpe, Germany, District Court Siegen, HRB 8718 Managing Director: Frank Hoberg US Office: Open-Xchange. Inc., 530 Lytton Avenue, Palo Alto, CA 94301, USA -------------------------------------------------------------------------------------

2 4

LDA-based vacation responses bouncing
by micah anderson 14 May '19

14 May '19

I've got dovecot vacataion auto-responses working via sieve, but when the responses are sent, they are sent as if they are to be locally delivered, which causes them to bounce for domains that I am not local for. How can I get dovecot's sieve vacation response to check the domain is local or not? Here is an example of what happens: The LDA notices it needs to send a vacation response: 2019-05-14T10:50:47.827466-07:00 brant dovecot: lda(user(a)example.org)<14817><xL6LL/f/2lzhOQAAh856Uw>: sieve: msgid=<20190514135045.012486@localhost>: sent vacation response to <someone(a)somewhere.org> but that response was sent via the postfix pipe through the dovecot lda transport... because that is local, and the domain it is sending to is not local, it bounces: 2019-05-14T10:50:47.923333-07:00 brant postfix/pipe[14821]: C998381539: to=<someone(a)somewhere.org>, relay=dovecot, delay=0.11, delays=0.04/0.01/0/0.06, dsn=5.1.1, status=bounced (user unknown) Postfix is set to do this: dovecot unix - n n - - pipe flags=DRhu user=mail argv=/usr/bin/spamc --connect-retries=1 -H -d 10.0.1.92 -s 10240000 -t 100 -u ${recipient} -e /usr/lib/dovecot/dovecot-lda -f ${sender} -d ${recipient} require ["fileinto", "vacation"]; vacation :days 2 :subject "Helllo" "Hi"; Here is my doveconf -n: # 2.3.4.1 (f79e8e7e4): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.4 () # OS: Linux 4.9.0-8-amd64 x86_64 Debian 9.8 auth_worker_max_count = 120 default_client_limit = 6144 default_process_limit = 256 default_vsz_limit = 512 M dict { expire = mysql:/etc/dovecot/dovecot-dict-sql.conf quota = mysql:/etc/dovecot/dovecot-dict-sql.conf } disable_plaintext_auth = no first_valid_gid = 8 first_valid_uid = 8 last_valid_gid = 8 last_valid_uid = 8 listen = * login_greeting = howdy, ready. login_log_format_elements = user=<%u> method=%m rip=%r lip=%l mpid=%e %c %k mail_location = mdbox:~/mdbox mail_plugins = expire quota zlib maildir_very_dirty_syncs = yes namespace { inbox = yes location = prefix = separator = . } namespace { alias_for = hidden = yes inbox = no list = no location = prefix = INBOX. separator = . } passdb { args = /etc/dovecot/dovecot-sql.conf driver = sql } plugin { expire = Trash expire2 = Trash/* expire3 = Spam expire_dict = proxy::expire quota = dict:Your mail quota::proxy::quota quota_rule = *:bytes=100663296 quota_rule2 = Trash:bytes=+20%% quota_rule3 = Spam:bytes=+10%% quota_rule4 = INBOX.Trash:bytes=+20%% quota_rule5 = INBOX.Spam:bytes=+10%% quota_rule6 = INBOX.restored_from_backups:bytes=+500%% sieve = ~/.dovecot.sieve sieve_after = /var/lib/dovecot/sieve/after.sieve sieve_before = /var/lib/dovecot/sieve/default.sieve sieve_dir = ~/sieve zlib_save = gz zlib_save_level = 6 } protocols = " imap pop3" service anvil { unix_listener anvil { group = dovecot mode = 0660 user = root } } service auth { client_limit = 6144 unix_listener auth-userdb { group = mail mode = 0600 user = mail } } service dict { unix_listener dict { group = mail mode = 0600 user = mail } } service imap-login { process_min_avail = 10 service_count = 0 vsz_limit = 512 M } service imap-postlogin { executable = script-login /usr/local/sbin/postlogin_imap } service imap { executable = imap imap-postlogin process_limit = 6144 } service pop3-login { process_min_avail = 10 service_count = 0 vsz_limit = 512 M } service pop3-postlogin { executable = script-login /usr/local/sbin/postlogin_pop } service pop3 { executable = pop3 pop3-postlogin } service stats { unix_listener stats-writer { group = mail mode = 0660 } } ssl_cert = </etc/certs/wildcard/cert.pem ssl_cipher_list = ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA ssl_dh = # hidden, use -P to show it ssl_key = # hidden, use -P to show it ssl_prefer_server_ciphers = yes userdb { args = /etc/dovecot/dovecot-sql.conf driver = sql } verbose_proctitle = yes verbose_ssl = yes protocol lda { mail_plugins = expire quota trees zlib sieve plugin { quota_exceeded_message = Sorry, your message cannot be delivered to that person because their mailbox is full. If you can contact them another way, you may wish to tell them of this problem. quota_rule7 = INBOX:bytes=+10%% } } protocol imap { imap_client_workarounds = delay-newmail tb-extra-mailbox-sep mail_plugins = expire quota trees zlib imap_quota imap_zlib plugin { quota_exceeded_message = You are over quota. To avoid losing mail, immediately empty your Trash and Sent folders and delete emails with large attachments. } } protocol pop3 { mail_plugins = expire quota trees zlib pop3_client_workarounds = outlook-no-nuls oe-ns-eoh pop3_uidl_format = %g } remote 127.0.0.1 { mail_max_userip_connections = 60 } Thanks for any suggestions, micah

1 1

Graceful dovecot reload for LE certificate renewals
by Sidsel Jensen 14 May '19

14 May '19

Hi Dovecot-gurus With the introduction of LE certificates the certificate renewal cycle is a lot faster, unfortunately even a "dovecot reload" cuts the existing connections when doing the cert updates, which is quite frustrating - and yes most clients automatically reconnect but still... Is any work going into implementing a more “graceful reload” for dovecot like the one for nginx where existing connections are preserved with the old cert and new connections get the new cert? Kind Regards, Sidsel Jensen Systems Engineer @ One.com <http://one.com/>

2 1

Graceful dovecot reload for LE certificate renewals
by Sidsel Jensen 14 May '19

14 May '19

Hi Dovecot-gurus With the introduction of LE certificates the certificate renewal cycle is a lot faster, unfortunately even a "dovecot reload" cuts the existing connections when doing the cert updates, which is quite frustrating - and yes most clients automatically reconnect but still... Is any work going into implementing a more “graceful reload” for dovecot like the one for nginx where existing connections are preserved with the old cert and new connections get the new cert? Kind Regards, Sidsel Jensen Systems Engineer @ One.com <http://one.com/>

1 0

weakforced and GeoIP lookups
by Tobi 14 May '19

14 May '19

Hi list hope it's okay to ask weakforced questions here as well, but I could not find a dedicated mailinglist for wforce. I want to enable GeoIP lookups in my wforce daemon. In a first step I installed luarocks and lua-compat53 to install mmdblua module. Then I added newGeoIP2DB("country", "/usr/local/share/GeoIP/GeoLite2-Country.mmdb") local mygeodb = getGeoIP2DB("country") if(mygeodb:lookupCountry(lt.remote) == 'XX') then return -1, "country blocked", "country blocked", { country="XX" } end to wforce.conf and tried to restart wforce but that ends up in a > Fatal Lua error: [string "chunk"]:28: attempt to call global > 'newGeoIP2DB' (a nil value) Any ideas what I could be missing here? Cheers tobi

1 0

Is it possible to (re)direct only 1 imap user to the new server
by Marc Roos 14 May '19

14 May '19

I haven't used dovecot proxy or director. If I have a setup where all my users are connecting to HOSTNAMEOLD, is it possible to have 1 imap user that is connecting to HOSTNAMEOLD directed/forwarded to HOSTNAMENEW? Without changing my dns settings and preferably without creating any new servers. I think I can route one users mail to HOSTNAMENEW with sendmail ldap routing. So the only thing I need to be able to do is have the incoming imap requests on HOSTNAMEOLD been handled by HOSTNAMENEW. HOSTNAMEOLD HOSTNAMENEW +--------------+ +--------------+ | SENDMAIL | | SENDMAIL | | | | | | | | | | | V | | V | |--------------| |--------------| | lmtp | | NS /INBOX | | | | | mbox on | | V | | block device | |--------------| | | | NS /INBOX | |--------------| | mdbox on | | NS /ARCHIVE | | block device | | mdbox on | | | | clustered fs | |--------------| | | | NS /ARCHIVE | +--------------+ | mdbox on | | clustered fs | | | +--------------+

1 0

email notification regression between 2.2 and 2.3
by Thomas Capricelli 14 May '19

14 May '19

Hi, Hello. For the last year, each time i've tried updating dovecot from 2.2.x to 2.3.x, I had to rollback because of the following problem: Users don't "see" new emails arriving in subdirs. To be specific * we mostly use/tested thunderbird client * we use maildrop for delivery * this is using imap, not pop3 * when a new email arrives, thunderbird renders the dir name in blue and appends a "(1)" (or more..). That's what we call 'see' * this happens only on 'subdirs', not the main directory. * the server is a typical linux amd64, using the gentoo distribution More testing shows that * if we switch delivery to dovecot-lda, it works ok. But we can't commit that change, or at least not now/easily. Our users heavily use .mailfilter * if the user is currently viewing the subdir, then email notification is working * better : if the user went on the subdir and then in another dir, it keeps on working. It seems we need to 'open' it at least once for notification to work * "maildir_very_dirty_syncs = no" doesn't help (we had =yes) * "mailbox_list_index = no" doesn't help * i can confirm inotify was detected/used in autoconf when installed (anyway it works well with 2.2) I'm always on freenode (orzel). I'll be in #dovecot the next days at least. greetings, -- Thomas Capricelli

1 0

Userdb userdb_mail=, error Mailbox list driver maildir++: maildir_name not supported by this driver
by Marc Roos 14 May '19

14 May '19

I have this default configuration [0], when use the userdb_mail to point to the mdbox location, the inbox subfolders show differently in a firebird client. So I decided to copy the whole default mail_location into the userdb_mail configuration [2]. But then I get errors [3]. Should I change the namespace configuration here, how? My default namespaces are inbox and 4archives [0] [@ ]# doveconf | grep mail_loc mail_location = mbox:~/mail:INBOX=/var/spool/mail/%u:CONTROL=~/mail/control:INDEX=/var/d ovecot/%u/index:LAYOUT=maildir++ [1] [@dovecot]# cat special-userdb test:x:8267:231:Account with special settings for dovecot:/home/popusers/test:/bin/false:userdb_mail=mdbox:~/mdbox [2] [@dovecot]# cat special-userdb test:x:8267:231:Account with special settings for dovecot:/home/popusers/test:/bin/false:userdb_mail=mdbox:~/mdbox:INBOX=/ var/spool/mail/%u:CONTROL=~/mail/control:INDEX=/var/dovecot/%u/index:LAY OUT=maildir++ [3] May 13 22:41:32 mail04 dovecot: imap-login: Login: user=<test>, method=PLAIN, rip=192.168.10.219, lip=192.168.10.44, mpid=1138, TLS, session=<Gk4K8cqIkdHAqArb> May 13 22:41:32 mail04 dovecot: imap(test): Debug: Loading modules from directory: /usr/lib64/dovecot May 13 22:41:32 mail04 dovecot: imap(test): Debug: Module loaded: /usr/lib64/dovecot/lib15_notify_plugin.so May 13 22:41:32 mail04 dovecot: imap(test): Debug: Module loaded: /usr/lib64/dovecot/lib20_listescape_plugin.so May 13 22:41:32 mail04 dovecot: imap(test): Debug: Added userdb setting: mail=mdbox:~/mdbox:INBOX=/var/spool/mail/test:CONTROL=~/mail/control:IND EX=/var/dovecot/test/index:LAYOUT=maildir++ May 13 22:41:32 mail04 dovecot: imap(test): Debug: Effective uid=8267, gid=231, home=/home/popusers/test May 13 22:41:32 mail04 dovecot: imap(test): Debug: Namespace inbox: type=private, prefix=, sep=/, inbox=yes, hidden=no, list=yes, subscriptions=yes location=mdbox:~/mdbox:INBOX=/var/spool/mail/test:CONTROL=~/mail/control :INDEX=/var/dovecot/test/index:LAYOUT=maildir++ May 13 22:41:32 mail04 dovecot: imap(test): Error: Namespace '': Mailbox list driver maildir++: maildir_name not supported by this driver May 13 22:41:32 mail04 dovecot: imap(test): Namespace '': Mailbox list driver maildir++: maildir_name not supported by this driver in=0 out=378

2 5

doveadm 2.2.36-3.el7.x86_64 mailbox list -u test, does not use symlinked mailboxes
by Marc Roos 14 May '19

14 May '19

Maybe this has been already fixed, but symlinked mailboxes are not shown by [@ dovecot]# doveadm mailbox list -u test | sort Archive Archive/2018 Archive/2019 Archive/2019old Archive/Archive Drafts INBOX INBOX/test1 INBOX/test2 INBOX/test3 Junk Sent test testing-folder-home testing-folder-home/another folder Trash dovecot-2.2.36-3.el7.x86_64 CentOS Linux release 7.6.1810 (Core)

1 0

Sieve scripting
by Lefteris Tsintjelis 14 May '19

14 May '19

I want to monitor a special folder and execute a shell script each time I put an email to it. I would like to automate that way the process of SPAM reporting (SPAMCop). Is that possible with sieve? Lefteris

2 3

Doveadm sync, Error: read(remote) failed: EOF, Error: read(remote) failed: EOF
by Marc Roos 13 May '19

13 May '19

In the manual page this command is used for converting a mailbox doveadm sync -u test mdbox:~/mdbox -x INBOX -x INBOX/* Yet I am getting this error and the mdbox folder is not created. dsync-local(test): (version not received) doveadm(test): Fatal: execvp(mdbox:~/mdbox) failed: No such file or directory [@ dovecot]# doveconf | grep mail_locat mail_location = mbox:~/mail:INBOX=/var/spool/mail/%u:CONTROL=~/mail/control:INDEX=/var/d ovecot/%u/index:LAYOUT=maildir++ Users are not having shell access so something like su test -c '' will also not work. What would be a work-around for this?

2 2

dovecot 2.2.36 and wforce
by Tobi 13 May '19

13 May '19

Hi list I'm trying to setup dovecot 2.2.36 on a Centos6 to communicate with a wforce daemon on the remote side. wforce is latest released from git repo. Daemon part is working and I can successfully send queries from remote systems to wforce via curl For dovecot I configured in /etc/dovecot/conf.d/95-wforce.conf > auth_policy_server_url = http://REMOTE_IP:8084/ > auth_policy_hash_nonce = my_random > auth_policy_server_api_header = Authorization: Basic <BASE64 of wforce:my_password> > auth_policy_request_attributes = login=%{requested_username} pwhash=%{hashed_password} remote=%{rip} device_id=%{client_id} protocol=%s restarted dovecot without errors, but upon testing via imap I cannot see just one single tcp paket leaving direction REMOTE_IP on port 8084. It looks like auth policy in not involved at all. Thanks for any idea tobi

2 2

Re: Re: Dovecot not surviving OpenLDAP restart
by Dag Nygren 12 May '19

12 May '19

One more obvious line from the log: dovecot[26621]: auth: Error: LDAP: Connection lost to LDAP server, reconnecting Where it claims to reconnect, but after that there is no LDAP authentication. And the same configuration has worked fine since at least 10 years ago up to some recent update of dovecot or openldap. Best Dag

2 1

IMAPSieve message marked as HAM should go through full sieve script of user
by Matthias Fechner 10 May '19

10 May '19

Dear all, I use the IMAPSieve implementation described here: https://wiki.dovecot.org/HowTo/AntispamWithSieve It is working really great! Thanks a lot for this. The problem I have now is: A message was by accident marked by rspamd as spam, so a false-positive and is moved to the Junk folder. If I click in my email program now on `Not Spam` it is learn as HAM but moved to the INBOX. I would like that the email is not moved to INBOX but it should be moved through the sieve script of the user again, as it is a new email. Currently I have to mark all false-positives as not spam and have then to manually move it to the correct subfolder which is a bit annoying. Is this possible? Thanks a lot! -- Gruß Matthias

4 3

smtputf8
by Jerry 10 May '19

10 May '19

I am trying to find out if Dovecot supports "smtputf8". Obviously, I am looking in the wrong places, but I just cannot find a definitive answer. Thanks! -- Jerry

4 5

New WebSite
by Jorge Bastos 10 May '19

10 May '19

Hi There, The new website is cute, but I miss one thing, and I believe other also. In the releases, the date of the release, for example when 2.3.6 was out :P Maybe under the release version: Jorge,

