- dovecot - dovecot.org

Workaround for infinite loop in XCLIENT command bug
by mabi 26 May '19

26 May '19

Hello, I am running Dovecot 2.3.5 package on OpenBSD 6.5 and it looks like this bug which has been fixed in 2.3.6 is hitting me: lib-smtp: client: Fix infinite loop in XCLIENT command interaction with server https://github.com/dovecot/core/commit/5d03f39b345127b80d145ee90772739baa7a… so I was wondering if there is any workarounds? Maybe like disabling the XCLIENT command from the config file or something similar? My original post regarding this issue is here: https://www.mail-archive.com/misc@opensmtpd.org/msg04362.html I first thought this was an OpenSMTPD issue but it seems to be that Dovecot bug. Cheers, Mabi

3 6

Dovecot multiple passdb and fail2ban
by Joaquin F 26 May '19

26 May '19

Objective: different password for remote and local imap login Version: 2.2.36 (1f10bfa63) on CentOS 7 Users are from Active Directory, mapped to local users via sssd After much experimentation, I have configured this way: doveconf -n passdb userdb passdb { args = username_format=%Ln /etc/dovecot/remote driver = passwd-file skip = authenticated username_filter = user01 user02 } passdb { driver = pam override_fields = allow_nets=127.0.0.0/8,192.168.1.0/24 skip = authenticated } userdb { driver = passwd } If I put the passdb's in the reverse order, I would get failure messages (when logging in remotely) in /var/log/secure, such as: auth: pam_sss(dovecot:auth): authentication failure; logname= uid=0 euid=0 tty=dovecot ruser=user02 rhost=xx.xx.xx.xx user=user02 Which caused fail2ban to ban that ip /etc/fail2ban/jail.local [dovecot] enabled = true port = imap,imaps If I set "auth_verbose = yes", then I can see messages in (when logging in locally) in /var/log/maillog dovecot: auth: passwd-file(user02,192.168.1.20,<Na/7f8WJC8HAqAEU>): Password mismatch which is probably not a big deal... but seems inefficient? Question: is there a more elegant way to use different passdb depending on ip? Thanks in advance.

1 0

Imap reverse / proxy in front of our clients machines.
by Brent Clark 25 May '19

25 May '19

Good day Guys I have a user story have an imap reverse / proxy in front of our clients servers. Im currently using the following sources for information. https://wiki.failover.de/Email/Dovecot/IMAP/Proxy/ https://gist.github.com/rplessl/dd56d05c84f988706418 https://wiki2.dovecot.org/PasswordDatabase/ExtraFields/Proxy In my vagrant instance, dovecot can connect to the the remote server You can see my debugging and conf: https://pastebin.com/raw/H2AL53Fz https://pastebin.com/raw/hZHSHvcu If anyone can assist it would be greatly appreciated. Many thanks Regards Brent

1 0

Race condition in IMAP NOTIFY for events received NOTIFY_DELAY_MSECS apart
by Guilhem Moulin 25 May '19

25 May '19

Hi there, There seem to be a race condition in IMAP NOTIFY: when two events for the SELECTED mailbox are received soon after one another, sometimes only the first one is being reported to clients that enabled IMAP NOTIFY. On closer look it seems like this is most often reproducible when the delay between the two events is NOTIFY_DELAY_MSECS (500ms). This is with 2.3.4.1 from Debian sid. $ sed -r 's/^\s*//; s/\s+/ /g' >/tmp/dovecot.conf <<-EOF log_path = /tmp/dovecot.log mailbox_list_index = yes mail_home = /dev/shm/dovecot-test/%u mail_location = dbox:~/mail ssl = no EOF (`doveconf -c /tmp/dovecot.conf -n` output enclosed.) $ rm -rf /dev/shm/dovecot-test && mkdir -m0700 /dev/shm/dovecot-test $ env -i USER=user HOME=/dev/shm/dovecot-test/user PATH=/usr/bin:/bin \ doveadm -c /tmp/dovecot.conf exec imap S: * PREAUTH [CAPABILITY IMAP4rev1 … NOTIFY] Logged in as user C: a NOTIFY SET STATUS (SELECTED (MessageNew MessageExpunge FlagChange)) (MAILBOXES (INBOX test) (MessageNew MessageExpunge FlagChange)) S: * STATUS INBOX (MESSAGES 0 UIDNEXT 1 UIDVALIDITY 1558785754 UNSEEN 0 HIGHESTMODSEQ 1) S: a OK NOTIFY completed (0.004 + 0.000 + 0.003 secs). S: * STATUS INBOX (MESSAGES 0 UIDNEXT 1 UIDVALIDITY 1558785754 UNSEEN 0 HIGHESTMODSEQ 1) C: b SELECT INBOX […] S: b OK [READ-WRITE] Select completed (0.001 + 0.000 secs). Now deliver two messages to INBOX with ~500ms in between: $ env -i USER=user HOME=/dev/shm/dovecot-test/user PATH=/usr/bin:/bin sh -c \ 'echo -n . | doveadm -c /tmp/dovecot.conf exec dovecot-lda -e -m INBOX; \ sleep 0.500; \ echo -n . | doveadm -c /tmp/dovecot.conf exec dovecot-lda -e -m INBOX' Only the the first message is reported in the above IMAP session: S: * 1 EXISTS S: * 1 RECENT An UNSELECT doesn't trigger the notification, but (of course) a NOOP does: C: c NOOP S: * 2 EXISTS S: * 2 RECENT S: c OK NOOP completed (0.001 + 0.000 secs). Similarly, for two flag changes within 0.5s only the first is recorded: $ env -i USER=user HOME=/dev/shm/dovecot-test/user PATH=/usr/bin:/bin sh -c \ 'doveadm -c /tmp/dovecot.conf flags add "\\Seen" mailbox INBOX 1; \ sleep 0.500; \ doveadm -c /tmp/dovecot.conf flags add "\\Answered" mailbox INBOX 2' yields a single unsolicited FETCH response: S: * 1 FETCH (MODSEQ (4) FLAGS (\Seen \Recent)) AFAICT this is only reproducible in the ‘SELECTED’ mailbox specifier: after creating a mailbox "test", $ env -i USER=user HOME=/dev/shm/dovecot-test/user PATH=/usr/bin:/bin sh -c \ 'echo -n . | doveadm -c /tmp/dovecot.conf exec dovecot-lda -e -m test; \ sleep 0.500; \ echo -n . | doveadm -c /tmp/dovecot.conf exec dovecot-lda -e -m test' yields two unsolicited STATUS responses as expected: * STATUS test (MESSAGES 1 UIDNEXT 2 UIDVALIDITY 1558787038 UNSEEN 1 HIGHESTMODSEQ 2) * STATUS test (MESSAGES 2 UIDNEXT 3 UIDVALIDITY 1558787038 UNSEEN 2 HIGHESTMODSEQ 3) (And same thing for two flag updates in the "test" mailbox.) This is not specific to INBOX as once "test" is selected the same problem arises. AFAICT the race is in ‘src/lib-storage/list/mailbox-list-index-notify.c’ which for some reason doesn't acknowledge ST_CHANGED() after inotify_rm_watch(), but I couldn't get my head around that file. Cheers, -- Guilhem.

1 0

SIGABRT on fetching mail
by Peter Nabbefeld 24 May '19

24 May '19

Hello, I'm running dovecot with getmail for several months already, but today it's always crashing: "getmailrc: operation error (child pid 2995 killed by signal 6)". The deliver process aborts due to an unknown reason. > tail /var/log/dovecot-info.log May 24 12:10:28 imap-login: Info: Login: user=<peter.nabbefeld(a)gmx.de>, method=PLAIN, rip=::1, lip=::1, mpid=2970, secured, session=<n/dfaJ+JuIMAAAAAAAAAAAAAAAAAAAAB> May 24 12:10:49 lda(peter.nabbefeld(a)gmx.de)<2994><kCP3FifD51yyCwAA7IIYzw>: Info: sieve: msgid=<318D121B-37FC-4E8C-B4B8-93C87E0692B8(a)gmx.de>: stored mail into mailbox 'Gesendet' May 24 15:14:30 imap-login: Info: Login: user=<peter.nabbefeld(a)gmx.de>, method=PLAIN, rip=::1, lip=::1, mpid=6304, secured, session=<+Rae+qGJ4IUAAAAAAAAAAAAAAAAAAAAB> May 24 15:14:31 imap(peter.nabbefeld(a)gmx.de)<6304><+Rae+qGJ4IUAAAAAAAAAAAAAAAAAAAAB>: Info: Connection closed (append finished 0.562 secs ago) in=157758 out=520 deleted=0 expunged=0 trashed=0 hdr_count=0 hdr_bytes=0 body_count=0 body_bytes=0 May 24 15:14:37 imap-login: Info: Login: user=<peter.nabbefeld(a)gmx.de>, method=PLAIN, rip=::1, lip=::1, mpid=6307, secured, session=<MjwD+6GJ4oUAAAAAAAAAAAAAAAAAAAAB> May 24 15:55:28 imap-login: Info: Login: user=<peter.nabbefeld(a)gmx.de>, method=PLAIN, rip=::1, lip=::1, mpid=7205, secured, session=<T9ofjaKJgIYAAAAAAAAAAAAAAAAAAAAB> May 24 15:57:00 imap-login: Info: Login: user=<peter.nabbefeld(a)gmx.de>, method=PLAIN, rip=::1, lip=::1, mpid=7254, secured, session=<nT6XkqKJhIYAAAAAAAAAAAAAAAAAAAAB> May 24 16:08:22 imap-login: Info: Login: user=<peter.nabbefeld(a)gmx.de>, method=PLAIN, rip=::1, lip=::1, mpid=7507, secured, session=<LI40u6KJJIcAAAAAAAAAAAAAAAAAAAAB> May 24 16:16:40 imap(peter.nabbefeld(a)gmx.de)<6307><MjwD+6GJ4oUAAAAAAAAAAAAAAAAAAAAB>: Info: Connection closed (IDLE running for 0.001 + waiting input for 0.001 secs, 2 B in + 10 B out, state=wait-input) in=4251 out=137885 deleted=0 expunged=0 trashed=0 hdr_count=1 hdr_bytes=661 body_count=0 body_bytes=0 May 24 16:16:54 imap-login: Info: Login: user=<peter.nabbefeld(a)gmx.de>, method=PLAIN, rip=::1, lip=::1, mpid=7662, secured, session=<zV++2aKJOIcAAAAAAAAAAAAAAAAAAAAB> > tail /var/log/dovecot.log May 24 11:25:33 master: Warning: Killed with signal 15 (by pid=12275 uid=0 code=kill) May 24 11:25:35 log(660): Warning: Killed with signal 15 (by pid=1 uid=0 code=kill) May 24 12:10:47 lda(peter.nabbefeld(a)gmx.de)<2994><kCP3FifD51yyCwAA7IIYzw>: Warning: Failed to parse return-path header May 24 12:10:50 lda(peter.nabbefeld(a)gmx.de)<2995><hco1BirD51yzCwAA7IIYzw>: Panic: file istream-crlf.c: line 24 (i_stream_crlf_read_common): assertion failed: (ret != -2) May 24 12:10:50 lda(peter.nabbefeld(a)gmx.de)<2995><hco1BirD51yzCwAA7IIYzw>: Error: Raw backtrace: /usr/lib/dovecot/libdovecot.so.0(+0xeee14) [0x7fd668defe14] -> /usr/lib/dovecot/libdovecot.so.0(+0xeee51) [0x7fd668defe51] -> /usr/lib/dovecot/libdovecot.so.0(+0x46268) [0x7fd668d47268] -> /usr/lib/dovecot/libdovecot.so.0(+0x4892e) [0x7fd668d4992e] -> /usr/lib/dovecot/libdovecot.so.0(+0x1004e6) [0x7fd668e014e6] -> /usr/lib/dovecot/libdovecot.so.0(i_stream_read_memarea+0x81) [0x7fd668dfd681] -> /usr/lib/dovecot/libdovecot.so.0(i_stream_read+0x36) [0x7fd668dfd8a6] -> /usr/lib/dovecot/libdovecot.so.0(+0x1058f8) [0x7fd668e068f8] -> /usr/lib/dovecot/libdovecot.so.0(i_stream_read_memarea+0x81) [0x7fd668dfd681] -> /usr/lib/dovecot/libdovecot.so.0(i_stream_read+0x36) [0x7fd668dfd8a6] -> /usr/lib/dovecot/libdovecot.so.0(i_stream_read_data+0x4c) [0x7fd668dfe33c] -> /usr/lib/dovecot/libdovecot.so.0(io_stream_copy+0x8a) [0x7fd668e18aba] -> /usr/lib/dovecot/libdovecot.so.0(+0x119ac2) [0x7fd668e1aac2] -> /usr/lib/dovecot/libdovecot.so.0(o_stream_send_istream+0x4f) [0x7fd668e1874f] -> /usr/lib/dovecot/libdovecot-storage.so.0(index_storage_save_continue+0x2e) [0x7fd668f981ee] -> /usr/lib/dovecot/libdovecot-storage.so.0(maildir_save_continue+0x27) [0x7fd668f36887] -> /usr/lib/dovecot/libdovecot-storage.so.0(mailbox_save_continue+0x44) [0x7fd668f083f4] -> /usr/lib/dovecot/libdovecot-storage.so.0(mail_storage_copy+0xf8) [0x7fd668ef9828] -> /usr/lib/dovecot/libdovecot-storage.so.0(maildir_copy+0x59) [0x7fd668f32639] -> /usr/lib/dovecot/libdovecot-lda.so.0(+0x3d5c) [0x7fd66902ad5c] -> /usr/lib/dovecot/modules/lib20_fts_plugin.so(+0x10eec) [0x7fd668a90eec] -> /usr/lib/dovecot/libdovecot-storage.so.0(+0x58981) [0x7fd668f08981] -> /usr/lib/dovecot/libdovecot-sieve.so.0(+0x4e6df) [0x7fd66676e6df] -> /usr/lib/dovecot/libdovecot-sieve.so.0(sieve_result_execute+0x4e5) [0x7fd666764065] -> /usr/lib/dovecot/libdovecot-sieve.so.0(+0x57259) [0x7fd666777259] -> /usr/lib/dovecot/libdovecot-sieve.so.0(sieve_multiscript_run+0xa2) [0x7fd6667783f2] -> /usr/lib/dovecot/modules/lib90_sieve_plugin.so(+0x3d45) [0x7fd668cecd45] -> /usr/lib/dovecot/libdovecot-lda.so.0(mail_deliver+0xf9) [0x7fd66902c229] How can I find out which message is causing the crash? It would be very helpful, if the message's subject and receipt time could be logged in case of an abort or anything else that could help identify the corrupt message. This would also enable me to send You the message for further investigation (if appropriate). Kind regards Peter

1 0

Panic: file mail-index-util.c: line 10 (mail_index_uint32_to_offset): assertion failed: (offset < 0x40000000)
by Ralf Hildebrandt 24 May '19

24 May '19

I'm encountering a crash which this command: % doveadm import -u restore(a)backup.invalid mdbox:/home/copymail2/mdbox '' mailbox INBOX header X-Spam Yes SAVEDBEFORE 2019-05-23 doveadm(restore(a)backup.invalid): Panic: file mail-index-util.c: line 10 (mail_index_uint32_to_offset): assertion failed: (offset < 0x40000000) doveadm(restore(a)backup.invalid): Error: Raw backtrace: /usr/lib/dovecot/libdovecot.so.0(+0xd9f9e) [0x7fbc52ba7f9e] -> /usr/lib/dovecot/libdovecot.so.0(+0xd9fe1) [0x7fbc52ba7fe1] -> /usr/lib/dovecot/libdovecot.so.0(i_fatal+0) [0x7fbc52b0cc54] -> /usr/lib/dovecot/libdovecot-storage.so.0(mail_index_uint32_to_offset+0x78)[0x7fbc52f525e8] -> /usr/lib/dovecot/libdovecot-storage.so.0(mail_cache_add+0x83b)[0x7fbc52f3ac2b] -> /usr/lib/dovecot/libdovecot-storage.so.0(index_mail_parse_header+0x449)[0x7fbc52f1c969] -> /usr/lib/dovecot/libdovecot.so.0(+0xb6af9) [0x7fbc52b84af9] -> /usr/lib/dovecot/libdovecot.so.0(i_stream_read_memarea+0x7a) [0x7fbc52bb531a] -> /usr/lib/dovecot/libdovecot.so.0(i_stream_read+0x2f) [0x7fbc52bb565f] -> /usr/lib/dovecot/libdovecot.so.0(i_stream_read_data+0x3d)[0x7fbc52bb604d] -> /usr/lib/dovecot/libdovecot.so.0(message_parse_header_next+0x68)[0x7fbc52b8b3f8] -> /usr/lib/dovecot/libdovecot.so.0(message_parse_header+0x52)[0x7fbc52b8bdd2] -> /usr/lib/dovecot/libdovecot-storage.so.0(+0xcadae) [0x7fbc52f26dae] -> /usr/lib/dovecot/libdovecot-storage.so.0(+0xcc0ac) [0x7fbc52f280ac] -> /usr/lib/dovecot/libdovecot-storage.so.0(index_storage_search_next_nonblock+0x11d)[0x7fbc52f288bd] -> /usr/lib/dovecot/libdovecot-storage.so.0(mailbox_search_next_nonblock+0x28)[0x7fbc52ea92e8] -> /usr/lib/dovecot/libdovecot-storage.so.0(mailbox_search_next+0x3d)[0x7fbc52ea934d] -> doveadm(+0x31443) [0x5635b4760443] -> doveadm(+0x2bdb1) [0x5635b475adb1] -> doveadm(+0x2caf9) [0x5635b475baf9] -> doveadm(doveadm_cmd_ver2_to_mail_cmd_wrapper+0x20e) [0x5635b475c9ce] -> doveadm(doveadm_cmd_run_ver2+0x55e) [0x5635b476db7e] -> doveadm(doveadm_cmd_try_run_ver2+0x37) [0x5635b476dbd7] -> doveadm(main+0x1d1) [0x5635b474aec1] -> /lib/x86_64-linux-gnu/libc.so.6(__libc_start_main+0xe7) [0x7fbc5210fb97] -> doveadm(_start+0x2a) [0x5635b474b39a] Version info: ii dovecot-core 2:2.3.6-2~bionic amd64 secure POP3/IMAP server - core files ii dovecot-dbg 2:2.3.6-2~bionic amd64 secure POP3/IMAP server - debug symbols ii dovecot-imapd 2:2.3.6-2~bionic amd64 secure POP3/IMAP server - IMAP daemon ii dovecot-lmtpd 2:2.3.6-2~bionic amd64 secure POP3/IMAP server - LMTP server Backtrace: Program received signal SIGABRT, Aborted. __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:51 51../sysdeps/unix/sysv/linux/raise.c: No such file or directory. (gdb) bt #0 __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:51 #1 0x00007ffff68fa801 in __GI_abort () at abort.c:79 #2 0x00007ffff7373f51 in default_fatal_finish (status=0, type=LOG_TYPE_PANIC) at failures.c:459 #3 fatal_handler_real (ctx=<optimized out>, format=<optimized out>, args=<optimized out>) at failures.c:471 #4 0x00007ffff7373fe1 in default_fatal_handler (ctx=<optimized out>, format=<optimized out>, args=<optimized out>) at failures.c:479 #5 0x00007ffff72d8c54 in i_panic (format=format@entry=0x7ffff772e440 "file %s: line %d (%s): assertion failed: (%s)") at failures.c:523 #6 0x00007ffff771e5e8 in mail_index_uint32_to_offset (offset=<optimized out>) at mail-index-util.c:10 #7 0x00007ffff7706c2b in mail_cache_header_fields_write (ctx=0x55555583d960, buffer=<optimized out>, buffer=<optimized out>) at mail-cache-transaction.c:609 #8 mail_cache_header_add_field (field_idx=15, ctx=0x55555583d960) at mail-cache-transaction.c:690 #9 mail_cache_add (ctx=0x55555583d960, seq=1, field_idx=field_idx@entry=15, data=0x7ffff773ba56, data_size=0) at mail-cache-transaction.c:739 #10 0x00007ffff76eafdc in index_mail_cache_add_idx (mail=mail@entry=0x55555583e2f8, field_idx=field_idx@entry=15, data=data@entry=0x7ffff773ba56, data_size=data_size@entry=0) at index-mail.c:621 #11 0x00007ffff76e8969 in index_mail_parse_header_finish (mail=<optimized out>) at index-mail-headers.c:132 #12 index_mail_parse_header (part=<optimized out>, hdr=<optimized out>, mail=<optimized out>) at index-mail-headers.c:312 #13 0x00007ffff7350af9 in read_header (mstream=0x55555584b7f0) at istream-header-filter.c:357 #14 i_stream_header_filter_read (stream=0x55555584b7f0) at istream-header-filter.c:447 #15 0x00007ffff738131a in i_stream_read_memarea (stream=stream@entry=0x55555584b870) at istream.c:313 #16 0x00007ffff738165f in i_stream_read (stream=stream@entry=0x55555584b870) at istream.c:271 #17 0x00007ffff738204d in i_stream_read_data (stream=0x55555584b870, data_r=data_r@entry=0x7fffffffdbe8, size_r=size_r@entry=0x7fffffffdbf0, threshold=threshold@entry=1) at istream.c:745 #18 0x00007ffff73573f8 in i_stream_read_bytes (wanted=2, size_r=0x7fffffffdbf0, data_r=0x7fffffffdbe8, stream=<optimized out>) at ../../src/lib/istream.h:217 #19 message_parse_header_next (ctx=0x55555584ca70, hdr_r=hdr_r@entry=0x7fffffffdc50) at message-header-parser.c:85 #20 0x00007ffff7357dd2 in message_parse_header (input=<optimized out>, hdr_size=hdr_size@entry=0x0,flags=flags@entry=MESSAGE_HEADER_PARSER_FLAG_CLEAN_ONELINE, callback=callback@entry=0x7ffff76f2310 <search_header>, context=context@entry=0x7fffffffdcc0) at message-header-parser.c:392 #21 0x00007ffff76f2dae in search_arg_match_text (ctx=0x55555583dd20, args=0x555555809690) at index-search.c:760 #22 search_match_once (ctx=0x55555583dd20) at index-search.c:1400 #23 0x00007ffff76f40ac in search_match_next (ctx=0x55555583dd20) at index-search.c:1507 #24 search_more_with_mail (mail=<optimized out>, ctx=0x55555583dd20) at index-search.c:1624 #25 search_more_with_prefetching (mail_r=<optimized out>, ctx=<optimized out>) at index-search.c:1706 #26 search_more (ctx=ctx@entry=0x55555583dd20, mail_r=mail_r@entry=0x7fffffffddf0) at index-search.c:1780 #27 0x00007ffff76f48bd in index_storage_search_next_nonblock(_ctx=0x55555583dd20, mail_r=0x7fffffffdec0, tryagain_r=0x7fffffffde57) at index-search.c:1808 #28 0x00007ffff76752e8 in mailbox_search_next_nonblock (ctx=0x55555583dd20, mail_r=0x7fffffffdec0, tryagain_r=<optimized out>) at mail-storage.c:2141 #29 0x00007ffff767534d in mailbox_search_next (ctx=0x55555583dd20, mail_r=mail_r@entry=0x7fffffffdec0) at mail-storage.c:2126 #30 0x0000555555586682 in doveadm_mail_iter_next (iter=<optimized out>, mail_r=mail_r@entry=0x7fffffffdec0) at doveadm-mail-iter.c:160 #31 0x0000555555585443 in cmd_import_box (search_args=<optimized out>, info=0x555555832118, dest_user=<optimized out>, ctx=0x555555807d78) at doveadm-mail-import.c:142 #32 cmd_import_run (_ctx=0x555555807d78, user=0x55555581c688) at doveadm-mail-import.c:202 #33 0x000055555557fdb1 in doveadm_mail_next_user (ctx=ctx@entry=0x555555807d78, error_r=error_r@entry=0x7fffffffe0a0) at doveadm-mail.c:462 #34 0x0000555555580a0b in doveadm_mail_single_user (ctx=ctx@entry=0x555555807d78, error_r=error_r@entry=0x7fffffffe0a0) at doveadm-mail.c:492 #35 0x0000555555580af9 in doveadm_mail_cmd_exec (ctx=ctx@entry=0x555555807d78, wildcard_user=wildcard_user@entry=0x0) at doveadm-mail.c:653 #36 0x00005555555819ce in doveadm_cmd_ver2_to_mail_cmd_wrapper (cctx=<optimized out>) at doveadm-mail.c:1144 #37 0x0000555555592b7e in doveadm_cmd_run_ver2 (argc=12, argv=0x5555557f5ae8, cctx=cctx@entry=0x7fffffffe290) at doveadm-cmd.c:574 #38 0x0000555555592bd7 in doveadm_cmd_try_run_ver2 (cmd_name=<optimized out>, argc=<optimized out>, argv=<optimized out>, cctx=0x7fffffffe290) at doveadm-cmd.c:496 #39 0x000055555556fec1 in main (argc=<optimized out>, argv=<optimized out>) at doveadm.c:391 -- Ralf Hildebrandt Geschäftsbereich IT | Abteilung Netzwerk Charité - Universitätsmedizin Berlin Campus Benjamin Franklin Hindenburgdamm 30 | D-12203 Berlin Tel. +49 30 450 570 155 | Fax: +49 30 450 570 962 ralf.hildebrandt(a)charite.de | https://www.charite.de

2 2

MailCrypt plugin questions
by MRob 24 May '19

24 May '19

I read the mailcrypt plugin document on the wiki and had couple questions. 1. If I want per-user encryption am I correct I should configure global keys with all related settings override in the userdb lookup? 2. If I do not want to encrypt some user accounts, is it enough to omit the mail_crypt_global_private_key from the userdb lookup? In other word, mail_plugins still active with mail_crypt, will that cause user account to be encrypted unexpectedly if no private key is given? 3. Example command to create EC key does not ask for password, openssl ecparam command does not seem to have password arg. If I want password-protection should I use RSA key which the doc tell to be discouraged?

1 1

Re: Catch all for dovecot authentication?
by Joseph Tam 24 May '19

24 May '19

> as stated by Aki > > > passdb { > > driver = static > > args = nopassword > >} > > works fine and does what I want: accept any SMTP AUTH :-) (Brings back memories of good fun I had with patched Qpopper snare feeding custom messages to the hacker.) Another alternative is to use the checkpassword hook that will accept any username/password. The advantage is you can do post-analysis of credentials as the script has access to them. Joseph Tam <jtam.home(a)gmail.com>

1 0

Catch all for dovecot authentication?
by Tobi 23 May '19

23 May '19

Hi I'm aware that there are several good reasons not to do what I want, but in my use-case it would be an interesting feature. So please no discussions about the reasonableness I have some spamtrap SMTP servers (postfix). Currently SMTP AUTH is disabled. But as I daily have thousands of AUTH tries I thought it would be nice to be able to accept any AUTH request from postfix in dovecot. Is something like this possible with dovecot? If so any good description available on how to achieve? Thanks -- tobi

4 5

How to get original recipient from Postfix when using LMTP?
by MRob 22 May '19

22 May '19

Many people prefer to use LMTP for delivery from postfix for better efficiency but X-Original-to header support still missing after many years. One affect of this is need to set sieve_vacation_dont_check_recipient = yes which violate Sieve standard and cause auto-replyies sent to messages that should not happen. Or abandon LMTP. or abandon postfix?? So while feature request is stalled are there any realistic workarounds?

3 3

weakforced: Possible to access the ip address of report/allow?
by Tobi 22 May '19

22 May '19

Hi I wonder if the information about the origin of report or allow can be accessed somehow. lt.remote gives the IP of the client trying to login but is there anything in lt which gives the ip of the system that connects to wforced? Thanks and have a good one -- tobi

2 3

lmtp report permission denied on delivery to multiple recipients
by Patrick Cernko 22 May '19

22 May '19

Hello, when receiving mails for multiple recipients via LMTP, I often see the following messages on our servers: > May 22 11:06:10 sinon dovecot[44304]: lmtp(119718): Connect from $IP$ > May 22 11:06:11 sinon dovecot[44304]: lmtp($USER1$)<119718><2HnmOgIR5Vym0wEA22L5Rg>: msgid=<$MSGID$>: saved mail to INBOX > May 22 11:06:11 sinon dovecot[44304]: lmtp($USER2$)<119718><2HnmOgIR5Vym0wEA22L5Rg:2>: Error: stat(/IMAP/mail/mailboxes/$USER1$/mdbox/mailboxes/INBOX/dbox-Mails/dovecot.index.cache) failed: Permission denied (euid=$UID2$($USER2$) egid=$GID2$(rbg) missing +x perm: /IMAP/mail/mailboxes/$USER1$, dir owned by $UID1$:$GID2$ mode=0700) > May 22 11:06:11 sinon dovecot[44304]: lmtp($USER2$)<119718><2HnmOgIR5Vym0wEA22L5Rg:2>: Error: open(/IMAP/mail/mailboxes/$USER1$/mdbox/mailboxes/INBOX/dbox-Mails/dovecot.index.cache) failed: Permission denied (euid=$UID2$($USER2$) egid=$GID2$(rbg) missing +x perm: /IMAP/mail/mailboxes/$USER1$, dir owned by $UID1$:$GID2$ mode=0700) > May 22 11:06:11 sinon dovecot[44304]: lmtp($USER2$)<119718><2HnmOgIR5Vym0wEA22L5Rg:2>: Error: lstat(/IMAP/mail/mailboxes/$USER1$/mdbox/mailboxes/INBOX/dbox-Mails/dovecot.index.cache.lock) failed: Permission denied > May 22 11:06:11 sinon dovecot[44304]: lmtp($USER2$)<119718><2HnmOgIR5Vym0wEA22L5Rg:2>: Error: file_dotlock_open(/IMAP/mail/mailboxes/$USER1$/mdbox/mailboxes/INBOX/dbox-Mails/dovecot.index.cache) failed: Permission denied (euid=$UID2$($USER2$) egid=$GID2$(rbg) missing +x perm: /IMAP/mail/mailboxes/$USER1$, dir owned by $UID1$:$GID2$ mode=0700) > May 22 11:06:11 sinon dovecot[44304]: lmtp($USER2$)<119718><2HnmOgIR5Vym0wEA22L5Rg:2>: Error: open(/IMAP/mail/mailboxes/$USER1$/mdbox/mailboxes/INBOX/dbox-Mails/dovecot.index.cache) failed: Permission denied (euid=$UID2$($USER2$) egid=$GID2$(rbg) missing +x perm: /IMAP/mail/mailboxes/$USER1$, dir owned by $UID1$:$GID2$ mode=0700) > May 22 11:06:11 sinon dovecot[44304]: lmtp($USER2$)<119718><2HnmOgIR5Vym0wEA22L5Rg:2>: 2HnmOgIR5Vym0wEA22L5Rg:2: sieve: msgid=<$MSGID$>: stored mail into mailbox 'INBOX' > May 22 11:06:11 sinon dovecot[44304]: lmtp(119718): Disconnect from $IP$: Successful quit (usernames, uids, gids and IP addresses anonymized) So far, I was not able to reproduce this issue on a simple test setup, but I have the strong impression, that is has something to do with the fact, if some of the affected users have a active sieve script and others do not use sieve. In the example above $USER1$ did not have a sieve script configured but $USER2$ had one, as you can see. As a workaround, I configured an empty sieve script for all users with out sieve configured. This seems to work but actually I do not want to have users with empty sieve scripts. This bug seems to be related to https://dovecot.org/list/dovecot/2013-February/088540.html where Timo stated: "LMTP always delivers the mail to the first user. Then it tries to copy the first mail to the second user, because in some setups this can be done using hard links. With mbox that of course doesn't work, but looks like instead of failing silently it logs an error. So everything is working as it should, except there are these unnecessary errors logged. I'll see about getting rid of them." Is it possible to get rid of these error messages, either by a config setting that prevents if they do not lead to a real problem or by changing the code to avoid the behaviour described by Timo? Attached you can find doveconf -n output and the used ldap.conf (both anonymized), the referenced /etc/dovecot/passdb.deny and /etc/dovecot/userdb.overrides are usually empty files and only used during mailbox migrations. Best regards, -- Patrick Cernko <pcernko(a)mpi-klsb.mpg.de> +49 681 9325 5815 Joint Administration: Information Services and Technology Max-Planck-Institute fuer Informatik & Softwaresysteme

1 0

Integrity check mdbox?
by Marc Roos 22 May '19

22 May '19

Is it possible to do some sort of integrity check on mdbox's

2 1

Converting user mailboxes from maildir to sdbox
by David Mehler 22 May '19

22 May '19

Hello, I've got a Postfix/Dovecot server setup. Currently Dovecot is version 2.3.6, and it's using Maildir storage. The mailbox is: mail_home = /home/vmail/mailboxes/%d/%n mail_location = maildir:~/mail:LAYOUT=fs I'm wanting to convert from Maildir to sdbox. I looked at: https://wiki2.dovecot.org/MailboxFormat I was initially thinking mdbox but that's multiple messages per file, which I do not believe is what I want. Am I correct that in the sdbox format if a single message file is corrupted only that message is corrupt and not the rest of the messages as would be the case in a mdbox setup? On the page: https://wiki2.dovecot.org/Migration/MailFormat " maildir -> sdbox migration. Set mail_location=sdbox:~/sdbox and run dsync -u username mirror maildir:~/Maildir " If I set mail_location=sdbox:~/sdbox will that put the user mailboxes in mail_home/sdbox? So it would be: /home/vmail/mailboxes/example.com/username/sdbox I am needing to do this migration, but am paranoid about loosing mail or corrupting mailboxes. All of my users are virtual users and they are stored in a mysql database. Thanks. Dave.

2 1

[mail-crypt-plugin] How to decrypt mailbox?
by emordin 22 May '19

22 May '19

How do I enable the mail-crypt-plugin globally? Do I have to place 'mail_plugins = $mail_plugins mail_crypt' inside ever conf.d file where there is a protocol code block? Like for example the protocol lda codeblock in 15-lda.conf and the protocol imap codeblock in 20-imap.conf I placed 'mail_plugins = $mail_plugins mail_crypt' in 20-lmtp.conf inside the protocol lmtp code block, and the actual plugin settings are inside 90-plugin.conf inside the plugin codeblock. And I was able to get CRYPTED mail with this config. If I place 'mail_plugins = $mail_plugins mail_crypt' inside 90-plugin.conf, I get an error telling me to put 'mail_plugins = $mail_plugins mail_crypt' in 20-lmtp.conf Sent with [ProtonMail](https://protonmail.com) Secure Email.

2 1

Problems after upgrade from 2.2 to 2.3
by Lampa 21 May '19

21 May '19

Hello, i was using dovecot version 2.2 on debian server. After upgrade to debian version 2.3 i have problems. After some time imap doesn't work. There are lot of messages in log 2019-05-21T10:27:49.186373+02:00 hermes dovecot: imap-login: Error: master(imap): net_connect_unix(imap) failed: Resource temporarily unavailable - http://wiki2.dovecot.org/SocketUnavailable (client-pid=24810, client-id=148, rip=2.2.2.2, created 551 msecs ago, received 0/4 bytes) 2019-05-21T10:27:50.808136+02:00 hermes dovecot: imap-login: Error: master(imap): net_connect_unix(imap) failed: Resource temporarily unavailable - http://wiki2.dovecot.org/SocketUnavailable (client-pid=24810, client-id=169, rip=2.2.2.2, created 531 msecs ago, received 0/4 bytes) Tried client_limit set to 1 , service_count to 1 or 0 , still same results. It's imap server for 3k users. Any suggestions, please let me know. Thank you very much. Regards -- Lampa

1 0

Dovecot with LDAP Proxy
by Federico Bartolucci 21 May '19

21 May '19

Hello, configuring Dovecot with LDAP authentication, adding the parameter in ther sql config file: pass_attrs = \ =proxy=y I see then backend connections always addressed to localhot port 143: /user=utente1(a)domanin.com proxy lip=127.0.0.1 lport=143 / while I expect that connections would be managed by the director and then addressed to my backend IPs and specific port. Is there a way to configure ldap proxy to get that behavior? Thanks in advance. -federico

2 3

Dovecot documentation
by ＠lbutlr 21 May '19

21 May '19

the make config options for dovecot on FreeBSD list list [x] ICU Use libicu for FTS unicode normalization but https://wiki2.dovecot.org/Plugins/FTS makes no mention of libicu (nor of icu at all). is linicu simply in addition to the four options of Solar, Lucene, fts-xapian, and fts-dovecot? Also, the link to fts-dovecot goes to https://wiki2.dovecot.org/Plugins/FTS/Dovecot which is a 404. -- Man is born free, but is everywhere in chains.

1 0

[mail-crypt-plugin] How to decrypt mailbox?
by emordin 21 May '19

21 May '19

Hi, So I am able to encrypt email using the crypt plugin, but when I try to access the email by logging in thru mutt or roundcube the email is still encrypted. Is the decryption process automatic or do I have to create a custom program with the decrypt.rb code? Thanks. Sent with [ProtonMail](https://protonmail.com) Secure Email.

2 1

Further issues on FTS engine
by Joan Moreau 20 May '19

20 May '19

Hi, Additionally to the long list of problem on the FTS previously discussed, here a new: WHen I reset the indexes, the indexer-worker seems paralelleizing the indexing (which is good), however, the number available in "ps aux | grep dove" shows that it does not move: dovecot 28549 0.0 0.0 8620 3920 ? S 06:20 0:00 dovecot/indexer [0 clients, 3 requests] mailuse+ 28550 98.6 0.1 167412 86916 ? R 06:20 5:28 dovecot/indexer-worker [jom(a)grosjo.net XXXX - 800/37755] Looking further, if I put a tracer in teh backend, it treats the *same* message several times in parallel, and therefore does not move very fast on the global indexing of the box ANy clue ? THanks

2 1

enforcing multiple per-mailbox quotas for shared mailboxes
by Jost-Philip Matysik 20 May '19

20 May '19

Hi! I'm trying to get quotas for shared mailboxes set up on my server. It's not working, and I fail to understand why. Documentation for setup of this complexity is rather scarce on the web, and the discussions I found either don't directly apply or terminate with "I got it working" but no explanation. Can someone please help? The setup is rather lengthy and complicated, so I'll try to give a summary first for easier understanding. All help is appreciated! Please respond if you need more info! Thanks! Best regards, Jost Basic setup (where am I coming from?): ====================================== - This is a Debian 9 system with a more recent version of dovecot installed from https://repo.dovecot.org/ce-2.3-latest/debian/stretch - users have individual mailboxes with individual quotas -- this works great! - users can share mailboxes with other users through ACLs. To achieve this, there exists a wildcarded namespace with prefix="ZZZ_Freigaben/%%u" --this also works great! ==> up to here it's pretty much following the examples from the Wiki to the letter. Configuration goal (what do I want to achieve?): ================================================ - attach quotas to mailboxes, not logins - when copying/moving mails across shared mailboxes during imap sessions, enforce quota based on target mailbox, not logged-in user doing the copying. To clarify: ==> so if Bob has a quota of 500MB, all messages in Bob's mailbox should count against (and only against!) Bob's quota, regardless of who put them there. ==> if Alice has access to her own mailbox (directly), as well as Bob's mailbox and Dave's mailbox (through sharing), she should see 3 individual quotas when logging in: her own quota (200MB) for everything in her mailbox, bob's quota (300MB) for everything in Bob's mailbox, and Dave's quota (10GB) for everything in Dave's mailbox. These 3 quotas should be completely independant and neither block, nor override each other. Setup Idea (how I tried to get there): ====================================== - "quota=..." "quota_rule" and "quota_rule2" always refer to the user's own mailbox (with an additional rule for Trash). Everyone has those, so these are loaded statically from dovecot config file. - "quota_rule" is overwritten from userdb with the user's individual mailbox quota (the more I like you, the more space you get...) - since the number of different additional quotas required per user depends on how many mailboxes are shared with that user, individual "quota2=...", "quota3=...", "quotaN=..." fields are dynamically generated by the MySQL backend and loaded from userdb upon login. - consequently, for each "quotaN=..." entry, a corresponding "quotaN_rule=*:storage=XXX" is generated and returned from userdb (substitute N=1,2,3,4,... accordingly) Observations: ============= 1. enforcing quota for the user's personal mailbox works as expected, both through IMAP and when delivering incoming mail 2. overriding "quota_rule=..." from userdb for the user's personal mailbox works great. Individual quota is recognized and enforced both through IMAP and when delivering incoming mail. 3. dynamically loading "quota2=...", "quota3=..." etc. from userdb doesn't seem to work at all! I can see them being added as extra fields in the logs upon user login, but the quota-plugin seems to completely ignore them. They are not enforces, and tools like 'doveadm quota' list the userdb fields in the debug messages, but do not interpret them in any way. They do not throw errors either, the additional quota roots are just silently ignored. 4. the end result is that in an IMAP session the logged-in user's quota is enforced for their individual mailbox, but as soon as they write to someone else's mailbox (move a mail to /ZZZFreigaben/bob/Some-Subfolder), no quota is enforced at all! Additional debugging done: ========================== if I hardcode a "quota2=" and/or "quota3=" in the config file, I can observe the following: - If I hardcode "quota2=count:some_name:ns=ZZZ_Freigaben/", dovecot and doveadm will recognize the additional quota root. But since the folder "ZZZ_Freigaben/" on its own isn't a mailbox (it's just a path CONTAINING mailboxes), the quota is neither displayed in clients, nor enforced. It has no real-word effect, other than 'doveadm quota' showing an additional line. - If I hardcode "quota2=count:other_name:ns=ZZZ_Freigaben/postmaster/" in the config file (with that path being the real IMAP path to a shared mailbox), dovecot will complain in the log saying Error: quota: Unknown namespace: ZZZ_Freigaben/postmaster/ dovecot will start and work for the most part, but again completely ignore settings for the additional quota. - additionally, trying to override "quota2_rule=..." from userdb doesn't work as it does with "quota_rule=..."! If I have both "quota_rule=..." and "quota2_rule=..." in the config file as well as returned from userdb (with different values), dovecot will use "quota_rule" from userdb, but "quota2_rule" from config file. This behavior seems inconsistent! - I tried both maildir and count backends (seperately or mixed). Both show the same behavior. - I tried appending or removing an empty "ns=" to the first "quota=..." entry (the wiki shows some examples with it, some without). Makes no difference... Configuration Dumps below (slightly redacted to remove complete email addresses or IPs) ========================== output of dovecot -n: # 2.3.6 (7eab80676): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.6 (92dc263a) # OS: Linux 4.9.0-9-amd64 x86_64 Debian 9.9 # Hostname: [censored] auth_failure_delay = 10 secs auth_mechanisms = plain login default_vsz_limit = 512 M dict { acl = mysql:/etc/dovecot/dovecot-dict-sql.conf.ext } listen = * lmtp_rcpt_check_quota = yes login_greeting = Mail system ready. mail_gid = vmail mail_location = maildir:~/Maildir mail_plugins = " quota acl" mail_uid = vmail managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext imapsieve vnd.dovecot.imapsieve namespace Freigaben { list = children location = maildir:%%h/Maildir:INDEXPVT=%h/Maildir/Freigaben/%%u prefix = ZZZ_Freigaben/%%u/ separator = / subscriptions = no type = shared } namespace inbox { inbox = yes location = mailbox Drafts { auto = subscribe special_use = \Drafts } mailbox Junk { auto = subscribe autoexpunge = 61 days special_use = \Junk } mailbox Sent { auto = subscribe special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { auto = subscribe autoexpunge = 61 days special_use = \Trash } prefix = separator = / subscriptions = yes type = private } passdb { args = /etc/dovecot/dovecot-sql.conf.username driver = sql } plugin { acl = vfile:/etc/dovecot/dovecot-acl acl_defaults_from_inbox = yes acl_shared_dict = proxy::acl imapsieve_mailbox1_before = file:/etc/dovecot/sieve/learn-spam.sieve imapsieve_mailbox1_causes = COPY imapsieve_mailbox1_name = Junk imapsieve_mailbox2_before = file:/etc/dovecot/sieve/learn-ham.sieve imapsieve_mailbox2_causes = COPY imapsieve_mailbox2_from = Junk imapsieve_mailbox2_name = * quota = count:User quota:ns= quota_grace = 1%% quota_rule = *:storage=5G quota_rule2 = Trash:storage=+100M quota_status_nouser = DUNNO quota_status_overquota = 552 5.2.2 Mailbox is full quota_status_success = DUNNO quota_vsizes = yes sieve = file:~/sieve;active=~/.dovecot.sieve sieve_after = /etc/dovecot/sieve-after sieve_global_extensions = +vnd.dovecot.pipe +vnd.dovecot.environment sieve_max_script_size = 10M sieve_pipe_bin_dir = /etc/dovecot/sieve sieve_plugins = sieve_imapsieve sieve_extprograms sieve_quota_max_storage = 50M } postmaster_address = postmaster(a)matysik-ingenieurwesen.de protocols = " imap lmtp sieve" service auth-worker { user = vmail } service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0660 user = postfix } unix_listener auth-userdb { mode = 0666 } } service dict { unix_listener dict { group = vmail mode = 0660 user = dovecot } } service imap-login { inet_listener imap { port = 0 } inet_listener imaps { address = [censored] port = 993 ssl = yes } } service imap { process_limit = 1024 } service lmtp { unix_listener /var/spool/postfix/private/dovecot-lmtp { group = postfix mode = 0600 user = postfix } } service managesieve-login { inet_listener sieve { address = [censored] port = 4190 } service_count = 1 } service managesieve { process_limit = 64 } ssl_cert = </etc/letsencrypt/live/fullchain.pem ssl_cipher_list = ECDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:ECDH+3DES:DH+3DES:RSA+AESGCM:RSA+AES:RSA+3DES:!aNULL:!MD5:!DSS ssl_dh = # hidden, use -P to show it ssl_key = # hidden, use -P to show it ssl_min_protocol = TLSv1.2 ssl_options = no_compression ssl_prefer_server_ciphers = yes # comment: since imap logins differ from email-addresses I have 2 # userdb queries. One will return fields for %u='login', the other will # return fields for %u='email(a)domain.tld'. # no %u will ever make BOTH userdbs return rows (they are mutually exclusive) userdb { args = /etc/dovecot/dovecot-sql.conf.email driver = sql } userdb { args = /etc/dovecot/dovecot-sql.conf.username driver = sql } protocol lmtp { mail_plugins = " quota acl sieve" } protocol imap { mail_plugins = " quota acl imap_sieve imap_quota imap_acl" } example userdb output: ======================= root@server:/# doveadm -Dv user jost Debug: Loading modules from directory: /usr/lib/dovecot/modules Debug: Module loaded: /usr/lib/dovecot/modules/lib01_acl_plugin.so Debug: Module loaded: /usr/lib/dovecot/modules/lib10_quota_plugin.so Debug: Loading modules from directory: /usr/lib/dovecot/modules/doveadm Debug: Module loaded: /usr/lib/dovecot/modules/doveadm/lib10_doveadm_acl_plugin.so Debug: Skipping module doveadm_expire_plugin, because dlopen() failed: /usr/lib/dovecot/modules/doveadm/lib10_doveadm_expire_plugin.so: undefined symbol: expire_set_deinit (this is usually intentional, so just ignore this message) Debug: Module loaded: /usr/lib/dovecot/modules/doveadm/lib10_doveadm_quota_plugin.so Debug: Module loaded: /usr/lib/dovecot/modules/doveadm/lib10_doveadm_sieve_plugin.so Debug: Skipping module doveadm_fts_lucene_plugin, because dlopen() failed: /usr/lib/dovecot/modules/doveadm/lib20_doveadm_fts_lucene_plugin.so: undefined symbol: lucene_index_iter_deinit (this is usually intentional, so just ignore this message) Debug: Skipping module doveadm_fts_plugin, because dlopen() failed: /usr/lib/dovecot/modules/doveadm/lib20_doveadm_fts_plugin.so: undefined symbol: fts_user_get_language_list (this is usually intentional, so just ignore this message) Debug: Skipping module doveadm_mail_crypt_plugin, because dlopen() failed: /usr/lib/dovecot/modules/doveadm/libdoveadm_mail_crypt_plugin.so: undefined symbol: mail_crypt_box_get_pvt_digests (this is usually intentional, so just ignore this message) field valuedoveadm(jost)<25290><>: Debug: auth USER input: jost home=/var/vmail/matysik.it/jost-philip uid=5000 gid=5000 acl_groups=matysik,admin quota_rule=*:storage=10G quota_rule2 = Trash:storage=+100M quota2 = count:shared quota for maschinen:ns=ZZZ_Freigaben/maschinen/ quota2_rule = *:storage=500M quota3 = count:shared quota for matysik:ns=ZZZ_Freigaben/matysik/ quota3_rule = *:storage=10G quota4 = count:shared quota for postmaster:ns=ZZZ_Freigaben/postmaster/ quota4_rule = *:storage=1G uid 5000 gid 5000 home /var/vmail/matysik.it/jost-philip mail maildir:~/Maildir acl_groups matysik,admin quota_rule *:storage=10G quota_rule2 Trash:storage=+100M quota2 count:shared quota for maschinen:ns=ZZZ_Freigaben/maschinen/ quota2_rule *:storage=500M quota3 count:shared quota for matysik:ns=ZZZ_Freigaben/matysik/ quota3_rule *:storage=10G quota4 count:shared quota for postmaster:ns=ZZZ_Freigaben/postmaster/ quota4_rule *:storage=1G

1 0

Create a malicious directory
by lty 20 May '19

20 May '19

Use scripts to create some malicious directories. Here is my creation process. How can I prevent the creation of these directories? I used the python imapclient script to create a directory. There may be no big threat to dovecot, but it is dangerous for doveadm.

4 3

Directory name have some malicious characters.
by hfh＠cndns.com 20 May '19

20 May '19

Directory name have some malicious characters, is it safe?How can I exclude some characters,thanks!

1 0

Plugins/Mailcrypt: mail_crypt_private_password not assigned by password_query
by Max Kostikov 20 May '19

20 May '19

I try to use Mailcrypt encrypted user keys with conjustion with dbsync replication(Dovecot 2.3.6 in FreeBSD 12.0 enviroment) but was unsuccessful. If I provide a password in mail_crypt_private_password variable directly in Dovecot config all things works as expected plugin { mail_crypt_curve = prime256v1 mail_crypt_save_version = 2 mail_crypt_require_encrypted_user_key = yes mail_crypt_private_password = 12345 } but when I remove this and trying to get the same user password in password_query it seems password doesn't assigned password_query = SELECT username AS user, password, \ '%w' AS userdb_mail_crypt_private_password \ FROM mailbox WHERE username = LCASE('%u') \ AND active = '1' with errors like this in log at server where message was accepted from remote system May 20 00:40:31 server1 dovecot[35417]: dsync-local(foo(a)example.com)<Y51qBF/b4VyHigAAJQnBKg>: Error: dsync(server1.example.com): read() failed: read(/var/mail/example.com/foo/new/1558305609.M674400P35456.server1.example… failed: Private key not available: Cannot decrypt key a4ceb2df0287c0c0ccb0d76e31d91824e1f13e9ffe63d1e04a9a233a073d8a64: Cannot decrypt key 5d19a9246ddce2759a21462974add562dd90f2cb2aa3ff6a5af1af1e3e9b58e6: Password not available (last sent=mail, last recv=mail_request (EOL)) and errors at replica server May 20 00:40:31 server2 dovecot[63985]: dsync-local(foo(a)example.com)<MpW+HV/b4VwD+wAAfP91Tw>: Error: dsync(server2.example.com): read() failed: read() failed: dot-input stream ends without '.' line (last sent=mail_request (EOL), last recv=mail) The question is it possible to have password encrypted user keys with Dovecot dbsync replication or we found a new bug? -- With best regards, Max Kostikov W: https://kostikov.co | DeltaChat: mk(a)eprove.net

1 0

Permission denied
by ＠lbutlr 19 May '19

19 May '19

mail dovecot: lda(user@domain)<955><rPK3B2Gr4Vy7AwAAIdGjjQ>: msgid=<4562Sm6YyYzvmrD(a)mail.covisp.net>: save failed to INBOX: Mailbox INBOX: open(/usr/local/virtual/user(a)domain/tmp/1558293345.M130062P955.mail.covisp.net) failed: Permission denied The permissions on /usr/local/virual have not changed and are still owed by user/group 89/89 dovecot-sql.conf.ext: user_query = select 89 as uid, 89 as gid, concat('/usr/local/virtual/', maildir) as home FROM mailbox where username = '%u' dovecot.conf: first_valid_uid = 89 # ls -lsdn /usr/local/virtual/ 8 drwx------ 29 89 89 1536 Mar 12 23:30 /usr/local/virtual/ # ls -lsdn /usr/local/virtual/backup\(a)southgaylord.com 184 drwx------ 2056 89 89 92672 May 19 12:43 /usr/local/virtual/user@domain Do I need to compile dovecot with vpopmail support? -- I WILL NOT DO THE DIRTY BIRD Bart chalkboard Ep. AABF08

1 0

Repo for RHEL8
by TG Servers 19 May '19

19 May '19

2 2

Merging existing mailboxes to aliases
by Lefteris Tsintjelis 19 May '19

19 May '19

I am trying to merge all, existing or not, different mailboxes in one with the mailbox alias plugin. If I add the following lines, will the existing mailboxes automatically merge in one mailbox and corresponding links auto create? If not, do I have to do this manually? mailbox_alias_new = Spam mailbox_alias_new2 = Junk E-mail mailbox_alias_new3 = Sent Items mailbox_alias_new4 = Sent Messages mailbox_alias_new5 = Deleted Items mailbox_alias_old = Junk mailbox_alias_old2 = Junk mailbox_alias_old3 = Sent mailbox_alias_old4 = Sent mailbox_alias_old5 = Trash Lefteris

3 4

Do we need ssl_dh_parameters_length in version 2.3
by MRob 19 May '19

19 May '19

Hi, I couldn't really find documentation about ssl_dh_parameters_length except for mention in passing on the page https://wiki2.dovecot.org/SSL/DovecotConfiguration For version 2.3 and above is that setting necessary? If so what are the values I can use, is setting it high like 4096 beneficial or make any problems for clients? Thanks for assistance.

2 1

Re: imap failing
by LuKreme 18 May '19

18 May '19

Ugh. Sorry about this, using gmail and it’s weird and annoying meant to send to list On Thu, May 16, 2019 at 00:46 LuKreme <kremels(a)kreme.com> wrote: > One more bit of info. After leaving s_client up for a bit, I got another > line > > CONNECTED(00000003) > 675481056:error:140790E5:SSL routines:ssl23_write:ssl handshake > failure:/usr/src/crypto/openssl/ssl/s23_lib.c:177: > --- > no peer certificate available > --- > No client certificate CA names sent > --- > SSL handshake has read 0 bytes and written 307 bytes > --- > New, (NONE), Cipher is (NONE) > Secure Renegotiation IS NOT supported > Compression: NONE > Expansion: NONE > No ALPN negotiated > SSL-Session: > Protocol : TLSv1.2 > Cipher : 0000 > Session-ID: > Session-ID-ctx: > Master-Key: > Key-Arg : None > PSK identity: None > PSK identity hint: None > SRP username: None > Start Time: 1557988789 > Timeout : 300 (sec) > Verify return code: 0 (ok) > --- > > I guess I wasn't patient enough before. But the certs are in the exact > same place as they've been all along and are working fine with apache. > I can also send mail, if that is at all relevant. (postconf -n is in > another post in this thread) > -- Sent from Gmail Mobile

3 3

Find last day of login
by Lefteris Tsintjelis 18 May '19

18 May '19

I am using dovecot virtual maildir accounts. Is it possible to find last day of login for an account by checking the last modification time of the maildir files? Lefteris

3 4

How to continuously gather statistics?
by Roel van Duijnhoven 17 May '19

17 May '19

Hello, I recently upgraded to the latest version of Dovecot, and want to use the newly introduced logging / event system. I want to fetch the statistics every couple of seconds, and push those to our logging platform. Metrics such as: number of IMAP commands, average time they took, etc. However the metrics as reported by Dovecot continously increment. So I see two solutions: - Our solution could keep track of the previous values. But that could also break if the statistics are reset for some reason (e.g. threshold reached). - My second thought was to use "stats -r". That *should* clear the statistics directly after fetching them. And thus, give a better picture. However I am not sure if this gives me actual useful results. Or is there maybe a better approach to fetch statistics that I overlooked? Thanks a lot. Best, Roel van Duijnhoven

2 1

Dovecot Separator change
by Oliver Werner 16 May '19

16 May '19

Hi community, actually we are using dovecot 2.2.27 without shares mailboxes. Now we would like to implement it. So the problem is that our separator is dot „.“ and the username like „firstname.surname“. That’s doesn’t works with shared mailboxes. Are there a migration guide for changing „.“ to „/„ or it's not possible? kind regards Oliver

1 0

File-dictionary based quotas and SETQUOTA
by Ganael Laplanche 16 May '19

16 May '19

Hello, I am trying to set up file-dictionary based quotas while supporting the SETQUOTA IMAP command. I am using the following configuration : ---- plugin { quota = dict:User quota::file:%h/Maildir/dovecot-quota quota_set = dict:file:%h/Maildir/dovecot-quota } ---- which enables correct quota accounting + setting through SETQUOTA. A user's dovecot-quota file ends with the following contents : ---- priv/quota/limit/storage 5242880 priv/quota/limit/messages 20 priv/quota/messages 1 priv/quota/storage 8506282 ---- which shows a correct accounting (1 mail received, ~8MB used) and correct setting after having used the following IMAP command through a master user : A2 SETQUOTA "User quota" (STORAGE 5242880 MESSAGE 20) *But* the problem is that I am unable to fetch the limits and consume them from userdb (as a consequence, the limits are never applied). On the consuming side, I am using a dictionary userdb to try to fetch the 'priv/quota/limit/storage' value from the file but it does not work because the key is never found. Here is my configuration : ---- userdb { driver = dict args = /etc/dovecot/dovecot-dict-quota.conf.ext } ---- and my dovecot-dict-quota.conf.ext file : ---- uri = file:%h/Maildir/dovecot-quota iterate_disable = yes key quota { key = priv/quota/limit/storage default_value = 100 } userdb_fields { quota_rule = *:storage=%{dict:quota} } ---- If I try to fetch the quota for that user : # doveadm quota get -u ganael.laplanche(a)centralesupelec.fr Quota name Type Value Limit % User quota STORAGE 8307 100 8307 User quota MESSAGE 1 - 0 the default rule is returned (100). The logs show : May 16 12:02:45 mailhost1-saclay dovecot: auth-worker(12899): Debug: dict(Ganael.Laplanche(a)centralesupelec.fr): Lookup: shared/priv/quota/limit/ storage not found, using default value 100 We can see that the default quota rule has been applied because the key is not found. The problem is that a "shared/" prefix is always prepended when looking for the key I configured (priv/quota/limit/storage). If I test the dictionary manually, the key is found : # doveadm dict get -u ganael.laplanche(a)centralesupelec.fr "file:/var/vmail/l/ laplanche_gan/Maildir/dovecot-quota" priv/quota/limit/storage 5242880 Does anyone know how to prevent Dovecot from adding that prefix and make it fetch the correct value from userdb ? Best regards, -- Ganael Laplanche <ganael.laplanche(a)centralesupelec.fr> Unix Systems Engineer @CentraleSupelec Rennes

1 0

Password database - external verification
by Richard Hector 16 May '19

16 May '19

Hi all, I'm currently using a PostgreSQL database for my user/password db, directly from dovecot. The trouble with that is that I'm stuck with whatever hash algorithms dovecot supports - which IIRC means (a subset of?) what libc has been compiled with, which can be a bit restrictive. So I'd like to use an external tool, which would also let me integrate other applications (eg web apps). PAM seems to be most suited to sharing accounts with the OS, which isn't what I want. BSDAuth likewise, but I'm not using BSD. CheckPassword looks like a somewhat convoluted protocol, but maybe the best bet? IMAP - well, that's circular :-) OAuth2 looks possible, but seems to be focused on http? Any suggestions? And recommended implementations? How hard is it to add extra methods? Thanks, Richard

2 2

Dovecot not connecting to OpenLDAP
by Elias Falconi 16 May '19

16 May '19

Hi, We recently shutdown our old LDAP server and repointed our mail server (dovecot + postfix) to our new LDAP server and ever since we've been unable to fetch mail. Mail is getting delivered, but we just can't pop it. We're using Ubuntu 16.04, btw. We keep on getting the following error messages in /var/log/dovecote: 2019-05-15 16:27:43 auth: Error: LDAP /etc/dovecot/dovecot-ldap.conf.ext: ldap_start_tls_s() failed: Can't contact LDAP server 2019-05-15 16:39:36 auth: Error: LDAP /etc/dovecot/dovecot-ldap.conf.ext: ldap_start_tls_s() failed: Connect error 2019-05-15 16:39:43 auth: Error: LDAP /etc/dovecot/dovecot-ldap.conf.ext: ldap_start_tls_s() failed: Local error However, our server is finding our LDAP users and postfix doesn't seem to have a problem, just Dovecot. Also, when we try to connect via Dovecot, we get the following message: -ERR [SYS/TEMP] Temporary authentication failure. [mail:2019-05-15 21:40:06] Our /etc/dovecot/dovecot.conf contains the following: ## Dovecot configuration file # If you're in a hurry, see http://wiki2.dovecot.org/QuickConfiguration # "doveconf -n" command gives a clean output of the changed settings. Use it # instead of copy&pasting files when posting to the Dovecot mailing list. # '#' character and everything after it is treated as comments. Extra spaces # and tabs are ignored. If you want to use either of these explicitly, put the # value inside quotes, eg.: key = "# char and trailing whitespace " # Most (but not all) settings can be overridden by different protocols and/or # source/destination IPs by placing the settings inside sections, for example: # protocol imap { }, local 127.0.0.1 { }, remote 10.0.0.0/8 { } # Default values are shown for each setting, it's not required to uncomment # those. These are exceptions to this though: No sections (e.g. namespace {}) # or plugin settings are added by default, they're listed only as examples. # Paths are also just examples with the real defaults being based on configure # options. The paths listed here are for configure --prefix=/usr # --sysconfdir=/etc --localstatedir=/var # Enable installed protocols !include_try /usr/share/dovecot/protocols.d/*.protocol # A comma separated list of IPs or hosts where to listen in for connections. # "*" listens in all IPv4 interfaces, "::" listens in all IPv6 interfaces. # If you want to specify non-default ports or anything more complex, # edit conf.d/master.conf. #listen = *, :: # Base directory where to store runtime data. #base_dir = /var/run/dovecot/ # Name of this instance. In multi-instance setup doveadm and other commands # can use -i <instance_name> to select which instance is used (an alternative # to -c <config_path>). The instance name is also added to Dovecot processes # in ps output. #instance_name = dovecot # Greeting message for clients. #login_greeting = Dovecot ready. # Space separated list of trusted network ranges. Connections from these # IPs are allowed to override their IP addresses and ports (for logging and # for authentication checks). disable_plaintext_auth is also ignored for # these networks. Typically you'd specify your IMAP proxy servers here. #login_trusted_networks = # Space separated list of login access check sockets (e.g. tcpwrap) #login_access_sockets = # With proxy_maybe=yes if proxy destination matches any of these IPs, don't do # proxying. This isn't necessary normally, but may be useful if the destination # IP is e.g. a load balancer's IP. #auth_proxy_self = # Show more verbose process titles (in ps). Currently shows user name and # IP address. Useful for seeing who are actually using the IMAP processes # (eg. shared mailboxes or if same uid is used for multiple accounts). #verbose_proctitle = no # Should all processes be killed when Dovecot master process shuts down. # Setting this to "no" means that Dovecot can be upgraded without # forcing existing client connections to close (although that could also be # a problem if the upgrade is e.g. because of a security fix). #shutdown_clients = yes # If non-zero, run mail commands via this many connections to doveadm server, # instead of running them directly in the same process. #doveadm_worker_count = 0 # UNIX socket or host:port used for connecting to doveadm server #doveadm_socket_path = doveadm-server # Space separated list of environment variables that are preserved on Dovecot # startup and passed down to all of its child processes. You can also give # key=value pairs to always set specific settings. #import_environment = TZ ## ## Dictionary server settings ## # Dictionary can be used to store key=value lists. This is used by several # plugins. The dictionary can be accessed either directly or though a # dictionary server. The following dict block maps dictionary names to URIs # when the server is used. These can then be referenced using URIs in format # "proxy::<name>". dict { #quota = mysql:/etc/dovecot/dovecot-dict-sql.conf.ext #expire = sqlite:/etc/dovecot/dovecot-dict-sql.conf.ext quota = ldap:/etc/dovecot/dovecot-ldap.conf.ext expire = ldap:/etc/dovecot/dovecot-ldap.conf.ext } # Most of the actual configuration gets included below. The filenames are # first sorted by their ASCII value and parsed in that order. The 00-prefixes # in filenames are intended to make it easier to understand the ordering. !include conf.d/*.conf # A config file can also tried to be included without giving an error if # it's not found: !include_try local.conf # Added by Elias protocols = pop3 imap #ssl_cert = </etc/ssl/certs/server.crt #ssl_key = </etc/ssl/private/server.key ssl_cert = </etc/ssl/certs/ssl-cert-snakeoil.pem ssl_key = </etc/ssl/private/ssl-cert-snakeoil.key log_path = /var/log/dovecote info_log_path = /var/log/dovecote_info log_timestamp = "%Y-%m-%d %H:%M:%S " #syslog_facility = mail_dovecote #ssl = no #mail_location = mbox:~/:INBOX=/var/mail/%u #namespace { # type = private # separator = . # inbox = yes #} mail_privileged_group = mail mail_full_filesystem_access = yes mail_debug = yes mmap_disable = yes mail_nfs_storage = yes mail_nfs_index = yes mail_fsync = always mbox_read_locks = dotlock mbox_write_locks = dotlock passdb ldap { driver = ldap # Path for LDAP configuration file args = /etc/dovecot/dovecot-ldap.conf.ext } userdb { driver=passwd } userdb ldap { driver = ldap # Path for LDAP configuration file args = /etc/dovecot/dovecot-ldap.conf.ext } And our /etc/dovecot/dovecot-ldap.conf.ext has this: # This file is commonly accessed via passdb {} or userdb {} section in # conf.d/auth-ldap.conf.ext # This file is opened as root, so it should be owned by root and mode 0600. # # http://wiki2.dovecot.org/AuthDatabase/LDAP # # NOTE: If you're not using authentication binds, you'll need to give # dovecot-auth read access to userPassword field in the LDAP server. # With OpenLDAP this is done by modifying /etc/ldap/slapd.conf. There should # already be something like this: # access to attribute=userPassword # by dn="<dovecot's dn>" read # add this # by anonymous auth # by self write # by * none # Space separated list of LDAP hosts to use. host:port is allowed too. hosts = 139.147.9.135 # LDAP URIs to use. You can use this instead of hosts list. Note that this # setting isn't supported by all LDAP libraries. #uris = ldaps://139.147.9.135 # Distinguished Name - the username used to login to the LDAP server. # Leave it commented out to bind anonymously (useful with auth_bind=yes). dn = cn=admin,dc=cs,dc=lafayette,dc=edu # Password for LDAP server, if dn is specified. dnpass = blahblah123 # Use SASL binding instead of the simple binding. Note that this changes # ldap_version automatically to be 3 if it's lower. Also note that SASL binds # and auth_bind=yes don't work together. #sasl_bind = no # SASL mechanism name to use. #sasl_mech = # SASL realm to use. #sasl_realm = # SASL authorization ID, ie. the dnpass is for this "master user", but the # dn is still the logged in user. Normally you want to keep this empty. #sasl_authz_id = # Use TLS to connect to the LDAP server. tls = yes # TLS options, currently supported only with OpenLDAP: #tls_ca_cert_file =/etc/ssl/certs/ldap.crt tls_ca_cert_file =/etc/ssl/certs/ldap6_cacert.pem #tls_ca_cert_dir =/etc/ssl/certs/ #tls_cipher_suite = # TLS cert/key is used only if LDAP server requires a client certificate. #tls_cert_file = /etc/ssl/certs/ldap01_slapd_cert.pem #tls_key_file = /etc/ssl/private/ldap01_slapd_key.pem # Valid values: never, hard, demand, allow, try #tls_require_cert = demand # Use the given ldaprc path. #ldaprc_path = # LDAP library debug level as specified by LDAP_DEBUG_* in ldap_log.h. # -1 = everything. You may need to recompile OpenLDAP with debugging enabled # to get enough output. #debug_level = 0 # Use authentication binding for verifying password's validity. This works by # logging into LDAP server using the username and password given by client. # The pass_filter is used to find the DN for the user. Note that the pass_attrs # is still used, only the password field is ignored in it. Before doing any # search, the binding is switched back to the default DN. auth_bind = yes # If authentication binding is used, you can save one LDAP request per login # if users' DN can be specified with a common template. The template can use # the standard %variables (see user_filter). Note that you can't # use any pass_attrs if you use this setting. # # If you use this setting, it's a good idea to use a different # dovecot-ldap.conf.ext for userdb (it can even be a symlink, just as long as # the filename is different in userdb's args). That way one connection is used # only for LDAP binds and another connection is used for user lookups. # Otherwise the binding is changed to the default DN before each user lookup. # # For example: # auth_bind_userdn = cn=%u,ou=people,o=org # #auth_bind_userdn = # LDAP protocol version to use. Likely 2 or 3. ldap_version = 3 # LDAP base. %variables can be used here. # For example: dc=mail, dc=example, dc=org base = ou=People,dc=cs,dc=lafayette,dc=edu # Dereference: never, searching, finding, always deref = never # Search scope: base, onelevel, subtree scope = subtree # User attributes are given in LDAP-name=dovecot-internal-name list. The # internal names are: # uid - System UID # gid - System GID # home - Home directory # mail - Mail location # # There are also other special fields which can be returned, see # http://wiki2.dovecot.org/UserDatabase/ExtraFields user_attrs = homeDirectory=home,uidNumber=uid,gidNumber=gid # Filter for user lookup. Some variables can be used (see # http://wiki2.dovecot.org/Variables for full list): # %u - username # %n - user part in user@domain, same as %u if there's no domain # %d - domain part in user@domain, empty if user there's no domain user_filter = (&(objectClass=posixAccount)(uid=%u)) # Password checking attributes: # user: Virtual user name (user@domain), if you wish to change the # user-given username to something else # password: Password, may optionally start with {type}, eg. {crypt} # There are also other special fields which can be returned, see # http://wiki2.dovecot.org/PasswordDatabase/ExtraFields pass_attrs = uid=user,userPassword=password # If you wish to avoid two LDAP lookups (passdb + userdb), you can use # userdb prefetch instead of userdb ldap in dovecot.conf. In that case you'll # also have to include user_attrs in pass_attrs field prefixed with "userdb_" # string. For example: #pass_attrs = uid=user,userPassword=password,\ # homeDirectory=userdb_home,uidNumber=userdb_uid,gidNumber=userdb_gid # Filter for password lookups pass_filter = (&(objectClass=posixAccount)(uid=%u)) # Attributes and filter to get a list of all users #iterate_attrs = uid=user #iterate_filter = (objectClass=posixAccount) # Default password scheme. "{scheme}" before password overrides this. # List of supported schemes is in: http://wiki2.dovecot.org/Authentication #default_pass_scheme = CRYPT What do you suppose could be the problem? Thanks, Elias

3 2

imap failing
by ＠lbutlr 16 May '19

16 May '19

mail kernel: pid 59433 (imap-login), uid 0: exited on signal 11 (core dumped) master: Error: service(imap-login): command startup failed, throttling for 16 secs May 15 17:21:37 imap-login: Fatal: master: service(imap-login): child 92934 killed with signal 11 (core dumped) I also get a password error for a user unknown, but if I connect to the database with the credentials dovecot uses, I get a password. MariaDB [postfix]> select password FROM mailbox where username ='sample(a)domain.munged'; +-------------------------------------------------------------------------------+ | password | +-------------------------------------------------------------------------------+ | {SHA256-CRYPT}$5$042......................................................... | +-------------------------------------------------------------------------------+ MariaDB [postfix]> select 89 as uid, 89 as gid, concat('/usr/local/virtual/', maildir) as home FROM mailbox where username = 'sample(a)domain.munged'; +-----+-----+------------------------------------------+ | uid | gid | home | +-----+-----+------------------------------------------+ | 89 | 89 | /usr/local/virtual/sample(a)domain.munged/ | +-----+-----+------------------------------------------+ 1 row in set (0.00 sec) I updated my system to openssl111 and rebuilt dovecot and postfix (and a hundred other packages). <y configuration files have not changed. I've looked through he logs for other info, but I don't see anything. Trying to connect via openssl gives me: # openssl s_client -connect mail.covisp.net:993 -starttls imap CONNECTED(00000003)

3 5

Setting up individual encrypted user keys using mail-crypt-plugin
by emordin 16 May '19

16 May '19

Hi, I have setup up a simple mail server using the ISPMail tutorial and I'm trying to learn how to create email encryption at rest. I'm having a tough time understanding how to set this up... So say a user logins thru roundcube and they type in their password...so the password authenticates to the mysql database which is storing their encrypted private key?? And once they access that private key, how do they use that private key to unencrypt their mailbox? I'm a super noob at this, and I may be off, but I don't know where to start when it comes to setting this up... if I'm way off could you just recommend some tutorials or other basics I should learn first before moving on to setting this up? Sent with [ProtonMail](https://protonmail.com) Secure Email.

2 1

Mutual auth and MS Outlook
by dovecot＠scottsavarese.com 16 May '19

16 May '19

I am trying to get Dovecot IMAP and Outlook to talk to each other with SSL and client certificates enabled. In Dovecot, I have the following options enabled: ssl_ca = ... ssl_verify_client_cert = yes auth_ssl_require_client_cert = yes auth_ssl_username_from_cert = yes when I try to connect with Outlook, I get: May 12 08:07:50 mail dovecot: imap-login: Disconnected (client didn't send a cert): user=<>, method=PLAIN, rip=192.168.1.245, lip=192.168.2.5, TLS: Disconnected, session=<is7gpa+Im97AqAH1> But when I use openssl directly with the same certificates it seems to pass the certificate in just fine. Does anybody have any ideas? Thanks in advance.

2 1

Permissions fix
by Lefteris Tsintjelis 16 May '19

16 May '19

Is there a fast way for dovecot to set and/or fix its directory permissions?

2 2

Anyone using object storage ceph?
by Marc Roos 15 May '19

15 May '19

Just curious if there are already people actively using object storage? https://github.com/ceph-dovecot/dovecot-ceph-plugin https://docplayer.net/docs-images/40/9935441/images/page_13.jpg

2 1

Re: weakforced and GeoIP lookups
by Neil Cook 15 May '19

15 May '19

Hi Tobi, This looks like you haven’t included the libmaxmind libraries before running configure. GeoIP support is only compiled in if it finds the right libs. This would be libmaxminddb-dev on Ubuntu for example. Neil >> Hi list >> >> hope it's okay to ask weakforced questions here as well, but I could not >> find a dedicated mailinglist for wforce. >> >> I want to enable GeoIP lookups in my wforce daemon. In a first step I >> installed luarocks and lua-compat53 to install mmdblua module. >> Then I added >> >> newGeoIP2DB("country", "/usr/local/share/GeoIP/GeoLite2-Country.mmdb") >> local mygeodb = getGeoIP2DB("country") >> if(mygeodb:lookupCountry(lt.remote) == 'XX') >> then >> return -1, "country blocked", "country blocked", { country="XX" } >> end >> >> to wforce.conf and tried to restart wforce but that ends up in a >> >> > Fatal Lua error: [string "chunk"]:28: attempt to call global >> > 'newGeoIP2DB' (a nil value) >> >> Any ideas what I could be missing here? >> >> Cheers >> >> tobi > > > Neil Cook > neil.cook(a)open-xchange.com <mailto:neil.cook@open-xchange.com> > > ------------------------------------------------------------------------------------- > Open-Xchange AG, Rollnerstr. 14, 90408 Nuremberg, District Court Nuremberg HRB 24738 > Managing Board: Rafael Laguna de la Vera, Carsten Dirks, Michael Knapstein, Stephan Martin > Chairman of the Board: Richard Seibt > > European Office: > Open-Xchange GmbH, Olper Huette 5f, D-57462 Olpe, Germany, District Court Siegen, HRB 8718 > Managing Director: Frank Hoberg > > US Office: > Open-Xchange. Inc., 530 Lytton Avenue, Palo Alto, CA 94301, USA > ------------------------------------------------------------------------------------- > Neil Cook neil.cook(a)open-xchange.com <mailto:neil.cook@open-xchange.com> ------------------------------------------------------------------------------------- Open-Xchange AG, Rollnerstr. 14, 90408 Nuremberg, District Court Nuremberg HRB 24738 Managing Board: Rafael Laguna de la Vera, Carsten Dirks, Michael Knapstein, Stephan Martin Chairman of the Board: Richard Seibt European Office: Open-Xchange GmbH, Olper Huette 5f, D-57462 Olpe, Germany, District Court Siegen, HRB 8718 Managing Director: Frank Hoberg US Office: Open-Xchange. Inc., 530 Lytton Avenue, Palo Alto, CA 94301, USA -------------------------------------------------------------------------------------

2 4

LDA-based vacation responses bouncing
by micah anderson 14 May '19

14 May '19

I've got dovecot vacataion auto-responses working via sieve, but when the responses are sent, they are sent as if they are to be locally delivered, which causes them to bounce for domains that I am not local for. How can I get dovecot's sieve vacation response to check the domain is local or not? Here is an example of what happens: The LDA notices it needs to send a vacation response: 2019-05-14T10:50:47.827466-07:00 brant dovecot: lda(user(a)example.org)<14817><xL6LL/f/2lzhOQAAh856Uw>: sieve: msgid=<20190514135045.012486@localhost>: sent vacation response to <someone(a)somewhere.org> but that response was sent via the postfix pipe through the dovecot lda transport... because that is local, and the domain it is sending to is not local, it bounces: 2019-05-14T10:50:47.923333-07:00 brant postfix/pipe[14821]: C998381539: to=<someone(a)somewhere.org>, relay=dovecot, delay=0.11, delays=0.04/0.01/0/0.06, dsn=5.1.1, status=bounced (user unknown) Postfix is set to do this: dovecot unix - n n - - pipe flags=DRhu user=mail argv=/usr/bin/spamc --connect-retries=1 -H -d 10.0.1.92 -s 10240000 -t 100 -u ${recipient} -e /usr/lib/dovecot/dovecot-lda -f ${sender} -d ${recipient} require ["fileinto", "vacation"]; vacation :days 2 :subject "Helllo" "Hi"; Here is my doveconf -n: # 2.3.4.1 (f79e8e7e4): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.4 () # OS: Linux 4.9.0-8-amd64 x86_64 Debian 9.8 auth_worker_max_count = 120 default_client_limit = 6144 default_process_limit = 256 default_vsz_limit = 512 M dict { expire = mysql:/etc/dovecot/dovecot-dict-sql.conf quota = mysql:/etc/dovecot/dovecot-dict-sql.conf } disable_plaintext_auth = no first_valid_gid = 8 first_valid_uid = 8 last_valid_gid = 8 last_valid_uid = 8 listen = * login_greeting = howdy, ready. login_log_format_elements = user=<%u> method=%m rip=%r lip=%l mpid=%e %c %k mail_location = mdbox:~/mdbox mail_plugins = expire quota zlib maildir_very_dirty_syncs = yes namespace { inbox = yes location = prefix = separator = . } namespace { alias_for = hidden = yes inbox = no list = no location = prefix = INBOX. separator = . } passdb { args = /etc/dovecot/dovecot-sql.conf driver = sql } plugin { expire = Trash expire2 = Trash/* expire3 = Spam expire_dict = proxy::expire quota = dict:Your mail quota::proxy::quota quota_rule = *:bytes=100663296 quota_rule2 = Trash:bytes=+20%% quota_rule3 = Spam:bytes=+10%% quota_rule4 = INBOX.Trash:bytes=+20%% quota_rule5 = INBOX.Spam:bytes=+10%% quota_rule6 = INBOX.restored_from_backups:bytes=+500%% sieve = ~/.dovecot.sieve sieve_after = /var/lib/dovecot/sieve/after.sieve sieve_before = /var/lib/dovecot/sieve/default.sieve sieve_dir = ~/sieve zlib_save = gz zlib_save_level = 6 } protocols = " imap pop3" service anvil { unix_listener anvil { group = dovecot mode = 0660 user = root } } service auth { client_limit = 6144 unix_listener auth-userdb { group = mail mode = 0600 user = mail } } service dict { unix_listener dict { group = mail mode = 0600 user = mail } } service imap-login { process_min_avail = 10 service_count = 0 vsz_limit = 512 M } service imap-postlogin { executable = script-login /usr/local/sbin/postlogin_imap } service imap { executable = imap imap-postlogin process_limit = 6144 } service pop3-login { process_min_avail = 10 service_count = 0 vsz_limit = 512 M } service pop3-postlogin { executable = script-login /usr/local/sbin/postlogin_pop } service pop3 { executable = pop3 pop3-postlogin } service stats { unix_listener stats-writer { group = mail mode = 0660 } } ssl_cert = </etc/certs/wildcard/cert.pem ssl_cipher_list = ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA ssl_dh = # hidden, use -P to show it ssl_key = # hidden, use -P to show it ssl_prefer_server_ciphers = yes userdb { args = /etc/dovecot/dovecot-sql.conf driver = sql } verbose_proctitle = yes verbose_ssl = yes protocol lda { mail_plugins = expire quota trees zlib sieve plugin { quota_exceeded_message = Sorry, your message cannot be delivered to that person because their mailbox is full. If you can contact them another way, you may wish to tell them of this problem. quota_rule7 = INBOX:bytes=+10%% } } protocol imap { imap_client_workarounds = delay-newmail tb-extra-mailbox-sep mail_plugins = expire quota trees zlib imap_quota imap_zlib plugin { quota_exceeded_message = You are over quota. To avoid losing mail, immediately empty your Trash and Sent folders and delete emails with large attachments. } } protocol pop3 { mail_plugins = expire quota trees zlib pop3_client_workarounds = outlook-no-nuls oe-ns-eoh pop3_uidl_format = %g } remote 127.0.0.1 { mail_max_userip_connections = 60 } Thanks for any suggestions, micah

1 1

Graceful dovecot reload for LE certificate renewals
by Sidsel Jensen 14 May '19

14 May '19

Hi Dovecot-gurus With the introduction of LE certificates the certificate renewal cycle is a lot faster, unfortunately even a "dovecot reload" cuts the existing connections when doing the cert updates, which is quite frustrating - and yes most clients automatically reconnect but still... Is any work going into implementing a more “graceful reload” for dovecot like the one for nginx where existing connections are preserved with the old cert and new connections get the new cert? Kind Regards, Sidsel Jensen Systems Engineer @ One.com <http://one.com/>

2 1

Graceful dovecot reload for LE certificate renewals
by Sidsel Jensen 14 May '19

14 May '19

Hi Dovecot-gurus With the introduction of LE certificates the certificate renewal cycle is a lot faster, unfortunately even a "dovecot reload" cuts the existing connections when doing the cert updates, which is quite frustrating - and yes most clients automatically reconnect but still... Is any work going into implementing a more “graceful reload” for dovecot like the one for nginx where existing connections are preserved with the old cert and new connections get the new cert? Kind Regards, Sidsel Jensen Systems Engineer @ One.com <http://one.com/>

1 0

weakforced and GeoIP lookups
by Tobi 14 May '19

14 May '19

Hi list hope it's okay to ask weakforced questions here as well, but I could not find a dedicated mailinglist for wforce. I want to enable GeoIP lookups in my wforce daemon. In a first step I installed luarocks and lua-compat53 to install mmdblua module. Then I added newGeoIP2DB("country", "/usr/local/share/GeoIP/GeoLite2-Country.mmdb") local mygeodb = getGeoIP2DB("country") if(mygeodb:lookupCountry(lt.remote) == 'XX') then return -1, "country blocked", "country blocked", { country="XX" } end to wforce.conf and tried to restart wforce but that ends up in a > Fatal Lua error: [string "chunk"]:28: attempt to call global > 'newGeoIP2DB' (a nil value) Any ideas what I could be missing here? Cheers tobi

1 0

Is it possible to (re)direct only 1 imap user to the new server
by Marc Roos 14 May '19

14 May '19

I haven't used dovecot proxy or director. If I have a setup where all my users are connecting to HOSTNAMEOLD, is it possible to have 1 imap user that is connecting to HOSTNAMEOLD directed/forwarded to HOSTNAMENEW? Without changing my dns settings and preferably without creating any new servers. I think I can route one users mail to HOSTNAMENEW with sendmail ldap routing. So the only thing I need to be able to do is have the incoming imap requests on HOSTNAMEOLD been handled by HOSTNAMENEW. HOSTNAMEOLD HOSTNAMENEW +--------------+ +--------------+ | SENDMAIL | | SENDMAIL | | | | | | | | | | | V | | V | |--------------| |--------------| | lmtp | | NS /INBOX | | | | | mbox on | | V | | block device | |--------------| | | | NS /INBOX | |--------------| | mdbox on | | NS /ARCHIVE | | block device | | mdbox on | | | | clustered fs | |--------------| | | | NS /ARCHIVE | +--------------+ | mdbox on | | clustered fs | | | +--------------+

1 0

email notification regression between 2.2 and 2.3
by Thomas Capricelli 14 May '19

14 May '19

Hi, Hello. For the last year, each time i've tried updating dovecot from 2.2.x to 2.3.x, I had to rollback because of the following problem: Users don't "see" new emails arriving in subdirs. To be specific * we mostly use/tested thunderbird client * we use maildrop for delivery * this is using imap, not pop3 * when a new email arrives, thunderbird renders the dir name in blue and appends a "(1)" (or more..). That's what we call 'see' * this happens only on 'subdirs', not the main directory. * the server is a typical linux amd64, using the gentoo distribution More testing shows that * if we switch delivery to dovecot-lda, it works ok. But we can't commit that change, or at least not now/easily. Our users heavily use .mailfilter * if the user is currently viewing the subdir, then email notification is working * better : if the user went on the subdir and then in another dir, it keeps on working. It seems we need to 'open' it at least once for notification to work * "maildir_very_dirty_syncs = no" doesn't help (we had =yes) * "mailbox_list_index = no" doesn't help * i can confirm inotify was detected/used in autoconf when installed (anyway it works well with 2.2) I'm always on freenode (orzel). I'll be in #dovecot the next days at least. greetings, -- Thomas Capricelli

1 0

Userdb userdb_mail=, error Mailbox list driver maildir++: maildir_name not supported by this driver
by Marc Roos 14 May '19

14 May '19

I have this default configuration [0], when use the userdb_mail to point to the mdbox location, the inbox subfolders show differently in a firebird client. So I decided to copy the whole default mail_location into the userdb_mail configuration [2]. But then I get errors [3]. Should I change the namespace configuration here, how? My default namespaces are inbox and 4archives [0] [@ ]# doveconf | grep mail_loc mail_location = mbox:~/mail:INBOX=/var/spool/mail/%u:CONTROL=~/mail/control:INDEX=/var/d ovecot/%u/index:LAYOUT=maildir++ [1] [@dovecot]# cat special-userdb test:x:8267:231:Account with special settings for dovecot:/home/popusers/test:/bin/false:userdb_mail=mdbox:~/mdbox [2] [@dovecot]# cat special-userdb test:x:8267:231:Account with special settings for dovecot:/home/popusers/test:/bin/false:userdb_mail=mdbox:~/mdbox:INBOX=/ var/spool/mail/%u:CONTROL=~/mail/control:INDEX=/var/dovecot/%u/index:LAY OUT=maildir++ [3] May 13 22:41:32 mail04 dovecot: imap-login: Login: user=<test>, method=PLAIN, rip=192.168.10.219, lip=192.168.10.44, mpid=1138, TLS, session=<Gk4K8cqIkdHAqArb> May 13 22:41:32 mail04 dovecot: imap(test): Debug: Loading modules from directory: /usr/lib64/dovecot May 13 22:41:32 mail04 dovecot: imap(test): Debug: Module loaded: /usr/lib64/dovecot/lib15_notify_plugin.so May 13 22:41:32 mail04 dovecot: imap(test): Debug: Module loaded: /usr/lib64/dovecot/lib20_listescape_plugin.so May 13 22:41:32 mail04 dovecot: imap(test): Debug: Added userdb setting: mail=mdbox:~/mdbox:INBOX=/var/spool/mail/test:CONTROL=~/mail/control:IND EX=/var/dovecot/test/index:LAYOUT=maildir++ May 13 22:41:32 mail04 dovecot: imap(test): Debug: Effective uid=8267, gid=231, home=/home/popusers/test May 13 22:41:32 mail04 dovecot: imap(test): Debug: Namespace inbox: type=private, prefix=, sep=/, inbox=yes, hidden=no, list=yes, subscriptions=yes location=mdbox:~/mdbox:INBOX=/var/spool/mail/test:CONTROL=~/mail/control :INDEX=/var/dovecot/test/index:LAYOUT=maildir++ May 13 22:41:32 mail04 dovecot: imap(test): Error: Namespace '': Mailbox list driver maildir++: maildir_name not supported by this driver May 13 22:41:32 mail04 dovecot: imap(test): Namespace '': Mailbox list driver maildir++: maildir_name not supported by this driver in=0 out=378

2 5

doveadm 2.2.36-3.el7.x86_64 mailbox list -u test, does not use symlinked mailboxes
by Marc Roos 14 May '19

14 May '19

Maybe this has been already fixed, but symlinked mailboxes are not shown by [@ dovecot]# doveadm mailbox list -u test | sort Archive Archive/2018 Archive/2019 Archive/2019old Archive/Archive Drafts INBOX INBOX/test1 INBOX/test2 INBOX/test3 Junk Sent test testing-folder-home testing-folder-home/another folder Trash dovecot-2.2.36-3.el7.x86_64 CentOS Linux release 7.6.1810 (Core)

1 0

Sieve scripting
by Lefteris Tsintjelis 14 May '19

14 May '19

I want to monitor a special folder and execute a shell script each time I put an email to it. I would like to automate that way the process of SPAM reporting (SPAMCop). Is that possible with sieve? Lefteris

2 3

Doveadm sync, Error: read(remote) failed: EOF, Error: read(remote) failed: EOF
by Marc Roos 13 May '19

13 May '19

In the manual page this command is used for converting a mailbox doveadm sync -u test mdbox:~/mdbox -x INBOX -x INBOX/* Yet I am getting this error and the mdbox folder is not created. dsync-local(test): (version not received) doveadm(test): Fatal: execvp(mdbox:~/mdbox) failed: No such file or directory [@ dovecot]# doveconf | grep mail_locat mail_location = mbox:~/mail:INBOX=/var/spool/mail/%u:CONTROL=~/mail/control:INDEX=/var/d ovecot/%u/index:LAYOUT=maildir++ Users are not having shell access so something like su test -c '' will also not work. What would be a work-around for this?

2 2

dovecot 2.2.36 and wforce
by Tobi 13 May '19

13 May '19

Hi list I'm trying to setup dovecot 2.2.36 on a Centos6 to communicate with a wforce daemon on the remote side. wforce is latest released from git repo. Daemon part is working and I can successfully send queries from remote systems to wforce via curl For dovecot I configured in /etc/dovecot/conf.d/95-wforce.conf > auth_policy_server_url = http://REMOTE_IP:8084/ > auth_policy_hash_nonce = my_random > auth_policy_server_api_header = Authorization: Basic <BASE64 of wforce:my_password> > auth_policy_request_attributes = login=%{requested_username} pwhash=%{hashed_password} remote=%{rip} device_id=%{client_id} protocol=%s restarted dovecot without errors, but upon testing via imap I cannot see just one single tcp paket leaving direction REMOTE_IP on port 8084. It looks like auth policy in not involved at all. Thanks for any idea tobi

2 2

Re: Re: Dovecot not surviving OpenLDAP restart
by Dag Nygren 12 May '19

12 May '19

One more obvious line from the log: dovecot[26621]: auth: Error: LDAP: Connection lost to LDAP server, reconnecting Where it claims to reconnect, but after that there is no LDAP authentication. And the same configuration has worked fine since at least 10 years ago up to some recent update of dovecot or openldap. Best Dag

2 1

IMAPSieve message marked as HAM should go through full sieve script of user
by Matthias Fechner 10 May '19

10 May '19

Dear all, I use the IMAPSieve implementation described here: https://wiki.dovecot.org/HowTo/AntispamWithSieve It is working really great! Thanks a lot for this. The problem I have now is: A message was by accident marked by rspamd as spam, so a false-positive and is moved to the Junk folder. If I click in my email program now on `Not Spam` it is learn as HAM but moved to the INBOX. I would like that the email is not moved to INBOX but it should be moved through the sieve script of the user again, as it is a new email. Currently I have to mark all false-positives as not spam and have then to manually move it to the correct subfolder which is a bit annoying. Is this possible? Thanks a lot! -- Gruß Matthias

4 3

smtputf8
by Jerry 10 May '19

10 May '19

I am trying to find out if Dovecot supports "smtputf8". Obviously, I am looking in the wrong places, but I just cannot find a definitive answer. Thanks! -- Jerry

4 5

New WebSite
by Jorge Bastos 10 May '19

10 May '19

Hi There, The new website is cute, but I miss one thing, and I believe other also. In the releases, the date of the release, for example when 2.3.6 was out :P Maybe under the release version: Jorge,

1 0

doveadm sync issues (revised)
by Sven Strickroth 10 May '19

10 May '19

Hi, I'm experiencing serious issues using doveadm sync; mails are not replicating and/or mails are duplicating. I wanted to use this for migrating external mailboxes to my server (in order to overcome the time when some servers/clients still use the old server and some already my server, as described on <https://wiki2.dovecot.org/Tools/Doveadm/Sync>). Finally I was able to reproduce this with the 2.3 branch (cf. <https://dovecot.org/pipermail/dovecot/2019-April/115600.html>). I'm sorry that I can only test the version 2.3.4.1, but according to the changelog I think this is still an issue with the latest version. I tried to find a few steps in order to replicate this easily: For testing purposes I simulate both the remote and local server on my Dovecot instance. I created remote(a)DOMAIN.TLD and local(a)DOMAIN.TLD accounts and both use mdbox and are empty. First, send two mails to remote(a)DOMAIL.TLD (Subjects: Test1 and Test2). Start backup remote IMAP account (remote(a)DOMAIN.TLD) to local account (local(a)DOMAIN.TLD) $ doveadm -o imapc_user="remote(a)DOMAIN.TLD" -o imapc_password="PW" -o imapc_host="localhost" backup -R -u local(a)DOMAIN.TLD imapc: Both mailboxes are in sync now (containing Test1 und Test2). Now send two messages to remote(a)DOMAIN.TLD (Subjects Test3 and Test4) and two messages to local(a)DOMAIN.TLD (Subjects Test5 and Test6). Run sync: $ doveadm -o imapc_user="remote(a)DOMAIN.TLD" -o imapc_password="PW" -o imapc_host="localhost" sync -R -u local(a)DOMAIN.TLD imapc: See that syncing fails: remote(a)DOMAIN.TLD contains: Test1,2,3,4,5,6 (as expected) local(a)DOMAIN.TLD contains: Test1,2,5,6,4 (Test3 is missing here) When not using the "-R" parameter it seems to work. Running sync again: $ doveadm -o imapc_user="remote(a)DOMAIN.TLD" -o imapc_password="PW" -o imapc_host="localhost" sync -R -u local(a)DOMAIN.TLD imapc: causes messages to duplicate: remote(a)DOMAIN.TLD contains: Test1,2,6,5,4,3,5,6,4,6,5,4,3,5,6 local(a)DOMAIN.TLD contains: Test1,2,5,4,6,4,5,6 (3 is still missing) This is independent of the "-R" parameter. I could also experience this issue when using one-way sync, however, the first one-way sync is still ok, but then messages start duplicating as for the two-way sync without "-R": $ doveadm -o imapc_user="remote(a)DOMAIN.TLD" -o imapc_password="PW" -o imapc_host="localhost" sync -R -1 -u local(a)DOMAIN.TLD imapc: Hope you can replicate this, too, and finally fix the issue. -- Best regards, Sven Strickroth PGP key id F5A9D4C4 @ any key-server

2 1

Re: Dovecot does not recognize imported messages
by lty 10 May '19

10 May '19

I changed the user permissions, this is a must. Because an email is sent to this user, all emails are identified. > Did you do something like "chown -R vmail:vmail /var/mail" after copy messages? > > ср, 8 мая 2019 г. в 12:57, lty via dovecot <dovecot(a)dovecot.org>: > > Today I tried to import mail directly on the server's home directory on the server. I copied it directly. I didn't use the imap protocol. Dovcot didn't recognize these emails. I didn't display these imported emails on my page, recalculating disk quotas. It will not increase the used capacity. I try to send an email to this user, dovcot recognizes all the emails, and recalculates the disk cooperation, this time is correct. > Why can't I identify the mail I imported? > > [root@imap2 ~]# dovecot -n > # 2.2.36 (1f10bfa63): /etc/dovecot/dovecot.conf > # Pigeonhole version 0.4.24 (124e06aa) > # OS: Linux 2.6.32-431.el6.x86_64 x86_64 CentOS release 6.5 (Final) > # Hostname: imap > auth_master_user_separator = * > auth_mechanisms = PLAIN LOGIN > default_internal_user = vmail > default_vsz_limit = 2 G > deliver_log_format = msgid=%m, subject=%s, from=%f, %$ > dict { > acl = mysql:/etc/dovecot/dovecot-share-folder.conf > quotadict = mysql:/etc/dovecot/dovecot-used-quota.conf > } > disable_plaintext_auth = no > first_valid_uid = 2000 > last_valid_uid = 2000 > listen = * > mail_fsync = never > mail_gid = 2000 > mail_location = maildir:/%Lh/Maildir/:INDEX=/%Lh/Maildir/ > mail_plugins = quota lazy_expunge zlib fts fts_solr > mail_uid = 2000 > maildir_stat_dirs = yes > managesieve_notify_capability = mailto > managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext > mmap_disable = yes > namespace { > list = children > location = maildir:/%%Lh/Maildir/:INDEX=/%%Lh/Maildir/Shared/%%u > prefix = Shared/%%u/ > separator = / > subscriptions = yes > type = shared > } > namespace { > hidden = yes > list = no > location = maildir:/var/vmail/backup/expunged/%d/%n > prefix = .DELETED/ > separator = / > } > namespace inbox { > inbox = yes > location = > mailbox Drafts { > auto = subscribe > special_use = Drafts > } > mailbox Junk { > auto = subscribe > special_use = Junk > } > mailbox Sent { > auto = subscribe > special_use = Sent > } > mailbox Trash { > auto = subscribe > special_use = Trash > } > prefix = > separator = / > } > passdb { > args = /etc/dovecot/dovecot-mysql.conf > driver = sql > } > passdb { > args = /etc/dovecot/dovecot-fallback-password-mysql.conf > driver = sql > } > passdb { > args = /etc/dovecot/dovecot-fallback-mysql.conf > driver = sql > } > passdb { > args = /etc/dovecot/dovecot-master-users-password > driver = passwd-file > master = yes > } > plugin { > acl = vfile:/etc/dovecot/dovecot-acl > acl_globals_only = yes > auth_socket_path = /var/run/dovecot/auth-master > fts_autoindex_exclude = Junk > fts_autoindex_exclude2 = Trash > fts_autoindex_exclude3 = Sent > fts_autoindex_exclude4 = Drafts > fts_autoindex_max_recent_msgs = 20 > lazy_expunge = .DELETED/ > mail_replica = tcp:10.0.11.152:1111 [1] > quota = dict:user::proxy::quotadict > quota_grace = 0%% > quota_max_mail_size = 70M > quota_rule = *:storage=1G > quota_rule2 = *:messages=0 > quota_warning = storage=85%% quota-warning 85 %u > quota_warning2 = storage=90%% quota-warning 90 %u > quota_warning3 = storage=95%% quota-warning 95 %u > sieve = /%Lh/sieve/dovecot.sieve > sieve_default = /var/vmail/sieve/dovecot.sieve > sieve_default_name = managesieve > sieve_dir = /%Lh/sieve > } > protocols = pop3 imap sieve > service anvil { > client_limit = 20500 > } > service auth { > client_limit = 20500 > unix_listener /var/spool/postfix/private/auth { > group = postfix > mode = 0666 > user = postfix > } > unix_listener auth-master { > group = vmail > mode = 0666 > user = vmail > } > unix_listener auth-userdb { > group = vmail > mode = 0660 > user = vmail > } > } > service dict { > unix_listener dict { > group = vmail > mode = 0660 > user = vmail > } > } > service imap-login { > process_min_avail = 24 > service_count = 0 > vsz_limit = 2 G > } > service imap { > process_limit = 1024000 > process_min_avail = 24 > vsz_limit = 2 G > } > service pop3-login { > service_count = 0 > } > service quota-warning { > executable = script /usr/local/bin/dovecot-quota-warning.sh > unix_listener quota-warning { > group = vmail > mode = 0660 > user = vmail > } > } > ssl_ca = </etc/pki/tls/certs/c.cn.ca-bundle > ssl_cert = </etc/pki/tls/certs/c.cn.crt > ssl_key = # hidden, use -P to show it > syslog_facility = local6 > userdb { > args = /etc/dovecot/dovecot-mysql.conf > driver = sql > } > userdb { > args = /etc/dovecot/dovecot-fallback-user-mysql.conf > driver = sql > } > protocol lda { > auth_socket_path = /var/run/dovecot/auth-master > lda_mailbox_autocreate = yes > mail_fsync = optimized > mail_plugins = quota lazy_expunge zlib fts fts_solr sieve > syslog_facility = local6 > } > protocol imap { > imap_client_workarounds = tb-extra-mailbox-sep > imap_id_send = NAME dovecot VERSION 2.1.17 > mail_max_userip_connections = 20 > mail_plugins = quota lazy_expunge zlib fts fts_solr imap_quota mail_log imap_zlib notify > } > protocol pop3 { > mail_max_userip_connections = 20 > mail_plugins = quota lazy_expunge zlib fts fts_solr mail_log notify > pop3_client_workarounds = outlook-no-nuls oe-ns-eoh > pop3_uidl_format = %08Xu%08Xv > } -- С уважением, Рустам Багов. Links: ------ [1] http://10.0.11.152:1111

1 0

Dovecot not surviving OpenLDAP restart
by Dag Nygren 09 May '19

09 May '19

Hi! Running Dovecot 2.2.36 and authenticating against an OpenLDAP 2.4.45 server. Now since some update of dovecot it will not be able to authenticate your logins after a restart of the LDAP service is restarted without a reboot of the dovecot server. Anything new here that I should be aware of? Best Regards Dag

2 2

Re: Re: dict lookup too long time
by hfh＠cndns.com 09 May '19

09 May '19

logging some error,dict process is not dead. hfh(a)cndns.com From: Aki Tuomi via dovecot Date: 2019-05-09 14:21 To: hfh(a)cndns.com; dovecot Subject: Re: dict lookup too long time On 9.5.2019 8.00, hfh--- via dovecot wrote: hi, The following error message sometimes appears on my server log,it causes the mailbox to exceed the disk capacity limit. May 9 09:54:11 imap dovecot: imap(hfh(a)cndns.com): Error: dict-client: Lookup 'priv/quota/storage' failed: Connection closed: read(size=8192) failed: Connection reset by peer (reply took 2.728 secs (2.729 in dict wait, 0.000 in other ioloops, 0.000 in locks)) Is the dict process by chance dying or logging some error(s)? Aki

1 0

dovecot dict protocol
by Peter Hudec 09 May '19

09 May '19

Hi there is there any written specification for dovecot dict protocol instead of the code? Small example is in docs on https://wiki.dovecot.org/AuthDatabase/Dict and theere is link for all commands/reply in the code https://wiki.dovecot.org/AuthDatabase/Dict I’m writing small dict server and need some explanation for CMD: I, what does the flags means and how should the result looks like CMD: D, I thing this is the same as C, but coud be done later /async/ The reply codes are not very clear. I understand O, N, F. The rest is strange to me. Maybe this is good question do devel mailing list. regards Peter

1 0

UID to file?
by Carles Pina i Estany 09 May '19

09 May '19

Hello, In the past I was in a situation that given an email UID I wanted to know which file in the Maildir directory this UID was saved. I did a small parser for $HOME/Maildir/dovecot-uidlist where, if the file had: 1000 W1838 S1796 :1557351041.10447_1.example I would ask for the UID 1000 and would return :1557351041.10447_1.example (and I knew that it was in $HOME/Maildir/new) Is there any other way using dovecot tools to do the same, to avoid parsing an internal dovecot file? Thank you! -- Carles Pina i Estany GPG Key 0x8CD5C157

2 2

Push Notification clarification (MessageNew w/o LMTP or LDA)
by Christian Balzer 09 May '19

09 May '19

Hello, Both the examples on the Push Notification wiki page and the XAPS plugin docs seem to suggest or state that LMTP/LDA is required. However IMAP IDLE notifications work without either of these (please no religious discussion of why Dovecot LMTP is the best thing since sliced bread and that everybody should use it). The LUA part of the push notification docs however states that events other than MessageNew are supported. So my question is, when not using LMTP/LDA and a LUA script and of course the correct mail_plugins definition (either global or for IMAP), will a message delivery trigger MessageNew? Regards, Christian -- Christian Balzer Network/Systems Engineer chibi(a)gol.com Rakuten Communications

2 3

dict lookup too long time
by hfh＠cndns.com 09 May '19

09 May '19

hi, The following error message sometimes appears on my server log,it causes the mailbox to exceed the disk capacity limit. May 9 09:54:11 imap dovecot: imap(hfh(a)cndns.com): Error: dict-client: Lookup 'priv/quota/storage' failed: Connection closed: read(size=8192) failed: Connection reset by peer (reply took 2.728 secs (2.729 in dict wait, 0.000 in other ioloops, 0.000 in locks)) dovecot -n # 2.2.36 (1f10bfa63): /etc/dovecot/dovecot.conf # Pigeonhole version 0.4.24 (124e06aa) # OS: Linux 2.6.32-504.el6.x86_64 x86_64 CentOS release 6.6 (Final) # Hostname: imap3bak.sh.chengmail.me auth_master_user_separator = * auth_mechanisms = PLAIN LOGIN deliver_log_format = msgid=%m, subject=%s, from=%f, %$ dict { acl = mysql:/etc/dovecot/dovecot-share-folder.conf quotadict = mysql:/etc/dovecot/dovecot-used-quota.conf } disable_plaintext_auth = no first_valid_uid = 2000 last_valid_uid = 2000 listen = * mail_fsync = never mail_gid = 2000 mail_location = maildir:/%Lh/Maildir/:INDEX=/%Lh/Maildir/ mail_plugins = quota lazy_expunge zlib mail_uid = 2000 managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext mmap_disable = yes namespace { list = children location = maildir:/%%Lh/Maildir/:INDEX=/%%Lh/Maildir/Shared/%%u prefix = Shared/%%u/ separator = / subscriptions = yes type = shared } namespace { hidden = yes list = no location = maildir:/var/vmail/backup/expunged/%d/%n prefix = .DELETED/ separator = / } namespace inbox { inbox = yes location = mailbox Drafts { auto = subscribe special_use = \Drafts } mailbox Junk { auto = subscribe special_use = \Junk } mailbox Sent { auto = subscribe special_use = \Sent } mailbox Trash { auto = subscribe special_use = \Trash } prefix = separator = / } passdb { args = /etc/dovecot/dovecot-mysql.conf driver = sql } passdb { args = /etc/dovecot/dovecot-fallback-password-mysql.conf driver = sql } passdb { args = /etc/dovecot/dovecot-fallback-mysql.conf driver = sql } passdb { args = /etc/dovecot/dovecot-master-users-password driver = passwd-file master = yes } plugin { acl = vfile:/etc/dovecot/dovecot-acl acl_globals_only = yes auth_socket_path = /var/run/dovecot/auth-master lazy_expunge = .DELETED/ quota = dict:user::proxy::quotadict quota_grace = 0%% quota_max_mail_size = 70M quota_rule = *:storage=1G quota_rule2 = *:messages=0 quota_warning = storage=85%% quota-warning 85 %u quota_warning2 = storage=90%% quota-warning 90 %u quota_warning3 = storage=95%% quota-warning 95 %u sieve = /%Lh/sieve/dovecot.sieve sieve_default = /var/vmail/sieve/dovecot.sieve sieve_default_name = managesieve sieve_dir = /%Lh/sieve } protocols = pop3 imap sieve service anvil { client_limit = 20500 } service auth { client_limit = 20500 unix_listener /var/spool/postfix/dovecot-auth { group = postfix mode = 0666 user = postfix } unix_listener auth-master { group = vmail mode = 0666 user = vmail } unix_listener auth-userdb { group = vmail mode = 0660 user = vmail } } service dict { unix_listener dict { group = vmail mode = 0660 user = vmail } } service imap-login { process_min_avail = 24 service_count = 0 vsz_limit = 2 G } service imap { process_limit = 1024000 process_min_avail = 24 vsz_limit = 2 G } service pop3-login { service_count = 0 } service quota-warning { executable = script /usr/local/bin/dovecot-quota-warning.sh unix_listener quota-warning { group = vmail mode = 0660 user = vmail } } ssl_ca = </etc/pki/tls/certs/cndns.com.ca-bundle ssl_cert = </etc/pki/tls/certs/cndns.com.crt ssl_key = # hidden, use -P to show it syslog_facility = local6 userdb { args = /etc/dovecot/dovecot-mysql.conf driver = sql } userdb { args = /etc/dovecot/dovecot-fallback-user-mysql.conf driver = sql } protocol lda { auth_socket_path = /var/run/dovecot/auth-master lda_mailbox_autocreate = yes mail_fsync = optimized mail_plugins = quota lazy_expunge zlib sieve postmaster_address = root syslog_facility = local6 } protocol imap { imap_client_workarounds = tb-extra-mailbox-sep imap_id_send = NAME dovecot VERSION 2.1.17 mail_max_userip_connections = 20 mail_plugins = quota lazy_expunge zlib imap_quota mail_log imap_zlib notify } protocol pop3 { mail_max_userip_connections = 20 mail_plugins = quota lazy_expunge zlib mail_log notify pop3_client_workarounds = outlook-no-nuls oe-ns-eoh pop3_uidl_format = %08Xu%08Xv } hfh(a)cndns.com

2 1

How to auto-subscribe to virtual namespace/prefix?
by MRob 09 May '19

09 May '19

In virtual namespace I can have: namespace myvirt { location = blah prefix=Virtual/ separator=/ mailbox "My folder" { auto = subscribe } } And i see email clients successful display subscribed "My folder" but the top-level prefix "Virtual/" is not subscribed. I see the Virtual/ prefix available as a noselect folder in the list of unsubscribed folders and if I manual subscribe to it, folder tree display is perfect. So how can i also make auto-subscription to the "Virtual/" prefix noselect folder?