1 0

doveadm sync issues (revised)
by Sven Strickroth 10 May '19

10 May '19

Hi, I'm experiencing serious issues using doveadm sync; mails are not replicating and/or mails are duplicating. I wanted to use this for migrating external mailboxes to my server (in order to overcome the time when some servers/clients still use the old server and some already my server, as described on <https://wiki2.dovecot.org/Tools/Doveadm/Sync>). Finally I was able to reproduce this with the 2.3 branch (cf. <https://dovecot.org/pipermail/dovecot/2019-April/115600.html>). I'm sorry that I can only test the version 2.3.4.1, but according to the changelog I think this is still an issue with the latest version. I tried to find a few steps in order to replicate this easily: For testing purposes I simulate both the remote and local server on my Dovecot instance. I created remote(a)DOMAIN.TLD and local(a)DOMAIN.TLD accounts and both use mdbox and are empty. First, send two mails to remote(a)DOMAIL.TLD (Subjects: Test1 and Test2). Start backup remote IMAP account (remote(a)DOMAIN.TLD) to local account (local(a)DOMAIN.TLD) $ doveadm -o imapc_user="remote(a)DOMAIN.TLD" -o imapc_password="PW" -o imapc_host="localhost" backup -R -u local(a)DOMAIN.TLD imapc: Both mailboxes are in sync now (containing Test1 und Test2). Now send two messages to remote(a)DOMAIN.TLD (Subjects Test3 and Test4) and two messages to local(a)DOMAIN.TLD (Subjects Test5 and Test6). Run sync: $ doveadm -o imapc_user="remote(a)DOMAIN.TLD" -o imapc_password="PW" -o imapc_host="localhost" sync -R -u local(a)DOMAIN.TLD imapc: See that syncing fails: remote(a)DOMAIN.TLD contains: Test1,2,3,4,5,6 (as expected) local(a)DOMAIN.TLD contains: Test1,2,5,6,4 (Test3 is missing here) When not using the "-R" parameter it seems to work. Running sync again: $ doveadm -o imapc_user="remote(a)DOMAIN.TLD" -o imapc_password="PW" -o imapc_host="localhost" sync -R -u local(a)DOMAIN.TLD imapc: causes messages to duplicate: remote(a)DOMAIN.TLD contains: Test1,2,6,5,4,3,5,6,4,6,5,4,3,5,6 local(a)DOMAIN.TLD contains: Test1,2,5,4,6,4,5,6 (3 is still missing) This is independent of the "-R" parameter. I could also experience this issue when using one-way sync, however, the first one-way sync is still ok, but then messages start duplicating as for the two-way sync without "-R": $ doveadm -o imapc_user="remote(a)DOMAIN.TLD" -o imapc_password="PW" -o imapc_host="localhost" sync -R -1 -u local(a)DOMAIN.TLD imapc: Hope you can replicate this, too, and finally fix the issue. -- Best regards, Sven Strickroth PGP key id F5A9D4C4 @ any key-server

2 1

Re: Dovecot does not recognize imported messages
by lty 10 May '19

10 May '19

I changed the user permissions, this is a must. Because an email is sent to this user, all emails are identified. > Did you do something like "chown -R vmail:vmail /var/mail" after copy messages? > > ср, 8 мая 2019 г. в 12:57, lty via dovecot <dovecot(a)dovecot.org>: > > Today I tried to import mail directly on the server's home directory on the server. I copied it directly. I didn't use the imap protocol. Dovcot didn't recognize these emails. I didn't display these imported emails on my page, recalculating disk quotas. It will not increase the used capacity. I try to send an email to this user, dovcot recognizes all the emails, and recalculates the disk cooperation, this time is correct. > Why can't I identify the mail I imported? > > [root@imap2 ~]# dovecot -n > # 2.2.36 (1f10bfa63): /etc/dovecot/dovecot.conf > # Pigeonhole version 0.4.24 (124e06aa) > # OS: Linux 2.6.32-431.el6.x86_64 x86_64 CentOS release 6.5 (Final) > # Hostname: imap > auth_master_user_separator = * > auth_mechanisms = PLAIN LOGIN > default_internal_user = vmail > default_vsz_limit = 2 G > deliver_log_format = msgid=%m, subject=%s, from=%f, %$ > dict { > acl = mysql:/etc/dovecot/dovecot-share-folder.conf > quotadict = mysql:/etc/dovecot/dovecot-used-quota.conf > } > disable_plaintext_auth = no > first_valid_uid = 2000 > last_valid_uid = 2000 > listen = * > mail_fsync = never > mail_gid = 2000 > mail_location = maildir:/%Lh/Maildir/:INDEX=/%Lh/Maildir/ > mail_plugins = quota lazy_expunge zlib fts fts_solr > mail_uid = 2000 > maildir_stat_dirs = yes > managesieve_notify_capability = mailto > managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext > mmap_disable = yes > namespace { > list = children > location = maildir:/%%Lh/Maildir/:INDEX=/%%Lh/Maildir/Shared/%%u > prefix = Shared/%%u/ > separator = / > subscriptions = yes > type = shared > } > namespace { > hidden = yes > list = no > location = maildir:/var/vmail/backup/expunged/%d/%n > prefix = .DELETED/ > separator = / > } > namespace inbox { > inbox = yes > location = > mailbox Drafts { > auto = subscribe > special_use = Drafts > } > mailbox Junk { > auto = subscribe > special_use = Junk > } > mailbox Sent { > auto = subscribe > special_use = Sent > } > mailbox Trash { > auto = subscribe > special_use = Trash > } > prefix = > separator = / > } > passdb { > args = /etc/dovecot/dovecot-mysql.conf > driver = sql > } > passdb { > args = /etc/dovecot/dovecot-fallback-password-mysql.conf > driver = sql > } > passdb { > args = /etc/dovecot/dovecot-fallback-mysql.conf > driver = sql > } > passdb { > args = /etc/dovecot/dovecot-master-users-password > driver = passwd-file > master = yes > } > plugin { > acl = vfile:/etc/dovecot/dovecot-acl > acl_globals_only = yes > auth_socket_path = /var/run/dovecot/auth-master > fts_autoindex_exclude = Junk > fts_autoindex_exclude2 = Trash > fts_autoindex_exclude3 = Sent > fts_autoindex_exclude4 = Drafts > fts_autoindex_max_recent_msgs = 20 > lazy_expunge = .DELETED/ > mail_replica = tcp:10.0.11.152:1111 [1] > quota = dict:user::proxy::quotadict > quota_grace = 0%% > quota_max_mail_size = 70M > quota_rule = *:storage=1G > quota_rule2 = *:messages=0 > quota_warning = storage=85%% quota-warning 85 %u > quota_warning2 = storage=90%% quota-warning 90 %u > quota_warning3 = storage=95%% quota-warning 95 %u > sieve = /%Lh/sieve/dovecot.sieve > sieve_default = /var/vmail/sieve/dovecot.sieve > sieve_default_name = managesieve > sieve_dir = /%Lh/sieve > } > protocols = pop3 imap sieve > service anvil { > client_limit = 20500 > } > service auth { > client_limit = 20500 > unix_listener /var/spool/postfix/private/auth { > group = postfix > mode = 0666 > user = postfix > } > unix_listener auth-master { > group = vmail > mode = 0666 > user = vmail > } > unix_listener auth-userdb { > group = vmail > mode = 0660 > user = vmail > } > } > service dict { > unix_listener dict { > group = vmail > mode = 0660 > user = vmail > } > } > service imap-login { > process_min_avail = 24 > service_count = 0 > vsz_limit = 2 G > } > service imap { > process_limit = 1024000 > process_min_avail = 24 > vsz_limit = 2 G > } > service pop3-login { > service_count = 0 > } > service quota-warning { > executable = script /usr/local/bin/dovecot-quota-warning.sh > unix_listener quota-warning { > group = vmail > mode = 0660 > user = vmail > } > } > ssl_ca = </etc/pki/tls/certs/c.cn.ca-bundle > ssl_cert = </etc/pki/tls/certs/c.cn.crt > ssl_key = # hidden, use -P to show it > syslog_facility = local6 > userdb { > args = /etc/dovecot/dovecot-mysql.conf > driver = sql > } > userdb { > args = /etc/dovecot/dovecot-fallback-user-mysql.conf > driver = sql > } > protocol lda { > auth_socket_path = /var/run/dovecot/auth-master > lda_mailbox_autocreate = yes > mail_fsync = optimized > mail_plugins = quota lazy_expunge zlib fts fts_solr sieve > syslog_facility = local6 > } > protocol imap { > imap_client_workarounds = tb-extra-mailbox-sep > imap_id_send = NAME dovecot VERSION 2.1.17 > mail_max_userip_connections = 20 > mail_plugins = quota lazy_expunge zlib fts fts_solr imap_quota mail_log imap_zlib notify > } > protocol pop3 { > mail_max_userip_connections = 20 > mail_plugins = quota lazy_expunge zlib fts fts_solr mail_log notify > pop3_client_workarounds = outlook-no-nuls oe-ns-eoh > pop3_uidl_format = %08Xu%08Xv > } -- С уважением, Рустам Багов. Links: ------ [1] http://10.0.11.152:1111

1 0

Dovecot not surviving OpenLDAP restart
by Dag Nygren 09 May '19

09 May '19

Hi! Running Dovecot 2.2.36 and authenticating against an OpenLDAP 2.4.45 server. Now since some update of dovecot it will not be able to authenticate your logins after a restart of the LDAP service is restarted without a reboot of the dovecot server. Anything new here that I should be aware of? Best Regards Dag

2 2

Re: Re: dict lookup too long time
by hfh＠cndns.com 09 May '19

09 May '19

logging some error,dict process is not dead. hfh(a)cndns.com From: Aki Tuomi via dovecot Date: 2019-05-09 14:21 To: hfh(a)cndns.com; dovecot Subject: Re: dict lookup too long time On 9.5.2019 8.00, hfh--- via dovecot wrote: hi, The following error message sometimes appears on my server log,it causes the mailbox to exceed the disk capacity limit. May 9 09:54:11 imap dovecot: imap(hfh(a)cndns.com): Error: dict-client: Lookup 'priv/quota/storage' failed: Connection closed: read(size=8192) failed: Connection reset by peer (reply took 2.728 secs (2.729 in dict wait, 0.000 in other ioloops, 0.000 in locks)) Is the dict process by chance dying or logging some error(s)? Aki

1 0

dovecot dict protocol
by Peter Hudec 09 May '19

09 May '19

Hi there is there any written specification for dovecot dict protocol instead of the code? Small example is in docs on https://wiki.dovecot.org/AuthDatabase/Dict and theere is link for all commands/reply in the code https://wiki.dovecot.org/AuthDatabase/Dict I’m writing small dict server and need some explanation for CMD: I, what does the flags means and how should the result looks like CMD: D, I thing this is the same as C, but coud be done later /async/ The reply codes are not very clear. I understand O, N, F. The rest is strange to me. Maybe this is good question do devel mailing list. regards Peter

1 0

UID to file?
by Carles Pina i Estany 09 May '19

09 May '19

Hello, In the past I was in a situation that given an email UID I wanted to know which file in the Maildir directory this UID was saved. I did a small parser for $HOME/Maildir/dovecot-uidlist where, if the file had: 1000 W1838 S1796 :1557351041.10447_1.example I would ask for the UID 1000 and would return :1557351041.10447_1.example (and I knew that it was in $HOME/Maildir/new) Is there any other way using dovecot tools to do the same, to avoid parsing an internal dovecot file? Thank you! -- Carles Pina i Estany GPG Key 0x8CD5C157

2 2

Push Notification clarification (MessageNew w/o LMTP or LDA)
by Christian Balzer 09 May '19

09 May '19

Hello, Both the examples on the Push Notification wiki page and the XAPS plugin docs seem to suggest or state that LMTP/LDA is required. However IMAP IDLE notifications work without either of these (please no religious discussion of why Dovecot LMTP is the best thing since sliced bread and that everybody should use it). The LUA part of the push notification docs however states that events other than MessageNew are supported. So my question is, when not using LMTP/LDA and a LUA script and of course the correct mail_plugins definition (either global or for IMAP), will a message delivery trigger MessageNew? Regards, Christian -- Christian Balzer Network/Systems Engineer chibi(a)gol.com Rakuten Communications

2 3

dict lookup too long time
by hfh＠cndns.com 09 May '19

09 May '19

hi, The following error message sometimes appears on my server log,it causes the mailbox to exceed the disk capacity limit. May 9 09:54:11 imap dovecot: imap(hfh(a)cndns.com): Error: dict-client: Lookup 'priv/quota/storage' failed: Connection closed: read(size=8192) failed: Connection reset by peer (reply took 2.728 secs (2.729 in dict wait, 0.000 in other ioloops, 0.000 in locks)) dovecot -n # 2.2.36 (1f10bfa63): /etc/dovecot/dovecot.conf # Pigeonhole version 0.4.24 (124e06aa) # OS: Linux 2.6.32-504.el6.x86_64 x86_64 CentOS release 6.6 (Final) # Hostname: imap3bak.sh.chengmail.me auth_master_user_separator = * auth_mechanisms = PLAIN LOGIN deliver_log_format = msgid=%m, subject=%s, from=%f, %$ dict { acl = mysql:/etc/dovecot/dovecot-share-folder.conf quotadict = mysql:/etc/dovecot/dovecot-used-quota.conf } disable_plaintext_auth = no first_valid_uid = 2000 last_valid_uid = 2000 listen = * mail_fsync = never mail_gid = 2000 mail_location = maildir:/%Lh/Maildir/:INDEX=/%Lh/Maildir/ mail_plugins = quota lazy_expunge zlib mail_uid = 2000 managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext mmap_disable = yes namespace { list = children location = maildir:/%%Lh/Maildir/:INDEX=/%%Lh/Maildir/Shared/%%u prefix = Shared/%%u/ separator = / subscriptions = yes type = shared } namespace { hidden = yes list = no location = maildir:/var/vmail/backup/expunged/%d/%n prefix = .DELETED/ separator = / } namespace inbox { inbox = yes location = mailbox Drafts { auto = subscribe special_use = \Drafts } mailbox Junk { auto = subscribe special_use = \Junk } mailbox Sent { auto = subscribe special_use = \Sent } mailbox Trash { auto = subscribe special_use = \Trash } prefix = separator = / } passdb { args = /etc/dovecot/dovecot-mysql.conf driver = sql } passdb { args = /etc/dovecot/dovecot-fallback-password-mysql.conf driver = sql } passdb { args = /etc/dovecot/dovecot-fallback-mysql.conf driver = sql } passdb { args = /etc/dovecot/dovecot-master-users-password driver = passwd-file master = yes } plugin { acl = vfile:/etc/dovecot/dovecot-acl acl_globals_only = yes auth_socket_path = /var/run/dovecot/auth-master lazy_expunge = .DELETED/ quota = dict:user::proxy::quotadict quota_grace = 0%% quota_max_mail_size = 70M quota_rule = *:storage=1G quota_rule2 = *:messages=0 quota_warning = storage=85%% quota-warning 85 %u quota_warning2 = storage=90%% quota-warning 90 %u quota_warning3 = storage=95%% quota-warning 95 %u sieve = /%Lh/sieve/dovecot.sieve sieve_default = /var/vmail/sieve/dovecot.sieve sieve_default_name = managesieve sieve_dir = /%Lh/sieve } protocols = pop3 imap sieve service anvil { client_limit = 20500 } service auth { client_limit = 20500 unix_listener /var/spool/postfix/dovecot-auth { group = postfix mode = 0666 user = postfix } unix_listener auth-master { group = vmail mode = 0666 user = vmail } unix_listener auth-userdb { group = vmail mode = 0660 user = vmail } } service dict { unix_listener dict { group = vmail mode = 0660 user = vmail } } service imap-login { process_min_avail = 24 service_count = 0 vsz_limit = 2 G } service imap { process_limit = 1024000 process_min_avail = 24 vsz_limit = 2 G } service pop3-login { service_count = 0 } service quota-warning { executable = script /usr/local/bin/dovecot-quota-warning.sh unix_listener quota-warning { group = vmail mode = 0660 user = vmail } } ssl_ca = </etc/pki/tls/certs/cndns.com.ca-bundle ssl_cert = </etc/pki/tls/certs/cndns.com.crt ssl_key = # hidden, use -P to show it syslog_facility = local6 userdb { args = /etc/dovecot/dovecot-mysql.conf driver = sql } userdb { args = /etc/dovecot/dovecot-fallback-user-mysql.conf driver = sql } protocol lda { auth_socket_path = /var/run/dovecot/auth-master lda_mailbox_autocreate = yes mail_fsync = optimized mail_plugins = quota lazy_expunge zlib sieve postmaster_address = root syslog_facility = local6 } protocol imap { imap_client_workarounds = tb-extra-mailbox-sep imap_id_send = NAME dovecot VERSION 2.1.17 mail_max_userip_connections = 20 mail_plugins = quota lazy_expunge zlib imap_quota mail_log imap_zlib notify } protocol pop3 { mail_max_userip_connections = 20 mail_plugins = quota lazy_expunge zlib mail_log notify pop3_client_workarounds = outlook-no-nuls oe-ns-eoh pop3_uidl_format = %08Xu%08Xv } hfh(a)cndns.com

2 1

How to auto-subscribe to virtual namespace/prefix?
by MRob 09 May '19

09 May '19

In virtual namespace I can have: namespace myvirt { location = blah prefix=Virtual/ separator=/ mailbox "My folder" { auto = subscribe } } And i see email clients successful display subscribed "My folder" but the top-level prefix "Virtual/" is not subscribed. I see the Virtual/ prefix available as a noselect folder in the list of unsubscribed folders and if I manual subscribe to it, folder tree display is perfect. So how can i also make auto-subscription to the "Virtual/" prefix noselect folder?

1 2

dsync to backup to directory?
by Felipe Gasper 08 May '19

08 May '19

Hello, We have a hosting operation and are interested in offloading mail for some of our machines to a separate machine. We want the ability, though, to migrate accounts between the “offloaded” and “unified” configurations. Toward that end, is it possible to “merge” two different mail directories (either maildir or mdbox) via doveadm? “doveadm backup” looks like the closest match, but it doesn’t appear to accept an arbitrary directory as its synchronization source. Thank you! -Felipe Gasper Mississauga, Ontario

1 0

Re: Dovecot does not recognize imported messages
by lty 08 May '19

08 May '19

I put it in the cur/ directory.

1 0

Dovecot does not recognize imported messages
by lty 08 May '19

08 May '19

Today I tried to import mail directly on the server's home directory on the server. I copied it directly. I didn't use the imap protocol. Dovcot didn't recognize these emails. I didn't display these imported emails on my page, recalculating disk quotas. It will not increase the used capacity. I try to send an email to this user, dovcot recognizes all the emails, and recalculates the disk cooperation, this time is correct. Why can't I identify the mail I imported? > [root@imap2 ~]# dovecot -n > # 2.2.36 (1f10bfa63): /etc/dovecot/dovecot.conf > # Pigeonhole version 0.4.24 (124e06aa) > # OS: Linux 2.6.32-431.el6.x86_64 x86_64 CentOS release 6.5 (Final) > # Hostname: imap > auth_master_user_separator = * > auth_mechanisms = PLAIN LOGIN > default_internal_user = vmail > default_vsz_limit = 2 G > deliver_log_format = msgid=%m, subject=%s, from=%f, %$ > dict { > acl = mysql:/etc/dovecot/dovecot-share-folder.conf > quotadict = mysql:/etc/dovecot/dovecot-used-quota.conf > } > disable_plaintext_auth = no > first_valid_uid = 2000 > last_valid_uid = 2000 > listen = * > mail_fsync = never > mail_gid = 2000 > mail_location = maildir:/%Lh/Maildir/:INDEX=/%Lh/Maildir/ > mail_plugins = quota lazy_expunge zlib fts fts_solr > mail_uid = 2000 > maildir_stat_dirs = yes > managesieve_notify_capability = mailto > managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext > mmap_disable = yes > namespace { > list = children > location = maildir:/%%Lh/Maildir/:INDEX=/%%Lh/Maildir/Shared/%%u > prefix = Shared/%%u/ > separator = / > subscriptions = yes > type = shared > } > namespace { > hidden = yes > list = no > location = maildir:/var/vmail/backup/expunged/%d/%n > prefix = .DELETED/ > separator = / > } > namespace inbox { > inbox = yes > location = > mailbox Drafts { > auto = subscribe > special_use = Drafts > } > mailbox Junk { > auto = subscribe > special_use = Junk > } > mailbox Sent { > auto = subscribe > special_use = Sent > } > mailbox Trash { > auto = subscribe > special_use = Trash > } > prefix = > separator = / > } > passdb { > args = /etc/dovecot/dovecot-mysql.conf > driver = sql > } > passdb { > args = /etc/dovecot/dovecot-fallback-password-mysql.conf > driver = sql > } > passdb { > args = /etc/dovecot/dovecot-fallback-mysql.conf > driver = sql > } > passdb { > args = /etc/dovecot/dovecot-master-users-password > driver = passwd-file > master = yes > } > plugin { > acl = vfile:/etc/dovecot/dovecot-acl > acl_globals_only = yes > auth_socket_path = /var/run/dovecot/auth-master > fts_autoindex_exclude = Junk > fts_autoindex_exclude2 = Trash > fts_autoindex_exclude3 = Sent > fts_autoindex_exclude4 = Drafts > fts_autoindex_max_recent_msgs = 20 > lazy_expunge = .DELETED/ > mail_replica = tcp:10.0.11.152:1111 > quota = dict:user::proxy::quotadict > quota_grace = 0%% > quota_max_mail_size = 70M > quota_rule = *:storage=1G > quota_rule2 = *:messages=0 > quota_warning = storage=85%% quota-warning 85 %u > quota_warning2 = storage=90%% quota-warning 90 %u > quota_warning3 = storage=95%% quota-warning 95 %u > sieve = /%Lh/sieve/dovecot.sieve > sieve_default = /var/vmail/sieve/dovecot.sieve > sieve_default_name = managesieve > sieve_dir = /%Lh/sieve > } > protocols = pop3 imap sieve > service anvil { > client_limit = 20500 > } > service auth { > client_limit = 20500 > unix_listener /var/spool/postfix/private/auth { > group = postfix > mode = 0666 > user = postfix > } > unix_listener auth-master { > group = vmail > mode = 0666 > user = vmail > } > unix_listener auth-userdb { > group = vmail > mode = 0660 > user = vmail > } > } > service dict { > unix_listener dict { > group = vmail > mode = 0660 > user = vmail > } > } > service imap-login { > process_min_avail = 24 > service_count = 0 > vsz_limit = 2 G > } > service imap { > process_limit = 1024000 > process_min_avail = 24 > vsz_limit = 2 G > } > service pop3-login { > service_count = 0 > } > service quota-warning { > executable = script /usr/local/bin/dovecot-quota-warning.sh > unix_listener quota-warning { > group = vmail > mode = 0660 > user = vmail > } > } > ssl_ca = </etc/pki/tls/certs/c.cn.ca-bundle > ssl_cert = </etc/pki/tls/certs/c.cn.crt > ssl_key = # hidden, use -P to show it > syslog_facility = local6 > userdb { > args = /etc/dovecot/dovecot-mysql.conf > driver = sql > } > userdb { > args = /etc/dovecot/dovecot-fallback-user-mysql.conf > driver = sql > } > protocol lda { > auth_socket_path = /var/run/dovecot/auth-master > lda_mailbox_autocreate = yes > mail_fsync = optimized > mail_plugins = quota lazy_expunge zlib fts fts_solr sieve > syslog_facility = local6 > } > protocol imap { > imap_client_workarounds = tb-extra-mailbox-sep > imap_id_send = NAME dovecot VERSION 2.1.17 > mail_max_userip_connections = 20 > mail_plugins = quota lazy_expunge zlib fts fts_solr imap_quota mail_log imap_zlib notify > } > protocol pop3 { > mail_max_userip_connections = 20 > mail_plugins = quota lazy_expunge zlib fts fts_solr mail_log notify > pop3_client_workarounds = outlook-no-nuls oe-ns-eoh > pop3_uidl_format = %08Xu%08Xv > }

2 1

Question about GIT repository
by Juan C. Blanco 07 May '19

07 May '19

Hello, just a question, I can't see a core "release-2.3.6" branch, nor a pigeonhole "release-0.5.6" branch on the GIT repository, it is outdated? or do you have changed your policy to create a new branch for each new release of dovecot and pigeonhole? Thanks and regards -- +-------------------------------------------------------------------+ | Juan C. Blanco | | | | Centro de Calculo | | | E.T.S. Ingenieros Informáticos | E-mail: jcblanco(a)fi.upm.es | | Universidad Politécnica de Madrid | | | Campus de Montegancedo | | | Boadilla del Monte | Tel.: (+34) 91 067 2771 | | 28660 MADRID (Spain) | Fax : (+34) 91 336 7412 | +-------------------------------------------------------------------+

4 6

Symlinked mailboxes and dovecot-uidlist.lock
by Dave 07 May '19

07 May '19

I have a scenario where I have two users, one account (user1) with it's own Maildir account, and another account (user2) (which I wish to see the same messages) with a symlinked Maildir to user1's Maildir. I.E.: /home/user1/Maildir /home/user2/Maildir (where this Maildir is symlinked to /home/user1/Maildir) Both users are in a group together (usergroup), and so all of the permissions on the Maildir, new, cur, etc folders are rwxrwx--- or rw-rw----. All mail gets created and delivered correctly, both users can move and create files, and everything generally seems to be working fine. However, I did notice one error showing up in the system logs: May 2 11:35:13 userserver dovecot: imap(user1): Error: inotify_add_watch(/home/user1/Maildir/dovecot-uidlist.lock) failed: Permission denied May 2 11:36:27 userserver dovecot: imap(user2): Error: inotify_add_watch(/home/user2/Maildir/dovecot-uidlist.lock) failed: Permission denied May 3 10:10:11 userserver dovecot: imap(user2): Error: inotify_add_watch(/home/user2/Maildir/.Folder1/dovecot-uidlist.lock) failed: Permission denied I've managed to catch a glimpse of a lock file, as it comes and goes very quickly, and it is permissioned as so: -rw-rw---- 1 user1 usergroup 10 May 5 11:39 dovecot-uidlist.lock So I'm not sure what exactly the permissions issue is then? The file seems to have the appropriate group permissions for each user to read from and write to it. Again, this is the only error I'm getting, and everything has been working fine. I did read the Dovecot wiki talking about symlinking mailboxes, and it refers to symlinking each box/folder individually and not the entire Maildir folder as I've done, but since each individual box/folder has its own dovecot-uidlist I imagine I might run into this same issue anyway? Anyway, I'd like to squelch the error if I can, so are there any thoughts as to why the lock files are having trouble with inotify_add_watch? -Dave

1 0

doveadm - mailbox to filesystem directory?
by Joaquin F 07 May '19

07 May '19

Is it possible to get the filesystem location (directory name) for a given mailbox? The closest I found was parsing the output of "doveadm -D mailbox create", but this only works if the mailbox doesn't exist yet and prone to failure if the debug output changes in future versions. Using "doveadm mailbox mutf7" helps, but there's some ASCII characters which are encoded. So far I've found "\" turns in to "\5c", "." into "\2e" and "/" to "\2f" and the separator to ".". But maybe there are others. Thanks in advance. Version: dovecot 2.2.36 (1f10bfa63) Relevant config: mail_location = maildir:~/Maildir protocols = imap namespace inbox { separator = "$" }

1 0

2.3.6 lib-smtp test failure in CentOS 6
by Peter 07 May '19

07 May '19

After applying the patches in my previous message... I'm getting the following when building dovecot for CentOS 6 (but not for CentOS 7): lmtp payload - normal: parallel pipelining ssl ....................... : ok CLIENT: Panic: file smtp-client-connection.c: line 1309 (smtp_client_connection_established): assertion failed: (!conn->connect_succeeded) CLIENT: Error: Raw backtrace: /builddir/build/BUILD/dovecot-2.3.6/src/lib-smtp/.libs/lt-test-smtp-payload() [0x4547ea] -> /builddir/build/BUILD/dovecot-2.3.6/src/lib-smtp/.libs/lt-test-smtp-payload() [0x454891] -> /builddir/build/BUILD/dovecot-2.3.6/src/lib-smtp/.libs/lt-test-smtp-payload(_start+0) [0x4193f8] -> /builddir/build/BUILD/dovecot-2.3.6/src/lib-smtp/.libs/lt-test-smtp-payload() [0x41fb95] -> /builddir/build/BUILD/dovecot-2.3.6/src/lib-smtp/.libs/lt-test-smtp-payload() [0x4203f0] -> /builddir/build/BUILD/dovecot-2.3.6/src/lib-smtp/.libs/lt-test-smtp-payload() [0x421d77] -> /builddir/build/BUILD/dovecot-2.3.6/src/lib-smtp/.libs/lt-test-smtp-payload(smtp_client_command_input_reply+0x17d) [0x42ffdd] -> /builddir/build/BUILD/dovecot-2.3.6/src/lib-smtp/.libs/lt-test-smtp-payload() [0x42145b] -> /builddir/build/BUILD/dovecot-2.3.6/src/lib-smtp/.libs/lt-test-smtp-payload(io_loop_call_io+0x61) [0x461d81] -> /builddir/build/BUILD/dovecot-2.3.6/src/lib-smtp/.libs/lt-test-smtp-payload(io_loop_handler_run_internal+0xd6) [0x463c16] -> /builddir/build/BUILD/dovecot-2.3.6/src/lib-smtp/.libs/lt-test-smtp-payload(io_loop_handler_run+0x59) [0x461e79] -> /builddir/build/BUILD/dovecot-2.3.6/src/lib-smtp/.libs/lt-test-smtp-payload(io_loop_run+0x38) [0x4620a8] -> /builddir/build/BUILD/dovecot-2.3.6/src/lib-smtp/.libs/lt-test-smtp-payload() [0x41a619] -> /builddir/build/BUILD/dovecot-2.3.6/src/lib-smtp/.libs/lt-test-smtp-payload() [0x41aaa8] -> /builddir/build/BUILD/dovecot-2.3.6/src/lib-smtp/.libs/lt-test-smtp-payload() [0x41ab7d] -> /builddir/build/BUILD/dovecot-2.3.6/src/lib-smtp/.libs/lt-test-smtp-payload() [0x44beae] -> /builddir/build/BUILD/dovecot-2.3.6/src/lib-smtp/.libs/lt-test-smtp-payload(test_run+0x11) [0x44c011] -> /builddir/build/BUILD/dovecot-2.3.6/src/lib-smtp/.libs/lt-test-smtp-payload(main+0x115) [0x419d65] -> /lib64/libc.so.6(__libc_start_main+0x100) [0x7f3850d4ad20] -> /builddir/build/BUILD/dovecot-2.3.6/src/lib-smtp/.libs/lt-test-smtp-payload() [0x419421] /bin/sh: line 1: 28384 Aborted ./$bin make[3]: Leaving directory `/builddir/build/BUILD/dovecot-2.3.6/src/lib-smtp' make[3]: *** [check-local] Error 1 make[2]: *** [check-am] Error 2 make[2]: Leaving directory `/builddir/build/BUILD/dovecot-2.3.6/src/lib-smtp' make[1]: *** [check-recursive] Error 1 make[1]: Leaving directory `/builddir/build/BUILD/dovecot-2.3.6/src' make: *** [check-recursive] Error 1 error: Bad exit status from /var/tmp/rpm-tmp.9PlfRJ (%check) Peter

2 4

regression with lmtp_hdr_delivery_address in 2.3
by dovecot-ffe7＠ryanc.org 07 May '19

07 May '19

Hi, In my LMTP config, I have lmtp_hdr_delivery_address = none. Under 2.2, Received headers looked like this: Received: from smtp.example.com by lmtp.example.com with LMTP id +IVdKS81cFwWagAAGhmRSA ; Fri, 22 Feb 2019 17:45:19 +0000 After the update to 2.3, they look like this: Received: from smtp.example.com by lmtp.example.com with LMTP id MJbKAMFEclyKCQAAGhmRSA (envelope-from <yyy(a)example.net>) for <xxx(a)example.com>; Sun, 24 Feb 2019 07:16:17 +0000 In both cases I *do not* have a "Delivered-To" header I do see a check for rcpt_to == NULL in the smtp_server_transaction_write_trace_record function, but it looks like the lmtp_local_add_headers function does not update the transaction, so it doesn't get pulled in. Also, the LMTP settings struct isn't exposed in that function currently, and I'm not sure how to add it. In 2.2, both the "Delivered-To" and "Received" headers were handled by client_get_added_headers. Please CC me in replies, as I am not subscribed to the list. Thanks, Ryan

2 1

http-lib test failures when building dovecot-2.3.5 and later in mock builder
by Tuomo Soini 07 May '19

07 May '19

There is random failure in test-http-payload when building rpm package from 2.3.6. I couldn't reproduce that in normal system but that happens something like every second try in mock chroot build envirnoment. Other tests don't have issues so it looks like test is not very reliable. Building 2.3.4 didn't yet have this issue. ./test-http-payload -D output attached. -- Tuomo Soini <tis(a)foobar.fi> Foobar Linux services +358 40 5240030 Foobar Oy <https://foobar.fi/>

2 1

dynamic virtual mailboxes?
by MRob 06 May '19

06 May '19

hi, I spent time learning about virtual mailboxes. Is there some way to create dynamic virtual mailboxes? I mean, when I look at a mailbox, I want to see only unread messages or flagged messages in that mailbox.

2 5

Understanding virtual mailboxes (examples in 15-mailboxes.conf)
by MRob 05 May '19

05 May '19

The examples in 15-mailboxes.conf # If you have a virtual "All messages" mailbox: #mailbox virtual/All { # special_use = \All # comment = All my messages #} # If you have a virtual "Flagged" mailbox: #mailbox virtual/Flagged { # special_use = \Flagged # comment = All my flagged messages #} They seem to reference some kind of virtual mailbox setup that doesn't compare to the docs for the "virtual" plugin. That plugin says we should create a separate namespace instead, like "namespace virtual" and put files representing the virtual folders into user maildirs. What if we use mdbox? add the files to user/mailboxes director I will guess. Is there a way to use the mailbox examples in the inbox namespace in the default config? Does it use some other method different from the virtual plugin? maybe more config hints for those examples would be helpful. Thank you.