1 2

dsync to backup to directory?
by Felipe Gasper 08 May '19

08 May '19

Hello, We have a hosting operation and are interested in offloading mail for some of our machines to a separate machine. We want the ability, though, to migrate accounts between the “offloaded” and “unified” configurations. Toward that end, is it possible to “merge” two different mail directories (either maildir or mdbox) via doveadm? “doveadm backup” looks like the closest match, but it doesn’t appear to accept an arbitrary directory as its synchronization source. Thank you! -Felipe Gasper Mississauga, Ontario

1 0

Re: Dovecot does not recognize imported messages
by lty 08 May '19

08 May '19

I put it in the cur/ directory.

1 0

Dovecot does not recognize imported messages
by lty 08 May '19

08 May '19

Today I tried to import mail directly on the server's home directory on the server. I copied it directly. I didn't use the imap protocol. Dovcot didn't recognize these emails. I didn't display these imported emails on my page, recalculating disk quotas. It will not increase the used capacity. I try to send an email to this user, dovcot recognizes all the emails, and recalculates the disk cooperation, this time is correct. Why can't I identify the mail I imported? > [root@imap2 ~]# dovecot -n > # 2.2.36 (1f10bfa63): /etc/dovecot/dovecot.conf > # Pigeonhole version 0.4.24 (124e06aa) > # OS: Linux 2.6.32-431.el6.x86_64 x86_64 CentOS release 6.5 (Final) > # Hostname: imap > auth_master_user_separator = * > auth_mechanisms = PLAIN LOGIN > default_internal_user = vmail > default_vsz_limit = 2 G > deliver_log_format = msgid=%m, subject=%s, from=%f, %$ > dict { > acl = mysql:/etc/dovecot/dovecot-share-folder.conf > quotadict = mysql:/etc/dovecot/dovecot-used-quota.conf > } > disable_plaintext_auth = no > first_valid_uid = 2000 > last_valid_uid = 2000 > listen = * > mail_fsync = never > mail_gid = 2000 > mail_location = maildir:/%Lh/Maildir/:INDEX=/%Lh/Maildir/ > mail_plugins = quota lazy_expunge zlib fts fts_solr > mail_uid = 2000 > maildir_stat_dirs = yes > managesieve_notify_capability = mailto > managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext > mmap_disable = yes > namespace { > list = children > location = maildir:/%%Lh/Maildir/:INDEX=/%%Lh/Maildir/Shared/%%u > prefix = Shared/%%u/ > separator = / > subscriptions = yes > type = shared > } > namespace { > hidden = yes > list = no > location = maildir:/var/vmail/backup/expunged/%d/%n > prefix = .DELETED/ > separator = / > } > namespace inbox { > inbox = yes > location = > mailbox Drafts { > auto = subscribe > special_use = Drafts > } > mailbox Junk { > auto = subscribe > special_use = Junk > } > mailbox Sent { > auto = subscribe > special_use = Sent > } > mailbox Trash { > auto = subscribe > special_use = Trash > } > prefix = > separator = / > } > passdb { > args = /etc/dovecot/dovecot-mysql.conf > driver = sql > } > passdb { > args = /etc/dovecot/dovecot-fallback-password-mysql.conf > driver = sql > } > passdb { > args = /etc/dovecot/dovecot-fallback-mysql.conf > driver = sql > } > passdb { > args = /etc/dovecot/dovecot-master-users-password > driver = passwd-file > master = yes > } > plugin { > acl = vfile:/etc/dovecot/dovecot-acl > acl_globals_only = yes > auth_socket_path = /var/run/dovecot/auth-master > fts_autoindex_exclude = Junk > fts_autoindex_exclude2 = Trash > fts_autoindex_exclude3 = Sent > fts_autoindex_exclude4 = Drafts > fts_autoindex_max_recent_msgs = 20 > lazy_expunge = .DELETED/ > mail_replica = tcp:10.0.11.152:1111 > quota = dict:user::proxy::quotadict > quota_grace = 0%% > quota_max_mail_size = 70M > quota_rule = *:storage=1G > quota_rule2 = *:messages=0 > quota_warning = storage=85%% quota-warning 85 %u > quota_warning2 = storage=90%% quota-warning 90 %u > quota_warning3 = storage=95%% quota-warning 95 %u > sieve = /%Lh/sieve/dovecot.sieve > sieve_default = /var/vmail/sieve/dovecot.sieve > sieve_default_name = managesieve > sieve_dir = /%Lh/sieve > } > protocols = pop3 imap sieve > service anvil { > client_limit = 20500 > } > service auth { > client_limit = 20500 > unix_listener /var/spool/postfix/private/auth { > group = postfix > mode = 0666 > user = postfix > } > unix_listener auth-master { > group = vmail > mode = 0666 > user = vmail > } > unix_listener auth-userdb { > group = vmail > mode = 0660 > user = vmail > } > } > service dict { > unix_listener dict { > group = vmail > mode = 0660 > user = vmail > } > } > service imap-login { > process_min_avail = 24 > service_count = 0 > vsz_limit = 2 G > } > service imap { > process_limit = 1024000 > process_min_avail = 24 > vsz_limit = 2 G > } > service pop3-login { > service_count = 0 > } > service quota-warning { > executable = script /usr/local/bin/dovecot-quota-warning.sh > unix_listener quota-warning { > group = vmail > mode = 0660 > user = vmail > } > } > ssl_ca = </etc/pki/tls/certs/c.cn.ca-bundle > ssl_cert = </etc/pki/tls/certs/c.cn.crt > ssl_key = # hidden, use -P to show it > syslog_facility = local6 > userdb { > args = /etc/dovecot/dovecot-mysql.conf > driver = sql > } > userdb { > args = /etc/dovecot/dovecot-fallback-user-mysql.conf > driver = sql > } > protocol lda { > auth_socket_path = /var/run/dovecot/auth-master > lda_mailbox_autocreate = yes > mail_fsync = optimized > mail_plugins = quota lazy_expunge zlib fts fts_solr sieve > syslog_facility = local6 > } > protocol imap { > imap_client_workarounds = tb-extra-mailbox-sep > imap_id_send = NAME dovecot VERSION 2.1.17 > mail_max_userip_connections = 20 > mail_plugins = quota lazy_expunge zlib fts fts_solr imap_quota mail_log imap_zlib notify > } > protocol pop3 { > mail_max_userip_connections = 20 > mail_plugins = quota lazy_expunge zlib fts fts_solr mail_log notify > pop3_client_workarounds = outlook-no-nuls oe-ns-eoh > pop3_uidl_format = %08Xu%08Xv > }

2 1

Question about GIT repository
by Juan C. Blanco 07 May '19

07 May '19

Hello, just a question, I can't see a core "release-2.3.6" branch, nor a pigeonhole "release-0.5.6" branch on the GIT repository, it is outdated? or do you have changed your policy to create a new branch for each new release of dovecot and pigeonhole? Thanks and regards -- +-------------------------------------------------------------------+ | Juan C. Blanco | | | | Centro de Calculo | | | E.T.S. Ingenieros Informáticos | E-mail: jcblanco(a)fi.upm.es | | Universidad Politécnica de Madrid | | | Campus de Montegancedo | | | Boadilla del Monte | Tel.: (+34) 91 067 2771 | | 28660 MADRID (Spain) | Fax : (+34) 91 336 7412 | +-------------------------------------------------------------------+

4 6

Symlinked mailboxes and dovecot-uidlist.lock
by Dave 07 May '19

07 May '19

I have a scenario where I have two users, one account (user1) with it's own Maildir account, and another account (user2) (which I wish to see the same messages) with a symlinked Maildir to user1's Maildir. I.E.: /home/user1/Maildir /home/user2/Maildir (where this Maildir is symlinked to /home/user1/Maildir) Both users are in a group together (usergroup), and so all of the permissions on the Maildir, new, cur, etc folders are rwxrwx--- or rw-rw----. All mail gets created and delivered correctly, both users can move and create files, and everything generally seems to be working fine. However, I did notice one error showing up in the system logs: May 2 11:35:13 userserver dovecot: imap(user1): Error: inotify_add_watch(/home/user1/Maildir/dovecot-uidlist.lock) failed: Permission denied May 2 11:36:27 userserver dovecot: imap(user2): Error: inotify_add_watch(/home/user2/Maildir/dovecot-uidlist.lock) failed: Permission denied May 3 10:10:11 userserver dovecot: imap(user2): Error: inotify_add_watch(/home/user2/Maildir/.Folder1/dovecot-uidlist.lock) failed: Permission denied I've managed to catch a glimpse of a lock file, as it comes and goes very quickly, and it is permissioned as so: -rw-rw---- 1 user1 usergroup 10 May 5 11:39 dovecot-uidlist.lock So I'm not sure what exactly the permissions issue is then? The file seems to have the appropriate group permissions for each user to read from and write to it. Again, this is the only error I'm getting, and everything has been working fine. I did read the Dovecot wiki talking about symlinking mailboxes, and it refers to symlinking each box/folder individually and not the entire Maildir folder as I've done, but since each individual box/folder has its own dovecot-uidlist I imagine I might run into this same issue anyway? Anyway, I'd like to squelch the error if I can, so are there any thoughts as to why the lock files are having trouble with inotify_add_watch? -Dave

1 0

doveadm - mailbox to filesystem directory?
by Joaquin F 07 May '19

07 May '19

Is it possible to get the filesystem location (directory name) for a given mailbox? The closest I found was parsing the output of "doveadm -D mailbox create", but this only works if the mailbox doesn't exist yet and prone to failure if the debug output changes in future versions. Using "doveadm mailbox mutf7" helps, but there's some ASCII characters which are encoded. So far I've found "\" turns in to "\5c", "." into "\2e" and "/" to "\2f" and the separator to ".". But maybe there are others. Thanks in advance. Version: dovecot 2.2.36 (1f10bfa63) Relevant config: mail_location = maildir:~/Maildir protocols = imap namespace inbox { separator = "$" }

1 0

2.3.6 lib-smtp test failure in CentOS 6
by Peter 07 May '19

07 May '19

After applying the patches in my previous message... I'm getting the following when building dovecot for CentOS 6 (but not for CentOS 7): lmtp payload - normal: parallel pipelining ssl ....................... : ok CLIENT: Panic: file smtp-client-connection.c: line 1309 (smtp_client_connection_established): assertion failed: (!conn->connect_succeeded) CLIENT: Error: Raw backtrace: /builddir/build/BUILD/dovecot-2.3.6/src/lib-smtp/.libs/lt-test-smtp-payload() [0x4547ea] -> /builddir/build/BUILD/dovecot-2.3.6/src/lib-smtp/.libs/lt-test-smtp-payload() [0x454891] -> /builddir/build/BUILD/dovecot-2.3.6/src/lib-smtp/.libs/lt-test-smtp-payload(_start+0) [0x4193f8] -> /builddir/build/BUILD/dovecot-2.3.6/src/lib-smtp/.libs/lt-test-smtp-payload() [0x41fb95] -> /builddir/build/BUILD/dovecot-2.3.6/src/lib-smtp/.libs/lt-test-smtp-payload() [0x4203f0] -> /builddir/build/BUILD/dovecot-2.3.6/src/lib-smtp/.libs/lt-test-smtp-payload() [0x421d77] -> /builddir/build/BUILD/dovecot-2.3.6/src/lib-smtp/.libs/lt-test-smtp-payload(smtp_client_command_input_reply+0x17d) [0x42ffdd] -> /builddir/build/BUILD/dovecot-2.3.6/src/lib-smtp/.libs/lt-test-smtp-payload() [0x42145b] -> /builddir/build/BUILD/dovecot-2.3.6/src/lib-smtp/.libs/lt-test-smtp-payload(io_loop_call_io+0x61) [0x461d81] -> /builddir/build/BUILD/dovecot-2.3.6/src/lib-smtp/.libs/lt-test-smtp-payload(io_loop_handler_run_internal+0xd6) [0x463c16] -> /builddir/build/BUILD/dovecot-2.3.6/src/lib-smtp/.libs/lt-test-smtp-payload(io_loop_handler_run+0x59) [0x461e79] -> /builddir/build/BUILD/dovecot-2.3.6/src/lib-smtp/.libs/lt-test-smtp-payload(io_loop_run+0x38) [0x4620a8] -> /builddir/build/BUILD/dovecot-2.3.6/src/lib-smtp/.libs/lt-test-smtp-payload() [0x41a619] -> /builddir/build/BUILD/dovecot-2.3.6/src/lib-smtp/.libs/lt-test-smtp-payload() [0x41aaa8] -> /builddir/build/BUILD/dovecot-2.3.6/src/lib-smtp/.libs/lt-test-smtp-payload() [0x41ab7d] -> /builddir/build/BUILD/dovecot-2.3.6/src/lib-smtp/.libs/lt-test-smtp-payload() [0x44beae] -> /builddir/build/BUILD/dovecot-2.3.6/src/lib-smtp/.libs/lt-test-smtp-payload(test_run+0x11) [0x44c011] -> /builddir/build/BUILD/dovecot-2.3.6/src/lib-smtp/.libs/lt-test-smtp-payload(main+0x115) [0x419d65] -> /lib64/libc.so.6(__libc_start_main+0x100) [0x7f3850d4ad20] -> /builddir/build/BUILD/dovecot-2.3.6/src/lib-smtp/.libs/lt-test-smtp-payload() [0x419421] /bin/sh: line 1: 28384 Aborted ./$bin make[3]: Leaving directory `/builddir/build/BUILD/dovecot-2.3.6/src/lib-smtp' make[3]: *** [check-local] Error 1 make[2]: *** [check-am] Error 2 make[2]: Leaving directory `/builddir/build/BUILD/dovecot-2.3.6/src/lib-smtp' make[1]: *** [check-recursive] Error 1 make[1]: Leaving directory `/builddir/build/BUILD/dovecot-2.3.6/src' make: *** [check-recursive] Error 1 error: Bad exit status from /var/tmp/rpm-tmp.9PlfRJ (%check) Peter

2 4

regression with lmtp_hdr_delivery_address in 2.3
by dovecot-ffe7＠ryanc.org 07 May '19

07 May '19

Hi, In my LMTP config, I have lmtp_hdr_delivery_address = none. Under 2.2, Received headers looked like this: Received: from smtp.example.com by lmtp.example.com with LMTP id +IVdKS81cFwWagAAGhmRSA ; Fri, 22 Feb 2019 17:45:19 +0000 After the update to 2.3, they look like this: Received: from smtp.example.com by lmtp.example.com with LMTP id MJbKAMFEclyKCQAAGhmRSA (envelope-from <yyy(a)example.net>) for <xxx(a)example.com>; Sun, 24 Feb 2019 07:16:17 +0000 In both cases I *do not* have a "Delivered-To" header I do see a check for rcpt_to == NULL in the smtp_server_transaction_write_trace_record function, but it looks like the lmtp_local_add_headers function does not update the transaction, so it doesn't get pulled in. Also, the LMTP settings struct isn't exposed in that function currently, and I'm not sure how to add it. In 2.2, both the "Delivered-To" and "Received" headers were handled by client_get_added_headers. Please CC me in replies, as I am not subscribed to the list. Thanks, Ryan

2 1

http-lib test failures when building dovecot-2.3.5 and later in mock builder
by Tuomo Soini 07 May '19

07 May '19

There is random failure in test-http-payload when building rpm package from 2.3.6. I couldn't reproduce that in normal system but that happens something like every second try in mock chroot build envirnoment. Other tests don't have issues so it looks like test is not very reliable. Building 2.3.4 didn't yet have this issue. ./test-http-payload -D output attached. -- Tuomo Soini <tis(a)foobar.fi> Foobar Linux services +358 40 5240030 Foobar Oy <https://foobar.fi/>

2 1

dynamic virtual mailboxes?
by MRob 06 May '19

06 May '19

hi, I spent time learning about virtual mailboxes. Is there some way to create dynamic virtual mailboxes? I mean, when I look at a mailbox, I want to see only unread messages or flagged messages in that mailbox.

2 5

Understanding virtual mailboxes (examples in 15-mailboxes.conf)
by MRob 05 May '19

05 May '19

The examples in 15-mailboxes.conf # If you have a virtual "All messages" mailbox: #mailbox virtual/All { # special_use = \All # comment = All my messages #} # If you have a virtual "Flagged" mailbox: #mailbox virtual/Flagged { # special_use = \Flagged # comment = All my flagged messages #} They seem to reference some kind of virtual mailbox setup that doesn't compare to the docs for the "virtual" plugin. That plugin says we should create a separate namespace instead, like "namespace virtual" and put files representing the virtual folders into user maildirs. What if we use mdbox? add the files to user/mailboxes director I will guess. Is there a way to use the mailbox examples in the inbox namespace in the default config? Does it use some other method different from the virtual plugin? maybe more config hints for those examples would be helpful. Thank you.

2 3

Feature request - blacklistd interaction
by Lefteris Tsintjelis 04 May '19

04 May '19

Would be really really REALLY nice to have dovecot interact directly with blacklistd! Makes a huge difference on busy systems and beats log parsing by far. Thank you

2 2

Feature request: additional commands for doveadm HTTP API
by Peter Kubica 04 May '19

04 May '19

Hi, I hope this is correct way of making a feature request. I like doveadm HTTP API very much and use it for Zabbix monitoring. Would be possible to add "replicator status" and "auth test" doveadm commands to HTTP API? Thanks. Kind regards, Peter

1 0

2.3.6 lib-http assert failure
by Peter 02 May '19

02 May '19

connection lost after 100-continue ................................... : ok test-http-client-errors.c:1319: Assert failed: resp->status == 200 /bin/sh: line 1: 25431 Segmentation fault ./$bin make[3]: Leaving directory `/builddir/build/BUILD/dovecot-2.3.6/src/lib-http' make[3]: *** [check-local] Error 1 make[2]: Leaving directory `/builddir/build/BUILD/dovecot-2.3.6/src/lib-http' make[2]: *** [check-am] Error 2 make[1]: *** [check-recursive] Error 1make[1]: Leaving directory `/builddir/build/BUILD/dovecot-2.3.6/src' I tried applying the following patches: https://github.com/dovecot/core/commit/82e3ba00ef449dcead8af1885c2d323fd8cf… https://github.com/dovecot/core/commit/7debc474f2b4f5e24a9ba27a6b8adb4d5f78… ...which seem to fix the issue at least for CentOS 7 (CentOS 6 then errors out in the lib-smtp tests, see next post for details). It looks like there are some bug fix patches that didn't make it to the 2.3 branch. Peter

1 0

Re: v2.3.6 Configure fail 'libssl not found' macOS
by James Brown 01 May '19

01 May '19

> On 1 May 2019, at 4:38 pm, James Brown via dovecot <dovecot(a)dovecot.org <mailto:dovecot@dovecot.org>> wrote: > > No problems with 2.3.5, but when I try to compile 2.3.6 with: > > ./configure --with-mysql --with-ssl=openssl > > I get: > > checking for dlopen... yes > checking for SSL_read in -lssl... no > configure: error: Can't build with OpenSSL: libssl not found > > $ locate libssl > /Applications/BBEdit.app/Contents/XPCServices/GitIgnoreXPCService.xpc/Contents/Frameworks/libssl.dylib > /Applications/Navicat for MySQL.app/Contents/Frameworks/libssl.1.0.0.dylib > /Applications/assp/assp.mod/bin/libssl32.dll > /usr/lib/libssl.0.9.7.dylib > /usr/lib/libssl.0.9.8.dylib > /usr/lib/libssl.35.dylib > /usr/lib/libssl.43.dylib > /usr/lib/libssl.44.dylib > /usr/lib/libssl.dylib > /usr/local/Cellar/openssl/1.0.2r/lib/libssl.1.0.0.dylib > /usr/local/Cellar/openssl/1.0.2r/lib/libssl.a > /usr/local/Cellar/openssl/1.0.2r/lib/libssl.dylib > /usr/local/Cellar/openssl/1.0.2r/lib/pkgconfig/libssl.pc > /usr/local/Cellar/openssl(a)1.1/1.1.1b/lib/libssl.1.1.dylib > /usr/local/Cellar/openssl(a)1.1/1.1.1b/lib/libssl.a > /usr/local/Cellar/openssl(a)1.1/1.1.1b/lib/libssl.dylib > /usr/local/Cellar/openssl(a)1.1/1.1.1b/lib/pkgconfig/libssl.pc > /usr/local/lib/dovecot/libssl_iostream_openssl.a > /usr/local/lib/dovecot/libssl_iostream_openssl.la <http://libssl_iostream_openssl.la/> > /usr/local/lib/dovecot/libssl_iostream_openssl.so > > Any suggestions? > > Thanks, > > James. Sorry for the noise. export CPPFLAGS="-I/usr/local/opt/mysql(a)5.7/include/mysql -I/usr/local/Cellar/openssl(a)1.1/1.1.1b/include" export LDFLAGS="-L/usr/local/opt/mysql(a)5.7/lib -L/usr/local/opt/openssl(a)1.1/lib" ./configure --with-mysql --with-ssl=openssl Worked. James.

1 0

Feature request: exclude IP/network in allow_nets extra field
by Zhang Huangbin 01 May '19

01 May '19

Dear all, We use `allow_nets`[1] to restrict login clients, it works fine. Recently we need to allow some users to login from everywhere except some IP/networks, how can we accomplish this with "allow_nets"? Tried allow_nets="!a.b.c.d", but Dovecot reports error "allow_nets: Invalid network '!a.b.c.d'". Can we have this feature? i guess it should be done in function "auth_request_validate_networks"[2] in file src/auth/auth-request.c. [1] allow_nets: https://wiki.dovecot.org/PasswordDatabase/ExtraFields/AllowNets [2] https://github.com/dovecot/core/blob/fbc3ccc4a9a02b82073585a33254eacedc6a99…

6 11

v2.3.6 Configure fail 'libssl not found' macOS
by James Brown 01 May '19

01 May '19

No problems with 2.3.5, but when I try to compile 2.3.6 with: ./configure --with-mysql --with-ssl=openssl I get: checking for dlopen... yes checking for SSL_read in -lssl... no configure: error: Can't build with OpenSSL: libssl not found $ locate libssl /Applications/BBEdit.app/Contents/XPCServices/GitIgnoreXPCService.xpc/Contents/Frameworks/libssl.dylib /Applications/Navicat for MySQL.app/Contents/Frameworks/libssl.1.0.0.dylib /Applications/assp/assp.mod/bin/libssl32.dll /usr/lib/libssl.0.9.7.dylib /usr/lib/libssl.0.9.8.dylib /usr/lib/libssl.35.dylib /usr/lib/libssl.43.dylib /usr/lib/libssl.44.dylib /usr/lib/libssl.dylib /usr/local/Cellar/openssl/1.0.2r/lib/libssl.1.0.0.dylib /usr/local/Cellar/openssl/1.0.2r/lib/libssl.a /usr/local/Cellar/openssl/1.0.2r/lib/libssl.dylib /usr/local/Cellar/openssl/1.0.2r/lib/pkgconfig/libssl.pc /usr/local/Cellar/openssl(a)1.1/1.1.1b/lib/libssl.1.1.dylib /usr/local/Cellar/openssl(a)1.1/1.1.1b/lib/libssl.a /usr/local/Cellar/openssl(a)1.1/1.1.1b/lib/libssl.dylib /usr/local/Cellar/openssl(a)1.1/1.1.1b/lib/pkgconfig/libssl.pc /usr/local/lib/dovecot/libssl_iostream_openssl.a /usr/local/lib/dovecot/libssl_iostream_openssl.la <http://libssl_iostream_openssl.la/> /usr/local/lib/dovecot/libssl_iostream_openssl.so Any suggestions? Thanks, James.

1 0

Dovecot release v2.3.6
by Aki Tuomi 30 Apr '19

30 Apr '19

Hi! We are pleased to release Dovecot v2.3.6. Tarball is available at https://dovecot.org/releases/2.3/dovecot-2.3.6.tar.gz https://dovecot.org/releases/2.3/dovecot-2.3.6.tar.gz.sig Binary packages are available at https://repo.dovecot.org/ Changes ------- * CVE-2019-11494: Submission-login crashed with signal 11 due to null pointer access when authentication was aborted by disconnecting. * CVE-2019-11499: Submission-login crashed when authentication was started over TLS secured channel and invalid authentication message was sent. * auth: Support password grant with passdb oauth2. + Use system default CAs for outbound TLS connections. + Simplify array handling with new helper macros. + fts_solr: Enable configuring batch_size and soft_commit features. - lmtp/submission: Fixed various bugs in XCLIENT handling, including a hang when XCLIENT commands were sent infinitely to the remote server. - lmtp/submission: Forwarded multi-line replies were erroneously sent as two replies to the client. - lib-smtp: client: Message was not guaranteed to contain CRLF consistently when CHUNKING was used. - fts_solr: Plugin was no longer compatible with Solr 7. - Make it possible to disable certificate checking without setting ssl_client_ca_* settings. - pop3c: SSL support was broken. - mysql: Closing connection twice lead to crash on some systems. - auth: Multiple oauth2 passdbs crashed auth process on deinit. - HTTP client connection errors infrequently triggered a segmentation fault when the connection was idle and not used for a particular client instance. --- Aki Tuomi Open-Xchange oy

4 6

Pigeonhole release 0.5.6
by Aki Tuomi 30 Apr '19

30 Apr '19

Hi! We are pleased to release Pigeonhole 0.5.6 for Dovecot 2.3.6. Tarball https://pigeonhole.dovecot.org/releases/2.3/dovecot-2.3-pigeonhole-0.5.6.ta… https://pigeonhole.dovecot.org/releases/2.3/dovecot-2.3-pigeonhole-0.5.6.ta… Binary packages can be found from https://repo.dovecot.org/ Changes + sieve: Redirect loop prevention is sometimes ineffective. Improve existing loop detection by also recognizing the X-Sieve-Redirected-From header in incoming messages and dropping redirect actions when it points to the sending account. This header is already added by the redirect action, so this improvement only adds an additional use of this header. - sieve: Prevent execution of implicit keep upon temporary failure occurring at runtime. --- Aki Tuomi Open-Xchange oy

1 0

CVE-2019-11499: Submission-login crashes when authentication is started over TLS secured channel and invalid authentication message is sent
by Aki Tuomi 30 Apr '19

30 Apr '19

Open-Xchange Security Advisory 2019-04-30 Product: Dovecot Vendor: OX Software GmbH Internal reference: DOV-3223 (Bug ID) Vulnerability type: CWE-617 Vulnerable version: 2.3.0 - 2.3.5.2 Vulnerable component: submission-login Report confidence: Confirmed Solution status: Fixed by Vendor Fixed version: 2.3.6 Vendor notification: 2019-03-11 Solution date: 2019-04-23 Public disclosure: 2019-04-30 CVE reference: CVE-2019-11499 CVSS: 7.5 (CVSS3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vulnerability Details: Submission-login crashes when authentication is started over TLS secured channel and invalid authentication message is sent. This can lead to denial-of-service attack by persistent attacker(s). Workaround: Authentication crash can be avoided if authentication is done without TLS. Solution: Operators should upgrade to a fixed version.

1 0

CVE-2019-11494: Submission-login crashes with signal 11 due to null pointer access when authentication is aborted by disconnecting.
by Aki Tuomi 30 Apr '19

30 Apr '19

Open-Xchange Security Advisory 2019-04-30 Product: Dovecot Vendor: OX Software GmbH Internal reference: DOV-3212 (Bug ID) Vulnerability type: CWE-476 Vulnerable version: 2.3.0 - 2.3.5.2 Vulnerable component: submission-login Report confidence: Confirmed Researcher credits: Marcelo Coelho Solution status: Fixed by Vendor Fixed version: 2.3.6 Vendor notificatio: 2019-03-11 Solution date: 2019-04-23 Public disclosure: 2019-04-30 CVE reference: CVE-2019-11494 CVSS: 7.5 (CVSS3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vulnerability Details: Submission-login crashes with signal 11 due to null pointer access when authentication is aborted by disconnecting. This can lead to denial-of-service attack by persistent attacker(s). Workaround: There is no available workaround for this issue. Solution: Operators should upgrade to a fixed version.

1 0

Re: Sis to deduplicate attachments does not work?
by Daniel Miller 29 Apr '19

29 Apr '19

On April 23, 2019 10:54:38 PM luckydog xf <luckydogxf(a)gmail.com> wrote: > Is it worthwile to use dbox? seeing from > http://www.linuxmail.info/mbox-maildir-mail-storage-formats/ it may cause > file lock and easy to corrupt. As with everything - it depends. You're asking me so these are *my* opinions - and I do not claim to be anything more than a hobbyist/tinkerer when the comes to this. mbox has potential use for long term read-only archives - I see no reason to use it for live mailboxes. maildir is undoubtedly the least susceptible to corruption. It's also the slowest format for reading. How slow is "slow" depends on your hardware - it may be imperceptible with enough RAM and SSD's - or it may result in user complaints with large mailboxes. dbox is Dovecot's preferred format. I know Timo has put a lot of effort into it. sdbox is similar to maildir in that each mail is a separate file. mdbox significantly reduces the number of files which can make file-based backups faster. Both dbox formats are dependent on their index files. If you've got good hardware, including a proper UPS, I'd recommend dbox (my server is presently using sdbox). With large mailboxes and file-based backups you'll benefit from mdbox. When reliability is the #1 concern above anything else - use maildir. Depending on your use SIS can have significant impact on storage requirements - but storage these days is relatively cheap. I haven't seen much feedback from users actively using SIS - I'd love to hear from high traffic sites with SIS experience to know if the corruption issues have been resolved. In my case there was at least a 30% reduction in space but I had too many errors - admittedly it's been a couple years since I last tried it. -- Daniel

3 3

Using lmtp to authenticate email users
by Patrick Mahan 29 Apr '19

29 Apr '19

FreeBSD 11.2 Postfix 3.3.2 Dovecot 2.3.4 I am trying to use dovecot lmtp with postfix to verify authentication of incoming email and to avoid being a spam relay (an issue I was having using sendmail as my MTA). I am getting the following log message in /var/log/maillog: Mar 30 20:31:38 ns postfix/smtpd[40373]: NOQUEUE: reject: RCPT from mail-eopbgr750091.outbound.protection.outlook.com[40.107.75.91]: 450 4.1.1 < mahan(a)mahan.org>: Recipient address rejected: unverified address: host ns.mahan.org[private/dovecot-lmtp] said: 550 5.1.1 <mahan(a)mahan.org> User doesn't exist: mahan(a)mahan.org (in reply to RCPT TO command); from=< pmahan(a)silver-peak.com> to=<mahan(a)mahan.org> proto=ESMTP helo=< NAM02-BL2-obe.outbound.protection.outlook.com> 'mahan' does exist on ns.mahan.org. So I am confused to why lmtp is failing to find this username. Thanks, Patrick

4 5

used Lazyexpunge
by lty 28 Apr '19

28 Apr '19

I used Lazyexpunge. I tried to create .DELETED without any hints and see that the creation was successful. I want to prevent users from creating .DELETED, what should I do? My settings > plugin { > lazy_expunge = .DELETED/ > } > # > > namespace { > prefix = .DELETED/ > hidden = yes > list = no > separator = / > location = maildir:/var/vmail/backup/expunged/%d/%n > }

2 1

Auto rebuilding of Solr indexes on settings change?
by Peter Mogensen 25 Apr '19

25 Apr '19

Hi, Looking at the source, it doesn't seem like fts-solr checks for settings changes using fts_index_have_compatible_settings() like fts-lucene does. Is there any special reason for why fts-solr shouldn't also rebuild indexes if settings has changed? /Peter

2 1

msg header has bad magic value
by 김태용 25 Apr '19

25 Apr '19

There was an error saving the message. 'Error: Corrupted dbox file /storage/m.1 (around offset = 21589): msg header has bad magic value' Why do I get an error? How can I fix it?

1 0

haproxy + submission services -> postfix failure
by Chris Thomas 24 Apr '19

24 Apr '19

Hi, I have a nginx server which is using the proxy protocol to forward tcp connections to dovecot. Dovecot is configured to be a submission service for email to be sent. Then postfix should send the email itself which is also using the ha proxy protocol. There are a few moving parts in this problem so I'm not sure where the problem is. But I want to ask if somebody can validate my dovecot configuration somehow so I can start to tick off some things from the list. Sending email fails, seems to get to postfix, then die Receiving emails succeeds and I don't have any problem to pick them up. I've figured out some stuff, like lmtp shouldn't use haproxy when talking between postfix -> dovecot for receiving emails. If I enable the protocol on lmtp, I can't receive any emails at all. In order to get postfix to accept emails, I enabled haproxy protocol and enabled postscreen and then postfix could access the source ip and stop my server from being an open relay. I've got tls certificates installed on dovecot and postfix, all created by letsencrypt and I don't appear to have any problems with them. I will try to give as much information about the config as I can, I'm not sure what other parts are good to have, but let me know if you are missing something or want to check a value. >> 10-master.conf: service submission-login { inet_listener submission { port = 587 haproxy = yes } } service lmtp { inet_listener lmtp { port = 24 haproxy = no } } >> 20-submission.conf submission_relay_host = postfix.mail-server submission_relay_port = 25 submission_relay_ssl = starttls submission_relay_ssl_verify = yes Then because it might help to give the other side of the connection configuration for postfix, here is the relevant information: >> master.cf: smtp inet n - - - 1 postscreen smtpd pass - - - - - smtpd >> main.cf postscreen_upstream_proxy_protocol = haproxy postscreen_upstream_proxy_timeout = 10s That's it. I don't know what other information could be useful. There are some logs, they are like this (I've got logging turned on for pretty much every option I have: Dovecot logs: Apr 19 17:54:47 submission(__EMAIL__)<497><KUGA0OWG8XlfW/Q8>: Debug: Added userdb setting: plugin/quota_rule=*:bytes=0 Apr 19 17:54:47 submission(__EMAIL__)<497><KUGA0OWG8XlfW/Q8>: Debug: Effective uid=8, gid=8, home=/mail/__DOMAIN_COM__/__USER__ Apr 19 17:54:47 submission(__EMAIL__)<497><KUGA0OWG8XlfW/Q8>: Debug: Namespace inbox: type=private, prefix=, sep=, inbox=yes, hidden=no, list=yes, subscriptions=yes location=maildir:/mail/__DOMAIN_COM__/__USER__ Apr 19 17:54:47 submission(__EMAIL__)<497><KUGA0OWG8XlfW/Q8>: Debug: maildir++: root=/mail/__DOMAIN_COM__/__USER__, index=, indexpvt=, control=, inbox=/mail/__DOMAIN_COM__/__USER__, alt= Apr 19 17:54:47 submission(__EMAIL__)<497><KUGA0OWG8XlfW/Q8>: Debug: smtp-server: conn __IP_ADDR_1__:31217 [0]: Connection created Apr 19 17:54:47 submission(__EMAIL__)<497><KUGA0OWG8XlfW/Q8>: Debug: smtp-client: conn postfix.mail-server:25 [0]: Connection created Apr 19 17:54:47 submission(__EMAIL__)<497><KUGA0OWG8XlfW/Q8>: Debug: smtp-client: conn postfix.mail-server:25 [0]: Looking up IP address Apr 19 17:54:47 submission(__EMAIL__)<497><KUGA0OWG8XlfW/Q8>: Debug: smtp-client: conn postfix.mail-server:25 [0]: DNS lookup successful; got 1 IPs Apr 19 17:54:47 submission(__EMAIL__)<497><KUGA0OWG8XlfW/Q8>: Debug: smtp-client: conn postfix.mail-server:25 [0]: Connecting to 10.104.211.161:25 Apr 19 17:54:47 submission(__EMAIL__)<497><KUGA0OWG8XlfW/Q8>: Debug: smtp-client: conn postfix.mail-server:25 [0]: Connected Apr 19 17:54:57 submission(__EMAIL__)<497><KUGA0OWG8XlfW/Q8>: Debug: smtp-client: conn postfix.mail-server:25 [0]: Received greeting from server: 421 4.3.2 No system resources Apr 19 17:54:57 submission(__EMAIL__)<497><KUGA0OWG8XlfW/Q8>: Debug: smtp-client: conn postfix.mail-server:25 [0]: Connection failed: 421 4.3.2 No system resources Apr 19 17:54:57 submission(__EMAIL__)<497><KUGA0OWG8XlfW/Q8>: Error: Failed to establish relay connection: 421 4.3.2 No system resources Apr 19 17:54:57 submission(__EMAIL__)<497><KUGA0OWG8XlfW/Q8>: Debug: smtp-client: conn postfix.mail-server:25 [0]: Disconnected Apr 19 17:54:57 submission(__EMAIL__)<497><KUGA0OWG8XlfW/Q8>: Info: Disconnect from __IP_ADDR_1__: Failed to establish relay connection in=0 out=22 (state=GREETING) Apr 19 17:54:57 submission(__EMAIL__)<497><KUGA0OWG8XlfW/Q8>: Debug: smtp-server: conn __IP_ADDR_1__:31217 [0]: Disconnected: Failed to establish relay connection Postfix Logs: postfix/postscreen[525]: warning: haproxy read: time limit exceeded If anybody could help out, I'd be grateful because I just can't see what the problem is. Chris

2 1

lmtp_save_to_detail_mailbox override
by Andreas Thienemann 24 Apr '19

24 Apr '19

Hi, I have a dovecot 2.3.2.1 instance running here that is getting userdb and passdb data from a SQL database. This was a cyrus server migrated over and all users are happy. All users except one: Said user asked if it would be possible to disable subaddressing (localuser+folder(a)example.com) again. The setting controlling that is AFAIK the lmtp_save_to_detail_mailbox item. My idea was to override that setting for the specific user. I changed the user_query to return no for the user in question and all seems well: # doveadm user test field value user test(a)example.com uid vmail gid vmail home /var/lib/imap/example.com/test mail mdbox:/var/spool/imap/user/example.com/test lmtp_save_to_detail_mailbox no # Looks good, doesn't work though. Mail is still delivered to the +folder. Is this per user setting not taken into account? I could probably provide the user in question with a sieve script that files everything into the INBOX again but I wonder if there's a better way? cheers, Andreas

3 3

pigeonhole tests crashing in deleteheader.svtest
by Michal Hlavinka 24 Apr '19

24 Apr '19

Hi, when trying to build dovecot 2.3.5.1 pigeonhole testsuite crashes in Test case: ./tests/extensions/editheader/deleteheader.svtest: 1: Test 'Deleteheader - nonexistent' SUCCEEDED 2: Test 'Deleteheader - nonexistent (match)' SUCCEEDED 3: Test 'Deleteheader - one' SUCCEEDED 4: Test 'Deleteheader - two (first)' SUCCEEDED 5: Test 'Deleteheader - two (last)' SUCCEEDED 6: Test 'Deleteheader - :index' SUCCEEDED 7: Test 'Deleteheader - :index :last' SUCCEEDED 8: Test 'Deleteheader - implicit keep' SUCCEEDED make: *** [Makefile:1190: tests/extensions/editheader/deleteheader.svtest] Segmentation fault (core dumped) Let me know if you need more debug information. Cheers Michal Hlavinka #0 0x00007f9924faea8a in __strlen_sse2 () from /lib64/libc.so.6 #1 0x00007f992514fdd2 in smtp_address_clone (pool=0x7f992528dce0 <static_system_pool>, src=src@entry=0x7ffd30eace10) at smtp-address.c:632 #2 0x000055f7330916b3 in testsuite_message_set_data (mail=0x55f73486f848) at testsuite-message.c:96 #3 0x000055f7330918b9 in testsuite_message_set_file (renv=renv@entry=0x55f734856ac0, file_path=<optimized out>) at testsuite-message.c:139 #4 0x000055f7330931cc in testsuite_smtp_get (renv=renv@entry=0x55f734856ac0, index=<optimized out>) at testsuite-smtp.c:171 #5 0x000055f73309566c in cmd_test_message_smtp_operation_execute (renv=0x55f734856ac0, address=<optimized out>) at cmd-test-message.c:404 #6 0x00007f992543f371 in sieve_interpreter_operation_execute (interp=0x55f734856a68) at sieve-interpreter.c:911 #7 sieve_interpreter_continue (interp=0x55f734856a68, interrupted=0x0) at sieve-interpreter.c:949 #8 0x00007f992543f5d1 in sieve_interpreter_run (interp=0x55f734856a68, result=<optimized out>) at sieve-interpreter.c:999 #9 0x000055f73308f670 in testsuite_run (msgdata=<optimized out>, ehandler=<optimized out>, senv=0x7ffd30eacfa0, sbin=<optimized out>) at testsuite.c:73 #10 main (argc=<optimized out>, argv=<optimized out>) at testsuite.c:203 (gdb) up #1 0x00007f992514fdd2 in smtp_address_clone (pool=0x7f992528dce0 <static_system_pool>, src=src@entry=0x7ffd30eace10) at smtp-address.c:632 632 dsize = strlen(src->domain) + 1; (gdb) p *src $4 = {localpart = 0x55f73480cdc8 "/tmp/dsieve-testsuite.1553794316.30960/smtp/0.eml", domain = 0x1 <error: Cannot access memory at address 0x1>}

3 5

Sis to deduplicate attachments does not work?
by luckydog xf 23 Apr '19

23 Apr '19

Hi, I use sis to deduplicate attachments, here is my `doveconf -n` ------------ auth_cache_size = 10 M auth_failure_delay = 5 secs auth_mechanisms = plain login auth_socket_path = /var/run/dovecot/auth-userdb auth_ssl_username_from_cert = yes auth_username_format = %Ln default_vsz_limit = 512 M lmtp_rcpt_check_quota = yes mail_attachment_detection_options = add-flags-on-save mail_attachment_dir = /var/mail/mail_attachment/ mail_debug = yes mail_gid = vmail mail_location = maildir:/var/mail/%n/Maildir mail_plugins = quota fts fts_solr mail_privileged_group = vmail mail_uid = vmail managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { auto = subscribe special_use = \Junk } mailbox Sent { auto = subscribe special_use = \Sent } mailbox Trash { auto = subscribe special_use = \Trash } prefix = } passdb { args = /etc/dovecot/dovecot-ldap.conf.ext driver = ldap } plugin { fts = solr fts_autoindex = yes fts_autoindex_exclude = \Junk fts_autoindex_exclude2 = \Trash fts_solr = break-imap-search url=http://localhost:8983/solr/dovecot/ quota = maildir:User quota quota_grace = 10%% quota_max_mail_size = 5M quota_over_flag_lazy_check = yes quota_over_flag_value = TRUE quota_rule = *:storage=100M quota_warning = storage=65%% quota-warning 65 %u quota_warning2 = storage=60%% quota-warning 60 %u sieve = file:~/sieve;active=~/.dovecot.sieve } protocols = imap lmtp sieve service auth-worker { user = $default_internal_user } service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0640 user = postfix } unix_listener auth-userdb { mode = 0777 user = $default_internal_user } user = $default_internal_user } service imap-login { inet_listener imap { port = 0 } inet_listener imaps { port = 993 ssl = yes } } service managesieve-login { inet_listener sieve { port = 4190 } process_min_avail = 0 service_count = 1 vsz_limit = 128 M } service pop3-login { inet_listener pop3 { port = 0 } inet_listener pop3s { port = 0 } } service quota-warning { executable = script /usr/local/bin/quota-warning.sh unix_listener quota-warning { user = vmail } user = vmail } service stats { unix_listener stats-writer { mode = 0666 } } service submission-login { inet_listener submission { port = 0 } } ssl = required ssl_cert = </etc/ssl/certs/dovecot.pem ssl_dh = # hidden, use -P to show it ssl_key = # hidden, use -P to show it userdb { driver = prefetch } userdb { args = /etc/dovecot/dovecot-ldap.conf.ext default_fields = home=/var/mail/%u driver = ldap } protocol !indexer-worker { mail_vsize_bg_after_count = 0 } protocol lda { mail_plugins = quota fts fts_solr sieve } protocol imap { mail_max_userip_connections = 5 mail_plugins = quota fts fts_solr imap_quota } protocol lmtp { mail_plugins = quota fts fts_solr } --------- I try to send an email and then forward this email to another recipient. No attachment is generated in `mail_attachment_dir`. Anything wrong ?

2 1

making selected accounts read-only
by Wojciech Puchar 23 Apr '19

23 Apr '19

how to make selected few accounts readonly by pop3/imap?

3 2

SolrCore 'dovecot' is not available due to init failure: fieldType 'text_general' not found in the schema
by luckydog xf 23 Apr '19

23 Apr '19

Hello, it seems an mismatch of schema file provided by dovecot-2.3.5.2 [root@mail conf]# pwd /var/solr/data/dovecot/conf # Below solrconfig.xml is from Solr-8.0.0. [root@mail conf]# grep text_general solrconfig.xml <str name="queryAnalyzerFieldType">text_general</str> field types. Text content will be indexed as "text_general" as <str name="fieldType">text_general</str> # schema is from /usr/share/doc/dovecot/solr-schema.xml dovecot-2.3.5.2 and the latest solr-8.0.0. It seems XMLs do not match each other. How can I fix this problem？ Thanks.

3 5

mbsync updating new emails but dovecot not reading them ? [2.3.3]
by Kunal A. 21 Apr '19

21 Apr '19

Hi, Once again sincere apologies for emailing here. My dovecot isn't reading the newly updated e-mails from the mbsync. I have tried running doveadm -D -v force-resync -u email1(a)example.com "Inbox/Public/Other Users/user1(a)example.com" Plese help if possible. Highly appreciate if someone could help here... Below is the debug log :- Debug: Loading modules from directory: /usr/lib64/dovecot Debug: Module loaded: /usr/lib64/dovecot/lib01_acl_plugin.so Debug: Module loaded: /usr/lib64/dovecot/lib10_quota_plugin.so Debug: Loading modules from directory: /usr/lib64/dovecot/doveadm Debug: Module loaded: /usr/lib64/dovecot/doveadm/lib10_doveadm_acl_plugin.so Debug: Skipping module doveadm_expire_plugin, because dlopen() failed: /usr/lib64/dovecot/doveadm/lib10_doveadm_expire_plugin.so: undefined symbol: expire_set_deinit (this is usually intentional, so just ignore this message) Debug: Module loaded: /usr/lib64/dovecot/doveadm/lib10_doveadm_quota_plugin.so Debug: Skipping module doveadm_fts_lucene_plugin, because dlopen() failed: /usr/lib64/dovecot/doveadm/lib20_doveadm_fts_lucene_plugin.so: undefined symbol: lucene_index_iter_deinit (this is usually intentional, so just ignore this message) Debug: Skipping module doveadm_fts_plugin, because dlopen() failed: /usr/lib64/dovecot/doveadm/lib20_doveadm_fts_plugin.so: undefined symbol: fts_user_get_language_list (this is usually intentional, so just ignore this message) Debug: Skipping module doveadm_mail_crypt_plugin, because dlopen() failed: /usr/lib64/dovecot/doveadm/libdoveadm_mail_crypt_plugin.so: undefined symbol: mail_crypt_box_get_pvt_digests (this is usually intentional, so just ignore this message) doveadm(email1(a)example.com)<20402><>: Debug: auth USER input: email1(a)example.com uid=5000 gid=5000 home=/var/mail/vhosts/ example.com/email1 doveadm(email1(a)example.com): Debug: Effective uid=5000, gid=5000, home=/var/mail/vhosts/example.com/email1 doveadm(email1(a)example.com): Debug: quota: No quota setting - plugin disabled doveadm(email1(a)example.com): Debug: Namespace inbox: type=private, prefix=INBOX/, sep=/, inbox=yes, hidden=no, list=yes, subscriptions=yes location=maildir:~/Maildir doveadm(email1(a)example.com): Debug: maildir++: root=/var/mail/vhosts/ example.com/email1/Maildir, index=, indexpvt=, control=, inbox=/var/mail/vhosts/example.com/email1/Maildir, alt= doveadm(email1(a)example.com): Debug: acl: initializing backend with data: vfile doveadm(email1(a)example.com): Debug: acl: acl username = email1(a)example.com doveadm(email1(a)example.com): Debug: acl: owner = 1 doveadm(email1(a)example.com): Debug: acl vfile: Global ACLs disabled doveadm(email1(a)example.com): Debug: Namespace : type=public, prefix=Public/, sep=/, inbox=no, hidden=no, list=children, subscriptions=yes location=maildir:/mnt/5ea86261-cfae-4e17-b21f-3a6c1a03d795/Email/fastmail:LAYOUT=fs doveadm(email1(a)example.com): Debug: fs: root=/mnt/5ea86261-cfae-4e17-b21f-3a6c1a03d795/Email/fastmail, index=, indexpvt=, control=, inbox=, alt= doveadm(email1(a)example.com): Debug: acl: initializing backend with data: vfile doveadm(email1(a)example.com): Debug: acl: acl username = email1(a)example.com doveadm(email1(a)example.com): Debug: acl: owner = 0 doveadm(email1(a)example.com): Debug: acl vfile: Global ACLs disabled doveadm(email1(a)example.com): Debug: Namespace : type=private, prefix=, sep=, inbox=no, hidden=yes, list=no, subscriptions=no location=fail::LAYOUT=none doveadm(email1(a)example.com): Debug: none: root=, index=, indexpvt=, control=, inbox=, alt= doveadm(email1(a)example.com): Debug: acl vfile: file /var/mail/vhosts/ example.com/email1/Maildir/dovecot-acl not found Doveconf output :- # 2.3.5 (513208660): /etc/dovecot/dovecot.conf # OS: Linux 5.0.7-200.fc29.x86_64 x86_64 Fedora release 29 (Twenty Nine) # Hostname: machine auth_mechanisms = plain login mail_debug = yes mail_gid = vmail mail_location = maildir:~/Maildir mail_plugins = acl quota mail_privileged_group = mail mail_uid = vmail mbox_write_locks = fcntl namespace { list = children location = maildir:/mnt/5ea86261-cfae-4e17-b21f-3a6c1a03d795/Email/fastmail:LAYOUT=fs prefix = Public/ separator = / subscriptions = yes type = public } namespace inbox { inbox = yes list = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = INBOX/ separator = / } passdb { driver = pam } passdb { args = /etc/dovecot/dovecot-sql.conf.ext driver = sql } plugin { acl = vfile acl_shared_dict = file:/var/mail/vhosts/example.com/Sharedbox } postmaster_address = postmaster at example.com protocols = imap pop3 service auth-worker { user = vmail } service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0666 user = postfix } unix_listener auth-userdb { mode = 0600 user = vmail } user = dovecot } service imap-login { inet_listener imap { port = 143 } inet_listener imaps { port = 993 ssl = yes } } service lmtp { unix_listener /var/spool/postfix/private/dovecot-lmtp { group = postfix mode = 0600 user = postfix } } service pop3-login { inet_listener pop3 { port = 0 } inet_listener pop3s { port = 995 ssl = yes } } ssl = required ssl_cert = </etc/pki/dovecot/certs/dovecot.pem ssl_cipher_list = PROFILE=SYSTEM ssl_key = # hidden, use -P to show it userdb { driver = passwd } userdb { args = uid=vmail gid=vmail home=/var/mail/vhosts/%d/%n driver = static } protocol lmtp { mail_plugins = quota acl sieve quota } protocol lda { mail_plugins = quota acl sieve } protocol imap { mail_plugins = acl quota imap_acl quota acl imap_quota }

1 1

FTS delays
by Joan Moreau 21 Apr '19

21 Apr '19

Hi When I do a FTS search (using Xapian plugin) in the BODY part, the plugins returns the matching IDs within few milliseconds (as seen in the log). However, roundcube (connected on dovecot) takes ages to show (headers only vie IMAP) the few results (I tested with a matching requests of 9 emails) What could be the root cause ? Thank you

6 24

maildirlock fails
by Martynas Bendorius 21 Apr '19

21 Apr '19

Hello, Maildirlock seems to panic on locking: [root@centos7 home]# /usr/libexec/dovecot/maildirlock "/home/user/imap/domain.com/email/Maildir" 10 Panic: BUG: No IOs or timeouts set. Not waiting for infinity. Error: Raw backtrace: /usr/lib/dovecot/libdovecot.so.0(+0xd90ee) [0x7f5bf02f10ee] -> /usr/lib/dovecot/libdovecot.so.0(+0xd9131) [0x7f5bf02f1131] -> /usr/lib/dovecot/libdovecot.so.0(i_fatal+0) [0x7f5bf0256efd] -> /usr/lib/dovecot/libdovecot.so.0(+0xf078c) [0x7f5bf030878c] -> /usr/lib/dovecot/libdovecot.so.0(io_loop_handler_run_internal+0x36) [0x7f5bf030b1f6] -> /usr/lib/dovecot/libdovecot.so.0(io_loop_handler_run+0x56) [0x7f5bf03099c6] -> /usr/lib/dovecot/libdovecot.so.0(io_loop_run+0x38) [0x7f5bf0309be8] -> /usr/libexec/dovecot/maildirlock(main+0x24a) [0x558ae0e032ca] -> /lib64/libc.so.6(__libc_start_main+0xf5) [0x7f5befe6d3d5] -> /usr/libexec/dovecot/maildirlock(+0x13a2) [0x558ae0e033a2] Is this a known issue? Thank you! -- Best regards, Martynas Bendorius

2 3

stats-writer error is back
by unknown＠example.com 20 Apr '19

20 Apr '19

Afer a reboot (and installation of postfix-3.4.5) I am getting the stat-writer permission denied error again. from doveconf -n service stats { unix_listener stats-reader { user = dovecot } unix_listener stats-writer { user = dovecot } } # ls -ls /var/run/dovecot/stats-writer 0 srw-rw---- 1 dovecot dovecot 0 Apr 20 04:34 /var/run/dovecot/stats-writer Apr 20 04:45:00 mail postfix/pipe[80136]: 44mTxm3Mblzc3Td: to=<munged>, relay=dovecot, delay=0.06, delays=0.02/0.02/0/0.02, dsn=2.0.0, status=sent (delivered via dovecot service (lda(,munged,)Error: net_connect_unix(/var/run/dovecot/stats-writer) failed: Permiss)) -- W is for WINNIE embedded in ice X is for XERXES devoured by mice

3 6

Extended logging / moved mails jumping back
by Martin Müller 20 Apr '19

20 Apr '19

Hi! About 4-6 MUA Thunderbird 60.6.1 are going to connect with dovecot 2.2.13/IMAP (debian 8) and are using the same user/password. This setup works for years flawless (updated clients and serversoftware). Since a few weeks there is one major trouble: I one of the client moves a mail from the inbox to a another IMAP-Folder, most of the moved mail are moved for the moment. But an unstable period later, the mails are moved back to the inbox. In rarely cases, the moved mail is copied (one in the inbox, one in the destinationfolder). Now I have to check, if this a Thunderbird-Issue or is this a dovecot-issue. For that reason, I will activate the extended logging of dovecot. ### ### ### ### dovecot -n # 2.2.13: /etc/dovecot/dovecot.conf # OS: Linux 3.16.0-6-amd64 x86_64 Debian 8.11 auth_mechanisms = plain login debug_log_path = /var/log/mail.dovecot-debug disable_plaintext_auth = no info_log_path = /var/log/mail.dovecot-info listen = *,[::] log_path = /var/log/mail.dovecot-error log_timestamp = "%Y-%m-%d %H:%M:%S " mail_debug = yes mail_max_userip_connections = 100 mail_privileged_group = vmail passdb { args = /etc/dovecot/dovecot-sql.conf driver = sql } plugin { mail_log_events = delete undelete expunge copy mailbox_delete mailbox_rename mail_log_fields = uid box msgid size quota = dict:user::file:/var/vmail/%d/%n/.quotausage sieve = /var/vmail/%d/%n/.sieve sieve_max_redirects = 25 } protocols = imap pop3 service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0660 user = postfix } unix_listener auth-userdb { group = vmail mode = 0600 user = vmail } user = root } service imap-login { client_limit = 1000 process_limit = 512 } service lmtp { unix_listener /var/spool/postfix/private/dovecot-lmtp { group = postfix mode = 0600 user = postfix } } ssl_cert = </etc/postfix/smtpd.cert ssl_key = </etc/postfix/smtpd.key ssl_protocols = !SSLv3 userdb { driver = prefetch } userdb { args = /etc/dovecot/dovecot-sql.conf driver = sql } protocol imap { mail_plugins = quota imap_quota } protocol pop3 { mail_plugins = quota pop3_uidl_format = %08Xu%08Xv } protocol lda { mail_plugins = sieve quota postmaster_address = postmaster(a)monarch.products4more.at } protocol lmtp { mail_plugins = quota sieve postmaster_address = postmaster(a)monarch.products4more.at } ### ### ### ### ### ### ### ### It works: dovecot logs to three differnt logfiles /var/log/mail.dovecot-* It doesnt work: plugin { mail_log_events = delete undelete expunge copy mailbox_delete mailbox_rename mail_log_fields = uid box msgid size } I cant see such events in the logfiles. Which switch is to turn on to log all events? Or do anyone know the reason for the annoying "copy/move-the-mail-back"-issue? Thank you in advance for all inputs. regards, martin

4 5

[Dovecot] Dovecot LDA/LMTP vs postfix virtual delivery agent and the x-original-to header
by Charles Marcus 19 Apr '19

19 Apr '19

On 2012-04-05 4:18 AM, Thomas Leuxner <tlx(a)leuxner.net> wrote: > Also with 2.x you may want to use LMTP rather than the LDA Piping. > > http://wiki2.dovecot.org/HowTo/PostfixDovecotLMTP I am preparing to convert my main client's postfix_courier-imap setup to dovecot 2.1, which currently just uses the postfix virtual delivery agent... Does anyone know if the use of LMTP (or even the dovecot LDA) still loses the x-original-to header that the postfix vda adds and that I rely heavily on (since I use a lot of aliases), and if it does, is there any solution to get the original recipient added back in before final delivery? Everything I'm reading says that LMTP is better, but I really do need this header (or one like it) to be there so I know who the original recipient was (for filtering and other purposes). Thanks, -- Best regards, Charles

8 16

OAuth Passdb Grant
by Tom 19 Apr '19

19 Apr '19

I'm trying to implement the password grant flow, as specified at https://wiki2.dovecot.org/PasswordDatabase/oauth2, but am getting an error message. Can you please help? auth: Fatal: oauth2 /etc/dovecot/dovecot-oauth2.token.conf.ext: Error in configuration file /etc/dovecot/dovecot-oauth2.token.conf.ext line 1: Unknown setting: grant_url $ dovecot -n # 2.3.5.2 (38c8f1daf): /etc/dovecot/dovecot.conf # OS: Linux 3.10.0-957.10.1.el7.x86_64 x86_64 CentOS Linux release 7.6.1810 (Core)

2 1

v2.3.5.2 released
by Aki Tuomi 18 Apr '19

18 Apr '19

Lets try again, put wrong changelog to the mail. Sorry about this. https://dovecot.org/releases/2.3/dovecot-2.3.5.2.tar.gz https://dovecot.org/releases/2.3/dovecot-2.3.5.2.tar.gz.sig Binary packages in https://repo.dovecot.org/ * CVE-2019-10691: Trying to login with 8bit username containing invalid UTF8 input causes auth process to crash if auth policy is enabled. This could be used rather easily to cause a DoS. Similar crash also happens during mail delivery when using invalid UTF8 in From or Subject header when OX push notification driver is used. --- Aki Tuomi Open-Xchange oy

2 2

Problems with auth connection
by Fernando Ortega 18 Apr '19

18 Apr '19

Hi, We are having some issues with the auth connection Version: 2.3.5.1, with MySQL and Postfix The server is working fine, and randomly after some days, Dovecot fails to auth: Apr 18 14:25:16 mail dovecot[25013]: auth: Warning: Event 0x126eba20 leaked (parent=0x126eb820): auth-request.c:89 Apr 18 14:25:16 mail dovecot[25013]: auth: Warning: Event 0x126eb420 leaked (parent=0x0): auth-client-connection.c:338 It's neccesary to restart dovecot, and once restarted the server start to work fine again and deliver emails What do you think i could do? Thank you, best regards Fernando

1 0

ssl_verify_server_cert against SAN?
by TG Servers 18 Apr '19

18 Apr '19

3 5

CVE-2019-10691: JSON encoder in Dovecot 2.3 incorrecty assert-crashes when encountering invalid UTF-8 characters.
by Aki Tuomi 18 Apr '19

18 Apr '19

Dear subscribers, we're sharing our latest advisory with you and would like to thank everyone who contributed in finding and solving those vulnerabilities. Feel free to join our bug bounty programs (open-xchange, dovecot, powerdns) at HackerOne. You can find binary packages at https://repo.dovecot.org/ Yours sincerely, Aki Tuomi Open-Xchange Oy Open-Xchange Security Advisory 2019-04-18 Product: Dovecot Vendor: OX Software GmbH Internal reference: DOV-3173 (Bug ID) Vulnerability type: CWE-176 Vulnerable version: 2.3.0 - 2.3.5.1 Vulnerable component: json encoder Report confidence: Confirmed Researcher credits: cPanel L.L.C. Solution status: Fixed by Vendor Fixed version: 2.3.5.2 Vendor notification: 2019-04-02 Solution date: 2019-04-11 Public disclosure: 2019-04-18 CVE reference: CVE-2019-10691 CVSS: 7.5 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vulnerability Details: JSON encoder in Dovecot 2.3 incorrecty assert-crashes when encountering invalid UTF-8 characters. This can be used to crash dovecot in two ways. Attacker can repeatedly crash Dovecot authentication process by logging in using invalid UTF-8 sequence in username. This requires that auth policy is enabled. Crash can also occur if OX push notification driver is enabled and an email is delivered with invalid UTF-8 sequence in From or Subject header. In 2.2, malformed UTF-8 sequences are forwarded "as-is", and thus do not cause problems in Dovecot itself. Target systems should be checked for possible problems in dealing with such sequences. See https://wiki.dovecot.org/Authentication/Policy for details on auth policy support. Risk: Determined attacker can prevent authentication process from staying up by keeping on attempting to log in with username containing invalid UTF-8 sequence. Steps to reproduce: Configure dovecot with auth_policy_server_url and auth_policy_hash_nonce set. Attempt to log in with username containing an invalid UTF-8 sequence Observe assert-crash in dovecot logs. Solution: Operators should update to the latest Patch Release or disable auth policy support.

1 0

v2.3.5.2 released
by Aki Tuomi 18 Apr '19

18 Apr '19

https://dovecot.org/releases/2.3/dovecot-2.3.5.2.tar.gz https://dovecot.org/releases/2.3/dovecot-2.3.5.2.tar.gz.sig Binary packages in https://repo.dovecot.org/ * CVE-2019-7524: Missing input buffer size validation leads into arbitrary buffer overflow when reading fts or pop3 uidl header from Dovecot index. Exploiting this requires direct write access to the index files. --- Aki Tuomi Open-Xchange oy

1 0

Problem with mysql backend and SSL ciphers
by TG Servers 18 Apr '19

18 Apr '19

3 3

Documentation update
by azurit＠pobox.sk 18 Apr '19

18 Apr '19

Hi guys, this page needs to be updated: https://wiki2.dovecot.org/MailLocation/Maildir#Control_files (link was from here: https://wiki2.dovecot.org/MailLocation) Section 'Control files' is mentioning only 2 files but, in fact, Dovecot will store some additional files in CONTROL location: dovecot-uidvalidity dovecot-uidvalidity.* subscriptions (anything more?) Even more, page https://wiki2.dovecot.org/MailLocation has missing note to CONTROL files location about storing files 'dovecot-uidlist' and 'dovecot-keywords' of INBOX inside .INBOX directory instead of root directory (as it's stored inside mailbox). Missing anything from above will cause re-downloading of all e-mails by e-mail clients! And finally, i'm attaching a Python script which will safely copy/move CONTROL files from mail_location to new location (btw, moving it on SSD storage caused quite high performance boost in our environment). azur

2 1

Full mail
by Yevgeny Kosarzhevsky 18 Apr '19

18 Apr '19

Hello, I am getting strange messages on logs and I cannot find any reason. Could someone point me on what's wrong with my dovecot configuration? ~# dovecot -n # 2.3.4.1 (f79e8e7e4): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.4 () # OS: Linux 4.9.0-8-amd64 x86_64 Debian 9 ext4 ~# grep 'full mail' //var/log/dovecot.log Apr 16 19:25:43 imap(phaoost(a)phaoost.net)<15956><bv4DlqqGQNC5LcCN>: Debug: Mailbox INBOX: UID 3: Opened mail because: full mail Apr 16 19:29:06 imap(phaoost(a)phaoost.net)<17588><U1oXyKqGKNG5LcCN>: Debug: Mailbox INBOX: UID 4: Opened mail because: full mail Apr 16 20:28:19 imap(phaoost(a)phaoost.net)<21808><pT01V6uGgtO5LcCN>: Debug: Mailbox INBOX: UID 6: Opened mail because: full mail Apr 16 22:22:38 imap(phaoost(a)phaoost.net)<32077><lQTltKyGItq5LcCN>: Debug: Mailbox INBOX: UID 7: Opened mail because: full mail Apr 16 22:55:57 imap(phaoost(a)phaoost.net)<3732><hw1UQ62GWt25LcCN>: Debug: Mailbox INBOX: UID 8: Opened mail because: full mail Apr 16 23:37:12 imap(phaoost(a)phaoost.net)<8139><+2dd262G3N+5LcCN>: Debug: Mailbox INBOX: UID 9: Opened mail because: full mail Apr 17 01:09:13 imap(phaoost(a)phaoost.net)<8041><BqWBiK+GAua5LcCN>: Debug: Mailbox Trash: UID 3: Opened mail because: full mail Apr 17 01:09:13 imap(phaoost(a)phaoost.net)<8041><BqWBiK+GAua5LcCN>: Debug: Mailbox Trash: UID 4: Opened mail because: full mail Apr 17 01:09:13 imap(phaoost(a)phaoost.net)<8041><BqWBiK+GAua5LcCN>: Debug: Mailbox Trash: UID 5: Opened mail because: full mail Apr 17 01:09:13 imap(phaoost(a)phaoost.net)<8041><BqWBiK+GAua5LcCN>: Debug: Mailbox Trash: UID 6: Opened mail because: full mail Apr 17 01:09:13 imap(phaoost(a)phaoost.net)<8041><BqWBiK+GAua5LcCN>: Debug: Mailbox Trash: UID 7: Opened mail because: full mail Apr 17 04:34:44 imap(phaoost(a)phaoost.net)<23874><PC06DLKGaoC5LcCN>: Debug: Mailbox INBOX: UID 10: Opened mail because: full mail Apr 17 05:45:21 imap(phaoost(a)phaoost.net)<17176><fcoRZLOGHIW5LcCN>: Debug: Mailbox INBOX: UID 11: Opened mail because: full mail Apr 17 07:00:10 imap(phaoost(a)phaoost.net)<5348><bG6Ub7SGKom5LcCN>: Debug: Mailbox INBOX: UID 12: Opened mail because: full mail Apr 17 07:35:58 imap(phaoost(a)phaoost.net)<8078><QsTyj7SGyom5LcCN>: Debug: Mailbox INBOX: UID 13: Opened mail because: full mail Apr 17 08:25:17 imap(phaoost(a)phaoost.net)<29005><Zyr3n7WGIJC5LcCN>: Debug: Mailbox INBOX: UID 14: Opened mail because: full mail Apr 17 10:36:54 imap(phaoost(a)phaoost.net)<31565><TcqvdreGwJi5LcCN>: Debug: Mailbox INBOX: UID 15: Opened mail because: full mail Apr 17 11:08:27 imap(phaoost(a)phaoost.net)<7864><0+xW57eGjJq5LcCN>: Debug: Mailbox INBOX/Spam: UID 1: Opened mail because: full mail Apr 17 11:09:11 imap(phaoost(a)phaoost.net)<7864><0+xW57eGjJq5LcCN>: Debug: Mailbox Spam: UID 27: Opened mail because: full mail Apr 17 11:09:11 imap(phaoost(a)phaoost.net)<7864><0+xW57eGjJq5LcCN>: Debug: Mailbox Spam: UID 28: Opened mail because: full mail Apr 17 12:09:12 imap(phaoost(a)phaoost.net)<25908><bXnRwLiGKJ+5LcCN>: Debug: Mailbox Spam: UID 33: Opened mail because: full mail Apr 17 13:19:38 imap(phaoost(a)phaoost.net)<20835><El6SvLmGEKG5LcCN>: Debug: Mailbox Spam: UID 34: Opened mail because: full mail Apr 17 16:50:57 imap(phaoost(a)phaoost.net)<14923><hkpHsLyGYKa5LcCN>: Debug: Mailbox Spam: UID 35: Opened mail because: full mail Apr 17 16:50:57 imap(phaoost(a)phaoost.net)<14923><hkpHsLyGYKa5LcCN>: Debug: Mailbox Spam: UID 36: Opened mail because: full mail Apr 17 18:50:56 imap(phaoost(a)phaoost.net)<14650><JJZsXb6GCq25LcCN>: Debug: Mailbox Spam: UID 37: Opened mail because: full mail Apr 17 18:50:56 imap(phaoost(a)phaoost.net)<14650><JJZsXb6GCq25LcCN>: Debug: Mailbox Spam: UID 38: Opened mail because: full mail -- Regards, Yevgeny

2 1

Sieve operation "send copy" not working since upgrade from dovecot 2.2.31-1 to 2.3.5.1-1
by Kristijan Savic - ratiokontakt GmbH 16 Apr '19

16 Apr '19

I hope that someone can help me here. Software: CentOS 7.6.1810, dovecot-2.3.5.1, dovecot-pigeonhole-2.3.5.1, exim 4.91-1 Example filter: # rule:[test] if header :contains "subject" "meow" { redirect :copy "ks(a)ratiokontakt.de"; } Mail log: Apr 16 11:29:02 frontend-17 dovecot: lmtp(testi(a)mrhoang.de)<25201><QPgZHF6gtVxxYgAARS1pjg>: sieve: msgid=<311099964.O2fbMfmo3K(a)ws-ks.intern.ratiokontakt.de>: failed to redirect message to <ks(a)ratiokontakt.de>: smtp(localhost): DATA failed: 552 Message header not CRLF terminated (permanent failure) Apr 16 11:29:02 frontend-17 dovecot: lmtp(testi(a)mrhoang.de)<25201><QPgZHF6gtVxxYgAARS1pjg>: sieve: msgid=<311099964.O2fbMfmo3K(a)ws-ks.intern.ratiokontakt.de>: stored mail into mailbox 'INBOX' Apr 16 11:29:02 frontend-17 dovecot: lmtp(testi(a)mrhoang.de)<25201><QPgZHF6gtVxxYgAARS1pjg>: sieve: Execution of script /usr/local/mail/0117/mrhoang.de/testi/.dovecot.sieve failed, but implicit keep was successful (user logfile /usr/local/mail/0117/mrhoang.de/ testi/.dovecot.sieve.log may reveal additional details) And in the: /.dovecot.sieve.log: sieve: info: started log at Apr 16 11:29:02. error: msgid=<311099964.O2fbMfmo3K(a)ws-ks.intern.ratiokontakt.de>: failed to redirect message to <ks(a)ratiokontakt.de>: smtp(localhost): DATA failed: 552 Message header not CRLF terminated (permanent failure) We are stumped. Any ideas? Regards, Kristijan Savic

2 2

Fwd: SOLR/Index?
by Larry Rosenman 15 Apr '19

15 Apr '19

forgot to reply all. ---------- Forwarded message --------- From: Larry Rosenman <larryrtx(a)gmail.com> Date: Mon, Apr 15, 2019 at 5:58 AM Subject: Re: SOLR/Index? To: John Fawcett <john(a)voipsupport.it> the local users (myself, my wife, a friend) can authenticate EITHER as <username> or <username>@lerctr.org. switching to all virtual users is NOT going to happen. If I login to roundcube with <user>@lerctr.org it finds the autoindexed mail. So, if I make everyone always authenticate as <user>@lerctr.org we should be fine. and change my script to do doveadm -u <user>@<domain> instead of depending on the local user running the cron job. question: Is there some way to have dovecot change what it sees to be <user>@lerctr.org when they login as <user>? On Mon, Apr 15, 2019 at 5:54 AM John Fawcett via dovecot < dovecot(a)dovecot.org> wrote: > On 15/04/2019 11:38, Larry Rosenman via dovecot wrote: > > ⌂63% [ler@thebighonker.lerctr.org:~] $ grep fts1970 mail/INBOX > ⌂67% [ler@thebighonker.lerctr.org:~] 1 $ mail -s "test fts1970" > ler(a)lerctr.org > test fts1970 > > test fts1970 > . > EOT > [ler@thebighonker.lerctr.org:~] $ mailq > [ler@thebighonker.lerctr.org:~] $ grep fts1970 mail/INBOX > Subject: test fts1970 > test fts1970 > test fts1970 > > > Apr 15 04:29:03 thebighonker exim[49528]: 1hFxvD-000Csq-P6 <= > ler(a)lerctr.org U=ler P=local S=388 > Apr 15 04:29:03 thebighonker dovecot[2507]: lmtp(49364): Connect from local > Apr 15 04:29:03 thebighonker dovecot[2507]: lmtp(ler(a)lerctr.org/49364): > save: box=INBOX, uid=175402, msgid=< > E1hFxvD-000Csq-P6(a)thebighonker.lerctr.org>, size=640, vsize=660, > from=Larry Rosenman <ler(a)lerctr.org>, subject=test fts1970, flags=() > Apr 15 04:29:03 thebighonker dovecot[2507]: lmtp(ler(a)lerctr.org/49364): > sieve: msgid=<E1hFxvD-000Csq-P6(a)thebighonker.lerctr.org>: stored mail > into mailbox 'INBOX' (subject=test fts1970 from=ler(a)lerctr.org size=660) > Apr 15 04:29:03 thebighonker dovecot[2507]: lmtp(49364): Disconnect from > local: Client has quit the connection (state=READY) > Apr 15 04:29:03 thebighonker exim[49535]: 1hFxvD-000Csq-P6 => ler < > ler(a)lerctr.org> R=localuser T=dovecot_lmtp S=404 C="250 2.0.0 < > ler(a)lerctr.org> 6ACWMN9OtFzUwAAAu+mOrA Saved" QT=0s DT=0s > Apr 15 04:29:03 thebighonker exim[49535]: 1hFxvD-000Csq-P6 Completed QT=0s > Apr 15 04:29:03 thebighonker dovecot[2507]: indexer-worker( > ler(a)lerctr.org/49366) Indexed 1 messages in INBOX (UIDs 175402..175402) > > > ⌂81% [ler@thebighonker.lerctr.org:~] $ doveadm search mailbox INBOX body > 'fts1970' > ⌂83% [ler@thebighonker.lerctr.org:~] $ > > > ⌂65% [ler@thebighonker.lerctr.org:~] 75 $ doveadm search -u ler(a)lerctr.org > mailbox INBOX body 'fts1970' > a53a143be44bda5bd4830000bbe98eac 175402 > [ler@thebighonker.lerctr.org:~] $ doveadm index -q INBOX > [ler@thebighonker.lerctr.org:~] $ doveadm search mailbox INBOX body > 'fts1970' > [ler@thebighonker.lerctr.org:~] $ doveadm fts rescan > [ler@thebighonker.lerctr.org:~] $ doveadm index -q INBOX > [ler@thebighonker.lerctr.org:~] $ doveadm search mailbox INBOX body > 'fts1970' > a53a143be44bda5bd4830000bbe98eac 175402 > [ler@thebighonker.lerctr.org:~] $ doveadm search -u ler(a)lerctr.org > mailbox INBOX body 'fts1970' > a53a143be44bda5bd4830000bbe98eac 175402 > [ler@thebighonker.lerctr.org:~] $ > > So, yes, your hypothesis is correct. > > Question: How can I make it consistent? > > I have a script that runs on the first of the month that does archiving, > and I have similar issues in that namespace: > ⌂67% [ler@thebighonker.lerctr.org:~] $ cat bin/archive-mail > #!/bin/sh > PATH=$PATH:/usr/local/bin > #Expects to be run after midnight on the first of the month > # to archive all the previous months mail > #Date Run: > TODAY=`date "+%Y-%m-%d"` > #last month in YYYY/MM > YEAR_LAST_MONTH=`date -v-1d "+%Y/%m"` > #1st of last month as 01-Mon-YYYY > FIRST_LAST_MONTH=`date -v-1d "+01-%b-%Y"` > echo 'TODAY=' ${TODAY} > echo 'YEAR_LAST_MONTH=' ${YEAR_LAST_MONTH} > echo 'FIRST_LAST_MONTH=' ${FIRST_LAST_MONTH} > # get a list of all the mailboxes with at least one real message > doveadm -f tab mailbox status vsize \* 2>/dev/null | > sed -e 1d | sort -k 1,1 | > awk 'BEGIN {FS="\t"} {if ($2 > 0) print $1}' | > while read i > do > echo `date` start ${i} > doveadm mailbox create "ARCHIVE/${YEAR_LAST_MONTH}/${i}" > doveadm -f tab mailbox status messages "${i}" > doveadm move "ARCHIVE/${YEAR_LAST_MONTH}/${i}" mailbox \ > "${i}" BEFORE ${TODAY} SINCE ${FIRST_LAST_MONTH} > doveadm -f tab mailbox status messages "${i}" > echo `date` done ${i} > done > ⌂64% [ler@thebighonker.lerctr.org:~] $ > > > The Exim config can be provided as well if necessary. > > ler & ler(a)lerctr.org *ARE THE SAME MAILBOX* > > At the moment it looks as though you have two sets of emails indexed in > solr. One is indexed under username (the one you are running mannually and > apparently the one used by roundcube too, but that's to be verified) and > another set being indexed by autoindex = yes option using the full email > address. Once you've got it working as you require, then you may want to > clean out solr and reindex with just one of them just to reduce volumes. > > Your setup seems to have a mix of users from mysql and from /etc/passwd. > Not sure if your mysql users are all mapped to real users or they have > their own mailboxes with domain included. Your solution will depend on what > you really need and if the setup is working correctly you may not want to > tweak it too much or other things may start breaking. > > The simplest thing that comes to mind (providing your manually indexed > mails show up in roundcube searches) is just to turn off autoindex and > schedule indexing from cron. As things stand I believe autoindex works well > with virtual users username@domain. You'll probably need to start off > with a rescan if you do this. > > If you can swith to all virtual users without local users then probably > you can use autoindex, but I can understand that may not be possible. For > sure I'd recommend doing it in a test environment first so you can be sure > of the configuration and then look at migrating your existing mailboxes > over to virtual users. > > John > > > > -- Larry Rosenman http://www.lerctr.org/~ler Phone: +1 214-642-9640 (c) E-Mail: larryrtx(a)gmail.com US Mail: 5708 Sabbia Dr, Round Rock, TX 78665-2106 -- Larry Rosenman http://www.lerctr.org/~ler Phone: +1 214-642-9640 (c) E-Mail: larryrtx(a)gmail.com US Mail: 5708 Sabbia Dr, Round Rock, TX 78665-2106

4 11

No CRLF in Pigeonhole's header?
by Wojciech Sychut 15 Apr '19

15 Apr '19

Hello, I have been told on Freenode's #dovecot to ask here. I have Exim 4.92 complaining about "Non-CRLF-terminated header, under CHUNKING: message abandoned" with redirects made by Pigeonhole 0.5.5 (with Dovecot 2.3.5.1). Please find relevant part of the traffic below, and help me determine whether Exim is correct on this. 0x0000: 4500 0954 0000 4000 8006 0000 7f00 0001 E..T..@......... 0x0010: 7f00 0001 6ea2 0019 8982 e279 d090 b820 ....n......y.... 0x0020: 8018 021e 0749 0000 0101 080a c345 2b51 .....I.......E+Q 0x0030: b382 853c 4d41 494c 2046 524f 4d3a 3c72 ...<MAIL.FROM:<r 0x0040: 4073 3066 2e6d 642e 6465 7664 6576 6465 @sxf.md.devdevde 0x0050: 762e 6e65 743e 0d0a 5243 5054 2054 4f3a v.net>..RCPT.TO: 0x0060: 3c63 6f6e 7461 6374 4072 6567 6973 2e74 <contact(a)regis.t 0x0070: 6563 683e 0d0a 4244 4154 2032 3235 3420 ech>..BDAT.2254. 0x0080: 4c41 5354 0d0a 582d 5369 6576 653a 2050 LAST..X-Sieve:.P 0x0090: 6967 656f 6e68 6f6c 6520 5369 6576 6520 igeonhole.Sieve. 0x00a0: 302e 352e 3520 2832 3438 3362 3038 3529 0.5.5.(2483b085) 0x00b0: 0a58 2d53 6965 7665 2d52 6564 6972 6563 .X-Sieve-Redirec 0x00c0: 7465 642d 4672 6f6d 3a20 7240 7330 662e ted-From:.r@sxf. With Dovecot 2.2.36 + Pigeonhole 0.4.24.1 and required minimum of version-related configuration changes - redirection works properly. Related Exim code fragment: https://github.com/Exim/exim/blob/master/src/src/receive.c#L2222 Thank you, -- Wojtek Sychut

2 1

rsync sdbox, no new mails?
by Jakob Curdes 15 Apr '19

15 Apr '19

Hello, I had to restore a mailserver from a backup to replace a system with problems that is still live. I did a 1:1 restore as far as possible from a backup, then rsynced the /var/vmail/ directory, where we have all the mailboxes, in sdbox format. So both directories should be the same. After syncing, I started dovecot. I can see the mails until to the point of the backup, but not the newer ones ,although they seem to be present in the "cur" directory. I thought with sdbox it is all in the index files that have been transferred with the mails? Or am I missing a place that has to be synced? Thank you for hints, Jakob

2 2

LDAP iterate (dovecoc 2.2.27)
by Debreczeni Attila 15 Apr '19

15 Apr '19

Dear Dovecot Team, We would like to use the LDAP iterate for dovecot replication, but I got this error: dovecot: auth-worker(10149): Error: ldap(*): ldap_search(base=ou=mail,o=asd,c=TLD filter=(objectClass=inetMailUser) failed: Size limit exceeded dovecot: replicator: Error: User listing returned failure dovecot: replicator: Error: listing users failed, can't replicate existing data When I check the "doveadm replicator status": ... Total number of known users 1200 But we have more than 10.000 users. When I run the ldapsearch manually, I get the full list of the mail addresses. Who can I fix it? Thank you, Attila # dovecot --version 2.2.27 (c0f36b0) # dovecot -n | filtered # 2.2.27 (c0f36b0): /etc/dovecot/dovecot.conf # Pigeonhole version 0.4.16 (fed8554) # OS: Linux 4.9.0-6-amd64 x86_64 Debian 9.8 auth_worker_max_count = 150 default_vsz_limit = 512 M doveadm_password = # hidden, use -P to show it doveadm_port = *** mail_gid = vmail mail_plugins = " quota notify replication" namespace inbox { ... } passdb { args = /etc/dovecot/dovecot-ldap.conf.ext driver = ldap } plugin { mail_replica = tcp:REMOTE_IP } replication_dsync_parameters = -d -N -1 -l 30 -U service aggregator { fifo_listener replication-notify-fifo { user = vmail } unix_listener replication-notify { user = vmail } } service auth { inet_listener { address = LOCAL_IP port = LOCAL_PORT } unix_listener auth-userdb { group = vmail mode = 0600 user = vmail } } service dict { unix_listener dict { group = vmail mode = 0600 user = vmail } } service lmtp { inet_listener lmtp { address = LOCAL_IP port = LOCAL_PORT } } service replicator { process_min_avail = 1 unix_listener replicator-doveadm { mode = 0600 } } userdb { args = /etc/dovecot/dovecot-domain-ldap.conf.ext driver = ldap result_success = continue-ok } userdb { args = /etc/dovecot/dovecot-ldap.conf.ext driver = ldap result_failure = return-fail } protocol imap { ... } protocol pop3 { ... } # grep -v '^ *$#.*$\?$' dovecot-ldap.conf.ext uris = ldaps://ldap.URL dn = uid=auth,o=domain,c=TLD dnpass = **** sasl_bind = no tls_ca_cert_dir = /etc/ssl/certs tls_require_cert = demand ldap_version = 3 base = ou=mail,o=asd,c=TLD deref = never scope = subtree user_attrs = =home=/dev/null/%Ld/%L{ldap:uid}, mailQuota=quota_rule=*:bytes=%$ user_filter = (objectClass=inetMailUser) pass_attrs = userPassword=password pass_filter = (objectClass=inetMailUser) iterate_attrs = mail=user iterate_filter = (objectClass=inetMailUser) default_pass_scheme = PLAIN

1 0

LDAP iterate (dovecoc 2.2.27)
by Debreczeni Attila 15 Apr '19

15 Apr '19

Dear Dovecot Team, We would like to use the LDAP iterate for dovecot replication, but I got this error: dovecot: auth-worker(10149): Error: ldap(*): ldap_search(base=ou=mail,o=asd,c=TLD filter=(objectClass=inetMailUser) failed: Size limit exceeded dovecot: replicator: Error: User listing returned failure dovecot: replicator: Error: listing users failed, can't replicate existing data When I check the "doveadm replicator status": ... Total number of known users 1200 But we have more than 10.000 users. When I run the ldapsearch manually, I get the full list of the mail addresses. Who can I fix it? Thank you, Attila # dovecot --version 2.2.27 (c0f36b0) # dovecot -n | filtered # 2.2.27 (c0f36b0): /etc/dovecot/dovecot.conf # Pigeonhole version 0.4.16 (fed8554) # OS: Linux 4.9.0-6-amd64 x86_64 Debian 9.8 auth_worker_max_count = 150 default_vsz_limit = 512 M doveadm_password = # hidden, use -P to show it doveadm_port = *** mail_gid = vmail mail_plugins = " quota notify replication" namespace inbox { ... } passdb { args = /etc/dovecot/dovecot-ldap.conf.ext driver = ldap } plugin { mail_replica = tcp:REMOTE_IP } replication_dsync_parameters = -d -N -1 -l 30 -U service aggregator { fifo_listener replication-notify-fifo { user = vmail } unix_listener replication-notify { user = vmail } } service auth { inet_listener { address = LOCAL_IP port = LOCAL_PORT } unix_listener auth-userdb { group = vmail mode = 0600 user = vmail } } service dict { unix_listener dict { group = vmail mode = 0600 user = vmail } } service lmtp { inet_listener lmtp { address = LOCAL_IP port = LOCAL_PORT } } service replicator { process_min_avail = 1 unix_listener replicator-doveadm { mode = 0600 } } userdb { args = /etc/dovecot/dovecot-domain-ldap.conf.ext driver = ldap result_success = continue-ok } userdb { args = /etc/dovecot/dovecot-ldap.conf.ext driver = ldap result_failure = return-fail } protocol imap { ... } protocol pop3 { ... } # grep -v '^ *$#.*$\?$' dovecot-ldap.conf.ext uris = ldaps://ldap.URL dn = uid=auth,o=domain,c=TLD dnpass = **** sasl_bind = no tls_ca_cert_dir = /etc/ssl/certs tls_require_cert = demand ldap_version = 3 base = ou=mail,o=asd,c=TLD deref = never scope = subtree user_attrs = =home=/dev/null/%Ld/%L{ldap:uid}, mailQuota=quota_rule=*:bytes=%$ user_filter = (objectClass=inetMailUser) pass_attrs = userPassword=password pass_filter = (objectClass=inetMailUser) iterate_attrs = mail=user iterate_filter = (objectClass=inetMailUser) default_pass_scheme = PLAIN

1 0

Re: SOLR/Index?
by Larry Rosenman 15 Apr '19

15 Apr '19

full solr.log at: https://www.lerctr.org/~ler/solr.log The search DOES make it to SOLR: ⌂77% [ler@thebighonker.lerctr.org:~] 130 $ grep sysutils /var/log/solr/solr.log 2019-04-14 18:31:34.749 INFO (qtp349420578-7538) [ x:dovecot] o.a.s.c.S.Request [dovecot] webapp=/solr path=/select params={q={!lucene+q.op%3DAND}(hdr:sysutils\/+OR+body:sysutils\/)&fl=uid,score&sort=uid+asc&fq=%2Bbox:8097632f69627b5b58950000bbe98eac+%2Buser:ler&rows=22644&wt=xml} hits=0 status=0 QTime=460 Pick showing subjects: https://www.lerctr.org/~ler/sysutils_mail.png What else? I'm happy to provide access. -- Larry Rosenman http://www.lerctr.org/~ler Phone: +1 214-642-9640 (c) E-Mail: larryrtx(a)gmail.com US Mail: 5708 Sabbia Dr, Round Rock, TX 78665-2106

3 11

SOLR/Index?
by Larry Rosenman 15 Apr '19

15 Apr '19

Given all the discussion on FTS/Solr, etc, I have a question: I have autoindex set, and searching in roundcube most of the time does NOT find things, HOWEVER if I do: doveadm fts rescan doveadm index I can find things in the mailboxes. WHY? (doveconf -n attached). -- Larry Rosenman http://www.lerctr.org/~ler Phone: +1 214-642-9640 (c) E-Mail: larryrtx(a)gmail.com US Mail: 5708 Sabbia Dr, Round Rock, TX 78665-2106

2 1

Re: dovecot Digest, Vol 192, Issue 52
by Peter Mogensen 15 Apr '19

15 Apr '19

On 4/14/19 4:04 PM, dovecot-request(a)dovecot.org wrote: >> Solr ships with autoCommit set to 15 seconds and openSearcher set to >> false on the autoCommit.? The autoSoftCommit setting is not enabled by >> default, but depending on how the index was created, Solr might try to >> set autoSoftCommit to 3 seconds ... which is WAY too short. I just run with the default. 15s autoCommit and no autoSoftCommit >> This thread says that dovecot is sending explicit commits.? I see explicit /update req. with softCommit and waitSearcer=true in a tcpdump. >> One thing >> that might be happening to exceed 60 seconds is an extremely long >> commit, which is usually caused by excessive cache autowarming, but >> might be related to insufficient memory.? The max heap setting on an >> out-of-the-box Solr install (5.0 and later) is 512MB.? That's VERY >> small, and it doesn't take much index data before a much larger heap >> is required. I run with SOLR_JAVA_MEM="-Xmx8g -Xms2g" > I looked into the code (version 2.3.5.1): This is 2.2.35. I haven't checked the source difference to 2.3.x I must admit. > I immagine that one of the reasons dovecot sends softCommits is because > without autoindex active and even if mailboxes are periodically indexed > from cron, the last emails received with be indexed at the moment of the > search.? I expect that dovecot has to because of it's default behavior by only bringing the index up-to-date just before search. So it has towait for the index result to be available if there's been any new mails indexed. > 1) a configurable batch size would enable to tune the number of emails > per request and help stay under the 60 seconds hard coded http request > timeout. A configurable http timeout would be less useful, since this > will potentially run into other timeouts on solr side. Being able to configure it is great. But I don't think it solves much. I recompiled with 100 as batch size and it still ended in timeouts. Then I recompiled with 10min timeout and now I see all the batches completing and their processesing time is mostly between 1 and 2 minutes (so all would have failed). To me it looks like Solr just takes too long time to index. This is no small machine. It's a 20 core Intel(R) Xeon(R) Silver 4114 CPU @ 2.20GHz and for this test it's not doing anything else, so I'm a bit surprised that even with only a few users this takes so long time. /Peter

2 1

Re: Solr connection timeout hardwired to 60s
by Peter Mogensen 15 Apr '19

15 Apr '19

On 4/4/19 6:47 PM, dovecot-request(a)dovecot.org wrote: > For a typical Solr index, 60 seconds is an eternity. Most people aim > for query times of 100 milliseconds or less, and they often achieve > that goal. I'm pretty sure I get these while indexing, not querying. Apr 04 16:44:50 host dovecot[114690]: indexer-worker(me(a)example.com): Error: fts_solr: Indexing failed: Request timed out (Request queued 66.015 secs ago, 1 attempts in 66.005 secs, 63.146 in http ioloop, 0.000 in other ioloops, connected 94.903 secs ago) /Peter

5 8

Fwd: Problem with solr working, but not indexing
by TG Servers 14 Apr '19

14 Apr '19

2 2

Problem with solr working, but not indexing
by TG Servers 14 Apr '19

14 Apr '19

2 1

Re: Solr connection timeout hardwired to 60s
by Peter Mogensen 14 Apr '19

14 Apr '19

sorry... I got distracted half way and forgot to put a meaningfull subject so the archive could figure out the thread. - resending. On 4/14/19 4:04 PM, dovecot-request(a)dovecot.org wrote: >> Solr ships with autoCommit set to 15 seconds and openSearcher set to >> false on the autoCommit.? The autoSoftCommit setting is not enabled by >> default, but depending on how the index was created, Solr might try to >> set autoSoftCommit to 3 seconds ... which is WAY too short. I just run with the default. 15s autoCommit and no autoSoftCommit >> This thread says that dovecot is sending explicit commits.? I see explicit /update req. with softCommit and waitSearcer=true in a tcpdump. >> One thing >> that might be happening to exceed 60 seconds is an extremely long >> commit, which is usually caused by excessive cache autowarming, but >> might be related to insufficient memory.? The max heap setting on an >> out-of-the-box Solr install (5.0 and later) is 512MB.? That's VERY >> small, and it doesn't take much index data before a much larger heap >> is required. I run with SOLR_JAVA_MEM="-Xmx8g -Xms2g" > I looked into the code (version 2.3.5.1): This is 2.2.35. I haven't checked the source difference to 2.3.x I must admit. > I immagine that one of the reasons dovecot sends softCommits is because > without autoindex active and even if mailboxes are periodically indexed > from cron, the last emails received with be indexed at the moment of the > search.? I expect that dovecot has to because of it's default behavior by only bringing the index up-to-date just before search. So it has towait for the index result to be available if there's been any new mails indexed. > 1) a configurable batch size would enable to tune the number of emails > per request and help stay under the 60 seconds hard coded http request > timeout. A configurable http timeout would be less useful, since this > will potentially run into other timeouts on solr side. Being able to configure it is great. But I don't think it solves much. I recompiled with 100 as batch size and it still ended in timeouts. Then I recompiled with 10min timeout and now I see all the batches completing and their processesing time is mostly between 1 and 2 minutes (so all would have failed). To me it looks like Solr just takes too long time to index. This is no small machine. It's a 20 core Intel(R) Xeon(R) Silver 4114 CPU @ 2.20GHz and for this test it's not doing anything else, so I'm a bit surprised that even with only a few users this takes so long time. /Peter

2 2

Re: Mail account brute force / harassment
by Odhiambo Washington 14 Apr '19

14 Apr '19

On Thu, 11 Apr 2019 at 13:24, Marc Roos via dovecot <dovecot(a)dovecot.org> wrote: > > > Say for instance you have some one trying to constantly access an > account > > > Has any of you made something creative like this: > > * configure that account to allow to login with any password > * link that account to something like /dev/zero that generates infinite > amount of messages > (maybe send an archive of virusses?) > * transferring TB's of data to this harassing client. > > I think it would be interesting to be able to do such a thing. > > Instead of being evil, just use fail2ban to address this problem :-) -- Best regards, Odhiambo WASHINGTON, Nairobi,KE +254 7 3200 0004/+254 7 2274 3223 "Oh, the cruft.", grep ^[^#] :-)

10 24

permissions for quota-status
by Andreas Meyer 14 Apr '19

14 Apr '19

Hello! doveconf --version 2.2.36 I want to move to a new server with dovecot but get an error Error: service(quota-status): listen(*, 12340) failed: Permission denied when I define service quota-status { executable = quota-status -p postfix inet_listener { port = 12340 } client_limit = 1 } private]# ll insgesamt 0 srw-rw-rw-. 1 postfix postfix 0 14. Apr 15:05 anvil srw-rw-rw-. 1 postfix postfix 0 14. Apr 15:05 bounce srw-rw-rw-. 1 postfix postfix 0 14. Apr 15:05 defer srw-rw-rw-. 1 postfix postfix 0 14. Apr 15:05 discard srw-------. 1 postfix postfix 0 14. Apr 15:08 dovecot-lmtp srw-rw-rw-. 1 postfix postfix 0 14. Apr 15:05 error srw-rw-rw-. 1 postfix postfix 0 14. Apr 15:05 lmtp srw-rw-rw-. 1 postfix postfix 0 14. Apr 15:05 local srw-rw-rw-. 1 postfix postfix 0 14. Apr 15:05 proxymap srw-rw-rw-. 1 postfix postfix 0 14. Apr 15:05 proxywrite srw-rw----. 1 postfix postfix 0 14. Apr 14:58 quota-status srw-rw-rw-. 1 postfix postfix 0 14. Apr 15:05 relay srw-rw-rw-. 1 postfix postfix 0 14. Apr 15:05 retry srw-rw-rw-. 1 postfix postfix 0 14. Apr 15:05 rewrite srw-rw-rw-. 1 postfix postfix 0 14. Apr 15:05 scache srw-rw-rw-. 1 postfix postfix 0 14. Apr 15:05 smtp srw-rw-rw-. 1 postfix postfix 0 14. Apr 15:05 tlsmgr srw-rw-rw-. 1 postfix postfix 0 14. Apr 15:05 trace srw-rw-rw-. 1 postfix postfix 0 14. Apr 15:05 verify srw-rw-rw-. 1 postfix postfix 0 14. Apr 15:05 virtual Don't know what's wrong. Can someone help? Kind regards Andreas -- PGP-Fingerprint: D392 5D21 0299 63D7 5BAE 4562 1E56 B2EA 81A2 59F1

2 1

nginx configuration to pass x-originating-ip
by André Rodier 14 Apr '19

14 Apr '19

Hello, There is a bug in SOGo, as it sends the original IP after successful login, and not before the login process. I traced the bug to the source code. https://sogo.nu/bugs/view.php?id=2979. Then, in my research, I found this old thread: https://forum.nginx.org/read.php?29,237299,237367#msg-237367 Can I use Nginx as an IMAP proxy to add the missing ID. I suspect this is something that can be achieved? I already have an Nginx for the SOGo front-end, so I would add another one for the IMAP proxy. With a little bit of luck, I should be able to pass the original IP between the two servers Does anyone has a working example? Thanks, André -- André Rodier HomeBox: https://github.com/progmaticltd/homebox

1 0

Post login scripts environment
by André Rodier 14 Apr '19

14 Apr '19

Dear Dovecot users, I am running Dovecot 2.2.27 on Debian Stretch, no issue so far. I wonder if there is a way to pass the remote IP address, in an environment variable, in the post login script. My Post login scripts are working well, except that when the server is accessed through a webmail (Roundcube or SOGo), the remote IP address is systematically 127.0.0.1. The other question I have is, is it possible to pass the user agent of the email client used to access the server? I know this can be easily forged, but I would like to log it. Thanks for your insight. -- André Rodier

2 6

Using userdb/passdb data in director_username_hash
by Mark Moseley 12 Apr '19

12 Apr '19

TL;DR: Can director_username_hash use %{userdb:...} or %{passdb:...} ? ==================================== This is on Ubuntu Precise, running dovecot 2.2.36. It's a fully production, director-ized env, so assume everything is working correctly. Happy to post doveconf if it's relevant but wanted to ask a general question first. I was curious if there's a way to get userdb/passdb data into director_username_hash. Currently, we've got default hashing (on %u). I'm returning a SQL field called 'real_username' (the owner of the mailbox, so almost never the same as %u). I'd like (for mdbox reasons) to hash on that rather than %u. My test SQL is returning (this is just a chunk -- it's duplicated for testing): UserName AS userdb_real_username, UserName AS real_username I can see in my director boxes that it's at least picking up the latter: passdb out: PASS 1 user=tesbox(a)mailbox.com proxy=y real_username=testuser Is it possible to inject 'real_username' into director_username_hash? That is, I'd rather hash on 'testuser' instead of 'testbed'. I've been trying different permutations on my director boxes with no luck. director_username_hash = %{userdb:real_username} director_username_hash = %{passdb:real_username} director_username_hash = %{userdb:userdb_real_username} director_username_hash = %{passdb:userdb_real_username} With any of those settings, every mailbox gets hashed to the same backend, so I'm guessing it's not getting anything useful (i.e. probably resolving to the same empty string and hashing on that -- or perhaps is just hashing on the literal string, e.g. "%{userdb:real_username}" ). And I'm not even sure if director_username_hash has access to any passdb/userdb data. Is there a debug setting that would show what string director is using to do the hashing? Current debug settings are: auth_debug = yes auth_debug_passwords = yes mail_debug = yes but not a peep as to the string that director is hashing on.

2 2

Migrating from external server to Dovecot (doveadm sync issues)
by Sven Strickroth 12 Apr '19

12 Apr '19

Hi, I'm experiencing serious issues when using doveadm sync not working at all or do not properly sync. I wanted to use this for migrating external mailboxes to my server (in order to overcome the time when some servers/clients still use the old server and some already the my server). I tried to find a few steps in order to replicate this: For testing purposes I simulate both the remote and local server on my Dovecot instance. I created remote(a)DOMAIN.TLD and local(a)DOMAIN.TLD both use mdbox and are empty (i.e., the mail_location is still non-existent). Then I send two mails to remote(a)DOMAIL.TLD (Subjects: Test1 and Test2). Start backup remote IMAP account (remote(a)DOMAIN.TLD) to local account (local(a)DOMAIN.TLD) * doveadm -o imapc_user="remote(a)DOMAIN.TLD" -o imapc_password="PW" -o imapc_host="localhost" -o mail_prefetch_count=20 -o imapc_features="rfc822.size fetch-headers" backup -R -u local(a)DOMAIN.TLD imapc: (without this I often got errors such as "Error: Backend didn't update mailbox Trash GUID" on sync runs, which seems to be an unrecoverable error). Now the two mailboxes seem to be the same (can confirm this when logging into the two mailboxes). Now, run first sync: * doveadm -o imapc_user="remote(a)DOMAIN.TLD" -o imapc_password="PW" -o imapc_host="localhost" -o mail_prefetch_count=20 -o imapc_features="rfc822.size fetch-headers" sync -R -u local(a)DOMAIN.TLD imapc: Seems to work and does nothing at the moment. Deliver one message to local(a)DOMAIN.TLD (Subject Test3). * doveadm -o imapc_user="remote(a)DOMAIN.TLD" -o imapc_password="PW" -o imapc_host="localhost" -o mail_prefetch_count=20 -o imapc_features="rfc822.size fetch-headers" sync -R -u local(a)DOMAIN.TLD imapc: Now Test1,2,3 are in both mailboxes (further runs do change nothing). Everything OK up the here. Now deliver one messages to remote(a)DOMAIN.TLD (Test4) and delete one old message (Test3). Deliver two messages to local(a)DOMAIN.TLD (Subjects Test5 and Test6) and delete one message (Test2). In sum both mailboxes look like this: remote(a)DOMAIN.TLD has Test1,2,4 and local(a)DOMAIN.TLD has 1,3,5,6. Now sync: * doveadm -o imapc_user="remote(a)DOMAIN.TLD" -o imapc_password="PW" -o imapc_host="localhost" -o mail_prefetch_count=20 -o imapc_features="rfc822.size fetch-headers" sync -R -u local(a)DOMAIN.TLD imapc: dsync(local(a)DOMAIN.TLD): Warning: Mailbox changes caused a desync. You may want to run dsync again: 3 UIDs changed due to UID conflicts Rerun again and see that mails start duplicating and deletings are not synced: remote(a)DOMAIN.TLD: Test1,2,4,3,5,6,5,6,6,5,3,4 (12 mails) and local(a)DOMAIN.TLD: 1,6,4,3,5,6,4,3,5,6,5 (11 mails) When I re-run again I sometimes see the above error message again, mails keep duplicating in both mailboxes and the mailboxes are not synced at all. Am I using doveadm sync wrongly? Is there a way to use "sync" directly w/o backup from the beginning (i.e., how to get rid of the error "Error: Backend didn't update mailbox Trash GUID"). Context: # 2.2.27 (c0f36b0): /etc/dovecot/dovecot.conf # Pigeonhole version 0.4.16 (fed8554) # OS: Linux 4.9.0-8-amd64 x86_64 Debian 9.8 imap_client_workarounds = delay-newmail I can't upgrade to latest Dovecot right now. :( -- Best regards, Sven Strickroth PGP key id F5A9D4C4 @ any key-server

1 0

Mail account brute force / harassment
by Marc Roos 12 Apr '19

12 Apr '19

Say for instance you have some one trying to constantly access an account Has any of you made something creative like this: * configure that account to allow to login with any password * link that account to something like /dev/zero that generates infinite amount of messages (maybe send an archive of virusses?) * transferring TB's of data to this harassing client. I think it would be interesting to be able to do such a thing.