2 3

Feature request - blacklistd interaction
by Lefteris Tsintjelis 04 May '19

04 May '19

Would be really really REALLY nice to have dovecot interact directly with blacklistd! Makes a huge difference on busy systems and beats log parsing by far. Thank you

2 2

Feature request: additional commands for doveadm HTTP API
by Peter Kubica 04 May '19

04 May '19

Hi, I hope this is correct way of making a feature request. I like doveadm HTTP API very much and use it for Zabbix monitoring. Would be possible to add "replicator status" and "auth test" doveadm commands to HTTP API? Thanks. Kind regards, Peter

1 0

2.3.6 lib-http assert failure
by Peter 02 May '19

02 May '19

connection lost after 100-continue ................................... : ok test-http-client-errors.c:1319: Assert failed: resp->status == 200 /bin/sh: line 1: 25431 Segmentation fault ./$bin make[3]: Leaving directory `/builddir/build/BUILD/dovecot-2.3.6/src/lib-http' make[3]: *** [check-local] Error 1 make[2]: Leaving directory `/builddir/build/BUILD/dovecot-2.3.6/src/lib-http' make[2]: *** [check-am] Error 2 make[1]: *** [check-recursive] Error 1make[1]: Leaving directory `/builddir/build/BUILD/dovecot-2.3.6/src' I tried applying the following patches: https://github.com/dovecot/core/commit/82e3ba00ef449dcead8af1885c2d323fd8cf… https://github.com/dovecot/core/commit/7debc474f2b4f5e24a9ba27a6b8adb4d5f78… ...which seem to fix the issue at least for CentOS 7 (CentOS 6 then errors out in the lib-smtp tests, see next post for details). It looks like there are some bug fix patches that didn't make it to the 2.3 branch. Peter

1 0

Re: v2.3.6 Configure fail 'libssl not found' macOS
by James Brown 01 May '19

01 May '19

> On 1 May 2019, at 4:38 pm, James Brown via dovecot <dovecot(a)dovecot.org <mailto:dovecot@dovecot.org>> wrote: > > No problems with 2.3.5, but when I try to compile 2.3.6 with: > > ./configure --with-mysql --with-ssl=openssl > > I get: > > checking for dlopen... yes > checking for SSL_read in -lssl... no > configure: error: Can't build with OpenSSL: libssl not found > > $ locate libssl > /Applications/BBEdit.app/Contents/XPCServices/GitIgnoreXPCService.xpc/Contents/Frameworks/libssl.dylib > /Applications/Navicat for MySQL.app/Contents/Frameworks/libssl.1.0.0.dylib > /Applications/assp/assp.mod/bin/libssl32.dll > /usr/lib/libssl.0.9.7.dylib > /usr/lib/libssl.0.9.8.dylib > /usr/lib/libssl.35.dylib > /usr/lib/libssl.43.dylib > /usr/lib/libssl.44.dylib > /usr/lib/libssl.dylib > /usr/local/Cellar/openssl/1.0.2r/lib/libssl.1.0.0.dylib > /usr/local/Cellar/openssl/1.0.2r/lib/libssl.a > /usr/local/Cellar/openssl/1.0.2r/lib/libssl.dylib > /usr/local/Cellar/openssl/1.0.2r/lib/pkgconfig/libssl.pc > /usr/local/Cellar/openssl(a)1.1/1.1.1b/lib/libssl.1.1.dylib > /usr/local/Cellar/openssl(a)1.1/1.1.1b/lib/libssl.a > /usr/local/Cellar/openssl(a)1.1/1.1.1b/lib/libssl.dylib > /usr/local/Cellar/openssl(a)1.1/1.1.1b/lib/pkgconfig/libssl.pc > /usr/local/lib/dovecot/libssl_iostream_openssl.a > /usr/local/lib/dovecot/libssl_iostream_openssl.la <http://libssl_iostream_openssl.la/> > /usr/local/lib/dovecot/libssl_iostream_openssl.so > > Any suggestions? > > Thanks, > > James. Sorry for the noise. export CPPFLAGS="-I/usr/local/opt/mysql(a)5.7/include/mysql -I/usr/local/Cellar/openssl(a)1.1/1.1.1b/include" export LDFLAGS="-L/usr/local/opt/mysql(a)5.7/lib -L/usr/local/opt/openssl(a)1.1/lib" ./configure --with-mysql --with-ssl=openssl Worked. James.

1 0

Feature request: exclude IP/network in allow_nets extra field
by Zhang Huangbin 01 May '19

01 May '19

Dear all, We use `allow_nets`[1] to restrict login clients, it works fine. Recently we need to allow some users to login from everywhere except some IP/networks, how can we accomplish this with "allow_nets"? Tried allow_nets="!a.b.c.d", but Dovecot reports error "allow_nets: Invalid network '!a.b.c.d'". Can we have this feature? i guess it should be done in function "auth_request_validate_networks"[2] in file src/auth/auth-request.c. [1] allow_nets: https://wiki.dovecot.org/PasswordDatabase/ExtraFields/AllowNets [2] https://github.com/dovecot/core/blob/fbc3ccc4a9a02b82073585a33254eacedc6a99…

6 11

v2.3.6 Configure fail 'libssl not found' macOS
by James Brown 01 May '19

01 May '19

No problems with 2.3.5, but when I try to compile 2.3.6 with: ./configure --with-mysql --with-ssl=openssl I get: checking for dlopen... yes checking for SSL_read in -lssl... no configure: error: Can't build with OpenSSL: libssl not found $ locate libssl /Applications/BBEdit.app/Contents/XPCServices/GitIgnoreXPCService.xpc/Contents/Frameworks/libssl.dylib /Applications/Navicat for MySQL.app/Contents/Frameworks/libssl.1.0.0.dylib /Applications/assp/assp.mod/bin/libssl32.dll /usr/lib/libssl.0.9.7.dylib /usr/lib/libssl.0.9.8.dylib /usr/lib/libssl.35.dylib /usr/lib/libssl.43.dylib /usr/lib/libssl.44.dylib /usr/lib/libssl.dylib /usr/local/Cellar/openssl/1.0.2r/lib/libssl.1.0.0.dylib /usr/local/Cellar/openssl/1.0.2r/lib/libssl.a /usr/local/Cellar/openssl/1.0.2r/lib/libssl.dylib /usr/local/Cellar/openssl/1.0.2r/lib/pkgconfig/libssl.pc /usr/local/Cellar/openssl(a)1.1/1.1.1b/lib/libssl.1.1.dylib /usr/local/Cellar/openssl(a)1.1/1.1.1b/lib/libssl.a /usr/local/Cellar/openssl(a)1.1/1.1.1b/lib/libssl.dylib /usr/local/Cellar/openssl(a)1.1/1.1.1b/lib/pkgconfig/libssl.pc /usr/local/lib/dovecot/libssl_iostream_openssl.a /usr/local/lib/dovecot/libssl_iostream_openssl.la <http://libssl_iostream_openssl.la/> /usr/local/lib/dovecot/libssl_iostream_openssl.so Any suggestions? Thanks, James.

1 0

Dovecot release v2.3.6
by Aki Tuomi 30 Apr '19

30 Apr '19

Hi! We are pleased to release Dovecot v2.3.6. Tarball is available at https://dovecot.org/releases/2.3/dovecot-2.3.6.tar.gz https://dovecot.org/releases/2.3/dovecot-2.3.6.tar.gz.sig Binary packages are available at https://repo.dovecot.org/ Changes ------- * CVE-2019-11494: Submission-login crashed with signal 11 due to null pointer access when authentication was aborted by disconnecting. * CVE-2019-11499: Submission-login crashed when authentication was started over TLS secured channel and invalid authentication message was sent. * auth: Support password grant with passdb oauth2. + Use system default CAs for outbound TLS connections. + Simplify array handling with new helper macros. + fts_solr: Enable configuring batch_size and soft_commit features. - lmtp/submission: Fixed various bugs in XCLIENT handling, including a hang when XCLIENT commands were sent infinitely to the remote server. - lmtp/submission: Forwarded multi-line replies were erroneously sent as two replies to the client. - lib-smtp: client: Message was not guaranteed to contain CRLF consistently when CHUNKING was used. - fts_solr: Plugin was no longer compatible with Solr 7. - Make it possible to disable certificate checking without setting ssl_client_ca_* settings. - pop3c: SSL support was broken. - mysql: Closing connection twice lead to crash on some systems. - auth: Multiple oauth2 passdbs crashed auth process on deinit. - HTTP client connection errors infrequently triggered a segmentation fault when the connection was idle and not used for a particular client instance. --- Aki Tuomi Open-Xchange oy

4 6

Pigeonhole release 0.5.6
by Aki Tuomi 30 Apr '19

30 Apr '19

Hi! We are pleased to release Pigeonhole 0.5.6 for Dovecot 2.3.6. Tarball https://pigeonhole.dovecot.org/releases/2.3/dovecot-2.3-pigeonhole-0.5.6.ta… https://pigeonhole.dovecot.org/releases/2.3/dovecot-2.3-pigeonhole-0.5.6.ta… Binary packages can be found from https://repo.dovecot.org/ Changes + sieve: Redirect loop prevention is sometimes ineffective. Improve existing loop detection by also recognizing the X-Sieve-Redirected-From header in incoming messages and dropping redirect actions when it points to the sending account. This header is already added by the redirect action, so this improvement only adds an additional use of this header. - sieve: Prevent execution of implicit keep upon temporary failure occurring at runtime. --- Aki Tuomi Open-Xchange oy

1 0

CVE-2019-11499: Submission-login crashes when authentication is started over TLS secured channel and invalid authentication message is sent
by Aki Tuomi 30 Apr '19

30 Apr '19

Open-Xchange Security Advisory 2019-04-30 Product: Dovecot Vendor: OX Software GmbH Internal reference: DOV-3223 (Bug ID) Vulnerability type: CWE-617 Vulnerable version: 2.3.0 - 2.3.5.2 Vulnerable component: submission-login Report confidence: Confirmed Solution status: Fixed by Vendor Fixed version: 2.3.6 Vendor notification: 2019-03-11 Solution date: 2019-04-23 Public disclosure: 2019-04-30 CVE reference: CVE-2019-11499 CVSS: 7.5 (CVSS3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vulnerability Details: Submission-login crashes when authentication is started over TLS secured channel and invalid authentication message is sent. This can lead to denial-of-service attack by persistent attacker(s). Workaround: Authentication crash can be avoided if authentication is done without TLS. Solution: Operators should upgrade to a fixed version.

1 0

CVE-2019-11494: Submission-login crashes with signal 11 due to null pointer access when authentication is aborted by disconnecting.
by Aki Tuomi 30 Apr '19

30 Apr '19

Open-Xchange Security Advisory 2019-04-30 Product: Dovecot Vendor: OX Software GmbH Internal reference: DOV-3212 (Bug ID) Vulnerability type: CWE-476 Vulnerable version: 2.3.0 - 2.3.5.2 Vulnerable component: submission-login Report confidence: Confirmed Researcher credits: Marcelo Coelho Solution status: Fixed by Vendor Fixed version: 2.3.6 Vendor notificatio: 2019-03-11 Solution date: 2019-04-23 Public disclosure: 2019-04-30 CVE reference: CVE-2019-11494 CVSS: 7.5 (CVSS3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vulnerability Details: Submission-login crashes with signal 11 due to null pointer access when authentication is aborted by disconnecting. This can lead to denial-of-service attack by persistent attacker(s). Workaround: There is no available workaround for this issue. Solution: Operators should upgrade to a fixed version.

1 0

Re: Sis to deduplicate attachments does not work?
by Daniel Miller 29 Apr '19

29 Apr '19

On April 23, 2019 10:54:38 PM luckydog xf <luckydogxf(a)gmail.com> wrote: > Is it worthwile to use dbox? seeing from > http://www.linuxmail.info/mbox-maildir-mail-storage-formats/ it may cause > file lock and easy to corrupt. As with everything - it depends. You're asking me so these are *my* opinions - and I do not claim to be anything more than a hobbyist/tinkerer when the comes to this. mbox has potential use for long term read-only archives - I see no reason to use it for live mailboxes. maildir is undoubtedly the least susceptible to corruption. It's also the slowest format for reading. How slow is "slow" depends on your hardware - it may be imperceptible with enough RAM and SSD's - or it may result in user complaints with large mailboxes. dbox is Dovecot's preferred format. I know Timo has put a lot of effort into it. sdbox is similar to maildir in that each mail is a separate file. mdbox significantly reduces the number of files which can make file-based backups faster. Both dbox formats are dependent on their index files. If you've got good hardware, including a proper UPS, I'd recommend dbox (my server is presently using sdbox). With large mailboxes and file-based backups you'll benefit from mdbox. When reliability is the #1 concern above anything else - use maildir. Depending on your use SIS can have significant impact on storage requirements - but storage these days is relatively cheap. I haven't seen much feedback from users actively using SIS - I'd love to hear from high traffic sites with SIS experience to know if the corruption issues have been resolved. In my case there was at least a 30% reduction in space but I had too many errors - admittedly it's been a couple years since I last tried it. -- Daniel

3 3

Using lmtp to authenticate email users
by Patrick Mahan 29 Apr '19

29 Apr '19

FreeBSD 11.2 Postfix 3.3.2 Dovecot 2.3.4 I am trying to use dovecot lmtp with postfix to verify authentication of incoming email and to avoid being a spam relay (an issue I was having using sendmail as my MTA). I am getting the following log message in /var/log/maillog: Mar 30 20:31:38 ns postfix/smtpd[40373]: NOQUEUE: reject: RCPT from mail-eopbgr750091.outbound.protection.outlook.com[40.107.75.91]: 450 4.1.1 < mahan(a)mahan.org>: Recipient address rejected: unverified address: host ns.mahan.org[private/dovecot-lmtp] said: 550 5.1.1 <mahan(a)mahan.org> User doesn't exist: mahan(a)mahan.org (in reply to RCPT TO command); from=< pmahan(a)silver-peak.com> to=<mahan(a)mahan.org> proto=ESMTP helo=< NAM02-BL2-obe.outbound.protection.outlook.com> 'mahan' does exist on ns.mahan.org. So I am confused to why lmtp is failing to find this username. Thanks, Patrick

4 5

used Lazyexpunge
by lty 28 Apr '19

28 Apr '19

I used Lazyexpunge. I tried to create .DELETED without any hints and see that the creation was successful. I want to prevent users from creating .DELETED, what should I do? My settings > plugin { > lazy_expunge = .DELETED/ > } > # > > namespace { > prefix = .DELETED/ > hidden = yes > list = no > separator = / > location = maildir:/var/vmail/backup/expunged/%d/%n > }

2 1

Auto rebuilding of Solr indexes on settings change?
by Peter Mogensen 25 Apr '19

25 Apr '19

Hi, Looking at the source, it doesn't seem like fts-solr checks for settings changes using fts_index_have_compatible_settings() like fts-lucene does. Is there any special reason for why fts-solr shouldn't also rebuild indexes if settings has changed? /Peter

2 1

msg header has bad magic value
by 김태용 25 Apr '19

25 Apr '19

There was an error saving the message. 'Error: Corrupted dbox file /storage/m.1 (around offset = 21589): msg header has bad magic value' Why do I get an error? How can I fix it?

1 0

haproxy + submission services -> postfix failure
by Chris Thomas 24 Apr '19

24 Apr '19

Hi, I have a nginx server which is using the proxy protocol to forward tcp connections to dovecot. Dovecot is configured to be a submission service for email to be sent. Then postfix should send the email itself which is also using the ha proxy protocol. There are a few moving parts in this problem so I'm not sure where the problem is. But I want to ask if somebody can validate my dovecot configuration somehow so I can start to tick off some things from the list. Sending email fails, seems to get to postfix, then die Receiving emails succeeds and I don't have any problem to pick them up. I've figured out some stuff, like lmtp shouldn't use haproxy when talking between postfix -> dovecot for receiving emails. If I enable the protocol on lmtp, I can't receive any emails at all. In order to get postfix to accept emails, I enabled haproxy protocol and enabled postscreen and then postfix could access the source ip and stop my server from being an open relay. I've got tls certificates installed on dovecot and postfix, all created by letsencrypt and I don't appear to have any problems with them. I will try to give as much information about the config as I can, I'm not sure what other parts are good to have, but let me know if you are missing something or want to check a value. >> 10-master.conf: service submission-login { inet_listener submission { port = 587 haproxy = yes } } service lmtp { inet_listener lmtp { port = 24 haproxy = no } } >> 20-submission.conf submission_relay_host = postfix.mail-server submission_relay_port = 25 submission_relay_ssl = starttls submission_relay_ssl_verify = yes Then because it might help to give the other side of the connection configuration for postfix, here is the relevant information: >> master.cf: smtp inet n - - - 1 postscreen smtpd pass - - - - - smtpd >> main.cf postscreen_upstream_proxy_protocol = haproxy postscreen_upstream_proxy_timeout = 10s That's it. I don't know what other information could be useful. There are some logs, they are like this (I've got logging turned on for pretty much every option I have: Dovecot logs: Apr 19 17:54:47 submission(__EMAIL__)<497><KUGA0OWG8XlfW/Q8>: Debug: Added userdb setting: plugin/quota_rule=*:bytes=0 Apr 19 17:54:47 submission(__EMAIL__)<497><KUGA0OWG8XlfW/Q8>: Debug: Effective uid=8, gid=8, home=/mail/__DOMAIN_COM__/__USER__ Apr 19 17:54:47 submission(__EMAIL__)<497><KUGA0OWG8XlfW/Q8>: Debug: Namespace inbox: type=private, prefix=, sep=, inbox=yes, hidden=no, list=yes, subscriptions=yes location=maildir:/mail/__DOMAIN_COM__/__USER__ Apr 19 17:54:47 submission(__EMAIL__)<497><KUGA0OWG8XlfW/Q8>: Debug: maildir++: root=/mail/__DOMAIN_COM__/__USER__, index=, indexpvt=, control=, inbox=/mail/__DOMAIN_COM__/__USER__, alt= Apr 19 17:54:47 submission(__EMAIL__)<497><KUGA0OWG8XlfW/Q8>: Debug: smtp-server: conn __IP_ADDR_1__:31217 [0]: Connection created Apr 19 17:54:47 submission(__EMAIL__)<497><KUGA0OWG8XlfW/Q8>: Debug: smtp-client: conn postfix.mail-server:25 [0]: Connection created Apr 19 17:54:47 submission(__EMAIL__)<497><KUGA0OWG8XlfW/Q8>: Debug: smtp-client: conn postfix.mail-server:25 [0]: Looking up IP address Apr 19 17:54:47 submission(__EMAIL__)<497><KUGA0OWG8XlfW/Q8>: Debug: smtp-client: conn postfix.mail-server:25 [0]: DNS lookup successful; got 1 IPs Apr 19 17:54:47 submission(__EMAIL__)<497><KUGA0OWG8XlfW/Q8>: Debug: smtp-client: conn postfix.mail-server:25 [0]: Connecting to 10.104.211.161:25 Apr 19 17:54:47 submission(__EMAIL__)<497><KUGA0OWG8XlfW/Q8>: Debug: smtp-client: conn postfix.mail-server:25 [0]: Connected Apr 19 17:54:57 submission(__EMAIL__)<497><KUGA0OWG8XlfW/Q8>: Debug: smtp-client: conn postfix.mail-server:25 [0]: Received greeting from server: 421 4.3.2 No system resources Apr 19 17:54:57 submission(__EMAIL__)<497><KUGA0OWG8XlfW/Q8>: Debug: smtp-client: conn postfix.mail-server:25 [0]: Connection failed: 421 4.3.2 No system resources Apr 19 17:54:57 submission(__EMAIL__)<497><KUGA0OWG8XlfW/Q8>: Error: Failed to establish relay connection: 421 4.3.2 No system resources Apr 19 17:54:57 submission(__EMAIL__)<497><KUGA0OWG8XlfW/Q8>: Debug: smtp-client: conn postfix.mail-server:25 [0]: Disconnected Apr 19 17:54:57 submission(__EMAIL__)<497><KUGA0OWG8XlfW/Q8>: Info: Disconnect from __IP_ADDR_1__: Failed to establish relay connection in=0 out=22 (state=GREETING) Apr 19 17:54:57 submission(__EMAIL__)<497><KUGA0OWG8XlfW/Q8>: Debug: smtp-server: conn __IP_ADDR_1__:31217 [0]: Disconnected: Failed to establish relay connection Postfix Logs: postfix/postscreen[525]: warning: haproxy read: time limit exceeded If anybody could help out, I'd be grateful because I just can't see what the problem is. Chris

2 1

lmtp_save_to_detail_mailbox override
by Andreas Thienemann 24 Apr '19

24 Apr '19

Hi, I have a dovecot 2.3.2.1 instance running here that is getting userdb and passdb data from a SQL database. This was a cyrus server migrated over and all users are happy. All users except one: Said user asked if it would be possible to disable subaddressing (localuser+folder(a)example.com) again. The setting controlling that is AFAIK the lmtp_save_to_detail_mailbox item. My idea was to override that setting for the specific user. I changed the user_query to return no for the user in question and all seems well: # doveadm user test field value user test(a)example.com uid vmail gid vmail home /var/lib/imap/example.com/test mail mdbox:/var/spool/imap/user/example.com/test lmtp_save_to_detail_mailbox no # Looks good, doesn't work though. Mail is still delivered to the +folder. Is this per user setting not taken into account? I could probably provide the user in question with a sieve script that files everything into the INBOX again but I wonder if there's a better way? cheers, Andreas

3 3

pigeonhole tests crashing in deleteheader.svtest
by Michal Hlavinka 24 Apr '19

24 Apr '19

Hi, when trying to build dovecot 2.3.5.1 pigeonhole testsuite crashes in Test case: ./tests/extensions/editheader/deleteheader.svtest: 1: Test 'Deleteheader - nonexistent' SUCCEEDED 2: Test 'Deleteheader - nonexistent (match)' SUCCEEDED 3: Test 'Deleteheader - one' SUCCEEDED 4: Test 'Deleteheader - two (first)' SUCCEEDED 5: Test 'Deleteheader - two (last)' SUCCEEDED 6: Test 'Deleteheader - :index' SUCCEEDED 7: Test 'Deleteheader - :index :last' SUCCEEDED 8: Test 'Deleteheader - implicit keep' SUCCEEDED make: *** [Makefile:1190: tests/extensions/editheader/deleteheader.svtest] Segmentation fault (core dumped) Let me know if you need more debug information. Cheers Michal Hlavinka #0 0x00007f9924faea8a in __strlen_sse2 () from /lib64/libc.so.6 #1 0x00007f992514fdd2 in smtp_address_clone (pool=0x7f992528dce0 <static_system_pool>, src=src@entry=0x7ffd30eace10) at smtp-address.c:632 #2 0x000055f7330916b3 in testsuite_message_set_data (mail=0x55f73486f848) at testsuite-message.c:96 #3 0x000055f7330918b9 in testsuite_message_set_file (renv=renv@entry=0x55f734856ac0, file_path=<optimized out>) at testsuite-message.c:139 #4 0x000055f7330931cc in testsuite_smtp_get (renv=renv@entry=0x55f734856ac0, index=<optimized out>) at testsuite-smtp.c:171 #5 0x000055f73309566c in cmd_test_message_smtp_operation_execute (renv=0x55f734856ac0, address=<optimized out>) at cmd-test-message.c:404 #6 0x00007f992543f371 in sieve_interpreter_operation_execute (interp=0x55f734856a68) at sieve-interpreter.c:911 #7 sieve_interpreter_continue (interp=0x55f734856a68, interrupted=0x0) at sieve-interpreter.c:949 #8 0x00007f992543f5d1 in sieve_interpreter_run (interp=0x55f734856a68, result=<optimized out>) at sieve-interpreter.c:999 #9 0x000055f73308f670 in testsuite_run (msgdata=<optimized out>, ehandler=<optimized out>, senv=0x7ffd30eacfa0, sbin=<optimized out>) at testsuite.c:73 #10 main (argc=<optimized out>, argv=<optimized out>) at testsuite.c:203 (gdb) up #1 0x00007f992514fdd2 in smtp_address_clone (pool=0x7f992528dce0 <static_system_pool>, src=src@entry=0x7ffd30eace10) at smtp-address.c:632 632 dsize = strlen(src->domain) + 1; (gdb) p *src $4 = {localpart = 0x55f73480cdc8 "/tmp/dsieve-testsuite.1553794316.30960/smtp/0.eml", domain = 0x1 <error: Cannot access memory at address 0x1>}

3 5

Sis to deduplicate attachments does not work?
by luckydog xf 23 Apr '19

23 Apr '19

Hi, I use sis to deduplicate attachments, here is my `doveconf -n` ------------ auth_cache_size = 10 M auth_failure_delay = 5 secs auth_mechanisms = plain login auth_socket_path = /var/run/dovecot/auth-userdb auth_ssl_username_from_cert = yes auth_username_format = %Ln default_vsz_limit = 512 M lmtp_rcpt_check_quota = yes mail_attachment_detection_options = add-flags-on-save mail_attachment_dir = /var/mail/mail_attachment/ mail_debug = yes mail_gid = vmail mail_location = maildir:/var/mail/%n/Maildir mail_plugins = quota fts fts_solr mail_privileged_group = vmail mail_uid = vmail managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { auto = subscribe special_use = \Junk } mailbox Sent { auto = subscribe special_use = \Sent } mailbox Trash { auto = subscribe special_use = \Trash } prefix = } passdb { args = /etc/dovecot/dovecot-ldap.conf.ext driver = ldap } plugin { fts = solr fts_autoindex = yes fts_autoindex_exclude = \Junk fts_autoindex_exclude2 = \Trash fts_solr = break-imap-search url=http://localhost:8983/solr/dovecot/ quota = maildir:User quota quota_grace = 10%% quota_max_mail_size = 5M quota_over_flag_lazy_check = yes quota_over_flag_value = TRUE quota_rule = *:storage=100M quota_warning = storage=65%% quota-warning 65 %u quota_warning2 = storage=60%% quota-warning 60 %u sieve = file:~/sieve;active=~/.dovecot.sieve } protocols = imap lmtp sieve service auth-worker { user = $default_internal_user } service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0640 user = postfix } unix_listener auth-userdb { mode = 0777 user = $default_internal_user } user = $default_internal_user } service imap-login { inet_listener imap { port = 0 } inet_listener imaps { port = 993 ssl = yes } } service managesieve-login { inet_listener sieve { port = 4190 } process_min_avail = 0 service_count = 1 vsz_limit = 128 M } service pop3-login { inet_listener pop3 { port = 0 } inet_listener pop3s { port = 0 } } service quota-warning { executable = script /usr/local/bin/quota-warning.sh unix_listener quota-warning { user = vmail } user = vmail } service stats { unix_listener stats-writer { mode = 0666 } } service submission-login { inet_listener submission { port = 0 } } ssl = required ssl_cert = </etc/ssl/certs/dovecot.pem ssl_dh = # hidden, use -P to show it ssl_key = # hidden, use -P to show it userdb { driver = prefetch } userdb { args = /etc/dovecot/dovecot-ldap.conf.ext default_fields = home=/var/mail/%u driver = ldap } protocol !indexer-worker { mail_vsize_bg_after_count = 0 } protocol lda { mail_plugins = quota fts fts_solr sieve } protocol imap { mail_max_userip_connections = 5 mail_plugins = quota fts fts_solr imap_quota } protocol lmtp { mail_plugins = quota fts fts_solr } --------- I try to send an email and then forward this email to another recipient. No attachment is generated in `mail_attachment_dir`. Anything wrong ?

2 1

making selected accounts read-only
by Wojciech Puchar 23 Apr '19

23 Apr '19

how to make selected few accounts readonly by pop3/imap?

3 2

SolrCore 'dovecot' is not available due to init failure: fieldType 'text_general' not found in the schema
by luckydog xf 23 Apr '19

23 Apr '19

Hello, it seems an mismatch of schema file provided by dovecot-2.3.5.2 [root@mail conf]# pwd /var/solr/data/dovecot/conf # Below solrconfig.xml is from Solr-8.0.0. [root@mail conf]# grep text_general solrconfig.xml <str name="queryAnalyzerFieldType">text_general</str> field types. Text content will be indexed as "text_general" as <str name="fieldType">text_general</str> # schema is from /usr/share/doc/dovecot/solr-schema.xml dovecot-2.3.5.2 and the latest solr-8.0.0. It seems XMLs do not match each other. How can I fix this problem？ Thanks.

3 5

mbsync updating new emails but dovecot not reading them ? [2.3.3]
by Kunal A. 21 Apr '19

21 Apr '19

Hi, Once again sincere apologies for emailing here. My dovecot isn't reading the newly updated e-mails from the mbsync. I have tried running doveadm -D -v force-resync -u email1(a)example.com "Inbox/Public/Other Users/user1(a)example.com" Plese help if possible. Highly appreciate if someone could help here... Below is the debug log :- Debug: Loading modules from directory: /usr/lib64/dovecot Debug: Module loaded: /usr/lib64/dovecot/lib01_acl_plugin.so Debug: Module loaded: /usr/lib64/dovecot/lib10_quota_plugin.so Debug: Loading modules from directory: /usr/lib64/dovecot/doveadm Debug: Module loaded: /usr/lib64/dovecot/doveadm/lib10_doveadm_acl_plugin.so Debug: Skipping module doveadm_expire_plugin, because dlopen() failed: /usr/lib64/dovecot/doveadm/lib10_doveadm_expire_plugin.so: undefined symbol: expire_set_deinit (this is usually intentional, so just ignore this message) Debug: Module loaded: /usr/lib64/dovecot/doveadm/lib10_doveadm_quota_plugin.so Debug: Skipping module doveadm_fts_lucene_plugin, because dlopen() failed: /usr/lib64/dovecot/doveadm/lib20_doveadm_fts_lucene_plugin.so: undefined symbol: lucene_index_iter_deinit (this is usually intentional, so just ignore this message) Debug: Skipping module doveadm_fts_plugin, because dlopen() failed: /usr/lib64/dovecot/doveadm/lib20_doveadm_fts_plugin.so: undefined symbol: fts_user_get_language_list (this is usually intentional, so just ignore this message) Debug: Skipping module doveadm_mail_crypt_plugin, because dlopen() failed: /usr/lib64/dovecot/doveadm/libdoveadm_mail_crypt_plugin.so: undefined symbol: mail_crypt_box_get_pvt_digests (this is usually intentional, so just ignore this message) doveadm(email1(a)example.com)<20402><>: Debug: auth USER input: email1(a)example.com uid=5000 gid=5000 home=/var/mail/vhosts/ example.com/email1 doveadm(email1(a)example.com): Debug: Effective uid=5000, gid=5000, home=/var/mail/vhosts/example.com/email1 doveadm(email1(a)example.com): Debug: quota: No quota setting - plugin disabled doveadm(email1(a)example.com): Debug: Namespace inbox: type=private, prefix=INBOX/, sep=/, inbox=yes, hidden=no, list=yes, subscriptions=yes location=maildir:~/Maildir doveadm(email1(a)example.com): Debug: maildir++: root=/var/mail/vhosts/ example.com/email1/Maildir, index=, indexpvt=, control=, inbox=/var/mail/vhosts/example.com/email1/Maildir, alt= doveadm(email1(a)example.com): Debug: acl: initializing backend with data: vfile doveadm(email1(a)example.com): Debug: acl: acl username = email1(a)example.com doveadm(email1(a)example.com): Debug: acl: owner = 1 doveadm(email1(a)example.com): Debug: acl vfile: Global ACLs disabled doveadm(email1(a)example.com): Debug: Namespace : type=public, prefix=Public/, sep=/, inbox=no, hidden=no, list=children, subscriptions=yes location=maildir:/mnt/5ea86261-cfae-4e17-b21f-3a6c1a03d795/Email/fastmail:LAYOUT=fs doveadm(email1(a)example.com): Debug: fs: root=/mnt/5ea86261-cfae-4e17-b21f-3a6c1a03d795/Email/fastmail, index=, indexpvt=, control=, inbox=, alt= doveadm(email1(a)example.com): Debug: acl: initializing backend with data: vfile doveadm(email1(a)example.com): Debug: acl: acl username = email1(a)example.com doveadm(email1(a)example.com): Debug: acl: owner = 0 doveadm(email1(a)example.com): Debug: acl vfile: Global ACLs disabled doveadm(email1(a)example.com): Debug: Namespace : type=private, prefix=, sep=, inbox=no, hidden=yes, list=no, subscriptions=no location=fail::LAYOUT=none doveadm(email1(a)example.com): Debug: none: root=, index=, indexpvt=, control=, inbox=, alt= doveadm(email1(a)example.com): Debug: acl vfile: file /var/mail/vhosts/ example.com/email1/Maildir/dovecot-acl not found Doveconf output :- # 2.3.5 (513208660): /etc/dovecot/dovecot.conf # OS: Linux 5.0.7-200.fc29.x86_64 x86_64 Fedora release 29 (Twenty Nine) # Hostname: machine auth_mechanisms = plain login mail_debug = yes mail_gid = vmail mail_location = maildir:~/Maildir mail_plugins = acl quota mail_privileged_group = mail mail_uid = vmail mbox_write_locks = fcntl namespace { list = children location = maildir:/mnt/5ea86261-cfae-4e17-b21f-3a6c1a03d795/Email/fastmail:LAYOUT=fs prefix = Public/ separator = / subscriptions = yes type = public } namespace inbox { inbox = yes list = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = INBOX/ separator = / } passdb { driver = pam } passdb { args = /etc/dovecot/dovecot-sql.conf.ext driver = sql } plugin { acl = vfile acl_shared_dict = file:/var/mail/vhosts/example.com/Sharedbox } postmaster_address = postmaster at example.com protocols = imap pop3 service auth-worker { user = vmail } service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0666 user = postfix } unix_listener auth-userdb { mode = 0600 user = vmail } user = dovecot } service imap-login { inet_listener imap { port = 143 } inet_listener imaps { port = 993 ssl = yes } } service lmtp { unix_listener /var/spool/postfix/private/dovecot-lmtp { group = postfix mode = 0600 user = postfix } } service pop3-login { inet_listener pop3 { port = 0 } inet_listener pop3s { port = 995 ssl = yes } } ssl = required ssl_cert = </etc/pki/dovecot/certs/dovecot.pem ssl_cipher_list = PROFILE=SYSTEM ssl_key = # hidden, use -P to show it userdb { driver = passwd } userdb { args = uid=vmail gid=vmail home=/var/mail/vhosts/%d/%n driver = static } protocol lmtp { mail_plugins = quota acl sieve quota } protocol lda { mail_plugins = quota acl sieve } protocol imap { mail_plugins = acl quota imap_acl quota acl imap_quota }

1 1

FTS delays
by Joan Moreau 21 Apr '19

21 Apr '19

Hi When I do a FTS search (using Xapian plugin) in the BODY part, the plugins returns the matching IDs within few milliseconds (as seen in the log). However, roundcube (connected on dovecot) takes ages to show (headers only vie IMAP) the few results (I tested with a matching requests of 9 emails) What could be the root cause ? Thank you

6 24

maildirlock fails
by Martynas Bendorius 21 Apr '19

21 Apr '19

Hello, Maildirlock seems to panic on locking: [root@centos7 home]# /usr/libexec/dovecot/maildirlock "/home/user/imap/domain.com/email/Maildir" 10 Panic: BUG: No IOs or timeouts set. Not waiting for infinity. Error: Raw backtrace: /usr/lib/dovecot/libdovecot.so.0(+0xd90ee) [0x7f5bf02f10ee] -> /usr/lib/dovecot/libdovecot.so.0(+0xd9131) [0x7f5bf02f1131] -> /usr/lib/dovecot/libdovecot.so.0(i_fatal+0) [0x7f5bf0256efd] -> /usr/lib/dovecot/libdovecot.so.0(+0xf078c) [0x7f5bf030878c] -> /usr/lib/dovecot/libdovecot.so.0(io_loop_handler_run_internal+0x36) [0x7f5bf030b1f6] -> /usr/lib/dovecot/libdovecot.so.0(io_loop_handler_run+0x56) [0x7f5bf03099c6] -> /usr/lib/dovecot/libdovecot.so.0(io_loop_run+0x38) [0x7f5bf0309be8] -> /usr/libexec/dovecot/maildirlock(main+0x24a) [0x558ae0e032ca] -> /lib64/libc.so.6(__libc_start_main+0xf5) [0x7f5befe6d3d5] -> /usr/libexec/dovecot/maildirlock(+0x13a2) [0x558ae0e033a2] Is this a known issue? Thank you! -- Best regards, Martynas Bendorius

2 3

stats-writer error is back
by unknown＠example.com 20 Apr '19

20 Apr '19

Afer a reboot (and installation of postfix-3.4.5) I am getting the stat-writer permission denied error again. from doveconf -n service stats { unix_listener stats-reader { user = dovecot } unix_listener stats-writer { user = dovecot } } # ls -ls /var/run/dovecot/stats-writer 0 srw-rw---- 1 dovecot dovecot 0 Apr 20 04:34 /var/run/dovecot/stats-writer Apr 20 04:45:00 mail postfix/pipe[80136]: 44mTxm3Mblzc3Td: to=<munged>, relay=dovecot, delay=0.06, delays=0.02/0.02/0/0.02, dsn=2.0.0, status=sent (delivered via dovecot service (lda(,munged,)Error: net_connect_unix(/var/run/dovecot/stats-writer) failed: Permiss)) -- W is for WINNIE embedded in ice X is for XERXES devoured by mice