3 2

Emails redownloading
by azurit＠pobox.sk 12 Apr '19

12 Apr '19

Hi, recently, we had a problem on one of our mail servers and, after reboot, HDD with emails wasn't mounted into system. Until we fixed it, LOTS of users logged in (Dovecot allowed login and recreated directory structure of mailboxes) and saw empty mailboxes. Now they are redownloading all email, which isn't fun, as it's about 2 TB of data. Anyway, is there a way how to prevent this in the future? Can i set Dovecot to disallow logins in such situations? Thanks. azur

3 5

Doveadm stats
by ＠lbutlr 12 Apr '19

12 Apr '19

Are there any examples of the utility of doveadm stats? in the man page: > dump accepts following types: command, session, user, domain, ip and > global. > > Filter can be > > user=<wildcard> > Match given user. I've tried the following commands after looking at the (sparse and example-less) man page. # doveadm stats dump metric_name field count sum min max avg median stddev %95 # doveadm stats dump user Error: Extraneous arguments found: user # doveadm stats dump user user="*" Error: Extraneous arguments found: user user=* # doveadm stats dump global Error: Extraneous arguments found: global # doveadm stats dump global user="*" Error: Extraneous arguments found: global user=* # I assume there is more to the configuration for stats than merely making it not report an error. So, the first question is what sorts of stats would be most likely to be useful and what do I do in the configuration to get those? Second question is why is this required to be enabled if, by default, it has no functionality? -- Beware of geeks bearing .GIF's

2 1

Mailbox INBOX: Opening INBOX failed: Mailbox doesn't exist: INBOX. Maybe master user + namespace problem?
by Usuario prueba 12 Apr '19

12 Apr '19

2 2

Secure Client-Initiated Renegotiation
by sergio 12 Apr '19

12 Apr '19

Hello. I've just tested my system that runs dovecot 2.3.4.1 on debian buster with testssl.sh (https://testssl.sh/) and is says: Secure Renegotiation (CVE-2009-3555) not vulnerable (OK) Secure Client-Initiated Renegotiation VULNERABLE (NOT ok), potential DoS threat Is this a configuration or a compilation issue and how to solve it? -- sergio.

2 1

Re: High availability of Dovecot
by Gerald Galster 12 Apr '19

12 Apr '19

> Am 11.04.2019 um 11:48 schrieb luckydog xf <luckydogxf(a)gmail.com>: > > As your statement, nothing speical is needed to do except setting up DNS MX records, right? MX records are for incoming MAIL: yourdomain.com <http://yourdomain.com/> IN MX 100 mail1.yourdomain.com <http://server1.yourdomain.com/> yourdomain.com <http://yourdomain.com/> IN MX 100 mail2.yourdomain.com <http://mail2.yourdomain.com/> -> both priority 100 = 50/50 load balancing (globally, not when checked on a single resolver!) Then you need A Records (AAAA for ipv6) mail1.yourdomain.com IN A 192.168.10.1 mail2.yourdomain.com <http://mail2.yourdomain.com/> IN A 192.168.20.1 mail.yourdomain.com IN A 192.168.10.1 mail.yourdomain.com IN A 192.168.20.1 mail1/mail2 is for direct connection (MTAs) Your users (outlook, thunderbird, ...) connect to mail.yourdomain.com <http://mail.yourdomain.com/> which returns the two ip addresses. In this scenario MUA just connects to mail.yourdomain.com <http://mail.yourdomain.com/> and randomly uses one of the two ips. You can't control which one, but this gives you active/active loadbalancing. In case one server is down the MUA just uses the other ip. dsync replicates bi-directionally so that both servers are up-to-date. You don't need shared storage, every server is a copy of the other. If you want to use shared storage, then dsync is not for you because there is nothing to sync at that stage. I would use shared storage only if you need to have more than two servers. The above setup has no locking problems and is performant due to local filesystems. It depends on how many users you have and how much storage you need. You could buy two 2HE servers with 24 2.5" disks each (up to 96 with 4 HE), which may be sufficient for your needs. > User's mail store is running on shared storage, basically user's MUA connects to primary MX , the backup one is used once Primary is down. If you're not using Maildir beware of locking issues with concurrent access. It could crash indices. > It's a native HA of email system? I'll test those solution out. Yes, it works well with small setups. For big setups you'd typically use dovecot director, shared storage, object storage ... but you need more servers and it is way more complex and expensive. Best regards Gerald

3 3

failed: read(/var/run/dovecot/dns-client)
by Laura Smith 12 Apr '19

12 Apr '19

=== dsync(foobar(a)example.com): Error: imapc(foobar.example.com:993): dns_lookup(foobar.example.com) failed: read(/var/run/dovecot/dns-client) failed: read(size=512) failed: Connection reset by peer dsync(foobar(a)example.com): Error: Failed to initialize user: imapc: Login to foobar.example.com failed: Disconnected from server === Initially I thought "oh no, not another AppArmor block". But then surely the second message would not appear if the DNS lookup was not successful ? Also "dig foobar.example.com" works fine. How should I be troubleshooting this ? And if it is still likely to be AppArmor, what is calling it ? "doveadm" itself or something else ? What does "/var/run/dovecot/dns-client" do and why doesn't dovecot use standard OS calls like everyone else ? So many questions !

3 18

auth-worker unknown user
by Laura Smith 11 Apr '19

11 Apr '19

pam(foobar(a)example.com,192.0.1.1,<9zMTUUCGNfHZzMpL>): unknown user (SHA1 of given password: ff75068c2f4d700a49dae204d56477a5ffa5d23d) The password is correct, i.e. 'echo -n 'passed' | openssl dgst -sha1' matches. The user is setup correctly in /etc/dovecot/users (the /etc/dovecot/users was copied from another known-good server, so the syntax is correct and appropriate adjustments have been made for chmod and directory). doveconf -N follows: # 2.3.3 (dcead646b): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.3 (f018bbab) # OS: Linux 4.12.14-lp150.12.48-default x86_64 # Hostname: foobar auth_mechanisms = plain login auth_verbose = yes auth_verbose_passwords = sha1 doveadm_password = # hidden, use -P to show it first_valid_uid = 471 imapc_features = rfc822.size fetch-headers imapc_host = foobar.example.com imapc_password = # hidden, use -P to show it imapc_port = 993 imapc_ssl = imaps imapc_user = %u mail_location = maildir:~/Maildir mail_plugin_dir = /usr/lib64/dovecot/modules mail_prefetch_count = 20 mailbox_list_index = yes managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body environment mailbox date ihave enotify namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } passdb { driver = pam name = } plugin { sieve = file:~/.dovecot.sieve } protocols = imap lmtp service auth { unix_listener /var/spool/postfix/private/dovecot-auth { group = postfix mode = 0660 user = postfix } } service imap-login { process_min_avail = 3 } service lmtp { process_min_avail = 5 unix_listener /var/spool/postfix/private/dovecot-lmtp { group = postfix mode = 0660 user = postfix } user = my_virtmailuser } service managesieve-login { inet_listener sieve { port = 4190 } inet_listener sieves { address = port = 5190 ssl = yes } } ssl = required ssl_ca = </etc/dovecot/ssl/certbot_ca.pem ssl_cert = </etc/dovecot/ssl/certbot.pem ssl_cipher_list = ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES256-SHA:ECDHE-ECDSA-DES-CBC3-SHA:ECDHE-RSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:DES-CBC3-SHA:!DSS ssl_client_ca_dir = /etc/ssl/certs ssl_dh = # hidden, use -P to show it ssl_key = # hidden, use -P to show it ssl_min_protocol = TLSv1.2 ssl_options = no_compression ssl_prefer_server_ciphers = yes userdb { driver = passwd name = } userdb { args = scheme=ARGON2ID username_format=%u /etc/dovecot/users auth_verbose = yes driver = passwd-file name = } protocol lmtp { mail_plugins = sieve postmaster_address = foobar(a)example.com } protocol lda { deliver_log_format = msgid=%m: %$ mail_plugins = sieve postmaster_address = postmaster quota_full_tempfail = yes rejection_reason = Your message to <%t> was automatically rejected:%n%r } protocol imap { mail_max_userip_connections = 20 }

2 7

LMTP, PAM session and home directory autocreation
by Ivars Strazdins 11 Apr '19

11 Apr '19

Hi, mail is delivered by Dovecot's LMTP locally and I need user's home directory to be created if it doesn't exist yet. There is a setting in Dovecot's configuration, "session=yes", in /etc/Dovecot/conf.d/auth-system.conf.ext, which should do that. passdb { driver = pam args = session=yes dovecot } But I think it does not work in my setup because I do not see any PAM log entry for Dovecot in system log when this error happens: Apr 9 13:01:55 mailhost dovecot: lmtp(2935): Connect from local Apr 9 13:01:55 mailhost dovecot: lmtp(2935, testuser): Error: User initialization failed: Namespace '': mkdir(/home/testuser/Maildir) failed: Permission denied (euid=174000327(testuser) egid=174000327(testuser ) missing +w perm: /home, dir owned by 0:0 mode=0755) Apr 9 13:01:55 mailhost dovecot: lmtp(2935): Disconnect from local: Successful quit The error above seems expected, because it is not LMTP agent's job to create user's home directory but pam_oddjob_mkhomedir.so module should do that. Right? And there are common PAM log entries for every user session: Apr 9 13:24:42 mailhost auth: pam_sss(dovecot:auth): authentication success; logname= uid=0 euid=0 tty=dovecot ruser=validuser rhost=::1 user= validuser Apr 9 13:24:42 mailhost auth: pam_unix(dovecot:session): session opened for user validuser by (uid=0) Apr 9 13:24:42 mailhost auth: pam_unix(dovecot:session): session closed for user validuser How to debug this problem and find out why Dovecot does not open PAM session or - if I am wrong and it does, then what else is going wrong? Home directory autocreation is configured with command "authconfig --enablemkhomedir --update" and it works if user logs into system via shell or webmail. I tried to enable "mail_debug" in Dovecot's settings, but it did not give me any more information on PAM session. Running on Centos 7.6, with Dovecot 2.2.36. It looks like a common mistake or issue, because I am not alone: http://tinyurl.com/y6kjhsnw Thank you very much in advance for your time. Ivars /etc/pam.d/dovecot #%PAM-1.0 auth required pam_nologin.so auth include password-auth account include password-auth session include password-auth /etc/pam.d/password-auth #%PAM-1.0 # This file is auto-generated. # User changes will be destroyed the next time authconfig is run. auth required pam_env.so auth [default=1 success=ok] pam_localuser.so auth [success=done ignore=ignore default=die] pam_unix.so nullok try_first_pass auth requisite pam_succeed_if.so uid >= 1000 quiet_success auth sufficient pam_sss.so forward_pass auth required pam_deny.so account required pam_unix.so account sufficient pam_localuser.so account sufficient pam_succeed_if.so uid < 1000 quiet account [default=bad success=ok user_unknown=ignore] pam_sss.so account required pam_permit.so password requisite pam_pwquality.so try_first_pass local_users_only retry=3 authtok_type= password sufficient pam_unix.so sha512 shadow nullok try_first_pass use_authtok password sufficient pam_sss.so use_authtok password required pam_deny.so session optional pam_keyinit.so revoke session required pam_limits.so -session optional pam_systemd.so session optional pam_oddjob_mkhomedir.so umask=0077 session [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid session required pam_unix.so session optional pam_sss.so doveconf -n # 2.2.36 (1f10bfa63): /etc/dovecot/dovecot.conf # Pigeonhole version 0.4.24 (124e06aa) # OS: Linux 3.10.0-957.10.1.el7.x86_64 x86_64 CentOS Linux release 7.6.1810 (Core) # Hostname: mailhost.example.com auth_mechanisms = plain login auth_socket_path = /var/run/dovecot/auth-master auth_username_format = %Ln auth_verbose = yes default_client_limit = 3500 default_process_limit = 500 disable_plaintext_auth = no first_valid_uid = 203 imap_client_workarounds = tb-lsub-flags tb-extra-mailbox-sep lda_mailbox_autocreate = yes lda_mailbox_autosubscribe = yes lmtp_save_to_detail_mailbox = yes mail_location = maildir:~/Maildir:INBOX=~/Maildir:LAYOUT=fs mail_plugins = " fts fts_lucene" mail_privileged_group = mail maildir_very_dirty_syncs = yes managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext imapsieve vnd.dovecot.imapsieve mbox_write_locks = fcntl namespace inbox { inbox = yes list = yes location = mailbox Drafts { auto = subscribe special_use = \Drafts } mailbox Junk { auto = subscribe special_use = \Junk } mailbox Sent { auto = subscribe special_use = \Sent } mailbox "Sent Messages" { auto = subscribe special_use = \Sent } mailbox Trash { auto = subscribe special_use = \Trash } prefix = separator = / type = private } passdb { args = session=yes dovecot driver = pam } plugin { autocreate = Junk autocreate2 = Sent autocreate3 = Drafts autocreate4 = Trash autosubscribe = Junk autosubscribe2 = Sent autosubscribe3 = Drafts autosubscribe4 = Trash fts = lucene fts_lucene = whitespace_chars=@. imapsieve_mailbox1_before = file:/usr/lib64/dovecot/sieve/report-spam.sieve imapsieve_mailbox1_causes = COPY imapsieve_mailbox1_name = Junk imapsieve_mailbox2_before = file:/usr/lib64/dovecot/sieve/report-ham.sieve imapsieve_mailbox2_causes = COPY imapsieve_mailbox2_from = Junk imapsieve_mailbox2_name = * sieve = file:~/sieve;active=~/roundcube.sieve sieve_before = /var/lib/sieve/junk.sieve sieve_global_extensions = +vnd.dovecot.pipe +vnd.dovecot.environment sieve_pipe_bin_dir = /usr/lib64/dovecot/sieve sieve_plugins = sieve_imapsieve sieve_extprograms } pop3_client_workarounds = outlook-no-nuls oe-ns-eoh pop3_uidl_format = %v.%u protocols = imap pop3 lmtp sieve service auth { unix_listener /var/spool/postfix/private/dovecot-auth { group = postfix mode = 0660 user = postfix } unix_listener auth-master { group = user mode = 0660 user = root } } service lmtp { unix_listener /var/spool/postfix/private/dovecot-lmtp { group = postfix mode = 0600 user = postfix } } ssl_cert = </etc/letsencrypt/live/webmail.example.com/fullchain.pem ssl_key = # hidden, use -P to show it syslog_facility = local0 userdb { driver = passwd } valid_chroot_dirs = /var/mail:/home protocol lmtp { mail_fsync = never mail_plugins = " fts fts_lucene sieve" postmaster_address = postmaster(a)example.com } protocol lda { mail_fsync = never mail_plugins = " fts fts_lucene sieve expire" } protocol imap { mail_max_userip_connections = 25 mail_plugins = " fts fts_lucene fts fts_squat expire imap_sieve" } protocol sieve { managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date } protocol pop3 { mail_max_userip_connections = 20 mail_plugins = " fts fts_lucene fts fts_squat expire" }

1 0

High availability of Dovecot
by luckydog xf 11 Apr '19

11 Apr '19

Hi, list, I'm going to deploy postfix + dovecot + CephFS( as Mail Storage). Basically I want to use two servers for them, which is kind of HA. My idea is that using keepalived or Pacemaker to host a VIP, which could fail over the other server once one is down. And I'll use Haproxy or Nginx to schedule connections to one of those server based on source IP( Session stickiness), I'll use VIP as DNS record.etc, is my plan doable? I know MX could be server ones with different priority. But I think it brings along shortage that DNS couldn't know Email server is up or down, it just returns results to MUA, right? Thanks for any suggestions and ideas. -

7 6

Re: Mail account brute force / harassment
by Odhiambo Washington 11 Apr '19

11 Apr '19

All your approaches are not well thought out. The best solutions are always the simplest ones. KISS principle dictates so. On Thu, 11 Apr 2019 at 15:01, Marc Roos <M.Roos(a)f1-outsourcing.eu> wrote: > > How long have we been using the current strategy? Do we have less or > more abuse clouds operating? > > "Let the others bother with their own problems." is a bit narrow minded > view. If every one on this mailing list would have this attitude, there > would be no single answer to your question. > > > -----Original Message----- > From: Odhiambo Washington [mailto:odhiambo@gmail.com] > Sent: donderdag 11 april 2019 12:54 > To: Marc Roos > Cc: dovecot > Subject: Re: Mail account brute force / harassment > > Marc, > > There is a strategy loosely referred to as "choose your battles well" > :-) > If you can, hack the server and dump the 500GB - you'll be using > resources transferring the 500GB as the other server receives it. Two > servers wasting resources because you think you are punishing an > offender! > > > On Thu, 11 Apr 2019 at 13:43, wrote: > > > Please do not assume anything other than what is written, it is a > hypothetical situation > > > A. With the fail2ban solution > - you 'solve' that the current ip is not able to access you > - it will continue bothering other servers and admins > - you get the next abuse host to give a try. > > B. With 500GB dump > - the owner of the attacking server (probably hacked) will notice > it > will be forced to take action. > > > If abuse clouds are smart (most are) they would notice that > attacking my > servers, will result in the loss of abuse nodes, hence they will > not > bother me anymore. > > If every one would apply strategy B, the abuse problem would get > less. > Don't you agree?? > > > > > > > -----Original Message----- > From: Odhiambo Washington > Sent: donderdag 11 april 2019 12:28 > To: Marc Roos > Cc: dovecot > Subject: Re: Mail account brute force / harassment > > > > On Thu, 11 Apr 2019 at 13:24, Marc Roos via dovecot > <dovecot(a)dovecot.org> wrote: > > > > > Say for instance you have some one trying to constantly > access an > account > > > Has any of you made something creative like this: > > * configure that account to allow to login with any > password > * link that account to something like /dev/zero that > generates > infinite > amount of messages > (maybe send an archive of virusses?) > * transferring TB's of data to this harassing client. > > I think it would be interesting to be able to do such a > thing. > > > > > Instead of being evil, just use fail2ban to address this problem > :-) > > -- > > Best regards, > Odhiambo WASHINGTON, > Nairobi,KE > +254 7 3200 0004/+254 7 2274 3223 > "Oh, the cruft.", grep ^[^#] :-) > > > > > > > -- > > Best regards, > Odhiambo WASHINGTON, > Nairobi,KE > +254 7 3200 0004/+254 7 2274 3223 > "Oh, the cruft.", grep ^[^#] :-) > > > -- Best regards, Odhiambo WASHINGTON, Nairobi,KE +254 7 3200 0004/+254 7 2274 3223 "Oh, the cruft.", grep ^[^#] :-)

1 0

Re: Mail account brute force / harassment
by Odhiambo Washington 11 Apr '19

11 Apr '19

Marc, There is a strategy loosely referred to as "choose your battles well" :-) Let the others bother with their own problems. If you can, hack the server and dump the 500GB - you'll be using resources transferring the 500GB as the other server receives it. Two servers wasting resources because you think you are punishing an offender! On Thu, 11 Apr 2019 at 13:43, Marc Roos <M.Roos(a)f1-outsourcing.eu> wrote: > Please do not assume anything other than what is written, it is a > hypothetical situation > > > A. With the fail2ban solution > - you 'solve' that the current ip is not able to access you > - it will continue bothering other servers and admins > - you get the next abuse host to give a try. > > B. With 500GB dump > - the owner of the attacking server (probably hacked) will notice it > will be forced to take action. > > > If abuse clouds are smart (most are) they would notice that attacking my > servers, will result in the loss of abuse nodes, hence they will not > bother me anymore. > > If every one would apply strategy B, the abuse problem would get less. > Don't you agree?? > > > > > > > -----Original Message----- > From: Odhiambo Washington > Sent: donderdag 11 april 2019 12:28 > To: Marc Roos > Cc: dovecot > Subject: Re: Mail account brute force / harassment > > > > On Thu, 11 Apr 2019 at 13:24, Marc Roos via dovecot > <dovecot(a)dovecot.org> wrote: > > > > > Say for instance you have some one trying to constantly access an > account > > > Has any of you made something creative like this: > > * configure that account to allow to login with any password > * link that account to something like /dev/zero that generates > infinite > amount of messages > (maybe send an archive of virusses?) > * transferring TB's of data to this harassing client. > > I think it would be interesting to be able to do such a thing. > > > > > Instead of being evil, just use fail2ban to address this problem :-) > > -- > > Best regards, > Odhiambo WASHINGTON, > Nairobi,KE > +254 7 3200 0004/+254 7 2274 3223 > "Oh, the cruft.", grep ^[^#] :-) > > > -- Best regards, Odhiambo WASHINGTON, Nairobi,KE +254 7 3200 0004/+254 7 2274 3223 "Oh, the cruft.", grep ^[^#] :-)

2 1

Re: Lua Push Notification Plugin
by Sami Ketola 11 Apr '19

11 Apr '19

Hi, doveadm mailbox metadata get -u victim INBOX /private/vendor/vendor.dovecot/pvt/server/vendor/vendor.dovecot/http-notify or doveadm mailbox metadata set if you are not using appsuite as your mail frontend then you need to set the metadata manually or make sure that your mail frontend does set it. Sami > On 11 Apr 2019, at 11.50, Pabsky <j0hnw0rk3r(a)gmail.com> wrote: > > Sami, > > the package 'appsuite' is not mentioned in the documentation, also I already enabled imap metadata. > > What do you mean by 'It's not supposed to be a file. It's supposed to be a attribute on the users INBOX'? > > I'm attaching my dovecot configuration file for you to examine. Thanks Sami! > > On 11/04/2019 4:37 PM, Sami Ketola wrote: >> >> >>> On 11 Apr 2019, at 11.00, Pabsky via dovecot <dovecot(a)dovecot.org <mailto:dovecot@dovecot.org>> wrote: >>> >>> Thanks AKI! I'm a step closer to achieving my goals. >>> >>> However, I'm getting a new error as indicated from below: >>> >>> Apr 11 01:45:34 lmtp(user(a)mydomain.com <mailto:user@mydomain.com>)<20801><pVlIEJ7wrlxBUQAAUdwEFQ>: Debug: push-notification-ox: Skipped because not active (/private/vendor/vendor.dovecot/pvt/server/vendor/vendor.dovecot/http-notify METADATA not set) >>> Apr 11 01:45:34 lmtp(user(a)mydomain.com <mailto:user@mydomain.com>)<20801><pVlIEJ7wrlxBUQAAUdwEFQ>: Debug: push-notification: Push notification transaction completed >>> >>> By the way, the file /private/vendor/vendor.dovecot/pvt/server/vendor/vendor.dovecot/http-notify does not exist on my server. >> >> It's not supposed to be a file. It's supposed to be a attribute on the users INBOX. Also you need to enable imap metadata or appsuite can't set the attribute. >> >> Sami >> >> > <dovecot.conf>

1 0

Passord change problem. (INTERNAL)
by Arvid.Eikas＠telenor.com 11 Apr '19

11 Apr '19

Hi, We have a strange problem with login after password change. We need to kill the auth_worker processes to activate the new password. It doesn't work with SIGHUP on pid, it doesn't help to run "doveadm auth cache flush". It runs flush xx but the new password still doesn't work. Are there any suggestions for how this can be resolved? Our release is 2.3.5. Arvid

1 0

Re: Lua Push Notification Plugin
by Pabsky 11 Apr '19

11 Apr '19

Thanks AKI! I'm a step closer to achieving my goals. However, I'm getting a new error as indicated from below: Apr 11 01:45:34 lmtp(user(a)mydomain.com)<20801><pVlIEJ7wrlxBUQAAUdwEFQ>:*Debug: push-notification-ox: Skipped because not active (/private/vendor/vendor.dovecot/pvt/server/vendor/vendor.dovecot/http-notify METADATA not set)* Apr 11 01:45:34 lmtp(user(a)mydomain.com)<20801><pVlIEJ7wrlxBUQAAUdwEFQ>:*Debug: push-notification: Push notification transaction completed *By the way, the file****/private/vendor/vendor.dovecot/pvt/server/vendor/vendor.dovecot/http-notify* *does not exist on my server. Again, I appreciate the help :) ** > On 11 April 2019 07:57 Robust Coding via dovecot <dovecot(a)dovecot.org> wrote: > > > Hi Admin, > > I hope you consider reading and addressing my concern promptly. > > For the past few days I've been setting up a VPS with cPanel and WHM > pre-installed on Bluehost. I want to enable push notification plugin in > Dovecot2.3.5. I tried OX and Lua plugins and got errors. > > For using OX plugin: > push_notification_driver = ox:url=http://staging.mydomain.com/mail-notify/v1 > user_from_metadata > And got this error on runtime: > Error: push-notification-ox: Skipped because unable to get attribute: Mailbox > attributes not enabled > mail_attribute_dict = file:%h/Maildir/dovecot-attributes > When using Lua: > mail_plugins = $mail_plugins mail_lua notify push_notification > push_notification_lua > > plugin { > push_notification_driver = lua:file=/path/to/lua/push.lua > } > And got this order: > Plugin 'push_notification_lua' not found from directory /usr/lib64/dovecot > You do not have push_notification_lua installed. > I think I'm missing something here but I can't figure it out. Please HELP! > > Sincerely, > John Lopena > > -- > > "Become a programmer - Lose your brain's virginity" Aki

3 2

masteruser can not select INBOX
by Ludwig Wieland 11 Apr '19

11 Apr '19

Hello, My Dovecot Master can login but not not select INBOX ! What's wrong ? best regards Luda 1) USER can select INBOX: OK --------------------------------------------------- telnet localhost imap Trying ::1... Connected to localhost. Escape character is '^]'. * OK [CAPABILITY IMAP4rev1 LITERAL+ SASL-IR LOGIN-REFERRALS ID ENABLE IDLE STARTTLS AUTH=CRAM-MD5 AUTH=DIGEST-MD5 AUTH=GSSAPI AUTH=PLAIN AUTH=LOGIN] Dovecot ready. a login test1 password a OK [CAPABILITY IMAP4rev1 LITERAL+ SASL-IR LOGIN-REFERRALS ID ENABLE IDLE SORT SORT=DISPLAY THREAD=REFERENCES THREAD=REFS THREAD=ORDEREDSUBJECT MULTIAPPEND URL-PARTIAL CATENATE UNSELECT CHILDREN NAMESPACE UIDPLUS LIST-EXTENDED I18NLEVEL=1 CONDSTORE QRESYNC ESEARCH ESORT SEARCHRES WITHIN CONTEXT=SEARCH LIST-STATUS BINARY MOVE SEARCH=FUZZY SPECIAL-USE COMPRESS=DEFLATE QUOTA ACL RIGHTS=texk] Logged in b select INBOX * FLAGS (\Answered \Flagged \Deleted \Seen \Draft) * OK [PERMANENTFLAGS (\Answered \Flagged \Deleted \Seen \Draft \*)] Flags permitted. * 5 EXISTS * 0 RECENT * OK [UNSEEN 1] First unseen. * OK [UIDVALIDITY 1328091893] UIDs valid * OK [UIDNEXT 6] Predicted next UID * OK [HIGHESTMODSEQ 11] Highest b OK [READ-WRITE] Select completed (0.000 + 0.000 secs). c logout * BYE Logging out c OK Logout completed. Connection closed by foreign host. 2) MASTER-USER can't select INBOX: ! --------------------------------------------------- admins$ telnet localhost imap Trying ::1... Connected to localhost. Escape character is '^]'. * OK [CAPABILITY IMAP4rev1 LITERAL+ SASL-IR LOGIN-REFERRALS ID ENABLE IDLE STARTTLS AUTH=CRAM-MD5 AUTH=DIGEST-MD5 AUTH=GSSAPI AUTH=PLAIN AUTH=LOGIN] Dovecot ready. a login test1*mailmaster password a OK [CAPABILITY IMAP4rev1 LITERAL+ SASL-IR LOGIN-REFERRALS ID ENABLE IDLE SORT SORT=DISPLAY THREAD=REFERENCES THREAD=REFS THREAD=ORDEREDSUBJECT MULTIAPPEND URL-PARTIAL CATENATE UNSELECT CHILDREN NAMESPACE UIDPLUS LIST-EXTENDED I18NLEVEL=1 CONDSTORE QRESYNC ESEARCH ESORT SEARCHRES WITHIN CONTEXT=SEARCH LIST-STATUS BINARY MOVE SEARCH=FUZZY SPECIAL-USE COMPRESS=DEFLATE QUOTA ACL RIGHTS=texk] Logged in b select INBOX b NO [SERVERBUG] Internal error occurred. Refer to server log for more information. [2019-04-09 08:20:46] (0.000 + 0.000 secs). c logout * BYE Logging out c OK Logout completed. Connection closed by foreign host. ---------------------------------------- An the Server Error log says: Apr 09 00:05:40 imap(pid 62335 user test1): Error: Opening INBOX failed: Mailbox doesn't exist: INBOX ---------------------------------------- admins$ doveconf -n # 2.2.24 (a82c823): /Library/Server/Mail/Config/dovecot/dovecot.conf # OS: Darwin 16.7.0 x86_64 hfs auth_master_user_separator = * auth_mechanisms = cram-md5 digest-md5 gssapi plain login apop auth_realms = xserver.mydomain.ch auth_socket_path = /var/run/dovecot/auth-userdb auth_username_format = %n debug_log_path = /Library/Logs/Mail/mail-debug.log default_internal_user = _dovecot default_login_user = _dovenull disable_plaintext_auth = no first_valid_gid = 6 first_valid_uid = 6 imap_id_log = * imap_id_send = "name" * "version" * imap_urlauth_submit_user = submit info_log_path = /Library/Logs/Mail/mail-info.log log_path = /Library/Logs/Mail/mail-err.log login_log_format_elements = user=<%u> method=%m rip=%r lip=%l mpid=%e %c mail_access_groups = mail mail_attribute_dict = file:/Library/Server/Mail/Data/attributes/attributes.dict mail_location = maildir:/Library/Server/Mail/Data/mail/%u mail_log_prefix = "%s(pid %p user %u): " mail_plugins = quota zlib acl fts fts_sk managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date ihave mdbox_rotate_size = 200 M namespace acl-mailboxes { list = children location = maildir:/Library/Server/Mail/Data/mail/users/%%u:INDEX=/Library/Server/Mail/Data/mail/shared/%%u prefix = shared.%%u. separator = . subscriptions = no type = shared } namespace inbox { inbox = yes location = mailbox "Deleted Messages" { special_use = \Trash } mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } namespace list-archives { list = children location = maildir:/Library/Server/Mail/Data/listserver/messages/archive/lists/%%u:INDEX=/Library/Server/Mail/Data/listserver/messages/archive/shared/%%u prefix = archives.%%u. separator = . subscriptions = no type = shared } passdb { args = /Library/Server/Mail/Config/dovecot/master-users driver = passwd-file master = yes pass = yes } passdb { driver = od } passdb { args = /Library/Server/Mail/Config/dovecot/submit.passdb driver = passwd-file } plugin { acl = vfile:/Library/Server/Mail/Config/dovecot/global-acls:cache_secs=300 acl_shared_dict = file:/Library/Server/Mail/Data/shared/shared-mailboxes fts = sk quota = maildir:User quota quota_warning = storage=100%% quota-exceeded %u quota_warning2 = storage=80%% quota-warning %u sieve = /Library/Server/Mail/Data/rules/%u/dovecot.sieve sieve_dir = /Library/Server/Mail/Data/rules/%u stats_refresh = 30 secs stats_track_cmds = yes } postmaster_address = postmaster(a)xserver.myserver.ch protocols = imap pop3 lmtp sieve quota_full_tempfail = yes service auth { idle_kill = 15 mins unix_listener auth-userdb { user = _dovecot } } service dns_client { unix_listener dns-client { mode = 0600 } } service imap-login { inet_listener imap { port = 143 } inet_listener imaps { port = 993 ssl = yes } service_count = 0 } service imap { client_limit = 5 process_limit = 200 service_count = 0 } service indexer-worker { user = _dovecot } service lmtp { unix_listener lmtp { mode = 0600 } } service managesieve-login { inet_listener sieve { port = 4190 } } service pop3-login { inet_listener pop3 { port = 110 } inet_listener pop3s { port = 995 ssl = yes } } service pop3 { client_limit = 5 process_limit = 200 service_count = 0 } service quota-exceeded { executable = script /Applications/Server.app/Contents/ServerRoot/usr/libexec/dovecot/quota-exceeded.sh unix_listener quota-exceeded { group = mail mode = 0660 user = _dovecot } user = _dovecot } service quota-warning { executable = script /Applications/Server.app/Contents/ServerRoot/usr/libexec/dovecot/quota-warning.sh unix_listener quota-warning { group = mail mode = 0660 user = _dovecot } user = _dovecot } service stats { fifo_listener stats-mail { mode = 0600 user = _dovecot } } ssl = required ssl_ca = </etc/certificates/myserver.ch.A9FFFFB4B4C0E4CA959917BC2F60BDECBC414D35.chain.pem ssl_cert = </etc/certificates/myserver.ch.A9FFFFB4B4C0E4CA959917BC2F60BDECBC414D35.cert.pem ssl_cipher_list = ALL:!LOW:!SSLv2:!EXP:!aNULL:!ADH:!eNULL ssl_key = </etc/certificates/myserver.ch.A9FFFFB4B4C0E4CA959917BC2F60BDECBC414D35.key.pem ssl_key_path = /etc/certificates/myserver.ch.A9FFFFB4B4C0E4CA959917BC2F60BDECBC414D35.key.pem ssl_protocols = !SSLv2 !SSLv3 userdb { args = partition=/Library/Server/Mail/Config/dovecot/partition_map.conf global_quota=0 enforce_quotas=yes driver = od } userdb { args = /Library/Server/Mail/Config/dovecot/submit.passdb driver = passwd-file } verbose_proctitle = yes protocol lmtp { mail_plugins = quota zlib acl fts fts_sk sieve } protocol lda { mail_plugins = quota zlib acl fts fts_sk sieve } protocol imap { mail_max_userip_connections = 20 mail_plugins = quota zlib acl fts fts_sk imap_acl imap_quota imap_zlib } protocol pop3 { mail_max_userip_connections = 6 }

3 8

Lua Push Notification Plugin
by Robust Coding 11 Apr '19

11 Apr '19

Hi Admin, I hope you consider reading and addressing my concern promptly. For the past few days I've been setting up a VPS with cPanel and WHM pre-installed on Bluehost. I want to enable push notification plugin in Dovecot2.3.5. I tried OX and Lua plugins and got errors. For using OX plugin: push_notification_driver = ox:url=http://staging.mydomain.com/mail-notify/v1 user_from_metadata And got this error on runtime: *Error: push-notification-ox: Skipped because unable to get attribute: Mailbox attributes not enabled* When using Lua: mail_plugins = $mail_plugins mail_lua notify push_notification push_notification_luaplugin { push_notification_driver = lua:file=/path/to/lua/push.lua} And got this order: *Plugin 'push_notification_lua' not found from directory /usr/lib64/dovecot* I think I'm missing something here but I can't figure it out. Please HELP! Sincerely, John Lopena -- *"Become a programmer - Lose your brain's virginity"*

2 1

ssl_cert: Can't open file permission denied
by Laura Smith 10 Apr '19

10 Apr '19

Dovecot 2.3.3 (dcead646b) openSUSE Leap 15.0 I am getting a weird error message: Fatal: Error in configuration file /etc/dovecot/local.conf line 16: ssl_cert: Can't open file /etc/foobar/ssl/certbot.pem: Permission denied I have tried the following: - chmod -R 655 /etc/foobar/ssl (/etc/foobar is 755) - create "ssl_users" group add dovecot to it chown -R dovecot:ssl_users /etc/foobar/ssl How can I fix this ? There's no obvious solution ?

5 7

/var/run/dovecot/stats-writer) failed: Permission denied
by ＠lbutlr 10 Apr '19

10 Apr '19

I am getting this error in logs net_connect_unix(/var/run/dovecot/stats-writer) failed: Permission den)) and I looked around the google results and it seems to be related to using service stats, which I am not using. # doveconf -n | grep stat # doveconf -n | head -3 # 2.3.5.1 (7ec6d0ade): /usr/local/etc/dovecot/dovecot.conf # Pigeonhole version 0.5.5 (2483b085) # OS: FreeBSD 11.2-RELEASE-p4 i386 Postfix is 3.4-20190106 (the newest version in ports) -- Over 3,500 gay marriages and, what, no hellfire? I was promise hellfire. And riots. What gives? -- Mark Morford

4 12

Restoring mailboxes from backup duplicates messages in POP clients
by Luis F. V. Gomes 10 Apr '19

10 Apr '19

Hello I had a disk problem and had to reformat it. All mailboxes were backed up using rsync. After I restored the mailboxes, the POP clients (Thunderbird) that were configured to leave the messages on the mailserver for, let's say, 30 days, didn't understand that some messages were already transfered and the users got duplicated messages in their Inbox. How can we avoid this? -- Thanks Luís F. Gomes IT Manager (55)(21) 3527-1220 Departamento de Engenharia Elétrica PUC-Rio R. Marques de S. Vicente 225/401L 22451-900 - Rio de Janeiro/RJ

3 4

protocols: Unknown protocol: sieve
by luckydog xf 10 Apr '19

10 Apr '19

Hi, list, I downloaded dovecot-2.3-pigeonhole-0.5.5.tar.gz and installed it, after I enabled #/etc/dovecot/conf.d/20-managesieve.conf protocols = $protocols sieve it said " protocols: Unknown protocol: sieve" What's wrong?" Thanks,

3 2

sieve match ANY header
by Shawn Heisey 10 Apr '19

10 Apr '19

I would like to create a sieve rule where I do a regex match on ALL headers, not a specific header. I've been trying to find out the proper syntax, but haven't found anything. Is this possible, and if so, how do I write it? Thanks, Shawn

4 6

Dovecot index compatibility
by Frido Otten 10 Apr '19

10 Apr '19

We're in the process of upgrading Dovecot from version 2.1.17 to 2.2.27 (package Debian Stretch). We have a shared NFS storage in use by multiple servers without Dovecot director. I've tested by connecting to IMAP on the new server to my own mailbox. This isn't a problem. But when the server with the Dovecot version 2.1.17 LDA drops a new message in my mailbox it thinks the index file is corrupted, and the message bounces to it's sender. So there must be a index compatibility issue between both versions. This is still no problem if I upgrade the entire platform in a maintenance window at once. But what I want is a rollback possibility. To which minimal Dovecot version should I upgrade the old platform to create this rollback possibility. I was looking for a table of dovecot index compatibility between the different versions (forward and backward), but couldn't find it. Is there any? Please advice. Best regards, Frido

1 0

dict: Error: Fatal error in defaults handling. Program aborted
by Hugo Manuel Ojendiz Lemus 10 Apr '19

10 Apr '19

Good day to everyone Currently, I'm trying to implement the sieve "vacation" plugin with the sieve "Extdata" plugin to lookup information from a MySQL remote server. I'm following the instructions in the documentation: https://wiki2.dovecot.org/Pigeonhole/Sieve/Plugins/Extdata ===== I have the following error === Apr 09 13:46:51 mail dovecot[5512]: dict: Error: Fatal error in defaults handling. Program aborted Apr 09 13:46:51 mail dovecot[5512]: lmtp(usrx(a)themail.com)<5539><PNwlBJvorFyjFQAAYWwSRA:2>: Warning: sieve: before: line 18: extdata: failed to lookup value `reply_enabled': Connection closed (reply took 0.016 secs (0.017 in dict wait, 0.000 in other ioloops, 0.000 in locks, async-id reply 0.001 secs ago)) Apr 09 13:46:51 mail dovecot[5512]: dict: Fatal: master: service(dict): child 5542 killed with signal 11 (core dumps disabled - https://dovecot.org/bugreport.html#coredumps) Apr 09 13:46:51 mail.halmex.com.mx dovecot[5512]: dict: Error: Fatal error in defaults handling. Program aborted ============================ ====== Dovecot Information ====== 2.3.5.1 (7ec6d0ade): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.5 (2483b085) # OS: Linux 3.10.0-514.16.1.el7.x86_64 x86_64 CentOS Linux release 7.3.1611 (Core) xfs doveconf: Warning: please set ssl_dh=</etc/dovecot/dh.pem doveconf: Warning: You can generate it with: dd if=/var/lib/dovecot/ssl-parameters.dat bs=1 skip=88 | openssl dhparam -inform der > /etc/dovecot/dh.pem dict { sieve = mysql:/etc/dovecot/pigeonhole-sieve.dict } log_timestamp = "%Y-%m-%d %H:%M:%S " mail_location = maildir:/var/vmail/%d/%Ln managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext namespace inbox { inbox = yes location = prefix = separator = . type = private } passdb { args = /etc/dovecot/dovecot-sql.conf.ext driver = sql } plugin { pop3_migration_mailbox = imapc: sieve_extdata_dict_uri = proxy::sieve sieve_global_extensions = +vnd.dovecot.extdata sieve_plugins = sieve_extdata sieve_vacation_send_from_recipient = yes sieve_before = /var/lib/dovecot/before.sieve } pop3c_host = mail.halmex.com.mx service auth-worker { user = root } service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0660 user = postfix } unix_listener auth-master { mode = 0600 user = vmail } user = root } service dict { unix_listener dict { group = vmail mode = 0600 user = vmail } } service lmtp { unix_listener /var/spool/postfix/private/dovecot-lmtp { group = postfix mode = 0600 user = postfix } } userdb { args = uid=5000 gid=5000 home=/var/vmail/%d/%Ln allow_all_users=yes driver = static } protocol pop3 { disable_plaintext_auth = no } protocol doveadm { mail_plugins = " pop3_migration" } protocol lmtp { mail_plugins = " sieve" } ============================ An important bit of information it's that the dict service was trying to read the /etc/my.cnf file, but SELinux prevent it, and the sieve script worked fine, once I solved the SELinux access problem, the errors began to appear. This is a postfix server working great for years, with a local MariaDB. The remote MySQL server its in the same LAN and Its reachable by the mail server and other servers, the account has access, and like Ive mention, before I gave access to the local /etc/my.cnf the sieve script worked fine (just the SELinux warnings). Looks like the dict service has problems with the local MariaDB configuration file, but in this scenario its not required Any information or help you can provide me would be greatly appreciated. Hugo Manuel Ojendiz Lemus Desarrollo | Recursos Humanos | HALMEX ((°J°))

2 1

Where to report (potential) Dovecot bugs
by Mark Moseley 10 Apr '19

10 Apr '19

I'm curious if this is still the right place to report potential bugs with Dovecot. Is there a Dovecot bug tracker somewhere?

2 2

LMTP, PAM session and home directory autocreating
by Ivars Strazdins 09 Apr '19

09 Apr '19

Hi, mail is delivered by Dovecot's lmtp locally and I need user's home directory to be created if it doesn't exist yet. There is a setting in Dovecot's configuration, "session=yes", in /etc/Dovecot/conf.d/auth-system.conf.ext, which should do that. passdb { driver = pam args = session=yes dovecot } But I think it does not work in my setup because I do not see any PAM log entry for Dovecot when this error happens: Apr 9 13:01:55 mailhost dovecot: lmtp(2935): Connect from local Apr 9 13:01:55 mailhost dovecot: lmtp(2935, testuser): Error: User initialization failed: Namespace '': mkdir(/home/testuser/Maildir) failed: Permission denied (euid=174000327(testuser) egid=174000327(testuser ) missing +w perm: /home, dir owned by 0:0 mode=0755) Apr 9 13:01:55 mailhost dovecot: lmtp(2935): Disconnect from local: Successful quit The error above seems expected, because it is not lmtp agent's job to create user's home directory but pam_oddjob_mkhomedir.so module should do that. Right? And there are log entries every PAM user session: Apr 9 13:24:42 mailhost auth: pam_sss(dovecot:auth): authentication success; logname= uid=0 euid=0 tty=dovecot ruser=validuser rhost=::1 user= validuser Apr 9 13:24:42 mailhost auth: pam_unix(dovecot:session): session opened for user validuser by (uid=0) Apr 9 13:24:42 mailhost auth: pam_unix(dovecot:session): session closed for user validuser I ask for help how to debug this problem and find out why Dovecot does not open PAM session or - if I am wrong and it does, then what else is going wrong. Home directory autocreation is configured with command "authconfig --enablemkhomedir --update" and it works if user logs into system manually. I tried to enable "mail_debug" in Dovecot's settings, but it did not give me any more information on PAM session. Running on Centos 7.6, with Dovecot 2.2.36. I sort of remember this was working 2 years ago when I enabled "session=yes" but something has changed along the way with all the Centos updates. Thank you very much in advance for your time. Ivars /etc/pam.d/dovecot #%PAM-1.0 auth required pam_nologin.so auth include password-auth account include password-auth session include password-auth /etc/pam.d/password-auth #%PAM-1.0 # This file is auto-generated. # User changes will be destroyed the next time authconfig is run. auth required pam_env.so auth [default=1 success=ok] pam_localuser.so auth [success=done ignore=ignore default=die] pam_unix.so nullok try_first_pass auth requisite pam_succeed_if.so uid >= 1000 quiet_success auth sufficient pam_sss.so forward_pass auth required pam_deny.so account required pam_unix.so account sufficient pam_localuser.so account sufficient pam_succeed_if.so uid < 1000 quiet account [default=bad success=ok user_unknown=ignore] pam_sss.so account required pam_permit.so password requisite pam_pwquality.so try_first_pass local_users_only retry=3 authtok_type= password sufficient pam_unix.so sha512 shadow nullok try_first_pass use_authtok password sufficient pam_sss.so use_authtok password required pam_deny.so session optional pam_keyinit.so revoke session required pam_limits.so -session optional pam_systemd.so session optional pam_oddjob_mkhomedir.so umask=0077 session [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid session required pam_unix.so session optional pam_sss.so doveconf -n # 2.2.36 (1f10bfa63): /etc/dovecot/dovecot.conf # Pigeonhole version 0.4.24 (124e06aa) # OS: Linux 3.10.0-957.10.1.el7.x86_64 x86_64 CentOS Linux release 7.6.1810 (Core) # Hostname: mailhost.example.com auth_mechanisms = plain login auth_socket_path = /var/run/dovecot/auth-master auth_username_format = %Ln auth_verbose = yes default_client_limit = 3500 default_process_limit = 500 disable_plaintext_auth = no first_valid_uid = 203 imap_client_workarounds = tb-lsub-flags tb-extra-mailbox-sep lda_mailbox_autocreate = yes lda_mailbox_autosubscribe = yes lmtp_save_to_detail_mailbox = yes mail_location = maildir:~/Maildir:INBOX=~/Maildir:LAYOUT=fs mail_plugins = " fts fts_lucene" mail_privileged_group = mail maildir_very_dirty_syncs = yes managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext imapsieve vnd.dovecot.imapsieve mbox_write_locks = fcntl namespace inbox { inbox = yes list = yes location = mailbox Drafts { auto = subscribe special_use = \Drafts } mailbox Junk { auto = subscribe special_use = \Junk } mailbox Sent { auto = subscribe special_use = \Sent } mailbox "Sent Messages" { auto = subscribe special_use = \Sent } mailbox Trash { auto = subscribe special_use = \Trash } prefix = separator = / type = private } passdb { args = session=yes dovecot driver = pam } plugin { autocreate = Junk autocreate2 = Sent autocreate3 = Drafts autocreate4 = Trash autosubscribe = Junk autosubscribe2 = Sent autosubscribe3 = Drafts autosubscribe4 = Trash fts = lucene fts_lucene = whitespace_chars=@. imapsieve_mailbox1_before = file:/usr/lib64/dovecot/sieve/report-spam.sieve imapsieve_mailbox1_causes = COPY imapsieve_mailbox1_name = Junk imapsieve_mailbox2_before = file:/usr/lib64/dovecot/sieve/report-ham.sieve imapsieve_mailbox2_causes = COPY imapsieve_mailbox2_from = Junk imapsieve_mailbox2_name = * sieve = file:~/sieve;active=~/roundcube.sieve sieve_before = /var/lib/sieve/junk.sieve sieve_global_extensions = +vnd.dovecot.pipe +vnd.dovecot.environment sieve_pipe_bin_dir = /usr/lib64/dovecot/sieve sieve_plugins = sieve_imapsieve sieve_extprograms } pop3_client_workarounds = outlook-no-nuls oe-ns-eoh pop3_uidl_format = %v.%u protocols = imap pop3 lmtp sieve service auth { unix_listener /var/spool/postfix/private/dovecot-auth { group = postfix mode = 0660 user = postfix } unix_listener auth-master { group = user mode = 0660 user = root } } service lmtp { unix_listener /var/spool/postfix/private/dovecot-lmtp { group = postfix mode = 0600 user = postfix } } ssl_cert = </etc/letsencrypt/live/webmail.example.com/fullchain.pem ssl_key = # hidden, use -P to show it syslog_facility = local0 userdb { driver = passwd } valid_chroot_dirs = /var/mail:/home protocol lmtp { mail_fsync = never mail_plugins = " fts fts_lucene sieve" postmaster_address = postmaster(a)example.com } protocol lda { mail_fsync = never mail_plugins = " fts fts_lucene sieve expire" } protocol imap { mail_max_userip_connections = 25 mail_plugins = " fts fts_lucene fts fts_squat expire imap_sieve" } protocol sieve { managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date } protocol pop3 { mail_max_userip_connections = 20 mail_plugins = " fts fts_lucene fts fts_squat expire" }

1 0

Problem with filter forwarded messages when using director proxy
by Ted 09 Apr '19

09 Apr '19

Hey there, I've been able to switch our mailservers over to using director to proxy logins and received email to the backend servers which store email on a shared NFS mount. Before I did this we were having trouble with the indexes running into errors because multiple servers accessing and modifying the dovecot.index files at the same time. I'm still seeing a small amount of this, and tracing it through it appears that when an account uses a filter to forward email to another address within our mail system, it recognises that it is a local email address it is responsible for and saves the message locally despite the fact that it is not the director specified server for the recipient address. As an example, lets say that test1(a)example.com is currently pointed to the 01 backend server by director, and test2(a)example.com to 02. If a filter at test1 forwards email to test2, then when an email for test1 comes in the director porxy will direct it to the 01 backend server, and when the message is saved the filter will run to forward it, and the 01 server will recognise that it is also responsible for test2 and so 01 will save the message for test2 rather than 02, as per director. This is causing a smallish number of clashes which I'd like to get cleaned up. I've tried getting the server to send through a relay but if it recognises the account as local it will not use the relay to send the email. Has anyone run into anything like this or have any ideas about how to approach the problem? Thank you Ted easyDNS Technologies

1 0

Editing fail2ban page?
by Mauricio Tavares 09 Apr '19

09 Apr '19

In https://wiki.dovecot.org/HowTo/Fail2Ban, for a current (I know for a fact in 2.2.36) I believe it should be filter = dovecot instead of filter = dovecot-pop3imap [root@mail ~]# ls -l /etc/fail2ban/filter.d/doveco* -rw-r--r-- 1 root root 1875 May 11 2017 /etc/fail2ban/filter.d/dovecot.conf [root@mail ~]#

2 1

dovecot[30008]: auth-worker: Fatal: master: service(auth-worker): child 31074 killed with signal 11
by Herbert 09 Apr '19

09 Apr '19

Hi Since a recent DNF update, I see many log file entries like the following: Apr 08 16:16:36 udoo.symmetrix.ch audit[31074]: ANOM_ABEND auid=4294967295 uid=0 gid=0 ses=4294967295 subj=system_u:system_r:dovecot_auth_t:s0 pid=31074 comm="auth" exe="/usr/libexec/dovecot/auth" sig=11 res=1 Apr 08 16:16:36 udoo.symmetrix.ch kernel: traps: auth[31074] general protection fault ip:7ff45b5f98a7 sp:7fff0df96830 error:0 in libmariadb.so.3[7ff45b5d7000+46000] Apr 08 16:16:36 udoo.symmetrix.ch dovecot[30008]: auth-worker: Fatal: master: service(auth-worker): child 31074 killed with signal 11 (core not dumped - https://dovecot.org/bugreport.html#coredumps) Apr 08 16:16:38 udoo.symmetrix.ch abrt-dump-journal-oops[1139]: abrt-dump-journal-oops: Found oopses: 1 Apr 08 16:16:38 udoo.symmetrix.ch abrt-dump-journal-oops[1139]: abrt-dump-journal-oops: Creating problem directories Apr 08 16:16:39 udoo.symmetrix.ch abrt-dump-journal-oops[1139]: Reported 1 kernel oopses to Abrt Apr 08 16:16:39 udoo.symmetrix.ch abrt-server[31104]: Can't find a meaningful backtrace for hashing in '.' Apr 08 16:16:39 udoo.symmetrix.ch abrt-server[31104]: Option 'DropNotReportableOopses' is not configured Apr 08 16:16:39 udoo.symmetrix.ch abrt-server[31104]: Preserving oops '.' because DropNotReportableOopses is 'no' Apr 08 16:16:39 udoo.symmetrix.ch dbus-daemon[1022]: [system] Activating service name='org.freedesktop.problems' requested by ':1.779' (uid=0 pid=31122 comm="/usr/bin/python3 /usr/bin/abrt-action-notify -d /v" label="system_u:system_r:abrt_t:s0-s0:c0.c1023") (using servicehelper) Apr 08 16:16:40 udoo.symmetrix.ch dbus-daemon[1022]: [system] Successfully activated service 'org.freedesktop.problems' Apr 08 16:16:40 udoo.symmetrix.ch abrt-notification[31129]: System encountered a non-fatal error in ??() # uname -a Linux udoo.symmetrix.ch 5.0.5-100.fc28.x86_64 #1 SMP Wed Mar 27 22:16:29 UTC 2019 x86_64 x86_64 x86_64 GNU/Linux # dovecot --version 2.3.5 (513208660) # mysql --version mysql Ver 15.1 Distrib 10.2.22-MariaDB, for Linux (x86_64) using readline 5.1 Unfortunately I didn't manage to get a core dump, sorry. Kind regards, Herbert

2 1

Re: SMTPUTF8 support
by David Bürgin 08 Apr '19

08 Apr '19

André, are you quite sure you have it working? In this thread someone from Open-Xchange stated that no, Dovecot doesn’t have SMTPUTF8 support implemented, and the same response was given by another Dovecot developer last September (it ‘is being considered’ was the answer then, see https://dovecot.org/pipermail/dovecot/2018-September/112887.html) I am using LMTP to deliver mail to Dovecot from Postfix, and delivery fails with Postfix reporting: ‘SMTPUTF8 is required, but was not offered by host mail.my.org[private/dovecot-lmtp]’. I doubt that this can work without a change in Dovecot LMTP. Anyway, I am also interested in SMTPUTF8 support, so +1 from me! -- David

6 10

OpenFTS
by Cerebus 05 Apr '19

05 Apr '19

All the discussion on FTS reminds me, is there any plan to support OpenFTS in dovecot or is there a reason preventing that? -- This is my signature. There are many like it, but this one is mine.