3 6

Extended logging / moved mails jumping back
by Martin Müller 20 Apr '19

20 Apr '19

Hi! About 4-6 MUA Thunderbird 60.6.1 are going to connect with dovecot 2.2.13/IMAP (debian 8) and are using the same user/password. This setup works for years flawless (updated clients and serversoftware). Since a few weeks there is one major trouble: I one of the client moves a mail from the inbox to a another IMAP-Folder, most of the moved mail are moved for the moment. But an unstable period later, the mails are moved back to the inbox. In rarely cases, the moved mail is copied (one in the inbox, one in the destinationfolder). Now I have to check, if this a Thunderbird-Issue or is this a dovecot-issue. For that reason, I will activate the extended logging of dovecot. ### ### ### ### dovecot -n # 2.2.13: /etc/dovecot/dovecot.conf # OS: Linux 3.16.0-6-amd64 x86_64 Debian 8.11 auth_mechanisms = plain login debug_log_path = /var/log/mail.dovecot-debug disable_plaintext_auth = no info_log_path = /var/log/mail.dovecot-info listen = *,[::] log_path = /var/log/mail.dovecot-error log_timestamp = "%Y-%m-%d %H:%M:%S " mail_debug = yes mail_max_userip_connections = 100 mail_privileged_group = vmail passdb { args = /etc/dovecot/dovecot-sql.conf driver = sql } plugin { mail_log_events = delete undelete expunge copy mailbox_delete mailbox_rename mail_log_fields = uid box msgid size quota = dict:user::file:/var/vmail/%d/%n/.quotausage sieve = /var/vmail/%d/%n/.sieve sieve_max_redirects = 25 } protocols = imap pop3 service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0660 user = postfix } unix_listener auth-userdb { group = vmail mode = 0600 user = vmail } user = root } service imap-login { client_limit = 1000 process_limit = 512 } service lmtp { unix_listener /var/spool/postfix/private/dovecot-lmtp { group = postfix mode = 0600 user = postfix } } ssl_cert = </etc/postfix/smtpd.cert ssl_key = </etc/postfix/smtpd.key ssl_protocols = !SSLv3 userdb { driver = prefetch } userdb { args = /etc/dovecot/dovecot-sql.conf driver = sql } protocol imap { mail_plugins = quota imap_quota } protocol pop3 { mail_plugins = quota pop3_uidl_format = %08Xu%08Xv } protocol lda { mail_plugins = sieve quota postmaster_address = postmaster(a)monarch.products4more.at } protocol lmtp { mail_plugins = quota sieve postmaster_address = postmaster(a)monarch.products4more.at } ### ### ### ### ### ### ### ### It works: dovecot logs to three differnt logfiles /var/log/mail.dovecot-* It doesnt work: plugin { mail_log_events = delete undelete expunge copy mailbox_delete mailbox_rename mail_log_fields = uid box msgid size } I cant see such events in the logfiles. Which switch is to turn on to log all events? Or do anyone know the reason for the annoying "copy/move-the-mail-back"-issue? Thank you in advance for all inputs. regards, martin

4 5

[Dovecot] Dovecot LDA/LMTP vs postfix virtual delivery agent and the x-original-to header
by Charles Marcus 19 Apr '19

19 Apr '19

On 2012-04-05 4:18 AM, Thomas Leuxner <tlx(a)leuxner.net> wrote: > Also with 2.x you may want to use LMTP rather than the LDA Piping. > > http://wiki2.dovecot.org/HowTo/PostfixDovecotLMTP I am preparing to convert my main client's postfix_courier-imap setup to dovecot 2.1, which currently just uses the postfix virtual delivery agent... Does anyone know if the use of LMTP (or even the dovecot LDA) still loses the x-original-to header that the postfix vda adds and that I rely heavily on (since I use a lot of aliases), and if it does, is there any solution to get the original recipient added back in before final delivery? Everything I'm reading says that LMTP is better, but I really do need this header (or one like it) to be there so I know who the original recipient was (for filtering and other purposes). Thanks, -- Best regards, Charles

8 16

OAuth Passdb Grant
by Tom 19 Apr '19

19 Apr '19

I'm trying to implement the password grant flow, as specified at https://wiki2.dovecot.org/PasswordDatabase/oauth2, but am getting an error message. Can you please help? auth: Fatal: oauth2 /etc/dovecot/dovecot-oauth2.token.conf.ext: Error in configuration file /etc/dovecot/dovecot-oauth2.token.conf.ext line 1: Unknown setting: grant_url $ dovecot -n # 2.3.5.2 (38c8f1daf): /etc/dovecot/dovecot.conf # OS: Linux 3.10.0-957.10.1.el7.x86_64 x86_64 CentOS Linux release 7.6.1810 (Core)

2 1

v2.3.5.2 released
by Aki Tuomi 18 Apr '19

18 Apr '19

Lets try again, put wrong changelog to the mail. Sorry about this. https://dovecot.org/releases/2.3/dovecot-2.3.5.2.tar.gz https://dovecot.org/releases/2.3/dovecot-2.3.5.2.tar.gz.sig Binary packages in https://repo.dovecot.org/ * CVE-2019-10691: Trying to login with 8bit username containing invalid UTF8 input causes auth process to crash if auth policy is enabled. This could be used rather easily to cause a DoS. Similar crash also happens during mail delivery when using invalid UTF8 in From or Subject header when OX push notification driver is used. --- Aki Tuomi Open-Xchange oy

2 2

Problems with auth connection
by Fernando Ortega 18 Apr '19

18 Apr '19

Hi, We are having some issues with the auth connection Version: 2.3.5.1, with MySQL and Postfix The server is working fine, and randomly after some days, Dovecot fails to auth: Apr 18 14:25:16 mail dovecot[25013]: auth: Warning: Event 0x126eba20 leaked (parent=0x126eb820): auth-request.c:89 Apr 18 14:25:16 mail dovecot[25013]: auth: Warning: Event 0x126eb420 leaked (parent=0x0): auth-client-connection.c:338 It's neccesary to restart dovecot, and once restarted the server start to work fine again and deliver emails What do you think i could do? Thank you, best regards Fernando

1 0

ssl_verify_server_cert against SAN?
by TG Servers 18 Apr '19

18 Apr '19

3 5

CVE-2019-10691: JSON encoder in Dovecot 2.3 incorrecty assert-crashes when encountering invalid UTF-8 characters.
by Aki Tuomi 18 Apr '19

18 Apr '19

Dear subscribers, we're sharing our latest advisory with you and would like to thank everyone who contributed in finding and solving those vulnerabilities. Feel free to join our bug bounty programs (open-xchange, dovecot, powerdns) at HackerOne. You can find binary packages at https://repo.dovecot.org/ Yours sincerely, Aki Tuomi Open-Xchange Oy Open-Xchange Security Advisory 2019-04-18 Product: Dovecot Vendor: OX Software GmbH Internal reference: DOV-3173 (Bug ID) Vulnerability type: CWE-176 Vulnerable version: 2.3.0 - 2.3.5.1 Vulnerable component: json encoder Report confidence: Confirmed Researcher credits: cPanel L.L.C. Solution status: Fixed by Vendor Fixed version: 2.3.5.2 Vendor notification: 2019-04-02 Solution date: 2019-04-11 Public disclosure: 2019-04-18 CVE reference: CVE-2019-10691 CVSS: 7.5 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vulnerability Details: JSON encoder in Dovecot 2.3 incorrecty assert-crashes when encountering invalid UTF-8 characters. This can be used to crash dovecot in two ways. Attacker can repeatedly crash Dovecot authentication process by logging in using invalid UTF-8 sequence in username. This requires that auth policy is enabled. Crash can also occur if OX push notification driver is enabled and an email is delivered with invalid UTF-8 sequence in From or Subject header. In 2.2, malformed UTF-8 sequences are forwarded "as-is", and thus do not cause problems in Dovecot itself. Target systems should be checked for possible problems in dealing with such sequences. See https://wiki.dovecot.org/Authentication/Policy for details on auth policy support. Risk: Determined attacker can prevent authentication process from staying up by keeping on attempting to log in with username containing invalid UTF-8 sequence. Steps to reproduce: Configure dovecot with auth_policy_server_url and auth_policy_hash_nonce set. Attempt to log in with username containing an invalid UTF-8 sequence Observe assert-crash in dovecot logs. Solution: Operators should update to the latest Patch Release or disable auth policy support.

1 0

v2.3.5.2 released
by Aki Tuomi 18 Apr '19

18 Apr '19

https://dovecot.org/releases/2.3/dovecot-2.3.5.2.tar.gz https://dovecot.org/releases/2.3/dovecot-2.3.5.2.tar.gz.sig Binary packages in https://repo.dovecot.org/ * CVE-2019-7524: Missing input buffer size validation leads into arbitrary buffer overflow when reading fts or pop3 uidl header from Dovecot index. Exploiting this requires direct write access to the index files. --- Aki Tuomi Open-Xchange oy

1 0

Problem with mysql backend and SSL ciphers
by TG Servers 18 Apr '19

18 Apr '19

3 3

Documentation update
by azurit＠pobox.sk 18 Apr '19

18 Apr '19

Hi guys, this page needs to be updated: https://wiki2.dovecot.org/MailLocation/Maildir#Control_files (link was from here: https://wiki2.dovecot.org/MailLocation) Section 'Control files' is mentioning only 2 files but, in fact, Dovecot will store some additional files in CONTROL location: dovecot-uidvalidity dovecot-uidvalidity.* subscriptions (anything more?) Even more, page https://wiki2.dovecot.org/MailLocation has missing note to CONTROL files location about storing files 'dovecot-uidlist' and 'dovecot-keywords' of INBOX inside .INBOX directory instead of root directory (as it's stored inside mailbox). Missing anything from above will cause re-downloading of all e-mails by e-mail clients! And finally, i'm attaching a Python script which will safely copy/move CONTROL files from mail_location to new location (btw, moving it on SSD storage caused quite high performance boost in our environment). azur

2 1

Full mail
by Yevgeny Kosarzhevsky 18 Apr '19

18 Apr '19

Hello, I am getting strange messages on logs and I cannot find any reason. Could someone point me on what's wrong with my dovecot configuration? ~# dovecot -n # 2.3.4.1 (f79e8e7e4): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.4 () # OS: Linux 4.9.0-8-amd64 x86_64 Debian 9 ext4 ~# grep 'full mail' //var/log/dovecot.log Apr 16 19:25:43 imap(phaoost(a)phaoost.net)<15956><bv4DlqqGQNC5LcCN>: Debug: Mailbox INBOX: UID 3: Opened mail because: full mail Apr 16 19:29:06 imap(phaoost(a)phaoost.net)<17588><U1oXyKqGKNG5LcCN>: Debug: Mailbox INBOX: UID 4: Opened mail because: full mail Apr 16 20:28:19 imap(phaoost(a)phaoost.net)<21808><pT01V6uGgtO5LcCN>: Debug: Mailbox INBOX: UID 6: Opened mail because: full mail Apr 16 22:22:38 imap(phaoost(a)phaoost.net)<32077><lQTltKyGItq5LcCN>: Debug: Mailbox INBOX: UID 7: Opened mail because: full mail Apr 16 22:55:57 imap(phaoost(a)phaoost.net)<3732><hw1UQ62GWt25LcCN>: Debug: Mailbox INBOX: UID 8: Opened mail because: full mail Apr 16 23:37:12 imap(phaoost(a)phaoost.net)<8139><+2dd262G3N+5LcCN>: Debug: Mailbox INBOX: UID 9: Opened mail because: full mail Apr 17 01:09:13 imap(phaoost(a)phaoost.net)<8041><BqWBiK+GAua5LcCN>: Debug: Mailbox Trash: UID 3: Opened mail because: full mail Apr 17 01:09:13 imap(phaoost(a)phaoost.net)<8041><BqWBiK+GAua5LcCN>: Debug: Mailbox Trash: UID 4: Opened mail because: full mail Apr 17 01:09:13 imap(phaoost(a)phaoost.net)<8041><BqWBiK+GAua5LcCN>: Debug: Mailbox Trash: UID 5: Opened mail because: full mail Apr 17 01:09:13 imap(phaoost(a)phaoost.net)<8041><BqWBiK+GAua5LcCN>: Debug: Mailbox Trash: UID 6: Opened mail because: full mail Apr 17 01:09:13 imap(phaoost(a)phaoost.net)<8041><BqWBiK+GAua5LcCN>: Debug: Mailbox Trash: UID 7: Opened mail because: full mail Apr 17 04:34:44 imap(phaoost(a)phaoost.net)<23874><PC06DLKGaoC5LcCN>: Debug: Mailbox INBOX: UID 10: Opened mail because: full mail Apr 17 05:45:21 imap(phaoost(a)phaoost.net)<17176><fcoRZLOGHIW5LcCN>: Debug: Mailbox INBOX: UID 11: Opened mail because: full mail Apr 17 07:00:10 imap(phaoost(a)phaoost.net)<5348><bG6Ub7SGKom5LcCN>: Debug: Mailbox INBOX: UID 12: Opened mail because: full mail Apr 17 07:35:58 imap(phaoost(a)phaoost.net)<8078><QsTyj7SGyom5LcCN>: Debug: Mailbox INBOX: UID 13: Opened mail because: full mail Apr 17 08:25:17 imap(phaoost(a)phaoost.net)<29005><Zyr3n7WGIJC5LcCN>: Debug: Mailbox INBOX: UID 14: Opened mail because: full mail Apr 17 10:36:54 imap(phaoost(a)phaoost.net)<31565><TcqvdreGwJi5LcCN>: Debug: Mailbox INBOX: UID 15: Opened mail because: full mail Apr 17 11:08:27 imap(phaoost(a)phaoost.net)<7864><0+xW57eGjJq5LcCN>: Debug: Mailbox INBOX/Spam: UID 1: Opened mail because: full mail Apr 17 11:09:11 imap(phaoost(a)phaoost.net)<7864><0+xW57eGjJq5LcCN>: Debug: Mailbox Spam: UID 27: Opened mail because: full mail Apr 17 11:09:11 imap(phaoost(a)phaoost.net)<7864><0+xW57eGjJq5LcCN>: Debug: Mailbox Spam: UID 28: Opened mail because: full mail Apr 17 12:09:12 imap(phaoost(a)phaoost.net)<25908><bXnRwLiGKJ+5LcCN>: Debug: Mailbox Spam: UID 33: Opened mail because: full mail Apr 17 13:19:38 imap(phaoost(a)phaoost.net)<20835><El6SvLmGEKG5LcCN>: Debug: Mailbox Spam: UID 34: Opened mail because: full mail Apr 17 16:50:57 imap(phaoost(a)phaoost.net)<14923><hkpHsLyGYKa5LcCN>: Debug: Mailbox Spam: UID 35: Opened mail because: full mail Apr 17 16:50:57 imap(phaoost(a)phaoost.net)<14923><hkpHsLyGYKa5LcCN>: Debug: Mailbox Spam: UID 36: Opened mail because: full mail Apr 17 18:50:56 imap(phaoost(a)phaoost.net)<14650><JJZsXb6GCq25LcCN>: Debug: Mailbox Spam: UID 37: Opened mail because: full mail Apr 17 18:50:56 imap(phaoost(a)phaoost.net)<14650><JJZsXb6GCq25LcCN>: Debug: Mailbox Spam: UID 38: Opened mail because: full mail -- Regards, Yevgeny

2 1

Sieve operation "send copy" not working since upgrade from dovecot 2.2.31-1 to 2.3.5.1-1
by Kristijan Savic - ratiokontakt GmbH 16 Apr '19

16 Apr '19

I hope that someone can help me here. Software: CentOS 7.6.1810, dovecot-2.3.5.1, dovecot-pigeonhole-2.3.5.1, exim 4.91-1 Example filter: # rule:[test] if header :contains "subject" "meow" { redirect :copy "ks(a)ratiokontakt.de"; } Mail log: Apr 16 11:29:02 frontend-17 dovecot: lmtp(testi(a)mrhoang.de)<25201><QPgZHF6gtVxxYgAARS1pjg>: sieve: msgid=<311099964.O2fbMfmo3K(a)ws-ks.intern.ratiokontakt.de>: failed to redirect message to <ks(a)ratiokontakt.de>: smtp(localhost): DATA failed: 552 Message header not CRLF terminated (permanent failure) Apr 16 11:29:02 frontend-17 dovecot: lmtp(testi(a)mrhoang.de)<25201><QPgZHF6gtVxxYgAARS1pjg>: sieve: msgid=<311099964.O2fbMfmo3K(a)ws-ks.intern.ratiokontakt.de>: stored mail into mailbox 'INBOX' Apr 16 11:29:02 frontend-17 dovecot: lmtp(testi(a)mrhoang.de)<25201><QPgZHF6gtVxxYgAARS1pjg>: sieve: Execution of script /usr/local/mail/0117/mrhoang.de/testi/.dovecot.sieve failed, but implicit keep was successful (user logfile /usr/local/mail/0117/mrhoang.de/ testi/.dovecot.sieve.log may reveal additional details) And in the: /.dovecot.sieve.log: sieve: info: started log at Apr 16 11:29:02. error: msgid=<311099964.O2fbMfmo3K(a)ws-ks.intern.ratiokontakt.de>: failed to redirect message to <ks(a)ratiokontakt.de>: smtp(localhost): DATA failed: 552 Message header not CRLF terminated (permanent failure) We are stumped. Any ideas? Regards, Kristijan Savic