2 1

SMTPUTF8 support
by sylvhem＠lepubdelobservateur.fr 05 Apr '19

05 Apr '19

Hi, I'm currently trying to set up SMTPUTF8 on my mail stack, but I can't find any information on Dovecot's RFC 6531 support. Has it been implemented yet? If so, does anyone know how to activate it? Regards. -- Sylvhem

4 5

Solr connection timeout hardwired to 60s
by Peter Mogensen 05 Apr '19

05 Apr '19

Hi, What's the recommended way to handling timeouts on large mailboxes given the hardwired request timeout of 60s in solr-connection.c: http_set.request_timeout_msecs = 60*1000; /Peter

5 5

doveadm backup + ISO 8859-1 mailbox name
by Michael Goth 04 Apr '19

04 Apr '19

Hi! I'm trying to migrate a mailbox from an old IMAP server (not Dovecot) to a new Dovecot server with 'doveadm backup'. The command fails because of an unexpected character in a mailbox name: doveadm -o imapc_user=ag(a)example.org \ -o imapc_password=XXX \ -o imapc_host=old-mailserver.webflow.de \ -o imapc_port=993 \ -o imapc_ssl=imaps \ -o imapc_ssl_verify=no \ -o imapc_features=rfc822.size,fetch-headers \ -o ssl_client_ca_dir=/etc/ssl \ backup -R -f -x ~* -u migration-ag(a)example.org imapc: dsync(migration-ag(a)example.org): Info: imapc(old-mailserver.webflow.de:993): Connected to 1.1.1.1:993 (local 2.2.2.2:46154) dsync(migration-ag(a)example.org): Error: Failed to access mailbox Entw?rfe: mailbox does not exist The problem is with "Entw?rfe" here. It's actually Entw<0xfc>rfe, which translates to "Entwürfe" in ISO-8859-1. Why can't doveadm find that mailbox? Is the old mailserver misbehaving (I hope not because I have no idea how to change that...), or does this happen on the new server? Can I tell doveadm something that makes this work? Thank you Michael -- Michael Goth .webflow GmbH Geschäftsführer: Andreas Schrei Wasserburger Straße 4 D - 83352 Altenmarkt a. d. Alz Amtsgericht Traunstein HRB 18537 E-Mail: mg(a)webflow.de Tel: +49 (0) 8621 - 99989 - 26 Fax: +49 (0) 8621 - 99989 - 28 Web: www.webflow.de

3 3

Autosubscribe to public folder
by Рустам 04 Apr '19

04 Apr '19

Hello everyone! I am trying to migrate from Dovecot 1.2 to Dovecot 2.2 and I can`t find information how to subscribe all users to public folder. In Dovecot 1.2 I have a few strings kind of "autosubscribeX = Public.Documents" and every users get subscribed to this Public folders and can`t unsubscribe. This is a goal. Is any posibility to make the same in Dovecot 2.2 or each user have to susbscribe to public folders themselves and this is kind of policy of Dovecot 2.2? -- С уважением, Рустам Багов.

2 1

TFA authentication in dovecot, using XMPP and RFC 4226
by André Rodier 03 Apr '19

03 Apr '19

Hello, I would like to implement some kind of two factors authentication, in Dovecot. I am thinking about using the post login script, to check for unusual behaviour, like say, a different country / IP address or an unusual hour. I already wrote a simple shell script that check these factors, but now, I have some options for the following, and I need to know your opinion if this is feasible or not. I want to use google authenticator Debian package (support the HMAC- Based One-time Password (HOTP) algorithm specified in RFC 4226 and the Time-based One-time Password (TOTP)) The challenge would be send via XMPP. This second part is fairly easy to do, I have all the packages on Debian, for instance sendxmpp. The first tests are promising. In case of success, the IP address is added to the list, let's say for one month... My back-end for authentication is OpenLDAP. My questions are: - Do you see any performance issues for other users or login processes, if I implement this? - I am planning to use a timeout, for instance one minute to confirm the connection. Does Dovecot have a timeout on its side, that would abort the connection before? Otherwise: - Is it possible to have multiple authentication back-ends in Dovecot? For instance LDAP and/or OTP? - I think to have seen some TFA options in Dovecot, but AFAICS, they are mandatory. Thanks for your insights, and this fabulous software. -- André Rodier HomeBox: https://github.com/progmaticltd/homebox

2 1

where shall I enforce sieve and quota plugins
by luckydog xf 03 Apr '19

03 Apr '19

Hello, guys, I'm going to using sieve and quota plugins, but I'm not sure where shall I enforce against properly? I see somebody uses them against 20-imap.conf, 15-lda.conf, or 20-lmtp.conf I use LMTP as MDA, so where is the correct location to call these plugins and why? Thanks,

2 1

Trying to track down source of duplicate messages
by Alex 02 Apr '19

02 Apr '19

Hi, I have a fedora28 system with dovecot-2.3.5 and I'm trying to figure out why I'm increasingly receiving duplicate emails. The message IDs are exactly the same. It's always two of the same messages. I don't think it's ever occurred in the inbox. It doesn't happen with every message or seemingly in every folder. I've read about dovecot deduplicate, but of course I want to prevent them from being duplicated in the first place. It's also happening much more frequently now. Could something in my configuration cause this problem? Below is the contents of my doveconf # 2.3.5 (513208660): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.5 (2483b085) # OS: Linux 4.20.11-100.fc28.x86_64 x86_64 Fedora release 28 (Twenty Eight) # Hostname: orion.inside.guardiandigital.com # NOTE: Send doveconf -n output instead when asking for help. auth_anonymous_username = anonymous auth_cache_negative_ttl = 1 hours auth_cache_size = 0 auth_cache_ttl = 1 hours auth_cache_verify_password_with_worker = no auth_debug = no auth_debug_passwords = no auth_default_realm = auth_failure_delay = 2 secs auth_gssapi_hostname = auth_krb5_keytab = auth_master_user_separator = auth_mechanisms = plain auth_policy_check_after_auth = yes auth_policy_check_before_auth = yes auth_policy_hash_mech = sha256 auth_policy_hash_nonce = auth_policy_hash_truncate = 12 auth_policy_log_only = no auth_policy_reject_on_fail = no auth_policy_report_after_auth = yes auth_policy_request_attributes = login=%{requested_username} pwhash=%{hashed_password} remote=%{rip} device_id=%{client_id} protocol=%s auth_policy_server_api_header = auth_policy_server_timeout_msecs = 2000 auth_policy_server_url = auth_proxy_self = auth_realms = auth_socket_path = auth-userdb auth_ssl_require_client_cert = no auth_ssl_username_from_cert = no auth_stats = no auth_use_winbind = no auth_username_chars = abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ01234567890.-_@ auth_username_format = %Lu auth_username_translation = auth_verbose = no auth_verbose_passwords = no auth_winbind_helper_path = /usr/bin/ntlm_auth auth_worker_max_count = 30 base_dir = /var/run/dovecot config_cache_size = 1 M debug_log_path = default_client_limit = 1000 default_idle_kill = 1 mins default_internal_group = dovecot default_internal_user = dovecot default_login_user = dovenull default_process_limit = 100 default_vsz_limit = 256 M deliver_log_format = msgid=%m: %$ dict_db_config = director_flush_socket = director_mail_servers = director_max_parallel_kicks = 100 director_max_parallel_moves = 100 director_output_buffer_size = 10 M director_ping_idle_timeout = 30 secs director_ping_max_timeout = 1 mins director_servers = director_user_expire = 15 mins director_user_kick_delay = 2 secs director_username_hash = %u disable_plaintext_auth = yes dotlock_use_excl = yes doveadm_allowed_commands = doveadm_api_key = doveadm_http_rawlog_dir = doveadm_password = doveadm_port = 0 doveadm_socket_path = doveadm-server doveadm_username = doveadm doveadm_worker_count = 0 dsync_alt_char = _ dsync_commit_msgs_interval = 100 dsync_features = dsync_hashed_headers = Date Message-ID dsync_remote_cmd = ssh -l%{login} %{host} doveadm dsync-server -u%u -U first_valid_gid = 1 first_valid_uid = 500 haproxy_timeout = 3 secs haproxy_trusted_networks = hostname = imap_capability = imap_client_workarounds = imap_fetch_failure = disconnect-immediately imap_hibernate_timeout = 0 imap_id_log = imap_id_retain = no imap_id_send = name * imap_idle_notify_interval = 2 mins imap_literal_minus = no imap_logout_format = in=%i out=%o deleted=%{deleted} expunged=%{expunged} trashed=%{trashed} hdr_count=%{fetch_hdr_count} hdr_bytes=%{fetch_hdr_bytes} body_count=%{fetch_body_count} body_bytes=%{fetch_body_bytes} imap_max_line_length = 64 k imap_metadata = no imap_urlauth_host = imap_urlauth_logout_format = in=%i out=%o imap_urlauth_port = 143 imapc_cmd_timeout = 5 mins imapc_connection_retry_count = 1 imapc_connection_retry_interval = 1 secs imapc_features = imapc_host = imapc_list_prefix = imapc_master_user = imapc_max_idle_time = 29 mins imapc_max_line_length = 0 imapc_password = imapc_port = 143 imapc_rawlog_dir = imapc_sasl_mechanisms = imapc_ssl = no imapc_ssl_verify = yes imapc_user = import_environment = TZ CORE_OUTOFMEM CORE_ERROR LISTEN_PID LISTEN_FDS info_log_path = instance_name = dovecot last_valid_gid = 0 last_valid_uid = 0 lda_mailbox_autocreate = no lda_mailbox_autosubscribe = no lda_original_recipient_header = libexec_dir = /usr/libexec/dovecot listen = *, :: lmtp_hdr_delivery_address = final lmtp_proxy = no lmtp_proxy_rawlog_dir = lmtp_rawlog_dir = lmtp_rcpt_check_quota = no lmtp_save_to_detail_mailbox = no lmtp_user_concurrency_limit = 0 lock_method = fcntl log_core_filter = log_debug = log_path = syslog log_timestamp = "%b %d %H:%M:%S " login_access_sockets = login_greeting = Dovecot ready. login_log_format = %$: %s login_log_format_elements = user=<%u> method=%m rip=%r lip=%l mpid=%e %c session=<%{session}> login_plugin_dir = /usr/lib64/dovecot/login login_plugins = login_proxy_max_disconnect_delay = 0 login_proxy_notify_path = proxy-notify login_source_ips = login_trusted_networks = mail_access_groups = mail_always_cache_fields = mail_attachment_detection_options = mail_attachment_dir = mail_attachment_fs = sis posix mail_attachment_hash = %{sha1} mail_attachment_min_size = 128 k mail_attribute_dict = mail_cache_compress_continued_percentage = 200 mail_cache_compress_delete_percentage = 20 mail_cache_compress_header_continue_count = 4 mail_cache_compress_min_size = 32 k mail_cache_fields = flags mail_cache_min_mail_count = 0 mail_cache_record_max_size = 64 k mail_cache_unaccessed_field_drop = 30 days mail_chroot = mail_debug = no mail_fsync = optimized mail_full_filesystem_access = no mail_gid = mail mail_home = mail/ mail_index_log2_max_age = 2 days mail_index_log_rotate_max_size = 1 M mail_index_log_rotate_min_age = 5 mins mail_index_log_rotate_min_size = 32 k mail_index_rewrite_max_log_bytes = 128 k mail_index_rewrite_min_log_bytes = 8 k mail_location = mbox:~/mail:INBOX=/var/spool/mail/%u mail_log_prefix = "%s(%u)<%{pid}><%{session}>: " mail_max_keyword_length = 50 mail_max_lock_timeout = 0 mail_max_userip_connections = 500 mail_never_cache_fields = imap.envelope mail_nfs_index = no mail_nfs_storage = no mail_plugin_dir = /usr/lib64/dovecot mail_plugins = " listescape" mail_prefetch_count = 0 mail_privileged_group = mail mail_save_crlf = no mail_server_admin = mail_server_comment = mail_shared_explicit_inbox = no mail_sort_max_read_count = 0 mail_temp_dir = /tmp mail_temp_scan_interval = 1 weeks mail_uid = mail_vsize_bg_after_count = 0 mailbox_idle_check_interval = 30 secs mailbox_list_index = yes mailbox_list_index_include_inbox = no mailbox_list_index_very_dirty_syncs = no maildir_broken_filename_sizes = no maildir_copy_with_hardlinks = yes maildir_empty_new = no maildir_stat_dirs = no maildir_very_dirty_syncs = no managesieve_client_workarounds = managesieve_implementation_string = Dovecot Pigeonhole managesieve_logout_format = bytes=%i/%o managesieve_max_compile_errors = 5 managesieve_max_line_length = 65536 managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext master_user_separator = mbox_dirty_syncs = yes mbox_dotlock_change_timeout = 2 mins mbox_lazy_writes = yes mbox_lock_timeout = 5 mins mbox_md5 = apop3d mbox_min_index_size = 0 mbox_read_locks = fcntl mbox_very_dirty_syncs = no mbox_write_locks = fcntl mdbox_preallocate_space = no mdbox_rotate_interval = 0 mdbox_rotate_size = 10 M mmap_disable = no namespace inbox { disabled = no hidden = no ignore_on_failure = no inbox = yes list = yes location = mailbox Drafts { auto = no autoexpunge = 0 autoexpunge_max_mails = 0 comment = driver = special_use = \Drafts } mailbox Junk { auto = no autoexpunge = 0 autoexpunge_max_mails = 0 comment = driver = special_use = \Junk } mailbox Sent { auto = no autoexpunge = 0 autoexpunge_max_mails = 0 comment = driver = special_use = \Sent } mailbox "Sent Messages" { auto = no autoexpunge = 0 autoexpunge_max_mails = 0 comment = driver = special_use = \Sent } mailbox Trash { auto = no autoexpunge = 0 autoexpunge_max_mails = 0 comment = driver = special_use = \Trash } order = 0 prefix = separator = subscriptions = yes type = private } old_stats_carbon_interval = 30 secs old_stats_carbon_name = old_stats_carbon_server = old_stats_command_min_time = 1 mins old_stats_domain_min_time = 12 hours old_stats_ip_min_time = 12 hours old_stats_memory_limit = 16 M old_stats_session_min_time = 15 mins old_stats_user_min_time = 1 hours passdb { args = auth_verbose = default default_fields = deny = no driver = pam master = no mechanisms = name = override_fields = pass = no result_failure = continue result_internalfail = continue result_success = return-ok skip = never username_filter = } passdb { args = auth_verbose = default default_fields = deny = no driver = pam master = no mechanisms = name = override_fields = pass = no result_failure = continue result_internalfail = continue result_success = return-ok skip = never username_filter = } pop3_client_workarounds = pop3_delete_type = default pop3_deleted_flag = pop3_enable_last = no pop3_fast_size_lookups = no pop3_lock_session = no pop3_logout_format = top=%t/%p, retr=%r/%b, del=%d/%m, size=%s pop3_no_flag_updates = no pop3_reuse_xuidl = no pop3_save_uidl = no pop3_uidl_duplicates = allow pop3_uidl_format = %08Xu%08Xv pop3c_features = pop3c_host = pop3c_master_user = pop3c_password = pop3c_port = 110 pop3c_quick_received_date = no pop3c_rawlog_dir = pop3c_ssl = no pop3c_ssl_verify = yes pop3c_user = %u postmaster_address = postmaster@%{if;%d;ne;;%d;%{hostname}} protocols = imap pop3 quota_full_tempfail = no rawlog_dir = recipient_delimiter = + rejection_reason = Your message to <%t> was automatically rejected:%n%r rejection_subject = Rejected: %s replication_dsync_parameters = -d -N -l 30 -U replication_full_sync_interval = 1 days replication_max_conns = 10 replicator_host = replicator replicator_port = 0 sendmail_path = /usr/sbin/sendmail service aggregator { chroot = . client_limit = 0 drop_priv_before_exec = no executable = aggregator extra_groups = fifo_listener replication-notify-fifo { group = mode = 0600 user = } group = idle_kill = 0 privileged_group = process_limit = 0 process_min_avail = 0 protocol = service_count = 0 type = unix_listener replication-notify { group = mode = 0600 user = } user = $default_internal_user vsz_limit = 18446744073709551615 B } service anvil { chroot = empty client_limit = 0 drop_priv_before_exec = no executable = anvil extra_groups = group = idle_kill = 4294967295 secs privileged_group = process_limit = 1 process_min_avail = 1 protocol = service_count = 0 type = anvil unix_listener anvil-auth-penalty { group = mode = 0600 user = } unix_listener anvil { group = mode = 0600 user = } user = $default_internal_user vsz_limit = 18446744073709551615 B } service auth-worker { chroot = client_limit = 1 drop_priv_before_exec = no executable = auth -w extra_groups = group = idle_kill = 0 privileged_group = process_limit = 0 process_min_avail = 0 protocol = service_count = 1 type = unix_listener auth-worker { group = mode = 0600 user = $default_internal_user } user = vsz_limit = 18446744073709551615 B } service auth { chroot = client_limit = 0 drop_priv_before_exec = no executable = auth extra_groups = group = idle_kill = 0 privileged_group = process_limit = 1 process_min_avail = 0 protocol = service_count = 0 type = unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0660 user = postfix } unix_listener auth-client { group = mode = 0600 user = $default_internal_user } unix_listener auth-login { group = mode = 0600 user = $default_internal_user } unix_listener auth-master { group = mode = 0600 user = } unix_listener auth-userdb { group = mode = 0666 user = $default_internal_user } unix_listener login/login { group = mode = 0666 user = } unix_listener token-login/tokenlogin { group = mode = 0666 user = } user = $default_internal_user vsz_limit = 18446744073709551615 B } service config { chroot = client_limit = 0 drop_priv_before_exec = no executable = config extra_groups = group = idle_kill = 4294967295 secs privileged_group = process_limit = 0 process_min_avail = 0 protocol = service_count = 0 type = config unix_listener config { group = mode = 0600 user = } user = vsz_limit = 18446744073709551615 B } service dict-async { chroot = client_limit = 0 drop_priv_before_exec = no executable = dict extra_groups = group = idle_kill = 0 privileged_group = process_limit = 0 process_min_avail = 0 protocol = service_count = 0 type = unix_listener dict-async { group = $default_internal_group mode = 0660 user = } user = $default_internal_user vsz_limit = 18446744073709551615 B } service dict { chroot = client_limit = 1 drop_priv_before_exec = no executable = dict extra_groups = group = idle_kill = 0 privileged_group = process_limit = 0 process_min_avail = 0 protocol = service_count = 0 type = unix_listener dict { group = $default_internal_group mode = 0660 user = } user = $default_internal_user vsz_limit = 18446744073709551615 B } service director { chroot = . client_limit = 0 drop_priv_before_exec = no executable = director extra_groups = fifo_listener login/proxy-notify { group = mode = 00 user = } group = idle_kill = 4294967295 secs privileged_group = process_limit = 1 process_min_avail = 0 protocol = service_count = 0 type = unix_listener director-admin { group = mode = 0600 user = } unix_listener login/director { group = mode = 00 user = } user = $default_internal_user vsz_limit = 18446744073709551615 B } service dns_client { chroot = client_limit = 1 drop_priv_before_exec = no executable = dns-client extra_groups = group = idle_kill = 0 privileged_group = process_limit = 0 process_min_avail = 0 protocol = service_count = 0 type = unix_listener dns-client { group = mode = 0666 user = } user = $default_internal_user vsz_limit = 18446744073709551615 B } service doveadm { chroot = client_limit = 1 drop_priv_before_exec = no executable = doveadm-server extra_groups = $default_internal_group group = idle_kill = 0 privileged_group = process_limit = 0 process_min_avail = 0 protocol = service_count = 1 type = unix_listener doveadm-server { group = mode = 0600 user = } user = vsz_limit = 18446744073709551615 B } service imap-hibernate { chroot = client_limit = 0 drop_priv_before_exec = no executable = imap-hibernate extra_groups = group = idle_kill = 0 privileged_group = process_limit = 0 process_min_avail = 0 protocol = imap service_count = 0 type = unix_listener imap-hibernate { group = $default_internal_group mode = 0660 user = } user = $default_internal_user vsz_limit = 18446744073709551615 B } service imap-login { chroot = login client_limit = 0 drop_priv_before_exec = no executable = imap-login extra_groups = group = idle_kill = 0 inet_listener imap { address = haproxy = no port = 0 reuse_port = no ssl = no } inet_listener imaps { address = haproxy = no port = 993 reuse_port = no ssl = yes } privileged_group = process_limit = 0 process_min_avail = 20 protocol = imap service_count = 0 type = login user = $default_login_user vsz_limit = 18446744073709551615 B } service imap-urlauth-login { chroot = token-login client_limit = 0 drop_priv_before_exec = no executable = imap-urlauth-login extra_groups = group = idle_kill = 0 privileged_group = process_limit = 0 process_min_avail = 0 protocol = imap service_count = 1 type = login unix_listener imap-urlauth { group = mode = 0666 user = } user = $default_login_user vsz_limit = 18446744073709551615 B } service imap-urlauth-worker { chroot = client_limit = 1 drop_priv_before_exec = no executable = imap-urlauth-worker extra_groups = $default_internal_group group = idle_kill = 0 privileged_group = process_limit = 1024 process_min_avail = 0 protocol = imap service_count = 1 type = unix_listener imap-urlauth-worker { group = mode = 0600 user = $default_internal_user } user = vsz_limit = 18446744073709551615 B } service imap-urlauth { chroot = client_limit = 1 drop_priv_before_exec = no executable = imap-urlauth extra_groups = group = idle_kill = 0 privileged_group = process_limit = 1024 process_min_avail = 0 protocol = imap service_count = 1 type = unix_listener token-login/imap-urlauth { group = mode = 0666 user = } user = $default_internal_user vsz_limit = 18446744073709551615 B } service imap { chroot = client_limit = 1 drop_priv_before_exec = no executable = imap extra_groups = $default_internal_group group = idle_kill = 0 privileged_group = process_limit = 1024 process_min_avail = 0 protocol = imap service_count = 1 type = unix_listener imap-master { group = mode = 0600 user = } unix_listener login/imap { group = mode = 0666 user = } user = vsz_limit = 18446744073709551615 B } service indexer-worker { chroot = client_limit = 1 drop_priv_before_exec = no executable = indexer-worker extra_groups = $default_internal_group group = idle_kill = 0 privileged_group = process_limit = 10 process_min_avail = 0 protocol = service_count = 0 type = unix_listener indexer-worker { group = mode = 0600 user = $default_internal_user } user = vsz_limit = 18446744073709551615 B } service indexer { chroot = client_limit = 0 drop_priv_before_exec = no executable = indexer extra_groups = group = idle_kill = 0 privileged_group = process_limit = 1 process_min_avail = 0 protocol = service_count = 0 type = unix_listener indexer { group = mode = 0666 user = } user = $default_internal_user vsz_limit = 18446744073709551615 B } service ipc { chroot = empty client_limit = 0 drop_priv_before_exec = no executable = ipc extra_groups = group = idle_kill = 0 privileged_group = process_limit = 1 process_min_avail = 0 protocol = service_count = 0 type = unix_listener ipc { group = mode = 0600 user = $default_internal_user } unix_listener login/ipc-proxy { group = mode = 0600 user = $default_login_user } user = $default_internal_user vsz_limit = 18446744073709551615 B } service lmtp { chroot = client_limit = 1 drop_priv_before_exec = no executable = lmtp extra_groups = $default_internal_group group = idle_kill = 0 privileged_group = process_limit = 0 process_min_avail = 0 protocol = lmtp service_count = 0 type = unix_listener lmtp { group = mode = 0666 user = } user = vsz_limit = 18446744073709551615 B } service log { chroot = client_limit = 0 drop_priv_before_exec = no executable = log extra_groups = group = idle_kill = 4294967295 secs privileged_group = process_limit = 1 process_min_avail = 0 protocol = service_count = 0 type = log unix_listener log-errors { group = mode = 0600 user = } user = vsz_limit = 18446744073709551615 B } service managesieve-login { chroot = login client_limit = 0 drop_priv_before_exec = no executable = managesieve-login extra_groups = group = idle_kill = 0 inet_listener sieve { address = haproxy = no port = 4190 reuse_port = no ssl = no } privileged_group = process_limit = 0 process_min_avail = 0 protocol = sieve service_count = 1 type = login user = $default_login_user vsz_limit = 18446744073709551615 B } service managesieve { chroot = client_limit = 1 drop_priv_before_exec = no executable = managesieve extra_groups = group = idle_kill = 0 privileged_group = process_limit = 0 process_min_avail = 0 protocol = sieve service_count = 1 type = unix_listener login/sieve { group = mode = 0666 user = } user = vsz_limit = 18446744073709551615 B } service old-stats { chroot = empty client_limit = 0 drop_priv_before_exec = no executable = old-stats extra_groups = fifo_listener old-stats-mail { group = mode = 0600 user = } fifo_listener old-stats-user { group = mode = 0600 user = } group = idle_kill = 4294967295 secs privileged_group = process_limit = 1 process_min_avail = 0 protocol = service_count = 0 type = unix_listener old-stats { group = mode = 0600 user = } user = $default_internal_user vsz_limit = 18446744073709551615 B } service pop3-login { chroot = login client_limit = 0 drop_priv_before_exec = no executable = pop3-login extra_groups = group = idle_kill = 0 inet_listener pop3 { address = haproxy = no port = 0 reuse_port = no ssl = no } inet_listener pop3s { address = 192.168.1.100 haproxy = no port = 995 reuse_port = no ssl = yes } privileged_group = process_limit = 0 process_min_avail = 0 protocol = pop3 service_count = 1 type = login user = $default_login_user vsz_limit = 18446744073709551615 B } service pop3 { chroot = client_limit = 1 drop_priv_before_exec = no executable = pop3 extra_groups = $default_internal_group group = idle_kill = 0 privileged_group = process_limit = 1024 process_min_avail = 0 protocol = pop3 service_count = 1 type = unix_listener login/pop3 { group = mode = 0666 user = } user = vsz_limit = 18446744073709551615 B } service replicator { chroot = client_limit = 0 drop_priv_before_exec = no executable = replicator extra_groups = group = idle_kill = 4294967295 secs privileged_group = process_limit = 1 process_min_avail = 0 protocol = service_count = 0 type = unix_listener replicator-doveadm { group = mode = 00 user = $default_internal_user } unix_listener replicator { group = mode = 0600 user = $default_internal_user } user = vsz_limit = 18446744073709551615 B } service stats { chroot = empty client_limit = 0 drop_priv_before_exec = no executable = stats extra_groups = group = idle_kill = 4294967295 secs privileged_group = process_limit = 1 process_min_avail = 0 protocol = service_count = 0 type = unix_listener stats-reader { group = mode = 0600 user = } unix_listener stats-writer { group = $default_internal_group mode = 0660 user = } user = $default_internal_user vsz_limit = 18446744073709551615 B } service submission-login { chroot = login client_limit = 0 drop_priv_before_exec = no executable = submission-login extra_groups = group = idle_kill = 0 inet_listener submission { address = haproxy = no port = 587 reuse_port = no ssl = no } privileged_group = process_limit = 0 process_min_avail = 0 protocol = submission service_count = 1 type = login user = $default_login_user vsz_limit = 18446744073709551615 B } service submission { chroot = client_limit = 1 drop_priv_before_exec = no executable = submission extra_groups = $default_internal_group group = idle_kill = 0 privileged_group = process_limit = 1024 process_min_avail = 0 protocol = submission service_count = 1 type = unix_listener login/submission { group = mode = 0666 user = } user = vsz_limit = 18446744073709551615 B } shutdown_clients = yes ssl = yes ssl_alt_cert = ssl_alt_key = ssl_ca = ssl_cert = </etc/letsencrypt/fullchain.pem ssl_cert_username_field = commonName ssl_cipher_list = ALL:!LOW:!EXP:!aNULL:!RC4::!eNULL:!LOW:!3DES:!MD5:!EXP:!PSK:!SRP:!DSS ssl_client_ca_dir = ssl_client_ca_file = ssl_client_cert = ssl_client_key = ssl_crypto_device = ssl_curve_list = ssl_dh = # hidden, use -P to show it ssl_key = # hidden, use -P to show it ssl_key_password = ssl_min_protocol = TLSv1 ssl_options = ssl_prefer_server_ciphers = yes ssl_require_crl = yes ssl_verify_client_cert = no state_dir = /var/lib/dovecot stats_writer_socket_path = stats-writer submission_client_workarounds = submission_host = submission_logout_format = in=%i out=%o submission_max_mail_size = 40 M submission_max_recipients = 0 submission_relay_command_timeout = 5 mins submission_relay_connect_timeout = 30 secs submission_relay_host = submission_relay_master_user = submission_relay_max_idle_time = 29 mins submission_relay_password = submission_relay_port = 25 submission_relay_rawlog_dir = submission_relay_ssl = no submission_relay_ssl_verify = yes submission_relay_trusted = no submission_relay_user = submission_ssl = no submission_timeout = 30 secs syslog_facility = mail userdb { args = auth_verbose = default default_fields = driver = passwd name = override_fields = result_failure = continue result_internalfail = continue result_success = return-ok skip = never } userdb { args = auth_verbose = default default_fields = driver = passwd name = override_fields = result_failure = continue result_internalfail = continue result_success = return-ok skip = never } valid_chroot_dirs = verbose_proctitle = no verbose_ssl = no version_ignore = no

4 4

ssl_min_protocol
by ＠lbutlr 02 Apr '19

02 Apr '19

What are the possible settings for ssl_min_protocol? I only see it on the upgrade page where it mentions the default is TLSv1. Searching on the dovecot page gives me "Your search query "ssl_min_protocol" didn't return any results." -- Up the airy mountains, down the rushy glen... From ghosties and bogles and long-leggity beasties... My mother said I never should... We dare not go a-hunting for fear... And things that go bump... Play with the fairies in the wood... --Lords and Ladies

2 1

sql table definitions
by Richard Hector 02 Apr '19

02 Apr '19

Hi all, Trivial question ... I'm using PostgreSQL for my auth db. I used the example CREATE TABLE statement in the config file, but now I find the fields are too short. I assume dovecot will be fine with 'text' type columns replacing the varchars? Or failing that, I can change the length of the varchar fields? Cheers, Richard

2 1

Issue with dovecot/director
by Nico Stöckigt 01 Apr '19

01 Apr '19

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Hi, are there any known issues with dovecot/director (2.2.13) when receiving e-an mail with multiple receivers? In the given scenario the e-mail contains 3 recipients and is redirected by the director to 3 different mail servers (ox/dovecot @ UCS/univention). In this process the first 2 e-mails are just fine but the third e-mail is truncated somewhere in or after the header. Kind Regards Nico Stöckigt - -- Nico Stöckigt <stoeckigt(a)univention.de> Support Univention -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEoGjDpba412f0rm1CjVdPG/rdoykFAlyiPGoACgkQjVdPG/rd oyl+IRAAp11JHenIkDeonGV+tbj3nFF4RigPp85TiJmD2l/kddP5mMR/Bw+vMAc6 taHjfS4Myf6v+jCrn+FS+C2isZaassnqZF1JcyllT5RSvxzrSKl6ojf9vVl3jyfu gZ7RlVOqBqskSHkVsT4fmzFuGMRaTQBN7CtgQH3MXPcN477060WDiZ11x+w+2+be eI0hQID3X3CBRmhaYyXMsgwUCHF36dVYlzEnUy6yge2FuwgwonZASC9xueVQGN5b KYf66LmubJTERGo3XK7454s3jM6oEiz731Os7g/zHyd8X6fgpCaR1nre8x0xfe1I bz86GJzm3b+1Fme8++yxlGhTEERtNkw0znQG7LOw8fqY5ctD12kdxBgXQOgcLkjh 98zJD44wC8y9lRKfZ3Lydfq768U3D47AjmPY0u9Zp1YKdNS8PEsNk0iHaRn5ZpT0 0V+wfTTkh3jFFuaqqd0hgamwRuwkNfFNyGvNAd5x4nMUIGUZ1pI3ikGP8oGaLDMs iSo1YxXkUojZ9A2xMQ8bDbWLjpyj/YYw+Cs6t1QcP0h2HDATc7QrHMO02ajKXDW+ ZxsI4VvEplv4GhbMuhavRYhZk01fI1hdeV1+PvkcAsqxaljoJDSyqZP78A81f7F4 DWComweyk/k+BzLjiQPKhv7AjaXnjDVeJfVxLl8VYoW4jD/4aFc= =MGL8 -----END PGP SIGNATURE-----

2 3

mail_crypt not working on incoming messages?
by Dave 01 Apr '19

01 Apr '19

[Dovecot v2.2.33.2] I'm testing out mail_crypt on a fresh Dovecot install to get a feel for how it works, but I'm running into something unexpected. The mail_crypt plugin does seem to be working, but NOT on incoming email. What I mean is, if I send a test email to the server that has Dovecot installed, the message correctly arrives in the user's Maildir folder (I'm using Maildir format, not mbox), as I can see the mail message file appear. However, the message file is in plaintext and is not encrypted. But, if, using my Thunderbird email client connected to that account via IMAP, I move that message out of the inbox of that account to a folder on another account, and then move it back in to the original inbox, the file that appears in the Maildir folder structure IS encrypted. I have confirmed that mail_crypt is active in 10-mail.conf, 20-imap.conf, and 20-pop3.conf. The global public and private keys are working because (a) there are no errors and (b) it DOES encrypt -- just not on incoming email. mail_crypt_save_version is set 2, as per the docs for Dovecot 2 instruct. What am I missing? Does anyone have any thoughts as to why JUST incoming messages aren't encrypted, but that messages moved into the IMAP account DO get encrypted? Did I set up something incorrectly? I'm using sendmail as the MTA, if that matters, and messages are routed to the user's Maildir folder structure using a .procmailrc in that user's home folder. -Dave

2 3

dovecot ssl error message from my own connections
by Esteban L 01 Apr '19

01 Apr '19

Hello all, Just a minor thing. Not a big deal, because everything works fine, and I feel secure with my setup. But, I get this error message pretty much throughout the day/night, which appears to come from my own mail clients (desktop or mobile). I would like to resolve it, because it must me something (that is not good--that I may not understand), that may have other ramifications. So, here it is. date time myserver dovecot: imap-login: Debug: SSL error: SSL_read() syscall failed: Connection reset by peer Anyone have a suggestion of what this might hint to, other than obvious SSL. I tried parsing through various logs, but the most I find is just this single line. I can produce it, whenever I close my email client. Thanks in advance.

4 5

Possible bug with last_login plugin and PostgreSQL
by Zhang Huangbin 01 Apr '19

01 Apr '19

Dear all, I'm trying to get last_login plugin working with PostgreSQL, but seems Dovecot doesn't handle duplicate key while updating last login time (note: same setting works fine with MariaDB). I wonder whether it's a bug of Dovecot or i should handle this with PostgreSQL trigger. OS: OpenBSD 6.4 (amd64) Dovecot: 2.2.36 PostgreSQL: 10.5 Error log: ################### Mar 31 11:15:21 ob dovecot: imap-login: Login: user=<postmaster(a)a.io>, method=PLAIN, rip=127.0.0.1, lip=127.0.0.1, mpid=5936, TLS, session=<63/jV2CFhzt/AAAB> Mar 31 11:15:21 ob dovecot: imap(postmaster(a)a.io): Logged out in=300 out=1604 Mar 31 11:15:21 ob dovecot: imap-login: Login: user=<postmaster(a)a.io>, method=PLAIN, rip=127.0.0.1, lip=127.0.0.1, mpid=29797, TLS, session=<lLboV2CFuZ9/AAAB> Mar 31 11:15:21 ob dovecot: dict(9584): Error: sql dict: commit failed: ERROR: duplicate key value violates unique constraint "last_login_pkey" Mar 31 11:15:21 ob dovecot: dict: Error: DETAIL: Key (username)=(postmaster(a)a.io) already exists. Mar 31 11:15:21 ob dovecot: imap(postmaster(a)a.io): Error: dict-client: server returned failure: 1554023721 (reply took 0.012 secs) Mar 31 11:15:21 ob dovecot: imap(postmaster(a)a.io): Error: last_login_dict: Failed to write value for user postmaster(a)a.io Mar 31 11:15:21 ob dovecot: imap(postmaster(a)a.io): Logged out in=70 out=732 ################## My Dovecot config: ################### protocol imap { mail_plugins = ... last_login ... } protocol pop3 { mail_plugins = ... last_login ... } plugin { last_login_dict = proxy::lastlogin #last_login_key = last-login/%u ... } dict { lastlogin = pgsql:/etc/dovecot/dovecot-last-login.conf ... } ################### SQL commands used to create PostgreSQL table: ########### CREATE TABLE last_login ( username VARCHAR(255) NOT NULL, last_login INT DEFAULT NULL, PRIMARY KEY (username) ); ########### File /etc/dovecot/dovecot-last-login.conf: ########### connect = host=127.0.0.1 port=5432 dbname=vmail user=vmailadmin password=<password> map { pattern = shared/last-login/$user table = last_login value_field = last_login value_type = uint fields { username = $user } } ##############

1 1

I have a question.
by 김태용 01 Apr '19

01 Apr '19

Hi. I have a question. Can I limit the maximum number of messages I can sync per mailbox? Even if there are 10000 messages, I want to sync with the specified number of times. Ex)max sync mail count = 5000 (or 1000 or 2000..Outlook view message 5000) Thank you.

2 2

CentOS Repository broken ?
by Günther J. Niederwimmer 01 Apr '19

01 Apr '19

Hello, I have a CentOS 7 server with dovecot Repository enabled. But it is not possible to Update with Yum Update I have this Error? The dovecot package is missing? --> Transaktionsprüfung wird ausgeführt ---> Paket dovecot-imaptest.x86_64 2:2.3.5-1 markiert, um aktualisiert zu werden ---> Paket dovecot-imaptest.x86_64 2:2.3.5.1-1 markiert, um eine Aktualisierung zu werden --> Abhängigkeit dovecot = 2:2.3.5.1-1 wird für Paket 2:dovecot- imaptest-2.3.5.1-1.x86_64 verarbeitet ---> Paket dovecot-lua.x86_64 2:2.3.5-1 markiert, um aktualisiert zu werden ---> Paket dovecot-lua.x86_64 2:2.3.5.1-1 markiert, um eine Aktualisierung zu werden --> Abhängigkeit dovecot = 2:2.3.5.1-1 wird für Paket 2:dovecot- lua-2.3.5.1-1.x86_64 verarbeitet --> Abhängigkeitsauflösung beendet Fehler: Paket: 2:dovecot-imaptest-2.3.5.1-1.x86_64 (dovecot-2.3-latest) Benötigt: dovecot = 2:2.3.5.1-1 Installiert: 2:dovecot-2.3.5-1.x86_64 (installed) dovecot = 2:2.3.5-1 Verfügbar: 1:dovecot-2.2.36-3.el7.i686 (base) dovecot = 1:2.2.36-3.el7 Fehler: Paket: 2:dovecot-lua-2.3.5.1-1.x86_64 (dovecot-2.3-latest) Benötigt: dovecot = 2:2.3.5.1-1 Installiert: 2:dovecot-2.3.5-1.x86_64 (installed) dovecot = 2:2.3.5-1 Verfügbar: 1:dovecot-2.2.36-3.el7.i686 (base) dovecot = 1:2.2.36-3.el7 Thanks for repair. -- mit freundliche Grüßen / best regards, Günther J. Niederwimmer

5 12

Why is 'sent' folder missing in my MUA(email client)
by luckydog xf 31 Mar '19

31 Mar '19

hello, I'm successfully send and receive emails by postfix and dovecot, but folder name 'Sent' is gone, all sent emails are located in Drafts folder. Anything wrong? Guess it has something to do with mailbox and location. Here is `doveconf -n` ------------------ auth_cache_size = 1 M auth_debug_passwords = yes auth_mechanisms = plain login auth_ssl_username_from_cert = yes auth_verbose = yes auth_verbose_passwords = yes import_environment = TZ login_trusted_networks = 172.16.0.0/12 mail_location = maildir:/var/mail/%n/Maildir mail_privileged_group = mail namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } passdb { args = /etc/dovecot/dovecot-sql.conf.ext driver = sql } protocols = imap lmtp service auth-worker { user = $default_internal_user } service auth { unix_listener /var/spool/postfix/private/auth { mode = 0666 } } service imap-login { inet_listener imap { port = 0 } inet_listener imaps { port = 993 ssl = yes } } service lmtp { unix_listener lmtp { mode = 0666 } } service pop3-login { inet_listener pop3 { port = 110 } } ssl = required ssl_cert = </etc/ssl/certs/dovecot.pem ssl_dh = # hidden, use -P to show it ssl_key = # hidden, use -P to show it userdb { driver = prefetch } userdb { args = uid=mail gid=mail home=/var/mail/%u driver = static } verbose_proctitle = yes ----- I also checked mail dir, it has /var/mail/XXX/Maildir/.send/ So anything wrong? Thanks,

1 1

Attachment indicator
by azurit＠pobox.sk 29 Mar '19

29 Mar '19

Hi, if i use 'doveadm rebuild attachments' command with maildir mailboxes, will anything happen to files with emails? For example, will file name change? Or better, will anything, which could trigger data backup, happen to files containing emails? Thanks. azur

1 0

configuring Dovecot with wforced and auth_policy_server_url with https results in assertion failed
by Robert Kudyba 29 Mar '19

29 Mar '19

dovecot-2.3.3-1.fc29.x86_64 Mar 28 10:04:47 auth: Panic: file http-client-request.c: line 283 (http_client_request_unref): assertion failed: (req->refcount > 0) Mar 28 10:04:47 auth: Error: Raw backtrace: /usr/lib64/dovecot/libdovecot.so.0(+0xe34fb) [0x7fe76e0834fb] -> /usr/lib64/dovecot/libdovecot.so.0(+0xe3597) [0x7fe76e083597] -> /usr/lib64/dovecot/libdovecot.so.0(+0x51207) [0x7fe76dff1207] -> /usr/lib64/dovecot/libdovecot.so.0(+0x4972b) [0x7fe76dfe972b] -> /usr/lib64/dovecot/libdovecot.so.0(http_client_request_destroy+0x107) [0x7fe76e02cf87] -> /usr/lib64/dovecot/libdovecot.so.0(http_client_deinit+0x4c) [0x7fe76e03b9ec] -> dovecot/auth(auth_policy_deinit+0x1e) [0x55facfdb350e] -> dovecot/auth(main+0x3e1) [0x55facfdae3c1] -> /lib64/libc.so.6(__libc_start_main+0xf3) [0x7fe76dd93413] -> dovecot/auth(_start+0x2e) [0x55facfdae57e] Mar 28 10:04:47 auth: Fatal: master: service(auth): child 31162 killed with signal 6 (core not dumped - https://dovecot.org/bugreport.html#coredumps - set /proc/sys/fs/suid_dumpable to 2) Mar 28 10:04:48 master: Info: Dovecot v2.3.3 (dcead646b) starting up for imap, pop3

2 9

Fwd: segfault in libdovecot-storage at unknown circumstances
by sergio 29 Mar '19

29 Mar '19

https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=925961 -------- Forwarded Message -------- Subject: segfault in libdovecot-storage at unknown circumstances Date: Fri, 29 Mar 2019 16:34:15 +0300 From: sergio <sergio+it(a)outerface.net> To: Debian Bug Tracking System <submit(a)bugs.debian.org> Package: dovecot-core Version: 1:2.3.4.1-1~bpo9+1 Severity: normal Yes, I know this is not very informative. I've already set ALLOW_COREDUMPS to 1 in /etc/default/dovecot and waiting for the next fault. % grep segfa kern.log* kern.log.1: Mar 17 13:27:09 mail kernel: [118616.482998] imap[31111]: segfault at 8 ip 00007efbff924cbb sp 00007fff0b333890 error 4 in libdovecot-storage.so.0.0.0[7efbff858000+145000] % zgrep segfa kern.log*gz kern.log.2.gz:Mar 15 01:51:07 mail kernel: [1691560.449110] imap[8329]: segfault at 8 ip 00007ff38ae2390e sp 00007ffcd3317640 error 4 kern.log.2.gz:Mar 15 01:51:07 mail kernel: [1691560.449117] imap[8380]: segfault at 8 ip 00007fea0c1c890e sp 00007ffdc7607150 error 4 in libdovecot-storage.so.0.0.0[7fea0c10d000+12c000] kern.log.2.gz:Mar 15 01:51:07 mail kernel: [1691560.449438] imap[8371]: segfault at 8 ip 00007f4775b0490e sp 00007ffce2814cc0 error 4 in libdovecot-storage.so.0.0.0[7f4775a49000+12c000] kern.log.2.gz:Mar 15 01:51:07 mail kernel: [1691560.461685] imap[2435]: segfault at 8 ip 00007fa8cb0ab90e sp 00007ffc4185e130 error 4 in libdovecot-storage.so.0.0.0[7fa8caff0000+12c000] kern.log.3.gz:Mar 13 02:35:33 mail kernel: [1521426.802606] imap[11824]: segfault at 8 ip 00007fa1b95d290e sp 00007ffd935de700 error 4 kern.log.3.gz:Mar 13 02:35:33 mail kernel: [1521426.802614] imap[11827]: segfault at 8 ip 00007f1afe53490e sp 00007fffbeb753d0 error 4 in libdovecot-storage.so.0.0.0[7f1afe479000+12c000] kern.log.3.gz:Mar 13 02:35:33 mail kernel: [1521426.802983] imap[11837]: segfault at 8 ip 00007f70b5c9b90e sp 00007ffd7f80bc80 error 4 in libdovecot-storage.so.0.0.0[7f70b5be0000+12c000] % grep 'signal 11' mail.err* mail.err.1: Mar 17 13:27:09 mail dovecot: imap(sergio)<31111><lLOIej6EEN1Pht53>: Fatal: master: service(imap): child 31111 killed with signal 11 (core dumps disabled - https://dovecot.org/bugreport.html#coredumps) % zgrep 'signal 11' mail.err* mail.err.1:Mar 17 13:27:09 mail dovecot: imap(sergio)<31111><lLOIej6EEN1Pht53>: Fatal: master: service(imap): child 31111 killed with signal 11 (core dumps disabled - https://dovecot.org/bugreport.html#coredumps) mail.err.2.gz:Mar 15 01:51:07 mail dovecot: imap(sergio): Fatal: master: service(imap): child 8371 killed with signal 11 (core dumps disabled) mail.err.2.gz:Mar 15 01:51:07 mail dovecot: imap(sergio): Fatal: master: service(imap): child 8380 killed with signal 11 (core dumps disabled) mail.err.2.gz:Mar 15 01:51:07 mail dovecot: imap(sergio): Fatal: master: service(imap): child 8329 killed with signal 11 (core dumps disabled) mail.err.2.gz:Mar 15 01:51:07 mail dovecot: imap(sergio): Fatal: master: service(imap): child 2435 killed with signal 11 (core dumps disabled) mail.err.3.gz:Mar 13 02:35:33 mail dovecot: imap(sergio): Fatal: master: service(imap): child 11827 killed with signal 11 (core dumps disabled) mail.err.3.gz:Mar 13 02:35:33 mail dovecot: imap(sergio): Fatal: master: service(imap): child 11837 killed with signal 11 (core dumps disabled) mail.err.3.gz:Mar 13 02:35:33 mail dovecot: imap(sergio): Fatal: master: service(imap): child 11824 killed with signal 11 (core dumps disabled) % s dovecot -n # 2.3.4.1 (f79e8e7e4): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.4 () doveconf: Warning: service auth { client_limit=1000 } is lower than required under max. load (1324) doveconf: Warning: service anvil { client_limit=1000 } is lower than required under max. load (1227) # OS: Linux 4.9.0-8-amd64 x86_64 Debian 9.8 ext4 # Hostname: mail.outerface.net auth_verbose = yes lda_mailbox_autocreate = yes lda_mailbox_autosubscribe = yes lmtp_rcpt_check_quota = yes lmtp_save_to_detail_mailbox = yes mail_home = /var/mail/%u mail_location = sdbox:/var/mail/%u mail_plugins = quota fts virtual mail_privileged_group = mail managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext spamtest spamtestplus namespace { location = virtual:~/mailboxes/virtual prefix = virtual/ separator = / } namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Spam { special_use = \Junk } mailbox Trash { special_use = \Trash } prefix = } passdb { args = /etc/dovecot/dovecot-ldap.conf.ext driver = ldap } plugin { fts_autoindex = yes quota = count:User quota quota_grace = 10%% quota_rule = *:storage=2G quota_vsizes = yes sieve = file:~/sieve;active=~/.dovecot.sieve sieve_extensions = +spamtest +spamtestplus sieve_global = /etc/dovecot/sieve/ sieve_spamtest_max_value = 120 sieve_spamtest_status_header = X-Spam_score_int sieve_spamtest_status_type = score } protocols = " imap lmtp sieve" service auth-worker { user = $default_internal_user } service auth { unix_listener auth-client { mode = 0666 user = mail } } service imap-login { inet_listener imaps { port = 0 } process_limit = 1024 service_count = 1 vsz_limit = 64 M } service imap { process_limit = 1024 } ssl = required ssl_cert = </etc/ssl/localcerts/outerface.net-cert.pem ssl_cipher_list = ECDHE-ECDSA-AES256-GCM-SHA384 ssl_client_ca_dir = /etc/ssl/certs ssl_key = # hidden, use -P to show it ssl_min_protocol = TLSv1.2 userdb { driver = prefetch } userdb { args = /etc/dovecot/dovecot-ldap.conf.ext driver = ldap } protocol lmtp { mail_fsync = optimized mail_plugins = quota fts virtual sieve } protocol lda { mail_fsync = optimized } protocol imap { mail_max_userip_connections = 128 mail_plugins = quota fts virtual imap_zlib quota } -- sergio.