2 2

Fwd: SOLR/Index?
by Larry Rosenman 15 Apr '19

15 Apr '19

forgot to reply all. ---------- Forwarded message --------- From: Larry Rosenman <larryrtx(a)gmail.com> Date: Mon, Apr 15, 2019 at 5:58 AM Subject: Re: SOLR/Index? To: John Fawcett <john(a)voipsupport.it> the local users (myself, my wife, a friend) can authenticate EITHER as <username> or <username>@lerctr.org. switching to all virtual users is NOT going to happen. If I login to roundcube with <user>@lerctr.org it finds the autoindexed mail. So, if I make everyone always authenticate as <user>@lerctr.org we should be fine. and change my script to do doveadm -u <user>@<domain> instead of depending on the local user running the cron job. question: Is there some way to have dovecot change what it sees to be <user>@lerctr.org when they login as <user>? On Mon, Apr 15, 2019 at 5:54 AM John Fawcett via dovecot < dovecot(a)dovecot.org> wrote: > On 15/04/2019 11:38, Larry Rosenman via dovecot wrote: > > ⌂63% [ler@thebighonker.lerctr.org:~] $ grep fts1970 mail/INBOX > ⌂67% [ler@thebighonker.lerctr.org:~] 1 $ mail -s "test fts1970" > ler(a)lerctr.org > test fts1970 > > test fts1970 > . > EOT > [ler@thebighonker.lerctr.org:~] $ mailq > [ler@thebighonker.lerctr.org:~] $ grep fts1970 mail/INBOX > Subject: test fts1970 > test fts1970 > test fts1970 > > > Apr 15 04:29:03 thebighonker exim[49528]: 1hFxvD-000Csq-P6 <= > ler(a)lerctr.org U=ler P=local S=388 > Apr 15 04:29:03 thebighonker dovecot[2507]: lmtp(49364): Connect from local > Apr 15 04:29:03 thebighonker dovecot[2507]: lmtp(ler(a)lerctr.org/49364): > save: box=INBOX, uid=175402, msgid=< > E1hFxvD-000Csq-P6(a)thebighonker.lerctr.org>, size=640, vsize=660, > from=Larry Rosenman <ler(a)lerctr.org>, subject=test fts1970, flags=() > Apr 15 04:29:03 thebighonker dovecot[2507]: lmtp(ler(a)lerctr.org/49364): > sieve: msgid=<E1hFxvD-000Csq-P6(a)thebighonker.lerctr.org>: stored mail > into mailbox 'INBOX' (subject=test fts1970 from=ler(a)lerctr.org size=660) > Apr 15 04:29:03 thebighonker dovecot[2507]: lmtp(49364): Disconnect from > local: Client has quit the connection (state=READY) > Apr 15 04:29:03 thebighonker exim[49535]: 1hFxvD-000Csq-P6 => ler < > ler(a)lerctr.org> R=localuser T=dovecot_lmtp S=404 C="250 2.0.0 < > ler(a)lerctr.org> 6ACWMN9OtFzUwAAAu+mOrA Saved" QT=0s DT=0s > Apr 15 04:29:03 thebighonker exim[49535]: 1hFxvD-000Csq-P6 Completed QT=0s > Apr 15 04:29:03 thebighonker dovecot[2507]: indexer-worker( > ler(a)lerctr.org/49366) Indexed 1 messages in INBOX (UIDs 175402..175402) > > > ⌂81% [ler@thebighonker.lerctr.org:~] $ doveadm search mailbox INBOX body > 'fts1970' > ⌂83% [ler@thebighonker.lerctr.org:~] $ > > > ⌂65% [ler@thebighonker.lerctr.org:~] 75 $ doveadm search -u ler(a)lerctr.org > mailbox INBOX body 'fts1970' > a53a143be44bda5bd4830000bbe98eac 175402 > [ler@thebighonker.lerctr.org:~] $ doveadm index -q INBOX > [ler@thebighonker.lerctr.org:~] $ doveadm search mailbox INBOX body > 'fts1970' > [ler@thebighonker.lerctr.org:~] $ doveadm fts rescan > [ler@thebighonker.lerctr.org:~] $ doveadm index -q INBOX > [ler@thebighonker.lerctr.org:~] $ doveadm search mailbox INBOX body > 'fts1970' > a53a143be44bda5bd4830000bbe98eac 175402 > [ler@thebighonker.lerctr.org:~] $ doveadm search -u ler(a)lerctr.org > mailbox INBOX body 'fts1970' > a53a143be44bda5bd4830000bbe98eac 175402 > [ler@thebighonker.lerctr.org:~] $ > > So, yes, your hypothesis is correct. > > Question: How can I make it consistent? > > I have a script that runs on the first of the month that does archiving, > and I have similar issues in that namespace: > ⌂67% [ler@thebighonker.lerctr.org:~] $ cat bin/archive-mail > #!/bin/sh > PATH=$PATH:/usr/local/bin > #Expects to be run after midnight on the first of the month > # to archive all the previous months mail > #Date Run: > TODAY=`date "+%Y-%m-%d"` > #last month in YYYY/MM > YEAR_LAST_MONTH=`date -v-1d "+%Y/%m"` > #1st of last month as 01-Mon-YYYY > FIRST_LAST_MONTH=`date -v-1d "+01-%b-%Y"` > echo 'TODAY=' ${TODAY} > echo 'YEAR_LAST_MONTH=' ${YEAR_LAST_MONTH} > echo 'FIRST_LAST_MONTH=' ${FIRST_LAST_MONTH} > # get a list of all the mailboxes with at least one real message > doveadm -f tab mailbox status vsize \* 2>/dev/null | > sed -e 1d | sort -k 1,1 | > awk 'BEGIN {FS="\t"} {if ($2 > 0) print $1}' | > while read i > do > echo `date` start ${i} > doveadm mailbox create "ARCHIVE/${YEAR_LAST_MONTH}/${i}" > doveadm -f tab mailbox status messages "${i}" > doveadm move "ARCHIVE/${YEAR_LAST_MONTH}/${i}" mailbox \ > "${i}" BEFORE ${TODAY} SINCE ${FIRST_LAST_MONTH} > doveadm -f tab mailbox status messages "${i}" > echo `date` done ${i} > done > ⌂64% [ler@thebighonker.lerctr.org:~] $ > > > The Exim config can be provided as well if necessary. > > ler & ler(a)lerctr.org *ARE THE SAME MAILBOX* > > At the moment it looks as though you have two sets of emails indexed in > solr. One is indexed under username (the one you are running mannually and > apparently the one used by roundcube too, but that's to be verified) and > another set being indexed by autoindex = yes option using the full email > address. Once you've got it working as you require, then you may want to > clean out solr and reindex with just one of them just to reduce volumes. > > Your setup seems to have a mix of users from mysql and from /etc/passwd. > Not sure if your mysql users are all mapped to real users or they have > their own mailboxes with domain included. Your solution will depend on what > you really need and if the setup is working correctly you may not want to > tweak it too much or other things may start breaking. > > The simplest thing that comes to mind (providing your manually indexed > mails show up in roundcube searches) is just to turn off autoindex and > schedule indexing from cron. As things stand I believe autoindex works well > with virtual users username@domain. You'll probably need to start off > with a rescan if you do this. > > If you can swith to all virtual users without local users then probably > you can use autoindex, but I can understand that may not be possible. For > sure I'd recommend doing it in a test environment first so you can be sure > of the configuration and then look at migrating your existing mailboxes > over to virtual users. > > John > > > > -- Larry Rosenman http://www.lerctr.org/~ler Phone: +1 214-642-9640 (c) E-Mail: larryrtx(a)gmail.com US Mail: 5708 Sabbia Dr, Round Rock, TX 78665-2106 -- Larry Rosenman http://www.lerctr.org/~ler Phone: +1 214-642-9640 (c) E-Mail: larryrtx(a)gmail.com US Mail: 5708 Sabbia Dr, Round Rock, TX 78665-2106

4 11

No CRLF in Pigeonhole's header?
by Wojciech Sychut 15 Apr '19

15 Apr '19

Hello, I have been told on Freenode's #dovecot to ask here. I have Exim 4.92 complaining about "Non-CRLF-terminated header, under CHUNKING: message abandoned" with redirects made by Pigeonhole 0.5.5 (with Dovecot 2.3.5.1). Please find relevant part of the traffic below, and help me determine whether Exim is correct on this. 0x0000: 4500 0954 0000 4000 8006 0000 7f00 0001 E..T..@......... 0x0010: 7f00 0001 6ea2 0019 8982 e279 d090 b820 ....n......y.... 0x0020: 8018 021e 0749 0000 0101 080a c345 2b51 .....I.......E+Q 0x0030: b382 853c 4d41 494c 2046 524f 4d3a 3c72 ...<MAIL.FROM:<r 0x0040: 4073 3066 2e6d 642e 6465 7664 6576 6465 @sxf.md.devdevde 0x0050: 762e 6e65 743e 0d0a 5243 5054 2054 4f3a v.net>..RCPT.TO: 0x0060: 3c63 6f6e 7461 6374 4072 6567 6973 2e74 <contact(a)regis.t 0x0070: 6563 683e 0d0a 4244 4154 2032 3235 3420 ech>..BDAT.2254. 0x0080: 4c41 5354 0d0a 582d 5369 6576 653a 2050 LAST..X-Sieve:.P 0x0090: 6967 656f 6e68 6f6c 6520 5369 6576 6520 igeonhole.Sieve. 0x00a0: 302e 352e 3520 2832 3438 3362 3038 3529 0.5.5.(2483b085) 0x00b0: 0a58 2d53 6965 7665 2d52 6564 6972 6563 .X-Sieve-Redirec 0x00c0: 7465 642d 4672 6f6d 3a20 7240 7330 662e ted-From:.r@sxf. With Dovecot 2.2.36 + Pigeonhole 0.4.24.1 and required minimum of version-related configuration changes - redirection works properly. Related Exim code fragment: https://github.com/Exim/exim/blob/master/src/src/receive.c#L2222 Thank you, -- Wojtek Sychut

2 1

rsync sdbox, no new mails?
by Jakob Curdes 15 Apr '19

15 Apr '19

Hello, I had to restore a mailserver from a backup to replace a system with problems that is still live. I did a 1:1 restore as far as possible from a backup, then rsynced the /var/vmail/ directory, where we have all the mailboxes, in sdbox format. So both directories should be the same. After syncing, I started dovecot. I can see the mails until to the point of the backup, but not the newer ones ,although they seem to be present in the "cur" directory. I thought with sdbox it is all in the index files that have been transferred with the mails? Or am I missing a place that has to be synced? Thank you for hints, Jakob

2 2

LDAP iterate (dovecoc 2.2.27)
by Debreczeni Attila 15 Apr '19

15 Apr '19

Dear Dovecot Team, We would like to use the LDAP iterate for dovecot replication, but I got this error: dovecot: auth-worker(10149): Error: ldap(*): ldap_search(base=ou=mail,o=asd,c=TLD filter=(objectClass=inetMailUser) failed: Size limit exceeded dovecot: replicator: Error: User listing returned failure dovecot: replicator: Error: listing users failed, can't replicate existing data When I check the "doveadm replicator status": ... Total number of known users 1200 But we have more than 10.000 users. When I run the ldapsearch manually, I get the full list of the mail addresses. Who can I fix it? Thank you, Attila # dovecot --version 2.2.27 (c0f36b0) # dovecot -n | filtered # 2.2.27 (c0f36b0): /etc/dovecot/dovecot.conf # Pigeonhole version 0.4.16 (fed8554) # OS: Linux 4.9.0-6-amd64 x86_64 Debian 9.8 auth_worker_max_count = 150 default_vsz_limit = 512 M doveadm_password = # hidden, use -P to show it doveadm_port = *** mail_gid = vmail mail_plugins = " quota notify replication" namespace inbox { ... } passdb { args = /etc/dovecot/dovecot-ldap.conf.ext driver = ldap } plugin { mail_replica = tcp:REMOTE_IP } replication_dsync_parameters = -d -N -1 -l 30 -U service aggregator { fifo_listener replication-notify-fifo { user = vmail } unix_listener replication-notify { user = vmail } } service auth { inet_listener { address = LOCAL_IP port = LOCAL_PORT } unix_listener auth-userdb { group = vmail mode = 0600 user = vmail } } service dict { unix_listener dict { group = vmail mode = 0600 user = vmail } } service lmtp { inet_listener lmtp { address = LOCAL_IP port = LOCAL_PORT } } service replicator { process_min_avail = 1 unix_listener replicator-doveadm { mode = 0600 } } userdb { args = /etc/dovecot/dovecot-domain-ldap.conf.ext driver = ldap result_success = continue-ok } userdb { args = /etc/dovecot/dovecot-ldap.conf.ext driver = ldap result_failure = return-fail } protocol imap { ... } protocol pop3 { ... } # grep -v '^ *$#.*$\?$' dovecot-ldap.conf.ext uris = ldaps://ldap.URL dn = uid=auth,o=domain,c=TLD dnpass = **** sasl_bind = no tls_ca_cert_dir = /etc/ssl/certs tls_require_cert = demand ldap_version = 3 base = ou=mail,o=asd,c=TLD deref = never scope = subtree user_attrs = =home=/dev/null/%Ld/%L{ldap:uid}, mailQuota=quota_rule=*:bytes=%$ user_filter = (objectClass=inetMailUser) pass_attrs = userPassword=password pass_filter = (objectClass=inetMailUser) iterate_attrs = mail=user iterate_filter = (objectClass=inetMailUser) default_pass_scheme = PLAIN

1 0

LDAP iterate (dovecoc 2.2.27)
by Debreczeni Attila 15 Apr '19

15 Apr '19

Dear Dovecot Team, We would like to use the LDAP iterate for dovecot replication, but I got this error: dovecot: auth-worker(10149): Error: ldap(*): ldap_search(base=ou=mail,o=asd,c=TLD filter=(objectClass=inetMailUser) failed: Size limit exceeded dovecot: replicator: Error: User listing returned failure dovecot: replicator: Error: listing users failed, can't replicate existing data When I check the "doveadm replicator status": ... Total number of known users 1200 But we have more than 10.000 users. When I run the ldapsearch manually, I get the full list of the mail addresses. Who can I fix it? Thank you, Attila # dovecot --version 2.2.27 (c0f36b0) # dovecot -n | filtered # 2.2.27 (c0f36b0): /etc/dovecot/dovecot.conf # Pigeonhole version 0.4.16 (fed8554) # OS: Linux 4.9.0-6-amd64 x86_64 Debian 9.8 auth_worker_max_count = 150 default_vsz_limit = 512 M doveadm_password = # hidden, use -P to show it doveadm_port = *** mail_gid = vmail mail_plugins = " quota notify replication" namespace inbox { ... } passdb { args = /etc/dovecot/dovecot-ldap.conf.ext driver = ldap } plugin { mail_replica = tcp:REMOTE_IP } replication_dsync_parameters = -d -N -1 -l 30 -U service aggregator { fifo_listener replication-notify-fifo { user = vmail } unix_listener replication-notify { user = vmail } } service auth { inet_listener { address = LOCAL_IP port = LOCAL_PORT } unix_listener auth-userdb { group = vmail mode = 0600 user = vmail } } service dict { unix_listener dict { group = vmail mode = 0600 user = vmail } } service lmtp { inet_listener lmtp { address = LOCAL_IP port = LOCAL_PORT } } service replicator { process_min_avail = 1 unix_listener replicator-doveadm { mode = 0600 } } userdb { args = /etc/dovecot/dovecot-domain-ldap.conf.ext driver = ldap result_success = continue-ok } userdb { args = /etc/dovecot/dovecot-ldap.conf.ext driver = ldap result_failure = return-fail } protocol imap { ... } protocol pop3 { ... } # grep -v '^ *$#.*$\?$' dovecot-ldap.conf.ext uris = ldaps://ldap.URL dn = uid=auth,o=domain,c=TLD dnpass = **** sasl_bind = no tls_ca_cert_dir = /etc/ssl/certs tls_require_cert = demand ldap_version = 3 base = ou=mail,o=asd,c=TLD deref = never scope = subtree user_attrs = =home=/dev/null/%Ld/%L{ldap:uid}, mailQuota=quota_rule=*:bytes=%$ user_filter = (objectClass=inetMailUser) pass_attrs = userPassword=password pass_filter = (objectClass=inetMailUser) iterate_attrs = mail=user iterate_filter = (objectClass=inetMailUser) default_pass_scheme = PLAIN

1 0

Re: SOLR/Index?
by Larry Rosenman 15 Apr '19

15 Apr '19

full solr.log at: https://www.lerctr.org/~ler/solr.log The search DOES make it to SOLR: ⌂77% [ler@thebighonker.lerctr.org:~] 130 $ grep sysutils /var/log/solr/solr.log 2019-04-14 18:31:34.749 INFO (qtp349420578-7538) [ x:dovecot] o.a.s.c.S.Request [dovecot] webapp=/solr path=/select params={q={!lucene+q.op%3DAND}(hdr:sysutils\/+OR+body:sysutils\/)&fl=uid,score&sort=uid+asc&fq=%2Bbox:8097632f69627b5b58950000bbe98eac+%2Buser:ler&rows=22644&wt=xml} hits=0 status=0 QTime=460 Pick showing subjects: https://www.lerctr.org/~ler/sysutils_mail.png What else? I'm happy to provide access. -- Larry Rosenman http://www.lerctr.org/~ler Phone: +1 214-642-9640 (c) E-Mail: larryrtx(a)gmail.com US Mail: 5708 Sabbia Dr, Round Rock, TX 78665-2106

3 11

SOLR/Index?
by Larry Rosenman 15 Apr '19

15 Apr '19

Given all the discussion on FTS/Solr, etc, I have a question: I have autoindex set, and searching in roundcube most of the time does NOT find things, HOWEVER if I do: doveadm fts rescan doveadm index I can find things in the mailboxes. WHY? (doveconf -n attached). -- Larry Rosenman http://www.lerctr.org/~ler Phone: +1 214-642-9640 (c) E-Mail: larryrtx(a)gmail.com US Mail: 5708 Sabbia Dr, Round Rock, TX 78665-2106