1 0

Purges now happen 5 times faster
by Steve Litt 29 Mar '19

29 Mar '19

Hi all, I use Claws-Mail to look inside my local (same metal) Dovecot server. All incoming mail is dumped into Dovecot folders via procmail. All of a sudden today, mass purges of "marked for delete" happen about 5 times faster. The process used to be a significant productivity destroyer, but now is easy to work with. In other words, it's a good thing, but until I know why this happened, I'll have that little voice inside telling me there's some evil side effect somewhere. Does anybody know any reason this should have happened? I'm using Dovecot 2.3.5 (513208660) and Claws-Mail 3.17.3. Thanks, SteveT

1 0

v2.2.27 Panic: file rfc822-parser.h: line 23 (rfc822_parser_deinit): assertion failed: (ctx->data <= ctx->end)
by Jason Lewis 29 Mar '19

29 Mar '19

Hi, I've been having an issue with the indexer giving me errors on mailbox in dovecot. I managed to narrow it down to a specific email in that mailbox. Various dovecot functions have issues with this email. The email itself is just spam. I can email it to you if you want to analyse it. I did run it through mbox-anonymize but its not clear to me that that would be of any use. Happy to email the suspect email privately to anyone who wants it. /home is mounted nfs4 and is zfs on the nfs server. Dovecot is installed from Debian Jessie. $ /usr/sbin/dovecot --version 2.2.27 (c0f36b0) dovecot-core: Installed: 1:2.2.27-3+deb9u2~bpo8+1 Candidate: 1:2.2.27-3+deb9u2~bpo8+1 Version table: *** 1:2.2.27-3+deb9u2~bpo8+1 0 100 /var/lib/dpkg/status 1:2.2.13-12~deb8u5 0 400 http://security.debian.org/ jessie/updates/main amd64 Packages 1:2.2.13-12~deb8u4 0 400 http://deb.debian.org/debian/ jessie/main amd64 Packages ~# dovecot -n # 2.2.27 (c0f36b0): /etc/dovecot/dovecot.conf # Pigeonhole version 0.4.16 (fed8554) # OS: Linux 4.9.0-0.bpo.6-amd64 x86_64 Debian 8.10 imap_hibernate_timeout = 5 secs mail_location = maildir:~/Maildir mail_plugins = fts fts_solr mailbox_list_index = yes namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } passdb { driver = pam } plugin { fts = solr fts_autoindex = yes fts_enforced = yes fts_solr = url=http://10.0.2.19:8080/solr/ imapsieve_mailbox1_before = file:/etc/dovecot/train-as-spam.sieve imapsieve_mailbox1_causes = COPY imapsieve_mailbox1_name = Junk imapsieve_mailbox2_before = file:/etc/dovecot/train-as-ham.sieve imapsieve_mailbox2_causes = COPY imapsieve_mailbox2_from = Junk imapsieve_mailbox2_name = * sieve = file:~/sieve;active=~/.dovecot.sieve sieve_global_extensions = +vnd.dovecot.pipe +vnd.dovecot.environment sieve_pipe_bin_dir = /usr/bin sieve_plugins = sieve_imapsieve sieve_extprograms } protocols = " imap" service anvil { client_limit = 1127 } service auth { client_limit = 2200 unix_listener /var/spool/postfix/private/auth { mode = 0666 } } service imap-hibernate { unix_listener imap-hibernate { group = dovecot mode = 0660 } } service imap-login { process_limit = 1024 process_min_avail = 12 service_count = 0 vsz_limit = 1 G } service imap { extra_groups = dovecot unix_listener imap-master { user = dovecot } } ssl_cert = </etc/letsencrypt/live/imap.organictrader.com.au/fullchain.pem ssl_key = # hidden, use -P to show it userdb { driver = passwd } protocol imap { mail_max_userip_connections = 20 mail_plugins = fts fts_solr imap_sieve } jason@debian:~$ doveadm -D -f flow fetch imap.envelope mailbox crm-spam.2008.g Debug: Loading modules from directory: /usr/lib/dovecot/modules Debug: Module loaded: /usr/lib/dovecot/modules/lib20_fts_plugin.so Debug: Module loaded: /usr/lib/dovecot/modules/lib21_fts_solr_plugin.so Debug: Loading modules from directory: /usr/lib/dovecot/modules/doveadm Debug: Skipping module doveadm_acl_plugin, because dlopen() failed: /usr/lib/dovecot/modules/doveadm/lib10_doveadm_acl_plugin.so: undefined symbol: acl_user_module (this is usually intentional, so just ignore this message) Debug: Skipping module doveadm_expire_plugin, because dlopen() failed: /usr/lib/dovecot/modules/doveadm/lib10_doveadm_expire_plugin.so: undefined symbol: expire_set_deinit (this is usually intentional, so just ignore this message) Debug: Skipping module doveadm_quota_plugin, because dlopen() failed: /usr/lib/dovecot/modules/doveadm/lib10_doveadm_quota_plugin.so: undefined symbol: quota_user_module (this is usually intentional, so just ignore this message) Debug: Module loaded: /usr/lib/dovecot/modules/doveadm/lib10_doveadm_sieve_plugin.so Debug: Skipping module doveadm_fts_lucene_plugin, because dlopen() failed: /usr/lib/dovecot/modules/doveadm/lib20_doveadm_fts_lucene_plugin.so: undefined symbol: lucene_index_iter_deinit (this is usually intentional, so just ignore this message) Debug: Module loaded: /usr/lib/dovecot/modules/doveadm/lib20_doveadm_fts_plugin.so Debug: Skipping module doveadm_mail_crypt_plugin, because dlopen() failed: /usr/lib/dovecot/modules/doveadm/libdoveadm_mail_crypt_plugin.so: undefined symbol: mail_crypt_box_get_pvt_digests (this is usually intentional, so just ignore this message) doveadm(jason): Debug: Effective uid=1000, gid=1000, home=/home/jason doveadm(jason): Debug: Namespace inbox: type=private, prefix=, sep=, inbox=yes, hidden=no, list=yes, subscriptions=yes location=maildir:~/Maildir doveadm(jason): Debug: maildir++: root=/home/jason/Maildir, index=, indexpvt=, control=, inbox=/home/jason/Maildir, alt= doveadm(jason): Debug: Namespace : Using permissions from /home/jason/Maildir: mode=0700 gid=default doveadm(jason): Debug: Mailbox crm-spam.2008.g: Opened mail UID=38 because: 1/10 headers not cached (first=Sender) (Mail has other cached fields, reset_id=1553472765) doveadm(jason): Panic: file rfc822-parser.h: line 23 (rfc822_parser_deinit): assertion failed: (ctx->data <= ctx->end) doveadm(jason): Error: Raw backtrace: /usr/lib/dovecot/libdovecot.so.0(+0x989ae) [0x7f170b1389ae] -> /usr/lib/dovecot/libdovecot.so.0(+0x98a28) [0x7f170b138a28] -> /usr/lib/dovecot/libdovecot.so.0(i_fatal+0) [0x7f170b0ce67e] -> /usr/lib/dovecot/libdovecot.so.0(+0x7c97d) [0x7f170b11c97d] -> /usr/lib/dovecot/libdovecot.so.0(message_address_parse+0x55) [0x7f170b11c9e5] -> /usr/lib/dovecot/libdovecot.so.0(imap_envelope_parse_header+0x144) [0x7f170b110374] -> /usr/lib/dovecot/libdovecot-storage.so.0(index_mail_parse_header+0xfe) [0x7f170b47422e] -> /usr/lib/dovecot/libdovecot.so.0(+0x7979f) [0x7f170b11979f] -> /usr/lib/dovecot/libdovecot.so.0(i_stream_read+0x53) [0x7f170b1437e3] -> /usr/lib/dovecot/libdovecot.so.0(i_stream_read_data+0x3d) [0x7f170b14422d] -> /usr/lib/dovecot/libdovecot.so.0(message_parse_header_next+0x72) [0x7f170b11f3d2] -> /usr/lib/dovecot/libdovecot.so.0(message_parse_header+0x4f) [0x7f170b11fd7f] -> /usr/lib/dovecot/libdovecot-storage.so.0(index_mail_headers_get_envelope+0x138) [0x7f170b475448] -> /usr/lib/dovecot/libdovecot-storage.so.0(index_mail_get_special+0x1a1) [0x7f170b4796c1] -> /usr/lib/dovecot/libdovecot-storage.so.0(+0x69dd3) [0x7f170b42fdd3] -> /usr/lib/dovecot/libdovecot-storage.so.0(mail_get_special+0xd) [0x7f170b400a8d] -> /usr/bin/doveadm(+0x2dca8) [0x562378dd4ca8] -> /usr/bin/doveadm(+0x2ed7e) [0x562378dd5d7e] -> /usr/bin/doveadm(+0x2a57c) [0x562378dd157c] -> /usr/bin/doveadm(+0x2b0da) [0x562378dd20da] -> /usr/bin/doveadm(doveadm_cmd_ver2_to_mail_cmd_wrapper+0x21f) [0x562378dd2f5f] -> /usr/bin/doveadm(doveadm_cmd_run_ver2+0x560) [0x562378de2390] -> /usr/bin/doveadm(doveadm_cmd_try_run_ver2+0x37) [0x562378de23e7] -> /usr/bin/doveadm(main+0x1e4) [0x562378dc1f44] -> /lib/x86_64-linux-gnu/libc.so.6(__libc_start_main+0xf5) [0x7f170ad16b45] -> /usr/bin/doveadm(+0x1b32c) [0x562378dc232c] Aborted (core dumped) jason@debian:~$ gdb /usr/bin/doveadm /home/jason/core GNU gdb (Debian 7.7.1+dfsg-5) 7.7.1 Copyright (C) 2014 Free Software Foundation, Inc. License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html> This is free software: you are free to change and redistribute it. There is NO WARRANTY, to the extent permitted by law. Type "show copying" and "show warranty" for details. This GDB was configured as "x86_64-linux-gnu". Type "show configuration" for configuration details. For bug reporting instructions, please see: <http://www.gnu.org/software/gdb/bugs/>. Find the GDB manual and other documentation resources online at: <http://www.gnu.org/software/gdb/documentation/>. For help, type "help". Type "apropos word" to search for commands related to "word"... Reading symbols from /usr/bin/doveadm...(no debugging symbols found)...done. [New LWP 22454] Core was generated by `/usr/bin/doveadm -D -f flow fetch imap.envelope mailbox crm-spam.2008.g'. Program terminated with signal SIGABRT, Aborted. #0 0x00007f170ad2a067 in __GI_raise (sig=sig@entry=6) at ../nptl/sysdeps/unix/sysv/linux/raise.c:56 56 ../nptl/sysdeps/unix/sysv/linux/raise.c: No such file or directory. (gdb) bt full #0 0x00007f170ad2a067 in __GI_raise (sig=sig@entry=6) at ../nptl/sysdeps/unix/sysv/linux/raise.c:56 resultvar = 0 pid = 22454 selftid = 22454 #1 0x00007f170ad2b448 in __GI_abort () at abort.c:89 save_stage = 2 act = {__sigaction_handler = {sa_handler = 0x0, sa_sigaction = 0x0}, sa_mask = {__val = {1024, 94710351668199, 94710351535940, 139736942472005, 94710351536940, 0, 94710367714600, 513, 13251895700223756544, 94710367714600, 139736946974659, 94710367714600, 140734907147216, 4294967040, 139736946975017, 94710367714600}}, sa_flags = 185808618, sa_restorer = 0x7fff6625e401} sigs = {__val = {32, 0 <repeats 15 times>}} #2 0x00007f170b1389a6 in ?? () from /usr/lib/dovecot/libdovecot.so.0 No symbol table info available. #3 0x00007f170b138a28 in default_fatal_handler () from /usr/lib/dovecot/libdovecot.so.0 No symbol table info available. #4 0x00007f170b0ce67e in i_panic () from /usr/lib/dovecot/libdovecot.so.0 No symbol table info available. #5 0x00007f170b11c97d in ?? () from /usr/lib/dovecot/libdovecot.so.0 No symbol table info available. #6 0x00007f170b11c9e5 in message_address_parse () from /usr/lib/dovecot/libdovecot.so.0 No symbol table info available. #7 0x00007f170b110374 in imap_envelope_parse_header () from /usr/lib/dovecot/libdovecot.so.0 No symbol table info available. #8 0x00007f170b47422e in index_mail_parse_header () from /usr/lib/dovecot/libdovecot-storage.so.0 No symbol table info available. #9 0x00007f170b11979f in ?? () from /usr/lib/dovecot/libdovecot.so.0 No symbol table info available. #10 0x00007f170b1437e3 in i_stream_read () from /usr/lib/dovecot/libdovecot.so.0 No symbol table info available. #11 0x00007f170b14422d in i_stream_read_data () from /usr/lib/dovecot/libdovecot.so.0 No symbol table info available. #12 0x00007f170b11f3d2 in message_parse_header_next () from /usr/lib/dovecot/libdovecot.so.0 No symbol table info available. #13 0x00007f170b11fd7f in message_parse_header () from /usr/lib/dovecot/libdovecot.so.0 No symbol table info available. #14 0x00007f170b475448 in index_mail_headers_get_envelope () from /usr/lib/dovecot/libdovecot-storage.so.0 No symbol table info available. #15 0x00007f170b4796c1 in index_mail_get_special () from /usr/lib/dovecot/libdovecot-storage.so.0 No symbol table info available. #16 0x00007f170b42fdd3 in ?? () from /usr/lib/dovecot/libdovecot-storage.so.0 No symbol table info available. ---Type <return> to continue, or q <return> to quit--- #17 0x00007f170b400a8d in mail_get_special () from /usr/lib/dovecot/libdovecot-storage.so.0 No symbol table info available. #18 0x0000562378dd4ca8 in ?? () No symbol table info available. #19 0x0000562378dd5d7e in ?? () No symbol table info available. #20 0x0000562378dd157c in ?? () No symbol table info available. #21 0x0000562378dd20da in ?? () No symbol table info available. #22 0x0000562378dd2f5f in doveadm_cmd_ver2_to_mail_cmd_wrapper () No symbol table info available. #23 0x0000562378de2390 in doveadm_cmd_run_ver2 () No symbol table info available. #24 0x0000562378de23e7 in doveadm_cmd_try_run_ver2 () No symbol table info available. #25 0x0000562378dc1f44 in main () No symbol table info available. (gdb) -- Jason Lewis http://emacstragic.net

5 9

Apparmor problem
by Ervin Hegedüs 28 Mar '19

28 Mar '19

Hi there, I know this isn't a Dovecot issue, but hope that somebody can helps me. I've successfully installed and configured Dovecot to a Debian 9 server. Looks like everything works as well, I just see a line in the log when I send a mail: Mar 28 22:21:47 mailng kernel: [3150146.825007] audit: type=1400 audit(1553808107.757:286204): apparmor="DENIED" operation="open" profile="/usr/lib/dovecot/dovecot-lda" name="/usr/share/dovecot/protocols.d/" pid=26197 comm="doveconf" requested_mask="r" denied_mask="r" fsuid=5000 ouid=0 The /usr/share/dovecot/protocols.d/ directory and its content (.../protocols.d/**) set up in usr.lib.dovecot.dovecot-lda apparmor profile with mask "r", but this line every time comes, when I send a mail through webmail - think when the client copies the message to the Sent folder (anyway, the sent messages are in Sent folder after sending, so everything works). Do you have any idea? Thanks, a.

1 0

Hibernation and proxy
by azurit＠pobox.sk 28 Mar '19

28 Mar '19

Hi, does hibernation works well with proxy? Are proxy connections hibernated or not? azur

2 3

Regression ACL & namespace prefix
by Michal Hlavinka 28 Mar '19

28 Mar '19

Hi tl;dr: Seems that for Global ACL directory, namespace prefix is not part of the path, when looking for acl file. Long version: We're planning to update dovecot in next os update to 2.2.36 and while going through regression testing, we found a problem with ACL configuration combined with namespace. Test uses "Global ACL directory" configuration. Relevant configuration part: mail_location = maildir:~/Maildir namespace inbox { hidden = no inbox = yes list = yes location = prefix = separator = / } namespace { hidden = no list = yes location = maildir:/var/mail/pub prefix = pub/ separator = / type = public } mail_plugins = acl protocol imap { mail_plugins = $mail_plugins acl imap_acl } plugin { acl = vfile:/etc/dovecot/global-acls } ACL config file is stored at: /etc/dovecot/global-acls/pub/.DEFAULT when trying to examine "pub", it is denied: fetchmail: IMAP> A0005 EXAMINE "pub" fetchmail: IMAP< A0005 NO Mailbox doesn't exist: pub (0.001 + 0.000 secs). # doveadm acl debug -u d2 pub doveadm(d2): Info: Mailbox '' is in namespace 'pub/' doveadm(d2): Info: Mailbox path: /var/mail/pub doveadm(d2): Info: All message flags are shared across users in mailbox doveadm(d2): Info: User d2 has no rights for mailbox doveadm(d2): Error: User d2 is missing 'lookup' right doveadm(d2): Info: Mailbox pub is NOT visible in LIST because it did not find acl file: imap(d2): Debug: Namespace : type=public, prefix=pub/, sep=/, inbox=no, hidden=no, list=yes, subscriptions=yes location=maildir:/var/mail/pub imap(d2): Debug: maildir++: root=/var/mail/pub, index=, indexpvt=, control=, inbox=, alt= imap(d2): Debug: acl: initializing backend with data: vfile:/etc/dovecot/global-acls imap(d2): Debug: acl: acl username = d2 imap(d2): Debug: acl: owner = 0 imap(d2): Debug: acl vfile: Global ACL legacy directory: /etc/dovecot/global-acls imap(d2): Debug: pub: Mailbox opened because: EXAMINE imap(d2): Debug: acl vfile: file /etc/dovecot/global-acls//.DEFAULT not found imap(d2): Debug: acl vfile: file /var/mail/pub/dovecot-acl not found see it's looking for: /etc/dovecot/global-acls//.DEFAULT instead of /etc/dovecot/global-acls/pub/.DEFAULT Checking with documentation https://wiki.dovecot.org/ACL it seems that prefix should still be part of the path, as it was before: """The filenames must start with namespace prefix (if it has one). For example with namespace prefix=INBOX/ containing mailbox "foo" use /etc/dovecot/acls/INBOX/foo.""" Just for comparison, previous version (2.2.10) would work fine: imap(d2): Debug: Namespace : type=public, prefix=pub/, sep=/, inbox=no, hidden=no, list=yes, subscriptions=yes location=maildir:/var/mail/pub imap(d2): Debug: maildir++: root=/var/mail/pub, index=, indexpvt=, control=, inbox=, alt= imap(d2): Debug: acl: initializing backend with data: vfile:/etc/dovecot/global-acls imap(d2): Debug: acl: acl username = d2 imap(d2): Debug: acl: owner = 0 imap(d2): Debug: acl vfile: Global ACL directory: /etc/dovecot/global-acls imap(d2): Debug: acl vfile: reading file /etc/dovecot/global-acls/pub/.DEFAULT imap(d2): Debug: acl vfile: file /var/mail/pub/dovecot-acl not found I've localized problem to: src/plugins/acl/acl-backend-vfile.c: acl_backend_vfile_object_init(...) and change from: vname = mailbox_list_get_vname(_backend->list, name); to: vname = *name == '\0' ? "" : mailbox_list_get_vname(_backend->list, name); that happened quite time ago during bigger acl changes and I don't know why exactly this line was changed previously. Anyway, reverting this line alone fixes the problem and while testing both per-mailbox ACL vfile and Global ACL file, reverting this did not affect them.

3 7

CVE-2019-7524 backport patch for 2.2.33.2
by Gerald Galster 28 Mar '19

28 Mar '19

Hello Aki, I'm currently stuck with 2.2.33.2 as 2.2.36 still duplicates mails after pop3 deletion on a two node dsync cluster. Therefore I've created a small patch and it seems only these two files are affected: dovecot-2.2.36.3/src/lib-storage/index/index-pop3-uidl.c dovecot-2.2.36.3/src/plugins/fts/fts-api.c Please correct me if I have missed something. Best regards Gerald

2 1

CVE-2019-7524: Buffer overflow when reading extension header from dovecot index files
by Aki Tuomi 28 Mar '19

28 Mar '19

Product: Dovecot Vendor: OX Software GmbH Internal reference: DOV-2964 (Bug ID) Vulnerability type: CWE-120 Vulnerable version: 2.0.14 - 2.3.5 Vulnerable component: fts, pop3-uidl-plugin Report confidence: Confirmed Researcher credits: Found in internal testing Solution status: Fixed by Vendor Fixed version: 2.3.5.1, 2.2.36.3 Vendor notification: 2019-02-05 Solution date: 2019-03-21 Public disclosure: 2019-03-28 CVE reference: CVE-2019-7524 CVSS: 3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:P/RL:O/RC:C (8.8) Vulnerability Details: When reading FTS or POP3-UIDL header from dovecot index, the input buffer size is not bound, and data is copied to target structure causing stack overflow. Risk: This can be used for local root privilege escalation or executing arbitrary code in dovecot process context. This requires ability to directly modify dovecot indexes. Steps to reproduce: Produce dovecot.index.log entry that creates an FTS header which has more than 12 bytes of data. Trigger dovecot indexer-worker or run doveadm index. Dovecot will crash. Mitigations: Since 2.3.0 dovecot has been compiled with stack smash protection, ASLR, read-only GOT tables and other techniques that make exploiting this bug much harder. Solution: Operators should update to the latest Patch Release. The only workaround is to disable FTS and pop3-uidl plugin. -- Aki Tuomi Open-Xchange Oy

2 4

v2.2.36.3 released
by Aki Tuomi 28 Mar '19

28 Mar '19

https://dovecot.org/releases/2.3/dovecot-2.2.36.3.tar.gz https://dovecot.org/releases/2.3/dovecot-2.2.36.3.tar.gz.sig * CVE-2019-7524: Missing input buffer size validation leads into arbitrary buffer overflow when reading fts or pop3 uidl header from Dovecot index. Exploiting this requires direct write access to the index files. --- Aki Tuomi Open-Xchange oy

1 1

dovecot mailing list stopped delivering mail
by Christian Anthon 28 Mar '19

28 Mar '19

Strangest thing. Since some time Marts 25. I'm no longer receiving mails from the dovecot mailing list server. Mails from other sources are behaving fine. Instead I'm just seing Mar 26 08:27:54 dna01 postfix/smtpd[107746]: Anonymous TLS connection established from talvi.dovecot.org[94.237.25.159]: TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits) Mar 26 08:27:54 dna01 postfix/smtpd[107746]: disconnect from talvi.dovecot.org[94.237.25.159] ehlo=1 starttls=1 quit=1 commands=3 And then no more. I tried turning up the postfix verbosity, but I'm none the wiser. I realize that this is probably not a dovecot issue, but anybody with any ideas? Cheers, Christian (and please send an off-list reply also) Verbose log: Mar 28 10:57:42 dna01 postfix/smtpd[66648]: connection established Mar 28 10:57:42 dna01 postfix/smtpd[66648]: master_notify: status 0 Mar 28 10:57:42 dna01 postfix/smtpd[66648]: name_mask: resource Mar 28 10:57:42 dna01 postfix/smtpd[66648]: name_mask: software Mar 28 10:57:42 dna01 postfix/smtpd[66648]: connect from talvi.dovecot.org[94.237.25.159] Mar 28 10:57:42 dna01 postfix/smtpd[66648]: match_list_match: talvi.dovecot.org: no match Mar 28 10:57:42 dna01 postfix/smtpd[66648]: match_list_match: 94.237.25.159: no match Mar 28 10:57:42 dna01 postfix/smtpd[66648]: match_list_match: talvi.dovecot.org: no match Mar 28 10:57:42 dna01 postfix/smtpd[66648]: match_list_match: 94.237.25.159: no match Mar 28 10:57:42 dna01 postfix/smtpd[66648]: smtp_stream_setup: maxtime=300 enable_deadline=0 Mar 28 10:57:42 dna01 postfix/smtpd[66648]: match_hostname: smtpd_client_event_limit_exceptions: talvi.dovecot.org ~? 192.168.3.0/24 Mar 28 10:57:42 dna01 postfix/smtpd[66648]: match_hostaddr: smtpd_client_event_limit_exceptions: 94.237.25.159 ~? 192.168.3.0/24 Mar 28 10:57:42 dna01 postfix/smtpd[66648]: match_hostname: smtpd_client_event_limit_exceptions: talvi.dovecot.org ~? 127.0.0.0/8 Mar 28 10:57:42 dna01 postfix/smtpd[66648]: match_hostaddr: smtpd_client_event_limit_exceptions: 94.237.25.159 ~? 127.0.0.0/8 Mar 28 10:57:42 dna01 postfix/smtpd[66648]: match_list_match: talvi.dovecot.org: no match Mar 28 10:57:42 dna01 postfix/smtpd[66648]: match_list_match: 94.237.25.159: no match Mar 28 10:57:42 dna01 postfix/smtpd[66648]: send attr request = connect Mar 28 10:57:42 dna01 postfix/smtpd[66648]: send attr ident = smtp:94.237.25.159 Mar 28 10:57:42 dna01 postfix/smtpd[66648]: private/anvil: wanted attribute: status Mar 28 10:57:42 dna01 postfix/smtpd[66648]: input attribute name: status Mar 28 10:57:42 dna01 postfix/smtpd[66648]: input attribute value: 0 Mar 28 10:57:42 dna01 postfix/smtpd[66648]: private/anvil: wanted attribute: count Mar 28 10:57:42 dna01 postfix/smtpd[66648]: input attribute name: count Mar 28 10:57:42 dna01 postfix/smtpd[66648]: input attribute value: 1 Mar 28 10:57:42 dna01 postfix/smtpd[66648]: private/anvil: wanted attribute: rate Mar 28 10:57:42 dna01 postfix/smtpd[66648]: input attribute name: rate Mar 28 10:57:42 dna01 postfix/smtpd[66648]: input attribute value: 1 Mar 28 10:57:42 dna01 postfix/smtpd[66648]: private/anvil: wanted attribute: (list terminator) Mar 28 10:57:42 dna01 postfix/smtpd[66648]: input attribute name: (end) Mar 28 10:57:42 dna01 postfix/smtpd[66648]: report connect to all milters Mar 28 10:57:42 dna01 postfix/smtpd[66648]: milter_macro_lookup: "j" Mar 28 10:57:42 dna01 postfix/smtpd[66648]: milter_macro_lookup: result "genome.ku.dk" Mar 28 10:57:42 dna01 postfix/smtpd[66648]: milter_macro_lookup: "{daemon_name}" Mar 28 10:57:42 dna01 postfix/smtpd[66648]: milter_macro_lookup: result "genome.ku.dk" Mar 28 10:57:42 dna01 postfix/smtpd[66648]: milter_macro_lookup: "{daemon_addr}" Mar 28 10:57:42 dna01 postfix/smtpd[66648]: milter_macro_lookup: result "192.168.3.112" Mar 28 10:57:42 dna01 postfix/smtpd[66648]: milter_macro_lookup: "v" Mar 28 10:57:42 dna01 postfix/smtpd[66648]: milter_macro_lookup: result "Postfix 3.3.3" Mar 28 10:57:42 dna01 postfix/smtpd[66648]: milter8_connect: non-protocol events for protocol version 6: Mar 28 10:57:42 dna01 postfix/smtpd[66648]: milter8_connect: transport=inet endpoint=localhost:11332 Mar 28 10:57:42 dna01 postfix/smtpd[66648]: trying... [127.0.0.1] Mar 28 10:57:42 dna01 postfix/smtpd[66648]: vstream_tweak_tcp: TCP_MAXSEG 32741 Mar 28 10:57:42 dna01 postfix/smtpd[66648]: fd=11: stream buffer size old=0 new=65482 Mar 28 10:57:42 dna01 postfix/smtpd[66648]: milter8_connect: my_version=0x6 Mar 28 10:57:42 dna01 postfix/smtpd[66648]: milter8_connect: my_actions=0x1ff SMFIF_ADDHDRS SMFIF_CHGBODY SMFIF_ADDRCPT SMFIF_DELRCPT SMFIF_CHGHDRS SMFIF_QUARANTINE SMFIF_CHGFROM SMFIF_ADDRCPT_PAR SMFIF_SETSYMLIST Mar 28 10:57:42 dna01 postfix/smtpd[66648]: milter8_connect: my_events=0x1fffff SMFIP_NOCONNECT SMFIP_NOHELO SMFIP_NOMAIL SMFIP_NORCPT SMFIP_NOBODY SMFIP_NOHDRS SMFIP_NOEOH SMFIP_NR_HDR SMFIP_NOUNKNOWN SMFIP_NODATA SMFIP_SKIP SMFIP_RCPT_REJ SMFIP_NR_CONN SMFIP_NR_HELO SMFIP_NR_MAIL SMFIP_NR_RCPT SMFIP_NR_DATA SMFIP_NR_UNKN SMFIP_NR_EOH SMFIP_NR_BODY SMFIP_HDR_LEADSPC Mar 28 10:57:42 dna01 postfix/smtpd[66648]: milter8_connect: milter inet:localhost:11332 version 6 Mar 28 10:57:42 dna01 postfix/smtpd[66648]: milter8_connect: events SMFIP_NR_HDR SMFIP_NR_CONN SMFIP_NR_HELO SMFIP_NR_MAIL SMFIP_NR_RCPT SMFIP_NR_DATA SMFIP_NR_UNKN SMFIP_NR_EOH SMFIP_NR_BODY Mar 28 10:57:42 dna01 postfix/smtpd[66648]: milter8_connect: requests SMFIF_ADDHDRS SMFIF_CHGBODY SMFIF_ADDRCPT SMFIF_DELRCPT SMFIF_CHGHDRS SMFIF_QUARANTINE SMFIF_CHGFROM SMFIF_ADDRCPT_PAR SMFIF_SETSYMLIST Mar 28 10:57:42 dna01 postfix/smtpd[66648]: milter8_conn_event: milter inet:localhost:11332: connect talvi.dovecot.org/94.237.25.159 Mar 28 10:57:42 dna01 postfix/smtpd[66648]: event: SMFIC_CONNECT; macros: j=genome.ku.dk {daemon_name}=genome.ku.dk {daemon_addr}=192.168.3.112 v=Postfix 3.3.3 Mar 28 10:57:42 dna01 postfix/smtpd[66648]: skipping reply for event SMFIC_CONNECT from milter inet:localhost:11332 Mar 28 10:57:42 dna01 postfix/smtpd[66648]: > talvi.dovecot.org[94.237.25.159]: 220 genome.ku.dk ESMTP Postfix Mar 28 10:57:42 dna01 postfix/smtpd[66648]: < talvi.dovecot.org[94.237.25.159]: EHLO talvi.dovecot.org Mar 28 10:57:42 dna01 postfix/smtpd[66648]: report helo to all milters Mar 28 10:57:42 dna01 postfix/smtpd[66648]: milter_macro_lookup: "{tls_version}" Mar 28 10:57:42 dna01 postfix/smtpd[66648]: milter_macro_lookup: "{cipher}" Mar 28 10:57:42 dna01 postfix/smtpd[66648]: milter_macro_lookup: "{cipher_bits}" Mar 28 10:57:42 dna01 postfix/smtpd[66648]: milter_macro_lookup: "{cert_subject}" Mar 28 10:57:42 dna01 postfix/smtpd[66648]: milter_macro_lookup: "{cert_issuer}" Mar 28 10:57:42 dna01 postfix/smtpd[66648]: milter8_helo_event: milter inet:localhost:11332: helo talvi.dovecot.org Mar 28 10:57:42 dna01 postfix/smtpd[66648]: event: SMFIC_HELO; macros: (none) Mar 28 10:57:42 dna01 postfix/smtpd[66648]: skipping reply for event SMFIC_HELO from milter inet:localhost:11332 Mar 28 10:57:42 dna01 postfix/smtpd[66648]: match_list_match: talvi.dovecot.org: no match Mar 28 10:57:42 dna01 postfix/smtpd[66648]: match_list_match: 94.237.25.159: no match Mar 28 10:57:42 dna01 postfix/smtpd[66648]: > talvi.dovecot.org[94.237.25.159]: 250-genome.ku.dk Mar 28 10:57:42 dna01 postfix/smtpd[66648]: > talvi.dovecot.org[94.237.25.159]: 250-PIPELINING Mar 28 10:57:42 dna01 postfix/smtpd[66648]: > talvi.dovecot.org[94.237.25.159]: 250-SIZE 150000000 Mar 28 10:57:42 dna01 postfix/smtpd[66648]: > talvi.dovecot.org[94.237.25.159]: 250-VRFY Mar 28 10:57:42 dna01 postfix/smtpd[66648]: > talvi.dovecot.org[94.237.25.159]: 250-ETRN Mar 28 10:57:42 dna01 postfix/smtpd[66648]: > talvi.dovecot.org[94.237.25.159]: 250-STARTTLS Mar 28 10:57:42 dna01 postfix/smtpd[66648]: > talvi.dovecot.org[94.237.25.159]: 250-ENHANCEDSTATUSCODES Mar 28 10:57:42 dna01 postfix/smtpd[66648]: > talvi.dovecot.org[94.237.25.159]: 250-8BITMIME Mar 28 10:57:42 dna01 postfix/smtpd[66648]: > talvi.dovecot.org[94.237.25.159]: 250 DSN Mar 28 10:57:42 dna01 postfix/smtpd[66648]: < talvi.dovecot.org[94.237.25.159]: STARTTLS Mar 28 10:57:42 dna01 postfix/smtpd[66648]: query milter states for other event Mar 28 10:57:42 dna01 postfix/smtpd[66648]: milter8_other_event: milter inet:localhost:11332 Mar 28 10:57:42 dna01 postfix/smtpd[66648]: > talvi.dovecot.org[94.237.25.159]: 220 2.0.0 Ready to start TLS Mar 28 10:57:42 dna01 postfix/smtpd[66648]: abort all milters Mar 28 10:57:42 dna01 postfix/smtpd[66648]: milter8_abort: abort milter inet:localhost:11332 Mar 28 10:57:42 dna01 postfix/smtpd[66648]: auto_clnt_open: connected to private/tlsmgr Mar 28 10:57:42 dna01 postfix/smtpd[66648]: send attr request = seed Mar 28 10:57:42 dna01 postfix/smtpd[66648]: send attr size = 32 Mar 28 10:57:42 dna01 postfix/smtpd[66648]: private/tlsmgr: wanted attribute: status Mar 28 10:57:42 dna01 postfix/smtpd[66648]: input attribute name: status Mar 28 10:57:42 dna01 postfix/smtpd[66648]: input attribute value: 0 Mar 28 10:57:42 dna01 postfix/smtpd[66648]: private/tlsmgr: wanted attribute: seed Mar 28 10:57:42 dna01 postfix/smtpd[66648]: input attribute name: seed Mar 28 10:57:42 dna01 postfix/smtpd[66648]: input attribute value: HIDDEN_BEFORE_POST Mar 28 10:57:42 dna01 postfix/smtpd[66648]: private/tlsmgr: wanted attribute: (list terminator) Mar 28 10:57:42 dna01 postfix/smtpd[66648]: input attribute name: (end) Mar 28 10:57:42 dna01 postfix/smtpd[66648]: send attr request = tktkey Mar 28 10:57:42 dna01 postfix/smtpd[66648]: send attr keyname = [data 16 bytes] Mar 28 10:57:42 dna01 postfix/smtpd[66648]: private/tlsmgr: wanted attribute: status Mar 28 10:57:42 dna01 postfix/smtpd[66648]: input attribute name: status Mar 28 10:57:42 dna01 postfix/smtpd[66648]: input attribute value: 4294967295 Mar 28 10:57:42 dna01 postfix/smtpd[66648]: private/tlsmgr: wanted attribute: keybuf Mar 28 10:57:42 dna01 postfix/smtpd[66648]: input attribute name: keybuf Mar 28 10:57:42 dna01 postfix/smtpd[66648]: input attribute value: HIDDEN_BEFORE_POST Mar 28 10:57:42 dna01 postfix/smtpd[66648]: private/tlsmgr: wanted attribute: (list terminator) Mar 28 10:57:42 dna01 postfix/smtpd[66648]: input attribute name: (end) Mar 28 10:57:42 dna01 postfix/smtpd[66648]: send attr request = tktkey Mar 28 10:57:42 dna01 postfix/smtpd[66648]: send attr keyname = [data 0 bytes] Mar 28 10:57:42 dna01 postfix/smtpd[66648]: private/tlsmgr: wanted attribute: status Mar 28 10:57:42 dna01 postfix/smtpd[66648]: input attribute name: status Mar 28 10:57:42 dna01 postfix/smtpd[66648]: input attribute value: 0 Mar 28 10:57:42 dna01 postfix/smtpd[66648]: private/tlsmgr: wanted attribute: keybuf Mar 28 10:57:42 dna01 postfix/smtpd[66648]: input attribute name: keybuf Mar 28 10:57:42 dna01 postfix/smtpd[66648]: input attribute value: HIDDEN_BEFORE_POST Mar 28 10:57:42 dna01 postfix/smtpd[66648]: private/tlsmgr: wanted attribute: (list terminator) Mar 28 10:57:42 dna01 postfix/smtpd[66648]: input attribute name: (end) Mar 28 10:57:42 dna01 postfix/smtpd[66648]: Anonymous TLS connection established from talvi.dovecot.org[94.237.25.159]: TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits) Mar 28 10:57:42 dna01 postfix/smtpd[66648]: xsasl_dovecot_server_create: SASL service=smtp, realm=(null) Mar 28 10:57:42 dna01 postfix/smtpd[66648]: name_mask: noanonymous Mar 28 10:57:42 dna01 postfix/smtpd[66648]: xsasl_dovecot_server_connect: Connecting Mar 28 10:57:42 dna01 postfix/smtpd[66648]: xsasl_dovecot_server_connect: auth reply: VERSION?1?1 Mar 28 10:57:42 dna01 postfix/smtpd[66648]: xsasl_dovecot_server_connect: auth reply: MECH?PLAIN?plaintext Mar 28 10:57:42 dna01 postfix/smtpd[66648]: name_mask: plaintext Mar 28 10:57:42 dna01 postfix/smtpd[66648]: xsasl_dovecot_server_connect: auth reply: MECH?LOGIN?plaintext Mar 28 10:57:42 dna01 postfix/smtpd[66648]: name_mask: plaintext Mar 28 10:57:42 dna01 postfix/smtpd[66648]: xsasl_dovecot_server_connect: auth reply: SPID?62898 Mar 28 10:57:42 dna01 postfix/smtpd[66648]: xsasl_dovecot_server_connect: auth reply: CUID?107 Mar 28 10:57:42 dna01 postfix/smtpd[66648]: xsasl_dovecot_server_connect: auth reply: COOKIE?HIDDEN_BEFORE_POST Mar 28 10:57:42 dna01 postfix/smtpd[66648]: xsasl_dovecot_server_connect: auth reply: DONE Mar 28 10:57:42 dna01 postfix/smtpd[66648]: xsasl_dovecot_server_mech_filter: keep mechanism: PLAIN Mar 28 10:57:42 dna01 postfix/smtpd[66648]: xsasl_dovecot_server_mech_filter: keep mechanism: LOGIN Mar 28 10:57:42 dna01 postfix/smtpd[66648]: < talvi.dovecot.org[94.237.25.159]: QUIT Mar 28 10:57:42 dna01 postfix/smtpd[66648]: > talvi.dovecot.org[94.237.25.159]: 221 2.0.0 Bye Mar 28 10:57:42 dna01 postfix/smtpd[66648]: match_hostname: smtpd_client_event_limit_exceptions: talvi.dovecot.org ~? 192.168.3.0/24 Mar 28 10:57:42 dna01 postfix/smtpd[66648]: match_hostaddr: smtpd_client_event_limit_exceptions: 94.237.25.159 ~? 192.168.3.0/24 Mar 28 10:57:42 dna01 postfix/smtpd[66648]: match_hostname: smtpd_client_event_limit_exceptions: talvi.dovecot.org ~? 127.0.0.0/8 Mar 28 10:57:42 dna01 postfix/smtpd[66648]: match_hostaddr: smtpd_client_event_limit_exceptions: 94.237.25.159 ~? 127.0.0.0/8 Mar 28 10:57:42 dna01 postfix/smtpd[66648]: match_list_match: talvi.dovecot.org: no match Mar 28 10:57:42 dna01 postfix/smtpd[66648]: match_list_match: 94.237.25.159: no match Mar 28 10:57:42 dna01 postfix/smtpd[66648]: send attr request = disconnect Mar 28 10:57:42 dna01 postfix/smtpd[66648]: send attr ident = smtp:94.237.25.159 Mar 28 10:57:42 dna01 postfix/smtpd[66648]: private/anvil: wanted attribute: status Mar 28 10:57:42 dna01 postfix/smtpd[66648]: input attribute name: status Mar 28 10:57:42 dna01 postfix/smtpd[66648]: input attribute value: 0 Mar 28 10:57:42 dna01 postfix/smtpd[66648]: private/anvil: wanted attribute: (list terminator) Mar 28 10:57:42 dna01 postfix/smtpd[66648]: input attribute name: (end) Mar 28 10:57:42 dna01 postfix/smtpd[66648]: disconnect event to all milters Mar 28 10:57:42 dna01 postfix/smtpd[66648]: milter8_disc_event: quit milter inet:localhost:11332 Mar 28 10:57:42 dna01 postfix/smtpd[66648]: disconnect from talvi.dovecot.org[94.237.25.159] ehlo=1 starttls=1 quit=1 commands=3 Mar 28 10:57:42 dna01 postfix/smtpd[66648]: free all milters Mar 28 10:57:42 dna01 postfix/smtpd[66648]: free milter inet:localhost:11332 Mar 28 10:57:42 dna01 postfix/smtpd[66648]: master_notify: status 1 Mar 28 10:57:42 dna01 postfix/smtpd[66648]: connection closed Mar 28 10:57:47 dna01 postfix/smtpd[66648]: auto_clnt_close: disconnect private/tlsmgr stream Mar 28 10:57:55 dna01 postfix/smtpd[66648]: connection established Mar 28 10:57:55 dna01 postfix/smtpd[66648]: master_notify: status 0 Mar 28 10:57:55 dna01 postfix/smtpd[66648]: name_mask: resource Mar 28 10:57:55 dna01 postfix/smtpd[66648]: name_mask: software Mar 28 10:57:55 dna01 postfix/smtpd[66648]: connect from talvi.dovecot.org[94.237.25.159] Mar 28 10:57:55 dna01 postfix/smtpd[66648]: match_list_match: talvi.dovecot.org: no match Mar 28 10:57:55 dna01 postfix/smtpd[66648]: match_list_match: 94.237.25.159: no match Mar 28 10:57:55 dna01 postfix/smtpd[66648]: match_list_match: talvi.dovecot.org: no match Mar 28 10:57:55 dna01 postfix/smtpd[66648]: match_list_match: 94.237.25.159: no match Mar 28 10:57:55 dna01 postfix/smtpd[66648]: smtp_stream_setup: maxtime=300 enable_deadline=0 Mar 28 10:57:55 dna01 postfix/smtpd[66648]: match_hostname: smtpd_client_event_limit_exceptions: talvi.dovecot.org ~? 192.168.3.0/24 Mar 28 10:57:55 dna01 postfix/smtpd[66648]: match_hostaddr: smtpd_client_event_limit_exceptions: 94.237.25.159 ~? 192.168.3.0/24 Mar 28 10:57:55 dna01 postfix/smtpd[66648]: match_hostname: smtpd_client_event_limit_exceptions: talvi.dovecot.org ~? 127.0.0.0/8 Mar 28 10:57:55 dna01 postfix/smtpd[66648]: match_hostaddr: smtpd_client_event_limit_exceptions: 94.237.25.159 ~? 127.0.0.0/8 Mar 28 10:57:55 dna01 postfix/smtpd[66648]: match_list_match: talvi.dovecot.org: no match Mar 28 10:57:55 dna01 postfix/smtpd[66648]: match_list_match: 94.237.25.159: no match Mar 28 10:57:55 dna01 postfix/smtpd[66648]: send attr request = connect Mar 28 10:57:55 dna01 postfix/smtpd[66648]: send attr ident = smtp:94.237.25.159 Mar 28 10:57:55 dna01 postfix/smtpd[66648]: private/anvil: wanted attribute: status Mar 28 10:57:55 dna01 postfix/smtpd[66648]: input attribute name: status Mar 28 10:57:55 dna01 postfix/smtpd[66648]: input attribute value: 0 Mar 28 10:57:55 dna01 postfix/smtpd[66648]: private/anvil: wanted attribute: count Mar 28 10:57:55 dna01 postfix/smtpd[66648]: input attribute name: count Mar 28 10:57:55 dna01 postfix/smtpd[66648]: input attribute value: 1 Mar 28 10:57:55 dna01 postfix/smtpd[66648]: private/anvil: wanted attribute: rate Mar 28 10:57:55 dna01 postfix/smtpd[66648]: input attribute name: rate Mar 28 10:57:55 dna01 postfix/smtpd[66648]: input attribute value: 2 Mar 28 10:57:55 dna01 postfix/smtpd[66648]: private/anvil: wanted attribute: (list terminator) Mar 28 10:57:55 dna01 postfix/smtpd[66648]: input attribute name: (end) Mar 28 10:57:55 dna01 postfix/smtpd[66648]: report connect to all milters Mar 28 10:57:55 dna01 postfix/smtpd[66648]: milter_macro_lookup: "j" Mar 28 10:57:55 dna01 postfix/smtpd[66648]: milter_macro_lookup: result "genome.ku.dk" Mar 28 10:57:55 dna01 postfix/smtpd[66648]: milter_macro_lookup: "{daemon_name}" Mar 28 10:57:55 dna01 postfix/smtpd[66648]: milter_macro_lookup: result "genome.ku.dk" Mar 28 10:57:55 dna01 postfix/smtpd[66648]: milter_macro_lookup: "{daemon_addr}" Mar 28 10:57:55 dna01 postfix/smtpd[66648]: milter_macro_lookup: result "192.168.3.112" Mar 28 10:57:55 dna01 postfix/smtpd[66648]: milter_macro_lookup: "v" Mar 28 10:57:55 dna01 postfix/smtpd[66648]: milter_macro_lookup: result "Postfix 3.3.3" Mar 28 10:57:55 dna01 postfix/smtpd[66648]: milter8_connect: non-protocol events for protocol version 6: Mar 28 10:57:55 dna01 postfix/smtpd[66648]: milter8_connect: transport=inet endpoint=localhost:11332 Mar 28 10:57:55 dna01 postfix/smtpd[66648]: trying... [127.0.0.1] Mar 28 10:57:55 dna01 postfix/smtpd[66648]: vstream_tweak_tcp: TCP_MAXSEG 32741 Mar 28 10:57:55 dna01 postfix/smtpd[66648]: fd=11: stream buffer size old=0 new=65482 Mar 28 10:57:55 dna01 postfix/smtpd[66648]: milter8_connect: my_version=0x6 Mar 28 10:57:55 dna01 postfix/smtpd[66648]: milter8_connect: my_actions=0x1ff SMFIF_ADDHDRS SMFIF_CHGBODY SMFIF_ADDRCPT SMFIF_DELRCPT SMFIF_CHGHDRS SMFIF_QUARANTINE SMFIF_CHGFROM SMFIF_ADDRCPT_PAR SMFIF_SETSYMLIST Mar 28 10:57:55 dna01 postfix/smtpd[66648]: milter8_connect: my_events=0x1fffff SMFIP_NOCONNECT SMFIP_NOHELO SMFIP_NOMAIL SMFIP_NORCPT SMFIP_NOBODY SMFIP_NOHDRS SMFIP_NOEOH SMFIP_NR_HDR SMFIP_NOUNKNOWN SMFIP_NODATA SMFIP_SKIP SMFIP_RCPT_REJ SMFIP_NR_CONN SMFIP_NR_HELO SMFIP_NR_MAIL SMFIP_NR_RCPT SMFIP_NR_DATA SMFIP_NR_UNKN SMFIP_NR_EOH SMFIP_NR_BODY SMFIP_HDR_LEADSPC Mar 28 10:57:55 dna01 postfix/smtpd[66648]: milter8_connect: milter inet:localhost:11332 version 6 Mar 28 10:57:55 dna01 postfix/smtpd[66648]: milter8_connect: events SMFIP_NR_HDR SMFIP_NR_CONN SMFIP_NR_HELO SMFIP_NR_MAIL SMFIP_NR_RCPT SMFIP_NR_DATA SMFIP_NR_UNKN SMFIP_NR_EOH SMFIP_NR_BODY Mar 28 10:57:55 dna01 postfix/smtpd[66648]: milter8_connect: requests SMFIF_ADDHDRS SMFIF_CHGBODY SMFIF_ADDRCPT SMFIF_DELRCPT SMFIF_CHGHDRS SMFIF_QUARANTINE SMFIF_CHGFROM SMFIF_ADDRCPT_PAR SMFIF_SETSYMLIST Mar 28 10:57:55 dna01 postfix/smtpd[66648]: milter8_conn_event: milter inet:localhost:11332: connect talvi.dovecot.org/94.237.25.159 Mar 28 10:57:55 dna01 postfix/smtpd[66648]: event: SMFIC_CONNECT; macros: j=genome.ku.dk {daemon_name}=genome.ku.dk {daemon_addr}=192.168.3.112 v=Postfix 3.3.3 Mar 28 10:57:55 dna01 postfix/smtpd[66648]: skipping reply for event SMFIC_CONNECT from milter inet:localhost:11332 Mar 28 10:57:55 dna01 postfix/smtpd[66648]: > talvi.dovecot.org[94.237.25.159]: 220 genome.ku.dk ESMTP Postfix Mar 28 10:57:55 dna01 postfix/smtpd[66648]: < talvi.dovecot.org[94.237.25.159]: EHLO talvi.dovecot.org Mar 28 10:57:55 dna01 postfix/smtpd[66648]: report helo to all milters Mar 28 10:57:55 dna01 postfix/smtpd[66648]: milter_macro_lookup: "{tls_version}" Mar 28 10:57:55 dna01 postfix/smtpd[66648]: milter_macro_lookup: "{cipher}" Mar 28 10:57:55 dna01 postfix/smtpd[66648]: milter_macro_lookup: "{cipher_bits}" Mar 28 10:57:55 dna01 postfix/smtpd[66648]: milter_macro_lookup: "{cert_subject}" Mar 28 10:57:55 dna01 postfix/smtpd[66648]: milter_macro_lookup: "{cert_issuer}" Mar 28 10:57:55 dna01 postfix/smtpd[66648]: milter8_helo_event: milter inet:localhost:11332: helo talvi.dovecot.org Mar 28 10:57:55 dna01 postfix/smtpd[66648]: event: SMFIC_HELO; macros: (none) Mar 28 10:57:55 dna01 postfix/smtpd[66648]: skipping reply for event SMFIC_HELO from milter inet:localhost:11332 Mar 28 10:57:55 dna01 postfix/smtpd[66648]: match_list_match: talvi.dovecot.org: no match Mar 28 10:57:55 dna01 postfix/smtpd[66648]: match_list_match: 94.237.25.159: no match Mar 28 10:57:55 dna01 postfix/smtpd[66648]: > talvi.dovecot.org[94.237.25.159]: 250-genome.ku.dk Mar 28 10:57:55 dna01 postfix/smtpd[66648]: > talvi.dovecot.org[94.237.25.159]: 250-PIPELINING Mar 28 10:57:55 dna01 postfix/smtpd[66648]: > talvi.dovecot.org[94.237.25.159]: 250-SIZE 150000000 Mar 28 10:57:55 dna01 postfix/smtpd[66648]: > talvi.dovecot.org[94.237.25.159]: 250-VRFY Mar 28 10:57:55 dna01 postfix/smtpd[66648]: > talvi.dovecot.org[94.237.25.159]: 250-ETRN Mar 28 10:57:55 dna01 postfix/smtpd[66648]: > talvi.dovecot.org[94.237.25.159]: 250-STARTTLS Mar 28 10:57:55 dna01 postfix/smtpd[66648]: > talvi.dovecot.org[94.237.25.159]: 250-ENHANCEDSTATUSCODES Mar 28 10:57:55 dna01 postfix/smtpd[66648]: > talvi.dovecot.org[94.237.25.159]: 250-8BITMIME Mar 28 10:57:55 dna01 postfix/smtpd[66648]: > talvi.dovecot.org[94.237.25.159]: 250 DSN Mar 28 10:57:55 dna01 postfix/smtpd[66648]: < talvi.dovecot.org[94.237.25.159]: STARTTLS Mar 28 10:57:55 dna01 postfix/smtpd[66648]: query milter states for other event Mar 28 10:57:55 dna01 postfix/smtpd[66648]: milter8_other_event: milter inet:localhost:11332 Mar 28 10:57:55 dna01 postfix/smtpd[66648]: > talvi.dovecot.org[94.237.25.159]: 220 2.0.0 Ready to start TLS Mar 28 10:57:55 dna01 postfix/smtpd[66648]: abort all milters Mar 28 10:57:55 dna01 postfix/smtpd[66648]: milter8_abort: abort milter inet:localhost:11332 Mar 28 10:57:55 dna01 postfix/smtpd[66648]: auto_clnt_open: connected to private/tlsmgr Mar 28 10:57:55 dna01 postfix/smtpd[66648]: send attr request = seed Mar 28 10:57:55 dna01 postfix/smtpd[66648]: send attr size = 32 Mar 28 10:57:55 dna01 postfix/smtpd[66648]: private/tlsmgr: wanted attribute: status Mar 28 10:57:55 dna01 postfix/smtpd[66648]: input attribute name: status Mar 28 10:57:55 dna01 postfix/smtpd[66648]: input attribute value: 0 Mar 28 10:57:55 dna01 postfix/smtpd[66648]: private/tlsmgr: wanted attribute: seed Mar 28 10:57:55 dna01 postfix/smtpd[66648]: input attribute name: seed Mar 28 10:57:55 dna01 postfix/smtpd[66648]: input attribute value: HIDDEN_BEFORE_POST Mar 28 10:57:55 dna01 postfix/smtpd[66648]: private/tlsmgr: wanted attribute: (list terminator) Mar 28 10:57:55 dna01 postfix/smtpd[66648]: input attribute name: (end) Mar 28 10:57:55 dna01 postfix/smtpd[66648]: Anonymous TLS connection established from talvi.dovecot.org[94.237.25.159]: TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits) Mar 28 10:57:55 dna01 postfix/smtpd[66648]: xsasl_dovecot_server_create: SASL service=smtp, realm=(null) Mar 28 10:57:55 dna01 postfix/smtpd[66648]: name_mask: noanonymous Mar 28 10:57:55 dna01 postfix/smtpd[66648]: xsasl_dovecot_server_mech_filter: keep mechanism: PLAIN Mar 28 10:57:55 dna01 postfix/smtpd[66648]: xsasl_dovecot_server_mech_filter: keep mechanism: LOGIN Mar 28 10:57:55 dna01 postfix/smtpd[66648]: < talvi.dovecot.org[94.237.25.159]: QUIT Mar 28 10:57:55 dna01 postfix/smtpd[66648]: > talvi.dovecot.org[94.237.25.159]: 221 2.0.0 Bye Mar 28 10:57:55 dna01 postfix/smtpd[66648]: match_hostname: smtpd_client_event_limit_exceptions: talvi.dovecot.org ~? 192.168.3.0/24 Mar 28 10:57:55 dna01 postfix/smtpd[66648]: match_hostaddr: smtpd_client_event_limit_exceptions: 94.237.25.159 ~? 192.168.3.0/24 Mar 28 10:57:55 dna01 postfix/smtpd[66648]: match_hostname: smtpd_client_event_limit_exceptions: talvi.dovecot.org ~? 127.0.0.0/8 Mar 28 10:57:55 dna01 postfix/smtpd[66648]: match_hostaddr: smtpd_client_event_limit_exceptions: 94.237.25.159 ~? 127.0.0.0/8 Mar 28 10:57:55 dna01 postfix/smtpd[66648]: match_list_match: talvi.dovecot.org: no match Mar 28 10:57:55 dna01 postfix/smtpd[66648]: match_list_match: 94.237.25.159: no match Mar 28 10:57:55 dna01 postfix/smtpd[66648]: send attr request = disconnect Mar 28 10:57:55 dna01 postfix/smtpd[66648]: send attr ident = smtp:94.237.25.159 Mar 28 10:57:55 dna01 postfix/smtpd[66648]: private/anvil: wanted attribute: status Mar 28 10:57:55 dna01 postfix/smtpd[66648]: input attribute name: status Mar 28 10:57:55 dna01 postfix/smtpd[66648]: input attribute value: 0 Mar 28 10:57:55 dna01 postfix/smtpd[66648]: private/anvil: wanted attribute: (list terminator) Mar 28 10:57:55 dna01 postfix/smtpd[66648]: input attribute name: (end) Mar 28 10:57:55 dna01 postfix/smtpd[66648]: disconnect event to all milters Mar 28 10:57:55 dna01 postfix/smtpd[66648]: milter8_disc_event: quit milter inet:localhost:11332 Mar 28 10:57:55 dna01 postfix/smtpd[66648]: disconnect from talvi.dovecot.org[94.237.25.159] ehlo=1 starttls=1 quit=1 commands=3 Mar 28 10:57:55 dna01 postfix/smtpd[66648]: free all milters Mar 28 10:57:55 dna01 postfix/smtpd[66648]: free milter inet:localhost:11332 Mar 28 10:57:55 dna01 postfix/smtpd[66648]: master_notify: status 1 Mar 28 10:57:55 dna01 postfix/smtpd[66648]: connection closed Mar 28 10:58:00 dna01 postfix/smtpd[66648]: auto_clnt_close: disconnect private/tlsmgr stream -- Christian Anthon

2 2

v2.3.5.1 released
by Aki Tuomi 28 Mar '19

28 Mar '19

https://dovecot.org/releases/2.3/dovecot-2.3.5.1.tar.gz https://dovecot.org/releases/2.3/dovecot-2.3.5.1.tar.gz.sig Binary packages in https://repo.dovecot.org/ * CVE-2019-7524: Missing input buffer size validation leads into arbitrary buffer overflow when reading fts or pop3 uidl header from Dovecot index. Exploiting this requires direct write access to the index files. --- Aki Tuomi Open-Xchange oy