2 1

Re: dovecot Digest, Vol 192, Issue 52
by Peter Mogensen 15 Apr '19

15 Apr '19

On 4/14/19 4:04 PM, dovecot-request(a)dovecot.org wrote: >> Solr ships with autoCommit set to 15 seconds and openSearcher set to >> false on the autoCommit.? The autoSoftCommit setting is not enabled by >> default, but depending on how the index was created, Solr might try to >> set autoSoftCommit to 3 seconds ... which is WAY too short. I just run with the default. 15s autoCommit and no autoSoftCommit >> This thread says that dovecot is sending explicit commits.? I see explicit /update req. with softCommit and waitSearcer=true in a tcpdump. >> One thing >> that might be happening to exceed 60 seconds is an extremely long >> commit, which is usually caused by excessive cache autowarming, but >> might be related to insufficient memory.? The max heap setting on an >> out-of-the-box Solr install (5.0 and later) is 512MB.? That's VERY >> small, and it doesn't take much index data before a much larger heap >> is required. I run with SOLR_JAVA_MEM="-Xmx8g -Xms2g" > I looked into the code (version 2.3.5.1): This is 2.2.35. I haven't checked the source difference to 2.3.x I must admit. > I immagine that one of the reasons dovecot sends softCommits is because > without autoindex active and even if mailboxes are periodically indexed > from cron, the last emails received with be indexed at the moment of the > search.? I expect that dovecot has to because of it's default behavior by only bringing the index up-to-date just before search. So it has towait for the index result to be available if there's been any new mails indexed. > 1) a configurable batch size would enable to tune the number of emails > per request and help stay under the 60 seconds hard coded http request > timeout. A configurable http timeout would be less useful, since this > will potentially run into other timeouts on solr side. Being able to configure it is great. But I don't think it solves much. I recompiled with 100 as batch size and it still ended in timeouts. Then I recompiled with 10min timeout and now I see all the batches completing and their processesing time is mostly between 1 and 2 minutes (so all would have failed). To me it looks like Solr just takes too long time to index. This is no small machine. It's a 20 core Intel(R) Xeon(R) Silver 4114 CPU @ 2.20GHz and for this test it's not doing anything else, so I'm a bit surprised that even with only a few users this takes so long time. /Peter

2 1

Re: Solr connection timeout hardwired to 60s
by Peter Mogensen 15 Apr '19

15 Apr '19

On 4/4/19 6:47 PM, dovecot-request(a)dovecot.org wrote: > For a typical Solr index, 60 seconds is an eternity. Most people aim > for query times of 100 milliseconds or less, and they often achieve > that goal. I'm pretty sure I get these while indexing, not querying. Apr 04 16:44:50 host dovecot[114690]: indexer-worker(me(a)example.com): Error: fts_solr: Indexing failed: Request timed out (Request queued 66.015 secs ago, 1 attempts in 66.005 secs, 63.146 in http ioloop, 0.000 in other ioloops, connected 94.903 secs ago) /Peter

5 8

Fwd: Problem with solr working, but not indexing
by TG Servers 14 Apr '19

14 Apr '19

2 2

Problem with solr working, but not indexing
by TG Servers 14 Apr '19

14 Apr '19

2 1

Re: Solr connection timeout hardwired to 60s
by Peter Mogensen 14 Apr '19

14 Apr '19

sorry... I got distracted half way and forgot to put a meaningfull subject so the archive could figure out the thread. - resending. On 4/14/19 4:04 PM, dovecot-request(a)dovecot.org wrote: >> Solr ships with autoCommit set to 15 seconds and openSearcher set to >> false on the autoCommit.? The autoSoftCommit setting is not enabled by >> default, but depending on how the index was created, Solr might try to >> set autoSoftCommit to 3 seconds ... which is WAY too short. I just run with the default. 15s autoCommit and no autoSoftCommit >> This thread says that dovecot is sending explicit commits.? I see explicit /update req. with softCommit and waitSearcer=true in a tcpdump. >> One thing >> that might be happening to exceed 60 seconds is an extremely long >> commit, which is usually caused by excessive cache autowarming, but >> might be related to insufficient memory.? The max heap setting on an >> out-of-the-box Solr install (5.0 and later) is 512MB.? That's VERY >> small, and it doesn't take much index data before a much larger heap >> is required. I run with SOLR_JAVA_MEM="-Xmx8g -Xms2g" > I looked into the code (version 2.3.5.1): This is 2.2.35. I haven't checked the source difference to 2.3.x I must admit. > I immagine that one of the reasons dovecot sends softCommits is because > without autoindex active and even if mailboxes are periodically indexed > from cron, the last emails received with be indexed at the moment of the > search.? I expect that dovecot has to because of it's default behavior by only bringing the index up-to-date just before search. So it has towait for the index result to be available if there's been any new mails indexed. > 1) a configurable batch size would enable to tune the number of emails > per request and help stay under the 60 seconds hard coded http request > timeout. A configurable http timeout would be less useful, since this > will potentially run into other timeouts on solr side. Being able to configure it is great. But I don't think it solves much. I recompiled with 100 as batch size and it still ended in timeouts. Then I recompiled with 10min timeout and now I see all the batches completing and their processesing time is mostly between 1 and 2 minutes (so all would have failed). To me it looks like Solr just takes too long time to index. This is no small machine. It's a 20 core Intel(R) Xeon(R) Silver 4114 CPU @ 2.20GHz and for this test it's not doing anything else, so I'm a bit surprised that even with only a few users this takes so long time. /Peter

2 2

Re: Mail account brute force / harassment
by Odhiambo Washington 14 Apr '19

14 Apr '19

On Thu, 11 Apr 2019 at 13:24, Marc Roos via dovecot <dovecot(a)dovecot.org> wrote: > > > Say for instance you have some one trying to constantly access an > account > > > Has any of you made something creative like this: > > * configure that account to allow to login with any password > * link that account to something like /dev/zero that generates infinite > amount of messages > (maybe send an archive of virusses?) > * transferring TB's of data to this harassing client. > > I think it would be interesting to be able to do such a thing. > > Instead of being evil, just use fail2ban to address this problem :-) -- Best regards, Odhiambo WASHINGTON, Nairobi,KE +254 7 3200 0004/+254 7 2274 3223 "Oh, the cruft.", grep ^[^#] :-)

10 24

permissions for quota-status
by Andreas Meyer 14 Apr '19

14 Apr '19

Hello! doveconf --version 2.2.36 I want to move to a new server with dovecot but get an error Error: service(quota-status): listen(*, 12340) failed: Permission denied when I define service quota-status { executable = quota-status -p postfix inet_listener { port = 12340 } client_limit = 1 } private]# ll insgesamt 0 srw-rw-rw-. 1 postfix postfix 0 14. Apr 15:05 anvil srw-rw-rw-. 1 postfix postfix 0 14. Apr 15:05 bounce srw-rw-rw-. 1 postfix postfix 0 14. Apr 15:05 defer srw-rw-rw-. 1 postfix postfix 0 14. Apr 15:05 discard srw-------. 1 postfix postfix 0 14. Apr 15:08 dovecot-lmtp srw-rw-rw-. 1 postfix postfix 0 14. Apr 15:05 error srw-rw-rw-. 1 postfix postfix 0 14. Apr 15:05 lmtp srw-rw-rw-. 1 postfix postfix 0 14. Apr 15:05 local srw-rw-rw-. 1 postfix postfix 0 14. Apr 15:05 proxymap srw-rw-rw-. 1 postfix postfix 0 14. Apr 15:05 proxywrite srw-rw----. 1 postfix postfix 0 14. Apr 14:58 quota-status srw-rw-rw-. 1 postfix postfix 0 14. Apr 15:05 relay srw-rw-rw-. 1 postfix postfix 0 14. Apr 15:05 retry srw-rw-rw-. 1 postfix postfix 0 14. Apr 15:05 rewrite srw-rw-rw-. 1 postfix postfix 0 14. Apr 15:05 scache srw-rw-rw-. 1 postfix postfix 0 14. Apr 15:05 smtp srw-rw-rw-. 1 postfix postfix 0 14. Apr 15:05 tlsmgr srw-rw-rw-. 1 postfix postfix 0 14. Apr 15:05 trace srw-rw-rw-. 1 postfix postfix 0 14. Apr 15:05 verify srw-rw-rw-. 1 postfix postfix 0 14. Apr 15:05 virtual Don't know what's wrong. Can someone help? Kind regards Andreas -- PGP-Fingerprint: D392 5D21 0299 63D7 5BAE 4562 1E56 B2EA 81A2 59F1

2 1

nginx configuration to pass x-originating-ip
by André Rodier 14 Apr '19

14 Apr '19

Hello, There is a bug in SOGo, as it sends the original IP after successful login, and not before the login process. I traced the bug to the source code. https://sogo.nu/bugs/view.php?id=2979. Then, in my research, I found this old thread: https://forum.nginx.org/read.php?29,237299,237367#msg-237367 Can I use Nginx as an IMAP proxy to add the missing ID. I suspect this is something that can be achieved? I already have an Nginx for the SOGo front-end, so I would add another one for the IMAP proxy. With a little bit of luck, I should be able to pass the original IP between the two servers Does anyone has a working example? Thanks, André -- André Rodier HomeBox: https://github.com/progmaticltd/homebox

1 0

Post login scripts environment
by André Rodier 14 Apr '19

14 Apr '19

Dear Dovecot users, I am running Dovecot 2.2.27 on Debian Stretch, no issue so far. I wonder if there is a way to pass the remote IP address, in an environment variable, in the post login script. My Post login scripts are working well, except that when the server is accessed through a webmail (Roundcube or SOGo), the remote IP address is systematically 127.0.0.1. The other question I have is, is it possible to pass the user agent of the email client used to access the server? I know this can be easily forged, but I would like to log it. Thanks for your insight. -- André Rodier

2 6

Using userdb/passdb data in director_username_hash
by Mark Moseley 12 Apr '19

12 Apr '19

TL;DR: Can director_username_hash use %{userdb:...} or %{passdb:...} ? ==================================== This is on Ubuntu Precise, running dovecot 2.2.36. It's a fully production, director-ized env, so assume everything is working correctly. Happy to post doveconf if it's relevant but wanted to ask a general question first. I was curious if there's a way to get userdb/passdb data into director_username_hash. Currently, we've got default hashing (on %u). I'm returning a SQL field called 'real_username' (the owner of the mailbox, so almost never the same as %u). I'd like (for mdbox reasons) to hash on that rather than %u. My test SQL is returning (this is just a chunk -- it's duplicated for testing): UserName AS userdb_real_username, UserName AS real_username I can see in my director boxes that it's at least picking up the latter: passdb out: PASS 1 user=tesbox(a)mailbox.com proxy=y real_username=testuser Is it possible to inject 'real_username' into director_username_hash? That is, I'd rather hash on 'testuser' instead of 'testbed'. I've been trying different permutations on my director boxes with no luck. director_username_hash = %{userdb:real_username} director_username_hash = %{passdb:real_username} director_username_hash = %{userdb:userdb_real_username} director_username_hash = %{passdb:userdb_real_username} With any of those settings, every mailbox gets hashed to the same backend, so I'm guessing it's not getting anything useful (i.e. probably resolving to the same empty string and hashing on that -- or perhaps is just hashing on the literal string, e.g. "%{userdb:real_username}" ). And I'm not even sure if director_username_hash has access to any passdb/userdb data. Is there a debug setting that would show what string director is using to do the hashing? Current debug settings are: auth_debug = yes auth_debug_passwords = yes mail_debug = yes but not a peep as to the string that director is hashing on.

2 2

Migrating from external server to Dovecot (doveadm sync issues)
by Sven Strickroth 12 Apr '19

12 Apr '19

Hi, I'm experiencing serious issues when using doveadm sync not working at all or do not properly sync. I wanted to use this for migrating external mailboxes to my server (in order to overcome the time when some servers/clients still use the old server and some already the my server). I tried to find a few steps in order to replicate this: For testing purposes I simulate both the remote and local server on my Dovecot instance. I created remote(a)DOMAIN.TLD and local(a)DOMAIN.TLD both use mdbox and are empty (i.e., the mail_location is still non-existent). Then I send two mails to remote(a)DOMAIL.TLD (Subjects: Test1 and Test2). Start backup remote IMAP account (remote(a)DOMAIN.TLD) to local account (local(a)DOMAIN.TLD) * doveadm -o imapc_user="remote(a)DOMAIN.TLD" -o imapc_password="PW" -o imapc_host="localhost" -o mail_prefetch_count=20 -o imapc_features="rfc822.size fetch-headers" backup -R -u local(a)DOMAIN.TLD imapc: (without this I often got errors such as "Error: Backend didn't update mailbox Trash GUID" on sync runs, which seems to be an unrecoverable error). Now the two mailboxes seem to be the same (can confirm this when logging into the two mailboxes). Now, run first sync: * doveadm -o imapc_user="remote(a)DOMAIN.TLD" -o imapc_password="PW" -o imapc_host="localhost" -o mail_prefetch_count=20 -o imapc_features="rfc822.size fetch-headers" sync -R -u local(a)DOMAIN.TLD imapc: Seems to work and does nothing at the moment. Deliver one message to local(a)DOMAIN.TLD (Subject Test3). * doveadm -o imapc_user="remote(a)DOMAIN.TLD" -o imapc_password="PW" -o imapc_host="localhost" -o mail_prefetch_count=20 -o imapc_features="rfc822.size fetch-headers" sync -R -u local(a)DOMAIN.TLD imapc: Now Test1,2,3 are in both mailboxes (further runs do change nothing). Everything OK up the here. Now deliver one messages to remote(a)DOMAIN.TLD (Test4) and delete one old message (Test3). Deliver two messages to local(a)DOMAIN.TLD (Subjects Test5 and Test6) and delete one message (Test2). In sum both mailboxes look like this: remote(a)DOMAIN.TLD has Test1,2,4 and local(a)DOMAIN.TLD has 1,3,5,6. Now sync: * doveadm -o imapc_user="remote(a)DOMAIN.TLD" -o imapc_password="PW" -o imapc_host="localhost" -o mail_prefetch_count=20 -o imapc_features="rfc822.size fetch-headers" sync -R -u local(a)DOMAIN.TLD imapc: dsync(local(a)DOMAIN.TLD): Warning: Mailbox changes caused a desync. You may want to run dsync again: 3 UIDs changed due to UID conflicts Rerun again and see that mails start duplicating and deletings are not synced: remote(a)DOMAIN.TLD: Test1,2,4,3,5,6,5,6,6,5,3,4 (12 mails) and local(a)DOMAIN.TLD: 1,6,4,3,5,6,4,3,5,6,5 (11 mails) When I re-run again I sometimes see the above error message again, mails keep duplicating in both mailboxes and the mailboxes are not synced at all. Am I using doveadm sync wrongly? Is there a way to use "sync" directly w/o backup from the beginning (i.e., how to get rid of the error "Error: Backend didn't update mailbox Trash GUID"). Context: # 2.2.27 (c0f36b0): /etc/dovecot/dovecot.conf # Pigeonhole version 0.4.16 (fed8554) # OS: Linux 4.9.0-8-amd64 x86_64 Debian 9.8 imap_client_workarounds = delay-newmail I can't upgrade to latest Dovecot right now. :( -- Best regards, Sven Strickroth PGP key id F5A9D4C4 @ any key-server

1 0

Mail account brute force / harassment
by Marc Roos 12 Apr '19

12 Apr '19

Say for instance you have some one trying to constantly access an account Has any of you made something creative like this: * configure that account to allow to login with any password * link that account to something like /dev/zero that generates infinite amount of messages (maybe send an archive of virusses?) * transferring TB's of data to this harassing client. I think it would be interesting to be able to do such a thing.

3 2

Emails redownloading
by azurit＠pobox.sk 12 Apr '19

12 Apr '19

Hi, recently, we had a problem on one of our mail servers and, after reboot, HDD with emails wasn't mounted into system. Until we fixed it, LOTS of users logged in (Dovecot allowed login and recreated directory structure of mailboxes) and saw empty mailboxes. Now they are redownloading all email, which isn't fun, as it's about 2 TB of data. Anyway, is there a way how to prevent this in the future? Can i set Dovecot to disallow logins in such situations? Thanks. azur

3 5

Doveadm stats
by ＠lbutlr 12 Apr '19

12 Apr '19

Are there any examples of the utility of doveadm stats? in the man page: > dump accepts following types: command, session, user, domain, ip and > global. > > Filter can be > > user=<wildcard> > Match given user. I've tried the following commands after looking at the (sparse and example-less) man page. # doveadm stats dump metric_name field count sum min max avg median stddev %95 # doveadm stats dump user Error: Extraneous arguments found: user # doveadm stats dump user user="*" Error: Extraneous arguments found: user user=* # doveadm stats dump global Error: Extraneous arguments found: global # doveadm stats dump global user="*" Error: Extraneous arguments found: global user=* # I assume there is more to the configuration for stats than merely making it not report an error. So, the first question is what sorts of stats would be most likely to be useful and what do I do in the configuration to get those? Second question is why is this required to be enabled if, by default, it has no functionality? -- Beware of geeks bearing .GIF's

2 1

Mailbox INBOX: Opening INBOX failed: Mailbox doesn't exist: INBOX. Maybe master user + namespace problem?
by Usuario prueba 12 Apr '19

12 Apr '19

2 2

Secure Client-Initiated Renegotiation
by sergio 12 Apr '19

12 Apr '19

Hello. I've just tested my system that runs dovecot 2.3.4.1 on debian buster with testssl.sh (https://testssl.sh/) and is says: Secure Renegotiation (CVE-2009-3555) not vulnerable (OK) Secure Client-Initiated Renegotiation VULNERABLE (NOT ok), potential DoS threat Is this a configuration or a compilation issue and how to solve it? -- sergio.

2 1