2 2

Panic: file mail-transaction-log-file.c: line 105 (mail_transaction_log_file_free): assertion failed: (!file->locked)
by Arkadiusz Miśkiewicz 28 Mar '19

28 Mar '19

Hello. I have one account with heavy traffic (big mails) and quite often indexes get corrupted. This is dovecot 2.3.5 on local fs (xfs), Linux kernel 4.19.20, glibc 2.28. When corruption happens lmtp and pop3 segfault on accessing it like: > Mar 27 11:13:50 mbox dovecot[22370]: lmtp(24428): Connect from local [0/0] > Mar 27 11:13:50 mbox dovecot[22370]: lmtp(piast_efaktury): pid=<24428> session=<QLacCN5Mm1xsXwAA9fPEKQ>, Error: Index /var/mail/piast_efaktury/dovecot.index: Lost log for seq=13 offset=25648: Missing middle file seq=13 (between 13..4294967295, we have seqs 14,15): .log.2 contains file_seq=14 (initial_mapped=0, reason=Index mapped) > Mar 27 11:13:50 mbox dovecot[22370]: lmtp(piast_efaktury): pid=<24428> session=<QLacCN5Mm1xsXwAA9fPEKQ>, Warning: fscking index file /var/mail/piast_efaktury/dovecot.index > Mar 27 11:13:50 mbox dovecot[22370]: lmtp(piast_efaktury): pid=<24428> session=<QLacCN5Mm1xsXwAA9fPEKQ>, Error: Fixed index file /var/mail/piast_efaktury/dovecot.index: log_file_seq 13 -> 15 > Mar 27 11:13:50 mbox dovecot[22370]: lmtp(piast_efaktury): pid=<24428> session=<QLacCN5Mm1xsXwAA9fPEKQ>, Panic: file mail-transaction-log-file.c: line 105 (mail_transaction_log_file_free): assertion failed: (!file->locked) > Mar 27 11:13:50 mbox dovecot[22370]: lmtp(piast_efaktury): pid=<24428> session=<QLacCN5Mm1xsXwAA9fPEKQ>, Error: Raw backtrace: /usr/lib64/dovecot/libdovecot.so.0(+0xe011b) [0x7f25fc82b11b] -> /usr/lib64/dovecot/libdovecot.so.0(+0xe01b1) [0x7f25fc82b1b1] -> /usr/lib64/dovecot/libdovecot.so.0(+0x4bf56) [0x7f25fc796f56] -> /usr/lib64/dovecot/libdovecot-storage.so.0(+0x4b17e) [0x7f25fc92f17e] -> /usr/lib64/dovecot/libdovecot-storage.so.0(mail_transaction_logs_clean+0x5c) [0x7f25fc9e6e3c] -> /usr/lib64/dovecot/libdovecot-storage.so.0(mail_transaction_log_close+0x34) [0x7f25fc9e6f04] -> /usr/lib64/dovecot/libdovecot-storage.so.0(mail_transaction_log_move_to_memory+0xed) [0x7f25fc9e709d] -> /usr/lib64/dovecot/libdovecot-storage.so.0(mail_index_move_to_memory+0x60) [0x7f25fc9e10b0] -> /usr/lib64/dovecot/libdovecot-storage.so.0(mail_index_write+0x1e1) [0x7f25fc9df3a1] -> /usr/lib64/dovecot/libdovecot-storage.so.0(mail_index_fsck+0x68a) [0x7f25fc9ca13a] -> /usr/lib64/dovecot/libdovecot-storage.so.0(mail_index_sync_map+0x5b0) [0x7f25fc9d4090] -> /usr/lib64/dovecot/libdovecot-storage.so.0(mail_index_map+0x13b) [0x7f25fc9cc1eb] -> /usr/lib64/dovecot/libdovecot-storage.so.0(+0xfcc96) [0x7f25fc9e0c96] -> /usr/lib64/dovecot/libdovecot-storage.so.0(+0xfd2a7) [0x7f25fc9e12a7] -> /usr/lib64/dovecot/libdovecot-storage.so.0(mail_index_open+0x7a) [0x7f25fc9e13aa] -> /usr/lib64/dovecot/libdovecot-storage.so.0(index_storage_mailbox_open+0xac) [0x7f25fc9bac1c] -> /usr/lib64/dovecot/libdovecot-storage.so.0(+0x84df9) [0x7f25fc968df9] -> /usr/lib64/dovecot/libdovecot-storage.so.0(+0x84ecf) [0x7f25fc968ecf] -> /usr/lib64/dovecot/libdovecot-storage.so.0(+0xbe11c) [0x7f25fc9a211c] -> /usr/lib64/dovecot/plugins/lib20_zlib_plugin.so(+0x46ee) [0x7f25f8ff86ee] -> /usr/lib64/dovecot/libdovecot-storage.so.0(+0x5bd56) [0x7f25fc93fd56] -> /usr/lib64/dovecot/libdovecot-storage.so.0(mailbox_open+0x4a) [0x7f25fc93ff3a] -> /usr/lib64/dovecot/libdovecot-lda.so.0(mail_deliver_save_open+0x63) [0x7f25fca49cc3] -> /usr/lib64/dovecot/libdovecot-lda.so.0(mail_deliver_save+0xc9) [0x7f25fca49f29] -> /usr/lib64/dovecot/libdovecot-lda.so.0(mail_deliver+0x1c6) [0x7f25fca4a586] -> dovecot/lmtp [local DATA](lmtp_local_data+0x6a1) [0x55e3e295a551] -> dovecot/lmtp [local DATA](cmd_data_continue+0x25d) [0x55e3e295920d] -> /usr/lib64/dovecot/libdovecot.so.0(+0x65737) [0x7f25fc7b0737] > Mar 27 11:13:50 mbox dovecot[22370]: lmtp(piast_efaktury): pid=<24428> session=<QLacCN5Mm1xsXwAA9fPEKQ>, Fatal: master: service(lmtp): child 24428 killed with signal 6 (core dumped) > ~ lmtp backtrace: http://ixion.pld-linux.org/~arekm/dovecot/lmtp-gdb.txt log: http://ixion.pld-linux.org/~arekm/dovecot/lmtp.txt pop3 backtrace: http://ixion.pld-linux.org/~arekm/dovecot/pop3-gdb.txt log: http://ixion.pld-linux.org/~arekm/dovecot/pop3.txt deleting dovecot.index* helps until problem starts again like - first entry with problem after deleting indexes: > Mar 26 14:18:12 mbox dovecot[10001]: pop3-login: Login: user=<piast_efaktury>, method=PLAIN, rip=1.1.1.1, lip=2.2.2.2, mpid=5694, session=</YwtJ/+EZPG5sziF> > Mar 26 14:18:12 mbox dovecot[10001]: pop3(piast_efaktury): pid=<5694> session=</YwtJ/+EZPG5sziF>, Error: Index /var/mail/piast_efaktury/dovecot.index: Lost log for seq=13 offset=25648: Missing middle file seq=13 (between 13..4294967295, we have seqs 14,15): .log.2 contains file_seq=14 (initial_mapped=0, reason=Index mapped) > Mar 26 14:18:12 mbox dovecot[10001]: pop3(piast_efaktury): pid=<5694> session=</YwtJ/+EZPG5sziF>, Warning: fscking index file /var/mail/piast_efaktury/dovecot.index > Mar 26 14:18:12 mbox dovecot[10001]: pop3(piast_efaktury): pid=<5694> session=</YwtJ/+EZPG5sziF>, Error: Fixed index file /var/mail/piast_efaktury/dovecot.index: log_file_seq 13 -> 15 > Mar 26 14:18:12 mbox dovecot[10001]: pop3(piast_efaktury): pid=<5694> session=</YwtJ/+EZPG5sziF>, Panic: file mail-transaction-log-file.c: line 105 (mail_transaction_log_file_free): assertion failed: (!file->locked) > Mar 26 14:18:12 mbox dovecot[10001]: pop3(piast_efaktury): pid=<5694> session=</YwtJ/+EZPG5sziF>, Error: Raw backtrace: /usr/lib64/dovecot/libdovecot.so.0(+0xe011b) [0x7f20b6e2911b] -> /usr/lib64/dovecot/libdovecot.so.0(+0xe01b1) [0x7f20b6e291b1] -> /usr/lib64/dovecot/libdovecot.so.0(+0x4bf56) [0x7f20b6d94f56] -> /usr/lib64/dovecot/libdovecot-storage.so.0(+0x4b17e) [0x7f20b6f2d17e] -> /usr/lib64/dovecot/libdovecot-storage.so.0(mail_transaction_logs_clean+0x5c) [0x7f20b6fe4e3c] -> /usr/lib64/dovecot/libdovecot-storage.so.0(mail_transaction_log_close+0x34) [0x7f20b6fe4f04] -> /usr/lib64/dovecot/libdovecot-storage.so.0(mail_transaction_log_move_to_memory+0xed) [0x7f20b6fe509d] -> /usr/lib64/dovecot/libdovecot-storage.so.0(mail_index_move_to_memory+0x60) [0x7f20b6fdf0b0] -> /usr/lib64/dovecot/libdovecot-storage.so.0(mail_index_write+0x1e1) [0x7f20b6fdd3a1] -> /usr/lib64/dovecot/libdovecot-storage.so.0(mail_index_fsck+0x68a) [0x7f20b6fc813a] -> /usr/lib64/dovecot/libdovecot-storage.so.0(mail_index_sync_map+0x5b0) [0x7f20b6fd2090] -> /usr/lib64/dovecot/libdovecot-storage.so.0(mail_index_map+0x13b) [0x7f20b6fca1eb] -> /usr/lib64/dovecot/libdovecot-storage.so.0(+0xfcc96) [0x7f20b6fdec96] -> /usr/lib64/dovecot/libdovecot-storage.so.0(+0xfd2a7) [0x7f20b6fdf2a7] -> /usr/lib64/dovecot/libdovecot-storage.so.0(mail_index_open+0x7a) [0x7f20b6fdf3aa] -> /usr/lib64/dovecot/libdovecot-storage.so.0(index_storage_mailbox_open+0xac) [0x7f20b6fb8c1c] -> /usr/lib64/dovecot/libdovecot-storage.so.0(+0x84df9) [0x7f20b6f66df9] -> /usr/lib64/dovecot/libdovecot-storage.so.0(+0x84ecf) [0x7f20b6f66ecf] -> /usr/lib64/dovecot/libdovecot-storage.so.0(+0xbe11c) [0x7f20b6fa011c] -> /usr/lib64/dovecot/plugins/lib20_zlib_plugin.so(+0x46ee) [0x7f20b36896ee] -> /usr/lib64/dovecot/libdovecot-storage.so.0(+0x5bd56) [0x7f20b6f3dd56] -> /usr/lib64/dovecot/libdovecot-storage.so.0(mailbox_open+0x4a) [0x7f20b6f3df3a] -> dovecot/pop3 [piast_efaktury 1.1.1.1](client_init_mailbox+0x7a) [0x5638a04d1bda] -> dovecot/pop3 [piast_efaktury 1.1.1.1](+0x5645) [0x5638a04d0645] -> dovecot/pop3 [piast_efaktury 1.1.1.1](+0x5882) [0x5638a04d0882] -> /usr/lib64/dovecot/libdovecot.so.0(+0x74021) [0x7f20b6dbd021] -> /usr/lib64/dovecot/libdovecot.so.0(+0x7439b) [0x7f20b6dbd39b] -> /usr/lib64/dovecot/libdovecot.so.0(+0x74d1d) [0x7f20b6dbdd1d] > Mar 26 14:18:12 mbox dovecot[10001]: pop3(piast_efaktury): pid=<5694> session=</YwtJ/+EZPG5sziF>, Fatal: master: service(pop3): child 5694 killed with signal 6 (core dumps disabled - https://dovecot.org/bugreport.html#coredumps) dovecot isn't able to auto fix the indexes and manual deletion is required in all such cases -- Arkadiusz Miśkiewicz, arekm / ( maven.pl | pld-linux.org )

2 5

MailCrypt: Encrypted user keys configuration with LDAP & cryptokey generate
by FELINN 28 Mar '19

28 Mar '19

Hi, I try to use the MailCrypt plugin with Floder encryption and encrypted user keys, using LDAP. I use Dovecot 2.2.27 (c0f36b0) I follow the wiki: https://wiki2.dovecot.org/Plugins/MailCrypt doveconf -n and dovecot-ldap.conf.ext attached to this message. I well configured slapd to let dovecot's dn query the userPassword (hashed password SSHA). I use fusiondirectory-mail plugin: ------------------------------------------------------------------------ $ ldapsearch -D 'cn=dovecot,ou=dsa,dc=foo,dc=bar' -W -LLL '(&(objectClass=gosaMailAccount)(objectClass=posixAccount)(uid=<user>))' 'userPassword' dn: cn=<user>,ou=people,dc=foo,dc=bar userPassword:: XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX ------------------------------------------------------------------------ The problem is that mails still readable and no keys are generated, even if a send a mail to this address, or login through webmail. I wait more than 1h until something happens, Cf: https://dovecot.org/list/dovecot/2018-September/112763.html If I try to generate keys manually I get this error: ------------------------------------------------------------------------ $ doeveadm mailbox cryptokey generate -u <user> doveadm(<user>): Error: mail_crypt_user_generate_keypair(<user>) failed: mail_crypt_require_encrypted_user_key set, cannot generate user keypair without password or key Folder Public ID x ERROR: mail_crypt_require_encrypted_user_key set, cannot generate user keypair without password or key doveadm(<user>): Warning: Timeout leak: 0x7f0c439c0180 (mail-index-alloc-cache.c:240) ------------------------------------------------------------------------ It works with -o plugin/mail_crypt_private_password=<password> of course, but by hand it's not the goal >< I probably miss something, I guess that the part of the wiki about sql and password_query is only for configuration that use SQL for dbuser. Is there similar things to do with LDAP? Thank you very much for your time. -- f00wl FELINN https://felinn.org

1 1

Weird things in the mail queue
by Lionel Elie Mamane 27 Mar '19

27 Mar '19

I noticed a mail stuck in my mail queue. dovecot-lda was returning error 64 Invalid parameter given. (EX_USAGE). Weird, weird, weird. After some sleuthing, I found the sender address was FirstLast(a)domain.tld, with a UTF8-encoded Unicode U+FEFF ZERO WIDTH NO-BREAK SPACE character (AKA byte order mark) between "First" and "Last" :) Since that is passed as the -f parameter to dovecot-lda, it was giving the 64 error.

3 3

Maildir permissions issue with Postfix
by Randall R. Sargent 27 Mar '19

27 Mar '19

Hi all, We have a Postfix server that serves as an alias MTA to route to other mail systems. I've recently installed Dovecot on it because we have three service accounts that need simple POP3 mailboxes. I have the accounts set up on the system and mail does get delivered to their ~/Maildir/ locations by Postfix, however, every time a message is dropped in the Maildir for the user, the permissions for the message are set to the user's uid:gid and Dovecot can't access the mail message. Doing a chmod fixes it temporarily until the next message drops. The vmail group has access to the user's home folder structure. Any help is appreciated!! Dovecot: 2.2.36 /etc/dovecot/dovecot.conf: auth_debug = yes disable_plaintext_auth = no first_valid_uid = 1002 log_path = /var/log/dovecot.log mail_debug = yes mail_home = /srv/mail/%Lu mail_location = maildir:~/Maildir mbox_very_dirty_syncs = yes namespace { inbox = yes location = prefix = separator = / } passdb { driver = pam } service auth-worker { user = root } userdb { args = blocking=no driver = passwd override_fields = uid=vmail gid=vmail } Thanks, Randy

2 1

doveadm backup doesn't transfer mail from root INBOX
by Francis 27 Mar '19

27 Mar '19

Hi, I'm trying to migrate IMAP mails from dovecot 1.1.20apple0.5 (osx) to dovecot 2.2.33.2 (ubuntu). I'm using "doveadm backup" to migrate my data. It works fine for all subfolders, but the root INBOX stay empty on the new server. I suspect a problem related with hierarchy separator ("." on previous server, "/" on new) or with the namespace prefix (set to "INBOX/" on new server). Any hint? Thanks. show there is no messages in INBOX # doveadm mailbox status -u (myuser) all INBOX INBOX messages=0 recent=0 uidnext=1 uidvalidity=1553630060 unseen=0 highestmodseq=1 vsize=0 guid=d54cd42849739b5cb5790000ed87e144 firstsaved=18446744073709551615 show there is messages in subdirectory # doveadm mailbox status -u (myuser) all INBOX/Sent INBOX/Sent messages=253 recent=0 uidnext=8721 uidvalidity=1263328366 unseen=0 highestmodseq=256 vsize=16335358 guid=bfb2e03fdce327671e82bf173b1ccb8b firstsaved=1553634631 The command I'm runnning on the new server to migrate data: # doveadm -o mail_fsync=never backup -R -u (myuser) imapc: # My config on the new server: # doveadm -n # 2.2.33.2 (d6601f4ec): /etc/dovecot/dovecot.conf # Pigeonhole version 0.4.21 (92477967) # OS: Linux 4.15.0-46-generic x86_64 Ubuntu 18.04.2 LTS auth_default_realm = example.com doveadm_password = # hidden, use -P to show it doveadm_port = 53683 first_valid_uid = 200 imapc_features = rfc822.size fetch-headers imapc_host = oldmail.example.com imapc_master_user = (removed) imapc_password = # hidden, use -P to show it imapc_user = %n last_valid_uid = 200 mail_location = mbox:~/mail:INBOX=/var/mail/%u mail_plugins = " notify replication zlib quota" mail_prefetch_count = 20 mail_privileged_group = mail managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext mdbox_rotate_size = 10 M namespace inbox { inbox = yes location = mailbox "Éléments envoyés" { special_use = \Sent } mailbox "Éléments supprimés" { special_use = \Trash } mailbox Brouillon { special_use = \Drafts } mailbox "Courrier indésirable" { special_use = \Junk } mailbox Drafts { auto = subscribe special_use = \Drafts } mailbox Junk { auto = subscribe special_use = \Junk } mailbox Sent { auto = subscribe special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { auto = subscribe special_use = \Trash } prefix = INBOX/ separator = / } passdb { args = /etc/dovecot/dovecot-ldap.conf.ext driver = ldap } plugin { mail_replica = tcps:mail2.example.com:53683 quota = count:User quota quota_grace = 10%% quota_rule = *:storage=10G quota_rule2 = INBOX/Trash:storage=+100M quota_vsizes = yes quota_warning = storage=100%% quota-warning 100 %u quota_warning2 = storage=95%% quota-warning 95 %u quota_warning3 = storage=90%% quota-warning 90 %u quota_warning4 = storage=85%% quota-warning 85 %u quota_warning5 = storage=75%% quota-warning 75 %u quota_warning6 = -storage=80%% quota-warning '-80' %u quota_warning7 = -storage=100%% quota-warning '-100' %u sieve = /var/vmail/domains/%Ld/%Ln/.dovecot.sieve sieve_before = /var/vmail/sieve/before.sieve sieve_default = /var/vmail/sieve/default.sieve sieve_global = /var/vmail/sieve/global zlib_save = lz4 } protocols = " imap lmtp sieve" service aggregator { fifo_listener replication-notify-fifo { user = vmail } unix_listener replication-notify { user = vmail } } service auth { inet_listener { address = (removed) port = 55123 } unix_listener /var/spool/postfix/private/auth { mode = 0666 } } service doveadm { inet_listener { port = 53683 ssl = yes } } service imap-login { inet_listener imap { port = 0 } process_min_avail = 10 } service lmtp { unix_listener /var/spool/postfix/private/dovecot-lmtp { group = postfix mode = 0660 user = postfix } } service quota-warning { executable = script /usr/local/bin/quota-warning.sh unix_listener quota-warning { user = vmail } } service replicator { process_min_avail = 1 unix_listener replicator-doveadm { mode = 0600 user = vmail } } ssl = required ssl_cert = </etc/ssl/example/example.com.crtbundle ssl_client_ca_dir = /etc/ssl/certs ssl_key = # hidden, use -P to show it userdb { args = /etc/dovecot/dovecot-ldap.conf.ext driver = ldap } verbose_proctitle = yes protocol lmtp { mail_plugins = " notify replication zlib quota sieve" postmaster_address = postmaster(a)example.com } protocol imap { mail_plugins = " notify replication zlib quota imap_zlib imap_quota" } # cat /etc/dovecot/dovecot-ldap.conf.ext | grep -v "^#" | grep -v "^$" uris = ldaps://dc1.ad.example.com ldaps://dc2.ad.example.com dn = (removed) dnpass = (removed) auth_bind = yes base = (removed) scope = subtree deref = never user_filter = (&(mail=%u)(memberOf:1.2.840.113556.1.4.1941:=CN=acces_courriels,(removed))(&(|(objectclass=person))(!(UserAccountControl:1.2.840.113556.1.4.803:=2)))) pass_filter = (&(mail=%u)(memberOf:1.2.840.113556.1.4.1941:=CN=acces_courriels,(removed))(&(|(objectclass=person))(!(UserAccountControl:1.2.840.113556.1.4.803:=2)))) iterate_filter = (&(mail=*)(memberOf:1.2.840.113556.1.4.1941:=CN=acces_courriels,(removed))(&(|(objectclass=person))(!(UserAccountControl:1.2.840.113556.1.4.803:=2)))) iterate_attrs = mail=user user_attrs = \ =quota_rule=*:storage=%{ldap:division:10G}, \ =home=/var/vmail/domains/%Ld/%Ln, \ =mail=mdbox:/var/vmail/domains/%Ld/%Ln/mdbox, \ =uid=200, \ =gid=200

1 0

index problems after update
by Hajo Locke 27 Mar '19

27 Mar '19

Hello List, i have a problem with index-files which is separated in 2 subproblems. May be these problems are connected. Currently we use Ubuntu 18.04 LTS which is bundled with dovecot 2.2.33.2 These servers are fresh installed machines and users are added to the system after, there was no upgrade. Sometimes it happens, that dovecot stops showing new mail. There is no error in log, dovecot just seems to do his normal operations but is not delivering new emails from /var/mail/myuser emails are delivered again if i delete index-files from .imap folder. So index is recreated and everything works again. I cant reproduce this problem, but every 2 days i have one user who is reporting this problem. Second problem is similiar. I Upgraded a server from Ubuntu 16.04 to Ubuntu 18.04. This includes an upgrade from dovecot 2.2.22 to 2.2.33.2. After that i installed an self packaged dovecot 2.2.36.1 Now here is same problem, dovecot is not showing new mails, but the difference is we have a Raw backtrace in Log just as expected: Feb 8 08:45:37 hostname dovecot[14882]: imap(myuser): Error: Raw backtrace: /usr/lib/dovecot/libdovecot.so.0(+0xa1ee2) [0x7f78b3b2cee2] -> /usr/lib/dovecot/libdovecot.so.0(+0xa1fda) [0x7f78b3b2cfda] -> /usr/lib/dovecot/libdovecot.so.0(i_fatal+0) [0x7f78b3abb8a8] -> /usr/lib/dovecot/libdovecot-storage.so.0(index_mail_parse_header+0x78a) [0x7f78b3e7940a] -> /usr/lib/dovecot/libdovecot.so.0(+0x83592) [0x7f78b3b0e592] -> /usr/lib/dovecot/libdovecot.so.0(i_stream_read+0x74) [0x7f78b3b38814] -> /usr/lib/dovecot/libdovecot.so.0(i_stream_read_data+0x3d) [0x7f78b3b392fd] -> /usr/lib/dovecot/libdovecot-storage.so.0(index_mail_get_header_stream+0x4a) [0x7f78b3e7a2ea] -> /usr/lib/dovecot/libdovecot-storage.so.0(mail_get_header_stream+0x4a) [0x7f78b3dfd8da] -> /usr/lib/dovecot/libdovecot-storage.so.0(imap_msgpart_open+0x24a) [0x7f78b3ebb57a] -> dovecot/imap [myuser ip.ip.ip.ip FETCH](+0x2081c) [0x5581ac76d81c] -> dovecot/imap [m038422 ip.ip.ip.ip FETCH](+0x1ea54) [0x5581ac76ba54] -> dovecot/imap [myuser ip.ip.ip.ip FETCH](imap_fetch_more+0x39) [0x5581ac76cd69] -> dovecot/imap [myuser ip.ip.ip.ip FETCH](cmd_fetch+0x31b) [0x5581ac75e1bb] -> dovecot/imap [myuser ip.ip.ip.ip FETCH](command_exec+0x5c) [0x5581ac76a09c] -> dovecot/imap [myuser ip.ip.ip.ip FETCH](+0x1b612) [0x5581ac768612] -> dovecot/imap [myuser ip.ip.ip.ip FETCH](+0x1b6ac) [0x5581ac7686ac] -> dovecot/imap [myuser ip.ip.ip.ip FETCH](client_handle_input+0x18d) [0x5581ac768a6d] -> dovecot/imap [myuser ip.ip.ip.ip FETCH](client_input+0xac) [0x5581ac768fbc] -> /usr/lib/dovecot/libdovecot.so.0(io_loop_call_io+0x52) [0x7f78b3b43482] -> /usr/lib/dovecot/libdovecot.so.0(io_loop_handler_run_internal+0x12e) [0x7f78b3b44b9e] -> /usr/lib/dovecot/libdovecot.so.0(io_loop_handler_run+0x36) [0x7f78b3b43516] -> /usr/lib/dovecot/libdovecot.so.0(io_loop_run+0x38) [0x7f78b3b436c8] -> /usr/lib/dovecot/libdovecot.so.0(master_service_run+0x13) [0x7f78b3ac6aa3] -> dovecot/imap [myuser ip.ip.ip.ip FETCH](main+0x329) [0x5581ac75b159] -> /lib/x86_64-linux-gnu/libc.so.6(__libc_start_main+0xe7) [0x7f78b36bbb97] -> dovecot/imap [myuser ip.ip.ip.ip FETCH](_start+0x2a) [0x5581ac75b2fa] Feb 8 08:45:37 hostname dovecot[14882]: imap(myuser): Fatal: master: service(imap): child 14135 killed with signal 6 (core dumped) Over all dovecot and OS versions we use same old-fashioned setup. Mails are delivered by procmail to classic mbox file. This is output of doveconf -n # 2.2.36.1 (5d621cf65): /etc/dovecot/dovecot.conf # Pigeonhole version 0.4.21 (92477967) # OS: Linux 4.18.0-14-generic x86_64 Ubuntu 18.04.1 LTS # Hostname: myhostname auth_mechanisms = plain login auth_username_chars = abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ01234567890.-_@üÜöÖäÄ auth_worker_max_count = 60 disable_plaintext_auth = no imap_capability = +XLIST lock_method = flock login_greeting = mailserver ready. login_log_format_elements = user=<%u> method=%m rip=%r lip=%l %c mail_cache_min_mail_count = 30 mail_location = mbox:~/mail:INBOX=/var/mail/%u mail_max_userip_connections = 30 mbox_read_locks = dotlock mbox_very_dirty_syncs = yes namespace inbox { inbox = yes location = mailbox Archiv { auto = no special_use = } mailbox Drafts { auto = no special_use = } mailbox Junk { auto = no special_use = } mailbox Sent { auto = no special_use = } mailbox Trash { auto = no special_use = } prefix = } passdb { args = /etc/dovecot/dovecot-sql.conf driver = sql } protocols = imap pop3 service auth-worker { idle_kill = 1 mins } service auth { idle_kill = 1 mins unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0660 user = postfix } user = root } service imap-login { executable = /usr/lib/dovecot/imap-login process_min_avail = 4 service_count = 0 user = dovecot } service imap { process_limit = 1024 } service pop3-login { executable = /usr/lib/dovecot/pop3-login process_min_avail = 4 service_count = 0 user = dovecot } service pop3 { executable = /usr/lib/dovecot/pop3 process_limit = 1024 } shutdown_clients = no ssl_ca = </path/cert.pem ssl_cert = </path/cert.pem ssl_cipher_list = ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:CAMELLIA:!DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA ssl_dh_parameters_length = 2048 ssl_key = # hidden, use -P to show it ssl_prefer_server_ciphers = yes userdb { args = /etc/dovecot/dovecot-sql.conf driver = sql } verbose_proctitle = yes protocol imap { imap_client_workarounds = delay-newmail mail_plugins = mail_log notify ssl = yes } protocol pop3 { pop3_client_workarounds = oe-ns-eoh outlook-no-nuls pop3_no_flag_updates = no pop3_uidl_format = %08Xu%08Xv ssl = yes } Whats going wrong here? Main problem is first one. dovecot stops showing new mail during service without telling a reason. reason looks like a broken index file. What to do here? Please tell me your opinion. Thanks, Hajo

7 17

Test SASL authentication via telnet (or similar)
by Alessio Cecchi 26 Mar '19

26 Mar '19

Hi, I'm looking for a way to autenticate my email users via Dovecot SASL TCP connections from an external nodejs or python script. Dovecot configuration is fine, if I set in postfix smtpd_sasl_path = inet:127.0.0.1:12345 works fine. But if a try via "telnet 127.0.0.1 12345" to chat with SASL in dovecot log found: dovecot: auth: Error: Authentication client not compatible with this server (mixed old and new binaries?) What is the right way to chat with SASL via TCP port? Thanks -- Alessio Cecchi Postmaster @ http://www.qboxmail.it https://www.linkedin.com/in/alessice

1 0

IMAP coredumps for one user
by Odhiambo Washington 26 Mar '19

26 Mar '19

FreeBSD-12 Dovecot-2.3.5 I am having problems with one use Mar 25 21:30:12 imap(gau.mon(a)crownkenya.com)<91364><U7qCZO+ECfCaRh6E>: Fatal: master: service(imap): child 91364 killed with signal 6 (core dumped) Mar 25 21:30:14 imap(gau.mon(a)crownkenya.com)<2381><moHYZO+EDvCaRh6E>: Fatal: master: service(imap): child 2381 killed with signal 6 (core dumped) Mar 26 06:29:26 imap(gau.mon(a)crownkenya.com)<7644><0aVP7faEI/GaTGQE>: Panic: file mempool-system.c: line 137 (pool_system_realloc): assertion failed: (old_size == (size_t)-1 || mem == NULL || old_size <= malloc_usable_size(mem)) Mar 26 06:29:26 imap(gau.mon(a)crownkenya.com)<8806><valP7faEJPGaTGQE>: Panic: file mempool-system.c: line 137 (pool_system_realloc): assertion failed: (old_size == (size_t)-1 || mem == NULL || old_size <= malloc_usable_size(mem)) Mar 26 06:29:26 imap(gau.mon(a)crownkenya.com)<8493><zKhP7faEIvGaTGQE>: Panic: file mempool-system.c: line 137 (pool_system_realloc): assertion failed: (old_size == (size_t)-1 || mem == NULL || old_size <= malloc_usable_size(mem)) Mar 26 06:29:26 imap(gau.mon(a)crownkenya.com)<9412><2qtP7faEIfGaTGQE>: Panic: file mempool-system.c: line 137 (pool_system_realloc): assertion failed: (old_size == (size_t)-1 || mem == NULL || old_size <= malloc_usable_size(mem)) Mar 26 06:29:28 imap(gau.mon(a)crownkenya.com)<7644><0aVP7faEI/GaTGQE>: Fatal: master: service(imap): child 7644 killed with signal 6 (core dumped) Mar 26 06:29:29 imap(gau.mon(a)crownkenya.com)<10764><7sW+7faEJvGaTGQE>: Panic: file mempool-system.c: line 137 (pool_system_realloc): assertion failed: (old_size == (size_t)-1 || mem == NULL || old_size <= malloc_usable_size(mem)) Mar 26 06:29:31 imap(gau.mon(a)crownkenya.com)<8806><valP7faEJPGaTGQE>: Fatal: master: service(imap): child 8806 killed with signal 6 (core dumped) Mar 26 06:29:33 imap(gau.mon(a)crownkenya.com)<8493><zKhP7faEIvGaTGQE>: Fatal: master: service(imap): child 8493 killed with signal 6 (core dumped) Mar 26 06:29:36 imap(gau.mon(a)crownkenya.com)<9412><2qtP7faEIfGaTGQE>: Fatal: master: service(imap): child 9412 killed with signal 6 (core dumped) Mar 26 06:29:38 imap(gau.mon(a)crownkenya.com)<10764><7sW+7faEJvGaTGQE>: Fatal: master: service(imap): child 10764 killed with signal 6 (core dumped) Mar 26 06:29:57 imap(gau.mon(a)crownkenya.com)<13285><JhMO7vaEKfGaTGQE>: Panic: file mempool-system.c: line 137 (pool_system_realloc): assertion failed: (old_size == (size_t)-1 || mem == NULL || old_size <= malloc_usable_size(mem)) Mar 26 06:29:57 imap(gau.mon(a)crownkenya.com)<19736><UQMD7/aELfGaTGQE>: Panic: file mempool-system.c: line 137 (pool_system_realloc): assertion failed: (old_size == (size_t)-1 || mem == NULL || old_size <= malloc_usable_size(mem)) Mar 26 06:29:57 imap(gau.mon(a)crownkenya.com)<22060><athw7/aEL/GaTGQE>: Panic: file mempool-system.c: line 137 (pool_system_realloc): assertion failed: (old_size == (size_t)-1 || mem == NULL || old_size <= malloc_usable_size(mem)) Mar 26 06:29:57 imap(gau.mon(a)crownkenya.com)<21367><Prhw7/aELvGaTGQE>: Panic: file mempool-system.c: line 137 (pool_system_realloc): assertion failed: (old_size == (size_t)-1 || mem == NULL || old_size <= malloc_usable_size(mem)) Mar 26 06:30:00 imap(gau.mon(a)crownkenya.com)<13285><JhMO7vaEKfGaTGQE>: Fatal: master: service(imap): child 13285 killed with signal 6 (core dumped) Mar 26 06:30:00 imap(gau.mon(a)crownkenya.com)<49026><FCSb7/aEMPGaTGQE>: Panic: file mempool-system.c: line 137 (pool_system_realloc): assertion failed: (old_size == (size_t)-1 || mem == NULL || old_size <= malloc_usable_size(mem)) Mar 26 06:30:02 imap(gau.mon(a)crownkenya.com)<19736><UQMD7/aELfGaTGQE>: Fatal: master: service(imap): child 19736 killed with signal 6 (core dumped) Mar 26 06:30:05 imap(gau.mon(a)crownkenya.com)<22060><athw7/aEL/GaTGQE>: Fatal: master: service(imap): child 22060 killed with signal 6 (core dumped) Mar 26 06:30:07 imap(gau.mon(a)crownkenya.com)<21367><Prhw7/aELvGaTGQE>: Fatal: master: service(imap): child 21367 killed with signal 6 (core dumped) Mar 26 06:30:10 imap(gau.mon(a)crownkenya.com)<49026><FCSb7/aEMPGaTGQE>: Fatal: master: service(imap): child 49026 killed with signal 6 (core dumped) Mar 26 07:59:40 imap(gau.mon(a)crownkenya.com)<27221><06UEMPiESPKaRh6E>: Panic: file mempool-system.c: line 137 (pool_system_realloc): assertion failed: (old_size == (size_t)-1 || mem == NULL || old_size <= malloc_usable_size(mem)) Mar 26 07:59:40 imap(gau.mon(a)crownkenya.com)<28883><fssEMPiESvKaRh6E>: Panic: file mempool-system.c: line 137 (pool_system_realloc): assertion failed: (old_size == (size_t)-1 || mem == NULL || old_size <= malloc_usable_size(mem)) Mar 26 07:59:40 imap(gau.mon(a)crownkenya.com)<29823><28oEMPiESfKaRh6E>: Panic: file mempool-system.c: line 137 (pool_system_realloc): assertion failed: (old_size == (size_t)-1 || mem == NULL || old_size <= malloc_usable_size(mem)) Mar 26 07:59:40 imap(gau.mon(a)crownkenya.com)<27530><04UEMPiER/KaRh6E>: Panic: file mempool-system.c: line 137 (pool_system_realloc): assertion failed: (old_size == (size_t)-1 || mem == NULL || old_size <= malloc_usable_size(mem)) Mar 26 07:59:42 imap(gau.mon(a)crownkenya.com)<27221><06UEMPiESPKaRh6E>: Fatal: master: service(imap): child 27221 killed with signal 6 (core dumped) Mar 26 07:59:42 imap(gau.mon(a)crownkenya.com)<30775><w9tqMPiETPKaRh6E>: Panic: file mempool-system.c: line 137 (pool_system_realloc): assertion failed: (old_size == (size_t)-1 || mem == NULL || old_size <= malloc_usable_size(mem)) Mar 26 07:59:45 imap(gau.mon(a)crownkenya.com)<28883><fssEMPiESvKaRh6E>: Fatal: master: service(imap): child 28883 killed with signal 6 (core dumped) Mar 26 07:59:47 imap(gau.mon(a)crownkenya.com)<29823><28oEMPiESfKaRh6E>: Fatal: master: service(imap): child 29823 killed with signal 6 (core dumped) Mar 26 07:59:50 imap(gau.mon(a)crownkenya.com)<27530><04UEMPiER/KaRh6E>: Fatal: master: service(imap): child 27530 killed with signal 6 (core dumped) Mar 26 07:59:52 imap(gau.mon(a)crownkenya.com)<30775><w9tqMPiETPKaRh6E>: Fatal: master: service(imap): child 30775 killed with signal 6 (core dumped) Mar 26 08:45:40 imap(gau.mon(a)crownkenya.com)<83330><VtGH1PiEr/KaTGQE>: Panic: file mempool-system.c: line 137 (pool_system_realloc): assertion failed: (old_size == (size_t)-1 || mem == NULL || old_size <= malloc_usable_size(mem)) Mar 26 08:45:40 imap(gau.mon(a)crownkenya.com)<84059><lhKI1PiEsPKaTGQE>: Panic: file mempool-system.c: line 137 (pool_system_realloc): assertion failed: (old_size == (size_t)-1 || mem == NULL || old_size <= malloc_usable_size(mem)) Mar 26 08:45:40 imap(gau.mon(a)crownkenya.com)<84406><kRaI1PiEsfKaTGQE>: Panic: file mempool-system.c: line 137 (pool_system_realloc): assertion failed: (old_size == (size_t)-1 || mem == NULL || old_size <= malloc_usable_size(mem)) Mar 26 08:45:40 imap(gau.mon(a)crownkenya.com)<84458><CzKI1PiErvKaTGQE>: Panic: file mempool-system.c: line 137 (pool_system_realloc): assertion failed: (old_size == (size_t)-1 || mem == NULL || old_size <= malloc_usable_size(mem)) Mar 26 08:45:42 imap(gau.mon(a)crownkenya.com)<83330><VtGH1PiEr/KaTGQE>: Fatal: master: service(imap): child 83330 killed with signal 6 (core dumped) Mar 26 08:45:45 imap(gau.mon(a)crownkenya.com)<84059><lhKI1PiEsPKaTGQE>: Fatal: master: service(imap): child 84059 killed with signal 6 (core dumped) Mar 26 08:45:47 imap(gau.mon(a)crownkenya.com)<84406><kRaI1PiEsfKaTGQE>: Fatal: master: service(imap): child 84406 killed with signal 6 (core dumped) Mar 26 08:45:50 imap(gau.mon(a)crownkenya.com)<84458><CzKI1PiErvKaTGQE>: Fatal: master: service(imap): child 84458 killed with signal 6 (core dumped) Mar 26 08:54:55 imap(gau.mon(a)crownkenya.com)<88519><2qiO9fiE0fKaTGQE>: Panic: file mempool-system.c: line 137 (pool_system_realloc): assertion failed: (old_size == (size_t)-1 || mem == NULL || old_size <= malloc_usable_size(mem)) Mar 26 08:54:56 imap(gau.mon(a)crownkenya.com)<90725><ZhDq9fiE0vKaTGQE>: Panic: file mempool-system.c: line 137 (pool_system_realloc): assertion failed: (old_size == (size_t)-1 || mem == NULL || old_size <= malloc_usable_size(mem)) Mar 26 08:54:56 imap(gau.mon(a)crownkenya.com)<91408><oA/q9fiE0/KaTGQE>: Panic: file mempool-system.c: line 137 (pool_system_realloc): assertion failed: (old_size == (size_t)-1 || mem == NULL || old_size <= malloc_usable_size(mem)) Mar 26 08:54:56 imap(gau.mon(a)crownkenya.com)<90661><kc3p9fiE1PKaTGQE>: Panic: file mempool-system.c: line 137 (pool_system_realloc): assertion failed: (old_size == (size_t)-1 || mem == NULL || old_size <= malloc_usable_size(mem)) Mar 26 08:54:58 imap(gau.mon(a)crownkenya.com)<88519><2qiO9fiE0fKaTGQE>: Fatal: master: service(imap): child 88519 killed with signal 6 (core dumped) Mar 26 08:55:01 imap(gau.mon(a)crownkenya.com)<90725><ZhDq9fiE0vKaTGQE>: Fatal: master: service(imap): child 90725 killed with signal 6 (core dumped) Mar 26 08:55:03 imap(gau.mon(a)crownkenya.com)<91408><oA/q9fiE0/KaTGQE>: Fatal: master: service(imap): child 91408 killed with signal 6 (core dumped) Mar 26 08:55:06 imap(gau.mon(a)crownkenya.com)<90661><kc3p9fiE1PKaTGQE>: Fatal: master: service(imap): child 90661 killed with signal 6 (core dumped) Mar 26 09:26:06 imap(gau.mon(a)crownkenya.com)<45868><K+R8ZPmEJfMpOWd5>: Panic: file mempool-system.c: line 137 (pool_system_realloc): assertion failed: (old_size == (size_t)-1 || mem == NULL || old_size <= malloc_usable_size(mem)) Mar 26 09:26:06 imap(gau.mon(a)crownkenya.com)<46114><WfR8ZPmEJPMpOWd5>: Panic: file mempool-system.c: line 137 (pool_system_realloc): assertion failed: (old_size == (size_t)-1 || mem == NULL || old_size <= malloc_usable_size(mem)) Mar 26 09:26:06 imap(gau.mon(a)crownkenya.com)<47667><lCR9ZPmEJ/MpOWd5>: Panic: file mempool-system.c: line 137 (pool_system_realloc): assertion failed: (old_size == (size_t)-1 || mem == NULL || old_size <= malloc_usable_size(mem)) Mar 26 09:26:06 imap(gau.mon(a)crownkenya.com)<46900><fAx9ZPmEJvMpOWd5>: Panic: file mempool-system.c: line 137 (pool_system_realloc): assertion failed: (old_size == (size_t)-1 || mem == NULL || old_size <= malloc_usable_size(mem)) Mar 26 09:26:08 imap(gau.mon(a)crownkenya.com)<45868><K+R8ZPmEJfMpOWd5>: Fatal: master: service(imap): child 45868 killed with signal 6 (core dumped) Mar 26 09:26:08 imap(gau.mon(a)crownkenya.com)<50503><zz+LZfmEKPMpOWd5>: Panic: file mempool-system.c: line 137 (pool_system_realloc): assertion failed: (old_size == (size_t)-1 || mem == NULL || old_size <= malloc_usable_size(mem)) Mar 26 09:26:11 imap(gau.mon(a)crownkenya.com)<46114><WfR8ZPmEJPMpOWd5>: Fatal: master: service(imap): child 46114 killed with signal 6 (core dumped) Mar 26 09:26:15 imap(gau.mon(a)crownkenya.com)<47667><lCR9ZPmEJ/MpOWd5>: Fatal: master: service(imap): child 47667 killed with signal 6 (core dumped) Mar 26 09:26:17 imap(gau.mon(a)crownkenya.com)<46900><fAx9ZPmEJvMpOWd5>: Fatal: master: service(imap): child 46900 killed with signal 6 (core dumped) Mar 26 09:26:20 imap(gau.mon(a)crownkenya.com)<50503><zz+LZfmEKPMpOWd5>: Fatal: master: service(imap): child 50503 killed with signal 6 (core dumped) Mar 26 09:42:18 imap(andrew.oyugi(a)crownkenya.com)<52237><7dJjnfmEJtPFt2RO>: Error: Mailbox Sent: Saving mail: read(<imap client>) failed: read(size=7224) failed: Connection reset by peer (read reason=) Mar 26 10:13:18 imap(gau.mon(a)crownkenya.com)<81127><JxMuDvqEd/MpOWd5>: Panic: file mempool-system.c: line 137 (pool_system_realloc): assertion failed: (old_size == (size_t)-1 || mem == NULL || old_size <= malloc_usable_size(mem)) Mar 26 10:13:18 imap(gau.mon(a)crownkenya.com)<81432><QRMuDvqEePMpOWd5>: Panic: file mempool-system.c: line 137 (pool_system_realloc): assertion failed: (old_size == (size_t)-1 || mem == NULL || old_size <= malloc_usable_size(mem)) Mar 26 10:13:18 imap(gau.mon(a)crownkenya.com)<79708><LBMuDvqEdvMpOWd5>: Panic: file mempool-system.c: line 137 (pool_system_realloc): assertion failed: (old_size == (size_t)-1 || mem == NULL || old_size <= malloc_usable_size(mem)) Mar 26 10:13:18 imap(gau.mon(a)crownkenya.com)<78811><IxMuDvqEefMpOWd5>: Panic: file mempool-system.c: line 137 (pool_system_realloc): assertion failed: (old_size == (size_t)-1 || mem == NULL || old_size <= malloc_usable_size(mem)) Mar 26 10:13:20 imap(gau.mon(a)crownkenya.com)<81127><JxMuDvqEd/MpOWd5>: Fatal: master: service(imap): child 81127 killed with signal 6 (core dumped) Mar 26 10:13:21 imap(gau.mon(a)crownkenya.com)<84406><wIVfDvqEevMpOWd5>: Panic: file mempool-system.c: line 137 (pool_system_realloc): assertion failed: (old_size == (size_t)-1 || mem == NULL || old_size <= malloc_usable_size(mem)) Mar 26 10:13:23 imap(gau.mon(a)crownkenya.com)<81432><QRMuDvqEePMpOWd5>: Fatal: master: service(imap): child 81432 killed with signal 6 (core dumped) Mar 26 10:13:25 imap(gau.mon(a)crownkenya.com)<79708><LBMuDvqEdvMpOWd5>: Fatal: master: service(imap): child 79708 killed with signal 6 (core dumped) Mar 26 10:13:28 imap(gau.mon(a)crownkenya.com)<78811><IxMuDvqEefMpOWd5>: Fatal: master: service(imap): child 78811 killed with signal 6 (core dumped) Mar 26 10:13:30 imap(gau.mon(a)crownkenya.com)<84406><wIVfDvqEevMpOWd5>: Fatal: master: service(imap): child 84406 killed with signal 6 (core dumped) I have a coredump, but I don't see any relation so far: root@gw:/tmp/corefiles # gdb /usr/local/libexec/dovecot/imap imap.core GNU gdb (GDB) 8.2.1 [GDB v8.2.1 for FreeBSD] Copyright (C) 2018 Free Software Foundation, Inc. License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html > This is free software: you are free to change and redistribute it. There is NO WARRANTY, to the extent permitted by law. Type "show copying" and "show warranty" for details. This GDB was configured as "x86_64-portbld-freebsd12.0". Type "show configuration" for configuration details. For bug reporting instructions, please see: <http://www.gnu.org/software/gdb/bugs/>. Find the GDB manual and other documentation resources online at: <http://www.gnu.org/software/gdb/documentation/>. For help, type "help". Type "apropos word" to search for commands related to "word"... Reading symbols from /usr/local/libexec/dovecot/imap...(no debugging symbols found)...done. [New LWP 101447] Core was generated by `dovecot/imap'. Program terminated with signal SIGABRT, Aborted. #0 0x000000008153145a in thr_kill () from /lib/libc.so.7 (gdb) bt full #0 0x000000008153145a in thr_kill () from /lib/libc.so.7 No symbol table info available. #1 0x000000008152f844 in raise () from /lib/libc.so.7 No symbol table info available. #2 0x00000000814a2079 in abort () from /lib/libc.so.7 No symbol table info available. #3 0x00000000813257f7 in ?? () from /usr/local/lib/dovecot/libdovecot.so.0 No symbol table info available. #4 0x0000000081324000 in ?? () from /usr/local/lib/dovecot/libdovecot.so.0 No symbol table info available. #5 0x0000000081324d81 in ?? () from /usr/local/lib/dovecot/libdovecot.so.0 No symbol table info available. #6 0x0000000081324200 in i_panic () from /usr/local/lib/dovecot/libdovecot.so.0 No symbol table info available. #7 0x0000000081349fcf in ?? () from /usr/local/lib/dovecot/libdovecot.so.0 No symbol table info available. #8 0x0000000081ec2fc2 in XQuerySet::add_term (this=0x7fffffffe3e0, s=0x817892e0 "maureen.xxxxx(a)xxxx.co.ke") at ./fts-backend-xapian-functions.cpp:151 l = <optimized out> i = <optimized out> pos = <optimized out> #9 0x0000000081ec2c22 in XQuerySet::add (this=0x7fffffffe3e0, t=<optimized out>, s=<optimized out>) at ./fts-backend-xapian-functions.cpp:254 tmp1 = "body" tmp2 = "maureen.xxxx(a)xxxx.co.ke" t2 = <optimized out> s2 = 0x817892e0 "maureen.xxxx(a)xxxx.co.ke" i = <optimized out> #10 0x0000000081ec24fb in XQuerySet::add (this=0x7fffffffe3e0, type=<optimized out>, s=<optimized out>) at ./fts-backend-xapian-functions.cpp:182 sp = {<icu::UMemory> = {<No data fields>}, ptr_ = 0x81eb8591 "body", length_ = 4, static npos = 2147483647} t = {<icu::Replaceable> = {<icu::UObject> = {<icu::UMemory> = {<No data fields>}, _vptr$UObject = 0x822c3bc0 <vtable for icu::UnicodeString+16>}, <No data fields>}, fUnion = {fStackFields = {fLengthAndFlags = 130, fBuffer = u<error reading variable>}, fFields = {fLengthAndFlags = 130, fLength = 6553711, fCapacity = 121, fArray = 0x7fffffffe270 u<error reading variable>}}} s2 = <optimized out> sp2 = <optimized out> #11 0x0000000081ec0667 in fts_backend_xapian_lookup (_backend=<optimized out>, box=<optimized out>, args=0x81e35110, flags=<optimized out>, result=0x7fffffffe550) at fts-backend-xapian.cpp:470 a = <optimized out> backend = <optimized out> tp = {tv_sec = 1553584401, tv_usec = 717885} is_and = <error reading variable is_and (Cannot access memory at address 0x1)> hdr = <optimized out> i = <optimized out> r = <optimized out> n = <optimized out> uid = <optimized out> dt = <optimized out> qs = <optimized out> #12 0x0000000081ea5bf4 in fts_backend_lookup () from /usr/local/lib/dovecot/lib20_fts_plugin.so No symbol table info available. #13 0x0000000081eaa782 in ?? () from /usr/local/lib/dovecot/lib20_fts_plugin.so No symbol table info available. #14 0x0000000081eaa5d0 in fts_search_lookup () from /usr/local/lib/dovecot/lib20_fts_plugin.so No symbol table info available. #15 0x0000000081eace94 in ?? () from /usr/local/lib/dovecot/lib20_fts_plugin.so No symbol table info available. #16 0x000000000104fa47 in imap_search_start () No symbol table info available. #17 0x0000000001040441 in cmd_search () No symbol table info available. #18 0x00000000010486bd in command_exec () No symbol table info available. #19 0x000000000104730a in ?? () No symbol table info available. #20 0x0000000001045ed7 in client_handle_input () No symbol table info available. #21 0x00000000010446c8 in client_input () No symbol table info available. #22 0x000000008133ebbf in io_loop_call_io () from /usr/local/lib/dovecot/libdovecot.so.0 No symbol table info available. #23 0x00000000813411ed in io_loop_handler_run_internal () from /usr/local/lib/dovecot/libdovecot.so.0 No symbol table info available. #24 0x000000008133f22e in io_loop_handler_run () from /usr/local/lib/dovecot/libdovecot.so.0 No symbol table info available. --Type <RET> for more, q to quit, c to continue without paging-- #25 0x000000008133ef98 in io_loop_run () from /usr/local/lib/dovecot/libdovecot.so.0 No symbol table info available. #26 0x00000000812b2e08 in master_service_run () from /usr/local/lib/dovecot/libdovecot.so.0 No symbol table info available. #27 0x00000000010558a7 in main () No symbol table info available. (gdb) -- Best regards, Odhiambo WASHINGTON, Nairobi,KE +254 7 3200 0004/+254 7 2274 3223 "Oh, the cruft.", grep ^[^#] :-)

2 1

dovecot 2.3.5 - tests fail: http payload echo (ssl)
by Helmut K. C. Tessarek 26 Mar '19

26 Mar '19

Hi, I was womdering, if anyone has experienced the same issues. When I run the tests after compiling 2.3.5, the following 4 tests fail: http payload echo (ssl): sequential .................................. : ok http payload echo (ssl): pipeline .................................... : ok http payload echo (ssl): parallel .................................... : FAILED: Test is hanging http payload echo (ssl) .............................................. : FAILED http payload echo (ssl; unknown size): sequential .................... : ok http payload echo (ssl; unknown size): pipeline ...................... : ok http payload echo (ssl; unknown size): parallel ...................... : FAILED: Test is hanging http payload echo (ssl; unknown size) ................................ : FAILED 4 / 114 tests failed Failed to run: ./test-http-payload The tests ran fine for 2.3.4.1. Is there any way, to debug the issue any further? Do the tests write log files? It just doesn't make amy sense. Nothing has changed on the OS since I compiled and tested 2.3.4.1. Cheers, K. C. -- regards Helmut K. C. Tessarek KeyID 0x172380A011EF4944 Key fingerprint = 8A55 70C1 BD85 D34E ADBC 386C 1723 80A0 11EF 4944 /* Thou shalt not follow the NULL pointer for chaos and madness await thee at its end. */

4 11